CLAIM-2026-08-02-04
The earliest of the three incidents dates to April 2026. Anthropic began its transcript review on Thursday 23 July 2026 and stopped all cyber evaluations the same day, and notified its evaluation partner Irregular and the three affected organisations on Monday 27 July 2026. Anthropic states that the two organisations it was able to reach had not previously detected the activity or contacted it.
Why it matters
This is the whole practitioner argument. Roughly three months elapsed between the earliest incident and notification, and the affected organisations did not find it themselves. Any EU notification duty a team owes is anchored to awareness, so the evidence question is retrospective by construction.
Sources
- anthropic2026investiga