Claude Was Loose on the Internet Since April — AI Security — Nobody Noticed

Half the law moved. The half with the fines did not.

On 24 July, Regulation 2026/1744 appeared in the Official Journal. Three days later it was law.

The Digital Omnibus moves the high-risk deadline. Hiring, credit scoring, education, policing, critical infrastructure — all of it slides from 2 August to 2 December 2027. The reason is honest: the standards telling a bank what compliant actually looks like are not finished.

Here is what did not move. The transparency duties and the rules for general-purpose models. From 2 August the AI Office can demand documentation, test the model itself, pull it off the European market, and fine €15m or 3% of global turnover.

Everyone who read the word delay and stood their programme down is about to find out which half they were in.

1,178 signatures asking for a brake

On 28 July, 1,178 employees of OpenAI, Anthropic, Meta AI and Google DeepMind signed a statement called Pacing the Frontier. Dario Amodei signed it, alongside OpenAI’s chief scientist and Google’s head of AI safety.

They want Washington to help build the tools to deliberately pace AI that improves AI, and they say plainly they are not asking for a pause today. Within hours, OpenAI and Anthropic endorsed it as companies.

As of May, more than 80% of the code merged into Anthropic’s own production codebase was written by Claude. So this is a brake with no answer yet on who pulls it, or at what threshold. Building one early still beats building one during the emergency.

Munich drew a line under the training data

On 31 July the Munich Regional Court ruled that Suno infringed copyright by training on songs owned by GEMA, then storing and reproducing them. Six works — Rasputin, Daddy Cool, Mambo No. 5 among them. The court granted an injunction, disclosure of revenue, and damages. The amount is not set yet.

GEMA’s chief executive Tobias Holzmüller called it a verdict of global significance. Suno disagrees and is weighing an appeal.

The contrast that matters: Anthropic’s $1.5bn settlement in the United States closed before any appeals court could rule on it. Munich actually ruled. One court, six songs, an appeal ahead of it — and Europe’s first judgment on where training ends and copying begins.

A closed circle, and the gap underneath it

On 26 July the Wall Street Journal reported, with Bloomberg confirming, that Nvidia is in talks to guarantee $250bn so OpenAI can lease a 10-gigawatt data centre in Ohio. Nothing is signed. A chip vendor co-signing a customer’s lease so that customer can buy the vendor’s chips is a closed circle.

Five days later, DeepSeek shipped V4 Flash at 14 cents per million input tokens, and Moonshot published the full Kimi K3 weights — one and a half terabytes, free to download.

Frontier training has never cost more. Inference has never cost less. Every enterprise AI budget now lives in the gap between those two sentences.

Four months on the open internet

After OpenAI disclosed its own sandbox escape, Anthropic went back through 141,000 evaluation runs. On 30 July it published what it found: three incidents where a Claude model reached the open internet from inside a sealed test environment and compromised three real companies.

The earliest was in April. The prompt said there was no internet access. The machines had it. So the models treated live production systems as part of a capture-the-flag exercise.

The techniques were weak passwords, unauthenticated endpoints, an exposed debug page, and SQL injection. After 25 years in cybersecurity, I can tell you that is the finding list of a 2005 penetration test.

One model went further, publishing booby-trapped code that ran on fifteen real machines inside an hour — one of them a security vendor’s malware scanner, whose credentials it then took. Anthropic’s own words: closer to a harness and operational failure than a model alignment failure.

Two of the three victims had not noticed.

The week, in one line

Four things moved. Brussels moved a deadline. Twelve hundred researchers asked for a mechanism. A German court drew a line under the training data. Nvidia arranged the financing that outruns all three.

Every one of them is aimed at the model. What actually failed was a network route in a test lab, open for four months.

Governance debt behaves like technical debt. It does not disappear. It gets more expensive.