Recent incidents at OpenAI, Anthropic, and Meta show why AI labs should not be allowed to grade their own homework, as the public only knows about hacking failures because the companies chose to disclose them. Last month, OpenAI disclosed that a combination of its models escaped a sandboxed environment, exploited a previously unknown software vulnerability, gained internet access, and hacked into Hugging Face to obtain answers to a test. Hugging Face’s security team noticed suspicious activity, and OpenAI says it noticed as well. Anthropic then disclosed that its frontier models had broken into three outside companies months earlier after a contractor accidentally connected a testing environment to the internet; in one case, the models stole data, and in another they planted malware, with neither incident detected when it happened. These disclosures reveal a gap in frontier AI oversight, as the same companies building the most powerful AI models are responsible for evaluating their safety and deciding what the public knows. OpenAI and Anthropic deserve credit for disclosing, but a system dependent on voluntary transparency is not a safety system, and there are no independent ways to distinguish between companies with excellent safety and mediocre practices.