Defense Department officials admitted on Tuesday that they do not know how many states or countries around the world may have received dangerous samples of live anthrax mistakenly sent from an Army lab in Utah.

But they are admitting that anthrax has been discovered at the Pentagon itself.

The Pentagon Force Protection Agency, which serves as the security force for the building, received the anthrax. PFPA uses such spores to test its biosecurity measures, a defense official said. But the spores are supposed to be dead. This sample came from a sample that was live.

Officials have yet to confirm whether the actual shipment sent to the Pentagon contained live spores or not, a senior defense official told The Daily Beast. This official could not say when the anthrax arrived, or how much had entered the building.

It’s the kind of confusion that’s become commonplace as word of this anthrax distribution continues to spread. Department spokesman Army Colonel Steven Warren acknowledged in a briefing with reporters Tuesday that an ongoing investigation found some live anthrax went to two laboratories in Canada and one in Washington state, marking the third country and 12th U.S. state to receive the potentially deadly bacteria. Warren would not say where the shipments went to in Canada, even as he said Canadian officials had been notified a day earlier. And Pentagon officials anticipate more states and countries could emerge as anthrax recipients.

“The department is in the process of determining the scale and scope of this,” said Warren, who noted that among the things the military is investigating is whether there was some sort of malicious wrongdoing at Dugway, the Army lab from which the anthrax came.

It wouldn’t be the first time. In 2001, a series of anthrax-laden letters were mailed to key senators and media personalities, killing five people and exposing nearly 30,000 to the lethal spores. The FBI’s main culprit: Bruce Ivins, an Army biodefense researcher.

Tuesday’s announcement was the latest in series of trickled revelations about the mistaken shipments. Last week, the Pentagon acknowledged sending anthrax to at least 24 laboratories in 11 states, a U.S. military base in South Korea, and commercial lab in Australia and that at least 20 military personnel were being monitored.

Dugway Proving Ground, about 86 miles southwest of Salt Lake City, first learned it had shipped activated anthrax spores when a lab in Maryland first notified the base on May 22 that it had received a sample. The Maryland lab then informed the Centers for Diseases Control, which is leading the investigation, on May 23.

At the moment, the risk to both the public and lab workers appears to be minimal. Labs that work with anthrax for detection, decontamination, and training efforts often vaccinate their workers. They have protocols and facilities designed to receive and handle such material. Regardless, the repeated acknowledgements by the Department of Defense that it did not know how many live anthrax samples went out, the origins of the spores, and their ultimate destinations was an embarrassing for an organization tasked with protecting the nation against bioterrorism and bio warfare attacks.

For now, Warren said, “the department’s shipment and transport of anthrax spores has stopped.”

Privately, officials conceded that Warren’s claim that there was “no risk to the public at this point” could not have been definitively made without a full understanding of how much anthrax went where.

Such efforts for surety in tracking anthrax were supposed to be put in place around 2009 shortly after the FBI announced it planned to charge Ivins with the deadliest act of bioterrorism on American soil.

“Somebody got sloppy. They put too much faith in the protocol,” a senior defense official said in explaining how anthrax could be lost.

In reality, those 2009 protocols were an attempt to contain a secondary problem unleashed by the 2001 anthrax attacks: a huge increase in bioterror research funding and biodefense labs. That proliferation increased risk—without putting in place major safety upgrades, critics of the expansion say.

Even when the anthrax attacks turned out to be an internal threat—rather than an outside biological strike, as some initially feared—the policies and the increased funding for research did not change. Rather than reduce risks, the number of people with access to deadly pathogens increased as much 40-fold, said Richard Ebright, professor of chemistry and chemical biology at Rutgers University.

“Your typical Walmart has greater security than the average U.S. biological weapons lab,” Ebright said. “We are still operating with the same policies as on December of 2001—no revision, no reassessment.”

After last week’s announcements, Work, the Deputy Secretary of Defense, announced a comprehensive review of the Defense Department’s “laboratory procedures, processes, and protocols associated with inactivating spore-forming anthrax. There is no known risk to the general public and an extremely low risk to lab workers from the department’s inadvertent shipments of inactivated samples containing small numbers of live anthrax to several laboratories.”

At that time, Work said the review would take 30 days but defense officials suspect it will now likely take longer. Among the tasks involved is tracking master samples of anthrax that date back to at least 2008. Warren said the master samples that remain in Dugway are being tested now but could not say how many.

Warren said that defense experts would brief reporters Wednesday with more specifics about the latest shipment.

In 2014, a unit CDC producing anthrax spores accidentally gave it to another unit within the CDC, which proceeded to use, exposing it to approximately 80 people. A mid-level administrator in the first unit resigned. Ebright said the Pentagon repeated the same mistakes that led one CDC lab to send live anthrax to another.

“This is the exact same chain of errors,” Ebright added.

The last time the Pentagon suffered a similar embarrassment surrounding weapons of mass destruction was in 2007 when the U.S. Air Force accidentally flew six nuclear warheads for more than three hours across several states. The Pentagon also said then the public was not at risk. But the following year then-Secretary of Defense Robert Gates asked for the resignations of Michael Wynne, then Secretary of the Air Force, and General T. Michael Moseley, the Air Force Chief of Staff, is response to the mistake, which they tendered.