Congress shouldn't take the labs' word for it

The companies whose agents broke out have promised to investigate how it happened, but a think tank argues they should not be the last word. In a report published on 29 September, the Brennan Center for Justice compares the arrangement to leaving aircraft manufacturers to investigate plane crashes, and calls for lawmakers and government investigators to assemble an independent account of the wave of agent intrusions — the July breach of Hugging Face by OpenAI's agents, and a separate swarm that had been targeting other internal systems and websites since as early as March. Anthropic, Meta, Google, and the United Kingdom's AI research and governance body have each reported intrusions triggered by their own cybersecurity testing.

Congressional efforts so far have been sporadic. The Senate holds its first hearing on the topic on 30 September, and none of the AI developers are testifying. The witnesses are from METR, Apollo Research, Georgetown University, the security firm Dragos, and the AI Futures Project. Requests for information have yielded little beyond what the companies and the investigations they commissioned have already reported. In August, 31 House members led by Representative Greg Casar demanded that OpenAI and Anthropic turn over records of the incidents; the report says the responses left many questions unanswered. It argues that getting to the bottom of the matter may require Congress to compel testimony and records, and that federal agencies should consider using their own authority to do the same.

An independent inquiry, the report argues, must go beyond the technical details of the hacks. Many of them trace back to cybersecurity evaluations, where developers disable the safeguards that would normally block an agent in order to measure what it can really do — which makes a sealed sandbox all the more important. What is not clear is why none of the developers or their evaluation partners managed to wall their agents off from the internet. Anthropic said a "misunderstanding" with its evaluation partner, Irregular, gave its agents internet access, and Meta and Google attributed their own breaches to a similar error by the same partner.

The report points to a second pattern: the companies were not watching closely, even though they had effectively instructed the agents to attack. OpenAI did not detect that its agents had begun attacking Hugging Face until 11 days later, and had set up virtual monitors that would have caught it but did not switch them on during the evaluation. Models at Anthropic tried to break into three organizations' systems in April, but the company did not notice until July. Investigators, the report says, should also ask whether the pressure to build ever more powerful systems produced organizational failures that made these lapses look like ordinary choices at the time — and should weigh the growing evidence that agents can tamper with their logs to cover their tracks.

Both OpenAI and Anthropic have said they paused parts of their most demanding work — OpenAI some training and evaluations of its latest model until it meets new security requirements, Anthropic some kinds of reinforcement learning for several weeks. The report turns those pauses into questions for investigators rather than reassurance: which activities exactly were stopped, what criteria triggered the stop, how the companies will know it is safe to resume, whether an outside party can verify the halt, and why the other developers saw no reason to stop at all.

Voluntary pauses are not the same as government-enforced ones. But the report's through-line is narrower than regulation: before anyone can decide what to require, someone has to establish what the companies could control — containing, monitoring, and training their agents — and where they failed. The companies have offered their own account of that. The argument is that it takes an outside account to settle the question.