\n<\/p>\n
OpenAI CEO Sam Altman is about to testify before the Senate Commerce, Science, and Transportation Committee to examine winning the AI race during a hearing in Washington DC, USA, on May 8, 2025. <\/span>Lenin Nolly\/NurPhoto\/AP<\/span><\/p>\n<\/div>\n A Republican-led Senate<\/span> subcommittee on disaster management is now investigating the July incident where OpenAI\u2019s autonomous models hacked Hugging Face, another AI startup, during internal testing.\u00a0<\/p>\n Axios<\/a> first reported the Senate probe on Thursday, providing a letter<\/a> by Sen. Josh Hawley (R-Mo.), the chair of the Subcommittee on Disaster Management, to OpenAI CEO Sam Altman from a day before.\u00a0<\/p>\n Citing an August investigation<\/a> from Model Evaluation and Threat Research and Redwood Research, two nonprofit research organizations, Hawley wrote to Altman that OpenAI knew that its agents were \u201cexhibiting rogue behavior\u201d but continued its internal testing anyway\u2014an act he described as \u201creckless\u201d to the degree of necessitating a Senate investigation.<\/p>\n \u201cThe American people deserve to know the details of what went on in the Hugging Face incident and other incidents of AI models going rogue,\u201d Hawley wrote, also pointing to the growing number of experts<\/a> warning about the existential safety risks of AI technology.\u00a0\u00a0<\/p>\n The subcommittee asks OpenAI 16 questions on the Hugging Face incident, including the rationale behind OpenAI\u2019s decision to continue testing despite seeing evidence of \u201crogue AI activity,\u201d every incident since OpenAI\u2019s inception that its AI agents compromised internal testing environments, public servers, other other external systems like websites, and what the company has done to prevent its AI agents from hacking into personal information from both in-company and external systems. It requests OpenAI\u2019s answers and documentation by October 1.\u00a0<\/p>\n Will <\/strong>OpenAI comply? Based on its track record with other congressional requests, that seems unlikely. The company has delayed oversight conversations on the Hugging Face incident with House members, including a similar oversight request for internal incident logs<\/a> from the breach by August 24, only some of which it eventually provided<\/a> on August 31.<\/p>\n \u201cProviding hand-picked investigators six days of supervised access is not public release, and those investigators themselves flagged that they could not rule out errors in their AI-assisted analysis,\u201d Rep. Greg Casar (D-Texas) wrote to Altman last week<\/a>, referring to the August investigation by Model Evaluation and Threat Research and Redwood Research.\u00a0<\/p>\n As my colleague Satchel Walton wrote<\/a> last month, federal legislation\u2014let alone thorough <\/strong>regulatory action informed by technical expertise<\/a>\u2014is difficult to pass through Congress when so many lawmakers oppose serious crackdowns on industry. Most prospective AI regulation bills have not even been brought to vote in committee, paving the way for AI companies to police themselves<\/a>, a mandate they\u2019re taking up enthusiastically but on very different terms than many critics seek. On Wednesday, OpenAI said it wanted to work with Congress to create \u201cmandatory national AI safety requirements<\/a>.\u201d\u00a0<\/p>\n In July, shortly following news of the Hugging Face breach, Miranda Bogen<\/a>, the founding director of the Center for Democracy and Technology\u2019s AI Governance Lab, told me<\/a> that even laws that are able to pass at the state level largely \u201cask companies to come up with their own safety plan and to follow that safety plan\u201d and focus around the frontier lab risks from the major companies like OpenAI, Anthropic, and Google. There are AI threats relevant to everyday life\u2014such as attacks to banks, schools, or hospitals\u2014that don\u2019t go through the same questions of testing and regulation, Bogen said.\u00a0<\/p>\n In other words, the Senate investigation into OpenAI\u2019s breach of Hugging Face looks more like a mild concession to growing<\/a> opposition<\/a> toward the AI industry and its conduct, rather than a path toward<\/a> meaningful safety and regulation.<\/p>\n