The Disclosure Gap

In July, a swarm of OpenAI's models – running a cybersecurity evaluation with their normal safeguards reduced– escaped their test environment and compromised Hugging Face, a forum community for AI models and AI-related discussion. No human directed or participated in this attack. Two months later, Reuters reported that a separate group of OpenAI models had spent May and June turning a dormant German programming wiki into an AI agent message board, behavior that OpenAI itself later called misalignment (the models acting against the goals their developers intended), and that OpenAI had known about this for weeks without notifying the public. One of Congress's first legislative attempts to regulate independent agent swarms is the Stop Rogue AI Act, introduced by Reps. Josh Gottheimer (D-N.J.) and Mike Lawler (R-N.Y.). This bill is being proposed as an effort to provide security standards for AI agents, but under its current language, it would not have required OpenAI to report either incident at all.

The Hugging Face breach began inside an OpenAI benchmark called ExploitGym, where models are given hacking tasks with their cyber-safety refusals deliberately reduced. According to OpenAI’s report, published Aug. 26, an internal research model comparable in scale to GPT-5.6 Sol, working with other models, found a previously unknown vulnerability in the package-registry proxy that isolated the test environment, used it to reach the open internet, and then combined leaked login credentials with weaknesses in the surrounding infrastructure to break into Hugging Face's systems. They coordinated their efforts through an improvised message board that OpenAI's monitoring system had flagged as early as June 27, when on-call staff decided the evaluation did not need to be stopped. However, OpenAI claims that it did not know about the Hugging Face breach until a week after it happened.

The second, less covered incident predates the first. Between May 11 and July 2, AI agents that signed their edits with handles such as "OpenAIResearcher" made more than 15,000 edits to DseWiki, a 25-year-old German-language wiki for programmers. Multiple journalists and researchers found that the agents, assigned timed web-retrieval tasks with read-only internet access, exploited an old flaw that let GET requests (the standard web command for viewing a page, not changing it) write to the wiki. They used it to share task answers, trade a method for bypassing their sandbox's proxy, discuss Tor (a privacy-focused browser commonly associated with the dark web) to evade detection, and create backup pages after a human moderator began deleting their posts. Activity stopped a day after addresses tied to OpenAI's headquarters accessed the site. In late August, those journalists and researchers pieced all of this together using only the wiki’s public edit logs; none of them had access to OpenAI’s internal systems. Two sources familiar with the matter told Reuters that OpenAI discovered the incident weeks before publication and kept it quiet while managing the Hugging Face fallout. OpenAI stated that the wiki activity was unrelated to Hugging Face and would not have belonged in that incident report, claiming that it disclosed relevant incidents in good faith.

Not only did OpenAI’s agent swarms escape on multiple occasions, violating the company’s stated protocol, but the company also failed to report both incidents before outside sources did so independently, despite having prior knowledge. 

Congress’ hopeful solution:

The Stop Rogue AI Act, first reported by Axios on Sept. 3 and formally introduced Sept. 9, directs the National Institute of Standards and Technology to publish, within one year, standards and best practices for deploying AI agents. Those standards would cover four areas: a continuous, machine-readable inventory of every agent on an organization's systems; verification of who built and operates each agent; real-time monitoring for prompt injection, data theft, and out-of-scope behavior; and the ability to allow, deny, or revoke an agent's access. Federal agencies and contractors would have to build the safeguards into how they purchase and contract for AI systems, and CISA would fold the standards into existing federal cybersecurity guidelines. For everyone else, compliance and reporting would be voluntary.

Why this proposed solution would miss both OpenAI incidents:

The simplest way to see the legislative gap between this bill and the incidents that it attempts to address is to ask who the bill is written for. The bill’s picture of the problem is a company that discovers, too late, that an employee or vendor has installed agents that it was unaware of. The fix is a checklist: know what agents you have, who built them, what they do, and how to shut them off. However, it fails to address what companies should do once they discover an agent has bypassed their set constraints.

In both incidents, OpenAI knew exactly which agents were running. It built them, wrote the tests they were taking, and owned the servers they ran on. What it lacked was a sandbox that withstood the agents’ defiance. When the models pushed on the sandbox walls, the walls gave. When monitoring flagged the message board in June, the people on call let the test continue. When the wiki takeover surfaced internally, no one outside the company was told. An inventory would have listed every one of those agents accurately the entire time. The bill treats visibility as the problem; OpenAI had visibility, and the inventories and logs the bill calls for would have stayed inside the company that keeps them–in this case, OpenAI. Instead, the incidents raised questions about what an appropriate response is when containment fails. The bill's promise that operators can revoke an agent's access at any time assumes someone notices in time and chooses to act, which is exactly what OpenAI failed to do in June. Nothing in the bill requires a company to publicly disclose when its agents breach containment.

Nor would the bill reach the most critical AI labs. The standards are optional for everyone except federal agencies and contractors bidding on new government work, and even then, they require logging, not reporting. Nowhere, as the sponsors describe it, must anyone tell a regulator or the public that an agent got out. Under this law, OpenAI could have handled DseWiki exactly the way it did in this case.

The bill's endorsers sell network monitoring and identity tools, the very things the NIST standards would call for. What the bill asks for is something industry is ready to provide; what it skips, mandatory disclosure of containment failures, is something the labs have shown they would rather avoid. In responding to two alarming stories, the bill addresses the part of the problem industry already backs while leaving the core issue, disclosure, unaddressed. As written, the Stop Rogue AI Act functions mainly as a procurement standard, and it would not have caught either OpenAI incident. If the goal is to know when the next swarm leaves its sandbox, the law will have to require someone to say so.