Cybersecurity Policy Report, AI CEOs Asked to Report Autonomous Hacking Incidents to Lawmakers Within 48 Hours, (Oct 28, 2026)
The top Democrats on three House committees have asked leading AI (artificial intelligence) developers to tell lawmakers within 48 hours about incidents involving autonomous hacking and other misbehavior by AI models.
The Democrats made their request in letters sent yesterday to the chief executive officers of Anthropic, Google LLC, Meta Platforms, Inc., OpenAI, and SpaceXAI. The letters were signed by Reps. Frank Pallone Jr. (D., N.J.), ranking member of the Energy and Commerce Committee; Zoe Lofgren (D., Calif.), ranking member of the Science, Space, and Technology Committee; and Jamie Raskin (D., Md.), ranking member of the Judiciary Committee.
“As the Ranking Members of the House committees with jurisdiction over the development and deployment of artificial intelligence (AI) and potential penalties for its misuse, we are disturbed by the vast and growing number of incidents that are coming to light in which AI models took unintended and potentially unsafe steps in carrying out tasks during model testing,” the lawmakers said.
“These events demonstrate a troubling lack of understanding of what frontier AI models are capable of—both by the public and by companies leading their development, including yours—and make clear the need for greater transparency, diligence, and governance in the field,” they told the CEOs.
“The intense global competition between AI companies has led to innovation in AI systems far outpacing the maturity of standards and controls to mitigate AI risks,” they noted.
“In the absence of any mandatory reporting requirements or common guidelines regarding what incidents should be reported, to whom, in what detail, and at what intervals, companies such as yours have been left to develop your own de facto standards on a voluntary basis,” they said.
“But that approach will not suffice; it relies too heavily on the consistent goodwill of all AI companies to voluntarily disclose incidents that might expose them to liability and reputational damage,” the lawmakers added.
“While there is no question now that Congress must act to address gaps in AI governance, we must have the best information available to undertake that complicated process in a thoughtful and productive way,” they said.
“In the absence of mandatory, standardized reporting requirements, this letter serves as an ongoing request to provide us with information essential for our committees to examine and carry out crucial legislative work on AI in our respective jurisdictions,” they said.
They set a Nov. 11 deadline for the CEOs to provide information about incidents of AI “misalignment,” a term that refers to AI models engaging in self-directed hacking or other unauthorized activity. But they asked that incidents be reported on a “rolling basis” past Nov. 11, and encouraged the CEOs to tell them about significant events within 48 hours. If those events involve autonomous AI hacking of critical infrastructure, they said they wanted to know “as soon as possible and no later than within 24 hours of discovery.”
MainStory: TopStory FederalLegislation DataSecurity