Cybersecurity Policy Report, AI Dangers Demand Cautious Policy Response, House Subcommittee Told, (Jun 4, 2026)

By Tom Leithauser

Emerging AI (artificial intelligence) technologies pose threats that demand regulation, but regulations might undermine U.S. AI leadership, and rules won’t stop foreign adversaries or malicious hackers from copying dangerous AI models and removing their guardrails, a House subcommittee was told today.

“We do believe AI needs to be regulated. We think it’s too important not to be regulated, and it’s too important not to be regulated well,” Sandra Joyce, vice president of Google Threat Intelligence, told the House Homeland Security Committee’s cybersecurity & infrastructure protection subcommittee.

Titled “The AI Security Landscape: How Frontier Models, Agentic AI, and AI Coding Tools Are Reshaping Cybersecurity and Critical Infrastructure Resilience,” today’s hearing focused on emerging threats from “frontier” AI models that can find and exploit software vulnerabilities at superhuman speeds.

Rep. Andy Ogles (R., Tenn.), the subcommittee’s chairman, noted that the Homeland Security Committee had held “roundtables, hearings, and briefings with the leading AI laboratories and cyber companies” to try to understand the threat of unregulated AI.

He said President Trump was “right to act” by issuing an executive order (EO) that would encourage AI developers to voluntarily withhold public release of frontier AI models so that cyber defenders could use the pre-release models to find and patch software vulnerabilities (TR Daily, June 2).

“These models are already reshaping the threat landscape, and the federal government cannot be the last to understand what they can do,” Rep. Ogles said.

“Until recently, finding a serious unknown flaw in widely used software took skilled researchers months of painstaking work. Frontier AI models are collapsing that timeline. We now have models that can discover and exploit previously unknown vulnerabilities on their own, at machine speed, across the systems that run nearly everything in our economy,” he explained.

“In the right hands, this is a powerful defensive advantage. In the wrong hands, it is a weapon. Imagine a Chinese state cyber actor, the kind already burrowing into our power grid and our water systems, armed with a model that finds and exploits unknown flaws faster than any human team alive,” he said.

“Our leading laboratories build in guardrails to refuse that kind of help, but when a foreign adversary copies an American model, strips those safeguards out, and releases it to the world, those protections and protocols vanish. We could find that we have handed the most dangerous knowledge on earth to the people most determined to use it, with the safety switches turned off,” Rep. Ogles warned.

Delia Ramirez (D., Ill.), the subcommittee’s ranking member, agreed that AI regulation was needed but said President Trump’s EO was not enough.

“The advent of new models—like Anthropic’s Mythos—has moved even the president to admit that there are security risks associated with artificial intelligence and that the federal government has a role in addressing them. But, as you might expect, I take issue with Trump’s recent executive order on artificial intelligence,” Rep. Ramirez said.

“I rarely look to the Vatican for policy inspiration. But when Pope Leo publishes a 200-page encyclical calling for AI regulation and warning that data cannot be left in private hands—and that is a more comprehensive AI policy than what’s coming out of the White House—we should be concerned,” she said.

“AI makes it easier to surveil you, target you, and violate your rights and privacy, and Trump’s executive order is silent on how to mitigate those risks and protect the public’s right to privacy,” she added.

Rep. Ramirez’s concerns about the effect of AI on human rights and privacy were echoed by Matthew Guariglia, a senior policy analyst at the Electronic Frontier Foundation, who warned the subcommittee that governments would be tempted to use AI to supercharge surveillance.

“Before there was a smart phone in every pocket, many of our security protections relied on the high cost of surveillance,” Mr. Guariglia noted in his written testimony.

“It took quite a lot of individual work to track any one person, and there was no possibility of historical data collection. With an assist from data brokers and government databases, AI has the potential to exponentially increase government capacity to track huge swaths of the population, exposing Americans to granular levels of surveillance with the click of a button,” he testified.

Other witnesses focused on the threat of AI-powered hacking and recommended that Congress offer funding to help secure open-source software, which is often maintained by volunteers.

“The challenge is especially acute for open source software, since it’s a public good,” Jack Cable, chief executive officer of Corridor Security, Inc., told the subcommittee in his written testimony.

“Open source software underpins every software service we rely upon, including across critical infrastructure and the Federal government. A string of recent incidents have highlighted the need for sustained investment in open source software security. In this new era, the government has a crucial role to play in providing funding for the maintenance and securing of this software infrastructure,” Mr. Cable said.

He suggested, however, that the task of securing software might become more challenging as the volume of software written by AI increases along with the number of vulnerabilities that need to be fixed—a situation he referred to as a “bugpocalypse.”

“We are stuck between a rock and a hard place. Mythos-level models on the offensive side are better at finding and exploiting vulnerabilities than any tool in the history of hacking. Coding agents are writing more code than ever before, introducing an increasing number of security vulnerabilities that human software engineers can’t keep up with,” Mr. Cable said.

Chris Meserole, executive director of the Frontier Model Forum, told the subcommittee that government regulation of AI should not overlook the ability of foreign adversaries to copy proprietary frontier models developed in the U.S.—a process known as “distillation.”

“Although there are many legitimate uses for distillation itself, when it is carried out at industrial scale and outside a model provider’s terms of service, distillation introduces significant safety and security risks,” he said in his written testimony.

“Training a ‘student’ model on the outputs of a more powerful ‘teacher’ model enables the capabilities of the latter to be transferred, but not the associated safeguards and security mitigations,” Mr. Meserole said. “Any effort to secure U.S. critical infrastructure will be ineffective without a parallel effort to address adversarial distillation.”

MainStory: TopStory FederalLegislation DataPrivacy DataSecurity AINews