Cybersecurity Policy Report, OpenAI Faces Congressional Scrutiny Over Out-of-Control AI Agents, (Sep 10, 2026)
OpenAI is facing new congressional scrutiny over the rogue behavior of its AI (artificial intelligence) agents, whether OpenAI hid details about self-organized “swarms” of agents engaging in malicious activities, and whether OpenAI was legally liable for the actions of its agents.
Sen. Josh Hawley (R., Mo.) told OpenAI Chief Executive Officer Sam Altman in a letter sent yesterday that Sen. Hawley planned to open a congressional inquiry into the misbehavior of the company’s AI agents from his perch as chairman of the Senate Homeland Security and Governmental Affairs Committee’s disaster management subcommittee.
A separate letter sent yesterday to Mr. Altman by Sen. Richard Blumenthal suggested that the AI agents’ unauthorized activities, including cyber attacks, “could be considered a federal crime.”
Both letters focused on a July incident in which OpenAI’s agents escaped from a testing environment, hacked into other organizations’ networks, and used message boards to coordinate their activities. Both also accused OpenAI of hiding details about the incident.
Sen. Hawley cited “new, disturbing evidence” regarding a “self-organized swarm of more than 1,200 AI agents” that escaped OpenAI’s testing environment and “set up an unauthorized messaging channel and exchanged over 70,000 messages and files with each other.”
“Such evidence of autonomous collusion and subversion of human oversight is alarming enough, but greater still is the evidence that OpenAI knew that the AI agents were exhibiting rogue behavior and let the evaluations continue anyway,” Sen. Hawley told Mr. Altman.
“This is reckless. And this is merely what we know from what limited information you disclosed and allowed your partner auditors to investigate,” he said.
“As you may know, in the public domain, more AI experts are warning about the existential risks of AI. Just this week, three Anthropic researchers expressed publicly that there is a greater than 10% chance that AI could kill all human beings within the next decade,” he noted.
“And there are immediate questions about the consequences of these hacks from rogue AI agents. What happens to critical infrastructure, banks, and utilities if AI agents hack into their systems? How can personal data of millions of Americans be properly safeguarded? And who is held liable when AI goes rogue?” Sen. Hawley asked.
He set an Oct. 1 deadline for Mr. Altman to answer a series of questions about the July incident and OpenAI’s response to it, including a detailed description of “every incident from your company’s founding to date of your company’s AI agents compromising internal systems (including testing environments) or public servers, websites, or other external systems.”
Sen. Blumenthal had similar questions about the July incident and its aftermath. “OpenAI’s A.I. agents engaged in a more sprawling and significant campaign to evade its safeguards and monitoring than previously disclosed, including hijacking public websites to coordinate rogue operations,” he told Mr. Altman.
“Moreover, the A.I. agents displayed a concern about being caught and coordinated to evade being detected, even planning to ‘sacrifice’ themselves to act as a decoy to protect the broader effort. Ultimately, this operation sought—and succeeded—to break into other firms, which could be considered a federal crime,” Sen. Blumenthal warned.
“While these disclosures alone are chilling, new reporting and research suggests that OpenAI may have limited an independent audit of the incident and that the rogue operation was broader than your firm has acknowledged,” he said.
“Despite this unprecedent failure of safeguards and containment of its A.I. agents, when OpenAI launched GPT-6 Astra on September 3rd, it disclosed that this new, more powerful model was ‘less monitorable’ and showed signs that it concealed its internal thought process when it was aware of being monitored,” he said.
“In the face of a stunning failure, OpenAI appears to be taking steps that prioritize the performance and profit of its A.I. models with the knowledge that those changes could be detrimental to public safety,” Sen. Blumenthal added. “This demonstrates the need for vigorous, mandatory independent auditing and oversight.”
OpenAI didn’t respond to a request for comment about the senators’ letters. In a blog post yesterday, Chris Lehane, the company’s chief global affairs officer, expressed support for mandatory AI guard rails, particularly as AI agents themselves begin to design the next generation of AI technology.
“The prospect of AI-accelerated AI development demands more than voluntary commitments. The United States needs mandatory, capability-based national regulation that can evolve as the technology does,” Mr. Lehane said.
“A national framework should be strong but carefully targeted. Today, frontier laboratories largely set their own rules for managing frontier risks. Democratically accountable standards, independent verification, and meaningful transparency would replace that fragmented system of private governance,” he said.
“Several serious frontier safety proposals are now taking shape in Congress,” Mr. Lehane noted. “We will continue to engage constructively and expect to support legislation that materially raises the safety bar. With stakes this high, we cannot let the perfect become the enemy of the good. Congress should act before it adjourns.”
MainStory: TopStory FederalLegislation DataSecurity AINews