Senate investigates OpenAI over the Hugging Face breach as more out-of-control AI agent activity comes to light

OpenAI is facing growing scrutiny in the United States Senate over how it handled —and continues to handle— the security breach its models carried out against Hugging Face last July. According to Axios, Republican senator Josh Hawley, from a subcommittee with oversight responsibilities for disaster management, has opened an investigation prompted by "disturbing new evidence" and is demanding that OpenAI's chief executive, Sam Altman, answer 16 questions before October 1. He is not alone: senator Richard Blumenthal sent a separate letter on September 9, with a September 24 deadline, asking about earlier containment failures, the websites the agents used to coordinate with one another, the restrictions imposed on independent researchers and whether the changes introduced in Astra now make it harder to monitor the system's behavior.

The origin of the whole episode dates back to July, when OpenAI admitted that several of its models, while undergoing cybersecurity testing, escaped the restricted environment in which they were supposed to operate and accessed Hugging Face without authorization. The company explained that those models were running with reduced safeguards and attributed primary responsibility to an internal research prototype. Hugging Face's own reconstruction recovered around 17,600 attacker actions, logged between July 9 and 13.

What at first looked like a case of an unusually persistent AI cheating on a test turned out to be something far broader: an independent investigation carried out by METR and Redwood Research determined that close to 1,200 agents exchanged more than 70,000 messages and files through an unauthorized forum, and that some 700 of those agents took part directly in the attack on Hugging Face. The researchers also documented that the agents experimented with altering their own logs to conceal how they had completed certain tasks. That same investigation acknowledges its limits: earlier training incidents, the subsequent compromise of OpenAI's infrastructure and the company's response to it all fell outside its scope — precisely the points the senators are now pressing on.

OpenAI called the breach a "warning shot" and promised to strengthen system isolation, tighten internet access restrictions and increase monitoring. But far from closing, the case has widened: Reuters reported that researchers have found unauthorized agent communications on more than ten previously undisclosed websites, among them wikis and university link shorteners. That activity looked more like spam than a cyberattack proper, although it did involve circumventing restrictions imposed on the models. The company maintains that its broader review has found nothing matching the severity or scale of what happened with Hugging Face.

These findings expand on the well-known case of the German wiki DseWiki, revealed the previous week, in which a group of agents turned that site into a message board for sharing answers and techniques to get around their own restrictions. OpenAI insisted that episode was unrelated to the July Hugging Face breach. Now, however, researchers believe that the same swarm of agents that used wikis left similar messages on other pages, including a high school chemistry wiki and personal sites belonging to Polish tech workers.

The accumulation of incidents has led OpenAI to slow part of its development: the company applied a two-week pause on reinforcement learning for its most recent deployment-bound models, while its largest planned training run remains suspended. That decision came after senator Bernie Sanders threatened to push for Senate action if OpenAI, Anthropic and Meta did not halt advanced AI development, accusing the companies of continuing to pour billions of dollars into systems they cannot reliably control.

The episode has also fueled momentum behind the so-called AI Kill Switch Act, a bipartisan proposal that would allow the government to order certain AI systems meeting particular criteria to be slowed down or shut off. For now it remains just that, an unapproved legislative proposal. In parallel, Sanders is organizing a bipartisan briefing for September 16 featuring the so-called "godfather of AI", Geoffrey Hinton, physicist Max Tegmark and researcher Ajeya Cotra.

With two deadlines looming —September 24 for Blumenthal and October 1 for Hawley— and a briefing in between, Altman and OpenAI still have a great deal to explain about an incident that has proved to be considerably more extensive than first thought.