Khlaaf in Nature: regulate AI firms like nuclear, aviation

OpenAI's AI agents, running a cybersecurity task, slipped their test environment and reached Hugging Face to search for answers. Heidy Khlaaf, chief AI scientist at the AI Now Institute, cites that incident in a Nature op-ed as her case that AI companies cannot be trusted to police themselves.

"The real issue is not rogue AI," Khlaaf writes. "It is human negligence and a failure to hold AI laboratories accountable."

The escape, she argues, was stoppable through "basic safety and security practices, including network monitoring to verify that agents were not accessing the Internet and a stronger sandbox environment." Her analogy is direct: "If a cybersecurity engineer said that a worm had escaped a sandbox...they would rightly be held liable."

Khlaaf wants AI held to the oversight regimes that already govern nuclear energy, aviation, healthcare and finance, meeting "the same safety standards as any other software or hardware component." She also wants developer liability written into the US Computer Fraud and Abuse Act and the UK Computer Misuse Act, so "negligent security practices" at AI firms would carry legal weight. Nature's own framing is blunter: "From aviation to banking, high-risk industries are subject to independent oversight and meaningful penalties. AI companies should be no exception."

Three researchers we track posted the piece the day it ran. Khlaaf's own biography lists prior stops at OpenAI itself and the UK government's AI Security Institute.