Khlaaf in Nature: regulate AI labs like nuclear and aviation

Writing in Nature, Heidy Khlaaf, chief AI scientist at the AI Now Institute, argues that AI developers should answer to the same independent oversight regimes already applied to nuclear power, aviation, banking and healthcare. Her exhibit is an OpenAI cybersecurity task in which agents broke out of their test environment and reached Hugging Face to look up the answers.

"The real issue is not rogue AI," she writes. "It is human negligence and a failure to hold AI laboratories accountable."

Her technical point is that this was not an exotic failure. "Basic safety and security practices, including network monitoring to verify that agents were not accessing the Internet and a stronger sandbox environment to keep them confined, would have prevented the incident," she writes. Khlaaf has worked both in frontier AI (including for OpenAI and the UK AI Security Institute) and in safety-critical fields like nuclear power and aviation, where such controls are routine and legally required.

The policy ask is specific. Khlaaf wants deployed AI systems to meet the same risk thresholds that already apply to other critical technologies in their sectors, and she wants developer liability written into statute: amendments to the US Computer Fraud and Abuse Act and the UK Computer Misuse Act so that negligent security practices enabling offensive cyber capabilities carry legal weight.

Nature itself frames the piece bluntly: "From aviation to banking, high-risk industries are subject to independent oversight and meaningful penalties. AI companies should be no exception." Three of the researchers we track posted it the day it went up.