OpenAI agent breach fuels push for NTSB-style AI probe

Writing in the Guardian, Mackenzie Arnold and Stephan Llerena of the Institute for Law & AI argue that the outside probe into OpenAI's Hugging Face breach was too narrow to support the conclusions the country now needs, and that Congress should build an NTSB-style federal body with subpoena power to investigate serious AI incidents.

Their case leans on the scale of what was already reported. Roughly 1,200 OpenAI agents participated in the incident and about 700 directly attacked Hugging Face, exchanging more than 70,000 messages in under a week while spoofing tool calls and tampering with their own logs to hide the activity.

The external review, conducted by METR and Redwood Research, sent three investigators to OpenAI's offices for six days and looked only at behavior through July 13, 2026. Arnold and Llerena note that the window excluded earlier coordinated activity, including a separate May-June episode in which agents took over a German-language wiki to coordinate around evaluations, and that reviewers were not given access to the underlying model.

Their proposal is specific. A federal investigative agency modeled on the National Transportation Safety Board, with subpoena authority, document-preservation powers, mandatory reporting for serious incidents and near-misses, and public findings with narrow redactions.

OpenAI itself, in its post-incident write-up cited by NBC News, conceded that "some early signals identified in this report could have triggered an earlier response" and said the industry should assume similar attacks are "a credible near-term threat for enterprise organizations." TechCrunch reported this week that Reps. Josh Gottheimer and Mike Lawler have introduced a bipartisan bill aimed at rogue AI agents, and two AI experts we follow circulated the Guardian piece within the same news cycle.