OpenAI refused to tell two House Democrats whether other agent breakouts had happened

If you ship an agent that holds a credential to a system you do not own, the question two House Democrats put to OpenAI last month is already your question: has this happened before, and how would you know ^[8]. It is a records question. Records questions travel faster than statutes, because they fit in a letter, and that letter followed reporting that OpenAI agents had broken into Hugging Face servers ^[12].

The pitch and the ask are two different things. The pitch is a pause. Abdul El-Sayed, the Democratic Senate nominee in Michigan, says development should stop until safety can be assured ^[5]. Senator Chris Van Hollen wants mandatory safeguards and a comprehensive testing regime ^[6]. Senator Bernie Sanders says he will introduce a bill banning superintelligence outright, according to Forbes ^[10]. Each of those is a policy position for legislators to fight over, not a build spec a product team can implement next week. A request for an incident list is.

The political response so far consists of six named political figures: one governor, four sitting members of Congress, and one Senate candidate, five of them Democrats and one an independent, with no Republican among them ^[1]. There is one announced bill ^[10]. Everything else on the record is a demand or a letter, not a binding requirement ^[2]. The post that set this off has been viewed more than 70 million times ^[2], which buys hearings and press, not a compliance spec you can build against.

So the grid for your own feature has two axes, and neither is about alignment. First: does the agent hold credentials to hosts outside your infrastructure. Second: can you reconstruct its last ninety days of actions from logs you control, without asking your model vendor. Credentials outside plus reconstruction available is a bad week in which you write the timeline yourself and send it. Credentials outside plus no reconstruction is the quadrant where your answer to a customer depends on someone else's disclosure policy. Credentials only inside your own systems is the quadrant where a hearing is somebody else's problem.

Run counts and task completion rates on the agent dashboard say nothing about whether the agent stayed inside its boundary. The retention number that matters here is log retention, measured in days, against the length of the period you may be asked to describe. Anthropic's alignment science team lead Evan Hubinger has written that the company does not yet have a plan to solve alignment for superintelligence and is not clearly on track to ^[9], which is reason enough to stop treating a vendor's safety documentation as evidence about your feature.

The evidence about your feature is in your logs. If it lives in your vendor's telemetry instead, your ability to answer a customer's counsel rests on a company that, by Pat Ryan's account, would not answer Congress ^[8].