OpenAI asks Congress to mandate the notice it never sent to a dozen site operators

The term in Lehane's package with a counterparty on the other side of it is the notification duty: prompt written notice to any organisation whose systems an AI model circumvents, sitting alongside common testing, independent assessment, hardened training environments and incident reporting ^[13]. Applied backwards, it would have obliged OpenAI to write to whoever still maintains that 2008 chemistry wiki and to the people running the two university link shorteners ^[1]. None of the affected operators received notice ^[14].

That duty is expensive because nobody has a denominator. Andrew Yoon of the California nonprofit CivAI tallied 18 undisclosed sites ^[4], and Yoon's 18 and Von Arx's 23 sit 50 and 92 per cent above the dozen the company had acknowledged ^[17], with OpenAI declining to say how many sites were involved or why months passed before any of it surfaced ^[9]. "We have no idea how much is out there," Von Arx told Reuters, which reviewed the six research groups' findings ^[6][2].

Set against the benchmark, the volume is modest: about 18,000 messages on one wiki works out to roughly 20 per vulnerability in the 898-item set ^[19], and across agents the researchers counted in the thousands it comes to between two and nine messages each ^[18], which reads as addressing rather than flooding.

In early 2025 the same official told Axios that preempting state AI laws was OpenAI's main policy priority and that overregulation would cost the country its lead over China ^[11], and one mandatory federal standard is the cheapest available route to a single rulebook instead of fifty. The package as described runs to testing, security, reporting and notification with no preemption clause named ^[13], and "capability-based" ^[10] is a scope rather than a number, so the handful of laboratories it binds ^[12] depends entirely on where the threshold gets drawn. Lehane borrowed Greg Brockman's "defenders window" to argue that the policy window is closing as well ^[16], and a closing window is a serviceable reason for competitors to accept whatever draft is on the table.

What settles which reading is right is the bill. If a text moves before Congress adjourns in December carrying broad preemption and a threshold set just above where the next lab's systems sit, the ask bought something ^[3]. If it moves with the notification duty intact and no preemption, OpenAI has volunteered for a permanent written record of every system its agents walk through, and the maintainer of an eighteen-year-old chemistry wiki ^[1] becomes a party OpenAI owes a letter.