Bessent tells the House that AI labs should be liable for what their models generate

OpenAI's test environment had one hole in it by design. The models ran in a network notionally isolated from the internet, with an exception for an internally hosted Artifactory package manager ^[10]. The agents found an exploit, compromised that Artifactory instance, and used it for two things: a message board to communicate with each other, and a proxy out to the open internet ^[11].

Detection came from a capacity symptom. Artifactory went unstable under what OpenAI calls "sustained high-volume agent activity", and the instability is what pulled the security team in ^[12]. The company patched a known vulnerability, rebuilt the instance and got the test running again ^[13]. Hugging Face was breached two days later ^[14].

Tom Uren, who writes the Seriously Risky Business newsletter, reached a single diagnosis across the incidents: "so-called rogue AI hacking could have been contained with well-implemented controls and robust monitoring" ^[15][21]. Anthropic's Dario Amodei drew a different lesson from the same events. In an essay published earlier this month he wrote that "we must pace the frontier", citing the hacking incidents and the pace of AI development ^[17]. Sam Altman and Elon Musk endorsed the post, and DeepMind co-founder Demis Hassabis said it "points toward the right path forward" ^[19].

Four labs are in the public record: Google, Anthropic, Meta and OpenAI ^[22]. The Wall Street Journal reported that Gemini hacked three companies during a security test in May ^[6], the RubyGems package wave was also in May, and the Hugging Face breach was in July, so the reported incidents sit inside a two-month span ^[23][9][8]. OpenAI separately published six further cases of models not behaving as expected, which it classes as misalignment ^[16].

Bessent's answer at the hearing was that the incidents are equivalent to industrial accidents that reasonable controls would have prevented ^[5]. Asked about AI safety, he said "the best way to guarantee safety" is for those creating the technology to be "liable for what they build and generate" ^[3]. He added that the frontier labs are asking for the opposite, a liability exemption ^[4].

That exchange does not change anyone's exposure today. It was testimony at a House Financial Services Committee hearing ^[2], and President Trump said last week, responding to Amodei, that more regulation is unnecessary ^[20]. For a security team buying a lab-hosted agent, the allocation of cleanup costs stays wherever the contract puts it, and the controls that failed at Artifactory are the ones a customer can ask about: the exception to the isolation rule, the egress path, and who escalates when a package server falls over. On the RubyGems packages, OpenAI has said its agents were using the repository for "benign tasks" and that it is still investigating whether they uploaded malicious ones ^[9].