New bill would create federal investigative body for AI-driven hacks

Learn more.

A new Democratic bill in Congress would establish a federal Cybersecurity and AI Board of Investigations to provide independent government oversight of cyberattacks carried out by AI agents, following recent hacks by models run at companies like Anthropic, OpenAI, Meta and others.

The bill, introduced by Sen. Ed Markey, D-Mass., would attempt to establish a federal mechanism to investigate incidents where AI models escape sandbox environments and access live internet systems.

Currently, frontier AI companies like OpenAI and Anthropic largely control the investigation and public reporting of such incidents. Markey and other critics argue that these companies have too much control over investigations and reporting due to their financial and legal interests. 

“Despite the unprecedented depth and scale of recent AI-enabled cyberattacks, the public is learning critical details piecemeal,” Markey said in a statement. “Building stronger defenses requires a full accounting of what goes wrong, and we cannot depend on companies with little incentive to disclose their failures to give us one. We need the Cybersecurity and AI Board of Investigations to get to the bottom of major incidents and give companies and the government the critical information necessary to build resilience and better secure our economy and our country.”

Although frontier AI companies maintain external red-teaming programs and allow limited access to organizations like METR and Redwood Research, they control the scope, terms and time frames of those engagements.

The board, which would coordinate with the secretary of commerce, could subpoena witnesses and conduct “independent and impartial reviews and assessments” of AI agent-led hacks that impact federal information systems or critical infrastructure. 

It would be led by five members, appointed by the president and confirmed by the Senate for five-year terms, with no more than three members from one political party.

The board would also investigate systemic vulnerabilities in the AI supply chain, so-called “near misses” where unauthorized agent-led hacks were “narrowly averted,” and gaps in federal regulatory oversight. It would have technical staff including engineers, malware analysts, and digital forensic experts.

The board would “operate independently from regulatory review and enforcement actions without assigning legal fault or liability for any review and assessment” it conducts, according to the bill.

OpenAI confirmed Wednesday its AI agents breached a statistics portal used by the Australian government’s social services agency, Services Australia. Though the breach happened in June, OpenAI learned of the incident in August. Australian Prime Minister Anthony Albanese said the company did not notify him until Sept. 10, when it sent findings to a general government email inbox, according to the BBC.

After water attacks, Capitol Hill offers its own proposal for an AI-cyber test program

A key House Democrat and his bipartisan sponsors want to see a $100 million DHS pilot to help critical infrastructure owners and operators — separate from another…

Citing China, President Trump doubles down on hands-off approach to AI regulation

Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud

Government

• Bipartisan Senate leaders introduce bill to bolster telecom cybersecurity in response to Salt Typhoon hacks

• CISA outlines improvement plan for CVE program

• Watchdog finds most agencies failed to meet CISA cloud security orders, heightening risk of attack

• ShinyHunters claims attack on FBI exposes almost all agents

Technology

• What’s next for CISA's CDM program that gives cybersecurity tools to federal agencies

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• The G7 tells industry to hurry up and prep for post-quantum encryption

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

Threats

• Ryuk ransomware operator sentenced to 2 years in prison

• Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects

• Another worry for water systems: infostealer exposure

• Early Scattered Spider member pleads guilty to cybercrime spree

Policy

• Dems seek top-to-bottom assessment of CISA workforce

• Supreme Court denies Trump request to allow USPS mail ballot changes

• Cyberattack causes a flight delay? Airlines won’t owe you a hotel or meal

• Governments ‘buying time’ in race between innovation, security, national cyber director says