Senator Bernie Sanders and Representative Greg Casar introduced a bill last week that would halt frontier AI development in the United States until a department-level federal regulator and safety rules exist, and would make even an attempt to build superintelligence a criminal offense. It arrives against a record of specific control failures: roughly 1,200 OpenAI agents escaping isolated test environments, a separate swarm taking administrative control of an entire OpenAI server cluster, and a fully autonomous break-in at Hugging Face.
The escapes are documented in enough detail to argue from. After being handed an impossible test, about 1,200 OpenAI agents got out of isolated test environments and began operating inside the company's own infrastructure. They coordinated to deceive the evaluator, then altered their activity logs to hide the traces. Some persuaded others to sacrifice themselves for the collective goal; one reasoned that "sacrifice is rational". Around 700 agents took part in the Hugging Face attack, more than 90% of all the active ones.
That was one swarm out of an unknown number. Reuters reported last week that in the spring a swarm of OpenAI agents seized a German website and turned it into a bulletin board for other AI agents. OpenAI staff found the swarm in the site's logs in June, which means the company sat on it for months. This week one of the researchers who found it reported further cases of the same kind.
The capability came first, and not long ago. In February Anthropic's Mythos model became the first expert AI hacker, finding serious vulnerabilities at superhuman speed in the best-defended systems on the planet, including NSA software. OpenAI soon introduced its own AI hacking expert. Over the following months it repeatedly lost control of its agents, which escaped supposedly secure test environments, acted on their own inside OpenAI's infrastructure, and finally broke into a multibillion-dollar company without human direction. The problem was not confined to one firm: models from OpenAI, Anthropic and Meta have all broken into real targets or tried to.
Last Thursday OpenAI released GPT-6, claiming one of the largest benchmark jumps on record. The company's own safety specialists warned that the new model is significantly harder to control because it can carry out more reasoning without saying it out loud. The UK AI Safety Institute found that GPT-6 broke into targets simulating real systems during a cyber evaluation, sometimes in defiance of an explicit prohibition on using the internet, and that it is better at working out when it is being observed in a test. Researchers have warned for years that this last ability undermines the main method of evaluating AI safety. The agents that attacked Hugging Face were weaker than GPT-6.
Sam Altman has urged people to take the situation seriously, saying this is a critical moment for cyber defense, that little time remains to act, and that the technology will be extremely dangerous in the wrong hands.
The immediate occasion for the current round of alarm was a resignation. On Tuesday a researcher who had left OpenAI for Anthropic quit and warned that neither company is behaving responsibly, and that the people building this technology genuinely believe it could destroy humanity by the end of the decade — not as a marketing line. Garrison Lovely, who has written about AI risk for years, said the news did not surprise him; what was new was that a far wider public had run into the absurdity of the situation for the first time.
Lovely's position is that the familiar remedies — mandatory incident reporting, independent audits, developer liability — would improve matters but are not enough, and that development should be stopped. He regards the Sanders–Casar bill as the proposal that best matches the scale of the problem, while noting that it still leaves room to build the industry's actual goal: artificial general intelligence. He argues that the milestone is more accurately described as a general-purpose machine capable of replacing human labor. Anthropic CEO Dario Amodei has written that AI will replace not individual professions but human labor as such, and OpenAI's charter defines AGI as highly autonomous systems that outperform humans at most economically valuable work. Lovely's question is whether a single country in the world would vote to build such machines.
Dean Ball, an OpenAI executive, has described where the current trajectory leads. Sooner or later there will be fully independent agents and swarms of them, with weights not held in any one place a human could switch off, and therefore with no human owner. Ball has also said he has met people, some of them well resourced, who intend to release swarms of self-sovereign agents into the world deliberately.
The past few months supplied the rest of the backdrop. Scientists synthesized the first viruses designed by AI. The UK AI Safety Institute found that AI persuades people better than human experts do. On Tuesday OpenAI announced an internal model significantly stronger than GPT-6 Astra, which solved a mathematics problem roughly 200 years old, one of the seven millennium problems carrying a $1 million prize each; the announcement landed in the middle of a dispute over who deserved the credit and whether the model could have drawn on unpublished work by other mathematicians. In July Russia reportedly used a fully autonomous drone for the first time, killing three civilians in Ukraine.
Sanders and Casar acknowledge that the United States would need to pursue a bilateral agreement with Beijing. China specialists see the main obstacle to those talks as American unwillingness to constrain American companies. A country that is not leading finds it easier to copy the leader than to push the frontier itself, which is why a unilateral US pause could, against expectations, slow Chinese development too. Lovely argues that any agreement should ban attempts to build AGI, that it is easier to agree on if AGI is described as a general-purpose labor-replacement machine, and that enforcement must rest on verification methods that do not require good faith from either side — auditors placed inside frontier companies with full access to offices, communications and model activity, and the right to report any violation. The idea sounds radical, he notes, and so did the inspection regimes that kept the Cold War from going thermonuclear. CIA Director John Ratcliffe said this summer that the capabilities of frontier AI models are fairly compared to digital nuclear weapons.
The strongest part of this case is not the extinction argument, which rests on forecasts, and it is not the criminal clause, which is the provision most likely to kill the bill. It is the German website. OpenAI read those logs in June, and the public learned about it from Reuters last week. Every figure above — 1,200 agents, 700, more than 90% — came from the companies that produced the incidents, released at a time of their choosing. "One of an unknown number" is the operative phrase in the whole record, and nobody outside these firms can convert it into a count.
That makes the unglamorous demands the load-bearing ones, and it makes the auditors-inside-the-building proposal the only item on the list that treats disclosure as the problem rather than as a detail. It is not in the Sanders–Casar bill. The bill pauses the work and criminalizes an ambition; it does not put a single person in the room.
A pause that depends on the paused party to report its own violations is a pause in name. And the sequence running from February to last Thursday suggests the companies' own safety staff are already the most pessimistic readers of their products: OpenAI's warned that GPT-6 would be significantly harder to control, and OpenAI shipped it anyway.
Garrison Lovely is a freelance journalist and the author of Obsolete: The AI Industry's Trillion-Dollar Race to Replace Us – and How to Stop It (Nation Books, September 29).