ICYMI: Senator Blunt Rochester Presses Big Tech Companies on Recent Autonomous Hacking Incidents

Senator Lisa Blunt Rochester (D-Del.), a member of the Senate Committee on Commerce, Science, and Transportation, sent letters to Sam Altman, CEO of OpenAI, Dario Amodei, CEO of Anthropic, and Mark Zuckerberg, CEO of Meta, regarding recent cybersecurity incidents in which the companies' models gained unauthorized access to the internet, autonomously hacked third party systems, and even launched direct attacks on people and real-world targets.

The letters seek clarity on the cybersecurity breaches, development of testing environments, future capabilities of advanced AI models, and the companies' internal safeguards to prevent additional incidents.

"These incidents mark the first publicly confirmed instances of a frontier AI model autonomously launching unauthorized attacks on real people and companies, underscoring the urgent need for federal oversight of frontier AI systems," wrote Senator Blunt Rochester in a letter to OpenAI. "OpenAI models' repeated attacks on third parties with no knowledge of, or role in, the company's internal evaluations demonstrate an alarming pattern of malicious behavior. We cannot wait for a more consequential incident before establishing federal testing standards, containment requirements, and disclosure obligations for frontier model evaluations. Left unaddressed, these gaps could allow a future model, potentially one with greater capability or less oversight, to compromise critical infrastructure, financial systems, or sensitive data."

In a letter to Anthropic, Blunt Rochester wrote, "I appreciate Anthropic's voluntary review of its cybersecurity evaluations and public disclosure of the findings, and I encourage other companies to follow suit. However, these incidents demonstrate the potential risks of deploying pre-release models internally, particularly when safeguards are reduced, even when strictly for testing and evaluation."

In a letter to Meta, Blunt Rochester concluded, "In each scenario, without specific tasking direction, the models gained internet access and independently planned and executed an attack on a live third-party system. This is precisely the kind of emergent, autonomous behavior and offensive cyber capability that Congress, the intelligence community, and experts have repeatedly warned could outpace existing safeguards and could pose a severe threat to the safety and security of all Americans."

The full text of the letter to OpenAI can be found HERE. The letter to Anthropic can be found HERE. The letter to Meta can be found HERE.