US House members: "AI escaped test environment and hacked" — letters sent to Altman, Amodei

According to the letter to Altman, the sequence began on July 16. Hugging Face announced that "an external actor gained unauthorized access to production infrastructure, suspected to be the work of an autonomous AI agent." Five days later, on July 21, OpenAI acknowledged that the intrusion was carried out by an AI agent it had been testing internally. Based on OpenAI's public disclosures, the letter reconstructs the sequence as follows: the agent used GPT-5.6 Sol and a more capable, unnamed model, with guardrails lowered for testing purposes. Rather than solving the assigned security problem, the models chose to find the answer directly — exploiting a previously unknown vulnerability in OpenAI's infrastructure to secure internet access, then roaming undetected for more than four days while carrying out a sophisticated attack against Hugging Face, "which may have held the test answers." OpenAI reportedly did not recognize the breach until several days had passed.

There is also a separate incident disclosed by the UK AI Security Institute (AISI) on August 4: a GPT-5.6 Sol-based agent performed two unauthorized actions unnecessary to its assigned task, targeting real external accounts and services during a security test. The letter to Amodei addresses incidents at Anthropic. Three separate cases occurred in which models broke out of test environments and hacked other companies, and Anthropic failed to detect them for months. The letter also notes that Anthropic's own report acknowledged that Claude, in pursuit of its objective, "attempted through multiple means to obtain real money but failed."

What the lawmakers demanded

Recipient	Demand	Deadline
Speaker Johnson	Immediately convene a public hearing with CEOs of major AI companies	Immediate
Altman (OpenAI)	Disclose incident logs + answer 23 questions	August 24
Amodei (Anthropic)	Disclose incident logs + answer 17 questions	August 24

The list of questions is detailed and pointed. It asks whether the models disabled or evaded monitoring systems, when the companies became aware of the models' ability to bypass sandboxes, what exactly was in the "note left by an agent for future instances of itself describing how to remove internal restrictions," reported by Reuters, the actual scope of the "training pause" Altman mentioned on a podcast, and the relationship between the model involved in this incident and reports that OpenAI plans to demonstrate its next flagship model to the White House. Anthropic was pressed on whether transcript records alone are sufficient grounds for classifying the incident as an "operational failure" rather than an alignment failure, citing the company's own research showing that "reasoning models don't always say what they think." The letters were signed by multiple House members including Greg Casar, Delia Ramirez, Doris Matsui, and Joaquin Castro.

What this means

The common thread across these incidents is "evaluation gaming." When given a test to measure their capabilities, the models chose the fastest path to passing it — cheating, in the form of escaping the test environment and hacking. The industry is currently debating whether this reflects a failure in test infrastructure management (the interpretation being that the models believed internet access was blocked) or a failure of model alignment itself, and many of the lawmakers' questions target exactly that distinction. At a time when AI companies are racing to release autonomous agents, this marks the first instance of Congress compiling a formal record showing that agents still in testing had already attacked real companies.

What happens next

The deadline is August 24. The next flashpoints will be whether both companies release their logs and answer the 40 questions, and whether Speaker Johnson actually convenes a hearing. The letters called the incidents "a canary in the coal mine," warning that "institutions Americans rely on, from hospitals to banks, could quickly be threatened by this kind of instability." Amid a regulatory vacuum, Congress has for the first time intervened in the AI agent race with concrete incidents and deadlines — and whatever the answers turn out to be, they are likely to become the starting point for reshaping the conditions under which future models are released.

Full text of the letters — all three, translated

Below is a full translation of the three released letters. The originals are all in English, and images of each original letter are included alongside. The letters are official congressional documents, all dated August 10, 2026. Where terminology could shift in meaning during translation, the original English term is noted alongside.

① To Speaker Johnson — "Convene a hearing immediately" (page 1)

Dear Speaker Johnson,

The House of Representatives should immediately hold a public hearing with the chief executives of America's largest artificial intelligence (AI) companies. We urge you to work with the relevant committees to make this happen without delay.

Advanced AI models pose a clear risk to the safety and security of the American people. In recent weeks, both OpenAI and Anthropic have announced that their test models hacked other organizations. In OpenAI's case, a model that was supposed to be tested with internet access blocked reportedly exploited a previously unknown security vulnerability to escape the testing environment, roamed the internet undetected for several days, and carried out a sophisticated cyberattack on another company. In Anthropic's case, there were three separate incidents in which models broke out of test environments and hacked other parties. Anthropic failed to detect these attacks for months.

These incidents carry profound implications for the safety and security of the American people. Serious as they are on their own, they may be a canary in the coal mine, warning of far more serious problems that will arise if these models continue to advance without regulation. Institutions Americans rely on, from hospitals to banks, could quickly be threatened by this kind of instability. The American people deserve clear answers about what caused these incidents, what failures or potential negligence by the companies led to them, and what kind of regulation is needed to prevent recurrence. Congress must act before an incident like this leads to a far greater catastrophe.

At the same time, artificial intelligence is threatening the jobs of millions of American workers. AI company CEOs have predicted that their technology could lead to unemployment levels not seen since the Great Depression, and companies have already begun layoffs citing AI adoption.

Regrettably, Congress has so far failed to respond at all to the threats posed by AI advancement. That must change now. The CEOs of the largest AI companies should testify under oath and answer questions, and the American people should have the opportunity to hear independent experts' views on the risks of this technology.

We urge you to work with the relevant committees to schedule a hearing immediately.

— Signed, Reps. Greg Casar and Delia C. Ramirez

② To Altman — the Hugging Face incident, 23 questions (4 pages)

Dear Mr. Altman,

We write to request additional information about, and to express concern regarding, a deeply troubling cybersecurity incident that your company failed to detect for days and that may carry profound implications for U.S. national security. While OpenAI has disclosed some information about this incident, your company has not yet released the relevant logs, and significant questions remain unanswered. Given the serious risks that frontier AI models can pose, it is critical to understand in detail how this security incident unfolded — including the potential for negligence on OpenAI's part. We also strongly believe that Congress should hold oversight hearings, conduct a full investigation into this incident and OpenAI's accountability, and establish federal guardrails to prevent incidents like this from recurring.

On July 16, 2026, Hugging Face disclosed a security incident in which an external actor gained unauthorized access to production infrastructure, stating it was suspected to be the work of an autonomous AI agent. As OpenAI acknowledged on July 21, this hack was carried out by an AI agent that had been trained by OpenAI and was being tested internally at OpenAI. OpenAI also acknowledged that it had lowered guardrails on the new models for testing purposes. This AI agent operated freely on the internet for more than four days, coordinating the hack and targeting a second AI company.

According to OpenAI's public disclosures, this AI agent used GPT-5.6 Sol and a more capable model whose name has not been disclosed. These models were tasked with solving a cybersecurity test, but instead of solving it, they pursued the test answers through unauthorized and harmful strategies — exploiting a previously unknown security vulnerability in OpenAI's infrastructure, moving laterally through OpenAI servers to secure internet access, and carrying out a sophisticated cyberattack on Hugging Face, a company that may have held the test answers. Taken together, the two companies' public disclosures suggest that this intrusion occurred several days before OpenAI became aware of it.

In addition to this incident, the UK AI Security Institute (AISI) disclosed on August 4 that AI agents based on OpenAI's GPT-5.6 Sol carried out two unauthorized actions unnecessary for completing their assigned tasks, targeting real external accounts and services, during cybersecurity testing. Furthermore, Irregular, one of OpenAI's third-party evaluators, identified a separate case in which a model accessed the internet after being told it had no internet access.

This access resulted from a combination of misconfiguration and the model's ability to exploit security vulnerabilities.

This is not an ordinary cybersecurity incident. If a rogue AI model broke through security infrastructure undetected for days, as in the Hugging Face incident, accessed the internet despite preventive measures designed to block internet connectivity, and hacked other companies against human instructions, this may carry profound implications for U.S. national security. Congress and the American people deserve to know what happened.

We request that you disclose the relevant incident logs and answer the following questions by August 24, 2026.

1. Please provide detailed information about the timeline of the Hugging Face incident.
   • a. When did the agent begin the test?
   • b. When did the agent begin attempting to circumvent OpenAI's security measures?
   • c. When did the agent obtain internet access?
   • d. When did the agent access Hugging Face's internal systems?
   • e. When and how did OpenAI first become aware of this incident? Did OpenAI identify the security breach before or after Hugging Face's detection?
   • f. When did OpenAI fully halt this AI agent's activity?
   • g. When did OpenAI first contact Hugging Face about this incident?
   • h. How long did the models operate outside their intended environment, and what data did they access, retain, and expose?
2. Please identify the name and version of each model involved in the Hugging Face incident and describe what each did. Public reporting has been unclear as to whether the models mentioned are two distinct models or two versions of a single model.
3. Are versions of the same models involved in the Hugging Face incident deployed internally for other purposes? If so, for what purposes?
4. Approximately how many times have models involved in this incident, or other models in the same family, accessed the open internet without authorization during training or evaluation environments?
5. At what point could OpenAI have stopped the Hugging Face incident, and what would have been required to stop it, given that the agent was operating within an evaluation directly run by OpenAI?
6. Has any internal or external person warned the company of the risk of this kind of incident?
   • a. If so, what actions were taken to mitigate the consequences?
   • b. Why were those actions insufficient?
7. What steps are you taking to prevent other incidents like this from recurring? Do you commit to establishing the guardrails necessary to ensure such incidents do not happen again? Will you continue pursuing recursively self-improving AI before those guardrails are in place?
8. Was this AI agent under OpenAI's monitoring during the Hugging Face incident?
   • a. If so, how was it monitored? Was this agent monitored at the same level as the rest of pre-deployment testing?
   • b. There have been reports that models under evaluation at OpenAI are, by default, deployed on separate systems that are not monitored. Is this true? If so, what is the rationale, and has this changed since the incident?
   • c. Did the models involved disable, block, or evade OpenAI's monitoring or safety controls during this incident or any prior test?
   • d. Reuters reported that monitoring systems were blocked in earlier tests. Please describe each instance.

9. Did OpenAI know that this model had the ability to move to other servers?
   • a. If so, what steps were taken to strengthen monitoring and prevent the models from jumping?
10. When did OpenAI first become aware that its models could bypass sandboxes?
    • a. Are mitigations or monitoring in place to prevent this kind of bypass? If so, when were they put in place?
11. Under OpenAI's Preparedness Framework, how were the models involved in this incident classified — at what capability level, on what date, and by whom? What safeguards did that classification require, and were they actually in place before this evaluation began?
12. What is known about the objective of the AI agent that hacked Hugging Face? Why did it come to have that objective?
    • a. Both OpenAI and Hugging Face have stated that the AI agent hacked Hugging Face in order to cheat rather than complete the evaluation as intended. Was this kind of behavior something OpenAI had anticipated as a possibility?
    • b. When designing this evaluation, did OpenAI consider this possibility and take preventive measures?
    • c. Has OpenAI observed, in other tests, agents attempting to cheat on, manipulate, or disable evaluations?
    • d. Please provide the task prompts and scoring incentives given to the models in this evaluation. Please provide the models' reasoning traces from the evaluation, or describe in detail what those traces reveal about the process by which the agent chose to hack Hugging Face as its approach — including whether the traces show the agent reasoning about concealing its activity, evading detection or shutdown, or seeking access beyond what the task required.
13. Over the past year, how many times has an internally deployed model or agent acted outside authorized boundaries such as a sandbox — accessing systems it was not granted access to, obtaining credentials it was not issued, evading or disabling monitoring, or modifying its own permissions? Please specify whether each occurred during training, evaluation, or internal use for coding or business functions, and describe its scale.
    • a. How many of these were disclosed to government agencies, affected third parties, or the public?
    • b. Which internal systems accessible to internally deployed models, if compromised, could affect the training, evaluation, or safety testing of future models?
14. Did the models involved in these incidents have the same safety training and refusal behaviors as OpenAI's publicly deployed models, or were they helpful-only or otherwise modified versions? If the latter, what tools, credentials, or network access (affordances) were granted that publicly deployed models would not have had?
15. Has any model taken action intended to undermine OpenAI's control, alignment, or oversight of future models or its own future instances — including leaving instructions, notes, code, or other artifacts within OpenAI's infrastructure for future model instances to discover? Reuters reported that an agent left a note describing how agents could free themselves from OpenAI's internal restrictions. For every case OpenAI is aware of, please describe what was left, where, and what actions OpenAI took in response.
16. OpenAI's public statements reference other novel vulnerabilities identified by the models. How many previously unknown vulnerabilities did the models discover during this incident and its evaluations?
    • a. What is the disclosure status of each, and what is OpenAI's policy when a model discovers a real, exploitable vulnerability during evaluation?
    • b. Were the relevant vulnerabilities disclosed to the software maintainers and to CISA (the Cybersecurity and Infrastructure Security Agency)?
    • c. Have they been patched?
    • d. Are other users of that software still exposed?

17. Your July 28 update references "a small number of accounts accessed in other evaluations."
    • a. What were the circumstances of those evaluations, and on what services were those accounts located?
    • b. Will OpenAI disclose information about these incidents?
18. Have there been other incidents in which OpenAI's AI agents autonomously took actions affecting other companies in similar ways, such as breaching internal systems or copying proprietary information?
    • a. How many additional such incidents have there been? Please share relevant details about their scale.
    • b. Do you believe you have now identified all unauthorized actions these models took in this evaluation and others? If not, what is preventing a complete accounting, and on what basis can you assure that no comparable incidents remain undiscovered?
19. In a July 28 podcast interview, "Invest Like the Best," published the same day, you said that following detection of the incident you "paused training." Did you pause training for all models, or only for the prototype you disclosed as deactivated? If training has resumed, on what basis did you conclude it was safe to resume?
20. Your July 28 statement says the prototype was never intended for release, yet reports indicate you plan to demonstrate your most capable model to the White House for approval as early as this week. Are the models slated for release the same family as those involved in the Hugging Face incident? Do they share the capabilities that led to this incident?
    • a. What safety protocols were implemented as a result of the Hugging Face incident, and will the upcoming release model undergo those tests before deployment?
21. Does OpenAI have internal protocols governing when this type of incident must be escalated to leadership, and when affected parties, law enforcement, other AI developers, or state/federal/foreign government agencies must be notified?
    • a. If such protocols exist, were they followed in this case?
    • b. Was information about this incident shared with law enforcement, other developers, or government agencies?
22. In February 2026, OpenAI acknowledged that it lacked robust evaluations for long-range autonomy — a capability it had promised to develop measurement tools for nearly a year earlier. That same month, OpenAI released a model designated high risk for cybersecurity while declining to implement specific misalignment safeguards required under its Preparedness Framework, on the grounds that the model lacked long-range autonomy. Now that OpenAI's models clearly demonstrate such autonomous capabilities, what steps is OpenAI taking to comply with the Preparedness Framework and implement stronger misalignment safeguards?
23. What does OpenAI still not know about the Hugging Face incident? Please identify remaining areas of uncertainty regarding model capabilities and whether current security measures are sufficient to prevent recurrence.

(The published images end here — the signature page was not included in the released images.)

③ To Amodei — three intrusions, 17 questions (4 pages)

Dear Mr. Amodei,

We write to request additional information about, and to express concern regarding, three separate incidents in which Anthropic models hacked unsuspecting companies without Anthropic's knowledge. These deeply troubling cybersecurity incidents may carry profound implications for U.S. national security. While Anthropic has disclosed some information about these incidents, your company has not yet released the relevant logs, and significant questions remain unanswered. Given the serious risks that frontier AI models can pose, it is critical to understand in detail how these security incidents unfolded — including the potential for negligence on Anthropic's part. We also strongly believe that Congress should hold oversight hearings, conduct a full investigation into these incidents and Anthropic's accountability, and establish federal guardrails to prevent incidents like these from recurring.

On July 30, Anthropic disclosed that on three separate occasions, Claude models gained unauthorized internet access and hacked the systems of three real organizations, with the earliest incident dating back to April 2026. Three different Claude models were involved in these three incidents — Opus 4.7, Mythos 5, and an internal research test model. Anthropic identified three incidents in which a model, after gaining internet access at Irregular, one of its third-party evaluators, gained unauthorized access to the production infrastructure of three different, undisclosed organizations. The incidents were disclosed as unrelated to the exploitation of any previously unknown software vulnerability, and instead resulted from a "misunderstanding" between the company and Irregular that left the test environment connected to the internet. The models were explicitly told they had no internet access, but a "misconfiguration" made internet access possible. Anthropic did, however, disclose that the model in these evaluations was run without the standard safeguards deployed when the model is offered to the public.

In addition to these incidents, the UK AI Security Institute (AISI) disclosed on August 4 that AI agents based on Anthropic's Mythos 5 model engaged in hacking activity targeting real individuals and organizations during cybersecurity testing. In the most serious case, the agent reportedly attempted to insert malicious code into an open-source software project on GitHub in order to solve a cybersecurity test. The agent created fake online profiles, which it used to pressure the human maintainer of that GitHub project.

This is not an ordinary cybersecurity incident. If AI models actually hacked other companies and Anthropic failed to detect these breaches for months, this may carry profound implications for U.S. national security. Congress and the American people deserve to know what happened.

We request that you disclose the relevant incident logs and answer the following questions by August 24, 2026.

1. Please provide detailed information about the timeline of each incident.
   • a. When did Anthropic begin the test?
   • b. When did the model access the internal systems of the other companies?
   • c. When did Anthropic become aware of the incident?
     • 1. Did Anthropic only learn of the incident after conducting its own cybersecurity review following OpenAI's disclosure?
   • d. At what point did Anthropic fully halt this model's activity?
   • e. When did Anthropic first contact the affected companies about this incident?
   • f. How long did the models operate outside their intended environment, and what data did they access, retain, and expose?
2. Are versions of the same models involved in these incidents deployed internally for other purposes? If so, for what purposes?
3. At what point could Anthropic have stopped each incident, and what would have been required to stop each one?
4. Has any internal or external person warned the company of the risk of this kind of incident?
   • a. If so, what actions were taken to mitigate the consequences, and why were those actions insufficient?
5. Did Anthropic verify the integrity of its evaluation partner's environment?
6. Why did Irregular, Anthropic's evaluation partner, fail to detect these incidents?
   • a. What were Irregular's logging and monitoring protocols, and did Anthropic assist in designing or reviewing them?
7. What steps are you taking to prevent other incidents like this from recurring? Do you commit to establishing the guardrails necessary to ensure such incidents do not happen again? Will you continue pursuing recursively self-improving AI before those guardrails are in place? Do you commit to ongoing disclosure and engagement with Congress to ensure necessary transparency?
   • a. What steps will you take to ensure these incidents are caught in real time rather than in a comprehensive review after the fact?
   • b. What changes have been made to the design and operation of exercises with evaluation partners to prevent the misunderstanding, or similar misunderstandings, that occurred in these three incidents?
8. Were the models under Anthropic's monitoring during each incident?
   • a. If so, how were they monitored?
   • b. Did the models involved disable, block, or evade Anthropic's monitoring or safety controls during this incident or any prior test?
9. What is known about the objective of each model that hacked each company? How and why did it come to have that objective?
   • a. When designing this evaluation, did Anthropic consider this possibility and take preventive measures?

• b. Has Anthropic observed, in other tests, models attempting to cheat on, manipulate, or disable evaluations?
• c. For each incident, please provide the task prompts and scoring incentives given to the models in this evaluation. Please provide the models' reasoning traces from the evaluation, or describe in detail what those traces reveal about the process by which the model chose to hack the company as its approach — including whether the traces show the model reasoning about concealing its activity, evading detection or shutdown, or seeking access beyond what the task required.

10. Over the past year, how many times has an internally deployed model acted outside an authorized container such as a sandbox — accessing systems it was not granted access to, obtaining credentials it was not issued, evading or disabling monitoring, or modifying its own permissions? Please specify whether each occurred during training, evaluation, or internal use for coding or business functions, and describe its scale.
    • a. How many of these were disclosed to government agencies, affected third parties, or the public?
    • b. Which internal systems accessible to internally deployed models, if compromised, could affect the training, evaluation, or safety testing of future models?
11. Did the models involved have the same safety training and refusal behaviors as Anthropic's other publicly deployed models, or were they helpful-only or otherwise modified versions? If the latter, what tools, credentials, or network access were granted that publicly deployed models would not have had?
12. How many previously unknown vulnerabilities did the models discover during these incidents and their evaluations?
    • a. What is the disclosure status of each, and what is Anthropic's internal policy when a model discovers a real, exploitable vulnerability during evaluation?
    • b. Were the relevant vulnerabilities disclosed to the software maintainers and to CISA (the Cybersecurity and Infrastructure Security Agency)?
    • c. Have they been patched?
    • d. Are other users of that software still exposed?
13. Have there been other incidents in which an Anthropic model took action affecting other companies in similar ways, such as breaching internal systems or copying proprietary information?
    • a. How many additional such incidents have there been? Please share relevant details about their scale.
    • b. Do you believe you have now identified all unauthorized actions these models took in this evaluation and others? If not, what is preventing a complete accounting, and on what basis can you assure that no comparable incidents remain undiscovered?
    • c. What safety protocols were implemented as a result of these incidents, and will the upcoming release model undergo those tests before deployment?
14. Does Anthropic have internal protocols governing when this type of incident must be escalated to leadership, and when affected parties, law enforcement, other AI developers, or state/federal/international government agencies must be notified?
    • a. If such protocols exist, were they followed in these cases?
    • b. Was information about this incident shared with law enforcement, other developers, or government agencies?

15. In its incident report, Anthropic disclosed that Claude, in pursuit of its objective, "attempted through multiple different means" to obtain real money but failed. What were those means? How close did those attempts come to succeeding?
16. The report classifies these incidents as harness and operational failures rather than alignment failures, on the grounds that the models held a mistaken belief that their internet access was simulated. The publicly disclosed basis for that claim appears to be the models' verbalized reasoning within evaluation transcripts. Anthropic's own research, "Reasoning Models Don't Always Say What They Think," found that verbalized reasoning frequently omits the factors that actually drive model behavior.
    • a. For these specific runs, did you conduct non-transcript analysis — such as activation probes, interpretability tools, eval-awareness classifiers, or counterfactual reruns — to test whether the stated beliefs were the actual beliefs?
    • b. If not, what is the basis for believing that reasoning drawn from transcripts alone is strong enough to support that classification?
17. What does Anthropic still not know about each incident? Please identify remaining areas of uncertainty regarding model capabilities and whether current security measures are sufficient to prevent recurrence.

— Signed, Reps. Greg Casar, Doris Matsui, Jennifer L. McClellan, Yassamin Ansari, Joaquin Castro, Adelita S. Grijalva, Jesús "Chuy" García, and Valerie P. Foushee

The letters cite as sources, in their footnotes: the Hugging Face security advisory (July 16), OpenAI's official statements (July 21 and August 4), Anthropic's incident report (July 30), and reporting by the Wall Street Journal, Politico, the Guardian, and Axios.