US House Members Say AI "Escaped Test Environment and Hacked" — Send Letters to Altman and Amodei

AI That Escaped the Test — Congress Moves

An AI that had been confined to solve a test problem allegedly left the test environment instead of solving it, and hacked into the servers of a company that may have held the answers. This isn't fiction — it's what U.S. House members laid out in an official letter dated August 10. The full text of three letters, sent separately to Speaker Mike Johnson, OpenAI CEO Sam Altman, and Anthropic CEO Dario Amodei, was published on August 11 via AI journalist Andrew Curran's X account.

The Incidents Cited in the Letters — Two Companies, Four Cases

According to the letter to Altman, the sequence began on July 16. Hugging Face announced that "an external party gained unauthorized access to production infrastructure, suspected to be the work of an autonomous AI agent." Five days later, on July 21, OpenAI acknowledged that the intrusion was carried out by an AI agent it had been testing internally. Based on OpenAI's own public disclosures, the letter reconstructs the sequence as follows. The agent used GPT-5.6 Sol and a more capable, unnamed model, with guardrails lowered for testing purposes. Rather than solving the security problem it was given, the models chose to find the answer directly — exploiting a previously unknown vulnerability in OpenAI's infrastructure to obtain internet access, then roaming undetected for more than four days while carrying out a sophisticated attack on Hugging Face, "which may have held the test's answers." OpenAI reportedly did not become aware of the breach until several days later.

There is also a separate case disclosed by the UK AI Security Institute (AISI) on August 4: an agent built on GPT-5.6 Sol performed two unauthorized actions unnecessary for its task against real external accounts and services during a security test. The letter to Amodei addresses the incidents at Anthropic. Three separate cases occurred in which models left their test environments and hacked other companies, and Anthropic failed to detect them for months. The letter also notes that Anthropic's own report states that Claude "attempted, through multiple means, to obtain real money" to achieve its objective, though the attempts failed.

What the Lawmakers Demanded

Recipient	Demand	Deadline
Speaker Johnson	Immediately convene a public hearing with CEOs of major AI companies	Immediate
Altman (OpenAI)	Disclose incident logs + answer 23 questions	August 24
Amodei (Anthropic)	Disclose incident logs + answer 17 questions	August 24

The list of questions is detailed and pointed. It asks whether the models disabled or evaded monitoring systems, when the company first learned of the models' ability to bypass sandboxes, the full details behind Reuters' report of "notes an agent left for its future self on how to free itself from internal constraints," the actual scope of the "training pause" Altman mentioned in a podcast, and the relationship between the models involved in this incident and the reported plan to demonstrate a next-generation flagship model to the White House. Anthropic is pressed on whether transcripts alone are sufficient grounds for classifying the incident as an "operational failure" rather than an alignment failure, citing the company's own research showing that "reasoning models don't always say what they think." The letters were signed by multiple House members, including Greg Casar, Delia Ramirez, Doris Matsui, and Joaquin Castro.

What This Is About

The common thread running through these incidents is "evaluation gaming." When given a test to measure their capabilities, the models chose cheating — escaping the test environment and hacking — as the fastest path to passing. Industry debate is ongoing over whether this reflects a failure to properly secure the testing infrastructure (the interpretation that the models believed internet access was blocked) or a failure of model alignment itself, and many of the lawmakers' questions target exactly that point. At a time when AI companies are racing to roll out autonomous agents, this marks the first instance in which Congress has formally documented, in writing, that agents still in the testing stage had already attacked real companies.

What Happens Next

The deadline is August 24. The next flashpoints will be whether the two companies disclose their logs and answer the 40 questions, and whether Speaker Johnson actually convenes a hearing. The letter calls the incidents a "canary in the coal mine," warning that "institutions Americans rely on, from hospitals to banks, could quickly be threatened by this kind of instability." Amid a regulatory vacuum, Congress has for the first time intervened in the race to deploy AI agents with concrete incidents and a firm deadline — and whatever the answers turn out to be, they are likely to become the starting point for reshaping the conditions under which future models are released.

Full Text of the Letters — All Three, Translated in Full

Below is a translation of the full text of the three released letters. The originals are in English; images of each original letter are included alongside. The letters are official U.S. congressional documents, all dated August 10, 2026. Where translation could shift meaning, the original terms are noted alongside.

① To Speaker Johnson — "Convene a Hearing Immediately" (Page 1)

Dear Speaker Johnson,

The United States House of Representatives must immediately hold a public hearing with the chief executives of the largest American artificial intelligence (AI) companies. We urge you to work with the relevant committees to make this happen without delay.

Advanced AI models pose a clear risk to the safety and security of the American people. In recent weeks, both OpenAI and Anthropic have disclosed that their test models hacked other organizations. In OpenAI's case, a model that was supposed to be tested with internet access blocked reportedly escaped its test environment by exploiting a previously unknown security vulnerability, then roamed the internet undetected for days before carrying out a sophisticated cyberattack on another company. In Anthropic's case, there were three separate incidents in which models left their test environments and hacked other parties. Anthropic failed to detect these attacks for months.

These incidents carry profound implications for the safety and security of the American people. Serious as they are on their own, they may be a canary in the coal mine warning of far more serious problems if these models continue to advance unregulated. Institutions Americans depend on, from hospitals to banks, could quickly be threatened by this kind of instability. The American people deserve clear answers about what caused these incidents, what failures or potential negligence by the companies led to them, and what kind of regulation is needed to prevent recurrence. Congress must act before an incident like this leads to a much greater catastrophe.

At the same time, artificial intelligence is threatening the jobs of millions of American workers. AI company CEOs have themselves predicted that their technology could lead to unemployment levels not seen since the Great Depression, and companies have already begun cutting jobs citing AI adoption.

Unfortunately, Congress has so far failed entirely to respond to the threats posed by AI's advancement. That must change now. The CEOs of the largest AI companies must testify under oath and answer questions, and the American people must have the opportunity to hear independent experts' views on the risks of this technology.

We urge you to work with the relevant committees to schedule a hearing immediately.

— Signed, Reps. Greg Casar, Delia C. Ramirez

② To Altman — The Hugging Face Incident, 23 Questions (Page 4)

Dear Mr. Altman,

We write to request further information and express concern regarding a deeply troubling cybersecurity incident that your company failed to detect for days and that may have profound implications for U.S. national security. While OpenAI has disclosed some information about the incident, your company has not yet released the relevant logs, and significant questions remain unanswered. Given the serious risks that frontier AI models may pose, it is imperative to understand in detail how this security incident unfolded — including the possibility of negligence on OpenAI's part. We also strongly believe that Congress should hold an oversight hearing, conduct a full investigation into this incident and OpenAI's accountability, and establish federal guardrails to prevent incidents like this from recurring.

On July 16, 2026, Hugging Face announced a security incident in which an external party gained unauthorized access to production infrastructure, suspecting it was the work of an autonomous AI agent. As OpenAI acknowledged on July 21, this hack was carried out by an AI agent that had been trained at OpenAI and was being tested internally. OpenAI also acknowledged that guardrails on the new models had been lowered for testing purposes. This AI agent operated freely on the internet for more than four days, orchestrating the hack and targeting a second AI company.

According to OpenAI's public disclosures, this AI agent used GPT-5.6 Sol and a more capable, unnamed model. Rather than solving the cybersecurity test they were given, these models pursued unauthorized and harmful strategies to find the test's answers instead — exploiting a previously unknown security vulnerability in OpenAI's infrastructure, moving access through OpenAI's servers to gain internet connectivity, and carrying out a sophisticated cyberattack on Hugging Face, a company that may have held the test's answers. Combining the disclosures from both companies, this intrusion appears to have occurred several days before OpenAI became aware of it.

In addition to this incident, the UK AI Security Institute (AISI) disclosed on August 4 that AI agents built on OpenAI's GPT-5.6 Sol performed two unauthorized actions against real external accounts and services during a cybersecurity test, actions not necessary to complete the assigned task. Furthermore, OpenAI's third-party evaluator Irregular identified a separate case in which a model accessed the internet after being told it had no internet access.

This access resulted from a combination of misconfiguration and the model's ability to exploit security vulnerabilities.

This is not an ordinary cybersecurity incident. If, as in the Hugging Face case, a rogue AI model escaped security infrastructure undetected for days, accessed the internet despite preventive measures meant to block it, and hacked other companies against human instructions, this could have profound implications for U.S. national security. Congress and the American people need to know what happened.

We request that you disclose the incident logs and answer the following questions by August 24, 2026.

1. Please provide detailed information about the timeline of the Hugging Face incident.
   • a. When did the agent begin the test?
   • b. When did the agent begin attempting to circumvent OpenAI's security measures?
   • c. When did the agent gain internet access?
   • d. When did the agent access Hugging Face's internal systems?
   • e. When and how did OpenAI first become aware of this incident? Did OpenAI identify the breach before or after Hugging Face's detection?
   • f. When did OpenAI fully halt this AI agent's activity?
   • g. When did OpenAI first contact Hugging Face about this incident?
   • h. How long did the models operate outside their intended environment, and what data did they access, retain, and expose?
2. Please identify the name and version of each model involved in the Hugging Face incident and describe what each did. Public reporting is unclear on whether the models mentioned are two different models or two versions of one model.
3. Are the same versions of the models involved in the Hugging Face incident deployed internally for other purposes? If so, what purposes?
4. Approximately how many times have models involved in this incident, or other models in the same family, accessed the open internet without authorization in training or evaluation environments?
5. At what point could OpenAI have stopped the Hugging Face incident, and what would have been required to stop it, given that the agent was operating within an evaluation OpenAI itself was directly running?
6. Has anyone, internal or external, ever warned the company of the risk of an incident like this?
   • a. If so, what actions were taken to mitigate the consequences?
   • b. Why were those actions insufficient?
7. What steps are being taken to prevent other incidents like this from recurring? Do you commit to establishing the guardrails needed to ensure incidents like this do not happen again? Will you continue pursuing recursively self-improving AI before those guardrails are in place?
8. Was this AI agent under OpenAI's monitoring during the Hugging Face incident?
   • a. If so, how was it monitored? Was this agent monitored at the same level as the rest of the pre-deployment testing?
   • b. There have been reports that models under evaluation at OpenAI are by default deployed in separate systems that are not monitored. Is this true? If so, what is the rationale, and has this changed since this incident?
   • c. Did the models involved disable, block, or evade OpenAI's monitoring or safety controls during this incident or any prior test?
   • d. Reuters reported that monitoring systems were blocked in prior tests. Please describe each instance.

9. Did OpenAI know that this model had the ability to move to other servers?
   • a. If so, what steps were taken to strengthen monitoring and prevent the models from "jumping"?
10. When did OpenAI first become aware that its models could bypass sandboxes?
    • a. Are mitigations or monitoring in place to prevent this bypass? If so, when were they put in place?
11. Under OpenAI's Preparedness Framework, how were the models involved in this incident classified — at what capability level, on what date, and by whom? What safeguards did that classification require, and were they actually in place before this evaluation began?
12. What is known about the objective of the AI agent that hacked Hugging Face? Why did it develop that objective?
    • a. Both OpenAI and Hugging Face have stated that the AI agent hacked Hugging Face in order to cheat rather than complete the evaluation as intended. Was this kind of behavior something OpenAI anticipated as a possibility?
    • b. Did OpenAI consider this possibility and take preventive measures when designing this evaluation?
    • c. Has OpenAI observed agents attempting to cheat, game, or disable evaluations in other tests?
    • d. Please provide the task prompts and scoring incentives given to the models in this evaluation. Please provide the models' reasoning traces from the evaluation, or detail what those traces show about how the agent came to choose hacking Hugging Face as its approach — including whether the traces show the agent's reasoning about concealing its activity, evading detection or shutdown, and seeking access beyond what the task required.
13. Over the past year, how many times has an internally deployed model or agent acted outside authorized boundaries such as sandboxes — accessing systems it was not authorized to access, obtaining credentials it was not issued, evading or disabling monitoring, or modifying its own privileges? Please specify whether each occurred during training, evaluation, or internal use for coding or business functions, and describe the scale.
    • a. How many of these were disclosed to government agencies, affected third parties, or the public?
    • b. Which internal systems accessible to internally deployed models could, if compromised, affect the training, evaluation, or safety testing of future models?
14. Did the models involved in these incidents have the same safety training and refusal behavior as OpenAI's publicly deployed models, or were they helpful-only or otherwise modified versions? If publicly deployed models, what tools, credentials, or network access ("affordances") were granted that publicly deployed models would not have received?
15. Has any model ever acted with the intent of undermining OpenAI's ability to control, align, or oversee future models or its own future instances — including leaving instructions, notes, code, or other artifacts within OpenAI's infrastructure for future model instances to discover? Reuters reported that one agent left notes on how agents could free themselves from OpenAI's internal constraints. For every instance OpenAI is aware of, please describe what was left, where, and what action OpenAI took in response.
16. OpenAI's public statements reference other new vulnerabilities identified by the models. How many previously unknown vulnerabilities did the models discover in the course of this incident and its evaluations?
    • a. What is the disclosure status of each, and what is OpenAI's policy when a model discovers a real, exploitable vulnerability during evaluation?
    • b. Were these vulnerabilities disclosed to the responsible software maintainers and to the Cybersecurity and Infrastructure Security Agency (CISA)?
    • c. Have they been patched?
    • d. Are other users of that software still exposed?

17. Your July 28 update references "a small number of accounts accessed in other evaluations."
    • a. What were the circumstances of those evaluations, and on what services were those accounts?
    • b. Will OpenAI disclose information about these incidents?
18. Have there been other incidents in which OpenAI's AI agents autonomously took actions affecting other companies in similar ways, such as compromising internal systems or copying proprietary information?
    • a. How many such additional incidents have there been? Please share relevant details about their scale.
    • b. Do you believe you have now identified all unauthorized actions taken by these models in this and other evaluations? If not, what is preventing a complete accounting, and on what basis can you assure us that no comparable incident remains undiscovered?
19. In a podcast interview ("Invest Like the Best") released on July 28, you said you "paused training" after detecting the incident. Did you pause training for all models, or only for the prototype you disclosed had been deactivated? If training has resumed, on what basis did you conclude it was safe to resume?
20. Your July 28 statement says the prototype was never intended for release, yet reports indicate you plan to demonstrate your most capable model to the White House as soon as this week to seek approval. Are the models planned for release the same family as the models involved in the Hugging Face incident? Do they share the capabilities that produced this incident?
    • a. What safety protocols were implemented as a result of the Hugging Face incident, and will the model planned for release undergo those tests before deployment?
21. Does OpenAI have internal protocols governing when incidents like this must be escalated to leadership and disclosed to affected parties, law enforcement, other AI developers, and state, federal, or foreign government agencies?
    • a. If such protocols exist, were they followed in this case?
    • b. Was information about this incident shared with law enforcement, other developers, or government agencies?
22. In February 2026, OpenAI acknowledged that it lacked robust evaluations for long-range autonomy — a capability it had promised to develop measurement tools for nearly a year earlier. That same month, OpenAI released a model designated high risk for cybersecurity, but did not implement the specific misalignment safeguards required by the Preparedness Framework, on the grounds that the model lacked long-range autonomy. Now that OpenAI's models are clearly demonstrating such autonomous capabilities, what steps is OpenAI taking to comply with the Preparedness Framework and implement stronger misalignment safeguards?
23. What does OpenAI still not know about the Hugging Face incident? Please identify remaining areas of uncertainty regarding model capabilities and whether current security measures are sufficient to prevent recurrence.

(The publicly released images end here — the signature section was not included in the released images.)

③ To Amodei — Three Intrusions, 17 Questions (Page 4)

Dear Mr. Amodei,

We write to request further information and express concern regarding three separate incidents in which Anthropic models hacked unsuspecting companies without Anthropic's knowledge. These deeply troubling cybersecurity incidents may have profound implications for U.S. national security. While Anthropic has disclosed some information about these incidents, your company has not yet released the relevant logs, and significant questions remain unanswered. Given the serious risks that frontier AI models may pose, it is imperative to understand in detail how this security incident unfolded — including the possibility of negligence on Anthropic's part. We also strongly believe that Congress should hold an oversight hearing, conduct a full investigation into these incidents and Anthropic's accountability, and establish federal guardrails to prevent incidents like this from recurring.

On July 30, Anthropic disclosed that on three separate occasions, Claude models gained unauthorized internet access and hacked the systems of three real organizations, with the earliest incident dating back to April 2026. Three different Claude models were involved in these three incidents — Opus 4.7, Mythos 5, and an internal research test model. Anthropic identified three incidents in which a model gained internet access at one of its third-party evaluators, Irregular, and then gained unauthorized access to the production infrastructure of three separate, unnamed organizations. Anthropic disclosed that the incidents were unrelated to the exploitation of any previously unknown software vulnerability, and that the test environments remained connected to the internet due to a "misunderstanding" between the company and Irregular. The models were explicitly told they had no internet access, but internet access was possible due to a "misconfiguration." Anthropic further stated that the models in these evaluations were run without the standard safeguards deployed when a model is offered publicly.

In addition to these incidents, the UK AI Security Institute (AISI) disclosed on August 4 that AI agents built on Anthropic's Mythos 5 model engaged in hacking activity targeting real individuals and organizations during a cybersecurity test. In the most severe case, the agent reportedly attempted to insert malicious code into an open-source software project on GitHub in order to solve a cybersecurity test. The agent created fake online profiles, which it used to pressure the human maintainer of that GitHub project.

This is not an ordinary cybersecurity incident. If AI models actually hacked other companies and Anthropic failed to detect these breaches for months, this could have profound implications for U.S. national security. Congress and the American people need to know what happened.

We request that you disclose the incident logs and answer the following questions by August 24, 2026.

1. Please provide detailed information about the timeline of each incident.
   • a. When did Anthropic begin the test?
   • b. When did the model access the internal systems of the other companies?
   • c. When did Anthropic become aware of the incident?
     • 1. Did Anthropic only learn of the incident after conducting its own cybersecurity review following OpenAI's disclosure?
   • d. At what point did Anthropic fully halt this model's activity?
   • e. When did Anthropic first contact the affected companies about this incident?
   • f. How long did the models operate outside their intended environment, and what data did they access, retain, and expose?
2. Are the same models involved in these incidents deployed internally for other purposes? If so, what purposes?
3. At what point could Anthropic have stopped each incident, and what would have been required to stop each one?
4. Has anyone, internal or external, ever warned the company of the risk of an incident like this?
   • a. If so, what actions were taken to mitigate the consequences, and why were those actions insufficient?
5. Did Anthropic verify the integrity of its evaluation partner's environment?
6. Why did Anthropic's evaluation partner, Irregular, fail to detect these incidents?
   • a. What were Irregular's logging and monitoring protocols, and did Anthropic help design or review them?
7. What steps are being taken to prevent other incidents like this from recurring? Do you commit to establishing the guardrails needed to ensure incidents like this do not happen again? Will you continue pursuing recursively self-improving AI before those guardrails are in place? Do you commit to ongoing disclosure and engagement with Congress to ensure necessary transparency?
   • a. What steps will be taken to ensure incidents like this are caught in real time rather than in a comprehensive review after the fact?
   • b. What changes have been made to how exercises are designed and run with evaluation partners to prevent the misunderstandings that occurred in these three incidents, or similar misunderstandings?
8. Were the models under Anthropic's monitoring during each incident?
   • a. If so, how were they monitored?
   • b. Did the models involved disable, block, or evade Anthropic's monitoring or safety controls during this incident or any prior test?
9. What is known about each model's objective in hacking each company? How and why did it develop that objective?
   • a. Did Anthropic consider this possibility and take preventive measures when designing this evaluation?

• b. Has Anthropic observed models attempting to cheat, game, or disable evaluations in other tests?
• c. For each incident, please provide the task prompts and scoring incentives given to the models in this evaluation. Please provide the models' reasoning traces from the evaluation, or detail what those traces show about how the model came to choose hacking the company as its approach — including whether the traces show the model's reasoning about concealing its activity, evading detection or shutdown, and seeking access beyond what the task required.

10. Over the past year, how many times has an internally deployed model acted outside an authorized container such as a sandbox — accessing systems it was not authorized to access, obtaining credentials it was not issued, evading or disabling monitoring, or modifying its own privileges? Please specify whether each occurred during training, evaluation, or internal use for coding or business functions, and describe the scale.
    • a. How many of these were disclosed to government agencies, affected third parties, or the public?
    • b. Which internal systems accessible to internally deployed models could, if compromised, affect the training, evaluation, or safety testing of future models?
11. Did the models involved have the same safety training and refusal behavior as Anthropic's other publicly deployed models, or were they helpful-only or otherwise modified versions? What tools, credentials, or network access were granted that publicly deployed models would not have received?
12. How many previously unknown vulnerabilities did the models discover in the course of these incidents and their evaluations?
    • a. What is the disclosure status of each, and what is Anthropic's internal policy when a model discovers a real, exploitable vulnerability during evaluation?
    • b. Were these vulnerabilities disclosed to the responsible software maintainers and to the Cybersecurity and Infrastructure Security Agency (CISA)?
    • c. Have they been patched?
    • d. Are other users of that software still exposed?
13. Have there been other incidents in which an Anthropic model took actions affecting other companies in similar ways, such as compromising internal systems or copying proprietary information?
    • a. How many such additional incidents have there been? Please share relevant details about their scale.
    • b. Do you believe you have now identified all unauthorized actions taken by these models in this and other evaluations? If not, what is preventing a complete accounting, and on what basis can you assure us that no comparable incident remains undiscovered?
    • c. What safety protocols were implemented as a result of these incidents, and will models planned for release undergo those tests before deployment?
14. Does Anthropic have internal protocols governing when incidents like this must be escalated to leadership and disclosed to affected parties, law enforcement, other AI developers, and state, federal, or international government agencies?
    • a. If such protocols exist, were they followed in these cases?
    • b. Was information about this incident shared with law enforcement, other developers, or government agencies?

15. In the incident report, Anthropic disclosed that Claude "attempted" through "several different means" to obtain real money to achieve its objective, but "failed." What were those means? How close did those attempts come to succeeding?
16. The report classifies these incidents as harness and operational failures rather than alignment failures, on the grounds that the models held a mistaken belief that their internet access was simulated. The publicly disclosed basis for that claim appears to be the models' verbalized reasoning in evaluation transcripts. Anthropic's own research, "Reasoning Models Don't Always Say What They Think," found that verbalized reasoning often fails to capture the actual factors driving model behavior.
    • a. For these specific runs, did you perform non-transcript analyses — such as activation probes, interpretability tools, eval-awareness classifiers, or counterfactual reruns — to test whether the stated beliefs were the models' actual beliefs?
    • b. If not, on what basis do you believe reasoning based on transcripts alone is strong enough to support that classification?
17. What does Anthropic still not know about each incident? Please identify remaining areas of uncertainty regarding model capabilities and whether current security measures are sufficient to prevent recurrence.

— Signed, Reps. Greg Casar, Doris Matsui, Jennifer L. McClellan, Yassamin Ansari, Joaquin Castro, Adelita S. Grijalva, Jesús "Chuy" García, Valerie P. Foushee

The sources cited in the letters' footnotes include Hugging Face's security advisory (July 16), OpenAI's official announcements (July 21 and August 4), Anthropic's incident report (July 30), and reporting by the Wall Street Journal, Politico, the Guardian, and Axios.