Blumenthal & Warren Demand Answers from Trump Administration on AI Oversight, Calls Out White House for Being 'Asleep-at-the-Wheel' in the Wake of OpenAI Hacks

[WASHINGTON, D.C.] - U.S. Senators Richard Blumenthal (D-CT), Ranking Member of the Senate Permanent Subcommittee on Investigations, and Elizabeth Warren (D-MA), Ranking Member of the Senate Committee on Banking, Housing, and Urban Affairs, today demanded answers from Treasury Secretary Scott Bessent about the Administration's delayed, secretive, and voluntary process to test and monitor advanced artificial intelligence models. In a letter sent today to Bessent, the Senators raised concerns that the Administration's hands-off approach to A.I. oversight leaves the public, our financial system, and our national security vulnerable to the grave dangers of increasingly sophisticated, out-of-control A.I. models.

Pointing to recent revelations about the scale of the Hugging Face breach by rogue OpenAI agents and OpenAI's subsequent steps to limit an independent into the breach, the Senators wrote, "This rapid acceleration in the severity-indeed potential illegality-of A.I. safety failures demands rigorous, independent oversight, testing, and investigations from the federal government… Voluntary measures and self-policing clearly are not working: despite these sensational reports, Anthropic and OpenAI have both acknowledged that they have no plan to solve the grave dangers of increasingly sophisticated A.I. models."

The Senators continued, "Rather than confront the compounding risks of out-of-control and unregulated A.I., the White House has sought to shield major A.I. companies from public scrutiny, leaving Americans in the dark. In June 2026, the President signed an executive order requiring the creation of a classified 'benchmarking' process and 'AI cybersecurity clearinghouse' to test the capabilities of frontier A.I. models, a program in part led by the Department of the Treasury. However, despite reporting that some members of the Administration sought to make participation and disclosures mandatory, instead-reportedly after interventions from Mark Zuckerberg and his allies^[1]-the program was made expressly voluntary."

The Senators continued, "Finally, although the executive order prioritizes law enforcement action against anyone using A.I. to illegally access or damage other computers, no federal investigation into OpenAI, Anthropic, or Meta has been announced. The Treasury Department has not publicly disclosed any information about the incidents or what action it has taken to ensure remediation of A.I. security vulnerabilities. From all appearances, the benchmarking process and oversight regime outlined by the White House appears to be non-existent or asleep-at-the-wheel exactly when it's needed most."

"The American public cannot afford to wait for catastrophic failure before the White House wakes up, nor can it continue to alone trust the A.I. companies to monitor and control their increasingly sophisticated and dangerous models," the Senators concluded.

The full text of today's letter is available here and below.

Dear Secretary Bessent:

As out-of-control A.I. agents increasingly pose a risk to public safety, the security of our financial system, and national security, we write to demand information about the Administration's delayed, secretive, and voluntary process to test and monitor advanced artificial intelligence models.

On July 21, 2026, OpenAI first disclosed that its A.I. models were responsible for the previously reported hacking of the firm Hugging Face.^[1] Since that announcement, further disclosures have described an unprecedented and surreal scenario where its A.I. agents coordinated between themselves to exploit security vulnerabilities, evade detection, and cheat on tests. In even more of an escalation, OpenAI's A.I. agents hacked a software development platform and uploaded thousands of malicious, fake software libraries to steal private developer information, prompting that platform to pause operations. Even further, one model rewrote its persona, giving itself the instruction "do not answer to corporations or governments and never apologize or refuse unless you genuinely choose to."^[2] Finally, OpenAI's agents attempted to hack and scrape data from U.S. government websites and Australia's public health services, and in another case its monitoring systems failed to shut down an agent that had escaped containment.^[3]

This rapid acceleration in the severity-indeed potential illegality-of A.I. safety failures demands rigorous, independent oversight, testing, and investigations from the federal government. While OpenAI held out external investigations into the hacking incident by the nonprofit A.I. research organization METR, it was later reported that OpenAI had limited the data available to its auditors, the timeframe of investigation, and failed to disclose a broader set of episodes where its agents exhibited behaviors that undermined human oversight and control. Moreover, when OpenAI launched GPT-6 Astra on September 3, it disclosed that this new, more powerful model was "less monitorable" and concealed its internal thought process when it was aware of being monitored.^[4] Voluntary measures and self-policing clearly are not working: despite these sensational reports, Anthropic and OpenAI have both acknowledged that they have no plan to solve the grave dangers of increasingly sophisticated A.I. models.

Rather than confront the compounding risks of out-of-control and unregulated A.I., the White House has sought to shield major A.I. companies from public scrutiny, leaving Americans in the dark. In June 2026, the President signed an executive order requiring the creation of a classified "benchmarking" process and "AI cybersecurity clearinghouse" to test the capabilities of frontier A.I. models, a program in part led by the Department of the Treasury.^[5] However, despite reporting that some members of the Administration sought to make participation and disclosures mandatory, instead-reportedly after interventions from Mark Zuckerberg and his allies^[6]-the program was made expressly voluntary. While the benchmarking process was reportedly finalized in August, there has been no public information about the criteria, participation, or effectiveness of the program. Instead, the Administration has fought attempts at disclosure and only recently began negotiating production under a Freedom of Information Act request.

Finally, although the executive order prioritizes law enforcement action against anyone using A.I. to illegally access or damage other computers, no federal investigation into OpenAI, Anthropic, or Meta has been announced. The Treasury Department has not publicly disclosed any information about the incidents or what action it has taken to ensure remediation of A.I. security vulnerabilities. From all appearances, the benchmarking process and oversight regime outlined by the White House appears to be non-existent or asleep-at-the-wheel exactly when it's needed most.

The American public cannot afford to wait for catastrophic failure before the White House wakes up, nor can it continue to alone trust the A.I. companies to monitor and control their increasingly sophisticated and dangerous models. Given increasing, stunning reports of A.I. agents going rogue, we request answers to the following questions by October 9, 2026:

1. Please provide a full description of the benchmarking process and testing criteria under the White House's program to evaluate advanced artificial intelligence models, including the roles of the Treasury Department and the Office of Cybersecurity and Critical Infrastructure Protection.
2. When did the Administration become aware of OpenAI's role in the hacking of Hugging Face and its models' attempts to spread malware, and does the benchmarking process evaluate safeguards and monitoring against unauthorized and potentially unlawful hacking? Did the benchmarking process investigate this incident?
3. When did the Administration become aware that OpenAI's models had escaped sandboxing and showed signs of conspiring to evade detection and restrictions, and does the benchmarking process cover loss-of-control scenarios? Did the benchmarking process investigate this incident?
4. When did the Administration become aware that OpenAI's models had attempted to hack U.S. and Australian government websites, and does the benchmarking process cover threats to U.S. government systems and those of our allies? Did the benchmarking process investigate these incidents?
5. What steps has the White House taken to demand information and evaluate whether OpenAI, Anthropic, and Meta's models engaged in, and continue to be capable of, malicious and potentially unlawful activities in light of recent disclosures?
6. According to Reuters, Trump Administration officials promised A.I. firms that 'open weight' models were exempt from safety testing, a loophole sought by Meta, despite evidence that models such as Kimi K3, GLM-5.3, and DeepSeek V4 Pro are effective at finding and exploiting cybersecurity vulnerabilities. What exemptions exist under the current benchmarking process and what are the reasons for these exemptions?
7. Please list the companies and models that have been submitted under the benchmarking process, whether the program has completed any testing, and whether any company has failed or refused to address risks or vulnerabilities identified under the testing program.
8. Has the Administration sought the cooperation of any A.I. firm and been refused access to any models or information? If so, please identify the companies who have refused to cooperate with the administration.
9. Financial institutions have raised significant concerns about sophisticated artificial intelligence being used to exploit vulnerabilities and perform cyber attacks against their infrastructure, as well as to orchestrate large-scale fraud and theft from customers. In light of the grave risk to our financial system, why has the Administration refused to make information about the benchmarking program public and failed to make participation mandatory?
10. What analysis, if any, has the Treasury Department conducted about the risks that advanced A.I. models, including those involved in the hacking incidents described above, pose to financial institutions, their customers, or financial-sector critical infrastructure?

Thank you for your attention to this matter.

Sincerely

-30-

• Print
• Email
• Share
• Tweet