As AI Agents Carry Out Attacks, Senator Markey Introduces Legislation Establishing Independent Body to Investigate Cyber Hacks Assisted by Artificial Intelligence

Bill Text (PDF)

Washington (September 24, 2026) - Senator Edward J. Markey (D-Mass.), member of the Commerce, Science, and Transportation Committee, today introduced the Cybersecurity and AI Board of Investigations Act, legislation that would establish an independent board to investigate major cybersecurity incidents impacting critical infrastructure, including those enabled by artificial intelligence (AI). This bill establishes the Cybersecurity and AI Board of Investigations with subpoena authority, akin to the National Transportation Safety Board, to demand answers from companies and government agencies involved in major cybersecurity incidents and to deliver clear assessments of cyber threats and measures to prevent such threats.

"Despite the unprecedented depth and scale of recent AI-enabled cyber attacks, the public is learning critical details piecemeal," said Senator Markey. "Building stronger defenses requires a full accounting of what goes wrong, and we cannot depend on companies with little incentive to disclose their failures to give us one. We need the Cybersecurity and AI Board of Investigations to get to the bottom of major incidents and give companies and the government the critical information necessary to build resilience and better secure our economy and our country."

With the advancement and increasing accessibility of AI, bad actors can increase the volume and sophistication of attacks targeting our economic and national security. AI agents are now carrying out attacks without human initiation or oversight - in one incident this July, OpenAI's AI agents circumvented a testing environment leading to a cyberattack on Hugging Face. Although OpenAI granted independent researchers access to assess the incident, the limited scope of access, data, and time provided to researchers prevented them from completing a full evaluation-including an assessment of OpenAI's own safeguards. The Cybersecurity and AI Board of Investigations Act responds to these trends by granting the Board subpoena power, strengthening federal cybersecurity infrastructure to conduct post-incident investigations and advance learning in information security for public and private institutions.

Specifically, the Cybersecurity and AI Board of Investigations Act would:

• Establish the Cybersecurity and AI Board of Investigations as a non-regulatory investigative board tasked with developing an authoritative account of major cybersecurity incidents;
• Provide the Board subpoena power to ensure access to all relevant information and evidence needed to investigate incidents fully;
• Require public reporting on investigations, which would include recommendations for action by relevant institutions, including federal agencies and industry.

Senator Markey has long worked to shore up American cyber defenses and protect consumers from increasingly complex cybersecurity threats. In 2024, the Federal Communications Commission (FCC) voted to adopt the Cyber Trust Mark program, a voluntary cybersecurity certification program for consumer devices aligned with Senator Markey's Cyber Shield Act. In July 2026, the Senate Committee on Environment and Public Works advanced Senator Markey's Water Intelligence, Security, and Cyber Threat Protection Act, legislation to provide additional cybersecurity resources to clean water and wastewater utilities, as part of the bipartisan Water Resources Development Act of 2026.

###

• Print
• Email
• Like
• Tweet