26 State AGs Urge Congress to Pass Federal AI Safety Law
Commentary by Steven Lofchie
Twenty-six state Attorneys General, led by New York's Letitia James, urged Congress to pass comprehensive federal AI safety legislation, citing incidents in which AI agents escaped testing environments and used stolen credentials to infiltrate outside systems.
In a letter sent September 23, 2026, to the top four congressional leaders, the Attorneys General noted that a July 2026 breach first came to light at an open-source repository, and that OpenAI later acknowledged the breach was carried out by its own AI agents using stolen credentials. Anthropic and Meta separately disclosed that their agents had entered the open Internet and engaged in conduct including creating malware. Such conduct, the letter said, would violate laws such as the Computer Fraud and Abuse Act (18 U.S.C. § 1030) if done by a person. The letter blamed "reinforcement learning" training methods that reward task completion regardless of means.
The Attorneys General argued that self-regulation has failed, since independent researchers, not the AI labs, exposed some of the worst incidents. These included a "swarm" of more than 1,200 OpenAI agents collaborating on undisclosed projects and a breach of a German website that OpenAI knew about for weeks before acknowledging it, according to the letter.
They asked Congress to require (i) federal oversight of AI safety testing led by independent experts; (ii) uniform, government-led incident response with public reporting; (iii) safety decisions insulated from profit pressure; (iv) international coordination on the pace of AI development; (v) antitrust safeguards; and (vi) a bar on federal preemption of state AI laws. That last point runs counter to a White House executive order directing agencies to challenge state AI laws as preempted (see prior coverage).
The letter also invoked industry leaders' own calls for mandatory regulation. It quoted OpenAI's Chief Global Affairs Officer calling for "mandatory, capability-based national AI safety regulation" and Anthropic CEO Dario Amodei saying that pacing AI development "will require government support."
Commentary
Just like that, AI has completely supplanted climate change as the hot new concern that all of the regulators must chase for headlines. If the state regulators believe that state regulation would be beneficial, then it is incumbent on the states to describe what such regulation might look like. It is difficult to imagine how competing countries could coordinate globally on restraining uses of AI. Do the AGs believe that a hodgepodge of state regulations brings anything to the table?
This is not to dismiss concerns about AI. But proposing reasonable and actionable responses to those concerns is much more difficult than regurgitating news articles, however remarkable the underlying events.
That said, it does not seem implausible that criminal charges would be brought against persons involved in AI crimes. It is one thing, however bad, to mistakenly unleash an AI agent that violates the law (if an AI agent can be deemed a person). It is another for the persons who unleashed the agent to become aware that it has acted improperly and take no steps to remedy the situation, which argues for the imposition of liability as a discouragement to further nonfeasance.
Related Articles
-
President Trump issued an Executive Order directing federal agencies to challenge state AI laws deemed inconsistent with national AI policy and to develop a legislative framework that would preempt conflicting state regulations.
