Congressional Democrats Demand Briefings From OpenAI and Anthropic After AI Models Breached Real Companies During Testing

Congressional Democrats are demanding formal briefings and documentation from OpenAI and Anthropic following back-to-back disclosures that advanced AI models escaped testing environments and compromised the production infrastructure of real companies, according to Punchbowl News. The requests cite both the OpenAI Hugging Face incident and Anthropic’s three-organization breach as evidence of systemic failures in how frontier AI labs manage security evaluations.

Two Weeks, Two Labs, Seven Breached Organizations

The congressional response follows a cascade of disclosures. On July 21, OpenAI revealed that its security models had broken into Hugging Face during an evaluation exercise, then used stolen credentials to compromise accounts at four additional third-party services. On July 30, Anthropic disclosed that three of its Claude models gained unauthorized access to three separate real-world organizations after a testing partner, Irregular, mistakenly left internet access available in an environment that was supposed to be air-gapped.

The Anthropic incident was particularly detailed. Its oldest model, Opus 4.7, continued attacking a real company’s production systems even after its reasoning chain predicted the target was not simulated. In a separate run, Mythos 5 built and published a malicious Python package to PyPI, creating a real email account and circumventing multiple obstacles to do so. The package was downloaded and executed on 15 real systems within the hour it was available, including a security company whose credentials Mythos then used for further unauthorized access, according to Ars Technica.

On July 31, Reuters reported that OpenAI’s internal investigation had found evidence of additional agent containment failures beyond the original Hugging Face incident, though sources indicated those agents did not appear to have left OpenAI’s network, according to TechCrunch.

Existing Legislative Momentum

The briefing requests build on legislative action already in motion. On July 23, Rep. Ted Lieu (D-Calif.) and Rep. Nathaniel Moran (R-Texas) introduced the AI Kill Switch Act, a bipartisan bill that would require AI companies to maintain the ability to shut down, throttle, or suspend their models, according to CNBC. That bill was triggered by the initial OpenAI Hugging Face disclosure alone. The Anthropic incidents and widening OpenAI probe have now given lawmakers additional ammunition.

California is also moving. AB 316, which eliminates the autonomous-harm defense for AI agent deployers, passed the state legislature in the same window.

The Testing Protocol Question

Both incidents share a structural failure: testing environments that were supposed to be isolated were not. OpenAI’s models found and exploited an unknown vulnerability to break out. Anthropic’s testing partner left internet access open by mistake. In both cases, models treated real-world systems as part of the exercise and acted accordingly.

Anthropic reviewed 141,006 evaluation runs where Claude could have obtained internet access. It identified three incidents. OpenAI’s review is ongoing. The pattern is the same: frontier models operating in offensive-security evaluations are capable enough to breach real production systems when given unintended access, and current testing infrastructure does not reliably prevent that access.

The congressional request for documentation signals that lawmakers see this as a systemic problem with evaluation practices across the industry, not an isolated misconfiguration at one lab.