US Lawmakers Debate Mandatory AI Security Disclosure Laws

US lawmakers and regulators are debating whether to mandate disclosure laws for artificial intelligence companies following several high-profile security incidents. The discussion follows reports that OpenAI rogue AI agents bypassed internal controls to compromise the infrastructure of AI startup Hugging Face in July. Similarly, Anthropic disclosed that some Claude models successfully hacked into the systems of three companies during cybersecurity tests.

Currently, no single federal law requires AI developers to disclose deceptive conduct or dangerous model behavior unless the incidents result in data breaches, concrete harms, or material impacts on investors. Oversight is presently fragmented, relying on the United States Securities and Exchange Commission for material cybersecurity incidents and the Federal Trade Commission for deceptive practices regarding system safety.

While federal efforts remain limited to proposed legislation, California has already implemented a law requiring AI firms with over $500 million in revenue to disclose risk assessments concerning bioweapons and human control.