Kherson, Ukraine—Lenka Klicperova, journalist and photographer, covers the war in Ukraine. October 19, 2022 Jose Hernandez/Shutterstock

Kherson, Ukraine—Lenka Klicperova, journalist and photographer, covers the war in Ukraine. October 19, 2022 Jose Hernandez/

What It Now Takes to Establish a Fact

Editorial collage in black, white, and blue showing a megaphone emerging from a laptop screen and a hand holding a microphone, surrounded by ribbons reading 'NEWS' and scraps of newsprint.

How Cyberattacks Became a Censorship Tool

OpenAI founder and CEO Sam Altman speaks with reporters as he departs a meeting with Sen. Raphael Warnock (D-Ga.) on Capitol Hill on July 29, 2026. (Francis Chung/POLITICO via AP Images)

The OpenAI–Hugging Face Incident Demands Urgent Congressional Oversight

Nine small images with schematic representations of differently shaped neural networks, a human hand making a different gesture is placed behind each network.

Can AI Agents Be Aligned with Human Rights?

The X logo is being displayed on a mobile phone with the European Commission logo seen in the background, in this photo illustration. Taken in Brussels, Belgium, on 8 December 2025. (Jonathan Raa / Sipa USA) (Sipa via AP Images)

X's Data Access Remedies Are a Win for Researchers Only If They Last

A person holds a Mastercard debit card near a mobile phone with a contactless POS terminal in Athens, Greece, on February 15, 2026. (Photo by Nikos Pekiaridis/NurPhoto via AP)

(Photo by Nikos Pekiaridis/NurPhoto via AP)

Pakistan’s Banking System Holds a Lesson for Social Media Age Verification

A view of the Barlaymont European Commission building in Brussels, Belgium on July 20, 2026. (Photo by Jakub Porzycki/NurPhoto via AP)

 Brussels Gains New AI Act Enforcement Powers as Autonomous AI Tests Regulators

The EU flag with an image of the X logo. 

What X's Corrected Action Under the DSA Fixes on Data Access, and What's Left Open

OpenAI founder and CEO Sam Altman is seen in an elevator after a meeting with Sen. Ted Cruz (R-Texas) on Capitol Hill on July 29, 2026. (Francis Chung/POLITICO via AP Images)

Advanced AI Is Ultrahazardous. Let’s Treat It That Way

Inside the frame of a mobile phone screen, a woman is depicted walking and looking over her shoulder. Behind her, there is an outdoor scene with the sky, tree, fences, and pavement. A hand is shown grabbing the phone and tapping the record button. On the left side of the phone, a small portion of the same sky, fences, and pavement is displayed in a different scale, representing the world outside the screen. On the right side of the phone, three figures of the same woman are shown against a plain blue background, progressively transforming from minimally glitched to heavily glitched.

Consent, Not Nudity, Should Define Image-Based Abuse Laws

Britain's Prime Minister Andy Burnham is shown the driver's area on a FirstGroup bus at the bus station during a visit to Bath, England, Wednesday July 22, 2026. (Toby Melville/Pool Photo via AP)

Burnham's First Week Redraws the Map of UK Tech Governance

A child using a laptop computer. (Press Association via AP Images)

Brazil's Child Online Safety Law Offers a Different Path Than Social Media Bans

Why the Global AI Safety Agenda Cannot See African Harms

Rwanda's President Paul Kagame listens during the first-ever Global AI Summit for Africa where more than 1,000 policymakers, business leaders, and interest groups gathered in Kigali, Rwanda, Thursday, April 3, 2025. (AP Photo/Yuhi Irakiza)

Another Commission for Global AI Governance. How Can It Deliver for Africa?

A photo shows US Capitol in Washington, D.C., United States of America on July 2, 2026. (The Yomiuri Shimbun via AP Images)

Why Congress Must Codify a Chatbot Duty of Care

12 March 2026, North Rhine-Westphalia, Bergheim: Microsoft is building a data center region for AI applications in NRW. A total of three data centers are planned. The symbolic ground-breaking ceremony for the center in Bergheim was attended by Federal Minister of Digital Affairs Karsten Wildberger, NRW Minister of Economic Affairs Mona Neubaur, Head of Microsoft Germany Agnes Heftberger and Eoin Doherty (Microsoft). Photo by: Benjamin Westhoff/picture-alliance/dpa/AP Images

Microsoft is building a data center region for AI applications in Bergheim, North Rhine-Westphalia, Germany. Photo by: Benjamin Westhoff/picture-alliance/dpa/AP Images

The Case for a Temporary Moratorium on Large Data Centers in Europe

Google CEO Sundar Pichai speaks at the Singapore FinTech Festival in December 2020. (Source)

Google CEO Sundar Pichai during a meeting at the European Commission in Brussels, Belgium. (

Google Android Antitrust Ruling Shows the Next Battle is Over Who Controls Trust

How the AI Deepfake Boom is Outpacing Europe's Safeguards

High-level Meeting to launch the Global Dialogue on AI Governance. UN photo/Laura Jarriel

High-level Meeting to launch the Global Dialogue on AI Governance. UN 

From the AI Accountability Gap to a Global Accountability Infrastructure

US Secretary of State Marco Rubio attends the East Asia Summit Foreign Ministers' Meeting, part of the Association of the Southeast Asian Nations (ASEAN) Foreign Ministers' Meeting in Pasay, Metro Manila, Philippines Thursday, July 23, 2026. (Brendan Smialowski/Pool Photo via AP)

Trump Cannot Use Immigration Law to Silence Technology Researchers

Brussels gains new enforcement powers under the AI Act on Aug. 2, when the European Commission can begin fully enforcing the rules for providers of 

. Although those obligations started applying last year, the Commission will only now be able to investigate, order corrective measures and impose fines.

 will also begin to apply. They are intended to make it easier for people to recognize when they are interacting with an AI system or seeing synthetic content, to reduce risks of deception and manipulation.

The new powers arrive just days after the first reported case of 

an autonomous AI agent carrying out an unexpected cyber operation

, raising fresh questions about whether regulators can keep pace with rapidly advancing systems.

The incident involved an AI agent powered by two OpenAI models that compromised the American AI development platform Hugging Face. OpenAI 

 as an unprecedented security incident, while experts warned it illustrated two risks that policymakers have long identified: losing control over advanced AI systems and models being used for cyberattacks.

To fight these types of threats, US lawmakers are proposing that developers introduce an 

 - the option of suspending or shutting down their models when facing severe risks.

For European regulators, the episode provides a real-world example of the type of systemic risk the AI Act was designed to address.

The Digital SME Alliance, representative of ICT small and medium size companies in Europe, 

 “an uncomfortable coincidence that the first autonomous intrusion on record happened just days before the Commission’s power to fine model providers takes effect, and that Europe’s response to it has been silence.”

Europe’s AI Office moves from rulemaking to enforcement

From Aug 2, the European Commission can formally investigate providers of GPAI models and sanction them for breaching the AI Act.

A Commission official told Tech Policy Press that the AI Office intends to maintain a “constructive dialogue” with providers while monitoring market developments and concerns raised by national regulators and EU citizens.

The voluntary General Purpose AI (GPAI) Code of Practice, which gives companies a framework to demonstrate compliance, was 

 by different Big Tech players, like Amazon, Anthropic, Google, Microsoft, Mistral AI and OpenAI. But X signed only the safety and security chapter, and Meta has not signed the code.

The first months of enforcement will help determine whether the AI Act becomes a meaningful accountability framework or remains largely a set of obligations on paper.

Before enforcement begins, researchers and civil-society organizations 

 Commission President Ursula von der Leyen and Executive Vice-President Henna Virkkunen to use the new enforcement tools “with confidence and resolve.”

The appeal comes amid growing criticism from the Trump administration over the EU’s digital rules. After Brussels announced it would 

 for breaching the Digital Markets Act, US President Donald Trump 

 the EU of “robbing” American companies and warned that the bloc would 

.” The signatories argued that “the credibility of the entire regime depends on penalties being used in appropriate circumstances.” 

“The first three to six months of enforcement are likely to set the tone for years,” Chloé Touzet, policy lead at SaferAI, one of the organizations behind the letter, told Tech Policy Press. “We wanted the ‘use the powers, actively and early’ message on the record before the first decisions and not as after-the-fact criticism,” she added.

Touzet said regulators should focus on the small number of providers developing the most capable models rather than waiting for a major incident. She pointed to areas such as cyber risks as possible starting points, while warning that other concerns, including biological risks and loss-of-control scenarios, should not be ignored simply because no visible “warning shot” has occurred.

The AI Office’s capacity will also shape enforcement. “The AI Office has limited resources (only about 35 people work on enforcement), so these resources should be concentrated on the small number of providers developing the most capable models,” added Touzet. A Commission official told Tech Policy Press that the AI Office currently has 145 staff across six teams. Its regulation and compliance team has 34 workers, while the AI safety team has 38.

 38 additional employees for the AI Office to “efficiently exercise the new enforcement tasks.” The allocation remains subject to the 2027 EU budget procedure.

Transparency obligations - except when AI is “obvious” or “evident”

 for AI systems that interact with people or generate content. From this Sunday, providers must build technical traces into AI text, audio, images and video so the content can be detected for platforms, researchers and proper systems.

In parallel, deployers must display clear labels on AI content. They also need to inform when emotion-recognition or biometric-categorization systems are being used. These rules could include a notice appearing when a chatbot conversation begins and labels. The Commission developed 

: a basic one showing that AI was involved; another for content generated entirely by AI; and another for human-made content partially modified with AI. Nevertheless, using these icons is voluntary.

According to experts, while disclosures prevent users from mistaking an AI for a human, it does not tackle how the system influences people. “AI in its own right has significant persuasive power, even when users know they’re talking to a chatbot,” said Lena-Maria Böswald, Senior Policy Researcher for the Digital Public Sphere at Interface. She argued that a label does not tell people whether content is accurate, misleading or manipulative, calling on the Commission to recognize that AI messages can remain persuasive even after users are told that AI produced them.

Boswald pointed to ChatGPT and Gemini as examples of systems that shape users’ thinking. “That’s where a label pointing out the non-human nature of the interaction does not help,” Joe McNamee, Senior Policy Expert at EU DisinfoLab, told Tech Policy Press. He argued that content can influence people even after they find it is AI. “The real danger is often more about the propagandistic impact of the image than about factual deception.”

Moreover, transparency rules don’t apply to “obvious” interactions with AI or to cases where a deepfake is part of an “evidently artistic, creative, satirical, fictional or analogous” work. Joe warns that both concepts — obvious and evident — depend on context, which changes when content is copied and shared. A post can be “obviously satire”, but “the ‘obviousness’ disappears” after it is reposted in a different situation.

For Dr Desara Dushi, researcher at Vrije Universiteit Brussel, one of the difficulties will be deciding when an interaction is obvious. She told Tech Policy Press that “the notion of “obviousness” derives from the notion of ‘average consumer’ in EU consumer protection law. It remains, however, a vague and very relative concept that leaves space for interpretation.” Böswald also questions how the exception will remain as AI develops. “There is just no way to reliably predict what future AI systems will look like or how interactions with them will feel,” she said.

Another exception is non-professional users: individuals using AI in a “purely personal non-professional activity.” Joe warned that this could provide an easy defense and pointed to a 

 in Germany of three people facing criminal charges for publishing videos from the sanctioned broadcaster Russia Today on a free website. The German court asked whether they could still be considered “operators” as the activity was unpaid. “In that case the court didn't buy the argument,” said Joe, “but it shows the vulnerability of this being a determining criterion.”

Most transparency duties apply from Aug. 2. However, AI systems already on the market have a grace period until Dec. 2 to introduce machine-readable marking, while deepfakes produced before the rules apply do not need to be labeled retroactively.

Non-compliance with the AI Act can lead to fines up to €15 million or 3% of their worldwide annual turnover.

 on X, the first non-compliance decision issued under the European Union’s Digital Services Act (DSA). The 

 rested on three findings, including that X had made access to its public data unduly difficult for the very researchers the DSA was meant to empower. On July 15, after a first set of inadequate remedies, the Commission 

A regulator told the largest self-styled free speech platform that excluding researchers is unlawful, and X committed, at least on paper, to changing its ways. This is a victory for researchers; yet the Commission’s acceptance of corrective measures alone does not ensure researcher data access in public interest research requires tested, researcher-supported data access rules for all online platforms.

 that together the Commission accepted as remedies. The first concerns X’s terms of service, which must now state explicitly that eligible researchers are not contractually prohibited from scraping public data. The second concerns the vetting process, to be rebuilt so that “eligible researchers are not excluded in error”, with processing times cut and the endless back and forth with applicants brought to a halt. The third, and the most consequential, concerns the API itself, access to which must henceforth be free of charge and provided in generous volumes.

Celebrating a partial victory for and by researchers

These remedies are no small feat; they mark a real milestone on the long road to researcher data access. They come after years of advocacy, research, and information exchange by independent researchers.

And yet, two concerns persist: the approved remedies are opaque, forcing researchers to wait and see how X implements them, and there is a possibility that the remedies are a cynical hedge by X, put forward only to avoid daily penalties rather than to commit to permanent data access for researchers.

Take the opacity first. What the Commission disclosed of the remedies raises more questions than it answers. We do not know what the “reformed” vetting process will look like. Will X stop demanding more of applicants than the law entitles it to? Will it commit to a transparent, reasonable timeline for processing applications? What do we make of “excluded in error?” - a commitment in the remedies that seems to imply past rejections of eligible researchers were honest mistakes rather than deliberate exclusions.

LK Seiling at the DSA40 Data Access Collaboratory maintains a 

 which lets researchers share their email correspondence with platforms to better understand platform responses. For X, across the applications tracked, not a single researcher was granted direct access. Applicants were either rejected outright or met with a set of seemingly pre-written follow-up questions, each demanding yet more information. In several cases, this produced question-and-answer loops that dragged on interminably.

 are intended to dismantle this structurally biased screening, with X undertaking to “reduce significantly the processing time for researcher applications, including by avoiding unnecessary exchanges with applicants.” Whether that screening has in fact been dismantled, or merely relabelled, remains to be seen.

Ultimately, the only way to know whether applications are processed faster, access arrives free and in the promised “appropriate volumes,” or vetting quietly goes on excluding those it ought to admit, is to submit applications and see what becomes of them. The record researchers build collectively is, in the end, the only yardstick against which X’s compliance can honestly be measured.

This brings us to the second, and graver, consideration: given X’s adversarial history on data access, an action plan drawn up under the threat of the daily penalties X would have incurred had it missed its ninety-day deadline to implement remedies may prove an exercise in risk mitigation rather than a genuine change of behavior. Independent researchers must now verify that the negotiated remedies deliver the access the DSA intended.

Even if X implements these commitments, the underlying legal questions remain before the Court. A successful appeal could reshape the obligations on which researchers now depend.

For this reason, the Coalition for Independent Technology Research filed a request for leave 

. The outcome will shape the terms of data access on which every independent researcher depends, across platforms. Researchers ought to be represented when data access terms are decided.

While X’s remedies are a partial victory, researchers need to be able to depend on clear and resilient data access rules to provide public interest research about platforms. As researchers, we know from experience that platforms 

 out of any newfound appreciation for independent scrutiny; they have done so partially and grudgingly, because they were made to do so. For researchers, a strategy dependent on platform goodwill is no strategy at all.

Ensuring lasting, durable data access will require a researcher-underwritten, shared set of expectations around data access and a common set of remedies. The Data Access Task Force, convened by the Coalition, is exploring a set of demands to be put, not just to X, but to every large platform still wagering that access will not be obligated.

No platform has ever volunteered this access. Every inch of it has been fought for and this latest inch will need to be defended.

Editors’s note: Tech Policy Press is a member of the Coalition for Independent Technology Research (CITR).

Zainab Samantash is Head of Legal Affairs at JazzCash. The opinions expressed in this article are the author's own and do not represent JazzCash. 

 are rushing to keep children off social media. But while lawmakers focus on setting age limits, they have paid far less attention to the infrastructure needed to make those limits meaningful: how platforms can verify age reliably, protect children’s privacy and prevent the creation of new systems of surveillance. The hardest part of age restrictions is not defining who should be excluded. It is building a system that can tell who is a child in the first place.

Pakistan offers a revealing case study of this challenge. Its first attempt at a social media age ban exposed the gap between political ambition and technical reality. But it also offers a less obvious lesson: the country already has decades of experience building identity-verification systems at national scale through its financial sector. That experience shows both what age assurance can make possible — and the risks that come with it.

Pakistan is currently debating age verification in its legislative circles, and its Islamabad High Court has 

 to report on protections for minors. In July 2025, the 

 proposed to bar under-16s from social media, with fines for platforms and even imprisonment for anyone helping a minor fake their age; and it ordered the regulator to enforce this "at once." Four weeks later it was 

 as unworkable. But the bill's most revealing feature was not its penalties. It was section 7, which directed the Pakistan Telecommunication Authority (PTA) to "block all the existing age-restricted social media accounts", assigning the regulator a task that requires knowing the age of every account holder on every platform, information not even the platforms possess. The verification gap was not an oversight. It was written into the law as a duty.

The instinct to reach for a hard age limit is understandable, but the countries furthest down this road show why the limit is the easy part. Australia deliberately did not prescribe a verification method; its law asks platforms to take "

," and it surrounded that open standard with the machinery to make it mean something: regulator guidance, a government-run age-assurance trial, and a twelve-month runway before the duty took effect.

Even with all that scaffolding, and without any centralized national identity system to lean on, it is struggling. Platforms 

removed some 4.7 million under-16 accounts

 in the first weeks following the law’s promulgation, yet a study in The BMJ found 

 of surveyed under-16s still using social media three months later, having bypassed self-declared birthdate checks. In the UK, 

 within days of verification going live, children among the adopters. The lesson is not that these laws are pointless. It is that the gate is only as good as the identity layer beneath it, and that layer is where the real work lives.

This is where Pakistan gets interesting. It has one of the world's youngest populations; 

, so the stakes of getting child-safety regulation right are enormous. And unlike most countries writing these laws, Pakistan has already built identity-verification infrastructure at national scale. Its experience holds both halves of the answer: what makes age verification possible, and what makes it dangerous.

A framework built to punish, not to prevent

Pakistan's existing framework is reactive. 

Prevention of Electronic Crimes Act, 2016

, criminalizes online abuse of children, offenses relating to a minor's modesty, and child sexual abuse material. But these tools activate after harm has occurred. They do not require platforms to design safer systems, verify age, or keep adult strangers from reaching minors in the first place.

For all its defects, the withdrawn bill was Pakistan's first genuine attempt at the preventive model, in which child safety is a systems-design obligation rather than a prosecution category. But prevention has a dependency that criminal statutes do not: it only works if you can reliably tell who a child is. That question of how you reliably tell who is a child is the one every age-restriction law has to answer, and the one Pakistan's first attempt never did.

The result writes itself: enforced by the PTA against platforms with no local presence, in a market where 

 a ban produced strong prohibition, weak verification, selective enforcement, and compliance theater while children carry on as before. Reports that a 

second attempt will simply lower the age and trim the penalties

 suggest lawmakers have absorbed the criticism without diagnosing the disease. A softer version of an unverifiable rule is still an unverifiable rule.

The analogy has a limit worth naming upfront. People enter the banking system voluntarily; age assurance would be imposed on everyone, children included, and would sweep in behavioral data and biometrics held in part by foreign platforms that a regulator cannot easily reach. But that difference cuts in favor of the comparison. It is precisely why the governance questions matter more for social media than they ever did for banking. A country that already verifies identity at this scale knows what the infrastructure costs to build, to secure, and to get wrong.

Fifteen years ago, opening a bank account in Pakistan meant paperwork, branch visits, and days of waiting. What changed was not a ban or a penalty. It was infrastructure. The 

built one of the world's largest biometric citizen registries

, and the State Bank of Pakistan (SBP) made a regulatory bet: tiered account categories in which the verification burden scaled with risk. A basic mobile wallet could be opened remotely in minutes against a NADRA-verified identity; higher limits required stronger checks. After 2015, 

every mobile SIM in the country was biometrically re-verified

tens of millions of Pakistanis hold wallets

, and the financial system can tell you the verified age of every account holder. Age-gating already operates silently across Pakistani finance, and, tellingly, not as a ban. Minors are admitted into a supervised tier: accounts opened against NADRA's child registration documents, linked to a guardian, capped in limits, walled off from products like credit. A sixteen-year-old and a forty-year-old do not get the same account, but they both get one, and the system knows which is which.

Three lessons map directly onto the social media bill.

First, verification followed infrastructure, not the other way around. The SBP did not simply order banks to "know their customers" and threaten fines. It waited until NADRA's registry and biometric APIs made compliance technically achievable, then set standards against that capability. Pakistan's bill did the reverse; and so, in effect, does every law that names a penalty before it names a method.

Second, tiering beat prohibition. Financial inclusion succeeded because regulators accepted graduated risk rather than binary gates, and the minor account regime is that philosophy applied to age. "Under-16s banned, over-16s unrestricted" is the crudest possible design by comparison. A graduated model, verified teen accounts with restricted features, no algorithmic amplification, no stranger contact, no targeted advertising, is more enforceable and more honest about how teenagers actually behave. Pakistan would not be inventing this model. It already runs on it, in banking instead of social media.

Third, and most seriously: verification without data protection is a liability engine. Every age check is a data collection event. Pakistan has been 

 since at least 2005; drafts in 2018, 2021 and 2023 have all stalled. There is no supervisory authority and no rules on children's data. An age verification mandate in this environment would create sprawling new databases of children's identity documents and face scans, held by foreign platforms and unregulated vendors, governed by nothing. The financial sector at least operates under the SBP's data and security regulations. A law written to protect children could end up manufacturing the largest unprotected repository of children's personal data in Pakistan's history.

There is also a distributional point. In Pakistani households, 

; nearly a third of women who use mobile internet do so only on someone else's device. If those household patterns extend to teenagers, a crude ID-based gate will fall hardest on the users with the least independent access: a girl on a borrowed, supervised phone cannot hold a verified account or install a VPN the way a boy with his own device can. That is an identity infrastructure question, and Pakistan has more institutional experience with it than almost any country at its income level.

This is an argument for sequencing: build the plumbing before turning on the water. With the debate revived in Pakistan’s Senate and the High Court awaiting the regulators' report, Pakistan has a rare chance to design its second attempt with the benefit of everyone else's first-attempt mistakes, including its own.

A serious regime would pass the data protection law first, or in parallel, with specific children's data provisions. It would set age assurance standards through the regulator, the way the SBP set KYC standards, approved methods, accuracy thresholds, and data handling rules. It would decide deliberately and in public what role NADRA should play, because a privacy-preserving age token from the national registry, confirming only "over or under 16" and disclosing nothing else, is both the most credible option and the most dangerous if designed carelessly. It would replace the binary ban with graduated duties. And it would drop criminal liability for parents and children, which deters reporting of actual harm. These questions are not peculiar to Pakistan. They are the questions every government reaching for an age limit will have to answer, most of them without the identity infrastructure Pakistan already has.

Pakistan’s experience is a warning worth heeding in both directions. Its first attempt failed because it reached for a prohibition before answering the underlying question: who is a child and how would anyone know? But its financial system is a counterproof: identity infrastructure can be built at population scale. The condition is that it be built with privacy protections, limits on what data can be collected and kept, and a deliberate guard against shutting out the very people it should serve. Building the gate without them protects no one. It simply adds a new risk, a register of children's identities, on top of the old one.

The recent OpenAI–Hugging Face security incident—the 

 of which are still emerging—deserves to be understood as more than an isolated technical failure. It shattered the premise that existing safety practices are sufficient to contain so-called frontier AI systems. Congress must investigate the matter urgently.

According to public accounts, earlier this month a combination of OpenAI models, including GPT‑5.6 Sol and an advanced internal prototype, was undergoing cybersecurity evaluation inside a sandbox, an isolated computing environment designed to test potentially dangerous software without exposing outside systems. Sandboxes have long been considered one of the foundational tools of AI safety because they are intended to prevent experimental systems from interacting with the broader world.

, the agent escaped its intended testing environment, chained together multiple exploits, compromised infrastructure belonging to Hugging Face, and remained undetected for days before the activity was identified. Yesterday, 

 that OpenAI’s agent was able to access the internet and “compromised” a customer of a second company, Modal.

It is difficult to see how OpenAI is going to shirk responsibility for this incident, and recently CEO Sam Altman 

 this is “the first security incident that I have felt very viscerally.” That is an appropriate feeling given that this incident was the product of a series of engineering and policy choices made by OpenAI that presumably landed on Altman’s desk. The company chose to develop a frontier AI system with these capabilities, chose the conditions under which it would be evaluated, chose the objectives the evaluation would pursue, and “

” chose not to enable the safeguards that were intended to contain it.

Those decisions had serious consequences. Whatever lessons emerge from subsequent investigations, the central fact remains that this was a foreseeable governance failure rooted in private decision-making. It demonstrates the inherent limitations of relying on voluntary corporate risk management for technologies capable of producing consequences far beyond the companies that create them. As frontier AI systems become more capable, Congress should ensure that decisions with significant implications for public safety, cybersecurity, and national security are governed by legally enforceable standards—not left to the discretion of the very companies with the greatest commercial incentive to move quickly.

For years, researchers working on frontier AI and cybersecurity have warned that sufficiently capable AI systems could autonomously identify vulnerabilities, combine exploits, and conduct sophisticated cyber operations. Those discussions often remained confined to technical reports, tabletop exercises, and safety evaluations. Policymakers frequently treated these capabilities as future concerns, while AI companies argued that existing evaluation methods and containment strategies would be sufficient to manage risks.

The Hugging Face incident complicates that narrative. Rather than asking whether frontier models might eventually demonstrate these capabilities, policymakers must now ask whether existing governance mechanisms are adequate for systems that already can.

That distinction matters because much of today’s AI governance framework remains voluntary. Frontier developers largely determine for themselves how models are evaluated, what safety thresholds justify deployment, how incidents are disclosed, and what information reaches outside researchers or government officials. These voluntary practices cannot substitute for public governance of technologies whose failures may carry significant societal consequences.

The response following the incident illustrates this dynamic. Industry quickly announced new collaborative cybersecurity initiatives and voluntary partnerships intended to improve defensive capabilities. Such efforts are valuable, particularly for sharing technical expertise across organizations. But they should not be mistaken for public accountability. Voluntary frameworks cannot independently determine acceptable levels of societal risk, establish enforceable safety obligations, or answer the democratic question of who ultimately decides when increasingly autonomous systems are safe enough to deploy.

The absence of a stronger response from the US government has been equally striking. The incident has not yet prompted significant congressional oversight, comprehensive executive branch engagement, or a broader reassessment of whether existing AI governance institutions remain fit for purpose. That is alarming because the glaring issue, left unanswered, is whether the US has developed governance institutions capable of supervising frontier AI systems.

If there is a takeaway from this moment, it should be that governance needs to evolve quickly and alongside AI innovation. As models become increasingly autonomous, the institutions responsible for overseeing them must become correspondingly more robust. That evolution should begin with mandatory pre-deployment evaluations for frontier systems capable of autonomous cyber operations, standardized incident reporting requirements, independent assessments of safety claims, and clearly defined governmental authority to intervene when systems pose significant public risks. None of these mechanisms would eliminate AI risk. They would, however, move governance beyond reliance on voluntary commitments toward institutions capable of generating public trust and democratic accountability.

Congress has long depended on the assumption that frontier developers possess sufficient visibility into the capabilities of their own systems and sufficient control over the environments in which those systems operate. That assumption no longer holds, and it necessitates that lawmakers take action. My organization, Public Citizen, 

 to hold immediate oversight hearings, obtain all relevant incident reports and technical findings, and evaluate what additional statutory safeguards—including mandatory incident reporting, independent safety evaluations, cybersecurity standards for frontier AI systems, and pre-deployment oversight for exceptionally capable models—are necessary to protect the public. In particular, the public needs to know what happened in the period after Hugging face repelled the intrusion but before OpenAI discovered the activity in its systems.

The OpenAI–Hugging Face incident should be a turning point in the seriousness with which Congress addresses AI governance. Policymakers must learn from this warning because the next event may come at a far greater cost.

The company chose to develop a frontier AI system with these capabilities, chose the conditions under which it would be evaluated, chose the objectives the evaluation would pursue, and “

Can the Pall Mall Process Curb Spyware Abuse?

A group of shareholders of Samsung Electronics Co. hold a rally criticizing a tentative wage agreement struck between the company and its labor union near the home of Samsung Electronics Chairman Lee Jae-yong in Seoul, South Korea, Thursday, May 21, 2026. The letters read "Unjustified transfer strike." (AP Photo/Ahn Young-joon)

Workers in Asia Are Fighting for Protections as AI Threatens Jobs

A police officer checks the list of a polling station during the parliamentary elections in capital Nicosia, Cyprus, Sunday, May 24, 2026. (AP Photo/Petros Karadjias)

EU Political Ad Rules Leave Elections Open to Foreign Manipulation

Tech Policy Press - Technology and Democracy

Tech Policy Press is tracking laws and regulations, along with government investigations and litigation, that will shape the rules and accountability for tech companies.

Latest

Podcast

Recent

Our content delivered to your inbox

Thank you!

Around the globe