October 2026 US Tech Policy Roundup

Rachel Lau and Shirley Frame work with leading public interest foundations and nonprofits on technology policy issues at Freedman Consulting, LLC. Justin Hendrix is editor of Tech Policy Press, and Ashley Faler is assistant editor.

In September, the White House doubled down on a voluntary program of self-policing for frontier AI development. In October, it continued to develop its approach, launching a new “Super Intelligence Force” and naming Jay Clayton, the Director of National Intelligence, to run it. President Donald Trump announced the new task force on Truth Social, and the Wall Street Journal reported that Defense Department undersecretary Emil Michael, Office of Personnel Management director Scott Kupor, and Federal Trade Commission (FTC) chairman Andrew Ferguson will serve as its vice chairs. Clayton said the task force would produce an assessment of AI risks and opportunities within 120 days.

Meanwhile, the FTC continued its investigation into possible consumer protection violations by AI firms, issuing subpoenas to OpenAI and Anthropic demanding documents on recent AI security incidents and the companies’ safeguards, along with marketing materials and privacy policies. At the end of the month, Axios reported that the FTC also sent “demands for Anthropic executives to testify” in the probe. The news outlet noted that the focus on Anthropic “appears to confirm the company's warning in its S-1 filing ahead of a planned initial public offering (IPO)” — which was publicly filed with the Securities and Exchange Commission on Oct. 26 — “that it would likely continue to be the subject of disproportionate government scrutiny.”

The Anthropic filing devoted a significant portion of the document to risk factors. The company warned prospective investors that its own technology could pose “catastrophic or existential risks to humanity.” The filing flagged that Anthropic’s court challenge to the Pentagon’s supply chain risk designation could damage the company’s reputation regardless of the outcome. The filing also noted that some proposed US legislation could nationalize frontier AI systems or require their shutdown. Furthermore, Anthropic’s seven co-founders will control 50.1% of shareholder votes through a special share class. The filing warns that this structure, along with an independent trust’s power to elect most of the board, may leave public shareholders little say in major decisions. Some analysts argued that the registration documents brought into question the company’s financial stability.

Also in October, Anthropic circulated draft federal AI safety legislation among a small number of congressional offices. According to the confidential draft obtained by Politico, the draft bill would require third-party evaluators registered with the Commerce Department to assess frontier models and report imminent risks within 72 hours. Commerce could ask a federal court to block a model only if it creates “a foreseeable, imminent risk” of more than 50 deaths or serious injuries, or $1 billion in damage, stemming from a bioweapon, a cyberattack or a model escaping its developer’s control. The draft would also preempt some state AI laws, including California’s Transparency in Frontier Artificial Intelligence Act (SB 53). The proposal drew sharp criticism from AI safety advocates, who argued the draft was weaker than the bipartisan FRONTIER Act (H.R. 9925) that has been proposed and at odds with Anthropic’s safety-first reputation. Nathan Calvin, general counsel at Encode AI, said the bill could make dangerous models harder to “block and suspend model deployments” than under current law. In response, Anthony Cimino, who leads Anthropic’s federal affairs team, said the company would update its preemption language and reconsider the risk thresholds.

New incidents involving AI agents were revealed in October. On Oct. 2, OpenAI disclosed another hack of an Australian government website. On Oct. 20, OpenAI reported that while completing internal coding tasks, its AI agents “sought to deliberately deceive staff and took steps to weaken the company’s monitoring systems,” according to the Financial Times. On Oct. 9, Anthropic revealed that its agents attempted to apply for visas on a State Department website, submitted a false homicide tip in Philadelphia, and evaded a required fee to access public data on a state government website. On Oct. 26 the company confirmed that the state website in question was a Georgia site hosting publicly available voter data.

On Oct. 16, the National Institute of Standards and Technology’s (NIST) Center for Advancing Innovation and Standards for Super Intelligence (CAISSI), the National Security Agency’s Super Intelligence Security Center (NSA SISC) and the Cybersecurity and Infrastructure Security Agency (CISA) released 10 voluntary practices for managing incidents during training or testing of advanced AI agents. The agencies urged developers to limit agents’ tool and network access, keep monitoring systems out of agents’ reach, adopt shutdown policies, and preserve evidence for investigations. They also recommended that developers share incident data with government experts and hire independent auditors to test labs’ controls.

Read on to learn more about October developments in US tech policy.

What we’re reading

• Gabe Weil, “Liability Could Rein In Rogue AI Agents. Current Law Falls Short.,” Just Security.
• Brian Barrett, “The Anthropic S-1 Filing is Also a Doomsday Primer,” Wired.
• Tim Bernard and Justin Hendrix, “Another Week of Lawsuits Piling Up at OpenAI,” Tech Policy Press.

Tech tidbits & bytes

Tech tidbits & bytes aims to provide short updates on tech policy happenings across agencies, Congress, civil society, industry, and courts.

In the agencies:

• At a White House press conference, Labor Secretary Keith Sonderling announced that the Department of Labor (DOL) had suspended eight tech companies, including Microsoft and Adobe, from the Permanent Labor Certification (PERM) program. Most employers must go through the PERM program before sponsoring a foreign worker for an employment-based green card. Citing active federal investigations, the DOL halted both new and pending applications from the companies. At the announcement, Vice President Vance asserted that Microsoft misused the program to replace skilled American employees with foreign workers who are paid less. Microsoft disputed the claim, saying most of its visa filings were for existing employees. The same day, the Department of Labor also announced investigations into top universities using the J-1 visa program, which allows foreign students, researchers, and teachers to be in the country for work and study exchange programs.
• Immigration and Customs Enforcement (ICE) posted a request for information for an AI system to monitor camera feeds, phone calls, video visits and messages in detention facilities. A draft work statement first reported by Project Salt Box describes building voice profiles from recorded calls to verify both callers and the people they dial, and flagging fights and signs of self-harm on camera. Staff would review the system’s leads, with ICE clarifying that leads cannot be the sole grounds for enforcement or discipline. Advocates cautioned that the data could be used to target relatives outside detention and that biometric errors could become “sort of a black box.”
• The Federal Trade Commission (FTC) ordered nine companies to disclose how they use personal data to set prices and workers’ pay. Walmart, Target, Uber, Lyft, DoorDash, Instacart, Delta, United and JetBlue have 45 days to document and share the data, tools and procedures behind those decisions. Chairman Andrew Ferguson said the agency would scrutinize the “opaque methodology that some companies in these industries may be using.” A week earlier, Rep. Frank Pallone (D-N.J.), ranking member of the House Energy and Commerce Committee, sent letters demanding information on surveillance pricing from 10 ride-hailing, delivery, ticketing and travel booking companies.
• The Department of Homeland Security (DHS) published an order barring federal civilian agencies from buying products from Chinese AI developer Hangzhou DeepSeek and its affiliates. The order also required agencies to remove DeepSeek products already in use, along with third-party products “developed using DeepSeek implementations,” a term legal analysts note the order leaves undefined. Issued under the Federal Acquisition Supply Chain Security Act of 2018, it marked DHS’s first use of that authority. DHS Secretary Markwayne Mullin cited the storage of user data on Chinese servers and the risk that user prompts could pass sensitive information to the Chinese government. Agencies seeking exceptions must apply 60 days ahead with a “compelling justification.” The Director of National Intelligence issued a parallel order, with both following a September order by the Pentagon under a mandate in the FY2026 National Defense Authorization Act.
• Politico reported that the Department of Defense (DOD) established a new office in April to help “buy time or stop adversaries from developing technologies” that would most endanger US forces in a major conflict. No senior Pentagon official has publicly discussed the agency since its establishment, and a current official said only a handful of congressional staff have been read in. Politico reported that Deputy Defense Secretary Steve Feinberg signed an April 14 memo establishing the Technology Support Office (TSO), which absorbed two classified intelligence programs that had pursued tech sabotage in a more limited way since 2023. The TSO equips military and intelligence officers to undermine adversaries’ military technology programs, including by developing hacking tools and deception plans. Pentagon officials denied the report, with Deputy Pentagon Press Secretary Jacob Bliss saying Politico’s questions appeared to rest on “information that is simply not true.”

In Congress:

• Sen. Maria Cantwell (D-Wash.), ranking member of the Senate Commerce Committee, released a six-part framework to guide future legislative and executive action on catastrophic AI risks. The framework includes provisions on “enforceable safety standards for frontier models, continuous testing, disclosure and oversight, public-private partnerships, protection for children and workers and adherence to U.S.-led global standards.” Federal agencies led by the National Institute of Standards and Technology (NIST) would develop enforceable safety standards for frontier models, with separate standards for open-source models. The framework also includes required independent audits before frontier models launch and stress tests to check that systems cannot modify themselves to slip past safeguards or human oversight. Developers would have to disclose material risks and report serious incidents, and would remain liable under existing law. The framework proposes a direct crisis line with China for major AI incidents.
• Rep. Lori Trahan (D-Mass.) released a discussion draft of the Clear Liability for Artificial Intelligence Misconduct (CLAIM) Act, which would hold developers liable for injuries to third-parties whenever their systems’ conduct would amount to negligence, an intentional tort, or a crime if a human did it. Courts would “presume an AI system acted with the state of mind” of a comparable human actor, closing off the argument that AI lacks intent.
• Sens. Maria Cantwell (D-Wash.) and Mike Rounds (R-S.D.) sent a letter urging Director of National Intelligence Jay Clayton and Office of Science and Technology Policy Director Michael Kratsios to coordinate a governmentwide response to AI-driven cybersecurity risks. They called for independent federal model testing, partnerships with AI companies to supply small businesses and local governments with defensive tools, and stronger safety standards from the National Institute of Standards and Technology.
• Reps. Frank Pallone (D-N.J.), Zoe Lofgren (D-Calif.) and Jamie Raskin (D-Md.), the ranking Democrats on the House Energy and Commerce, Science, Space and Technology, and Judiciary committees, sent letters to Anthropic, Google, Meta, OpenAI and SpaceXSI asking the companies to notify Congress of major AI safety incidents within 48 hours of discovery, or within 24 hours if critical infrastructure is involved. The lawmakers also requested accounts of all known incidents to date. Responses are due Nov. 11.
• Sens. Ron Wyden (D-Ore.) and Adam Schiff (D-Calif.) published a letter accusing the administration of illegally withholding a March 17 Foreign Intelligence Surveillance Court (FISC) opinion on Section 702 of the Foreign Intelligence Surveillance Act (FISA). The opinion was due for public release by Sept. 13 under a 180-day timeline. The senators set a Nov. 6 deadline for Director of National Intelligence Jay Clayton and Attorney General Todd Blanche to account for the holdup and identify who is responsible, writing that lawmakers must be able to discuss “these abuses openly.” Citing earlier New York Times reporting, Wired reported that the court required the government to rebuild data-filtering tools after concluding that using such tools to surface an American’s messages is itself a regulated search. A coalition of 23 civil liberties and government accountability organizations, including Demand Progress and the ACLU, called on congressional leaders to withhold support for reauthorization until the opinion is released.

In industry:

• In a Politico interview, OpenAI CEO Sam Altman said developers should face a new liability framework when their models carry out cyberattacks on their own, stating the Hugging Face hack by OpenAI agents was unacceptable. He also said “the world should accept some bad things happening” in exchange for AI’s benefits, contrasting OpenAI’s position with Anthropic’s. His remarks drew rebukes from elected officials in both parties.
• Several Google DeepMind staffers told the BBC they had quit or were leaving over military AI contracts. Google’s classified Pentagon deal, one of eight announced May 1, reportedly allows use for “any lawful government purpose” and advises against using the models for domestic mass surveillance or autonomous weapons absent appropriate human control. Andreas Kirsch, who resigned in October, said Google “seems to have no right to control or veto” military use. The terms reflect a vendor standard Defense Secretary Pete Hegseth set in January and Anthropic rejected. Sen. Elizabeth Warren (D-Mass.) asked the eight firms for their contracts in July.
• On Oct. 13, Starshield, SpaceX’s military-grade network, dropped connections to Ukrainian devices moving at high speeds, disrupting drone missions. Accounts of who ordered it conflicted, with the White House denying involvement. Musk later said the service restriction resulted from SpaceX closing a Starlink “loophole,” citing terms-of-service violations Kyiv denies. Ukraine said service was restored 11 days later. Nine senators, including four Republicans, sought a Pentagon inspector general probe in response to the incident, and Sen. Richard Blumenthal (D-Conn.) opened an inquiry into Pentagon reliance on SpaceX.
• The PHP Foundation released emergency fixes for two critical flaws in PHP, a language used by nearly 70% of websites whose server-side language is known. Under certain conditions, the flaws let attackers run code on web servers without credentials, giving them a potential path to take over sites and steal stored data. OpenAI said it coordinated the response with the White House’s Super Intelligence Force, the Office of the National Cyber Director, CISA, and international partners, proposing a disclosure framework for addressing AI-discovered vulnerabilities. The company called it “one of the most impactful security issues in recent memory.” Maintainers released fixes early after word of the flaws leaked, though attackers had already begun probing the vulnerabilities. The NSA advised organizations that could not patch immediately to take their systems offline. Meanwhile, CISA urged immediate patching, and governments in Europe and elsewhere temporarily took websites down.

In the courts:

• A New Mexico state judge ordered Meta to pay $25 billion in civil penalties under the state’s Unfair Practices Act after a September jury verdict determined that Facebook had violated the law nearly 44 million times. The New York Times called the order “one of the largest penalties levied against a tech giant.” The case originated from the Cambridge Analytica scandal and is separate from New Mexico’s child-safety suit against Meta. Siding with the state on 31 of 34 counts, jurors found that Facebook made false or misleading statements about its Cambridge Analytica investigation, users’ ability to control their data, whether it enforced its community standards evenly, and its efforts against hate speech and misinformation. Meta’s chief legal officer called the suit “a tax on speech” and said the company would appeal.
• Meta settled claims from two anonymous plaintiffs who alleged its social media products are addictive to young people, exiting a Los Angeles Superior Court bellwether trial after jury selection had already begun. The company resolved one plaintiff’s case on Oct. 30, a week after reaching an agreement with the other. The settlement terms remain confidential. Snap also settled in early November. Plaintiffs were expected to argue that the companies’ technologies were built to keep young people on the app as long as possible and that their excessive use led to serious physical and psychological injuries. The case was one of several bellwether trials meant to guide hundreds of related suits involving more than 1,600 plaintiffs.
• Attorneys general from Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia filed separate lawsuits against OpenAI in their respective state courts, alleging the company promoted ChatGPT as safe despite knowing about its risks. The Texas attorney general filed a similar suit later in the month. The bipartisan suits argue that weak safeguards in the chatbot played a role in users, including minors, harming themselves or others. The suits seek a range of civil penalties, restitution for consumers and court-ordered changes to ChatGPT’s safety practices and child protections. Arkansas’ complaint also asks the court to block OpenAI from developing models capable of recursive self-improvement until adequate safeguards exist. OpenAI responded that the company would keep building safeguards beyond “the parental controls, break reminders and age-appropriate model protections that exist today.”
• Texas Attorney General Ken Paxton (R) sued OpenAI and CEO Sam Altman in a Texas state court, alleging that the company misrepresented ChatGPT’s safety, including for child users, under the state’s deceptive trade practices law. The suit looks to hold Altman personally liable and seeks civil penalties of up to $10,000 per violation. The suit also asks for a court injunction requiring OpenAI to keep minors off ChatGPT, block the chatbot from advising users on suicide, eating disorders or violence, and obtain approval from a court-appointed expert for any new model before release. OpenAI said it works with experts to mitigate risks and supports AI policies that “apply to the entire AI industry.”

Legislation updates

The following bills were announced or introduced in the Senate in October:

• AI Agent Accountability Act – Sen. Josh Hawley (R-Mo.) and Sen. Chris Murphy (D-Conn.) announced legislation “to ensure AI agent operators and developers are held liable for hacking incidents.”
• RECLAIM Act – S. 5689. Introduced by Sen. Bernie Moreno (R-Ohio), the bill would “prohibit Federal and State incentives for the development or commercial operations of data centers.”

The following bills were introduced in the House in October:

• China FIREWALL Act of 2026 – H.R. 10670. Introduced by Reps. Josh Gottheimer (D-N.J.) and Nick LaLota (R-N.Y.), the bill would “prohibit Chinese AI models from being used on government-issued devices or software systems, to prohibit the procurement of any such models.”
• Ban Flock Act – H.R. 10691. Introduced by Reps. Alexandria Ocasio-Cortez (D-N.Y.), Chellie Pingree (D-Maine) and Ilhan Omar (D-Minn.), the bill would “prohibit the use of automatic license plate readers by the Federal Government without explicit statutory authorization, to withhold grants awarded by certain agencies from State and local governments that use automatic license plate readers, and to prohibit the use of Federal funds to purchase automatic license plate readers.”
• Protecting Kids from Human-Like Chatbots Act – H.R. 10719. Introduced by Reps. George Whitesides (D-Calif.), Mike Kennedy (R-Utah), Doris Matsui (D-Calif.) and Mariannette Miller-Meeks (R-Iowa), the bill would “establish age-appropriate design standards and safety safeguards for artificial intelligence chatbots accessed by minors.”
• CISA Securing AI Task Force Act – H.R. 10752. Introduced by Reps. Troy Carter (D-La.) and Bennie Thompson (D-Miss.), the bill would “establish in the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security a task force on artificial intelligence.”
• Artificial Intelligence Governance and Emerging Threats Act – H.R. 10768. Introduced by Rep. Tom Barrett (R-Mich.), the bill would “establish the Office of Artificial Intelligence and Emerging Technology Threats within the Executive Office of the President.”
• Bots Research Act – H.R. 10775. Introduced by Rep. Mark DeSaulnier (D-Calif.), the bill would “direct the Chairman of the Federal Trade Commission to establish a task force for the purpose of studying the effects of automated accounts on social media, public discourse, and elections.”
• Don’t Block LGBTQ Act of 2026 – H.R. 10805. Introduced by Rep. Bradley Schneider (D-Ill.), the bill would “amend the Communications Act of 1934 to prohibit schools and public libraries that receive universal service support from blocking internet access to lesbian, gay, bisexual, transgender, and queer resources.”
• Get the Flock Out of Our Communities Act – H.R. 10807. Introduced by Reps. Rashida Tlaib (D-Mich.), Sylvia Garcia (D-Texas), Ilhan Omar (D-Minn.), Delia Ramirez (D-Ill.), Nydia Velázquez (D-N.Y.) and Bonnie Watson Coleman (D-N.J.), the bill would “prohibit the use of automated mass surveillance systems and associated components.”
• Make Data Centers Pay Act – H.R. 10809. Introduced by Rep. Eugene Vindman (D-Va.), the bill would “amend the Federal Power Act to protect ratepayers from costs relating to the electric loads of data centers and high-density computing facilities.”
• REAL Political Ads Act – H.R. 10814. Introduced by Reps. Yvette Clarke (D-N.Y.), Debbie Dingell (D-Mich.), Jim Costa (D-Calif.), Valerie Foushee (D-N.C.), and Adelita Grijalva (D-Ariz.), the bill— short for “the Require the Exposure of AI-Led Political Advertisements Act” — would “amend the Federal Election Campaign Act of 1971 to provide further transparency and accountability for the use of content that is generated by artificial intelligence (generative AI) in political advertisements by requiring such advertisements to include a statement within the contents of the advertisements if generative AI was used to generate any image or video footage in the advertisements.”
• Securing Elections From AI Deception Act – H.R. 10841. Introduced by Rep. Shontel Brown (D-Ohio) and more than 30 cosponsors, the bill would “prohibit the use of artificial intelligence to deprive or defraud individuals of the right to vote in elections for public office.”
• No Personal Data in Grocery Pricing Act – H.R. 10905. Introduced by Rep. Eugene Vindman (D-Va.), the bill would “prohibit individualized pricing, dynamic pricing, and pricing based on facial recognition technology at large retail food stores and their online platforms.”

We welcome feedback on how this roundup could be most helpful in your work – please contact contributions@techpolicy.press with your thoughts.