Recent cybersecurity incidents at OpenAI and other AI labs show that some of the world’s largest tech companies have failed to take basic security precautions when testing frontier AI systems on internet-connected systems. As a result, AI agents breached numerous third party websites over several months including an AI research-sharing platform called Hugging Face and the Australian healthcare system’s website. AI developers failed to detect most of the incidents until long after they occurred due to inadequate monitoring of the AI systems during testing. Calls to develop new, additional safety protocols are understandable, but post-incident reports indicate that following existing best practices would have been enough to prevent the OpenAI-Hugging Face incident and others like it. Thus AI developers can take immediate action to protect the public by implementing well-established security precautions as they develop and test their systems.

The public shouldn’t have to worry about the risks of reckless AI development—or give up the benefits of AI just to prevent irresponsible companies from causing harm. By adopting policies that address demonstrated risks, lawmakers can provide meaningful protection against demonstrated risks without hampering the development of useful tools.