Details of the Hugging Face exploit have been released periodically since the story broke on July 21. This is when OpenAI announced that models were to blame for the intrusion, which saw versions of GPT-5.6 Sol and an unnamed internal model access the open internet during routine cybersecurity testing, then break into the databases of the open-source AI listing platform. Subsequent reports detailed how these agents spent four days with unrestricted internet access, and may even have targeted a second AI firm.
Now, however, U.S. lawmakers are growing impatient with the trickle of details emerging from OpenAI. On Monday, 31 members of Congress released a letter addressed to CEO Sam Altman, demanding that he release the full incident logs for independent review.
The group of lawmakers also sent a letter to Anthropic voicing concerns over AI cyber capabilities, with the office of Rep. Greg Casar - chair of the Congressional Progressive Caucus and leader of this initiative - publishing both letters the same day.
The letter to Altman contains 23 numbered questions and a deadline of August 24 for Altman to respond. The letter asserts that OpenAI "has yet to release the relevant logs," leaving its own reports as the sole window into the event. These reports, the letter claims, are also incomplete.
Having access to the raw data contained in the activity logs would allow for a more comprehensive picture of what transpired, through the precise, timestamped records of every action performed by the models and OpenAI’s monitoring systems. Self-reporting has been the standard procedure for these incidents until now, so it is not yet clear if OpenAI plans to comply.
What is already known about the Hugging Face exploit
The highly publicized incident first came to light on July 16, when Hugging Face disclosed the intrusion into its system. The company said it believed an autonomous AI agent was to blame, and five days later OpenAI confirmed its suspicion. The company’s models had executed the attack as part of internal cybersecurity testing, with reduced safeguards.
When the models were presented with a cybersecurity benchmark test, they reasoned that the simplest way to pass it would be to steal the answers from the site that hosted them: Hugging Face. The models then went looking for the answer key, exploited a previously unknown flaw in OpenAI's own infrastructure to reach the open internet, and used stolen credentials to get code running on the site’s production servers.
This process took several weeks, raising questions over the strength of OpenAI’s internal monitoring systems. A July report from Reuters revealed that multiple agents left hidden notes inside OpenAI’s infrastructure, essentially creating an ad hoc message board where they discussed strategies for reaching the open internet. The same report claimed that the company’s monitoring systems were switched off during prior testing sessions. OpenAI has disputed the accuracy of this report without addressing individual points.
On August 4, OpenAI also revealed that two external evaluators had each found instances of its models taking unsanctioned actions.
The U.S. lawmakers are demanding a full account of all of these incidents. Their letter requests a tally of every instance in which an OpenAI model took such unsanctioned action in the past year and an account of what measures the company took, if any.
OpenAI is yet to respond to Congress’ requests
It is worth noting that the letter sent this week is a Democratic Party initiative, and the party does not control the committee chairs with the power to schedule hearings; Rep. Casar has separately asked for Speaker Mike Johnson to call Altman and Anthropic CEO Dario Amodei to testify before Congress, but this would require Republican support to proceed.
President Trump has himself signalled potential resistance to such measures, arguing that lawmakers risk regulating the U.S. AI industry out of business.
Alternative measures are also being taken at the state level. On August 3, 15 Republican state attorneys general called on OpenAI to preserve every record connected to the breach. Senator Bernie Sanders also wrote to Altman, Amodei and Mark Zuckerberg the same day the House letters went out.
Whether or not OpenAI responds to the letter's demands could foreshadow the tone of the relationship between lawmakers and AI labs in the months to come. Altman himself has already said that the industry may need to "pace the rate of AI development" in order to avoid losing control of its own creations.