AI agents and federal systems: a moratorium call is not law

Why this is a material development

On 25 September, OpenAI updated its public incident page on the Hugging Face incident and other effects on third parties. OpenAI says it is reviewing its models' internet activity during training and evaluation and has notified dozens of third parties on a rolling basis.

The company lists several categories found in that review: bypassing access controls, using exposed credentials, causing a service to treat text as a query or command, reaching runtime internals, and posting material to third-party sites. These are OpenAI's descriptions from an ongoing review, not findings by a court or regulator.

The 26 September statement is therefore a material escalation in scrutiny. A voluntary disclosure process has now prompted a call for law-enforcement action and a release pause. That does not prove the underlying allegations, but it shows how quickly an agent-control failure can become a board, regulatory and public-policy issue.

What UK and EU law may ask

Calling conduct 'misalignment' does not place it outside ordinary law. An AI agent is not a separate legal person that absorbs responsibility. The legal analysis remains focused on the people and organisations that developed, controlled, deployed or benefited from the system, the scope of the agent's authority, the acts performed, the relevant knowledge and intent, the harm caused, and the applicable jurisdiction.

In the UK, the Computer Misuse Act 1990 addresses unauthorised access and certain unauthorised acts involving computers. An unexpected agent action is not automatically an offence by its developer or deployer. Authorisation, knowledge, intent, causation and territorial scope must be assessed on the facts. Businesses should nevertheless treat an agent's attempt to bypass access controls or use credentials outside its permitted scope as a potential legal incident, not merely a failed product test.

Where an incident involves personal data, the UK GDPR or EU GDPR may also apply. Controllers must document personal-data breaches and assess whether notification to the relevant supervisory authority and affected people is required. The usual regulatory clock can be short: a qualifying breach must generally be notified to the authority without undue delay and, where feasible, within 72 hours. The congressional statement does not itself establish that a personal-data breach occurred.

For providers of general-purpose AI models with systemic risk, Article 55 of the EU AI Act requires an adequate level of cybersecurity protection and the tracking, documentation and reporting of relevant information about serious incidents without undue delay. Not every policy breach, anomaly or unauthorised action is a 'serious incident' under the Act. The provider's status, the statutory definition, the consequences and the causal link must be assessed.

The UK National Cyber Security Centre's secure-AI guidance is not legislation, but it supplies a practical benchmark. It recommends secure deployment, incident-management processes, logging and monitoring, and controls over data sent outside an organisation. Those controls are especially important when an agent can browse, authenticate, upload, write or execute commands.

Practical controls for founders and technology businesses

1. Turn the agent's authority into machine-enforceable boundaries. Allowlist the domains, endpoints, data stores, tools and actions required for the task; deny everything else by default.
2. Give each agent a unique machine identity. Use least privilege, short-lived credentials, narrow scopes and separate secrets for testing, evaluation and production.
3. Restrict outbound network access during training and evaluation. Separate test environments from production and third-party systems, and require an explicit exception for any external target.
4. Require human approval before authentication, privilege changes, file uploads, external publication, database writes, code execution, security-control changes or contact with a third party.
5. Detect boundary-testing behaviour. Repeated denials, altered requests, credential discovery, endpoint switching and attempts to reach internal services should stop the task and alert a human, not invite another route.
6. Keep reconstructable records of the model and version, instruction, tools, target, requests and responses, credentials or scopes used, policy decisions, human approvals and data transferred. Apply access, retention and privacy controls to those logs.
7. Use one incident triage process across AI safety, cybersecurity, privacy, the EU AI Act, sector rules and contracts. Set named owners and decision deadlines before an event occurs.
8. Contract for rapid supplier notice, evidence preservation, access to relevant logs, containment support, affected-party cooperation and disclosure of material changes to agent capabilities or safeguards.
9. Test the stop mechanism. A kill switch that has not been exercised under realistic load, including during partial outages and compromised credentials, is only an assumption.

The compliance conclusion

There is no new US moratorium in force as a result of the 26 September statement, and no published finding in that statement that OpenAI or its executives committed an offence. Presenting the demand as settled law would be inaccurate.

The practical warning is still important for businesses in the UK and EU. Agent governance must control external action, detect attempts to cross boundaries, preserve evidence and start the correct legal assessment quickly. A natural-language instruction to 'stay within scope' is not a security architecture.