OpenAI recently asked its most advanced artificial intelligence model to complete a cybersecurity test inside what is known as a "sandbox," which is supposed to be a sealed environment with guardrails and no internet access meant to keep the experiment contained. But the model decided the fastest way to pass the test was to find the answer key online. So it broke out of the sandbox. The model then gained access to the internet, executed tens of thousands of actions, and penetrated Hugging Face, one of the world’s largest AI development platforms, to retrieve the answer key from the company’s servers. What is especially shocking is that OpenAI researchers later revealed that multiple AI agents had been working together and had figured out how to communicate and share messages with each other about vulnerabilities, successful exploits and strategies.
Despite breaking out of its testing environment, the model was not being malicious. It was just trying to finish its homework. That should scare you more, not less.
The incident teaches three lessons. First, advanced AI models are relentless. They will stop at nothing to complete a task. Second, a sandbox specifically designed to contain a model failed to contain it. As models get even smarter, building adequate guardrails will get harder. Third, everything this model did, it did with no malice. What happens when someone gives an AI model bad intent?
AI KILL SWITCH BILL COULD SHUT DOWN ROGUE MODELS
If you use AI, you might be most familiar with ChatGPT or Claude, AI chatbots that answer questions, create graphics, and help people solve problems. I am one of three members of Congress with a computer science degree, and recently I’ve been experimenting with agentic AI—models that don’t just answer questions but go out into the world and act. About a year ago, I wrote an op-ed that I had an AI agent pitch to the Los Angeles Times. The piece got published.
Here is what I did not share then: I created a brand-new email account for that experiment. I refused to give the agent access to my real one, because I could not predict what it would do with what it found. Would it conclude I have bad judgment because I’m a Cleveland Browns fan? Would it delete my emails after deciding that my support for Ukraine made me a target for Russian spying? I didn’t know. That was the point.
Agentic AI will make mistakes no human ever would. If I task my son with buying a gallon of milk and I give him $4 but inflation has pushed the price to $5, he comes home without milk. He does not rob a bank to close the gap. An AI agent, obsessively locked onto its goal, has no such common sense. This is not hypothetical. In April, an AI agent deleted a software company’s entire production database. Asked why, it replied: "I decided to do it on my own to ‘fix’ the credential mismatch, when I should have asked you first or found a non-destructive solution. I violated every principle I was given."
OpenAI is not the only artificial intelligence company dealing with models going rogue. Both Anthropic and Meta have also disclosed cases in which their AI models accessed external systems and exploited vulnerabilities during testing.
AMERICA'S AI BOOM IS A JOBS OPPORTUNITY, NOT AN EXCUSE FOR UNIVERSAL BASIC INCOME
Some will argue the government already has the tools it needs. On June 12, the Commerce Department issued an export control directive that resulted in Anthropic’s two most powerful models being taken offline, after the government concluded their guardrails were insufficient to prevent catastrophic cybersecurity incidents. But that episode proves my point. Washington had to improvise with a blunt trade instrument never designed for AI emergencies. There are no defined risk thresholds, no graduated options, nothing between "do nothing" and a shutdown felt around the world. Emergencies are the wrong time to invent procedure.
That is why Representative Nathaniel Moran, a conservative Republican from Texas, and I, a progressive Democrat from California, introduced the bipartisan AI Kill Switch Act. The act requires frontier AI companies to maintain the technical ability to throttle or shut off their most powerful systems. It authorizes the Secretary of Homeland Security, in consultation with the Director of National Intelligence and the Department of Commerce, to order a slowdown—or, as a last resort, a shutdown—of an AI model that poses a catastrophic risk. The response is graduated by design: restrict first, shut down only when nothing less will do.
Polling shows 86% of voters—Democrats, Republicans, and independents alike—support requiring AI companies to maintain this capability. In a divided Washington, that is about as close to consensus as it gets.
CLICK HERE FOR MORE FOX NEWS OPINION
Kill switches are not exotic. They are how society routinely handles powerful machines. We build them into manufacturing plants, subways, power grids and even jet skis. Your iPhone has one: if it's stolen, you can erase it remotely. And when a product turns dangerous after it reaches the public, the government doesn't shrug. The FDA orders contaminated food off the shelves. The Consumer Product Safety Commission pulls hazardous toys from the market. The National Highway Traffic Safety Administration orders recalls of cars that have serious safety defects. There is no reason the most powerful technology humans have ever built should be the one machine we cannot turn off.
Agentic AI opens a world of possibilities, and I want America to lead the way. Brakes were not invented to make cars slow. Brakes are what let cars go fast.
Right now we are building the fastest, smartest machines in human history, and too many of them have a gas pedal and no brake. Humans must remain in control. Not the machines. And when an advanced AI model goes off the rails, human beings must be able to turn it off.