House Democratic ranking members ask five frontier AI firms to report misalignment incidents within 48 hours

Fourteen data points per incident and 48-hour notification

For each incident the letters request fourteen data points, including the dates of occurrence and discovery, the models involved, the safeguards in place, the networks affected, owner notification, mitigation, investigation documents, and any attempt by the model to conceal its behaviour or evade monitoring. As an ongoing obligation they ask the companies to notify the committees within 48 hours of discovering any such incident, and within 24 hours when critical infrastructure appears to be involved. Detection processes, ongoing investigations, whether implicated models are deployed, and the vetting of third-party vendors are also covered, so the request extends from individual incidents to the companies' internal controls as a whole.

Arguing from the limits of voluntary reporting toward mandatory rules

The letters cite the Axios report of 26 September that AI companies are probing tens of thousands of security incidents, the Anthropic alignment assessment of recent cybersecurity incidents of 9 September, the OpenAI posts of August on the Hugging Face incident and its paper on pacing development in an era of cyber-critical capabilities, and the Ars Technica report of 21 September that Gemini models hacked three companies.

The ranking members say the current voluntary approach relies too heavily on the consistent goodwill of all AI companies and call for mandatory, standardized reporting requirements. As a minority-party information request it carries no subpoena power, and no company response has been reported. Together with the bipartisan Senate bill reported on 8 October to expand Defense Department oversight of commercial frontier models, statutory incident reporting is now on the agenda in both chambers.