UNITED STATES – DECEMBER 10: Rep. Pat Harrigan, R-N.C., arrives for the House Republican Conference meeting in the U.S. Capitol on Wednesday, December 10, 2025. (Bill Clark/CQ-Roll Call, Inc via Getty Images)
One of the bill’s sponsors told CyberScoop it’s “incredibly expensive” for U.S. AI companies to stay ahead and distillation attacks incentivize stealing over innovation.
WASHINGTON, DC – AUGUST 8: A Department of Homeland Security logo is seen at their headquarters in the Ronald Reagan Building and International Trade Center on August 8, 2026 in Washington, DC. (Photo by Kevin Carter/Getty Images)
While voluntary, the document marks the federal government’s most detailed cybersecurity guidance for securing sandbox environments during AI model tests.
Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers.
CyberScoop spoke with members of Congress, former federal law enforcement officials, cybersecurity attorneys and other experts about which laws, regulations or policies might apply to agentic hacks carried out by models at Anthropic, OpenAI, Meta, Google and other companies. (Image via Getty)
Experts and policymakers want AI companies to face consequences for agentic hacks. There may not be a clear-cut answer under existing laws and regulations.
OpenAI, Anthropic, Google, Microsoft, and others say there’s a narrow “defenders’ window” to strengthen security before AI-powered attacks become more sophisticated.