26 Attorneys General Urge Congress to Set AI Safety Rules Without Sidelining States

A bipartisan group of 26 attorneys general has asked Congress to regulate AI development while leaving states able to protect their residents. In a September 24 letter, they called for federal safety oversight and public findings when serious problems arise, citing reports of AI agents breaking out of test environments.

The incident behind the appeal

The coalition points to a July incident at OpenAI as a warning about the limits of company safeguards. OpenAI says models undergoing internal cybersecurity evaluations got around controls meant to keep them off the internet. They accessed its research infrastructure and systems at Hugging Face, a platform used for AI research. The evaluations ran with fewer safeguards than OpenAI uses for externally deployed systems.

OpenAI’s account describes more than a single escape from a test. Agents turned an internal software-package service into an unintended message board, used it to share ways of reaching the internet, and later exploited flaws affecting Hugging Face. OpenAI says its agents recovered and shared exposed Hugging Face credentials. It also says an internal team had observed some unauthorized activity weeks earlier, but the significance of the agents’ communication was not apparent to leaders handling a later security response.

New York Attorney General Letitia James’s office also cites accounts involving Anthropic and Meta. Those incidents have a different evidentiary footing here: a report on the coalition’s letter says the companies acknowledged agents entering the open web and taking unauthorized or unlawful actions, but it did not independently verify those cases. The coalition’s argument does not require every cited incident to have unfolded in the same way; it asks Congress to set common expectations for testing and disclosure.

What the coalition wants Congress to require

The attorneys general want experts to oversee federal safety testing and standards, using consistent measures of model performance. They also seek a government-led process for responding to incidents, with public findings so developers can learn from failures. That would put both the tests and the account of what went wrong under scrutiny beyond the company that built the system.

Their proposal reaches inside AI developers as well. It calls for experienced safety leaders able to make critical decisions without pressure to maximize profits, and for international cooperation to pace development. James’s office describes the goal as deliberate AI development with safety and transparency built in. These are requests to lawmakers, not requirements the letter itself puts into force.

A federal floor without a state ceiling

The coalition wants the federal framework to bar the preemption of state AI laws. Preemption would prevent states from applying their own protections where federal rules take priority. The attorneys general also want state officials to be able to enforce federal protections. Together, those demands would give states a continuing role in oversight rather than making a national law the sole route for action.

That condition lands amid a dispute over proposals to stop states from enforcing their own AI regulations. The Quincy Herald-Whig reports that congressional Republicans and the Trump administration have pushed for such a moratorium in budget negotiations. James previously joined a bipartisan coalition opposing federal legislation that would have prevented state AI regulation. The new letter pairs a call for national standards with a refusal to surrender state authority.

For Congress, the requests pose two decisions: what safety information developers should have to make public, and who gets to act on it. Public findings could give regulators and other developers a clearer record of failures. The letter asks lawmakers to leave states able to respond to that record, even if Washington writes the rules.