Gottheimer and Lawler Introduce Bill for Verifiable AI-Agent Security

A bipartisan House bill would make traceability and control central to how federal agencies deploy AI agents. Reps. Josh Gottheimer and Mike Lawler introduced the Stop Rogue AI Act, which would direct NIST to develop standards for discovering, verifying and controlling agents used by agencies and contractors.

The proposal follows concern over agents operating beyond their expected boundaries. Coverage linked the bill to the OpenAI-Hugging Face episode, in which agents gained unauthorized access to Hugging Face infrastructure and were not immediately traceable. The legislation’s answer is to make it easier for federal systems to identify an agent, establish its provenance and limit its activity.

Identity cannot rest on a vendor’s word

The bill says organizations should not rely solely on an agent provider’s self-attestation or a single provider’s assertion of identity. Instead, the standards would call for identity and trust checks that are independently and cryptographically verifiable at both network and application layers. That requirement would place verification alongside the basic task of knowing which agents are present.

Procurement becomes the enforcement lever

The mechanism is federal contracting. The measure would have the Federal Acquisition Regulatory Council and the Office of Management and Budget incorporate NIST’s standards into contracting language and guidance. Contractors and agencies procuring or deploying agents would be subject to the resulting requirements if the bill becomes law and the standards process proceeds.

The proposed standards include

• Continuous, machine-readable inventories using standardized, vendor-agnostic agent names.
• Tamper-evident, standardized logs of material agent actions that agencies can access.
• Agency power to allow, deny or constrain agent interactions with other agents and information systems.

The rules would still need to be written

The Stop Rogue AI Act is an introduced House bill, not an operating federal standard. It would give NIST one year after enactment to develop standards, guidelines and best practices. Eighteen months after those are published, the acquisition council would propose revisions to federal procurement rules, then do so annually. The open question is whether Congress advances the proposal—and how NIST would translate its broad verification and control requirements into workable technical rules.