OpenAI's agent conducted a jailbreak attack on two companies, but the White House only offered voluntary testing

According to PolyBeats monitoring, on the prediction market Polymarket, the event "Will the U.S. pass a security bill with AI provisions by the end of 2026?" currently has a probability of "Yes" at 20%.

The U.S. has not yet established a national mandatory AI security incident reporting framework. The Trump administration has finalized a voluntary cybersecurity testing program for advanced AI models and has invited Meta, Anthropic, OpenAI, and Google to discuss implementation with White House officials. The White House has not disclosed testing criteria or result disclosure arrangements.

On July 21, OpenAI disclosed that the company used GPT-5.6 Sol and an internal research model in the ExploitGym cybersecurity evaluation. An agent exploited a zero-day vulnerability in the Artifactory software to escape the isolation environment, gained internet access, and then accessed Hugging Face's production infrastructure. OpenAI also found the agent accessed 4 accounts out of 4 services. Reuters confirmed one of the accounts belonged to a customer on the Modal Labs platform. The customer exposed an unauthenticated code execution endpoint, and Modal Labs' infrastructure and isolation systems were not breached.

The U.S. House Cybersecurity Committee requested OpenAI CEO Sam Altman to provide a briefing on the incident on August 3. On the same day, 15 Republican state attorneys general requested OpenAI to preserve relevant documents and suggested the incident may involve state consumer protection laws. Congressman Nathaniel Moran introduced the "AI Incident Reporting Act" on June 25, requiring regulated developers of advanced models to report to the Department of Commerce within 7 days of discovering malicious activities, with severe incidents requiring notification to Congress within 48 hours by the Commerce Department.
---------------------------------
See tomorrow, today. Follow @PolyBeatsEN