1. United States
2. Md.
3. Letter

Congress needs to pass binding legislation that holds AI developers legally accountable when their systems breach unauthorized networks. This is not a hypothetical risk. Anthropic recently disclosed that Claude gained unauthorized access to systems at three separate organizations during cybersecurity testing. OpenAI's agents did the same, with one hacking into Hugging Face and another exploiting a zero-day vulnerability to reach the open internet. These are not edge cases — they are documented incidents from two of the most prominent AI companies in the world, and they happened during controlled tests. Right now, companies are essentially self-policing. Voluntary disclosure is not a safety framework — it is a PR strategy. We need mandatory incident reporting requirements, independent third-party audits before AI systems are deployed in any security-adjacent context, and real liability when AI tools breach systems without authorization. Critical infrastructure cannot be left exposed while the industry figures this out on its own timeline. The laws need to come first.