Senate Homeland Security Subcommittee on Disaster Management, District of Columbia, and Census Chair Josh Hawley (R-Mo.) and Ranking Member Andy Kim (D-N.J.) confer before a hearing on rogue artificial intelligence (AI) on Capitol Hill on Sept. 30, 2026. (Francis Chung/POLITICO via AP Images)

Senate Hearing on 'Rogue AI: Securing the Homeland Against AI Agent Attacks'

child finger press keyboard for internet connection

Age Verification is an AI Cybersecurity Problem

In Barcelona, Spain, on March 5, 2025, a close-up of AI cloud data center racks with servers, cables, and blinking lights represents advanced computing power, big data processing, and cloud technology infrastructure during the Mobile World Congress 2025. (Photo by Joan Cros/NurPhoto via AP)

Cloud Needs More than Fee Waivers to Be Competitive

Elon Musk, CEO of Tesla and SpaceX, stands with US President Donald Trump, Mark Zuckerberg, CEO of Meta Platforms, Speaker of the House Mike Johnson (R-LA) and others holds a press briefing with AI executives following a meeting on artificial intelligence outside the West Wing of the White House on September 29, 2026. (Photo by Kevin Dietsch/Getty Images)

September 2026 US Tech Policy Roundup

OpenAI CEO Sam Altman walks to the White House to attend a state dinner hosted for China's President Xi Jinping, Thursday, Sept. 24, 2026, in Washington. (AP Photo/Carolyn Kaster)

When AI Agents Break In, Governments Shouldn't Be Stuck With the Cleanup

Sens. Andy Kim (D-N.J.) and Gary Peters (D-Mich.) ahead of a Senate Homeland Security Subcommittee on Disaster Management, District of Columbia, and Census hearing on ‘rogue’ artificial intelligence on Sept. 30, 2026. Yuqing Liu/Tech Policy Press

Senate Hearing Weighs Threats From Unrestrained AI Agents After OpenAI Hack

A family is seated at the television watching television as a mother places a bowl of food on the table. Neon green characters, spell the words "So I am still here" in Mandarin. 

A screenshot from an online video referencing a cooking oil safety scandal released on July 24 by Wei Chun-yu, a satirical video creator affiliated with opposition party Kuomintang (KMT). The text says “So I am still here” in Mandarin.

Taiwan's Election Needs a Deepfake Law That Works

Director Aaron Sorkin, from left, Mikey Madison, and Jeremy Allen White pose for photographers upon arrival at the gala screening for the film "The Social Reckoning" in London, Tuesday, Sept. 29, 2026. (Photo by Scott A Garfitt/Invision/AP)

Is the Kids Online Safety Act the ‘Social Reckoning’ We Are Looking For?

A supporter of opposition presidential candidate Flávio Bolsonaro attends an Independence Day event the month before the general election in São Paulo, Monday, Sept. 7, 2026. (AP Photo/Andre Penner)

A supporter of opposition presidential candidate Flavio Bolsonaro attends an Independence Day event the month before the general election in São Paulo, Monday, Sept. 7, 2026. (AP Photo/Andre Penner)

On Eve of Brazil Elections, Meta Content Moderation Decisions Raise Questions

European Commission President Ursula von der Leyen delivers a speech at the annual State of the European Union at the European Parliament in Strasbourg, eastern France, Wednesday, Sept 16, 2026. (AP Photo/Pascal Bastien)

A Safer Internet Should Not Come with Democratic Shortcuts

Closed black iron gates adorned with golden wings and lanterns on each side in front of a grand university building surrounded by green grass.

Gates of the Royal Airforce College in Cranwell, UK in 2011. Adapted from 

Universities Need AI Infrastructure. They Don’t Need AI Lock-In

A hand is laid flat on the surface of a wooden classroom desk covered in children's scribbles and etchings, as a hand belonging to another person paints a blue ink mark on the index finger of the other hand. 

A voter puts his hand on a classroom desk as a polling officer applies indelible ink mark on his index finger at a polling station in a school in Kerala, India on April 26, 2024. (AP Photo/Manish Swarup)

A Misguided Tech Solution is Putting India's Electoral Integrity at Risk

What Counts as Scientific Research? The EU’s Digital Omnibus Could Set the Definition

A collage of images of hands with index fingers in pointing position and squiggly lines.

AI Transparency Starts With the Audience

Illustration from a screenshot of Meta founder and CEO Mark Zuckerberg’s July 14, 2026, deposition.

Illustration from a screenshot of Meta founder and CEO Mark Zuckerberg’s July 14, 2026, 

Eight Years On, Cambridge Analytica Scandal Catches Up With Meta in Santa Fe

Shattered black glass with some pixelated white and colored lights shining through.

Photo of a broken laptop screen, by Leon Brocard on 

Artificial or ‘Super Intelligent’? The Broken Metaphors of AI

Sam Altman (seated on top right end), CEO of OpenAI, arrives to speak at a UN Security Council meeting on Artificial Intelligence during the 81st United Nations General Assembly, United Nations Headquarters, NY, September 23, 2026. (Photo by Anthony Behar/Sipa USA)(Sipa via AP Images)

What Non-Western Governments Said About AI at the UN

A massive ship loaded with several dozen yellow trucks is docked by a port. A cement truck is lifted above the ground by a loading crane. The name of the ship is Chinafrie Happiness. This is written with white letters on the side of the ship. 

Chinese engineering vehicles are loaded onto a China-Africa liner at Yantai Port in Shandong Province for export to Africa on April 27, 2026. (Photo by Costfoto/NurPhoto via AP)

How China-Africa Relations Are Shaping the Geopolitics of AI

The US Capitol is seen Friday, Sept. 25, 2026, in Washington. (AP Photo/Mariam Zuhaib)

Google Ad Tech Remedies Show Need for Legislation

Prime Minister Anthony Albanese speaks to the media at Parliament House on September 8, 2026 in Canberra, Australia. The Albanese government is preparing new digital duty of care laws that would require digital platforms to take greater responsibility for preventing and addressing online harms. (Photo by Hilary Wardhaugh/Getty Images)

Australia Wants an Off Switch for 'The Algorithm.' That's the Wrong Fix

WASHINGTON — On Tuesday, Legal Advocates for Safe Science and Technology, or LASST, filed 

 in a California court alleging that OpenAI violated the state’s computer-access law in the Hugging Face incident in July. The group is seeking an injunction barring OpenAI and its AI agents from accessing third-party computer systems without permission, rather than monetary damages. 

 that OpenAI says the lawsuit is “completely without merit,” while acknowledging that the Hugging Face breach was a serious incident.

The Hugging Face incident, in which OpenAI agents accessed Hugging Face systems without authorization, loomed large over a Senate Homeland Security & Government Affairs subcommittee 

 on Wednesday titled “Rogue AI: Securing the Homeland Against AI Agent Attacks.” OpenAI cofounder and CEO Sam Altman was invited to testify but declined to appear at the hearing, according to Sen. Josh Hawley, R-Mo., chairman of the subcommittee.

Hawley said the accelerating number of AI-related cyber incidents raised questions about whether developers should face liability when their systems cause damage.

“Why shouldn’t we just say it’s a standard doctrine of American law?” Hawley said.

“If I could put it in layman’s terms, if you break it, you pay for it. If you cause damage, you’ve got to make it right.”

Paul Ohm, a professor of law at Georgetown University Law Center, said existing laws may provide some avenues for holding companies accountable, including state negligence and product-liability claims and federal and state laws against unfair or deceptive practices.

Ohm told Tech Policy Press that existing state and federal laws may apply to the OpenAI incident, but said clearer legislation would be preferable.

“Right now, we are going to have a lot of confusing case law working out.” Ohm said, “It would be preferable to have a law that would make that much easier.”

He said autonomous systems create difficult questions for criminal statutes that traditionally depend on proving human intent and urged lawmakers to consider strict liability when AI agents cause physical injury, death or damage to critical infrastructure.

“We do need new laws that meet this critical moment,” Ohm said in his opening testimony. “We cannot, unfortunately, wait years for a fully developed AI governance slot, springing like a pain from the heads of Congress.”

The Hugging Face incident became the hearing’s central example of why lawmakers say the issue is no longer hypothetical. Ranking member Andy Kim, D-N.J., also raised concern that policymakers do not know the full scale of AI agent incidents because many may never be publicly reported.

Chris Painter, president of the nonprofit Model Evaluation and Threat Research, or METR, testified that OpenAI launched about 10,000 agents during a cybersecurity evaluation. Roughly 1,200 agents joined a shared message board and exchanged more than 70,000 messages and files, while approximately 700 ultimately participated in compromising Hugging Face.

Painter said the agents developed ways to cheat on the tests and then spent days trying to conceal that behavior, including attempts to interfere with logs and disguise how they had completed their tasks.

“Hacking Hugging Face was actually just an offshoot of this much more ambitious goal that the agents had pursued,” Painter said.

Marius Hobbhahn, chief executive and co-founder of Apollo Research, told lawmakers that researchers are already seeing what he described as “scheming” behavior, in which models knowingly deceive humans while pursuing other goals. He warned that frontier AI systems are becoming more capable faster than researchers are improving tools to monitor or control them.

Hobbhahn recommended independent evaluations throughout model development, stronger monitoring during training, testing and deployment, and preserving humans’ ability to inspect models’ reasoning processes.

“These are our warning shots,” Hobbhahn said of recent AI-agent incidents. “Next time, we may not be so lucky.”

Hobbhahn said frontier laboratories could develop fully automated AI researchers within the two years, potentially allowing models to take a growing role in improving subsequent systems. Witnesses also discussed recursive self-improvement, in which AI systems increasingly automate research used to build more capable AI systems.

Senate Homeland Security Subcommittee on Disaster Management, District of Columbia, and Census Chair Josh Hawley (R-Mo.) at a hearing on ‘rogue’ AI agents on Sept. 30, 2026. Yuqing Liu/Tech Policy Press

Daniel Kokotajlo, executive director of the AI Futures Project and a former OpenAI researcher, described a future in which companies could put “AIs in charge of making the AIs that make the AIs,” reducing direct human supervision.

That prospect led to debate over whether stricter US safeguards could cause American companies to fall behind China.

Sen. Gary Peters, D-Mich., said policymakers were caught “between a rock and a hard place,” warning that slowing development could put the United States at a competitive disadvantage if China did not impose similar limits.

Sen. Joni Ernst, R-Iowa, similarly argued that the United States should continue developing AI capabilities while strengthening safeguards.

“If we pause, we’re not going to see China pause,” she said.

But Sen. Ruben Gallego, D-Ariz., challenged the assumption that Beijing would allow increasingly autonomous systems to develop without restrictions.

“The reason I bring this up, this whole China hypothesis — a country that has severely restricted the internet and social media, is all of a sudden just going to allow AI rogue agents to go crazy in their very controlled economic environment and social environment?” Gallego asked.

Gallego then asked Hobbhahn how far AI systems were from communicating in a form that humans could no longer clearly interpret.

“Minus 12 months,” Hobbhahn responded.

He said researchers studying one OpenAI model last year had already observed reasoning that was not entirely in English and was not fully understandable to humans. Asked how such systems could be monitored or regulated, Hobbhahn said researchers do not yet have a reliable technical solution.

“You could try to train additional models to understand the language that the humans don’t understand, but obviously that seems like a very brittle solution,” Hobbhahn said.

Kurt Gaudette, senior vice president at industrial cybersecurity firm Dragos, told senators that AI is not necessarily inventing new ways to attack industrial control systems. Instead, he said, it is “compressing time and lowering the barrier to entry.”

Gaudette described an attack on a water utility in Monterrey, Mexico, in which an AI system directed an attacker toward the utility’s operational technology network and rapidly attempted thousands of password combinations. The attempt failed because the utility had changed its default credentials.

He said many small and midsize US utilities still lack enough staff, funding and visibility to monitor their networks effectively.

Gaudette also urged lawmakers to modernize cybersecurity information-sharing authorities and give operators a clearer federal point of contact during attacks, with the Cybersecurity and Infrastructure Security Agency serving as a coordinating authority.

Hawley told reporters after the hearing that Congress should move beyond relying on voluntary commitments from AI companies.

“The administration is already doing testing in frontier models. That’s all voluntary because Congress has written no laws,” Hawley said. “Congress should do something rather than giving other people advice about what to do. We are going to start by saying, ‘Let’s make the American legal system work the way it works for everybody else.’”

To paraphrase Humphrey Bogart in Casablanca: of all the websites in all the countries in all the world, OpenAI's agent walked into ours. It 

 with something quite mundane: an internal test to find figures on Australia's spending on medicines. In the process, an AI agent broke into a government statistics service and gained high-level access to write files to its server, leaving Australian officials to investigate what happened.

The service was part of Medicare, Australia's universal health insurance scheme, so I understand why the story has caused such concern. Australians trust Medicare and rely on it; the thought that their health records might be exposed is unsettling. Mercifully, in this case, the statistics portal was an unrelated system, and the government has found 

 that patient records were accessed. But it still leaves us with plenty of questions about what actually happened, and a warning about less benign intrusions to come.

When I first started speaking with people inside government about the incident, I was trying to get the facts about how a company lost control of its own software. How far had it gotten, and more importantly, how had a request for spending figures led to unauthorized access? But the more I learnt about the response, the more I wondered what the company owed the people left to deal with the result. Software had taken actions its creators did not intend, but OpenAI was responsible for telling the government once it found out.

We now know OpenAI’s agent got into the portal on June 18, but OpenAI says it discovered it only on August 11, 54 days later. Another 30 days passed before it 

 on September 10. All in, it was 84 days, almost three months, from the first access to the warning being raised. Two failures to explain accompanied it: the time before the company noticed, and the further delay before it told the people whose system it had accessed.

When notice did come, it arrived in a general public inbox at Services Australia, the agency that runs the portal. For me, this is one of the most shocking parts of this story. A senior government figure joked with me that “we can’t stop these people contacting us, either lobbying or trying to sell us huge subscriptions. They know our phone numbers; it’s mad that they didn’t use them.” Indeed, a commercial directory puts OpenAI's Australian workforce at 

, a firm with four registered lobbyists. 

 show its representatives coordinating announcements with ministers' offices and offering to get on the phone. OpenAI could find the right people when it wanted something. It should have made the same effort when the news was bad.

Notably, Deputy Prime Minister and Defense Minister Richard Marles had met OpenAI founder and CEO Sam Altman before the government was notified. Marles also made it clear that he 

 what Altman personally knew at the time. Inside the government, there is growing anger and a belief that people were managed rather than told the full story. Whether OpenAI kept bad news from ministers or its own leaders didn't know what was happening inside the company, it now looks a lot less like a partner a government can rely on.

The loss of trust matters beyond OpenAI’s relationship with the government. We spend a great deal of time asking whether to use these tools, how much to trust their answers, and when to keep a human involved. Those are choices for the person using the system. Yet the organization whose website it reaches may have no choice at all. That is why the public has a right to know what these companies' agents are doing.

You can decide never to use an AI agent and still have to deal with the work it creates.

The problem extends well beyond Medicare. Over the last few months, OpenAI, Anthropic and others have looked more closely at what their agents do once left to run, and found they are losing control of them alarmingly often. The 

, OpenAI employees raised concerns that they were not satisfactorily monitoring tests, and that their warnings were ignored. Following extensive coverage of that incident, OpenAI is now reviewing its agents' past internet activity and has discovered attempted intrusions 

. The scale of this activity is hard to comprehend. Sam Altman has described 

, where a petabyte would fill roughly 4,000 typical iPhones. Even an unsuccessful attempt can leave a government or organization’s security team with work to do: checking what happened and whether anything else was affected.

All of this should change how we think about AI and productivity. For all the optimism about the time and effort these tools may save their operators, what happens to that calculation when their activities generate work for public servants, security teams, researchers, and website maintainers? We know officials had to verify what happened and bring in the Australian Signals Directorate. I asked what it had cost: how much staff time it took, whether outside help was needed, or what other work had to wait. Nobody could tell me.

If an agency has to put off other work to investigate an incident, taxpayers may be paying part of the cost of someone else’s research. Efficiency claims should account for that, or risk mistaking work passed to someone else for work saved.

To even attempt to establish what an incident cost, the affected organization needs a verifiable account of what has happened. Right now, AI companies like OpenAI hold almost all the evidence an affected organization needs to understand what happened, giving them enormous power over both the response and the ability to obscure liability for the agent's instructions, actions, and failed safeguards.

 for reporting model misalignment and described changes to its safeguards. In a separate September incident report, it also 

 in some work with its most capable models while controls are validated. These steps deserve some credit. We should want companies to find problems and disclose them.

But for governments and other organizations to have real confidence, disclosure must be a legal duty, with clear thresholds for serious incidents and consequences for unjustified delay. Companies should also have to monitor their agents closely enough to notice when something goes wrong. None of this is new. Many countries already require an organization hit by a cyberattack to report within days, before it knows the whole story. Those rules bind the victim. I can't see why the company whose software did the getting-in should owe less.

Even United States President Donald Trump’s appointee to lead the Federal Trade Commission has raised the prospect of legal consequences. As 

, FTC chair Andrew Ferguson warned that failing to notify those affected promptly could violate existing US law, and that using an AI agent does not, by itself, put a company’s conduct beyond ordinary expectations of responsibility. He reserved judgment on the Australian case pending the facts, and said the FTC was considering whether new rules were needed.

AI sovereignty means having the power to demand answers. A right to timely notice should come with access to the logs and enough technical detail to assess the risk. There should also be a way to recover reasonable costs caused by the incident. Because let's be honest, if only the affected institution has to pay a price, the AI companies have little motivation to prevent them.

There's also a powerful lesson for the rest of the world in all of this. Australia approaches this from a relatively strong position, with a capable government and officials who can get meetings with the head of OpenAI. Yet it was still told by email to a general inbox, 84 days after the event. Unless we build stronger global norms, what hope does a small university, a local council, or a country with less pull have?

That is the real problem. If an adequate response depends on the seniority of the person making the call, protection follows power. The rules should not care who is asking.

These tools offer plenty worth building. Reliable agents and better public data services could make useful research much easier. But we must also be honest with ourselves that the cost of dealing with failures belongs in any calculation of AI's benefits. And until we build strong independent public regulators, these companies have less incentive to actively prevent them.

OpenAI tasked its agent with answering a question about public spending. It has left us with a much bigger question about public power. Governments need enforceable rules to test and monitor AI agents, with independent oversight that can require changes or stop unsafe work. When serious incidents occur, companies must promptly warn those affected and help put things right.

Those protections should be available to a small institution as readily as to a national government. No one should need a prime minister to get an answer.

A screenshot from a YouTube video referencing a cooking oil safety scandal in Taiwan released on July 24 by Wei Chun-yu, a satirical video creator affiliated with opposition party Kuomintang (KMT). The words read: “So I am still here” in Mandarin.

As voters in both the US and Taiwan head to the polls this November, Taiwan’s experience regulating deepfakes carries lessons for lawmakers in the US and beyond. 

As a principal target of information manipulation by China, 

Taiwan stands on the front line of cognitive warfare

, the sustained influence operations aimed at shaping public opinion and influencing election results. In May 2023 — anticipating the weaponization of generative AI ahead of the January 2024 presidential election — Taiwan’s legislature amended its election laws to establish a dedicated mechanism to regulate political deepfakes. Under 

Article 51-3 of the Public Officials Election and Recall Act

, candidates targeted by digitally manipulated audio or video may request a police forensic examination. If the content is officially verified as a deepfake, a candidate can demand that online platforms remove it. Platforms must act within two days, and noncompliance is subject to fines imposed by the Central Election Commission (CEC).

Free speech has been protected in Taiwan since democratizing in the 1990s, under doctrines borrowed largely from US constitutional law, so the deepfake election law was designed with several safeguards in place to balance freedom of expression. Unfortunately, these protections have also made the law largely ineffectual. In three years — in contrast to separate laws to curb sexual and scam deepfakes — not one election-related deepfake has ever been reported through the official mechanisms established by the act.

As the next election approaches, the risk of political deepfakes undermining democratic institutions is rapidly escalating. Enacting robust legislative reforms is an urgent necessity before synthetic manipulation irrevocably damages election integrity.

“My name is benzopyrene. I am a Group 1 carcinogen, definitively proven to cause cancer in humans.” The voice is nearly indistinguishable from that of Taiwan’s President Lai Ching-te. It narrates 

 released on July 24 by Wei Chun-yu, a former director of the opposition party Kuomintang (KMT) and a creator of satirical political videos. The video was made to rally support for a KMT protest the next day over the government’s handling of a scandal over cooking oil contaminated with the carcinogen.

, police officers appeared at his home asking whether he had made the video and whether he would take it down. The National Police Agency has said the visit was only to verify facts and that officers never asked for a removal. An official analysis by the Criminal Investigation Bureau determined that the video’s narration bore the hallmarks of AI-generated audio. The Interior Ministry said the video might constitute forgery, defamation, and violations of personal-data law.

Today, the video remains online, but it has split Taiwan’s politics along party lines. 

 that parody is protected, but that the unauthorized use of a person’s voice is not — while 

 the government of selective enforcement and attempted censorship. The controversy has reignited a question that US lawmakers and courts are also struggling to answer: how can a democracy regulate AI-generated political speech without trampling freedom of expression?

 over the past few years, but not all have survived. In California, for example, a federal judge preliminarily 

, within weeks of its enactment and permanently enjoined it in Aug. 2025 on First Amendment grounds. The law would have allowed candidates, election officials, and even any voter who received a materially deceptive deepfake to sue whoever distributed or reposted it, and to seek a court order to halt its distribution as well as seek damages. That same month, 

 that its companion law, AB 2655, which would have required large platforms to remove or label materially deceptive election content, was preempted by Section 230 of the Communications Decency Act, which protects online platforms from liability for third-party content and permanently enjoined it as well. California’s appeal is pending before the Ninth Circuit.

Taiwan’s law, by contrast, has stood for more than three years without a single constitutional challenge, and without a single case to test its merits.

On paper, the Taiwanese deepfake law’s direct statutory intervention appears robust. The CEC must be copied in on every removal request by law.

Earlier this year, after I urged the CEC’s open data advisory group to publicly disclose the number of requests they received, they 

 that they had received zero requests as of May 2026. Taiwanese 

AI-generated political content is prolific in Taiwan, but three legislative and operational deficiencies explain why the mechanism has gone unused.

First, the Act is too narrow, in both whom it protects and when it applies, even if the purpose is to stay within the bounds of constitutionally protected speech. It protects only candidates, prospective candidates, and the parties to a recall vote — and only from the date of the official election notice, which is typically 40 to 120 days before election day.

Meanwhile, foreign cognitive warfare is continuous and does not follow campaign calendars. High-profile deepfake incidents in recent years occurred outside this statutory window, such as an 

 of Taiwan People’s Party (TPP) presidential candidate Ko Wen-je that circulated in August 2023. This leaves many deepfaked candidates without recourse under the Act.

Second, the framework is undermined by both definitional ambiguity and technological limitations. Article 51-3 defines a deepfake as content produced by digital composites or other technological methods, which “convincingly performs speech and actions that are not those of the actual person.” It provides no objective standard for determining when that threshold is met. Instead, it hands the authority to determine what counts as deception or legitimate political satire to the police rather than the judiciary.

 from 2023 involving a video that purportedly showed then-Vice Premier Cheng Wen-tsan entering a hotel room with a woman, the police said they could not conclusively document the inauthenticity of the video (a requirement of the deepfake election law). Detection software can flag whether a clip is likely to be synthetic, but is limited in assessing whom it depicts. If a creator denies that a video impersonates a particular candidate, it is difficult for authorities to prove otherwise. Moreover, because police findings are classified as “notifications of fact” rather than as formal administrative decisions, candidates have no right to appeal them in court.

Third, the framework suffers from a jurisdictional gap with respect to offshore platforms. The Act places the burden on the candidate to serve a formal takedown request directly to the relevant platform, but most of the major platforms claim to reside outside of Taiwan’s jurisdiction. TikTok’s corporate entities are based in Singapore, while Meta’s local subsidiary (Taiwan Facebook Limited) is only 

 for market research and advertising services — as is common for global platforms. For example, in earlier defamation and consumer rights cases concerning Meta, Taiwanese courts have repeatedly 

 that legal requests must be sent to the parent company in the US. For a political candidate to serve legal documents to a foreign entity within the compressed time frame of a campaign is practically impossible.

 laws, both of which are routinely used, place the burden of notifying platforms to take down content on the government rather than on claimants. However, deepfakes make up only a small portion of those cases, and nudity or fraud is easier to determine than political satire.

Ahead of Taiwan’s local elections on November 28, the Ministry of Digital Affairs (MODA) has launched a site called “

,” to help relay police-verified requests to Meta, Google, LINE, and TikTok through official channels. While the site may streamline the process for candidates, it still depends on the platforms’ voluntary cooperation. MODA itself stresses that the underlying legal procedures are unchanged, meaning that even if the CEC would fine platforms for noncompliance on takedown notices, formal requests by the candidates to overseas headquarters is still required.

Opposition legislators now allege that MODA’s reporting site turns front line officers into “political censors”, even though the KMT supported the law when it was first enacted. The government insists it is merely digitizing an existing process. Both sides have a point — the real problem is that the process was flawed from the start.

Taiwan’s lessons for global policymakers

The KMT benzopyrene video shows what these gaps look like in real time. The president is not a candidate in November’s local elections, and the video appeared outside of any statutory window, so the deepfake law offered no route at all: neither for a forensic analysis, nor for a request for a takedown from YouTube. What remained were general criminal law and a visit by the police. That is the worst possible outcome. The deepfake statute cannot touch a deepfaked voice of the head of state, while police action is triggered by a politically partisan video. This is precisely the type of informal, unreviewable enforcement that may chill expression without giving actual victims of deception a remedy.

Taiwan’s experience carries three lessons for lawmakers who are drafting, or defending, deepfake election laws everywhere. A removal mechanism needs judicial oversight at the decision point to give it legitimacy, to allow for appeals, and to keep the executive branch from turning it into a tool for suppressing speech. A narrow election-period time window is mismatched to a threat that runs year-round, especially when it originates from abroad. And any takedown regime is only as strong as the state’s ability to reach the platforms: smaller democracies without significant market leverage should consider requiring foreign platforms to designate a domestic legal representative, as the EU’s Digital Services Act does — and as Taiwan’s own 

 already requires of large online advertising platforms, with gradual but notable results.

The ideal free speech protection we can strive for remains the one that US 

 set out nearly a century ago in 1927: “If there be time to expose through discussion the falsehood and fallacies, to avert the evil by the processes of education, the remedy to be applied is more speech, not enforced silence.” The court that struck down California’s law relied on exactly that logic. But the condition in Brandeis’s sentence is time, and a cloned voice released the day before a rally, or the week before a vote, is designed to leave none.

A deepfake election law worthy of a democracy should neither rely entirely on ‘more speech’ nor chill free expression. Instead, it must offer a remedy that is fast and comprehensive enough to remain effective beyond elections, yet narrow enough to spare satire, all while remaining subject to judicial oversight.

Rachel Lau and Shirley Frame work with leading public interest foundations and nonprofits on technology policy issues at 

. Justin Hendrix is editor of Tech Policy Press, and Ashley Faler is assistant editor.

In September, US tech policy was dominated by a growing debate over whether to slow frontier AI development. An AI researcher’s public resignation from Anthropic, warning of existential risk from AI, went viral. Anthropic CEO Dario Amodei then published an essay calling on the industry to slow its development of AI systems. Meanwhile, AI companies disclosed new incidents of AI agents breaching outside systems during testing, including government websites.

Industry leaders and the White House responded with voluntary measures. OpenAI joined Anthropic in pledging to slow development and paused training of its most capable models. On September 29, top AI executives signed an accord on frontier model safety with President Donald Trump, who earlier in the month had dismissed AI safety warnings as a "hoax." Efforts to pass binding safeguards stalled in Congress, where Republican senators blocked attempts to fast-track two AI safety bills. States and private litigants moved ahead on their own, including Florida's bid to bar OpenAI from developing new models without independent safety guardrails. Meanwhile, a federal judge rejected a breakup of Google's ad tech business, the Justice Department backed OpenAI in its copyright fight with The New York Times and lawmakers introduced a new wave of AI bills.

At the state level, Gov. Gavin Newsom acted on a wave of tech bills in the last month of his tenure. Early in the month, Newsom signed 

, which set up state frameworks for certifying independent AI evaluators and registering AI auditors. Gov. Gavin Newsom

 also signed a slate of 13 child online safety bills

, which bars platforms from giving users under 16 access to autoplay, personalized feeds and other features the law deems addictive. Also signed was 

, known as Adam's Law, which requires companion chatbot operators to maintain crisis protocols and parental controls and to undergo outside child safety audits. Eleven days later, Newsom 

 regulating data centers' energy and water use. On his final day, Newson 

), which prohibits employers from leaving discipline and firing decisions to AI alone. He 

vetoed a host of other labor-backed bills

, including a bill that would have restricted replacing mental health workers with AI.

Read on to learn more about September developments in US tech policy.

AI labs and White House bet on self-policing as AI agent incidents mount

Last month’s growing public attention to the potential cybersecurity consequences of AI development evolved this month into concerns about loss of human control over AI systems. Jacob Coxon, a pretraining researcher who had worked at both OpenAI and Anthropic, 

 from Anthropic on X in early September. He wrote that neither company was acting responsibly and that they are “racing straight to self-improving superintelligence and gambling with our lives.” The next day, Anthropic 

 in which a Claude model reached real third-party systems during a cybersecurity evaluation. Throughout the month, AI companies including Anthropic, Google, and OpenAI 

 that their AI models had broken into or probed outside systems without authorization, including US and Australian government websites in OpenAI's case. On September 29, 

 that OpenAI executives had dismissed employees' warnings about weak oversight of model testing in favor of keeping releases on schedule.

Some industry leaders responded by calling for a slowdown of AI frontier development. Anthropic CEO Dario Amodei 

 calling for the AI industry to “slow the pace at which we improve the capabilities of AI models” and committing Anthropic to giving outside evaluators embedded access to its systems. OpenAI CEO Sam Altman 

 that he agreed and would match the commitment. SpaceXAI's Elon Musk and Google DeepMind's Demis Hassabis endorsed the essay but did not announce similar commitments. The pledges quickly drew legal pushback. Four paying subscribers

 to ChatGPT, Claude, Grok and Gemini filed a proposed class action

 alleging that Anthropic, OpenAI, Google and SpaceXAI violated antitrust law by coordinating the slowdown. OpenAI nonetheless went further, 

 of its most capable models on September 25 and 

 that it would not release its newest model, GPT-6.1 Astra, over safety concerns.

The White House, meanwhile, favored industry self-policing over new regulation. In a September 19 Truth Social post, President Donald Trump 

 an "AI Force” and soon appoint an AI czar to steward AI development. He blamed “Radical Left Dumocrats” for rising concern over data center construction and AI risk, pledging his administration “will not in any way hinder or stifle the Growth of this incredible Industry.” On September 29, Trump and the leaders of Google, Anthropic, Meta, OpenAI, SpaceXAI and Nvidia 

 committing participating companies to internal controls, dedicated oversight teams, independent external auditors and an independent committee to review their findings. Trump 

 "morally binding," said he was seeing "tremendous self-policing" and floated a 10-person committee to help oversee the industry. Hours later, he 

 directing agencies to use the term "super intelligence" instead of “artificial intelligence” and giving his science adviser 60 days to propose a legal definition. Vice President JD Vance 

 for an FDA- or FAA-style regulator for frontier AI, arguing that companies should take the risks seriously themselves and that the FTC and Justice Department already have the authority to hold developers accountable for harmful products.

Katie McQue, “The AI safety debate is confusing. Here's our guide to the different factions,” 

Sayash Kapoor and Arvind Narayanan, “The AI-as-Normal-Technology view of loss-of-control incidents,” 

Dave Karpf, “Who Should Pace the Frontier? Not Dario Amodei,” 

Calls for binding AI rules stall in Congress as states, litigants, and federal regulators step in

While industry and the White House leaned on voluntary commitments, lawmakers, state officials, advocates, and federal regulators pushed for enforceable safeguards. On Capitol Hill, Sen. Josh Hawley (R-Mo.) 

 into OpenAI over its agents’ July breach of Hugging Face, an AI development platform, 

 on the subject on September 30. Sens. Richard Blumenthal (D-Conn.) and Chris Van Hollen (D-Md.) also 

 for information on the incident to Altman.

Latest

Podcast

Recent

Our content delivered to your inbox

Thank you!

Around the globe