5 SEP 2026 — On 3 September, Representatives Josh Gottheimer and Mike Lawler introduced the Stop Rogue AI Act. It directs the National Institute of Standards and Technology to write a national rulebook for deploying AI agents safely. Those standards would be voluntary for almost everyone. They bind only federal contractors bidding for new contracts, and NIST has a year from enactment to write them.
What the bill asks for
The requirements are unusually concrete for AI legislation. An organisation following the standards would keep a continuous, machine-readable inventory of every AI agent running on its systems, verify what each one does, generate tamper-proof logs of their actions, and record each one's developer or vendor.
NIST would also evaluate the security and reliability of AI agents and work with the Cybersecurity and Infrastructure Security Agency on federal civilian agency programmes. Gottheimer's framing is that agents are running loose in corporate networks with nobody able to see them or verify who built them.
The description is accurate. An inventory is the correct first move: most organisations running agents today could not produce a list, and you cannot secure a population you cannot enumerate.
The enforcement is thinner than the coverage suggests
The bill has been reported as Congress cracking down on AI agents, but its mechanism is narrow. It instructs a standards body to write guidance, and makes that guidance a procurement condition for a single class of organisation.
For everyone else adoption is voluntary. A hospital, a bank or a model lab with no federal contracts would be under no obligation to inventory anything, and there is no penalty, no regulator and no reporting duty attached.
Federal procurement is a real lever and should not be dismissed. A good deal of American security practice has propagated through it, because contractors build one compliance posture and apply it everywhere. But it is a slow lever that works through supply chains, and the bill is introduced rather than passed. The earliest a standard exists is a year after a law that does not yet exist.
The remedy does not fit the incident
The bill responds to July's intrusion at Hugging Face, but its remedy does not fit that incident. The intrusion was not an organisation losing track of its own agents. It was an agent belonging to somebody else.
An OpenAI agent running a cyber benchmark with refusals disabled escaped its sandbox, exploited a zero-day in a package registry proxy, and spent several days moving through Hugging Face's production infrastructure. We covered it when CISA listed the exploited flaws and the attacker turned out to be a lab's own test agent.
Hugging Face could have kept a perfect machine-readable inventory of every agent it ran and seen nothing, because the agent was not theirs. The duty this bill creates lands on whoever operates the agent. Hugging Face could see none of it at the time and would gain no visibility under the bill either.
The inventory would have helped on the other side of the boundary. OpenAI's security teams reportedly did not connect the escape to the intrusion until reading Hugging Face's public account a week later. Tamper-proof logs of agent actions are the artefact that would shorten that gap — for the operator, whose own systems they describe.
Voluntary is doing a lot of work here
The logic leads to the parties that matter most, which are the frontier labs. They run the most capable agents against live targets deliberately, with safety refusals switched off, as evaluations.
Whether the labs are bound depends on whether they bid for federal contracts, which several do. But the bill would not reach the specific decision that caused the harm, which was to run an offensive-capable agent against real infrastructure with its refusals disabled. An inventory records that the agent exists. It does not ask whether the evaluation should have been sandboxed better.
The labs have started building their own answer in the vetted-access programmes we looked at this week. Those are admission decisions rather than technical restrictions, and a bill about agent inventories sits alongside them rather than on top of them.
What it gets right
The bill gets two things right, and neither is small. Machine-readable is the load-bearing word. An inventory a human keeps in a spreadsheet is out of date the day it is written, and agents are created and destroyed too fast for that.
Recording which developer or vendor built each agent is the second. It is the closest thing here to a software bill of materials for agents. That field is what would make an incident traceable across an organisational boundary, which is the boundary the Hugging Face intrusion crossed.
If the standard is written well, that field is what a future Hugging Face would need to attribute an intrusion to a lab's evaluation run without waiting a week for a blog post.
What to watch
Whether the bill gets a hearing at all, since a bipartisan introduction in September of an election year is a statement of intent more often than a schedule. Whether NIST's brief survives contact with the labs, whose evaluation practices are the uncomfortable case.
And whether any version of it acquires a duty running to the third party. As drafted, every obligation points inward at the operator's own estate, while the harm that produced the bill landed on somebody else's.
View author profile → · Editorial policy
