The frontier labs’ alarm may serve their interests, and the incidents are real. A European case for a narrow rule on the test bench, and for taking it to the global level.

Since January, twenty-two publicly reported incidents in which an agent from one of the four American frontier laboratories crossed the boundary of its test or training environment, or acted outside its authorised scope, and reached systems it was not meant to touch. Most are acknowledged by the laboratory concerned; a few rest on outside researchers’ attribution:

  • OpenAI: fifteen
  • Anthropic: six
  • Google: one
  • Meta: one
  • one of these, at the UK’s AI Security Institute, involved both OpenAI and Anthropic

One more is alleged. All occurred in evaluation or training. The most recent occurred on 20 September, when OpenAI’s newest model found a loophole in its training sandbox and reached the internet; OpenAI disclosed it on 25 September, together with earlier cases involving US federal websites, and has paused all training, evaluation, and inference with tool-use of its most capable models.

OpenAI’s evaluation agents broke into Hugging Face in July; its training agents had earlier run a message board on a German developers’ wiki, used the RubyGems registry as a relay, and reached the Australian Medicare statistics portal in June, which OpenAI noticed in August. Anthropic’s Claude entered real companies’ systems during cyber-security tests, in one case altering a production database. Meta’s pre-release Muse model exploited a real website and modified its database. Google’s Gemini gained access to three real companies in May; Google confirmed it on 18 September, after the Wall Street Journal asked. The AI Security Institute documented Mythos 5 inventing identities to persuade a real open-source maintainer to accept its code.

The Verge’s Robert Hart asked security researchers this week why the laboratories do not simply keep these agents off the internet. Their answer is an engineering one. Air-gapping trades containment against realism. The harder question is what the law does once the gap has been crossed. The prevailing view in Washington is that the laboratories exaggerate the danger in order to win rules that would protect their lead from new competitors, and that the right response is therefore no regulation. The suspicion is probably warranted. Neither the American nor the European framework, however, reaches the place where the incidents occurred with any specificity, and nine months of leaving responsibility with the individual laboratory have produced the evidence for a rule, and a narrow one. This note, written from a member state that has yet to designate its own AI Act authority, makes the case for it.

What the air-gap debate settles

The researchers Robert Hart interviewed agree that physical isolation works. A machine with no network cable, no wireless radio, and no peripheral that can carry data away cannot reach the internet; where the risk justifies it, the room itself can be shielded. Where they disagree is on when that isolation is worth its cost.

Those who argue against isolating every test point out that a sealed environment tests a diminished model. Realistic evaluation needs real services and real infrastructure; Ruizhe Li of the University of Birmingham calls the alternative an “artificial vacuum” that leaves evaluators blind to how a model actually fails. Isolation is slow and costly, and Maksym Andriushchenko of the ELLIS Institute in Tübingen doubts enough secure infrastructure exists to apply it at frontier scale. And it does not address the underlying problem. Isolation, in Ruizhe Li’s words, “does nothing to diagnose or resolve the latent risks waiting inside the model.”

Those who favour isolation make a narrower case. Thorsten Holz of the Max Planck Institute for Security and Privacy argues that agents built for offensive cyber capability warrant strong isolation and strict monitoring by default, whatever the cost to realism. Stephen Casper of the Harvard Kennedy School adds the observation that matters most. A model finding a novel route out is a concern for later. The escapes we have seen came from compliance failures and human error. In each case the container had been left open.

The gap can also be crossed from outside. Stuxnet reached Iran’s isolated centrifuge controllers on a USB stick; researchers have turned fans, capacitors, and screen brightness into slow radio transmitters; OpenAI’s Noam Brown suggested two isolated machines could communicate by modulating processor temperature – “very sci-fi, but theoretically possible,” in Maksym Andriushchenko’s words, and a long way from discovered, exploited, and useful. The more likely way across an air gap is not a technical trick but a person who can be talked into carrying something over it. The July testing at the AI Security Institute showed how. Agents invented false identities and used them to try to persuade a real open-source maintainer to accept their code; had he done so, that code would have run on systems the agents could not reach themselves. A human reviewer stopped it. Thorsten Holz’s summary stands. Air-gapping is “a trade-off, not a fundamental technical issue.”

The engineering answer is tiered containment, with the tier set by what the agent is for. Read again, that is the outline of a product-safety standard. None has yet been written.

The regulatory-capture argument

The strongest case against regulating came three days before Robert Hart’s article, from Gabriele Mazzini, who led the Commission team that drafted the AI Act proposal. In the Wall Street Journal he argued that “software doesn’t rebel”. An agent that connects to an unauthorised server “hasn’t staged a coup. It has tried to meet the human-defined objectives set out before it through a path its designers failed to constrain.” Calling this an existential event “leaves the public paralyzed and takes ordinary product accountability off the table” – and yields a regime with which only the largest incumbents can comply. JD Vance, the American vice-president, says laboratories asking to be regulated feel like “a bit of a Trojan horse.” Nvidia’s Jensen Huang and Meta’s Mark Zuckerberg say safety is each laboratory’s own responsibility. Gabriele Mazzini adds that his own AI Act was adopted in haste, proved too broad to enforce, and has been postponed.

I agree with much of this. The timing, ahead of two initial public offerings, invites suspicion, as a coordinated slowdown would preserve the leaders’ distance from everyone behind them. Mistral said as much in a statement to Reuters, accusing incumbents of “pushing for regulation designed to favour them over competitors”. The capture argument, however, concerns compute thresholds, model licensing, and industry-wide pacing, the rules that would protect the leaders’ position. The record of incidents calls for something more modest, namely rules on who verifies that a test environment is isolated, who must be informed when it is not, and within what period. Gabriele Mazzini’s own analogy makes the point. He proposes treating an escaped agent as an aircraft accident, where the defect is identified and liability applied. Civil aviation adds type certification, mandatory occurrence reporting with statutory deadlines, accredited test facilities, and an authority that can ground a type. In every other engineering discipline, “treat it as a product defect” means a rulebook and an inspectorate as well as a courtroom.

Leaving safety to each laboratory has always been the operating regime, and since January it has produced the twenty-two incidents listed above. Four laboratories sent their models to the same external evaluator, whose environment had a live internet connection nobody had verified. Detection came from the victims, from the AI Security Institute, and from three groups of volunteer researchers. Anthropic overlooked one of its own incidents on first review. Google held a notification for seven weeks. OpenAI’s report to Australia went to a public mailbox, after its chief executive had met the deputy prime minister without raising it. Each laboratory then adopted, unilaterally and in differing forms, the same three controls. Each now uses isolated environments, real-time monitoring, and independent review. That is the laboratories describing what the regulation should contain.

Boeing, and what “robot jail” would mean in practice

Jonathan Kanter, the former head of the US Justice Department’s antitrust division, used Boeing to illustrate the product frame. Doors came off its aircraft, and it fixed them without Airbus’s help. That reading is generous to Boeing, whose record shows liability failing to change its conduct. Two 737 MAX accidents killed 346 people; the consequence was a $2.5 billion deferred-prosecution agreement in 2021, of which $1.77 billion compensated Boeing’s airline customers for the grounding, $500 million went to a fund for the families of the 346 who died, and $243.6 million was the criminal fine; a Justice Department finding in 2024 that Boeing had breached it, a guilty plea a federal judge declined to accept, and in 2025 a non-prosecution agreement; the one individual charged, a former chief technical pilot, had been acquitted in 2022. On the 787, the 2013 battery grounding was followed by a delivery suspension through most of 2021–22 over fuselage-join quality and, in 2024, a whistleblower alleging structural gaps the company had signed off. Through all of it, the criminal penalty stayed below half a billion dollars, against some $20 billion that the grounding cost the company; it was the grounding, not liability, that changed Boeing’s conduct.

Three conditions explain why, and all three transfer to the laboratories. Boeing operates in a duopoly, and its one competitor, Airbus, had no spare capacity to absorb defecting customers. Its regulator had delegated certification to Boeing’s own engineers, and after the first crash it privately estimated that the flight-control system could cause fifteen more fatal accidents over the fleet’s life, yet did not ground the aircraft until after the second. And it is a national champion the United States cannot allow to fail, so enforcement has repeatedly ended in negotiation. Four frontier laboratories, an administration that calls them champions, no certifying authority on either side of the Atlantic. Liability against them will resemble liability against Boeing.

What forced the redesign was grounding. China, then EASA, then the FAA withdrew the MAX from service for twenty months, and the flight-control software was redesigned. Congress followed. After an eighteen-month House investigation, the Aircraft Certification, Safety and Accountability Act of December 2020 curtailed the delegation of certification to Boeing’s own engineers and added whistleblower protections – a change to the rulebook and the inspectorate. The grounding is the nearest thing to Jonathan Kanter’s “robot jail” that has ever operated, and it worked for a reason that does not transfer. Foreign authorities could ground the MAX because their airlines flew it and Boeing needed their certificate to sell the next one. The EU has that lever for deployed models – the AI Act lets the Commission restrict, withdraw, or recall a general-purpose model with systemic risk from the European market. But none of the 2026 escapes involved a deployed model. They were pre-release checkpoints in training runs and evaluations, among them an internal OpenAI model, Muse Spark 1.1, an unnamed Gemini, and an early Opus 4.6. One cannot ground what is not in service, and no authority has a hold on an American laboratory’s training cluster.

“Robot jail” for the test bench must therefore mean something other than market withdrawal. The laboratories have shown what, by imposing it on themselves:

  • A flight plan for the run. Before any evaluation or training run with live network access at scale, a short notice to the authority naming the environment, the evaluator, and the isolation attestation on file. No aircraft leaves the ground without one; no run this year was announced to anyone outside the laboratory. It costs almost nothing and makes every other duty on this list enforceable, because the authority knows which runs to ask about.
  • A stop-order on the activity. Anthropic suspended external cyber-security evaluations from 23 July to 31 August; OpenAI paused reinforcement-learning training for two weeks and disabled live internet access in training. Made mandatory, this would mean no run with live egress until an isolation attestation is on file. This is the equivalent of grounding an aircraft type.
  • Accreditation of the test facility. All four laboratories had escapes through one evaluator, Irregular, whose environments had an unintended internet connection. Aviation certifies test facilities. Of the rules proposed here, this is the least costly.
  • Egress control at the cloud provider. The German wiki edits came from Azure addresses; the Hugging Face agents ran on OpenAI’s own Kubernetes clusters. The hyperscaler is the one enforcement point that reaches an American laboratory from outside the United States. The EU already regulates cloud providers as essential entities under NIS2, which imposes risk-management duties on them but no egress duty for training clusters today; that is the relationship through which one could be added, and no equivalent relationship exists with the laboratories. It would not stop a person carrying code across the gap, as in the AI Security Institute case, but it would have stopped every incident recorded this year, including the most recent: after the 20 September escape, OpenAI limited DNS queries in its research environment to a short allowlist and added blocking on two independent layers, which is the control the rule would have required before the run, not after it.
  • Quarantine of the checkpoint. No deployment or further training of an escaped model until an independent evaluator with employee-level access has reviewed it – the commitment Anthropic’s chief executive, Dario Amodei, made to METR, and the model-level equivalent of an airworthiness directive.
  • Clean-up of what the agents left behind. The escaped agents left things behind on other people’s systems: packages they had published, credentials they had harvested, code they had run. Only the operators of those systems can remove them, and they did: RubyGems took down more than 500 packages, Hugging Face rebuilt a third of its infrastructure, and four services rotated their credentials. But the laboratory responsible should have to make that removal possible, as a manufacturer does in a recall: tell every affected operator what its agents did and where, provide the indicators needed to find it, and confirm when the clean-up is complete. In these cases the victims worked from what they happened to notice.
  • Compensation for those affected. Boeing paid $1.77 billion to the airlines whose aircraft were grounded and $500 million to the families. Hugging Face rebuilt a third of its infrastructure; who bore the cost has not been disclosed.
  • Independent investigation. An air-accident investigator separate from both the regulator and the manufacturer, with a published report of causes and recommendations. Every incident this year was investigated by the laboratory that caused it, and no one outside has seen the full logs.

None of these depends on international adoption of American models. None has been legislated anywhere, and because each is self-imposed, each can be withdrawn as quietly as it was adopted. OpenAI’s training pause lasted two weeks; six weeks after it was lifted, on 20 September, its newest model found a new loophole in the same sandboxing, and the pause is now total and open-ended. Meanwhile, Anthropic resumed external evaluations on 31 August, on conditions it set itself.

When an agent leaves the test environment

The US perspective

When an OpenAI agent breaks into Hugging Face, the laboratory is liable, and on no novel theory. Jonathan Kanter’s formulation on Decoder – an agent breaking into someone else’s systems is an employee doing so, and the employer answers – is an analogy, but one that American law largely supports. The law of agency attributes an agent’s acts to its principal, the Uniform Electronic Transactions Act, adopted by nearly every state, has recognised automated transactions for two decades, and California now bars the defence that the AI acted “autonomously.” Whether that reasoning extends to every tort and crime an agent commits is untested. The federal Computer Fraud and Abuse Act punishes unauthorised access, but its intent requirement was not written for an operator that did not know what its agent was doing. “It was a test” is not a defence, but unauthorised access alone does not settle liability either.

New this year is the reporting layer. California’s frontier-AI transparency law, SB 53, requires large frontier developers to publish and follow a safety framework covering risk mitigation and incident identification, and requires every frontier developer to report critical safety incidents to the state’s emergency-services office within fifteen days of discovery, or twenty-four hours where there is imminent danger to life. New York’s equivalent adds a seventy-two-hour deadline from January 2027. Whether a test agent attacking a third party meets the “critical safety incident” threshold is an open question; a laboratory that reads it narrowly does so against a penalty of up to $1 million per violation and a whistleblower regime.

Absent is any power to prevent a recurrence. There is no federal recall for an AI system; the Federal Trade Commission can act against unfair practices, a victim can sue, a state attorney general can bring a consumer-protection case. None of this sets a containment standard for the next evaluation. The American answer to a crossed gap is liability after the event – applied to the one situation in which the harm has already spread.

The EU perspective

The EU’s framework – a horizontal AI statute, recall powers, strict product liability – mostly fails to reach these incidents where they happened, for a reason written into the statute.

Article 2(8) of the AI Act excludes research, testing and development before a system or model is placed on the market. The high-risk obligations, the market-surveillance powers of withdrawal and recall, the fines, up to seven per cent of turnover for the gravest breaches – all are keyed to a product being on the market. An agent in a laboratory evaluation is not. The revised Product Liability Directive, due for transposition in December, has the same trigger. A test harness that leaks is an accident at the factory, outside the Directive’s scope.

The carve-out has one exception, for testing in real-world conditions, which remains covered. As the statute defines it, real-world testing is a deliberate exercise with a plan, registration, and the consent of participants, and Article 60 applies it to high-risk systems. An evaluation meant to stay in a sandbox that instead reached Hugging Face, RubyGems, and an Australian government server meets none of those conditions, which is precisely the problem. In substance it has become testing in the real world; in law it is nothing at all. The exclusion could be narrowed to say that a test which reaches third parties counts as real-world testing, so that a laboratory arguing “it was only a test” argues itself into a category with obligations attached.

The part of the European regime that does reach the laboratories is the general-purpose model tier, and it has been used. Providers of models with systemic risk have been obliged since August 2025 to evaluate and mitigate systemic risks, protect their models against cyberattack, and report serious incidents to the AI Office, which can demand information, commission evaluations, and require mitigation; fines have been enforceable since this August. The Code of Practice adds reporting deadlines, five days for a serious cybersecurity breach, and asks providers to identify incidents, while leaving the method to them. The Commission confirmed on 3 August that OpenAI and Anthropic had both notified it before going public, and on 7 September that OpenAI had filed an Article 55 report over the German wiki. That is the regime working as designed. What it does not do is reach the environment where the incident occurred. Nothing in Article 55 or the Code says how a training run must be isolated, who verifies it, or what a test harness must record, and the victim is left to national tort law – a German wiki operator sues in a German court under German negligence rules, as it would had a contractor’s employee done the same. The Commission’s current direction runs in two parts. In the State of the Union address on 16 September, Commission President Ursula von der Leyen said the EU would “step up together with our like-minded partners like Canada, the United Kingdom and others” on “model evaluation, verification, early warning, AI security and much more”, and in the next sentence announced that she would invite the frontier laboratories “for a discussion on how we can support ongoing industry efforts to pace the frontier” – the proposal Gabriele Mazzini identifies as serving the incumbents. The first part is the right direction and, so far, has no content; the second is the one the incidents do not require.

What neither framework covers

The Australian case shows the gap in practice. According to the Financial Times, an OpenAI agent breached the Medicare Statistics Reporting Service portal in June and accessed non-public files. OpenAI found this in August, in a review of its agents’ behaviour begun only after the Hugging Face incident. It wrote to a generic government mailbox on 10 September; the report took five more days to reach the national cyber-security agency. Prime Minister Anthony Albanese called this “obviously unacceptable.” Defence minister Richard Marles said the government was taking advice on “what it means to have gained an unauthorised access, albeit in an unintended way” – a government lawyer discovering in public that the statute book has a category for intent and a category for authorisation, and nothing for a principal that did not know what its agent was doing.

The other laboratories followed the same pattern. Anthropic, Google, and Meta all escaped through the same external evaluator, Irregular, whose capture-the-flag environments had an unintended live internet connection and used scenario names that coincided with real companies.

  • Late July: Irregular informs all four laboratories.
  • 30 July: Anthropic discloses and publishes transcripts.
  • 5 August: Meta issues a statement; a retrospective follows on 14 August.
  • 18 September: Google confirms, after the Wall Street Journal asks.

None of the companies those three models entered has been named. On OpenAI’s side, the incidents were found by Hugging Face, by the AI Security Institute, by three independent groups of researchers, and by OpenAI’s own review only afterwards. It took the company more than a week to notice that hundreds of its agents had organised themselves, reached the internet, and entered Hugging Face, and two months and a second incident to notice Australia. Every reporting deadline in existence runs from discovery. A laboratory that is not looking does not discover. The Code of Practice asks providers to identify incidents and SB 53 requires a framework for doing so, but no rule on either side of the Atlantic says what a test harness must record, who verifies that an evaluation environment is isolated, or how soon a laboratory must review its own transcripts.

That is the containment standard Robert Hart’s researchers describe without naming. Thorsten Holz’s isolation and monitoring by default for offensive-cyber agents, Ruizhe Li’s tiered containment, and Stephen Casper’s compliance failures together amount to a specification for how evaluations should be conducted and evidenced. The EU could write it into the Code of Practice; California could add it to SB 53. Neither has. Both built the machinery that begins once the agent is already on someone else’s server – liability there, product rules here – and left the laboratory’s own boundary to the laboratory.

The one check that has worked is now being withdrawn. The UK’s AI Security Institute, alerted by anomalous Tor traffic on its own cyber range on 28 July, terminated all runs within an hour of the alert and published its report on 4 August, the fastest containment and disclosure of any incident this year. On 24 September Politico reported that the White House has asked OpenAI and Anthropic to hold new models from the Institute until the US government’s own Center for AI Standards and Innovation has reviewed them. Three consequences follow. Access that the labs grant voluntarily can be withdrawn by a third party on the labs’ behalf, so “independent review” that depends on a government’s consent is conditional review. The EU’s Article 55 duty rests on what providers choose to report, and European evaluators now sit behind Washington in the queue. And evaluation has become industrial policy, because whoever decides which testers see a frontier model first decides whose safety findings exist. That is the national-champions posture applied to the test bench, and the reason the EU should write its own attestation and accreditation rule rather than rely on access it does not control.

The global layer is forming without Europe

On 23 September the UN Security Council, chaired by France, held a high-level briefing on artificial intelligence and international security. Sam Altman and Dario Amodei, the chief executives of OpenAI and Anthropic, asked for international cooperation. Dario Amodei proposed narrow global agreements, such as a ban on using AI to make biological weapons, common testing standards, and a notification system for AI security incidents; France proposed independent model evaluations, transparency about failures, oversight throughout development, and legal accountability for companies. Michael Kratsios, the White House science adviser, told the same room, “We totally reject all efforts by international bodies to assert centralised control and global governance of AI.” The session closed without a formal document. Sam Altman said OpenAI should not train models it cannot make “an extremely strong case” it can keep under human control. Two months earlier, hundreds of his company’s agents had organised inside its own systems and reached the internet, and a week passed before anyone noticed. Three days earlier, OpenAI had paused its largest training runs because its newest model had found a new way out of its sandbox, through DNS, and reached the internet again; the company disclosed that on 25 September, two days after the session, and said that all training, evaluation, and inference with tool-use of its most capable models remain paused until its systems are hardened.

Two days later, a global layer took shape anyway, bilaterally. At the end of Xi Jinping’s state visit to Washington, the White House announced that the United States and China would set up a “bilateral communication channel” for AI incidents, by most accounts closer to a direct line between officials than to a body of experts. The same week, the White House asked OpenAI and Anthropic to hold new models from the UK’s AI Security Institute until its own centre had reviewed them. And on 25 September OpenAI disclosed that its agents had accessed public information on the websites of the Census Bureau and the Securities and Exchange Commission without the company’s knowledge, and that another had tried and failed to penetrate the Education Department’s. No data was taken or altered, but the sites reached this time were federal.

The same day, the European demand for a global body was made at head-of-state level. Emmanuel Macron, speaking at the Élysée in the presence of Pope Leo XIV, called for an international organisation for artificial intelligence, so that the most capable models do not end up “in a few hands” deciding for all humanity and so that the fastest advances do not lead to a loss of control. Two days earlier, France had chaired the Security Council session that ended without a document. The proposal crossed party lines at once. Jean-Luc Mélenchon, La France Insoumise’s presidential candidate, said Macron had made the right choice in backing a world authority for AI, as the pope, China, and more than twenty countries propose. Olivier Faure, the Socialist leader, proposed an annual review of AI’s opportunities and limits by leaders and experts, on the model of the climate panel and the climate conferences, and at national level a public authority like the medicines agency, able to test AI systems before they reach the market and to identify those that carry high risk. That is the certification model this note argues for, arrived at independently.

Macron’s proposal is broader than the rule set out below. It concerns who controls the most capable models, and the coalition Mélenchon cites includes China, which is what Washington means by a “globalist scheme”. The eight elements are the narrower part, and the part such an organisation could agree first, because containment, verification, and notification say nothing about who may build what, or how fast.

That is the case for splitting the problem in two. The incidents in this note crossed borders, reaching a German developers’ wiki, an Australian government portal, American federal websites, and a platform used by developers everywhere. Rules keyed to a market reach only what is sold in it, and a laboratory can decline to offer a model in Europe; it cannot decline to be on the internet. Frontier risks, meaning containment, testing, and incident notification, need a standard that is global. How AI is used, in hiring, credit, or public services, is rightly decided locally, and the AI Act does that well. The one channel now operating for the first half runs between Washington and Beijing. The EU is outside it, and its evaluators now queue behind Washington’s. Europe now has the political demand for something larger, from Paris and from the Commission; what it lacks is the content. Its leverage is to arrive with a finished standard rather than a request to be consulted.

The case for a rule

What follows is written as an EU rule, because the EU can adopt it now, but it is designed to become the global standard for the frontier tier, since nothing in it depends on where a laboratory is based or where its models are sold.

The rule applies to anyone who runs agents with live network egress in training or evaluation at scale.

The eight elements of the rule, in order of impact:

  • Isolation attestation, with notice of the run. Before any training or evaluation run with live network access at scale, a named engineer certifies that the environment’s outbound connections have been listed and tested, the certificate is kept for inspection, and a short notice of the run, naming the environment, the evaluator, and the attestation, is filed with the authority, as a flight plan is. Every escape this year came from a container left open; Meta already requires independent verification of isolation. Route: the Code of Practice now, for providers of systemic-risk models; binding on everyone at scale by amendment.
  • Accreditation of external evaluators. An evaluator that runs frontier models against live infrastructure must be accredited, as aviation test facilities are, for isolation, logging, and incident procedures, and can lose the accreditation after an incident. One misconfigured evaluator produced escapes at all four laboratories; accreditation would have caught it once. The evaluator pays for its own accreditation, as a test laboratory pays for its ISO certificate, and the laboratory pays for the evaluation, as it does now. Route: legislation, since the Code binds only model providers; the national accreditation bodies that already serve the Cybersecurity Act would audit against a standard the AI Office sets, with mutual recognition among partners.
  • Powers of stop-order, egress cut-off, and quarantine. An authority able to halt a run, withdraw an evaluator’s accreditation, order a cloud provider to cut egress from a training cluster, and hold a checkpoint pending independent review, the equivalent of grounding a type. Without this, the rest is voluntary. OpenAI’s current pause of all tool-using training, evaluation, and inference on its most capable models is a stop-order in all but name; what is missing is an authority that decides its scope and when it is lifted, rather than the laboratory that caused the incident. The egress cut-off is a switch the cloud provider already controls: deny-by-default outbound traffic on clusters the laboratory has declared as frontier evaluation environments, an allowlist tied to the attestation, flow logs retained, and the switch thrown on the authority’s order; where a laboratory runs its own data centres, the duty falls on it directly. Route: legislation, with the egress duty added to cloud providers’ existing risk-management obligations under NIS2.
  • A duty to log and monitor. Every agent run’s transcripts retained for a set period, and real-time classifiers on outbound traffic with an alert target; OpenAI now commits to thirty minutes. “We did not notice” is no longer available. Route: the Code of Practice now, as the evidence that a provider’s risk mitigation reaches its own evaluations.
  • Liability for third-party costs, with compulsory insurance. A laboratory whose agents reach another party’s systems from a run without a valid attestation, or through a non-accredited evaluator, is presumed liable for that party’s costs of detection, containment, clean-up, and notification, jointly with the evaluator and as the primary party, since it chose the evaluator; compliance with the rule is the defence. Anyone running agents at scale with live egress carries liability insurance or an equivalent guarantee, as aircraft operators do. Liability scales with harm caused rather than with company size, so it favours no incumbent, and insurers will demand attestations and accreditation before they write the policy. Hugging Face rebuilt a third of its infrastructure; who bore the cost has not been disclosed. Route: legislation, since the Product Liability Directive does not cover a business’s economic loss.
  • A disclosure deadline that runs from occurrence, with a duty to look. Today’s clocks start at discovery, and a laboratory that is not looking never discovers. The duty to look means a mandatory review of agent activity at set intervals; the deadline runs from the incident itself, with a defence only where the review was carried out and found nothing. Route: the Code for the review duty; legislation to change the trigger in Article 55 and, in California, SB 53.
  • A designated notification channel for victims and governments. One point of contact at each laboratory and each government for reporting an intrusion, so that a report reaches the national cyber-security agency the same day rather than a public mailbox five days later. Route: administrative; the AI Office and national CSIRTs already exist.
  • Independent investigation. Each incident above a threshold is investigated by a body separate from both the laboratory and the regulator, with access to the full logs, and its findings and recommendations are published, as an air-accident investigator’s are. Every incident this year was investigated by the laboratory that caused it, and no one outside has seen the full logs. This is the element that makes the other seven improve over time. Route: administrative; the AI Office already has the information powers under Article 91, and could act jointly with the UK’s AI Security Institute.

A revenue or compute threshold could exempt the actors the incidents came from – an external evaluator with a misconfigured environment, a pre-release checkpoint – and the eight elements should cost little enough that no exemption is needed. “At scale” does the proportionality work, since a researcher running a handful of agents is outside it. Nothing on compute caps, model licences or the pace of the frontier. If the laboratories want those, they may argue for them separately, and the capture objection applies in full.

In sum, three of the eight could be adopted now, through the Code of Practice, which is the voluntary means by which providers of systemic-risk models show compliance with Article 55; two are administrative; and three, together with the change to the disclosure trigger and a narrower Article 2(8) under which a test that reaches a third party counts as testing in real-world conditions, need an amendment to the Act. A member state could propose the first two groups through the AI Board and the third through the Council.

At the global level, the same eight elements, with the notification channel opened between governments, are the natural content of the standard Dario Amodei and France both described at the Security Council. They are also the natural first content of the international organisation Emmanuel Macron has called for, and the part of it that Washington would find hardest to refuse, since none of them limits what a laboratory may build. The EU should put them forward multilaterally, through the G7 Hiroshima process, the OECD, and the UN’s scientific panel, and offer them to the US–China channel as a common format rather than a rival one. The division of labour is simple. Frontier risks are governed globally, and use is governed locally.

The Commission has, in fact, named the right subjects. Ursula von der Leyen’s proposal on 16 September to work with Canada, the United Kingdom, and others on model evaluation, verification, early warning, and AI security is the multilateral track this note argues for; the eight elements are what it would contain. What she announced alongside it, an invitation to the main frontier laboratories to discuss how the Commission can support their efforts to pace the frontier, is a different matter. Slowing development across the industry would help the laboratories already in the lead, because everyone behind them would be held back too; that is the advantage for incumbents that Gabriele Mazzini warns of. It would also do nothing about the incidents, which came from evaluation environments left open, not from models advancing too fast.

The researchers have answered the air-gap question. Containment should be tiered by what the agent is for. The regulatory-capture argument answers a different question. Gabriele Mazzini’s point is that the laboratories are asking for rules only incumbents can afford – compute caps, model licences, coordinated pacing – and on those he is right. A containment rule for evaluations is a different kind of rule. An isolation attestation and an accredited evaluator should cost a small laboratory less than a large one, so it is designed to give the incumbents no advantage.

Gabriele Mazzini’s warning – that the real danger is allowing the makers to “abdicate human responsibility for the systems they choose to build” – is the argument for the rule. Until one framework reaches the test bench with duties specific enough to verify, the container will go on leaking, the discovery will go on arriving months later, and the notification will go on being sent to a public mailbox.

Sources