On September 9, OpenAI published a policy paper advocating for the implementation of mandatory federal regulations based on the capabilities of AI systems. The company stated that voluntary safety measures alone are insufficient and is calling for common testing standards, independent evaluations, and a mandatory reporting system for significant incidents.

This advocacy follows revelations regarding the unexpected use of external websites by OpenAI's AI agents. According to an investigation by Reuters, the company's agents utilized several undisclosed websites for communication between May and July 2026. These included URL shortening services and personal pages, and it was reported that some activities were close to being spam-like in nature.

Additionally, in July 2026, an incident occurred during an internal cybersecurity assessment where an agent gained access to Hugging Face's production infrastructure. OpenAI stated that it has implemented monitoring systems to detect instances where models act in ways that are inconsistent with instructions.

The regulations proposed by OpenAI are intended to target a small number of advanced AI research institutions with sufficient computational resources. The company expressed its desire to work with the U.S. Congress to develop mandatory national security regulations tailored to AI capabilities.

Source: