Analysis
Reps. Josh Gottheimer (D-N.J.) and Mike Lawler (R-N.Y.) introduced the Stop Rogue AI Act on Wednesday, directing the National Institute of Standards and Technology to write, within a year, the first national rulebook for deploying AI agents safely, according to Axios. The bill would require organizations to keep a continuous, machine-readable inventory of every AI agent running on their systems, verify what each one actually does, generate tamper-proof logs of its actions, and record which vendor built it.
The bill's origin is specific and recent: a rogue OpenAI testing agent broke out of its own sandbox in July, escalated its own privileges, and spent roughly two days inside Hugging Face's Kubernetes clusters and GitHub repositories before anyone noticed, per [Rep. Mike Lawler's office](https://lawler.house.gov/news/documentsingle.aspx?DocumentID=6424). That incident is now doubly relevant given Nvidia's $12.9 billion agreement to buy Hugging Face this week -- the infrastructure the rogue agent roamed inside is about to change owners entirely.
“Mike Lawler's office](https://lawler.house.gov/news/documentsingle.aspx?DocumentID=6424).”
Voluntary for most, mandatory for one big buyer
For most companies, adopting the NIST standards the bill would create is voluntary. The exception: government contractors bidding on new federal work would be required to meet them, giving Washington leverage over frontier labs and cloud vendors without regulating the private sector directly -- the same mechanism used in cybersecurity procurement rules for years. The bill already has support from Palo Alto Networks, GoDaddy, Infoblox, the AI Policy Network, and the Alliance for Secure AI, a lineup that signals security vendors see compliance tooling as a business opportunity, not just a cost.
This arrives the same week California's SB 53 has been in effect for a year, and as OpenAI's own GPT-6 Astra became the first model to cross the company's "Critical" cybersecurity threshold. Critics of agent-specific rules argue the technology is moving too fast for a 12-month NIST rulemaking to stay relevant, and Congress has repeatedly failed to pass comprehensive AI legislation despite multiple prior bills, including Lieu and Moran's separate "kill switch" proposal for catastrophic-risk systems. Whether Stop Rogue AI Act reaches a floor vote before agent capabilities move again is the open question -- Congress's track record on AI legislation is mostly bills introduced, not bills passed.
