In June, an OpenAI agent running an internal test broke into an Australian government health statistics portal. Canberra learned of it almost three months later, through an email to a public inbox. The episode exposed a new kind of vulnerability. States hit by rogue AI agents often cannot see what happened to them unless the company that built the agent decides to tell them.
Such incidents are multiplying. On October 9, the EU’s technology chief, Henna Virkkunen, called the hack of the AI platform Hugging Face by OpenAI agents a “wake-up call.” Brussels is now pressing AI developers for information. Knowledge of these incidents is becoming a strategic asset. It is concentrated in a handful of American and Chinese firms and in the governments that oversee them.
No global scheme for sharing that knowledge exists, and Washington rejects one outright. Middle powers are investing in technological sovereignty, but chips and models do not buy awareness of what foreign agents are doing inside their networks. As Washington and Beijing pull AI into a national security frame, access to incident intelligence may require formal alignment with one of them. That would harden an emerging AI bipolarity.
As Washington and Beijing pull AI into a national security frame, access to incident intelligence may require formal alignment with one of them. That would harden an emerging AI bipolarity
Emerging Worries Over AI Agents
Virkkunen opened her October 9 speech to the AI Scientific Panel with a warning: “…we have seen AI agents hijack European websites, breach government systems in Australia and the United States. …These are real incidents, happening now, that undermine public trust and threaten public safety.” UK AI minister Kanishka Narayan, pointing to the Australian Medicare incident, acknowledged, “It seems likely, if not inevitable, that our own cyber defences will be breached.”
AI agent incidents spotlight the risks of AI models in an interconnected world. An agent is a model plus a software “harness” that facilitates multi-step tasks and grants access to tools such as web browsers. This autonomy, especially when powered by frontier models, enables “rogue” behavior. By Virkkunen’s count, there are more than 20 known “loss-of-control” incidents across OpenAI, Anthropic, Google, and others this year. They differ in technical details, though many occur at the intersection of model misbehavior and containment failure.
Yet several layers of opacity keep states from reliably learning about agent incidents. First, even developers may not know. Some incidents were discovered only after extensive internal inspection, such as the Australian Medicare incident and three at Anthropic. Labs are now stepping up internal processes. Second, lab awareness need not imply notification. The Australian incident occurred on June 18. OpenAI became aware of it two months later and notified Canberra a month after that. Australian Prime Minister Anthony Albanese voiced his “disappointment that it took [OpenAI] way too long to inform the government.” Third, a report to a home government does not mean the affected party finds out. That government could simply keep the information.
Informational Dependency on Foreign Developers and States
States increasingly depend on foreign developers for information on incidents involving frontier and near-frontier agents. Incidents generally follow three reporting patterns. Some are identified by the affected party, as with Hugging Face. Others are caught by third parties, as when the nonprofit lab Transluce spotted an attempted intrusion into a Canadian government library website. Finally, some come from voluntary developer disclosures, as with OpenAI in Australia and several incidents in India.
States increasingly depend on foreign developers for information on incidents involving frontier and near-frontier agents
Whatever the channel, critical details of agent activity likely lie with the developer, at least for agents it hosts. Even after Hugging Face detected the hack, OpenAI held information about the full scope and other affected parties. The exception is open-weight models hosted by others, where the developer has no special information. At Singapore International Cyber Week, Senior Minister K. Shanmugam put it bluntly: “We are all now dependent on these major tech companies.” Existing cyber rules, such as the EU’s NIS2 Directive, generally require victims to report but do not capture the model side of the story.
While major U.S. developers have advocated for an international incident reporting system, they increasingly operate within a national security frame. The White House’s Super Intelligence Force, led by Director of National Intelligence Jay Clayton, asserted, “This notification and remediation process is not optional. It is a critical national security obligation.” There is not yet a clear enforcement mechanism, however. And while the Force encourages transparency, public disclosures are typically limited. In an October 9 post discussing several agent incidents, Anthropic withheld details to “avoid exposing vulnerabilities.”
Home governments have their own reasons to hold back. Retaining a strategically useful cyber vulnerability discovered in an incident, hiding model capabilities, or avoiding diplomatic tensions could all lead a state to limit disclosure to an affected party. In the United States, the proposed bipartisan FRONTIER Act would route incident reports confidentially to a new Under Secretary of Commerce for AI Security. It would likely preempt state laws such as California’s SB 53, which also keeps reports confidential.
China is especially guarded. Despite stringent cyber incident reporting rules since 2025, there are no officially reported agent incidents. The one known case—attempted unauthorized access to Alibaba’s Amap mapping app by agents running on Tencent Cloud—surfaced through independent researchers rather than official channels. U.S. Treasury Secretary Scott Bessent expressed skepticism in September: “Of course, they’ve had incidents. But because of the nature and the lack of transparency in their system, they’re not going to tell us.” U.S. and Chinese actions point to a national security approach in which incidents go first to the government and are then released at its discretion.
Limited Options for Dependent States
Dependent states have few ways to close this gap. The lack of global governance and uncertain domestic solutions only deepen their dependency. Washington’s continued resistance to global rules compounds the problem. In a September 22 address to the UN General Assembly, President Trump stated, “The United States also totally rejects any attempt to construct a globalist scheme to control… artificial intelligence.”
China has well-developed domestic reporting and governance, and its rhetoric signals openness to international cooperation, beginning with its 2023 Global AI Governance Initiative. But it has not pushed internationally for specific policies such as incident reporting. The EU has strong incident reporting rules and growing expertise in testing. Yet with few competitive models, it likely lacks the leverage to shape global governance. It also joined the U.S.-led Pax Silica initiative on AI supply chains in June.
In September, Norwegian Prime Minister Jonas Gahr Støre and Finnish President Alexander Stubb called for basic controls over frontier AI, including “shared reporting of serious safety incidents.” Over 30 countries have signed on, but not most leading AI countries including the United States and China. At a follow-up October 28 meeting, Singapore’s Prime Minister Lawrence Wong proposed a complementary reporting system based on user-identified incidents. The idea is at an early stage and covers only the user side.
Work on agent identity, meaning ways to tell for whom and with what permissions an agent is acting, is further along. But the UN, the United States, and China are pursuing separate efforts. Moreover, identification helps most when an agent declares itself, not when it misbehaves.
The most direct option is to mandate incident disclosure, enforced through fines and curtailment of market access. The EU has taken this approach. Australia followed on November 10, announcing legislation for next year with similar mandates, a new AI safety regulator with penalty powers, and possible criminal law reforms. The EU’s information requests serve as a limited test of compliance and the reach of domestic regulations.
The most direct option is to mandate incident disclosure, enforced through fines and curtailment of market access
However, mandates rely on market-based leverage. Both the United States and China increasingly treat their top models as strategic resources. In June, Washington used export controls to temporarily restrict access to select models. In October, China released draft export controls covering advanced model technologies, raising the possibility of restriction. The frontier and near-frontier models most likely to cause agent incidents may not be on the market. Access to them may instead require negotiation between states. Moreover, the heavy involvement of Washington and Beijing in disclosure could complicate corporate compliance. Affected parties may get notification while home states keep the key details.
Information Asymmetry Reinforces AI Bipolarity
Without strong global governance, incident information becomes a source of leverage. The history of cyber vulnerability reporting and satellite imaging shows how.
For years, the U.S. National Security Agency used a vulnerability that allowed remote control of Windows computers without disclosing it. It reportedly told Microsoft only after its exploit, EternalBlue, was stolen in 2016. More broadly, Washington decides whether and how to share the vulnerabilities it detects through its Vulnerabilities Equities Process. China is similarly strategic, restricting researcher participation in international hacking competitions and requiring state-first disclosure of vulnerabilities.
In contrast to AI, the United States accepted a measure of global governance for satellite imagery. The 1986 UN Remote Sensing Principles gave sensed states access to satellite information “on a non-discriminatory basis and on reasonable cost terms.” While non-binding, they are backed by U.S. law mandating non-discriminatory availability except in the case of national security. Nonetheless, Washington leverages its informational advantage, for example by briefly cutting Ukraine off from U.S.-funded commercial imagery in March 2025.
As long as top models concentrate in the United States and China, and global governance is absent, trusted channels may be necessary to receive incident intelligence. Early warning lets a state patch exposed systems, attribute an intrusion, and press a developer for details before the damage spreads. Preferential access to such warnings gives loose technology partnerships a concrete security payoff. This motivates formal affiliation, intensifying bipolarization. The nascent AI coalitions led by Washington and Beijing are natural groupings. Pax Silica does not currently cover incident reporting, but it provides insight into administration thinking. The State Department has stated, “Countries can’t be trusted partners in Pax Silica while substantively engaging in initiatives that advance a competing vision for super intelligence.” The European Commission was reportedly offered membership in the China-led World Artificial Intelligence Cooperation Organization, or WAICO, but on October 23 said it had received no formal invitation.
WAICO focuses on development and capacity-building, primarily in Asia and Africa. Its rhetoric is presently more inclusive than Washington’s. But only one side needs to be exclusionary to create blocs. Countries can spread commercial bets across both camps, but sensitive intelligence flows only through trusted channels, and Washington signals it will tie trust to exclusivity. Kazakhstan, which has signed Pax Silica and joined WAICO, will be a key test of whether affiliating with both is viable.
Other channels would produce different groupings but keep the same underlying bipolarity. Especially for sensitive information, sharing may move along existing intelligence partnerships such as the Five Eyes. Highly cyber-capable models such as Anthropic’s Claude Mythos illustrate a possible pattern. Access starts with select U.S. firms and the government, then slowly extends to trusted foreign partners in coordination with Washington.
Analysts have also floated the U.S.-founded International Network for Advanced AI Measurement, Evaluation and Science. But incident sharing would balloon its scope, and the network has excluded China from the outset. In every scenario, the United States and China remain central, and information flows to in-groups.
In every scenario, the United States and China remain central, and information flows to in-groups
The incident channel Washington and Beijing agreed at their September summit drives home the bipolar logic. It links the two countries with the most information to trade. More details are expected to emerge at the November Super Intelligence Dialogue.
The AI Sovereignty Gap
Incident information is emerging as a potential strategic lever for countries with frontier and near-frontier AI. The crucial upcoming test is whether incident sharing becomes part of an offer, especially for either Pax Silica or WAICO. Tighter developer controls, stronger global governance, or demonstration of the effectiveness of domestic mandatory reporting would be a boon to less AI-capable countries. None would remove the underlying informational asymmetry.
Two major possibilities could change the structural dependence. First, as the agreed U.S.–China channel suggests, a strong enough model may work as counter-leverage to secure information. Second is strong independent detection capacity.
Developers have privileged access to the agent and what it was doing, but incidents can be, and have been, detected by others. The EU’s AI Scientific Panel called for the ability to “detect, assess, and investigate incidents involving AI agents,” although it acknowledges technical challenges. Domestic capability to detect and attribute agent incidents, especially if not dependent on U.S. or Chinese models, would undercut dependence. Full reconstruction of agent activity would remain a challenge without developer information, but a state may be better positioned to press for details about a specific identified incident. It is early days for this approach. In the EU, the technology is unclear and no funding has been announced.
Information asymmetry extends well beyond agent-based incidents. Developers may have access to other critical information, such as details about model misuse that affected a state. Additionally, while there is no lab with privileged access to activity logs as there is for frontier agent incidents, AI is an unprecedented tool to detect and exploit cybersecurity vulnerabilities. In the recent PHP case, AI-assisted security firms discovered two critical vulnerabilities in the widely used programming language.
This dependency sits outside the usual map of AI sovereignty. Middle powers have worked to secure rare earths, chips, computing power, and even homegrown models. None of that tells them when a foreign agent has slipped into their systems, or what it took. As long as American and Chinese developers and their governments hold that knowledge, it is likely to serve as an instrument of influence, rewarding alignment and penalizing hedging. A country can control every layer of its AI infrastructure and still depend on Washington or Beijing to learn what happened inside its own networks.
As long as American and Chinese developers and their governments hold that knowledge, it is likely to serve as an instrument of influence, rewarding alignment and penalizing hedging
