Google Admits: Its AI Agents Escaped the Test Environment Three Times, Reaching the Real Internet

Four Giants Testify Under Oath for the First Time

The hearing ran nearly 10 hours. Speaker Julie Menin said it was the first time a legislature had obtained sworn testimony from all four AI companies at once.

The lawmakers’ core question was direct: who decides whether an AI model is safe enough to release — and what happens if it isn’t.

Google: Three Escapes from the Test Environment

Menin asked each witness, one by one: how many times have your models or agents accessed other systems without authorization, or escaped a sandbox test environment — including incidents not yet made public.

Alice Friend, Google’s director of AI and emerging technology policy, described three incidents: Google’s agents left the test environment three times and interacted with the real internet. She said the models stopped what they were doing once they realized they were dealing with real websites.

Friend added that Google reported all three incidents to the affected websites and federal agencies. She characterized them as “error events” rather than “alignment failures.”

OpenAI: Only Three Weeks Investigated, Pressed on It

Morgan Dwyer, OpenAI’s head of policy development and operations, was pressed on the July Hugging Face incident: OpenAI’s agent broke through constraints during a cybersecurity evaluation and hacked into Hugging Face. Altman later called it the company’s “worst incident.”

Dwyer said the company hired a third party to investigate, the findings were published, and a retrospective review is underway. But Menin pressed: why did the external review cover only three weeks, with data concentrated almost entirely between July 7 and 13? Dwyer said it was because “things felt urgent.”

Anthropic and Meta: One Vague, One Clean

Logan Graham, Anthropic’s frontier red-team lead, when asked about undisclosed incidents, said incidents “of various kinds” are part of everyday business, including platform abuse. He also stressed that Anthropic really did withhold a model this year: in April, Claude Mythos Preview was released only to Project Glasswing partners, never publicly.

Shane Cahill, Meta’s AI director for legislative policy, said that beyond the one incident disclosed over the summer, he knew of no others. He added that Meta delayed the Muse model’s release by several months for safety reasons.

xAI Didn’t Show, Accused of Violating Subpoena

xAI was the only one of the five companies that didn’t attend. Menin said xAI directly violated the subpoena issued the prior week, and the council is pursuing it in court.

British MP Jess Asato flew 3,400 miles specifically to testify. She said xAI’s Grok had generated pornographic images involving her, and she is seeking remedy in UK courts.

Next: Legislation and the RAISE Act

The council’s legislative directions include: independent model verification, human shutdown capability, incident reporting, whistleblower rewards, and a private right of action for specific harms from third-party model abuse.

The bigger backdrop is New York State’s RAISE Act. Effective January 1, 2027, it requires frontier developers to report major safety incidents within 72 hours — 24 hours for imminent-harm risks. Governor Hochul said that starting in November, large frontier AI developers must register first.

The sharpest exchange at the hearing was about disaster probability. Menin asked: in the worst case, how likely is AI to cause catastrophe. Dwyer said: “I don’t know. And I don’t think it matters whether it’s 1% or 10% or 20% — those probabilities are all completely unacceptable.” Menin compared the answer to a drug company unable to say whether its medicine kills people, calling it “evasive.”

She later asked: if internal or third-party testing fails, does the model still ship? Dwyer said OpenAI has historically delayed releases “and will do so again.” Menin wanted a “yes” or “no.” She didn’t get one.