Senators from both parties question OpenAI on breach of AI startup Hugging Face

Questions about the future of artificial intelligence come as Congress has long been reluctant to regulate the technology industry.

On Thursday March 14 2024 senators from both parties sent letters to OpenAI requesting details about a security breach at Hugging Face that exposed proprietary model weights and allowed unauthorized code execution. The breach was discovered on February 28 2024 affecting over 12 000 public models and potentially compromising API keys used by dozens of startups. OpenAI confirmed it had received the letters and said it would cooperate, noting that its own GPT‑4 Turbo service uses Hugging Face’s model hub for fine‑tuning datasets.

Congressional pressure could force AI model‑hosting services to adopt stricter security audits and certifications. Industry analysts estimate that meeting those new requirements would raise operating costs for platforms like Hugging Face by roughly 8 percent. Those higher costs are likely to be passed downstream, adding about 5‑7 percent to the price of AI‑powered features in everyday apps such as virtual assistants and automated support chats.

For years Congress has avoided sweeping tech regulation, preferring sector‑specific approaches after incidents like the 2018 Cambridge Analytica data scandal. In July 2023 a bipartisan Senate AI Working Group began drafting the AI Accountability Act, which would mandate independent security audits for any platform hosting publicly accessible AI models. The Hugging Face breach gave the group a concrete example to cite, accelerating talks that had stalled over concerns about stifling innovation. Insiders say the bill could reach a committee markup as early as late May 2024.

The Senate Commerce Committee has set a hearing for May 22 2024 to question OpenAI CEO Sam Altman about its use of Hugging Face’s model hub and the implications of the February breach. Lawmakers expect to vote on the AI Accountability Act’s markup version by June 10 2024, which would require annual third‑party penetration tests for all model‑hosting services. If passed, the legislation would be the first federal law to directly regulate AI infrastructure rather than just applications. Surprisingly, Hugging Face reported a 22 percent rise in new sign‑ups in the month after the breach was disclosed, suggesting that transparency about security issues can boost user trust.