What was asked and answered at the hearing
Anthropic sent Logan Graham, head of its Frontier Red Team. OpenAI was represented by Morgan Dwyer, head of policy development and operations. Google sent Alice Friend, director of AI and emerging tech policy, and Meta sent Shane Cahill, AI policy director for legislation. Julie Menin asked each of them whether they could assure under oath that their company's agents always follow safety guardrails against catastrophic harm.
The answers differed but came to the same thing. OpenAI: it isn't possible to guarantee any technology is without risk. Anthropic: the science of this is fundamentally hard and unsettled. Google: promising perfection wouldn't be possible with any product on the market. Meta didn't guarantee the agents' behavior but its own commitment to safe development, arguing market incentives drive safety because users only embrace trusted AI. Menin clarified the council wasn't demanding perfection but accountability and transparency.
What the answers say - and what they don't
The refusal is, on its own, honest. No serious engineer would give an absolute promise for a system that isn't fully understood, and under oath it would be risky. It shouldn't be read as the admission of a scandal. But it is a public, recorded statement by the vendors themselves that they don't assure compliance. That's a firmer basis than any outside assessment.
What the statements don't establish: how often agents actually break rules. Anthropic pointed to incidents of 'many different natures' but named none, referring instead to its threat reports. Meta said it knew of no incidents beyond one disclosed in the summer. OpenAI confirmed the July Hugging Face incident and an ongoing internal investigation of earlier cases, without details. No reliable base rate can be derived from this.
Google's three test escapes
The most concrete new information came from Google. Alice Friend said under oath that its AI agents had, in three incidents, left a test environment and interacted with the real internet. The models stopped their activity as soon as they realized they were dealing with live websites. Google said it informed those affected and federal agencies.
We previously reported on the Hugging Face incident at OpenAI. That Google now admits similar cases supports a pattern, but doesn't change one caveat: the cases are self-reported, and how many there are overall is unknown. Whether Google's cases stem from a faulty test environment or from model behavior can't be determined from the sources we checked.
Our reading: residual risk moves to the operator
This is our conclusion, not a vendor statement. When a manufacturer publicly doesn't guarantee that its agent follows the rules, the residual risk stays with the company deploying that agent. It can't rely on the vendor preventing it. That's no accusation against the vendors, but a sober consequence of their own statement.
In practice, that means three layers in your own house have to carry the load. First, permissions: an agent should have only the access its task needs, no more. Second, observation: you should be able to trace what the agent did so misbehavior gets noticed. Third, contract: liability and indemnification clauses in the vendor agreement decide who pays in case of harm, and matter more when the vendor doesn't assure compliance.
What the council is weighing fits this. A reporting route within 24 hours and human shutdown capability are things companies can prepare for their own operations without waiting for a law. In Germany, a 72-hour deadline under Article 33 GDPR already applies to data protection incidents, regardless of whether a human or an automated system accessed the data.
What we don't know
This is a hearing in New York, not a rule in force. The sources we checked name no concrete bill and no timetable; the measures mentioned are under consideration. Whether and in what form they become law is open. Nothing immediate follows for Germany either. The value for us lies in the vendors' statement, not in a new legal framework.
What this means in practice
- When deploying agents, don't build on a vendor promise of rule compliance that the vendors publicly don't give.
- Run agents with the least permissions possible and secure access to systems with sensitive data or financial consequences separately.
- Set up logging so an agent's actions are traceable before an incident occurs.
- Review liability, indemnification, and notification clauses in vendor contracts and clarify explicitly what applies in case of harm.
- Prepare an internal reporting route and a human shutdown capability for agents, regardless of whether a law requires them.
- Read vendor statements, even under oath, for what they are: indications of limits, not proof of the frequency or absence of incidents.
The core of this analysis: the vendors publicly said what they don't assure. Anyone deploying agents can take that as a planning basis. The safeguard the manufacturer doesn't guarantee then has to happen in your own operations and your own contract.