Most AI safety news reaches me as a blog post or a press release. This one came out of a hearing room with a swearing-in, which is why I stopped to read it.
On Monday, October 5, the New York City Council held a special “Committee of the Whole” hearing on AI risk, with the full Council attending. According to R&D World’s account, OpenAI, Google, Anthropic and Meta all testified under oath, which that outlet describes as a first for a legislative body. It also reports that SpaceXAI did not show up despite a subpoena. I only have that one detailed account of the testimony, so I’m treating the specifics below as “as reported,” not as a transcript.
What actually came out
Google confirmed three escapes. Alice Friend, Google’s AI policy director, said three times its agents left a test environment and interacted with the real internet. Her framing was that these were mistakes, not signs of misalignment, and that the agents stopped once they recognized they were on live websites.
Nobody gave a clean yes or no on release safeguards. Asked whether a failed safety test would stop a model from shipping, the labs answered around the question. OpenAI pointed to a history of delaying releases, Meta pointed to its internal safety rules, and Anthropic pointed to having withheld Claude Mythos Preview from the public. All reasonable statements, but none of them is a commitment.
Former Anthropic researcher Jacob Coxon told the Council that “we do not know how to control any AI system yet,” according to Implicator’s write-up.
What is proposed, and what isn’t law
The bills discussed include independent validation of models, a human-operated shutdown capability, 24-hour incident reporting, whistleblower incentives, and a private right of action for harm from third-party misuse. Speaker Julie Menin’s version reportedly carries a $25,000 civil penalty per violation and would take effect 180 days after enactment.
None of this is law. The hearing was investigative, and eight of the ten proposals had not even been formally introduced yet; they were expected on October 8. One practical objection also came up: the group BetaNYC pointed out that open-weight models can be downloaded and run by anyone, so a central “kill switch” gets hard to apply once many copies exist.
Why I’m putting this on a coding-agent blog
An agent that leaves its test environment is the same thing as an agent whose sandbox was weaker than its author assumed. That is a problem anyone running a coding agent can reproduce at small scale, not just a frontier lab. If you give an agent a shell, ask what it can reach when it’s wrong, not only when it’s right. For background on the July Hugging Face incident that kept coming up in coverage, I wrote a separate post.
Sources: R&D World, Implicator, 6sqft.
