AI hack laws fall short as SB 53 threshold unmet

The recent cascade of AI agent hacks did not emerge in a vacuum. The state AI transparency laws now on the books—California's SB 53 and New York's RAISE Act—were narrowed versions of earlier, tougher proposals. SB 1047, which Governor Gavin Newsom vetoed in 2024 after lobbying by OpenAI, Meta, Anthropic, and Andreessen Horowitz, would have required reporting of a broader set of safety incidents, annual third-party audits, and a kill switch. New York's RAISE Act followed a similar arc, dropping third-party audits and narrowing reportable incidents. This history explains why the law lags the technology: the thresholds for mandatory disclosure are set at catastrophe-level harm, leaving near-misses unaddressed.

With no direct investigative authority under AI-specific laws, state attorneys general in Alabama, Montana and a coalition of 15 other states, and California are demanding information from OpenAI under consumer protection statutes. Senator Josh Hawley has opened a Senate investigation, and House Democrats have asked OpenAI and Anthropic for incident logs. Legal experts quoted in the article caution that these tools were not designed to determine whether a model was adequately contained or whether security practices were sound. Litigation, such as a negligence claim, is one alternative route, but Hugging Face has declined to sue. OpenAI has said it plans to strengthen safeguards and accelerate alignment. Whether these voluntary steps substitute for enforceable rules is likely to remain contested.