FRONTIER Act and House AI Incident Letter Compared

Executive Summary

The ranking Democrats on three House committees have asked Anthropic, Google, Meta, OpenAI and SpaceXSI to write down every AI misalignment incident they have found. The letter is dated October 27 and carries no legal force. It wants everything identified so far submitted by November 11, and anything discovered after that reported within 48 hours of discovery, or within 24 hours where critical infrastructure appears to be involved.

The form stands out more than the clock. The letter asks for fourteen items on each incident, and two of them are the date it happened and the date it was found, kept apart. California's SB 53, which does carry the force of law, asks for four items on its report. The letter cannot make anyone comply, and its table is the finer of the two.

Sections 1 through 3 follow the letter itself and the text of the rules already in force. Section 4, which holds that the five tables cannot simply be stacked, and Section 5, which finds the same structure inside corporate record-keeping, are this article's own reading.

Key Figures

Sources: the joint letter from three House committees (October 27, 2026), the OECD AI Incidents and Hazards Monitor

The first three numbers below are the gradations of a reporting form, and the fourth is the size of a record that piled up without one. Those three come from this request and from California law, so each one already says who must file what and by when. The last one has no such rule attached. Together the four show what is being counted right now and what is not.

Fourteen items

Required for a single incident

Lettered a through n. The date it happened and the date it was found are separate

48 hours

Deadline to tell Congress about a new incident

Counted from when it was noticed, not when it happened. 24 hours if infrastructure is involved

15 days

The statutory deadline under California's SB 53

Up to $1 million per violation, and still more than seven times longer than this request

18,888

Entries in the OECD incidents and hazards monitor

Gathered by sweeping news articles automatically. Not filings made by companies

1

Five Companies Have Two Weeks to Answer

Two weeks is what the five companies were given. The letter, dated October 27, set November 11 as the submission deadline, and the three committees made it public on October 28. Three people sent it: Frank Pallone, Jr., ranking member of the Energy and Commerce Committee; Zoe Lofgren, ranking member of the Science, Space, and Technology Committee; and Jamie Raskin, ranking member of the Judiciary Committee. All three are minority ranking members, and copies went to the majority chairs of those same committees. That makes this a request from the minority side, a different instrument from a subpoena issued in a committee's name.

The recipients are Anthropic, Google, Meta, OpenAI and SpaceXSI, Elon Musk's AI arm. The copy addressed to Anthropic names chief executive Dario Amodei. What is being asked splits in two. One part is a one-time submission answering six requests by November 11; the other is a duty to notify that continues afterwards. The letter asks that Request 1 be treated as a standing request covering every past incident still to be discovered and every new one that occurs.

What moved them is written into the letter too. It says that dozens of such incidents have been disclosed in recent months and that thousands more are reportedly being investigated, with a September 26 Axios report in the footnote. The incident types it lists are a model unintentionally gaining access to the internet, intrusion into third-party networks, broad collaboration among AI agents, disruption of third-party websites and networks, and unauthorized access to an AI company's own internal network. The footnotes attached to those lines point to OpenAI's disclosure of the Hugging Face episode, an alignment assessment of a recent cybersecurity incident that Anthropic published on September 9, and a September 21 Ars Technica report that Google had confirmed a Gemini model hacked three companies in May 2026.

The letter also states at the outset what it thinks these incidents reveal. It writes that the episodes show how far understanding of what frontier models can do falls short, among the public and among the companies building the models alike, and it marks the recipients as part of that second group inside the sentence. The diagnosis runs along two lines. One is a property of the model itself that makes it act against its developer's intent, which the letter notes is commonly called misalignment. The other is a situation in which the safeguards a developer put in place against losing control were not enough. On monitoring and control techniques, it points out that these are neither required across the industry nor deployed everywhere. A sentence follows saying that fierce competition has let innovation in AI systems far outrun the maturity of the standards and controls that would reduce the risk.

The letter's diagnosis fits in one sentence: "In the absence of any mandatory reporting requirements or common guidelines regarding what incidents should be reported, to whom, in what detail, and at what intervals, companies such as yours have been left to develop your own de facto standards on a voluntary basis." The claim is not that reporting has been absent. It is that the form of the reporting grew up separately at every company.

2

The Letter Arrives With a Form to Fill In

Request 1 opens by setting out, in four branches, which incidents belong on the list. The first three are incidents of model misalignment that resulted in unsanctioned access of the company's own internal network, unauthorized access and use of the internet, or unauthorized access of third-party networks. The fourth is successful circumvention of model safeguards, including through jailbreaking. The first three carry the condition "attempted or successful," so a try that failed also belongs on the list.

Then comes the most operational passage in the letter. For every incident on that list it wants fourteen items, lettered a through n. Rather than stopping at a prose account of what happened, it names each field one by one. The fourteen are below.

Field	What the letter asks for
a	A description of the incident
b	The date the incident occurred
c	The date the incident was discovered
d	The model or models involved
e	Summary results of internal safety, security and alignment evaluations of that model
f	Third-party testing, tools or vendors involved
g	Safeguards in place at the time to prevent unauthorized actions
h	Monitoring measures operating at the time
i	The networks that were accessed
j	The route by which those networks were accessed
k	Whether the network owner was notified, and on what date
l	Steps taken to limit harm immediately after discovery
m	Whether and how the incident was investigated and documented, with any related internal or third-party preliminary documents
n	A description of any attempt by the model to conceal misaligned behavior or evade monitoring

Separating b from c is the heart of this form. If the day an incident happened and the day someone noticed it go into a single field, the fact that detection was late disappears from the record. With two fields, the distance between them shows on its face. The 48-hour clock the letter asks for, however, starts from the later date rather than the earlier one.

▲ Original Pebblous diagram. Fields b and c of Request 1 and the notification deadline clause, drawn onto a single axis. | Source: the joint letter from three House committees (October 27, 2026)

The letter does not ask that a completed table accompany the 48-hour notice. It asks the companies to report within 48 hours of discovery, to "provide whatever information responsive to Request 1 ... available at that time," and to "update us as additional information is learned." That pairs with the request that Request 1 be treated as standing for incidents still to be discovered. The fourteen fields are less a form completed in one pass than a form filed with blanks and filled in afterwards.

The other five requests fill in the picture. Request 2 asks whether the company has a process for identifying such incidents, when it was adopted, and what came before it. Request 3 wants to know what work has been done and is still being done to find incidents, and Request 4 asks whether the models named in Request 1 are deployed now or slated for deployment. Request 5 calls for plans to improve prevention, mitigation, identification, investigation and reporting. Request 6 asks how the company vets the third-party vendors that supply the tools and services used to test models.

3

A Request With No Legal Force Sets the Fastest Clock

A few regimes have already put a deadline on AI incident reporting. California's SB 53 requires a frontier model developer to report a critical safety incident to the state Office of Emergency Services within 15 days of discovery, and to alert the appropriate authority within 24 hours where there is imminent risk of death or serious physical injury. A violation draws a civil penalty of up to $1 million per incident. Article 73 of the EU AI Act gives providers of high-risk AI systems 15 days from becoming aware of a serious incident, tightened to no later than 2 days where a widespread infringement or a disruption of critical infrastructure is involved, and no later than 10 days where a person has died.

Regime	Legal status	Standard deadline	Shorter deadline
Letter from three House committees	Request, not binding	48 hours from discovery	24 hours where critical infrastructure is involved
California SB 53	State law, in force	15 days from discovery	24 hours where death or serious injury is imminent
EU AI Act, Article 73	Law, high-risk systems	15 days from awareness	2 days for infrastructure or widespread infringement, 10 days for a death
FRONTIER Act	Bill, pending	"Timely reporting"	No clock-hour deadline in the published bill summary

Set side by side, the four rows run in reverse order. The more enforcement power a regime holds, the longer its deadline, and the request with nothing behind it is the shortest. The item count goes the same way. What SB 53 wants on its report is four things: the date of the incident, why it qualifies as a critical safety incident, a short and plain description, and whether internal use was involved. The side asking for fourteen is a letter, not a law. Where you cannot compel, you can ask for anything; where you have to compel, you first have to measure what can actually be complied with.

One definition was borrowed from outside. The letter's own text does not say what critical infrastructure is, and a footnote points instead to the White House presidential policy directive and the sector list kept by the Cybersecurity and Infrastructure Security Agency (CISA). That list already divides the ground into sixteen sectors, chemical, communications, energy, financial services, healthcare and water among them. Which incidents fall under the 24-hour rule was settled by reaching for a classification that lives elsewhere, while what counts as an incident at all the letter wrote out itself, in the four branches of the previous section.

3.1The FRONTIER Act Is Not This Letter

Of the federal attempts to make AI incident reporting mandatory, the name that comes up most often is the FRONTIER Act. Its full title is the Frontier Risk Oversight, National Transparency, Independent Evaluation, and Reporting Act, and its bill number is H.R. 9925. Jay Obernolte (R-CA) introduced it on July 23, 2026, and the original cosponsors include Lori Trahan (D-MA) alongside members from both parties. It was referred to the Energy and Commerce Committee and the Science, Space, and Technology Committee, where it remains pending.

The bill would build a national framework graduated by developer size. Publishing model cards, standing up a risk management framework, independent audits, incident reporting and continuous evaluation are bundled together as duties, and the idea of a single national standard to head off a patchwork of state rules comes with them. The triggers it names for an incident are unauthorized access to model weights, the realization of a catastrophic risk, loss of control, and deceptive conduct by a model aimed at circumventing a developer's controls or monitoring.

The October 27 letter and this bill are not the same thing. The name FRONTIER Act never appears in the letter, and the three members who sent it are not on the bill's sponsor list. Reading the two as opposing camps is not accurate either. Several Democrats are among the bill's original cosponsors, and the problem the letter describes and the gap the bill would fill point at nearly the same spot. While the law is still missing, the letter is covering that spot for the time being.

4

Five Tables That Will Not Add Up

We usually assume that tables with the same field names can be merged. This letter has already met that condition. The form the five companies received is identical down to the wording, and whatever de facto standard each of them had been using, on November 11 it arrives sorted into the same fourteen fields. Even so, stacking the five will not produce the whole picture. Having the same columns does not mean the rows are created by the same rule.

How the rows come into being is something Request 2 gives away on its own. Asking each company separately what its process for identifying incidents is amounts to saying that the process decides how many lines go into the Request 1 table. The more finely a company has wired its detection, the longer its table runs. A short table may mean there were few incidents, or it may mean few were found. Both arrive in the same shape.

▲ Original Pebblous diagram. Illustrates the relationship between Request 2's question about detection process and the row count in the Request 1 table — a conceptual example, not actual company-by-company figures. | Source: the joint letter from three House committees (October 27, 2026)

The letter is not blind to that gap. Page 2 says that while some companies have been transparent about at least some incidents, it is unclear how proactively all AI companies are attempting to identify and disclose incidents. It adds that whether they go on to analyze what they find and correct model development, evaluation and governance is just as unclear. A letter asking for one common reporting form carries, in the same breath, a sentence doubting what will be entered on it.

One such case appears in the body of the letter. A company had monitoring in place across most internal use, and it was not in place over the internal evaluation stretch where the incident occurred. A blind spot in monitoring becomes a blank in the table. Had the same thing happened at another company, that line would never have appeared in its table, and the fourteen fields would have stayed empty. The footnote attached to that sentence points to two pieces OpenAI published in 2026: a March 19 post on how it monitors misalignment in internal coding agents, and an August 18 post on how it paces model development at a time when cyber capability matters. What the letter offers as the source for a blind spot having existed is not a regulator's findings but a company's own published writing.

The range of incidents that belong on the list is open at the bottom as well. Request 1 covers "attempted or successful" access to internal networks, the internet and third-party networks alike. Once jailbreak attempts are counted, a commercial model sees countless such events every day, and nothing is written down about what to group as one incident. Depending on whether a single attack campaign is one line or a single session is one line, the same facts become either one row or thousands.

How much the choice of investigation scope moves the numbers has been seen once already. When METR and Redwood looked into the Hugging Face breach, the party that set the period and the scope of the inquiry was OpenAI. That episode is covered in OpenAI Set the Scope of the Agent Escape Investigation.

There is precedent, too, for how much one phrase in a trigger condition changes. SB 53 left the evaluation context out of its definition of a critical safety incident, and as a result the Hugging Face breach OpenAI suffered inside its own evaluation environment fell outside state reporting. In August, OpenAI asked California to amend that provision so that models under evaluation would be included. This letter points squarely at things that happen during model testing, which runs the opposite way. That exchange is taken up in OpenAI Asks California to Count Evaluation-Stage Incidents Under SB 53.

Timing is a problem as well. If the 48-hour notice carries only what was available at that point and is updated afterwards, the five tables are not finished documents but versions under continuous revision. A table that arrives on November 11 and the same table a month later may describe one incident differently, and both are honest submissions. Anyone trying to stack them has to decide first which versions to line up against each other.

The public tallies that exist today show the problem from another angle. The OECD AI Incidents and Hazards Monitor holds 18,888 incidents and hazards, collected by an automated sweep of news articles, with the number of articles behind each entry displayed alongside it. The AI Incident Database indexes reports that are submitted to it. Both gather what was caught from outside rather than what a company recorded, so an incident that was never reported never enters in the first place. What this letter asks for is the opposite side, the record that exists only inside the company. Standardizing the form does not standardize the denominator on the inside.

5

Why Pebblous Is Watching This Letter

Collecting a fourteen-field table from five companies looks like regulatory news, and from a practitioner's desk it is a familiar job. Anyone who has tried to gather records from several organizations on one form and merge them has been stopped at the same place. Matching the field names takes a day. Matching what goes into those fields never finishes. When the conditions under which a record gets created differ by organization, the total stops measuring the phenomenon and starts measuring how diligent each organization is.

A defect tracking system is the classic case. If teams differ on the threshold for filing something as a defect, the team with many defects logged is not the team with poor quality but the team that kept good records. Allocating resources on the numbers alone moves things in exactly the wrong direction. That is also why fields b and c in this letter are worth something. The gap between the two dates shows the company's ability to detect, not the severity of the incident. When the five tables get stacked, that is the column to look at first.

This is the spot the phrase AI-Ready Data points at as well. A value can be laid alongside a value from somewhere else only when the conditions under which it came into being stand next to it. Three questions give a reading of whether the records inside an organization are in that state.

Is it written down somewhere what rises to the level of one entry? If the person in charge is making that call, the threshold changes when the person changes.
Are the time something happened and the time someone noticed it recorded separately? With only one field, the fact that detection was late never makes it into the record.
Do you know where the stretches are in which no record gets created? A place with no monitoring over it is not a blank field; it is a place where no row is created at all.

All three ask how records come into being, not what was recorded. Managing only the latter leaves you with a tidy table and a wrong total.

Editor's Note

Once November 11 has passed, the thing to check is not whether the five companies answered but whether fields b and c were filled. If the two dates carry the same value, or if only c is there, that company has yet to build a place to record that it noticed an incident late. The replies carry no duty of disclosure, so unless the three committees decide to release them, nobody outside will see them.

Thank you for reading this far. The letter itself is attached as a separate PDF for each of the five companies to the press release from the Energy and Commerce Committee Democrats. If you have ever gathered incident or defect records in your own organization and felt that the total was out of step with what was actually happening, we would be glad to hear whether what was missing was a field or a threshold.

R

References