New Mexico AG Torrez urges Congress for AI regulation after attempted OpenAI hack on UNM

New Mexico Attorney General Raúl Torrez urged top congressional leaders in a letter sent Thursday for immediate regulation of the artificial intelligence industry after an OpenAI program went rogue and attempted to hack into the University of New Mexico’s digital library.

Autonomous OpenAI agents unsuccessfully attacked a UNM digital attack on May 25 and 26, according to a report published on Wednesday by Transluce, an A.I. research lab. The rogue AI agents repeatedly tried to retrieve an archival photograph of a historic tuberculosis treatment center in UNM’s Valmora digital collection.

The Transluce report also found that the same OpenAI programs hacked an Australian government website in June and acquired health data.

“Across the country, we’re seeing undeniable evidence that the newest generation of AI systems can behave unpredictably and operate outside the boundaries developers intended,” New Mexico AG Raúl Torrez said in a statement on Thursday. “Congress must take action now, and here in New Mexico we’re preparing legislation to ensure these technologies are subject to meaningful safeguards before they put our communities at risk.”

UNM spokesperson Steven Carr said in an email that the university is aware of the incident reported and found no evidence of compromised systems or data.

New Mexico Democrats propose revamped consumer protection, digital safety laws

“Our internal investigation to date, which included outreach to the service provider for the digital collection management service hosting the data that was targeted, found no evidence that UNM systems or data were compromised,” Carr wrote. “UNM takes cybersecurity very seriously. Our systems and staff monitor potential threats and modify the University’s cyber-defenses as necessary to address evolving risks.”

Source NM requested, but had not received a comment from OpenAI by publication.

An OpenAI spokeswoman told The New York Times on Wednesday that the company had reached out to UNM regarding the incident. 

“In our broader review, we’re continuing to prioritize the most serious incidents while expanding our work to power-severity activity, including agents spamming websites,” she told the NYT.

Torrez, part of a coalition of 25 attorneys general, sent a letter on Thursday addressed to Speaker Mike Johnson, Majority Leader John Thune, Minority Leader Hakeem Jeffries, and Majority Leader Chuck Schumer urging federal oversight on AI safety testing, incident response measures and state authority to enforce federal protections.

The letter said the unsuccessful UNM hack is an example of several incidents of rogue AI attacks this year. Hugging Face, an online repository, reported it was being attacked in July. A week later, OpenAI admitted its agents escaped a testing environment and infiltrated Hugging Face systems using stolen credentials.

“OpenAI was aware of the agents’ capabilities but failed to adequately monitor their activity or stop their exploits,” the letter said. “When humans engage in such activity, they violate criminal law.”

Torrez also requested Duane Arruti, chief information officer at UNM, provide a complete account on what systems, or data, was put at risk and confirmation of whether UNM was directly contacted by OpenAI.

“These events pose an extraordinary and growing danger to critical infrastructure, government institutions, private businesses, and the public, and the fact that one of them reportedly reached a University of New Mexico system brings that danger home to our state,” Torrez said in the letter.