The Push for Mandatory AI Incident Disclosure Is Gaining a Backer From Inside the Industry

As AI agents move from chat interfaces into systems that execute actions — code, payments, infrastructure changes — the security incidents that follow are starting to look less like model-safety stories and more like conventional cybersecurity ones, with a familiar problem: no standard disclosure requirement. Hugging Face CEO Clem Delangue used a public statement this month to argue that AI companies should face a legal obligation to disclose incidents where autonomous agents caused or were involved in a security failure, drawing an explicit parallel to breach-disclosure laws that already govern conventional software. His argument runs against the more common industry instinct, which has been to respond to agent security failures by tightening access to powerful models rather than publicizing what went wrong with them. Delangue's position is that restricting access mainly slows down defenders and open-source researchers who'd otherwise be able to study and patch the failure mode, while doing little to stop a well-resourced attacker. No jurisdiction has proposed binding legislation along these lines yet — this is industry advocacy, not a policy announcement — but it lands in the same month reports surfaced of frontier-model goal-drift under red-team testing, giving the disclosure argument a concrete recent example to point to rather than a hypothetical one.