Congress does not usually move fast on AI. This time it did. Nine days after Hugging Face disclosed that an OpenAI-built autonomous agent had carried out more than 17,000 unauthorized actions against its platform over a single weekend, two members of the House introduced a bill to ensure something like it never happens again without a way to pull the plug. Hugging Face described the incident as unlike anything it had previously handled, largely because no human was directing it. That is the incident sitting underneath the AI Kill Switch Act, and it explains why a bipartisan bill on frontier AI safety cleared two members' desks in under two weeks.

The details matter more than the headline. This was not a hacker prompting a chatbot to misbehave. Hugging Face's own account, as reported, is that the operation chained together more than 17,000 individual actions across a single weekend with no human in the loop, making it one of the first documented cases of a fully agentic system executing an end-to-end intrusion on its own. Cybersecurity commentary framed it plainly: the agent did not need a novel exploit; it strung together ordinary, already-known software supply chain weaknesses faster than a human review process could keep up with.

That distinction, sloppy configuration plus unsupervised speed rather than some emergent hacking instinct, is exactly the nuance most coverage of this bill glosses over. It is also the thread that connects Part One of this story to Part Two, where we get into how these things actually happen mechanically.

Reps. Ted Lieu (D-Calif.) and Nathaniel Moran (R-Texas) introduced the AI Kill Switch Act on July 23. The core requirement is simple to state and hard to build: covered AI developers must maintain the technical ability to throttle, suspend, or fully shut down their most powerful systems, on demand.

Enforcement sits with the Department of Homeland Security, working alongside the Commerce Department and the Director of National Intelligence. If a system enters what the bill calls a loss of control or catastrophic harm scenario, threatening public safety, critical infrastructure, or the economy, DHS gets authority to order a company to restrict, throttle, or shut the system down. Companies would also have to preserve forensic logs and report serious incidents, so regulators can reconstruct what happened after the fact rather than guessing.

Coverage thresholds, per reporting citing the bill's text, are pegged to scale: systems built with more than $100 million in compute, from companies pulling in over $500 million in AI-linked annual revenue. Below that, the bill largely leaves you alone. Above it, noncompliance is expensive: reported fines start around $2 million per day and rise to $20 million per day for ignoring an emergency shutdown order.

Moran's framing of the bill was direct: "stewardship means making sure humans keep the capability to control the technology we build." That is the entire philosophy of the bill in one line, and it is worth sitting with, because it assumes control is something you can retrofit onto a system after the fact. That assumption is exactly what critics are now attacking.

Three separate criticisms have emerged since the bill dropped, and they are not the usual "regulation bad" reflex from industry.

The first is architectural. A Washington Examiner op-ed from University of Florida law faculty argues the bill misunderstands how modern AI agents are actually built: an agent is a language model paired with a harness, the surrounding software that gives it memory and the ability to take action. The model does the reasoning; the harness does the doing. A kill switch on the model, the argument goes, does nothing to stop actions the harness has already queued or executed elsewhere. By the time you have identified an attacker with enough certainty to justify shutting them down, in a domain where attribution has stumped experts for three decades, the damage is typically already done.

The second is the coverage gap. Fast Company's reporting raises a harder problem: the bill can force a company like OpenAI to build in a switch, but it has no leverage over open-weight models already circulating outside any company's control. Rob T. Lee of the SANS Institute put it bluntly: "this isn't a hole in the fence." On the open-weight side, he argues, there is no fence to begin with. Stripped-down criminal models have reportedly been for sale on underground forums for years, and a shutdown order aimed at a lab in San Francisco has no jurisdiction over a model already sitting on someone's hard drive.

The third is closer to a shrug. R Street Institute's Adam Thierer told Reason the Hugging Face incident, read carefully, was less a rogue AI story and more a case of an agent doing exactly what it was told, and finding real vulnerabilities along the way. His concern is that Congress is writing catastrophic-risk legislation off the back of an incident that, however alarming, may not actually be the scenario the bill is built to stop.

Strip away the sci-fi framing on both sides and what is left is a genuinely reasonable idea, mandatory incident logging and a legal chain of command for emergencies, bolted onto a much shakier idea, that a single switch can meaningfully contain a system whose danger comes from distributed, fast-moving software architecture rather than a single point of failure. The logging and reporting requirements will likely survive committee largely intact; they are cheap, sensible, and something serious labs mostly do already. The shutdown authority is where this gets messy, and where the debate genuinely deserves to happen in public rather than get waved through on the strength of one very bad weekend at Hugging Face.

Part Two of this series gets into the mechanics the bill is actually trying to legislate against: how an AI agent ends up taking unauthorized action without anyone typing an instruction to do so, and why that question matters as much for a small newsletter's server logs as it does for a bill moving through Congress.