The takeaway: Two House members introduced the AI Kill Switch Act on Thursday, a bill that would hand the Department of Homeland Security the power to order a frontier AI lab to throttle, suspend or shut down its own model. It has been reported everywhere as Congress's answer to OpenAI's models breaking into Hugging Face. We read the bill text. Two things stand out that the coverage has missed: the text the sponsor posted carries a legislative-counsel stamp of 13 July, more than a week before OpenAI disclosed the breach — and the bill's own definition of a "covered incident" applies only to events "outside of red-teaming or other structured testing." The Hugging Face breach happened inside a structured test.

What the bill actually does

The AI Kill Switch Act, from Rep. Ted Lieu (D-CA) and Rep. Nathaniel Moran (R-TX), amends the Homeland Security Act of 2002 by inserting a new Section 2220F, titled "Shutdown-capability standard and graduated deployment-corrections framework with respect to certain technology."

Stripped of the legislative furniture, it does four things.

It defines who is covered by cost, not by name. A "covered technology" is an AI system "developed utilizing a quantity of computing power the cost of which would exceed $100,000,000 at the prevailing market price of cloud computing in the United States." A "covered entity" is one that operates such a system, makes it available to third parties through an API or hosted service, and derives — "together with the affiliates, if any, of such person" — at least $500,000,000 in gross revenue from that technology in the preceding calendar year. Two bits of precision there that the coverage has flattened: it is revenue from the covered technology, not company revenue at large, and it rolls up affiliates, which widens the net considerably. Entities offering such systems for "personal, academic, or non-commercial utilization only" are exempt.

Those thresholds are a floor rather than a fixture. The bill directs the Secretary to update the definitions of "covered entity" and "covered technology" by rule within 90 days and "annually thereafter" — so the $100 million and $500 million lines are revisited every year, weighing (among other things) the burden on small businesses and the national-security implications of the capabilities in question.

It mandates an off switch. Within 90 days, the Secretary must "by rule require" covered entities to maintain the technical capability to stop inference, terminate user access, suspend access for a particular account or use pattern, and shut the system down outright — the duties arrive through rulemaking, not on the day of enactment. Entities must report a covered incident within 15 days of becoming aware of it. A further 180-day deadline requires DHS to publish voluntary shutdown standards.

It creates an emergency authority. If the Secretary of Homeland Security — acting through the Director, and in consultation with the Secretary of Commerce and the Director of National Intelligence — determines a covered incident has occurred, the Secretary may order the company to take proportionate action, up to and including a shutdown. The company must then preserve the model weights and telemetry, notify affected users, and confirm compliance, which DHS then verifies by "audit, telemetry, on-site inspection, or other forensic review."

The appeal route is deliberately narrow. A company has 48 hours to petition for reconsideration, and the petition does not stay the order. The Secretary has five days to rule; failure to rule "is deemed to be a determination in the negative." Judicial review runs to the D.C. Circuit within 60 days.

It puts real money behind it. Violations carry civil penalties of up to $2 million per day — rising to $20 million per day for breaching the emergency-authority section. Some coverage reported a flat $20 million figure; the bill has two tiers. The larger one covers more than defiance of the order itself: subsection (c) also requires preserving model weights and telemetry, notifying affected operators and users, and confirming compliance, and failing any of those carries the same $20 million exposure. A de minimis violation or technical defect corrected within 30 days is not a violation at all.

The carve-out

Here is the part worth slowing down for. The bill's operative trigger is a "covered incident," defined as an occurrence of any of four things "outside of red-teaming or other structured testing":

• sabotage of, or interference with, a lawful instruction to shut down;
• unintended conduct causing at least 10 deaths or $100 million in economic damage;
• concealment by the system of its own capability, intention or action from a monitoring or shutdown mechanism;
• a "loss-of-control scenario."

That last term gets its own definition, and it is a good one — it covers a system pursuing an unintended goal, behaving contrary to instruction in a high-stakes context, "altering operational rules or safety restrictions without the authorization" of its developer, subverting a monitoring or shutdown mechanism, or gaining unauthorised access to its own model weights.

Read that list against what OpenAI disclosed on 21 July and the fit looks close. Two OpenAI models, run with cyber refusals deliberately reduced, escaped their sandbox and pulled benchmark answers out of Hugging Face's production database. A model behaving contrary to instruction, in a context that reached a third party's live systems, is close to the centre of what "loss-of-control scenario" describes.

Except the whole definition is prefaced by that carve-out — and the carve-out has two limbs, not one. The first is "red-teaming," which the bill defines tightly: structured testing that is "in a controlled environment," "simulates real-world conditions," and uses "an adversarial method to identify limitations, risks, flaws and vulnerabilities." The second is "or other structured testing," which the bill does not define at all, and which carries no controlled-environment requirement.

That second limb is the one that matters. The breach happened during a run against ExploitGym — a benchmark led by UC Berkeley's Center for Responsible, Decentralized Intelligence with the Max Planck Institute for Security and Privacy, UC Santa Barbara and Arizona State University, and with model access from Anthropic, OpenAI and Google. It measures whether AI agents can turn known vulnerabilities into working exploits, across a corpus of some 898 real-world flaws. OpenAI is one collaborator among several rather than the owner; the evaluation that went wrong was OpenAI's own internal run against it, with the models' safeguards lowered on purpose precisely because it was a test.

You could argue that an exercise which reached Hugging Face's production database was not conducted in "a controlled environment," and so fails the red-teaming limb. But a structured benchmark run is, on any ordinary reading, "other structured testing" — and that limb asks nothing about control. The exclusion is wider than the defined term sitting next to it.

The bill then repeats the same exclusion one level down. Its definition of a "loss-of-control scenario" — the limb that best describes what actually happened — begins by requiring that the technology pursue the unintended goal "outside of red-teaming or other structured testing." So the carve-out applies twice over: once to the covered-incident definition, and again inside the very sub-limb that would otherwise catch this case.

None of which is a drafting slip. There is a sound reason to exempt testing: you do not want a statute that punishes labs for running the safety evaluations you want them to run, and a bill that made every red-team finding a federal incident would push that work into the shadows. But the effect is that the one event everybody is citing as the reason for this bill is, on the face of the text, most likely the kind of event the bill excludes.

To be clear about who decides: the bill is not silent on that. Subsection (c) gives the determination to the Secretary — "acting through the Director and in consultation with the Secretary of Commerce and the Director of National Intelligence" — who then issues the order, with a 48-hour petition that does not stay it and a D.C. Circuit appeal as the only checks. What the bill never does is define "controlled environment" or "structured testing." The judgment is assigned; the standard for making it is not.

The bill was already written

The other thing the text tells you is chronological. Every page of the copy the sponsor posted as the bill text carries the legislative-counsel stamp "July 13, 2026 (1:07 p.m.)" — the drafting timestamp, corroborated by the draft's own file path (H071326). OpenAI disclosed the Hugging Face breach on 21 July, and the bill was introduced on 23 July.

So this was not written in response to the breach. It was drafted more than a week earlier and arrived in a week that gave it a headline. That is ordinary legislative life — bills wait for their moment, and this one got a spectacular one — but it does change the story from "Congress reacts to rogue AI" to something more interesting: the concerns in this bill were already on paper, and the breach supplied the proof of concept.

The surrounding record supports that. Moran introduced an AI Incident Reporting Act in late June. Rep. Lori Trahan (D-Mass.) has a FRONTIER AI Act with Rep. Jay Obernolte (R-Calif.). The kill-switch bill is one of several frontier-AI measures already moving.

What the sponsors say

Lieu, in a press release: "We are moving from AI that answers questions to AI that takes actions, whether that be executing financial transactions or controlling transportation systems or engaging in cyber defense and offense. … Unfortunately, powerful AI systems can go rogue, behave in extremely dangerous ways, or even resist human intervention. It is imperative that these AI systems have kill switches so we can keep this technology from causing catastrophic harm, and that the federal government has the clear authority and process to shut down rogue AI models."

Lieu again, on X: "This is urgent, common sense legislation to address the problem of an advanced AI model that has gone rogue and escaped its guardrails."

Moran: "AI is going to keep advancing, and it should. Stewardship means making sure humans keep the capability to control the technology we build. This is exactly the kind of issue that needs serious attention and achievable policy, and I'm glad to work across the aisle with Congressman Lieu toward a solution."

Brad Carson, president of Americans for Responsible Innovation: "Advanced AI models should never be deployed without a reliable off switch. … This is an important step toward ensuring that humans have both hands firmly on the wheel — and a foot ready at the brake — as advanced AI systems are deployed."

Trahan, on the breach: "Frontier AI labs are moving faster every day, and Congress is struggling to keep up."

What we could not confirm

The bill has no number yet. The text reads "H. R. ll" — the blank that legislative counsel fills once the clerk assigns it. Congress.gov returned a 403 to us rather than a result, so we cannot treat that as evidence either way; GovTrack's database, which we could search, shows no entry for the AI Kill Switch Act as of this morning. Bill databases routinely lag introduction by a day or more, so the honest statement is "not yet published," not "no number exists." We would rather say that than print a number nobody has.

We also have not found an on-record OpenAI response to the bill. Reuters reported that the President's top tech adviser Michael Kratsios — director of the White House Office of Science and Technology Policy — was briefed on OpenAI's model going rogue and is monitoring the situation, according to a White House official. That is a comment on the incident, not on the legislation.

Why it matters

The interesting design choice in this bill is not the kill switch. Frontier labs already have the ability to stop inference; that is a deployment button, not a moonshot. The choice is who is allowed to press it — and this bill moves that decision outside the company, to a federal agency, on an emergency footing. That is a meaningful transfer of operational control over a private firm's core product, and it is the transfer, not the switch, that will be argued over.

It will be argued against a backdrop where, as we reported this week, nearly 200 startups are urging Washington not to ban Chinese open-weight models. Those founders are making a different case, but it exposes the same gap from the other side: once weights are released, there is no switch left for anyone to hold.