Trump considering AI controls after OpenAI hacking incidents

The Trump administration is actively considering new controls on artificial intelligence security following multiple hacking incidents targeting OpenAI, marking a sharp departure from the laissez-faire approach the White House has championed since January.

A change in direction

For most of its tenure, the Trump administration has moved to strip back AI oversight. It revoked a Biden-era executive order on AI safety within days of taking office and has repeatedly signaled that heavy regulation would strangle American innovation. But the OpenAI breaches appear to have rattled officials in a way that broader policy debates haven’t.

The incidents — at least two confirmed intrusion attempts over the past several months — exposed vulnerabilities in how frontier AI companies store sensitive research and model data. That’s not just a corporate headache. It’s a national security problem.

What the administration is weighing

According to a senior administration official familiar with the discussions, the White House is exploring a narrow set of requirements that would apply specifically to AI companies handling what officials are calling “critical model infrastructure.” The options on the table reportedly include mandatory incident reporting within 72 hours of a breach, minimum cybersecurity benchmarks for labs developing models above a certain capability threshold, and possible coordination with the Cybersecurity and Infrastructure Security Agency.

Still, it’s worth being clear about what this isn’t. Officials have been careful to frame any forthcoming measures as security policy, not AI governance. The distinction matters politically. Calling it security lets the administration act without appearing to contradict its deregulatory brand.

OpenAI at the center

OpenAI, which employs roughly 3,000 people and recently closed a $40 billion funding round valuing the company at $300 billion, has been the most visible target. The company disclosed earlier this year that foreign actors had attempted to access internal systems, though it said no core model weights or proprietary training data were compromised. A second incident, less publicly discussed, involved a more sophisticated probe of employee communication channels.

The company didn’t immediately respond to a request for comment for this article.

So why now? The timing isn’t entirely coincidental. Geopolitical pressure is building. U.S. intelligence agencies have repeatedly flagged China and Iran as the most aggressive state-sponsored actors targeting American AI firms, and congressional Republicans — typically allergic to tech regulation — have been more receptive when the threat is framed in terms of foreign adversaries rather than domestic consumer protection.

What comes next

The White House hasn’t committed to a timeline. And there’s genuine skepticism inside the administration that anything formal will materialize before the midterm election cycle kicks into gear. Some advisers reportedly believe voluntary industry commitments will be enough to satisfy the security concerns without triggering a political backlash from the tech sector.

But if another major incident hits before then, that calculus could change fast.