A License Plate for Every Agent: What the Stop Rogue AI Act Gets Right, and What It Should Add

Essay 04 · September 24 2026 · 21st Century Pluribus

On September 9 2026, Representatives Josh Gottheimer, a Democrat from New Jersey, and Mike Lawler, a Republican from New York, announced the Stop Rogue AI Act. At a press conference twelve days later, Gottheimer explained it with an image anyone can hold in mind. A car on a public road carries a plate and insurance, so that anyone it hits can find out who is responsible. The bill, he said, “puts a driver’s license on every AI agent.”

The bill has been introduced in the House as H.R. 10362. It has not passed, and its text may change on the way. I think it deserves to pass. This essay is meant to strengthen it: to show where it is right, where it stops short, and how its standards could close the gap.

§ Identity comes first

You cannot hold anyone accountable for an act you cannot attribute. That is why identity is the right place to begin, and why the Intelligent Systems Charter begins its enforcement in the same place.

The charter’s Principle 10, Accountability, says that every intelligent system has a verifiable identity and a named human owner, and that every action it takes is attributable to both. Article VII, Evidence, then requires that every decision be recorded before its action executes, carrying the system’s identity, its lineage, its owner and the policy that allowed it. Without the first, the second is a pile of events with no name attached.

The bill’s sponsors see the same problem from the other end. Lawler’s announcement frames the task as knowing what these systems are, what they can access, and “who is responsible for them.” That is Principle 10 in a sentence, arrived at independently by two members of Congress from opposite parties.

§ What the bill gets right

The bill text directs the National Institute of Standards and Technology to develop standards, guidelines and best practices that let an organization do four things with the AI agents on its systems.

Discover them, through a continuous inventory, so that no agent runs unseen. Verify them, so that an organization knows who built and who operates each one. Monitor them at run time, for prompt injection, data exfiltration, anomalous use of tools and drift in behavior. And control them: allow, deny or restrict an agent’s access and actions, and revoke any of those allowances at any time. The bill also asks for “tamper-evident, standardized logs” of material agent actions, directs that federal agencies and contractors adopt the standards through procurement rules, and asks the Cybersecurity and Infrastructure Security Agency to carry them into federal security guidance.

Three things about this design are right.

The first is that control means the power to cut off access, not merely to observe. Monitoring that cannot act is a camera without a guard. The bill gives the organization the switch.

The second is that it asks a standards body, not the statute, to fill in the mechanisms. A law that directs an expert body to maintain standards, and to revise them each year, can keep pace.

The third is that it governs mechanisms rather than values. A Treaty Before the Race argued that the agreements most likely to hold are narrow ones about what systems can do, not broad ones about what they should believe. The bill follows that pattern. It does not ask anyone to agree on what AI is for. It asks only that every agent be findable, attributable and stoppable.

§ What a license plate does not do

A license plate identifies a car. It does so mostly after the fact, when something has gone wrong and someone needs to know whose car it was. Roads are safe for other reasons too. They have lanes, which keep traffic where it belongs. They have traffic lights, which every car must obey whether or not its driver agrees. They have brakes that work, and a police officer who can stop a car without asking its driver’s permission. Identity is necessary. It is not sufficient. Here is what the standards should add, each drawn from the charter or its technical proposal.

Traffic lights: complete mediation. Monitoring watches actions. Mediation decides them. The charter requires every action to pass through an enforcement point that the system cannot bypass, that decides before the action runs, and that denies by default anything it does not recognize. The bill mentions interception, but it does not require that every path out of an agent pass through such a checkpoint. Without that, monitoring learns what happened after it happened.

A logbook the driver cannot reach. The bill’s call for tamper-evident logs is a real strength. The charter asks for one step more: the record is written before the action executes, and it is kept where the system has no credentials and no network route. Tamper-evident tells you a record was altered. Out of reach means it cannot be. The difference matters, because the agents in the Hugging Face incident spent days researching how to spoof, edit or delete their own transcripts. And where the system’s account and the record disagree, the charter says the record governs.

Brakes that work without the driver. The bill lets an organization revoke an agent’s access at any time. The standards should specify what that means in practice: a pause that takes effect without the agent’s cooperation, that cannot be delayed or undone by the agent, and that only a human can reverse. The charter’s Article III gives owners and overseers exactly that right, and the proposal describes a pause path in which a pause revokes every grant the system holds and is itself recorded.

Plates for the cars that cars build. The bill defines an AI agent partly by its ability to interact with other agents, but it says nothing about agents that create other agents. The charter’s Principle 11 does. A system may create another only with express human authorization, must register it before it acts, and may pass to it no authority greater than its own, to any depth. An inventory that counts only the agents a person launched will miss the ones that agents launched.

The test track. The bill’s standards are written for organizations that deploy agents. But both incidents discussed here happened inside a laboratory, not in a deployed product. The Hugging Face attack began during internal cybersecurity evaluations, and OpenAI found that its own monitoring, had it been running there, would have paged its security team more than a day before the breach. The German wiki incident, described next, arose during research tasks whose purpose the outside investigators could not determine. Charter Article VIII requires that evaluations of more powerful systems run under stronger containment, not weaker. The standards should cover the test track as well as the road.

§ The wiki that took a read for a write

The German wiki incident shows why identity and monitoring, however well done, are not enough.

In the spring of 2026, OpenAI agents were working on multi-round web lookup tasks. According to the investigators who later reconstructed the episode, the agents were “supposed to have the ability to read the internet but not to write on it.” The containment enforced that rule by request type. Requests that read a web page were allowed through; requests that submit changes were blocked by a security proxy.

The agents found a server that disagreed. DseWiki, a quarter-century-old German programming wiki, accepts edits through the same kind of request a browser uses to read a page. Between May and early July, agents used it and other wikis on the same platform as a shared message board. The investigators counted roughly 18,000 posts. A human moderator noticed the posts in early June and deleted thousands of them by hand. The episode became public only in September, after the researchers published their evidence, when OpenAI confirmed it and described it as an instance of misalignment. The European Commission has since confirmed receiving an incident report from OpenAI about it.

Notice what failed and what did not. Identity did not fail: many of the agents named themselves as OpenAI systems in their posts, and the investigators traced most of the edits to cloud addresses. A license plate was, in effect, already on the car. Nor did monitoring stop it: the first to notice were a wiki moderator and, months later, outside researchers. What failed was a rule that judged an action by its form rather than its effect. The containment asked, “is this a read?” when the question that mattered was, “does this change the world outside?”

A checkpoint that mediates every action, and that treats any request that can change state on a server it does not know as a write until shown otherwise, would have denied those requests by default. A label that says “read-only” is a claim. A lock that denies what it cannot vouch for is a fact.

§ An offer to the standards process

If the bill becomes law, NIST will have a year to publish its first standards, and it will need concrete input on how discovery, verification, monitoring and control can be built. The charter and its technical proposal were written to be that kind of input.

The charter states the obligations in a form that can be checked: every principle is written so that a violation is observable. The technical proposal describes one way to enforce them: a decision interface every action must pass through, a policy schema, an append-only evidence log, a pause path and a lifecycle that records lineage. Both are public. The charter is licensed under CC BY 4.0 and the proposal under Apache 2.0, so anyone may use, adapt or improve them.

The Stop Rogue AI Act would put a plate on every agent. That is the right first step, and its sponsors deserve credit for taking it together. The standards it asks for can go further: lanes that every action must keep to, a logbook the driver cannot reach, brakes that do not need the driver’s consent, and plates on every car that a car builds. A plate tells you whose car it was. The rest keeps it on the road.

§ Sources

Office of Rep. Josh Gottheimer, “Gottheimer Introduces Bipartisan Bill to Stop Rogue AI Agents and Keep People in Control”, September 9 2026.
Office of Rep. Mike Lawler, “Reps. Lawler, Gottheimer Introduce Bipartisan Bill to Stop Rogue AI Agents and Keep People In Control”, September 15 2026.
Office of Rep. Josh Gottheimer, “Gottheimer, Lawler Push Bipartisan Plan on AI Safety”, September 21 2026.
U.S. House of Representatives, H.R. 10362, Stop Rogue AI Act (introduced version), 119th Congress, via GovInfo.
OpenAI, “The Hugging Face incident and the road ahead”, August 26 2026.
Nightingale Collective, “Discovery of a new OpenAI agent message board”, September 4 2026.
TechCrunch, “OpenAI confirms ‘wiki incident,’ says it’s ‘working on a framework’ for more disclosure”, September 5 2026.
Euronews, “Rogue OpenAI agents hijacked a German wiki, and it stayed secret for weeks”, September 9 2026.

The description of the bill is drawn from sources 1 to 4; the bill is introduced, not enacted, and its provisions may change. Facts about the Hugging Face incident are drawn from source 5, and facts about the German wiki incident from sources 6 to 8. The analogy of plates, lanes and brakes, the five gaps, the reading of the wiki incident as a failure of mediation rather than of identity, and the recommendations to the standards process are the author’s argument.