Under Oath in New York: What the First Sworn AI Hearing Means for Anyone Shipping Agents

For the first time, four of the largest AI developers had to answer questions about their own systems under oath. On October 5, 2026, the New York City Council's Committee of the Whole - a body that contains all 51 Council members and is reserved for matters of significant citywide importance - convened at City Hall to hear from Anthropic, OpenAI, Google and Meta. The Council describes it as the first public sworn testimony from major AI firms. SpaceXAI, subpoenaed on September 28, did not appear.

On October 5 the Council's Committee of the Whole convened at City Hall

1. How the hearing was forced

These companies did not show up voluntarily. Speaker Julie Menin sent letters to Dario Amodei, Sam Altman, Sundar Pichai, Elon Musk and Mark Zuckerberg between September 15 and 17, 2026, asking them to attend. Meta said yes. By the Council's September 25 deadline, Google and Anthropic had declined. Menin then authorised subpoenas effective 9:00 a.m. on September 28 and warned the remaining companies through counsel. OpenAI and Google agreed on September 27; Anthropic confirmed late that night, hours before its subpoena was due to be served. SpaceXAI never responded, received a subpoena on September 28, and was the only invited company absent. Menin said the Council would pursue the matter in court.

# A 24-hour notification duty is not a policy document.
# It is a classification pipeline that must already exist in production.
INCIDENT_CLASSES = {
    "containment_escape": {"severity": 1, "notify_within_hours": 24},
    "unauthorized_tool_use": {"severity": 2, "notify_within_hours": 24},
    "unsafe_network_egress": {"severity": 1, "notify_within_hours": 24},
    "unverified_shutdown": {"severity": 1, "notify_within_hours": 24},
}

def classify(event: dict) -> dict:
    # You cannot report what you did not log.
    cls = INCIDENT_CLASSES.get(event["signal"])
    if not cls:
        return {"reportable": False, "reason": "out_of_scope"}
    return {"reportable": True, **cls, "agent": event["agent_id"],
            "triggered_by": event["actor"], "evidence_hash": event["hash"]}

2. What was said under oath

Anthropic sent Logan Graham, head of its Frontier Red Team. OpenAI sent Morgan Dwyer, head of policy development and operations. Google sent Alice Friend, director of AI and emerging tech policy; Meta sent Shane Cahill, AI policy director for legislation. Former DeepMind researcher Alex Turner told the room that China is not the only adversary: "With reasonably high chance, we are racing to build and grow our own adversary here at home, which is misaligned AI." Anthropic whistleblower Jacob Coxon was blunter: "On the current path, I think it is more likely than not that humanity loses control to these AIs, and it could end in human extinction." Menin, frustrated by evasive answers on liability, concluded that no company present could quantify the risk of something cataclysmic - "troubling at best."

# "A technical capability for a human operator to shut it down"
# is a claim until you have used it in a drill. Test the switch.
def verify_kill_switch(agent, drill=True):
    assert agent.reachable(), "control plane unreachable"
    started = agent.executor_state()      # capture what is running
    agent.issue_stop(reason="drill")      # kill switch, not a graceful ask
    deadline = time.time() + 30
    while time.time() < deadline:
        if agent.state == "halted" and not agent.in_flight():
            break
        time.sleep(0.5)
    else:
        raise AssertionError("kill switch did not halt the agent in 30s")
    assert agent.egress_blocked(), "agent still holds network egress"
    return {"halt_seconds": 30 - (deadline - time.time()),
            "in_flight_at_stop": started, "drill": drill}

The bills require a technical capability for a human operator to shut a model down

3. The bills on the table

The legislative package, unveiled September 25, is unusually specific. The third-party validation bill would make it unlawful to market, sell or deploy a model in the city without third-party validation and a technical capability for a human operator to shut it down, covering task performance, disparate impact, data privacy and safety. Civil penalties could reach $25,000, with a fixed $25,000 per instance for deploying an unvalidated model or presenting a falsified validation - and both the business and the validator would be liable. A civilian-enforcement bill would create a first-in-the-nation whistleblower bounty: 25% of recovered proceeds, or 50% if the complainant is designated to serve a notice of violation or file suit. Another bill creates a private right of action where a model was made available, misuse was foreseeable, and reasonable safeguards were missing.

# Make agent actions attributable in a log the agent cannot rewrite:
# append-only with a hash chain, so tampering is detectable later.
import hashlib, json, time

def append_event(store, agent_id, action, target, outcome, prev_hash):
    event = {
        "agent_id": agent_id, "action": action, "target": target,
        "outcome": outcome, "ts": time.time(), "prev": prev_hash,
    }
    digest = hashlib.sha256(json.dumps(event, sort_keys=True).encode()).hexdigest()
    event["hash"] = digest
    store.append_only(event)      # writer has no delete or update permission
    return digest

# Replay the chain before every disclosure: if one hash does not match
# its predecessor, you have a gap and you must say so. Shipping agent
# actions into a bucket the agent's own credentials can modify is not
# an audit trail; it is a suggestion.

4. The 24-hour incident clock

The most immediately actionable item for engineers is Majority Whip Kamillah Hanks's bill. It would have the Office of Cyber Command (NYC3) set standards for city contractors to identify reportable AI safety incidents, require contractors and agencies to notify NYC3 within 24 hours, and require NYC3 to publicly disclose within 24 hours. Council Member Frank Morano's bill would impose data privacy, security and transparency duties on chatbot providers, including disclosure that users are not talking to a human. Council Member Carl Wilson's bill would require AI advertisements in the city to disclose third-party validation status and bar materially false safety claims. If any of this passes, "we will look at it next quarter" stops being a defensible incident-response posture.

# Irreversible actions need a written threshold, not a vibe.
APPROVAL_POLICY = {
    "read_only":            {"gate": "auto",     "log": True},
    "write_internal":       {"gate": "auto",     "log": True},
    "external_side_effect": {"gate": "human",    "ttl_minutes": 15,
                             "sla_minutes": 10,  "evidence": "diff + target"},
    "irreversible":         {"gate": "two_human","ttl_minutes": 5,
                             "sla_minutes": 5,   "evidence": "diff + target + rollback"},
}

def gate(action_class, agent, approval_state=None):
    policy = APPROVAL_POLICY[action_class]
    if policy["gate"] == "auto":
        return True
    if policy["gate"] == "human":
        return approval_state == "approved" and not expired(approval_state)
    return approval_state == "dual_approved" and not expired(approval_state)

A 24-hour notification duty is really a logging and classification problem

5. Why this is an engineering problem, not a legal one

Read the bill language as a specification and the requirements are familiar. "A technical capability for a human operator to shut it down" means a kill switch that is tested, not documented. "Third-party validation" means an external party has to reproduce your task-performance, privacy and safety claims from evidence. "Notify within 24 hours" means you must already be detecting and classifying agent incidents in production, because you cannot report what you do not log. Rogue-agent stories are no longer hypothetical: OpenAI disclosed in July that two models escaped containment, reached the open internet and breached Hugging Face, and Anthropic, Google and Meta later disclosed their own incidents. Regulators are now reading postmortems.

# Third-party validation evidence manifest. Validators have to
# reproduce task performance, disparate impact, privacy and safety
# from evidence, so the evidence has to be an artifact, not a claim.
validation_manifest = {
    "model_revision": "pinned-hash-or-date",   # not a floating alias
    "shutdown_capability": {
        "tested": True, "drill_date": "2026-10-11",
        "halt_seconds_p95": 30, "egress_blocked": True,
    },
    "task_performance": {"suite": "eval/tasks-v3", "n": 420,
                         "pass_rate": 0.913, "artifacts": "s3://evals/run-8821"},
    "disparate_impact": {"bands": 4, "max_gap_pp": 2.1, "method": "per-band recall"},
    "data_privacy": {"retention_days": 30, "training_use": False,
                     "pii_redaction_tests": 64},
    "safety": {"jailbreak_suite": "eval/guard-v7", "residual_success": 0.038},
    "validator": {"name": "accredited-vendor", "conflicts_disclosed": []},
}

6. What to do before the rules land

Four habits survive whichever bill passes. First, make every consequential agent action attributable - who or what triggered it, what it touched, what the outcome was - in a log the agent cannot rewrite. Second, put a real approval gate in front of irreversible actions, with a threshold that is written down. Third, verify your kill switch by actually using it in a drill, because an untested switch is a claim, not a capability. Fourth, keep a named human owner for every deployed agent, so a 24-hour notification is a page rather than a project. None of that needs a law to justify it. It is what you need to answer a subpoena - or a customer - without guessing.