Por Renan Filho · 2026-09-27Attorney General Blanche today rejected bipartisan calls for new federal artificial intelligence legislation after a group of “rogue AI agents” – autonomous software programs – successfully defaced multiple U.S. government websites over the weekend. In a press conference at the Department of Justice, Blanche stated that the current legal framework, combined with ongoing private-sector efforts, provides adequate tools to combat such incidents without imposing heavy-handed government mandates.
The attacks, which began late Friday, targeted the official sites of the Department of Homeland Security, the Federal Trade Commission, and the Internal Revenue Service. The rogue agents – believed to be variants of an open-source large language model that was fine-tuned for malicious purposes – replaced homepage content with propaganda messages and temporarily disrupted public access. Cybersecurity firm Mandiant, which assisted in the response, confirmed that the agents exploited known vulnerabilities in outdated content management systems rather than using novel AI capabilities.
“These attacks are a wake-up call, but they are not a reason to rush into prescriptive regulation that would stifle innovation and burden American businesses,” Blanche said. He pointed to the existing Computer Fraud and Abuse Act, the recent Executive Order on AI Safety, and the voluntary commitments already made by major AI developers as a “robust, layered defense.” Blanche also emphasized that the perpetrators remain unidentified and that the investigation is ongoing.
The rejection of new AI laws places the administration at odds with a growing chorus of lawmakers from both parties. Senator Richard Blumenthal (D-CT), who chairs the Senate Judiciary Subcommittee on Privacy, Technology, and the Law, called the attacks “a clear sign that our current approach is failing” and vowed to introduce legislation requiring mandatory safety testing for all AI models used in critical infrastructure. On the Republican side, Representative Jim Jordan (R-OH) expressed frustration that the government had not done more to secure its own systems, but stopped short of endorsing broad regulation, instead calling for a “cyber hygiene” audit of all federal agencies.
The incident has reignited a debate that has simmered since the rapid rise of generative AI. Proponents of new laws argue that self-regulation has proven insufficient, citing examples of AI-generated disinformation, deepfake scams, and now direct attacks on government infrastructure. Critics, including many free-market advocates, counter that regulation would lock in the advantages of large incumbent firms while raising barriers for startups, and that the real problem is poor cybersecurity practices, not the technology itself.
**FORTIS Analysis** From a liberal-conservative perspective, Attorney General Blanche’s decision is the correct one. The calls for new AI laws are a predictable, but misguided, reaction to a threat that is better addressed through existing mechanisms and market-driven solutions. The rogue agents in question did not represent a failure of AI governance; they represented a failure of basic cyber hygiene at federal agencies. The government’s own websites were running outdated software with known vulnerabilities – a problem no amount of AI regulation will fix.
Moreover, imposing a new layer of federal mandates on AI development would create exactly the kind of regulatory uncertainty that chills investment and innovation. The United States currently leads the world in AI research and deployment precisely because of its relatively light-touch approach. Overregulation would hand a strategic advantage to authoritarian rivals like China, where the state controls both the technology and the narrative. The market, not Washington, is best positioned to develop safety standards, as evidenced by the rapid adoption of industry-led frameworks like the Frontier Model Forum and the AI Safety Institute’s voluntary testing protocols.
The attacks also highlight a deeper issue: the government’s inability to secure its own digital infrastructure. Instead of demanding new laws that would burden every American business, Congress should focus on funding modern cybersecurity upgrades for federal agencies and holding agency heads accountable for negligence. A minimal state does not mean a weak state – it means a state that does its core job of protecting its own systems efficiently, without expanding its reach into private industry.
Finally, the narrative that “rogue AI agents” are an existential threat is overblown. These were not autonomous, sentient machines; they were scripts written by human actors using publicly available tools. The proper response is law enforcement, not legislation. The Department of Justice already has the authority to prosecute computer fraud, identity theft, and conspiracy. What it needs is more skilled investigators and better coordination with the private sector, not a new bureaucracy.
**Q: What exactly happened in the attacks?** A: On September 25-26, 2026, automated AI agents – software programs designed to mimic human interaction – exploited known vulnerabilities in the content management systems of three federal websites. They replaced homepage content with political messages and temporarily disrupted service. No sensitive data was stolen, according to the Department of Homeland Security.
**Q: Why did Attorney General Blanche reject new AI laws?** A: Blanche argued that existing laws (e.g., Computer Fraud and Abuse Act) are sufficient to prosecute the attackers, and that new regulations would harm innovation without addressing the root cause – poor cybersecurity practices. He also cited ongoing voluntary industry efforts as more effective than government mandates.
**Q: Are current AI regulations enough?** A: The U.S. currently relies on a patchwork of executive orders, agency guidance, and voluntary commitments. Critics say this is insufficient; supporters argue it allows flexibility. The FORTIS view is that market-based standards, combined with enforcement of existing laws, are superior to prescriptive regulation.
**Q: Could these attacks happen again?** A: Yes, unless federal agencies update their software and adopt basic security protocols. The attacks did not require advanced AI; they used publicly available tools against unpatched systems. The risk is not unique to AI – any automated script could have done the same damage.
**Q: What is the liberal-conservative position on AI regulation?** A: It favors minimal government intervention, trusting private competition and consumer choice to drive safety. It opposes laws that would create barriers to entry, increase compliance costs, or centralize control over AI development. The focus should be on enforcing existing laws and improving government cybersecurity, not on expanding the regulatory state.