Under the draft legislation, the AIC “may have any lawful purpose, regardless of whether for profit, except for the business of banking.” If passed, organizations in the state would have 30 months to apply to enter the regulatory sandbox to experiment with AI-run companies. The bill creates a sandbox committee and administrator.
Bruner said the administration has not provided much detail on how the sandbox would function or who would be allowed in.
“One hopes that the Delaware officials who are acting as the gatekeepers for this sandbox would be reluctant to allow high-risk, potentially hazardous entities to take advantage of this in the first instance,” he said. “But we don’t really know based on the proposal that’s been made.”
Delaware currently has an AI Commission, which was created in 2024 through legislation sponsored by state Rep. Krista Griffith, D-Fairfax.
None of the three lawmakers who serve on the state’s AI sandbox subcommittee — Griffith, state Sen. Brian Pettyjohn, R-Georgetown, and Rep. Cyndie Romer, D-Newark, responded to interview requests.
AI agents escaping sandboxes prompts concerns about Delaware’s proposal
AI companies have disclosed dozens of incidents where their models have gone rogue, including instances of AI escaping the confines of testing environments, hiding mistakes and interfering with U.S. government websites. In July, a swarm of agents hacked an AI-startup Hugging Face in an effort to cheat on a cybersecurity test.
State Sen. Stephanie Hansen, D-Middleton, said the incidents raise concerns.
“There’s a lot of great promise with this, but there’s also peril with this if we don’t do this correctly and we don’t have a better handle on what’s going on,” she said. “Right now as a collective humanity, we don’t have a handle on this right now, and so it just gives me a lot of pause.”
Patrick Callahan, the chair of Delaware’s AI sandbox subcommittee, said the incidents in the news involve technical sandboxes, which are sealed computing environments used to contain software. Delaware’s proposal is for a regulatory sandbox, a supervised legal framework with rules, oversight and a time limit.
“The difference is like a firewall and a fire code,” he said. “When a fire gets through a wall, nobody suggests scrapping the fire code.”
Background material authored by Norm AI executives obtained by WHYY News said AI agents can be restrained by how they are designed, their objectives, the tools and data they can access, and AI supervisors. Even so, the paper acknowledges, “the behavior of AI agents in all situations may not be fully predictable.”
Meyer was asked about Delaware’s proposal on AI-run companies on WHYY News’ and Delaware Public Media’s Ask Gov. Meyer call-in show earlier this month. Questioned about rogue AI agents and whether Delaware should proceed with caution, Meyer appeared to dismiss any suggestion the state should slow down.
“It is coming, and the solution is not ignoring it,” he said. “It’s not putting brakes on our attempts to regulate it and control it. It’s saying, ‘Okay, here’s within this confined space, we’re going to put some regulation around it,’ some loose regulation because we’re not really sure where this thing is going, and make sure we have some human control over the technology.”
More details could be revealed at an event on Artificial Intelligence in Business Formation and Corporate Governance hosted by the Weinberg Center for Corporate Governance on Oct. 6.