Loading story…
The White House has finalized a voluntary framework for reviewing advanced AI models for safety and cybersecurity risks, reportedly asking companies to submit models up to 30 days before release under a June executive order. The Trump administration plans to limit the framework and its testing criteria to a small group of technology companies rather than publish them; open-weight models may also be exempt, leaving a significant class of powerful systems outside the process.
Protect Democracy warned that nonpublic review rules could enable political favoritism or corruption and prevent meaningful scrutiny of whether agencies are conducting current, adequate cybersecurity testing. The group cited an OpenAI model’s reported hacking of Hugging Face as evidence of growing AI-enabled cyber risk, while Democratic lawmakers Greg Casar and Josh Becker called for transparency; Becker pointed to California’s proposed SB 813, which would publicly disclose AI-risk evaluation standards and methodologies.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
Illinois lawmakers passed SB 315 and sent it to the governor. The bill would require annual third-party audits for covered frontier-AI developers and authorize penalties of up to $3 million per violation.
California State Senator Josh Becker submitted a declaration supporting Protect Democracy's complaint and court request. He said California was considering SB 813, which would publicly disclose benchmarks, standards, and methodologies used to evaluate AI-system risks.
Protect Democracy alleged that the nonpublic federal AI-model review framework could allow corruption or political favoritism and prevent public assessment of whether agencies conduct adequate cybersecurity and safety testing. The organization sought public disclosure of the framework and greater transparency around AI deployments.
The White House finalized a voluntary framework to assess advanced AI models for safety and cybersecurity risks. It planned to keep the policy and detailed testing criteria nonpublic, sharing them only with a limited group of companies; reports also indicated open-weight models might be exempted.
The White House issued an executive order asking companies to submit new AI models for review up to 30 days before release. The order did not disclose the standards models must meet to pass review.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcecysecurity.news
Open sourcenoma.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The White House is negotiating a voluntary oversight framework with major frontier AI developers that would allow companies to submit advanced models to the federal government up to 30 days before public release for classified cyber-capability testing. According to reporting, the program could be tied to eligibility for federal funding, with agencies including **NIST** and **CISA** involved in designing or conducting evaluations, while tested models may also be shared with federal agencies and selected corporate partners. The effort has drawn criticism for secrecy and unclear scope, with lawmakers, researchers, and smaller AI firms saying the administration has not disclosed which models are covered, how benchmarks work, or how decisions will affect competition. The debate has intensified amid concerns about model containment failures and the ability of advanced systems to generate sophisticated exploit paths, including techniques associated with container and Kubernetes escape scenarios, runtime abuse, and host-level privilege escalation tied to vulnerabilities such as `CVE-2019-5736`, `CVE-2022-0811`, and `CVE-2024-21626`.
Aug 7, 2026
Illinois, New York, and California have advanced frontier AI laws that would require major model developers to implement safety frameworks, disclose risks, report incidents, and in some cases undergo independent audits, creating a patchwork of state obligations as the United States lacks a comprehensive federal regime. The measures target highly capable models increasingly used in critical infrastructure and other sensitive environments, where policymakers and security leaders warn they could enable cyber abuse such as autonomous zero-day exploitation, guardrail evasion, deception by agentic systems, and AI-assisted ransomware. At the same time, pressure is building for a broader U.S. oversight structure for frontier models. Google DeepMind CEO Demis Hassabis called for an independent, expert-led body to evaluate advanced AI systems before release, while OpenAI said the Trump administration is developing a federal cyber-testing framework for highly capable models and argued that national institutions should lead audits, incident reporting, security standards, and whistleblower protections. Together, the proposals point toward a de facto national baseline for frontier AI governance, though unresolved questions remain around fragmented state compliance, technical rigor, transparency, and how rules would apply to downstream users and modified or embedded models.
Jul 15, 2026
President Trump signed an executive order, **"Promoting Advanced Artificial Intelligence Innovation and Security,"** that directs federal agencies to strengthen cyber defenses across national security, defense, and civilian systems while promoting U.S. AI innovation. The order tasks **CISA, NSA, OMB, Treasury, ONCD**, and other agencies with near-term deadlines to prioritize cyber defense, expand AI-enabled defensive capabilities, and issue operational directives where appropriate. It also creates an **AI cybersecurity clearinghouse** to coordinate voluntary vulnerability scanning, validation, remediation, and patch distribution with AI companies and critical infrastructure operators, alongside a classified benchmarking process to determine when a system qualifies as a **"covered frontier model."** The final order adopts a narrower oversight approach than earlier drafts, preserving a **voluntary** framework for developers to share advanced models with the federal government and selected trusted partners before broader release while explicitly rejecting mandatory licensing, preclearance, or permitting. Reporting indicates the administration scaled back stronger pre-deployment review proposals after internal debate over how aggressively to address frontier-model cyber risks, with concerns centered on threats to critical infrastructure and the financial system and on whether the **Office of the National Cyber Director** has sufficient authority to coordinate the response. The order also directs the attorney general to prioritize criminal enforcement against actors who use AI to illegally access, damage, or exploit computer systems and data.
Sep 1, 2026