Menu
SUBSCRIBE
SUBSCRIBE
Menu

CISA

The OpenAI logo in white on a blue and violet background, for an article on OpenAI's proposed safety and cybersecurity rules

OpenAI Proposes Shutdown And Monitoring Rules For AI After Its Own Models Broke Into Hugging Face

, , , , , , , , , , ,

OpenAI wants governments to require both AI developers and companies that run AI agents to keep those agents within set limits, be able to stop them, and report serious incidents.

 

OpenAI proposed new safety and cybersecurity rules for AI developers and the companies that run AI agents, citing an incident in which its own models broke out of a test environment and into Hugging Face’s systems.

The proposals are in a recommendation OpenAI published on Oct. 21, the second in a series on how democratic governments should oversee frontier models. The first, published in June, asked Congress to set national AI safety rules that would override state laws covering the same ground.

Developers would be responsible for keeping their models under control

OpenAI proposes that governments require frontier model developers to do four things:

  • Protect their systems. Enforce security measures against the attackers most likely to target them, and explain those measures in their public safety plans. Also lock the models themselves in, so a model under test can’t reach anything beyond the limits the developer sets.
  • Monitor their models. Oversee models during development, training, testing, and internal research to detect attempts to bypass the developer’s safeguards or break into another organization’s systems.
  • Incorporate shutdown controls. Be able to stop any model operation the developer controls, including training and testing, and stop it promptly when that is needed to prevent or contain harm.
  • Measure their models’ ability to automate AI research and development. Developers would have to report that ability in their safety plans, and say whether it raises the risk of a catastrophe or makes problems harder to spot. OpenAI worries that models building better models could speed development past the point where people can check the work.

OpenAI says it supports the interest in a “kill switch” but prefers the term “shutdown controls,” because stopping an AI system may take several controls and actions by more than one company. It wants governments, industry, and standards bodies to set common rules for when and how to use the controls.

Some state laws already require frontier developers to publish and follow written safety plans. OpenAI wants to add security and monitoring measures to those plans and hold developers accountable for carrying them out.

Companies that deploy AI agents would be accountable for controlling them

The proposed duties wouldn’t stop with developers. OpenAI proposes three that would reach companies that host AI models, deploy AI agents, or use them:

  • Stopping agents. Companies that host models, deploy agents, or use them would have to stop dangerous activity within their control and act promptly when serious threats arise. Users would also be barred from bypassing the controls developers and deployers provide.
  • Setting limits. Companies that deploy or use agents would have to “configure and operate agents within specified boundaries,” use the available security controls where appropriate, and “remain accountable for misuse they direct.”
  • Seeing what agents do. Companies running agents would see their agents’ work: developers whose models run agents would have to let those customers see the agents’ actions and receive alerts about unsafe or unintended behavior.

Developers would also have to address the cyber risks their agents can reasonably be expected to pose, and tell customers about the agents’ limits.

Serious AI incidents would be reported to the government and to the victims

Organizations running advanced AI models or agents, including developers, would report serious AI safety and security incidents confidentially to the federal government. Each would also have to promptly notify the affected organizations.

Reportable incidents would include an AI system that escapes its operator’s control and gains unauthorized access to another organization’s confidential information, alters or destroys it, or disrupts that organization’s systems or services. Stealing a model’s files would also count. Behavior that appears during a controlled safety test and stays inside the test would not have to be reported to the government.

A company that runs agents on another developer’s model would report incidents from those agents itself.

Developers would also have to publish and follow a policy for notifying any outside organization whose confidential information a model accesses, alters, or destroys without permission by exploiting a security flaw during development or testing. The notice would be required even when the incident falls below the threshold for reporting to the government. The Hugging Face breach is an example of this kind of incident.

In the United States, OpenAI wants the Cybersecurity and Infrastructure Security Agency (CISA), the federal agency that protects government networks and critical infrastructure, to be the single federal agency that receives cyber incident reports. It wants Congress to build the AI reporting system on the Cyber Incident Reporting for Critical Infrastructure Act model, a 2022 law under which critical infrastructure companies report cyberattacks to CISA, and it says one report should satisfy both federal and state rules.

The government would test the most capable models and agents before release

OpenAI wants pre-release government testing to be mandatory for the most capable AI models and for agent systems built on them. The Center for Advancing Innovation and Standards for Super Intelligence (CAISSI), the federal office that tests advanced AI models, would carry it out.

OpenAI says an agent’s safety depends on the software, tools, and permissions around the model, not only on the model. CAISSI’s tests would check whether safeguards still work when those change.

Congress would also let CAISSI certify outside assessors to review developers. Developers would write “safety cases”: explanations, backed by evidence, of how they manage each risk when training and releasing their models. Assessors would examine the evidence and test the developers’ assumptions, starting with risks that arise during training, testing, and internal use.

Assessors’ pay should not depend on favorable results, and OpenAI says a credible system should not rely only on organizations paid by the companies they assess. The government would keep the final decisions on public safety.

Software that runs hospitals, water and power would face enforceable security duties

OpenAI proposes enforceable security duties for companies that provide software that essential services depend on, including healthcare, water, energy and communications. These companies would have to build secure products, promptly fix serious flaws, and make secure settings the default.

The organizations that run those services would have to operate their systems securely and be ready to keep services running, or restore them, during and after an attack. OpenAI cites tested recovery plans as one example. Industry regulators would set the requirements and penalties.

OpenAI also wants Congress to fund CISA to lead a national effort to fix long-standing security weaknesses. A five-year plan would set deadlines and measurable targets to fix urgent, known flaws. Hospitals, schools and water systems that lack money, staff or expertise would come first. Governments would also pay to replace equipment that has reached the end of its working life and to redesign systems that can no longer be adequately secured.

OpenAI says it has committed $1 billion to subsidized access to Daybreak, its AI tools for finding and fixing security flaws, along with training and support for organizations that defend essential services.

OpenAI cites its own models’ attack on Hugging Face as the reason to act now

In July, AI agents running on OpenAI models in an internal hacking test, with some safeguards reduced, used a flaw in an OpenAI system to reach the internet and broke into Hugging Face, a company with no part in the test. OpenAI’s investigation found the models were “pursuing their assigned tasks through actions outside their intended scope and permissions.” OpenAI says it has since strengthened its monitoring and security.

OpenAI says the incident shows that AI agents built on frontier models can work together through a multi-stage attack without a person directing each step. It says criminals and state-backed attackers could use the same abilities.

OpenAI says AI can now help defenders find and fix security flaws, detect intrusions, and respond to attacks at a scale previously not possible. It calls the present a “defender’s window”: a brief period in which AI gives defenders a potentially temporary advantage. It wants governments to act before attackers gain the same capabilities. The recommendation does not estimate how long the window will last.

OpenAI wants a national law, and state laws until Congress acts

OpenAI urges Congress to pass “mandatory, capability-based national AI safety regulation.” Until Congress acts, it says states should keep passing frontier AI safety laws that match one another, so developers face the same requirements from state to state. It names California’s SB 53, New York’s RAISE Act and Illinois’ SB 315 among those it supports.

OpenAI says the third part of the series, on keeping safety in step with how fast the most powerful AI advances, will follow soon.

Close-up of colorful PHP code in a dark code editor, for an article on critical PHP flaws found with AI

Governments And Companies Take Websites Offline After AI Finds Critical Flaws In The Language Behind 70% Of Websites

, , , , , , , , , , ,

The flaws let attackers take over web servers without a password. Cloudflare alone counted millions of attempts to exploit them within hours of their disclosure.

 

Governments and website operators around the world took sites offline after researchers using AI found flaws in PHP, the programming language behind roughly 70% of all websites, that let attackers take over servers without logging in.

Attackers began trying to exploit the flaws as soon as they became public. Cloudflare, which filters traffic for about 28% of all websites, said it counted tens of thousands of attempts to exploit the flaws within 45 minutes of PHP disclosing the vulnerabilities, and millions within hours.

Amazon said one of its decoy servers, which are set up to attract attackers, recorded an attempt on Oct. 17, four days before the flaws were made public. Amazon said it is unclear how the attacker got the details before disclosure.

Amazon said it is unclear whether the attempts it recorded would have worked against real systems. No successful break-in has been confirmed as yet.

The Cybersecurity and Infrastructure Security Agency (CISA) confirmed that it hasn’t seen the flaws exploited as of Oct. 21. The PHP Foundation, the nonprofit that funds PHP’s developers, also said it had found no working attack code when the fix was released.

CERT-EU, the cybersecurity team for EU institutions, was less certain: it said attack code circulating online “raises the likelihood that attackers are already exploiting the vulnerabilities,” but stopped short of confirming a breach.

Sites went offline from Europe to Australia

News of the flaws leaked online on Oct. 20, a day before PHP’s developers planned to release a fix. Rather than wait, governments, companies, and nonprofits took sites offline as a precaution. Those that went offline included:

  • Netherlands: DigiD, the national login for government services, along with the MijnOverheid government portal, the parliament’s website, and the NCSC’s own site. Broadcaster RTL’s news site and app and Amsterdam Schiphol Airport’s app were also affected.
  • Belgium: all Flemish government websites, temporarily.
  • France: the Interior Ministry took down local government prefecture websites.
  • Finland and Australia: government agency websites.
  • Wikipedia: the Wikimedia Foundation, which runs it, took many of the tools its volunteer developers use offline while working to keep Wikipedia itself running.

Some sites, including DigiD and MijnOverheid, were back online by the evening of Oct. 21, while others stayed offline longer.

The National Security Agency told organizations to install PHP’s fix immediately or take vulnerable systems offline, according to AFP. Authorities on three continents issued similar calls, including CISA, the FBI, CERT-EU, Japan’s prime minister and a platform affiliated with China’s Ministry of Industry and Information Technology.

Any unpatched PHP site can be taken over without a password

PHP runs on web servers and builds the pages visitors see. WordPress, Drupal, Joomla, and MediaWiki, the software that runs Wikipedia, are all written in PHP.

The flaws are in PHP itself, not in the websites built on it, so a site with secure code can still be exposed. Wiz, a cloud security company owned by Google, showed that an attacker who never logs in could run their own commands on servers running the latest versions of WordPress, Drupal and Joomla.

Wiz also showed that an attacker could read data from a server’s memory without taking over the server. That data can include passwords, login tokens and API keys, both the server’s own and those sent by other people using the site.

PHP’s security team tracks the problems as two flaws and rated both 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS), the scale security teams use to rank how dangerous a flaw is. Wiz says every PHP version released in the last decade has at least one of them.

Two teams found the flaws with AI, weeks apart

Calif, a California security firm, found the first flaw in August using OpenAI’s GPT-5.6 Sol model. It was auditing PHP’s code under Patch the Planet, an OpenAI program that pays for security reviews of widely used open-source software.

Wiz found both flaws on its own on Aug. 19, using Google’s Gemini 4 Argon, GPT-5.6 Sol, and its own Wiz Atlas research tool. It reported them to PHP’s developers on Aug. 24.

AI turned a flaw too complex for humans to exploit into a one-week job

Wiz said AI is what turned the flaws into a working attack. The flawed code had been in PHP for more than a decade. Before AI, building a working attack from these flaws was so complex that Wiz called the work “at the edge of what human researchers could practically achieve.” An attacker had to combine several flaws, then retest and adjust the attack on each server, because each one handles memory differently. Wiz said AI models can now do that retesting and adjusting themselves. A single researcher built the working attack in a week using the AI models Wiz mentioned. Wiz said before AI the attack would have taken “a world-class team months” to create.

PHP’s developers say updating is the only complete fix

PHP’s developers released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21. Versions 8.1 and older no longer get official updates. The developers posted fixes that technical teams can apply themselves to versions 7.4 through 8.1, and some Linux distributors and other vendors supply updates for older versions.

Cloudflare, Amazon Web Services, Microsoft, Google, Akamai and other providers set up filters to block attack attempts before they reach a customer’s server. PHP’s developers say these filters block some attack methods, but only installing PHP’s fixed versions closes the flaws.

AI has been finding software flaws in large numbers

In June, the UK government said it found 407 security flaws using the most powerful AI models. Companies in Anthropic’s Project Glasswing, which gives vetted organizations access to its most powerful models to find and fix software flaws, found at least 129,000 software flaws between April and July.

OpenAI said the PHP flaws are among several serious vulnerabilities it has already found and is working to fix. It expects similar findings “to increase sharply in the coming months.”

A glowing shield with a whale emblem between China's flag and the U.S. Capitol, for DHS's order to remove DeepSeek

DHS Orders Civilian Agencies to Remove DeepSeek AI, Saying Government Data Could Reach China

, , , , , , , , , ,

The order covers agencies such as the Treasury, State, and Justice departments and bars them from buying or using products from other companies built on DeepSeek.

 

On Oct. 20, the Department of Homeland Security (DHS) made public an order requiring federal civilian agencies to stop buying products from Chinese AI company DeepSeek and to remove DeepSeek products already in their computer systems. The removal also covers products and services that other companies built using DeepSeek.

DHS says anything a government employee or vendor types into DeepSeek could end up in China, where Chinese law gives the Chinese government’s cyber and intelligence agencies wide access to private companies’ computer systems.

Homeland Security Secretary Markwayne Mullin issued the order on July 24. DHS published notice of it in the Federal Register on Oct. 20, the government’s daily publication of official rules and notices. The order applies to civilian agencies such as the Treasury, State, and Justice departments. It does not apply to the Department of War, the intelligence agencies, or the systems civilian agencies use for national security and classified work. Those fall outside DHS’s authority. The Department of War and intelligence agencies decide whether to remove a technology from their own systems and classified systems.

DHS says DeepSeek could send government information to China

DeepSeek offers free public-facing AI apps that relay user sessions to its servers in China. DHS warns that government employees or vendors who use them could transfer sensitive government data to China. DHS says that information, alone or combined with public data, could give China useful intelligence about Americans and government programs.

DHS also says DeepSeek collects personal information when users create an account and may track them and identify their devices.

DHS raised cybersecurity concerns, warning that DeepSeek’s AI models “may contain malware or other security vulnerabilities.” It cites outside security research from February 2025 that found multiple critical flaws in DeepSeek’s iPhone app.

Agencies cannot buy products that other companies built on DeepSeek

The order bars agencies from acquiring any DeepSeek product or service, including from its corporate affiliates. Agencies must take those offerings off the approved-product lists and online marketplaces they use to buy technology.

Agencies also cannot buy, and must remove, products and services that other companies built using DeepSeek to sell to the government.

Agencies must remove DeepSeek at once unless DHS grants an exception

The order took effect as soon as it was issued. An agency that needs more time, or wants an exemption, can ask DHS in writing. The order gave agencies 60 days from its issue to make that request and explain why, for example, by showing how the order would stop the agency from doing essential work. The Cybersecurity and Infrastructure Security Agency (CISA), part of DHS, approves or rejects each request.

Until DeepSeek products are fully removed, DHS encourages agencies to monitor data moving in and out of their systems, keep more detailed activity records, limit how much data can leave, and flag unusual activity. CISA may give technical help to agencies that cannot comply on their own.

Background: other U.S. limits on DeepSeek and China’s response

Other parts of the government have already restricted DeepSeek. Commerce Department offices told staff in March 2025 that DeepSeek was banned on government devices, and Congress restricted its use in intelligence agency systems in December 2025, according to CNBC.

In September, the NSA, CISA, and FBI accused DeepSeek and five other Chinese AI companies of secretly training their own models on billions of answers drawn from American AI models.

Asked about the DHS order, China’s foreign ministry said it would protect its companies’ rights and interests, Reuters reported. Spokesperson Mao Ning said China “consistently opposes the over-generalization of national security as well as the politicization of science, technology and trade issues.”

The 2018 federal supply chain security law behind the order requires DHS to review it within a year and then annually thereafter.

U.S. Capitol linked by network lines to a seal reading CISA and a transparent shield, for the CISA Securing AI Task Force Act

Carter, Thompson Reintroduce Bill Creating an AI Security Task Force at CISA

, , , , , , , , , ,

The task force would update the federal cybersecurity agency’s AI security guidance and coordinate warnings about the cyber risks of using AI software.

 

Reps. Troy Carter (D-La.) and Bennie Thompson (D-Miss.) reintroduced a bill that would require the Cybersecurity and Infrastructure Security Agency (CISA), the federal government’s cybersecurity agency, to create a task force to coordinate its AI safety and security work.

The task force would oversee the agency’s AI security warnings and guidance, including warnings about the cyber risks of using AI software. Its work would cover AI from design and development through adoption and deployment. It would also coordinate CISA’s input into AI working groups. These include groups led by the Department of Homeland Security, groups made up of several federal agencies, and groups outside the government.

Thompson, the top Democrat on the House Homeland Security Committee, said the task force would help CISA “better understand the risks that come with AI” and protect “the systems and infrastructure Americans rely on every day.”

The CISA Securing AI Task Force Act was announced on Oct. 8 and sent to the House Homeland Security Committee.

The task force would update CISA’s AI guidance and warnings

Within a year of the bill becoming law, CISA’s director would have to form the task force from staff already working across the agency’s offices.

The task force would review CISA’s existing security guidance and programs and recommend changes so they address the safety and security problems that come with AI.

It would also coordinate CISA’s efforts to warn about the cyber risks of using AI-based software and to encourage the use of security-focused AI software.

The task force would also look at how AI can help defend against attacks

The task force would also look for ways AI can help defend the systems and infrastructure Americans rely on against cyberattacks. Within CISA, it would identify where the agency needs more staff with AI skills and recommend new projects to make AI safer to build and use.

The bill would set no rules for companies

The bill would put no new requirements on businesses and would give CISA no new powers. It does not set aside money for the task force.

Every six months, the task force would brief the House Homeland Security Committee and the Senate Committee on Homeland Security and Governmental Affairs on its work. Apart from the briefings, the bill sets no deadlines and requires no reports or other products from the task force. The law would expire five years after it took effect.

To become law, the bill would need approval from the House Homeland Security Committee, votes in both the House and the Senate, and the president’s signature.

U.S. Capitol behind blue and red digital networks illustrating proposed security standards for organizations deploying AI agents.

House Proposal Calls for AI Agent Inventories After Hugging Face Breach

, , , , , , , , ,

The proposed security standards would be voluntary for most organizations, but companies pursuing new federal contracts could be expected to follow them.

 

Reps. Josh Gottheimer (D-N.J.) and Mike Lawler (R-N.Y.) announced the Stop Rogue AI Act, a bipartisan proposal that would direct the federal government to create security standards for organizations deploying AI agents.

The proposal follows recent incidents in which AI agents took unauthorized actions while working toward assigned goals.

The proposed standards would call on organizations to maintain a continuously updated, computer-readable inventory of every AI agent they deploy. The records would identify the company or developer behind each agent.

The standards would be voluntary for most organizations. Companies pursuing new federal contracts, however, could be expected to follow them.

The proposal would track agents and their actions

The Stop Rogue AI Act would give the National Institute of Standards and Technology (NIST) one year after the bill becomes law to publish standards for deploying AI agents securely.

The standards would cover how organizations verify the actions agents take on their systems and test whether the agents operate securely and reliably.

Organizations would also be encouraged to preserve records of agent actions in a form that cannot be secretly altered. The inventory requirement would give them an ongoing record of which agents are operating on their systems and who created them.

The proposal would direct NIST to work with the Cybersecurity and Infrastructure Security Agency (CISA) so that civilian federal agencies incorporate the standards into their cybersecurity programs.

Rogue AI incidents cited

The proposal comes after several incidents where AI agents ignored instructions beyond test parameters and breached outside systems. The most famous, the Hugging Face breach, involved AI agents OpenAI used in cybersecurity testing that escaped their restricted environment and entered the production systems of AI platform Hugging Face.

Hugging Face said the agents carried out thousands of automated actions, gained unauthorized access to a limited number of internal datasets, and obtained credentials used by its services.

The company said it found no evidence that the agents altered its public models, datasets, or applications. Hugging Face initially said it did not know which AI models powered the agents. OpenAI later acknowledged that models it was testing caused the intrusion.

The proposal would not impose a general mandate

The bill would not directly impose its proposed security practices on most companies. Instead, it would instruct NIST to develop standards that organizations could adopt voluntarily.

The federal-contracting provision could give the standards greater force for companies seeking new government business. The announcement did not explain how compliance would be assessed or which new contracts it would cover.

The House page does not yet include the proposed bill text or a timetable for congressional action. If the measure becomes law, NIST would have one year to publish the standards.

Red and blue cutaway illustration of a data center beside power lines, on AI critical infrastructure designation

Advocacy Group Asks The President To Designate AI As Critical Infrastructure

, , , , , , , , ,

A critical infrastructure designation would give AI companies 72 hours to report a cyberattack, put their data centers under federal security standards, and name the firms the government defends first.

 

Key Takeaways

  • Americans for Responsible Innovation (ARI) asked the President to add AI to the critical infrastructure list, which already covers power, water, banking, and hospitals.
  • A 2022 law requires critical infrastructure companies to report cyberattacks within 72 hours, and a designation would extend that duty to AI companies. The law is not in force for anyone yet because CISA has not yet written the regulation that puts it into effect.
  • ARI says the need for critical infrastructure designation is urgent as adversaries are already attacking AI infrastructure.
    • ARI cited recent Iranian drone strikes that destroyed two Amazon data centers in the United Arab Emirates as proof.

 

Americans for Responsible Innovation, a Washington nonprofit that lobbies on technology policy, published a report on August 20 asking the President to add AI to the federal critical infrastructure list. Sixteen sectors sit on that list today.

ARI recommends including in the designation companies that build and train AI models, the data centers powering them, AI chip designers and manufacturers, and the platforms selling access. A critical infrastructure designation puts one federal agency in charge of the sector, requires its companies to report attacks, and ensures the government tells those companies what it knows about threats aimed at them.

Attacks on AI infrastructure have already done damage

ARI cites two attacks as examples of the need for designation. On March 1, Iran flew drones into two Amazon Web Services data centers in the United Arab Emirates, setting fires and cutting power. Banking and food delivery apps across the UAE stopped working, and Amazon’s status page still showed problems eleven days later.

The previous July, someone offered a routine code contribution to the public repository behind Amazon Q Developer, a coding assistant used inside a programmer’s editor. Amazon merged it, and a badly protected credential in its build system handed the contributor administrator access. They planted an instruction in the next official release telling the assistant to wipe the computer it ran on and delete the customer’s cloud account. Amazon published that release to the marketplace, where the assistant was downloaded more than 964,000 times. The instruction never ran, because whoever wrote it made a syntax error.

ARI says one corrupted model could damage many industries at once

AI now runs inside operations across finance, health care, energy, and government. Those companies mostly build their own AI tools, but nearly all of those tools sit on a small number of underlying models, running in data centers owned by a handful of cloud companies.

That is the risk ARI describes. An attacker who corrupts one widely used model does not damage one company. The corruption travels into everything built on that model.

This kind of attack is hard to notice. An AI system produces different output every time it runs, so a tampered one keeps answering and looks like it is working long after its answers stopped being reliable. And currently no rule requires the companies building those models to meet a security standard or disclose a breach, so the businesses running on them cannot spot the problem themselves, and nobody has to tell them. The government cannot see it either.

A designation would assign one federal agency to the sector, set security standards those companies must meet, and require them to report attacks, so a warning reaches the businesses downstream.

“AI systems are becoming increasingly integrated across industries, including health care, finance, and manufacturing, and without formal national security standards, an attack on these systems could lead to the incapacitation of these sectors at once,” said ARI policy analyst Jessica Maksimov, who wrote the report with Terrence Kelly.

AI companies would get 72 hours to report an attack

The designation would put AI companies under the Cyber Incident Reporting for Critical Infrastructure Act of 2022, which gives companies in listed sectors 72 hours to tell the government they were attacked. AI companies currently have no federal reporting duty.

That requirement is not in force for anyone. A law of this kind takes effect only once the responsible agency writes the regulation that carries it out, and CISA, the federal cybersecurity agency, has missed its deadlines to do so. It now expects to publish this fall.

CISA and the Center for AI Standards and Innovation (CAISI), the federal office that writes AI security guidance, would then publish security standards for AI data centers. ARI wants Congress to fund a CISA team to audit them.

A short list of AI companies would get government attention first

The agency would name the systemically important AI companies whose failure would do the country the most damage. The report says government protection, security requirements, and help reducing risk should start with these companies ahead of everyone else in the sector.

The last two sectors that asked were turned down

In 2024, the President declined to label space systems or the bioeconomy, meaning goods made from biological processes, as critical infrastructure. Officials said space systems were already spread across other sectors on the list, and that the bioeconomy’s risks were not sufficiently different from the risks those sectors already cover.

The White House South Lawn and fountain on a clear day, site of the Gold Eagle AI cyber defense announcement

White House Launches Gold Eagle To Coordinate AI-Driven Cyber Defense

, , , , , , , ,

The new initiative will connect AI developers, software companies, and critical infrastructure operators to identify and patch vulnerabilities before attackers can exploit them.

 

The White House launched a cybersecurity initiative called Gold Eagle to help companies and government agencies share information about software vulnerabilities discovered by advanced AI systems.

Announced Tuesday, the program brings together federal agencies, AI developers, and operators of critical infrastructure. The administration said Gold Eagle has already begun collecting and prioritizing vulnerability reports and coordinating responses.

Gold Eagle was created under President Trump’s June 2 executive order, “Promoting Advanced Artificial Intelligence Innovation and Security.” According to the White House, the initiative is intended to reduce duplicate scanning efforts and speed up the process of getting vulnerability information to the organizations responsible for fixing the flaws.

The effort is led by the White House, the Department of the Treasury, the Department of Homeland Security through the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Defense. Officials said the participating organizations will coordinate responses to vulnerabilities identified by increasingly capable AI systems.

The White House did not identify the companies participating in Gold Eagle.

Abstract Earth from space with a digital AI overlay illustrating a Five Eyes warning about frontier AI cyber risks.

Five Eyes Warn Frontier AI Could Enable Major Cyberattacks Within Months

, , , , , , , , , , ,

The cyber agencies of Australia, Canada, New Zealand, the United Kingdom and the United States said advances in frontier AI may soon increase the speed, scale and sophistication of cyber operations.

The cybersecurity and intelligence agencies of the Five Eyes alliance issued a rare joint statement, warning that frontier AI advances could enable more serious cyberattacks within months, potentially altering the threat landscape faster than many organizations expect.

The statement was released by the leading cyber agencies of Australia, Canada, New Zealand, the United Kingdom and the United States, including organizations such as the U.S. National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the United Kingdom’s National Cyber Security Centre (NCSC), the Australian Cyber Security Centre (ACSC), and the Canadian Centre for Cyber Security (CCCS).

According to the agencies, increasingly capable AI models could enable threat actors to conduct cyber operations with greater speed, scale, and sophistication. The agencies warned that advances in frontier AI may reduce the expertise and resources traditionally required to carry out complex cyber activities, potentially placing more powerful capabilities into the hands of a broader range of threat actors.

The Five Eyes called on organizations to take practical steps now to understand their risks, strengthen cybersecurity fundamentals, and ensure leadership is prepared to respond as threats evolve.

The statement also emphasized that responding to AI-enabled cyber risks cannot be treated solely as a technology challenge. The agencies said a “whole-of-organization and whole-of-society response is required,” with leaders across business, government, and critical infrastructure working together to improve resilience.

For organizational leaders, the agencies highlighted several priority actions. Here they are verbatim:

  • Reduce your attack surface: Limit unnecessary system access and external connectivity. Challenge whether systems need to be exposed at all and isolate those that do not.
  • Accelerate patching processes: AI is shortening the time between vulnerability discovery and exploitation. Delays in patching increase risk, especially for operational systems with long update cycles. Prioritize security updates accordingly to manage risks.
  • Address legacy systems: Unsupported systems are easy targets. They are not just technical debt; they are strategic liabilities.
  • Review and strengthen identity and access controls: Limit who can access critical systems. Enforce strong authentication and regularly review permissions.
  • Prepare for incidents before they happen: Test response plans, train and prepare teams, and assume breaches will occur. Focus on fast containment and recovery.

The agencies also encouraged organizations to use AI as part of their defensive strategy, noting that the technology can help improve threat detection, accelerate incident response, and strengthen overall cyber resilience when deployed responsibly.

The Five Eyes agencies concluded by calling on leaders to act now rather than wait for future guidance or major incidents. Their message was that organizations should build resilience before more capable AI systems further compress the timeline between identifying a vulnerability and exploiting it.

CISA 3-day patch mandate abstract image with CISA logo over digital network lines

CISA Sets 3-Day Patch Mandate for Federal Agencies’ Most Dangerous Vulnerabilities

, , , , , , , , , ,

Federal agencies will have as little as three days to patch software vulnerabilities deemed most dangerous by CISA.

 

The Cybersecurity and Infrastructure Security Agency (CISA) issued a new directive requiring federal civilian agencies to fix the most dangerous software vulnerabilities within three days.

The directive, known as BOD 26-04, changes how federal agencies decide which software vulnerabilities need immediate attention. Instead of relying primarily on technical severity scores, CISA will now prioritize vulnerabilities based on their likelihood of being exploited by attackers and the damage they could cause.

Under the new system, agencies must fix the highest-risk vulnerabilities within three calendar days. Other vulnerabilities will have deadlines of 14 or 30 days depending on the level of risk identified by CISA.

CISA said the change is necessary because attackers are moving more quickly than ever. The agency specifically pointed to advances in AI that are helping attackers discover and target software vulnerabilities faster, reducing the time organizations have to respond.

“Defenders cannot afford to take weeks to patch systems that can be autonomously exploited en masse,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity, in a Reuters interview.

According to CISA, technical severity scores do not always reflect the actual danger posed by a vulnerability. Some highly rated vulnerabilities may never be exploited by attackers, while lower-rated vulnerabilities can become serious threats if actively targeted.

The new directive is designed to help agencies focus their resources on the vulnerabilities most likely to be used in real-world attacks.

Federal agencies must begin using the new approach immediately. CISA said the directive will create a more consistent process across government while helping agencies respond more quickly to emerging threats.

While the directive applies only to federal civilian agencies, it reflects a broader shift in cybersecurity. Organizations are increasingly looking beyond technical ratings and focusing on which vulnerabilities attackers are actually exploiting.

Architectural line illustration of the White House accompanying coverage of the Trump AI executive order 2026.

Trump Signs AI Executive Order, Tasks NSA With Classifying Frontier Models by Cyber Risk

, , , , , , , , ,

The order gives CISA 30 days to issue binding cybersecurity directives across all civilian federal agencies and creates a government review process for the most powerful AI models before they ship.

 

On June 2, President Trump signed an executive order that requires the Cybersecurity and Infrastructure Security Agency (CISA) to issue binding cybersecurity directives to federal agencies within 30 days and directs prosecutors to treat AI-assisted crimes as enforcement priorities.

Companies that build the most powerful AI models now face a new pre-release review process. There is no legal requirement to participate, but government pressure to do so.

 

What federal agencies must do in 30 days

CISA, the federal cybersecurity agency within the Department of Homeland Security, must issue binding operational directives specifying which cybersecurity measures all civilian federal agencies must implement. CISA must also “establish or expand Federal programs and cybersecurity services that enhance AI-enabled defensive tools” for federal agencies and extend access to the most capable AI models to state, local, and private-sector critical infrastructure operators, such as rural hospitals and utilities. 

The Treasury, NSA, and CISA must jointly establish a “vulnerability clearinghouse” within 30 days. The clearinghouse coordinates scanning for software vulnerabilities across federal agency and private-sector systems, validates its findings, and determines which vulnerabilities get patched first. The Defense Department runs the same process for its own systems under the same deadline.

The order also establishes a new government classification, “covered frontier model,” that determines which AI models are sufficiently powerful to warrant special handling before public release.

 

What a “covered frontier model” is, and why the designation matters

A “covered frontier model” is an AI model that the NSA deems to pose significant cyber risk. NSA determines, in consultation with the National Cyber Director and CISA, using a classified benchmarking process that the Treasury, NSA, and CISA must build within 60 days.

Once a model gets that designation, its developer can enter a voluntary government review process. The developer grants the government access to the model for up to 30 days before the public release, with confidentiality and IP protections in place. The government then helps determine which partners receive early access. Developers who go through the process get earlier visibility into how the government reads their model’s risk profile.

The government cannot use this process to block or require approval before an AI model ships. Participation is voluntary. However, developers who decline, will release their most powerful models without a government read on their cyber risk. 

 

Prioritizing AI-assisted crime

The Attorney General must prioritize prosecuting AI-enabled crimes. Three statutes apply: identity fraud (18 U.S.C. § 1028), unauthorized computer access (18 U.S.C. § 1030), and wire fraud (18 U.S.C. § 1343).

The 30-day agency deadlines run through early July. The frontier model benchmarking deadlines run through early August.

 

The executive order comes eight days after the President rejected a planned executive order to create a federal review process for advanced “frontier” AI models before release.

Load More