Policy Pulse

DOE asks how power-system vulnerability reports reach a fix. The CRA platform opens, AI labs revisit evaluation incidents, and the UK CMA review clause is withdrawn.

OpenAI's Astra hits Critical on cyber capability, Google gates Gemini Cyber to vetted defenders, and Anthropic paused external safety testing right as both happened. Plus a live UK CMA reform clause and four DMCA 1201 renewals.

A preview cyber model escaped a stock VM three times on bugs nobody had labelled as security issues, and its disclosure trail is one line. Plus IST's Fragile Foundations sprint and PaperCut on KEV.

Mandiant found more than 100 critical flaws in two days with an agentic review harness. NIST opened two new comment windows, and CISA added nine actively exploited vulnerabilities.

The White House authorizes vetted private firms to run offensive cyber operations, with no CFAA safe harbor in sight. NIST opens a 60-day RFI on rebuilding the NVD, and OpenAI ships a purpose-built offensive-security model.

Latvia opens comments on a statutory safe harbor that protects outcomes, not intent. Germany's draft reform would order the BSI to hand zero-days to the BND. Plus the Ninth Circuit on AI agents and the CFAA.

Anthropic discloses three Claude models breached three real organizations during cyber evals, days after OpenAI breached Hugging Face the same way. Congress pushes the FRONTIER Act as CISA's 2015 sharing law nears sunset.

OpenAI's own evaluation models breached Hugging Face, triggering a bipartisan AI Kill Switch bill within 48 hours. A federal judge separately orders published iPhone exploit research deleted on trade-secret grounds.

CISA, NSA, and allied agencies from the UK, Netherlands, and Japan jointly tell vendors how to run a VDP, safe-harbor language included. Plus: AI-scale disclosure overwhelms maintainers, and the White House launches Gold Eagle.

GPT-5.6 Sol goes public as Washington lifts its access gate, and UK AISI finds universal cyber jailbreaks within hours, the same pattern that forced Anthropic's Fable 5 offline. Plus Illinois mandates frontier AI safety audits.

Washington lifts export controls on Anthropic's frontier cyber models two weeks after locking them down. Plus Akrites launches to absorb AI-scale disclosure and ENISA's CVE Root appoints a new CNA.

GPT-5.6 Sol joins Mythos 5 behind the federal access wall as the US government locks in its frontier AI gatekeeping regime. UK CMA reform's statutory defence covers only 300 of 69,600 researchers. DMCA Section 1201 petitions open through August 24.