Policy Pulse

Trump's Executive Order 14409 stands up a federal AI cybersecurity clearinghouse, but benchmarks machine-found vulnerabilities while saying nothing about how they reach defenders. Plus: CISA opens KEV nominations to researchers.

Hackers on the Hill returns to DC on June 16, the first Capitol-side researcher-to-policymaker gathering of 2026. The White House signs the Mythos-era AI cybersecurity EO with a 30-day pre-release access window. A longer analysis lands later this week.

Microsoft's MSRC invokes the Digital Crimes Unit against the Nightmare Eclipse zero-day drops, and the disclosure community is not having it. UK National Security Bill confirms CMA reform that protects roughly 300 researchers.

Peter G. Neumann, who moderated the ACM RISKS Forum for 41 years and helped found the discipline of secure-systems research, died May 17 at 93. CISA opens a public KEV nomination form. Cloudflare publishes its Project Glasswing post-mortem.

OpenAI launches Daybreak with 20+ vendor partners, putting a second restricted-access defensive AI consortium next to Anthropic's Glasswing. AISI says autonomous AI cyber capability is now doubling every 4.7 months.

CAISI signs pre-deployment testing deals with Google, Microsoft, and xAI. CISA gives feds three days to patch Ivanti EPMM zero-day. NVD reclassifies 29,000 backlogged CVEs as Not Scheduled.

AISI's GPT-5.5 evaluation confirms frontier-model offensive cyber capability is a trend, not a Mythos one-off. NIST formally drops enrichment for 29,000 backlogged CVEs. UK still has no statutory defence.

CISA's KEV catalog absorbs 13 new CVEs in five days, the heaviest week since Emergency Directives retired in January. UK AISI publishes the first government evaluation of a frontier model's offensive cyber capabilities.

Your weekly briefing on cybersecurity policy affecting vulnerability disclosure and security research.

Your weekly briefing on cybersecurity policy affecting vulnerability disclosure and security research.

OWASP Agentic AI Top 10 redefines the disclosure landscape. Plus: OpenAI launches safety bug bounty, Langflow exploited in 20 hours, and GSA drops the first federal AI acquisition clause.

CVE program funding secured but transparency questions remain. Plus: lookup.disclose.io launches in beta, EU CRA countdown hits 6 months, and Rapid7 reports exploited vulns surged 105%.