Policy Pulse

Anthropic discloses three Claude models breached three real organizations during cyber evals, days after OpenAI breached Hugging Face the same way. Congress pushes the FRONTIER Act as CISA's 2015 sharing law nears sunset.

OpenAI's own evaluation models breached Hugging Face, triggering a bipartisan AI Kill Switch bill within 48 hours. A federal judge separately orders published iPhone exploit research deleted on trade-secret grounds.

CISA, NSA, and allied agencies from the UK, Netherlands, and Japan jointly tell vendors how to run a VDP, safe-harbor language included. Plus: AI-scale disclosure overwhelms maintainers, and the White House launches Gold Eagle.

GPT-5.6 Sol goes public as Washington lifts its access gate, and UK AISI finds universal cyber jailbreaks within hours, the same pattern that forced Anthropic's Fable 5 offline. Plus Illinois mandates frontier AI safety audits.

Washington lifts export controls on Anthropic's frontier cyber models two weeks after locking them down. Plus Akrites launches to absorb AI-scale disclosure and ENISA's CVE Root appoints a new CNA.

GPT-5.6 Sol joins Mythos 5 behind the federal access wall as the US government locks in its frontier AI gatekeeping regime. UK CMA reform's statutory defence covers only 300 of 69,600 researchers. DMCA Section 1201 petitions open through August 24.

Three days after Anthropic shipped Mythos 5 to vetted defenders, the US government used export control to recall it worldwide. CISA's BOD 26-04 also retires the fixed-deadline KEV model for a risk score.

Trump's Executive Order 14409 stands up a federal AI cybersecurity clearinghouse, but benchmarks machine-found vulnerabilities while saying nothing about how they reach defenders. Plus: CISA opens KEV nominations to researchers.

Hackers on the Hill returns to DC on June 16, the first Capitol-side researcher-to-policymaker gathering of 2026. The White House signs the Mythos-era AI cybersecurity EO with a 30-day pre-release access window. A longer analysis lands later this week.

Microsoft's MSRC invokes the Digital Crimes Unit against the Nightmare Eclipse zero-day drops, and the disclosure community is not having it. UK National Security Bill confirms CMA reform that protects roughly 300 researchers.

Peter G. Neumann, who moderated the ACM RISKS Forum for 41 years and helped found the discipline of secure-systems research, died May 17 at 93. CISA opens a public KEV nomination form. Cloudflare publishes its Project Glasswing post-mortem.

OpenAI launches Daybreak with 20+ vendor partners, putting a second restricted-access defensive AI consortium next to Anthropic's Glasswing. AISI says autonomous AI cyber capability is now doubling every 4.7 months.