The executive order Donald Trump signed in December 2025 was framed as a release valve, a way to stop states from imposing what the administration called "onerous" AI regulations before the federal government had a position of its own. Five months later the same administration is publicly weighing federal oversight of frontier AI models, and the Commerce Department's Center for AI Standards and Innovation has already signed pre-deployment evaluation agreements with Microsoft, xAI, and Google DeepMind. The thing the December order was supposed to prevent has happened, just from the other direction.

The reason is a single model. Anthropic's Mythos, announced last month, can autonomously find software vulnerabilities at a pace that has visibly rattled the officials who had been comfortable telling the public that frontier AI was largely a productivity story. Vice President JD Vance, on a recent call with the heads of the major AI companies, was reported to sound alarmed about small-town banks, hospitals, and water plants becoming targets for AI-coordinated attacks that local governments had no way to handle. Anthropic, the same company that was the conspicuous omission from the Pentagon's IL6 and IL7 vendor list days earlier, limited Mythos's initial release to a handful of American firms, Apple, Amazon, JPMorgan Chase, Palo Alto Networks, precisely because the open release would, in their own internal language, trigger a "reckoning". Watching the policy response, you can see the administration believing them.

What is striking is that nobody achieved this through advocacy. For the last two years labs and researchers had argued in favour of pre-deployment evaluation in essentially the terms CAISI is now using: independent, measurement-driven testing of frontier systems before broad release. Voluntary commitments under the previous administration tried to get there. Op-eds tried. Senate testimony tried. None of that moved the December order. One model demonstrably finding bugs in production code did. The lesson the White House appears to have learned isn't really about regulation as a category, it's that capability now arrives faster than position papers, and a position paper six months old can already be obsolete.

CAISI Director Chris Fall has been quoted insisting that the new arrangements are about "independent, rigorous measurement science", which is the polite, public version of saying that none of the relevant officials are willing to take the labs' own self-assessments at face value when the failure mode looks like cyberattacks against utility companies. The labs themselves seem mostly relieved. Independent evaluation, even mandatory independent evaluation, gives them something they have publicly wanted, which is a reason other than goodwill to slow a competitor's release if the competitor's release is dangerous. It also, incidentally, gives the administration political cover if a bad release happens anyway.

There is something almost old-fashioned about the shape of the policy: a real-world incident, a phone call between officials, a quiet pivot, federal oversight rules taking shape behind closed doors. Until recently this kind of feedback loop ran on bills and hearings. It now runs at the speed of a model release. The interesting question is what happens the next time a lab announces something at this capability tier with less restraint than Anthropic showed. The December order was supposed to be the answer to that question. It isn't, and the people who wrote it can see that as plainly as anyone else.

Sources: