Cybersecurity Policy Report, White House Plans to Stick With Voluntary Testing of Cyber-Capable AI, Cairncross Says, (Aug 7, 2026)
The Trump administration isn’t planning to impose regulations on developers of cyber-capable AI (artificial intelligence) models and instead will continue relying on developers’ voluntarily submitting “frontier” models for prerelease testing, according to National Cyber Director Sean Cairncross.
“This is moving at such speed and at such pace, a regulatory regime ... would not only strangle growth, development, and innovation and be enormously harmful to the industry, but it would be obsolete 48 hours after it was going through whatever process it had gone through,” Mr. Cairncross said during a Tuesday appearance at the Black Hat USA conference in Las Vegas.
“What needs to be built is a flexible, adaptable structure that enables information sharing between industry and government so we can guarantee that this technology benefits everyone ... but is used responsibly and securely,” he said.
The administration initially took a hands-off policy toward AI but changed course after Anthropic released Claude Mythos 2 Preview, an AI model that was capable of quickly finding and exploiting long-dormant vulnerabilities in widely used software and operating systems. The White House responded to Anthropic’s announcement by issuing an executive order (EO) that encouraged AI developers to voluntarily submit cyber-capable models for predeployment security assessments (CPR, June 2).
Mr. Cairncross reported that AI developers had responded positively to the EO. “The executive order is designed to be non-regulatory but to put in place a system to work with industry to ensure that this technology is handled responsibly,” he explained.
“We’ve had tremendous industry engagement, which has been a very gratifying thing to see. Everyone is working towards the same goal in terms of protecting the country and securing our systems,” he said.
“We are trying to ensure that defenders have this technology as quickly and at scale as possible. But there are obviously specific security concerns and industry has been very sensitive to this as well,” he added.
“The design of this is when there is something that happens—when there is a breach, when there is an event—that system and that network of connections can ... adapt to that and seek to remedy that as quickly as possible,” Mr. Cairncross explained.
It’s also important, he said, for cyber defenders to be able to use the capabilities of U.S.-developed AI models to identify and patch vulnerabilities.
“We’ve seen these models don’t necessarily create new problems, but they bring a lot of latent problems to the surface—things that hadn’t been tended to in a long time. And so I think taking care of those issues moving forward from legacy systems is great. But what hasn’t happened before is there wasn’t an incentive for technology that remediated at machine pace,” he said.
“We have to be able to ensure that the security equities are in place, but that innovation is running full speed ahead because at the end of the day, the American innovator ... is going to provide technology that’s going to be beneficial to the entire planet,” he said. “It will secure our country, and it will improve the lives of our citizens.”
MainStory: TopStory FederalLegislation DataSecurity AINews