Government Actions Attempt to Address AI Cybersecurity Risks

Action: The President signed an Executive Order directing Federal agencies to take steps to improve cyber defenses including through a voluntary AI cybersecurity clearinghouse through which public and private sector entities may share information about vulnerabilities.¹ The Order also directs agencies to develop a process by which an AI model would be designated as a “covered frontier model” based on its “advanced cyber capabilities.” Developers of frontier models could provide the government with access to these models voluntarily 30 days before broader release to help ensure the security of critical infrastructure. The Commerce Department also issued an export control order to Anthropic to block foreign nationals (including foreign nationals in the US and employees of the company) from accessing two of its advanced models based on concerns about their ability to exploit cybersecurity vulnerabilities.²

Trusted Insights for What’s Ahead^®

• The Administration had reportedly considered then rejected an earlier Order that would have instituted a mandatory 90-day review period for frontier AI models after objections that it would slow model development and innovation. Reactions in the tech sector to the voluntary approach taken in the final Order were largely positive while some AI safety advocates noted the Order introduces the possibility of stronger oversight in the future.³ However, others expressed concern about whether the Order would be sufficient to address cybersecurity vulnerabilities.
• The Order reflects growing concern that increasingly powerful AI models can be used to identify and exploit cybersecurity vulnerabilities, prompting calls for greater government involvement in the distribution of such models.
• Notably, the cyber security agencies for the “Five Eyes” – the intelligence sharing alliance comprising Australia, Canada, New Zealand, the United Kingdom, and the United States – released a statement on June 22 warning that AI models that could fundamentally alter both offensive and defensive cyber capabilities are only months away.⁴
• The Administration has indicated that it sees AI innovation as a core economic and national security priority and has generally opposed AI regulations, arguing that burdensome rules could slow innovation, undermine US competitiveness, and hinder the nation’s ability to maintain technological leadership in AI.
• However, the Administration has sought to balance its light regulatory approach with national security concerns. Following the Administration’s export control order, Anthropic responded by blocking access to those models for all users – reportedly because it could not effectively screen users by nationality – while arguing that the restrictions were unnecessary and objecting that the government had not provided sufficient evidence of the models’ national security risks.⁵
• Others called for a more transparent decision-making process around these restrictions and broader engagement in AI policymaking.⁶ The company and the Administration are reportedly working to identify a resolution that would allow the company to release its models.⁷ 
• What this means for business:
  • The Order does not define the capabilities or characteristics of frontier models, so developers should closely monitor agency guidance to see whether their models may qualify. Developers will also need to decide whether to participate in the voluntary review program and coordinate across technical and legal teams to prepare accordingly.  
  • As the Five Eyes statement urged, all firms should assess their cyber defenses and monitor information from the cybersecurity clearinghouse to address vulnerabilities.  
  • Firms should also be prepared for more interaction with Federal agencies to address national security concerns related to AI. This may require a thorough understanding of how AI is being used across an enterprise, regular audits of access controls and safeguards, and assessment of vulnerability remediation processes. Restrictions on access by nationality introduce a new level of complexity for firms.
  • Firms should also monitor how facially targeted government actions could require broad responses – such as withholding a product or service – to avoid compliance risk.