Trump's Frontier AI Permit Has No Form

Across 2025 and 2026, President Donald Trump’s administration promised lighter AI regulation, then restricted top frontier models without creating a license, published threshold or appeal. The AI Security Institute found that open-weight models now trail closed frontiers in cyber capability by only four to seven months, down from six to ten months through most of 2025. Washington’s emergency switch remained intact as the capability gap narrowed.

Trump officials pursued two designs at once. On artificial intelligence, they favored speed, national scale and relief from fragmented state rules. On cybersecurity, they preserved the executive branch’s ability to act before disclosing what it knew. During Trump’s first administration, interagency rules let officials decide whether to disclose or retain security flaws, with retained flaws revisited annually. The process had a review cycle, but the government preserved discretion because publication could destroy the value of the capability under review.

From 2025 into 2026, officials converged on incident-led executive gatekeeping rather than durable deregulation or a transparent licensing regime. Ordinary access remained broad until cyber performance or national-security exposure prompted White House pressure, procurement conditions, export controls or model restrictions. Control became centralized without stable thresholds, evidence rules or appeal.

A light-touch plan left the emergency switch intact

The administration’s AI Action Plan contained more than 90 recommendations and sought to roll back Biden-era measures addressing bias and cybersecurity threats. Regulatory sandboxes, federal uniformity and a “try-first” posture addressed how the United States could accelerate adoption while competitors advanced. A standing federal model-review authority would answer a different question: when may the government withhold deployment permission? The plan did not create one.

The White House later explored an AI working group that could examine oversight procedures, including pre-release vetting. A proposed cybersecurity order would have directed agencies to partner with AI companies without requiring government pre-release testing. Officials considered institutional review, but neither proposal described an operating system with published thresholds, a final evaluator and a routine path to approval.

Executive agencies can target a specific exposure without subjecting every model to advance licensing. They can also preserve pro-innovation rhetoric because most developers never encounter the switch. A company that does encounter it must discover which concern triggered action, which agency owns the judgment and what evidence could reverse it.

Cyber evaluations changed the cost of waiting

Palo Alto Networks reported that three weeks of frontier-AI-assisted analysis matched a full year of manual penetration testing in its tests while covering more ground. Anthropic’s Claude Mythos Preview reached a reported 73% success rate on expert-level capture-the-flag challenges that no model could finish before April 2025. Those results do not establish autonomous real-world intrusion, but they show a sharp compression in the time and labor once required from scarce specialists.

A benchmark can measure vulnerability discovery, tool use and multistep execution without reproducing the defender, monitoring stack, access constraints or operational uncertainty of a live network. In the GPT-5.5 cyber evaluation, the model became the second to complete a multistep attack simulation end to end. The evaluation cautioned that its environment lacked active defenders and defensive tooling. Controlled success is evidence of capability, not proof of an attack campaign.

Those caveats limit claims about immediate offensive autonomy, but Palo Alto still compressed a year of manual testing into weeks. A national-security official therefore faces asymmetric costs: overreacting to a benign evaluation imposes visible costs on a company, while underreacting to a capability that later scales can produce losses far beyond the average test result. “On average, the model failed” offers little comfort when one successful chain is enough.

Anthropic CEO Dario Amodei called for mandatory third-party tests covering cyber, bio and autonomy risks, with authority to block or revoke dangerous deployments. His proposal placed the decision before release and assigned it to an evaluator. The administration instead acted through powers it already held. Both approaches accept that some capabilities require authorization; they differ over who defines the threshold before conflict begins.

Agents moved control below the model

An AI agent couples model output with tools, credentials and a chance to alter the world described in the prompt. Business software companies began moving from copilots that assist users toward agents that act for them. The application layer became the place where a model could open an account, spend money, change code or deploy infrastructure.

Cloudflare enabled agents to create accounts, start paid subscriptions, register domains and deploy applications on a user’s behalf. OpenAI added native sandboxing and an in-distribution harness to its Agents SDK for long-horizon deployment and testing. Microsoft introduced the Agent Control Specification to give developers granular, consistent control over agent behavior. Each company addressed the same engineering fact: model-level rules cannot govern an action that only the surrounding application has permission to execute.

Operators therefore split the agent-security problem into smaller authorization decisions. The model may propose a command; the sandbox decides where it can run. The application may request a purchase; the payment system decides whether the credential can authorize it. The agent may identify a vulnerability; the deployment environment decides whether it can connect to the target. Accountability sits at those boundaries because that is where an intention becomes an irreversible act.

Human review catches errors and records who accepted responsibility, what evidence that person saw and which action crossed the boundary. Removing the human may improve throughput, but the surrounding system must then assign responsibility elsewhere.

Institutions make thresholds; vacancies make discretion

OpenAI asked CAISI, rather than the NSA, to lead mandatory cyber-risk evaluations of advanced systems. The White House discussed an oversight working group, while the White House and Anthropic reportedly worked on a framework for assessing the severity of AI security flaws. Officials and model companies had identified the missing institutional layer.

CAISI and NIST also revealed the capacity constraints that make formalization difficult. CAISI Director Chris Fall resigned after taking over the federal testing institute in April, leaving NIST Director Arvind Raman as acting director. NIST narrowed National Vulnerability Database work to vulnerabilities in CISA’s known-exploited catalog after a backlog tied to a 2024 funding lapse. Naming an evaluator cannot make thresholds repeatable without personnel, continuity and enough capacity to maintain the evidence base.

Anthropic encountered the practical difference. A source said the company received 90 minutes to comply and no detailed concerns before the Commerce Department imposed export controls on its models. A formal evaluator might have reached the same substantive decision, but it would have had to identify the threshold, document the evidence, specify the remedy and provide a route for reconsideration.

Officials instead fill those missing fields through negotiation. A frontier lab can bargain because it controls a scarce model, while the government can escalate because it controls procurement, export permissions and national-security authorities. The decision may arrive faster than a licensing process. It also binds the immediate parties more clearly than the next company with a slightly different model and the same underlying capability.

Open weights remove the comfort of a permanent lead

The AI Security Institute found that recent open-weight models were closing the cyber-capability gap with frontier closed models. It also said the open models it tested were largely unimpeded by safeguards, while cautioning that the future size of the gap remains uncertain.

That uncertainty cuts both ways. Closed providers can impose account controls, monitor API use, withdraw access and add model-level safeguards. Open-weight releases reduce the provider’s ability to apply those controls after distribution. The measured lag does not guarantee that open systems will reach every closed-model capability on schedule; evaluations, training advances and release choices can move the distance in either direction.

CAISI found DeepSeek V4 Pro about eight months behind leading US models and called it the most capable Chinese AI model to date. The White House was also expected to extend its oversight framework to open models once they reached frontier capabilities. Officials still must define what crosses the line: a model’s weights, measured performance, missing safeguards, the user’s identity or the infrastructure connected to the model.

Access restrictions weaken as containment tools when comparable capability diffuses beyond a provider’s accounts. The government can respond by moving down the stack. US officials proposed global AI-chip export controls that would require Commerce approval for Nvidia and AMD shipments to each country. When an API key cannot contain the capability, the state reaches for the accelerator shipment that made it possible.

Controllability has become part of the product

Frontier labs once sold model quality as the primary distinction. Agent deployment has added sandbox design, credential scope, audit records, action approval and revocation. Microsoft’s control specification and OpenAI’s agent harness package those controls alongside capability. Their products must identify what the model can do, which actor can stop it, where that boundary sits and what record remains.

Federal procurement adds another control surface. Draft GSA guidance tightened civilian AI contract terms by requiring providers to allow any lawful government use of their models. National-security agencies separately considered rules intended to avoid reliance on one vendor. The government acts as a buyer rather than a licensor, but a sufficiently large buyer can turn contract eligibility into an operating requirement.

Providers that retain identity controls, logs, deployment boundaries and evaluation access can demonstrate conditional access more readily than providers that release weights without downstream control. That advantage creates dependence: the mechanisms that reassure enterprise buyers and security officials also give the executive branch a direct lever over the provider’s customers, deployments and markets.

The unwritten permit is the API key that still works after a 90-minute call, the procurement clause that survives review and the chip shipment Commerce allows to leave the dock.