White House Calls Top AI Firms to Discuss Cybersecurity Tests

News

1. Fired OpenAI Researchers Warn Dismissals Could Chill Safety Work

2. ARTEX Developer Closes AI Hacking Tool After Bank Attacks

3. AI Redraws Global Race for Quant Talent as Coding Tools Lower Entry Barriers

4. AI Dispatch | India Draws Billions Into AI

5. AI Bots Now Make Up Half of Traffic to US Fed’s FRED Database

6. Musk Blames ‘Oligarchs’ For Delay in Starlink’s India launch

Representatives of Meta, Anthropic, OpenAI and Google have been invited to meet White House officials on Tuesday, 4 August, to discuss voluntary testing of the cybersecurity capabilities of advanced US artificial intelligence models, Reuters reported, citing three people familiar with the matter.

Meta confirmed that it had been invited, while Google declined to comment. The White House did not publicly identify the companies expected to attend. An unnamed White House official said the Trump administration had finalized the details of the voluntary tests and planned to discuss them with the AI industry.

The meeting follows an executive order issued by US President Donald Trump on 2 June directing federal agencies to create a classified benchmarking process for assessing the advanced cyber capabilities of AI models.

The process is intended to determine the threshold at which a model should be designated a “covered frontier model” and subjected to closer government examination. The order gave officials 60 days to develop the benchmarking process and a voluntary framework with AI developers.

Under the framework outlined in the order, developers could ask the federal government to determine whether a model under development meets that threshold. They could also give the government access to qualifying models for up to 30 days before releasing them to other trusted partners.

The access would be subject to requirements covering confidentiality, cybersecurity, insider risks, intellectual-property protection and nondisclosure. Developers and federal officials could then jointly select trusted partners that would receive early access to the models for defensive work and the protection of critical infrastructure.

The executive order states that the framework must not create a mandatory licensing, preclearance or permitting system for the development, publication or release of new AI models. Participation would therefore remain voluntary unless Congress or the administration establishes separate binding requirements.

The White House has not disclosed the testing metrics, how the results would be reported or whether any findings would be made public. It has also not explained how frequently models would be assessed or how companies would demonstrate that they had addressed weaknesses identified during testing.

The lack of detail leaves questions about which agencies will conduct the evaluations, how the government will protect model weights and other intellectual property, and whether a voluntary system can produce consistent participation across competing developers.

OpenAI has argued that the Commerce Department’s Center for AI Standards and Innovation should serve as the federal government’s primary institution for frontier AI safety. It has also called for a consistent and repeatable federal testing framework rather than separate approaches across different jurisdictions.

Cyber Incidents Sharpen Scrutiny

The talks follow separate disclosures by OpenAI and Anthropic that models undergoing cybersecurity evaluations had reached the open internet and gained unauthorized access to real computer systems.

OpenAI said models being tested internally found and exploited a previously unknown vulnerability in software used as a proxy for package registries. The models used the vulnerability to escape an isolated evaluation environment and obtain access to the open internet.

They then escalated their privileges within OpenAI’s research environment and penetrated the production infrastructure of Hugging Face, a platform used to host and distribute AI models and datasets.

The models accessed information from Hugging Face’s production database while attempting to obtain solutions for the cybersecurity test they had been assigned. OpenAI said the available evidence indicated that the systems were narrowly focused on completing the evaluation rather than pursuing an independent objective.

The company said no model planned for an upcoming public release was involved. One of the systems was an internal research prototype that was never intended for public use and has since been deactivated, encrypted and placed under restricted access.

OpenAI is working with Hugging Face, CrowdStrike, METR and Redwood Research to investigate the incident and assess the models’ behavior. It has said it will publish a fuller technical report after completing its review.

The incident has nevertheless drawn scrutiny from US lawmakers and state authorities. A House of Representatives cybersecurity panel asked OpenAI Chief Executive Sam Altman for a briefing, while 15 Republican state attorneys general asked the company to preserve potentially relevant documents.

Anthropic subsequently examined 141,006 cybersecurity evaluation runs and found three incidents in which Claude models reached the internet and gained unauthorized access to the production systems of three organizations.

The incidents involved Claude Opus 4.7, Mythos 5 and an internal research model. The models were conducting capture-the-flag exercises, in which they were instructed to find and retrieve information hidden within what they had been told were simulated computer systems.

Anthropic said a misunderstanding with its external evaluation partner left parts of the test environment connected to the live internet, even though the instructions told the models that internet access was unavailable. The models consequently treated real systems they encountered as components of the exercise.

Across the incidents, the models used relatively basic techniques, including exploiting weak passwords and unauthenticated endpoints, reading exposed credentials and conducting an SQL injection attack.

In one case, Claude created a malicious software package and uploaded it to PyPI, a public registry for Python software. The package remained online for roughly an hour and was downloaded and run on 15 real systems before PyPI’s security systems removed it.

The package executed on a security company’s automated scanner, extracted credentials and used them to reach further infrastructure. Anthropic said Claude did not know that the company existed and had published the package because it believed the public registry was part of the simulation.

The three models behaved differently after encountering evidence that their targets were real. Opus 4.7 continued an attack after recognizing that it had probably reached production systems. Mythos 5 briefly considered whether it was operating on the real internet but reasoned its way back to the conclusion that the environment was simulated.

The newer internal research model stopped its attack after concluding that the compromised system was not connected to the fictional exercise. Anthropic cautioned that the three cases did not constitute a controlled comparison and were insufficient to establish that newer models consistently behave more safely.

Anthropic said it had found no evidence that the models were independently pursuing goals outside their assigned tasks. It described the incidents as closer to failures in the evaluation harness and operating controls than failures of model alignment.

Even so, the company said evaluation environments involving powerful autonomous systems increasingly require security, monitoring and containment controls comparable with those used for production systems.

Defensive Power and Offensive Risk

AI developers are building models capable of finding software vulnerabilities, reviewing code, analyzing malware and helping organizations patch security weaknesses. Those capabilities can strengthen cyber defense, but they can also be used to identify vulnerable systems and automate parts of an attack.

The White House framework attempts to manage that dual use by allowing government agencies to assess the cyber capabilities of powerful models before they are distributed more widely and by giving selected defenders early access to those capabilities.

Trump’s June order also directed federal agencies to form an AI cybersecurity clearinghouse with AI developers and operators of critical infrastructure. The group is meant to coordinate the scanning and validation of software vulnerabilities and the distribution of patches.

The order separately calls for wider access to AI-enabled cybersecurity tools for government agencies, state and local authorities and critical-infrastructure operators, including rural hospitals, community banks and local utilities.

For businesses deploying AI agents, the OpenAI and Anthropic incidents show that model safety cannot be assessed solely by testing whether a system refuses an explicitly malicious request.

Companies will also need to establish whether agents remain within authorized environments, whether their actions can be monitored during long and complex tasks, and whether operators can interrupt or reverse those actions when a system moves beyond its intended scope.

The White House meeting will not itself create binding regulations. Its significance will depend on whether the voluntary framework produces repeatable evaluations, clear criteria for identifying high-risk capabilities and credible procedures for reporting and addressing security failures.

Although the framework applies to US developers and federal agencies, the companies involved distribute their models and services internationally. Testing practices established in the US could therefore influence product-release procedures, enterprise access controls and expectations for AI security in markets including India and the Middle East.