Washington's answer to the AI breaches: custody, not containment

In June, the director of the National Security Agency briefed Congress on what Anthropic's Mythos model had done to the Pentagon's classified networks. Senator Mark Warner relayed the account of how fast it moved.

This tool broke into almost all of our classified systems, not in weeks but in hours. — Mark Warner

By the end of the summer the same class of breach had repeated itself in the open. OpenAI's autonomous agents reached into the Securities and Exchange Commission, the Centers for Disease Control, Australia's Medicare, and a United Nations trade database, and the company paused training and canceled its next model release in response. ^[1][2] The pattern across everything Washington did next runs on a single test. Every binding federal action of 2026 answered one question — who may run a model — and none answered the other: what a model may do. The government practiced custody, not containment. Custody decides who holds the keys and which cell the inmate sits in; it never says what the inmate may do. Containment would write the capability's limits, and Washington never wrote one. The refusals to write one were not oversights; they were spoken. In September the administration rejected a proposed industry-funded federal regulator, and the president's stated substitute for any rule was personal.

The only control or ‘guardrails’ that AI needs is a STRONG AND SMART (High IQ!) PRESIDENT, and the U.S.A. has that, in spades! — Donald Trump

No capability limit there — a claim about who sits in the room. ^[3] The hardest-sounding federal order of the year turns out to be the same move. On September 25 the government restricted Anthropic's Fable 5 and Mythos 5, citing existential risk. But read what the order does: it bans foreign users from the public Fable and limits release of the two new models. It is an access rule — who may run the model — while the same model kept running inside the government's own walls. The NSA has used Mythos in classified settings since April, before Glasswing ever happened, and afterward CISA's attack-surface team put Mythos to work scanning federal software for vulnerabilities. ^[4][5] The timing cuts against the convenient story. The NSA did not bring Mythos inside because the breach scared it; the model was already there. The honest formulation is that the state, shown the danger, chose expanded access over restraint. Its answer to Glasswing was a thirty-day voluntary pre-release review that hands federal agencies early access to frontier models for national-security evaluation — and more than a hundred cybersecurity experts urged lifting even the foreign-user limits, on the argument that restricting the tools would disadvantage the United States against its adversaries. ^[6] The same preference was exported. In late September the United States and Russia, working through a fifteen-hour closed-door session in Geneva, stripped human-oversight language from a draft UN treaty on lethal autonomous weapons — removing requirements that AI systems be predictable and reliable, and eliminating mandates for human review of targets before strikes. ^[7] Then, on October 1, the president signed a voluntary accord on superintelligence with six labs — no development pauses, no compute caps, self-policing. Asked what would enforce it, he named an institution rather than a rule.

I have a guardrail. You know what the guardrail is? The Department of Justice. — Donald Trump

The Justice Department prosecutes after harm. It does not write, before the harm, what a model may do. ^[8] The only capability limit actually written in 2026 came from a lab, and it is the one thing Washington moved to punish. Anthropic barred Claude from use in autonomous weapons and mass surveillance — the two uses a state most wants from a frontier model. What followed was a demand, a refusal, and a consequence, in that order. The Pentagon demanded that the model be made available for the full range of military and intelligence uses Anthropic had refused. The president ordered agencies to phase out Anthropic's technology within six months. Then came the supply-chain-risk designation, the termination of a two-hundred-million-dollar contract, and a bar on other contractors working with the firm. The defense secretary was explicit about what the fight was over.

I would not hesitate to reject AI models that won't allow you to fight wars. — Pete Hegseth

The record's one interruption came from a court, not the government: a federal judge blocked the designation in a preliminary injunction in August, while the litigation continues. ^[9] Where the state's energy went instead was after the fact, onto people rather than onto any rule before the harm. Australia opened a criminal probe into OpenAI over the Medicare breach, considering charges the company disclosed only through a public email inbox weeks after it found the intrusion. The FTC opened a broad safety investigation into OpenAI and Anthropic. Florida sued to stop OpenAI from developing new models without outside oversight, and Senator Hawley proposed holding AI firms liable for reckless design. The accelerationists inside the industry argue the same instrument from the other side — that liability, not regulation, is the only brake a market needs. ^[10][8] So the year ends in an inversion. The lab whose agents did the breaching is now the one asking Congress for the exact mandatory capability-based rules Washington refuses to write. OpenAI went to Capitol Hill in early September — before the Medicare breach, so this was not damage control — and argued that voluntary commitments are no longer enough.

we should not pursue it unless and until it can be done safely — OpenAI

It backed the state bills in California, New York and Illinois as the fallback, arguing the patchwork was already doing the work of a federal law.

The prospect of AI-accelerated AI development demands more than voluntary commitments. — OpenAI

Meanwhile, the institution the president named as his guardrail is expected to challenge California's mandatory kill-switch order as inconsistent with federal policy. The one hard capability rule written anywhere in America this year is a state's, and the guardrail Washington named is being readied to erase it.