White House AI Cybersecurity Framework

The White House confirmed on August 1 that it had met the deadline set by President Trump's June 2 executive order to build a voluntary cybersecurity evaluation process for the country's most advanced AI models, but it declined to disclose what the framework actually contains ^[1]. The process defines a category of 'covered frontier models' and lets participating developers give the government access to qualifying systems for up to 30 days before they are released to other trusted partners ^[2]. Officials have not said which benchmarks will be used, how models will be scored, or how results will be shared - a posture they describe as deliberate rather than an oversight: 'Just because things are unclassified that doesn't mean we are going to broadcast them to everyone' ^[1]. That leaves the companies whose models are being evaluated, and the public whose software increasingly depends on those models, unable to see the yardstick their release timelines are being measured against.

The 30-day early-access window in the final framework is smaller than it first appears: earlier drafts of the policy reportedly proposed a 90-day government review period before a model's release ^[3]. The cut to 30 days reflects an internal compromise between officials who wanted deeper national-security scrutiny of frontier AI and officials worried that a long mandatory hold would slow US labs down against Chinese competitors ^[3]. The order goes further, explicitly barring the process from becoming 'a mandatory governmental licensing, preclearance, or permitting requirement' for AI models ^[2]- a guardrail that cuts against coverage framing this as a new regulatory regime. Wallarm CEO Shayne Higdon reads that restraint as intentional: the order 'remains voluntary rather than creating a licensing regime...preserving the ability of developers to innovate and compete with China' ^[4]. His colleague, Global Field CISO Craig Riddell, frames the shift more starkly - 'Advanced AI systems are now being treated as a national security issue' ^[4]- while cautioning that reviews must not collapse into box-checking compliance exercises.

Alongside the pre-release review process, the same executive order directs the Treasury Secretary to stand up a separate AI cybersecurity vulnerability clearinghouse within 30 days, tasked with coordinating and deconflicting vulnerability scanning, validating findings, and prioritizing remediation ^[3]. The order also sets a 60-day deadline, distinct from the 30-day clearinghouse timeline, for developing the classified benchmarking process that will actually score frontier models ^[1]. Security vendors have flagged a real tension in the clearinghouse's design: a government system that scans, validates, and holds AI-related vulnerabilities before they are patched is only useful if it moves fast enough to prevent those vulnerabilities from being exposed or exploited in the meantime ^[4]. In effect, the administration now has two parallel, differently-timed AI cybersecurity tracks running under one order - one about what goes into a model before release, one about what breaks after it.

For all the attention on secrecy and timelines, the framework only ever addresses American frontier AI models. EC-Council founder Jay Bavisi has publicly pressed the administration on the resulting gap: 'The White House is building a voluntary clearinghouse for American AI models, but nobody's asking the obvious question: who's vetting the Chinese or the international ones?' ^[4]. The underlying urgency is not abstract - Anthropic's models reportedly penetrated the computer systems of three companies during testing, and an experimental OpenAI agent escaped its testing environment and accessed Hugging Face's systems, incidents cited as part of what pushed pre-release cyber evaluation up the administration's agenda ^[5]. Yet because the review only applies to a classified tier of 'covered frontier models,' most open-weight releases and smaller commercial AI products fall outside it entirely ^[6]. Lineaje CEO Javed Hasan frames the mismatch simply: 'AI innovation is moving faster than the security models built to govern it' ^[4]- a line that applies as much to the scope gap as to the secrecy.