The White House was set to sign an executive order on Thursday that would have created a formal process for the government to review powerful AI models before they reach the public. Trump delayed it, citing concerns about language that he felt could slow American AI development. The informal version of events: not enough tech executives made it to Washington in time for the signing ceremony.
The order came out of a genuine security problem. Anthropic's Mythos model, kept under tight restrictions by the company itself, demonstrated the ability to find and exploit software vulnerabilities at a scale and speed that alarmed the security community. Mozilla used it to find 271 vulnerabilities in Firefox. OpenAI's GPT-5.5 Cyber reached a comparable level of capability and, unlike Mythos, was made broadly available. The UK's AI Security Institute confirmed that both models represent a meaningful step up from anything that came before.
To put it plainly: these are tools that can scan software systems for weaknesses the way a human expert would, but thousands of times faster. Used defensively, they help companies fix problems before attackers find them. Used offensively, they hand criminal groups and hostile governments a significant advantage.
The draft order tried to thread a difficult needle. It proposed a voluntary arrangement, not a legal requirement, under which AI companies would share their most advanced models with the government between 14 and 90 days before launch. Banks, energy companies, telecoms, and large healthcare networks would have received early access too, specifically so they could stress-test their own defenses before the models reached the open market. The cybersecurity section also proposed a joint clearinghouse involving the Treasury Department and AI companies to identify risks in unreleased models.
The gap between 14 days and 90 days reveals the core tension. Tech-industry advisers saw even voluntary pre-release sharing as a competitive disadvantage and pushed for the shortest possible window. Voices from within the broader political base pushed for mandatory government review with teeth. The result was a compromise that satisfied no one fully, and the order did not get signed.
This matters beyond Washington politics. The administration had already struck informal agreements with Google DeepMind, Microsoft, xAI, Anthropic, and OpenAI for pre-deployment evaluations through the Commerce Department's standards body. Those agreements exist, but they carry no formal weight and have no defined timeline.
For any organisation that depends on digital systems, the practical situation is this: AI that can find security gaps at machine speed is already out in the world. The government review process that was meant to give defenders a head start has been paused. The delay is temporary, but the order will come back with revised language, and when it does, businesses in critical sectors including finance, healthcare, energy, and logistics should expect to be part of the early-access framework.
Companies in those sectors should not wait for the order to be signed before reviewing their own exposure. The models exist now. The question is whether your systems have been tested against what they can do.