Why Washington wants a 30-day look at frontier AI before it ships, and is backing a voluntary approach

Since April 2026, AI labs have begun keeping their most powerful models behind vetted-access programs. Anthropic limited its Claude Mythos system and OpenAI its GPT-5.5-Cyber to approved security partners, each billed as able to spot and exploit software flaws with unprecedented precision. Also in April, OpenAI announced its GPT-Rosalind life-sciences model, gating it over biosecurity concerns.

The first month of testing showed what that meant. Inside Project Glasswing, the restricted program Anthropic built around Mythos, Mozilla fixed 271 vulnerabilities in Firefox 150 with the model, more than ten times what an earlier version of Claude had surfaced. Meanwhile, Cloudflare turned up 2,000 bugs, 400 of them high or critical, at a false-positive rate its team rated better than human testers. Across roughly 50 partners including Microsoft, Apple and Google, Mythos flagged more than 10,000 critical or high-severity zero-days, finding and chaining unknown flaws across every major operating system and browser and writing working exploits on its own.

The recent launch of more powerful models rattled Washington, ultimately informing two AI directives President Trump signed this week. The June 2 order says advanced AI capabilities “make our Nation stronger, but also introduce new national security considerations” that require coordinated action across agencies. The White House also unveiled a national-security memorandum opens by calling AI “among the most transformative technologies to national security in the history of the United States.”

Simon Mattias Koser, co-founder and chief product officer of the AI startup Tzafon, views the first half of 2026 as the inflection point in artificial intelligence. “Since Mythos, I think that was really a wake-up call for the wider industries beyond AI,” he said. The same capability in an adversary’s hands, ahead of defenders, is the scenario the directives are built against. Imagine a system weaponizing flaws in the software behind power grids, banks and hospitals faster than anyone can patch them. “We’re in this very malleable window of time now, where the policies, the things that end up being put in place now, will have huge downstream effects.”

The same order asks developers to give the government access to a covered model for “up to 30 days before they plan to release such models to other trusted partners,” down from 90, and describes the review as a “voluntary framework.”

The open-weight pressure from China

Trump is simultaneously trying to keep American labs close to Washington without slowing them down at a moment when open-weight rivals are moving fast. In a span of roughly three weeks in April, Google introduced Gemma 4, Alibaba’s Qwen team released Qwen3.6-27B as open weights, and DeepSeek released V4, a 1-million-token open-source model family. DeepSeek then made the 75% discount on V4-Pro permanent, taking it to about $0.44 per million input tokens and $0.87 per million output tokens, down from $1.74 and $3.48, against $5.00 and $30.00 for OpenAI’s flagship GPT-5.5.

Washington has spent the past year trying to wall those Chinese systems off from sensitive networks. A bipartisan No Adversarial AI Act would bar models tied to foreign adversaries, DeepSeek among them, from federal agencies; the Commerce Department and the Navy have already blocked DeepSeek on government-issued devices, and New York, Texas and other states have restricted it as well. The June 2 order works on a different axis. Its trigger is cyber capability, measured by a classified benchmark, and it leaves “covered frontier model” for the administration to define. The cheap open-weight tier, and the wave of small, task-specific models Koser expects to follow it into healthcare, finance and other niches, sit below that line for now.

“A small model can’t really independently conduct cybersecurity work and find vulnerabilities and security issues today,” Koser said. “So if that changes, obviously the smaller models will also be encompassed, but that’s not really the world we live in today.”

A shrinking review window

The major frontier labs have ramped up their launch cadence, launching new model iterations every couple of months, down from roughly twice a year in prior years. One tracker clocked the median gap between a leading lab’s frontier releases at 49 days so far in 2026. In 2023, it pegged the fiture at about 170.

For Koser, that pace is the argument for the kind of review the June 2 order sets up. “That’s why we need these voluntary agreements: to make sure you can at least measure what’s happening, measure progress, measure the risk,” he said. “If the industry holds onto its ‘move fast and break things’ mindset, I think we’re going to be in a less good position than if we embrace AI safety more.”

Whether to slow down is feasible

Frontier AI labs themselves have at times seemed to recommend tapping the brakes even as launch cadence has reached a rapid clip. On June 4, Anthropic published a proposal urging top labs to consider a coordinated pause. The announcement warned that recursive self-improvement appeared to be a real possibility in the relatively near future. At that point, systems could begin designing their own successors and model development could skyrocket in speed.

Calls to slow the field down predate this week: the Future of Life Institute’s 2023 open letter, signed by Elon Musk and more than 30,000 others, urged labs to halt training of systems more powerful than GPT-4 for at least six months, and demonstrators gathered outside Anthropic, OpenAI and xAI in March calling for a pause. The pressure has reached the courts, too. On June 1, the day before Trump signed the first order, Florida became the first state to sue OpenAI and CEO Sam Altman. The suite accuses them of marketing ChatGPT as safe while concealing its risks to minors and seeking to hold Altman personally liable.

Despite the calls for a time out in development, such a coordinated freeze remains difficult, Koser said. “I don’t think we’re necessarily in a position where you can say we’re just going to pause this,” he said. The exception, he added, is a system that can improve itself recursively, “an entirely different class of risk, and that maybe requires its own approach of: let’s not build it until we know it’s safe.”

Whether or not anyone pauses, Koser suspects the work of watching frontier AI will come to resemble the apparatus built around an older technology. Asked whether Washington can monitor a rival’s model training the way it tracks nuclear programs, where mining and enrichment leave a visible trail, he said the comparison may be more apt than it sounds. The largest systems now require data centers that are hard to hide and power draws that can run to a gigawatt or more. “You track where the uranium is being enriched, but also where the data centers are being built,” he said. “There would be very visible artifacts in the world. That’s a very strange reality. This is not where we were a few years ago.”

Koser concluded: “Nuclear power can be used for good, but it can also be used for weapons of mass destruction, and so maybe you don’t want everyone to have access to knowledge about creating those things.”