The Secret Rules Taking Shape Around Frontier AI

A Secret Frontier Review

Some of the most powerful closed AI models could soon spend up to 30 days under government examination before release. The rules deciding which models enter that room are themselves secret.

That gap between sensitive testing and public accountability is why this development deserves some time. Axios reported on August 4 that the White House had briefed AI companies on a voluntary framework for government review of certain closed-source frontier models. The framework hasn’t been published, so its operational details come from unnamed people familiar with confidential meetings.

Under the reported process, covered models could be tested for as long as 30 days inside high-security environments. Access would be closely controlled and recorded through detailed logs. The focus is advanced cyber capability and national-security risk: the sort of testing where publishing the exact methods could reveal useful information to attackers.

There is a sound security argument for keeping those benchmarks classified. If a test is meant to determine whether a model can discover or exploit serious vulnerabilities, openly documenting the procedure could expose the targets, techniques or thresholds being protected. Executive Order 14409 already says the benchmarking process for advanced cyber capabilities will be classified.

The harder problem is everything around those tests. Axios says the framework applies to closed-source models with state-of-the-art capabilities and national-security risks, yet neither term has a clearly reported threshold. Companies don’t know from a public rule exactly when a model becomes eligible. Researchers and civil society can’t assess whether comparable systems receive comparable scrutiny. And because participation is voluntary, there’s still a question about what happens when a developer declines.

Open models are reportedly excluded. That creates two oversight paths based partly on how a model is distributed rather than solely on what it can do. There may be practical reasons for that distinction: a government review involving privileged access is easier to arrange with a lab that controls its weights and release. But an open model can also carry serious capabilities, and once its weights are released, containment becomes much harder. Exclusion from this process doesn’t make the underlying risk disappear.

For frontier labs, the practical effect begins well before any government test. Release plans may need room for a possible month-long review, secure government access, extensive logging and staff who can respond to findings without compromising model or customer information. Those controls can’t be improvised a few days before launch.

My read is that confidential testing can be legitimate without making the entire oversight system opaque. Sensitive benchmarks can stay protected while eligibility rules, review stages, broad outcome categories and the consequences of a failed assessment are described publicly. Right now, the reported framework gives us the secure room but not the rules for entering it.

That leaves a delicate trade-off. Publish too much and officials may weaken the cyber tests they are trying to protect. Publish too little and the public has no reliable way to judge whether the strongest models are receiving consistent scrutiny, whether companies are being treated evenly, or whether the process is strong enough to change a risky release. Until the framework itself appears, those remain open questions rather than settled safeguards.

Texas Counts the Load

Leave Washington’s closed-door review there for now, because Texas is putting a more physical constraint on AI deployment.

Governor Greg Abbott directed the state utility regulator and grid operator to conduct comprehensive audits of proposed data-centre projects. The review reaches beyond a facility’s headline electricity requirement. Officials are seeking details on on-site and off-site power demand, water consumption, noise, lighting, tax incentives, ownership and effects on surrounding communities.

The scale behind that order is striking. ERCOT, the operator of most of the Texas grid, is tracking 474 gigawatts of new connection requests. It attributes roughly 90 per cent of that queue to data centres. The total is more than five times ERCOT’s peak demand.

That doesn’t mean Texas is about to build 474 gigawatts of data centres. Connection queues routinely contain speculative projects, duplicate possibilities and developments that never secure finance, land, equipment or power. The audit is partly an attempt to distinguish credible demand from proposals occupying space in the planning system.

Even after that discount, electricity is becoming a direct scheduling constraint for AI infrastructure. A developer can secure accelerators, design a facility and negotiate a cloud customer, then discover that transmission capacity, generation or local water supply determines whether the project starts on time. Texas now wants much more evidence before accepting the claimed benefits and costs.

For infrastructure developers, vague growth projections become less useful under that scrutiny. Credible projects need defensible estimates of power and water use, a clear ownership structure, and an account of what nearby communities receive in exchange for noise, lighting, resource pressure and public incentives.

The order doesn’t yet establish permanent restrictions, new fees or a uniform limit on data-centre construction. Project-specific conditions are also possible. My read is that the important shift has already happened: chip access is no longer the only scarce input governing the AI build-out. Grid capacity and local consent can now decide which ambitious compute plans become real.

Sharing AI Incidents

The next security question is less visible but just as practical: what happens after an AI system fails in the field?

The Linux Foundation has published a request for comments on the Shared AI Findings Exchange, known as SAFE. It’s a proposed framework for confidentially reporting and analysing AI security incidents and near misses. The idea is to let organisations learn from failures that would otherwise remain isolated inside individual companies.

The draft calls for timely notification of affected organisations, blame-free analysis and independent governance. Its scope extends beyond the model itself to tools, runtimes, safeguards, monitoring and human operations. That breadth is useful because agent failures rarely belong to one component. A model may make a poor decision, but excessive permissions, a weak approval boundary or missing monitoring can turn the decision into an incident.

Initial contributors include Cisco, CrowdStrike, Hugging Face, Nvidia and Red Hat. Nvidia says the wider Open Secure AI Alliance has grown beyond 120 member organisations. Those names give the proposal technical reach across security, infrastructure and open-source AI.

SAFE is still only a draft. It isn’t an adopted standard, a regulator or an operational clearinghouse, and organisations can’t treat it as a substitute for formal reporting obligations. The governance model, legal and disclosure protections, participation rules and implementation schedule are all unsettled.

Participation will determine whether this becomes genuinely useful. A neutral exchange could reveal recurring failure patterns across different agent stacks: unsafe tool use, prompt-injection paths, ineffective guardrails or human approvals that routinely arrive too late. Shared evidence could then support better tests and defences before the same weakness appears somewhere else.

The challenge is persuading organisations with the most consequential systems to contribute candidly. Security teams need confidence that disclosure won’t expose customers, create an uncontrolled legal risk or turn a learning exercise into public blame. Independent governance also has to be real, not merely a label attached to an industry forum.

For AI deployers, the opportunity is to shape those protections while the design is open. My assessment is that a credible incident exchange could become more valuable than another static checklist, because it would draw on actual failures. Without broad participation from frontier labs and strong confidentiality rules, though, it risks becoming a thoughtful catalogue with the most important incidents missing.

Security Agents in Preview

There’s also a more immediate attempt to make security operations move at machine speed.

Microsoft has opened Project Perception in worldwide public preview. The system combines red-team, blue-team and remediation agents that share security context across a multi-model architecture. In simple terms, one group of agents looks for possible attack paths, another investigates the risk, and remediation agents translate validated findings into corrective actions.

The initial scenario is software-vulnerability management. Microsoft is using its MAI-Cyber-1-Flash model inside an agent team called MDASH. The company says that configuration scored 96 per cent on CyberGym and cost almost 50 per cent less than its previous production configuration.

Those figures come from Microsoft’s own benchmark testing. They aren’t independent evidence of performance across varied production networks, and Microsoft hasn’t provided comparable public data on false positives, operational costs or effectiveness in different environments. A strong benchmark result tells us the approach is worth examining, not that it is ready to control every remediation workflow.

The interesting step is the movement from generating alerts towards investigating and acting on them. Security teams already struggle with more findings than people can comfortably process. An agent system that traces an attack path, preserves the relevant context and proposes a specific correction could shorten the distance between detection and repair.

That same chain concentrates risk. A false conclusion from one agent can pass into another agent’s action plan. Broad permissions can turn a mistaken remediation into downtime or a new security weakness. Shared context can improve decisions, but it also creates a valuable pool of sensitive information inside a complex vendor-controlled stack.

Microsoft says humans retain control. Organisations evaluating the preview still need to define what that control means at each stage: which systems the agents can inspect, which changes require approval, how actions are logged, and how an incorrect fix is reversed. A nominal approval button offers little protection if the reviewer can’t understand the evidence behind the recommendation.

For security leaders, the preview is a chance to test defensive autonomy in bounded environments. My read is that permissions and rollback quality deserve as much attention as detection accuracy. If those controls are weak, faster remediation simply means mistakes can travel faster too.

Location Leaks Through SDKs

A much more familiar software pattern is creating a privacy risk on Android, and no sophisticated exploit is required.

The Electronic Frontier Foundation investigated four advertising software development kits whose documented defaults allow location collection and sharing whenever the host app has location permission. Developers may add one of these SDKs for advertising functions without fully understanding that the library can inherit access to a user’s precise location.

Android grants permissions to the application as a whole. It doesn’t provide a separate location permission for every embedded SDK. Once a user allows an app to access location, third-party code running inside that app may receive the same capability. The permission prompt names the app the user installed, not each advertising service operating within it.

In network testing, the EFF found precise coordinates being transmitted from two apps with a combined 60 million downloads. That is evidence of the mechanism operating at meaningful scale, but it doesn’t tell us the total number of affected apps or how far the collected information travels through advertising and data-broker systems.

One provider, BidMachine, corrected its documentation after the EFF pointed out discrepancies. The EFF says the default collection behaviour itself didn’t change. That distinction is important. Clearer documentation can help developers understand a risk, but it doesn’t protect users whose applications continue to transmit location under the same default.

The four SDKs aren’t described as the most prevalent advertising libraries in the Android ecosystem. It would be a mistake to turn this investigation into a claim that every ad-supported Android app is leaking precise coordinates. What the work demonstrates is a supply-chain weakness: permissions granted for the app’s apparent function can be reused by embedded code with a different commercial purpose.

Developers using advertising libraries have an engineering problem, not merely a paperwork problem. The useful review covers SDK defaults, network behaviour, consent language and whether location access is genuinely necessary for the product. Depending only on an integration guide leaves the most consequential behaviour in somebody else’s hands.

For users, the uncomfortable limit is that Android’s permission model doesn’t expose this relationship clearly. Granting location access to a weather, transport or local-service app may also make the information available to its embedded advertising systems.

My view is that third-party SDKs deserve the same privacy scrutiny as first-party application code. A permissive default buried in a dependency can cause just as much harm as a deliberate design choice, while being much easier for the development team to overlook.

Anthropic’s Reported Cloud Bet

The appetite behind those data-centre queues becomes easier to grasp when a single reported agreement reaches ten figures.

Bloomberg and TechCrunch report that Anthropic has agreed to purchase about 10 billion US dollars of computing capacity from the young AI cloud provider Volta over six years. The project is reportedly tied to a 133-megawatt facility in Norway being developed with the crypto-mining company Bitdeer, with systems planned around Nvidia’s Vera Rubin hardware.

Neither Anthropic nor Volta had publicly confirmed the reported value, duration or capacity details when TechCrunch published. The accounts rely on unnamed sources, so the numbers are best treated as a reported commitment rather than a settled public contract.

If completed on those terms, the deal would do two things at once. Anthropic would reserve a large block of long-term power and accelerator capacity, reducing its dependence on whatever compute happens to be available later. Volta would gain a major anchor customer for an enormous infrastructure build.

That structure shows why frontier-model competition increasingly involves multi-year commitments to land, power, cooling and hardware delivery. Labs aren’t only buying compute for the workloads they have now; they’re trying to secure capacity for models and demand that may arrive years into the agreement.

For organisations watching the cloud market, the headline value is less useful than the commitment period and physical capacity behind it. My read is that long contracts may protect frontier labs from future scarcity, while making forecasting errors far more expensive. Until the parties confirm this one, the scale is notable but not settled.

Minnesota’s Ban Takes Effect

Regulation is already landing more directly on services that generate non-consensual intimate imagery.

On July 31, a US federal judge denied xAI’s request for a temporary restraining order against Minnesota’s ban on services that generate non-consensual nudified images. The decision allowed the law to take effect on August 1 while xAI’s wider constitutional challenge continues.

The judge focused partly on timing. Minnesota signed the law nearly three months earlier, but xAI waited until July 29, just three days before commencement, to seek emergency relief. The court found that delay weakened the company’s argument that immediate intervention was necessary to prevent irreparable harm.

This was not a final ruling on whether the law is constitutional. It also didn’t resolve xAI’s pending request for a preliminary injunction. Further filings are scheduled for August 12 and August 17, followed by a preliminary-injunction hearing on August 19. Enforcement could still change after that hearing or through later appeals.

For now, services operating in Minnesota have to account for the ban. A pending challenge doesn’t suspend the practical obligation created by the court’s refusal to grant emergency relief.

The legal boundary remains difficult. Courts will still need to examine how the prohibition interacts with protected expression and whether its terms are appropriately drawn. But platforms face an immediate product and safety question regardless of the eventual constitutional result: whether they have effective controls against generating intimate imagery without consent.

My assessment is that the short-term cost falls most heavily on services that treated those safeguards as optional until legislation arrived. The court hasn’t settled the larger speech dispute, but it has removed the assumption that a late emergency filing would preserve the previous operating conditions.

What Changes for You

For people building AI products, one release offers a concrete new option for keeping moderation closer to home.

Mistral has released Shieldstral, a three-billion-parameter, open-weights classifier that evaluates text and images against a safety policy supplied in plain language at inference time. It can score prompts, responses, images and combined text-image inputs. The weights are available under the Apache 2.0 licence.

The adaptable policy is the useful part. A developer can change the moderation question or policy without retraining the classifier. That makes it possible to express rules suited to a particular product, community or risk level rather than fitting every case into a fixed set of hosted moderation categories.

Mistral says the model can run on a single GPU with 16 gigabytes of memory. For teams with the necessary infrastructure and skills, self-hosting keeps prompts, responses and images from being sent to a separate moderation provider. It can also reduce dependence on a hosted service’s policy choices and availability.

There are important limits. Shieldstral is newly released, and its performance comparisons come from Mistral rather than independent evaluators. The company identifies multilingual coverage and robustness on long documents as areas needing further work. There is not yet broad external evidence across specialised domains, adversarial inputs or languages.

A continuous safety score also needs a decision process around it. Different thresholds produce different trade-offs between blocking legitimate content and allowing harmful material. High-risk cases still benefit from domain-specific testing, monitoring and a path to human review.

So what becomes different now is control: working AI builders have a compact, downloadable multimodal guardrail whose policy can change without a training run. My read is that this lowers the friction of testing product-specific moderation, but it doesn’t lower the standard of evidence needed before trusting that moderation in production.