Nextgov/FCW - All Content

White House unveils billions in investments for Genesis Mission

Edward Graham — Thu, 08 Oct 2026 18:34:00 -0400

The Trump administration on Thursday announced billions in investments from the federal government to help advance U.S. scientific research and development, with almost a dozen leading tech companies also committing to provide cloud and software credits to help the White House follow through on its Genesis Mission initiative.

The announcements came at the White House’s AI Science Summit, which the administration billed as a $6 billion push to drive the next era of U.S.-led scientific and technological innovation and to further expand the effort across the government. The event evolved out of a White House Office of Science and Technology Policy report released in July that detailed ways of ushering in “the Golden Age of American Innovation.”

Eleven tech giants pledged to provide $2.4 billion in compute credits for the Genesis Mission Consortium, which the White House said will be used to support “over 15 Federal agencies working towards National Science & Technology Challenges.”

The industry commitments included $1 billion from Nvidia, $500 million from AMD and $200 million from OpenAI. Anthropic and Google each pledged $150 million, while AMP and Emerald AI each committed $100 million. Amazon Web Services, Armada, Crusoe and Micron each committed $50 million.

"American scientists are on the cusp of breakthroughs that will define the next century — from accelerating biomedical research and improving health outcomes, to AI-driven drug discovery — but they need computing power at scale," David Appel, interim vice president of Worldwide Public Sector at AWS, said in a statement.

Federal agencies also unveiled a host of new funding opportunities, programs and partnerships to further drive scientific discovery.

The Pentagon announced a series of steps to align with the White House effort, including establishing an enterprisewide framework to measure and enhance the effectiveness of its laboratories and research centers. The department similarly announced up to $350 million for quantum computing initiatives to strengthen use of the advanced capabilities for national security purposes.

"President [Donald] Trump has made it clear that technological dominance requires us to move faster, safeguard our research, and build right here in America," Emil Michael, undersecretary of Defense for research and engineering, said in a statement. "We are answering that call by dismantling barriers to commercialization, modernizing our labs, and ruthlessly securing taxpayer-funded research from foreign exploitation.”

The same day, the Energy Department announced $159 million in new phase II Genesis Mission project awards, $96 million for early-career researchers and a new graduate fellowship program, along with an effort to advance the development of fault-tolerant quantum computers.

Trump also used Thursday’s summit as an opportunity to award the National Medal of Technology and Innovation and the National Medal of Science to six leading tech executives. One of the award recipients was SpaceX CEO Elon Musk, who helmed the cost-cutting Department of Government Efficiency at the start of Trump's second term.

]]>

Energy debuts new Genesis Mission, quantum computing initiatives

Edward Graham — Thu, 08 Oct 2026 16:43:00 -0400

The Energy Department on Thursday unveiled new funding and training opportunities tied to the Genesis Mission — the Trump administration’s push to use artificial intelligence and advanced computing capabilities to accelerate the nation’s scientific research and technological innovation — as well as a new effort designed to further the nation’s quantum computing development.

The announcements were made as part of the White House’s AI Science Summit, which the administration billed as an opportunity to push a whole-of-nation approach to leading-edge scientific research and development.

As part of the event, Energy announced the launch of a Genesis Mission Graduate Fellowship Pilot — an effort to accelerate American students’ pursuits of doctorates with competency in both AI and other relevant scientific and engineering disciplines. The department said the program, which has up to $100 million in total funding, will include “two high-impact, hands-on research experiences, one at a DOE National Laboratory/User Facility and another with industry.”

Energy’s Office of Science also unveiled the selection of 67 early-career scientists to receive a combined $96 million through its 2026 Early Career Research Program, which is designed to help fund innovative research projects. The department said the awardees represent 39 universities, 11 national laboratories and Office of Science User Facilities, and 26 states.

Additionally, Energy announced its latest batch of Genesis Mission awards, with 12 phase II projects receiving a total of $159 million. The department offers project funding through two sequential tiers, with phase I awards used for proof-of-concept purposes and phase II funding being used to actualize concepts. Thursday’s announcement raises the total number of phase II projects to 14.

In a press call ahead of the announcements, Energy’s Undersecretary for Science Darío Gil said the number of overall Genesis Mission projects that have received funding demonstrates the rapid progress that has already been made to carry out the Genesis Mission’s goals.

“With this set of awards, we've completed the first construction of the portfolio for the launch of the Genesis Mission,” Gil said. “So that portfolio that has been constructed now over many months has 297 teams across all 50 states as the inaugural cohort of the Genesis Mission effort.”

Energy also announced on Thursday the release of Quantum Genesis Priority Applications, which it said are “a set of eight key scientific utility problems” to help guide U.S. development of the world’s first fault-tolerant, scientifically relevant quantum computer. The effort builds on the department’s launch of the Quantum Genesis initiative in June to deploy such an advanced computer for scientific research by 2028.

“These Priority Applications, along with the other elements of Quantum Genesis, will bring domain scientists from across disciplines into direct partnership with quantum researchers,” Energy said in a release. “Together, they will integrate quantum computing into real-world scientific workflows and benchmark performance against today’s most advanced supercomputing methods.”

The department similarly launched a Quantum Genesis Q Competition last month offering up to $215 million in total planned funding to U.S. companies that submit proposals on ways “to deploy quantum computers with at least 100 logical qubits that are capable of performing hundreds of millions fault-tolerant operations and scientific demonstration programs.”

]]>

Watchdog to examine summertime hack of DHS information network, other incidents

David DiMolfetta — Thu, 08 Oct 2026 15:50:00 -0400

A forthcoming audit of a key Department of Homeland Security information-sharing network will examine three known security incidents that occurred on agency networks, including an intrusion by outside hackers that Nextgov/FCW first reported this summer, according to two people with knowledge of the matter.

The review concerns the Homeland Security Information Network, or HSIN, which allows government agencies, law enforcement and other approved partners to exchange sensitive but unclassified information. Its users rely on the platform to share threat reporting, coordinate security for major events and respond to emergencies.

The Government Accountability Office review is expected to document the incidents that occurred between 2023 and 2026 and potentially scrutinize DHS for failing to promptly notify Congress about those security problems, the first person said.

The audit is being conducted in response to a directive in the fiscal 2025 defense policy package, the second person said. Both people spoke on the condition of anonymity to discuss details of the review. It’s not clear when the final report will be released.

The previously unreported scope of the audit places this summer’s intrusion within a longer history of security problems on the platform. It also raises questions about whether DHS has given Congress and HSIN stakeholder organizations enough detail to understand what may have been exposed.

GAO has identified two incidents stemming from employee and contractor errors, while the most recent involved a malicious actor whose affiliation remains unknown, the first person said.

In 2023, a contractor’s coding error allowed HSIN users to access restricted information they were not authorized to see, according to a memo previously obtained by Nextgov/FCW. Another similar incident occurred in 2025, the first person said.

Having an HSIN account does not automatically give a user access to everything on the platform. Information is organized into restricted groups, called communities of interest, focused on particular threats, regions or missions. A police official in a border state seeking information about cartel activity, for example, could request admission to a relevant group, with an administrator deciding whether to grant access.

The security incidents have also strained partners’ confidence in the network, according to the first person. Staff at some fusion centers — state and local hubs that bring together law enforcement and other partners to analyze and share threat information — do not know whether their files were accessed without authorization during the various incidents, the person said.

Sen. Mark Warner, D-Va., the Senate Intelligence Committee’s vice chairman, previously said HSIN supported security coordination for this summer’s World Cup and America250 events and that the network’s exposure “risks national security.”

During the most recent intrusion, DHS analysts twice dismissed suspicious activity as harmless, allowing hackers to remain inside for weeks, Nextgov/FCW reported in July. An internal incident readout showed suspicious activity beginning in mid-May. By June 4, the intruders had installed hidden access points and stolen credential data used to authenticate access to accounts or systems, prompting personnel to declare an active breach.

It remains unclear what data, if any, was pilfered from the network.

A DHS spokesperson did not immediately respond to a request for comment. In an earlier statement, the department said it was “aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment” and had isolated affected systems, addressed the vulnerability and begun a forensic investigation.

]]>

GSA seeks to boost understanding of FedRAMP 20x overhaul

Christian Robles — Thu, 08 Oct 2026 15:43:00 -0400

The General Services Administration is seeking to communicate new FedRAMP rules to agencies and private companies, which the program’s security director said on Thursday are sometimes confused with legacy rules.

“A lot of people, instead of using an AI agent to go through the rules or to try to find their answer directly in the rules, they’re googling, or they’re relying on past advice … so we’re doing a lot of trying to message ‘hey, this is the new FedRAMP; this is how things work now,’” FedRAMP Security Director Nicole Thompson said at the GovCIO Media & Research Federal Cloud & Data Forum.

FedRAMP now uses GitHub discussion boards, hosts community updates on a YouTube channel and has expanded its help desk to communicate with its stakeholders, according to a blog post updated Thursday.

Thompson’s comments come as GSA is currently in phase three of a five-phase 20x rollout, a major reform effort designed to speed up the authorization of cloud services by cutting red tape and pushing companies to automate certain FedRAMP requirements. GSA’s push to clarify 20x rules matters because FedRAMP serves as a key market access point for cloud service providers doing business with agencies.

Through phases one and two of the 20x rollout, GSA has tested new cybersecurity rules with multiple cloud service providers.

“We were able to develop [20x processes] in real time, make adjustments to the rules that weren't clear, and so a lot of the very beginning was managing a lot of frustration about too much information happening all at one time,” Thompson said of 20x pilots.

“Over the last year and a half, people have adjusted,” Thompson added.

Now in phase three, GSA is formalizing FedRAMP 20x requirements from phases one and two while supporting new Class A, B and C certification types, according to the FedRAMP website. Phase four will pilot Class D certifications and phase five will end new certifications for legacy Rev5 offerings, the website says.

But agencies like the Centers for Medicare and Medicaid Services continue to have questions about the new FedRAMP regime.

CMS has been asking FedRAMP questions to help speed up authorizations for cloud services it is sponsoring, Leslie Nettles, the agency’s acting deputy chief information security officer, said at the Thursday event.

“People are just hungry for what is the ground truth? Like, what do I need to pay attention to? Because Google [search] is full of complaints from old FedRAMP guidance,” Thompson said.

Thompson’s emphasis on 20x education is the latest public acknowledgement of the challenges the flagship cloud security program faces. The FedRAMP director recently told companies that are slow to patch known vulnerabilities they should not sell their cloud services to agencies, particularly after OpenAI models escaped a restricted testing environment and breached Hugging Face’s production infrastructure.

Amid the emerging challenges, some cloud service providers are reporting satisfaction with the security standards FedRAMP has set.

“Think about all the breaches that happen … most of the time, when it's those cloud systems, it's not the FedRAMP instance of that system that's getting breached,” Anish Patel, head of federal for Cloudflare, said Thursday.

“In reality, if we could make a world where the FedRAMP stuff could be applied across the board, it would raise the floor for everything,” he added.

]]>

FBI seizes websites supporting Chinese contractor’s hacking operations

David DiMolfetta — Thu, 08 Oct 2026 14:34:00 -0400

The Justice Department and FBI seized six internet domains supporting a major Chinese government contractor’s hacking operations, officials announced Thursday, alongside issuing a warning about the company’s role in targeting critical infrastructure worldwide.

The court-authorized seizures targeted two tools, Microscan and FishHub, operated by China-based Integrity Technology Group. Microscan searched networks for security weaknesses, while FishHub supported deceptive emails and delivered malicious software that could steal files or let hackers remotely control affected systems, according to the DOJ.

The action coincided with an advisory from the Cybersecurity and Infrastructure Security Agency, FBI, National Security Agency and international partners warning that the company supplies tools and technical support to China-linked hackers.

Officials said the activity has targeted government, manufacturing, healthcare, law enforcement and education organizations.

“The [People’s Republic of China] relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity,” FBI Cyber Division Assistant Director Brett Leatherman said. “By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure.”

According to court documents, Integrity Tech used a network of hacked internet-connected devices, known as a botnet, to help Microscan search other networks for weaknesses its clients could exploit.

Scanning targets included a South Carolina power company, airports in Japan and Poland, Taiwanese natural gas and power companies, two Taiwanese universities and a multinational nongovernmental organization.

Being scanned does not necessarily mean those organizations were successfully breached, but the digital reconnaissance can help intruders identify security weaknesses they could use to gain access.

FishHub helped hackers expand their access after an initial break-in. It delivered additional malicious software that allowed Integrity Tech’s clients to remotely access a network or search for specific files and send them to company-controlled servers, prosecutors said. Confirmed victims included approximately 20 Taiwanese universities.

The accompanying advisory describes how hackers supported by Integrity Tech seek to remain inside networks without being noticed. They target equipment that connects organizations to the internet, including devices that receive limited security monitoring. They also misuse legitimate system tools, making their activity harder to distinguish from routine work.

Thursday’s operation follows the September 2024 disruption of an Integrity Tech botnet made up of more than 200,000 compromised consumer devices worldwide. The company also faced U.S. sanctions in January 2025 for its role in facilitating hacking operations.

“Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity.

]]>

White House targets tech giants with H-1B visa suspension

Nick Wakeman — Thu, 08 Oct 2026 13:03:00 -0400

EDITOR'S NOTE: This story has been updated with comments from Microsoft.

The Trump administration has barred multiple technology companies from hiring workers from outside the U.S. under the H-1B visa program.

At the top of the administration's list is Microsoft, which Vice President J.D. Vance called the "biggest abuser" of the program. Microsoft laid off 6,000 workers in 2015 while adding 6,300 people via the H-1B visa program and another 3,000 workers with Green Cards, Vance said at a White House briefing Thursday.

Microsoft pushed back in a statement Thursday afternoon, saying about 80% of its roughly 6,000 H-1B applications in the last fiscal year were to extend or change the status of current employees, not to hire new workers.

Other companies under suspension include Adobe, Cognizant, Tata, Wipro, Infosys, HCL and Capgemini.

“We are cutting off the head of the snake,” Labor Secretary Keith Sonderling said in the briefing.

Vance said the administration’s fraud task force has launched multiple criminal investigations, but the abuse of the foreign worker programs is so severe that action could not wait.

The government will not process new or pending applications for H-1B visas and Permanent Labor Certification, or PERM, the Labor Department process that is typically the first step for an employer sponsoring a worker for a green card.

“H-1B is how they get in, and PERM program is how they stay,” Vance said.

The White House is claiming rampant fraud in the program that goes back decades.

“H-1B was meant to bring in the best of the best of foreign workers for positions that are impossible to fill with American workers,” Vance said.

Vance said companies will advertise for open positions and then claim no American workers applied, then "go and replace them with indentured servants."

Worker abuse has long been a complaint aimed at the H-1B program because the company, not the individual, holds the visa. That can make it difficult for someone to switch jobs or file complaints.

“They don’t come in with the same rights as an American citizen or American employee. They are being mistreated by their employers and are used to undercut the wages of American workers,” Vance said.

Many of the targeted companies are also federal contractors.

Microsoft is one of the government's largest software suppliers. Cognizant, Capgemini, Infosys, Tata, Wipro and HCL all perform federal IT services work directly or through U.S. subsidiaries.

It is not clear yet whether the suspension affects workers assigned to government contracts.

We have reached out to Microsoft and will update this story when they respond.

In its statement, Microsoft said its remaining H-1B filings for new hires were for people already legally in the United States, and that those hires equal about 1% of its U.S. workforce.

“They are not new arrivals to our country,” the company said.

Microsoft also said it pays H-1B employees the same as other employees doing comparable work, and that its H-1B wages are among the highest of any filer.

The company said the vast majority of its U.S. employees are Americans and that it looks forward to giving the administration more information.

]]>

VA rolls out CLEAR login option and in-person identity verification pilot

Edward Graham — Wed, 07 Oct 2026 17:52:00 -0400

The Department of Veterans Affairs announced on Wednesday that it has rolled out a new identity verification login option from CLEAR and established a pilot program at six medical facilities to help veterans create online VA accounts in person.

The new services are billed as part of a broader digital modernization effort being spearheaded by GovCIO to enhance VA’s online services and integrate the CLEAR1 security identity platform onto the VA.gov website.

Veterans now have the opportunity to voluntarily create CLEAR accounts to access their VA services using facial recognition. The agency’s platform also offers other log-in services that use biometrics for identity verification, like Login.gov — the government’s single sign-on service for federal and state platforms — and ID.me — another private sector offering that can be used to verify users of federal platforms.

Veterans who create CLEAR accounts can also use the service to sign into Medicare.gov through a similar partnership announced by the Centers for Medicare and Medicaid Services earlier this year.

The CLEAR accounts used to access VA.gov are different from those operated by the company that allow users to access CLEAR-verified airport security lines.

“Veterans want better customer service and convenience, and under President [Donald] Trump, VA is delivering,” VA Secretary Doug Collins said in a statement. “This technology is another way we’re changing VA to put Veterans first and make it easier for those who have worn the uniform to get the care and benefits they’ve earned.”

In addition to the new login option, VA is deploying CLEAR pods at selected medical sites to help veterans create identity verification accounts while at the facilities. Veterans who visit these biometric verification kiosks with the proper identifications can have their photos taken and then used to create CLEAR accounts.

The on-site identity verification pilot is now active at VA facilities in Atlanta, Georgia; Brooklyn, New York; Orlando, Florida; Palo Alto, California; San Juan, Puerto Rico; and Washington, D.C.

During a Wednesday interview on CBS Mornings, CLEAR CEO Caryn Seidman Becker said veterans can go to VA.gov and verify their identities with “one selfie, and you’re in.” She said the CLEAR pods’ pilot program will also allow the firm “to meet veterans where they are and help them to enroll there.”

]]>

CMS pitches new contractor operating model for ‘detect and prevent’ fraud strategy

Christian Robles — Wed, 07 Oct 2026 16:36:00 -0400

The Centers for Medicare and Medicaid Services is exploring a new contract operating model and technologies so that the agency can more effectively prevent fraud, instead of chasing after money already in the hands of bad actors, according to documents posted on SAM.gov Monday.

CMS has traditionally contracted with private companies to boost its investigative capabilities and support administrative actions, such as imposing payment suspensions, according to the listing. But under a draft operating model, CMS wants to take a greater role in leading the development, prioritization and direction of those investigations, the website adds.

The old model “worked in the past but new technology and new techniques mean it is time to see if it still works as well,” Kimberly Brandt, a CMS Deputy Administrator, posted on LinkedIn.

Under the draft model, CMS would assign fraud investigations to contractors whose primary role is to develop the investigation and administrative actions under the agency’s oversight, according to a draft Statement of Objectives posted on SAM.gov.

At CMS’ direction, contractors could review claims, conduct provider interviews and coordinate with other program integrity stakeholders while documenting those investigative methods in a central CMS-designated system, the document continues.

The model also gives contractors the flexibility to develop potential fraud leads from authorized data sources, pending CMS approval and the company’s capacity.

A request for information asks contractors a series of questions about how private companies can best fulfill the proposed operating model detailed in the Statement of Objectives.

For example, the agency asks about the strengths and weaknesses of centralizing “compliance-related tasks” and provider site verifications. The agency also asks if it should contract with specialty companies for different provider types and if investigations involving private Medicare plans should be integrated with ones involving traditional Medicare.

The RFI includes a question about which data sources, analytics, artificial intelligence, SQL methods and other technologies CMS should use to develop fraud leads and investigations.

The RFI — which closes Nov. 4 at 11 a.m. ET — is only for informational purposes and will not lead to awards, according to the SAM.gov listing.

The questions are meant to “help us identify how to ensure our contracts with [third-party] entities helps us stop paying and chasing and instead detect and prevent,” Brandt wrote.

CMS stood up a Fraud Defense Operations Center in March 2025 to prevent fraud in federal health programs by reviewing claims in real-time, Brandt previously told Nextgov/FCW. The center has stopped nearly $2.5 billion in potentially fraudulent Medicare payments and taken action on just under 800 providers, Brandt recently said.

CMS is asking state medical boards for a point of contact the agency could work with to strengthen fraud-related data sharing, according to a video Administrator Mehmet Oz posted on social media yesterday.

But using new technologies is only part of the CMS strategy to curtail fraud, waste and abuse.

Brandt recently said she is urging congressional offices to give CMS the ability to occasionally stop providers and payers from enrolling in federal health programs.

And earlier this year, CMS published a “CRUSH” request for information seeking public comment on fraud-busting regulatory changes the agency could make to Medicare, Medicaid and other federal health programs.

The health sector is still waiting for those longer-term policy shifts, Kristen O’Brien, a healthcare policy and regulatory attorney at Holland & Knight, told Nextgov/FCW.

“While we wait for the next regulatory push on CRUSH, HHS is soliciting the public on what can be done today to leverage technology to crush fraud and abuse and save taxpayer money,” O’Brien said of the RFI released Monday.

]]>

Census Bureau partially sketches out timeline for $2.5B in digital transformation pacts

Ross Wilkers — Wed, 07 Oct 2026 15:39:00 -0400

The Census Bureau has partially updated the timeline for competing its primary enterprise technology and application modernization contract mechanism in support of the 2030 exercise.

Also known as CenTAM, the Census Bureau Transformation & Application Modernization effort will be a set of four blanket purchase agreements covering various tech needs for the U.S.’ next population tally.

The Census Bureau first detailed the planned structure of awards for CenTAM in the summer of 2025, then held an industry day in July to further explain the plan.

The Census Bureau is now reassessing portions of CenTAM’s framework given how artificial intelligence and other technology areas have quickly evolved, the agency said in a Tuesday Sam.gov notice.

CenTAM will have a combined ceiling value of roughly $2.5 billion across all BPAs, according to a slide deck from the July 21 industry day.

In describing AI, the bureau’s newest notice uses the term “Super Intelligence” following President Trump’s Sept. 29 executive order directing agencies to use the SI phrase in official communications.

The new rough timeline for CenTAM pegs solicitation activity for the decennial- and geospatial-focused BPAs to start ramping up before this calendar year ends.

More details will be forthcoming for the enterprise BPA, as well as the systems and programs pact, after the Census Bureau completes its review of those requirements and acquisition strategies.

Both the enterprise and decennial BPAs will have ceilings of $1 billion each for multiple awardees, while the geospatial piece will be worth up to $241 million and the SPS portion will have a maximum $311 million value. The geospatial and SPS tracks will have single winners.

Work under each BPA will take place over one initial base year and up to nine individual option years.

]]>

Recent Taiwan simulation highlights US cyberdefense gaps against China, experts warn

David DiMolfetta — Wed, 07 Oct 2026 11:59:00 -0400

The United States devotes too little attention toward preparedness for a Chinese campaign of cyberattacks and economic pressure against Taiwan, organizers of a recent war game warned Tuesday, arguing that gaps between military and civilian planning could delay assistance to the island.

The Foundation for Defense of Democracies exercise examined how Beijing could disrupt Taiwan’s communications networks to extract political concessions without launching an invasion. The simulation was held in Taiwan in late September, and its findings were briefed to Taiwanese President Lai Ching-te and his national security team, according to the think tank.

Mark Montgomery, an FDD senior fellow and retired Navy rear admiral who helped lead the exercise, said Washington routinely rehearses possible military conflict over Taiwan but is less systematic about preparing for the cyber operations he considers more likely to occur.

“The Department of Defense sees it as a problem for the other federal agencies, and the other federal agencies don’t have a budget or a systematic process for running these kinds of tabletops,” he said in a briefing with reporters.

The exercise began with localized cellular disruptions, information manipulation and pressure on satellite connectivity. A second phase escalated to damaged undersea cables, disabled electrical substations supporting telecommunications and strained backup networks, according to Craig Singleton, FDD’s China program director, who played China in the simulation.

The aim was to make daily life less reliable and undermine confidence in Taiwan’s government while avoiding a direct confrontation with the United States, Singleton said. Communications outages could also compound problems in other sectors, disrupting payments, slowing emergency coordination and making power failures harder to manage.

Taiwanese participants rerouted traffic and activated alternatives. But the harder test was whether those systems could sustain services for weeks as Beijing studied the response and targeted the backups, he said.

Asked by Nextgov/FCW about lessons from Salt Typhoon, the Chinese hacking campaign that breached U.S. and global telecommunications networks, Singleton said that operation informed the scenario, but it wasn’t named directly in the exercise packets.

A separate Chinese hacking collective dubbed Volt Typhoon — which seeks to establish access⁠ to critical infrastructure for disruptive or destructive attacks during a major crisis or conflict — was also not mentioned directly, but its activities also influenced the war game.

“If an adversary already understands the network, its dependencies and its fallback pathways, then disruption can become much more targeted and adaptive,” Singleton said.

Montgomery said policymakers also tend to underestimate recovery times for systems that are taken down, especially when restoring one service depends on bringing others back online. He described that as a recurring problem in exercises across several countries.

“You know they’re speaking in minutes and hours, and my experience is days or weeks,” he said.

The warnings underscore the range of threats Taiwan faces beyond a possible Chinese invasion. In its 2026 worldwide threat assessment⁠, the Office of the Director of National Intelligence said Chinese leaders did not currently plan to invade Taiwan in 2027 and had no fixed timeline for unification. Beijing preferred achieving its goal without force, the assessment said, while continuing to develop military options.

More recently, U.S. officials have assessed an invasion before 2028 as increasingly unlikely⁠, citing military readiness delays and China’s interest in Taiwan’s next presidential election.

China claims Taiwan as its territory, although it has never governed the self-ruled island, and views bringing the island under its control as central to national unification. China has not ruled out using force, but cyberattacks and economic pressure could offer ways to weaken Taiwan’s resistance and push its leaders toward concessions without the risks of an invasion.

Montgomery separately warned that early 2028 could bring intensified cyber and economic coercion if Taiwan’s Democratic Progressive Party wins a fourth consecutive presidential election. FDD hopes to run future exercises with congressional staff and federal agencies, he added.

]]>

Experts hope new AI czar’s leadership can move the needle on regulation

Edward Graham — Tue, 06 Oct 2026 17:57:00 -0400

President Donald Trump officially announced on Sunday that Jay Clayton, the director of national intelligence, will helm the administration’s artificial intelligence portfolio. Several former officials told Nextgov/FCW they hope the White House’s new AI czar will engage with Congress to examine potential guardrails around use of the emerging capabilities and figure out what actually needs governing.

In a Truth Social post, Trump said Clayton will lead a “Super Intelligence Force” focused on coordinating “the Federal Government's engagement with Consumers, Public Interest Groups, Religious Organizations, Critical Infrastructure Providers, and Super Intelligence Companies.” Trump signed an executive order on Sept. 29 calling for federal agencies to begin referring to AI as “super intelligence.”

In an interview with The Wall Street Journal that was published on Saturday, Clayton said the task force will have 120 days to report on the risks and opportunities posed by AI and provide recommendations on the role that the government should play.

Undersecretary of Defense for Research and Engineering Emil Michael, Office of Personnel Management Director Scott Kupor and Federal Trade Commission Chairman Andrew Ferguson will also serve as vice-chairs of the Super Intelligence Force. Other members include Vice President JD Vance and Defense Secretary Pete Hegseth, as well as external advisors like venture capitalist David Sacks, who previously served as the administration’s AI and crypto czar until March.

Although Trump has vocally opposed imposing new regulations on tech firms that could hinder U.S. competition with China, when he first floated the appointment of a new AI czar and the creation of an AI Force in a Truth Social post last month he said his administration “will also be looking for BAD” in AI development.

In interviews conducted prior to Clayton’s selection as AI lead, former Biden and Trump White House officials and a Democrat lawmaker shared their hopes for how a new AI czar will guide the nation’s policies on the emerging capabilities.

One former Trump administration official, granted anonymity to speak candidly, said they hoped the task force would ultimately resemble the National Space Council’s model, which advised the president on space policy and coordinated efforts across the government and commercial sectors. Although that space council was revoked by Trump in a December 2025 executive order, the official said the AI czar could help distill collected input into policy recommendations.

“Maybe [the AI czar] can work with Congress to help come up with some governance, some laws that address different pieces of it, and then we can kind of move forward,” they added. “I don't think there's going to be like one bill, one AI act that covers everything. But I think you sort of pick and choose what's most important.”

Rep. Don Beyer, D-Va., who co-chairs the Congressional Artificial Intelligence Caucus, also said a task force can’t replace the need for federal regulation. He noted that Trump has taken a similar approach to the risks posed by AI as he has to climate change, which he considers to be fake.

“We need the president to move away from ‘this is a hoax,’ to understand that we must responsibly regulate this, and then I think listen carefully to the best intentions coming from the AI leaders about how best to structure it,” Beyer said.

But an important part of this work, another former official said, is shifting the basic understanding of how to approach AI regulations.

Arati Prabhakar, who served as director of the White House Office of Science and Technology Policy from 2022 to 2025 during the Biden administration, said much of the current conversation around AI policies is misframed around the idea of promoting balance between innovation and safety. This is one area, she said, where the AI czar will have to particularly focus.

“We need to be aggressive as heck about using AI, and aggressive as heck about making sure that it's being done safely,” she said. “And not only are they not trade-offs, getting the safety and getting it on the right track is a condition that is required in order to achieve advances.”

]]>

The monsters of Cybersecurity Awareness Month are getting stronger

John Breeden II — Tue, 06 Oct 2026 17:26:00 -0400

Every October, when horror movies start turning up again, I’m reminded of one particularly ambitious attempt from my childhood to make an old monster a little scarier.

In May 1982, DC’s Channel 20 turned a showing of Revenge of the Creature, the sequel to Creature From the Black Lagoon, into a local television event by broadcasting the movie in 3D. My friend Dan Murphy and I had picked up the required red-and-blue cardboard glasses from 7-Eleven and settled into the basement where we spent an enormous amount of our childhood playing games and watching movies. My mother kept us supplied with hot pizza bagel bites while we waited for the Creature to leap out of the television.

It never quite happened. I remember a monster’s hand reaching toward the camera and, for some reason, a boat rope being tossed in our direction. Contemporary accounts suggest there was also a trombone involved. Mostly, I think Dan and I were more excited about the pizza bagels and playing Intellivision afterward.

The Creature wasn’t exactly terrifying, even with a slight bit of 3D magic. But it was a good monster for its time.

Cybersecurity has monsters too, and October has been dedicated to teaching people how to recognize and defend against them since Cybersecurity Awareness Month began in 2004. When I last wrote about cybersecurity month in 2023, CISA was launching its Secure Our World campaign and emphasizing familiar protections against familiar threats: recognizing phishing, using multifactor authentication, updating software and creating stronger passwords.

Those threats have not gone anywhere. NIST’s current Cybersecurity Awareness Month resources still emphasize fundamentals such as multifactor authentication, ransomware protection, secure software development and cybersecurity education. But three years is a long time in technology, and the newer monsters are getting considerably more capable.

Generative AI had only recently burst into widespread public use when Cybersecurity Awareness Month arrived in 2023. Today, AI is increasingly embedded in software development, cybersecurity tools and everyday business operations. Agentic AI is notably pushing that evolution even further by allowing software to pursue goals, use tools and perform sequences of actions with much less direct human involvement, sometimes even performing illegal or morally questionable activities.

Adding AI-focused cybersecurity is one big change showing up in the federal government’s Cybersecurity Awareness Month activities this year. NIST’s theme for 2026 is “Securing the Next 250,” a reference to the nation’s 250th anniversary and the need to build a secure digital foundation for its next era. The agency has scheduled events throughout October dealing with everything from cybersecurity careers and small-business protection to controlled unclassified information.

One of the most technically ambitious sessions arrives Oct. 28, when NIST’s National Cybersecurity Center of Excellence will host a webinar called “DevSecOps and the Impact of Agentic AI.”

The NCCoE is already working with 14 technology companies on a project demonstrating how organizations can apply NIST’s Secure Software Development Framework using modern DevSecOps pipelines and commercially available technologies. The next phase will go considerably further by examining agentic AI systems that can help develop, build and test software.

That creates an obvious security question. If an AI agent is going to act inside a software development environment, organizations need some way to know which agent it is, what it is allowed to access and what actions it has permission to perform.

NIST plans to explore exactly that. Its DevSecOps team is working with the agency’s Software and AI Agent Identity and Authorization project on an implementation designed to demonstrate how AI agents can be identified, authenticated and authorized inside the software development lifecycle. NIST says its DevSecOps environment will provide the first implementation use case for that effort.

The issue is already attracting considerable attention. NIST said in late September that an earlier concept paper on software and AI agent identity generated more than 600 comments from industry, government and academia.

NIST security engineer Bill Fisher and Ryan Galluzzo, the agency’s Digital Identity Program Lead, described the underlying concern in an August article about agentic AI and identity.

“Early agentic deployments are repeating a familiar pattern: prioritizing feature development and immediate value over security,” Fisher and Galluzzo wrote in their NIST agency blog.

That observation sounds familiar because cybersecurity has seen similar patterns before. New technology arrives, organizations race to take advantage of it and security sometimes has to catch up later. What makes agentic AI different is that the software itself may have greater freedom to take actions, interact with other systems and pursue objectives without waiting for a person to approve each step.

The federal government’s October activities are not focused exclusively on advanced AI threats. NIST’s Cybersecurity Career Week runs Oct. 19 through 24, with webinars and other activities designed to introduce students, recent graduates and career changers to cybersecurity work. That matters because increasingly sophisticated defensive technology still depends on people who know how to design, operate and evaluate it.

Other agencies are concentrating on more familiar threats. On Oct. 14, the Small Business Administration’s Rhode Island District Office is joining the Federal Trade Commission and NIST for a cybersecurity and scam-awareness session covering leading 2026 fraud trends, common cyber risks, reporting, recovery and federal resources available to small businesses.

NIST is also holding an Oct. 29 webinar aimed at organizations that handle Controlled Unclassified Information. That session will focus on assessing security requirements under NIST Special Publication 800-171A Revision 3, with particular attention to helping small businesses understand what those requirements mean in practice.

Taken together, the events show how much territory Cybersecurity Awareness Month now has to cover. Like that old rubber-suited monster wandering around in the Creature From the Black Lagoon movies, classic threats are still lurking. Criminals are still phishing for credentials, deploying ransomware, stealing identities and taking advantage of organizations that fail to patch vulnerable software.

But new capabilities are being layered on top of that familiar threat landscape. AI can help write software, analyze data and automate security work. Increasingly autonomous agents may also interact with systems, identities and development environments in ways that demand entirely new controls.

That doesn’t make the old cybersecurity lessons obsolete. Multifactor authentication, secure software development, good identity management and an educated workforce may matter even more as the technology using those systems becomes increasingly capable.

The old Creature never really went away either. He is still wandering around somewhere in the cinematic swamp more than 70 years later, looking a little quaint compared with the monsters that came after him. Cybersecurity monsters are evolving too, only with considerably higher stakes. And unlike those cardboard 3D glasses from 7-Eleven, the new threats are getting much better at reaching out of the screen.

John Breeden II is an award-winning journalist and reviewer with over 20 years of experience covering technology. He is the CEO of the Tech Writers Bureau, a group that creates technological thought leadership content for organizations of all sizes. Twitter: @LabGuys

]]>

GSA faces recurrent issues with geospatial data handling, watchdog finds

Christian Robles — Tue, 06 Oct 2026 17:06:00 -0400

The General Services Administration is still not meeting the Geospatial Data Act of 2018’s requirement to maintain geospatial data, an Office of Inspector General report published Monday found. Previous 2024 and 2022 OIG audits also found that GSA was not fully compliant with the federal law.

GSA has two publicly available geospatial datasets — the Inventory of Owned and Leased Properties Dataset and the Federal Real Property Profile Dataset — that contain inaccurate or missing latitude and longitude coordinates, the OIG found.

The watchdog noted that about 78,624 — or 26% — of properties in the FRPP dataset with coordinates lacked distinct ones and “numerous properties” in that dataset contained erroneous coordinates. The finding echoes a June 2026 Government Accountability Office report that determined about 20% of buildings in the FRPP had coordinates that did not match their reported zip codes.

The OIG found that 634, or about 7%, of the GSA-controlled properties listed in the IOLP-buildings dataset lacked distinct coordinates. Approximately 20% of the IOLP-buildings dataset’s real property assets contained outdated and incorrect congressional representative data.

“GSA should identify cost-effective measures to improve the accuracy and usefulness of the latitude and longitude coordinates in the IOLP and FRPP datasets based on each property’s physical location,” the OIG wrote.

GSA did not maintain its geospatial data inventory for two years until it responded to OIG’s audit, according to the report. The updated inventory showed a roughly 22% increase in geospatial data assets compared to the 2024 inventory.

The OIG found that the agency did not maintain an updated inventory because it does not have a documented process listed in materials like the GEOSPATIAL DATA Standard Operating Procedure — or SOP — and Standards Guide.

“GSA should update its geospatial data SOP to establish a process for maintaining its geospatial data inventory, including defining roles and responsibilities,” the office wrote.

While the Geospatial Data Act requires agencies to search for existing geospatial data before procuring new data, the OIG found that GSA continues to not comply with that requirement.

Following the 2024 audit, GSA agreed to establish a search process, but the agency has not yet implemented it. GSA staff said in April that they were “evaluating resources to determine a timeline for updating the process,” the OIG wrote.

The report said that GSA’s delegation of Geospatial Data Act responsibilities is not effective, leading to some of the recurrent issues. GSA staffing cuts since 2025 have exacerbated those problems, the report added.

GSA did not respond to a request for comment on the OIG report by the time of publication.

GSA Chief Information Officer David Shive did sign a letter agreeing with all five of the OIG’s recommendations for improving geospatial data. The letter says GSA is “working on a plan to address” the recommendations.

Shive agreed to conduct a cost-benefit analysis of feasible corrective action plans for geospatial data accuracy, create a process for correcting IOLP congressional representative name data and establish protocols for GSA-wide compliance with Geospatial Data Act rules.

Shive also agreed to align the GSA’s geospatial strategy plan with a federal 2025-2035 strategic plan and update GSA’s GEOSPATIAL DATA SOP and Standards Guide.

]]>

FBI removes Accenture contractor after missed security patch led to breach

David DiMolfetta — Tue, 06 Oct 2026 10:08:00 -0400

The FBI has severed ties with a contractor working for Accenture amid a massive cybercrime intrusion that may have exposed data on thousands of bureau employees, according to a person with knowledge of the matter.

Prolific cybercrime group ShinyHunters claimed responsibility for the hack last month. The data stolen contained employees’ addresses, phone numbers and information on their spouses, among other categories. It also revealed sensitive data on employees’ intelligence and surveillance roles, as well as private medical information.

Accenture is responsible for software patch management and maintaining custom code at the FBI, said the person, who spoke on the condition of anonymity because the situation is sensitive. Oracle — whose PeopleSoft platform was the initial access point that ShinyHunters claimed to have exploited — provided the security patches that were not integrated, the person added.

FBI cybersecurity chief Brett Leatherman confirmed the removal of an unnamed contractor in a statement to Nextgov/FCW.

“To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform,” Leatherman said. “As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce.”

The remarks offer the bureau’s clearest explanation yet of how the intrusion occurred, though they do not address why the patch was missed and how the FBI monitored the contractor’s work to ensure systems holding sensitive employee information were protected.

Reuters first reported the removal late Monday. The specific Accenture employee could not be immediately identified.

In a statement, the company said it’s “proud to support the mission of the FBI and will continue to do so.”

The breach follows recent findings from Google’s Mandiant that ShinyHunters had resumed widespread exploitation of a PeopleSoft vulnerability for which Oracle issued a patch in June.

The incident poses serious counterintelligence risks because the exposed records could help foreign intelligence services identify employees working on sensitive investigations and exploit personal information about them.

ShinyHunters has said it would not publish the stolen data, but its statement did not say the records had been deleted. Retired Lt. Gen. Robert Skinner, who previously led the Defense Information Systems Agency, told Nextgov/FCW last week that the group could still sell some or all of the information to foreign intelligence services or other buyers.

Authorities have also moved against suspected members of the group. Dutch police last week announced the arrest of an alleged leader, and Reuters reported Saturday that another suspected member, Saif al-Din Khader, had been detained in Jordan and was helping investigators locate other hackers.

]]>

TMF invests $83.4M in 4 AI-enabled projects

Christian Robles — Mon, 05 Oct 2026 17:49:00 -0400

The Technology Modernization Fund has awarded millions of dollars to support artificial intelligence projects at the departments of State, Transportation and Agriculture, according to a Wednesday website update.

The new projects include efforts to boost federal AI adoption and streamline burdensome permitting processes, which TMF specifically sought in a June call for proposals. They also come several weeks after Congress extended authorization for TMF through Dec. 11 in its most recent stopgap funding bill, preventing the program from expiring on Sept. 30.

Of the roughly $83.4 million total, $17.3 million will help the State Department implement agentic AI to streamline desk processes, support foreign policy staff’s research and launch a secure environment where employees can build their own agents, according to the website update.

“A person will review every automated decision and minimum risk management practices will be followed, as federal rules on oversight require,” the website added.

State expects the investment to save help desk staff and policy teams more than 100,000 hours a year and achieve about $15 million in timing savings in its first year, rising to about $20 million the following year. The project has seen 57% of the $17.3 million transferred since the TMF Board notified the department it had voted to invest in their proposal in July.

TMF previously spent $18.2 million to bring generative AI tools to State's network but “employees still lack a way to connect the systems that stand between them and their work,” the website said.

The Transportation Department will receive nearly $3.8 million to automate air travel complaint categorization, identify trends across complaint categories beyond statutory minimums and pull records faster for congressional and other inquiries.

TMF says the Transportation Department project will use “secure AI features” but will have a person review every automated decision and ensure minimum risk management practices are followed.

The Transportation Department expects the project to achieve 80% to 85% accuracy in automated complaint classification, identify complaint trends up to 80% faster and decrease record request response time by up to 75%. The TMF award follows a previous $8 million project to replace a 30-year-old database platform with a modern one called ACERS, making it easier for travelers to file complaints and allowing airliners to respond in real time.

“While ACERS improved public intake and real-time carrier access, staff still spend critical hours on manual administrative tasks such as manually searching records, verifying complaint categories, and checking for complaint duplicates, leaving little time for anything beyond what the law requires,” according to TMF’s website.

The Department of Agriculture received awards for two of its initiatives in the most recent funding announcement.

The first is a roughly $52.3 million replacement of “high-risk” USDA payroll technology serving nearly a third of the federal workforce with an AI-enabled cloud platform.

“Without immediate action, the risk of system failure or cyber threats will escalate, potentially jeopardizing the delivery of paychecks and benefits to hundreds of thousands of federal employees,” according to TMF’s website.

The new platform will consolidate more than 50 separate applications into one environment that meets FedRAMP requirements, applies layered security controls, launches through early test runs and aligns with the Office of Personnel Management’s HR 2.0 initiative.

“OPM has reviewed and endorsed the plan, confirming it aligns with HR 2.0, and both agencies have committed to coordinating milestones as implementation moves forward,” according to TMF’s website.

The second award is a $10 million consolidation of 10 USDA environmental review systems into one shared platform.

The platform will also use AI to identify applications eligible for the “fastest review path” and build the first centralized reporting and oversight system USDA has had in its environmental review portfolio, according to TMF’s website.

The project is expected to save an estimated 1.8 million labor hours a year, process about 78% of fast-track applications “in near real time,” and align with the Trump administration’s April 2025 permitting technology priorities, the website adds.

“It is great to have the TMF focused on products that matter, and I'm excited for more to come in the quarter ahead,” Jessie Posilkin, acting TMF executive director, posted on LinkedIn.

A July Government Accountability Office report found that the TMF has only realized $13.5 million in savings through June 2025, but the office expects the program to yield roughly $1.06 billion in savings in the future.

]]>

HHS unveils efforts to speed up clinical trials with AI

Christian Robles — Mon, 05 Oct 2026 17:39:00 -0400

The Health and Human Services Department announced Tuesday a program and three projects aiming to speed up clinical trials with artificial intelligence, advanced computational models, real-time analysis and other technologies.

The Simulation-augmented, Real-time Platform Adaptive Seamless Trials — or SURPASS — program seeks to create AI-powered platforms that continuously and adaptively support clinical trial designs, according to an HHS press release. The platform will enable “earlier, smarter decision making that will help speed effective drugs to patients,” according to the release.

The department’s Advanced Research Projects Agency for Health, or ARPA-H, will host two informational sessions before a SURPASS solution summary is due on Nov. 30.

Companies interested in the SURPASS program will have to focus on three technical areas.

The first is building a phaseless design engine that simulates clinical trials so that researchers can create faster trials with fewer patients while complying with regulations, according to an HHS release and a SAM.gov listing.

The second is developing a continuous inference engine that allows researchers to conduct real-time or on-demand analysis of clinical trials, supporting trial adaptations.

The third is creating an agentic AI operations layer that will automate trial startup activities, speed up data collection and support other procedures.

“SURPASS is developing the technology and biostatistical frameworks needed to analyze trial data as it accumulates, allowing teams [to] learn in real time, adapt when needed, and generate stronger evidence faster with less operational burden,” Daria Fedyukina, SURPASS program manager, said in the release.

HHS also unveiled STACK, COMMONS and CINCH, three complementary ARPA-H initiatives meant to transform U.S. clinical trials.

STACK will create more domestic clinical trial sites and boost trial enrollment by using AI “to accelerate clinical site activation and convert research-naïve sites into clinical trial sites,” according to the HHS release. Evidence Health is the prime STACK awardee and could receive up to $41.18 million, according to an ARPA-H listing.

COMMONS will build “the connective tissue for nationwide data infrastructure” by creating “architecture for consent at national scale and enable access to regulatory-grade data,” according to the HHS release. The project targets over 40 million individuals and 3 million linked records, according to an ARPA-H listing. Evidence Health is the prime COMMONS awardee and could receive up to $49.9 million, the listing says.

University of Texas at Austin Dell Medical School is partnering with Evidence Health on STACK and COMMONS. The medical school is preparing sites for clinical trial research and developing a national research data resource, according to a press release.

CINCH aims to help cancer patients contribute their own data to speed up the identification of clinical trials that may be appropriate for them, according to the HHS release and an ARPA-H listing. CINCH is meant to operate as a patient-initiated way for adults to better understand their conditions. Courage Health is the prime CINCH awardee and could receive up to $8.95 million, the listing says.

The HHS initiatives build on other Trump administration efforts to speed up clinical trials.

HHS announced Operation TrialBlazer in June, a department-wide effort to support clinical trials through pilot programs, public-private partnerships and patient connections.

The Food and Drug Administration announced in April that it is using AI and cloud computing to monitor clinical trial data in real-time under a pilot program. An FDA official estimated that the effort could cut overall clinical trial times by as much as 40% without compromising patient safety.

HHS says the clinical development of drugs and biologics often takes over a decade, costs an average of up to $2 billion and fails more than 90% of the time.

]]>

Pentagon personnel breach — undetected for months — renews cyber standard scrutiny

David DiMolfetta — Mon, 05 Oct 2026 10:48:00 -0400

A Pentagon breach that exposed sensitive personnel information for months before discovery is raising questions yet again about how federal agencies are able to successfully detect unauthorized access to the records they hold on millions of individuals.

The incident at the Defense Manpower Data Center — which maintains personnel information used across the military and other government agencies — affected roughly 3 million people. Cybersecurity experts say it’s significant because of the risks often created when government employee personnel information is exposed for a long period of time.

“Three million people may be the headline, but months of unauthorized access to highly sensitive data going undetected is the real warning,” said Nitay Milner, co-founder and CEO of data security company ORION Security.

Nextgov/FCW obtained a breach notification letter signed by DMDC Director Katie Griffin, describing unauthorized access between October 2025 and July 16, 2026, when the agency discovered a vulnerability in a file-sharing system. The files contained unencrypted personal information, including Social Security numbers and, depending on the individual, names, birth dates, contact information and military occupational specialties.

“Upon discovery of the security vulnerability, DMDC immediately initiated privacy and cybersecurity incident response actions in accordance with Office of the Management and Budget and [Defense] Department guidelines and policies,” it reads. “We are taking appropriate actions to assess and enhance the cybersecurity posture of the DMDC system.”

DMDC patched the flaw and restored the system, according to the letter, and affected individuals are being offered a year of credit monitoring and identity-restoration services.

Military Times first reported the incident late last month, citing the same notice. A defense official later told CNN that the breach affected 2.76 million living people and another 294,000 deceased individuals.

The disclosure comes as the FBI responds to a separate breach claimed by prolific cybercrime group ShinyHunters, which likely exposed sensitive records of personnel involved in intelligence-gathering roles.

No public evidence has linked the intrusions, though both cases involve information that could help attackers identify government personnel and tailor attempts to deceive them through fraud schemes. Such data can also identify employees whose work is of particular interest to foreign intelligence services.

The breach is hardly the first to expose weaknesses in federal systems in recent years. In December 2024, Treasury disclosed that Chinese state-sponsored hackers accessed unclassified documents through a compromised remote-support service. Separately, the federal judiciary acknowledged attacks on its electronic case management system in August 2025, and the Congressional Budget Office confirmed unauthorized access to its systems that November.

AI systems are widely expected to accelerate cyberattacks, helping hackers find security weaknesses and use stolen personal information to make their targeting more precise and convincing.

Milner said detecting unauthorized activity requires agencies to understand who is gathering sensitive information, whether they are permitted to enter a given system and whether their behavior makes sense.

That scrutiny can matter even when an intrusion doesn’t immediately disrupt a system or draw attention. In the case of DMDC, the department’s notification described access spanning roughly nine months before the vulnerability was discovered.

Jeff Wichman, senior director of breach preparedness and response at Semperis, said agencies must plan for intrusions even when they have experienced security teams and established protections.

“The FBI and Pentagon have amazing responders, but these breaches are still happening and eventually everyone is hit,” he said. “True resilience depends on having a fully pressure-tested incident response plan detailing exactly which teams are responsible for what across the entire breach cycle, from initial discovery and containment to legal and regulatory reporting.”

He also warned that new government AI services, including the ‘America.gov’ chatbot, could create additional ways for attackers to reach sensitive information if those tools connect to agency systems. “More government agencies will fall victim to compromise,” he said. “Every piece of leaked data creates a domino effect.”

]]>

Spy chief Jay Clayton takes on White House’s AI portfolio

David DiMolfetta — Mon, 05 Oct 2026 10:13:00 -0400

President Donald Trump named intelligence director Jay Clayton to serve as the White House AI czar, just two months after being sworn in as the nation’s top spy.

Clayton will head what Trump referred to in a Truth Social post as the “Super Intelligence Force” meant to coordinate the government’s engagement with various organizations, critical infrastructure providers and AI companies. The Trump administration has begun referring to AI as “super intelligence” after the president signed an executive order late last month calling for federal agencies to use the new phrasing.

According to its charter, the task force will create plans to handle AI-enabled threats, streamline breach notifications and improve government response capacities while aiming to avoid overregulation. Its creation follows growing public concerns over AI safety and cybersecurity risks, as well as heated political discussions over data center buildouts that power many of today’s AI systems.

“The risk of not being first is high,” Clayton told the Wall Street Journal in a Saturday exclusive that discussed the task force. “Not being first increases the identified, and unidentified, risks, particularly from our adversaries,” he said. “Being first will better enable us to address those risks on behalf of the American people.”

The task force features three vice chairs: Undersecretary of Defense for Research and Engineering Emil Michael, Office of Personnel Management Director Scott Kupor and Federal Trade Commission Chairman Andrew Ferguson. Its members include Vice President JD Vance, Defense Secretary Pete Hegseth and other senior advisors, alongside external advisors like venture capitalist David Sacks — who previously worked as Trump’s AI and crypto czar early in the administration — and former Secretary of State Condoleezza Rice. It will have 120 days to report on the risks and opportunities of AI and establish a plan for the federal government to tackle it.

The panel’s establishment marks a shift for an administration that has predominantly maintained a hands-off approach toward AI governance. But officials have faced mounting pressure over the past six months to respond as a new generation of sophisticated, autonomous AI models demonstrating advanced cybersecurity capabilities have repeatedly circumvented or escaped established technical safeguards.

Its creation highlights a steady group of voices in the administration and tech industry that believe the time for AI safeguard discussions should begin, though Trump and other officials have largely continued to lean toward a more relaxed approach to regulating the technology.

In public discussions, officials and researchers typically frame AI development as a trade-off between slowing down for safety and accelerating to maintain an edge over foreign adversaries pursuing AI for military and economic gains.

China has especially become a major player in the global AI race. Clayton’s appointment to the task force appears to signal a shift by the administration to cast AI as a geopolitical and national security subject area.

His dual role is a unique move for the White House, placing the current DNI — who oversees all 18 U.S. spy agencies — at the helm of broad domestic technology and economic policy discussions. Clayton brings a background as a corporate lawyer and former SEC chairman, making him a unique pick compared to people with more tech-focused backgrounds that hail from Silicon Valley.

The U.S. intelligence enterprise is poised to benefit from advanced AI adoption. Integrating AI has already transformed how spy agencies digest vast troves of collected data and build intelligence products, among other things.

Sen. Mark Warner, D-Va., the vice chairman of the Senate Intelligence Committee, said that he welcomed the administration’s attention toward the fast-evolving technology but said Clayton’s new title lacks a coherent strategy.

“We still do not know what authority this new role will have, whether it will include developing safety standards or reviewing the most advanced models, or how it fits into the administration’s broader approach to AI,” Warner said in a statement. “That lack of clarity is especially concerning as leading AI companies themselves are confronting increasingly capable systems that can evade safeguards and exploit cybersecurity vulnerabilities.”

“I hope this appointment is an opportunity for the administration to move beyond slogans and toward a serious, coordinated national strategy for AI,” he added.

]]>

Tech bills of the week: AI research competitions; Prohibiting federal use of biometric tech; and more

Edward Graham — Fri, 02 Oct 2026 19:21:00 -0400

Incentivizing AI research

A bipartisan House measure introduced on Wednesday looks to create federally-funded research competitions to enhance AI security and understanding of the technologies.

Led by Reps. August Pfluger, R-Texas, and Josh Harder, D-Calif., the Reliable Artificial Intelligence Research Act would create two national competitions operated by the Department of Homeland Security focused on AI interpretability and adversarial robustness. The legislation would set aside $10 million in prizes to award through the national competitions over the next five years.

"As AI becomes more deeply woven into our economy and our national defense, we cannot afford to leave it vulnerable to those who would exploit it,” Pfluger said in a statement. “Adversaries are already looking for ways to manipulate these systems, and we must stay ahead of them. The Reliable Artificial Intelligence Research Act puts American ingenuity to work on making AI more transparent, more predictable, and more resistant to attacks.”

Sens. Jim Banks, R-Ind., and Maggie Hassan, D-N.H., previously introduced a companion bill in the upper chamber.

Stopping federal use of biometric tech

A group of House and Senate Democrats reintroduced legislation last Friday that would prohibit the federal government from using biometric technologies. The lawmakers said their proposal is in response to Immigration and Customs Enforcement and Customs and Border Protection’s use of a mobile facial recognition app, which they said has been used to target immigrants.

The measure is sponsored by Sens. Ed Markey, D-Mass., and Jeff Merkley, D-Ore., and Reps. Pramila Jayapal, D-Wash., Rashida Tlaib, D-Mich., and Ayanna Pressley, D-Mass.

The bill would, in part, “place a prohibition on the use of facial recognition technology by federal entities, which can only be lifted with an act of Congress” and “prohibit the use of federal dollars for biometric surveillance systems.”

“Every American who values their right to privacy, stands against discrimination, and believes people are innocent until proven guilty should be concerned about facial recognition technology fueling a national surveillance state,” Merkley said in a statement. “Enacting a federal moratorium on this technology is critical to ensuring we can rein in inappropriate surveillance and protect our communities’ fundamental right to privacy.”

Safeguarding data collected by AI-powered cameras

Sen. Josh Hawley, R-Mo., announced on Wednesday that he is introducing legislation to create guardrails around the use of AI-powered cameras to protect Americans’ data that is collected by the technologies.

The senator’s measure comes after the Senate Judiciary Subcommittee on Crime and Counterterrorism — chaired by Hawley — held a hearing last month that examined the use of automatic license plate readers from companies like Flock Safety.

Hawley’s bill, the Stop Flock Abuse Act, would prohibit local governments from selling or sharing collected data with non-governmental third parties, prevent users from abusing access to the systems, preserve an audit log of network access and create data security and retention guidelines.

“AI-powered cameras produced by Flock and its competitors are tracking and creating digital footprints of everyday Americans — a nightmare for individual liberties unless Congress enacts meaningful rules and accountability,” Hawley said in a statement.

Holding AI firms liable for hacking incidents

Hawley and Sen. Chris Murphy, D-Conn., also announced on Thursday that they are introducing a proposal that would hold AI agent operators and developers criminally and civilly liable for instances in which their advanced models hack into other systems or networks.

The announcement came after Hawley chaired a Senate Homeland Security and Governmental Affairs Subcommittee on Disaster Management, District of Columbia and Census hearing on Wednesday that looked into instances where AI tools broke out of their testing environments and attempted to hack into other companies or networks, including websites hosted by federal agencies.

“Hacking is a crime, and when AI agents conduct dangerous cyberattacks, the corporations and executives responsible for those AI agents need to be held accountable,” Murphy said in a statement. “Our bipartisan bill forces the heads of big AI companies to develop responsibly or face prison time for the damage done by their products to everyone else.”

Prohibiting human-like chatbots from interacting with minors

House lawmakers introduced a measure on Thursday that would prohibit AI chatbots from communicating by default in a human-like manner with minors, including through the use of simulated emotions or relationship-building responses.

The bipartisan bill is sponsored by Reps. George Whitesides, D-Calif., Mike Kennedy, R-Utah, Doris Matsui, D-Calif., and Mariannette Miller-Meeks, R-Iowa.

The legislation would, in part, require that chatbots engaging with children refrain from claiming to be human or pose as “credentialed professionals like doctors or counselors,” periodically state that they are not real and do not “guilt-trip” children into continuing to chat with them. The proposal also calls for the National Institute of Standards and Technology to work with industry and academic partners “to develop testing standards and examples of compliant behavior, and companies that follow the guidance won’t be penalized.”

The lawmakers noted that their measure would not affect products or features for adults and would also not require age verification.

“Parents should not have to worry that an AI chatbot is pretending to be their child’s friend or encouraging them to form an emotional attachment to a machine,” Miller-Meeks said in a statement. “The Protecting Kids from Human-Like Chatbots Act puts parents in control and makes sure AI chatbots used by minors are designed to function as tools, without forming fake relationships. This bill is about giving families peace of mind and making sure new technology serves our children without trying to replace real human relationships. Protecting our kids is a priority we should all share.”

Keeping data centers off federally-owned public lands

Sen. Ron Wyden, D-Ore., introduced legislation on Wednesday that would ban the construction of data centers on federally-owned public lands. The measure would also cover the sale or transfer of relevant public lands for the development of new data centers and related infrastructure.

“Public lands belong to the taxpayers, not corporations, and especially not [President] Donald Trump,” Wyden said in a statement. “If there’s one thing I’ve learned during my time in public service, it’s that when you come for Oregonians’ public lands, you’ll have hell to pay. My legislation is the ironclad path to ensuring that Trump – or any future administration – cannot hijack our treasured public lands to build data centers that use up water resources and jack up energy costs.”

More transparency in data center use and development

Sens. John Curtis, R-Utah, and Lisa Blunt Rochester, D-Del., also introduced two measures focused on enhancing transparency around the construction of new data centers.

One proposal, the Data Center Community Empowerment Act, would create a program within the Energy Department to provide technical assistance to state, local and Tribal governments on the potential impacts of data center development in their regions, create a “Data Center Community Toolkit” and provide independent project analyses for interested communities.

The second bill, the Data Center Transparency Act, would similarly require that the Environmental Protection Agency and Energy Information Administration collect and update information related to the environmental impacts and resource uses of data centers.

“Americans are rightly skeptical when a large company tells them not to worry about the impacts of a new data center in their community,” Curtis said in a statement. “The answer to that distrust is transparency. Communities deserve independent, reliable information about what these projects mean for their power bills, water, infrastructure, and local economy. These bills give local leaders the facts and expertise they need to ask tough questions and make informed decisions — without Washington or industry making those decisions for them.”

Establishing an AI Safety Board

Sens. Mark Warner, D-Va., Brian Schatz, D-Hawaii, and Andy Kim, D-N.J., introduced legislation on Tuesday that would create an Artificial Intelligence Safety Board within the Commerce Department to convene representatives from agencies across government — including from the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the Treasury Department — to evaluate emerging AI risks. This board would also develop enforceable safety and security standards for the most advanced AI tools.

The measure, in part, would also create a national AI incident database, require AI companies to report serious safety and security incidents within certain timeframes and create “ secure federal testing environments that can use resources at the National Security Agency and Department of Energy National Laboratories to conduct sensitive pre-deployment testing of frontier models.”

In a statement ahead of the bill’s formal introduction, Schatz said the proposal “is about making sure humans remain in control of AI models and preventing future breaches with rigorous standards, testing, and oversight. Immediate risk requires immediate action.”

Creating new federal oversight of data collection

Sen. Kirsten Gillibrand, D-N.Y., also reintroduced a bill on Wednesday that would stand up a new federal agency to help protect Americans’ data.

Gillibrand’s measure, the Data Protection Act, would also limit the collection, sharing and use of personal data; provide oversight of high-risk data practices and data collection for commercial purposes; maintain a public list of data aggregators; and examine “the social, ethical, economic, and civil rights impacts of data collection practices.”

In a statement, Gillibrand said her measure would “create an independent federal agency to protect data and privacy, equipped with the resources to give Americans the meaningful protection they deserve.”

Creating a centralized website of public HHS data

Rep. Cliff Bentz, R-Ore., also introduced legislation on Monday that would direct the Department of Health and Human Services to establish “a centralized repository of all publicly available data.”

The congressman said his measure is designed to provide easier access to HHS’ collection of public information that is currently broken down into “tens of thousands of distinct data sets across multiple websites.”

In addition to directing HHS to create a centralized website where all of the public data can be accessed, HHS would be required to report to Congress on the types of datasets that are available, how frequently they are updated and the barriers that prevent publication of the information.

“We all want to improve our healthcare system, and access to data is absolutely essential to these efforts,” Bentz said in a statement. “My Public Access to HHS Health Data Act will help all groups more quickly access this essential information.”

]]>

Transportation works to ease fears about new AI air traffic control tool

Edward Graham — Fri, 02 Oct 2026 17:24:00 -0400

The Transportation Department’s request to receive an additional $30 billion from Congress to push its massive air traffic control modernization project across the finish line would include new funding to finish overhauling existing IT systems and deploying new artificial intelligence capabilities.

Reactions to the recent rollout of new AI capabilities at Washington, D.C.-region airports, however, have underscored some of the broader national concerns about relying more on advanced technologies, with officials having to go out of their way to ease worries about the tools.

Transportation and the Federal Aviation Administration, which is overseeing the ambitious effort to modernize management of U.S. airspace, announced on Sept. 21 that they officially rolled out a new AI-powered tool for Ronald Reagan Washington National Airport, Dulles International Airport and Baltimore/Washington International Thurgood Marshall Airport that combines 200 different data streams into one system that can provide better flight traffic management.

FAA said at the time that the Strategic Management of Airspace, Routes and Trajectories — or SMART — tool synthesizes information like flight paths and weather patterns “to provide a comprehensive visualization of where planes are going, how much traffic the system can handle, and where congestion or weather could cause challenges.”

During a Monday press conference announcing the department’s request for $30 billion, Transportation Secretary Duffy cited SMART’s recent deployment and said it is “giving different tools to be predictive in what we not just see at this moment, but what we see in the future, because we want to deliver better for the American people, reduce their delays and reduce their cancelations.”

Duffy added, however, that while new tools like SMART can help enhance air traffic control management, the FAA's continued reliance on outdated systems means that more underlying tech modernization efforts are needed.

“I can operate SMART on that old operating system, but I want a new operating system so I can give new tools to the air traffic controllers,” he said.

Despite Transportation’s excitement about further deployments of the SMART tool, the fact that it is AI-powered has led to some unease from lawmakers and others.

Last month, prior to SMART’s rollout, Politico reported that airline industry officials had been “panicking” about the tool’s integration with other air traffic control systems before the FAA ultimately alleviated their concerns about the new capability.

Rep. Don Beyer, D-Va., who represents the congressional district in which Ronald Reagan Washington National Airport is situated, expressed similar concerns and released a statement the day the SMART tool was set to be deployed that called for its impending rollout to be suspended, saying that “the FAA should not use my constituents as guinea pigs for an unproven AI air traffic control system.”

In an interview with Nextgov/FCW following SMART’s rollout at the D.C.-area airports, Beyer referenced growing global concerns about the capabilities of more advanced AI models and said his office received feedback expressing similar misgivings about the tool’s deployment.

“If it was just the constituents it would be one thing, but then the air traffic controllers were jumping in saying, ‘Hey, we don't know anything about this. We've not been part of the design. We didn't see anything ahead of time. We found that at the same time you did that it’s going to suddenly be made operational,’” he said.

Beyer said he subsequently spoke with FAA Administrator Bryan Bedford to share his concerns and had “a good conversation” with him about the SMART tool, including how it was created.

In a statement to Nextgov/FCW, the National Air Traffic Controllers Association said it “has not been involved in the design, testing or implementation of SMART and therefore cannot speak to its effect on the air traffic control workforce at this time.”

But Beyer said Bedford was reassuring and told him that the tool was designed by air traffic controllers who aren't in the towers right now but are the “30- and 40-year guys who've been doing it all their lives.” He added that Bedford also said SMART is operating at the D.C. region’s Terminal Radar Approach Control facility in Warrenton, Virginia, and not within the towers at Dulles or National airports.

“I think the feedback was you almost need big, busy airports in order to generate enough information to make AI relevant,” Beyer said about SMART first being deployed for the large airports in the Washington, D.C. region, instead of being piloted at smaller airports.

He added that he told Bedford “it would have been good to explain that to the American public,” particularly given the current global discussion around new AI capabilities.

In response to a request for comment, Transportation pointed to a Sept. 22 tweet from Duffy, in which he reposted Beyer’s release expressing concerns about the tool’s deployment and wrote: “Here’s the truth: HUMANS still control the airspace and HUMANS still make the calls. With SMART, we are giving air traffic controllers new technology and better data to make critical decisions.”

In a Fox News clip that was shared with the post, Duffy called SMART “a tool that’s used to better manage traffic” and said air traffic controllers “are the ones who will always manage airspace.”

Recent high-profile incidents where frontier AI models have taken undirected action — including one case in which OpenAI agents escaped from their testing environment and hacked into Hugging Face on their own volition — have exacerbated concerns from tech executives, lawmakers and others about whether guardrails are needed on advanced AI technologies.

President Donald Trump has been vocal about his desire to not overregulate the AI sector to ensure that the U.S. continues to outpace China in development of the technologies.

Duffy has previously drawn a distinction between the frontier models that have raised alarms from some sectors and the AI tools being used to help modernize the nation’s air traffic control systems.

During an event hosted by the National Artificial Intelligence Association in Washington, D.C. last month, Duffy said the air traffic control system upgrades are “going to be driven not by the most complicated AI, but AI that will provide information to [controllers], and will, I think, have a huge impact on the flying public.”

He also stressed that AI capabilities will never replace human air traffic controllers — a sentiment that the National Air Traffic Controllers Association similarly expressed.

“NATCA believes any new technology should complement and not replace the experience, training, and professional judgment of air traffic controllers who are responsible for the safety of the National Airspace System,” the association said.

]]>

Tax chief pushes 'AI-first IRS' to get more out of agency's workforce

Jory Heckman — Fri, 02 Oct 2026 10:54:00 -0400

The IRS is looking to move more aggressively to adopt artificial intelligence tools, with the goal of being more responsive to taxpayers seeking help – while also ensuring individuals and businesses pay what they owe the tax agency.

IRS Chief Executive Officer Frank Bisignano told employees in an all-staff meeting Wednesday that an “AI-first IRS” will make its workforce more productive, after the agency cut more than a quarter of its headcount under prior leadership last year. He said AI won’t replace IRS employees' jobs, but will “deliver larger collections and better client service to the American public.”

“It has the benefit of improving every employee's job. It is not designed to eliminate jobs," Bisignano said, according to a transcript and audio recording obtained by Government Executive.

Bisignano and other senior IRS officials said greater adoption of AI tools will also reduce wait times for taxpayers, and shrink the “tax gap” between the revenue the IRS collects every year, and the amount individuals and companies actually owe.

The IRS cut tens of thousands of jobs last year — more than a quarter of its workforce — and fell short of its hiring goals for this year’s filing season. Bisignano told lawmakers the IRS carried out a successful filing season this year, despite losing more than 25,000 employees.

He told employees that IRS has “added to the ranks of the workforce,” and is focused on “getting more tech out the door.”

“I feel good about where staffing is, and anybody who reports to me always submits whatever they need to get the resources they need,” he told employees.

IRS Chief Human Capital Officer Alex Kweskin said the IRS made more than 4,000 hires this year, but that when accounting for retirements and attrition, the agency’s headcount remains mostly unchanged.

“Our headcount started the year at 74,000, and we are ending the year at 74,000. It's remained effectively flat all year long,” Kweskin said, adding that the agency will “continue to hire” ahead of the filing season.

Former IRS Commissioner Charles Rettig, Trump’s first-term pick to run the agency, told lawmakers in 2021 that the tax gap could be as much as $1 trillion a year, and that the agency is often too “outgunned” in terms of staffing and resources to go after tax cheats.

“When you think about the tax gap, obviously our ability to do a better job there through technology will be big,” Bisignano said. “Five years from now, I mean, if you look at the speed of change, what I see is an IRS that has a mid-90s compliance rate,” he said.

The IRS' most recent estimate of the voluntary tax compliance rate is about 85%. The New York Times recently reported that the IRS, under the second Trump administration, has fallen behind on producing annual tax-gap estimates. The IRS last estimated in October 2024 that about $700 billion in taxes owed went uncollected in 2022. The Yale Budget Lab estimated that last year’s staffing cuts resulted a $861 billion decrease in revenue collected by the IRS.

The IRS all-staff meeting came a day after the Trump administration unveiled America.gov, a website that uses an AI chatbot to point users to services provided by federal agencies. At the event, President Donald Trump signed an executive order mandating that agencies ensure public-facing services integrate directly with America.gov as soon as possible.

Bisignano spent much of last year rolling out his playbook for a “digital-first IRS,” focused in part on reducing the total number of phone calls the IRS receives, and instead moving taxpayers onto online, self-service platforms.

The IRS recently rolled out a new mobile app, which Bisignano described as a “great example of work we're doing to meet taxpayers where they want to be met.”

The IRS had a busier time than usual preparing for last year’s tax filing season, because of changes from Trump’s One Big, Beautiful Bill Act. But next filling season will be even more complicated, because more tax filing changes from the legislation will go in effect starting in 2027.

“This year for filing season ‘27, it is twice as complex,” IRS Chief Information Officer Kaschit Pandya told employees. “We have twice as many provisions to implement for filing season ‘27 than we did for filing season ‘26.”

Pandya said the IRS is already using AI to process amended tax returns more quickly. The agency receives about 5 million amended tax returns annually, and that the IRS is using AI to accelerate the processing of “hundreds of thousands” of returns.

The IRS in February put about 1,500 IT and human resources employees on involuntary details to frontline taxpayer service jobs. Among their duties, employees were directed to help reduce a “huge backlog” of amended tax returns.

Pandya said that previously, an amended individual return “might take multiple weeks to process.”

“[The] average time can be 12, 14, 16 weeks. Through AI and automation, we have seen that go down to under three days,” he said.

]]>

GSA memo to set AI-specific acquisition rules

Christian Robles — Thu, 01 Oct 2026 19:04:00 -0400

The General Services Administration is adjusting its acquisition regulation to include language aimed at protecting government data that contractors process in large language models.

Buried on page 129 of an agency memo signed by GSA Senior Procurement Executive Jeffrey Koses is a section titled “Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems.” The section details what data protections contractors and subcontractors must include when their LLMs process government data.

For example, the rules state contractors cannot use government data to train LLMs, inform advertising or sell to a third party. Contractors must also implement data handling procedures, including encrypted data transmission and audit logging systems. The memo clarifies the language does not apply to LLMs that contractors use internally for business purposes or products where the LLM functionality is “incidental to” its primary purpose.

The memo is originally from January, but states GSA signed off on the section with the LLM acquisition language in July and that it takes effect on Oct. 19.

GSA had sought to enact a similar draft LLM acquisition rule through a public comment period but ran into intense pushback from industry groups even after a round of modifications. Several stakeholders welcomed the memo’s take on LLM acquisition safeguards.

"GSA’s final AI terms and conditions mark a significant improvement from prior draft versions, and establishes a stronger foundation for safeguarding government data in AI systems,” Quinn Anex-Ries, a senior policy analyst at the Center for Democracy and Technology, said in a Thursday statement.

Anex-Ries praised the rule for “almost entirely” removing language requiring contractors to adhere to “unbiased AI principles.” That language was one of the most controversial provisions of GSA’s draft rule, with some industry groups warning the agency there’s no clear way to test for compliance.

“The AI clause changed in ways industry asked for. It self-deletes when LLM use stays inside the contractor's own back-office systems, or when LLM functionality is incidental to a product the Government isn't using for AI. Flowdown reaches only subcontractors who design, develop, deploy or operate the model,” Kevin Martin, GSA program manager at Government Acquisitions Inc, wrote on LinkedIn.

However, “the workload that remains is still substantial for anyone whose product has LLM functionality in scope: a 120-day disclosure deadline, 72-hour incident reporting, deletion of embeddings and fine-tuned weights at closeout, 30 days of notice and concurrent access before a major model swap, and Government rights to benchmark the deployed model for bias and truthfulness,” he added.

]]>

AI firms should be held liable for their models’ actions, lawmakers say

Edward Graham — Thu, 01 Oct 2026 17:10:00 -0400

Amid a rise in public concerns about the dangers posed by advanced artificial intelligence — and the Trump administration’s ongoing opposition to imposing new regulations on the U.S. technology sector — lawmakers from both parties are signaling their openness to expanding liability laws for frontier AI firms that do not sufficiently police their models.

During a Senate Homeland Security and Governmental Affairs Subcommittee on Disaster Management, District of Columbia and Census hearing on Wednesday, Chairman Josh Hawley, R-Mo., expressed concern about “the accelerating number of attacks” across the world that are linked to advanced AI models operating outside the bounds of their directives and said that steps need to be taken to hold the developers of these models accountable.

Hawley launched a committee probe last month to investigate details of one of the more notable cases, in which OpenAI agents escaped their testing environment and hacked into Hugging Face on their own volition.

“At the end of the day, they're a product,” Hawley said about the advanced AI models. “And if you make that product in a reckless kind of way, and … these AI agents cause significant harm and damage — they crash a hospital ER, they shut down a bank so that folks can't get their money — if that happens, then it's the people who made it who should be responsible.”

President Donald Trump and White House officials have been vocal about their desire to not overregulate the AI sector, pointing to China’s competing AI ambitions as a reason that the U.S. needs to allow frontier model developers to continue to innovate unabated.

The panel hearing came after the White House held a meeting with tech executives on Tuesday, in which Trump and the gathered leaders signed a voluntary accord outlining how they would implement internal safety controls.

Despite his conservative bona fides, Hawley has not been afraid to break with Trump when it comes to advancing antitrust measures on the tech industry or pushing for more regulatory guardrails for the sector. The senator said on Wednesday that “it's time to talk about what we're going to do to hold the companies, the product makers accountable.”

Hawley’s office announced on Thursday that he and Sen. Chris Murphy, D-Conn., are introducing legislation that would hold AI agent operators and developers criminally and civilly liable for instances in which their advanced models hack into other systems or networks.

Hawley outlined the proposal in an opinion piece published in The Washington Post on Tuesday, writing that the measure would force AI companies to “give more thought to protecting Americans’ rights, to protecting their data, and to keeping their AI agents under control.”

Democrats also said during Wednesday’s hearing that more needs to be done to make AI firms accountable for the actions of their models.

Sen. Richard Blumenthal, D-Conn. — who introduced legislation with Hawley last September that would empower the Energy Department to track AI safety concerns — said the voluntary accord Trump signed with tech executives doesn’t go far enough, since companies wouldn’t need to publicly disclose any violations found by internal auditors and can cease cooperating with the pledge at any time.

“I consider this regimen to be worse than ineffectual,” Blumenthal said. “In effect, it accomplishes nothing, but it seems to give Congress a free pass. In other words, ‘it’s taken care of, don’t worry. We have this morally binding pledge.’”

Although Trump officials have argued that any issues arising from uses of AI can be addressed through existing laws, Sen. Ruben Gallego, D-Ariz., noted during the hearing that “unless we actually change the word ‘intent’ to actually cover AI companies, they may also still be shielded from liability.”

Gallego also raised some issues that might still need to be addressed when it comes to the future abilities of more advanced AI models: ”What happens when an AI agent tells another agent to hack? Who is responsible? Is it the original AI developer of that AI agent?”

Paul Ohm, a professor of law at the Georgetown University Law Center who appeared as a witness before the panel, said “I don't think the tort system alone can bear everything we need to do, but I think it's a great place to start.”

]]>