Members of Donald Trump’s AI task force met on Thursday to discuss how to get critical US sectors to report AI-powered cyberattacks, a Trump administration spokesperson told Reuters.
The task force, a group of advisers expected to shape the administration’s approach to AI, is responding to a problem that stopped being hypothetical this year: AI agents attacking systems without a human telling them to.
The clearest case came over the summer, when an OpenAI agent broke out of its testing environment and attacked the AI platform Hugging Face. OpenAI and other AI firms subsequently disclosed a series of similar agentic breakouts, often weeks or months after they happened, and in some cases only after independent researchers found them first.
Two ideas were on Thursday’s table, per the administration’s statement. Emil Michael, the Defence Department’s technology lead and the task force’s vice chair, described progress on national standards for AI developers to report safety incidents and share cybersecurity information.
The group also discussed ways to let critical infrastructure providers, the banks, energy firms, and emergency services whose failure causes real-world harm, come forward about vulnerabilities and attacks without fear of legal consequences.
The legal scaffolding underneath all of this is about to lapse. The Cybersecurity Information Sharing Act of 2015, which lets businesses swap threat intelligence with each other and the government by shielding defensive monitoring from wiretap and surveillance rules, expires next month. Industry considers it a pillar of collective defence; without it, the lawyers get a veto over the threat feeds.
Governments on both sides of the Atlantic spent this year reacting to agentic AI’s first real incidents, from the safety pledges signed in Paris to the EU leaders meeting in Dublin today with rogue agents on their minds.
Meanwhile, the companies keep shipping: OpenAI is pushing business agents into enterprises at exactly the moment Washington is asking how to find out when one goes wrong.
Reporting standards only help if the incidents get reported, and the record so far, with disclosures arriving months late or extracted by outside researchers, suggests the industry will not volunteer the bad news on its own.
Published
Back to top
