Internal disputes within the White House are hindering the progress of AI regulation in the U.S. following the Mythos incident.

      A three-way internal conflict involving the Commerce Department, intelligence agencies, and pro-industry factions has stalled federal AI regulation in the U.S. In the last moments, Trump canceled an executive order, announcements regarding CAISI testing were removed from NIST’s website, and no regulatory framework is in place weeks after Mythos showcased offensive cybersecurity abilities.

      The Trump administration is currently embroiled in an internal struggle over AI regulation, leading to a standstill in federal AI policy at a critical juncture. Three groups are vying for dominance: the Commerce Department, which has been quietly forming civilian testing partnerships with AI firms; national security officials pushing for intelligence evaluations of advanced models prior to release; and pro-industry advisors warning that regulations could hinder American AI leadership. Those involved have likened the situation to a “knife fight.”

      The paralysis became evident in May. On May 5, the Center for AI Standards and Innovation, part of the Commerce Department’s National Institute of Standards and Technology, revealed pre-deployment testing agreements with Google DeepMind, Microsoft, and Elon Musk’s xAI. Shortly after, the announcement was taken down from NIST’s website without explanation, and CAISI staff were instructed to remove the page but were not informed as to why.

      The unrealized executive order

      The dysfunction escalated on May 21 when Trump unexpectedly canceled the signing of an executive order intended to formalize government collaborations with top AI companies for reviewing cutting-edge models before they were made public. The signing ceremony was abruptly called off, with Trump expressing concerns that the order might “dull America’s edge on AI technology.”

      The order had been in development for several months. Axios obtained a draft, which would have set a framework for safety evaluations before the release of advanced AI models, formally empowered CAISI, and established reporting requirements for companies creating powerful systems. Allies in Silicon Valley within the administration opposed the order, arguing it would mirror the regulatory strategy of Biden’s AI executive order, which Trump had rescinded on his first day in office.

      The Mythos influence

      The internal dispute has been exacerbated by Anthropic’s Mythos model, which identified over 10,000 zero-day vulnerabilities across major operating systems and web browsers. The model's ability to autonomously uncover and exploit software flaws raised alarms among national security officials, who contend that AI systems capable of such offensive cybersecurity functions should be assessed by intelligence agencies prior to release, as opposed to civilian bodies.

      The Office of the National Cyber Director has suggested the creation of a large AI evaluation center under the Office of the Director of National Intelligence, aiming to provide intelligence agencies with a greater role in AI policy. This proposal emerges amid the Pentagon's supply-chain risk designation of Anthropic, stemming from the company's refusal to allow military unrestricted access to its models.

      Officials from the Commerce Department have resisted this, arguing that locating AI evaluations within the intelligence community would deter companies from cooperating voluntarily and turn safety testing into a national security issue that other nations might perceive as weaponization. They maintain that a civilian testing approach is the only method that preserves trust with the AI industry while still allowing the government to gain early insights into advanced capabilities.

      The regulatory gap

      The result of this infighting is a lack of new federal AI regulations in the U.S., weeks after Mythos exhibited capabilities that would have prompted immediate regulatory responses in most other developed nations. The European Union’s AI Act is set for full enforcement in August 2026, granting European regulators powers over AI systems that the U.S. government currently does not possess.

      This disparity is not lost on industry stakeholders. AI companies have expressed concerns about excessive regulation in Europe, but the absence of a coherent U.S. framework presents its own challenges. In the absence of clear federal guidelines, states are formulating their own AI laws, leading to a confusing array of requirements for companies, with the government lacking a formal mechanism to assess models before deployment, even when those models can uncover thousands of exploitable vulnerabilities within critical infrastructure.

      Trump’s repeal of Biden’s AI executive order, which had instituted reporting thresholds for the most advanced AI models, removed the only existing federal structure. The administration's rationale was that Biden’s approach was overly stringent and would hinder innovation. Sixteen months later, a replacement framework has yet to emerge, and the internal factions show no signs of achieving consensus.

      What comes next

      The halted executive order might be revived in a weakened form, or the administration may adopt a more limited strategy centered on voluntary commitments from AI companies instead of formal pre-release evaluations. Anthropic’s own Project Glasswing, which allows vetted organizations to access Mythos for cybersecurity tests, effectively acts as a private-sector alternative to the government evaluation program that currently lacks consensus.

      Ironically, the administration’s pro-innovation rhetoric, intended to give American AI companies an edge over more heavily regulated European and Chinese competitors, has created a policy void, leaving the government unable to effectively respond to this year's most significant demonstration of AI capabilities. The internal conflict continues,