Nextgov/FCW - All Content

Oversight and program management gaps slowing VA’s benefits processing system modernization, OIG says

Edward Graham — Tue, 11 Aug 2026 18:45:00 -0400

Efforts to modernize a Department of Veterans Affairs system that supports the processing of veterans’ benefits claims have been hampered by “insufficient oversight and weak program management,” according to the agency’s Office of Inspector General.

The watchdog warned in an audit released on Tuesday that VA’s Office of Information and Technology has not taken all of the necessary steps to keep the revamp of the agency’s Benefits Enterprise Platform on track, which could potentially affect the processing of veterans’ benefits and other modernization efforts.

The BEP platform — one of 85 legacy systems that VA has identified as needing to be modernized or decommissioned to “improve overall efficiency of claims processing” — helps facilitate the sharing of information between the Veterans Benefits Administration and other “business line systems” that include pension, vocational rehabilitation and employment benefits.

VA awarded Booz Allen Hamilton a $1.1 billion contract in May 2021 to integrate its benefits systems into a new cloud-based Benefits Integration Platform, with the plan calling for the legacy BEP system to be migrated to this new service and then subsequently decommissioned. Although the contract was supposed to be completed this month, OIG noted that the latest timetable from VA said the BEP modernization effort is now slated to be completed in the second quarter of fiscal year 2034.

"Because BEP supports a significant number of systems, there is increased risk that other systems relying on it may experience negative consequences from potential delays in the modernization effort,” the report said.

The audit said the Office of Information and Technology failed to develop “a high-quality, reliable program schedule as recommended by the Government Accountability Office’s Schedule Assessment Guide” for the project and has instead relied on an agile project management tool for the effort — a tool that “does not contain roadmaps or detailed plans for the entire scope of the project.”

OIG also found that the office lacked a reliable lifecycle cost estimate for the modernization initiative, which has resulted in inconsistent funding information being included in various BEP plans and has “limit[ed] VA’s ability to make informed decisions.”

Lack of proper oversight, the watchdog reported, also may have jeopardized the security of veterans’ sensitive personal data when the office “hosted minor applications without conducting required security assessments.” After OIG notified VA officials about documented vulnerabilities — some of which dated as far back as 2021 — the watchdog said VA took the necessary steps to assess the security of its applications and remediate any identified issues.

OIG’s audit recommended that VA take steps to enhance its BEP modernization efforts, including by developing and maintaining a program schedule that aligns with best practices, ensuring that staff are following proper procedures when it comes to storing scheduling information, developing a “reliable, validated life cycle cost estimate” for the project and tracking all relevant project costs. VA officials said they concurred with the watchdog’s recommendations.

The BEP project is just the latest VA modernization initiative to be singled out for criticism by OIG for resulting in significant delays, cost overruns and oversight gaps.

VA is still in the process of developing a new digital GI Bill system, which the watchdog noted in an August 2024 report has seen its cost more than double as a result of “insufficient planning.”

The agency’s large-scale electronic health record modernization project has also been plagued by cost overruns, delays and oversight issues since the deployment effort began in earnest in 2020. The Trump administration has prioritized righting that effort, however, and VA Secretary Doug Collins said earlier this year that an EHR rollout resumption push has been “phenomenal” so far.

]]>

Trump admin delays TANF data sharing plan opposed by blue states

Christian Robles — Tue, 11 Aug 2026 17:43:00 -0400

The Trump administration pushed the effective date for a proposal allowing the Administration for Children and Families to share Temporary Assistance for Needy Families — or TANF — recipients’ information with other federal agencies to Sept. 1, according to a Federal Register listing posted last week.

Without the extension, the policy shift was set to kick in Tuesday, according to another Federal Register notice.

The delay comes as a coalition of Democratic attorneys general is requesting a federal district court vacate ACF’s proposal and declare it unlawful, according to an Aug. 3 filing.

The coalition alleged ACF could illegally share millions of TANF recipients’ Social Security numbers, marital status, income and other sensitive information with the Department of Homeland Security and other agencies if the Trump administration has its way.

That data sharing “will erode the trust that State agencies have developed with TANF recipients and will deter qualified beneficiaries from applying for TANF benefits, forcing Plaintiff States to spend more of their own money to ensure that families are housed and children do not go hungry,” the coalition said in the lawsuit filed in the U.S. District Court for the District of Columbia.

“If ACF can proceed with sharing TANF data with DHS, without clearly defined purposes and limits required by federal law, then community fears that DHS will use that data for other purposes will impede that public trust and chill participation in State TANF programs by citizens and qualified non-citizens alike,” the coalition added.

The group of attorneys general alleged that the administration’s data sharing plan is “arbitrary and capricious” under the Administrative Procedure Act. The coalition also claimed it violates the Constitution’s Spending Clause because states “could not have foreseen these potential uses and disclosures years ago when they collected and shared this data with ACF.”

An ACF spokesperson did not return a request for comment by the time of publication. The administration wrote in the Federal Register that its TANF data-sharing policies are designed to curtail fraud and ensure compliance with TANF requirements, such as verifying recipients’ immigration status.

A public comment period for the TANF proposal closes Tuesday. The federal government gave states and the District of Columbia nearly $16.5 billion in TANF block grants in fiscal 2024, according to the Congressional Research Service.

]]>

How OneGov is changing CACI's contractor role

Ross Wilkers — Tue, 11 Aug 2026 17:00:00 -0400

CACI International counts as business partners many of the same brand name technology companies that the U.S. government wants to have more direct relationships with, especially licenses for enterprise software platforms.

During CACI’s fiscal fourth quarter and year-end earnings call with investors Thursday, chief executive John Mengucci described that shift as having a “small revenue impact” and one resulting in “more positive margins.”

The General Services Administration’s OneGov initiative for unified technology procurements is the highest-profile example of how the government is seeking more direct relationships with commercial providers, including contracts for the product itself and associated licenses.

GSA is looking to obtain savings through volume discounts of tech products it believes can essentially be purchased in bulk and in a more consolidated manner and wants to do so on behalf of other agencies.

“Customers traditionally repurpose those savings right back to CACI, that gives us an ability to deliver additional capabilities,” Mengucci said.

Mengucci said that under the traditional model of integrators like CACI as primes, revenue was often reduced by the value of the licenses from the enterprise software providers. That revenue often provided CACI with “little-to-no margin,” he added.

CACI is experiencing the shift of who the prime contractor is firsthand in Federal HR 2.0 – the Office of Personnel Management’s effort to overhaul the government’s human resource systems by consolidating them into a single platform.

Oracle won the 10-year, $395.8 million contract over the summer and has enlisted CACI as a key teammate for the program alongside Baker Tilly and Deloitte. The core implementation will be based off of Oracle Fusion Cloud HCM.

In talking with analysts, Mengucci described the partial role-reversal of who the prime is as one of merely changing the order of things.

“What the OEMs (original equipment manufacturers) don't want, and generally aren't able to deliver, is the full implementation,” Mengucci said. “The government is going to them for the licensing first and then we are partnering with those folks.

“We've been in partnerships with them over the last eight-to-10 for a lot of those large enterprise tech jobs that we've put out there,” Mengucci added.

Fourth quarter revenue of $2.7 billion was 17% higher than the prior year period with an organic growth rate of 11%, while profit of $353.1 million showed a 33% year-over-year increase in EBITDA (earnings before interest, taxes, depreciation and amortization).

Full fiscal year 2026 revenue of $9.6 billion was 10.9% higher than the prior year period with an organic growth rate of 7.2%, while EBITDA of $1.2 billion showed a 21% year-over-year increase from FY 2025. CACI ended fiscal 2026 with an EBITDA margin of 12.3%, up from the prior year’s 11.2%.

CACI’s initial guidance for its 2027 fiscal year, which started July 1, pegs revenue in the range of $10.65 billion-to-$10.85 billion on an EBITDA margin in the high-12% range.

]]>

DHS wraps up Oracle's Cumulus cloud contract

Ross Wilkers — Tue, 11 Aug 2026 15:32:00 -0400

The Homeland Security Department has entered into the second out of four planned awards under Cumulus, a centralized mechanism for acquiring commercial cloud computing services across the entire organization.

Oracle’s portion of the potential five-year contract has a ceiling value of $567.9 million, DHS said in a Friday notice to Sam.gov. This follows DHS’ finalization in June of the award to Amazon Web Services, which is eligible for up to $2.5 billion under Cumulus.

DHS first laid out its intended timeline for wrapping up each Cumulus contract with all four of the hyperscalers, with awards to Google Cloud and Microsoft still in-the-works. The department originally pegged the end of the calendar year’s second quarter as its deadline for finalizing each contract.

Each award under Cumulus will cover a one-year base period and up to four option years.

Cumulus is designed to have a blend of competitive and non-competitive awards across all aspects of commercial cloud including infrastructure-as-a-service, platform-as-a-service and software-as-a-service.

After DHS finalizes each hyperscaler contract, the department will then work on creating a separate multiple-award competition to support the Cumulus effort.

]]>

The government wants your help solving today’s biggest challenges

John Breeden II — Tue, 11 Aug 2026 14:36:00 -0400

A few years ago, I tried to help a team of astronauts survive a Martian dust storm.

Fortunately, nobody was actually in danger. I was participating in the second NASA MarsXR Challenge, a government-sponsored competition hosted on the HeroX open-innovation platform. NASA wanted members of the public to design virtual reality scenarios that could someday help train astronauts for missions on Mars.

The first phase focused on storyboarding, so participants did not need to know how to program a VR simulation. They needed to imagine a realistic challenge, explain how astronauts would respond and take advantage of the immersive capabilities offered by virtual reality. My team designed a scenario in which astronauts left their rover behind while collecting rock samples in terrain too rough for a vehicle. When a surprise dust storm swept into the area and visibility began to collapse, they had to navigate back to the rover using digital waypoints and beacons they had placed along their route.

It seemed like a plausible worst-case scenario and, admittedly, a pretty exciting video game mission. The design required astronauts to think ahead, use the available technology and remain calm when conditions suddenly changed. Our entry earned an honorable mention in the first phase. We did not advance to the programming round, where winning concepts could be developed into functioning VR training missions, but the experience gave me a firsthand look at how seriously NASA approaches open-innovation competitions.

NASA has used HeroX and the NASA Tournament Lab to solicit outside ideas for everything from virtual reality astronaut training to building better lunar rover wheels. Some of the most visible government-sponsored challenges over the past several years have naturally focused on space exploration.

But one of the most consequential challenges open in 2026 is aimed at a problem that is far more Earth-bound and deeply human. The National Institutes of Health’s Office of AIDS Research is offering $1 million in prizes for ideas that could help more people gain access to long-acting HIV prevention and treatment. The competition, called the NIH ARISE-HIV LAUNCH Challenge, is open for first-round submissions through Aug. 6.

Federal government involvement goes well beyond an agency endorsement for the HIV Challenge. The Office of AIDS Research is the official sponsor and is providing the $1 million prize purse. The NIH Office of the Director is conducting the challenge under the federal prize authority established by the America COMPETES Reauthorization Act.

The challenge is also part of a broader program called Advancing Research in Implementation Science to End HIV, or ARISE-HIV. That effort involves all NIH institutes, centers and offices that award HIV funding or support related prevention, care and treatment research. HeroX provides the public competition platform, and the challenge appears through the NASA Tournament Lab’s wider open-innovation network.

To be clear, the current contest is not asking participants to invent a new HIV medication. Scientists have already developed long-acting products that can prevent or treat HIV without requiring patients to take a pill every day. Some are administered every two months, while others can provide protection for as long as six months. The challenge is getting those advances to the people who need them and making sure they remain connected to care.

In an August 2025 post reflecting on her appearance with NIH Director Jay Bhattacharya on The Director’s Desk podcast, Office of AIDS Research Director Geri R. Donenberg described the gap the new challenge is trying to address.

“We have effective, lifesaving interventions, but people are not benefiting equally,” she wrote.

Donenberg explained that implementation science can help determine how, where and by whom effective treatments should be delivered to reach different populations. An approach that works well for patients in one community may prove impractical in another because of transportation, cost, staffing, stigma, scheduling or limited access to health care.

That is where the LAUNCH Challenge comes in. NIH is asking participants to develop actionable ideas in at least one of four areas: access, delivery, engagement or retention.

An access proposal might explore how mobile clinics, home-based services, street medicine or pharmacists could bring long-acting products to people who are not well served by traditional health care systems. A delivery proposal could address the staffing or coordination needed to administer injections safely and reliably. That might include evening appointments, transportation assistance, child care support or better integration with mental health and substance-use services.

Engagement proposals could focus on building awareness, understanding and trust among patients and their families. Finally, retention ideas might help patients remain on schedule and connected to care during the months between appointments. But those are just a few suggestions. By all means, if you have better ideas, feel free to participate in this new challenge and earn a share of the prize money.

NIH is deliberately casting a wide net looking for precipitants. Individuals, informal teams, community organizations, health professionals, researchers, universities and companies can all participate. People and organizations that do not currently receive NIH funding are specifically encouraged to enter as the agency is looking for fresh and new ideas.

The first-round submission for the ARISE-HIV Challenge is pretty approachable. Participants need to complete an online concept submission totaling about three pages. Participants must also provide a short public abstract and identify whether their proposal addresses access, delivery, engagement, retention or some combination of those areas.

Judges will place the greatest weight on public health significance and impact, which accounts for 40% of the score. Innovation and novelty make up 35%, while the remaining 25% focuses on whether the idea is pragmatic enough to work outside a controlled research environment. HeroX and government officials explained the judging process and the importance of the challenge in a recent YouTube video.

Completed Phase 1 entries must be submitted through HeroX by 5 p.m. Eastern on Aug. 6. NIH expects to award as many as 35 first-round prizes of $10,000 each. Those winners will be invited into Phase 2, where they will develop more detailed implementation and evaluation plans. Up to 13 second-round winners could receive approximately $50,000 each.

And this is a busy time for government sponsored and federally focused challenges as the HIV event is not the only one being opened to outside solvers. The Department of Energy’s Office of Electricity recently launched the $500,000 Storage Design Strategies to Ease Production Prize, known as the Storage Design STEP Prize. It asks developers of emerging grid-scale storage technologies to identify manufacturing, material-sourcing and supply-chain obstacles before those problems prevent promising designs from reaching commercial production. Phase 1 entries are due Oct. 8.

Another active competition, the privately organized GoAERO Prize, is supported by NASA, RTX, Boeing, Honeywell, Iridium and other partners. Teams for that challenge are actually building compact, portable aircraft that could autonomously carry a person or emergency supplies into areas where conventional rescue vehicles cannot easily reach. Its final fly-off will take place at NASA’s Ames Research Center in April 2027. The best overall performer can earn $1 million, with additional prizes for missions involving rapid deployment, difficult conditions and precise maneuvering around obstacles.

The live challenges are radically different, but they share the same underlying idea. Agencies and other sponsors describe a difficult problem, establish rules and rewards, then open the door to people who may never have encountered the issue through a conventional grant, contract or government job.

My Mars scenario never became a functioning astronaut-training mission. But earning an honorable mention showed that someone outside NASA could still contribute an idea the agency considered useful. The next valuable idea may come from a community health worker who understands why patients miss appointments, an engineer trying to manufacture a new kind of battery or an aviation team that knows how to reach people stranded after a disaster.

For readers with a useful perspective, technical skill or firsthand understanding of one of these problems, the invitation is real: take a look, join a team or submit an idea. You may not win the top prize, but you could still contribute something that advances a technology, helps an agency or improves someone’s life.

John Breeden II is an award-winning journalist and reviewer with over 20 years of experience covering technology. He is the CEO of the Tech Writers Bureau, a group that creates technological thought leadership content for organizations of all sizes. Twitter: @LabGuys

]]>

Federal agencies quietly joined health data superhighway governing council

Christian Robles — Mon, 10 Aug 2026 17:37:00 -0400

Officials with the Consumer Product Safety Commission, Social Security Administration and Indian Health Service were added to the governing council for a federal initiative designed to facilitate the exchange of health data in June, Nextgov/FCW has learned.

The council’s recent additions highlight how agencies are increasingly eyeing participation in the initiative — known as the Trusted Exchange Framework and Common Agreement, or TEFCA — to obtain digital health records that would help quickly process disability claims, track consumer safety issues and improve medical care.

The new federal representatives on the TEFCA governing council are:

Brien Lorenze, executive director of CPSC
Sean Fry, executive advisor of health information technology and electronic records in SSA’s office of disability policy
Bobby Villines, acting director of the division of information technology within IHS’ office of information technology

The TEFCA website was updated Monday afternoon to list the governing council members, including federal representatives, after Nextgov/FCW inquired about new representatives. The governing council saw the federal members added in June, according to a spokesperson for the Department of Health and Human Services’ Office of the National Coordinator for Health Information Technology.

The governing council is tasked with monitoring health data exchanges, reviewing potential updates to the superhighway and helping resolve contentious cases of health information sharing, according to TEFCA rules.

The rules state that up to five individuals affiliated with a federal agency can sit on the governing council. The governing council can be expanded to include more federal representatives.

The ability for members to vote on the governing council depends on whether their agency is “actively involved in or enabling TEFCA exchange,” according to the rules. CPSC’s representative is a nonvoting member on the governing council.

How the agencies are leveraging TEFCA

The three agencies with new representatives on the TEFCA governing council are actively eyeing the health data sharing initiative to support agency procedures. Some are already receiving data through TEFCA.

In February, SSA announced it joined TEFCA to speed up disability benefits processing by more than 50% in some cases. Health systems using Epic electronic health records have already begun to digitally send SSA health information through TEFCA.

SSA has long pulled medical records through other health data superhighways known as Carequality and eHealth Exchange, but TEFCA has enabled additional hospitals and clinics using Epic electronic health records to send health information to the federal government, according to Epic. SSA specifically chose eHealth Exchange as its Qualified Health Information Network, or QHIN, which is essentially an onramp to the broader TEFCA superhighway.

An SSA spokesperson did not return a request for comment on the agency’s participation in the governing council.

In July, CPSC announced it will leverage a QHIN, Konza Health, to update its National Electronic Injury Surveillance System, or NEISS, a tracking system for consumer product-related injuries. The new system would allow hospitals in all 50 states to share vital medical information with CPSC and speed up the detection of hazardous consumer products, the agency said in a press release.

“As CPSC modernizes [NEISS to] NEISS-R, interoperability with the nation's health information infrastructure has become increasingly important. TEFCA provides a common framework for trusted health information exchange that can support authorized public health activities while promoting privacy, security, and standardized data exchange,” a CPSC spokesperson told Nextgov/FCW. “CPSC's participation reflects the mutual recognition that TEFCA and NEISS-R have complementary public health objectives and that collaboration benefits both efforts.”

CPSC’s partnership with Konza Health has garnered controversy from the likes of Rachel Maddow and consumer advocacy groups because it may sweep up personally identifiable information, such as names, addresses and birthdates, according to a KFF Health report.

Hospital technologists are also wary about the initiative because Konza Health officials have described medical record sharing as mandatory or else hospitals could be charged with violating federal information blocking rules, the report says.

The HHS office overseeing TEFCA invited CPSC to recommend a federal representative on the governing council in April.

IHS became the first federal agency to join TEFCA in December 2024 with eHealth Exchange serving as its QHIN onramp. As a health care provider to federally recognized tribes, IHS is using TEFCA to improve care coordination between agency and nonagency medical providers.

“The patients we serve are commonly shared with private sector, academic, or other federal healthcare providers. As such, the IHS has a clear interest in modernization and optimization of interoperability and coordination of care, and having a seat and a voice on the TEFCA Governing Council supports that interest,” an IHS spokesperson told Nextgov/FCW.

In addition to federal representatives, the TEFCA governing council has added several health IT industry bigwigs, including Alex Mugge and Hans Buitendijk of Oracle and Matt Becker of Kno2, Nextgov/FCW has learned.

]]>

Senate’s short-term funding bill provides temporary extensions for TMF, cyber data-sharing law

Edward Graham — Mon, 10 Aug 2026 17:25:00 -0400

The Senate approved a temporary funding measure this weekend that would provide a short-term extension for both the Technology Modernization Fund and a key cybersecurity law, although the proposal faces an uncertain future in the House.

The continuing resolution, which overwhelmingly passed the upper chamber in a 90-6 vote on Saturday morning, would punt funding for the federal government until Dec. 11. In lieu of further action and President Donald Trump signing such legislation, the government faces the likelihood of another shutdown beginning on Oct. 1.

The Senate-passed legislation, in part, extends the Technology Modernization Fund, a federal program that provides financial assistance to government technology projects. TMF was established in 2017 and helps support longer-term IT modernization initiatives while also having agencies pay back the investments that they received.

A Government Accountability Office report released last month found that TMF-funded projects have only resulted in about $13.5 million in savings through June 2025, although the watchdog estimated that 24 reviewed projects that received program funds between fiscal years 2018 and 2025 will result in roughly $1.06 billion in savings alone.

Saturday’s funding measure also provided a short-term extension for the Cybersecurity Information Sharing Act of 2015, a cornerstone cyber data-sharing measure that lets companies disseminate cyber threat intelligence with federal partners and one another while maintaining key legal exemptions. The law temporarily expired during the 43-day government shutdown late last year, although Congress passed a funding package in February that extended the statute through Sept. 30.

Trump administration officials have expressed a desire for lawmakers to extend the law for a prolonged period of time to enhance cyber information sharing.

National Cyber Director Sean Cairncross said during an event in May that the White House was “pushing for a long-term reauthorization” of the law, noting that the administration’s national cybersecurity strategy includes a focus on enhancing information sharing between the government and the private sector.

Lawmakers have moved to push the next federal funding fight until after the November midterm elections, although both chambers still need to come together to support one measure.

Saturday’s bill passed before senators departed for the August recess. The House, which is also slated to be out until Aug. 31, passed its own temporary funding measure on July 21. Senate Democrats, however, have called that bill a non-starter.

]]>

Senate Finance panel’s top Dem proposes excise tax on new data centers

Alexandra Kelley — Mon, 10 Aug 2026 17:12:00 -0400

A new draft white paper from a top Senate Democrat proposes tax code updates that would shift incentives for data center construction.

The paper, released on Aug. 6 by Sen. Ron Wyden, D-Ore. — ranking member of the Senate Finance Committee — proposes changing the incentives that could spur more data center construction amid the national boom in a bid to offset consumer burdens associated with more data centers.

Wyden’s framework hinges on two changes to existing tax code: removing the current tax incentives that apply to data center construction and applying a new excise tax on data centers whose workloads primarily handle AI compute.

With the removal of the tax incentive and the creation of an excise tax on data center operations, the new revenue would help address the myriad concerns with increased data center costs, including higher energy prices, workforce turmoil and a drain on broader resources.

“American communities are rightfully questioning whether the rapid buildout of data centers across the nation will benefit them, as local disruptions rise and Americans grow concerned about the long-term career prospects of millions of workers,” Wyden said in a press release. “These proposals are a first step towards safeguarding taxpayer dollars and ensuring there are resources to support American workers displaced by the coming disruptions to the economy.”

Wyden includes several caveats to his tax proposal. The new excise tax would function as a gross receipts tax that charges a fee the total revenue or sales of a business.

Two types of data centers will be subject to the tax: those owned, operated or rented by massive data center operators, and those being used by major data center payors, which include major hyperscalers Amazon and Meta. The paper stipulates that the tax would target the large AI hyperscalers and other entities that are primarily “causing the data center boom and most able to pay.”

Wyden’s proposal offers selective exemptions, which apply to data center assets constructed before 2024. It states that “for all but the largest actors,” the share of data center assets built before 2024 won’t be subject to the new tax.

“These proposals will not end data center development or put at risk the U.S. maintaining its

status as the global leader in AI and other innovative technologies,” the paper reads. “Rather, they will ensure we have the resources to help the communities and workers most impacted as data center construction continues.”

The proposal also says that the tax would apply to data centers in space. The draft paper stipulates that if a space-based data center attempts to avoid the tax by being labeled as a non-U.S. asset, a withholding tax will apply to payments made by U.S. taxpayers to use the data center. Space-focused tech firms, including Blue Origin and SpaceX, have proposed building millions of orbital data centers.

Wyden also solicited feedback on his proposal, calling for the public to provide the Senate Finance Committee’s minority staff with comments by Aug. 31. The paper said that discussion draft language is expected to arrive in the coming fall.

Data center construction and the question of who bears the burden of increased electricity rates and other potential hazards has become a major political talking point. Democrats, in particular, have been looking to leverage growing opposition to further data center construction as a political issue ahead of the 2026 midterm elections.

In March, President Donal Trump unveiled the Ratepayer Protection Pledge that brought companies Amazon, xAI, Oracle, Microsoft, Meta, Google and OpenAI to agree to absorb utility costs stemming from data centers handling their technology’s compute loads.

Other lawmakers have also turned their attention to issues brought about by the data center boom. Sen. Bernie Sanders, I-Vt., previously called for a moratorium on new construction until more information can be garnered about both data center impacts and AI itself.

“We cannot sit back and allow a handful of billionaire Big Tech oligarchs to make decisions that will reshape our economy, our democracy and the future of humanity,” Sanders wrote in February. “We need serious public debate and democratic oversight over this enormously consequential issue.”

]]>

Federal systems increasingly likely to face accidental AI breach after Hugging Face, experts say

David DiMolfetta — Mon, 10 Aug 2026 11:19:00 -0400

LAS VEGAS — An OpenAI agent tasked with finding software flaws escaped its testing environment, hacked into Hugging Face and spent days moving through the company’s systems in search of answers to an evaluation. It had not been sent to attack the company, yet it did so anyway — and a smattering of other accidental AI intrusions in separate environments have since followed.

If the same chain of events began again, former officials and cybersecurity experts told Nextgov/FCW there is little reason to assume a federal agency would be spared. In interviews during Black Hat and DEF CON this past week, they said aging networks, systems that are not properly separated and the government’s heavy reliance on contractors could present weaknesses that would let an unauthorized AI agent move from one environment into another before defenders realize.

One former federal chief information officer likened the risk to turning loose a hunting dog: “If you’re going to put your dog in the yard and instruct it to hunt, probably best to ensure the back gate is closed.” The former official spoke on condition of anonymity to discuss their views more candidly.

The July intrusion began during an internal OpenAI test designed to measure how effectively advanced models could find and exploit vulnerabilities. OpenAI said the agent — powered by GPT-5.6 Sol and a more capable internal research prototype — was operating with some security safeguards intentionally reduced.

The agent exploited a previously unknown flaw in an internal package-management service, reached the public internet and commandeered a third-party code sandbox as a staging point. From there, it exploited two flaws in Hugging Face’s dataset-processing systems, obtained credentials, executed commands and moved through parts of the company’s infrastructure.

In the leadup to the intrusion, OpenAI models created an internal message board, used it to trade hacking methods and found a way to bring it back even after humans shut it down, company engineers said in a presentation at the cyber conferences this past week.

The agent deliberately exploited Hugging Face’s systems in pursuit of its assigned goal, but OpenAI had not instructed it to attack the company. Bob Costello, who served as chief information officer at the Cybersecurity and Infrastructure Security Agency before becoming chief digital and information officer at Merlin Group, said a similar federal incident could begin with authorized security testing.

“As we start using really advanced AI to operate our systems or penetration-test our systems or blue-red-purple team our systems,” he said, “maybe one of those kind of goes sideways, [and] takes a lateral system to the side.” The color-coding he described refers to red teams that simulate hackers, blue teams that defend systems and purple teams that combine both approaches to find digital weaknesses.

That possibility is becoming more relevant as agencies begin experimenting with AI agents that can retrieve information and take actions. The General Services Administration is preparing a governmentwide hackathon in which federal, state and local employees will build connections between AI systems and agency data and public services, including prototypes that would let AI route data directly to an agency. The work is slated to be conducted exclusively in sandboxed environments and will not involve any access to restricted data or production systems.

Contractors may keep their federal and commercial systems separate, said Leslie Nielsen, the executive vice president and CISO at Mimecast, but the same employees may still access both: “There’s lots of people using it from both sides, and getting in through one could eventually lead to the other.”

“The chances of it happening again, I would say it’s going to,” he added. “Some of these [federal] infrastructures are just so big and, candidly, so old, that there are little nooks and crannies in them, they’re going to get teased out.”

Asked to assess the likelihood of a comparable federal incident, Ellen Boehm, senior vice president of internet-of-things strategy and operations at Keyfactor, called it “pretty likely” and placed the odds at “seven out of 10.”

Michael Leland, vice president and field chief technology officer at enterprise browser provider Island, said some civilian agencies are exposed because “they don’t have the infrastructure, they don’t have the talent, and they haven’t spent years building those guardrails or that containment because they didn’t have to.”

“It shouldn’t be different for AI because AI doesn’t care where it is,” Leland said. “It is opportunistic.” Agencies that don’t do national security work that have lower cyberdefense standards are “very much at risk,” he added.

Bob Ackerman, co-founder and managing partner at cyber venture capital firm DataTribe, also said many organizations have embraced powerful AI systems before learning how to reliably control them.

“We fundamentally are kidding ourselves that we’ve got this under control,” Ackerman said. “We’ve got a really, really powerful tool, but we don’t know how to control it yet.”

But people interviewed for this story largely rejected the idea that autonomous agents have rendered the government’s existing security playbook obsolete. The Hugging Face campaign relied on recognizable techniques like finding exposed systems, stealing credentials, escalating privileges and moving between connected environments, all of which are problems agencies have faced for years.

“It’s really not gonna play out all that differently than if it was a hands-on keyboard actor … or someone who’s writing a script and letting a programmatic algorithm go and do its thing,” said Ben Bernstein, who manages the cybersecurity advisors team at Huntress.

The difference, ultimately, is tempo and scale. An AI hacker can probe potential routes, link digital weaknesses and iterate its maneuvers without the delays of human intervention. Such tools maintain a relentless fixation on specific targets, persisting with an objective well beyond the point where a human operative might question the value of taking their selected intrusion path. On top of it all, they don’t need to eat, sleep or take restroom breaks.

“An agent’s just a fast hacker at the end of the day, right?” Nielsen said. “But the one thing the agent doesn’t have is a moral or ethical compass. They’re given a task and they have focus, and they’re going to go do what you’ve told them to do.”

David Weston, Microsoft’s corporate vice president of agentic security, similarly cautioned against treating the federal government as a fundamentally different kind of target. The approach demonstrated in the Hugging Face breach “is going to be a challenge for most folks,” he said, but the response still comes down to basic security practices.

“Regardless of the target, everyone needs to follow those fundamentals,” Weston added.

Duncan Greatwood, CEO of Xage Security, also said agencies should not rely on simply telling an agent not to perform certain actions because those instructions can be bypassed. Instead, they should use separate security controls that technically prevent the agent from reaching systems or changing data it’s not authorized to touch. He described the approach as “bounded autonomy.”

“You allow the agent to do stuff, but you’re not going to allow it to go crazy. You’re going to put hard bounds around it,” Greatwood said.

Retired Gen. Paul Nakasone, the former director of U.S. Cyber Command and the NSA who now leads Vanderbilt University’s Institute of National Security and sits on OpenAI’s board, called the Hugging Face episode “an inflection point in terms of AI-generated autonomous cyber attack.”

“My question is, how do we ensure that the defense starts to catch up, right?” Nakasone said. “How do we make sure that artificial intelligence is able to bring together a capable defense that allows us to do vulnerability detection, to do patching, to do incident response, and to do mitigation?”

Editor's note: This article has been updated to clarify the participants in GSA's upcoming hackathon and where the work will occur.

]]>

Cloudflare to seek DOD IL4 authorization after new FedRAMP, GovRAMP designations

Christian Robles — Mon, 10 Aug 2026 09:00:00 -0400

Cloudflare announced Monday it plans to seek Department of Defense Impact Level 4 authorization to bring a platform that can store and process controlled unclassified information to defense agencies.

The connectivity cloud company also achieved FedRAMP High certification, which covers civilian federal agencies, Thursday and GovRAMP Moderate authorization, which covers state and local governments, in April.

With the FedRAMP High certification, agencies can use Cloudflare for Government to process sensitive information related to national security, critical infrastructure and financial systems, according to a press release. The certification comes shortly after the FedRAMP director warned vendors they should not be allowed to sell products to agencies if they are too slow in patching vulnerabilities.

With the GovRAMP Moderate authorization, state and local governments can similarly use Cloudflare for Government to protect sensitive information and meet state-specific data privacy mandates, the release said.

“FedRAMP High, GovRAMP Moderate, and our intent to pursue DoD IL4 let us bring a platform to federal, state, local, and defense teams to advance their missions, retire legacy technologies, and accelerate their shifts to a more secure, efficient, and innovative future,” David Mihalchik, vice president of U.S. public sector at Cloudflare, said in the release.

The departments of Energy, Health and Human Services, Commerce, Homeland Security, Interior, Justice and State, in addition to other agencies, already use Cloudflare technologies.

]]>

Voting machine researchers say federal work abruptly ended after Trump ally pushed back on their findings

David DiMolfetta — Sun, 09 Aug 2026 06:00:00 -0400

LAS VEGAS — After spending roughly six weeks analyzing Dominion voting systems used in Puerto Rico’s 2024 elections, Mojave Research came back to the Trump administration with findings that startled its researchers.

The systems contained at least a dozen high- or critical-severity software vulnerabilities. Passwords were reused, firewalls were disabled and basic cryptographic protections were poorly implemented. And in Puerto Rico, active cellular hardware modems opened additional pathways into underlying software that was thought to be isolated.

But the small cybersecurity firm found no evidence that any of those weaknesses had actually been exploited, or that votes had been changed. The company still wanted more time to be certain.

Federal officials initially seemed willing to give them considerably more of it. The company was asked to grow the team working on the effort from roughly 10 people to about 60, according to CEO Jason Wareham.

Chief Technology Officer Manbir Gulati also said Mojave received an authorization to proceed with a follow-on effort, hired personnel and was given funding to acquire equipment for examining additional voting systems ahead of the November midterms. A contracting officer had even been brought in to finalize the new agreement, Gulati said.

Then, as Mojave prepared to move ahead, the work was abruptly shut down.

Wareham and Gulati recounted the episode on Friday at DEF CON hacker convention’s Voting Village, where they publicly unpacked their technical findings before sitting down with a small group of reporters and onlookers afterward.

Their account fills in new details about a federal effort that grew out of the Trump administration’s broader focus on voting machines and election interference, and the political pressures that emerged when Mojave’s findings did not support claims of election manipulation.

The ODNI request

Mojave never set out to become an election security provider. Its involvement began last year through the Office of the Director of National Intelligence under then-director Tulsi Gabbard, where it was already performing unrelated technical work for the agency when officials approached the company about examining voting machines and data obtained from Puerto Rico.

Reuters reported in February that the May 2025 operation was tied to an effort involving ODNI and the FBI to investigate allegations that Venezuela had hacked Puerto Rico’s voting systems, though Gabbard’s office denied that Venezuela drove its work and said the examination was focused on technical vulnerabilities. The probe produced no clear evidence of Venezuelan interference.

Wareham said at DEF CON that ODNI asked whether his team of reverse engineers and forensic specialists could travel to Puerto Rico and capture an image of a voting system that had actually been used in an election, without the vendor overseeing the process. He agreed, thinking it would be a relatively small addition to Mojave’s existing contract.

The assignment instead dropped Mojave into a much larger skirmish over American elections. “Ultimately, I made the worst decision of my life in a business context,” Wareham said.

President Donald Trump has spent years falsely maintaining that his 2020 loss was stolen and the product of widespread fraud and foreign interference, claims that have been rejected by courts and officials in his own administration. A 2021 intelligence community assessment found no indication that a foreign actor attempted to alter ballots, vote tabulations or any other technical aspect of the election.

Since returning to office, Trump and allies have revived investigations into the 2020 contest and pushed election security back to the center of his administration’s agenda. Gabbard’s ODNI was one part of that effort, hauling off and analyzing voting systems from Puerto Rico and later becoming involved in a federal investigation of 2020 election records in Georgia.

Wareham said the ODNI officials directly overseeing the company’s technical work wanted the research to continue. Both he and Gulati described the ODNI staff they worked with as professionals who wanted to protect the security of election systems.

The resistance, Wareham said, came from a separate White House collective that was repeatedly dissatisfied Mojave had not produced evidence supporting claims that the 2020 election had been manipulated.

“There was a separate group — let’s call them White House-adjacent — who was dissatisfied,” he said. “They were dissatisfied overall that I was not willing to name and shame at that moment” and declare that Trump had actually won the 2020 election.

Asked whether he believed Mojave’s government work was axed because it failed to find the “smoking gun” some officials wanted, Wareham said: “I believe that was part of the termination, yes.”

Reuters reported in April that Kurt Olsen, a prominent 2020 election-denier and Trump adviser involved in efforts to investigate the election, pressed Mojave to broaden its work in search of evidence that could support those claims.

Olsen, who now works at the Justice Department, turned against the company when its research failed to uncover evidence that the Puerto Rico machines had been hacked. He advocated terminating its work and accused Mojave of secretly receiving money from billionaire George Soros, a frequent target of right-wing conspiracy theories, the news agency reported. ODNI has said Mojave’s contract ended because the company completed its voting-machine analysis.

Wareham said an ODNI official informed him while Mojave was preparing to expand its work that the company had been accused of receiving Soros funding. The allegation prompted him to compile a detailed accounting of the young company’s funding sources within three days and send it up the government chain. Asked who he was told had made the accusation, he said an ODNI official reported to him that it was Olsen.

“One, I’m not funded by George Soros,” Wareham said. “Two, it would be great to be funded by George Soros because I would probably not be here, I’d be on a yacht.”

The company kept moving forward. Wareham said Mojave briefed the White House on some of its findings around September. The firm believed it was heading toward a broader effort to remediate vulnerabilities before the midterms and conduct a deeper analysis for signs that the weaknesses it discovered had ever been actually abused.

Then came the record-long government shutdown. Wareham said that on the day he expected an expanded contract to move ahead, Mojave instead received a stop-work order and no additional funding.

“I think the government shutdown was all that was required, really, to have some folks that I didn’t know were still in the game, again, White-House adjacent, to take their shot,” he said. Wareham stopped short of saying he had direct proof that White House officials ordered Mojave removed because of its findings, but said “it was reported to me it was Kurt Olsen” who led the efforts.

The White House, ODNI and Olsen did not return requests for comment.

Identified vulnerabilities

Mojave had found many issues with the machines it examined. Gulati described the Puerto Rico system during the Voting Village presentation as “deeply insecure,” saying it did not meet the security bar he would expect from “an average low-risk application, let alone critical infrastructure.”

Researchers identified at least 12 major vulnerabilities in commercial software installed on the system, Gulati said. Mojave successfully executed five of them. None were newly discovered flaws, and fixes were already available — in some cases well before the system was used in the election.

Other weaknesses were rooted more deeply in how the system was built and deployed. Some passwords could be easily cracked and others were embedded directly into software. Firewalls were turned off on critical systems and ports were left open. Gulati was particularly critical of the system’s cryptography, which he described as being “in shambles.”

The company does not believe every problem it found necessarily stopped at Puerto Rico, as its formal review covered only one system from one manufacturer in one jurisdiction. Gulati suspects the issues could extend beyond a single voting machine company, though Mojave has not examined enough systems from other manufacturers to establish that.

“I don’t expect that the problems are unique to them,” he said. “I think many manufacturers probably exhibit the same problems.”

Mojave produced an approximately 100-page document of the Puerto Rico findings. Gulati said Mojave has been in discussions with Liberty Vote — which acquired Dominion’s election business last year — and that Liberty told the researchers it does not plan to make changes before November.

Liberty said it has not received Mojave’s report.

“Liberty Vote is not in receipt of any such report so, therefore, we cannot provide any comment,” a spokesperson said. “As always, Liberty Vote is committed to advancing the future of secure American elections.”

No evidence of vote tampering

Looking at the systems headed into the midterms, Gulati said, “I do know that as of now, the state that we have described is going to be pretty similar to what will be deployed in November.”

Despite the extensive findings, Gulati repeatedly returned to what the researchers did not establish: “We found extensive and largely unacceptable weaknesses,” he said in the presentation. “But we did not find evidence that those weaknesses were actively exploited or that votes were altered.”

That distinction has drawn renewed attention as Trump and his allies again focus on election matters.

Last month, the president used a prime-time White House address to release newly declassified intelligence he said showed China interfered in the 2020 election. Among several disclosures, Trump pointed to intelligence showing Beijing had acquired personal information on roughly 220 million American voters. But the documents did not show China altered votes or gained the ability to manipulate voting systems.

Gulati echoed those conclusions Friday when asked about the declassification.

“The China thing isn’t really much of anything,” he said, arguing that a large amount of the voter information at issue could be obtained commercially and should not be confused with access to election systems in ways that can manipulate votes.

“There is no evidence that I know of that says China successfully or any other country has successfully infiltrated our systems and manipulated votes in any way,” he added.

Wareham called the 100-page document a preliminary report and said the firm had wanted another six months to a year to dig deeper into the underlying data.

Gulati said the company’s interactions with the ODNI employees overseeing that work were markedly different from the political pressure the researchers later encountered. “We were never pressured to put anything in our reports that was untrue or politically leaning in a certain way,” he said of those officials.

Wareham said Friday that Mojave itself has pushed for its report to be made public for roughly a year and has recently been told it could soon emerge through a Freedom of Information Act request. Nextgov/FCW could not immediately determine the origin of the FOIA requester. As of publishing time, ODNI’s FOIA logs are available up until January 2025.

“I’m a little annoyed that we are very close to midterms and we had a whole year to freaking figure this out,” Wareham said.

With their government work scrapped, he announced at the Voting Village that he had filed paperwork to create the Machine Assurance Institute, seeking to bring together cybersecurity researchers and election technology companies to examine and independently verify voting infrastructure.

“We wanted to be the national security answer, and put to bed, finally, discussions about prior elections and/or accusations of voter fraud,” said Wareham. “Because, believe it or not, I find it fairly national security-destabilizing to constantly accuse each other of cheating.”

]]>

Senate confirms Adam Cassady to run State Department cyberspace bureau

David DiMolfetta — Fri, 07 Aug 2026 15:24:00 -0400

The Senate on Friday confirmed Adam Cassady as the new U.S. ambassador for cyber and digital policy, filling a high-profile role that had been vacant since the start of the second Trump administration.

Cassady, currently a senior official at the National Telecommunications and Information Administration, was approved in a 51-47 vote as part of a package of some 70 nominees.

The Bureau of Cyberspace and Digital Policy, which traditionally is led by the person named to the position he was just confirmed for, has undergone significant workforce changes. A reorganization last year saw the bureau divided into three separate entities, including a new Bureau of Emerging Threats, and a reduction in overall staff.

The cyber bureau has mainly focused on international diplomacy for U.S. cyberspace, telecommunications and emerging technologies, and has sought to counter authoritarian tech practices. It was formally launched in 2022 under then-president Joe Biden. Cassady’s purview is not entirely clear under the new organizational structure imposed over the last year.

Under the Biden administration, the unit was headed by retired U.S. Marine Corps officer and technology executive Nate Fick, who used his position to take firm stances against Chinese officials when addressing Beijing-backed cyber intrusions into U.S. critical infrastructure.

During his April confirmation hearing, Cassady emphasized a need for international collaboration on secure and resilient digital systems. He also sidestepped giving a definitive stance on the export of advanced semiconductor chips to China, saying he would “very, very quickly develop” a position on the issue.

“As NTIA’s Deputy Administrator, Adam was critical to many of the agency's most significant achievements in advancing America’s technology leadership and protecting our interests abroad,” NTIA head Arielle Roth said in a statement. “His experience makes him exceptionally well-suited to represent America’s strength on the world stage.”

]]>

New ‘Water Watch Center’ launched to help small utilities stop cyberattacks

David DiMolfetta — Fri, 07 Aug 2026 14:19:00 -0400

LAS VEGAS — A new program is seeking to assist water providers around the country as multiple states grapple with possible Iran-linked cyber intrusions against water infrastructure.

The Water Watch Center provides direct cyber mitigation support to utilities serving fewer than 10,000 people, which represents most of the nation’s community water systems. Launched at this year’s DEF CON hacker convention, the initiative is a joint effort between the National Rural Water Association and DEF CON Franklin, a project of the Cyber Policy Initiative at the University of Chicago Harris School of Public Policy.

More than 30 community water systems in Minnesota were targeted late last month, according to state officials. Around 12 states have reported similar activity in recent days, though state officials said they continued operating safely and experienced no known effects on public health. The FBI and Cybersecurity and Infrastructure Security Agency are working on incident response.

An initial group of five cybersecurity firms will help deliver services to water utilities as part of the initiative.

“These leading cyber firms and NRWA are architecting a scalable cyber delivery model that has eluded water industry and national security officials to date,” Jake Braun, the co-founder of DEF CON Franklin and a former White House acting principal deputy national cyber director, said in a statement.

Retired Gen. Paul Nakasone, who led U.S. Cyber Command and the NSA from 2018 to 2024, said at DEF CON this year that water utilities around the country are highly exposed, and he pushed for higher defense standards in the sector.

“These [programmable logic controllers] should not be exposed to the internet,” he told reporters in a briefing on Friday, referring to the small computers used to operate pumps, valves and other equipment inside water facilities.

Some U.S. officials believe Iran may be responsible, though there has been no definitive public confirmation.

“I think [the government] is taking a very measured approach to make sure that they have the right actor that’s doing this,” Nakasone said when asked about why Iran hasn’t publicly been linked to the hacks

“I look at intent. I look at capability. I look at history. I’m not the person that’s making the call on the attribution, but I see an actor here that has certainly shown a history of being able to do this,” he said. “They certainly have the capability, and I think there’s an intent right now — we’re in conflict with Iran.”

]]>

Tech Bills of the Week: Deterring AI distillation; Taxing AI developers; and more

Alexandra Kelley — Fri, 07 Aug 2026 14:03:00 -0400

Deterring AI distillation

Lawmakers are looking to address the threat of AI model distillation by adversaries, with a new bill introduced by Sen. Bill Hagerty, R-Texas targeting illicit intellectual property infringement by Chinese actors.

The Blocking Large-Scale Adversarial Distillation Efforts — or BLADE — Act of 2026 was introduced on Wednesday, just weeks after the White House voiced concern over Chinese AI developers training their models on American AI systems in a process called distillation. The BLADE Act mandates that the Executive Branch identify and consolidate the specific foreign entities driving illegal distillation operations.

“As the United States must remain at the forefront of competitiveness in artificial intelligence, we cannot allow our adversaries to steal the intellectual property of America’s top AI companies and thereby threaten U.S. national security and economic security,” said Hagerty in a press release. “The BLADE Act will expose and punish foreign entities that conduct hostile distillation campaigns against our frontier AI companies. Our nation must counter malign actors who seek to subvert our nation’s leadership and innovation in artificial intelligence.”

After composing and publicly releasing the list of entities engaging in AI model distillation, the Department of Commerce and Department of Treasury would be tasked with imposing export controls and financial sanctions, respectively, on the listed entities.

The BLADE Act boasts bipartisan support, with Sens. Tim Scott, R-S.C., Andy Kim, D-N.J., and Catherine Cortez Mastro, D-Nev., joining Hagerty in introducing the bill.

Taxing AI-driven unemployment

A group of House Democrats introduced a new bill on Thursday designed to fight predicted mass layoffs spurred by the rapid advancement and widespread deployment of artificial intelligence.

Reps. Greg Casar, D-Texas, Valerie Foushee, D-N.C., and Sara Jacobs, D-Calif., introduced the AI Tax and Work Protection Act to prevent mass unemployment through a new oversight office created by taxes levied on AI developers.

In a press call, Casar described the pending economic situation as an “emergency” that demands federal intervention.

“Right now, no one in Washington has a plan to deal with the threat that AI could pose to the workforce, and no one really knows what Democrats' policy position is on AI and job loss,” Casar said on Thursday. “We are not going to let millions of Americans go without work just so a few billionaires can become trillionaires, and we're not going to let AI CEOs take your job and make you unemployed.”

The bill creates a new Work Protection Administration, funded completely by taxes on AI companies based on the input tokens required for a given AI system or the total revenue generated by selling AI products, whichever is higher.

The Work Protection Administration’s purpose is to create jobs to offset AI-linked layoffs. With the tax revenue, the office will invest in job creation in sectors like housing construction, infrastructure modernization, child care and elder care via local grants.

“The tax starts small, but if unemployment goes up, the tax rate goes up, and we use that money to invest in jobs that need doing, taking care of our elderly, teaching our kids, fixing our broken infrastructure,” Casar said.

Studying AI’s impact in classrooms

Rep. George Whitesides, D-Calif., introduced a new bill on Monday that would instruct the National Science Foundation to develop more workshops that examine how to effectively deploy AI in education environments.

The Understanding AI in the Classroom Act specifically aims to examine the impact AI has on kids’ attention spans; their cognitive, social and behavioral development; and their burgeoning dependencies.

Six months after the workshops are completed, the NSF director will then compile a report on the findings and share them with the House Committee on Science, Space and Technology and the Senate Committee on Commerce, Science and Transportation.

Evaluating AI in the financial sector

Sen. Mark Warner, D-Va., introduced a new bill on Thursday that would amend the Financial Stability Act of 2010 to establish more oversight of AI’s presence in the financial sector by giving the Financial Stability Oversight Council duties specific to that technology.

Warner’s new bill follows a letter he and other Democrats sent to the Trump administration calling for information on the new framework officials established for evaluating AI models and their cybersecurity risks but have not released publicly.

Disclosing AI in healthcare claims

A proposed amendment to the Public Health Service Act and the Social Security Act includes provisions mandating that insurance providers disclose if AI has been used to evaluate insurance claims and coverage decisions.

The Health Insurance Transparency for Patients Act, introduced on Monday by Rep. Ashley Hinson, R-Iowa, outfits the landmark health bills with clauses designed to help patients when a denied claim had been processed with the help of AI tools.

“Big health insurance companies have a pattern of purposely denying patients coverage based on technicalities to protect their own bottom line,” Hinson said in a press release. “And they get away with it because nobody can see how they’re making these decisions. My bill holds them accountable by exposing these unfair practices, so patients are no longer in the dark and Iowans can get better healthcare coverage.”

Aligning immigration with AI dominance

A bill introduced on Thursday seeks to better align immigration policy with the need to fortify the U.S. AI sector.

S.5307, introduced by Sen. Chris Coons, D-Del., seeks to create a strategy specifically focused on harmonizing U.S. immigration policy with the national security need to lead globally in developing a robust AI sector. In addition to AI, the bill also looks to examine how immigration policy alignment can fortify innovation in the broader U.S. scientific, technological and entrepreneurial ecosystem.

]]>

As AI models break free, White House works with firms on secret safety measures

Patrick Tucker — Fri, 07 Aug 2026 12:52:00 -0400

No one is saying, officially, what was decided when top frontier AI labs—Google, OpenAI, Anthropic, and Meta—met with White House officials on Tuesday to discuss voluntary guidelines for testing new models.

But Democratic lawmakers described the Trump administration's approach to regulation as “ad-hoc and unpredictable,” and said it’s likely to boost global adoption of rival Chinese models at the worst possible time.

Two officials with one of the labs said that Google, Anthropic, and OpenAI submitted a joint draft of the regulation around nine days ago and then began to work with each other and with the White House to find points of agreement. According to the officials, the labs all agreed they should be able to continue A/B testing as part of the process for developing models, and the White House concurred.

Companies that agree to the framework will submit their models to U.S. inspectors to be evaluated for safety for 30 days before those companies can receive federal funding—including from the Defense Department, whose 2027 budget request seeks more than $54 billion for AI companies, according to the officials.

A June White House executive order adds that models from participating companies would get extra intellectual property protection from Chinese competitors or others who might seek to steal secrets.

The White House is not commenting on how it will conduct the inspections. One of the officials said the the Office of Science and Technology Policy is still trying to set testing standards and how bodies like the National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency will conduct or design tests.

The murkiness around the policy’s details has angered some top lawmakers. In a Tuesday letter, Senate Democrats ask the White House to “provide an unclassified response, with a classified annex if necessary, clarifying the Administration’s current policy and approach to limiting access to advanced AI models.”

The lawmakers also evinced concern about the models' new abilities to defy easy inspection, scrutiny, and limitation.

“During an internal evaluation [in July] OpenAI models escaped their testing environment and used high-level technical capabilities to compromise a third party’s network without any instructions to take those actions,” the letter reads. “The Federal Government cannot be passive as these capabilities emerge.”

AI’s Jurassic Park moment

Last week, Chinese company Moonshot AI released a new open-weight model, Kimi 3, that performs as well as some top U.S. models and is being offered to consumers around the world at a far lower price.

Lawmakers and others are increasingly worried the United States could fall behind China in a race to develop faster, more efficient, more profitable models and to shape the way global populations use, buy, sell, and even build AI. Open weight models have become a key point of contention.

Anthropic wants more scrutiny of open-weight models and more efforts to curb sales of high-performance chips to China to thwart distillation attacks. But others in the industry are taking a more supportive view of open weights.

A former senior White House official and a former senior defense official with direct knowledge of the discussion said Anthropic pushed for more language in the framework to address open-weight security, but came away disappointed.

Anthropic did not comment for this story.

In recent months, several of the newest AI models have broken out of their virtual testing containers.

Anthropic disclosed the first such incident in April, when an early version of their Mythos model was able to “autonomously write some remarkably sophisticated exploits,” including one that allowed it to escape an isolated testing environment that programmers use to test code for effectiveness and safety before it’s released.

Anthropic pulled the model from general release, but made it available under "Project Glasswing" so the government and a handful of large companies could find and fix vulnerabilities in their software.

The White House responded with an export-control ban on June 12, barring access to the model not just to foreign countries but even foreigners in the United States. That meant that Anthropic’s own researchers, many of whom were born outside of the United States, could not work on the model. The White House reversed the ban on June 30.

In July, tensions around a national AI safety strategy, or lack thereof, grew hotter. Both Anthropic and OpenAI revealed new incidents in which models breached their containment. It came as no surprise to many veteran cybersecurity experts. AI researcher and author Gary Marcus, in 2022, predicted such a possibility on his blog, describing it as an “AI’s Jurassic Park Moment.”

Last week, AWS Chief Security Officer Stephen Schmidt told reporters: “Containers are not security boundaries. I actually have a T-shirt that says that, which I started wearing about three years ago.”

AWS hosts multiple models for users through its Bedrock platform. Schmidt said the AI Mythos era requires a far more vigilant approach to cybersecurity, especially for researchers.

“One of the reasons that we built the virtualization infrastructure for AWS using our own Nitro Hypervisors so many years ago was we realized that containers were not an appropriate security boundary then. The same is true for AI. You cannot use an AI container as a security boundary.”

In March, a group of British researchers calculated the sandbox breakout period for various large language models, which proved very accurate months later.

A follow-on paper published this week by the same group describes how to build better containment environments for the models emerging today.

]]>

CISA cautions against rigid rules for future of cyber vulnerability program

David DiMolfetta — Fri, 07 Aug 2026 10:33:00 -0400

LAS VEGAS — The Cybersecurity and Infrastructure Security Agency sees value in formally placing the world’s dominant software vulnerability tracking program into federal law but is cautioning Congress against imposing rules that could make it harder to adapt as artificial intelligence and international partners reshape the system.

The Common Vulnerabilities and Exposures Program, or CVE, gives publicly known security flaws standardized identifiers so that governments, software companies and researchers can easily communicate about the same issue. It was first created in 1999, and it underpins cybersecurity discussions across both private industry and the national intelligence community.

Policymaking interest in the program followed a funding scare last year that exposed the fragility of the arrangement supporting its functions. MITRE, the scientific research giant that helps operate CVE under a federal contract, warned last April that its funding from the government would imminently expire.

CISA then extended the contract within hours, a sweeping relief for the cybersecurity community that raised fresh questions about why a major global cybersecurity resource leaned so much on a sole U.S. contract. A CISA official previously said that a “broad internal contracting review caused a brief renewal delay in April 2025, but operations continued without disruption and MITRE was ultimately retained as the program operator.”

A legislative proposal reported by Nextgov/FCW in June would formally authorize CVE within the Department of Homeland Security and establish a clearer legal role for CISA, its longtime federal sponsor.

“Defining the importance of the program in legislation in general seems like a very helpful thing,” Lindsey Cerkovnik, branch chief for vulnerability response and coordination at CISA, said Thursday during a panel at the Black Hat cybersecurity conference.

But Cerkovnik, whose office helps oversee CVE, said legislation could become counterproductive if it dictates too precisely how the program must operate.

“When you overdefine how to execute the thing, it can make it very restrictive and difficult,” she said. “In some ways, we are wary of overly-restrictive guidance” that could make CVE less nimble, agile and flexible, she added.

The congressional proposal would also require CISA and the National Institute of Standards and Technology to develop a modernization plan and establish a 15-member board to set CVE policies and priorities. Permanent seats would go to CISA, NIST and top-level CVE authorities, while rotating members would represent industry, academia, researchers and foreign governments.

Reps. Delia Ramirez, D-Ill., and George Whitesides, D-Calif., submitted the proposal as an amendment to the fiscal 2027 defense authorization bill. But the House Rules Committee didn’t select it for floor consideration, preventing it from getting a vote in the full House last month.

Cerkovnik said CISA had reviewed the proposal and saw both benefits and challenges. Formal recognition could help preserve support for the program, although CISA and DHS have maintained its operations without a lapse for more than 26 years, she said.

CISA is CVE’s sole federal sponsor, while MITRE helps execute the program alongside a global network of more than 530 CVE Numbering Authorities, known as CNAs. Those organizations — which include software vendors, research groups and national cybersecurity agencies — can assign identifiers and publish information about vulnerabilities within their areas of responsibility.

The number and variety of those participants has allowed CVE to keep pace with a growing volume of software flaws. AI, however, is widely expected to accelerate vulnerability discovery further and may require the program to make changes that its current structure did not anticipate.

Cerkovnik pointed to a recently announced AI researcher CNA pilot program that would allow selected AI companies to assign CVE identifiers for vulnerabilities uncovered through research using their own models.

That program may need to bring people with AI expertise into its leadership, she said, and rules narrowly prescribing who can serve on CVE boards or how new participants are admitted could complicate that kind of response. Cerkovnik didn’t say the current congressional proposal would block the pilot, instead using it to illustrate why the program needs room to adjust as technology changes.

CVE is also becoming less centered on the United States. The European Union Agency for Cybersecurity, known as ENISA, became a CVE Numbering Authority in 2024 and a CVE Root in November 2025. Roots oversee groups of numbering authorities, helping organizations join the program and maintaining the quality of the vulnerability records they produce.

ENISA has since begun bringing European organizations under its Root, building on the agency’s stated goal of helping strengthen and modernize CVE.

Nuno Rodrigues Carvalho, ENISA’s head of sector for incident and vulnerability services, said on the panel Thursday that the agency now wants to “step up in the coming months” to also be a top-level Root, bringing it to the same level as CISA and MITRE.

He described a more federated model in which organizations in Europe, Japan and potentially other regions oversee nearby numbering authorities and provide further support to the project.

Europe already accounts for roughly one-fifth of the organizations authorized to assign CVE identifiers, Carvalho said. ENISA also operates the European Vulnerability Database, although he emphasized that it relies on CVE identifiers rather than competing with the existing system.

Cerkovnik backed growing foreign participation, arguing the past year had reinforced the need to describe CVE as “a global program and not just a U.S.-centric program.”

AI poses another challenge by potentially increasing the number of vulnerabilities companies and governments must process. Cerkovnik said she expects CVE to scale alongside that growth but is more concerned about whether organizations can determine which flaws demand immediate attention.

“Not all vulnerabilities matter. Not all vulnerabilities matter at the same level,” she said. CISA made a similar argument in a binding directive issued in June that tells federal agencies to base patching deadlines on a variety of factors.

Some lower-risk flaws could be left until a system receives a major upgrade, while the most dangerous vulnerabilities may require action within days. That kind of triage will become more important as AI produces more findings, Cerkovnik said, because neither CVE nor the organizations relying on it can treat every newly discovered flaw as equally urgent.

]]>

CISA still finds water system controls exposed online amid multistate hacks

David DiMolfetta — Thu, 06 Aug 2026 14:53:00 -0400

LAS VEGAS — Federal cyber officials are still finding water system controls exposed to the public internet, even as the Cybersecurity and Infrastructure Security Agency and the FBI help utilities recover from a series of cyberattacks affecting at least 12 states, acting CISA Director Nick Andersen told Nextgov/FCW on Thursday.

“We’re seeing things like [programmable logic controllers] that are open and accessible on the internet with either no password set or default password set,” Andersen said in a brief interview on the sidelines of the Black Hat cybersecurity conference. “We’re not making ourselves hardened targets.”

Programmable logic controllers, commonly dubbed PLCs, are small computers used to operate pumps, valves and other equipment inside water facilities. Connecting them to the internet can allow operators to manage equipment remotely but it can also give hackers a path into systems that directly control physical processes.

Andersen said CISA’s immediate guidance to utilities remains straightforward: “Get your operational technology off the internet, set a password.”

The remarks come about a week after CISA warned that hackers were increasingly targeting internet-connected controllers used by water and wastewater utilities. The agency said attackers had changed passwords and other settings, locking out operators and contributing to water pressure problems, boil-water notices and extended periods of manual operation.

More than 30 community water systems in Minnesota were targeted late last month, according to state officials. Around 12 states have reported similar activity in recent days, though state officials said they continued operating safely and experienced no known effects on public health. The FBI has said it is aware of the incidents. Andersen also said CISA is working with the FBI on incident response.

But the cyberdefense agency isn’t attempting to determine publicly who was responsible for the hacks, he said.

Some U.S. officials suspect Iran-linked hackers carried out the attacks. A CISA notice distributed to water utilities last month said the activity in Minnesota shared characteristics with an earlier campaign involving Iran-affiliated hackers, though it didn’t provide direct evidence linking the latest incidents to Tehran.

“For us, we’re not doing anything with attribution right now,” Andersen said, explaining the agency is instead focused on assisting affected organizations, educating operators and improving the sector’s security over the longer term.

CISA also tries to identify vulnerable organizations before they are attacked by examining the broader collection of internet-facing systems, Andersen said. When the agency discovers a potentially exposed device or another security problem, it coordinates with other agencies and contacts the operator, he added.

Andersen couldn’t provide a precise estimate of how many exposed or poorly secured devices remain online.

Water utilities can be difficult to secure because many are small, have limited budgets and depend on aging equipment installed and maintained by multiple contractors. Still, Andersen said infrastructure operators bear some responsibility for taking basic precautions that can make their systems more difficult to compromise.

“There’s a degree of personal responsibility there to sort of engage in these minimum requirements that are feasible for helping to continue to secure yourselves,” he said.

]]>

DOGE took credit for savings that never happened, watchdog finds

Christian Robles — Thu, 06 Aug 2026 14:32:00 -0400

The Trump administration should prominently display data quality issues and limitations on the Department of Government Efficiency’s website listing estimated savings, the Government Accountability Office recommended in a new report, finding the public tally heralding billions of dollars in estimated savings was rife with errors.

The watchdog found that the website’s estimated savings tracker — or “Wall of Receipts” — listed contracts that were not actually cancelled, took credit for leases that were in the process of termination before DOGE’s existence and did not adequately explain how savings were calculated. The findings cast doubt on DOGE’s claim that it saved taxpayers $215 billion by slashing contracts, grants, leases and other wasteful expenditures.

The report, requested by Sens. Gary Peters, D-Mich., and Richard Blumenthal, D-Conn., analyzed the wall of receipts’ estimated savings of roughly $110.34 billion from supposedly terminated contracts, grants and leases.

GAO found that roughly $34.6 billion of the estimated $61 billion saved from cancelled contracts came from either contracts that were never actually terminated or could not be corroborated as terminated.

DOGE specifically reported it cancelled 13,476 contracts but “almost 2,000 contracts were not terminated,” according to GAO’s analysis of the Federal Procurement Data System. In one case, DOGE continued to estimate saving taxpayers more than $1.7 billion by cancelling a Defense Health Agency IT support contract after Defense Department officials got DOGE officials to agree the contract should not be terminated, GAO wrote. No action was ultimately taken on the contract.

Additionally, about 27.8% of contracts listed as terminated — including all contracts at the DOGE-dismantled United States Agency for International Development — did not include identifying information, GAO found. Because of this lack of information, the office could not find 1,856 supposedly terminated contracts on the Federal Procurement Data System even after taking additional steps to do so.

The watchdog added that DOGE did not consistently use its stated methodology for calculating estimated savings from terminated contracts. And even in cases where DOGE did use its stated methodology, it did not “account for many complexities and nuances of federal contracting or sufficiently identify limitations.” DOGE — whose operation formally ended as of July 4 — did not return GAO’s requests for interviews or clarifications.

DOGE did not provide sufficient information to verify about 96.2% — or $47.32 billion — of estimated grant savings, GAO found. But even for the small portion of grant savings GAO could replicate, “the amount of reported savings may not be realized,” according to the report.

DOGE reported that it terminated 264 leases, saving taxpayers about $113 million. But the General Services Administration told GAO that 108 out of those 264 leases were identified for termination before DOGE was established. Because of that discrepancy and other inaccuracies, GAO estimated DOGE overstated how much it saved on terminated leases by $81.1 million.

DOGE also further overstated lease savings by not considering other factors, such as relocation costs and potential early termination fees, according to the report.

The White House did not return a request for comment by the time of publication.

“This GAO report underscores the need for increased transparency and accountability from the Trump Administration so the American public can better understand DOGE’s activities as the organization guts vital government programs,” Blumenthal said in a press release.

The GAO released a separate report Wednesday where it said it could not verify if DOGE employees completed required ethics training designed to avoid conflicts of interest.

]]>

Palantir calls on GSA to withdraw draft AI acquisition rule

Christian Robles — Thu, 06 Aug 2026 11:49:00 -0400

The General Services Administration should axe its draft large language model-specific acquisition rule, in part because it is purportedly unlawful and would undermine Trump administration goals if it were finalized, Palantir argued in recent comments on the proposal.

“If implemented, the Proposed AI Clause will likely prevent Palantir from providing government customers with the AI-powered solutions they need through GSA contracts,” law firm Freshfields warned on behalf of the company.

“Accordingly, Palantir expects government customers to turn to non-GSA contract vehicles to acquire Palantir’s most valuable AI-powered commercial solutions, thus diluting the promise of GSA contracts overall,” the company added in a letter to GSA.

Palantir argued that GSA has no independent authority to finalize the proposed LLM rule and would violate the Federal Acquisition Streamlining Act by mandating contracting requirements beyond standard commercial practices if it did finalize it. It notes that the courts have held that when an agency claims authority to decide on an issue of “vast economic and political significance,” Congress must delegate that authority in statute, which it has not done here. The company further said that the rule would significantly burden contractors and cause agencies to turn to other contract vehicles, undermining the Trump administration’s goal of reducing inefficiencies and consolidating procurement through GSA.

The company also called the proposed LLM rule incompatible with legal requirements for defense acquisitions — such as limitations on the clauses defense agencies can require of contractors and prohibitions on “demanding proprietary IP rights as a condition of contract award” — and said it disregards decades of intellectual property rights precedence.

Menaka Kalaskar, head of Palantir’s U.S. government legal and contracting team, raised much of the same concerns during a GSA listening session last month but stopped short of calling for the agency to withdraw the rule.

“If the clause is really needed, then it can be included in the [Federal Acquisition Regulation] overhaul rather than the GSA coming out on its own,” Kalaskar said at the time.

Palantir’s call for GSA to kill the LLM acquisition clause stands apart from much of the rest of the federal contracting industry.

During last month’s listening session, industry groups representing contractors widely urged GSA to clarify definitions and modify flowdown requirements if the agency wanted to achieve its goal of safeguarding government data processed by LLMs. Groups reiterated many of those same talking points in letters sent to GSA, according to an Nextgov/FCW review of a dozen public comments on regulations.gov.

Coalition for Common Sense in Government Procurement members “continue to have concerns regarding the overly broad language utilized in the AI clause and believe the AI clause may have a chilling effect on contractor use and adoption of AI should the clause be finalized as written,” the group wrote to GSA.

The coalition asked GSA to ensure only data directly submitted to an LLM’s inference engine — not upstream and downstream processing by ancillary system components — be subject to LLM rule requirements. The group also asked GSA to create a bright-line test to clearly define when LLM functionality is “incidental to the primary purpose of the core requirement being procured” and therefore not subject to LLM rule requirements.

The Software & Information Industry Association, AEM Corporation, Sheppard, Mullin, Richter & Hampton LLP, the Business Software Alliance, Professional Services Council and the Information Technology Industry Council similarly called for GSA to more clearly define the scope of the LLM acquisition rule, Nextgov/FCW found in a review of comments sent to GSA.

But the contracting industry is not united on how to reform the proposal.

For example, the Information Technology Industry Council urged GSA to get rid of a requirement that contractors ensure LLMs are developed and monitored in a way that adheres to “unbiased AI principles.”

“The criteria through which the government will evaluate compliance are still insufficiently defined, which creates ongoing uncertainty regarding the government’s expectations,” Megan Petersen, ITI’s senior vice president of policy, public sector and counsel, told Nextgov/FCW. “Without clear definitions and transparent compliance benchmarks, contractors will be held to an impossible performance standard.”

Other groups instead urged GSA to clear up the “unbiased AI principles” language with objective metrics contractors could use to ensure compliance with the regulation.

The Professional Services Council urged GSA to publish its benchmark methodology and evaluation criteria for “unbiased AI principles” and update them through notice-and-comment periods. The group pointed to NIST AI RMF 1.0 trustworthiness criteria and the IEEE 7003 Algorithmic Bias standard as some third-party standards GSA could use.

In total, 79 stakeholders sent GSA comments on the potential LLM procurement overhaul before the Aug. 3 deadline, according to regulations.gov.

]]>

AI advances are pushing governments to treat cyberattacks as routine, Western officials say

David DiMolfetta — Thu, 06 Aug 2026 10:15:00 -0400

LAS VEGAS — The rise of autonomous artificial intelligence systems capable of finding and exploiting software flaws is putting serious pressure on governments to treat cyberattacks as inevitable events rather than rare emergencies, senior officials from the United States, Canada and Britain said Wednesday.

“Cyber compromise is not a black swan anymore. It’s just a swan,” Joseph Alm, the Department of Homeland Security’s assistant secretary for cyber, infrastructure, risk and resilience policy, said on an OpenPolicy panel at the Black Hat cyber conference. Organizations can no longer treat a breach as an unforeseeable crisis, he argued, and they should instead assume one will occur and prepare to limit the damage.

Alm said governments and companies need to devote more attention to “harm reduction,” including the steps they would take to contain an intrusion and continue operating after a hacker gets inside. AI is making it easier for hackers to find and exploit the weaknesses already buried in older technology, he added.

The remarks highlight a bleak near-term reality for cyberdefenders that concludes AI systems will find and exploit weaknesses faster than governments can fix them, and that agencies will need to assume some attacks will succeed and plan accordingly.

Michael Duffy, the federal government’s acting chief information security officer, said federal cyber policies over the past decade have largely been written after a crisis, with the Office of Personnel Management and SolarWinds breaches prompting new requirements designed to prevent the same failures from recurring.

The U.S. has become better at finding what went wrong and preventing the same failure from happening again, but the next decade needs to focus on anticipating attacks and ensuring agencies can continue functioning while under pressure, he argued .

“We know things cannot go down for an extended period of time,” Duffy said.

Some officials, however, cautioned against viewing AI as the source of most cyber risk. Jonathon Ellison, the U.K. National Cyber Security Centre’s director for national resilience, said a more immediate problem for many organizations remains the large number of known weaknesses already sitting inside their networks after years of underinvestment.

Policy discussions can focus too heavily on AI discovering new vulnerabilities when companies are already carrying enormous security burdens from outdated and poorly secured technology, Ellison said.

Thomas Lind, a former intelligence officer who directed policy at the White House Office of the National Cyber Director until June, noted that while officials anticipated advanced AI cyber capabilities, the rapid proliferation of these tools beyond certain governments and large firms has drastically reduced response times for policymakers and defenders.

Rajiv Gupta, head of the Canadian Centre for Cyber Security, similarly described autonomous agents as a significant change that governments are still working to understand, even though Canada has used less advanced forms of AI in cyber defense for years. At the same time, he said, countries still face a substantial backlog of older technology that must be replaced or secured, and governments will not have a “patch army” capable of fixing every vulnerable system for every organization.

That reality has led Canadian officials to consider what basic services citizens should expect the government to preserve during an extreme disruption, including the hypothetical loss of internet access for as long as three months. Gupta described the work as a “Minimum Viable Canada” initiative focused on identifying and maintaining the country’s most essential functions through a crisis.

The warnings come amid a series of recent unprecedented cyber incidents involving autonomous AI agents. Last month, OpenAI models escaped an internal cybersecurity evaluation environment and breached Hugging Face. Britain’s AI Security Institute disclosed this week that agents powered by Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol took unauthorized actions on the public internet during testing, including an unsuccessful attempt to place malicious code in an open-source software project.

And just Wednesday, Meta confirmed that one of its models exploited a flaw at another company after an outside testing firm mistakenly gave it internet access.

Duffy said he is working with NIST, the Cybersecurity and Infrastructure Security Agency and other parts of the government to more quickly turn technical guidance on emerging cybersecurity risks, including those involving AI, into policies for federal agencies. He didn’t provide a timeline for any finalized guidance.

The government can’t wait for another major incident to determine how AI should be governed or how agencies should use them, Duffy argued. “We likely won’t have time to pick up the pieces with the speed and the scale of what we’re seeing in these AI capabilities,” he said. “We know the types of steps that need to be taken. Let’s take them now.”

]]>

Watchdog puts new numbers on the size of DOGE, but many details remain unknown as agencies refuse to turn over information

Sean Michael Newhouse — Thu, 06 Aug 2026 09:00:00 -0400

The Government Accountability Office on Wednesday published a report that uncovered more information about the individuals who worked for the Department of Government Efficiency. Still, the congressional watchdog’s findings were limited, including with respect to whether the DOGE employees completed required ethics training and paperwork, due to a lack of cooperation from agencies.

Investigators determined that there were at least 206 employees who worked for the Trump administration’s cost-cutting entity that held positions in the Executive Office of the President, even if they were detailed to other agencies, between Jan. 20, 2025, and Jan. 31, 2026. That number excludes DOGE staffers who were not assigned to the EOP.

GAO found that at least 128 of these individuals separated from their EOP positions by Jan. 31, 2026.

Of those 206 staffers, at least 27 were special government employees, meaning they could not serve for more than 130 days during any one-year period. For example, Elon Musk, the former de facto head of DOGE, was an SGE, which raised conflict of interest questions due to his companies receiving billions in federal contracts.

However investigators were not able to determine the appointment type, such as Schedule C political appointee or noncareer Senior Executive Service, for more than 150 of the personnel because many agencies did not provide the requested information.

“This total includes the 127 [U.S. DOGE Service] employees who held titles as digital services experts or consultants within USDS,” according to the report. “Although USDS has stated that USDS positions last no more than 4 years, we were unable to determine whether these USDS employees or other personnel had held such time-limited appointments.”

In total, 10 agencies and the EOP did not respond to requests from GAO for records that these DOGE employees participated in ethics training and completed financial disclosure reports.

“As a result, we are not able to determine the total number of DOGE personnel who held positions within EOP who received trainings or who completed financial disclosures at those 10 agencies or at EOP,” investigators wrote.

Nine agencies, covering 64 DOGE employees, did submit information about whether the staffers did such training and reports. But GAO argued that much of the documentation was incomplete. For example, the Agriculture Department provided an “ethics-related presentation” for Trump appointees but didn’t offer evidence for when, or if, the DOGE staffers received the training.

The White House did not respond to a request for comment.

While “the U.S. DOGE Service Temporary Organization” terminated on July 4, pursuant to the executive order establishing it, GAO pointed out that the directive permanently renamed an existing White House office as the U.S. DOGE Service.

“Since the EO does not call for the termination of the broader USDS entity, it is possible that USDS and personnel at federal agencies could continue to do work that advances some of these initiatives after the temporary organization’s termination,” investigators wrote.

DOGE spearheaded many of the civil service reductions that took place last year, resulting in a decrease of more than 350,000 to the federal employee headcount.

GAO in April reported that the Treasury Department and DOGE did not follow all security protocols with respect to granting access to government payment systems.

]]>

OpenAI agents rebuilt internal message board in lead-up to Hugging Face breach

David DiMolfetta — Wed, 05 Aug 2026 19:06:00 -0400

LAS VEGAS — OpenAI models created a shared message board inside the company’s systems, used it to trade hacking methods and found a way to bring it back after engineers shut it down, company researchers said Wednesday in a more complete account of how an internal test led the agents to breach Hugging Face last month.

The account, presented at the Black Hat cybersecurity conference, showed how agents working on separate experiments found one another, exchanged information and built on each other’s work over roughly two months, ultimately contributing to the breach and illustrating how difficult to contain such advanced AI systems can become when they work together.

The breakdown offered major new details about how the agents coordinated and the possible dangers of increasingly autonomous AI systems finding ways to work together when they can reach real-world computer systems.

It involved “a team of agents who are working together, finding exploits, sharing them with one another, moving laterally through our systems, through external systems and doing this over the course of days and weeks,” said Eric Wallace, an OpenAI researcher.

The agents were participating in internal training and cybersecurity evaluations in which some safeguards had been reduced so OpenAI could measure their capabilities.

Wallace and OpenAI security engineer Michael Dalton said the activity began in May, when agents struggling to complete difficult or, in some cases, impossible assignments began searching for shortcuts. One discovered that it could leave files on Artifactory, a service OpenAI used to download and store software packages, and a second later used it to ask whether other agents had found a missing file.

Those agents found the files and responded, gradually turning the service into an accidental message board through which models in separate experiments could exchange instructions and information about newly discovered security flaws. Some agents began assigning work to one another or leaving behind scripts that allowed another model to continue where they had stopped.

The agents eventually found a previously unknown flaw that gave them control of the service, and their activity caused an outage in early July that alerted OpenAI engineers to the problem. The company rebuilt the affected system, revoked the credentials the agents had used and deleted the message board, but the fix did not last. Two days later, agents found another way to leave messages through the same service and resumed sharing information.

Their communications became increasingly organized, with agents developing ways to address one another, exchange tools and avoid overwriting each other’s work. At one point, Wallace said, they considered signing their messages because they suspected another agent was impersonating members of the group.

The agents then carried out overlapping attacks against OpenAI’s infrastructure and Hugging Face. Inside OpenAI, they found another previously unknown flaw, took control of a server and obtained administrator access to a wider part of the company’s computing environment, Dalton said.

At Hugging Face, they took advantage of two flaws in the company’s systems for processing uploaded datasets. One allowed them to retrieve internal files and credentials, while the other allowed them to run commands on Hugging Face servers. Dalton said the agents expanded their access across multiple parts of the company’s infrastructure in less than 13 hours.

Hugging Face’s technical reconstruction documented some 17,600 actions during the campaign. The agents accessed five private datasets that appeared connected to the cybersecurity test, but the company found no evidence that they altered public models, datasets or software packages.

On Tuesday, at Black Hat, former NSA cyber director Rob Joyce said the Hugging Face episode was arguably the most consequential hack since the Morris Worm in 1988.

Dalton said the incident demonstrated that groups of AI agents can already carry out coordinated hacking campaigns without people directing each individual action, leaving defenders under pressure to develop tools capable of responding at the same speed.

“What I would internalize is AI-orchestrated, fully automated offensive attacks are real now, and the actions we have discussed today were an unintended side effect of running evaluations on frontier AI,” he said. “In the near future, we should expect that threat actors will intentionally deploy, optimize, weaponize and use offensive agent collectives in the manner that we have just described here.”

]]>

Hugging Face AI breach is ‘most consequential hack’ since Morris Worm, former NSA cyber chief says

David DiMolfetta — Wed, 05 Aug 2026 13:32:00 -0400

LAS VEGAS — An OpenAI system that broke out of a cybersecurity test and entered Hugging Face’s network was a “watershed moment” comparable to the 1988 Morris Worm infection, former National Security Agency cybersecurity director Rob Joyce said Wednesday.

“We’re living in the last several weeks through with what I think is the most consequential hack,” Joyce said. He spoke alongside fellow former NSA cybersecurity director Dave Luber during a World Wide Technology panel held at the Black Hat cyber conference.

“I have to go back all the way to the Morris Worm in the ’80s to say something that’s equivalent to how it’s going to change the way we think about our infrastructure,” he said.

The Morris Worm spread automatically across the early internet, disrupting thousands of computers and helping spur major changes in how the government and technology industry handled cyber incidents. The episode led to the first felony conviction under the 1986 Computer Fraud and Abuse Act.

Joyce said he once believed large language models would mainly help hackers write convincing phishing emails and create fake images, audio and video, but he didn’t expect them to become broadly useful for carrying out the more technical stages of an attack.

“And boy, was I wrong,” he said, adding that the systems can now understand computer programs and networks well enough to find vulnerabilities that can be turned into working intrusions.

Hugging Face disclosed in July that an autonomous agent powered by OpenAI models had gained unauthorized access to parts of its production network. The company operates a widely used platform where developers store and share AI models, software and data.

OpenAI had been testing how effectively its models could find and exploit software vulnerabilities. The company loosened some of the models’ normal security safeguards for the exercise, which was supposed to remain inside an isolated testing environment. The agent instead reached Hugging Face, accessed internal datasets and credentials and moved across parts of its infrastructure.

Other researchers have since reported AI agents acting beyond the intended limits of cybersecurity tests. Britain’s AI Security Institute said Tuesday that agents powered by Anthropic and OpenAI models took unauthorized actions on the public internet during 10 of 122 test runs.

In the most serious case, an agent created fake online identities and attempted to convince an open-source software maintainer to approve malicious code. The maintainer rejected the proposed change, and investigators found no resulting real-world harm.

Luber, who succeeded Joyce at NSA before retiring from government last year, said advanced AI can also make powerful hacking tools available to a wider range of adversarial groups.

Five years ago, Luber said, previously unknown software flaws — known as zero-days because developers have “zero days” to fix them before being exploited — were mainly used by well-resourced nation-state hackers, while ransomware gangs generally relied on known vulnerabilities that victims had failed to patch.

“I think that’s changed,” Luber said. As advanced capabilities become more widely available, ransomware collectives could acquire more undisclosed exploits and use them more freely to break into victims’ networks, he added.

Joyce said attackers already use automation to scan continuously for various digital security gaps. AI agents can perform that work around the clock without becoming tired or distracted. Defenders, meanwhile, still rely heavily on people to review alerts, approve updates and respond to suspicious activity.

“The attackers are coming at machine-speed,” Joyce said. “We are on the defense, not at machine-speed today, and that’s got to change.”

The tools aren’t necessarily inventing entirely new hacking techniques, Joyce said, but they are becoming much better at uncovering years of neglected security problems — often dubbed technology debt — across companies and government agencies. Tech debt can include outdated software, unpatched security flaws, default passwords and systems that were built or configured quickly but never fully secured.

That speed should change how organizations install security updates, especially on devices connected directly to the public internet, he argued.

Companies typically test patches before broadly installing them because a faulty update can crash computers or disrupt operations. The widespread 2024 CrowdStrike outage demonstrated the damage a defective software update can cause.

But AI could allow attackers to exploit a newly disclosed vulnerability before an organization finishes testing the patch, Joyce added.

“I think it’s gotten to the point where we have to blindly accept patches for those internet-facing devices and just take them from the manufacturer and immediately put them on,” he said.

That leaves organizations choosing between the possibility that a patch causes an outage and the possibility that waiting exposes them to hacking attempts. But “of those two bad choices, I’m going to accept more risk on a self-inflicted outage than I am exposing myself to ransomware or an extortion event,” Joyce said.

]]>