It’s called GOLD EAGLE. It coordinates vulnerability scanning across the AI industry and critical infrastructure — voluntarily, on paper. Treasury leads it. The law that makes information-sharing legally safe expires October 1. And nobody in the administration is confident Congress will renew it in time.
GOLD EAGLE’s launch was confirmed — the operational activation of an AI cybersecurity clearinghouse first mandated in President Trump‘s 2 June executive order, “Promoting Advanced Artificial Intelligence Innovation and Security.” Open-source software partners and American critical infrastructure companies have built a coordinated system to receive and patch cyber vulnerabilities at a speed and scale the administration says has never been seen before. The Treasury Department, the Department of Homeland Security through CISA, and the Department of War have worked with industry partners to enable faster exploit detection and a prioritised response to vulnerabilities across critical infrastructure sectors. GOLD EAGLE has already begun intaking and prioritising cybersecurity vulnerabilities from across industries, coordinating scanning verification, National Cyber Director Sean Cairncross confirmed.
What’s Happening & Why It Matters
The AI Vulnerability Problem GOLD EAGLE Was Built to Solve
GOLD EAGLE’s launch responds to a specific and well-documented technical trend that TF has tracked throughout 2026. Open-source and proprietary AI models made in the United States are already being used to scan for vulnerabilities at an unprecedented scale, a senior White House official said. AI-powered vulnerability discovery — the same capability Anthropic and OpenAI have built into their frontier models — has produced what one industry calls a “bug tsunami”: more vulnerabilities discovered faster than defenders can triage and patch them.
GOLD EAGLE’s core function addresses that specific bottleneck. “A team of industry and government engineers are working to triage, prioritise and fix those vulnerabilities in a way that mitigates risk for industry absorbing them,” a senior official said. An important responsibility is to “deconflict” — ensuring resources aren’t wasted scanning for or fixing the same vulnerability multiple times across separate teams unaware of each other’s work. The clearinghouse is technically operated through a Vulnerability Information and Coordination Environment, a Python-based platform developed by Carnegie Mellon University‘s CERT Coordination Center — the same institution that has coordinated vulnerability disclosure for the wider software industry for decades.
Directly Tied to Anthropic’s Mythos — the Trigger Behind the Executive Order
GOLD EAGLE’s launch traces directly to a specific AI capability demonstration TF has covered extensively. The underlying executive order came in response to advancements in new AI models — particularly Anthropic‘s Claude Mythos model preview, which showed the ability to far outpace humans in identifying and exploiting new cyber vulnerabilities. As TF covered in its Claude Fable 5 suspension article and Andrew Garbarino Mythos demo article, Congressional demonstrations of Mythos’s ability to both find and patch bank system vulnerabilities alarmed lawmakers across both parties throughout June.
That same capability is precisely what makes GOLD EAGLE necessary and precisely what makes it dangerous if mismanaged. A model that can find vulnerabilities faster than humans is equally capable of finding them for defenders or attackers — the clearinghouse exists to ensure the defensive use case wins the race.
On Paper and in Practice
GOLD EAGLE’s launch carries a specific structural tension that legal analysts have flagged directly. The order disclaims any mandatory licensing, pre-clearance, or permitting requirement — participation is technically optional for every company involved. By contrast, early engagement — and especially designation as a “trusted partner” — is likely to translate into preferred placement in federal acquisitions and first-look access to government-facing deployments. “Voluntary on paper, table stakes in practice,” as one legal analysis of the order put it directly.
The clearinghouse specifically names rural hospitals, community banks, and local utilities as eligible beneficiaries of federally-facilitated cybersecurity tools — organisations that typically lack the resources to build advanced AI-powered defensive capability independently. Treasury Secretary Scott Bessent called the effort around exactly that gap: “Treasury is working hand in hand with the private sector to safeguard our financial institutions, close vulnerabilities, and protect the integrity of the US financial system.”
The 1 October Cliff: Could Things Fall Apart?
GOLD EAGLE’s launch depends on a piece of legislation that is set to lapse in less than three months. The entire information-sharing framework relies on the Cybersecurity Information Sharing Act of 2015, which expires on 1 October 2026. That law “provides liability and antitrust protection for industry to share information such as vulnerabilities to the USG,” a senior White House official explained. “Without that reauthorization, this effort is fundamentally challenged.”
The administration is asking Congress for a clean 10-year reauthorisation. By contrast, the official’s own language betrayed genuine uncertainty about whether that will happen in time: “I would expect that Congress will step up and do the right thing and act” — a statement of hope rather than confirmed legislative commitment. Without the legal shield that law provides, companies sharing vulnerability data through GOLD EAGLE face real antitrust and liability exposure — a risk few private companies will accept indefinitely on faith that Congress acts before the deadline.
TF Summary: What’s Next
GOLD EAGLE is operationally intaking and prioritising vulnerabilities across participating sectors. The Cybersecurity Information Sharing Act’s reauthorisation deadline falls on 1 October 2026 — roughly ten weeks from GOLD EAGLE’s launch. The US House Science Committee has already advanced 10 bipartisan AI-related bills, including the AI Security and Innovation Act, signalling parallel legislative groundwork. A classified benchmarking process to define “covered frontier models” for the parallel voluntary early-access framework is under development, with an August 2026 target.
MY FORECAST: GOLD EAGLE’s launch will function effectively for its largest and best-resourced participants — major banks, defence contractors, and Fortune 500 critical infrastructure operators already have the security teams capable of absorbing the vulnerability data the clearinghouse distributes. By contrast, the rural hospitals, community banks, and local utilities the order specifically names as beneficiaries will struggle to act on shared vulnerability information without additional federal support beyond the clearinghouse itself — a gap that will surface publicly within the first six months of operation. The October 1 reauthorisation deadline is the genuine make-or-break moment: without it, participating companies face real legal exposure for the information-sharing GOLD EAGLE requires, and expect at least one major participant to pause cooperation publicly if Congress has not acted by mid-September.
Related Stories
- Anthropic Pulls Claude Fable 5 — Four Days After Launch, on Government Order
- Mythos 5 Returns for Critical Infrastructure — Fable 5 Remains Suspended
- FortiBleed: Credential Leak Hits Oracle, Lenovo, NATO, and 74,000 Fortinet Firewalls