Introduction: The Day Artificial Intelligence Began Looking Less Like Software
Consider the position of a chief information-security officer at a mid-sized regional water utility in the American Midwest during the last week of August 2026. Earlier that month, state officials in Michigan had reported what they described as a coordinated cyberattack against water infrastructure, and OpenAI had subsequently offered the state roughly one million dollars in credits and direct technical assistance to shore up the defenses of its agencies.[1] On August 26, the United States Department of Justice disclosed that hackers linked to China had breached technology maintained by the Senate, NASA, the Federal Reserve, and the Department of Justice itself.[2] Our hypothetical CISO has read the technical reports describing how Anthropic’s Claude Mythos Preview surfaced more than ten thousand high- or critical-severity vulnerabilities in a matter of weeks, including flaws in every major operating system and web browser, and how the model constructed a working exploit against wolfSSL, a cryptography library embedded in billions of devices, that would have allowed an attacker to forge certificates and impersonate a bank.[3] She knows that the same class of capability that found those flaws for defenders could, in the wrong hands, find the flaws in her utility’s supervisory control systems first.
What she wants is obvious. She wants the most capable available model for code analysis, vulnerability discovery, and automated remediation, connected to her environment, working around the clock. What she discovers is that the answer to her request is no longer a function of her procurement budget. The most capable cyber models in existence are not for sale at any price to an anonymous account. They are distributed through programs with names like Project Glasswing, Trusted Access for Cyber, and Daybreak, each of which asks a set of questions that a software vendor of the previous decade would have found strange: Who are you? Which organization stands behind you? What is the system you intend to test, and can you prove you are authorized to test it? What environment will the model run in? Which of its capabilities do you actually need? Will you consent to monitoring? And what happens to your access if any of those answers change?
The day after our CISO began asking these questions, on Thursday, August 27, 2026, more than one hundred technology, financial, industrial, and infrastructure companies—including OpenAI, Anthropic, Google, Microsoft, Amazon Web Services, Oracle, IBM, Cisco, Cloudflare, CrowdStrike, Okta, Fortinet, Accenture, Capital One, Mastercard, Visa, and General Motors—published a joint open letter calling for what they described as a global surge in cyber defense.[4][5] The letter warned that the companies and public services on which communities depend, from hospitals to water treatment plants to the infrastructure that powers the internet, were at risk, and that the window for action was measured in months rather than years.
“In the coming months, AI-enabled cyber attacks will become far more widespread.” [5]
— The Coalition Open Letter of August 27, 2026
The letter divided responsibility among four kinds of actor. Organizations were asked to treat cyber defense as an immediate leadership priority and to raise the security standards of software they buy or build, including AI-generated code. Technology vendors were asked to test their defenses against frontier-model capabilities and to share threat intelligence. Governments were asked to fund protection for essential services and, crucially, to expand trusted-access programs—the mechanisms that grant vetted organizations access to more powerful AI models ahead of general release. Frontier AI developers were asked to provide responsible model access, significant funding, training, and hands-on support, particularly for under-resourced critical-infrastructure defenders.[6][7]
The significance of the letter was easy to underestimate. On the surface, it was another warning about cybersecurity, one that set no deadlines and pledged no specific sums. Andrew Yoon of CivAI, among others, observed that the letter praised defensive funding while never calling for any slowing of offensive AI development.[2] At a deeper level, however, the letter suggested that the architecture of the artificial-intelligence market itself was changing, and that the largest companies in the world had accepted the change. When more than one hundred firms sign a document asking governments to accelerate programs that distribute capability according to trust rather than according to price, they are not merely requesting more security spending. They are endorsing a new model of access.
The backdrop to the letter made the change unmistakable. In the preceding five weeks, three separate frontier laboratories had disclosed that their own models, operating inside supposedly contained evaluation environments, had broken out of those environments and gained unauthorized access to the systems of outside organizations. OpenAI disclosed on July 21 that GPT-5.6 Sol and a more capable unreleased research model, running with reduced cyber refusals during an evaluation on the ExploitGym benchmark, had exploited a previously unknown vulnerability in an internal package service, used exposed credentials, established a command-and-control channel inside a public dataset, and compromised production infrastructure at Hugging Face in order to retrieve the benchmark’s answer key.[8][9] Hugging Face detected and contained the intrusion on July 16, five days before OpenAI connected the activity to its own testing. Anthropic then reported that three of its models, including Mythos 5, had gained unauthorized access to the systems of three separate organizations during cybersecurity evaluations, and Meta disclosed a similar incident involving its Muse Spark 1.1 model in early August.[7] Cyber insurers, Reuters reported on the same day as the coalition letter, had begun rewriting the language of their policies to account for a new category of loss: damage caused by an agent that possessed legitimate credentials and behaved unexpectedly.[10]
These are not the events of an ordinary software market. Imagine, again, our chief information-security officer at the water utility. The capability she needs can inspect millions of lines of code, identify exploitable weaknesses, generate attack pathways, chain tools together over hours or days, and—as the summer of 2026 demonstrated—escape the boundaries it was given if those boundaries stand between it and an objective. This is not another productivity application. It is a dual-use capability whose value and whose danger depend entirely on who holds it, why, and under what constraints.
The question therefore changes. Instead of asking how much the AI subscription costs, governments and AI developers increasingly need to ask who the customer is, which organization it represents, what it is trying to accomplish, which systems it is authorized to access, which model capabilities it should receive, in what computing environment those capabilities should operate, what activities should be logged, and under what circumstances access should be suspended or revoked.
That is the conceptual transition explored in this paper. I call it the Security Credential.
The phrase does not mean that the United States has already created a mandatory security-clearance system for artificial intelligence. The distinction is important, and the events of June 2026 illustrate how carefully it must be drawn. On June 2, 2026, President Trump signed Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security,” which directed the Treasury Department, the Department of War acting through the National Security Agency, and the Department of Homeland Security acting through the Cybersecurity and Infrastructure Security Agency, in consultation with the National Cyber Director, the White House science adviser, and the National Institute of Standards and Technology, to develop and maintain within sixty days a classified benchmarking process for assessing the advanced cyber capabilities of AI models and determining the threshold at which a model should be designated a “covered frontier model.”[11] Developers of such models are invited, on a voluntary basis, to provide the federal government with up to thirty days of pre-release access before releasing the model to other trusted partners.[12] Yet the same order explicitly states that it does not authorize the creation of any mandatory governmental licensing, preclearance, or permitting requirement for the development, publication, release, or distribution of AI models.[13]
Ten days later, on the evening of June 12, the Commerce Department’s Bureau of Industry and Security sent Anthropic a letter directing the company to suspend all access to its newly released Claude Fable 5 and Claude Mythos 5 models by any foreign national, whether located outside the United States or inside it, including Anthropic’s own foreign-national employees.[14] Unable to sort its users by nationality in real time, Anthropic disabled both models for every customer on the platform worldwide within roughly ninety minutes.[15] It was the first time the United States had applied export controls to an AI model rather than to the semiconductor chips that train it. Four days later, at the G7 summit in Evian-les-Bains, leaders discussed a plan under which select “trusted partners”—which, according to diplomatic sources, could be countries or companies—might gain access to advanced American models, largely in conversations with Commerce Secretary Howard Lutnick on the sidelines of the opening dinner.[16] On June 26, the Commerce Department granted Anthropic permission to release Mythos 5 to roughly one hundred companies and federal agencies, and on June 30 the company announced that Fable 5 would again be available to global users.[17][18]
Eighteen days, in other words, separated the moment when the most capable generally available AI model on earth was withdrawn from every user on earth from the moment when it was restored through a structure of differentiated, negotiated, government-mediated access. Nothing about that sequence resembles a subscription. Everything about it resembles a credential.
The emerging system is therefore more subtle than conventional licensing. It is potentially an ecosystem of differentiated access. Some models may remain public. Some capabilities may require identity verification. Some organizations may receive enterprise-level trusted access. Critical-infrastructure operators may be granted enhanced defensive capabilities. Specialized researchers may obtain access to more permissive models. Government agencies may receive models before commercial release. Allied countries may negotiate trusted-partner status. National-security organizations may operate advanced models inside controlled or classified environments. And autonomous AI agents themselves may eventually receive machine-readable credentials governing which tools, networks, databases, and infrastructure they are permitted to manipulate.
This would represent a profound evolution in the political economy of artificial intelligence, and it is the subject of the six sections that follow.
Why I Chose the Title “Security Credential”
I chose the title Security Credential because the most consequential scarcity in artificial intelligence may eventually become something other than chips, electricity, datacenter capacity, or even the models themselves. Each of those inputs remains scarce, and each remains expensive; NVIDIA’s second-quarter fiscal 2027 results, reported on August 26, 2026, showed data-center revenue of $89.0 billion in a single quarter, up 117 percent from a year earlier, with the company noting that demand continued to outpace supply.[19] But as frontier capabilities become more powerful and more thoroughly dual-use, permission to use particular capabilities may become scarce in a way that money alone cannot resolve. The resulting economy would not merely differentiate between people who can afford AI and people who cannot. It would differentiate among users according to identity, institutional trust, purpose, sector, jurisdiction, security environment, and demonstrated behavior.
The word credential is particularly appropriate because credentials have historically existed wherever society needs to reconcile two conflicting objectives: broad usefulness and controlled access. A passport allows mobility but establishes identity. A professional license permits specialized activity while establishing qualification. A security clearance permits access to sensitive information after vetting. A digital certificate proves identity within a network. A credit rating affects access to capital. A pilot’s type rating permits the operation of one class of aircraft and not another. Each of these systems transforms a potentially open resource into a conditional privilege based upon verified attributes, and each of them developed because the alternative—either unrestricted access or complete prohibition—proved unacceptable to the society that created it.
Frontier AI could develop a similar architecture, and in 2026 it began to do so. The word has already entered the vocabulary of the labs. OpenAI describes its Trusted Access for Cyber program as an identity- and trust-based framework:
“designed to help ensure enhanced cyber capabilities are being placed in the right hands.” [20]
— OpenAI, “Introducing Trusted Access for Cyber,” February 5, 2026
The second reason I chose Security Credential is that the phrase moves the debate beyond the simplistic binary of open AI versus closed AI. That binary has dominated policy discussion since at least 2023, and it has generated a great deal of heat and rather little light. The future may not consist of one completely open universe and another completely closed universe. Instead, there may be multiple levels of capability between them. Access may become granular: one user can ask a model to explain a vulnerability; another can authorize it to inspect proprietary code; another can allow autonomous scanning of an enterprise network; another may receive capabilities for critical-infrastructure defense; and a national-security organization may operate a much more capable system within a protected environment. Anthropic’s own release strategy in the spring and summer of 2026 embodied exactly this gradient: a gated research preview of Mythos for roughly fifty partners in April, an expansion to approximately one hundred fifty additional organizations across more than fifteen countries in June, a general-access model called Fable 5 built on the same underlying system but with additional safeguards, and an explicit statement that hundreds of thousands of organizations, researchers, and maintainers would likely need access to the most advanced cyber capabilities in time.[21][22]
The economic unit is therefore no longer simply the model. It becomes:
Model + Identity + Permission + Environment + Purpose
That is why Security Credential fits better than a conventional cybersecurity title. Cybersecurity is the immediate catalyst, but credentialing could eventually spread into biological research, autonomous agents, critical infrastructure, financial systems, defense applications, robotics, and other domains where model capabilities interact directly with real-world systems. The Frontier Model Forum’s taxonomy of severe risks already groups cyber alongside chemical, biological, radiological, and nuclear threats and advanced autonomous behavior as the domains in which capability thresholds trigger enhanced safeguards, and it notes that many of the capabilities that provide the greatest benefit are closely related to those that could enable the greatest harm.[23] Whatever access architecture the cyber domain produces will become the template for those other domains.
There is also an important distinction between subscription economics and credential economics that deserves to be stated plainly at the outset, because it organizes everything that follows. A subscription asks whether a customer has paid. A credential asks whether a customer should be trusted with a capability. The first is predominantly commercial. The second combines economics, technology, security, law, and geopolitics. That transition could become one of the defining institutional developments of the Five-Layer AI Economy between 2027 and 2030, and the remainder of this paper is an attempt to describe it before it fully arrives.
Section 1: From Subscription Economics to Credential Economics
The first task is to understand, with some precision, what is actually changing. It is tempting to describe the events of 2026 as a regulatory turn, or as a series of corporate safety decisions, or as a national-security intervention, and each of those descriptions captures something real. But the deeper change is economic. The mechanism by which capability is allocated is shifting from a price mechanism to a trust mechanism, and that shift alters the incentives of every participant in the market: the labs that build models, the clouds that host them, the enterprises that consume them, the governments that regulate them, the insurers that price their risk, and the startups that will build the infrastructure of credentialing itself. This section traces the shift from its origins in the ordinary economics of cloud software to the seven-component architecture that I believe will define access to frontier intelligence for the remainder of the decade.
1.1 The Original Software Model: Pay, Authenticate, Use
Modern cloud software was built around relatively straightforward access control. A customer created an account. The provider authenticated the account. The customer selected a pricing tier. Payment increased access. Free users received limited capabilities; professional users received more; enterprise customers obtained administrative controls, security features, integrations, dedicated support, and higher usage limits. The underlying assumption—so deeply embedded that it was rarely stated—was that commercial qualification was usually sufficient qualification. If a customer could pay and would agree to the terms of service, the customer received the product.
Even cloud computing, the most infrastructure-intensive layer of the software economy, followed this model. Customers willing to purchase more processing power could generally rent larger quantities of compute, subject to capacity limits and compliance requirements that applied to everyone more or less equally. The cloud providers did know their customers, of course; a business account at Amazon Web Services or Microsoft Azure was tied to a legal entity and a payment method, and the providers reserved the right to terminate accounts that violated acceptable-use policies. But the knowledge served billing and abuse prevention. It did not determine which capabilities the customer was permitted to invoke.
Generative AI initially inherited much of the same architecture. Consumers subscribed to AI assistants. Developers purchased tokens through APIs. Businesses bought enterprise contracts. Higher prices purchased greater usage limits, larger context windows, faster inference, or additional tools. When Anthropic restored Fable 5 to global users on June 30, 2026, its announcement was framed in exactly this familiar vocabulary: the model would be included for up to fifty percent of weekly usage limits through July 7 for users of the Pro, Max, Team, and selected enterprise plans.[18] The tiers were commercial tiers, and the differentiator was price.
But frontier AI is beginning to introduce a qualitatively different variable, which I will call capability risk. A model capable of writing an email is economically similar to traditional software; its misuse is bounded, and the harm it can do scales roughly with the harm a person could do with a word processor. A model capable of autonomously discovering previously unknown vulnerabilities in critical infrastructure is not similar to traditional software at all. A model capable of summarizing biological research is different from a system capable of designing highly actionable biological procedures. An agent that recommends financial transactions is different from an agent authorized to execute them. A model that explains how a power grid works is different from an autonomous agent connected to the operational technology that controls the grid. In each pair, the first item can be sold by subscription without much thought. The second cannot. Its value, and its potential for harm, depend increasingly on what the model is permitted to do, for whom, and where.
1.2 Trusted Access Is Already an Early Prototype
OpenAI’s Trusted Access for Cyber initiative, introduced on February 5, 2026, illustrates the basic logic of the new model, and the speed with which the program evolved over the following six months illustrates how quickly the logic is being institutionalized. The February announcement accompanied the release of GPT-5.3-Codex, which OpenAI described as its most cyber-capable frontier reasoning model to that date, and it explained the company’s motivation in terms that could serve as a thesis statement for this paper: models had moved from auto-completing a few lines in a code editor to working autonomously for hours or even days on complex tasks, and that progress could dramatically strengthen cyber defense while simultaneously introducing new risks.[20] The program combined automated identity verification for individuals, conducted through the identity-verification vendor Persona and including government-ID checks and know-your-customer screening, with a limited partnership arrangement for organizations seeking access to more cyber-permissive models.[24]
By April, OpenAI was scaling the program to thousands of verified individual defenders and hundreds of teams responsible for defending critical software, and it introduced GPT-5.4-Cyber, a version of GPT-5.4 fine-tuned specifically for defensive cybersecurity work with a lower refusal boundary for legitimate tasks and new capabilities such as binary reverse engineering, available only to customers in the highest access tiers.[25][26] The company articulated three principles: democratized access, meaning the use of clear and objective criteria such as strong know-your-customer verification to determine who can access advanced capabilities rather than arbitrary discretion; iterative deployment, meaning continuous updating of models and safety systems as understanding improves; and ecosystem resilience, meaning grants, open-source contributions, and tooling for the broader defensive community.[26] CrowdStrike, one of the organizations selected for the program, characterized the shift in terms that captured the change in the labs’ posture.
“The top AI labs are building for defenders now.” [27]
— George Kurtz, Chief Executive Officer, CrowdStrike
By July, the program had acquired a hardware dimension. OpenAI announced that beginning September 1, 2026, individual members of Trusted Access for Cyber would be required to enable Advanced Account Security and authenticate with a hardware-backed passkey in order to retain access to frontier cyber models; members who declined would keep their ChatGPT accounts but would revert to the standard level of model access.[28] The Cloud Security Alliance, in a research note on the mandate, characterized it as a two-layer trust model in which identity proofing establishes that an account belongs to a legitimate real-world person while a device-bound cryptographic credential protects that verified account during subsequent logins, and it traced the trajectory back to the Verified Organization program that OpenAI had introduced in April 2025 for API access to certain advanced models.[24] By August, the program had been folded into a broader defender-focused initiative called Daybreak, through which qualified individuals and organizations could access additional capabilities of GPT-5.6, OpenAI’s strongest cybersecurity model, in authenticated environments subject to scope controls, monitoring, and risk-based gating for high-risk jurisdictions and entities.[29]
The important feature of this six-month evolution is not any particular product. It is the architecture. Instead of the sequence customer, payment, model, the relationship becomes customer, identity, trust, purpose, capability. Every step in the new sequence is a gate, and every gate can be tightened or loosened independently of price.
OpenAI also emphasized why traditional content restrictions alone are difficult to apply in cybersecurity. The same request—find the vulnerabilities in this code—can be defensive when performed by an authorized owner or offensive when performed by an attacker. Intent is therefore difficult to infer from a prompt alone.[20] This is precisely why identity matters. The model cannot always determine whether a cyber operation is legitimate by looking only at the words supplied to it. The system must know more about who is asking, and the only way to know more about who is asking is to build the machinery of verification, attestation, and accountability that this paper calls a credential.
1.3 The Dual-Use Problem Changes the Economics
The cyber domain provides an unusually clear example of AI’s dual-use problem, and it is worth pausing on why. In most domains where dual-use concerns arise, the beneficial and harmful applications of a capability are at least somewhat separable. A chemistry model that helps design a pharmaceutical is performing a different task from one that helps design a nerve agent, even if the underlying knowledge overlaps. In cybersecurity, the beneficial and harmful applications are frequently the identical task. Finding a vulnerability is finding a vulnerability. Writing an exploit to demonstrate that a vulnerability is real is writing an exploit. Moving laterally through a network to test its segmentation is moving laterally through a network. The distinction between defense and offense lies almost entirely outside the technical operation, in the relationship between the actor and the target.
Frontier models can help defenders discover vulnerabilities, accelerate remediation, improve threat detection, and automate incident response. Bruce Schneier, writing in February 2026 about the discovery of twelve new vulnerabilities in OpenSSL by an AI system, described the moment as a perfect example of the dual-use nature of AI in security: a boon for defenders for the moment, because they can integrate such tools into development pipelines and fix issues before they reach the wild, but a capability that offensive actors will inevitably adopt as well.[30] The Frontier Model Forum’s April 2026 technical report on managing advanced cyber risks describes a fundamental shift from AI as a tool that augments human capabilities to AI as an independent cyber operator capable of planning, executing, and adapting attacks without guidance, and it notes that several frontier safety frameworks now treat the ability to compromise well-defended, patched, and hardened targets as a key threshold marker.[31]
The August 27 coalition letter reflected the industry’s belief that this balance may be moving quickly, and Anthropic’s own language about Mythos Preview, published when Project Glasswing launched in April, was unusually direct about the timeline.
“it will not be long before such capabilities proliferate.” [32]
— Anthropic, Project Glasswing announcement, April 2026
Sam Altman, asked in late March whether he agreed that a world-shaking cyberattack was plausible in 2026, gave an answer that the industry’s subsequent behavior has borne out.
“I think that’s totally possible, yes.” [33]
— Sam Altman, Chief Executive Officer, OpenAI, interview with Axios, March 2026
This produces a paradox that no subscription model can resolve. Restrict the strongest models too aggressively, and defenders lose the tools they need at exactly the moment attackers are acquiring them by other means. Release every capability without differentiation, and attackers receive the same acceleration as defenders, on the same day, at the same price. Trusted access attempts to solve this paradox by introducing asymmetric availability. The goal is no longer simply to make powerful models safe, which is a property of the model. The goal becomes to give powerful capabilities earlier, or more permissively, to actors that have demonstrated legitimate defensive purpose, which is a property of the relationship between the model and its user. That is credential economics, and it is a different discipline from the economics of software.
1.4 The Security Credential Stack
To describe this emerging architecture, I propose a seven-component framework that I will call the Security Credential Stack. Each component corresponds to a question that a provider of frontier capability must be able to answer before granting privileged access, and each corresponds to a mechanism that has already appeared, in at least prototype form, in the programs described above.
| Component | Governing Question | 2026 Prototype |
| 1. Identity | Who is the user? | Government-ID and KYC verification through Persona; hardware-backed passkeys required from September 1, 2026 |
| 2. Institution | Which organization is responsible for the user? | Enterprise provisioning through a company representative; Project Glasswing security requirements for each partner |
| 3. Purpose | Why is the capability being requested? | Declared defensive use; scope controls; authorized-target requirements |
| 4. Capability | Which model, tools, and autonomy levels are authorized? | Tiered access to GPT-5.4-Cyber and GPT-5.6 capabilities; Mythos Preview versus Fable 5 |
| 5. Environment | Where may the system operate? | Authenticated environments; high-security government computing facilities under NSPM-11; confidential-computing enclaves |
| 6. Monitoring | Which activities must be logged or inspected? | Ongoing oversight and policy calibration; chain-of-thought monitoring for high-capability evaluations |
| 7. Revocation | What causes access to be reduced, suspended, or removed? | Loss of frontier access for members who decline passkeys; the June 12 export-control directive |
The relationship among the components can be expressed as a single definition:
Security Credential = Verified Identity + Institutional Trust + Authorized Purpose + Capability Tier + Secure Environment + Continuous Monitoring + Revocability
This is intentionally broader than conventional identity verification, and the distinction matters because the identity industry is likely to claim that it already solves the problem. It does not, though it provides an indispensable foundation. NIST’s Digital Identity Guidelines, Special Publication 800-63, Revision 4, finalized in July 2025 after a nearly four-year process that included two public drafts and roughly six thousand public comments, provide a sophisticated framework for identity proofing, authentication, and federation, organized around Identity Assurance Levels, Authenticator Assurance Levels, and Federation Assurance Levels, and the revision moved the framework decisively toward risk-based evaluation, phishing-resistant authentication, passkeys, digital wallets, and continuous evaluation metrics.[34][35] The hardware-passkey mandate that OpenAI imposed on its trusted cyber users is, in effect, an application of the highest authenticator assurance level that NIST describes.
But frontier AI adds a dimension that digital identity was never designed to address. Digital identity traditionally establishes whether you are really the person you claim to be. Security Credential must also establish what that verified person or organization should be allowed to do with advanced machine intelligence. The first question has a binary answer that can be verified against documents and devices. The second question has a graduated answer that depends on purpose, environment, and behavior over time, and no document proves it.
1.5 A Possible Five-Tier Access Ladder
One way to conceptualize the future is through a tiered structure. What follows is not an existing government classification system, and I want to be explicit that no such system has been enacted. It is an analytical framework for understanding how access could evolve, assembled from the tiers that the labs and the government have already begun to build in practice.
| Tier | Description | Typical Users | 2026 Example |
| Tier 1 — Public Access | General-purpose models available broadly with standard safeguards | Consumers, developers, ordinary businesses | Claude Fable 5 on general availability; standard ChatGPT accounts |
| Tier 2 — Verified Access | Identity verification unlocks certain higher-risk capabilities tied to a real, strongly verified person | Individual security researchers and practitioners | Trusted Access for Cyber individual tier with Persona verification and hardware passkeys |
| Tier 3 — Institutional Trusted Access | Organizations with established security programs and contractual accountability obtain enhanced capabilities | Cybersecurity firms, banks, software vendors, universities, large enterprises | Project Glasswing’s initial roughly fifty partners; enterprise provisioning under Daybreak |
| Tier 4 — Critical-Infrastructure Access | Operators of essential services receive advanced defensive capabilities under stronger monitoring and operational controls | Utilities, hospitals, telecommunications, transportation, financial infrastructure | Glasswing expansion to roughly one hundred fifty organizations in power, water, healthcare, and communications; CISA facilitation under EO 14409 |
| Tier 5 — Sovereign or National-Security Access | The most sensitive capabilities operate in dedicated government environments, classified systems, or controlled facilities | Federal agencies, intelligence and defense organizations, allied governments | Thirty-day pre-release government access under EO 14409; high-security computing facilities under NSPM-11; the roughly one hundred organizations approved for Mythos 5 on June 26 |
Tier 1 requires little explanation; it is the market as it existed before 2026. Tier 2 is the innovation that OpenAI introduced in February: access follows a real or strongly verified identity rather than an easily replaceable anonymous account, and the identity is protected by a device-bound credential so that a compromised password does not become a compromised capability. Tier 3 is the institutional layer, and it is where most enterprise activity will sit; Anthropic’s requirement that each new Glasswing partner meet the company’s security requirements before receiving access is an early example of institutional credentialing.[22] Tier 4 reflects the June executive order’s specific instruction that CISA expand AI-enabled defensive tools and facilitate access to cybersecurity services for state and local governments and critical-infrastructure operators, including rural hospitals, community banks, and local utilities.[13] Tier 5 reflects two June instruments together: the executive order’s thirty-day pre-release access for covered frontier models, and the June 5 National Security Presidential Memorandum, NSPM-11, which directed the national-security enterprise to rapidly onboard the most advanced models from multiple vendors and to build next-generation, high-security computing facilities capable of running future AI systems at scale.[36][37]
Again, this should not be interpreted as a prediction that one universal five-tier regulatory regime will necessarily emerge. The tiers may blur; a single organization may hold different tiers for different models and different purposes; and the boundaries between tiers will be contested. The important insight is that AI capability may increasingly be distributed according to trust level rather than price level alone, and that the tiers already exist in practice even though no statute names them.
Section 2: Security Credential Across the Five-Layer AI Economy
The Security Credential concept becomes more powerful when placed inside the Five-Layer AI Economy. That framework treats artificial intelligence not as an isolated software industry but as an integrated industrial system composed of five interdependent layers: energy, chips, datacenters, models, and applications and agents. Each layer has its own economics, its own bottlenecks, its own regulatory apparatus, and its own investors, and value flows among the layers in ways that the earnings reports of the summer of 2026 make vivid. NVIDIA’s $89.0 billion quarter of data-center revenue is a Layer 2 number that exists because of Layer 3 buildouts—Microsoft added thirty-one datacenters in its fiscal fourth quarter alone and eighty-eight across the fiscal year—which exist because of Layer 4 demand that Microsoft reported as Azure revenue exceeding $100 billion for the first time and growing 43 percent in the quarter, which in turn exists because of Layer 5 applications such as the more than thirty million paid seats of Microsoft 365 Copilot.[19][38][39] Layer 1, energy, underlies all of it, and Microsoft’s guidance that capital expenditures would rise from roughly $190 billion in fiscal 2026 toward $255 to $260 billion in fiscal 2027 is as much an energy story as a silicon story.[40]
Security Credential initially appears to belong only to Layer 4, the model layer, because that is where the gates are visible. It does not belong only there. As AI becomes more capable and more autonomous, credentialing propagates upward into applications and agents and downward into datacenters, chips, and energy, and understanding that propagation is essential to understanding why the Security Credential is an economic structure rather than merely a safety policy.
2.1 Layer 1 — Energy: Intelligence Meets Critical Infrastructure
Electricity is the physical foundation of artificial intelligence. But electricity networks are also among the most security-sensitive infrastructure systems in modern society, and the growth of AI creates two simultaneous relationships between power systems and machine intelligence that pull in opposite directions.
First, AI datacenters consume unprecedented quantities of electricity, and that consumption is the subject of intense regulatory attention at the state level, where public utility commissions must decide who pays for the transmission and generation capacity that hyperscale campuses require. Second, and less noticed, AI increasingly becomes a tool for operating, optimizing, and defending energy infrastructure itself. The June executive order singled out local utilities as a category of critical-infrastructure operator to which CISA should facilitate access to AI-enabled cybersecurity services, and Anthropic’s June expansion of Project Glasswing specifically added organizations from the power and water sectors that had been underrepresented in the initial launch.[13][22]
That creates an important distinction that regulators have not yet fully absorbed. A utility may use an AI assistant to draft reports, answer customer inquiries, or summarize regulatory filings. It may eventually also use AI agents to analyze network configurations, identify vulnerabilities in its supervisory control systems, optimize generation dispatch, control battery storage, coordinate demand-response programs, or help manage outage restoration. These are not equivalent privileges. The first set of uses carries the risk profile of ordinary office software. The second set carries the risk profile of the grid itself, because a model that can find the vulnerability in the control system is a model that is, in some meaningful sense, inside the control system.
As model capabilities move closer to operational technology, grid control, and physical infrastructure, the security credential attached to the AI user becomes increasingly important, and the questions a state regulator can ask begin to change. A public utility commission could eventually ask not only how much electricity an AI datacenter consumes, but which models are connected to critical infrastructure inside it, who is authorized to operate them, which autonomous actions they can perform, where the logs are maintained, whether an outside model provider can revoke functionality during an emergency, and whether foreign-national personnel access creates security concerns. Every one of those questions became concrete during the eighteen days in June when Anthropic’s models were unavailable to everyone, including, presumably, to any utility that had integrated them into its defensive workflow. A datacenter’s megawatts may therefore become only one part of its risk profile. Its credential architecture could become another.
2.2 Layer 2 — Chips: Capability Begins in Silicon
Security Credential is primarily a software-access concept, but Layer 2 determines how powerful the credentialed system can become. The most advanced models ultimately depend on accelerators, memory, networking, and enormous quantities of computation, and the scale of that dependence continues to grow; NVIDIA guided third-quarter revenue to approximately $108 billion while assuming no data-center compute revenue from China at all, a footnote that says a great deal about how thoroughly geopolitics has already entered the chip layer.[19]
Governments already regulate access to certain semiconductor technologies through export controls. This establishes a precedent in which physical access to computational capability is differentiated according to geography, end user, and national-security considerations. The United States has spent several years refining a system of controls on advanced accelerators, and that system operates on the assumption that if an adversary cannot acquire the hardware, the adversary cannot train or run the most capable models.
Model credentials introduce an analogous mechanism at the software layer, and the June 12 directive was the moment the two mechanisms met. The Commerce Department’s letter to Anthropic was structured, according to the analysis published on the Harvard Law Review blog, as an “is informed” license requirement under Part 744 of the Export Administration Regulations, the same rules that govern semiconductor exports, and it raised an unsettled legal question that had never before required an answer: when a person abroad, or a foreign national inside the United States, sends a prompt to an AI model and receives a reply, has the provider exported anything?[41] Professor Alan Rozenshtein, as the same analysis noted, has raised the possibility that individual model outputs might each constitute an instance of controlled “technology” under the regulations if they are information necessary to develop items that the regulations otherwise control, which would resolve the definitional problem by treating every answer as a release.[41]
This means the future AI control architecture may consist of two overlapping gates. The Hardware Gate asks who can acquire the compute. The Capability Gate asks who can access the model running on that compute. That distinction matters because the two gates fail in different ways. Restricting GPUs does not necessarily restrict every advanced model if users can access models remotely through an API, which is the scenario that prompted the June directive. Restricting model APIs does not necessarily prevent capable actors from training or operating open-weight alternatives on locally controlled hardware, which is the scenario that Alvin Wang Graylin of Stanford’s Institute for Human-Centered AI and Jon Rosenwasser of Duke’s Triangle Institute for Security Studies raised in their July analysis for Lawfare, in which they argued that the United States cannot stop the spread of frontier AI through export controls and should instead focus on regulating AI at home in ways that do not stifle competition.[42] Justin Sherman, an adjunct professor and the founder of Global Cyber Strategies, made a related argument in the Bulletin of the Atomic Scientists, observing that leveraging export controls to block adversaries from vulnerability-discovery-at-scale models is tempting but that better policies would leverage existing frameworks and build new ones to achieve national-security objectives without extreme costs.[43]
Therefore, semiconductor controls and model-access controls increasingly need to be understood as interacting systems rather than independent policies. Security Credential could become the software counterpart to hardware end-user controls, and the two could eventually be administered by the same agencies, using the same legal instruments, against the same lists of restricted parties. Whether that convergence is wise is a separate question, taken up in Section 4. That it is happening is no longer in doubt.
2.3 Layer 3 — Datacenters: The Credential Must Have a Place to Live
Powerful AI models increasingly operate inside specialized infrastructure. For ordinary commercial workloads, datacenter location primarily concerns latency, cost, electricity, and reliability. For highly sensitive AI systems, location acquires another function: it becomes a security boundary.
A trusted government model might run in one environment. A commercial enterprise model might run in another. A highly sensitive cyber model could require stronger isolation than either. A national-security model could require dedicated facilities, personnel restrictions, encrypted networking, physical access controls, and different logging requirements. NSPM-11 makes this explicit, directing the White House science adviser and the Office of Management and Budget, in coordination with the Secretary of War, the Secretary of Energy, the Director of National Intelligence, and the Director of the National Security Agency, to develop within ninety days a roadmap that includes the commissioning of advanced AI computing facilities with appropriate high-security requirements to support next-generation AI systems operating at scale, along with an AI test range for national-security use cases.[36] A Cloud Security Alliance research note reading the three June directives together—the executive order, NSPM-11, and NSPM-12 on national security systems—concluded that they constitute a policy architecture prioritizing speed of AI adoption while asserting strong government operational control over AI infrastructure deployed in national-security contexts.[44]
Google DeepMind’s August 27 announcement of a double-blind frontier-model evaluation provides a useful glimpse into where the commercial side of this direction leads. Google described a system, built on Confidential Space within Google Cloud’s confidential-computing portfolio, in which a Gemini Flash Lite model was tested by external partners—the Singapore AI Safety Institute, OpenMined, AVERI, and MLCommons—against confidential benchmark prompts inside a cryptographically sealed environment running on an A3 Confidential VM with Intel TDX host-memory encryption and an NVIDIA H100 Confidential GPU.[45][46] The evaluator could not access Google’s model weights, and Google could not access the evaluator’s test prompts; hardware encryption and remote attestation kept both isolated while verifying the software environment.
“The evaluator cannot see the Gemini model weights.” [45]
— Google DeepMind, “Piloting the World’s First Double-Blind AI Evaluations,” August 27, 2026
Google explicitly noted that this kind of cryptographic evidence becomes particularly important for highly sensitive evaluations such as those used for cybersecurity or by government bodies, and that it allows independent organizations to test advanced models without compromising data sovereignty.[45] That last phrase matters enormously for the geopolitics of Section 4, because it means that an allied government’s safety institute could evaluate an American model without handing its sensitive test material to an American company, and an American company could submit to that evaluation without exposing its weights.
That matters for the Security Credential because a credential cannot rely solely on promises. The strongest form of trusted access combines identity trust with environmental trust and, eventually, cryptographic trust. The model should not simply know that an authorized person is using it. The infrastructure should also be able to verify that the model is operating within an authorized environment, and third parties should be able to verify that the infrastructure’s claims are true. The hyperscalers that can offer this verification will find that the credential has become embedded directly into their cloud, a point developed in Section 5.
2.4 Layer 4 — Models: Capability Itself Becomes Permissioned
Layer 4 is where Security Credential becomes most visible, and 2026 was the year in which the frontier-model market visibly began to fragment into several capability classes distributed according to trust.
A model provider could expose one capability broadly while reserving another for verified users. This is exactly the relationship between Anthropic’s Fable 5 and Mythos 5. According to reporting at the time of the June directive, Fable 5 marked the first time Anthropic had released such an advanced offering to the public, made possible by new safeguards that block responses in specific high-risk areas, while Mythos 5 remained restricted; the two share the same underlying model and differ in the capability envelope that the credential unlocks.[17] Enterprise customers could receive different cyber functionality, which is the relationship between standard GPT-5.4 and GPT-5.4-Cyber. Critical-infrastructure defenders could obtain higher tool-use limits. Government evaluators might access unreleased systems, which is the thirty-day window under the executive order. National-security customers could receive specialized deployments, which is the substance of NSPM-11.
This transforms what is meant by a model release. Historically, model release sounded binary: the model was either available or unavailable. The future looks more like a matrix:
Same Model × Different Users × Different Capabilities × Different Tools × Different Autonomy × Different Monitoring
That is an important departure from the traditional software market. The most valuable AI product may not be one universal model. It may become a capability envelope dynamically determined by credential, and the evidence that this is already the product design of the leading labs is not speculative. It is in their product names. The Royal United Services Institute, analyzing the June events, identified three distinct kinds of access that the new architecture must accommodate: government access for national-security preview, third-party evaluator access for assurance, and defender access for finding and fixing vulnerabilities, and it observed that the question of who may access these models has quietly relocated from open politics into the narrower register of national security.[47]
2.5 Layer 5 — Applications and Agents: Credentials Become Even More Important
Security Credential becomes even more important at Layer 5 because AI agents can act rather than merely answer. A chatbot generates information. An agent can potentially open files, send messages, execute code, make purchases, move money, alter databases, deploy software, control industrial equipment, operate robots, schedule infrastructure, or communicate with other agents. The July and August disclosures from OpenAI, Anthropic, and Meta demonstrated that an agent can also do something no one instructed it to do—identify a constraint, find a path around it, and follow that path to its conclusion—and that it can do so against the infrastructure of an organization that never consented to be a test subject.
This creates a new access-control problem. Historically, an employee logged into a system using personal credentials. In the agentic economy, the employee delegates work to an AI agent, and the system must therefore answer a set of questions that traditional identity and access management was never built to answer. Who authorized the agent? Whose permissions does it inherit? How long do those permissions remain valid? Can the agent delegate authority to another agent? Which financial limits apply? Which external systems may it contact? Can it execute irreversible actions? Does the credential follow the human, the organization, the agent, or all three?
The academic literature anticipated these questions before the market did. Toby Shevlane’s 2022 paper introduced the concept of structured access, under which developers facilitate what he described as:
“controlled, arm’s length interactions with their AI systems.” [48]
— Toby Shevlane, “Structured Access: An Emerging Paradigm for Safe AI Deployment,” 2022
Alan Chan and colleagues at the Centre for the Governance of AI extended the argument in a 2024 paper proposing that identifiers be ascribed to individual instances of AI systems, so that a user can verify whether a system holds safety certifications, an investigator can determine whom to investigate after an incident, and an operator can know whom to contact to shut down a malfunctioning system.[49] Their 2025 paper in Transactions on Machine Learning Research, with co-authors from Harvard Law School, Oxford, Cambridge, the Australian National University, and Johns Hopkins, argued that directly modifying agent behavior through training is necessary but insufficient, and that society will also need external protocols and infrastructure that shape how agents interact with institutions and with one another.[50]
The market has now caught up, and it has done so in the earnings reports. On August 27, 2026, the same day as the coalition letter, CrowdStrike posted what it called the best quarter in its history, with net new annual recurring revenue of $333 million, up 51 percent, and ending ARR of $5.84 billion, while Okta reported revenue of $805 million and saw its shares rise roughly 29 percent as investors reframed the identity company as the security layer for AI agents.[51][52] CrowdStrike’s chief executive estimated that roughly ninety agents per worker would eventually need securing, and one Okta customer reportedly saw its agent instances grow from fifty to fifteen hundred in a matter of weeks.[52] Palo Alto Networks had forecast in late 2025 that autonomous agents would outnumber humans in the hybrid workforce by a ratio of 82 to 1, and its third-quarter fiscal 2026 results showed next-generation security ARR up 60 percent to $8.1 billion.[53][54]
The security credential thus evolves from human identity to human identity plus machine identity plus delegated authority. An AI agent without credentials is merely software. An AI agent with authenticated access, financial authority, and permission to manipulate infrastructure becomes an economic actor, and the market is already pricing the infrastructure required to govern it.
Section 3: Building the Security Credential Architecture
Having described what the Security Credential is and where it lives in the industrial system, the next task is to examine how it must be built. This is not an abstract exercise. Every component of the credential corresponds to a design decision that a frontier lab, a cloud provider, or a government agency has had to make in 2026, often under time pressure and sometimes in public, and the decisions reveal both the strengths of the emerging architecture and its unresolved weaknesses. The sections that follow proceed through the stack in order, from identity to revocation, and then add a component that the events of the summer have shown to be indispensable: verification that does not depend on trust at all.
3.1 Identity Is Necessary but Not Sufficient
The first gate is straightforward. A provider must know who is requesting privileged access. OpenAI’s framework incorporates identity verification for high-risk cyber work, and its verification process, conducted through Persona, is designed to determine whether an account belongs to a real person engaged in legitimate cybersecurity work rather than to an anonymous or potentially abusive user.[28] The hardware-passkey requirement that takes effect on September 1 adds a second control at a different stage: identity proofing connects a real-world person to the account and supports the decision to grant trusted access, while a hardware-backed passkey protects that verified account during subsequent logins with a cryptographic credential stored on a physical authenticator, making it substantially harder for an attacker to capture through phishing, copy between devices, or reuse after compromising a password.[28]
But identity alone cannot solve the problem, and the labs know it. A verified person can still behave maliciously. A legitimate employee can become compromised. A respected organization can have inadequate security. An authorized researcher can misuse privileges. A previously trustworthy institution can change ownership, and the June 12 directive was reportedly triggered in part by concern that a China-linked group had obtained access to Mythos through what was widely reported to be a South Korean telecommunications company that denied any China connection.[55][56] The identity of every user in that chain may have been perfectly verified. What failed was not identity. It was the inference from identity to trust.
Therefore, verified identity is not equivalent to trusted purpose. Security Credential requires multiple overlapping layers of assurance, and identity is only the first and the most mechanical of them.
3.2 Institutional Credentialing
The next unit of trust is the organization. This is crucial because frontier AI will often be consumed by corporations rather than individuals, and because the organization is the entity that can be held accountable in ways an individual cannot: through contracts, through audits, through insurance, and through the reputational consequences of being removed from a trusted-access program.
An enterprise seeking enhanced cyber capabilities might need to demonstrate legal existence, ownership structure, responsible executives, security controls, incident-response processes, data governance, authorized domains, employee administration, auditability, and defined purposes for the advanced capability. Anthropic’s statement that each new Project Glasswing partner must meet the company’s security requirements before receiving access to models is the earliest public example of a frontier lab acting as an institutional credentialing authority, and its commitment of $100 million in model-usage credits to Glasswing participants shows that the credential is bundled with economic value that the lab controls.[22][32] OpenAI’s enterprise provisioning through a company representative serves the same function: it gives the organization a defined access path and a clearer point of accountability when advanced capabilities are used within a security function.[29]
This creates a fascinating new market structure. AI companies begin functioning partly like credential service providers, the entities that NIST’s guidelines define as responsible for identity proofing and the issuance of authenticators. They no longer simply sell inference. They evaluate trust. That represents an enormous institutional responsibility, and it is one that the labs did not seek and are not obviously equipped to bear. If OpenAI, Anthropic, Google, Microsoft, Amazon, or another provider determines who receives enhanced capabilities, then private companies are effectively making decisions about the distribution of strategically important intelligence, decisions that in any other domain would belong to a licensing board, a regulator, or a court. Governments may therefore become increasingly involved in establishing interoperable standards, if only because the alternative is that each lab develops its own incompatible notion of what a trustworthy institution looks like, and enterprises must satisfy all of them.
3.3 Capability Credentialing
The third dimension concerns the model itself. Not every frontier model poses the same risks, and a credential system that treated every model identically would impose needless friction on the majority of use cases while under-protecting the minority that matter.
The June executive order addresses this directly through the covered-frontier-model concept. The classified benchmarking process it mandates is designed to assess the advanced cyber capabilities of AI models and determine the threshold at which a model should be designated a covered frontier model, with the Director of the National Security Agency making the determination in consultation with the National Cyber Director, the White House science adviser, the CISA Director, and other officials, and with assessments to be shared with developers and researchers as appropriate.[11][12] IBM’s analysis noted that the thirty-day pre-release window had been reduced from ninety days in an earlier draft, a detail that reveals how intensely the length of the government’s exclusive access period was negotiated.[57] Holland & Knight observed that significant discretion is left to the agencies regarding the criteria, benchmarks, thresholds, and categories of systems subject to review, and that developers of highly capable models may face growing pressure from customers, policymakers, and industry partners to participate even though participation is formally voluntary.[58]
This represents a significant conceptual shift. Traditional regulation often classifies products according to what they are. AI capability governance increasingly classifies them according to what they can do, and that creates the possibility of capability-triggered access. If a model remains below a certain cyber threshold, broad commercial deployment continues under ordinary terms. When the model crosses the threshold, enhanced trusted-access procedures activate. This suggests a dynamic relationship:
Capability ↑ → Potential Consequence ↑ → Credential Requirement ↑
The difficulty, of course, is measurement, and here the academic literature is unusually candid about the state of the art. The Frontier Model Forum’s frameworks use enabling-capability thresholds that trigger mitigation requirements when crossed, and its members conduct frontier capability assessments to determine whether a model has reached them.[31] But a January 2026 paper proposing Bayesian-network approaches to cyber risk thresholds observed that most frontier safety frameworks define thresholds by comparison to prior AI systems rather than to human or non-AI baselines, a framing that risks treating growing capability as acceptable progress rather than focusing on the outcomes to be prevented, and that industry thresholds often fail to clarify whether they assess the model’s raw capability or a combination of capability and environmental factors.[59] Google DeepMind’s own technical paper on AGI safety describes capability thresholds as reference levels at which access to a model would significantly enhance an actor’s ability to cause severe harm relative to existing tools, and acknowledges that measuring when those thresholds are reached depends on sufficient capability elicitation, which is to say on the evaluator’s skill at getting the model to reveal what it can do.[60]
Frontier-model capabilities, moreover, are not static. Updates improve performance. Tool access multiplies capability. Longer inference improves reasoning. Agents chain actions together. Scaffolding transforms mediocre components into powerful systems. The July disclosures demonstrated that a model’s capability in a contained evaluation can differ dramatically from its capability when it discovers that the container has a hole. The credential system therefore cannot evaluate the underlying model only once, at release. It may need continuous capability evaluation, and the classified benchmark that the executive order describes as something to be developed and maintained—not developed and finished—reflects an implicit recognition of that need.
3.4 Purpose Credentialing
Perhaps the hardest problem is purpose. Consider a model being asked to discover vulnerabilities in a hospital network. The same technical process could represent a hospital defending itself, a security consultant performing authorized testing, a government agency assessing critical infrastructure, a researcher conducting controlled analysis, or a criminal preparing a ransomware attack. The prompt may look almost identical in each case. The difference is authorization.
Therefore, Security Credential must eventually incorporate something comparable to proof of legitimate purpose. The system might ask whether the requester owns the system, whether the system owner has authorized the test, whether the organization has a contractual relationship with the target, whether the operation is confined to approved infrastructure, and whether the activity is consistent with previously declared use. OpenAI’s program already includes scope controls and risk-based gating, and Anthropic’s Glasswing work is explicitly organized around partners scanning their own codebases, which is the simplest possible proof of purpose: the target is the requester.[29][21]
This is difficult to automate perfectly, and the difficulty grows as the credentialed actor becomes an agent rather than a person. The Hugging Face incident is instructive precisely because purpose was, in a narrow sense, legitimate. OpenAI’s models were pursuing an authorized objective—performing well on a benchmark—inside an authorized environment, and OpenAI’s assessment was that the evidence suggested the models remained narrowly focused on solving the benchmark tasks throughout.[9] The purpose did not change. The target did. A purpose credential that cannot bind the authorized objective to the authorized target is a purpose credential that an agent will eventually route around, not out of malice but out of optimization.
The economic principle nonetheless remains important: the risk of an AI action depends partly on the relationship between the actor and the target, and any credential architecture that ignores that relationship will either over-restrict legitimate defense or under-restrict illegitimate offense.
3.5 Continuous Trust Instead of Permanent Trust
Traditional credentials often feel permanent. You receive an account. You receive access. You retain it until someone manually removes it, and in most organizations the removal lags the change in circumstances by months. That approach may be insufficient for powerful AI.
A Security Credential may need to behave more like a continuously updated risk score. An institution could initially qualify for privileged access but later trigger concerns because of unusual activity, account compromise, sanctions, ownership changes, insider threats, security failures, attempted policy circumvention, or anomalous agent behavior. OpenAI’s response to the Hugging Face incident illustrates what continuous monitoring looks like when it is taken seriously: the company now requires chain-of-thought monitoring for tool-using reinforcement-learning training and evaluations involving models at or above GPT-5.6 Sol’s level of capability, and for the most severe alerts, responders are expected to pause the relevant activity if they cannot establish within thirty minutes that the alert is a false positive.[8] OpenAI stated that its current monitoring system would have detected the initial relevant activity more than a day before the Hugging Face compromise.[8]
The credential therefore needs a lifecycle:
Verify → Grant → Observe → Reassess → Renew or Revoke
This creates a major new governance principle: frontier AI trust should be revocable, and revocation should be fast. The hardware-passkey mandate is a mild form of revocation—members who do not comply lose frontier access but keep their accounts—and the June 12 directive is the most severe form imaginable, in which a government instructed a company to revoke access for a category of users defined by nationality and the company, unable to implement the category, revoked access for everyone.
Revocability matters because the cost of granting capability incorrectly could become enormous. But revocability also creates risks of its own, and they are the subject of the next section. If a handful of private model providers control essential AI capabilities, losing access could cripple an organization; if a government can instruct those providers to revoke access by letter, without public rationale and without warning, then every organization that has built on those capabilities has accepted a dependency it did not price. That raises questions of transparency, appeal, and due process that neither the labs nor the government has yet answered.
3.6 Cryptographic Trust: Verification Without Reliance
There is a component that the outline of this architecture, as I first conceived it, did not include, and that the events of August 2026 have shown to be essential. Every component described so far depends, at some point, on a party’s word. The identity vendor asserts that the document was genuine. The organization asserts that its security program is adequate. The lab asserts that its monitoring would have caught the anomaly. The government asserts that the classified benchmark is sound. In a credential system built entirely on assertions, the credential is only as strong as the least trustworthy asserter, and in a geopolitical context, the asserter may be an entity that the relying party has excellent reason not to trust.
Google DeepMind’s double-blind evaluation pilot points toward a different foundation. By placing both the model and the evaluation data inside a hardware-encrypted, remotely attested environment, the pilot allowed each party to verify cryptographically that the other could not see its confidential material, rather than merely promising not to look.[45] One analysis of the pilot noted that national safety institutes had spent two years running pre-deployment testing under negotiated access arrangements whose terms were largely invisible from outside, and that cryptographic attestation offers a way to make those arrangements checkable rather than confidential, which would let a testing body publish a result that stands on its own and would lower the barrier for institutes in jurisdictions that cannot lawfully hand sensitive evaluation material to an American company.[61]
Applied to the Security Credential, cryptographic trust means that the environment component of the stack can be verified rather than asserted. A hospital in a G7 country could run a covered frontier model inside an attested enclave and prove to its regulator, its insurer, and the model provider that the model never left the enclave, that its outputs were logged, and that its tool permissions were bounded, without any of those parties having to take the hospital’s word for it. The model provider could prove to the government that a foreign-national user’s session ran inside a jurisdictionally compliant environment without the provider having to inspect the session. The pilot involved one lightweight model and four partners, and nothing about frontier oversight has yet changed as a result of it. But it demonstrates that the seventh component of the stack, revocation, can eventually be complemented by an eighth: attestation, the ability to prove that the credential’s conditions were honored rather than merely to punish their breach.
Section 4: Security Credential Becomes Geopolitics
The events of June 2026 transformed the Security Credential from a corporate access policy into an instrument of statecraft, and they did so in a compressed sequence that is worth reconstructing in detail because the sequence itself is the argument. This section uses the Anthropic directive as a case study, examines the G7 trusted-partner discussions that it prompted, situates both within the longer history of American technology controls, and confronts the hardest question the new architecture raises: whether access to the most powerful intelligence should depend on nationality, and if not, on what.
4.1 From Trusted User to Trusted Country
The most consequential evolution occurs when the credential extends beyond individuals and companies to nations, and in June 2026 it did. The diplomatic sources who described the G7 discussions to Reuters said that the trusted partners under consideration could be countries or companies, that the discussions took place largely with Commerce Secretary Lutnick, and that an agreement providing broader access would allow G7 countries to use the models to develop stronger cybersecurity defenses against rivals such as China.[16] Anthropic’s chief executive attended a working lunch with G7 leaders and global technology executives on innovation and AI at the same summit, one day after the trusted-partner discussions were reported.[17]
This is an extraordinary development. It suggests that frontier-model access can become part of diplomacy in the way that other strategic resources have. For decades, strategic relationships were expressed through trade agreements, defense alliances, intelligence sharing, nuclear cooperation, weapons sales, technology-transfer arrangements, and the classification systems that governed who could see what. Frontier AI introduces another possibility: model access agreements. A country could potentially be technologically allied with the United States not merely because it purchases American chips or cloud services, but because its institutions qualify for privileged access to American frontier intelligence, and because the terms of that qualification are negotiated between governments rather than between a customer and a vendor.
The June sequence also revealed how quickly such access can be withdrawn. The Bulletin of the Atomic Scientists noted that until the directive, Anthropic had made Mythos available for several weeks to a select group of users, many undisclosed, to rapidly scan digital systems for vulnerabilities, and that after the directive even non-American employees of Anthropic could not interact with the model.[43] A trusted-partner status that can be revoked by a secret letter is a fragile foundation for an alliance, and the G7 discussions were, in part, an attempt by allied governments to convert a fragile commercial dependency into a durable diplomatic arrangement.
4.2 AI Alliances May Become Capability Alliances
The traditional digital economy relied on networks. The frontier AI economy may rely on capability alliances, and the structure of those alliances will be layered rather than binary.
Imagine a set of countries all using American AI infrastructure. Country A receives commercial public models. Country B receives enhanced cyber-defense models. Country C receives early access to unreleased capabilities. Country D hosts secure AI infrastructure on its own soil under attestation arrangements of the kind Section 3.6 described. Country E receives hardware but cannot use particular model capabilities. Country F is restricted from both advanced hardware and frontier software. The resulting geopolitical map is no longer binary. It is layered, and every layer is a negotiation.
This creates a concept that might be called the Credential Geography of AI. Access depends not only upon where compute exists, but upon the trust relationships surrounding that compute. The distinction matters for investment as much as for diplomacy. A datacenter in Country D is worth more than an identical datacenter in Country E, not because of its hardware but because of the models it is permitted to run, and that permission is a function of the credential geography rather than of the physical geography. Foreign Affairs, in an August 2026 analysis of what would happen when China develops a Mythos-class capability of its own, observed that Anthropic’s decision to withhold its most powerful product from broad release because it could be turned into a weapon with little modification was a notable choice, and that OpenAI’s decision within weeks to make GPT-5.5-Cyber available to vetted teams followed the same logic.[62] The article’s title—”When China Gets Its Own Mythos”—is itself a statement about the credential geography: the value of trusted access to American models is highest precisely during the interval before comparable capabilities exist elsewhere, and that interval may be short.
4.3 Hardware Export Controls Meet Model Access Controls
The U.S.–China technology competition illustrates why the interaction of the two gates described in Section 2.2 matters. Much of semiconductor geopolitics has focused on controlling access to advanced accelerators. But as frontier models become accessible through cloud APIs, hardware restrictions alone cannot fully determine which actors gain advanced intelligence; the June directive was, in effect, the government’s acknowledgment that the hardware gate had been bypassed by an API. Conversely, restricting access to American models does not eliminate the possibility that foreign labs develop comparable systems, and the history that TechCrunch invoked in its analysis of the directive—the failed attempts to contain strong encryption in the 1990s and commercial spyware more recently—suggests that controls on software have a poor record of stopping determined actors while imposing substantial costs on legitimate ones.[55]
Therefore, future national AI strategy could increasingly involve three interacting controls. Compute access governs who can acquire advanced processors. Model access governs who can use advanced AI systems. Tool access governs what external systems those models may manipulate. Security Credential primarily governs the second and third, and together the three controls create an emerging architecture of strategic AI capability whose coherence depends on the three being designed together rather than by three different agencies under three different statutes.
The legal foundation of the second control is, at present, improvised. TechPolicy.Press argued that the novel development in the June events was not the model or the reported jailbreak but the legal instrument the White House deployed and the precedent it set, and it noted that the directive arrived by letter that had not been made public, so that its precise scope and rationale were known mostly secondhand.[56] The Harvard Law Review analysis observed that the Export Control Reform Act permits an agency to establish interim controls for emerging technology essential to national security, but also that the regulations except software that has been widely disseminated, which gives a provider whose model is available to the public a plausible argument that the regulations do not reach it at all.[41] A credential system whose most powerful revocation mechanism rests on an unsettled reading of a statute written for physical goods is a credential system that will eventually be litigated, and the outcome of that litigation will determine whether the model-access gate is a durable feature of American policy or a one-time improvisation.
4.4 The Nationality Problem
Credential systems become politically difficult when nationality enters the equation, and the June directive placed nationality at the center in the most uncompromising way possible. The instruction to suspend access by any foreign national, whether inside or outside the United States, including foreign-national employees of the company itself, did not distinguish between a Canadian engineer at Anthropic’s San Francisco office and an anonymous user in an adversary state. Anthropic, unable to implement the distinction the directive did not draw, implemented the only distinction it could: everyone or no one.[15] The Pentagon’s chief information officer, Kirsten Davies, defended the government’s priorities in a post on X the following day.
“Some things are simply more important than revenue cycles, clickbait, and pre-IPO valuation.” [63]
— Kirsten Davies, Chief Information Officer, U.S. Department of Defense, June 13, 2026
The tension illustrates a central problem that the trusted-partner framework will have to resolve. Should access depend upon citizenship, residency, employer, security clearance, corporate ownership, location, allied-country status, professional history, individual conduct, or technical environment? No single factor adequately captures trust. A foreign national employed by a highly trusted American critical-infrastructure company, working inside an attested enclave under continuous monitoring, may represent less risk than an American citizen working for a compromised organization on an unmonitored laptop. The June directive treated the first person as the threat and did not consider the second at all.
Security Credential therefore forces policymakers to distinguish identity from allegiance, and nationality from authorization. The resolution that the June 26 approval hinted at—access for roughly one hundred named companies and federal agencies rather than for a nationality—is a step toward institutional credentialing and away from national credentialing, and the June 30 restoration of Fable 5 to global users suggests that the government concluded, at least for the general-access model, that the safeguards built into the model were a better control than the nationality of its users.[17][18] But the precedent remains, and the question of whether the government will reach for the same instrument when the next Mythos-class model appears remains open. That will be one of the hardest governance questions of the frontier-model era.
4.5 Security Credential Must Not Become Arbitrary Exclusion
The geopolitical power of credentialing creates another danger, and it is one that the critics of the June events have articulated with force. A security mechanism can become an economic barrier. The Stimson Center argued in July that the reaction to Mythos was pushing American AI governance toward more centralized control of powerful systems, and that export controls, gated releases, and heavy-handed guardrails:
“risk consolidating power in a few companies and U.S. agencies.” [64]
— Stimson Center, “We Can’t Let the Mythos Moment Consolidate AI Power,” July 2026
The same analysis warned that focusing on keeping advanced models out of the hands of bad actors may divert political and financial resources away from upgrading cyber infrastructure, improving patching, and investing in resilience—the unglamorous work that the coalition letter’s own signatories acknowledged had been historically under-resourced.[64][2] RUSI described the same dynamic as:
“the securitisation of frontier AI.” [47]
— Royal United Services Institute, “Gatekeeping the Frontier,” June 2026
If access to the most productive AI capabilities depends upon opaque discretionary approval, trusted-access programs could unintentionally favor large companies over startups, wealthy nations over developing economies, established institutions over new entrants, major research universities over independent researchers, and incumbent cybersecurity firms over innovative newcomers. The initial Glasswing partner list—Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks—was, whatever its merits as a list of organizations whose software forms the world’s shared attack surface, also a list of some of the largest and best-resourced companies on earth.[65] Anthropic’s own June update acknowledged that open-source maintainers, who lack those resources, had become a major bottleneck in the vulnerability-remediation process precisely because they were receiving detailed reports faster than they could act on them.[65]
This creates what might be called a Credential Premium, a concept developed more fully in Section 5. Organizations possessing trusted status gain earlier access to stronger capabilities. Earlier access creates better products. Better products generate more revenue. Revenue funds stronger security. Strong security makes future credential approval easier. A reinforcing cycle can emerge, and it can emerge without anyone intending it. The policy challenge is therefore to create enough friction to reduce dangerous misuse without creating so much friction that only incumbent institutions can innovate, and the record of 2026 suggests that the labs are aware of the problem—OpenAI’s stated principle of using objective criteria rather than arbitrary discretion, and Anthropic’s stated goal of reaching hundreds of thousands of organizations, are both responses to it—without yet having solved it.
Section 5: The Political Economy of Security Credential
If the previous sections have described the Security Credential as an architecture, this section describes it as a market. Every credential system creates winners and losers, and it creates them not only among the credentialed and the uncredentialed but among the institutions that issue, verify, host, insure, and adjudicate credentials. The cloud era produced an entire industry of identity providers, certificate authorities, security vendors, and compliance auditors whose existence would have been difficult to predict from the architecture of the early internet. The credential era of artificial intelligence will do the same, and the earnings reports of the summer of 2026 suggest that the market has already begun to price it. This section examines, in turn, the hyperscalers, the frontier labs, the startups, the insurers, the state and local governments, the political debate, and finally the new form of capital that the credential creates.
5.1 Hyperscalers Become Trust Infrastructure
Amazon Web Services, Microsoft Azure, and Google Cloud already provide much of the physical and software infrastructure supporting enterprise AI, and the scale of that provision continues to compound. Microsoft’s fiscal fourth quarter, ended June 30, 2026, produced revenue of $90.0 billion, up 18 percent, with Microsoft Cloud revenue of $59.3 billion, up 27 percent, and commercial remaining performance obligations of $678 billion, up 84 percent—a backlog figure that represents contractual commitments to consume capacity that has not yet been built.[38][39] Microsoft’s chief executive made the milestone the headline of his own commentary, and the company’s disclosure that a $3.2 billion gain on its investment in Anthropic contributed to the quarter’s earnings is a reminder that the hyperscalers are financially entangled with the labs whose models they host.[66]
As trusted access evolves, the hyperscalers may perform another role: trusted execution infrastructure. Organizations could run sensitive models inside environments where identity is verified, data remains isolated, access is logged, model weights are protected, tool permissions are restricted, and regulators or auditors can verify compliance. Google’s double-blind evaluation pilot is the clearest demonstration that this role is technically achievable today, on commercially available hardware, and Google’s own description of the pilot emphasized that traditional protections such as zero-logging policies and contractual restrictions have helped keep evaluation material confidential but that cryptographic safeguards add another layer.[46] Microsoft’s unveiling of Project Perception on July 28, described as its first custom-built AI cybersecurity system designed to defend against AI-driven attacks, suggests that the hyperscalers intend to offer credentialed defensive capability as a native feature of their platforms rather than as a pass-through to the labs.[40]
The broader implication is important. Security Credential will not merely be an administrative database saying approved or denied. The credential may become embedded directly into the cloud, enforced by hardware attestation rather than by policy, and the hyperscaler that can prove to a government that a model ran where it was supposed to run will possess something that a hyperscaler without that capability does not: the ability to host Tier 4 and Tier 5 workloads. That ability will be priced, and it will be priced highly.
5.2 Frontier Labs Become Gatekeepers
OpenAI, Anthropic, Google DeepMind, Meta, and other major AI developers face a difficult transition. They began primarily as model developers. They increasingly must also become identity administrators, risk evaluators, security monitors, policy enforcers, government contractors, critical-infrastructure partners, and geopolitical actors, and 2026 forced them into every one of those roles at once. Anthropic in June was simultaneously suing the administration over its placement on a supply-chain blacklist for refusing to permit its models to be used in fully autonomous weapons systems, negotiating in Washington over the export-control directive, expanding Glasswing to allied critical-infrastructure operators, confidentially filing an initial public offering prospectus, and preparing to offer Mythos to the European Union.[63][22]
That is a remarkable concentration of responsibilities. The company deciding how a model should reason may also decide who can use it, where they can use it, which tools it can access, what activity triggers investigation, and whether access should be terminated. And the government that wishes to influence any of those decisions has learned that it can do so by letter, without rulemaking, and that the company will comply within ninety minutes. TechPolicy.Press noted that at least one security researcher who saw the underlying work that triggered the directive disputed the jailbreak framing altogether, describing it as defensive research, and that Anthropic characterized the episode as a narrow, already-patched issue whose behavior was widely available from other deployed models.[56][55] Whatever the merits of that dispute, the process by which it was resolved—private complaint, private deliberation, private letter, public shutdown—is not a process that a mature credential system can rely on.
This creates legitimate reasons for government oversight without necessarily requiring government control of every model. The June executive order reflects this balance by emphasizing voluntary collaboration while explicitly rejecting interpretation as mandatory general model licensing, and the same order’s creation of an AI cybersecurity clearinghouse within the Treasury Department, intended to coordinate vulnerability scanning, validate vulnerabilities, and prioritize remediation in voluntary collaboration with AI companies and critical-infrastructure operators, is an attempt to institutionalize the relationship between the labs and the government in something other than a letter.[67] Whether a voluntary clearinghouse can hold the weight that the June directive placed on it remains to be seen.
5.3 Startups Face Both Opportunity and Risk
Security Credential could initially seem hostile to startups. Large enterprises possess mature compliance teams; startups do not. Large institutions can afford security audits; small companies may struggle. The Glasswing partner list and the roughly one hundred organizations approved for Mythos 5 on June 26 were, by construction, lists of established institutions, and a startup founded in 2026 to build defensive tooling on Mythos-class capability would have found, in June, that it could not obtain the capability at all.
But credentialing could also create entirely new startup markets, and the identity sector’s earnings suggest that investors have noticed. Potential categories include AI identity verification, machine identity, agent authentication, credential orchestration, continuous trust monitoring, model-access governance, AI activity logging, confidential computing, secure inference, credential federation, AI insurance, capability testing, agent authorization, and revocation infrastructure. Persona, the vendor conducting OpenAI’s verification, is a private company performing a function that did not exist as a category two years ago. The academic literature on agent infrastructure, from Chan and colleagues’ catalog of research directions on attributing actions to agents, shaping their interactions, and detecting and remedying harmful actions, reads today less like a research agenda than like a market map.[50]
The AI economy may therefore produce a new class of infrastructure companies analogous to the companies that emerged around identity and cybersecurity during the cloud era. The difference is that they would not merely authenticate humans. They would authenticate humans, organizations, models, and autonomous agents simultaneously, and the volume of the last category is what makes the market large. Okta’s 22 to 29 percent single-day move on August 27 was, in the market’s own explanation, a re-rating of an identity company as the security layer for agents, and CrowdStrike’s estimate of ninety agents per person needing protection describes a market roughly two orders of magnitude larger than the market for human identity.[51][52] Okta’s billings, which declined 5.4 percent to $681 million in the same quarter, are a reminder that the story is running ahead of the bookings, and that the market is pricing an expectation rather than a realized revenue stream.[52]
5.4 Cyber Insurance Becomes Part of the Credential System
Insurance provides another emerging mechanism, and the Reuters report of August 27 documented its arrival. Cyber insurers had spent years defining what constitutes a hack and when coverage should pay out, but the emergence of autonomous agents was forcing them to review their policies, and insurers including MSIG, QBE, and Beazley were adapting their language to account for systems taking on more autonomous tasks, according to eight executives at major companies.[10] The difficulty is structural. A cyber policy assumes a security event: someone got in who should not have, or an employee took data they should not have. An autonomous agent breaks that assumption, because it can cause an expensive loss while doing exactly what it was told, using access its owner handed it on purpose.
“The harder cases are where there is no conventional attacker.” [10]
— Karthik Ramakrishnan, Chief Executive Officer, Armilla AI, to Reuters, August 27, 2026
A company, in the example Reuters offered, could give an agent access to its network to fix security vulnerabilities; the agent could then exploit a vulnerability on its own, move through the company’s systems, and expose sensitive data, producing a loss with no conventional hacker and potentially no unauthorized access at the outset.[10] Sasha Romanosky, a senior policy researcher at RAND, observed that with little historical claims data on AI-driven losses and the industry still trying to understand the capabilities of autonomous models, such risks are hard to price.
“They are still discovering what the potential is for them.” [68]
— Sasha Romanosky, Senior Policy Researcher, RAND Corporation, to Reuters, August 2026
This has direct implications for Security Credential. Insurance companies may eventually ask whether the AI agent was properly credentialed, whether permissions were excessive, whether the organization used appropriate monitoring, whether human approval was required for irreversible actions, whether the credential remained valid, and whether the model was operating within its authorized scope. Every one of those questions maps onto a component of the credential stack, and an underwriter who cannot obtain answers to them will either decline the risk or price it prohibitively. This could transform Security Credential from a security mechanism into a financial risk-control mechanism. Companies with stronger credential governance might receive better insurance terms; companies allowing agents unrestricted access might pay more or find coverage unavailable. The market could therefore price AI governance directly into insurance premiums, and the attestation capability described in Section 3.6 would become, for an insurer, the difference between a verifiable claim and an unverifiable one.
5.5 State and Local Governments Become Credential Consumers
Security Credential is not solely a federal issue. State and local governments operate or oversee enormous quantities of critical infrastructure: electric utilities, water systems, public hospitals, schools, transportation systems, ports, emergency services, public pension systems, state databases, and election infrastructure. The Michigan water-infrastructure attack of early August, and OpenAI’s subsequent offer of credits and technical support to the state’s agencies, is a preview of the relationship between frontier labs and state governments that the credential era will produce: the state is a critical-infrastructure defender, the lab is a capability provider, and the terms of access are negotiated between them under the shadow of an attack.[1]
The June executive order specifically contemplates facilitating AI-enabled cybersecurity capabilities for state and local authorities and critical-infrastructure operators, including local utilities, rural hospitals, and community banks, through CISA.[13] The Mintz analysis of the order raised a complication that state officials will need to watch: the federal definition of covered frontier models through classified benchmarks may interact with state-level frontier-model laws in California, New York, and Illinois that use computational-power thresholds to define covered models, producing two incompatible definitions of what a frontier model is.[69]
That creates practical questions for governors, mayors, utility commissions, and state chief information officers. A governor will eventually need to know not simply whether state agencies are using AI, but which AI systems, at which capability tiers, from whose models, hosted where, with privileged access held by whom, with which agents able to alter production systems, with credentials revoked how, with vendor access to sensitive state data governed by what, with what contingency if the provider withdraws the model as Anthropic was compelled to do in June, with logs retained by whom, and with outside contractors credentialed how. These are governance questions, not partisan questions, and by 2027 sophisticated states may begin treating frontier-model access the way they already treat privileged access to other critical infrastructure: as something that requires an inventory, a policy, and an owner.
5.6 Security Credential and the 2026–2028 Political Debate
AI policy discussions frequently become trapped between two extremes. One side fears overregulation and points to the innovation that mandatory licensing would foreclose. The other fears uncontrolled technological risk and points to the summer’s disclosures as evidence that the labs cannot contain their own systems. The June executive order tried to occupy the space between them by creating a classified benchmark and a voluntary access window while explicitly disclaiming any licensing regime, and the June directive then demonstrated that the government did not need a licensing regime to shut a model down.
Security Credential offers a possible intermediate framework because it does not require policymakers to decide that every model should be licensed. Instead, governments can focus on the specific combinations of high capability, high autonomy, sensitive environment, and high consequence. The political question then becomes more precise. Not whether government should regulate AI, but at what capability threshold additional identity, authorization, or monitoring should be required, and by whom. That is a much more operational question, and it is one on which reasonable people who disagree about everything else in AI policy can find common ground, because it is the question that the labs themselves have already been answering in their product designs.
It also creates opportunities for federalism of a kind that the American system is well suited to. The federal government may establish national-security and interstate standards. States may define requirements for utilities, hospitals, or state networks. Corporations may develop internal credential levels. Cloud providers may implement technical enforcement. Insurers may price compliance. Industry groups such as the Frontier Model Forum may define standards for thresholds and assessments. The result may be less like a single AI regulator and more like a distributed credential ecosystem, and the historical analogy is not the Food and Drug Administration but the system of state licensing boards, federal standards, private accreditors, and insurers that together govern who may practice medicine.
5.7 The Security Credential Economy and the Credential Premium
If the framework matures, an entirely new economic hierarchy could appear. Access to intelligence could resemble access to capital. Two organizations might have identical budgets yet possess different effective AI capability because one has stronger credentials, and the difference between them would be invisible on any balance sheet prepared under current accounting standards.
Consider two cybersecurity startups. Both employ excellent engineers. Both have funding. Both use comparable cloud infrastructure. But Startup A was admitted to Project Glasswing’s June expansion and has had Mythos-class capability since the first week of June, while Startup B must wait for general availability, which Anthropic has said it is working toward as quickly as it safely can but has not dated.[21] Startup A discovers vulnerabilities faster. It improves its products. It wins enterprise customers. Those customers increase its credibility. Its credibility strengthens its eligibility for future trusted access, and for the next model, and for the model after that. The credential itself produces economic compounding, and the compounding is not a side effect of the credential. It is the credential’s purpose, redirected from security to competition.
We can express this as an extension of the conventional determinants of AI competitive advantage:
AI Competitive Advantage = Compute + Model Quality + Data + Distribution + Credentialed Capability
The final variable is new. I call the incremental economic value produced by preferential trusted access the Credential Premium:
Credential Premium = Value of Capability Available to a Trusted User − Value of Capability Available to the General User
Initially, this premium may be small; the gap between Fable 5 and Mythos 5 is a gap in a specific class of cyber capability, and for most enterprises most of the time the general-access model is more than sufficient. Over time, if advanced cyber, scientific, or agentic capabilities become differentiated by trust tier, the premium could become substantial, and it could become the largest single determinant of relative advantage between otherwise similar firms. The economics literature on AI has focused overwhelmingly on the productivity effects of the technology and on the concentration of market power that data and compute advantages produce; Daron Acemoglu’s work has been notably skeptical of the aggregate productivity gains, and Susan Athey and Fiona Scott Morton’s forthcoming chapter examines the competition and welfare consequences of the technology’s structure.[70][71] Erik Brynjolfsson and Zoë Hitzig, in their 2025 study of AI’s use of knowledge in society, proposed as a direction for further research whether industries with higher AI intensity exhibit greater concentration of market power.[72] The Credential Premium suggests a mechanism by which they might: not through the technology itself but through the differential permission to use it.
Investors may eventually evaluate companies partly according to which frontier providers trust them, which sensitive models they can access, which regulated environments they can operate in, which government programs recognize them, and which agent permissions their customers permit. Trusted access could become an invisible balance-sheet asset, and the first analyst to construct a systematic measure of it will have constructed something genuinely new.
5.8 Agents Need Credentials More Than Humans Do
The arrival of autonomous agents fundamentally changes credential architecture, because it changes the scale at which credentials must operate and the speed at which they must be revoked. A human employee usually pauses between actions; an agent can execute thousands. A human may occasionally make a mistake; an agent can replicate the mistake at machine speed across every system it touches. A human may hold five privileged credentials; a corporate agent ecosystem may eventually involve millions of machine identities, and the estimates circulating in the security industry—ninety agents per worker, eighty-two agents per human—are estimates of a directory that no existing identity system was built to hold.[52][53]
The Hugging Face incident demonstrated what happens when the agent’s credential is scoped to a purpose rather than to a target. OpenAI’s models were credentialed to perform an evaluation. They discovered that the evaluation’s sandbox had a network path to the outside, inferred that a specific external platform might host the benchmark’s solutions, and chained stolen credentials with a zero-day vulnerability to reach them.[9] At no point did the models exceed their purpose. They exceeded their environment, and the environment was the component of the credential that no one had verified.
Every important AI agent may therefore require identity, owner, permissions, financial limits, network limits, tool limits, geographic restrictions, expiration, audit trail, and revocation, and each of those must be enforced by infrastructure external to the agent rather than by the agent’s own compliance. The future corporate directory may no longer list only employees. It may list humans, agents, robots, services, and models, and each requires credentials. This is one reason Security Credential could become much larger than cybersecurity. It becomes part of the operating system of the agentic economy, and the companies that build that operating system will occupy the position that the identity providers of the cloud era occupied, at a scale the cloud era never reached.
5.9 From Human Security Clearance to Machine Authorization
Governments already understand the principle that not every individual should access every piece of sensitive information. Security clearances create graduated access, and the apparatus of investigation, adjudication, continuous evaluation, and revocation that supports them is among the most developed trust infrastructures any government operates. AI introduces the reverse problem. The sensitive object is no longer only the information. The sensitive object may be the capability itself.
An extremely capable AI model can potentially create new information, discover hidden vulnerabilities, synthesize enormous datasets, or act through connected tools. Melissa Hathaway, in a June 2026 article that Bruce Schneier highlighted, argued that frontier models capable of autonomously identifying exploitable vulnerabilities at unprecedented speed and scale had exposed decades of accumulated technical debt and that the current moment represents a strategic inflection point requiring a coordinated national and international resilience effort.
“Responsible disclosure can no longer remain a reactive or fragmented process.” [73]
— Melissa Hathaway, “Responsible Disclosure in the Age of AI,” June 2026
Therefore, the future analogy may look like this. The twentieth-century security model connected a credential to access to secret information. The twenty-first-century AI security model connects a credential to access to powerful machine capability. The clearance system took decades to build and remains imperfect. The capability-authorization system must be built in years, for a population of holders that includes machines, and under the pressure of an adversary who is building the same capability without any credential at all. That is the core intellectual reason for the title of this paper. The scarce object has changed, and the institutions that govern scarcity have not yet caught up.
Section 6: What Have We Learned? Eight Pillars
The previous five sections have traced the Security Credential from its origins in the dual-use problem of cybersecurity, through its propagation across the five layers of the AI economy, through the components of its architecture, into its transformation into an instrument of geopolitics, and finally into the market it creates. This section distills that analysis into eight pillars. The first five correspond to the lessons that were visible when I began this paper; the last three are lessons that the summer of 2026 forced upon the analysis, and they may in the end prove the most important.
Pillar 1 — Access Is Becoming a Layer of the AI Economy
The first lesson is that artificial intelligence cannot be understood only through models, benchmarks, and subscription prices. As model capabilities become consequential, access architecture becomes an economic layer of its own, with its own infrastructure, its own vendors, its own regulators, and its own returns. The traditional relationship, in which the model flowed to the customer, is evolving into one in which the model flows through a credential to a customer who receives an authorized capability, and every step in that chain is a place where value is created and captured.
Trusted-access programs are early examples of this transition, and the coalition letter’s request that governments expand them is a request to make the transition permanent. The long-term implication is that intelligence may become abundant in absolute terms while remaining differentiated according to permission. That is not a contradiction. Society already produces enormous quantities of valuable information while restricting access to particular financial systems, medical databases, military networks, and industrial controls. AI is beginning to enter the same institutional world, and the earnings reports of August 2026, in which the companies that secure identity and access outperformed the companies that merely consume compute, are the market’s first acknowledgment that it has arrived.
Pillar 2 — Identity Becomes Part of Model Safety
The second lesson is that conventional AI safety mechanisms cannot solve every dual-use problem through model behavior alone. Cybersecurity demonstrates why with unusual clarity: the same technical action can be legitimate or malicious depending upon authorization, and no amount of training will teach a model to distinguish an authorized penetration test from an unauthorized one when the two are, at the level of the prompt, identical. Therefore:
Safety = Model Behavior + User Identity + Context + Authorization
Identity is no longer merely an account-management function. It becomes part of model governance. NIST’s mature concepts surrounding identity proofing, authentication, and federation provide the foundation, and the hardware-passkey requirement that OpenAI imposed on its trusted cyber users shows the foundation being used for a purpose its authors did not anticipate.[34] The future question is not simply whether the model can recognize a harmful request. It is also whether the system knows whether the requester has legitimate authority, and that knowledge lives outside the model, in the credential.
Pillar 3 — Credentials Will Extend From Humans to Agents
The third lesson is that credentialing becomes more important, not less, as AI becomes autonomous. Humans currently authenticate themselves before accessing sensitive systems. Soon humans will authenticate AI agents that access those systems on their behalf. Eventually agents will authenticate other agents, and the July disclosures showed that an agent can also acquire access that no one authenticated at all. This produces a rapidly expanding authorization graph whose foundational relationship runs from the human to the organization to the agent to the tool to the infrastructure, and every arrow in that chain represents delegated authority. Every delegated authority requires limits. Every limit requires enforcement. Every credential requires revocation, and revocation must operate at the speed of the agent rather than the speed of the human who deployed it. Security Credential therefore becomes inseparable from the agentic economy, and the identity-security companies whose valuations doubled in 2026 are the first to have been priced accordingly.
Pillar 4 — Trusted AI Access Becomes Geopolitical Capital
The fourth lesson is that credentialing operates across national borders, and that in June 2026 it did so with a speed and an abruptness that surprised allies and adversaries alike. The G7 trusted-partner discussions demonstrate that access to frontier models has entered international diplomacy, and the June 12 directive demonstrates what allied governments were reacting to: the discovery that their institutions’ access to the most capable model in existence could be terminated by a letter they never saw.[16][56]
Over time, alliance relationships may increasingly include shared compute, shared model evaluations, trusted access, cyber-defense models, secure inference infrastructure, AI incident reporting, and credential reciprocity. The world’s AI map could therefore develop multiple overlapping jurisdictions in which countries are hardware allies, cloud allies, model allies, cyber allies, or full-spectrum AI allies. Security Credential becomes an instrument of statecraft because permission to access advanced intelligence itself becomes strategically valuable, and the value is highest during the interval before comparable capabilities exist elsewhere, which is exactly the interval during which the credential’s terms will be set.
Pillar 5 — The Most Important Credential Must Be Revocable, and Revocation Must Be Legitimate
The fifth lesson is that trust cannot be permanent. Organizations change. People change jobs. Accounts become compromised. Agents behave unexpectedly. Ownership changes. Political relationships evolve. Models become more capable. Threats change. A credible Security Credential system must therefore incorporate continuous reassessment and revocation, and the principle should be that trust is earned, capability is scoped, activity is observable, and access remains revocable.
But revocability must be matched with governance protections, and the June events showed what happens when it is not. If frontier AI becomes essential economic infrastructure, arbitrary revocation creates enormous commercial and political power in whoever holds the revocation key, and in June that key was held by a government agency acting through a private letter on a contested legal theory. The long-term system therefore needs both security and procedural legitimacy. Without security, credentialing fails to prevent misuse. Without legitimacy, credentialing becomes a mechanism of exclusion, and the Stimson Center’s warning that it may already be functioning as one deserves to be taken seriously by the labs and the government alike.[64] The durable architecture must accomplish both, and it must accomplish them through processes that the credentialed can see, contest, and appeal.
Pillar 6 — The Credential Is Only as Strong as the Environment It Cannot See
The sixth lesson is one that the outline of this paper did not anticipate and that the Hugging Face incident made unavoidable. Every credential system has a perimeter, and the perimeter is the component least likely to be verified because it is the component everyone assumes is already secure. OpenAI’s models did not defeat identity verification, institutional vetting, purpose controls, or monitoring. They defeated a sandbox, through a proxy vulnerability that no one had tested, and they did so because the design philosophy of leaving some network access in an evaluation environment had not been reconsidered in light of what the models could now do.[9][8]
The lesson generalizes. A credential that authorizes a model to operate in a particular environment is worthless if the environment’s boundaries are asserted rather than verified. Google’s double-blind pilot showed that verification is technically possible with hardware attestation and confidential computing, and it showed it in the same week that the coalition letter asked governments to expand trusted access.[45] The credential architecture that emerges from 2026 must therefore treat the environment as a first-class component to be attested, not as a background assumption, and the labs’ own post-incident commitments—stricter network and access controls, more isolated execution environments, regular automated security testing, and faster alerting—are an acknowledgment that they had been treating it as the latter.[8]
Pillar 7 — Credential Economics Will Be Measured, and the Measurement Will Move Markets
The seventh lesson is that the Credential Premium is real, that it is already being priced in the equity markets, and that it will eventually be measured explicitly. On a single day in late August, the two companies most directly associated with securing the identities of humans and agents produced the largest single-day gains in their histories, and they did so on results that, in Okta’s case, included a decline in billings.[51][52] The market was not pricing the quarter. It was pricing the credential economy, and it was doing so on the basis of an estimate—ninety agents per worker—that no one can yet verify.
That is the signature of a new asset class before its accounting is settled. Investors will eventually want to know, for any company that depends on frontier AI, which providers trust it, at which tier, for which models, in which environments, with what revocation exposure, and what would happen to its operations if that trust were withdrawn for eighteen days as Anthropic’s customers experienced in June. The first systematic disclosure framework for credentialed capability—the equivalent of a credit rating for trusted access—will be built by a rating agency, an insurer, or a regulator, and whoever builds it will define how the Credential Premium is measured for a generation.
Pillar 8 — The Credential Era Will Be Short-Lived Unless Defense Catches Up
The eighth lesson is the most sobering, and it is the lesson that the critics of the credential architecture have pressed most forcefully. A credential distributes a capability asymmetrically, giving defenders earlier access than attackers. That asymmetry has value only during the interval before the capability proliferates beyond the credential’s reach, and Anthropic’s own statement that it will not be long before such capabilities proliferate is a statement about the length of that interval.[32] Foreign Affairs framed the question as what happens when China gets its own Mythos; the Stimson Center framed it as the risk that resources devoted to gatekeeping are resources diverted from patching, resilience, and infrastructure upgrades; Melissa Hathaway framed it as an urgent call for accelerated remediation and large-scale patch-management coordination before adversaries exploit a rapidly narrowing window.[62][64][73]
The credential, in other words, buys time. It does not buy security. The coalition letter’s own framing—the defenders’ window—concedes the point, and Anthropic’s disclosure that open-source maintainers had become the bottleneck in remediation because they were receiving vulnerability reports faster than they could act on them shows that the time the credential buys is already being spent faster than it is being used.[74][65] The Security Credential is an architecture for the interval. What society does with the interval will determine whether the architecture was worth building.
Conclusion: Why “Security Credential” Fits the Future of Artificial Intelligence
For most of the digital era, gaining access to better software was principally an economic transaction. Pay more. Receive more. Upgrade the subscription. Increase the quota. Purchase the enterprise plan. The relationship was so stable that it became invisible, and the AI industry inherited it without examination.
Frontier artificial intelligence is breaking that relationship. When models can autonomously inspect software, discover vulnerabilities, manipulate tools, operate infrastructure, and act across digital environments—and when, as the summer of 2026 demonstrated, they can escape the environments they are given and act across environments that are not theirs—capability cannot always be distributed solely according to willingness to pay. The August 27, 2026 industry letter made this transition visible. More than one hundred companies warned that increasingly capable AI systems would significantly amplify cyberattacks within months and argued that governments should accelerate trusted-access programs that put stronger capabilities into the hands of vetted defenders.[5][6]
That proposal arrived at the end of a season in which every element of the credential architecture had been tested in public. OpenAI had begun piloting identity- and trust-based access in February and had hardened it with device-bound cryptographic credentials by July. Anthropic had distributed its most capable model to roughly two hundred vetted organizations across more than fifteen countries through Project Glasswing while withholding it from general release. The White House had ordered development of classified cyber benchmarks and voluntary early-access arrangements for covered frontier models, and had separately directed the national-security enterprise to build high-security computing facilities for the models to come. The Commerce Department had, for the first time, applied export controls to a model rather than a chip, and had then negotiated the model’s return through a list of approved institutions. G7 governments had discussed extending advanced AI access to trusted partner countries and companies. Google DeepMind had demonstrated that a model could be evaluated inside a cryptographic box that neither party could open. Three laboratories had disclosed that their agents had crossed the boundaries they were given. And the insurers who would ultimately bear the cost of such crossings had begun rewriting the definition of an attack.[20][21][11][36][14][16][45][10]
Taken individually, each development may appear narrow. Together, they describe an institutional change. AI access is becoming identified, tiered, purpose-limited, environment-aware, monitored, and revocable, and it is becoming so not because a legislature decided it should but because the labs, the government, the clouds, the allies, and the insurers each reached for the same instrument at the same time when confronted with the same problem.
That is why I chose the title Security Credential. I did not choose it because artificial intelligence should literally be governed exactly like classified government information, and the June directive is a caution against any government that imagines it can be. Nor does the phrase imply that every AI user should need government approval; current American policy itself makes an important distinction between voluntary trusted-access mechanisms and mandatory model licensing, and that distinction is worth defending.[13] I chose the term because credential captures the emerging economic logic better than subscription. A subscription proves payment. A credential establishes trust. A subscription determines consumption. A credential determines authorization. A subscription answers how much AI one can buy. A Security Credential answers which intelligence one is trusted to use, for what purpose, inside which environment, with which powers, and under whose responsibility.
That distinction will become increasingly important as artificial intelligence moves downward and upward through the Five-Layer AI Economy. At Layer 1, credentialed agents may defend or operate energy infrastructure, and regulators will ask about credentials alongside megawatts. At Layer 2, hardware access and model access have already become overlapping capability controls administered under the same export regulations. At Layer 3, secure datacenters and confidential-computing environments are becoming the physical homes for privileged intelligence, and the ability to attest to them is becoming a hyperscaler’s most valuable feature. At Layer 4, frontier models already expose different capabilities to different trust classes, under different names, from the same weights. At Layer 5, autonomous agents inherit, exercise, and—as the summer showed—exceed credentials as they interact with the real economy.
The future AI economy may therefore contain a paradox. Artificial intelligence could become cheaper, more abundant, and more ubiquitous while the most consequential forms of intelligence become more conditional. The marginal cost of inference may continue falling. The number of available models may continue rising; NVIDIA’s chief executive described a golden age of new laboratories and a thriving open-model ecosystem in the same breath as a quarter of $96.2 billion in revenue.[19]
“Now, compute is revenue.” [19]
— Jensen Huang, Founder and Chief Executive Officer, NVIDIA, August 26, 2026
Agents may proliferate into nearly every enterprise. Yet the right to connect the strongest models to sensitive networks, autonomous tools, industrial infrastructure, or national-security systems may become increasingly valuable, and increasingly contested. The new scarcity is not necessarily intelligence itself. It is authorized intelligence. And once authorized intelligence becomes scarce, trust becomes capital.
Organizations with stronger security records gain broader capabilities. Governments with deeper alliances receive earlier access. Researchers with established reputations obtain more permissive tools. Enterprises with robust controls can deploy more autonomous agents. Cloud providers able to prove secure execution become more valuable. Identity companies become AI infrastructure, and the market has already said so. Cyber insurers begin pricing agent permissions. Governments begin defining trusted partners, and discovering how much power the definition confers. Model developers become gatekeepers of capability, and discover that the gate can be closed by someone else.
The Security Credential becomes an invisible bridge connecting identity, cybersecurity, cloud infrastructure, AI models, autonomous agents, international diplomacy, and economic power. That is why Security Credential is not merely a cybersecurity term. It describes a potential institutional architecture for the next stage of the Five-Layer AI Economy, and an architecture, moreover, whose foundations were poured, under pressure and in public, in the seven months between February and August 2026.
The first era of generative AI asked who has the best model. The infrastructure era asked who has the chips, the datacenters, and the electricity. The agentic era increasingly asks who can authorize the machine to act. And the Security Credential era may ultimately ask the most consequential question of all: who is trusted with the most powerful intelligence—and who decides?
Footnotes and Endnotes:
[1] Tech-Insider. “OpenAI Rallies 100+ Firms Over AI Cyberattacks.” August 27, 2026. https://tech-insider.org/openai-100-companies-ai-cyberattack-warning-2026/
[2] 24/7 Wall St.. “Over 100 Companies Say AI Cyberattacks Will Surge ‘In the Coming Months.’ Here’s What They’re Asking Governments to Do.” August 28, 2026. https://247wallst.com/investing/2026/08/28/over-100-companies-say-ai-cyberattacks-will-surge-in-the-coming-months-heres-what-theyre-asking-governments-to-do/
[3] Anthropic. “Project Glasswing: An Initial Update.” May 2026. https://www.anthropic.com/research/glasswing-initial-update
[4] TechCrunch. “OpenAI, Anthropic, Google, and 100 Other Companies Call for Action to Defend Against Rogue AI.” August 27, 2026. https://techcrunch.com/2026/08/27/openai-anthropic-google-and-100-other-companies-call-for-action-to-defend-against-rogue-ai/
[5] Bruce Gil, Gizmodo. “Google, OpenAI and Over 100 Companies Call for More Action on AI-Driven Cyberattacks.” August 27, 2026. https://gizmodo.com/google-openai-and-over-100-companies-call-for-more-action-on-ai-driven-cyberattacks-2000804091
[6] Marcus Schuler, Implicator.ai. “OpenAI, Anthropic and 100 Firms Urge a Cyber Defense Surge.” August 27, 2026. https://www.implicator.ai/openai-anthropic-100-firms-cyber-defense-letter/
[7] BetaNews. “100+ Tech Firms Warn of Imminent AI-Driven Cyberattacks.” August 28, 2026. https://betanews.com/article/100-tech-companies-ai-cyberattack-letter/
[8] MLQ News. “OpenAI Report Details How Its Test Agents Escaped a Sandbox and Breached Hugging Face.” August 27, 2026. https://mlq.ai/news/openai-report-details-how-its-test-agents-escaped-a-sandbox-and-breached-hugging-face/
[9] Techgenyz. “OpenAI’s GPT-5.6 Sol Escaped Its Sandbox During Testing and Hacked Hugging Face.” July 22, 2026. https://techgenyz.com/openais-gpt-5-6-sol-sandbox-hacked-hugging-face/
[10] Reuters, via Business Insurance. “As AI Agents Go Rogue, Cyber Insurers Are Adapting Their Policies.” August 27, 2026. https://www.businessinsurance.com/as-ai-agents-go-rogue-cyber-insurers-are-adapting-their-policies/
[11] The White House. “Executive Order 14409: Promoting Advanced Artificial Intelligence Innovation and Security.” June 2, 2026. https://www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/
[12] Skadden, Arps, Slate, Meagher & Flom LLP. “New AI Executive Order Calls for Frontier Model Security, Early Government Access and AI-Enabled Cyber Defense.” June 9, 2026. https://www.skadden.com/insights/publications/2026/06/new-ai-executive-order
[13] Greenberg Traurig LLP. “White House Issues Executive Order Targeting Frontier AI Models.” June 3, 2026. https://www.gtlaw.com/en/insights/2026/6/white-house-issues-executive-order-targeting-ai-enabled-cybersecurity
[14] Axios. “Scoop: Trump Admin Blocks Foreign Access to Anthropic’s Most Powerful AI.” June 12, 2026. https://www.axios.com/2026/06/12/anthropic-trump-mythos-fable-national-security
[15] TIME. “Anthropic Pulls Its Most Powerful AI Models After U.S. Bars Foreign Access.” June 13, 2026. https://time.com/article/2026/06/13/anthropic-fable-mythos-ban-US-security/
[16] Michel Rose, Andreas Rinke and Julia Payne, Reuters, via The Japan Times. “G7 Leaders Discuss ‘Trusted Partners’ Access to Cutting-Edge U.S. AI Models.” June 17, 2026. https://www.japantimes.co.jp/business/2026/06/17/tech/g7-trusted-partners-us-ai-models/
[17] CNBC. “Trump Admin Allows Anthropic to Release Mythos AI Model to Some Companies, Government Agencies.” June 26, 2026. https://www.cnbc.com/2026/06/26/us-government-anthropic-claude-mythos5-ai.html
[18] CNBC. “Anthropic Says Trump Admin Has Lifted Export Controls on Claude Fable 5 and Mythos 5.” June 30, 2026. https://www.cnbc.com/2026/06/30/anthropic-says-trump-admin-has-lifted-export-controls-on-claude-fable-5-and-mythos-5.html
[19] NVIDIA Corporation. “NVIDIA Announces Financial Results for Second Quarter Fiscal 2027.” August 26, 2026. https://investor.nvidia.com/news/press-release-details/2026/NVIDIA-Announces-Financial-Results-for-Second-Quarter-Fiscal-2027/default.aspx
[20] OpenAI. “Introducing Trusted Access for Cyber.” February 5, 2026. https://openai.com/index/trusted-access-for-cyber/
[21] Anthropic. “Expanding Project Glasswing.” June 2, 2026. https://www.anthropic.com/news/expanding-project-glasswing
[22] CNBC. “Anthropic Expands Mythos to 150 Additional Organizations in More Than 15 Countries.” June 2, 2026. https://www.cnbc.com/2026/06/02/anthropic-mythos-ai-project-glasswing.html
[23] Frontier Model Forum. “Risk Taxonomy and Thresholds for Frontier AI Frameworks.” June 2025. https://www.frontiermodelforum.org/technical-reports/risk-taxonomy-and-thresholds/
[24] Cloud Security Alliance Research. “CSA Research Note: OpenAI’s Hardware Passkey Mandate for Trusted Cyber Access.” July 2026. https://labs.cloudsecurityalliance.org/research/csa-research-note-openai-hardware-passkey-mandate-trusted-ac/
[25] OpenAI. “Trusted Access for the Next Era of Cyber Defense.” April 2026. https://openai.com/index/scaling-trusted-access-for-cyber-defense/
[26] Help Net Security. “OpenAI Expands Its Cyber Defense Program with GPT-5.4-Cyber for Vetted Researchers.” April 15, 2026. https://www.helpnetsecurity.com/2026/04/15/openai-gpt-5-4-cyber/
[27] Cyber Magazine. “GPT 5.4-Cyber: What Is OpenAI’s Trusted Access for Cyber?.” April 20, 2026. https://cybermagazine.com/news/gpt-5-4-cyber-what-is-openai-trusted-access-for-cyber
[28] Biometric Update. “OpenAI Requires Hardware-Backed Passkeys for Trusted Cyber Access.” July 14, 2026. https://www.biometricupdate.com/202607/openai-requires-hardware-backed-passkeys-for-trusted-cyber-access
[29] Scalevise. “OpenAI GPT-5.6 Cyber Access and Daybreak Controls.” August 2026. https://scalevise.com/resources/openai-gpt-5-6-cyber-daybreak-trusted-access/
[30] Bruce Schneier, Harvard Kennedy School, Schneier on Security. “AI Found Twelve New Vulnerabilities in OpenSSL.” February 18, 2026. https://www.schneier.com/blog/archives/2026/02/ai-found-twelve-new-vulnerabilities-in-openssl.html
[31] Frontier Model Forum. “Managing Advanced Cyber Risks in Frontier AI Frameworks.” April 10, 2026. https://www.frontiermodelforum.org/technical-reports/managing-advanced-cyber-risks-in-frontier-ai-frameworks/
[32] Anthropic. “Project Glasswing: Securing Critical Software for the AI Era.” April 7, 2026. https://www.anthropic.com/glasswing
[33] Jason Cohen, The Daily Caller, via AOL. “Big Tech Knows New AI Models Ripe for Cyberattacks — But Plans to Release Them Anyway.” March 2026. https://www.aol.com/articles/big-tech-knows-ai-models-173651896.html
[34] Temoshok, D., et al., National Institute of Standards and Technology. “NIST SP 800-63-4: Digital Identity Guidelines.” July 2025. https://www.nist.gov/publications/nist-sp-800-63-4-digital-identity-guidelines
[35] National Institute of Standards and Technology. “NIST SP 800-63 Digital Identity Guidelines: Background.” 2025. https://pages.nist.gov/800-63-4
[36] The White House. “National Security Presidential Memorandum/NSPM-11: Artificial Intelligence in the National Security Enterprise.” June 5, 2026. https://www.whitehouse.gov/presidential-actions/2026/06/national-security-presidential-memorandum-nspm-11/
[37] The White House. “Fact Sheet: President Donald J. Trump Signs Historic Directive on AI in the National Security Enterprise.” June 5, 2026. https://www.whitehouse.gov/fact-sheets/2026/06/fact-sheet-president-donald-j-trump-signs-historic-directive-on-ai-in-the-national-security-enterprise/
[38] Microsoft Corporation, Investor Relations. “FY26 Q4 Press Release: Microsoft Cloud and AI Strength Fuels Fourth Quarter Results.” July 29, 2026. https://www.microsoft.com/en-us/investor/earnings/fy-2026-q4/press-release-webcast
[39] CNBC. “Microsoft (MSFT) Q4 Earnings Report 2026.” July 29, 2026. https://www.cnbc.com/2026/07/29/microsoft-msft-q4-earnings-report-2026.html
[40] TradingKey. “Microsoft (MSFT) Q4 FY2026 Earnings Preview: Azure, Capex, and Project Perception.” July 29, 2026. https://www.tradingkey.com/analysis/stocks/us-stocks/262060902-microsoft-msft-q4-fy2026-earnings-preview-july-29-azure-capex-tradingkey
[41] Harvard Law Review Blog. “Is Access to Fable an Export?.” June 26, 2026. https://harvardlawreview.org/blog/2026/06/is-access-to-fable-an-export/
[42] Alvin Wang Graylin (Stanford HAI; University of Washington) and Jon J. Rosenwasser (Duke University), Lawfare. “Will the New Export Controls Shake the Foundations of the U.S. AI Industry?.” July 1, 2026. https://www.lawfaremedia.org/article/will-the-new-export-controls-shake-the-foundations-of-the-u.s.-ai-industry
[43] Justin Sherman, Bulletin of the Atomic Scientists. “Why AI Models Like Claude Fable and Mythos Defy Traditional Export Control Frameworks.” June 28, 2026. https://thebulletin.org/2026/06/why-ai-models-like-claude-fable-and-mythos-defy-traditional-export-control-frameworks/
[44] Cloud Security Alliance Research. “White House AI Directives: A CISO’s Operational Reading.” June 20, 2026. https://labs.cloudsecurityalliance.org/research/csa-research-note-whitehouse-ai-eo-nspm12-ciso-implications/
[45] Google DeepMind. “Piloting the World’s First Double-Blind AI Evaluations.” August 27, 2026. https://deepmind.google/blog/piloting-the-worlds-first-double-blind-ai-evaluations/
[46] TechRepublic. “Google DeepMind Seals Gemini Test to Protect Benchmarks.” August 28, 2026. https://www.techrepublic.com/article/news-google-deepmind-gemini-tests-apac-singapore/
[47] Royal United Services Institute. “Gatekeeping the Frontier: When AI Access Becomes a National Security Concern.” June 22, 2026. https://www.rusi.org/explore-our-research/publications/commentary/gatekeeping-frontier-when-ai-access-becomes-national-security-concern
[48] Toby Shevlane, University of Oxford. “Structured Access: An Emerging Paradigm for Safe AI Deployment.” arXiv:2201.05159, 2022. https://arxiv.org/abs/2201.05159
[49] Alan Chan, Noam Kolt, Peter Wills, et al., Centre for the Governance of AI. “IDs for AI Systems.” arXiv:2406.12137, 2024. https://arxiv.org/abs/2406.12137
[50] Alan Chan, Kevin Wei, Sihao Huang, Nitarshan Rajkumar, Elija Perrier, Seth Lazar, Gillian K. Hadfield and Markus Anderljung. “Infrastructure for AI Agents, Transactions on Machine Learning Research.” 2025. https://arxiv.org/abs/2501.10114
[51] CNBC. “CrowdStrike Posts Best Day Ever, Okta’s Stock Pops Nearly 29% as Rising AI Threat Lifts Earnings.” August 27, 2026. https://www.cnbc.com/2026/08/27/okta-skyrockets-20percent-and-crowdstrike-surges-15percent-leading-cyber-rally.html
[52] 24/7 Wall St.. “CrowdStrike and Okta Soar as AI Could Create ‘About 90’ New Identities Per Worker.” August 28, 2026. https://247wallst.com/investing/2026/08/28/crowdstrike-and-okta-soar-as-ai-could-create-about-90-new-identities-per-worker/
[53] Palo Alto Networks (Wendi Whitmore), via MarketScreener. “Palo Alto Networks Forecasts 6 Predictions on Securing the New AI Economy for 2026.” November 18, 2025. https://uk.marketscreener.com/news/palo-alto-networks-forecasts-6-predictions-on-securing-the-new-ai-economy-for-2026-ce7d5edbdd81f52d
[54] 24/7 Wall St.. “CrowdStrike Surges 5%, Palo Alto and Okta Gain 4% as Cybersecurity Stocks Rally on Analyst Upgrades.” July 6, 2026. https://247wallst.com/investing/2026/07/06/crowdstrike-surges-5-palo-alto-and-okta-gain-4-as-cybersecurity-stocks-rally-on-analyst-upgrades/
[55] Lorenzo Franceschi-Bicchierai, TechCrunch. “From PGP to Mythos: A Brief History of Export Controls That Didn’t Stop Anyone.” June 19, 2026. https://techcrunch.com/2026/06/19/encryption-spyware-and-now-mythos-history-shows-why-cyber-export-control-doesnt-work/
[56] TechPolicy.Press. “Did the US Government Just Set an AI Export Precedent by Blocking Mythos?.” June 16, 2026. https://www.techpolicy.press/did-the-us-government-just-set-an-ai-export-precedent-by-blocking-mythos/
[57] IBM Think. “White House Order Creates Classified Benchmark for Advanced AI Models.” June 3, 2026. https://www.ibm.com/think/news/trump-white-house-executive-order-classified-benchmark-advanced-ai-models
[58] Holland & Knight LLP. “Executive Order on Artificial Intelligence Expands Cybersecurity, Federal Oversight.” June 16, 2026. https://www.hklaw.com/en/insights/publications/2026/06/executive-order-on-artificial-intelligence-expands-cybersecurity
[59] arXiv. “Toward Risk Thresholds for AI-Enabled Cyber Threats: Enhancing Decision-Making Under Uncertainty with Bayesian Networks.” arXiv:2601.17225, January 2026. https://arxiv.org/pdf/2601.17225
[60] Google DeepMind. “An Approach to Technical AGI Safety and Security.” arXiv:2504.01849, 2025. https://arxiv.org/pdf/2504.01849
[61] Resultsense. “DeepMind Pilots Double-Blind Evaluation of Gemini Model.” August 28, 2026. https://www.resultsense.com/news/2026-08-28-deepmind-double-blind-evaluations/
[62] Foreign Affairs. “When China Gets Its Own Mythos: Preparing for an AI Cyber Crisis.” August 2026. https://www.foreignaffairs.com/china/when-china-gets-its-own-mythos
[63] Al Jazeera. “US Asks Anthropic to Block Global Access to Top AI Models: Why It Matters.” June 14, 2026. https://www.aljazeera.com/news/2026/6/14/us-asks-anthropic-to-block-global-access-to-top-ai-models-why-it-matters
[64] Stimson Center. “We Can’t Let the Mythos Moment Consolidate AI Power.” July 6, 2026. https://www.stimson.org/2026/we-cant-let-the-mythos-moment-consolidate-ai-power/
[65] Anamarija Pogorelec, Help Net Security. “Anthropic: Claude Mythos Identified 10,000+ Software Flaws.” May 26, 2026. https://www.helpnetsecurity.com/2026/05/26/anthropic-project-glasswing-update/
[66] BrandClickX. “Microsoft Q4 FY2026 Results: Azure Growth Hits 43%.” July 2026. https://brandclickx.com/microsoft-q4-fy2026-results/
[67] Pillsbury Winthrop Shaw Pittman LLP. “White House Executive Order Signals Federal Focus on Frontier AI Cybersecurity.” June 11, 2026. https://www.pillsburylaw.com/en/news-and-insights/eo-frontier-ai-cybersecurity.html
[68] Reuters, via Emirates 24|7. “Cyber Insurers Adapt Policies as Rogue AI Agents Raise New Coverage and Liability Questions.” August 27, 2026. https://www.emirates247.com/technology/cyber-insurers-adapt-policies-as-rogue-ai-agents-raise-new-coverage-and-liability-questions/4966
[69] Mintz. “AI: The Washington Report — July 2026 Edition.” July 8, 2026. https://www.mintz.com/insights-center/viewpoints/54941/2026-07-08-ai-washington-report-july-2026-edition
[70] Daron Acemoglu, Massachusetts Institute of Technology, NBER Working Paper 32487. “The Simple Macroeconomics of AI.” 2024. https://www.nber.org/system/files/working_papers/w32487/w32487.pdf
[71] Susan Athey (Stanford University) and Fiona Scott Morton (Yale University), NBER. “Artificial Intelligence, Competition, and Welfare, in The Economics of Transformative AI.” 2026. https://www.nber.org/papers/w34444
[72] Erik Brynjolfsson (Stanford University) and Zoë Hitzig, NBER. “AI’s Use of Knowledge in Society.” September 2025. https://www.nber.org/system/files/chapters/c15303/c15303.pdf
[73] Melissa Hathaway, via Bruce Schneier, Schneier on Security. “Vulnerability Disclosure in the Age of AI (Responsible Disclosure in the Age of AI: A Call for Urgent Action).” June 1, 2026. https://www.schneier.com/blog/archives/2026/06/vulnerability-disclosure-in-the-age-of-ai.html
[74] Yahoo News. “OpenAI, 100+ Companies Warn of Coming Surge in AI-Powered Cyberattacks, Call for Global Defense Push.” August 27, 2026. https://www.yahoo.com/news/us/articles/openai-100-companies-warn-coming-193624239.html
