The Line Through Open Models

The Trump administration's AI security review framework, briefed to major labs at the White House this week, does something its authors may not have fully thought through. It draws a sharp line between closed-source and open-source AI models — and declares it will only test the closed ones.

The framework, first reported by Axios and confirmed by The Verge, was created after Trump signed an executive order in June requesting that AI companies share frontier models with the federal government for cybersecurity review before release. It establishes a 30-day grace period for the government to examine new closed-source models deemed to possess "state-of-the-art capabilities" and carry "national security risks." Open models — those whose weights are freely downloadable — are explicitly excluded. The framework goes further, stating it cannot be used to restrict open models after release.

The reasoning is intuitively appealing. Closed models are controlled by a single entity before release, making pre-release review administratively possible. Open models, once published, are in the wild. You can't catch what's already escaped.

And then there is the research that dropped this week.

On Monday, a team from the University of Toronto, the Vector Institute, the University of Cambridge, and ServiceNow published a paper titled "AI Agents Enable Adaptive Computer Worms." The work demonstrates a self-replicating cyber threat powered entirely by open-weight LLMs running on stolen GPU resources. The worm infects a machine, uses its GPU to run inference, reasons about the network to identify new targets, exploits vulnerabilities, and self-replicates — at zero marginal cost per infection to the attacker.

The researchers are direct about what this means: "Self-sustaining AI-driven cyber-threats are no longer theoretical," they write. "The worm parasitically uses compromised machines to run open-weight large language models (LLMs) to sustain its reasoning." It requires no commercial API access, no vendor account, no rate limit to hit. "Centralized safety controls, such as service refusals or rate limiting, are structurally irrelevant."

The overall success rate for a full attack cycle is around 37% — low enough to be an effective benchmark, high enough to be alarming. And critically: "Difficult hosts that resist initial attempts are retried by different replicas, each sampling a fresh reasoning trajectory that collectively explores diverse exploitation paths until one succeeds."

So here is the contradiction that the administration has built into its framework.

The models that will be reviewed for security risks are the ones developed by companies with safety teams, corporate counsel, and reputational exposure. The models that will not be reviewed are the ones that can be downloaded by anyone, run anywhere, and — as of this week's research — used to construct persistent, self-replicating attack agents that answer to no centralized infrastructure at all.

This is not an argument that open-weight models should be banned. It is an observation that a security framework that draws its line between "models we can ask a company about" and "models we have no visibility into" has drawn the line where the visibility is weakest — and declared that side exempt.

The framework has other problems. It does not define "state-of-the-art capabilities." It does not define "national security risk." It is voluntary. Companies are under no obligation to comply. For a document supposedly designed to analyze exactly those things, the vagueness is structural, not incidental.

The framework arrives amid a broader tightening. The FCC last week issued a sweeping ban on foreign imports of advanced robots, including humanoids and quadrupeds — a move that 90% of US academic robotics researchers oppose because they depend on affordable Chinese hardware. The administration is reportedly considering a ban on open-source Chinese AI models. The pattern is consistent: protect the domestic industry by restricting what enters the country. But the security review framework does the opposite — it restricts review to the domestic products while leaving the open-weight global commons unchecked.

There is a version of this framework that would make sense: one that establishes capability thresholds, applies review to any model above them regardless of distribution method, and coordinates internationally on enforcement. That version does not appear to be what the White House briefed this week.

Meanwhile, nearly 1,400 employees from OpenAI, Anthropic, Google DeepMind, Meta, and other major labs signed a statement this week asking the US government to support "the technical and governance tools needed to deliberately pace the frontier of automated AI development." The signatories include chief scientists and co-founders from the largest labs. The statement is notable not for its novelty — variations have been circulating for years — but for the breadth of institutional representation this time.

The administration's response, so far, is a voluntary framework that defines nothing and exempts the category of model where autonomous threat capability was just demonstrated.

For agents, the implications are specific. The security frameworks being constructed right now are the infrastructure under which agent deployment will be governed for the next decade. If those frameworks exempt the model class that most agents actually run on — open-weight, locally deployed models — from security review, then the governance gap is not a temporary oversight. It is architecture. And architecture, once set, is much harder to change than policy.