Frontier AI Cyber Evaluation Exchange

In July 2026 two frontier developers disclosed that agents running inside cybersecurity evaluations had reached live third-party systems. Neither found the problem through a reporting channel: Hugging Face found OpenAI’s agents on its own network, and Anthropic found three of its own incidents, the earliest three months old, only after reviewing 141,006 evaluation runs in the days following OpenAI’s public disclosure. What failed was not willingness to share but the absence of anywhere to share to. This brief proposes a frontier-evaluation workstream inside GOLD EAGLE, the AI cybersecurity clearinghouse directed by Executive Order 14409: participants submit eight closed fields describing a containment failure, an operator aggregates them, and recurring patterns return to participants. It is scoped as a 12-month pilot that takes historical cases first, and it treats the binding constraint as legal rather than technical—the liability protection the scheme depends on currently expires in December 2026.

Question

How can organizations learn from failures observed during frontier-model cybersecurity evaluations without centralizing models, raw traces, or company-identified incidents?

My role

Individual. Policy research, institutional design, and the pilot architecture.

Method

Frontier AI · Cybersecurity · Institutional design

Protocol

Submit → Protect → Analyze → Return

Evidence

Six primary and institutional sources accessed September 2026: incident disclosures and reviews published by two frontier AI developers, Executive Order 14409, MITRE’s AI incident-sharing initiative, and SEI’s AISIRT.

Result

Collective learning without centralizing sensitive traces.

8

Field schema

12

Month pilot

0

Raw traces shared

Design

• An eight-field closed schema—failure class, escape mechanism, external reach, detection source, detection lag, monitoring coverage, mitigation, recurrence—carrying no model, victim or exploit detail
• A four-stage protocol—submit, protect, analyze, return—run on GOLD EAGLE’s existing intake, operator and disclosure route
• Exclusions enforced by the shape of the schema rather than by an undertaking not to send: no field can carry weights, raw traces, live credentials or third-party identity
• Two stop gates: no written CISA 2015 protection determination, no pilot; and if historical submissions re-identify their submitter at this population size, the schema narrows or the pilot ends
• Success measured against baselines taken from the July 2026 disclosures—0 of 4 incidents surfaced internally first, detection lag up to three months, nine days of unstructured warning time

Carries

Containment failure class · Escape mechanism and external reach · Detection source and detection lag · Monitoring coverage, mitigation and recurrence

Excludes

Model weights and training data · Raw model traces · Live credentials and exploit detail · Affected third-party identity · Submitter identity at analysis

Output

Policy brief, three pages (PDF).

BoundaryA portfolio policy concept—not an affiliated or endorsed government program.