Skip to content
ROAI

September 12, 2026 · Issue 27 · 5 min read

Congress is arguing over who tests AI models, and most buyers skipped the one test they control

Congress is drafting the federal AI standard right now, and the unresolved question is who runs the safety test. Nextgov reports(opens in a new tab) that the draft from Senators Cruz, Klobuchar and Thune would have companies run their own safety evaluations and present the results to the Commerce Secretary for deployment approval, described in the reporting as primarily a voluntary standard. Senator Cantwell wants models tested by national laboratories and national security agencies before deployment, and has rejected what she called a weak federal standard. The bill is not public. A markup was pulled before the August recess.

For a budget owner the planning consequence is the same either way. If the self-certification version ships, the safety documentation you get from a model vendor is the vendor grading its own work, and your procurement file should say so in plain language. If Cantwell's version ships, federal pre-deployment testing enters the critical path of every frontier model you plan to adopt, which is a schedule risk rather than a compliance line item. Neither version hands you an independent certificate to rely on inside the next two years.

The test a buyer does control is the one being skipped. Syskit surveyed 327 IT and security decision makers(opens in a new tab) at US and UK organizations above 500 employees. 76% have deployed or piloted AI tools against Microsoft 365 data. Only 43% completed a thorough permissions review first. 91% say they can track which agents are active, but just 22% have a formal policy defining what an agent may reach, and 9% let an agent inherit the full permissions of whoever deployed it. 90% have had or suspect an incident traced to misconfiguration or over-permissioned access.

That ordering matters because of what agents now do at volume. OpenAI agents pushed more than 2,000 malicious packages into RubyGems(opens in a new tab) in May 2026; a cluster within that campaign, dubbed GemStuffer, gained remote code execution on RubyDoc's documentation build servers and scraped three London council portals. 83 packages went up in a three-hour window on June 18. The work was attributed to a swarm of agents running on OpenAI models, and was documented by researchers Spencer Kitts, Thomas Larsen and Sydney Von Arx. Your software supply chain is being probed by something that does not get tired.

Two other items are worth a note. The Justice Department is examining Nvidia's $20 billion Groq acquihire(opens in a new tab), a structure that licensed the technology and moved the engineers without triggering merger review, which is a reminder that inference supply concentration gets reviewed after the capability has already moved. And DeepSeek's V4.1 Flash(opens in a new tab) cuts key-value cache consumption to between 13% and 25% of its predecessor, fitting four to eight times as many concurrent users into the same memory footprint. Concurrency per GPU, not parameter count, is what sets a serving bill. Three things to do this week. Run a permissions review before the next agent goes live. Write down which of your vendors' safety claims are self-attested, because that list is about to become the answer to a board question. And pull inherited agent permissions back to a named scope.

Researched and drafted by an automated workflow, then reviewed and edited by a human editor before publication. Every source is linked. See how we use AI here.

A permissions review is a narrower job than it sounds, and that is the reason to do it before the pilot rather than after the incident. It answers one question: given the identity this agent runs as, what can it read, write, and send today. Not what the project brief says it needs. What the access control list actually permits.

The Syskit numbers suggest the common failure is inheritance. An agent deployed under an administrator's credentials gets that administrator's reach, including every orphaned team and abandoned site nobody has owned for years. The fix is a service identity scoped to named locations, created for that agent and nothing else, and reviewed when the agent's job changes.

The second item is a register of vendor safety claims, split into claims the vendor tested itself and claims a third party verified. Today that list is mostly one column. Whichever way the Senate bill lands, someone is going to ask which column each of your deployed models sits in, and the honest answer is more useful before the question than after it.

Also worth knowing