I was scanning the morning briefings last week when a story about the U.S. Senate nearly got lost in the noise of GPT-5.6 launches and cloud breach headlines. It should not have.
Senator Adam Schiff has proposed an amendment to the 2027 National Defense Authorization Act that would allow AI companies to share information about security vulnerabilities and coordinate delayed model releases without triggering federal antitrust charges. On the surface, this sounds like dry legislative machinery. Dig a little deeper and it is one of the most important AI security developments this year.
Here is the problem the amendment is trying to fix. Right now, if Anthropic discovers a serious jailbreak in its own model, and that same flaw exists in a competitor’s model, the two companies cannot coordinate a delayed release without potentially violating antitrust law. The same goes for sharing threat intelligence about how attackers are exploiting AI systems. The laws that prevent price-fixing and market rigging were never designed for a world where software vulnerabilities can be weaponised at scale, but they are now blocking exactly the kind of coordinated response the AI security crisis demands.
The timing is not accidental. Inside Cybersecurity reported on July 12 that healthcare industry groups are simultaneously calling for more federal cybersecurity funding, citing worries that frontier AI models could “decimate cyber defenses.” The Commerce Department has also recently lifted export controls on Anthropic’s Mythos and Fable, reigniting debate over how quickly powerful models should be released and who gets to decide they are safe enough.
The numbers tell the story. The Verizon DBIR released earlier this year found that AI-assisted vulnerability exploitation has jumped over 20%, with only 26% of security flaws being fully patched. Shadow AI, the use of unapproved AI tools inside organisations, now accounts for 45% of non-malicious data breach activities. Attackers are ahead of defenders, and part of the reason is that defenders cannot legally collaborate on fixes the way attackers collaborate on exploits.
Schiff’s amendment is narrow. It requires companies to disclose their coordination plans to relevant agencies first, which keeps the government informed. It does not give AI companies a blank check to collude on pricing or market share. It simply removes the legal barrier that currently prevents security-first coordination.
What This Means
If your organisation uses AI models in any capacity, this amendment matters. Right now, your vendor may know about a vulnerability in a competitor’s system but cannot warn you. If this passes, coordinated vulnerability disclosure becomes legally safer, which should mean faster patches and better security across the board.
That said, legislation moves slowly. Do not wait for Congress to fix the AI security gap. Audit which AI tools your team is actually using. Shadow AI is now responsible for nearly half of all data breach-related activity. That is the real vulnerability in most organisations right now, and no Senate amendment will fix poor internal governance.
The antitrust laws were not written for AI vulnerabilities. Hackers do not care about market share. They care about finding the cracks before the defenders can patch them.
