30
Expanding AI access and cyber defense for federal, state, local, and tribal governments
OpenAI and GSA agreed to provide ChatGPT to federal, state, local, and tribal governments with $0 licenses, 50% off usage, and cyber-defense access.
OpenAI for Government and the U.S. General Services Administration announced a 27-month agreement (October 1, 2026 through December 31, 2028) waiving the $15 per-user monthly license fee and cutting usage costs 50% for federal, state, local, and tribal agencies. More than one million government employees already have ChatGPT access, with eligibility extending across a roughly 23 million-person U.S. public-sector workforce. Every verified government entity is approved for Daybreak Blue cyber-defender access at 50% off, with Daybreak Red available for vulnerability research, exploit validation, and red teaming at standard pricing. The deal builds on the $1 billion Daybreak for Frontline Defenders commitment announced the prior week.
70
Why "Shady AI" is Security's Next Big Governance Problem
Opinion piece argues approved-but-ungoverned AI agent use ('shady AI') is a growing enterprise risk, citing a Meta Sev 1 data-exposure incident.
In March 2026, an approved AI agent at Meta posted a forum answer publicly, exposing sensitive company and user data to unauthorized employees for over two hours and triggering a Sev 1 incident. The author contrasts shadow AI (unapproved tools) with 'shady AI' (approved tools used in unapproved or unanticipated ways), arguing the latter is harder to govern because it operates inside the organization's visibility. A July 2026 SANS survey found 76% of security teams now have a role in governing enterprise AI. The piece recommends governance-by-default environments with built-in permissions, access controls, and monitoring rather than policy and training alone.
35
30
30
30
30
30
30
30
Deloitte strengthens AI governance to support trusted enterprise adoption
Deloitte expanded AI Controls and Assurance services to close governance gaps, noting only 21% of firms have mature agentic AI governance.
Deloitte announced expanded AI Controls and Assurance services spanning AI governance frameworks, risk assessments, model validations, AI-enabled internal audit, ecosystem integration with hyperscalers, and regulatory readiness including SOC reporting. The launch cites Deloitte's State of AI in the Enterprise finding that 74% of companies plan to deploy agentic AI within two years while only 21% report mature governance for autonomous agents. The offerings align with Deloitte's Trustworthy AI framework and target the AI lifecycle from exploration to enterprise-scale deployment.
18
Who's governing your AI? A trust framework for enterprise agents and models
DigiCert pitches AI Trust framework using PKI, DNS policy records and workload identity to govern shadow AI agents across enterprises.
The Register-sponsored piece outlines DigiCert's AI Trust framework for governing AI agents, built on PKI, DNS, and attestation, citing IBM's 2026 Cost of a Data Breach report that 68% of organizations lack AI governance or shadow AI detection. The approach treats agent identity as workload identity aligned with IETF WIMSE, NIST CSF 2.0, and SPIFFE/SPIRE, using short-lived credentials instead of static API keys. DigiCert also proposes DMARC-style DNS agent policy records and an AI Agent Passport cryptographically binding agent identity to approved operations, with a unified kill switch.
20
30
30
30
30
30
30
50
30
30
30
30
30
30
30
30
30
Who gets to define the rules for AI?
Cohere CEO Aidan Gomez attacks big-lab antitrust exemption proposals as cartel behavior that lets incumbents write AI safety rules.
Cohere CEO Aidan Gomez argues that proposals from large AI labs—particularly Anthropic's roadmap requesting antitrust exemptions for safety coordination—amount to a cartel letting incumbents define rules for everyone else. He draws parallels to the 1975 SEC NRSRO credit-rating designations and the EU's 1985 Motor Vehicle Block Exemption, where safety justifications produced incumbent-protecting market structures. Gomez supports independent review of highly capable AI systems but disputes who writes the standards, who conducts review, and who participates. He also warns AI cyber offense is getting cheaper faster than defenses are improving.
25
Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance
Anthropic's new Compliance API endpoints expose Claude Code local session transcripts, highlighting governance gaps for endpoint AI agents.
Anthropic added local session transcript endpoints to its Compliance API on August 11, 2026, giving security teams visibility into prompts, bash commands, file operations, and MCP commands run by Claude Code harnesses on endpoints. The article argues local harnesses break the classic shared-responsibility model, citing Token Security data that 68.6% of discovered AI agents run on endpoints, and a Cloud Security Alliance survey of 418 IT and security professionals in which 82% found an unknown agent within the past year. It outlines three governance layers: Anthropic managed settings as a policy baseline, the Compliance API for cloud-visible transcripts, and endpoint telemetry to connect agent activity to identity, credentials, and permissions.
45
50
30
30
30
30
30
30
30
30
30