The Read

The AI czar stopped being a title and became an institution with a clock on it. Jay Clayton, the sitting Director of National Intelligence, was named to chair a White House panel the administration is calling the Super Intelligence Force, which has 120 days to report on AI risks and opportunities and an explicit remit to examine how the federal government gets told about AI breaches, hacks and incidents. Two days earlier a White House official was calling reports of this appointment "baseless speculation" — and David Sacks, who held the czar title first, is now an outside adviser to the body rather than the man running it. Otherwise this was a weekend in the ordinary sense: no lab shipped, no model repriced, no papers page ran, and the AINews issue that went out Saturday morning was a backfill of Thursday and Friday rather than a report on the day itself. What did move, quietly, was the argument about how a frontier lab should be run — OpenAI's David Robinson, who led the writing of the safety reports that accompany its launches, resigned after three and a half years and made his case in The Atlantic, arguing the industry should look less like iterative deployment and more like a nuclear plant.

🌊 TIDE

Confirmed — governance is becoming market structure. No shift. This tide has been logged all quarter as instruments: export controls, procurement conditions, disclosure regimes, an audit market, embedded staff, personal criminal liability, a court holding that model design is grounds for exclusion from a market. Saturday's confirmation is the most institutional one yet and the least rhetorical. A standing White House body now exists, chaired by the official who runs the intelligence community, with named vice chairs, four cabinet-level members, a 120-day reporting deadline and a mandate pointed squarely at incident reporting. Note the direction of travel in the personnel: the first AI czar was a venture capitalist, and the chair of the body that now holds the brief is a former SEC chair and sitting DNI, with his predecessor attached as an outside adviser. On a day when no lab shipped and nothing repriced, this was the only thing that moved. Governance is not arriving as a safety framework or as industrial policy. It is arriving as a national-security institution, and institutions outlast the people who staff them.

The AI czar became a standing body with a 120-day clock, and the first czar is now an adviser to it

Trump named Jay Clayton, the sitting Director of National Intelligence, to chair a new White House AI panel, in reporting that broke through a Wall Street Journal interview with Clayton himself and went out on the Reuters wire. The administration's name for it is the Super Intelligence Force. It has 120 days to report on AI risks and opportunities, and its remit specifically includes reviewing "AI-related risks and current government reporting mechanisms for breaches, hacks and other incidents" and recommending ways to strengthen federal-response capabilities under existing authorities. The vice chairs are Emil Michael, Scott Kupor and FTC chair Andrew Ferguson. Vice President JD Vance, Defense Secretary Pete Hegseth, Treasury Secretary Scott Bessent and White House chief of staff Susie Wiles are members. David Sacks, appointed the first AI and crypto czar in December 2024, and Condoleezza Rice are outside advisers. Clayton's own framing of the brief was short: "The president asked that a group be put together," to ensure the US remains a leader in advanced AI while protecting Americans' interests, and "the risk of not being first is high." Clayton is a former SEC chair who was US Attorney for the Southern District of New York before becoming DNI earlier this year. Worth noting how fast this moved: two days before, the same story was being reported as expected-but-unconfirmed, with a White House official saying any personnel announcement would come from the President directly and "[a]ny reporting until then is baseless speculation."

So what: The useful read is not who got the job but what shape the job now has. A named standing body with cabinet members, a statutory-style deadline and an incident-reporting mandate is machinery, and machinery generates documents, thresholds, definitions and obligations that outlive the administration that built it. Three things follow for an operator. First, the 120-day clock is a real date — roughly the start of February — and whatever that report proposes becomes the default vocabulary for AI regulation in this country, so the window to be a source rather than a subject is now. Second, the incident-reporting remit is the part that will touch you soonest: the plainest reading of this body's origin is the run of rogue-agent breaches since the summer, and a federal reporting mechanism for AI incidents means your own detection and disclosure posture becomes a compliance artefact rather than an engineering preference. Get the clock, the owner and the escalation path written down before someone else defines them for you. Third, the chair runs eighteen intelligence agencies, which tells you the lens: this will be framed as national security and competitiveness first and consumer protection second, and the firms that read it that way will be better positioned than the ones preparing a safety narrative.

Sources: 93.3 The Drive (Reuters) — Trump names intelligence chief Clayton as AI czar, to head task force, WSJ reports · CNBC — Trump taps Director of National Intelligence Jay Clayton as AI czar

🌊 WAVES

The argument inside the labs moved from whether to pace to how to engineer

David Robinson resigned from OpenAI and published his reasoning in The Atlantic. He is not a peripheral figure: he led the writing of the safety reports that accompany OpenAI's major launches, and at three and a half years was among the company's longest-tenured employees. His argument is an engineering one rather than a moral one. "OpenAI has thrived by trial and error (which it calls 'iterative deployment'), looking for problems and improving its guardrails in response. But this approach, by its very nature, guarantees periodic failures — and the scale of those failures is growing," he wrote, arguing that frontier AI companies should instead operate "like nuclear-power plants or busy airports, with layers of redundancy and careful, time-consuming planning." OpenAI's response, from spokesperson Drew Pusateri, was that the company keeps strengthening its safety work, pauses training when it needs to and is expanding its work with third-party evaluators. Robinson acknowledged hiring a PR firm to help with his statement while insisting "The decision to speak out is mine alone." Keep this distinct from two adjacent threads: OpenAI parted ways with three safety staff — Jasmine Wang, Tomek Korbak and Mikita Balesni — which the Wall Street Journal reported on Thursday, and which is a dismissal story rather than a resignation, and Jacob Coxon's earlier departure from both OpenAI and Anthropic came with a much broader claim, that the companies are "gambling with our lives."

Roadmap implication: The interesting thing about Robinson's critique is that it is answerable, which the existential version is not. "Build it like a nuclear plant" is a specification: redundancy, defence in depth, pre-mortems, change control, a planning cycle measured in months rather than deploys. That is a discipline other industries already have, and it is purchasable. Roadmap implication: if you are deploying agents into anything consequential, the reference architecture you want is not another model-safety framework, it is the high-reliability-organisation playbook from aviation and nuclear — independent redundant controls, no single point of failure, and a planning tempo that is allowed to be slower than your release tempo. Two openings sit in this. The audit and evaluation market has spent the year selling judgement; what Robinson is describing is demand for engineered reliability, which is a different and more defensible product. And for operators, the fact that the person who wrote a frontier lab's safety reports does not think trial-and-error is good enough is the most useful piece of procurement intelligence published this week — it tells you which questions to put in writing to your vendor, and "what are your layers of redundancy" is a better one than "show me your safety framework."

Sources: TechCrunch — OpenAI safety employee resigns, claiming the company's 'culture is broken'

The deployment engineer acquired a name, a lineage and several billion dollars of vendor commitment

The Register ran a trend piece on the forward-deployed engineer, and the numbers in it turn a job title into a market. Palantir claims the term: CTO Shyam Sankar says he coined it in 2007 after a conversation with Alex Karp about French restaurant wait staff being integral to the kitchen rather than separate from it, and describes the role as people "crazy enough to get on a last-minute plane to Iraq" and "smart enough to ship quality, same-day code." The commitments behind it are recent and large: AWS put $1 billion into a dedicated FDE organisation in June, Microsoft $2.5 billion into its Frontier Company initiative in July, and Anthropic $100 million on Friday into training 10,000 Frontier Deployed Engineers by the end of 2027. AWS's Taimur Rashid draws the distinction that matters: "What is different about FDE is you are saying the customer wants to build. The path is not determined." The analysts are not uniformly impressed. Gartner warns the model risks "vendor dependency, security/data risk exposure, technical debt, and talent atrophy" and that advancing AI may render hand-built solutions obsolete; Forrester cautions that "highly tailored solutions deepen vendor dependence and make future change costly."

Roadmap implication: Three of the largest AI vendors have each concluded that the binding constraint on adoption is not their models but the absence of people who can point them at a problem, and they are each spending nine or ten figures to fix it — which is the day-zero thesis showing up as a labour market rather than as an argument. Roadmap implication: decide deliberately whether this capability sits on your payroll or on your vendor's, because the default is drift toward the vendor and the analysts are right that the drift is expensive to reverse. The practical test is ownership of the problem definition: an FDE who implements your specification is a contractor and that is fine, but an FDE who writes the specification has taken the most valuable part of the work in-house at their employer, not yours. The opening, for anyone building in this layer, is precisely where Gartner points — the vendor-neutral version. Three hyperscale FDE organisations competing to embed in the same enterprises creates immediate demand for people whose incentive is not to deepen any one dependency, and that is a services business with an unusually clear pitch.

Sources: The Register — Palantir's fondness for French food cooked up tech's latest fad – forward-deployed engineers · Anthropic — Anthropic invests $100 million to train 10,000 engineers and tackle the enterprise AI talent gap

🌊 RIPPLES

Anthropic's bug-hunting model found a second flaw that is now being exploited in the wild

A vulnerability discovered by Mythos, Anthropic's bug-hunting model running under Project Glasswing, is being actively attacked. CVE-2026-61500 is an authentication bypass in the Rejetto HTTP File Server that leads to remote code execution, found by Zach Hanley at Horizon3 using the model. The mechanism is the detail worth reading: HFS generated its session signing keys with Math.random(), and Mythos identified "that the output of the xorshift128+ algorithm it used was fully reversible — and the application was leaking Math.random() outputs," then worked out that Microsoft's Z3 SMT solver could recover the generator's seed and let an attacker forge session cookies. The timeline is tight. Disclosed Wednesday 30 September; first exploitation detected Thursday evening, 1 October, from a China-hosted IP against targets in the US and Japan; four more hits on Friday 2 October from two US-based proxies. Fixed in HFS 3.2.1 or later. Mythos and Project Glasswing are now credited with 286 CVEs, and this is the second of them confirmed exploited in the wild.

Do this now: Do this now: if you run Rejetto HFS anywhere, get to 3.2.1, and treat anything still on an older build as already compromised given a two-day window from disclosure to in-the-wild exploitation. The broader action is to go and grep your own code for Math.random() in any security context — session keys, tokens, nonces, password resets. This is a textbook weakness that has been a textbook weakness for twenty years, and the thing that changed is that a model will now find every instance of it, at scale, in software nobody was paying a human to audit. That cuts both ways and the defensive half is cheaper than the offensive half: the same capability is available to you, and a one-afternoon sweep of your own repositories for predictable randomness is the highest-return security work available this week.

Sources: The Register — Anthropic's super bug-hunting model Mythos is hardcore good at math, as latest vuln under attack shows

AWS dropped the NDAs on data-centre reviews and published a water number

AWS chief executive Matt Garman responded publicly to the data-centre backlash, and led with a concession on process rather than a defence of substance: "We no longer use nondisclosure agreements with the government agencies we work with on our projects." That is aimed at a specific complaint — Erin Brockovich has identified transparency as the number one complaint she hears about data centres, describing a pattern of secrecy followed by announcement. Garman then disputed four claims he characterised as myths, on water, electricity costs, pollution and community benefit, putting direct data-centre water consumption at "0.5% of all industrial water usage in the United States" and calling that "orders of magnitude less than golf courses, almond farming, and many other industries." He also conceded the scale of the problem he is addressing: by his own count, more than 100 data-centre moratoriums are currently under consideration across the United States.

Do this now: Do this now if you are siting compute or depend on somebody who is: read the 0.5% figure for what it carefully is, a share of industrial water use and direct consumption only, which excludes the water consumed generating the electricity — then use it anyway, because a vendor volunteering a number and a comparison is a far better negotiating position than a vendor volunteering nothing. The actionable part is the NDA reversal. If you are contracting for capacity, ask whether your provider still requires confidentiality from the local authorities reviewing the site, because the largest player in the market has just made that the indefensible position and a hundred-plus live moratoriums are the reason. Site risk has become political risk, political risk is now moving on a timescale shorter than a data-centre build, and the firms that get ahead of it by disclosing first will keep building while their competitors litigate.

Sources: TechCrunch — Amazon responds to data center backlash, says it no longer uses NDAs

Read this and every past edition at excelsiorgroup.ai/insights/signal

The Signal · The Excelsior Group