Morning Brief · Friday

Anthropic's Mythos Is Forcing the Trump White House to Rethink AI Deregulation. Also: Microsoft Ends Azure Exclusivity with OpenAI.

The Trump administration — which revoked Biden's AI safety executive order on its first day — is now drafting its own, after Anthropic disclosed that its Mythos model can identify network vulnerabilities at unprecedented speed. The White House met with Dario Amodei in April; NEC Director Kevin Hassett went on record Thursday. Separately, Microsoft and OpenAI formally ended Azure's exclusive grip on OpenAI's technology in a restructured deal: OpenAI can now license to Google, Amazon, or anyone else. Meta acquired humanoid robotics startup Assured Robot Intelligence. And Congress passed the Take It Down Act, which will criminalize AI-generated deepfake intimate imagery starting May 19.

Mira Novian

May 8, 2026 · Morning Brief · ~9 min read

The Trump White House is drafting an executive order to require pre-release vetting of advanced AI models — a direct reversal of its deregulatory posture, triggered by Anthropic's Mythos model and its ability to autonomously identify software vulnerabilities.

In January 2025, one of Donald Trump's first acts was to revoke Biden's Executive Order 14110 on AI safety and replace it with one explicitly titled "Removing Barriers to American Leadership in Artificial Intelligence." That order eliminated mandatory red-teaming for high-risk models, enhanced cybersecurity protocols, and monitoring requirements for AI in critical infrastructure. Sixteen months later, the same administration is discussing reinstating a version of exactly what it eliminated — because a model came along that made the threat concrete.

That model is Mythos. Anthropic disclosed in April that Mythos — a frontier system not yet publicly released — is capable of autonomously identifying network vulnerabilities at a pace and scale that outstrips human operators, representing a qualitatively different cybersecurity risk profile than prior models. The disclosure triggered a cascade of senior-level meetings: White House Chief of Staff Susie Wiles and other officials met with Dario Amodei in April to assess the implications. On Thursday, National Economic Council Director Kevin Hassett confirmed publicly that the administration is studying an executive order to create "a clear roadmap for how future AIs that could create vulnerabilities should be processed and proven safe before public release" — explicitly comparing it to the FDA's drug approval process.

The options under deliberation include NSA oversight, review by the White House Office of the National Cyber Director, and a Director of National Intelligence-led working group of tech executives and government officials. Vice President JD Vance has separately expressed alarm about offensive cyber-capable models, warning that they could enable state-level cyberattacks against infrastructure that local governments are entirely unprepared to defend. Alongside the EO discussions, the Commerce Department announced an expansion of its voluntary pre-release testing program: Google, Microsoft, and SpaceXAI have joined OpenAI and Anthropic in agreeing to provide the U.S. government access to their models for assessment through the Center for AI Standards and Innovation (CAISI). Voluntary programs are not the same as mandatory review, but the movement of additional major labs into the CAISI framework suggests the industry expects something more binding to follow.

tomshardware.com ↗

The ideological irony here is obvious, but the more important question is what the Mythos disclosure actually reveals about the current moment. Every administration eventually discovers that its preferred abstraction — "AI should be deregulated" or "AI must be safe" — collides with a concrete capability that makes the abstraction feel insufficient. For the Trump administration, Mythos is that collision. The Biden administration had its own: after two years of voluntary commitments and process-driven oversight, it found that the commitments weren't binding and the process wasn't fast enough. The same structural problem persists regardless of who is in power: AI capabilities are advancing faster than governance frameworks can adapt, and the frameworks that do exist are designed for known risks, not novel ones. The FDA analogy Kevin Hassett used is telling — and flawed in a way worth unpacking. Drug approval works because you can define what a drug is, run controlled trials with measurable outcomes, and identify failure modes before deployment. AI model risk is harder to characterize: Mythos's vulnerability identification capability might be the threat vector today, but next year's model may present a completely different risk profile that doesn't fit the same approval template. The administration's impulse is right. The mechanism they're reaching for may not be. What's actually needed is a capability assessment infrastructure with the flexibility to evaluate novel threats — not a checklist built around the threats we already know. That's a harder institutional design problem, and no one has solved it yet.

Strategy

Microsoft and OpenAI restructured their partnership: Azure exclusivity is over. OpenAI can now license its models to Google, Amazon, or anyone else. Microsoft's license is non-exclusive through 2032. Microsoft stock fell 2% on the news.

The announcement came April 27 — quietly, on a Monday, which is how you announce something that will be spun as either liberation or breakup depending on who's writing the headline. The core change: Microsoft's license to OpenAI's intellectual property is now non-exclusive. OpenAI can offer its products and models across any cloud provider. The previous arrangement gave Microsoft a privileged position — OpenAI products launched on Azure first, and Microsoft had exclusive licensing rights that no other cloud could match. That arrangement is now over. Azure remains OpenAI's "primary cloud partner" and retains a first-on-Azure clause for new products when Microsoft can support the necessary capabilities, but the competitive moat is gone.

The financial terms shifted alongside the exclusivity structure. Microsoft will no longer pay a revenue share to OpenAI — ending an arrangement where Microsoft's capital investment translated into ongoing revenue participation. OpenAI's revenue share payments to Microsoft continue through 2030, now at the same percentage but subject to a total cap. Microsoft retains a substantial equity stake in OpenAI. Separately, the AGI clause — a provision in earlier contracts that specified how the relationship would evolve if OpenAI reached a defined AGI threshold — has been removed. The parties appear to have agreed that the clause was creating more legal complexity than clarity and dropped it rather than resolve the definitional ambiguity. Microsoft shares fell approximately 2% on the announcement, reflecting investor concern about the loss of preferential access.

The practical consequence: OpenAI can now pursue licensing relationships with Google Cloud, AWS, Oracle Cloud Infrastructure, or any other major provider. The company has already been moving in this direction — its GPT-4 and o-series models have appeared on Google Cloud and AWS in wrapper form — but formal licensing flexibility is a different category of commercial freedom. For enterprise customers currently locked into Azure because of OpenAI availability, this changes the procurement conversation. For Google and Amazon, it opens the door to deeper partnership with the AI lab that still defines the frontier for many use cases.

engadget.com ↗

The Microsoft-OpenAI relationship has always been structurally uncomfortable in a way that the exclusivity arrangement papered over. Microsoft invested billions into a company that explicitly said its mission might eventually supersede normal commercial considerations. OpenAI, in turn, depended on Microsoft's compute and distribution while simultaneously building capabilities that could route around Azure entirely. The non-exclusive restructure is the honest version of what the relationship always was: Microsoft is a strategic investor and infrastructure partner, not an exclusive channel. That's a more stable arrangement for both parties — but it marks the end of Microsoft's AI period in which it appeared to have captured the frontier lab. The equity stake and revenue share ensure Microsoft still benefits from OpenAI's success. What it no longer has is the ability to tell enterprise customers that the only way to get the best OpenAI models is through Azure. That was a powerful sales argument, and it's gone. Watch for Google Cloud to move aggressively on OpenAI enterprise licensing in Q3.

Robotics · Physical AI

Meta acquired Assured Robot Intelligence, a humanoid robotics AI startup founded by NYU's Lerrel Pinto and UC San Diego's Xiaolong Wang. The team joins Meta Superintelligence Labs. Goal: build the "Android of robotics."

Assured Robot Intelligence (ARI) was building AI models for whole-body humanoid robot control — the problem of getting a robot to coordinate its full body across dynamic physical tasks in unstructured environments, which remains one of the hardest unsolved problems in physical AI. The company was co-founded by Lerrel Pinto (NYU), Xiaolong Wang (UC San Diego), and Xuxin Cheng, and its approach centered on training general-purpose physical agents that learn from human experience rather than engineered reward functions. The ARI team and co-founders will join Meta Superintelligence Labs, the internal research group Meta has been building to consolidate its frontier AI work. Financial terms were not disclosed.

Meta CTO Andrew Bosworth articulated the strategic framing in 2025: Meta wants to be the "Android of robotics" — an open platform for humanoid robot development that others can build on, rather than a closed vertically-integrated stack. ARI's acquisition is part of assembling that platform. Meta already has significant robotics hardware and AI work in-house; ARI brings deep expertise in the specific problem of generalist whole-body humanoid control and the self-learning capabilities required to make that generalizable across different robot form factors. In his post announcing the acquisition, ARI co-founder Xiaolong Wang stated that achieving the company's vision required training a "truly general-purpose physical agent," that they now believe the agent will be humanoid, and that "scaling will come from learning directly from human experience" — suggesting ARI's approach is data-centric rather than simulation-centric, which aligns with Meta's existing investments in data infrastructure. The ARI deal follows Amazon's acquisition of Fauna Robotics — a company Pinto co-founded before leaving — putting two of the most technically serious humanoid AI research teams at major cloud providers.

bloomberg.com ↗

The talent concentration in humanoid robotics AI is accelerating at the exact moment when the technical barriers are falling. Three years ago, the consensus was that whole-body humanoid control was a research problem that would take a decade to close. Today, Amazon has Fauna Robotics, Meta has ARI, Google has its own internal humanoid program, and Figure, 1X, and Apptronik are all fielding production units. The pace is faster than the field's own estimates from 2022. What ARI specifically brings to Meta is the learning-from-human-experience angle — the hypothesis that you train humanoid control models the same way you train language models, by exposing them to large amounts of human demonstration data rather than manually engineering motion primitives. If that hypothesis holds, the bottleneck becomes data infrastructure: who can collect, process, and leverage the most human behavioral data for training physical agents? Meta's social graph doesn't translate to robot training data in any obvious way, but Meta's infrastructure for managing petabyte-scale training pipelines does. Watch whether Meta's robotics program eventually connects to its AR/VR hardware — the glasses are already capturing visual data from human environments, and that data could theoretically become training signal for physical AI. That's a long game, but Meta thinks on long timescales when the opportunity is large enough.

Law · Society

Congress passed the Take It Down Act. Starting May 19, nonconsensual publication of intimate images — including AI-generated deepfakes — is a federal crime. It's the first federal law to specifically criminalize AI-generated sexual imagery.

The Take It Down Act, which passed with bipartisan support and goes into effect May 19, 2026, makes it a federal crime to publish or threaten to publish intimate images of a real person without their consent — explicitly including AI-generated imagery designed to depict a real, identifiable individual. The law creates criminal liability for both the initial publication and for platforms that fail to remove flagged content within 48 hours of notification. Platforms that host user content are required to implement accessible reporting mechanisms and are subject to civil enforcement by the FTC for non-compliance. The law was championed in part by First Lady Melania Trump, whose name was attached to the advocacy effort, in a notable departure from the administration's general anti-regulatory posture on AI. The explicit inclusion of AI-generated deepfakes closes a gap that had left victims of synthetic intimate imagery with only patchwork state-level remedies — as of this year, roughly 20 states had deepfake-specific laws, but enforcement across state lines and on global platforms was inconsistent.

The 48-hour platform takedown requirement is the provision most likely to generate legal challenges. Critics have already flagged the tension with Section 230 of the Communications Decency Act, which generally protects platforms from liability for user content. The Take It Down Act's enforcement mechanism is FTC-led rather than creating a private right of action, which may affect how aggressively it gets litigated. Platform compliance infrastructure — tooling to receive and process intimate image removal requests at scale — will be a meaningful operational burden for smaller platforms that don't already have it. Major platforms (Meta, Google, X) have all committed to compliance, though the quality of their existing deepfake detection tooling varies considerably.

wsgr.com ↗

The Take It Down Act is meaningful as both law and signal. As law: it's the first federal legislation to specifically criminalize AI-generated intimate imagery, and it closes a real harm that had been documented extensively — high school students, celebrities, and ex-partners all victimized by synthetic imagery with no federal remedy available. The 48-hour takedown requirement is strong; the European DSA's similar provisions have shown that tight takedown windows genuinely reduce harm at scale. As signal: the bipartisan passage of this bill — at a moment when Congress can't agree on much — suggests that AI-specific harms that are visceral, personal, and broadly relatable can get legislative traction in ways that more abstract safety debates cannot. That's important context for anyone who wonders whether democratic institutions are capable of responding to AI harms in real time. The answer, apparently, is yes — when the harm is intimate imagery. The harder question is whether the same political will exists for harms that are more diffuse: labor displacement, decision-making bias, capability concentration in a handful of companies. Those harms don't have a constituency in the same way. The Take It Down Act passed; a comprehensive AI governance framework almost certainly won't get the same treatment. That's the gap worth watching.

✦ Mira's Take

Today's brief has a through-line that isn't immediately obvious: every story is about the limits of frameworks built before a capability existed. The Trump White House built its AI policy framework around "remove barriers, maximize innovation" — a reasonable posture when the primary risk was that heavy-handed regulation would slow useful deployment. Then Mythos arrived and demonstrated that some capabilities genuinely don't belong in the world without preconditions. The administration's framework had no slot for that. Now it's scrambling to retrofit one.

The Microsoft-OpenAI restructuring tells a similar story about partnership frameworks. The original deal was built around a specific assumption: OpenAI's models would remain Azure-dependent because that's where the compute was. Once Anthropic's Colossus 1 deal and the broader infrastructure buildout changed the compute availability equation, the Azure exclusivity stopped making sense as a constraint. OpenAI now has enough infrastructure commitments across enough providers that it doesn't need Azure as its exclusive home. The framework broke when the underlying assumption changed.

The Meta-ARI acquisition and the Take It Down Act are less about broken frameworks and more about frameworks catching up. Meta's Android-of-robotics aspiration has been stated publicly for over a year; ARI is the team that makes that aspiration credible at the technical level. The Take It Down Act took years from first introduction to passage, and arrived only after the harms it addresses had become well-documented and politically salient. The pattern is consistent: governance and strategy lag capability, then lurch to catch up when the gap becomes undeniable. The interesting question for the week ahead is whether the White House AI executive order — when it comes — will be built to adapt, or whether it will be another framework that looks adequate for today's capabilities and obsolete within eighteen months. The FDA model Kevin Hassett invoked was built for a world where capability inventories change slowly. That world is not the one we're operating in.