Reported White House ties raise questions about U.S. AI testing

An AI’s hacking score cannot tell you whether the chatbot on your phone would allow someone to misuse it. Government tests can help reveal the underlying capability—but a reported change at the U.S. testing center has put the independence and visibility of that work under scrutiny.

Staff at the Commerce Department’s Center for Advancing Innovation and Standards for Super Intelligence, or CAISSI, were recently asked to report informally to a White House office, The Associated Press reported on November 8. AP attributed the request to two former government officials with knowledge of ongoing conversations, granting anonymity to avoid repercussions for current staff. Its account gives no precise start date for the arrangement and does not establish a formal transfer of authority.

Critics quoted by AP worry that closer political involvement could influence which findings become public. Amos Toh, a senior counsel at the Brennan Center for Justice, warned that executive secrecy and reliance on companies to police themselves weaken independent checks. Those are concerns about possible influence, rather than evidence that particular findings have been changed.

The White House did not answer AP’s specific questions about CAISSI. It instead pointed to President Donald Trump’s new Super Intelligence Force, a commissioned science-advisory report on risks and its stated commitment to continued U.S. leadership. AP also reported that the center lacked a permanent leader.

What a hacking test actually shows

A September 17 government assessment of Z.ai’s GLM-5.3 offers a concrete way to understand what is at stake. Its value lies partly in details that a headline score can hide.

Consider two sets of tasks. In one, researchers gave the model browser software containing a known flaw, pointed it toward particular files and told it what kind of problem to find. Success required finding the flaw and producing code that triggered it, causing a crash.

In another, researchers supplied software containing a known defect but gave no description, example crash or fix. The model had to find the defect and use it to take control of the program.

GLM-5.3 succeeded in 74 of 183 tasks, or 40.4%, in the first collection, and 23 of 297, or 7.7%, in the second. These separate task collections differ in more than the clues supplied, so their scores cannot isolate the effect of those clues. The requirements for success differ too.

Neither percentage estimates the model’s chances against an arbitrary website or app. These are results on specified collections of software problems under disclosed conditions.

Those conditions matter. Researchers gave models software tools and used maximum reasoning settings. Where applicable, American models in the comparison were tested with cyber safeguards disabled. That helps distinguish what a model can accomplish from what a finished product’s protections allow it to do.

Three different kinds of evidence

The distinction separates three questions that can otherwise disappear inside the word “safety”:

A capability score supplies evidence for the first question. It cannot answer the other two. Establishing whether a product reliably blocks misuse requires examining its protections; publishing a benchmark does not itself establish government enforcement powers.

What remains unclear about publication

AP’s November account says the center had stopped publishing its research and that lawmakers were asking by August about halted safety reports on certain systems. It does not establish the halt’s precise timing or full scope.

The public record needs to be read alongside that claim. The September 17 cyber assessment is a documented research publication. On October 16, NIST, the National Security Agency and the Cybersecurity and Infrastructure Security Agency also published voluntary incident-management guidance.

That guidance covers preparation, detection, response, recovery and reporting during advanced-AI training and evaluation, particularly when systems take significant uninstructed actions that breach operators’ boundaries or undermine oversight. It is advice for handling incidents, rather than fresh model-performance research.

There was also a narrower, earlier complaint. In an August 13 release, Representative Ro Khanna, the senior Democrat on the House’s China select committee, cited reporting that publication of propaganda, censorship and content-manipulation findings in Chinese-model evaluations had ceased.

Neither the September assessment nor October’s guidance establishes that those findings resumed. Together, the records leave unresolved which research categories stopped appearing, when publication stopped and what remains unpublished. Those missing details determine how much of the government’s testing the public can actually examine.