US launches AI cyber defence clearinghouse to match machine-speed attacks

The White House on Tuesday launched Gold Eagle, an AI-backed clearinghouse designed to pool and rank software vulnerability reports from government and industry. The initiative brings together the Treasury, Homeland Security’s CISA, and the newly renamed Department of War alongside unnamed open-source groups and critical-infrastructure firms. The administration said the system will “receive and patch” flaws “at a speed and scale never seen before.”

The project stems from a 2 June executive order requiring advanced AI developers to grant the government early access to their systems. Security researchers note that AI now accelerates every stage of a cyberattack, converting a fresh vulnerability disclosure into a working exploit within hours. OpenAI last week labelled GPT-5.6 its strongest cyber model yet, underscoring the pace of the threat.

For European businesses and critical infrastructure operators, Washington’s pivot to automated defence creates a new transatlantic dynamic. European firms operate within the same global software supply chains that Gold Eagle aims to secure. As the US pushes to patch flaws at a speed and scale previously unseen, European networks face a shifting risk landscape if defences on the continent do not evolve at a similar pace.

The financial implications are significant. Treasury Secretary Scott Bessent framed the effort around protecting the financial system, promising to “harness frontier AI capabilities to stay ahead of our adversaries.” European banks and investors with deep ties to US financial infrastructure will ultimately depend on the efficacy of this American-led AI defence layer, even without a seat at the table.

Anthropic is widely expected to be among the participating AI firms. The company recently agreed to provide federal officials with advance access to its threat-intelligence reports and join the clearinghouse created by the June order, though it did not comment on the launch. This close integration of frontier AI firms into US defence structures could concentrate cyber threat intelligence primarily within Washington.

However, the initiative’s structural limitations may blunt its impact. The White House did not name the agency responsible for daily operations, nor did it explain how it will protect sensitive vulnerability data. Crucially, Gold Eagle lacks the authority to compel any company to actually apply a fix, functioning largely as a coordination mechanism rather than an enforcement tool.

Gold Eagle joins an already crowded field that includes CISA’s existing disclosure programme, the CVE system, and NIST’s National Vulnerability Database. Separately, the NSA and CISA face a 1 August deadline to create a classified benchmark for frontier models’ cyber capabilities. Whether a voluntary clearinghouse without enforcement powers can close the gap with machine-speed attackers remains an open question for both Washington and its European allies.