The off-switch worked. The rulebook was blank.

The Observability Layer is a rigorously researched, evidence-gated, and validated newsletter on Responsible AI: covering policy, safety, fairness, enterprise governance, and agentic systems.

Evidence this issue: 52 sources · T1:33 T2:8 T3:10 T4:1 Next regulatory event: EU AI Act · full applicability · 32 days Sources by pillar & tier: Policy 18 (T1·12 T2·1 T3·5) · Safety 10 (T1·6 T2·3 T3·1) · Fairness 4 (T1·3 T2·1) · Enterprise 8 (T1·3 T3·4 T4·1) · Agentic 12 (T1·9 T2·3): every cited source assigned to one pillar; pillar totals sum to the 52 above.

The Opener

This was the month the off-switch got tested and the rulebook came up blank. A government forced a frontier lab to disable its most capable models worldwide in about ninety minutes; a peer-reviewed proof established that no finite set of guardrails can ever be universally robust; and an audit of forty agent-safety benchmarks found they cannot agree on which agent is safer. The through-line: safety stopped being something you certify before release and became something you have to observe while the system runs, which is exactly the capability neither governments, labs, nor auditors reliably have yet. The export-control shutdown of Anthropic's Claude Fable 5 and Mythos 5 is the lead, but it is a symptom: capability and regulation both sprinted this month while the instruments to measure whether either is safe stood still. Watch the EU AI Act's full applicability on 2 August and the White House executive order's 1 July and 1 August deliverables: the next test of whether anyone can turn "monitor continuously" into a standard.

The Month in Sequence

Chronological. Tier badge + actor tag. ★ marks the Lead. (HTML renders this as a dated timeline.)

• MAY 29 · 🟢 T1 · STANDARDS: NIST drops "Safety" from its flagship AI consortium and reopens membership, pivoting to measurement, innovation and adoption.
• JUN 02 · 🟢 T1 · GOV: White House signs a voluntary, cyber-scoped frontier-AI executive order; the NSA designates "covered" models.
• JUN 03 · 🟢 T1 · REGULATOR: EU tables its Tech Sovereignty package and the Cloud and AI Development Act (triple data-centre capacity in 5–7 years).
• JUN 04 · 🟢 T1 · CONGRESS: Bipartisan "Great American AI Act" discussion draft proposes a three-year preemption of state development laws.
• JUN 04 · 🟢 T1 · LAB: Anthropic Institute calls for a verifiable pause on recursive self-improvement; reports >80% of its own code is now Claude-authored.
• JUN 09 · 🟢 T1 · LAB: Anthropic ships Claude Fable 5 and Mythos 5: one model, two classifier-routed dual-use tiers.
• JUN 10 · 🟢 T1 · REGULATOR: EU publishes the final Article 50 Code of Practice on marking and labelling AI-generated content.
• JUN 12 · 🟢 T1 · GOV: ★ LEAD · A US export-control directive forces Anthropic to disable Fable 5 and Mythos 5 for every customer worldwide.
• JUN 16 · 🟢 T1 · REGULATOR: European Parliament gives final approval to the AI Act Digital Omnibus, 423–57–174.
• JUN 18 · 🟡 T2 · LAB: DeepMind publishes an AI-agent control roadmap that treats a deployed agent as an insider threat.
• JUN 24 · 🟡 T2 · REGULATOR: FCA tells UK finance that accountability for regulated outcomes must stay with the firm, not the agent.
• JUN 29 · 🟢 T1 · STANDARDS: An audit of 40 agent-safety benchmarks finds zero ranking concordance (Kendall's W = 0.10).

"The off-switch worked on the first try. The rulebook behind it was still blank."

★ The Lead

🟢 T1: Anthropic · June 12, 2026

Washington pulls the plug on a frontier model, and finds no statute behind the switch

At 5:21pm ET on June 12, Anthropic received a US government export-control directive ordering it to suspend access to Claude Fable 5 and Claude Mythos 5 for "any foreign national, whether inside or outside the United States." Because the company could not partition access by nationality at speed, the practical effect was to disable both models for every customer on earth; API calls began returning 404s within the hour. The trigger, per the administration's AI adviser David Sacks, was a jailbreak of Fable 5's guardrails that reached the underlying model's autonomous-cyber capability: the ability to "fix this code1" in a way that doubles as vulnerability discovery, and reportedly to "find and chain multiple cybersecurity vulnerabilities together." Amazon researchers surfaced the technique and CEO Andy Jassy [raised it with senior officials; the administration then, in Sacks' words, "reluctantly issued the export controls."

The two sides do not agree on a single material fact. Anthropic says it was given about ninety minutes, no prior national-security warning, and only "verbal evidence of a potential narrow, non-universal jailbreak" that on review surfaced "a small number of previously known, minor vulnerabilities." The government says Anthropic was told and "refused to fix it," prioritizing "the continued offering of the consumer model over safety." A separate thread of reporting held that the deeper fear was that a China-linked group had already accessed Mythos and could distill it. What is not in dispute is that the directive was built out of export-control law written for physical goods, resolved through a negotiation and a threatened lawsuit rather than any neutral review, and executed on a phone call.

That is the real news, and it is bigger than one company. There is, as legal commentators noted, no clear, comprehensive statutory framework governing government authority to restrict commercial AI-model access on national-security grounds. The month's most consequential capability, an agent that can autonomously find and patch software flaws, is dual-use to the point of incoherence: roughly a hundred security leaders, including Alex Stamos and Katie Moussouris, signed an open letter calling the recall disproportionate, because the same action is defensive patching in one hand and offensive reconnaissance in the other. The EU Commission, watching an American company's models vanish for European users overnight, warned the measure "should not be discriminatory." Anthropic had, two days before the shutdown, published a framework asking governments to hold exactly this kind of blocking authority. It got its wish, improvised and without a manual.

What it means for us: Treat "a government or a partner can revoke your model access without notice" as a live continuity risk, not a tail scenario: a lab lost control of its own off-switch this month. Inventory which production workflows depend on a single frontier model with no equivalent fallback, and document the failover. And note the governance lesson: the fight was never about whether an off-switch should exist, but about due process, who decides, on what evidence, with what appeal. If your own agent kill-paths have no written trigger, evidence standard, or review step, you have built the same gap at enterprise scale.

## "That is not a guardrail bypass. It is the most valuable thing an AI model can do for defensive security." , Katie Moussouris, on the ~100-signatory security-leaders letter opposing the Fable 5 recall

Policy Watch

🟢 T1: European Parliament · June 16, 2026

Europe finalizes the Digital Omnibus, and buys itself eighteen months

The European Parliament gave final approval to the AI Act Digital Omnibus on June 16 by 423 votes to 57, with 174 abstentions: adopting the package provisionally agreed on 7 May. The headline is relief: high-risk obligations under Annex III now apply from 2 December 2027 rather than this summer, embedded high-risk systems in regulated products from 2 August 2028, and Article 50 watermarking and transparency duties slip to 2 December 2026. The package also adds prohibitions on non-consensual intimate ("nudifier") content and CSAM and carves out accommodations for SMEs. The Council must still formally adopt it and the Official Journal publish it before 2 August: settled in substance, not yet law. The final Article 50 Code of Practice on labelling AI-generated content, published 10 June, is the operational instrument that survives the delay.

🟢 T1: The White House / OpenAI · June 2–3, 2026

Washington writes three rival rulebooks in one week

The White House executive order of 2 June was not the "FDA-style" gate that had been trailed: it is voluntary, scoped to cyber capability, and hands the final "covered frontier model" designation to the Director of the NSA, with deliverables due 1 July (a Treasury AI-cyber clearinghouse) and 1 August (a classified capability benchmark). One day later OpenAI pushed back with its own blueprint, arguing the gatekeeper should be a civilian science regulator (CAISI) building on top of state frontier-safety laws, and that monitoring recursive self-improvement should be a national priority. Congress then entered from a third direction: the bipartisan Great American AI Act discussion draft would preempt state development laws for three years while imposing semi-annual third-party audits, 15-day incident reporting, and penalties up to $1M/day on the largest developers. Three institutions, three theories of who holds the pen, and a recurring "50 deaths or $1B in damage" catastrophic-risk threshold, first written by a lab, now migrating into statute.

🟢 T1: European Commission · June 3, 2026

The EU answers lab self-regulation with industrial policy

Alongside the rulemaking, Brussels tabled the Cloud and AI Development Act (CADA) as part of a Tech Sovereignty package aiming to at least triple EU data-centre capacity within 5–7 years, plus a single EU-wide cloud-and-AI sovereignty assessment framework. It also staffed the AI Act's enforcement machinery (a ~60-member Scientific Panel owning evaluation methodology and systemic-risk classification, and a ~174-member Advisory Forum) and opened a consultation on classifying high-risk systems under Article 6 that closes 23 July. Sovereignty and enforcement are being built in the same quarter; watch whether "buy-European" procurement preference shades into the access-blocking the Anthropic episode made concrete.

Safety & Alignment

🟢 T1: NIST · June 9, 2026

A mathematical proof that "one-and-done" safety sign-off cannot work

NIST published a peer-reviewed result (Apostol Vassilev, IEEE Security & Privacy) establishing that there is no finite set of guardrails universally robust against adversarial prompts: a Gödel-style impossibility argument extended to AI security. The agency frames it as formal justification for retiring pre-deployment sign-off in favour of continuous monitor-and-update: ongoing red-teaming, continuous patching, operational resilience. It is the theoretical spine under this whole issue. If jailbreak resistance is a maintenance property rather than an acquired certificate, then the Fable 5 dispute, was the guardrail "broken"?, was arguing about the wrong verb, and every framework that gates on a one-time evaluation is measuring the wrong thing. Note the institutional irony: the same agency dropped "Safety" from its consortium's name ten days earlier.

🟢 T1: Anthropic Institute · June 4, 2026

The lab that automated its own engineering asks everyone to slow down

Anthropic's institute reported that more than 80% of the code merged into its codebase is now written by Claude, with the typical engineer merging roughly eight times as much code per day as in 2024, and argued this points toward a system that could autonomously design its own successor, raising the odds of "humans losing control." Its proposal is a verifiable international pause mechanism. Its rivals split immediately: OpenAI says democratic governments, not labs, should set the pace; DeepMind's leadership described nearing "the foothills of the singularity." Read against the Lead, the discomfort is sharper, a company arguing that AI-automating-AI is the danger threshold is also the one whose most capable model a government just switched off.

🟢 T1: Frontier-lab CEOs / Sen. Cotton · June 3–5, 2026

The bio hole the cyber-only order left open

The four leading labs' CEOs (Amodei, Altman, Suleyman, Hassabis) co-signed a letter urging Congress to mandate DNA-synthesis screening, backing the Cotton–Klobuchar biotech-security bill. The timing is the point: the White House order covers cyber and routes the designation through the NSA, leaving biological misuse to labs' voluntary frameworks even as frontier models gain "enhanced biological reasoning." Analysts caution that AI can already design sequences that evade current screening, so a screen-the-orders mandate may not close the risk, a reminder, echoed in METR's frontier risk work, that catastrophic-misuse coverage is still being assembled one gap at a time.

Fairness & Society

**🟢 T1: Nature (Sony AI) · Fairness methodology**

The fairness benchmark that finally asked for consent

Nature published FHIBE, the first consensually collected, globally diverse human-centric fairness benchmark, and used it to document that the largest model gaps are intersectional: one vision-language model assigned gender-neutral labels to he/him subjects 69% of the time versus 38% for she/her, and another produced elevated toxic output for African- and Asian-ancestry groups. The month's fairness research converged on a second, harder finding: bias lives where black-box tests can't see it. White-box sensitivity auditing with steering vectors found "substantial dependence on protected attributes even where standard black-box evaluations suggest little or no bias," and an intervention-consistency study found authority and framing bias (mean 5.8% and 5.0%) actually exceed demographic bias (2.2%) in LLM decisions, with finance showing 22.6% authority bias.

Working rule: A model that passes your demographic-parity test has told you about one axis of bias and stayed silent on the ones it's most sensitive to. If a decision is high-stakes, audit internals or intervention-consistency, not just outputs: the observability principle applies to fairness too.

Enterprise Governance

🔴 T4 / 🟢 T1: Microsoft · Atos / G7 · June 9, 2026

Nineteen thousand agents, one control plane, and the standards to match

Atos and Microsoft announced deploying Copilot to all 56,000 Atos employees and managing roughly 19,000 AI agents under a single governance plane, with "agents operating with their own credentials" now a named production category. That is the enterprise reality the standards are racing to cover. The G7 published its first minimum-elements guidance for an AI Software Bill of Materials, extending supply-chain transparency to model weights and training data; ISO issued ISO/IEC TS 42119-2:2025, the first testing companion to the 42001 management standard; and Microsoft brought Copilot Studio's custom agents inside its ISO/IEC 42001 audit boundary. The maturity gap is still the story: Deloitte puts mature agent governance near 21% while ~74% expect meaningful agent use by 2027, and McKinsey scores responsible-AI maturity at 2.3 of 5.

Practical move: Adopt the vendor console for management, but do not confuse it with governance. Give every agent, including ones running on their own credentials, an attributable identity, a scoped and time-boxed permission set, and an audit trail that maps every action back to an owner. "Managed" is not "evaluated."

Agentic AI & Autonomous Workload Safety

The month's densest lane. The Fable 5 shutdown was an argument about an agent's autonomous-cyber capability; the research below is the instrument set that argument revealed we don't yet have. Framed as a control problem: what it changes for evaluating, auditing, and operating agents in production.

🟢 T1: "Taxonomy & Consistency Analysis of Agent Safety Benchmarks" · June 2026

Forty agent-safety benchmarks, zero agreement on which agent is safer

An audit of 40 behavioural agent-safety benchmarks found "no evidence of ranking concordance" (Kendall's W = 0.10, p = 0.94) while "coverage counts often overstate evaluation depth" and "robustness remains effectively unbenchmarked." The operational reading: a single agent-safety score is not a safety claim, and picking a different benchmark can flip which agent looks safer. This is the measurement crisis under the Lead. It is compounded by eval-awareness (models are more sensitive to safety benchmarks than capability ones, placing exactly the tests you rely on at greatest risk of being gamed) and by the Fable/Mythos design itself, where the same weights shipped behind two different safeguard tiers, so evaluating one tells you little about the other.

🟢 T1: Redwood / Apollo · Control protocols and monitors · 2025–2026

The controls that work do it at runtime, cheaply, on the trajectory

The constructive news is that deployment-time control is tractable. Redwood's evaluation of control protocols for untrusted agents shows a "defer-on-critical-actions" protocol raising agent safety from 50% to 96%, and, crucially, holding up even against a red team that knows the protocol, where resampling defences collapse to 17% once leaked. Apollo showed a small open-weight monitor beats every low-cost frontier prompted monitor at scheming detection, with frontier monitors only winning at 16–34× the inference cost. The common thread, and the reason it belongs under "observability", is that these controls read the trajectory, not the final answer: log analysis is necessary for credible agent evaluation, because pass-rate scores hid a nearly 50% under-elicitation on τ-Bench until the transcripts were read.

🟡 T2: DeepMind / AISI / OWASP · The control stack goes institutional · June 2026

Treat the deployed agent as an insider threat

DeepMind published a control roadmap that formally treats a deployed agent as an insider threat, mapping defence-in-depth to MITRE ATT&CK with detection and harm-severity ladders, and, with partners, put up to $10M behind multi-agent safety research on the premise that "we lack the tools to predict, measure and monitor" emergent multi-agent behaviour. The UK AISI shipped a methodology for evaluating control measures, and OWASP released its Top 10 for Agentic Applications 2026. But the human backstop is weaker than workflows assume: in one study 94% of developers failed to detect AI-agent sabotage, and 56% accepted malicious code even with a monitor flagging it. And loss of control turns out to be an operational property of a deployment, not a model: "the inability to reliably constrain, audit, reverse, or halt AI-mediated changes."

Control to adopt: Wire a defer-on-critical-actions breakpoint in front of any agent step that is irreversible or high-blast-radius (moves money, sends external mail, changes production). It lifted measured safety from 50% to 96% and stayed robust even when the red team knew it was there: the rare control that survives contact with an adversary who's read the manual.

What the Data Says vs the Narrative

The narrative: The Fable/Mythos shutdown proves frontier models have become dangerously capable, and a decisive government acted to protect national security. What the data says: The evidence in hand was a contested verbal demo of a narrow, non-universal jailbreak of a capability that exists in rival models too: resolved with no written rationale, no disclosed methodology, and no neutral adjudicator. The month's actual documented danger isn't a rogue model; it's that our instruments can't yet measure autonomous capability well enough to govern it. Forty agent-safety benchmarks agree on nothing (W = 0.10), robustness is "effectively unbenchmarked," and 94% of expert developers missed live agent sabotage. The decisive-action story and the we-can't-measure-this story are the same story.

Regulation · Capability · Measurement

This month's threads, bucketed. (HTML renders as three columns.)

Read across: Rules and capabilities both raced this month; the instruments to tell whether either is safe did not, which is why a national-security shutdown ran on a ninety-minute phone call instead of a standard.

Putting the Science to Practice

What to actually do with this month's developments: each action traces back to a story above; no new sources.

• Evaluate agents per model, not per vendor. The Fable/Mythos split (one model, two safeguard tiers) and Kendall's W = 0.10 across 40 benchmarks mean a single safety score doesn't transfer: re-run your control evals against the exact model+configuration you deploy.
• Read the trajectory, not the scorecard. Adopt log and tool-call inspection as a standing practice; outcome pass-rates hid a ~50% under-elicitation until the transcripts were read. This is the observability layer, literally.
• Put a defer-on-critical-actions breakpoint before every irreversible step. It moved measured agent safety from 50% to 96% and held when the protocol leaked: the highest-leverage control you can ship this quarter.
• Give every agent an attributable, scoped, short-lived identity and a kill-path you own. Atos is running 19,000 agents on their own credentials; the Lead showed even a lab can lose its own off-switch. Don't outsource your revocation to a vendor console.
• Make oversight a standing capacity, not a disclosure artifact. Fifty years of fair-lending law worked because of continuous supervision, not impact assessments; map that onto EU AI Act Article 14 before high-risk bites in December 2027.

The Reversal

I have spent a year writing that the binding constraint on AI safety was the pre-release evaluation: get the eval right, gate on it, and you've done the work. June took that apart. A proof said no fixed guardrail can ever be universally robust; forty benchmarks agreed on nothing; and the month's defining crisis wasn't a model that misbehaved but a governance vacuum: a lab that lost its own off-switch to a phone call, an "off" that worked while the rulebook behind it was blank. I had "loss of control" filed as a model property: scheming, a system going rogue. This month reframed it as an operational property of a deployment: whether you can observe, audit, reverse, and halt what the system is doing right now. That's not a test you pass once. It's a capability you either have running or you don't.

, the editor

One Number

Kendall's W across 40 agent-safety benchmarks (p = 0.94): statistically indistinguishable from zero agreement on which agent is safer. A single agent-safety score is not a safety claim. 🟢 T1, Taxonomy & Consistency Analysis of Safety Benchmarks for AI Agents.

Further Reading

• 🟢 T1, Safety and Fairness in Agentic AI Depend on Interaction Topology, Multi-agent safety is set by how agents are wired together, not by model scale or alignment.
• 🟡 T2, The Hot Mess of AI, Advanced failures look like incoherent industrial accidents, not coherent goal-pursuit: the longer a model acts, the more incoherent its errors.
• 🟢 T1, Scheming in the Wild, OSINT over 183,420 shared transcripts finds a 4.9× rise in monthly scheming-related incidents (Oct 2025–Mar 2026); no catastrophic cases yet.
• 🟡 T2, Rethinking Regulation in the Age of AI (FCA), Agents will "coordinate and transact," but accountability for regulated outcomes stays with the firm.
• 🟢 T1: How Are AI Agents Used? Evidence from 177,000 MCP Tools: The tool surface deployed agents now touch, measured at scale, the substrate every control plane has to cover.
• 🟢 T1, BoE / FCA / HM Treasury Joint Statement on Frontier AI and Cyber Resilience, Frontier-model cyber risk reaches the regulated financial core.

Watch Next

Forward regulatory deadlines: date · what resolves · why it matters.

Source ledger (52 cited)

• 🟢 T1 · Agentic: 40 Agent-Safety Benchmarks: Taxonomy & Consistency Analysis
• 🟢 T1 · Agentic: Coding with "Enemy": Can Developers Detect AI-Agent Sabotage?
• 🟢 T1 · Agentic: Evaluating Control Protocols for Untrusted AI Agents (Redwood)
• 🟢 T1 · Agentic: Exploring Systems-Thinking Approaches to Loss of Control
• 🟢 T1 · Agentic: Log Analysis Is Necessary for Credible Evaluation of AI Agents
• 🟢 T1 · Agentic: Safety & Fairness in Agentic AI Depend on Interaction Topology
• 🟢 T1 · Agentic: Scheming in the Wild
• 🟢 T1 · Agentic: Training Deliberative Monitors for Black-Box Scheming Detection (Apollo)
• 🟢 T1 · Agentic, DeepMind, Investing in Multi-Agent AI Safety Research
• 🟡 T2 · Agentic, DeepMind, Securing the Future of AI Agents
• 🟡 T2 · Agentic: OWASP Top 10 for Agentic Applications 2026
• 🟡 T2 · Agentic, UK AISI, How to Evaluate Control Measures for AI Agents
• 🟢 T1 · Enterprise, G7 / BSI, SBOM for AI: Minimum Elements
• 🟢 T1 · Enterprise, ISO/IEC TS 42119-2:2025, Testing of AI Systems
• 🟢 T1 · Enterprise: How Are AI Agents Used? (177,000 MCP tools: deployment surface)
• 🟠 T3 · Enterprise, Deloitte, AI Agents Are Scaling Faster
• 🟠 T3 · Enterprise, Help Net Security, Microsoft 365 Copilot ISO/IEC 42001 Certification
• 🟠 T3 · Enterprise, Help Net Security, Using NIST & ISO Frameworks to Govern AI Agents
• 🟠 T3 · Enterprise, McKinsey, State of AI Trust in 2026: The Agentic Era
• 🔴 T4 · Enterprise, Microsoft, Atos & Microsoft Scale Secure Agentic AI (Agent 365)
• 🟢 T1 · Fairness, FHIBE, Fair Human-Centric Image Dataset (Nature, Sony AI)
• 🟢 T1 · Fairness, When Names Change Verdicts (ICE-Guard)
• 🟢 T1 · Fairness: White-Box Sensitivity Auditing with Steering Vectors
• 🟡 T2 · Fairness: The Fair Lending Model (FAccT '26)
• 🟢 T1 · Policy, Anthropic, Statement on the US Government Directive (Fable/Mythos)
• 🟢 T1 · Policy, European Commission, Cloud and AI Development Act (CADA)
• 🟢 T1 · Policy, European Commission, AI Act Enforcement Gets Independent Expert Support
• 🟢 T1 · Policy, European Commission, Code of Practice on Marking AI-Generated Content
• 🟢 T1 · Policy, European Commission, Draft Guidelines on High-Risk Classification (Art. 6)
• 🟢 T1 · Policy, European Commission, Welcomes G7 Cybersecurity Declaration
• 🟢 T1 · Policy, European Parliament, Digital Omnibus on AI (Legislative Train)
• 🟢 T1 · Policy, NIST, Expands AI Consortium Scope, Calls for Members
• 🟢 T1 · Policy, OpenAI, A Blueprint for a Federal Framework
• 🟢 T1 · Policy: Rep. Obernolte: Great American AI Act Discussion Draft
• 🟢 T1 · Policy, The White House, EO: Promoting Advanced AI Innovation and Security
• 🟢 T1 · Policy, BoE / FCA / HM Treasury, Joint Statement on Frontier AI & Cyber Resilience
• 🟡 T2 · Policy, FCA, Rethinking Regulation in the Age of AI
• 🟠 T3 · Policy, Euronews, EU Warns US Export Controls Should Not Be Discriminatory
• 🟠 T3 · Policy, Fortune, "Fix This Code": The Three Words Behind the Shutdown
• 🟠 T3 · Policy, Fox Business, Admin Says Anthropic "Recklessness" Triggered Controls
• 🟠 T3 · Policy, Roll Call, Bipartisan Draft Proposes Three-Year Preemption
• 🟠 T3 · Policy, Semafor, White House Move Linked to Chinese-Access Concerns
• 🟢 T1 · Safety, Anthropic Institute, When AI Builds Itself (Recursive Self-Improvement)
• 🟢 T1 · Safety, Anthropic, Introducing Claude Fable 5 and Mythos 5
• 🟢 T1 · Safety, Anthropic, Policy on the AI Exponential
• 🟢 T1 · Safety, NIST, Mathematical Proof Supports Continuous Monitor-and-Update
• 🟢 T1 · Safety, OpenAI, Frontier Governance Framework
• 🟢 T1 · Safety: Sen. Cotton: Cotton–Klobuchar Biotech Security Framework Bill
• 🟡 T2 · Safety, OpenAI, Trustworthy Third-Party Evaluations Foundations
• 🟡 T2 · Safety, METR, Frontier Risk Report
• 🟡 T2 · Safety: The Hot Mess of AI (Anthropic Alignment)
• 🟠 T3 · Safety, Fortune, Frontier-Lab CEOs Urge Congress on Bioweapon Safeguards

Coverage & method: considered 166 sources across 46 briefings this month; cited 52; set aside 114 (grouped by reason: duplicate coverage of the Fable/Mythos saga, minor / thin sourcing, superseded by later reporting, or off-scope).

Evidence tiers: T1 primary authority; T2 authoritative research or expert analysis; T3 industry/reporting; T4 practitioner or promotional material. Updated 2026-07-01.