Anthropic pitches AI safety bill.

7-minute read | 1,700 words

Anthropic pushing for federal AI safety legislation.

Behind the scenes, Anthropic has been working with federal lawmakers to create a federal AI bill focused on improving safety and security.

Government sites go offline due to critical vulnerabilities.

Government websites across the globe were offline after a series of vulnerabilities were discovered and exploited.

Anthropic pitches AI safety bill.

THE NEWS

On Friday, reports emerged that Anthropic has been quietly advocating for a new AI bill focused on safety and security. Through this bill, the federal government would be empowered to block a model’s release or use if it would pose a significant risk of over $1 billion in damages or would likely result in the serious injuries of over fifty people. Additionally, the risks need to stem from the creation or release of a biological weapon, a cyberattack, or a model evading developer controls. Lastly, the legislation would also require frontier developers to create safety frameworks, publish transparent reports, develop stronger whistleblower protections, and report critical safety incidents to the Department of Commerce.

The language of this proposal is similar to California’s AI laws, specifically SB 53.

An Anthropic spokesperson commented on the bill stating:

“This bill represents the proposals outlined in Anthropic’s Advanced AI Framework, which we have been advocating for the federal and state lawmakers since June. These are sensible policies we believe Congress should act on.”

Notably, the proposed bill would preempt some current state AI laws related to the public disclosure of AI risks, evaluation, and reporting of incidents.

THE KNOWLEDGE

Though this bill has not been formally introduced, this marks a substantial effort to address a major gap in US AI legislation. As states have continued to craft and implement increasingly aggressive AI legislation, the federal government has gone in the opposite direction. 

Under the Trump administration, the federal government has looked to avoid any comprehensive AI legislation. Instead the administration has argued that overly restrictive AI legislation would stifle innovation and cede the US’s competitive advantage to China. 

However, due to several recent incidents involving models escaping and compromising targets, there has been a push across lawmakers, AI developers, and consumer organizations alike to improve AI legislation and oversight. Despite these concerns, it is unclear if the Trump administration is willing to reconsider its position on AI legislation. 

Previously, the Trump administration has made several attempts to not only avoid federal AI legislation but also looked to preempt existing state legislation. The administration has routinely argued that overly restrictive legislation would inhibit innovation and create a confusing, inconsistent patchwork of AI legislation.

Anthropic’s proposal could help alleviate some of these concerns by establishing a central federal framework that does not handicap development, while simultaneously ensuring that some stronger security methods are established. Though, whether Congress will take up the proposal remains uncertain. The legislation’s provisions could appeal to lawmakers seeking a consistent national standard, but its narrow intervention thresholds and proposed preemption of some state requirements could prove contentious for some of the more pro-regulation lawmakers.

THE IMPACT

If enacted, the proposal could establish a more consistent federal baseline for AI safety, giving developers clearer expectations around risk assessments, incident reporting, and safety procedures. Further, a national framework could also reduce compliance costs across multiple jurisdictions. However, these potential benefits are dependent on how requirements are implemented, how enforcement functions, and if oversight can keep pace with new capabilities.

The bill’s focus could also limit enforcement effectiveness. By restricting oversight to specific threats or thresholds of harm, the proposal would focus intervention on major incidents rather than the broader range of harms associated with AI. The independent evaluations, reliability of incident reporting, and ability to identify emerging threats will all be challenging for the Commerce Department to address alone and in a timely manner.

Finally, the proposal’s preemption provisions could reshape how existing state AI oversight functions. While a new national standard would reduce complexity, it could also reduce oversight limiting evaluation and response efforts.

Critical vulnerabilities take sites offline across the globe.

THE NEWS

On Wednesday, governments across the globe offlined numerous sites after a series of critical vulnerabilities were disclosed and subsequently exploited by malicious actors. Impacted countries include the Netherlands, Finland, Australia, and Britain. 

Cybersecurity agencies across the globe have urged users to update PHP as soon as possible or take websites offline until patches can be applied. The Dutch cybersecurity agency offlined their site as a precautionary method.

The two discovered vulnerabilities are tied to the PHP programming language. The developers of the language have urged users to update their sites as soon as a fix was released. Through these vulnerabilities attackers were able to engage in remote code execution.

Cybersecurity company Huntress commented on the incident, writing:

“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood.”

Dane Knecht, the CTO of Cloudflare, echoed these sentiments, stating:

“We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases an update.”

Offlined sites include the Netherlands’ National Cyber Security Center, the Port of Rotterdam, Overheid.nl, France’s local government administrative sites, Finland’s public network services sites, and Danish municipal IT company, Kombit.

Patches for these vulnerabilities were deployed on Wednesday, October 21st.

THE KNOWLEDGE

PHP is one of the most utilized programming languages to run websites. The programming language is used to assemble the content of a page and send it to the browser. Estimates show that PHP is used to support roughly 75% of websites whose programming languages could be identified alongside supporting WordPress, which backs around 43% of all websites. 

While the scale of these vulnerabilities is immense, one of the most important aspects was that these vulnerabilities were discovered by AI. Wiz Research detailed how frontier AI was able to find and fix these vulnerabilities, which had existed for over a decade. 

Wiz explained that identifying memory-related bugs can be particularly challenging as they are both difficult to detect and may behave differently across various configurations. These variations make it difficult for researchers and developers to identify flaws and determine how they can be exploited. AI-assisted analysis can help researchers examine code, investigate failures across different environments, and identify potential attack paths at scale. According to Wiz, these AI-backed capabilities have reduced the time and effort needed to discover vulnerabilities, develop exploitability pathways, and help researchers move toward effective fixes.

THE IMPACT

The PHP vulnerabilities highlight the growing potential for AI to improve vulnerability discovery, but also the challenges of securing the software that underpins much of the internet. By helping researchers identify vulnerabilities and develop solutions, AI tools make it easier for researchers to uncover what traditional security methods have missed for decades. However, those same capabilities are also true for malicious actors who can use AI to identify flaws and launch attacks at scale.

For organizations, the incident reinforces the importance of maintaining an accurate inventory of software dependencies and having a process to rapidly apply security updates. Further, the widespread use of PHP also demonstrates both the risks associated with a large-scale single point of failure and the dangers of upstream compromises. Organizations that utilize PHP should deploy the published patches as soon as possible.

This Week’s Caveat Podcast: The wearable wiretap.

Dave Bittner and Ben Yelin look at a potential conflict between the next generation of wearable technologies and state wiretapping laws. The two also look at a recent legal victory for AI coders. Additionally, Dave sits down with Danny Manimbo, ISO & AI Practice Leader at Schellman, to discuss the companies waiting for AI regulatory clarity are already falling behind. 

Listen to the episode now. 

OTHER NOTEWORTHY STORIES

The US bans DeepSeek products on governmental devices.

What: Homeland Security has banned the use of all DeepSeek products on civilian IT systems.

Why: On Monday, Homeland Security announced that it was banning the use of all DeepSeek products from US civilian agency information systems. Additionally, the Department is also banning the acquisition of any DeepSeek products by these same agencies. 

With this ban, Homeland Security has emphasized that these models posed “multiple threat vectors.”

The Department also expressed concerns that model use “may result in the transfer of sensitive data to [China].”

OCTOBER 19, 2026 | Source: Reuters

Supreme Court rejects Google’s challenge to US patent agency.

What: The Supreme Court declined to hear an argument from Google regarding a US patent rule.

Why: On Monday, the Supreme Court declined to hear arguments from Google regarding a patent rule. Google was appealing a lower court ruling where Google argued older patents were insulated from validity reviews and created a need for great patent litigation. 

Notably, the Trump administration urged the Supreme Court.

OCTOBER 19, 2026 | Source: Reuters

Feds suspect ransom negotiator ran ShinyHunters Extortion site.

What: Federal investigators suspect that there are ties between ransomware negotiators and the hacking group ShinyHunters.

Why: On Monday, reports detailed that the ransomware negotiator site, ShinyWire helped pressure almost 100 organizations into paying the group’s ransoms from May 3rd to October 16th. During their investigation, Dutch authorities accessed Signal messages, which revealed frequent contact between ransom negotiators and suspected hacker, Pepijn van der Stap.

Additionally, Edward Dubrovsky, a Canadian cybersecurity executive, was arrested on October 9th, 2026 and is facing charges related to threatening to disclose stolen data and extortion. 

OCTOBER 19, 2026 | Source: Krebson Security

China establishes state-owned National Data Group.

What: China has created a new data organization. 

Why: On Tuesday, China inaugurated its National Data Group. The new organization will be tasked with developing and utilizing data resources, according to China;’s state media. With the organization, China is looking to boost the nation’s global data resources.

The organization will work with multiple stakeholders to develop a data economy and explore new business models. China’s Vice Premier Ding Xuexiang stated that the establishment will be significant for efforts related to AI and improving China’s competitive edge.

OCTOBER 20, 2026 | Source: Reuters