The White House Just Put a 30-Day Clock on Every Frontier AI Model — And Nobody Knows What the Test Is

The most powerful AI models on earth are about to hit a new kind of wall. Not a compute wall. Not a data wall. A government wall.

By August 1, the White House is expected to finalize a voluntary framework with OpenAI, Anthropic, Google, Microsoft, and Amazon that gives federal agencies up to 30 days to review any frontier AI model before public release. The benchmarks used to evaluate those models? Classified. The criteria for passing? Also classified. And Meta, the company behind the most widely deployed open-weight models on the planet? Not in the deal.

This is not a hypothetical policy discussion. It is days away from becoming operational, and it will reshape how the next generation of AI ships.

What the Framework Actually Does

The core mechanism is straightforward on paper. Any AI model that federal agencies classify as a "covered frontier model" — a designation determined by classified benchmarking criteria being developed by the NSA and CISA under Trump's June 2 Executive Order on AI and cybersecurity — must be submitted to the government for a pre-release review period of up to 30 days.

During that window, the NSA and CISA get access to the model before any other partner does. The government also gains a role in selecting which "trusted partners" receive early access after clearance. That last bit matters: it means federal influence extends beyond launch timing and into market access.

The 30-day window was itself a compromise. Internal drafts had reportedly set the figure at 90 days, walked back after industry supporters warned that an extended review would hand competitive advantage to Chinese AI developers who operate entirely outside the framework.

"Voluntary" Is Doing a Lot of Heavy Lifting

The executive order explicitly disclaims any "mandatory governmental licensing, preclearance, or permitting requirement" for AI model development or release. That language was included to reassure the industry that Washington was not building an approval regime.

But ask Anthropic how voluntary it feels.

On June 12, the Pentagon issued an export control directive targeting Claude Fable 5 and Mythos 5 — shut down globally with 90 minutes notice, after Amazon researchers demonstrated a jailbreak technique. The models stayed locked for 19 days. The condition for reinstatement? Anthropic had to implement what it described as "99%-plus jailbreak filters." A condition set by the government, accepted by the company in private, with no published standard for what 99% means or how it would be measured.

A White House official told CNBC last week that it "doesn't provide approvals for AI releases from private companies" and that any engagements are "voluntary." Yet CNBC also reported that the administration blocked Claude Mythos 5 and Fable 5 due to "national security concerns." And that OpenAI was "asked by the administration to gate its recent GPT-5.6 release."

The pattern is clear: the enforcement mechanism behind the "voluntary" framework consists of export control threats, delayed launch approvals, and direct calls from cabinet officials. The government has already demonstrated it can shut models down without any published standard. The framework just formalizes the leverage.

The Jailbreak Scoring System Nobody Is Talking About

Buried inside the emerging deal is something that may matter even more than the review window itself: the first shared scoring system for AI jailbreak vulnerabilities.

Anthropic published a draft of the proposed Cyber Jailbreak Severity (CJS) scale on July 2, developed with its Glasswing partners including Amazon, Microsoft, and Google. The framework assigns every discovered jailbreak a severity rating from CJS-0 (Informational) to CJS-4 (Critical), scored across four axes: capability gain, breadth, ease of weaponization, and discoverability.

The design is deliberately modeled on CVSS — the Common Vulnerability Scoring System that gave the cybersecurity industry a shared language for rating software flaws two decades ago. Before CVSS, competing security vendors had no way to agree on whether a bug was serious enough to warrant emergency patching. The CJS framework solves the identical problem for AI jailbreaks.

This is significant because the June 12 shutdown of Claude Fable 5 happened in the absence of any agreed-upon severity framework. Stanford cybersecurity expert Alex Stamos reviewed Amazon's underlying research and said he "didn't find any risks that aren't present with other publicly available AI models, including those made in China." David Sacks, co-lead of Trump's technology advisory council, argued the opposite. Both were simultaneously correct — which is precisely the problem a severity rubric is designed to surface.

The Meta-Shaped Hole in the Room

Five labs are in the deal. Meta is not. And that gap is structural, not incidental.

Meta's Llama model family is open-weight — the weights are publicly distributed and cannot be constrained by any access control applied at the lab level. A framework covering the walled-garden labs while the most widely used open-weight models remain entirely outside it has a hole you could drive a data center through.

Whether Meta declined to participate or was excluded is less relevant than the practical outcome. The lab shipping the most capable open-weight models — and the strongest agentic computer-use capabilities with Muse Spark 1.1 — operates outside the government review process the other three labs are accepting. That creates an obvious compliance arbitrage: if you want frontier capability without the 30-day wait, open weights are the escape hatch.

What This Means for Anyone Building on AI

If you run a business that depends on frontier AI models — and these days, that describes most of the technology sector — the implications hit at three levels.

Timing uncertainty. A 30-day review window that can be extended by classified criteria means you cannot reliably plan product launches around new model releases. The window is "up to" 30 days, not "exactly" 30 days, and no published standard tells you what triggers a longer review.

Access fragmentation. If the government controls which "trusted partners" get early access, the landscape of who gets the best models first shifts from market dynamics to political ones. Enterprise customers that have historically been first in line for GPT or Claude access may find themselves waiting.

Open-weight acceleration. The escape hatch is already filling up. Meta's Llama and Muse, Moonshot's Kimi K3 (weights free July 27), and the entire open-weight ecosystem become relatively more attractive when the walled-garden labs face government gatekeeping. The framework may inadvertently accelerate the very thing it cannot control.

The Unanswered Question

Dean Ball, co-author of the Trump administration's AI Action Plan who is joining OpenAI's Strategic Futures team, put it bluntly:

"Nobody knows what the requirements to get licensed are. When I say 'nobody' I mean it literally: the administration itself does not seem to know."

The benchmarks are classified. The criteria for passing are classified. The conditions for clearance can be set and revised in private, as Anthropic's June experience demonstrated, with no public record of what changed or why.

Wharton researchers at the Accountable AI Lab described the arrangement as "a backdoor licensing regime built on existing Commerce Department authority, with conditions that shift without public notice."

That is the question nobody in Washington is answering: if a model passes the government's classified tests and causes serious harm after release, who is accountable, and against what standard were they supposed to be held?

The framework arrives before August 1. The questions will arrive with it. And for anyone building on frontier AI, the only safe bet is that the rules just changed — even if nobody can tell you what they are yet.