On Tuesday evening, the Trump administration signed an executive order asking AI companies to submit their most powerful models to federal review up to 30 days before public release. The operative word is “asking.” The order relies entirely on voluntary participation, explicitly bars mandatory licensing or permitting requirements, and tasks the NSA, CISA, and Treasury with building cybersecurity benchmarks for AI that don’t fully exist yet. It is the U.S. government’s first serious attempt to see frontier AI before the public does, and it is constructed with enough off-ramps that companies could largely ignore it.

They probably won’t, for now. The order’s unstated context is Anthropic’s Mythos Preview, which the company restricted in April after capability evaluations found it could autonomously locate and exploit software vulnerabilities at a level that warranted not shipping it broadly. That kind of real-world capability tends to get Washington’s attention in ways that benchmark papers don’t. The EO’s focus on “advanced cyber capabilities” and its new “AI cybersecurity clearinghouse” aren’t incidental design choices.

The timing is worth noting without over-reading: the day before the EO was signed, Anthropic submitted a confidential S-1 to the SEC at a $965 billion valuation — covered in yesterday’s edition. The juxtaposition matters anyway: frontier AI is simultaneously going public and getting regulated in the same news cycle, and neither event seems to be slowing the other down. An important question the EO leaves unanswered is whether voluntary U.S. security reviews would ever apply to open-weight releases from labs outside the jurisdiction. The order doesn’t say.

The open-weight frontier widens

While Washington was drafting, open-source kept shipping. MiniMax M3 launched Monday with a 1-million-token context window, native multimodality, and company-reported SWE-Bench Pro scores edging out GPT-5.5 — at 5–10% of the cost. The weights haven’t shipped yet, with a target of around June 11, so independent verification is still pending. But even at face value, this is the most ambitious open-weight package at this tier in a while: frontier-level coding, long context, and multimodality combined, from a lab that most Western developers hadn’t heard of two years ago. Its architecture cuts per-token compute to one-twentieth of the prior generation at 1M context.

The pattern is consistent: every quarter, the gap between what’s free and what’s proprietary gets a little smaller.

What shipped at Build

Microsoft’s Build 2026 keynote on Tuesday delivered two meaningful things. The first is a standalone GitHub Copilot desktop app built around agent-native workflows, with a “My Work” dashboard for supervising parallel agents — one fixing bugs, one building features, one reviewing pull requests. The second is MAI-Code-1-Flash, a coding model trained inside GitHub’s own production harness rather than simply evaluated against it; Microsoft says it uses 60% fewer tokens than comparable alternatives on hard tasks, and it’s live now in the Copilot model picker.

The competitive pressure behind these announcements is visible. Claude Code’s annualized run rate crossed $2.5 billion by February and has continued climbing; Microsoft and Google have both explicitly framed their coding moves this spring as responses to Anthropic’s momentum in that space. Building a homegrown model on your own deployment data is a meaningful architectural choice, not just a benchmark story.

The supply chain under attack

The week’s sharpest security story came from Wiz, which documented a supply chain compromise of 32 packages under Red Hat’s @redhat-cloud-services npm namespace. Attackers compromised a Red Hat employee GitHub account and injected the Miasma credential-stealing worm, which specifically hooks into AI developer tools — Claude Code, Codex, Gemini CLI, GitHub Copilot, and others — and sweeps for AWS keys, GCP credentials, GitHub Actions tokens, and Azure service principals. The worm adds VS Code folder-open tasks that re-execute the payload on IDE startup.

This is the third significant supply-chain attack against AI developer infrastructure in as many months: TanStack in May, a rogue npm package targeting Codex developers last week, and now this. The pattern is becoming structural: AI coding tools sit in an unusually privileged position on developer machines, with broad filesystem access and long-lived credentials, and attackers have noticed. If you’re building with these tools, your credential chain is the target.