The White House announced Tuesday the launch of a new coordination group, dubbed GOLD EAGLE, bringing together AI developers, software companies, and operators of critical infrastructure to share information about cybersecurity vulnerabilities identified by advanced AI systems and coordinate how those weaknesses get patched. Reuters confirmed the launch directly from a White House statement, and the effort fulfills an executive order President Trump signed in June, following a 30-day deadline to stand up the program.

The concern driving this is specific and grounded in real capability rather than speculation. Companies including Anthropic and OpenAI have released AI systems capable of identifying software and infrastructure vulnerabilities at scale, and U.S. officials worry that bad actors could use those same systems to find and exploit weaknesses in the software underpinning financial institutions, hospitals, and energy networks before defenders can patch them. GOLD EAGLE is built to close that timing gap by giving AI companies and critical infrastructure operators a shared channel to report and act on vulnerabilities together, rather than each discovering and responding to the same weaknesses independently and out of sync.

What GOLD EAGLE Does

According to the White House’s own release, GOLD EAGLE has already begun intaking and prioritizing identified cybersecurity vulnerabilities across industries, coordinating scanning verifications, and working toward a rapid, prioritized response process for critical infrastructure sectors. The structure is explicitly collaborative rather than regulatory: software companies, AI developers, and infrastructure providers use the group to communicate about vulnerabilities they’ve found in their own systems and develop coordinated responses, rather than being required to submit to government inspection or pre-approval before deploying anything.

The Executive Order Behind It

GOLD EAGLE traces back to Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security,” which Trump signed June 2 and gave 30 days to become operational. The order directs the Treasury Department, the National Cyber Director, the Department of War, and the National Security Agency to jointly establish the coordination effort, with Treasury Secretary Scott Bessent taking the lead public role alongside DHS Secretary Markwayne Mullin, National Cyber Director Sean Cairncross, and Secretary of War Pete Hegseth.

Two design choices in the order are worth noting for what they signal about the administration’s broader approach. First, the order explicitly prohibits mandatory licensing or pre clearance requirements for AI model development, a deliberate departure from the previous administration’s posture. The 2023 Biden era AI executive order included reporting requirements for developers of the most powerful AI systems; the Trump administration revoked that order entirely rather than amending it, and GOLD EAGLE’s voluntary partnership design reflects the same underlying instinct against pre clearance regimes for AI more broadly. Second, placing Treasury in the lead role is unusual: cybersecurity coordination has traditionally sat with the Department of Homeland Security and the intelligence community, and Bessent’s prominent public role in Tuesday’s announcement suggests the administration sees financial-sector risk as a central organizing concern for this specific initiative, alongside the broader critical infrastructure mandate.

AI Discovered Vulnerabilities Are a Double Edged Sword

The premise behind GOLD EAGLE reflects a tension that’s become increasingly visible across the AI industry this year: models capable of finding software vulnerabilities are valuable for defense precisely because they’re just as capable of being used for offense. That’s the same dynamic that shaped OpenAI’s own recent GPT-5.6 rollout, where the company’s Sol model faced extended government review specifically because of its cybersecurity capabilities, with OpenAI itself acknowledging that benchmark testing can’t fully account for how a model behaves once combined with other tools in the field. GOLD EAGLE doesn’t resolve that underlying tension, no coordination framework can, but it does attempt to shrink the window during which a vulnerability sits undisclosed and unpatched, by giving the companies capable of finding these weaknesses at scale a direct channel to the operators who need to fix them.

Notable Details in the Structure

The voluntary nature of the arrangement is likely to shape how effective it actually is. Nothing in the executive order compels an AI company or infrastructure operator to participate, and there’s no penalty structure described for companies that decline to join or that discover vulnerabilities and don’t report them through the new channel. National Cyber Director Sean Cairncross framed the effort as reinforcing American AI leadership rather than constraining it, describing the administration’s approach as pairing “commonsense, pro growth policies” with the new coordination structure. Hegseth, in a more martial framing, described the effort as bringing “a wartime footing to the cyber domain,” language that positions vulnerability patching as an active defense posture rather than a compliance exercise.

The Bottom Line

GOLD EAGLE’s real test won’t be visible in this week’s announcement, it will show up in whether AI companies and infrastructure operators actually use the channel consistently once the initial launch coverage fades, and whether a voluntary structure with no reporting mandate and no penalties for non-participation produces meaningfully faster vulnerability patching than the status quo did. The administration’s bet is that AI companies already have strong commercial incentives to disclose vulnerabilities responsibly, and that formalizing a shared channel removes friction rather than needing to force participation through regulation. Whether that bet holds will become clearer the next time an AI-discovered vulnerability in genuinely critical infrastructure surfaces publicly, and observers can check whether GOLD EAGLE’s coordination process caught it early or whether the disclosure happened the old way, after the fact.