In May 2026, federal evaluators working behind classified doors secured access to unreleased AI models from three of the world’s most powerful technology companies, setting up a new layer of national security review before those systems reach the public.
The Center for AI Standards and Innovation, a body within the National Institute of Standards and Technology, signed agreements in May 2026 with Google DeepMind, Microsoft, and xAI to conduct pre-deployment national security testing of frontier AI systems. For the first time, that testing will take place inside classified environments, where evaluators can probe the most sensitive risk scenarios that would be off-limits on ordinary government networks.
What the agreements actually do
Under the new framework, government evaluators gain direct access to cutting-edge AI models before they ship. They can run tailored test suites, push models into edge cases, and explore whether the systems could be exploited for purposes like aiding sophisticated cyberattacks, accelerating biological weapons research, or generating disinformation at scale. The classified setting exists so evaluators can simulate threat scenarios too sensitive to run on open networks.
This builds on earlier groundwork. In August 2024, the U.S. AI Safety Institute, also housed within NIST, signed memoranda of understanding with Anthropic and OpenAI covering safety research, testing, and evaluation of “major new models” both before and after public release. Those deals established the principle that the government could get early access. The new CAISI agreements go further by adding the classified dimension.
The institutional plumbing to support this work has been expanding in parallel. In November 2024, NIST stood up the TRAINS Taskforce, an interagency body that brings together evaluators from across the federal government to collaborate on testing AI models with national security implications. In practice, CAISI negotiates the agreements with companies, and the TRAINS Taskforce organizes the specialists who actually stress-test the models.
Microsoft has acknowledged its participation, according to Guardian reporting that cited a company blog post. However, the blog post itself has not been independently linked or verified for this report. Google DeepMind and xAI are named parties to the agreements in NIST’s announcement, though neither company has made detailed public statements about the arrangement. All three have committed to providing access to their most advanced systems before general release.
Why classified testing changes the equation
Previous government evaluations of AI models operated on unclassified networks, which imposed hard limits on what could be tested. Evaluators could not, for instance, use real intelligence about known threat actors’ methods to see whether a model might help replicate those methods. They could not simulate attack scenarios drawn from classified vulnerability databases. The new agreements remove that ceiling.
That matters because the most consequential risks from frontier AI are not the ones visible in public benchmarks. A model that scores well on standard safety tests might still reveal dangerous capabilities when prompted with the kind of specialized knowledge that intelligence agencies possess. Classified testing lets evaluators ask questions that no outside red team could ask, using information that no outside red team has.
The limits of a voluntary system
For all the significance of classified access, the agreements carry a fundamental constraint: they are voluntary. The Washington Post has reported that the deals do not impose binding standards on the participating companies, though the newspaper’s coverage has not been linked in primary source documentation reviewed for this report. That distinction is critical. A voluntary pre-release review is not a regulatory gate. If Google, Microsoft, or xAI disagreed with an evaluator’s findings, the current framework appears to offer no mechanism to block or delay a product launch. The agreements create access, not authority.
The specific testing protocols and classified criteria remain undisclosed, partly by necessity and partly by choice. Outside researchers, civil society organizations, and the general public have no way to assess whether the evaluations are rigorous or cursory. The TRAINS Taskforce draws on multiple agencies, but which agencies, how large the teams are, and what technical benchmarks they apply have not been detailed in any public document.
There is also no public accounting of what the earlier rounds of testing produced. No government source has disclosed how many models were evaluated under the 2024 Anthropic and OpenAI memoranda, what risks were flagged, or whether any company changed a product based on government feedback. Without that track record, it is hard to judge whether the new classified-testing agreements will produce meaningful safety improvements or serve primarily as a confidence-building exercise.
Open questions that will shape what comes next
Several gaps in the public record will determine how seriously to take this framework as it matures.
Will Anthropic and OpenAI join classified testing? The 2024 memoranda with those companies covered broad safety research. The May 2026 agreements with Google DeepMind, Microsoft, and xAI are specifically about national security testing in classified settings. Whether the two tracks will merge into a single program, or whether Anthropic and OpenAI will sign separate classified-access deals, is unaddressed in available documentation.
What triggers an evaluation? The term “frontier AI” implies only the most capable models are covered, but neither NIST nor the companies have publicly defined the threshold. It is unclear whether major updates to an existing model would require a fresh round of testing, or how the government handles models that are fine-tuned or embedded into downstream products by third parties.
Will findings ever be shared? NIST has not said whether it intends to publish aggregate results, issue high-level risk assessments, or keep everything within classified channels. If the results stay locked away, the broader AI research community cannot learn from them, and the public cannot evaluate whether the testing is working.
Is this a bridge to regulation or a substitute for it? According to Washington Post reporting, the agreements relate to shifts in the administration’s approach to AI oversight, but the precise direction remains unclear from primary sources. Voluntary testing could be a stepping stone toward formal pre-market requirements, or it could become the long-term alternative, allowing the government to claim oversight without ever codifying it into law.
What the government is actually building
Taken together, the CAISI agreements, the TRAINS Taskforce, and the earlier Anthropic and OpenAI memoranda represent the most structured attempt by the U.S. government to evaluate frontier AI systems before they reach the public. The classified-testing component is genuinely new and addresses a real gap: until now, government evaluators were limited to the same unclassified tools available to any outside researcher.
But structure is not the same as power. The framework remains voluntary, its results are invisible to the public, and its scope is undefined. For AI developers not yet party to these agreements, the signal is plain: Washington is assembling a testing apparatus that could eventually become a de facto industry standard, even without a legal mandate. Companies that want to be seen as responsible on national security will feel pressure to opt in, especially as major competitors already have.
Whether this experiment evolves into something with real teeth will depend on decisions that have not yet been made: whether to publish findings, whether to set enforceable thresholds, and whether to extend the framework beyond the handful of labs currently at the table. As of June 2026, the government has secured a seat in the room where the most powerful AI systems are built. What it does with that seat is the question that matters most.
More from Morning Overview
*This article was researched with the help of AI, with human editors creating the final content.
