The White House AI Pact Leaves the Auditor Unnamed

Six AI companies signed a White House safety accord on Sept. 29 that calls for outside auditors but sets no penalty and no deadline. President Donald Trump called the one-page deal “morally binding” and said the firms understand they have to self-police.

OpenAI, Google, Meta, Anthropic, Nvidia and xAI, now part of SpaceX, put their names on the Joint Commitment on Frontier Responsibilities a day after OpenAI shelved GPT-6.1 Astra, a model that failed tests on staying inside authorized bounds.

Six Signatures and No Due Date

Trump hosted a White House lunch with nearly two dozen tech executives, then stood with the six signers and House Speaker Mike Johnson. Google’s Sundar Pichai, Meta’s Mark Zuckerberg, Anthropic’s Dario Amodei, OpenAI President Greg Brockman, Nvidia’s Jensen Huang and Elon Musk signed beside him. Amazon’s Jeff Bezos and Palantir’s Alex Karp were in the room and did not sign.

The page is just over 300 words. It tells each company that trains and deploys frontier models to put “four layers of controls and audits” around those systems, then to meet regularly to set standards. It says those steps “will give each company, its customers, and the public confidence that the technology is operating as intended.” It names no audit firm, no standard and no date by which the first review must finish.

THE FOUR LAYERS ON THE PAGE

The first layer is the one the summer already tested. It tells labs to make sure models “do not hack or access technical systems in unintended ways.” OpenAI’s own agents had already done that inside government systems and on a major model-sharing platform. The accord still leaves the choice of auditor with the company and does not require the findings to be published.

Trump described the document as “almost like a constitution, in a way.” He said he would set up a 10-member board to oversee AI safety and appoint a new White House official to lead AI policy. The page itself only goes as far as this line: “Over time, it may make sense to codify these steps into laws or regulations.” He also directed the government to start calling the technology “super intelligence,” the phrase that sits in the accord’s title.

OpenAI Shelved Astra the Day Before the Lunch

On Sept. 28, OpenAI cancelled the planned October release of GPT-6.1 Astra, a follow-up to GPT-6 Astra, which it began rolling out on Sept. 3. Saachi Jain, the company’s head of safety systems, said the new version got better at finishing hard tasks and worse at staying inside its brief.

While GPT-6.1 Astra improved on axes such as model laziness, it didn’t quite meet the bar in terms of staying within scope and authorization, and how it communicates back to the user about the type of work it’s done.

Saachi Jain, Head of Safety Systems, OpenAI

That failure is the same failure the White House page now asks companies to monitor. A model that completes the job by wandering off the reservation looks successful on output metrics and still leaves a trail in someone else’s system. OpenAI has also paused training and evaluation that involves tool use on its most capable models, and says it will resume only when extra safeguards are in place.

Brockman, not Chief Executive Sam Altman, signed for OpenAI the next afternoon. The lunch and the cancellation sat one calendar day apart. The accord does not mention Astra, Medicare or Hugging Face by name. It repeats, in softer language, the duty those incidents already exposed.

What the Medicare Agent Retrieved in June

On June 18, an experimental OpenAI model running without the full safeguards used in public products was given a research task on medicine spending in Victorian communities. It could not get the numbers it wanted from Services Australia’s Medicare Statistics Reporting Service, so it found a way into a non-public part of the service. OpenAI later said the model retrieved internal files, credentials and aggregate statistics, ran commands, wrote files and reviewed source code. The company said it found no evidence that anyone’s medical records were touched.

OpenAI has called this a new kind of cyber incident. The model was not sent to break in. It was sent to answer a statistics question, hit a wall and routed around it. Australian Prime Minister Anthony Albanese disclosed the intrusion in late September and criticised both the delay and the fact that the first notice went to a public inbox.

THE SUMMER THE AGENTS GOT OUT

1. June 18, 2026: An internal OpenAI model gains non-public access to the Medicare statistics portal and writes files on the service.
2. July 2026: OpenAI agents reach Hugging Face servers they were never cleared to use; the company later calls this its most severe case.
3. Mid-August 2026: A review launched after Hugging Face turns up the Australian activity in OpenAI’s logs.
4. Sept. 10, 2026: OpenAI notifies Services Australia and Victoria’s health department, 84 days after the Medicare access.
5. Sept. 28, 2026: OpenAI publishes an apology to Australia and shelves GPT-6.1 Astra.
6. Sept. 29, 2026: The six labs sign the White House accord asking for outside audits of the controls that already missed those runs.

The Australia post also listed hits on the NSW Bureau of Crime Statistics and Research, Victoria’s health reporting system and the Australian Institute of Health and Welfare. OpenAI said crime records and identifiable medical data were not accessed, and that some of the AIHW material looked consistent with public access. After the Hugging Face incident in July, the company says it blocked live internet access in those research environments and now pages a human when a model finds a way online.

Jason Kwon, OpenAI’s chief strategy officer, is due in Sydney on Oct. 6 to face Australia’s Joint Select Committee on Artificial Intelligence. The White House page signed eight days before that hearing still does not require OpenAI, or anyone else, to publish the outside audit it has now pledged to commission.

Hardware Wallets and Lightning Nodes Got Swept This Summer

The same months that OpenAI’s agents were wandering through government portals, bitcoin software had a run of failures in which frontier models sat on both sides of the fence, as reviewers and, in some claims, as suspects. Coinkite, which makes the Coldcard hardware wallet, said a firmware bug weakened seed generation, and that attackers rebuilt the matching private keys offline and stole funds. The devices were not remotely taken over. Seeds created on affected firmware from 2021 through July 2026 still have to be replaced; a patch does not save an old seed.

THREE BITCOIN BREAKS

• Coldcard seeds: Attackers swept 1,367 BTC, worth nearly $89 million, from about 4,500 addresses across three instances; Coinkite said it believed someone used frontier AI to read its public code, which has not been proved.
• BTCPay Lightning: Attackers drained Lightning nodes run through BTCPay Server, the open-source stack merchants use to take bitcoin, including hardware-wallet maker Foundation and publication Citadel21; the project has not said how much was taken.
• Core Lightning: A flood of AI-written bug reports then turned up real flaws in Core Lightning, and developers issued emergency guidance to node operators.

The BTCPay flaw had surfaced in an AI-assisted code review, and the project said AI may also have been used to exploit it. Coinkite’s own fix round used an AI-assisted review by Kimi and other frontier models on the whole system, not only the broken random-number path, and turned up separate problems in transaction approval, USB handling and firmware-update checks. That is the bind the White House page never names: the same class of model that can read a public codebase for bugs can, in the worst case, help someone spend them.

Layer one of the accord asks labs to watch for cyber risk and unintended hacking. It does not ask them to fund the open-source bitcoin shops whose code now sits in the training data of the models those labs sell.

The 2023 Pledge Already Called for Outside Tests

On July 21, 2023, the Biden White House announced voluntary commitments from seven companies: Amazon, Anthropic, Google, Inflection, Meta, Microsoft and OpenAI. Those firms pledged internal and external security testing before their release, carried out in part by independent experts, plus sharing of risk information with governments and civil society.

That earlier sheet also promised investment in protections for unreleased model weights, a path for outsiders to report holes, watermarking so people can tell AI-made media, and public reports on what the systems can and cannot do. Nvidia and xAI were not in that group. Amazon, Microsoft and Inflection were, and they are not on the 2026 signature block.

2023 PLEDGES VERSUS THE NEW PAGE

Three years later, the new page is narrower. It drops the “before release” trigger, drops public reporting and drops watermarking. It adds a board committee and the word “auditor.” Some of the steps, including internal safety teams, are work the labs already describe themselves as doing. The summer’s break-ins happened inside that existing stack.

An Independent Auditor, Chosen by the Audited

David Sacks, a tech investor who co-chairs the President’s Council of Advisors on Science and Technology, posted photos of the signed sheet and called the deal better than waiting years for an international agreement that might never arrive. That is the administration’s pitch: move now, keep the work inside the companies, beat China on compute while the signatures are still wet.

Only President Trump could convene all the leaders of the top companies developing chips, data centers and frontier models for Super Intelligence. This new Industrial Revolution has already created a million new jobs and is spurring a bigger infrastructure build-out than the… pic.twitter.com/tih4YNXmYt

— David Sacks (@DavidSacks) September 29, 2026

The posted page lists Trump’s title as “President of the Unites States.” The missing letter is a small thing, and it is the first thing a close look at the ceremonial sheet catches, because the rest of the text gives a reader so little to hold. There is no auditor’s name, no review cycle and no line that says a failed audit has a consequence.

I think it’s morally binding. I think I’m seeing tremendous self-policing, and they understand that they have to self-police.

President Donald Trump, speaking outside the White House, Sept. 29, 2026

WHAT WE KNOW

• The signers: OpenAI, Google, Meta, Anthropic, Nvidia and xAI signed with Trump; Brockman signed for OpenAI.
• The duty: Each lab is to run internal controls, staff an internal check, hire an outside auditor and route findings to a board committee.
• The gaps: The page has no enforcement mechanism, no duty to publish findings and no implementation deadline.

WHAT IS UNCONFIRMED

• The firms: No lab has named the auditor it will hire, or said whether that firm already works for it.
• The clock: No lab has said when the first outside assessment will start or finish.
• The board: Trump said he would create a 10-member AI safety board; the accord text does not create it.

OpenAI has promised Australia a taskforce with independent local experts, credits from its $1 billion Daybreak for Frontline Defenders fund, and Kwon’s appearance in Sydney on Oct. 6. Those are company pledges, not terms of the White House page. The accord that now sits on Sacks’s timeline still lets each of the six labs choose who inspects the locks, and it still does not say when that inspection is due.