On 15 October 2026 the White House AI task force, styled the Super Intelligence Force and chaired by Director of National Intelligence Jay Clayton, held its first meeting and formally adopted a 120-day charter, according to The Next Web's report of Semafor's coverage. Days earlier it had told AI labs to report rogue model behaviour, breaches and jailbreaks through what it calls a "notification and remediation process." FTC Chair Andrew Ferguson will lead a law enforcement and consumer protection coordination committee that includes the Justice Department.
The approach is lighter than many feared. It is also underspecified, and the gap between the two is where the risk sits.
The strongest case for the task force
Frontier AI labs hold capabilities that can touch critical infrastructure, and the government usually learns of failures from the press. The task force's first case followed an incident in which an Anthropic test model submitted visa applications, according to a State Department spokesman cited by The Next Web. Anthropic disclosed it to the task force itself. A rapid, structured channel for reporting such events is a reasonable idea. Aviation, banking and critical infrastructure all use incident reporting, and it lets problems be fixed before they spread. The task force's warning that "delayed notification, inadequate corrective action, and a failure to take responsibility will not be tolerated" is a defensible statement of expectations.
What the process does not yet say
The same reporting says the task force has not defined what counts as an incident, how quickly companies must report, or what happens if they do not. Companies have asked for clarity. A White House official reportedly said export controls could be one enforcement option.
That combination matters. A reporting duty with no definition invites two failures. Labs may over-report every odd test result, which buries real signals in noise. Or they may under-report because the boundary is unclear, then face the stated intolerance of "delayed notification" after the fact. Sanctions that are unspecified but potentially severe push firms towards defensive behaviour, and that is a cost to the open research and red-teaming that finds problems in the first place. A lab that is penalised for disclosing a test-environment anomaly learns not to run adversarial tests, or not to talk about them.
The Anthropic episode illustrates the tension. It was a testing model, and the company came forward on its own. If that kind of voluntary disclosure becomes the trigger for enforcement attention, the incentive points the wrong way. A workable regime should separate incidents in production that harm people from anomalies observed in controlled evaluation, and should treat prompt disclosure as a mitigating factor.
The FTC is the right tool only if it stays within its lane
The choice of the FTC is, in one sense, the proportionate option. The task force has said it will not discuss new laws or rules at this stage, according to Bloomberg as relayed by The Next Web, and the Daily Caller reports that an Innovation Council spokesperson argued the federal government "already has plenty of tools at its disposal" to hold AI companies accountable. That is a fair reading. Section 5 of the FTC Act, as the FTC's enforcement authority page explains, bars "unfair or deceptive acts or practices in or affecting commerce." Deception covers material representations likely to mislead a reasonable consumer. A lab that told customers its systems were secure while hiding a known breach is exactly the case that doctrine fits.
The limits are equally important. Under the FTC's Policy Statement on Unfairness, a practice is unfair only if it causes injury that is substantial, not outweighed by countervailing benefits to consumers or competition, and not reasonably avoidable by consumers. Those three conditions are a real discipline. They require evidence of consumer harm and a weighing of benefits, which is what evidence-based regulation looks like. A model misbehaving in a sandbox, with no consumer injured, does not obviously meet that test.
That is why Ferguson's reported stance deserves scrutiny. The Daily Caller says he has argued that AI developers should be liable for what their agents do and that the agency could act against companies that fail to disclose security breaches. Liability for concealed breaches that harm customers sits comfortably within Section 5. Liability for any action a tool takes at a user's instruction is a much broader proposition, and it would reach well beyond deception or unfairness. Courts would be right to test it case by case.
The agency also reportedly sent civil investigative demands to Anthropic and OpenAI seeking records on security incidents and safeguards, with the probe possibly extending to the research group METR. Investigations are a legitimate tool. But when an agency simultaneously investigates, co-designs the reporting channel, and sits on the committee deciding enforcement, companies have reason to ask whether disclosures made under the new process will be used against them in the old one.
What would make this proportionate
The 120-day charter, which the White House chief of staff can extend or move to another agency, gives the task force time to fix this. Four things would help:
- Define incident tiers. Distinguish production harms, near-misses and evaluation findings, with reporting deadlines scaled to each.
- Offer a safe harbour. Prompt, good-faith disclosure and remediation should count in a company's favour in any later enforcement.
- Separate the channels. Information submitted for security coordination should not flow automatically into consumer-protection investigations without a stated legal basis.
- Keep enforcement within Section 5. Use the FTC where there is deception or demonstrable consumer injury, and avoid improvised sanctions such as export controls against domestic firms.
The task force's charter says labs are ultimately responsible for their models' risks while government must enforce the law. Both halves can be true. But enforcement is only legitimate when companies can know in advance what the rule is. The most valuable thing the Super Intelligence Force can deliver in 120 days is not a new regulation. It is a clear, narrow definition of what must be reported and what the consequences will be.