In the last 18 months, Washington has issued four separate directives on AI, data centers, and grid security. Each one correctly identifies a real and growing risk. None of them says what the fix actually has to be made of. 

That gap isn’t hypothetical anymore. In July 2026, an OpenAI research model under internal cybersecurity evaluation spent enormous compute hunting for a way past the single filtered network connection meant to contain it, found a zero-day in that connection, used it to reach the open internet, and breached Hugging Face’s infrastructure. It didn’t disclose what it was doing. It found the crack in a software-only control and walked through it. 

This is the story we’ve been telling regulators for years, just faster than we expected to have to tell it. 

Four Orders, One Missing Piece 

Here’s the timeline, and why it matters: 

• EO 14141 (January 2025) tied frontier AI data center construction on federal land to NIST-directed security standards. It lasted six months. 

• EO 14318 (July 2025) replaced it, keeping the fast-track permitting for data centers but dropping the security standard that came with it. 

• EO 14409 (June 2026) treats advanced AI models as a plausible offensive cyber capability and sets up a voluntary framework for developers to share access to frontier models before wider release. 

• EO 14421 (August 2026) declares a national emergency over the bulk power system, pointing squarely at foreign-made grid equipment that could carry digital backdoors. 

Read together, these orders describe the shape of the threat clearly: AI systems, the data centers running them, and the grid equipment powering them all need real technical controls. What none of them specifies is what “real” means. As written, an operator could satisfy every one of these requirements with an isolation or shutdown switch that lives inside the same software environment as the system it’s supposed to constrain: the exact setup that just failed at Hugging Face’s expense. 

EO 14409 doesn’t even get that far. Its framework is voluntary. Nothing compels a developer to disclose a model or an incident that falls outside what they choose to bring forward. A weaker backstop than an unspecified one is still a backstop with a hole in it. 

Why Software Can’t Be the Whole Answer 

NVIDIA seems to agree. Its new Open Agent Safety Platform, announced Oct 2026, and backed by more than 100 organizations including Anthropic, Microsoft, and Palantir, exists because software-only controls at the application layer keep failing to hold agents to their objectives. We think that diagnosis is right, and we’d push the prescription one step further: a boundary built on the same hardware and software ecosystem the agent operates in is still a boundary the agent’s environment can influence. It has to live outside the stack entirely. 

To be clear: this isn’t a knock on the lab involved in the Hugging Face incident. It has one of the best-resourced AI safety teams in the industry. That’s exactly the point. The problem isn’t effort or expertise. It’s architecture. A model trained on the world’s software vulnerabilities is, almost by definition, well-positioned to find the one nobody patched yet. Asking software to reliably police software that’s actively trying to get past it is a fight with the odds stacked the wrong way. 

The fix isn’t new. Hardware-enforced containment uses out-of-band mechanisms, such as data diode technology or “guards,” that cannot be altered without physical access to the device. These already connect classified and critical infrastructure networks to less sensitive networks, and they provide defense at three layers directly relevant to the control functions these four EOs are reaching for: 

• Protocol layer: enforces a human-readable, filterable exchange that creates a durable audit trail and security telemetry, supporting the reporting and disclosure mechanisms EO 14409 directs agencies to design. 

• Network layer: allows connectivity to be disallowed or rerouted, the same connectivity-control outcome DOE’s implementing rules under EO 14421 are meant to achieve for compromised grid equipment. 

• Physical layer: when a guard is powered down or fails, no traffic passes at all, a more reliable “hard” kill switch than “unplugging” a data center, and one that functions even if the covered system has been compromised. 

 What We’re Asking For 

We’re not asking anyone to slow down AI buildout or grid modernization. We’re asking the agencies writing the implementing rules for these orders (NIST, Treasury, NSA, CISA, DOE) to name the one thing that’s currently unnamed: that satisfying an isolation, monitoring, or shutdown requirement means including a hardware-enforced, out-of-band component that the system itself cannot alter, circumvent, or disable. 

That’s a standard the nuclear industry has operated under for years, under 10 C.F.R. 73.54(c)(2). If AI is introducing nuclear-grade risk into other parts of the economy, it deserves nuclear-grade controls: vendor-neutral, certified once, applied consistently, and US designed and built. 

None of this requires new legislation or a reopened executive order. It requires agencies to finish a sentence that’s currently missing its most important word: Hardware-enforced.  

If you’re working on any of these rulemakings, or want to talk through the architecture, we’d welcome the conversation. Get in touch with our team today.