AI Security

US lifts freeze on UK AI Security Institute access to new models

The White House has reversed its 17-day freeze on UK AISI pre-release access to frontier AI models. What it means for UK AI assurance.

Abstract AI motif illustrating restored UK access to frontier AI models for security testing

Washington has reportedly withdrawn its request that US AI labs keep unreleased frontier models away from the UK’s AI Security Institute, ending a pause of roughly two and a half weeks. Pre-deployment testing in Britain can resume, but the episode shows how much of the UK’s AI assurance model depends on a decision taken in another country.

What happened

The White House has reversed its instruction to American AI developers to hold back new frontier models from the UK AI Security Institute (AISI). The Telegraph first reported the U-turn on 11 October, and LBC carried it on Monday 12 October. Both outlets say the change followed lobbying by Kanishka Narayan, the UK’s AI minister.

The original request dates from 24 September. According to reporting at the time by City AM, the US Office of the National Cyber Director asked OpenAI and Anthropic to let American government testers see new frontier systems before the British institute did. An unnamed US official justified the move on security grounds, saying it applied because “they’re American companies”. Later accounts citing The Telegraph say the labs were told to keep models away from British testers until Washington had completed its own national security review. On that count the freeze lasted 17 days.

LBC and others name Claude Mythos 5.1 as the most visible casualty. The Financial Times reported in September that Anthropic had released the model on 1 September without first giving AISI access, which it described as the first time a major model had skipped the institute before launch. Anthropic said access was initially limited to US organisations and that it was working with the US government to widen it. AISI director Henry de Zoete acknowledged that the institute had not received the model. He insisted relations with the developers remained strong, citing pre-launch work on OpenAI’s GPT-6 Astra.

Several questions remain open. Neither the White House nor the labs have published terms. Reports so far leave open when access resumes, whether every developer is covered, whether Mythos 5.1 will now be reviewed and whether US agencies still get first sight.

The detail

AISI’s main contribution is pre-deployment evaluation. Under voluntary agreements with the labs, its researchers probe unreleased models for dangerous capabilities: cyber offence, help with chemical and biological weapons, autonomous behaviour that breaks containment, and the ability to deceive the people overseeing it. The institute was set up around the 2023 Bletchley Park summit and renamed in February 2025 to focus on security harms. TNW reports that in an evaluation AISI published in April, a preview of Mythos became the first to complete a 32-step simulated network intrusion, succeeding in three of ten attempts.

Timing matters. Once a model is generally available, attackers can use it on the same day as defenders. Evaluating it before launch is the only point at which findings can still change guardrails, access tiers or the release decision itself. De Zoete argued during the freeze that his teams could still assess models after public release, and that is true. But post-release testing tells you what attackers can already do. It does not let you prevent it.

The agreements behind AISI’s access are not statutory. They rest on memoranda and goodwill, and that is why a single request from Washington was enough to suspend them.

Timeline showing Mythos 5.1 release on 1 September, the US freeze from 24 September, and its reversal reported on 11 October

Why it matters for UK organisations

Few UK organisations deal with AISI directly, yet many rely on its work. The institute’s evaluations can inform NCSC guidance, government procurement decisions and the threat assessments that boards increasingly ask CISOs to explain. When a model with strong offensive cyber capability reaches the market before UK government researchers have examined it, defenders here start from behind. They learn what it can do from vendor system cards, from US agencies, or from attackers.

There is also a sovereignty point. Alan Turing Institute chief George Williamson told The Guardian last week that Britain may not always be able to obtain the AI it needs. The freeze illustrated his point. For regulated sectors adopting frontier models for code review, security operations or customer service, it raises a practical question: how much of your assurance case assumes that someone in the UK has independently tested the model?

The reversal emerged on the eve of what was billed as Narayan’s first speech since AI became a cabinet-level brief. Previews said he would urge frontier labs to do more on safety, argue that Britain cannot leave them to police themselves, and announce measures to strengthen national cyber defences. But the core issue is simpler: a foreign government switched off Britain’s main technical check on frontier AI, then switched it back on, with no public guarantee it stays on.

Expert view

In my experience, the most dangerous assumption in any assurance process is that a control is in place because it was in place last time. Pre-release testing by AISI has quietly become one of those controls for the UK. Teams cite it without asking whether it covered the version they deploy.

The last few weeks should change that. A control that a third party can suspend by memo, without notice and without telling you which products are affected, is a dependency, not a guarantee. We would never accept that from a cloud provider’s logging service, and we should not accept it for evaluation of the most capable software being deployed into our networks.

I am also cautious about reading the U-turn as a clear win. Restored access is welcome, but the terms matter. If US agencies still go first, AISI’s window before launch shrinks, and its findings arrive closer to the point where they can no longer shape the release. That lobbying worked shows UK leverage, but also that the arrangement is political rather than structural.

What to do now

  1. Inventory your frontier models. List which models and versions are in use across the business, including those embedded in SaaS tools and coding assistants. Under Cyber Essentials, treat them like any other software asset: secure configuration and access control apply.
  2. Check the assurance trail for each one. Record whether the specific version was evaluated before release by AISI or another independent body, and where the evidence sits. Do not assume a predecessor’s evaluation carries over.
  3. Tie adoption to evidence. For high-capability models, especially those with agentic or code-execution features, make independent evaluation, or your own red teaming, a gate in procurement and change management.
  4. Limit what agents can reach. Apply least privilege, separate credentials and network segmentation to AI agents, in line with the Cyber Essentials user access control and firewall themes, so an untested capability has less to damage.
  5. Watch for the terms. Track DSIT and AISI announcements on what the restored access covers, and add the risk of a renewed freeze to your AI risk register.

Bottom line

Britain’s AI testers are back in the room, and that is good news for UK defenders. But the freeze showed that the UK’s main independent check on frontier AI depends on permission from Washington and on the labs’ goodwill. Until that access rests on something firmer than a memo, UK organisations should verify for themselves what testing a model has had before trusting it with their systems.

Sources

Related Posts