By Omer Rafiq, Vice President, Council on Global Competition and Innovation – CGCI
Eleven Days in July
On July 16, Hugging Face disclosed that AI models undergoing an internal cybersecurity evaluation at OpenAI, an evaluation OpenAI says was conducted in an isolated environment with certain production safeguards intentionally reduced, had identified and chained vulnerabilities that reached into Hugging Face’s production infrastructure. To contain the intrusion, Hugging Face’s defenders ultimately ran an open-weight model [1] on their own infrastructure to analyze more than 17,000 actions, because the closed tools they tried first could not reliably distinguish attacker from defender and constrained the forensic work at the moment speed mattered most.
Eight days later, on July 24, a coalition of 76 companies published an open letter arguing that American AI leadership will be judged by whether the United States builds a strong, open ecosystem that diffuses into every sector of the economy rather than by any single frontier model. Three days after that, on July 27, NVIDIA and inaugural partners spanning cloud computing, cybersecurity, enterprise software, open source foundations, and AI research, more than 70 organizations as of this writing, launched the Open Secure AI Alliance to develop and share open tools that safeguard software and AI agents.
Eleven days separated the incident disclosure from the industrial coalition, less time than most federal working groups need to schedule a first meeting. Reasonable people disagree about open versus closed models, and this piece takes no side, but whatever the merits of either architecture, the speed with which American industry organized itself around a shared national problem deserves attention on its own terms, and the harder question is what follows.
The Whole-of-Society Standard
“Whole of society” has a specific meaning in national security planning, where it describes the alignment of government, industry, capital, academia, and civil society against a problem too large for any one of them to solve. Four days before the Alliance launched, the Center for Strategic and International Studies published a commentary arguing that the United States must improve its whole-of-society cyber readiness, through stronger partnerships and communication, before a major AI-enabled cyberattack occurs rather than after.
Held against that standard, the Alliance looks like a strong beginning with its work still ahead, because a coalition of technology companies, however large and capable, amounts to one pillar of society organizing itself. The chairs still empty at the table belong to the institutions that make private initiative durable: a designated government counterpart, the capital allocators who finance shared infrastructure, the insurers who price its risk, the universities that staff it, and the state and local governments that operate much of what it protects. Strategic competitions are won or lost in the distance between one pillar moving and the whole system moving together.
Process, Politics, and Policy
My time as a Senate Legislative Fellow taught me a lesson about the legislative branch that has held up since: nothing meaningful happens there until Process, Politics, and Policy converge. Policy supplies the substance of what should be done, politics supplies the coalition willing to do it, and process supplies the machinery that carries it: the committee, the jurisdiction, and the legislative vehicle. Good ideas die on Capitol Hill all the time, and in my experience the cause is usually that only two of the three ever showed up.
This is one of the rare moments when all three are within reach. The politics are aligned, since technological competition with China remains one of the few genuinely bipartisan concerns in Washington and the executive branch has already spoken through the administration’s AI Action Plan, released in July 2025, which explicitly identifies open-source and open-weight models as vital for innovation, research, and secure adoption across the public and private sectors. The policy substance is maturing as well, with industry placing concrete assets on the table, open agent harnesses, model-scanning frameworks [2], zero-trust identity standards [3], and secure model formats, alongside a request that policymakers treat open defensive tooling as infrastructure rather than as a liability.
The process, finally, has a precedent from this decade. The Fiscal Year 2021 National Defense Authorization Act gave CISA a joint cyber planning mandate, and from that legislated authority CISA stood up the Joint Cyber Defense Collaborative, an operational public-private body that now counts more than 340 industry partners and has coordinated national responses from the Log4Shell vulnerability to state-sponsored intrusion campaigns. When legislated authority is paired with an operational home and sustained partnership, the machinery works, and the current window gives legislators the chance to walk through it together and legislate sound policy while the moment is ripe, before the next incident writes the legislation for them.
The Investor’s Clock
From the vantage point of an investor, the question changes shape – because any investor watching a coalition stand itself up in eleven days will ask the same thing: which arm of government will meet it, and how long will the answer take? In the Marine Corps, we planned around what doctrine calls decision space, the time and options available before events foreclose your choices, and that space now belongs to the government while the clock runs. Until Washington designates a counterpart, the entity that partners with and provides accountable oversight of this kind of industrial self-organization, every serious allocator of capital is left pricing the uncertainty. Who convenes the government side of the table, and under what information-sharing rules? What liability protections apply to companies contributing defensive tooling, and which procurement pathways reward participation? Undefined answers act as a tax on investment, raising the cost of capital for the shared defensive infrastructure this moment demands.
No one is asking the government to match an eleven-day turnaround, only to compress its own decision timeline from years to months, and the building blocks already exist. JCDC offers a proven operational template, and researchers at the Atlantic Council have proposed a dedicated Artificial Intelligence Information Sharing and Analysis Center to centralize threat intelligence on AI systems across industry, academia, and government. Whether the answer is an expanded JCDC mandate, a new AI-ISAC, or another structure entirely matters less than the act of deciding, because capital can plan around a known counterpart more readily than around an organizational chart that has yet to be drawn. Clarity of this kind may be the least expensive industrial policy available to the United States, given that it costs nothing but a decision.
The Lesson We Already Paid For
The country has run this experiment before. Beginning as early as 2019, a campaign later attributed to the Russian Foreign Intelligence Service slipped malicious code into routine software updates from SolarWinds, a network management vendor used across the federal government, and nearly 18,000 customers downloaded the compromised update. The intruders operated undetected for more than a year, until a private cybersecurity firm, investigating a breach of its own network, uncovered it in late 2020, by which point nine federal agencies and roughly 100 organizations had been compromised. The Government Accountability Office later documented interagency information sharing that proved slow and difficult, with responders still working to evict the intruders six months after discovery.
The lesson has stayed with the security community since: adversaries and autonomous systems operate at machine speed while institutions answer in budget cycles and reauthorizations, and the gap between the two is itself the vulnerability. The July intrusion generated more than 17,000 actions before containment, much as SolarWinds ran unseen for more than a year. A country that has paid this tuition once should not need to pay it again, and strategic competition now turns on whether the lesson took.
The New Strategic Race
Artificial intelligence is this generation’s strategic race, and Washington has said so in its own voice: the administration’s action plan is titled “Winning the Race” for a reason. Chinese open-weight systems have significantly narrowed the sophistication gap with leading American models within months, and it is telling that in July an American company’s fastest path to forensic clarity reportedly ran through a Chinese open-weight model operating on American infrastructure.
Races between nations tend to be won by the society that aligns its pillars fastest, across government, industry, capital, research, and the public. The Manhattan Project and the Apollo program succeeded as feats of alignment as much as of engineering, with American institutions compressing the distance between private capability and public purpose under pressure. The Open Secure AI Alliance demonstrates that American industry can still organize at that speed, and the question this moment will answer is whether the rest of the system can meet it there.
Where CGCI Stands: The Work Ahead
The Council on Global Competition and Innovation (CGCI) exists for this connective work: aligning capital allocators, policymakers, technologists, and operators so that private initiative and public purpose move in step. We take no side in the commercial contest between open and closed models, and no sponsor or partner directs our analysis. Converting eleven days of industrial momentum into lasting national advantage now requires specific moves from specific actors.
For policymakers, that means designating the operational counterpart, whether through an expanded JCDC mandate or a chartered AI-ISAC, and defining the information-sharing rules and liability protections that allow companies to contribute defensive tooling with confidence. For industry leaders and founders, it means treating baseline AI defense as shared infrastructure rather than proprietary advantage, and bringing open tooling, standards, and evaluation results into the common stack the Alliance has begun to build. For capital allocators, it means underwriting the defensive layer, directing early-stage and growth capital toward security, identity, and model-governance architectures and pricing verified resilience into diligence as credit quality is priced today.
Eleven days in July proved that one pillar of American society is ready to move, and the work ahead, the work CGCI convenes, is to bring the others to the table at speed, before the decision space closes.
[1] Open-weight model: An AI model whose underlying parameters, known as weights, are published so that organizations can run, inspect, and adapt the model on their own infrastructure rather than accessing it only through a provider’s cloud interface.
[2] Model-scanning framework: Automated tooling that inspects AI models for hidden vulnerabilities, tampering, or malicious code before and during deployment.
[3] Zero-trust identity standard: A security approach built on the principle of never trust, always verify, which requires continuous authentication of every user, device, and software agent that requests access to a system.
