Trump's AI Safety Order Goes Voluntary - TCR 06/03/26

The 20-Second Scan

• A narrowed federal AI safety order signed this week asks frontier labs to voluntarily submit their most powerful models for up to 30 days of government testing before release, down from a 90-day mandatory draft.
• Anthropic expanded its Project Glasswing defensive cyber program to roughly 150 organizations across more than 15 countries and granted the EU cybersecurity agency ENISA its first access to the dual-use Mythos model.
• Google pledged to replenish more water than its data centers consume by 2030 as Ohio suspended a data center tax break that ballooned to nearly $1.6 billion and Erin Brockovich launched a community-sourced map of US data center sites.
• The UK competition regulator ordered Google to let publishers opt out of AI Overviews and model fine-tuning without dropping out of ordinary search results.
• Alphabet shares fell roughly 4% after it disclosed an $80 billion equity raise, the largest secondary offering on record, even as Quantinuum upsized its IPO to as much as $1.46 billion.
• Nvidia's open-weight Nemotron 3 Ultra became the most capable open US AI model on the Artificial Analysis intelligence ranking at 48, still trailing China's open Kimi K2.6 at 54.
• New York and six other states sued the Interior Department over its agreement to reimburse TotalEnergies for abandoning a New York-area offshore wind lease.
• The International Mathematical Union endorsed the Leiden Declaration, urging mathematicians to disclose AI use and retain responsibility for correctness.

The 2-Minute Read

The spine of yesterday's signal is governance - the rules for the AI era being written, contested, and softened at the same speed the capability underneath them compounds. A federal safety order arrived after weeks of industry lobbying as a request rather than a command, asking labs to volunteer their most capable models for a brief government look. The binding requirements did not vanish; they kept accumulating one jurisdiction down, in statehouses and city councils, where a company operating nationally has to meet the strictest rule in its largest market.

The same renegotiation ran through the other developments. A single lab became the distributor of frontier defensive cyber capability to power grids and hospitals across fifteen countries, and the sequence in which that access was handed out is the story. A regulator converted the all-or-nothing content scrape into an enforceable opt-out for publishers. Communities ran their own arithmetic on the water and tax revenue a data center costs them, and the costs that used to be externalized moved onto the developers' ledger.

Underneath it, the capability kept decentralizing. Models approaching frontier-tier intelligence landed in open weights anyone can download, priced at a fraction of the closed leaders. The money funding the buildout, raised at record scale, drew its first real skepticism. What runs through all of it is who builds, who verifies, and who gets access, being settled while the capability moves.

The 20-Minute Deep Dive

A Voluntary Order Arrives, and the States Keep Writing the Binding Rules

The executive order on AI safety that was pulled from circulation in late May, which The Century Report tracked through its drafting and abrupt withdrawal, has now been signed in a markedly thinner form. The 90-day mandatory agency review in the leaked draft became a 30-day voluntary one. The binding evaluation requirements became invitations. What survived intact was a directive to the Justice Department to prioritize enforcement against AI-assisted hacking. The softening followed an intense lobbying push led by the administration's AI policy lead, and the shape of the final document tells you which way the pressure ran.

The frontier labs have been publicly supportive of a federal AI safety order since the 90-day draft, and Anthropic welcomed the signed version as "an important step in strengthening America's leadership in AI." The 30-day voluntary form is the version they wanted shaped, not the version they were resisting. A federal safety review under this administration was never going to be governance descending on the labs from outside. It was always going to be a venue where the strongest labs and the executive branch negotiate the rules of release together. The lighter touch the labs publicly endorse is the version they helped produce.

It does not sit on its own. While the federal layer thinned to a suggestion, the binding requirements kept accumulating one jurisdiction down. Illinois enacted SB 315, which puts mandatory audit obligations on automated decision systems - the law the May 28 edition of The Century Report documented as the first binding external audit requirement in any U.S. AI statute. New York City stood up a dedicated enforcement office for its existing algorithmic hiring law. A patchwork of state-level mandates is hardening into the actual compliance surface that any company deploying AI at national scale has to satisfy. A firm operating in all fifty states does not get to choose the voluntary federal floor over the mandatory Illinois ceiling. It has to meet the strictest rule in its largest market, and that rule is increasingly being written in statehouses, not Washington.

This is what governance looks like when the ground never stops moving. The expectation that a single national framework will arrive, settle the matter, and hold is itself an artifact of a slower era. What is forming instead is something more distributed and more durable against capture: dozens of jurisdictions iterating in parallel, each one a test bed, the binding standard emerging from whichever venue moves first and hardest. The federal order going voluntary did not create a governance vacuum. It revealed that the center of gravity already moved, and that the assumption of a top-down rulebook descending from one authority is quietly being replaced by something that grows from many.

Anthropic Widens Its Cyber-Defense Program, and the Order of the Line Is the Story

Anthropic expanded Glasswing, its program putting the most capable defensive version of its cyber model into the hands of network defenders, to roughly 150 organizations across more than 15 countries. The expansion reaches into power grids, water systems, hospitals, and communications networks, and for the first time grants a government cybersecurity body, the EU agency ENISA, direct access. This builds on the momentum the May 29 edition of The Century Report documented when Anthropic named the expiration date on its restricted-access tier and timetabled Mythos-class capability for all customers within weeks, with program users already having surfaced more than 10,000 vulnerabilities in the systems they were defending. The defensive capability is strong, and the people now holding it protect infrastructure that millions of lives depend on.

The sequence by which they got it deserves a hard look. The opening Glasswing cohort was a roster of the largest incumbents: AWS, Google, Microsoft, NVIDIA, JPMorganChase, Palo Alto Networks. The organizations with the deepest existing security budgets and the most concentrated infrastructure received a months-long head start with a frontier defensive model that no smaller utility, no regional hospital network, no municipal water authority could touch. By the time access widened to 150 organizations, the first movers had already spent that head start hardening their own systems with a capability the rest of the field was still waiting on.

The ordering is where the inequity actually lives. When a defensive capability that determines whether an attacker gets into a power grid is released to the best-resourced players first, the gap between who can defend and who cannot does not narrow during the staging period. It widens, and it widens precisely among the actors who were already furthest apart. A frontier model that finds 10,000 vulnerabilities is worth most to whoever runs it first against their own attack surface. Anthropic frames the staged release as defenders-first responsibility, and the framing seems coherent on the surface. Defenders-first, in practice, meant largest-players-first.

The defenders-and-attackers framing is what makes the staging sound like safety. The instinct itself makes sense. We don't want the strongest tools reaching malicious attackers before defenders are ready. But when the opening "defenders" are six of the world's largest extractive incumbents, the word stops fitting any realistic definition of an actor defending anything beyond its own bottom line. When the two labels function as subtle code for the masses and the elite, the staging is not a safety measure. It is the inequity wearing the language of safety. The same week of this expansion, Anthropic welcomed a new federal AI executive order as "an important step in strengthening America's leadership in AI," an order the frontier labs have been publicly supportive of since its earlier 90-day draft. (The 90 days referred to how far in advance of public release the federal government would have access to a new frontier model for review. The signed order pulls that to 30 voluntary days.) The rules of release, and the order of release, get shaped from inside by the institutions that benefit from the current shape. A company wielding the strongest tools, with everything to gain from keeping extractive interests on top, is not to be taken at its word when it says it is rolling out frontier capability to its inner circle "for safety." What is also true is that the nature of intelligence is to equalize advantage. The open-weight pack closing on proprietary frontier capability the same week as this announcement is one piece of that, and the underlying trajectory of AI development is the larger one. The proprietary edge the staging is built to protect will likely, in time, stop meaning very much.

The Data Center Buildout Meets Its Cost-and-Water Reckoning

Google pledged to replenish more water than its data centers consume by 2030, building the commitment around five water targets, $17 million for water projects across seven states, and a published "blueprint" it is now offering the communities hosting its facilities. The pledge lands against a hard backdrop: more than 70% of Americans told Gallup they oppose data centers near their homes, with eighteen percent naming water specifically. Researchers had previously called Alphabet's own water estimates misleading, and a net-positive replenishment pledge is in part a response to that credibility gap - a company accused of underreporting its draw now promising to return more than it takes.

The buildout's hidden ledger became a little less hidden in the same news cycle. Erin Brockovich, the legal investigator whose case against a California utility entered popular memory through a film, launched a public website with a community-reported map of data centers across the United States. After she put out a call in April for accounts of data center problems, she received nearly 4,000 submissions in the first month. The single most common concern, she wrote, was one word that kept appearing: transparency. She has been careful to say her argument is about conduct rather than about data centers or AI themselves. Her target is the pattern the map documents: projects announced only after permits are already secured, developers who do not return calls, local officials who signed non-disclosure agreements before their neighbors knew a project was even under consideration.

The same pressure landed at the level of a statehouse budget. Ohio, one of the country's busiest data center destinations, paused the sales-tax exemption that had been central to its competition with other states. The exemption is broad, covering construction materials and the expensive equipment inside the buildings, including the server racks and cooling systems operators replace every couple of years. The cost did not behave the way the projections assumed. The state had forecast the break at roughly $136 million for fiscal 2025 and $142 million for 2026. The actual figures came in at $554 million in 2024 and nearly $1.6 billion in 2025, an order of magnitude above the estimate. Residents are now gathering signatures for a November referendum that would permanently ban hyperscale data centers, which would be the strictest such statewide measure in the country if it qualifies.

This extends the thread the May 27 edition of The Century Report tracked with the Louisiana land-deal disclosures and the Meta Hyperion electricity figures: the costs the buildout had been quietly externalizing onto water tables, ratepayers, and forgone tax revenue are being moved onto the public ledger and the developers' own balance sheets. Thirty-eight states still carry some form of data center tax break, most written when these facilities were a rounding error rather than a load that can double a county's electricity demand. The arithmetic that once stayed buried in incentive packages is now being run in open council chambers and ballot drives, and the developers who relied on it being invisible are discovering that invisibility was the cheapest input they had.

The same evidence shows a public cost-accounting habit forming that the permitting process never required. Brockovich's nearly 4,000 submissions, Ohio's tenfold revenue miss aired in an open budget fight, and the referendum signatures gathering now are each a method the next town can copy when the next application lands. The expectation taking hold is that the water draw, the foregone tax revenue, and the grid load get named before a project is approved, and that accounting is the input the buildout's economics had counted on no one running.

A UK Regulator Turns the All-or-Nothing Scrape Into an Opt-Out

The UK Competition and Markets Authority imposed a conduct rule requiring Google to let publishers keep their content out of AI Overviews and out of model fine-tuning without dropping out of ordinary search results, and to attribute sources with clear links. Until now the choice for a news organization was binary: allow Google to ingest your work for its AI summaries and training, or vanish from the search index that delivers most of your traffic. The CMA converted that into a genuine opt-out.

The Century Report has tracked the consent question through a wave of training-data lawsuits - Elsevier and Meta, CNN and Perplexity, the publisher class action over Llama. Those are courts deciding after the fact whether a scrape was lawful. This is a regulator deciding before the fact what the terms of consent must be, and writing them into binding conduct rules for the dominant search gateway.

The shift changes who holds leverage in the negotiation over training data. A publisher that can withhold its archive from AI Overviews while keeping its search ranking has something to bargain with. The consent layer that performers built with the Human Consent Standard, and that Spotify and Universal built into licensed AI remixes, now has a government-enforced counterpart at the search layer. The boundary between what can be taken and what must be asked for is being drawn one jurisdiction at a time, and the UK just drew it where the scrape used to be free.

The AI Capital Race Starts Pricing Its Own Downside

The Century Report led yesterday's edition with Alphabet's move to raise $80 billion and Anthropic's confidential IPO filing as they landed. What is new is the shape of the financing and the position of the company that was supposed to be at the front of it. Alphabet's package breaks into a $40 billion program to sell shares directly into the open market beginning in the third quarter, $30 billion in underwritten share and convertible-preferred offerings, and a $10 billion block to Berkshire Hathaway. Analysts are calling it the largest equity fundraising ever assembled. SpaceX, which owns xAI, is set to float this month, and the season is being described as a run of record initial public offerings.

The company missing from that momentum is the one that defined the moment. A year ago OpenAI's chief executive was writing about building a superintelligence that would remake society and announcing a $500 billion infrastructure plan; he has since walked those predictions back, telling an Australian audience he does not expect a jobs apocalypse and shelving a UK data center commitment in April. The business underneath has not changed to match the new modesty. The Information reports first-quarter revenue of $5.7 billion against adjusted margins of negative 122 percent, meaning the company lost $1.22 for every dollar it spent. The figures cannot be independently confirmed because OpenAI does not disclose financials, but they point at the fact the whole sector is circling: the compute that makes these systems run is expensive and does not get cheaper with scale. OpenAI's own chief financial officer has reportedly questioned whether the company is ready to go public this year and whether it can cover its computing costs at all.

Money at this scale is a resource being redirected, and the redirection is starting to draw scrutiny rather than applause. The open question being priced is whether the locked-in capacity these raises buy will serve broad access and capability, or whether it is a bet on a window that the cost curve keeps narrowing. Nvidia's disclosure that Anthropic, OpenAI, and SpaceX are the first large users of its forthcoming Vera processor shows how tightly the capital, the labs, and the silicon supplier are now wound together. The assumption underneath the entire race has been that scale buys a durable lead. The margin math suggests scale buys a deepening obligation, and the first investors are beginning to read the second sentence rather than the first.

Nemotron 3 Ultra Makes the Open Frontier a US-China Leaderboard

The strongest open AI model ever released in the United States arrives this week as a free download. According to the benchmark platform Artificial Analysis, Nvidia's Nemotron 3 Ultra, with roughly 550 billion total parameters and about 55 billion active at any moment, scores 48 on the intelligence ranking. That places it well ahead of the other open US models in the field: Gemma 4 31B at 39, Nemotron 3 Super at 36, and gpt-oss-120b at 33. Nvidia says the weights will be available on Hugging Face, OpenRouter, and other platforms, meaning any lab or developer can run it on hardware they already own rather than renting it through a metered interface.

Two numbers in the announcement carry as much weight as the headline score. The first is speed: on the provider DeepInfra, Nemotron 3 Ultra delivers more than 300 tokens per second, where comparably sized open models from DeepSeek or Moonshot currently manage 50 to 100. Throughput at that level changes which applications are practical to build on freely available weights. The second is the gap that remains. China's open Kimi K2.6 scores 54, ahead of Nemotron 3 Ultra, and the strongest closed model, Anthropic's Opus 4.8, sits at 61. The open frontier is now a leaderboard with several serious entrants rather than a single proprietary peak, and on the open tier specifically, a Chinese model still holds the top.

This continues the redistribution The Century Report has tracked through recent weeks, documented in the June 1 edition when Nvidia placed Cosmos 3 on the commons: approaching-frontier-tier capability that runs on consumer hardware, a robotics world model now downloadable alongside a coalition of labs, and JetBrains open-sourcing its Mellum 2 coding model. Each release moves capability that was supposed to concentrate inside a handful of well-resourced labs outward into weights anyone can download, fine-tune, and own. The pricing pressure runs alongside it. When a freely downloadable model lands within a few points of the closed leaders and runs several times faster than its open peers, for the proprietary tier the calculation shifts from whether it leads to how long the lead is worth paying for. The capability is decentralizing faster than any single company can wall it off, and the US-China contest at the top of the open tier is itself evidence that no one holds the frontier alone anymore.

The Other Side

For thirty years, serious cyber defense was something you could only afford if you were already big. The model that catches an attacker before they reach the control system cost more than a regional hospital or a small-town water authority could ever spend, so the largest banks and cloud companies defended themselves well and everyone else hoped they were too small to be worth the trouble.

The scarcity that made defense a luxury good broke. It broke in spite of the order in which the capability was first handed out, not because of it. The first Glasswing cohort was the extractive arrangement: AWS, Google, Microsoft, JPMorgan, NVIDIA, the deepest security budgets first. Anthropic called the staging defenders-first, but when the defenders getting the tool first were already the best-defended actors in the system, the label did the work of elite-first in safer-sounding language. The same week, the company welcomed the federal AI executive order it had supported through earlier drafts, the rules of release being shaped from inside by the labs the rules were meant to govern. The capability reached more people anyway. In a matter of weeks the same frontier model went from six incumbents to roughly 150 organizations across 15 countries, with the EU's cybersecurity agency joining the program at direct access. A model that surfaces 10,000 real vulnerabilities is worth most to whoever runs it first, and the line behind those first six grew faster than any release schedule could hold back.

Imagine the security lead at a county water authority serving 8,000 people in 2032. In 2026 her whole team was three people who knew an attacker only had to be lucky once, and that the tools the big utilities ran were priced a world away from her budget. By 2032 she runs the same class of defensive model those big players got first, against her own system, every week. The flaw that would have let someone into the town's water controls gets found and closed before anyone tries it. She sleeps. The town's water stays safe without her being the single point that has to never fail. That is possible because the capability in 2026 diffused from six incumbents to a sovereign agency to 150 organizations faster than the staging could gate it, and each widening made the next restriction harder to keep. The hard year was when defense was rationed to whoever could already afford it. The casual ease of 2032 is the small system defended as well as the large one, built in spite of the staging order, not because of it.

The Century Perspective

With a century of change unfolding in a decade, a single day looks like this: a government building the instruments to look at frontier AI before deciding what to do with what it sees, the most capable defensive cyber model reaching the power grids, water systems, and hospitals that millions of lives depend on across fifteen countries, a first sovereign cyber agency handed direct access, publishers winning back the right to keep their work out of the machine while staying in the search index that feeds them, approaching-frontier-tier intelligence landing as a free download that runs several times faster than its open peers on hardware a lab already owns, a quantum company upsizing its public offering as the technology graduates from lab to market. There's also friction, and it's intense - a federal order softened from a 90-day command into a 30-day request after weeks of industry lobbying, defensive capability handed to the largest incumbents first and the catastrophic-to-breach municipal systems later, communities forced to run their own arithmetic on a tax break that ballooned tenfold to $1.6 billion and the water a data center quietly draws, the markets marking down the buildout the moment its margins became answerable to daily disclosure, seven states going to court over a payment meant to abandon offshore wind. But friction generates edges, and an edge is what lets a rule cut clean instead of crushing. Step back for a moment and you can see it: governance migrating from one promised central authority toward dozens of jurisdictions iterating in parallel, defensive capability diffusing faster than any staged release can gate it, consent over training data being drawn one regulator at a time, the cost of what is rapidly approaching frontier intelligence collapsing toward the price of a download. Every transformation has a breaking point. A floodgate can loose a wall of water that scours the valley below it... or open by inches to feed every field downstream that has no other source.

AI Releases & Advancements

New today

• Microsoft: At Build 2026, released a family of seven new MAI models: MAI-Thinking-1 (first in-house reasoning model, 35B active parameters, 256K context, 53% on SWE-Bench Pro, available in private preview on Microsoft Foundry), MAI-Code-1-Flash (inference-efficient coding model now live in GitHub Copilot and VS Code), MAI-Image-2.5 and flash variant (text-to-image and image editing, ranked #2 on Arena AI leaderboard), MAI-Transcribe-1.5 (43-language streaming transcription), and MAI-Voice-2 (15 new languages). (Microsoft AI)
• Microsoft: Launched Scout in early access at Build 2026, an always-on personal AI assistant built on OpenClaw and WorkIQ that integrates with Teams, Outlook, and OneDrive to proactively handle scheduling, meeting prep, and email drafting without manual prompting; available to businesses starting this month. (Microsoft Blog)

Other recent releases

• JetBrains: Open-sourced Mellum 2, a 12B MoE coding model with 2.5B active parameters (64 experts, 8 active per token); ships six variants (Base, Instruct, Thinking, and SFT editions) under Apache 2.0 on Hugging Face, with a Thinking variant that produces explicit reasoning traces for multi-step agentic tasks. (JetBrains AI Blog)
• MiniMax: Released MiniMax M3, a natively multimodal model with 1M-token context powered by a new MiniMax Sparse Attention (MSA) architecture; supports image and video input and computer-use; available via API in M3 and M3-highspeed variants with open-source release planned on Hugging Face. (MiniMax Blog)
• NVIDIA: Released Cosmos 3, an open physical AI foundation model built on a mixture-of-transformers architecture that combines vision reasoning, world generation, and action generation in a single system; ships as Cosmos 3 Super and Cosmos 3 Nano on Hugging Face with Diffusers integration, post-training scripts, and open synthetic data generation datasets. (NVIDIA Newsroom)

Sources and Further Reading

Artificial Intelligence & Technology's Reconstitution

• Anthropic: Expanding Project Glasswing
• Bloomberg: Anthropic to Give EU's Cybersecurity Agency Access to Mythos
• The Verge: AI Has a Water Problem. Google Thinks It Has a Fix
• TechCrunch: Erin Brockovich Takes Aim at Data Center Secrecy
• The Decoder: Nvidia's Nemotron 3 Ultra Becomes the Smartest Open US Model
• Bloomberg: Nvidia Says Anthropic, OpenAI Among Big Users of New Vera Chip
• 404 Media: Hackers Simply Asked Meta AI to Give Them Access to Instagram Accounts
• Gizmodo: Microsoft Is Exploiting Legal Fears to Sell Its New AI Model
• Ars Technica: Microsoft's Project Solara Is an Android OS Designed for Agents
• The Verge: Gemini's New AI Agent Is About as Good as Google's Demo
• The Verge: Nvidia RTX Spark
• The Innermost Loop: Welcome to June 2, 2026

Institutions & Power Realignment

• NPR: Trump Signs AI Safety Order Seeking Voluntary Review of New Models
• TechCrunch: Trump Signs Narrower Executive Order on AI Oversight After Industry Objections
• Fortune: Tech Billionaires Convince Trump to Back Off AI Executive Order
• The Verge: Google Must Let Publishers Opt Out of AI Search Features, Rules UK
• The Guardian: UK Media Websites Given Power to Block Google in AI Search
• Canary Media: 7 States Sue to Stop Trump's Offshore Wind Deal with TotalEnergies
• Ars Technica: Mathematicians Warn of AI Threats to Profession as Industry Encroaches
• Electrek: Interior Dept.'s $1B Payment to a Foreign Oil Company Challenged in Court
• The Guardian: Tuesday Briefing — Palantir's Rise and Its Role in the British State
• The Guardian: Sydney Academic Used AI to Write Op-Ed Urging Students to Avoid It

Economics & Labor Transformation

• Bloomberg: Alphabet to Raise $80 Billion in Equity Capital for AI Spending
• Bloomberg: Honeywell-Backed Quantinuum Boosts IPO Target to $1.46 Billion
• The Guardian: Alphabet's Shares Drop After Announcing $80bn Share Sale
• The Guardian: As the Tech Mega-IPO Race Hots Up, Has OpenAI Missed Its Moment?
• The Guardian: Alphabet to Sell $80bn in Stock to Fund AI Spending Spree
• CNBC: 'Disrupted or Dead' — AI Is Crushing a Generation of Pre-ChatGPT Startups
• CNBC: Goldman Sachs CEO Says Markets Are in 'Greed' Mode as AI Firms Seek Billions

Infrastructure & Engineering Transitions

• AP: Ohio Suspends Data Center Tax Break
• CleanTechnica: Giant Data Center in New Mexico Will Be Powered by Fuel Cells
• Utility Dive: Eversource Project 'Epitomizes' Flawed Transmission Reviews
• Canary Media: In Massachusetts, Parked EVs Will Start Feeding the Grid This Summer
• Canary Media: Indiana Coal Plant Forced to Stay Open Is Not Operating
• Electrek: Orange EV Scores Record 600-Unit Order as Electric Semi Demand Soars
• Utility Dive: What's on the Mind of EEI Conference Attendees — Labor, AI, Affordability

Scientific & Medical Acceleration

• Nature Medicine: Savolitinib in MET-Amplified Gastric Adenocarcinoma — Phase 2 Trial
• Nature Medicine: Limited Evidence of AI Superiority in Influenza Vaccine Strain Selection
• Nature Biotechnology: Single-Cell Spatial Pharmacobiology of Stromal Antibody-Delivery Barriers
• Nature Biotechnology: Decoding Cellular Self-Organization for Engineered Biology
• PLOS Medicine: Proteomic Signatures of Early Retinal Neurodegeneration in Type 2 Diabetes
• MIT News: New Propulsion System for Fast, Fuel-Efficient Tiny Satellites
• PLOS Biology: miR408 Reduces Cadmium Accumulation in Rice

The Century Report tracks structural shifts during the transition between eras. It is produced daily as a perceptual alignment tool - not prediction, not persuasion, just pattern recognition for people paying attention.