The attacks, mapped before they are reported.
By Ellis Ward | November 13, 2026
The federal government does not know the full scope of AI-powered cyberattacks hitting U.S. critical infrastructure. Part of the reason is straightforward: the companies being attacked often keep it to themselves.
Members of President Trump's AI task force met Thursday to push toward changing that. The group discussed ways to get critical sectors, including banking, energy, and emergency services, to report attacks that use artificial intelligence. They also looked at options to protect those companies from legal consequences when they come forward. Reuters reported on the meeting Thursday.
Reporting Standards Under Discussion
Emil Michael, the Defense Department's technology lead and vice chair of the task force, discussed progress on national standards for AI developers. Those standards would govern how companies report safety incidents and share cybersecurity information with the government and each other.
The protections discussed Thursday are still options on the table, not settled policy. The task force is working through what legal cover companies would require before they voluntarily disclose an AI-related attack. Without that cover, companies have historically been reluctant to share details that could expose them to lawsuits, regulatory scrutiny, or competitive harm.
No decisions were announced following the meeting.
A December Deadline Is Forcing the Issue
The meeting came against the backdrop of a legal deadline that few outside Washington are tracking closely. The Cybersecurity Information Sharing Act of 2015, which provides the legal foundation for businesses to share threat information with each other and with the federal government, expires in December 2026.
The law, commonly called CISA, gives companies limited legal protection when they voluntarily share cyber threat indicators and defensive measures with the government. That protection has built the foundation for years of threat-sharing arrangements between private firms and federal agencies. It was the reason many companies participated in those arrangements at all.
If Congress does not reauthorize the law before it lapses, that framework loses its legal grounding. Any new standards for AI-specific reporting would then be built on an expiring base unless lawmakers act. That creates a compressed legislative agenda: Congress would need to both renew an existing cybersecurity law and potentially craft new AI-specific reporting requirements, possibly in the same window.
The timing matters for another reason. National standards for AI incident reporting would almost certainly need the kind of liability shield CISA currently provides. Without a clear legal structure behind voluntary disclosure, companies in banking and energy have little reason to report attacks they are not legally required to flag.
Critical Infrastructure Is the Starting Point
Banking, energy, and emergency services occupy the center of the task force's concern for concrete reasons. These sectors are vital to both economic stability and national security. A coordinated AI-powered attack on the energy grid, for example, could ripple into banking systems and emergency response capacity at the same time.
AI changes the threat picture in ways that make traditional defenses harder to hold. Automated systems can probe defenses faster than any human team can respond. They can adjust their approach based on what blocks them. When an attack uses AI, reconstructing what happened requires the kind of technical detail that companies typically regard as sensitive.
That reluctance to disclose creates a gap in the government's picture of how AI is being used as a weapon. The task force's interest in reporting standards is a direct response to that gap.
What New Rules Could Mean in Practice
If national standards are adopted, AI developers and operators of critical systems would have clearer obligations for when and how to report safety incidents. Federal regulators and defense agencies would receive a steadier stream of information about attack methods, timelines, and targets.
Companies have legitimate concerns about what sharing that information means for them. Detailed disclosures can expose proprietary system architecture, create legal liability, or give adversaries an account of what defenses failed and why. The options discussed Thursday were framed around addressing those concerns, not setting them aside.
Whether the task force's work translates into binding rules, voluntary frameworks, or executive guidance remains an open question. The task force has not set a public timeline for its recommendations. For now, the sectors it most wants to hear from, including banking, energy, and emergency services, are watching to see whether the government's interest in their data comes with meaningful protection for sharing it.
