White House Launches 'Gold Eagle' to Speed Up Vulnerability Fixes Across Critical Infrastructure
A new government programme pairs open-source software maintainers with power grids, hospitals, and other critical operators to find and patch security flaws faster, with AI doing much of the sorting work.
Key points
- The White House announced Gold Eagle on Tuesday as a formal coordination programme for finding and fixing security flaws in critical infrastructure such as energy grids and hospitals.
- Gold Eagle draws its authority from Executive Order 14409, which President Trump signed on 2 June 2026.
- The programme involves CISA (the federal agency responsible for infrastructure security), the Treasury Department, and the Department of War working alongside private companies.
- The White House confirmed Gold Eagle is already receiving and sorting vulnerability reports across industries, but has not named any participating companies.
- CISA is separately reported to be using Anthropic's AI model, called Mythos, to scan government software for security weaknesses.
The federal government has a new programme for hunting down dangerous software flaws before criminals exploit them. It's called Gold Eagle.
Gold Eagle is a coordination layer. Developers who maintain open-source software (code that anyone can read and modify freely, and which quietly powers a huge portion of critical systems) are being connected directly with operators of critical infrastructure: hospitals, water utilities, power providers. Instead of agencies and companies each scanning independently for the same problems, Gold Eagle routes findings into one shared pipeline and sends prioritised fix instructions to defenders.
Who is actually behind this programme?
Three federal bodies run it together: CISA, the Treasury Department, and the Department of War. Private-sector partners are involved too, though the White House hasn't said which ones.
The legal foundation is Executive Order 14409, titled "Promoting Advanced Artificial Intelligence Innovation and Security," which President Trump signed on 2 June 2026. That order called for an AI-powered clearinghouse to identify and fix software vulnerabilities (flaws in code that attackers can use to break in or cause damage). Gold Eagle is the government's operational answer to that mandate. We first covered the executive order on 15 July 2026.
AI does the heavy lifting inside the programme, reading incoming vulnerability reports, checking them against known scan data, and ranking which flaws need fixing first. The White House hasn't disclosed which models Gold Eagle uses for that ranking, or how it weights severity.
Separately, as first reported by SecurityWeek, CISA is using Anthropic's Mythos to audit government software. Anthropic had faced federal restrictions over cybersecurity concerns until those were recently lifted.
Secretary of War Pete Hegseth framed the effort plainly: "We are bringing a wartime footing to the cyber domain to relentlessly patch vulnerabilities."
Should you worry?
Gold Eagle is several steps removed from daily life. But the infrastructure it targets isn't: a flaw left unpatched in a hospital network or a water treatment system causes real disruption. Faster patching, if the programme delivers, shrinks that window. Our earlier story on security debt growing faster than companies can fix it put the scale of the problem in context: eight in ten organisations carry unresolved flaws stretching back more than a year.
The missing detail is accountability. No list of participating companies, no public ranking methodology, no timeline for how quickly fixes reach operators. Those gaps are worth watching.
