AI-Driven Vulnerability Sharing: Four Takeaways on “Gold Eagle” and Other New Initiatives
Federal, state, and private-sector-led initiatives are emerging in real time to respond to the ability of advanced AI models to accelerate the discovery of software vulnerabilities across industries. Companies and other organizations have new options for sharing information about cybersecurity vulnerabilities identified by advanced AI models, including the Trump Administration’s new “Gold Eagle” clearinghouse.
- The White House created the Gold Eagle cybersecurity vulnerability clearinghouse pursuant to Executive Order 14409, Promoting Advanced Artificial Intelligence Innovation and Security.The clearinghouse is managed by the Department of the Treasury, the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of War (DoW), and a key goal is for those agencies to collaborate with industry stakeholders – including AI developers and critical infrastructure organizations – to coordinate identification, validation, disclosure, and remediation of AI-discovered software vulnerabilities.
- The private sector and states are also standing up AI-enabled approaches for vulnerability identification and remediation.
As Gold Eagle ramps up and other AI-related vulnerability discovery and remediation initiatives come online, there are important new considerations for companies exploring voluntary participation, including how liability and confidentiality related to information sharing may be addressed in this rapidly evolving area. Below, we provide four key takeaways to help navigate this process.
1) There are multiple opportunities for interested companies to engage with federal, state, and private-sector collaborations to identify and address vulnerabilities.
Gold Eagle. Established pursuant to Executive Order 14409, Gold Eagle is an AI cybersecurity clearinghouse designed to help government and industry manage the growing volume of AI-discovered vulnerabilities. Through voluntary collaboration with AI developers and critical infrastructure operators, Gold Eagle is intended to coordinate and deconflict vulnerability scanning, support the discovery and validation of software vulnerabilities, and coordinate and prioritize remediation and distribution of vulnerability patches at scale.
CISA describes Gold Eagle as a capability that enables the ingestion, validation, and deduplication of AI-enabled vulnerability reporting, helping streamline coordinated vulnerability disclosure and remediation. Gold Eagle discloses vulnerabilities through the Carnegie Mellon Software Engineering Institute (SEI) Vulnerability Information and Coordination Environment (VINCE) platform, which serves as CISA’s primary disclosure tool for its Coordinated Vulnerability Disclosure (CVD) program.
The other functions of Gold Eagle are to accelerate patching and remediation by delivering validated vulnerability information more quickly to software vendors, system operators, Federal Government agencies, and critical infrastructure at scale.
Private-Sector AI-Enabled Initiatives. Private-sector initiatives are similarly using AI to accelerate vulnerability discovery, validation, prioritization, and remediation. For example, the Linux Foundation is working with industry leaders to secure critical open-source software using AI, and the Open Secure AI Alliance has announced its use of AI-enabled tools designed to identify vulnerabilities, assess exploitability, support secure coding, and facilitate patch management across software and AI-agent ecosystems. Commercial vendors are also increasingly using AI to analyze proprietary application code, validate potential vulnerabilities, prioritize findings based on risk, and generate proposed fixes.
State Initiatives. States are also exploring AI-enabled cybersecurity programs and cybersecurity threats. While these initiatives vary significantly in scope and function, collectively they are likely to increase the volume and speed of vulnerability identification, reinforcing the importance of risk-based processes for validating findings, prioritizing remediation efforts, and allocating limited cybersecurity resources. For example:
- On August 10, 2026, Governor Gavin Newsom announced California’s AI Cyber Defense Program, which is intended to support vulnerability detection, network hardening, and incident response across state systems and critical infrastructure.
- The New York Department of Financial Services (DFS) has also weighed in on frontier AI models’ abilities to “amplify the potency, scale, and speed of identifying vulnerabilities and exploits in information systems.” DFS recommends that regulated entities “should review vulnerability management timelines to determine whether accelerated detection and remediation processes are necessary based on updated Risk Assessments.”Although DFS has not proposed establishing a program to perform accelerated detection and remediation, its recommendations recognize the value of programs like Gold Eagle and those provided by third-party vendors.
2) Gold Eagle does not replace traditional disclosure programs or cybersecurity incident frameworks.
According to CISA’s Vulnerability Clearinghouse guidance, Gold Eagle “enables ingestion, validation, and deduplication of AI-enabled vulnerability reporting” at scale. As a consequence, Gold Eagle “amplify[ies] CISA’s ability to triage incoming vulnerability reports for CVD within the VINCE platform,” however, it does not replace existing vulnerability disclosure programs. Indeed, CISA guides that “[F]or traditional vulnerability disclosure, continue to use VINCE.”
Likewise, reporting AI-discovered vulnerabilities and associated remediation information through Gold Eagle is distinct from reporting an active cybersecurity incident, which should continue through existing incident-reporting channels.
3) With the onslaught of AI-discovered vulnerabilities, risk-based remediation is key.
As AI accelerates vulnerability discovery, organizations face a growing operational challenge: the volume of identified vulnerabilities may outpace available remediation resources. Initiatives such as Gold Eagle reflect a growing recognition that organizations cannot realistically investigate and remediate every vulnerability. Gold Eagle’s mission includes determining which findings warrant immediate action and then providing prioritized and actionable remediation information. This can help spare security teams from being overwhelmed by an increasingly large volume of patches.
More broadly, government and industry leaders have increasingly emphasized that AI is not only expanding the scale of vulnerability discovery but also reinforcing the need for disciplined, risk-based remediation. At the August 2026 Black Hat Conference, Acting CISA Director Nick Andersen highlighted the need for "ruthless prioritization" as AI-powered systems continue to identify vulnerabilities at unprecedented speed and volume, underscoring that organizations must focus finite resources on the issues most likely to affect critical systems and operations. CISA has also recommended that “organizations automate prioritization wherever possible to meet the breadth and scale of AI-enabled vulnerability reporting.”
This approach aligns with CISA’s broader emphasis on risk-based vulnerability management. For example, through its Binding Operational Directive (BOD) following Executive Order 14409, CISA has encouraged federal civilian agencies to prioritize remediation based on demonstrable risk and exploitability rather than treating all vulnerabilities equally. Although these directives generally do not apply to private-sector organizations, they provide a useful framework for considering how to allocate cybersecurity resources in an environment where vulnerability discovery increasingly outpaces remediation capacity.
4) Organizations should consider a layered approach to liability and confidentiality protections, starting with CISA 2015.
In considering participation in Gold Eagle and other AI-enabled vulnerability disclosure and remediation initiatives, organizations should assess the protections available and the terms, conditions, and legal obligations applicable to participation.
In particular, organizations should consider whether participation in these activities qualifies for protections under the Cybersecurity Information Sharing Act of 2015 (CISA 2015), which was enacted to encourage voluntary cybersecurity information sharing between the federal government and the private sector and between private-sector organizations. The statute provides liability protection for sharing cyber threat information (CTIs), deployment of defensive measures (DMs), and network monitoring. CISA 2015 also provides antitrust protections for industry collaboration on cybersecurity, confidentiality, and protection from regulatory enforcement. For companies participating in (or considering participating in) Gold Eagle, including critical infrastructure organizations, the protections for sharing CTIs and DMs (i.e., remediations) and for applying DMs shared through Gold Eagle will be important.
Critically, CISA 2015 is set to expire on September 30, 2026, though there is widespread support for Congress to grant long-term reauthorization. If CISA 2015 expires prior to reauthorization or an organization is unsure if its protections fully cover activities under Gold Eagle or other vulnerability disclosure and remediation initiatives, participants should consult with legal counsel, including to determine if there are other mechanisms available to protect these activities. For Gold Eagle, this could be through contractual terms governing participation in Gold Eagle or through other policies established by the Administration. For initiatives led by the private sector, confidentiality may be dictated by contractual terms or terms of use.
Organizations should also review cybersecurity information-sharing policies and procedures with legal counsel to assess whether the information being shared, the mechanisms used to share it, and the associated legal, privacy, confidentiality, and security safeguards align with organizational requirements and risk tolerance.
***
Organizations navigating this rapidly developing space of AI-enabled vulnerability disclosure and cybersecurity information should continue to monitor for developments and guidance – including potential congressional action on the CISA 2015 reauthorization, further Administration actions related to Gold Eagle and other AI-enabled cybersecurity resources, and emerging state AI cybersecurity information-sharing opportunities.
Our Privacy, Cyber & Data Governance team is closely monitoring these developments and is available to assist organizations in evaluating vulnerability disclosure programs, information-sharing strategies, and related cybersecurity compliance obligations. Please reach out to the authors with any questions.
