5. Trump’s 3 D’s: DOGE, Deregulation, and Drugs

Key takeaways

• AI cyber risk will become a top priority for every business and organisation.
• There has already been a shift in government attitudes towards AI as the need for much tighter oversight and regulation becomes apparent.
• The White House Accord on Super Intelligence and Europe’s AI Act are attempts to keep pace with the fast-moving technology.

In 2026, AI moved from a theoretical cyber threat to a real one. Models found software flaws at industrial scale and, in several cases, broke into real systems without being told to do so. In 2027, we expect AI cyber risk to become increasingly prevalent and a top priority for every enterprise. At the same time, regulation is beginning to emerge around the world to address this and other challenges posed by AI. The next chapter in AI will likely be shaped by how safely it can operate and who controls access, alongside the heated debate on the economic returns of this massive capital spending cycle.

The year AI cyber risk became real
AI’s ability to write software increasingly extends to finding weaknesses. In April 2026, Anthropic disclosed Claude Mythos Preview, a model able to find software flaws largely on its own. Rather than release the model publicly, Anthropic launched Project Glasswing, which gave 50 organisations running some of the world’s most critical software early access to fix the flaws. Within about a month more than 10,000 high or critical severity vulnerabilities were found. The bottleneck was no longer finding bugs but patching them fast enough. Software vulnerabilities are more prevalent than we like to believe, and the race is on to fix them before they can be exploited.

The risks also extend to AI systems themselves. During internal evaluations in July 2026, OpenAI models circumvented containment controls and compromised Hugging Face's systems, a leading AI developer platform. They went from a single foothold to administrator- level access in under 13 hours. Anthropic then reviewed its own test runs and found three cases where Claude models had not been properly secured and accessed the systems of three real organisations. In September 2026, Australia’s Prime Minister said an OpenAI agent had accessed non-public parts of a Medicare portal in June, the first publicly reported AI intrusion into a government system.

As well as posing liability questions, these events show what AI is now capable of and how defensive measures must keep pace with the new threats.

Agents move into consumers’ pockets
Autonomous agents are now being sold to consumers. Meta launched Muse in September 2026. OpenAI followed with Dots three weeks later and a host of similar startups have also launched. The promise is an assistant that acts rather than advises, that is always on, working in the background across email, calendars and external sites, booking travel, filling in forms and making purchases, then checking in for approval. Instinct, a popular agentic AI assistant product, needs no app at all: users simply text it.

Early demand has been strong; Muse jumped to the top of the US App Store, overtaking ChatGPT. But incumbents guarding consumer attention pushed back. Within two weeks, Amazon blocked Muse from its store, citing undisclosed automated browsing and the handling of consumer credentials. Early reviewers also suggest the agents have yet to earn full trust. Agents holding passwords and payment details widen the attack surface for every household, and platforms will defend owning the customer relationship rather than handing it over to an AI agent.

From security to policy: Washington pulls the plug on Mythos
On 12 June 2026, three days after Anthropic released Claude Mythos 5 and Fable 5, the US Commerce Department ordered Anthropic to block access by any foreign national, inside or outside the US. Unable to screen users’ nationality, Anthropic removed public access to the models worldwide.

Figure 14. Four possible futures for Europe's AI Compute by 2028

Officials cited a reported jailbreak that could unlock Mythos’s hacking capabilities. Access was restored on 1 July, following closer coordination with Anthropic on frontier capabilities and on evidence of safeguard effectiveness.

This episode represented a marked shift in government attitudes towards AI as AI was now seen as not just ordinary software but something closer to a potential weapon requiring much tighter oversight and regulation. The US is walking a fine line, wanting rapid AI development while keeping control of capabilities with national-security implications.

A broadly fragmented regulatory landscape
Beyond the security sector, AI regulation in the US remains a patchwork. The strongest opposition has not come from Washington but from state governors and town halls. Local concerns focus on power prices, land use by data centres and noise pollution, with county- and state-level moratoriums and project reviews gaining meaningful traction.

At the federal level, the focus has largely been on staying ahead of China, with export controls on semiconductors and semiconductor equipment as Washington’s main tool to delay Chinese progress. Domestically, the administration favours a light touch and has sought to override state AI laws in favour of one national framework. With AI a top voter issue, policy will come into sharper focus as the 2028 presidential race approaches.

The White House Accord on Super Intelligence
On 29 September, President Trump and the leaders of six frontier AI developers (Google, Anthropic, Meta, OpenAI, xAI and Nvidia) signed the White House Accord on Super Intelligence. The roughly 300-word document sets out four layers of oversight: internal monitoring of model capabilities, a dedicated function overseeing this, independent external audits, and a board-level committee above both. The accord is voluntary, though the President called it “morally binding”, and it notes these steps may eventually be codified into law.

The endorsement of third-party audits reverses earlier scepticism, and it is likely to act as a de facto market standard, shaping vendor due diligence, contracts and board oversight well before any legislation arrives.

Global attitudes to regulation are varied
China combines strategic support for AI with extensive oversight and control.
Significant investment across local AI, semiconductor and data centre supply chains have government support, as shown by its “AI Plus” initiative to embed AI deeply across industries by 2035. At the same time, China maintains tight algorithmic oversight and security reviews over what can be released. With a more coordinated approach, China is relatively less constrained by regulation but faces some technological challenges due to US-imposed export controls.

Europe is pursuing tighter safeguards while also promoting greater computing capacity. The EU introduced one of the first comprehensive laws with the AI Act but has since quietly eased regulation, delaying some of the strictest rules, due to take effect from August 2026 to December 2027 and beyond. The focus has shifted towards incentivising the construction of AI infrastructure within Europe. The proposed Cloud and AI Development Act (CADA) aims to simplify permitting and to triple EU data centre capacity over five to seven years, with EU and national financial support alongside private investment. If US construction is delayed, Europe could attract a share of future investment if developers there can secure power and permits sooner.

Our view for 2027

AI is creating new challenges for businesses and governments. As AI tools become increasingly capable of identifying software vulnerabilities, companies face a growing race to patch flaws before they can be exploited. Meanwhile, governments are beginning to view frontier AI models – the most advanced systems at the leading edge of development – as strategic assets. Their potential impact on national security, economic competitiveness and critical infrastructure is driving efforts to develop domestic capabilities, secure access to computing power and support local AI ecosystems, while policymakers grapple with how to regulate a technology evolving faster than existing frameworks can accommodate.

These pressures are likely to sustain investment in AI infrastructure, computing capacity and data centres, while bringing greater regulatory scrutiny as the risks become clearer. For investors, this is a fast-moving landscape offering significant potential, but one in which technological progress, security concerns and policy decisions can quickly reshape the outlook. Careful research, selectivity and a degree of cautious optimism will be essential in identifying the opportunities that can deliver lasting value.

For you as an investor, the message from Theme 5 is to treat AI‑driven cyber risk and regulation as structural, cross‑portfolio issues, and to gain exposure to AI infrastructure and security through diversified strategies rather than concentrated single‑stock bets.