Congress Races to Regulate AI After Mythos: The Battle Between Voluntary and Mandatory Oversight

The emergence of Anthropic's Mythos model, capable of finding cybersecurity vulnerabilities that human hackers cannot, has accelerated a quiet but consequential debate in Congress over how the federal government should oversee advanced AI systems. Bipartisan negotiations between Rep. Lori Trahan, a Massachusetts Democrat, and Rep. Jay Obernolte, a California Republican, are now focused on the central fault line of AI regulation: should oversight be voluntary or mandatory?

The talks, details of which have not been previously reported, represent the latest attempt to craft federal AI rules after multiple failed efforts in Congress. According to people familiar with the negotiations, Obernolte favors a light-touch approach that would let AI companies decide whether to disclose certain information to the government. Trahan wants mandatory data-sharing requirements and greater accountability for companies developing the most capable models.

The Mythos Catalyst

Anthropic's Mythos model changed the regulatory calculus. A system that can systematically identify zero-day vulnerabilities, the kind of security flaws that nations spend billions exploiting and defending, represents a fundamentally different category of AI risk than chatbots that generate misinformation or biased outputs. Mythos doesn't just find known problems faster; it finds problems that human experts didn't know existed.

The White House has been scrambling to respond. President Trump is considering an executive order that would create a vetting process for advanced AI, with internal debates mirroring the congressional talks. Some administration officials advocate laissez-faire, while others push for mandatory requirements or even a pre-clearance regime that would require White House approval before new AI models are released.

The Preemption Fight

The most contentious element of the Trahan-Obernolte negotiations is preemption: whether federal AI rules should override state laws. The AI industry has spent the past year lobbying to block what it calls a patchwork of conflicting state regulations. But AI safety advocates argue that state legislators have the right to protect their citizens, and that any federal preemption must be significantly stronger than what it replaces.

The preemption proposal under discussion is relatively narrow, applying only to laws that directly regulate cutting-edge AI development. But critics warn that if enacted, AI companies would argue in court that any new state rules around children's safety, privacy, or consumer protection force them to change how they develop their models, and would therefore be blocked. One AI policy advocate familiar with the talks called it a litigation magnet.

Trahan has already faced significant political backlash for engaging in the negotiations. Top Democrats in the Massachusetts legislature sent her a letter warning against working with Republicans on a bill that would override state AI safeguards. A coalition of AI safety advocates and Massachusetts voters launched a petition campaign urging her not to cut a deal.

The Stakes Are Getting Higher

The timing matters. Every month without federal rules, states continue passing their own legislation. Colorado, Illinois, Texas, and California have already enacted AI governance laws with varying requirements. If Congress eventually passes a weak federal standard that preempts these state laws, it could result in less overall oversight rather than more. If Congress fails entirely, the patchwork continues to grow, creating compliance headaches for AI companies operating nationally.

The Mythos revelation adds urgency because it demonstrates that the capabilities frontier is moving faster than the regulatory process. When an AI model can find vulnerabilities that human security researchers miss, the window for proactive governance narrows. Regulators are no longer discussing hypothetical future risks; they're responding to demonstrated present capabilities.

What This Means For You

If you work in technology, these negotiations will directly affect how your company builds and deploys AI systems. A mandatory federal framework would create compliance costs but also regulatory clarity. A voluntary regime would leave companies navigating a growing patchwork of state laws with no federal safe harbor. If you're an investor, the regulatory uncertainty is a risk factor for any company building frontier AI models, particularly Anthropic, OpenAI, and Google DeepMind. The outcome of these talks could shift billions in market value depending on whether compliance costs are minimal or substantial. And if you're simply a citizen who uses AI products, the question at the heart of this debate is whether you can trust that the most powerful systems ever built are being adequately tested before they're released into the world. The answer depends on whether Congress chooses accountability or self-regulation.