CISA loses ground as White House splits AI cyber authority

The Cybersecurity and Infrastructure Security Agency is heading into the next phase of cyber defense with diminished capacity, according to Axios reporting that cited former officials and industry participants. The agency was established as the civilian lead for protecting utilities, financial institutions, and other critical infrastructure operators. That mandate now faces a wave of AI-enabled intrusion techniques at the same moment the White House is distributing authority across multiple agencies rather than consolidating it at CISA.

The concern is not theoretical. Axios noted that the government is preparing for capabilities like Anthropic's Mythos model to accelerate threat vectors. The gap between the sophistication of the threat and the institutional capacity to coordinate a defensive posture is widening. CISA's role in convening cross-sector preparedness has historically depended on trust, technical credibility, and budget. All three are now constrained.

The White House response so far has been to assemble a multi-agency structure rather than resource the existing civilian node. Reuters separately reported that former Attorney General Pam Bondi has been appointed to a White House AI panel, a signal that coordination authority is being held closer to the executive office rather than delegated to the agency with operational cyber responsibility.

The structural question is whether the government will treat AI-enabled cyber threats as a CISA problem or a White House problem. The early read is the latter. That may accelerate decision-making at the policy layer, but it creates coordination risk at the operational layer—where utilities and banks need technical guidance, not interagency process.

For markets pricing critical infrastructure resilience, the relevant variable is not whether the government has an AI cyber strategy. It is whether the agency tasked with implementing that strategy in the field has the budget, the authority, and the attention span of the principals. The current configuration suggests it does not.