How June 2026 AI Executive Order Hides Its Own Guarantor: “The Stealth Third”

Gastón Rey

Gastón Rey

— 12 min read
Share
How June 2026 AI Executive Order Hides Its Own Guarantor: “The Stealth Third”

Gaston Rey

The executive order claims to remove the government from the release process of frontier AI models. Yet a closer look reveals something stranger: the government does not disappear as guarantor. It merely ceases to identify itself as one.

Let’s go to the main idea right away: the executive order does not eliminate the regulator; it privatizes and obscures the regulatory function. The hidden fact is that the order replaces visible regulation with invisible coordination. It abandons the formal gatekeeper while preserving the gatekeeping function. This article calls that phenomenon the “stealth third”.

To understand why, we need a concept that legal and political theory rarely names explicitly. That claim does not rest on a prediction about how agencies will behave. It rests on a logic about how regulated relationships are built: a logic anyone can follow, in five steps:

  1. Every regulated relationship requires a third. Two parties alone (a developer and the public, a buyer and a seller) cannot make their relation binding by themselves. Something outside the pair has to constitute the bond as more than present force.
  2. Libertarianism tends to believe the third can be eliminated. Under a Republican government is the dream of getting the state "out of the way", the returning to an unmediated pair. I still share it in essence. But now I assume, as much of the classical-liberal tradition does, that the third party is not an imposition that could in principle be removed, because it transcends the state, it is a relational articulator that preserves a greater structure (what preserves, conservs and evolves the whole structure).
  3. In reality, you can only change who occupies the third position. The third is not optional furniture you can carry out of the room. The position is structural; it is always filled.
  4. When the state abandons the formal third, it can return as the informal third. Drop the visible regulator and the regulatory function migrates (into reputation, into market focal points, into a "trusted partner" list that does the gatekeeper's work without the gatekeeper's name).
  5. The political problem is therefore not the existence of the third, but its visibility and controllability. A third bound by public law can be seen, challenged, and constrained. A third that operates by classified standard and soft pressure cannot.

The reason the third step is valid (the reason it cannot simply be eliminated) lies in the part that legal and political theory rarely names explicitly. Peirce, Simmel, and Supiot provide the foundation.

The constitutive third is the mediating instance that converts a brute pair (two parties, raw capacity) into a binding, rule-governed relation. It is at once a logical necessity (Peirce), a structural power-position (Simmel), and a source of legal authority (Supiot).

One political layer remains, and it is the one the executive order turns on. Modern states claim a monopoly over the third position: the state is the final arbiter, the guarantor of last resort, the one entitled to the last word in any dispute on its territory -at the same time, inside any republican state, the Judicial Power become the mediating part: if it is captured by any other dyadic forces it will not perform its essential job of articulation-.

A long classical-liberal lineage (sharpest in Hans-Hermann Hoppe) objects that a monopolist third is structurally a judge in its own cause, with standing incentives to enlarge its own jurisdiction. The rival vision is polycentric: many competing thirds (private arbitration, reputational orders, insurance, attestation markets) disciplined by exit and competition rather than by a single sovereign. One need not endorse the anarcho-capitalist conclusion to find the diagnostic question indispensable: in any arrangement, who occupies the third position, is it singular or plural, and above all, is it visible or hidden? With that question in hand, the order becomes legible.

What the order actually does

The order has two pillars. The first hardens federal and critical-infrastructure cybersecurity against AI-enabled attack, on accelerated thirty- and sixty-day timelines. The second governs the voluntary pre-release review of "covered frontier models." Developers may engage the government to learn whether a model qualifies; may grant up to thirty days of pre-release access under confidentiality, insider-risk and intellectual-property protections; and may help select the "trusted partners" (including operators of rural hospitals, community banks and local utilities) who get early access to defensive tools. A Treasury-coordinated "clearinghouse" pools vulnerability findings. The benchmark that decides what counts as a covered frontier model is classified, developed jointly by the Treasury, the National Security Agency and the Cybersecurity and Infrastructure Security Agency. No statute compels any of this; participation is, on its face, optional.

Now read each of its three advertised strengths, and each of its three structural risks, by asking the diagnostic question.

The three advantages, read through the third                                                                     

Speed and the refusal to license. The order's headline virtue is that it declines to install the state as a mandatory, ex ante third standing between a developer and the public: no permission slip to deploy. From the polycentric standpoint this is the virtuous abstention. But Peirce has already warned us it cannot produce a clean pair. Remove the named third and its function does not vanish; it migrates. Either the market's reputational order absorbs it (the desirable outcome) or the state reconstitutes itself informally, through a side door. The order builds exactly such a side door. "Zero friction" is therefore conditional: true only if the displaced third does not quietly reassemble elsewhere. Here it does.

The thirty-day head start. In offering critical-infrastructure operators a buffer to patch their systems before a powerful model goes public, the state casts itself not as authorizer but as the protective representative of an absent fourth party: the rural hospital or local utility that never sat at the table. This is its most defensible move, because it answers a genuine problem: the release of an offensive capability imposes uncompensated risk on parties who never consented, and even a thoroughly market-minded framework concedes that harms to non-consenting outsiders are somebody's legitimate concern. The contestable step is not that a third should act, but why it must be the monopolist. A syndicate of critical-infrastructure insurers demanding pre-release attestation, or an attested-hardware regime certifying capabilities, could discharge the same protective function without occupying a chokepoint. The order picks the monopolistic instantiation of a function that admits of plural ones. The function is sound; the form is a choice.

Protection of "American ingenuity." To serve as guarantor, the state must itself be trusted, so the order wraps its access in confidentiality and non-disclosure obligations. This is the state attempting to bind itself, to answer the oldest question about any third: who guarantees the guarantor? The difficulty is that the same government also wants the capability, for defensive hardening, and its cybersecurity pillar points toward offensive readiness as well. A third that is also a party: a potential buyer, user, even weaponizer of the very thing it reviews, cannot be the impartial third the framework needs. That a major developer was recently designated a national-security "supply-chain risk" by the defense establishment, shortly before releasing a powerful model, is not a footnote; it shows the third and one of the parties are entangled in fact, not just in theory. The non-disclosure regime is the state trying to purchase its legitimacy as third through pre-commitment. Whether that pre-commitment is credible, made by the institution that monopolizes both force and the power to classify, is the unresolved question on which the whole confidence-building edifice rests.

The three risks, read through the third

The honor system. That "voluntary" means "optional" is the most obvious worry, and the cleanest expression of the monopolistic-versus-polycentric tension; so it is where the critique most needs to be faithful with itself. An honor system is precisely a regime without a coercive third; it relies on the internalized third: reputation, the threat of losing "trusted partner" standing, the disapproval of peers. The polycentric reply to "national security cannot run on an honor system" is correct as far as it goes: reputation and market discipline genuinely are a third, a distributed one. But a reputational third disciplines the repeated player; it has almost no grip on the one-shot defector, the rogue domestic lab, the offshore developer, the actor willing to make a civilization-scale bet once. And the one-shot catastrophic defection is exactly the scenario national security exists to address. Worse, the capability does not stay where it can be watched: vulnerability-discovery reasoning of the kind that distinguishes today's frontier systems has been shown to be reproducible with openly available models. That collapses both thirds at once. A third (monopolistic or polycentric) can only constitute a relation it can perceive; and the government cannot assess what only the builders can see. This is a real limit of polycentric theory at the catastrophic tail, and it deserves to be met head-on rather than waved past.

The classified benchmark. This is the gravest defect from the standpoint of the rule of law, and where the order quietly contradicts its own logic. A constitutive third can function as law only if its criterion is knowable: Lon Fuller's elementary requirements that rules be public, prospective and intelligible. A classified benchmark means the third defines obligations whose content is secret. The boundary of "covered frontier model" becomes an unpublished norm: not nomos, the open and contestable law, but Arcanum, the secret of state.

And here the order produces its sharpest contradiction, which deserves to be stated without hedging: the executive order asks AI systems to become transparent while allowing the guarantor of transparency to remain opaque. The entire thrust of recent AI-governance work has been to demand legibility from the models: traceable reasoning, auditable logs, honesty about capability. The order demands precisely that legibility from the laboratories while rendering its own criterion illegible. The watchman insists on being watched by no one. The opacity that AI governance was built to cure at the level of the model reappears, one storey up, at the level of the state.

The de facto moat. Here the third displaced in the first advantage walks back in. Having declined to be the mandatory ex ante gatekeeper, the state reconstitutes itself as the de facto ex post gatekeeper through the "trusted partner" tier. This is Simmel's tertius gaudens exactly: the third that profits by setting the terms on which others must transact. A nominally voluntary program manufactures a focal point (a coordination signal around which insurers, defense contractors and enterprise buyers converge) so that the state becomes the de facto third of the entire market, and refusing to participate comes to look less like a free choice than like a confession. The effect is both cartelizing and regressive: large incumbents can absorb the cost of navigating the framework; open-source and resource-poor developers cannot. And the move is more insidious than honest licensing, not less because mandatory licensing is at least visible and reviewable, subject to notice-and-comment and judicial challenge, whereas a "voluntary" moat escapes administrative-law scrutiny precisely because it disclaims compulsion. A third that coerces through soft focal pressure is harder to constrain than one that coerces through hard law. The uncomfortable corollary, for the classical liberal especially, is that one might rationally prefer candid regulation to dishonest voluntarism.

The unifying thesis: the third went stealth

Lay the six readings beside the five-step logic and a single pattern resolves. The order does not retire the constitutive third of frontier-model release. It puts it in stealth mode. It moves the third out of the realm of nomos: a visible, ex ante, contestable guarantor bound by the disciplines of public law, and into the realm of Arcanum, a classified, ex post, focal and reputational power bound by nothing comparable. The tactical achievement is to let the state occupy the third position while stripping away the rule-of-law constraints that normally travel with it. "Voluntary" is not, on this reading, a retreat of the third. It is the third learning to move quietly.

Peirce supplies the deepest version of the point. The order sells itself as restoring a pair, lab and public, regulator removed. But there is no stable, unmediated pair in a rule-governed domain; a third is always constituting the relation. To appear to remove the third is therefore not to return to a free pair. It is to swap a legible third for an illegible one. The regulator was never eliminated. It was privatized and obscured.

audio-thumbnail
The Executive Order Debate
0:00
/1227.382993

What the critique owes in return

It would be too easy to end there, and the argument is stronger for conceding what it must. There is a serious case for the order's central instinct, and the polycentric tradition has not yet defeated it. If AI-enabled cyber-offense generates externalities at civilizational scale, falling on parties who never consented, then some third must constitute the release relation. And the only third with coercive reach against a one-shot catastrophic defector is, for now, the territorial monopolist. The polycentric answer either deny that the externality is that severe (a wager many will refuse) or build a polycentric third of comparable reach: underwriting syndicates that price catastrophic AI risk, attestation markets that certify capability, traceability infrastructure that makes a model's powers legible without a central licensor. That second exit is a construction project, not a slogan, and it must reckon with the same observability wall that limits the state: a third cannot bind what no one can see.

Read most generously, then, the June order is a placeholder third. A flawed occupant of a position that a more accountable, more plural architecture has not yet been built to fill. That reframing is also a charge. To object to the stealth third on rule-of-law grounds is legitimate and, I think, correct. But the objection only becomes a governing program when it produces a rival third that is at once visible, plural and capable. Legible where the classified benchmark is opaque, competitive where the trusted-partner tier is monopolistic, and able to reach the catastrophic tail that reputation alone cannot. Until that third exists, the state will keep the seat. The task is not merely to expose the guarantor that hides. It is to design one that need not.

As I am finishing this article, only days after the Executive Order's release, the suspension of foreign access to Anthropic's Fable 5 and Mythos 5 has provided an unexpected illustration of the argument developed here. The question was never whether the state retained ultimate authority. The question was whether the criteria governing that authority would remain visible and contestable.

Anthropic notes that Fable 5 was deployed with an architecture built around classification, monitoring, data retention, and layered security controls precisely because the company assumes that universal jailbreaks are likely unavoidable in the long run. This raises a deeper question: what distinguishes a tolerable risk from an intolerable one? If Anthropic is correct in arguing that all frontier models exhibit some form of non-universal jailbreak vulnerability, then the relevant criterion cannot simply be that "a jailbreak exists." Some additional threshold must be doing the decisive work.

Yet that threshold remains largely invisible to outside observers. The issue, therefore, is not the existence of a guarantor with the power to intervene. It is the opacity of the standard by which intervention is triggered.

And here the diagnosis must be sharpened. A constitutive third can take two legitimate forms: the State as a system issuing general rules (the Legislature, and the Executive when it regulates with genuine generality), and the Judiciary as the articulating, last-instance guarantor. But neither is present here. A singular, opaque act, addressed to a named party, without generality and without a real means of challenge, is not a third at all. It is a pole: one party exercising near-irresistible force over another, while the true third (the Judiciary) is virtually held off precisely because the opacity prevents the recipient from building the case that would activate it.

This is the final turn the episode reveals. The stealth third was never the deepest danger. The deeper danger is that the stealth third ceases to be stealthy and becomes brute force: the Executive operating as a singular pole, and using opacity so that neither the recipient nor the Judiciary can reclassify the act for what it is. The third has not merely become difficult to see. In this singular and opaque form, it has stopped being one.

Sources

Anthropic Says It’s Taking Claude Fable 5 Offline to Comply With US Government Order
“The government believes it has become aware of a method of bypassing, or ‘jailbreaking’ Fable 5,” the company said in a blog post.
WIREDMaxwell Zeff

Read more