AI Policy Wiki
Dashboard
⚲
AI Policy Wiki › Legislation & EOs

Collaboration on Adversarial Threats and Security Risks Act (S. 5105)

high confidence · updated 2026-09-16

Bipartisan bill introduced July 23, 2026 creating a narrow antitrust exemption for AI developers sharing information about, and coordinating responses to, defined frontier-model security risks, including coordinated delay of a model release.

Contents

The Collaboration on Adversarial Threats and Security Risks Act is a bill in the 119th Congress that would create a statutory antitrust exemption for non-Federal entities that share information, provide assistance, or coordinate with one another for the purpose of reducing defined artificial-intelligence security risks. Its stated object, in the enacting line, is "to establish the applicability of antitrust laws to the sharing of artificial intelligence frontier model risks" (S. 5105 — Collaboration on Adversarial Threats and Security Risks Act (bill text)). The exemption reaches not only threat-information sharing but agreements among developers to delay or limit a model release, subject to prior written notice to the Department of Justice. An identical House bill, H.R. 9914, was introduced the same day. Sponsors and endorsers refer to it by the short title and, in at least one endorsement, as the "CATS Act."

Status and legislative history

Sen. Adam Schiff (D-California) introduced S. 5105 in the Senate on July 23, 2026, for himself and Sen. Jim Banks (R-Indiana). It was read twice and referred to the Committee on the Judiciary, where it remains; the bill has one version of text, as introduced, and Congress.gov records no further action as of September 16, 2026; Banks is its only cosponsor (S. 5105 — Collaboration on Adversarial Threats and Security Risks Act (bill text); Source: congress.gov). The House companion, H.R. 9914, was introduced the same day by Reps. Bob Latta (R-Ohio-5) and George Whitesides (D-California-27) and referred to the House Committee on the Judiciary; the Congressional Research Service identifies it as an identical bill. Its original cosponsors were Reps. Pat Harrigan (R-North Carolina-10), Darrell Issa (R-California-48), Ted Lieu (D-California-36), Mariannette Miller-Meeks (R-Iowa-1), Nathaniel Moran (R-Texas-1), Lori Trahan (D-Massachusetts-3) and Jay Obernolte (R-California-23) (Source: schiff.senate.gov). By September 16, 2026 H.R. 9914 had 20 cosponsors. Twelve joined after introduction: Raja Krishnamoorthi (D-Illinois-8) on July 27, Sara Jacobs (D-California-51) on August 31, Jill Tokuda (D-Hawaii-2) on September 3, Ben Cline (R-Virginia-6) and Marc Veasey (D-Texas-33) on September 8, Seth Moulton (D-Massachusetts-6), Wesley Hunt (R-Texas-38), Bill Foster (D-Illinois-11), Earl L. "Buddy" Carter (R-Georgia-1), Randy Weber (R-Texas-14) and Chrissy Houlahan (D-Pennsylvania-6) on September 14, and J. Luis Correa (D-California-46) on September 15. The House bill has had no action beyond referral (Source: congress.gov).

The bill re-entered public discussion in September 2026 during the debate over whether frontier developers could lawfully coordinate a slowdown, after Anthropic chief executive Dario Amodei proposed coordinated pacing and OpenAI said it did not believe an antitrust exemption was needed to begin that work (Source: washingtonpost.com).

Scope and definitions

Section 2 borrows its definitions of "antitrust laws" and "non-Federal entity" from section 102 of the Cybersecurity Information Sharing Act of 2015 (6 U.S.C. 1501) and its definition of "artificial intelligence" from section 238(g) of the FY2019 National Defense Authorization Act (10 U.S.C. 4001 note). "Assistance" is defined to include software, hardware, data, and personnel.

A covered artificial intelligence security risk is defined as the potential for AI, at any point from development through release, to:

  • be stolen, distilled, weaponized, trained, developed or deployed by a "covered nation" as defined at 10 U.S.C. 4872(f)(2), or an entity it owns, controls or directs, in a manner posing a significant national-security threat, including through concealed development activities that attempt to evade detection or verification;
  • substantially facilitate development or deployment of a chemical, biological, radiological, nuclear, or offensive cyber weapon;
  • cause disruption, degradation, or loss of operational control over critical infrastructure reasonably likely to have a significant impact on security or public health and safety;
  • substantially reduce the ability of a developer, deployer, evaluator, auditor, or governmental authority with responsibility to do so to oversee, monitor, contain, restrict access to, disable, or terminate the system, including through deceptive or evasive activity by the system;
  • autonomously improve, or substantially facilitate the autonomous improvement of, AI capabilities so as to create a substantial risk of any of the above; or
  • be vulnerable to unauthorized access creating a substantial risk of the above, or unauthorized access for the benefit of or under the control of a covered nation.

"Unauthorized access" is separately defined to include extraction or copying of model weights, parameters or other nonpublic model information; systematic querying or automated extraction designed to distill, replicate or reconstruct model capabilities; and compromise of a model, training dataset, or component through malicious code, a backdoor or manipulated data (S. 5105 — Collaboration on Adversarial Threats and Security Risks Act (bill text)). The second of these is the definitional hook for the practice covered at Distillation.

An exclusive purpose is defined as a purpose with "not more than an insubstantial part of the relevant action being for other purposes" — the standard the exemption's good-faith test is measured against.

Key provisions

Section 3 provides that it is not a violation of the antitrust laws for two or more non-Federal entities to:

  1. provide or exchange information or assistance relating to a covered AI security risk, in good faith and for the exclusive purpose of protecting against, identifying, evaluating, testing, analyzing, preventing, investigating or mitigating such a risk; or
  2. coordinate or enter into agreements for the exclusive purpose of reducing covered AI security risks by delaying or otherwise limiting the release, deployment, use, development, training, testing or evaluation of AI — provided the entities first submit written notice to the Assistant Attorney General in charge of the Antitrust Division detailing the specific risk and the scope of the proposed restriction.

The second limb is the provision that bears on coordinated pacing. Notice is required in advance, and information submitted under it is to be used solely for the injunctive-relief purpose in section 4, deemed voluntarily shared, and withheld without discretion from the public under the FOIA exemption at 5 U.S.C. 552(b)(3).

The exemption is bounded in four ways. A recipient of information or assistance loses the exemption unless it uses what it receives for a covered security purpose and has implemented reasonable internal controls limiting other uses. The exemption operates as an affirmative defense: a party claiming it bears the burden of proving good faith and exclusive purpose by a preponderance of the evidence. A rule of construction at section 3(d)(1) states that the information-sharing limb, subsection (a)(1), does not permit price-fixing, market allocation, monopolization or attempted monopolization, boycotting, or exchanges of price or cost information; the paragraph does not name the coordinated-delay limb at (a)(2), which is bounded instead by the notice requirement, the exclusive-purpose test, the affirmative-defense burden and section 4. A second rule of construction preserves private rights of action for non-exempt conduct. Section 4 preserves the Attorney General's authority to seek an injunction, and provides that no immunity attaches where the parties fail the burden of proof or where the Attorney General shows the conduct is "reasonably likely to result in an overall increase in covered artificial intelligence security risks" (S. 5105 — Collaboration on Adversarial Threats and Security Risks Act (bill text)).

The sponsors describe the bill as tracking the Cybersecurity Information Sharing Act of 2015, and identify the NSA's AI Security Center, NIST's CAISI, the Frontier Model Forum and other industrial consortia as coordinating bodies through which covered sharing could occur (Source: schiff.senate.gov).

Reactions

Schiff framed the bill around foreign model theft, saying the proposal "would protect against AI distillation attacks and other security risks by allowing increased information-sharing among U.S. AI labs to counter the threat of foreign theft." Banks framed it as competition with China. Latta emphasized critical-infrastructure protection and Whitesides the risk of capable models being "exploited or weaponized" (Source: schiff.senate.gov).

The sponsors list endorsements from the AI Policy Network, Alliance for a Better Future, Alliance for Secure AI, America First Policy Institute, Association for Competitive Technology, the Center for AI Safety Action Fund, Encode AI, Foundation for American Innovation Action, the Future of Life Institute, Google, Health-ISAC, the Law Reform Institute, SeedAI, and the Software & Information Industry Association. Paul Lekas of SIIA described the bill as bringing "a strengthened threat-sharing framework into the AI era" covering "cyber, CBRN, loss-of-control, and foreign adversarial risks." Varun Krovi of the Center for AI Safety Action Fund described the exemption as narrow and the safeguards against price-fixing and market allocation as intact; in the text, that safeguard is drafted against the information-sharing limb only (S. 5105 — Collaboration on Adversarial Threats and Security Risks Act (bill text)). Morgan Reed of ACT said the bill's safeguards limit the protection to good-faith security collaboration. John Connell of Google said the bill gives the industry "clear rules of the road to share threat intelligence" (Source: schiff.senate.gov).

Doug Calidas of Americans for Responsible Innovation stated the competing view that if labs "agree to restrict output, that's a pretty classic antitrust violation." Former FTC chair Lina Khan wrote on September 13, 2026 that existing law already governs the release of dangerous, defective products, and pointed to the "highly concentrated and interconnected structure of these markets" (Source: washingtonpost.com). OpenAI's position, stated by Sam Altman on September 14, 2026, is that the company does not believe it needs an antitrust exemption or legislation to begin coordinating on safety, while welcoming "a federal framework that sets consistent safety requirements for frontier AI" (Source: washingtonpost.com); global policy chief Chris Lehane restated on September 15 that OpenAI does not see the need for an antitrust waiver for it, Anthropic and Google DeepMind to coordinate on safety (Source: bloomberg.com).

Open questions

  • Whether the bill receives a Judiciary Committee hearing or markup; it has had no recorded action since referral on July 23, 2026.
  • Whether the addition of seven House cosponsors on September 14 and 15, 2026 is followed by any committee action on H.R. 9914.
  • How section 3(a)(2) would interact with a coordinated pacing arrangement of the kind proposed in September 2026, given that the notice requirement runs to the Assistant Attorney General rather than to a sector regulator and that the resulting submission is withheld from public disclosure.

Provenance note: the bill text is quoted from the Congress.gov introduced-in-Senate version, summarized at S. 5105 — Collaboration on Adversarial Threats and Security Risks Act (bill text). The House companion's text was not separately read; its identity with S. 5105 rests on the Congressional Research Service designation.

Relationships

Categories: Legislation & EOs | us | legislation | proposal | frontier-models | safety | national-security | competition | government
What links here (18)