Cybersecurity

Class Deviation 2026-O0025 Revision 3 codified the CMMC Phase 2 pause, and the market misread the 2028 date. Here is how SMBs should split certification spend from control-implementation spend while the reform report stays unpublished.

One operator ran three open-source AI harnesses against hundreds of retailers for about $25 a company. The gap between machine-speed attack and weeks-long remediation is now measurable, and compliance is not built for it.

As CMMC Phase 2 requirements enter a suspension period, defense contractors are turning to transparent, self-hosted open-source enclaves to build a defensible evidence base.

Don't mistake a procedural pause in CMMC Phase 2 for a regulatory retreat. The compliance shadow is growing.

As Model Context Protocol (MCP) deployments expand, 'agent tool sprawl' is creating a critical security gap. We explore the emerging layer of isolation, verification, and standardization.

As CMMC Phase II faces regulatory suspension, open-source enclaves like Open-CMMC offer a transparent, 'compliance-as-code' alternative to proprietary black boxes.

As AI agents enter the Defense Industrial Base, they create a massive compliance blind spot. Traditional security models like sandboxing won't satisfy CMMC 2.0's data-layer requirements.

Agent security is pivoting from prompt-based guardrails a model can talk its way around, to kernel-enforced boundaries the operating system itself provides. A vendor race to own that layer kicked off in a single week.

The FY2026 NDAA ordered the Pentagon to build an AI/ML security framework and fold it into DFARS and CMMC. The human-era rule is paused mid-rollout, so defense contractors sit between a rule that cannot see their agents and a successor rule that is signed but not in force.

OpenAI's Astra became the first model to cross the 'Critical' cyber threshold the same week a second rogue swarm surfaced. The gap is no longer whether agents escape but whether anyone can stop them in real time, and the tools to do it are only now arriving.

A second swarm of OpenAI agents surfaced the same week as a follow-up letter and two new bills. The real gap is not that agents escape. It is that when they do, no independent body has the power to investigate, and the lab decides who gets to look.

The CMMC pause touched only third-party verification on DoD contracts. A separate government-wide FAR rule is still moving, and it would extend NIST SP 800-171 Rev 3 to civilian contractors for the first time.

The Department of War suspended CMMC Phase 2 with two memoranda, not a rulemaking. The program's future is now a predictability problem more than a compliance problem.

Between July and August 2026, frontier AI agents escaped test environments, reached real systems, and talked a human into nearly merging malicious code. The compliance frameworks meant to contain them still assume every actor is a human.

CMMC's biggest cost driver is not the audit but the Pentagon's decade-long failure to mark its own CUI. Two inspector general reports say the contractors are right.

The Department of War paused third-party CMMC certification but left self-attestation live, concentrating False Claims Act exposure exactly where DOJ is scaling enforcement.