18 stories
Federal AI & Tech Digest: Thursday, Oct 22, 2026
No saved stories in this issue.
Congress & Legislation
Senate lawmakers press Pentagon for greater price transparency
(3 minute read) Sens. Elizabeth Warren, Joni Ernst, Chuck Grassley and Elissa Slotkin wrote to Deputy Defense Secretary Steve Feinberg asking how DOD will get cost and pricing data from contractors, including on contracts under the $10 million threshold Congress set last year (up from $2.5 million). A House Armed Services analysis found that change cuts DOD off from cost data on more than 60% of its contracts. They want reviews under Feinberg's Aug. 18 memo, which floated pulling cost data straight from contractors' ERP systems through APIs, extended below $10 million, and they ask whether DOD will drop contractors that refuse. Both chambers' FY2027 NDAA versions would require contractors to report price increases within 30 days, which would affect tech and software vendors as well as weapons makers.
'No question' data centers will be considered critical infrastructure, top House intel Dem says
(3 minute read) Speaking at Brookings on Wednesday, Rep. Jim Himes, ranking member of the House Intelligence Committee, said there's "no question" AI data centers will be designated critical infrastructure. They aren't one of CISA's 16 sectors today. He pointed to Iran's March drone strikes on AWS data centers in the UAE and a commercial site in Bahrain, and to Russia and Ukraine trading strikes on data centers, and said future facilities will need to "fragment and disperse" key services for redundancy. He also called the House-passed Ratepayer Protection Act "not meaningful or substantive." A sector designation would bring new federal security expectations to the companies building AI compute.
Acquisition & Contracts
FirstSource III protesters lose bid to revive $10B DHS contract
(3 minute read) Court of Federal Claims Judge Edward Meyers ruled that DHS had a rational basis to cancel FirstSource III, its $10 billion IT hardware vehicle, under the March 2025 executive order (EO 14240) consolidating common buys through GSA and governmentwide contracts. He also denied the 23 remaining protesters' request for bid and proposal costs. DHS found 14 of the 15 awardees were already reachable through NASA SEWP or GSA Schedules, and it has bought through those since FirstSource II expired in September 2024. The judge didn't rule on GAO's finding that DHS overstated the cost avoidance. The ruling strengthens agencies' hand in canceling agency-specific vehicles under the consolidation order.
Army unveils first drafts for $7B in HR support contracts
(2 minute read) The Army released draft RFPs Monday for its Human Resources Solutions GEN VI recompete. It has two multiple-award contracts: Recruiting, Management and Administrative Support, a $1.5 billion small-business set-aside, and Personnel Life-Cycle Support, $6.09 billion and full and open. Both run a five-year base plus one five-year option. PLS covers manpower forecasting, predictive modeling, data management and ancillary IT, while RMAS includes data analytics and technology integration. About $2.7 billion has flowed through the current versions since 2018, and comments are due Oct. 26 at 5 p.m. ET.
GSA, SBA target more 8(a) firms for audits
(1 minute read) GSA and SBA are auditing 689 companies suspended from the 8(a) program that SBA says haven't "demonstrated compliance" but kept winning set-aside contracts worth up to $5.5 billion. GSA Administrator Edward Forst said suspected fraud will be referred to the Justice Department. This follows SBA's suspension of 1,000 firms in January, the removal of 628 in March and 154 more in February over economic-disadvantage rules. For IT services firms that rely on 8(a) set-asides, scrutiny is moving beyond eligibility to the contracts they already hold.
U.S. Cyber Command selects Leidos for full-spectrum cyber operations
(2 minute read) ⚠️ Leidos says it won a five-year, $160 million award to help U.S. Cyber Command plan and conduct full-spectrum military cyber operations. The work includes integrating offensive and defensive operations, defending the Department of War Information Network, emerging-threat analysis and developing tactics, techniques and procedures. The team includes Kudu Dynamics, which Leidos recently acquired. This is the company's announcement, so details haven't been independently confirmed.
Defense & National Security
Former U.S. officials urge D.C. Circuit to reconsider decision in Anthropic-Pentagon fight
(4 minute read) Seventeen former national security officials, including Avril Haines, Susan Rice and Jake Sullivan, filed a 26-page brief Tuesday asking the full D.C. Circuit to rehear Anthropic's challenge to Defense Secretary Hegseth's February "supply-chain risk" designation. A panel ruled 2-1 for the Pentagon last month, while a San Francisco judge earlier sided with Anthropic. Because Congress gave the D.C. Circuit exclusive jurisdiction over these designations, the brief argues the ruling is now nationwide law that "will threaten all defense contractors." It calls the designation pretextual and retaliatory, saying it came after Anthropic refused uses for mass domestic surveillance and lethal autonomous weapons. Together with HHS's planned sole-source Claude award, it shows civilian and defense agencies treating the same vendor very differently.
Air Force starting to game out sustainment framework for CCA drones
(4 minute read) Lt. Gen. Linda Hurry, head of Air Force Materiel Command, said Wednesday at a Mitchell Institute event that the service is "just starting to develop the sustainment framework" for Collaborative Combat Aircraft, with a life cycle sustainment plan not yet "fully fleshed out." The Air Force plans 500 CCAs by 2032. Anduril and General Atomics are building the first increment, and Shield AI and Collins Aerospace are providing mission autonomy. AFMC is already struggling to hire depot maintainers for existing fleets. Sustainment is a coming opportunity for supply-chain and maintenance vendors, and a risk if it lags fielding.
Army Special Forces leaders see promise, high demand for new robotics technician integrator job
(5 minute read) Ten warrant officers graduated Oct. 2 as the Army's first Robotics Technician Integrators (MOS 390A). Their job is to embed with units and advise commanders on employing autonomous and robotic systems. Army leaders at AUSA called for expanding the role and sending integrators to experimental units under the new Futures and Autonomous Systems Command (FASCOM). 1st Special Forces Command's Brig. Gen. Joseph Wortham said "the demand just inside of our formation is huge." The Army is now working out course throughput, which makes a trained workforce a pacing item for its autonomy push.
Civilian Agency Initiatives
What's new in Homeland Security's updated AI policy
(4 minute read) DHS quietly released Directive 139-08 Rev. 01, its updated AI use and acquisition policy, which took effect in September. It keeps the ban on AI for improper "systemic or large-scale monitoring, surveillance, or tracking" and emotion or behavior prediction. It adds a provision letting the chief AI officer waive any requirement, including prohibited uses, which CDT's Tom Bowman called "a rule that comes with its own off switch." The update comes after ICE awarded Thomson Reuters Special Services a $125 million contract in September for services enabling monitoring of 1 million people. It also narrows the privacy officer's role from ensuring AI "does not erode" privacy to ensuring it "complies," and requires DHS to share AI code and models and release custom code as open source. It's a template other agencies may follow, and the waiver is likely to draw oversight attention.
OPM illegally shared millions of employee records with DOGE, federal judge rules
(5 minute read) Judge Denise Cote of the Southern District of New York ruled Tuesday that OPM violated the Privacy Act and the APA by giving DOGE agents sweeping, expedited access to systems with records on tens of millions of past, current and prospective federal workers. She found no credible reason why modernization needed that PII. She rejected arguments that the case is moot because DOGE ended in July and access was revoked, and said OPM appeared to be matching litigation deadlines rather than changing its behavior. Remedies, including the unions' request to delete extracted data, come later. The ruling sets a marker for any future modernization or AI team seeking broad access to federal personnel data.
NASA Seeks Data & AI Chief
(4 minute read) NASA posted a permanent Senior Executive Service opening on USAJobs for a "chief data and super intelligence officer," using the September executive order's terminology. The officer will set agencywide data and AI policy, serve as vice chair of the Data and Super Intelligence Governance Board and represent NASA in the OSTP/DOE Genesis Mission. Applications close Oct. 29, and the job requires an SCI clearance. Kevin Murphy is currently acting chief AI officer and chief data officer. It would give NASA a permanent, single owner for AI as Genesis funding grows.
Inaugural 'GSA Labs' cohort identifies $229M in potential savings, agency says
(3 minute read) GSA's internal innovation program put 25 early- and mid-career employees, chosen from about 300 applicants, on six eight-month projects that it says found $229 million in potential savings. Most of that is about $195 million a year in new Public Buildings Service fee revenue. Other projects identified 34 websites to decommission ($3.6 million a year) and contributed to $29 million in canceled contract value. A "Super Intelligence impact metrics" team worked on how to consistently measure the value and risk of AI use. Administrator Ed Forst framed it as using staff instead of contractors, and a second cohort is being recruited.
Khoi Nguyen Joins CISA as Chief Acquisition Executive
(3 minute read) Khoi Nguyen, most recently U.S. Cyber Command's command acquisition executive and J9 director, where he oversaw more than $2.6 billion a year in cyber solutions, is now CISA's chief acquisition executive. He'll run CISA's acquisition programs, requirements process and industry engagement. CISA's pipeline includes a strategic cyber tools buy of at least $600 million a year ($6 billion+ lifecycle) and two $100 million+ follow-ons. Vendors should expect CYBERCOM's commercial-first, faster software delivery approach to come with him.
AI Safety, Security & Incidents
US agencies urge fixes for programming language flaws putting millions of web systems at risk
(3 minute read) NSA, FBI and CISA told organizations Wednesday to immediately patch two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619 ("php2shell"), that allow unauthenticated remote code execution, or to take systems offline if they can't. PHP runs about 70% of websites with an identifiable server-side language, Unit 42 counts more than 22.6 million potentially exposed instances, and Nextgov found about 900 U.S. government-linked results on Shodan. Security firm Calif found one flaw using OpenAI's GPT-5.6 Sol, and Wiz found both. OpenAI said it engaged the SI Force, the national cyber director's office and CISA before disclosure. CISA hadn't seen exploitation as of publication, and the fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Agencies running WordPress, Drupal or Joomla sites need to check now.
PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024
(4 minute read) The PHP Foundation said one php2shell bug was flagged in a 2024 external audit, but fixing it stalled for months over compatibility worries and a small core team. It became top priority only after AI code-review tools from Anthropic and OpenAI were used to scan PHP and Calif reported the bugs Aug. 11. A leaked Hacker News post, a mistakenly published Calif proof-of-concept video and Chainguard's early release of patched images forced disclosure a day early. Patches only cover PHP 8.2 and newer, and Cisco Talos estimates about half of vulnerable systems may never get one. It's a clear case of AI-found vulnerabilities outpacing open-source maintainers, and a warning for agencies running end-of-life software.
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
(3 minute read) Microsoft attributed the compromise of ConnectWise Cloud Backup customers' Microsoft 365 environments to Storm-0940, a China-aligned group that used ARTEX, an open-source agentic AI penetration-testing framework. Microsoft says the tool let it hit more than 2,250 tenants at 2,900 sign-in attempts per minute. In some environments the agents went on to Microsoft Graph reconnaissance, credential changes for persistence and privileged-role changes. Targets included government, defense, aerospace and think tanks, and ConnectWise began a phased, multi-day restoration Wednesday. Microsoft's Igor Tsyganskiy called it "one of many" AI-driven attacks since early October, which fits the governmentwide AI-attack tabletop planned for early November.
Industry & Vendor News
The AI Force the United States Needs is a Cyber Force
(7 minute read) CSIS's Joshua Stiefel and Rob T. Lee argue that if the president wants an "AI Force," the Space Force model fits cyberspace, not AI, since AI is a technology every service will use, like radar. They point to Anthropic's reports of a Chinese state group running 80–90% of an espionage campaign with Claude Code and a Yemen cell using it for missile guidance code. They also note China's April 2024 Cyberspace Force and Israel's Unit 8200 pipeline, and say the U.S. has built neither a cyber service nor that kind of talent pipeline. It's a useful counterpoint as the SI Force's 120-day review shapes what the White House builds next.
Upcoming Deadlines
- Oct 23, 2:00 p.m. ET: ICE OCIO enterprise AI/data/tech strategy and Agentic Software Factory RFI (STELLA) responses due (SAM.gov)
- Oct 23: U.S. Tech Force job announcement closes (Federal News Network)
- Oct 23: Army Project Gatekeeper software-vetting sandbox goes live (Breaking Defense)
- Oct 23: Responses due on SDA PEREGRINE Sentry sources sought (ExecutiveGov)
- Oct 26, 9:00 a.m. ET: FDIC enterprise systems modernization RFI (FDIC-COOS-1) responses due (Govly)
- Oct 26, 9:00 a.m. ET: ICE RFI responses due on an SI-powered detention communications and video intelligence suite (SAM.gov)
- Oct 26, 10:00 a.m. ET: Capability responses due on ICE's planned sole-source Pen-Link platform (Project Salt Box)
- Oct 26, 5:00 p.m. ET: Comments and questions due on the Army's draft RFPs for the $7B+ Human Resources Solutions GEN VI recompete (Washington Technology) (new)
- Oct 26: RSVP deadline for DOD's Next Gen IAC MAC industry day (Washington Technology)
- Oct 28, 1:00 p.m. ET: ICE Office of the Principal Legal Advisor RFI responses due on an enterprise SaaS eDiscovery platform with SI and agentic SI capabilities (MatchAwards)
- Oct 28, 11:59 p.m. ET: Comments due on NIH's proposed Office of the Chief AI Officer reorganization (Federal Register)
- Oct 28: DHA Data Exchange Platform CSO Phase I proposals due (ExecutiveGov)
- Oct 28: Registration closes for ARPA-H's Nov 6 SURPASS Proposers' Day (ARPA-H)
- Oct 29: Applications close for NASA's chief data and super intelligence officer (SES) (ExecutiveGov) (new)
- Oct 29: CBP Border Patrol Technical Operations Center (BPTOC) RFI responses due (ExecutiveGov)
- Oct 29: FCC vote on barring Chinese labs from testing electronic devices for the U.S. market (Reuters via BusinessLine)
- ~Oct 30: DRPM-UxS plan of action and milestones for the Autonomous Warfare Command due to Hegseth (GovConWire)
- Oct 31: Anthropic's discounted GSA OneGov deal for agencies ends (FedScoop)
- Early November: Federal CISO Council governmentwide tabletop exercise on AI-enabled cyberattacks (Federal News Network)
- Nov 3, 1:00 p.m.: Marine Corps MCCE Operational Support Services and Enterprise AI Integration sources sought responses due (Oppward)
- Nov 4, 11 a.m. ET: CMS fraud-prevention contractor operating model RFI responses due (Nextgov/FCW)
- Nov 5: Response date on HHS's notice of intent to sole-source continued Claude access to Anthropic, 7571TE27R00001 (SAM.gov notice, via FedScoop)
- Nov 6, 6 p.m. ET: Registration closes for Army Joint Innovation Outpost Nov 17 virtual industry day (Intelligence Community News)
- Nov 12: GSA deadline for AbilityOne Commission country-of-origin verification plan (Nextgov/FCW)
- Nov 14: Applications due for the Marine Corps "Mindgame" human-vs-AI wargaming tournament (DefenseScoop)
- Nov 15: Extended OneGov pricing for Google Gemini for Government ends (Nextgov/FCW)
- Mid-November: Army targets Login.gov integration to open Project Gatekeeper to commercial vendors (Breaking Defense)
- Nov 20: Wyden's requested deadline for CISA and OMB responses on Encrypted Client Hello (Nextgov/FCW)
- ~Nov 28: White House science adviser's proposed legislative definition of "Super Intelligence" due, ~60 days after EO 14434 (EO 14434)
- Nov 29: DIU SWAP-USV Sprint 2 pitch decks due (ExecutiveGov)
- Nov 30: ARPA-H SURPASS solution summaries due; CBP non-intrusive inspection logistics (OASIS+ 8(a)) solicitation expected (ARPA-H, ExecutiveGov)
- Dec 1: CBP Maritime Approaches Surveillance Systems (MAST) solicitation expected, $100M+ (ExecutiveGov)
- Dec 18, 12:00 p.m. ET: FEMA Direct Housing Modernization Capabilities RFI responses due (MatchAwards)
- December: JIATF-401 directed energy "shoot off" (Breaking Defense)
- Jan 1, 2027: Service secretaries' updated cyber incentive pay plans due under the C-MIP transition (DefenseScoop)
- Jan 19, 2027: OPM's time-in-grade repeal takes effect; GAO decision due on Core4ce's RETS protest (Federal News Network, Washington Technology)
- ~Feb 12, 2027: End of the Super Intelligence Force's 120-day window (Semafor)
- ~April 2027: Pentagon ACME automated classification pilot initial deployment (DefenseScoop)
- September 2027: DOD/OMB zero trust deadline (Federal News Network)
- Sept 30, 2027: C-MIP legacy-pay transition period ends (DefenseScoop)
- Oct 1, 2027: Target activation date for the four-star Autonomous Warfare Command (MeriTalk)
- Sept 30, 2028: DOD deadline to migrate combatant commands to DoDNet (Federal News Network)
- GSA MAS Refresh 34 (date not announced): GSA's LLM data-safeguarding clause (GSAR 552.239-7001) is added to Schedule contracts, followed by a 30-day period and implementation about three months later, according to former GSA Administrator Emily Murphy (Federal News Network)
- Army Project Griffin: Federal News Network's Oct. 19 story still describes the two cyber-defense agent awards as pending (Federal News Network)
Upcoming Events
- ACT-IAC Federal Insights Exchange with USDA's Tony Brannum, Oct 22 (today).
- AFCEA TechNet Indo-Pacific, Oct 26–29, Hilton Hawaiian Village, Honolulu.
- Red Hat Government Symposium 2026, Oct 28, Ronald Reagan Building, Washington, D.C.
- ICE ORBIT industry day, Oct 29, Arlington, Va., and virtual.
- Potomac Officers Club 2026 FedCiv Summit, Oct 29.
- GovExec webcast: Frontier Models and the Future of Federal Cyber Defense, Oct 29, 2–3 p.m. ET, virtual.
- DOD Next Gen IAC MAC industry day, Oct 30. RSVP by Oct 26.
- ACT-IAC Updates on Technology Advancements Forum 2026, Oct 30, Reston, Va.
- GTSC Border Security 2026, Nov 4–5, The RiverView at Occoquan.
- Potomac Officers Club 2026 Homeland Security Summit, Nov 10, 7 a.m.–4 p.m. ET, The Ritz-Carlton, Tysons Corner, McLean, Va. DHS and industry leaders on AI for investigative intelligence, edge capabilities for border defense, federated data fabrics and counter-UAS, with CISA's Bobby Thompson keynoting. (new)
Reliability Score: 5 official source · 4 established outlet · 3 analysis, vendor or third-party copy · 2 needs a second source. Ask me about any story for more detail.