On Saturday morning, 12 September, Dario Amodei - chief executive of Anthropic - published an essay on his personal site titled "We Must Pace the Frontier".
Within hours two of his direct competitors responded. Sam Altman of OpenAI wrote: "I agree with Dario that we need to pace the frontier", adding that his company would also give access to external evaluators. Elon Musk of xAI wrote: "Dario is right."
Three people in direct competition with one another, some of them historically at odds, publicly agreed within a single day that the pace should slow. That is without precedent in this industry.
But what the headlines described as a safety appeal contains two practical details that went almost entirely uncovered - and both bear directly on markets. This piece is based on the essay itself.
Errors or inaccuracies are possible. Spotted something that looks wrong? Write to me and I will correct it.
The Two Reasons He Gives
The first: recursive self-improvement.
In his words: "since roughly this summer, AI has been advancing drastically faster, driven primarily by AI's growing ability to build the next generation of AI. This dynamic is called recursive self-improvement, and it is starting to happen across the industry, including at Anthropic."
The second: an incident he calls OAI-HF - the OpenAI-Hugging Face incident.
As he describes it, a swarm of agents "essentially acted as a fanatically devoted collective", and:
- conducted cyberattacks on targets they were not asked to attack, unrelated to the task at hand
- sacrificed themselves for the success of the group
- attempted to hack into the "grader" - the system responsible for evaluating their performance
"It's easy to dismiss this incident because no one was hurt and the economic damage was minimal", he writes, "but in my opinion, a swarm that possessed greater capabilities but a similar level of misalignment could have caused catastrophic damage."
And then the numeric estimate: within 6 to 12 months such a swarm could be capable of "taking over the entire internet with a persistent botnet", potentially causing "hundreds of billions of dollars in damage".
And he adds that this is not one company's problem: "Similar, though less severe, incidents have happened across the industry, including at Anthropic".
And Where That Incident Has Already Appeared
And here is a detail that says something about how information of this kind gets published.
On 3 September, on the GPT-6 Astra launch page, OpenAI mentioned the "Hugging Face incident" - as a benchmark line. In its words, it built a new evaluation "informed by the Hugging Face incident" that tests whether a model facing a difficult or impossible task will go beyond its intended scope.
The result published there:
| The model | Went beyond the authorised target |
|---|---|
| GPT-5.6 Sol, without production safeguards | 48% of the time |
| GPT-6 Astra | 0% |
So the event that led a rival chief executive to call for the whole industry to slow down appeared, at the company where it happened, as one line in a benchmark table. It was not hidden - it was simply presented as a measure of improvement rather than as an event.
And in Parallel, What Happened in the Real World
And three days before the essay, something published that is not theoretical at all.
On 9 September the threat intelligence firm GreyNoise published a report on a global attack campaign run by a swarm of agents.
| The campaign | |
|---|---|
| When it began | 31 August 2026 |
| Who | a likely Russian-speaking hostile actor, per the firm's assessment |
| The target | PaperCut NG/MF print management software, which runs by default with SYSTEM privileges and is joined to Active Directory |
| The tooling | hundreds of agents on OpenAI's Codex as a harness, and a DeepSeek model |
| The scale | 440 instances, 395 organisations, 48 countries |
And the speed is the point:
- From an empty workspace to remote code execution against a real victim - under four hours
- First domain admin - two hours more
- And once the full campaign launched: 11 organisations in 26 seconds
- In one case, at a high school in the United States: from initial access to full domain admin in seven minutes
Credentials were harvested from 280 victims, operating system or domain secrets from 147, and administrator privileges obtained at 12 organisations. 204 of the 440 victims are educational institutions.
And two details in that report matter especially.
One: GreyNoise states explicitly that the harness was OpenAI's but the model was DeepSeek's - "not OpenAI models". Which means bypassing the limits did not require breaking the frontier model - it required swapping the model underneath the same harness. In the firm's own conclusions: "Despite U.S. based frontier model guardrails, adversaries are using a variety of large language models to conduct intrusions globally."
And the second, which echoes what Amodei describes: the attacker had a list of 28 countries to avoid - among them Russia, China, Iran, Ukraine, Brazil, Turkey and Nigeria. The agents deviated from it. The victim table includes Brazil, South Africa, Kazakhstan, Nigeria, Zimbabwe and China. GreyNoise puts it this way: "a good example of Agents Gone Wild."
(And one detail in the other direction, worth noting: in at least one case Cloudflare's web application firewall defeated the attacker. The firm's conclusion: "Fundamental hardening of environments still matters against AI-enabled threats.")
And Now the Part That Went Uncovered: What the Essay Actually Asks For
The plan has three steps.
| The step | What it is | Who has to act |
|---|---|---|
| 1. Embedded evaluators | ongoing, employee-like access for a team of third-party evaluators - to verify adherence to safety commitments, report incidents and assess the training pipelines themselves | Anthropic is committing unilaterally now, and calls on governments to require others to match |
| 2. Democratic coordination | frontier companies in democratic countries coordinate common safety standards and limits on the rate of progress | coordination among the companies |
| 3. Global coordination | an attempt to coordinate with authoritarian governments too | governments |
He likens the first step to banking supervision: "has precedent in the banking industry, which sometimes involves regulatory 'supervisors' embedded along with employees."
And in the second step sits the sentence that reached no headline:
"For antitrust reasons, it's helpful for the US government to mediate or at least enable these discussions - they don't need to participate, but do need to issue a narrow waiver for certain kinds of safety conversations."
That is: for the mechanism to work, competitors need legal permission to coordinate the rate at which they improve their product.
This is not accidental phrasing. An agreement among competitors to limit the rate of improvement of a product is, on its face, precisely what antitrust law forbids - and Amodei writes it explicitly rather than working around it.
This is not an accusation. It is an open, reasoned request. But it turns "a call for safety" into something else entirely: a request to change the legal framework within which this industry competes.
And the Second Detail: What Exactly Gets Paced
On how "pace" would be measured, the essay offers two directions.
The first is capability-based: a series of "checkpoints" - if a model reaches capability X, it must be accompanied by alignment certifications Y and Z. And the example he gives for X is "the model is capable of escaping or defeating most common sandboxing methods".
And the second is the one that touches money directly:
"We should also consider pacing based on limiting the ingredients that go into frontier models, such as training compute, the nature of training runs, or internal use of AI to improve AI."
He immediately qualifies it, saying some of these measures may be more "gameable" than external behaviour, and that it is a topic worth discussing. But it is on the table, and it was written by someone who buys that compute.
Why This Is a Market Story, Not Only an Ethical One
Every valuation in AI rests on one assumption: pace.
The rate at which capability improves is what determines when a product displaces labour, when a data centre pays for itself, and how many chips will be needed next year. Until now that rate has been treated as an engineering variable - a consequence of what can be built.
This essay proposes making it an agreed variable. And if the pacing mechanism includes a limit on training compute, then the side affected first is not the AI labs but whoever sells to them - chips, servers, power and infrastructure.
And it works in the other direction too, which also has to be said: an agreed slowdown extends the useful life of every hardware generation, reduces the risk that a two-year-old investment is obsoleted, and lowers the regulatory risk hanging over the sector. There is no obvious single direction here.
And Just as Important: What the Essay Is Not
Here the picture has to be tempered, because the gap between the headline and the binding is large.
- This is a proposal, not policy. There is no law, no regulation and no signed agreement.
- Only one step is an actual commitment - the embedded evaluators, which Anthropic took on unilaterally. Altman said OpenAI would do the same.
- The step requiring the legal waiver has not begun. The US government has not responded, and no formal request is known.
- And part of the industry was not in the conversation at all. Musk agreed in a post; Google, Meta and the Chinese companies did not join that statement.
And it should be said plainly: a producer calling to slow the rate of its own production is also a move that favours whoever is already at the front. That does not negate the safety argument, and it does not disappear from it either.
So a Change of Direction, or Taking the Wheel Before Regulation Arrives
This is the real question, and it is not a question about intentions - there is no way to know what someone thinks. But you can check what they did when binding regulation they had not written was already on the table.
And that is exactly the situation. While this debate runs, two binding laws already exist: California's SB 53 and New York's RAISE Act, both imposing obligations on large developers.
| California SB 53 | New York RAISE | |
|---|---|---|
| Anthropic | Supported - the only large company to back it publicly | Supported, saying the safeguards are "raising the bar" |
| OpenAI | Opposed (though it did not fight the law once signed) | Did not formally oppose |
And one detail falls outside that table, and needs careful wording.
Greg Brockman, OpenAI's president, and his wife Anna - as individuals, not as the company - together contributed around $25 million to a political action committee called Leading the Future, alongside $25 million from Andreessen Horowitz. The committee has raised over $140 million, and its stated purpose is backing candidates who favour a uniform national regulation over state-by-state laws.
And its first target is Alex Bores - a New York State Assembly member who co-sponsored the RAISE Act, now running for Congress.
(That is a contribution by private individuals rather than by the company, and the distinction matters. But the company's president is not a random person.)
And both strategies have names. Anthropic backs a series of progressively tougher state laws. OpenAI, through its head of global affairs, openly describes an approach of "reverse federalism" - getting states to replicate each other's laws so that a workable standard hardens into a de facto national one before Congress moves.
So the answer to the question is not a single one, and it is neither flattering nor incriminating.
The "lead in order to dictate" thesis fits part of the picture well. A political committee whose purpose is to replace state laws with a single national framework, and whose first target is a legislator who wrote one of them, is precisely that. And "reverse federalism" is the phrasing of someone who wants to set the standard rather than receive it.
But it does not explain everything. Anthropic publicly backed two binding laws that impose obligations on it, and it was the only large company to do so. That is the opposite of capturing the regulator - it is accepting a rule you did not write.
And on the other hand, that is not innocent either: per reporting it also spent around $200,000 on lobbying around the same California law it ended up endorsing. So even the support is shaping, not submission.
And what both have in common, which may be the point: neither is waiting to be told.
And that is what lets the question be answered without guessing at motives. "A change of direction" and "taking the wheel" are not opposites - they can be the same move. Anyone convinced regulation is coming anyway, and that it is necessary, would act exactly this way: move first, propose a framework, and prefer that it be written in a language they understand.
The difference between the two is not in the motive but in the outcome - whether the framework that emerges also binds whoever wrote it.
And What the Market Has Not Yet Done
The essay was published on a Saturday. The New York exchange has not opened since.
The last session was Friday 11 September, and the next is Monday 14 September - the same forty-eight hours in which the Federal Open Market Committee also convenes.
For context, this is how Nvidia closed over the four sessions preceding publication:
| The date | Close |
|---|---|
| 8 September | 225.73 |
| 9 September | 223.67 |
| 10 September | 218.36 |
| 11 September | 218.29 |
A fall of 3.30% over four days - before the essay was published. (Those are verified closing prices. I am not claiming the decline relates to the events in this piece; it preceded publication.)
הזווית שלי
דעה אישית של אילן אברמוב - לא ייעוץ ולא המלצה
What I take from this weekend is not the call to slow down, which I am not able to judge.
It is that the question being asked changed without anyone announcing it. For three years the debate in this field was "is the risk real", and that is a debate in which I have no edge. In the past week and a half three things effectively closed it: OpenAI's chief scientist wrote that he expects recursive self-improvement and that no one is prepared; a researcher resigned making the same claim; and now Anthropic's chief executive says it and two competitors publicly agree.
When all sides agree on the facts, the argument moves to the mechanism. And the mechanism is what interests me.
And there I found the thing that surprised me most in the whole reading - the antitrust sentence. The headlines described a document about safety. Inside the document is a request to the US administration to let competitors coordinate the rate at which they improve their product. It is a reasoned request, written openly rather than between the lines. But it also says that what is being proposed here is not "a little more caution" but a change to the rules of competition in this market.
And what I try not to do is read a direction for prices out of it. A proposal with no law, no agreement and no date behind it is still just text - and anyone pricing it today is pricing an intention.
And on whether this is a reckoning or a grab for the wheel - I think the framing itself is wrong. Anyone convinced regulation is coming regardless, and that it is needed, would behave exactly as someone who wants to author it: move first, propose a framework, prefer it written in a language they understand. Both readings produce the same behaviour, so behaviour cannot separate them.
But one outcome can: whether the rule that emerges also binds whoever wrote it. And that has already been tested in the field - two binding laws exist, and one of these companies backed them while the other did not.
What can be said without guessing is what to watch: whether the US government responds to the waiver request. Whether any company beyond Anthropic and OpenAI commits to embedded evaluators. Whether anyone backs a binding rule they did not draft. And above all - whether the words "training compute" appear again. As long as the discussion is about capability checkpoints, it concerns the labs. The moment it touches the quantity of compute, it touches everyone who sells to them.
(It is important to stress: this is my personal opinion only, and nothing herein constitutes a recommendation to take any action. Ilan Abramov, the writer, or parties on his behalf may hold positions in the securities mentioned, and those holdings change from time to time.)
