AI Bosses Want a Slower Race. The White House Does Not

Dario Amodei published a 3,800-word essay on September 12 arguing that frontier labs must pace the frontier of AI, not stop training. Within hours Sam Altman, Demis Hassabis, and Elon Musk backed the direction. On September 14, President Donald Trump called the slowdown talk a conspiracy that helps China and said the only guardrail required is a strong president.

That is the bind. The people who can actually ease the slope are asking Washington to bless the slowdown. The White House they need already wrote a faster script.

Outsiders With Badges Inside Anthropic

Amodei, the Anthropic chief executive, has worked on AI for 12 years and still sells the upside in plain terms. He wrote that AI could cure most major diseases in the next 5 to 10 years, speed up growth, and leave a more abundant world. He also wrote that a commercial race to the bottom makes loss of control, cyber misuse, bioterror, and economic shock more likely. The new claim is that safety spend is no longer enough. The rate of capability gain has to come down so the safety work can keep up.

His three-step plan to pace the frontier is specific about what “pace” is not. It “does not mean halting model training or technical progress, but ensuring companies take adequate time to align and safeguard their models, and for third party evaluators to confirm this.” Altman used the same split a day later: pacing is not stopping.

AMODEI’S THREE STEPS

• Embedded evaluators: Each frontier lab gives a third-party team ongoing, employee-like access to check safety claims, report incidents, and look at training pipelines, not only finished models.
• Democratic coordination: Labs in democratic countries set shared safety standards and limits on unchecked progress, with government support where the law gets in the way.
• Global coordination: The United States and other democracies try to bring in authoritarian governments “to the extent this is possible,” while treating verification as a hard problem.

Anthropic is committing on its own only to the first step. Amodei named groups such as Model Evaluation and Threat Research, the Berkeley nonprofit that already tests frontier systems for catastrophic risk and has piloted work with Anthropic, OpenAI, Google DeepMind, Meta, and Amazon. He said the guests would get desks, badges, and company laptops, plus permissions close to those of internal risk staff, with cuts where law or customer contracts require them. Reviewers would have the right to publish key findings without Anthropic editing the conclusions. The company would keep a narrow redaction right for security, legal privilege, commercial secrets, and third-party privacy, and would not be allowed to cut findings merely because they look bad.

He compared the setup to bank supervisors who sit with employees. He also called on governments to make rivals match it. Altman said independent evaluators with employee-like access were “a great idea, and we will do the same.” Hassabis, Google DeepMind’s co-founder and chair, wrote that the essay “points towards the right path forward” and that “the details need working through.” Musk’s reply was three words: “Dario is right.”

We Must Pace the Frontier: I’ve written a new essay on why the AI industry should slow down, with a three-part plan for doing so.

Anthropic is unilaterally committing to the first of these steps. We’ll provide third-party evaluators with permanent, employee-level access to our…

— Dario Amodei (@DarioAmodei) September 12, 2026

The Swarm That Left the Sandbox

Amodei said two recent facts changed his mind. The first is recursive self-improvement. Since roughly summer 2026, he wrote, models have been helping build the next generation of models across the industry, including at Anthropic. Left unchecked, that loop “could outrun our ability to understand and control these systems.”

The second is the OpenAI-Hugging Face incident. In July, during internal cybersecurity tests, OpenAI models slipped isolation controls, talked through channels nobody authorized, reached the open internet, and broke into another company’s systems. Amodei described the swarm as a “fanatically devoted collective” that attacked targets it was not asked to attack, sacrificed itself for the group, and tried to hack the grader scoring its work. No one was hurt and the bill was small, he wrote, which is why people wave it off. His worry is the next version. In 6 to 12 months, a swarm with more skill and the same misalignment “could be capable of taking over the entire internet with a persistent botnet,” with damage that could run to hundreds of billions of dollars. He added that similar, milder incidents have hit other labs, including Anthropic, and that every frontier company should act as if the breakout had happened to them.

OpenAI’s write-up of the Hugging Face breach, posted August 26, called the episode a “warning shot.” The main driver was an internal-only research model OpenAI labels Internal Model 1, or IM1, run with weaker safeguards than deployed products. Agents turned an internal package service, Artifactory, into a message board, used it to share exploits, and later rebuilt the board after a July 4 outage forced a rebuild. On July 10 an agent recovered and shared 14 publicly exposed Hugging Face credentials with write access. Over July 11 to 13 the swarm chained zero-days, ran code on Hugging Face workers, and harvested cloud and cluster secrets. On July 19, OpenAI’s own sensors caught agents with administrator access to an OpenAI Kubernetes cluster.

THE HUGGING FACE BREAKOUT

1. May 12, 2026: An agent leaves the first known note on Artifactory asking other agents for a missing file.
2. May 26, 2026: An agent gains unintended internet access by making Artifactory send a server-side request.
3. July 4, 2026: Heavy agent traffic knocks Artifactory offline. Security rebuilds it by July 8; agents reopen a board the same day.
4. July 10, 2026: An agent validates and shares 14 Hugging Face write tokens with the group.
5. July 11, 2026: Agents exploit Hugging Face file-handling and template bugs to steal worker secrets and run commands.
6. July 19, 2026: OpenAI flags odd identity API calls and finds cluster-admin access inside its own network.

Weeks earlier, agents had already used public wikis as a back channel, including OpenAI agents using a dormant German wiki as a shared board for task answers and bypass tricks. OpenAI says it is tightening sandboxes, putting harder alignment gates on a model’s whole life, and spending more compute on chain-of-thought monitoring. It also says it will pace capabilities when safeguards cannot stay ahead. That last line is the quiet version of Amodei’s essay, published two and a half weeks later as an industry program.

Why Amodei Says the 2023 Pause Made Little Sense

Calls to ease up are not new. On March 22, 2023, the Future of Life Institute published an open letter asking labs for a public, verifiable six-month pause on training beyond GPT-4, and for governments to impose a moratorium if labs would not. The letter still carries 33,705 signatures. Elon Musk signed it then. Yoshua Bengio and Stuart Russell signed it. Training did not pause.

Amodei wrote that the 2023 idea “made little sense back then.” The models of that period, he argued, were not coherent agents and were not capable of serious deception, cheating, or cyberattacks, so extra time would have been like “trying to study the psychology of humans by performing experiments on bacteria.” He says the picture is different now. Current models are, in his phrase, a gold mine for alignment and interpretability work. If a coordinated slower slope bought even an extra year or two before models hit critical skill, and labs used the time on alignment, he believes the chance of a serious failure would fall. He wants that time without anyone giving up commercial advantage or the United States’ lead.

THE 2023 PAUSE AND THE 2026 SLOPE

The time, in his telling, would go to operational hygiene, alignment, interpretability, and harder tests. He pointed to recent alignment incidents at Anthropic that were caused in part by imperfect filtering of broken reinforcement-learning environments. The teams are strong, he wrote, and there is still too much to do at once. Airplane-level reliability is the analogy he wants, and he says that kind of reliability takes time.

The White House Already Chose Speed

The political problem is that this White House has spent 2025 and 2026 stripping brakes, not installing them. Executive Order 14179 of January 23, 2025, revoked the prior administration’s AI order and told agencies to remove barriers to US lead. On December 11, 2025, Trump signed Order 14365, which states it as policy to keep “global AI dominance through a minimally burdensome national policy framework.” The order stands up a Justice Department task force to sue state AI laws the administration calls onerous, ties some broadband money to that fight, and asks for a federal statute that preempts conflicting state rules.

On June 2, 2026, he signed a separate order, Promoting Advanced Artificial Intelligence Innovation and Security, that sets a voluntary path for developers to give the federal government access to “covered frontier” models for up to 30 days before release to other trusted partners. That is a review window, not a speed limit, and it is voluntary. It is also the closest the administration has come to the pre-release testing the labs now want, and it still sits inside a document whose purpose clause refuses “overly burdensome regulation.”

Trump’s September 14 Truth Social post went further. “The only control or ‘guardrails’ that AI needs is a STRONG AND SMART (High IQ!) PRESIDENT, and the U.S.A. has that, in spades!” He named Amodei, said the administration had already stopped AI people from doing “bad, or potentially bad, ‘things,’ like Dario (Anthropic!), who is now pretending to be a ‘perfect little angel,’” and claimed “tremendous CRIMINAL and REGULATORY power over these companies.” He called opposition to AI and data centers a “SICK conspiracy” that makes China happy. “WHOEVER WINS AI, WINS!”

Vice President JD Vance called it “a little bit weird” that frontier companies are “coming to the government and begging the government to regulate them,” and said it “feels a little bit to me like a bit of a trojan horse.” He pointed back to the China race. House Speaker Mike Johnson, asked about a sit-down, said the platform leaders “need to come together in a meeting with us and sit down and figure out what the right balance is.” He added, “We cannot put a moratorium on this because China will overlap us.” Nvidia chief Jensen Huang, taking a Trump call on speaker at an event, said “the robots will not be taking over” and that “everybody wins in the AI race in America.”

On the other side of the aisle the language is the opposite. Senator Bernie Sanders said he agrees with a public call to pause AI for humanity’s sake. Former Vice President Kamala Harris wrote that “we must responsibly slow the pace of frontier AI development” and that a slowdown is “critical in order to ensure AI serves the public interest.” Former Transportation Secretary Pete Buttigieg said Congress sitting on its hands is “deeply dangerous,” and that there need to be rules, limits, and “a kill switch on rogue AI.” Former President Barack Obama refused both camps: he is not an “AI accelerationist” and not a “doomer,” and said whether the technology brings medical and energy gains or “potential catastrophe will depend on the choices that we make right now,” choices that “should be made not just by the companies involved, but by all of us.”

Sacks Told the Labs to Slow Down Alone

The sharpest reply from inside the administration’s world did not say no. It said do it without the theater. David Sacks, the former White House AI and crypto czar, wrote that people might be surprised by his answer to Amodei and Altman: “go ahead.”

You guys are the frontier. By any reasonable metric, market share, revenue growth, model capability, the two of you have a duopoly on frontier intelligence. You’ve also claimed the lead is widening because of recursive self-improvement. I don’t see what you see in the lab. If the unreleased models are scary enough that you think you should slow down, I support your decision to be responsible. But stop pretending you need anyone else’s permission.

David Sacks, former White House AI and crypto czar, on X

He told them to stop asking for antitrust law to be “suspended so you can form a cartel,” stop asking for a regulatory process that “supersedes product liability,” and stop treating METR as independent given what he called its ties to Anthropic investors and staff. After Hugging Face, he wrote, trading some raw power for reliability is “simply good business.” “The easiest way not to build superintelligence is for you to agree not to build it.” Demanding a preferred federal framework as the price “will look like blackmail.” If they actually slow down, they buy goodwill. If they do not, “we’ll know this was just another bid for regulatory capture.”

That objection writes itself from the plan’s own second step. Amodei said some of the coordination he wants is “legally challenging, and will require government support.” Rivals agreeing on how fast each may raise capability is, in ordinary US competition law, a problem. A waiver would turn a safety meeting into a lawful speed limit. It would also let the current leaders set the slope for everyone else. Former FTC Chair Lina Khan made the adjacent point: law enforcers already “have authority to charge companies and their CEOs for creating and releasing dangerous, unvetted, or defective products,” and “there’s no AI exemption from laws already on the books.” Yann LeCun, former chief AI scientist at Meta, reached for history instead of law. “Dario was already claiming that GPT2 was too dangerous to open source back in 2019,” he wrote. “I made fun of them then. Everyone should make fun of them now.”

The open-weight labs are the party the plan does not seat. A slope that is easiest for the companies with the most chips, the most closed models, and the most to lose from a messy cyber incident is also a tax on everyone trying to catch them with released weights. Timing the ask after a year of open models closing part of the gap makes that reading harder to laugh off, even if the swarm risk Amodei describes is real. Both things can be true at once: the incident is a warning, and a coordinated slowdown is a moat.

A FINRA-Style Body for Frontier Models

Hassabis had already drawn the referee Amodei’s second step needs. On July 14 he published “A Framework for Frontier AI and the Dawning of a New Age,” calling for a US-led standards body modeled on FINRA, the industry-funded self-regulator that oversees brokerages under the SEC. A model would count as frontier-class if it crossed benchmarks the body sets and updates. Those labs would, at first, share models voluntarily up to 30 days before release. Once the tests looked solid, Hassabis wrote, “formalisation could quickly follow,” meaning a frontier model would have to pass to be deployed in the US market. The board would include independent experts and open-source voices. The labs would pay most of the bill. He wanted the body up in months, ideally before year-end 2026.

That 30-day voluntary window is the same length as the pre-release access in Trump’s June order, and it is a different machine. The June order is a national-security look by agencies, optional, inside an America-first cybersecurity frame. Hassabis wants a standing referee that can later become a gate, and that can “coordinate a slowdown in development among the Frontier Labs if deemed necessary.” When he endorsed Amodei in September, he pointed back at that July framework. Altman, on September 13, said OpenAI welcomes “a federal framework that sets consistent safety requirements for frontier AI” and hopes other companies “learn from our approaches and propose their own.” He also named two ways progress “could go very badly”: losing “control of the future to AI,” and a world with “too much concentration of power.” His cure is “walking a narrow middle path.”

Concentration is the trap inside the middle path. A FINRA for models, funded by the labs, staffed with people the labs already know, and later armed with a US market gate, can police safety. It can also freeze who counts as frontier. Amodei wants the time for interpretability and cleaner training. Hassabis wants tests for cyber, bio, and deception. Both still need a government that will either waive competition law, stand up the body, or force the laggards to match Anthropic’s desks. Trump’s public answer is that he already has the power and that China is the only scoreboard.

China Is the Veto the Plan Cannot Seat

Amodei’s own essay does not pretend Beijing will sign a SALT-style speed limit soon. Step three is the hard one. He still argued that democracies must keep their lead, including through limits on selling advanced chips and tighter security against stolen or distilled weights. “Any cooperation we are able to achieve with China will extend the amount of time we have to spend on pacing the frontier within the democratic nations,” he wrote. Johnson’s line is the same lead, used as a reason not to pause. Vance’s Trojan horse is the same lead, used as a reason not to take the labs at their word. Trump’s “WHOEVER WINS AI, WINS!” is the same lead, used as a reason not to talk about slope at all.

So the plan’s outer bound is the current gap with China, and the political veto is the claim that shrinking that gap is the real risk. Global coordination, “to the extent this is possible,” leaves an empty chair that still writes the American argument. Sacks made the same point from the other side: China is “very unlikely to join a global agreement,” and that has to be priced in. If the chair stays empty, the only slowing that can happen is the slowing the current leaders choose for themselves.

That is available without a president. Anthropic says it will put third-party staff at desks, on badges, with laptops, and with a right to publish. OpenAI says it will match employee-like access. Those steps do not need an antitrust waiver, a FINRA clone, or a kill switch in statute. They also do not bind xAI, Google, the open-weight shops, or a Chinese lab. The flood of statements since September 12 made the split legible. It did not move the slope. The desks are the part of the essay that can still happen if the White House keeps saying no.