Back to Perspectives · Lexideck home
Pacing the Frontier, read against the record
September 15, 2026, revised September 16, 17 and 22, 2026
Dario Amodei's essay makes one commitment Anthropic can keep by itself, asks the government for one thing in a footnote, and bounds the whole scheme by a quantity it never says who measures. What follows takes each of those in turn and puts the documented record beside it, mostly the company's own documents and its own words.
The commitment he can make alone, and the exceptions written into it
The first step is the one Anthropic does not need anyone's permission for:
Each frontier AI company commits to giving ongoing, employee-like access to a team of embedded third-party evaluators (such as METR), whose role is to verify adherence to safety practices and commitments, report incidents, and help assess the alignment of not just completed AI models but training pipelines and processes.
He is specific about what that access includes, and the specificity is real: desks in the offices, access badges, company laptops. The sentence that matters is the next one.
Access to workspaces, tools, and permissions mostly comparable to what internal risk assessment teams have. We'll make some exceptions, such as where the law or our contracts require it, or to protect customers' and partners' private information.
Mostly comparable, with exceptions for Anthropic's contracts, which Anthropic writes. The publication right has the same architecture:
External reviewers should have the right to publish key findings about risk levels, incidents, practices, and the access they received or didn't receive — without editorial control by Anthropic. We will have the narrow ability to redact security-sensitive, legally privileged, commercially sensitive, or third-party confidential information, but we can't redact findings just because they are unfavorable.
No editorial control, and a redaction power over anything commercially sensitive, with Anthropic deciding what that covers. A finding about capability, release timing, or training practice at a company about to list publicly is commercially sensitive on any ordinary reading of the phrase. The reviewers can announce that a redaction removed something important, which is a real concession and also the shape of the whole document: the power is granted and the standard for applying it stays home. There is no date. The essay says Anthropic intends to invite the team in the near future.
Then there is the reason he gives for wanting evaluators at all.
Outside of verifying formal commitments and informing the public, embedded evaluators can simply provide a second opinion free of commercial incentives.
What the named evaluator runs on
METR is named in the essay. Its own funding statement says it takes no money from frontier AI companies, and its most recent public filing bears that out: for the fiscal year ending December 2024, revenue of $13,639,155, of which $13,603,035 is contributions and $36,120 is investment income, with no program service revenue at all. In the six months to August 2026 it raised roughly $71 million in commitments from philanthropic foundations and individuals. On the cash line, the independence claim holds.
The same page states where the compute comes from:
We have previously partnered with OpenAI, Anthropic, Google DeepMind, Meta and Amazon to pilot frontier risk assessments. These companies have also provided access and tokens, which we use for evaluations, research, and engineering.
Frontier evaluation cannot be done without frontier model access, and the access is donated by the companies under evaluation. That has a market price, and under US nonprofit accounting it has a reporting home: FASB ASU 2020-07 requires contributed nonfinancial assets to be presented on their own line and disclosed by category, with the valuation method and any donor restrictions on use. The figure that would size this dependency is that line against total expenses, which were $8,234,524 for the same year.
The figure is not published. METR's December 2024 filing carries Schedules A, B, D, F, J, O and R, and no Schedule M, the schedule for noncash contributions, which is required once they exceed $25,000. The Form 990 also cannot capture it: IRS instructions exclude donated services and the donated use of equipment from the contributions line, so donated compute has no place on the return even for an organization that wants to report it. Audited statements under the GAAP rule would carry it, and none are public. So the independence claim is supported on the input that has a line to report on, and unsupported on the larger one.
The dependency also grows with the work. Long-horizon agent evaluations consume far more tokens than short ones, and continuous access to pre-release training pipelines is the largest transfer of all, which means a successful version of the essay's first step makes the evaluator more dependent, not less. And it can be reduced without any public act: rate limits, queue priority, which checkpoint is visible and for how long. A funder who withdraws cash leaves a record. A lab that slows a queue leaves capacity management.
On the people: the same filing lists the chief operating officer at $230,384, technical staff between roughly $144,000 and $243,000, and Elizabeth Barnes at $172,737 plus $75,637 from a related organization, with Schedule R filed to describe that structure and five staff drawing part of their pay through it. A frontier lab pays a median near $414,000 for an AI researcher. The second opinion free of commercial incentives is produced by people whose next job offer and whose working compute both come from the companies they assess.
The evaluator helped write the standards it would be enforcing
The dependency has a second axis, and it is not money. METR's work on frontier safety policy predates the essay that would appoint it, and its own description of that work sits on the front page of its site:
We advise AI developers and governments on implementing risk assessment methodologies for AI. For example, we have advised developers on Frontier AI Safety Policies.
The specific policies are documented. The group that became METR advised on the development of Anthropic's Responsible Scaling Policy, OpenAI's Preparedness Framework and Google DeepMind's Frontier Safety Framework, and in November 2024 it published Common Elements of Frontier AI Safety Policies, a synthesis of those three frameworks written for policymakers, with Elizabeth Barnes and Paul Christiano among the authors. The institutional history runs the same direction. Barnes left OpenAI in 2022 and was hired by Christiano to build an evaluations team inside the Alignment Research Center. The spinout was announced in September 2023, the team became an independent nonprofit in December 2023, and Barnes is its chief executive.
So the first step asks a body to verify adherence to safety practices whose definitions it helped draft. An evaluator that co-authored a standard has an interest in that standard holding up, and that is the one direction of bias which no disclosure of funding would ever reveal. The essay's phrase is a second opinion free of commercial incentives. A second opinion on your own document is a different object from a second opinion.
The footnote
The second step is where the plan needs the state. The essay puts the request in one sentence:
For antitrust reasons, it's helpful for the US government to mediate or at least enable these discussions — they don't need to participate, but do need to issue a narrow waiver for certain kinds of safety conversations.
And footnote 1, attached to the words industry-wide coordination, says what the coordination requires:
With government mediation or waivers of antitrust restrictions.
Section 1 of the Sherman Act voids every contract, combination or conspiracy in restraint of trade, and an agreement among competitors to limit output is a per se violation, which means no court weighs whether the restraint was reasonable or whether the motive was safety. That is why the waiver has to precede the conversation rather than defend it afterward. The essay is candid that a better route exists, and sets it aside for speed:
The most effective method of pacing is via regulation that targets all US frontier AI companies, as that covers even those who are unwilling to cooperate voluntarily.
When the US government does grant a narrow antitrust waiver, it has a template, and the template is instructive about what is missing here. Under section 708 of the Defense Production Act, a federal agency has to sponsor the agreement and certify in writing that it is necessary. The Attorney General, after consulting the chairman of the Federal Trade Commission, has to find in writing that the purpose cannot reasonably be achieved through an agreement with less anticompetitive effect, or without any agreement at all. The President or a designee has to authorize and actively supervise it, and without that supervision the protection is unavailable. The Attorney General and the FTC have to survey for effects that eliminate competition, strengthen monopolies, injure small business, or promote undue concentration. The agreement is published, monitored and terminable, and the protection ends when it ends. What participants get is a defense they must prove, not immunity, and it disappears if the conduct was for the purpose of violating the antitrust laws. The Justice Department approved one of these for the Energy Department's consortium in April 2026, so the machinery works and is in use.
Read the essay's request against that: no sponsor, no finding, no supervision, no survey of the effect on smaller developers, no sunset, and a waiver rather than a defense. The least restrictive alternative test is the one the request cannot survive, because the essay has already named the alternative itself, and it is regulation.
There is also a nearer path than legislation. The FTC and the Justice Department withdrew their collaboration guidelines in December 2024 and opened an inquiry into new guidance in February 2026. A carve-out for safety conversations written into new collaboration guidance would be an agency act.
What happens to the company that goes faster anyway
The essay never says. Its own diagnosis of why companies cannot slow down alone is a race to the bottom, spurred by commercial incentives. A waiver permits a conversation and creates no consequence for leaving it, so the consequence has to come from somewhere.
If the government imposes it, this is regulation and the waiver is beside the point, since a government that can penalize a company for shipping too fast can set the pace directly. If the participants impose it, the instruments a private agreement among them can wield are denial of compute, denial of model access, and exclusion from the certification and evaluator ecosystem that would define a safe release, and those are the practices section 1 exists to reach. The compute chokepoint sits with Amazon, Microsoft and Google, who are participants and investors at once. If nobody imposes it, the essay's own premise says the agreement breaks, and it breaks first at whichever company is furthest behind.
The asymmetry is worth holding onto. The developer the essay says makes pacing dangerous is the one outside the arrangement, in China or shipping open weights. Every instrument a private agreement can reach touches only the companies inside it.
Two instruments the arrangement cannot reach
That enforcement sentence is scoped to what a private agreement among the participants can wield, because it is not exhaustive of enforcement generally. Gary Marcus, in a piece that endorses the pacing goal and doubts the vehicle, names two instruments that sit outside the agreement entirely:
The other thing about "pacing" is that it sidesteps at least two other important policy options that we should consider. First, we should insist on liability and even criminal charges against companies that build agents that harm society in negligent ways. It is negligent to put out AI agents that can't be well-controlled.
His second is recall: the second approach that we could consider is simply recalling the damn things, and that would help a lot. Neither instrument needs a waiver, a consortium, or anyone's agreement to pace. Negligence liability runs through the courts on facts a plaintiff proves, and recall is an existing regulatory power exercised against a product rather than negotiated among its makers. Both also reach the developer who stays outside the arrangement, which is the developer the essay says makes pacing dangerous. Neither is available to the participants themselves, which is why they sit outside the trilemma entirely.
There is a behavioral test attached to the first one. Marcus grounds it in the economics: agents are among the most token-hungry products on the market, which is what makes them worth shipping, and a company carrying liability for an uncontrolled agent would ship differently. That prediction is checkable against release behavior. The essay asks for neither instrument. Of the requests it does make of government, the two that would attach a cost to the labs' own shipping decisions are the two that are missing.
The bound nobody is appointed to measure
Step two is explicitly limited, and this is the load-bearing sentence of the whole plan:
Pacing within democracies will be limited by the lead that US companies have over authoritarian regimes, chiefly the Chinese Communist Party.
So the amount of slowing permitted is a function of the lead, and the essay proposes to enlarge the lead so that more slowing becomes affordable:
Thus, a key part of pacing within democracies is to keep democracies' AI lead over autocracies as large as possible, to give us the breathing room we need in order to pace effectively.
The measures are chip export controls, a crackdown on smuggling and on remote access to datacenters outside China, action against unauthorized distillation, and better security against weight theft. He adds that Anthropic has consistently advocated for all of these measures, because we've always understood that they would be essential to any pacing, and forecasts that executed well they would widen America's lead significantly over the next 3 to 5 years.
Those measures have been running for three years, and the record is available. Compute is the most tractable input restriction anyone has, a physical good with a chokepoint at three or four firms, and it was restricted about as firmly as a democracy can restrict a traded product. What followed was smuggling, offshore datacenter access, domestic accelerators from Huawei and Cambricon, and a research boom in efficiency: FP8 training, multi-token prediction, sparse attention. DeepSeek Sparse Attention was developed under those constraints and spread to GLM-5 and to Meituan's LongCat-2.0, trained at 1.6 trillion parameters on roughly 50,000 domestic chips. Stanford's 2026 AI Index puts the best US and best Chinese models 2.7 percent apart on Arena, 1,503 against 1,464 as of March 2026, narrowed from a spread of 17.5 to 31.6 percentage points across MMLU, MATH and HumanEval in 2023, while US private AI investment ran to $285.9 billion against China's $12.4 billion.
A lead that narrowed from 17 points to under 3 during the most aggressive input restriction available, at a twenty-to-one investment advantage, is not a quantity that widens on request. And nobody in the plan is appointed to measure it. The bound on how much anyone must slow down is a number that the companies doing the slowing would be describing to the government that granted them the waiver.
There is also an arithmetic the essay does not do. A limit on the rate of capability release, agreed among some developers while others keep going, does not reduce how fast capability arrives in the world. It moves where it arrives from.
The axis the restrictions do not reach
The lead narrowed while the restriction ran, and the plan never asks why. The answer is available, because the trade between compute and capability has been measured directly, and it turns out not to be a fixed rate.
Greater sparsity yields higher parameter efficiency without an observable turning point.
That is from a 2026 scaling-law study of mixture-of-experts models, and in plain words it says this: hold the compute budget fixed, build the same model with progressively fewer of its parameters doing any work on each word, and it keeps getting better rather than worse. They pushed the ratio to one working parameter in a hundred and twenty-eight and found no point at which the gain stopped. The study is large: over three hundred models trained, up to twenty-eight billion parameters, six hundred and eighty thousand H800-equivalent accelerator-hours, on the part built to comply with the export limits. Two of its results bear directly on the plan. The first is that the advantage is not a constant. It grows with the compute budget, following its own power law, so the sparse architecture becomes relatively more efficient as the budgets in play get larger, not less. The second is that the authors built a model to their own prescription and ran it: seventeen and a half billion parameters held, eight hundred and fifty million working on each word, against a six point one billion dense model trained on the same trillion tokens. The sparse model scored higher overall, and separately on reasoning, language, code and mathematics, using about an eighth of the dense model's working parameters. They had predicted a sevenfold advantage before training it, and they report the law holding on high-leverage validation points outside the range it was fitted on, so the extrapolation into the range that matters was out of sample. They are explicit that they count cost in theoretical operations rather than wall-clock time, which leaves communication and memory traffic outside the result and makes it an upper bound.
The record of who acted on that sits in the published model cards. DeepSeek's own technical report for V3, December 2024, describes six hundred and seventy-one billion parameters in total with thirty-seven billion working on each word, five and a half percent, trained in two point seven eight eight million accelerator-hours at a stated cost near five and a half million dollars. Mixtral, the open standard two years earlier, ran twenty-eight percent. The reported 2026 figure for DeepSeek V4-Pro is forty-nine billion working out of one point six trillion held, close to three percent, and Kimi K3 publishes two point seven eight trillion in total. The open frontier has converged on this shape, and the dense model, where every parameter works on every word, has stopped being built at the top of it.
What that buys is not a smaller model. It is a different split between the two things a model costs. Parameters cost memory, work per word costs processing, and those two do not trade against each other the way the plan assumes. The one systematic attempt to size closed models from the outside, calibrating recall of deliberately obscure facts against open models whose sizes are published, fitted the same curve separately against total parameters and against working parameters. Total predicted far better, 0.79 against 0.51 in variance explained. An independent replication has since found an undisclosed score flooring in that paper's code, contrary to the paper's own text, which inflates its absolute parameter estimates and roughly halves the fitted slope; the total-against-active comparison is not among the results it overturns, and no absolute estimate from it is relied on here. Stored capability follows the parameters a model holds. It does not follow the work the model does per word.
Set those two ledgers side by side and the consequence shows up in list prices. On Artificial Analysis's intelligence index in June 2026 the leading open-weight model scored fifty-one, with the closed frontier roughly five points above it, and the near-frontier open models list between ten and thirteen times cheaper per token than the American flagships they sit beside. SemiAnalysis, benchmarking inference economics, states the architectural relationship as part of its own methodology:
In terms of arithmetic intensity, approximate active, total parameter count, and memory access patterns, DeepSeekV3's model architecture is the model that best matches frontier closed models such as OpenAI's 4o/5 model architecture.
The mechanism was named on the record the day after the essay. Fortune reported on Chinese labs closing the gap through efficiency under compute scarcity, quoting Brendan Burke of the research firm Futurum Group:
Because they had less compute to work with, they found that computationally efficient method instead of just throwing more compute at an inefficient technique.
Now read the plan against that. It governs its own members by capability, with checkpoints whose worked example is a model that can defeat its sandbox. It reasons about everyone else by compute, and every one of the four measures it asks government for acts on compute: chips, smuggling and remote datacenter access, distillation, and security against weight theft. Those are two different meters. For three years the quantity the restrictions squeeze and the quantity that produced the capability have been coming apart, at a rate that has been measured and has shown no ceiling. The essay's own limiting sentence is that pacing within democracies will be limited by the lead. The lead is what the four measures are meant to widen, and it is denominated in the input that the efficiency result says a competitor does not have to spend.
What the distillation measure can reach
Of the four measures offered to widen the lead, one asks government for a power it does not currently hold rather than more of an existing one: action against unauthorized distillation. On July 27, 2026, the same author had already written down what distillation costs, in a post on Anthropic's site answering the charge that the company wanted open-weight models banned.
Distillation does not allow the CCP to obtain equivalent or superior AI capabilities to the US, but it can bring the Chinese frontier to within a few months of the US frontier.
The harm named in the same paragraph is chip-ban evasion: distillation is a much more compute-efficient process than training models from scratch, and it allows China to build much better models than its number of chips would ordinarily enable, and thus partially evade chip bans. That post also separates two concerns and assigns a remedy to each. The primary one is authoritarian governments building models more powerful than the ones the US builds. The secondary one is misuse for cyberattacks or biological attacks, together with serious alignment problems. Chips are the most efficient and direct way to block threat #1, and distillation enforcement is filed alongside them, because its stated effect is to partially evade chip bans. For the secondary concern the remedy named is a different one: the best way to address threat #2 is to just directly test models for cyber, biological, and alignment risks before release. So in the author's own assignment, action against distillation is not a cyber safeguard or a biological one. It is a lead measure, and the quantity it protects is months.
What a provider holds over an output decides what any enforcement can reach, so it is worth reading exactly. Anthropic's commercial terms, effective June 17, 2025, put it in section B:
As between the parties and to the extent permitted by applicable law, Anthropic agrees that Customer (a) retains all rights to its Inputs, and (b) owns its Outputs. Anthropic disclaims any rights it receives to the Customer Content under these Terms. Subject to Customer's compliance with these Terms, Anthropic hereby assigns to Customer its right, title and interest (if any) in and to Outputs.
Three words there do the work. The assignment covers whatever interest Anthropic has, if any, which is the company declining to assert that it owns an output at all. Section F closes the gap behind it: except as expressly stated in these Terms, these Terms do not grant either party any rights to the other's content or intellectual property, by implication or otherwise. The confidentiality section points the same direction, since Customer Content is defined as the customer's confidential information rather than Anthropic's. So the restriction in section D.4, that a customer may not access the Services to build a competing product or service, including to train competing AI models, is a promise rather than a property right. It binds whoever agreed to it. The drafting concedes the limit in the same sentence, because reaching anyone else takes a separate clause forbidding the customer to support any third party's attempt at the restricted conduct. A third party who agreed to nothing sits outside it, and the same document writes the exclusions that put them there:
Confidential Information excludes information that: (a) becomes publicly available through no fault of Recipient; (b) is obtained by Recipient from a third party without a breach of the third party's obligations of confidentiality; or (c) is independently developed by Recipient without use of Confidential Information.
That population is not hypothetical. In August 2026 eight researchers published a method for reading the encrypted reasoning traces that providers hand back to customers, and decoded 315,320 of them scraped from public code repositories. The attacker in their threat model is an ordinary API customer with no insider access and no model weights. Whatever those traces contain is distributed and cannot be recalled, and no term in a contract reaches the person who reads them.
The remedies the contract names match what it is. Anthropic may suspend access for a violation of the use restrictions, may terminate for material breach on thirty days notice detailing the breach unless it is cured within that time, and is indemnified by the customer against third-party claims arising from such a violation. None of that is a right in a model somebody else trained. A contract action reaches a person, and the artifact is not the person.
The company's own footnote says why that is not enough, and the admission is precise. Anthropic is committed to cracking down on industrial-scale distillation through its own practices, including identifying and banning accounts, and this is challenging because the relevant accounts can often only be identified after substantial distillation has occurred, and distillation often involves creating large numbers of fake accounts that form a moving target. The practices of any individual company cannot entirely solve the problem, which is why we have called for policy on this issue. That is an honest account of why the private remedy is insufficient. It is also a description of a lever that only moves after the thing it was meant to prevent.
So the request to government is a request for a prohibition that reaches non-parties, where the existing instrument reaches only signatories and no property right is asserted to use instead. Three channels stay open whatever happens to the fourth. Knowledge acquired from a model is unrestricted, because there is no right in a method. Traces already public are unreachable, because a promise cannot bind a stranger. And a model released under a permissive licence carries no term to violate: Meta put Muse Glimmer's weights out under Apache 2.0 on August 10, 2026, and that licence permits derivative works and commercial use with no field-of-use restriction. What the measure would close is the one channel that runs through a signatory, which is also the one already being policed.
A common ceiling moves the competition rather than ending it
In August, answering the investor Gavin Baker on X, Amodei described how Anthropic reads its own proposal: pacing would modulate the pace of the very best models while not constraining those who are catching up. Taken plainly, the ceiling binds at the frontier, where two or three companies sit, and the field behind keeps its speed while having no seat in the discussions that define what a safe release is.
Capability is the axis on which a newcomer can actually win, because a better method can beat a larger budget, which is what the efficiency work under export controls demonstrated. Hold that axis still and the contest moves to distribution, enterprise contracts, compute access, switching costs and brand, which is where the largest incumbents are already strongest. A common standard also turns safety practice from something a company can win on into a fixed cost of doing business, and fixed compliance costs are lightest, per unit of revenue, for the biggest firm in the room. The essay's stated ambition is the opposite of this: to make safety something on which AI companies compete, a race to the top. A uniform floor and ceiling is how a race to the top stops being a race.
The transparency claim and the record of what got published
The essay is direct about the limits of voluntary disclosure, and the admission is genuine:
Anthropic has been a supporter of transparency for a long time: we supported transparency legislation when most of the industry was against any regulation, and our model cards and risk reports run to hundreds of pages. But we are still the ones choosing what to include and omit. Embedded evaluators will change this dynamic.
Two entries in the record show what choosing what to include has looked like. In April 2026 Anthropic's public pricing page listed Claude Code as unsupported on the $20 Pro plan while keeping it on the $100 Max plan, and new Pro subscribers were blocked from it while existing subscribers saw no change. The company's head of growth, Amol Avasare, described it as a small test on roughly 2% of new prosumer signups. The public documentation had been changed as though the removal were universal, and the pricing page was restored after the reaction. The document said one thing to everyone while the experiment ran on a fortieth of them.
Earlier, the effort to build a book corpus was run under the codename Project Panama, and the internal memo entered in evidence as court exhibit 21 explains the codename: because we don't want it to be known that we are working on this. The company bought physical books, destructively scanned them and discarded them, having become wary of pirated copies for legal reasons, and treated licensing as a legal, practice and business slog not worth undertaking. Judge Alsup held that training on books was fair use however they were obtained, which leaves the concealment rather than the training as the finding, and the concealment was deliberate and written down.
Three months earlier, the same company argued the reverse
On June 10, 2026, Amodei published an essay calling for governments to hold the power to block models that fail safety audits. On June 12 the Commerce Department used a power of that kind, suspending access to Fable 5 and Mythos 5 for foreign nationals worldwide, including Anthropic's own foreign-national employees, after a jailbreak found by Amazon researchers. Anthropic's public statement objected on these grounds:
We disagree that the finding of a narrow potential jailbreak should be cause for recalling a commercial model deployed to hundreds of millions of people. If this standard was applied across the industry, we believe it would essentially halt all new model deployments for all frontier model providers.
An industry-wide halt to new deployments is offered there as the consequence that proves the government went too far. Three months later it is the objective. The statement also kept the blocking power in principle while removing it in this instance:
As we have stated publicly, we believe the government should have the ability to block unsafe deployments, as part of a statutory process that is transparent, fair, clear, and grounded in technical facts. This action does not adhere to those principles.
Transparent, fair, clear and grounded in technical facts, with nobody named to decide whether a given action meets that description. The same statement argued that Anthropic's safeguards were so strong that many users have complained that they are overly broad, and that the capability at issue was widely available from other models, including OpenAI's GPT-5.5, and is used every day by the defenders who keep systems safe. Those are the arguments other developers make about capability releases and open weights, and they are the arguments Anthropic's public position exists to answer.
The capability sequence sits in the same window. Mythos was withheld from public release in April on cyber-capability grounds. On June 9 Fable 5, the same model tier with guardrails, shipped to the general public. On June 10 came the call for blocking authority, and on June 12 the government used it. By July 1 the controls had been negotiated away.
The Fable 5 system card records one more thing. Alongside the cyber and biological safeguards, Anthropic added safeguards covering frontier LLM development itself: pretraining pipelines, distributed training infrastructure, ML accelerator design. The mechanism is that the model silently degrades its own performance on those tasks. The stated reason is concern about accelerating the overall pace of AI development. Three months before an essay asking the government to enable competitors to agree on the pace together, the pace argument was already implemented as a product behavior that makes the model worse at helping anyone build a competing one.
The labor claim, and the one document it is missing from
His most widely quoted claim about this technology is not in this essay. On May 28, 2025, he told Axios that AI could wipe out half of all entry-level white-collar jobs and spike unemployment to 10 to 20 percent in the next one to five years, and he put both halves of it in a single sentence:
Cancer is cured, the economy grows at 10% a year, the budget is balanced — and 20% of people don't have jobs.
He said the timing was close, as little as a couple of years or less, and he framed saying it out loud as a duty: we, as the producers of this technology, have a duty and an obligation to be honest about what is coming. His prescription then was not to slow the technology. You can't just step in front of the train and stop it, he said; the only move that's going to work is steering the train.
In January 2026 he restated the claim at length in The Adolescence of Technology, and defended it against the economists who said he had misunderstood labor markets:
There are two specific problems I am worried about: labor market displacement, and concentration of economic power. Let's start with the first one. This is a topic that I warned about very publicly in 2025, where I predicted that AI could displace half of all entry-level white collar jobs in the next 1–5 years, even as it accelerates economic growth and scientific progress.
That essay also tightens the claim in a way worth crediting. He grants that some readers missed the one-to-five-year range and thought he was claiming AI is displacing jobs right now, which I agree it is likely not. He keeps the pairing intact, proposing that a 10 to 20 percent sustained annual growth rate may be possible and then asking, in the next breath, what are the economic prospects for most existing humans in such a world. He names the outcome he fears: people affected not by profession but by intrinsic cognitive ability, who could form an unemployed or very-low-wage underclass. He writes that these outcomes would be great for economic growth but not so great for the labor market or those who are left behind.
In the September essay, labor appears once, as three words inside a list of risks, hyperlinked and never discussed: the risk of losing control of AI systems, misuse of AI for cyberattacks and bioterrorism, and serious economic disruption. The two developments he says convinced him to call for pacing are recursive self-improvement and the OpenAI-Hugging Face incident. The plan verifies alignment practices, proposes capability checkpoints whose worked example is a model that can defeat sandboxing, and seeks international agreement on bioweapons, pre-release testing, and the rate of recursive self-improvement. Nothing in the three steps touches employment. The requests it makes of government are the antitrust waiver, chip export controls, action against distillation, and better security at the labs. Pacing capability growth preserves no one's job; it changes when the capability arrives and who owns it.
The growth half of his pairing does survive into September. The essay opens by saying AI could cure most major diseases in the next 5 to 10 years and greatly accelerate economic growth rates. The unemployment half, which he had kept welded to it since the Axios interview, is absent.
The link the essay gives for serious economic disruption goes to Anthropic's own scenario explorer, built on Economic Scenarios for Transformative AI by Korinek and colleagues. His economics team is more conservative than he is:
In scenarios ranging from business as usual to an economy where AI increases growth to about twice the normal rate, unemployment stays within the historical range and wages remain flat or rise depending on the industry.
Their substantial scenario has AI capable of doing half of all knowledge work by 2030, most of it autonomously, with the economy growing at twice its normal rate, wages for knowledge workers flat, and other workers gaining. Unemployment reaches historic levels only in the extreme scenario, driven by recursive self-improvement and rapid adoption. So the source the essay cites for economic disruption does not carry 10 to 20 percent unemployment within one to five years of May 2025. It puts unemployment inside the historical range everywhere but one branch.
This is a different shape from the June statement, and the difference is worth stating precisely. He never withdraws the labor claim. What the record shows is that the claim is made wherever it establishes candour and urgency, in an interview in May 2025 and in a 20,000-word essay in January 2026, and is absent from the one document that asks the government for something, where it would have to be either acted on or dropped. The remedy he proposes does not reach the harm he has spent eighteen months describing, and the essay does not mention the gap.
One consequence of the growth claim survives on its own. A technology that raises an economy's growth rate is an input to nearly everything produced in it, and an input of that kind, supplied by a few firms with enormous fixed costs, near-zero marginal cost per unit served, and metered billing, occupies the position of a utility. Anthropic argued from that position in June, under pressure: a model deployed to hundreds of millions of people should not be recalled over a narrow jailbreak. What accompanies that position everywhere else it exists is rate regulation, an obligation to serve, common carriage, and government control over entry. The essay asks for coordination, evaluation and a waiver, and for none of those.
The five weeks before the essay
Two things in the record between August 7 and September 12 bear directly on the plan, and both are documentary.
The first is a competitor using the word pacing for something other than pacing. On August 7, 2026, OpenAI said it could not rule out that its upcoming model Astra met the critical cybersecurity capability threshold in its own Preparedness Framework, and it paused internal workloads that did not meet a stricter security bar. A White House official told Axios that OpenAI voluntarily informed the administration of their plans to delay the release, and Axios reported it as possibly the first time a frontier lab had committed to slowing progress on one of its own models over cyber concerns. On August 18 the company published its own account of the decision, titled Pacing model development in an era of cyber-critical capabilities:
Once we determined that Astra may have critical cyber capabilities on August 7, we added an additional monitoring requirement for all inference of Astra with tools (not just RL training and evaluations). While some Astra training and evaluations meet those requirements, a significant number of workloads remain paused until they are fully migrated and enhanced to meet the new security bar.
Now read that title against what the same company did inside the same window. On August 28 it began training a new internal model, which it says is significantly more capable than Astra and which its own account describes as showing unprecedented performance, including in mathematics. On September 1 it turned roughly ten thousand agents of that model onto the Millennium Prize problems. On September 3 it shipped Astra publicly, the model whose capability had triggered the August pause, disclosed as the first OpenAI model to reach the Critical cybersecurity level under the Preparedness Framework, with the least restricted version routed to vetted organizations through an application-only program called Daybreak. On September 5 the agents reached a candidate proof of a Navier-Stokes variant, after about eighty-eight hours, some 2.7 million messages between agents and on the order of 130 billion output tokens. On September 8 the company announced it. Nothing in that sequence limits the rate of capability gain. What was paused was a class of internal workload under a security bar the company wrote and applied itself, the pause ran concurrently with training something more capable, and it ended in a public release twenty-seven days later.
So this belongs beside the redaction power and the unmeasured lead. The essay asks government to enable a mechanism that would make pacing possible. Three and a half weeks earlier a competitor had already put the word on a document, and the conduct it covered included an acceleration. The company defined what pacing meant, applied the definition to itself, and satisfied it, which is the architecture of every other part of this plan: the power is granted and the standard for applying it stays home. A capability announced and withheld under a threshold its owner wrote, then released as graded access through an application-only program, is scarcity under management. The Navier-Stokes result also carries a public dispute over priority and provenance, unresolved and denied in part. The dates above stand clear of it: every one of them comes from OpenAI's own account and none is contested.
The second is that the pressure the essay describes was attested from inside Anthropic in the same window, by people who left. Jacob Coxon resigned in the week of September 7, warning that companies are racing toward self-improving superintelligence. On September 11 Joe Benton, who had led Anthropic's Scalable Oversight team, published his own account of leaving two weeks earlier, and named the cause as structural: competition pushes every frontier company to underinvest in safety because the cost of falling behind is too high, and Anthropic having avoided an incident as severe as the Hugging Face attack is partly a matter of luck. His opening line is the claim itself:
I left Anthropic's safety team two weeks ago. Now feels like a good moment to explain why. AI companies are racing to build machines that are much smarter than any human, and we may not survive this. I want to work from the outside to ensure the public is informed about these risks, and help the world navigate this transition responsibly.
That corroborates the essay's diagnosis. The race-to-the-bottom premise now has named witnesses who paid for acting on it. Benton is also joining METR, which belongs with the authorship section above: the evaluator the essay names was hiring off the safety team of the company it would be embedded in, and the hire became public the day before the essay did. Donated compute leaves no trace on the day it moves. This did.
What the people being benchmarked said
On September 11, the day before the essay, twenty-five Fields Medalists published a joint declaration titled A Severe Misalignment of AI in Mathematics. The signatories run from Pierre Deligne, who won in 1978, to Yu Deng, who won in 2026, and include Terence Tao, Peter Scholze, Maryna Viazovska, Cédric Villani and Manjul Bhargava. Tao has used these systems in his own research and has argued publicly that they are ready for it. He signed this:
However, the push by AI companies to solve mathematical problems as a benchmark is detrimental to the science of mathematics, and to the mathematical community. The goals of the AI companies and the goals of the mathematical community are severely misaligned. We see these as part of broader alignment issues impacting other scientific and creative professions, as well as the whole of society.
The declaration names no company, and its complaint is about what the speed costs. It grants that AI offers the potential of enhancing and accelerating genuine mathematical study, and the Navier-Stokes proof was machine-checked in Lean. What it objects to is that solutions get announced in a rush, leaving no time for a proper writeup, the isolation of new methods and ideas, and citing relevant previous work of others, which it says raises severe attribution and plagiarism questions. Then it locates the decision: whether these changes ultimately benefit the field or have a destructive effect will in large part be determined by the decisions of the humans in control of this new technology.
That is the location this piece keeps arriving at. The declaration asks the humans in control to decide well and names no mechanism that would make them, which is where the essay also ends. What the mathematicians add is a dated, named, independent account of the cost, published by twenty-five people with more standing on this question than anyone inside the industry. The sequence is worth holding in order. On September 8 a lab announced a Millennium Prize result produced by an unreleased model. On September 11 the most decorated mathematicians alive called the practice detrimental to their field. On September 12 the plan arrived, asking government to enable the industry to agree on its own pace.
The shape of it
Read together, the plan grants a power in each of its parts and keeps the standard for applying it. Government should be able to block an unsafe deployment, and whether any particular blocking was transparent, fair, clear and grounded in technical facts is judged at home. The frontier should be paced, and the pacing is bounded by a lead that no named party measures and that the essay proposes to widen. Competitors should agree on safe release, and the competitors define safe release. Reviewers should publish unfavorable findings, and the company keeps the redaction power, the contracts that carve out the exceptions to their access, and the choice of who gets a badge.
A second pattern runs beside it, and it is about the instruments rather than the standards. The measure against distillation reaches a contract with the people who sign it, and not the artifact it is aimed at. The measures meant to widen the lead all act on compute, while the capability they are meant to constrain has for three years been bought on an axis where the return to the constrained party rises rather than falls. The two instruments that would attach a cost to a lab's own shipping decisions, negligence liability and recall, are the two the essay does not ask for.
Two patterns and seven instances, every one of them in the essay's own sentences, the company's own filings and posts, or a measurement somebody else published, with the dates around them public.
One note on the parts that hold, which this piece credits late and briefly. A colander does retain water. Run a liter through one and a few milliliters stay behind on the screen, held there by surface tension, and that is a real measurement. It is also the entire quantity a colander retains, and nobody buys one in order to hold water. This plan retains about that much: one step Anthropic can take alone, a genuine concession on unfavorable findings, a funding line that checks out, a labor claim tightened rather than abandoned. The rest runs out through the holes, and the holes are where the standards live.
Sources
Dario Amodei, We Must Pace the Frontier, darioamodei.com, September 2026, read September 15, 2026
Dario Amodei, The Adolescence of Technology, darioamodei.com, January 2026, read September 15, 2026
Jim VandeHei and Mike Allen, Behind the Curtain: A white-collar bloodbath, Axios, May 28, 2025
Anthropic, Economic Scenarios for Transformative AI (Korinek et al., 2026) and the scenario explorer at anthropic.com/institute/econ-scenarios, read September 15, 2026
Anthropic, Statement on the US government directive to suspend access to Fable 5 and Mythos 5, June 12, 2026
Anthropic, Fable 5 system card, June 2026
Samuel Axon, Anthropic tested removing Claude Code from the Pro plan, Ars Technica, April 22, 2026
Bartz v. Anthropic, court exhibit 21, and Judge Alsup's fair use ruling
METR, About page, funding statement and front-page advisory statement, metr.org, read September 15 and 16, 2026
METR, IRS Form 990 for fiscal year ending December 2024, EIN 99-1219864, filed November 16, 2025, via ProPublica Nonprofit Explorer
FASB ASU 2020-07, contributed nonfinancial assets; IRS Form 990 instructions, Part VIII and Schedule M
Gary Marcus, Two cheers (out of three) for Dario Amodei, Marcus on AI, September 13, 2026, read September 16, 2026
Coverage of the Navier-Stokes priority and provenance dispute, including OpenAI's response and Tristan Buckmaster's account, Tom's Hardware and Cybernews, September 9 to 11, 2026
Sherman Antitrust Act of 1890, sections 1 and 2
Defense Production Act section 708, 50 U.S.C. 4558, and 44 CFR Part 332; DOJ Antitrust Division approval of the DOE DPA consortium, April 2026
FTC and DOJ withdrawal of the collaboration guidelines, December 2024, and inquiry into new guidance, February 2026
Stanford AI Index 2026, US and China frontier model gap and AI investment figures
Levels.fyi, Meta AI researcher compensation, read September 15, 2026
Pacing the Frontier employee statement and signatory list, pacingthefrontier.com, read September 15, 2026
METR, Common Elements of Frontier AI Safety Policies, November 2024
METR institutional history: ARC Evals founded inside Paul Christiano's Alignment Research Center in 2022, spinout announced September 2023, independent nonprofit from December 2023; METR team page for Elizabeth Barnes, read September 16, 2026
Ina Fried, Madison Mills, Sam Sabin and Maria Curi, Exclusive: OpenAI slows release of Astra model citing cyber capabilities, Axios, August 7, 2026
OpenAI, Pacing model development in an era of cyber-critical capabilities, openai.com, August 18, 2026
Joe Benton, Why I left Anthropic's safety team to hold AI companies accountable, jbenton1.substack.com, September 11, 2026, and his post on X the same day
Another Anthropic researcher warns of AI race risks after quitting, Business Standard, September 12, 2026, for the Jacob Coxon resignation
OpenAI, GPT-6 Astra launch announcement and system card, September 3, 2026
Ashley Capoot, OpenAI announces rollout of GPT-6 Astra model, CNBC, September 3, 2026
OpenAI, Navier-Stokes announcement and 165-page paper, openai.com, September 8, 2026
A Severe Misalignment of AI in Mathematics, joint declaration of twenty-five Fields Medalists, mathandai.org, published September 11, 2026, DOI 10.5281/zenodo.22737750, read September 16, 2026
Dario Amodei, Our position on open-weights models, anthropic.com, July 27, 2026, read September 17, 2026
Anthropic, Commercial Terms of Service, effective June 17, 2025, sections B, D.4, E.1, E.3, F, I.2, I.3 and K.2, read September 17, 2026
Panfilov, Schmotz, Shumailov and others, Stealing Reasoning Traces from Proprietary LLM APIs, arXiv 2608.09867, submitted August 10, 2026, read September 17, 2026
Meta Superintelligence Labs, Introducing Muse Glimmer: An Open Agentic Model That Runs on Your Device, research.meta.ai, August 10, 2026, Apache 2.0 weights release, read September 17, 2026
Changxin Tian, Kunlong Chen, Jia Liu, Ziqi Liu, Zhiqiang Zhang and Jun Zhou (Ling Team, Ant Group), Towards Greater Leverage: Scaling Laws for Efficient MoE Language Models, ICLR 2026 proceedings, read September 17 and re-read September 22, 2026; the 680,000 H800-equivalent GPU-hour total appears in the ICLR version and not in arXiv 2507.17702v1
DeepSeek-AI, DeepSeek-V3 Technical Report, arXiv 2412.19437, December 2024, for total and active parameter counts and training cost
SemiAnalysis, inference benchmarking methodology on DeepSeek V3 as the closest architectural match to closed frontier models, read September 17, 2026
Artificial Analysis Intelligence Index, open-weight and closed frontier scores, June 2026, and published list prices per million tokens
Beatrice Nolan, quoting Brendan Burke of Futurum Group on Chinese labs and computational efficiency, Fortune, September 13, 2026
Bojie Li, Incompressible Knowledge Probes: Estimating Black-Box LLM Parameter Counts via Factual Capacity, arXiv 2604.24827, HTML at arxiv.org/html/2604.24827v1, for the black-box sizing of closed models and the finding that total rather than active parameter count predicts factual capacity, read September 22, 2026
Benjamin Sturgeon and LawrenceC, Sanity-checking "Incompressible Knowledge Probes," LessWrong, May 1, 2026, with replication code at github.com/BenSturgeon/ikp-replication, for the undisclosed per-tier score flooring and the dataset ambiguity rates, read September 22, 2026