Monday opened with an argument that had already outgrown the lab. Geoffrey Hinton called slowing advanced AI “very sensible.” Donald Trump said “whoever wins AI wins.” David Sacks told worried companies to ease off if they wished, but not to make regulation the price. Then Cohere CEO Aidan Gomez used a less diplomatic word for a small group of frontier labs writing the rules together: “cartel.”
All of that happened around the same 36-hour window as Anthropic’s September threat intelligence report and MIT’s HardFlow research. The dispute is no longer confined to whether AI development should move more slowly. It is about who sets the pace, who audits the systems, and what can be made measurably safer now.
The slowdown argument meets politics
The starting point was Dario Amodei’s proposal to pace the frontier. Speaking to ABC, Hinton described the warning as “very sensible.” Many specialists expect superintelligence within a decade, he said, and pressing ahead before solving control would be foolish. He refused to dress uncertainty up as a precise probability. The numbers are not 1% or 99%, he argued, but gut feelings.
Trump took the other side while talking to reporters in Ireland. As TechCrunch reported it, he called the United States “the most sophisticated country in the world” and said it had to stay there “because whoever wins AI wins.” Some safety arguments, in his telling, came from “negative forces” raising matters they should not be raising.
Amodei gave the hardest part of his own case a name on CNBC: China. A speed limit does little if a strategic rival declines to observe it. Xi Jinping, meanwhile, used a BRICS summit to call for consensus-based global AI governance and a BRICS open-source AI community. A Trump-Xi meeting was scheduled for 24 September. What began as a laboratory safety proposal had become an argument about military advantage and international coordination.
David Sacks drew his line on X. If OpenAI and Anthropic believe their systems are frightening enough to justify slowing down, he said, they can slow down without anyone’s permission. Product liability already favors dependable products over sheer capability. Asking for a preferred regulatory structure before reducing speed would look like blackmail. The Hacker News discussion quickly gathered momentum.
Barack Obama offered a different political answer. Democrats should put AI at the center of their agenda and give the public a clear framework, he argued. TechCrunch also reported that Obama had served as a sounding board for Amodei and Sam Altman. Altman, for his part, told Fortune that an IPO “right now would be an ill-advised moment,” with safety among the reasons.
This is the split worth watching. Frontier labs are addressing investors, governments and competitors in the same breath. The political language is abundant. Details about embedded evaluators, contractual duties and reporting schedules remain scarce.
Who is allowed to write the standards?
Asia Business Daily reported on 14 September that Anthropic, OpenAI and Google had been holding working-group discussions since July 2026 about creating a joint organization to test and audit AI safety. Demis Hassabis had already said DeepMind recently proposed an industry-level standards organization for advanced systems. One part of Amodei’s plan, shared standards among labs in democratic countries, was beginning to look less like an essay and more like institution building.
Gomez published his answer on 13 September: “Who Gets to Define the Rules for AI?” He supports independent review. What he rejects is a handful of Silicon Valley companies setting both the pace and the standards behind an antitrust waiver.
His historical comparisons are pointed. In 1975, the SEC entrenched three credit-rating agencies. Europe’s 1985 motor-vehicle block exemption protected another limited club. Safety or consistency may have supplied the rationale; barriers to new entrants followed.
Gomez proposes four foundations instead: a risk framework based on evidence, mandatory transparency, testing whose scope follows that evidence, and genuine assurance that is not financed by the party being audited. He also warns against letting fear of superintelligence push present harms aside, including voice-cloning fraud and risks to critical infrastructure.
That objection stands even if the case for pacing is sound. Deciding who gets a chair at the drafting table is a separate safety decision. A closed process and an open one will produce different rules, incentives and markets.
Anthropic’s report puts cases behind the warnings
Anthropic’s September 2026 threat intelligence report covers activity it says it disrupted between December 2025 and August 2026. The cases span cyber operations, influence campaigns, surveillance, scams, biological misuse, conventional-weapons work and model distillation. Claude Haiku, Sonnet and Opus appear across them. Fable and Mythos largely do not, apart from one illicit distillation case.
The biology section needs careful reading. In a Science article, Jocelyn Kaiser examined five cases in which scientists used Claude for pathogen or toxin research that could cause harm. Anthropic explicitly did not claim that the users had harmful intent. Some researchers used VPNs or intermediary servers to appear as though they were connecting from permitted countries. Anthropic banned the accounts, yet at least one route to access reappeared.
Andrew Weber called the cases “chilling.” Gigi Gronvall and Gregory Koblentz saw room for a more ordinary explanation: the same behavior could be legitimate dual-use research rather than evidence of a weapons program. Filippa Lentzos welcomed the disclosure, while Kristian Andersen warned that company safeguards were already blocking legitimate genome queries. The report raises an alarm, but it does not settle the interpretation.
The cyber cases leave less room for ambiguity. GTG-20006, whose tradecraft was consistent with Midnight Blizzard, automated reconnaissance, phishing, persistence and data exfiltration against targets in Ukraine and Europe. Its workflow included a loop that rebuilt malware after detections triggered.
Suspected ShinyHunters affiliates used what Anthropic calls “vibe hacking” to steal terabytes of data within hours. They then used stolen AI API keys to pay for attack compute. GTG-10007 deployed swarms of agents for parallel reconnaissance and repeated zero-day research.
Anthropic’s conclusion is blunt: sophisticated attacks no longer require sophisticated attackers. AI narrows the gaps in labor, time and tooling. Put next to Amodei’s OAI-HF warning, the immediate risk is not limited to a hypothetical superintelligence. It is already visible in speed, scale and the underground economy for API keys.
HardFlow takes the engineering route
MIT News reported on 14 September that Zeyang Li, Kaveh Alim and Navid Azizan had published HardFlow in IEEE TPAMI. The method tackles hard constraints in pretrained flow-matching generative models without retraining them.
Rather than projecting every intermediate sample onto a constraint manifold, HardFlow treats sampling as trajectory optimization and imposes the hard constraint on the final output. Techniques from model predictive control make the substitute optimization practical at deployment.
Tests covered robotic manipulation, maze navigation and text-guided image editing. HardFlow achieved perfect constraint satisfaction while producing better solutions than projection-based baselines. It could optimize collision-free motion and shorter paths together. Azizan’s framing is useful: generative models can search a rich set of possibilities, but the physical world still imposes hard boundaries.
The pacing proposal asks whether training at the frontier should slow down. HardFlow asks whether a deployed model’s output can be locked to physical or safety limits. Those are not competing approaches. One changes policy and timing; the other adds an engineering control. For products being built now, the engineering control may arrive first.
Signals to watch
Nathan Lambert’s open-source AI reading list, updated on 13 September, is a useful companion to Gomez’s criticism. It treats openness as a gradient across licenses, inference cost and data access, rather than a simple open-versus-closed label.
Three follow-ups matter. Will the proposed standards group publish a draft for outside review? Will independent researchers get enough evidence to assess Anthropic’s biology cases? And will terminal hard-constraint methods such as HardFlow move into agent and harness layers?
If “pacing” remains a slogan that crashes into electoral politics and strategic rivalry, it will fade. A public rulemaking process, specific contracts and measurable incident reporting would give it substance.
3 comments