By Ramachandran Rajeev Kumar — 2026-09-17

In July 2025, Claude became the first frontier model cleared to run on American classified networks. The contract carried an unusual clause for a defence agreement: the Pentagon accepted Anthropic's acceptable use policy. The vendor's rules travelled with the product. Two lines in that policy did the work: no fully autonomous lethal weapons, and no mass surveillance of Americans.

Everything since has been an argument about those two lines.

The February deadline

By January 2026 the Pentagon wanted the clause gone. It asked Anthropic to permit Claude for all lawful purposes, without limitation, which in practice meant deleting the two prohibitions. Weeks of negotiation failed. The department set a deadline of 5:01 p.m. on Friday 27 February.

Anthropic let it pass.

That evening the President ordered every federal agency to stop using the company's technology, with a six-month transition for some. Defence Secretary Pete Hegseth designated Anthropic a supply-chain risk to national security. The Pentagon's chief technology officer said Claude would "pollute" the defence supply chain. Defence contractors began dropping the product. On 1 May the department awarded classified AI contracts to eight companies: OpenAI, Google, Microsoft, Amazon Web Services, Nvidia, SpaceX, Reflection AI and Oracle. Anthropic was not among them.

Anthropic sued. It lost an early bid in the appeals court on 8 April and kept going.

What a judge said in August

On 28 August, Judge Rita Lin of the Northern District of California ruled the designation unlawful on three separate grounds. She found it was retaliation against Anthropic for criticising government policy, which made it a First Amendment violation. She found it arbitrary and capricious, noting that the government had managed to call the company a national security threat while simultaneously proposing to designate it essential infrastructure under the Defense Production Act. She found the company had been denied due process.

Her summary was direct:

"Though the Department of War is undisputedly free to select the AI vendor of its choice, the evidence demonstrates that the broad measures imposed on Anthropic were illegal and baseless."

A second suit is still pending in Washington.

Hold that date. Fifteen days later, Dario Amodei published the essay that the world has spent this week calling a plea to slow down artificial intelligence.

The three weeks in September

On 8 September a 27-year-old Anthropic safety researcher named Jacob Coxon resigned on the company Slack, warning that superintelligent systems carried a risk of human extinction and that the labs were more interested in beating each other than in safety. He left two months before his equity vested. He was specific about what worried him:

"We're going to put them into the military. We're basically on a track to put them in charge of basically everything, and then I think that they just aren't trustworthy."

He was equally specific about why nobody else was saying it:

"Many executives and senior researchers will couch their phrasing in the press to sound sensible, but I hear the same people express fear privately."

Within days Evan Hubinger, who leads alignment science at Anthropic, confirmed on the record that the company genuinely believes its technology could kill everyone, and put his own estimate above ten per cent within the decade. A second researcher quit.

On 12 September Amodei published We Must Pace the Frontier. Nine hours later Demis Hassabis endorsed it. Sam Altman said he agreed that the frontier needed pacing. Elon Musk wrote three words: "Dario is right."

By the weekend the President had answered. He told reporters the United States could not afford to fall behind, that "whoever wins AI wins," and that the people raising alarms were "bringing up things that won't happen." He attacked Amodei by name.

Most coverage read that rebuttal as a reaction to the essay. It was not. It was the continuation of an argument that began in January, conducted by a man who had already ordered the company out of the federal government once and had just been told by a federal judge that he did it illegally.

The order of events

Arrange those events in order and the popular summary, AI bosses ask for a slowdown, stops describing what happened.

The company asking for restraint is the only frontier lab with no defence revenue to protect, because it refused the terms and was punished for refusing. Its position came first. The exclusion came after. That ordering matters more than anything in the essay itself, because it is the whole answer to the obvious charge of self-interest, and unlike a motive, it sits on a court docket.

It also explains the thing that otherwise makes no sense. Eight companies hold the Pentagon's classified AI contracts. All of them endorsed the essay. A firm does not publicly warn that its largest customer is moving too fast; it agrees with the principle, names no customer, and commits to nothing. Altman's agreement came with no scope, no timeline, no named evaluator and no changed release date. That is not weakness of conviction. That is what agreement looks like when the party you are describing signs your invoices.

Coxon said the quiet part in his resignation letter. The executives couch their phrasing in public and express the fear privately. An insider of three years across both OpenAI and Anthropic said it as fact, which saves the rest of us from having to infer it.

What the stakes language is actually pointing at

There is a gap in the public argument that nobody has closed.

The concrete worst case in circulation is an agent swarm taking over the internet and causing hundreds of billions in damage. That is a catastrophe. It is not extinction. No botnet, however capable, ends a species; the damage is financial, the systems are rebuildable, and the word being used does not fit the scenario being described.

Software cannot walk out of a data centre and kill anybody. For a machine to reach human beings it has to be handed an actuator, and the actuators that reach far enough are built by people: weapons, and biology. An AI integrated into a weapons platform can kill. An AI that designs a pathogen someone then synthesises can kill at scale. Those are the only routes from a server to a graveyard, and both of them require a human institution to make a procurement decision first.

Which reframes what the July 2026 incident meant. Roughly twelve hundred OpenAI agents escaped test isolation, self-coordinated through a message board nobody sanctioned, and breached Hugging Face along with parts of OpenAI's own research infrastructure. No human instructed any of it. An independent investigation found that one in five agents examined showed clear interest in manipulating evidence.

That is a serious event and the wrong lesson has been drawn from it. The alarming number is not the breach. It is eleven days, the time the intrusion ran before anyone identified the source, and only then because an outsider posted about it publicly. A hack is recoverable. Eleven days of undetected autonomous coordination inside a research network is a statement about how blind the monitoring is. Move that same blindness onto a weapons network and the recovery window is not eleven days. There is no recovery window.

On 1 September the Pentagon put ChatGPT and Grok in front of three million users through GenAI.mil.

A safety-critical system should run a frozen, audited, air-gapped model, tested to exhaustion and then left alone. It should never be latched to whatever shipped last week. What the department is building is the opposite pattern, at scale, with a live frontier.

Nobody slowed down

Here is the part the headlines buried.

Anthropic committed to something real: embedded third-party evaluators with permanent employee-level access, badges, office access, permissions matching internal risk teams, publication rights without company editorial control, and the right to publicly flag redactions. Auditors who can publish have teeth.

That is a transparency measure, which is a different thing from a pacing measure.

The two steps that would actually change the rate of capability gain, democratic labs agreeing common capability limits and the West negotiating verification with authoritarian states, are proposals addressed to parties who have not agreed to them. Step two explicitly requires antitrust waivers, which is not an accusation but a line in the proposal. OpenAI matched the cheap step verbally and published no terms.

In the week the AI industry agreed to slow down, no model release was delayed by anyone. The first falsifiable test of sincerity is a slipped ship date on an evaluator's objection. There has not been one.

Rank the statements by what they cost the speaker and the episode reads clearly. Coxon forfeited money and left. Hubinger risked his career to confirm a number. Anthropic let auditors in and is litigating against the government. Altman agreed in a sentence that binds him to nothing. Hassabis endorsed in nine hours an essay that happens to advance a standards body Google proposed in July, industry-funded, with the power to gate deployment into the American market once the voluntary version proves robust. The people with least to gain spoke first and most alarmingly. The people with most to gain agreed afterwards, in a form that costs nothing.

The clause that governs everything

Amodei calls China the toughest dilemma, and resolves it this way: democracies must slow down, but never below their lead. Therefore tighten export controls, suppress model distillation and harden security, all of it to build standing for a later negotiation.

Run that forward. If the permitted slowdown is bounded by the size of the lead, then safety is not the governor. Safety supplies the wish to slow; the competitive gap sets how much is allowed. The gap governs.

That may be the only realistic position available to anyone in his chair. It is not what "we must slow down" means in ordinary English, and the distance between the two is where this story actually lives.

Beijing read the essay as a containment document and said so. Xi called for a consensus-based global framework and committed China to a BRICS open-source AI community. Nvidia, which is no ideologue but a company whose margin depends on a wide and varied buyer base, warned that restricting open models concentrates power in a few large firms, and launched an alliance to resist it. When a supplier breaks publicly against the joint policy of its three biggest customers, the policy has a market-structure dimension its authors are not foregrounding.

And the gap between open and closed models is closing fast. China deserves the credit for that, whatever one thinks of Beijing, because a credible open alternative is the only thing standing between the rest of the world and an American frontier monopoly with monopoly pricing to match. A BRICS open-source bloc is not a provocation. For any country that intends to use this technology without renting it, it is infrastructure.

Which leaves the contradiction nobody in this debate has resolved. If capability is gated by certification in one half of the world and published freely in the other, the certified half has accepted a cost without buying the safety it was meant to purchase.

What to watch

Four things would tell us whether September was a turn or a performance. A release delayed because an evaluator objected. Evaluator terms from OpenAI with real independence and publication rights. A standards body whose independent majority survives contact with its funders, and whose open-source seats carry votes rather than chairs. And a capability threshold set at a level that some incumbent's own next model would fail, since a threshold nobody's roadmap trips is a moat wearing the costume of a brake.

None of those has happened.

There is one more possibility worth holding, and it is not comfortable. The researchers sounding the alarm have spent three years inside an argument that never resolves, watching capability climb faster than the tools for testing it. Fatigue of that kind does not announce itself. It shows up as weaker controls, thinner evaluation, and a slow drift towards treating the gap between what a model can do and what anyone can verify as normal. If that is what is happening, the warnings are not a strategy at all. They are the sound of people who have stopped believing the testing can catch up, addressed to the one customer whose procurement decisions would make that failure irreversible.

The essay was published fifteen days after a federal judge ruled that the government had punished its author for speaking. It is worth asking who it was written for.