Table of Contents

1. FDA Reformandum Est.
2. FDA Delenda Est.
3. IN MICE.
4. Doctor, Doctor.
5. Trust The Process.
6. Cancer Screening.
7. Autism Everywhere All At Once.
8. Other Mental Problems Everywhere All At Once.
9. Source Data Verification.
10. External Review Board.
11. Walk It Off.
12. An Unhealthy Weight Can Be Worse Than You Realize.
13. Our GLP-1 Price Cheap.
14. Right To Die Should Include Right To Try.

FDA Reformandum Est

In lieu of plan A, how about plan B?

Senator Bill Cassidy released a new report on modernizing the FDA. Alex Tabarrok approves, which means it’s probably good.

The FDA chief has an even better idea.

Matthew Herper: FDA chief Marty Makary says ‘everything should be over the counter’ unless drug is unsafe or addictive [or requires monitoring].

Annika Kim Constantino: Makary said the FDA is looking at “basic, safe” prescription drugs like nausea medications and vaginal estrogen, which is used to treat menopausal symptoms like dryness and pain.

You’d also want a carveout for antibiotics, but yes. Your offer is acceptable, LFG.

That was the good news. There’s also the bad news, which was the main event.

FDA Delenda Est

Settle in for the tale of Moderna, and its attempt to get approval for a flu vaccine.

They were told their study design was acceptable. Then they got rug pulled. Then a lot of people were very loud and the FDA backtracked a bit while pretending not to.

Jeremiah Johnson: I remember reading that the EA case for Trump was that we’d see a flood of new drugs with a more innovation-friendly FDA.

Alex Tabarrok: I Regret to Inform You that the FDA is FDAing Again.

I had high hopes and low expectations that the FDA under the new administration would be less paternalistic and more open to medical freedom. Instead, what we are getting is paternalism with different preferences. In particular, the FDA now appears to have a bizarre anti-vaccine fixation, particularly of the mRNA variety (disappointing but not surprising given the leadership of RFK Jr.).

It could have been one way. It’s the other way.

We’ve also lost Jim O’Neill, who was basically our last best advocate for reasonable policy, but on the bright side he’s going to the National Science Foundation. That’s also a good spot for him, but I worry his value over replacement will be a lower there.

mattparlmer: I’ve been restraining myself from political commentary for the last few weeks, but I would be remiss not to register my extreme disappointment at the groundless sacking of Jim O’Neill

The Trump admin desperately needs competent people, Jim is exceptionally competent, this is bad

Samuel Hammond: welp

This is what happens when you burn the term supervillain on people who want lower prices on drugs. What do you then call people who outright destroy one of the most promising medical advances of our time for no benefit whatsoever, via torching a $750 million study for decisions the FDA had explicitly already approved.

In this case, via withholding review for a drug that they had no business requiring the study for in the first place, in order to retroactively demand an absurd standard?

The FDA claims no, they didn’t say this study design was valid, but they’re lying, of course they did, there’s no way you spend $750 million dollars here without checking.

CNN Breaking News: The FDA has refused to accept an application from Moderna to review its first mRNA seasonal flu vaccine, the company said.

The agency told Moderna that its application didn’t contain an “adequate and well-controlled” trial because the control arm didn’t reflect the “best-available standard of care in the United States at the time of the study,” according to a letter dated February 3 that Moderna posted online. It didn’t identify any safety or efficacy concerns, the company said.

Moderna said that the refusal was inconsistent with previous feedback from the agency and that it had requested a meeting with FDA officials to understand how to proceed.

Alex Tabarrok: Hilarious: Trump admin is torn between those who say Moderna’s flu trial was unethical because it didn’t use a high-dose vaccine as comparator, exposing participants to “increased risk of severe illness,” and those who say it was unethical because it didn’t use an inert placebo!

Per STAT, Prasad overruled FDA scientists to reject the application outright, and we have confirmation that staff was ready to review.

As an obvious technical note, we already have extensive data on how different existing vaccines relate to each other, so even if you thought that we shouldn’t allow a new offering until it was proven strictly superior and you changed your mind about the current standard, it is not statistically difficult to back out the necessary information.

Christina Jewett: NEW: The F.D.A. refused to accept an application from Moderna for its mRNA flu vaccine.

Its reason: The agency did not think Moderna compared the new vaccine to one of the best flu shots available. The company spent $750M+ on a 41,000 person study.

Ruxandra Teslo: This is a very bad precedent. Regulatory agencies changing their stance after ok ing a study is one of the worst things for innovation.

Sam D’Amico: This is going to waste a week of my time every other year for the next 20 years

Leah Libresco Sargeant: “What is most disturbing is not the specifics of this case but the arbitrariness and capriciousness of the process. The EU, Canada, and Australia have all accepted Moderna’s application for review.”

Christina Jewett (NYT, February 11): UPDATE — FDA defends this refusal, but also retreats, calling this routine dialog with drug makers and saying it will work with Moderna —

The Food and Drug Administration on Wednesday backtracked on its refusal to review Moderna’s mRNA flu vaccine, while making an unusual public defense of its decisions on drug approvals.

… Dr. Marty Makary, the F.D.A. commissioner, suggested during a Fox News interview on Wednesday that the agency might eventually approve the vaccine. He characterized the rejection of Moderna’s application as “part of a conversation that occurs with all drug makers” and said the agency would continue to work with the company.

Matthew Herper: Here the Moderna flu data the FDA refused to review.

This is the most important slide from the company’s study of its experimental flu vaccine– exactly the data FDA said it wouldn’t even review.

And below is a thread of relevant slides from that presentation and links to other relevant studies I wanted to bookmark. (I’m a reporter who covers this stuff.)

Matthew Herper: As you can see, volunteers who received Moderna’s flu shot, mRNA-1010, had about 26% less influenza-like illness in a 40,000 patient study.

These slides were presented to Moderna investors in November. Vinay Prasad, a top FDA official, told the company the vaccine would not be reviewed because the company compared to a standard, not high-dose, flu vaccine, and high-dose vaccines are standard for people over 65.

Here’s more background on the study. It enrolled, 40,000 people. They’re about evenly split between the 50-64 age group and the 65+ group.

mRNA vaccines can cause fatigue, achiness, and headache. They certainly saw that here.

Here’s the efficacy for different strains of influenza.

The full slides are available here. It is not obvious this particular vaccine is a good deal for most people, but it clearly works, and they did what the FDA said to do. The FDA pulled the plug anyway, not even examining the findings.

It is hard to overstate how destructive this is. This meaningfully hurts your quality of life, the number of days per year you can expect to be sick, and your long term life expectancy.

That’s because if Moderna has to worry about the FDA retroactively withdrawing its word on what studies will be accepted, after the work is done, and they are facing an mRNA-hostile FDA in general, they have no choice. They were already abandoning much of the work.

And everyone else has to have the same worry everywhere else. Oh no. At minimum, this forces ballooning costs as studies have to be designed defensively in case the wrong person at the FDA suddenly changes their mind.

Good luck implementing risk-based monitoring (RBM) or otherwise cutting costs, and many potential drugs will be abandoned.

unusual_whales: Moderna’s, $MRNA, CEO has said that the company will no longer invest in new Phase 3 vaccine trials for infectious diseases: ‘You cannot make a return on investment if you don’t have access to the U.S. market.’ Vaccines for Epstein-Barr virus, herpes, and shingles have been shelved.

Dr. Lakshay Mittal: When late-stage programs for Epstein–Barr, herpes and shingles get shelved, it shifts the pipeline risk profile of the entire biotech sector.

Investors will start asking which other infectious disease programs depend heavily on US market access.

Nick Mark MD: Three points:
Moderna and FDA had previously agreed on the control arm dose. FDA went back on that agreement.

Presumably Prasad signed it because everyone else refused to.

If FDA pulls a switch like this it really kills biotechs incentive to do big trials. (this was n=40k)

Paul Offit: A closer look at the FDA’s recent kill shot against an mRNA influenza vaccine.

The pivot by Moderna to not invest in new Phase 3 trials was announced at Davos in January in the face of other symptoms of FDA hostility. Every person who gets Epstein-Barr, herpes or shingles more than a few years from now should know exactly who to blame for this outcome. That is only the start. Other companies, even those not focused on mRNA, have to now factor in this risk.

The good news is that we managed to yell loudly enough about this one that they may refuse course.

Christina Jewett: Two points here. First, one of these two people is lying, and it would be a hell of a thing if the liar was Moderna. Second, whether people were previously from some point of view exposed to risk of illness has zero bearing on whether you should now expose everyone to risk of illness.

Saying in hindsight that the trial you approved was ‘unethical’ when it was clearly net beneficial to patients and there’s no case this contaminated the study? Complete and utter bullshit.

Especially when you’re simultaneously arguing the exact opposite:

Mr. Kennedy long raised concerns as a vaccine activist that the inactive ingredients in vaccines could cause harm and should not be used in human trials.​

They say Kennedy was not involved here, but he’s head of the agency and has been furiously acting to undercut Moderna and its mRNA research at every turn.

One can try to frame this all as business as usual, and there are advantages to everyone coming away thinking about it that way whether or not it’s true:

Jessica Adams: The bad news is that I do not believe this was remotely normal. A lot of the damage is done and cannot be undone. The procedural decision itself is bad enough even if it is ultimately reversed. Mock the ‘chilling effect’ at your peril.

Venk Murthy tries to frame this as ‘rebuilding trust’ by the public, but I expect this only further inflames popular paranoia about vaccines, because of the reversal, and the key ‘rebuilding trust’ that is suddenly necessary is the trust in the FDA by those researching vaccines. Without that, no new vaccines.

Alex Tabarrok shares this, which summarizes the ‘medical freedom’ movement driving much of this. Do you really think you can ‘rebuild trust’ with such folks?

It is important, when people’s objections are Obvious Nonsense, to point this out.

IN MICE

Progress is being made.

We now have a single vaccine could protect against all coughs, cold and flus, researchers say. Well, okay, IN MICE. But it’s a start. The problem is, do they have the regulatory confidence to fully invest in that?

Stanford researchers identified 16-PGDH as a root cause of cartilage loss, claiming the mechanism works IN MICE, and also in human tissue samples. Epirium for now is doing Phase 1 trials for sarcopenia. FDA Delenda Est so we’re looking even in an optimistic case at 5-7 year timelines, but if it all works it’s possible this solves not only arthritis but a wide range of quality of life issues. Alas, this won’t do that much for life expectancy on its own since these mostly aren’t the things that kill you, but it could be a big win in QALY terms if it works out.

Doctor, Doctor

How should you describe your situation to a doctor? You want to be respectful and honest with them, but if you dump a bunch of information they can get easily distracted in predictable ways. I buy Carl Feynman’s advice here to start with your diagnosis and key facts that seem most relevant and unlikely to mislead, then only later give the rest. Think of it as (polite) prompt engineering. LLMs can help you.

Trust The Process

This is one way to do plastic surgery, but you’d better be damn sure you’ve solved the associated principal-agent problems and the surgeon has good taste:

Aella: Y’all my plastic surgery made me look moderately cuter. The feeling of seeing yourself more attractive in the mirror for the first time after the swelling finally fades is transcendent. You’ll have to pry the scalpel from my cold dead hands.

Aella: my strategy this time was to go into the surgeon’s office, refuse to tell him my own concerns, ask “what would you do to make me look hotter”, and then blanket accept everything he suggested – even if I hadn’t thought I needed it.

rohit: –dangerously-skip-permissions

It seems right that most people are not good judges of what would or would not make them look hotter, and that experts will know better, but also those experts have incentives. Perhaps you should focus more on establishing trust than trying to solve the problem yourself.

Also the person who most has to look at you will be you, so your preferences matter. Don’t fully ignore them. And yes, there is cumulative risk of backfire if you overdo it.

Cancer Screening

AI but not LLMs: New large study (n = 105,934) of AI in cancer screening that started in April 2021 finds strong results from Transpara Version 1.7.0. Gains plausibly were largely about workflow integration and use of risk scores, rather than AI as a standalone second reader. Descriptively, there were overall 16% fewer invasive, 21% fewer large (T2+), and 27% fewer non-luminal A interval cancers in the intervention group compared with the control group, and the detection rate of cancer rose 29%, while enabling a 44% reduction in radiologist ‘screen readings.’ They got increased sensitivity without loss of specificity.

I am deeply confused by the whole ‘we still don’t know if this would be worth the cost’ response. What cost?

Mohamed Foda: 100K women. 29% more cancers caught. 44% less workload. And somewhere a hospital administrator is still asking for a 3-year committee review before adopting AI. This is what happens when medicine actually evolves.

That’s for old school AI that was available back in 2021. Diffusion not going great.

Autism Everywhere All At Once

Autism as it is now super broadly defined and aggressively diagnosed may hit boys and girls in roughly equal measure. The marginal diagnosis clearly does net harm, and as explained previously there has been no actual increase in autism rates to explain.

Steven Pinker: The autism epidemic is a myth: The increase is only in expansive overdiagnosis of kids “on the spectrum,” e.g. “Would rather be alone than with others,” “Has difficulty making friends,” and “Is regarded by other children as odd or weird.” Severe cases (no language, socially unresponsive, etc.) have decreased. By my former grad student @AdamOmaryPhD

Justin Gregory Briggs: In the 20+ years I’ve been in the mental health field, the diagnostic criteria for autism have become so broad that they are clinically useless. Any spectrum that includes some of the most productive people on Earth and people who require 24/7 care is not interpretable.

Other Mental Problems Everywhere All At Once

Jesse Arm also has a similar view to this, as do I:

TheLegalProcess (v3.0 | Instruction Not Therapy): Honored to be a contributor with @CarolynGorman_ on this issues brief and model legislation for @ManhattanInst . In 2025, IL and LA accelerated the use of universal mental health screenings in schools.

We take a contrarian view. Schools are not mental health clinics: ban them.

Universal mental health screening is ineffective at creating prosocial behavior and improved academic outcomes. The practice is also harmful – and occurs almost wholly unregulated by state boards of behavioral health.

Carolyn D. Gorman: This issue brief provides an overview of universal school-based mental health screening, related law and evidence, and practical and ethical concerns. It finds that:

1. Universal mental health screenings are ineffective: they do not reduce the prevalence of mental health conditions or improve academic outcomes.
2. Universal mental health screenings are harmful: they produce overwhelmingly high rates of false positives and, when delivered in schools, have fewer protections in place than in clinical settings.

Given the lack of evidence for universal mental health screening, this brief recommends its prohibition in schools. For targeted and individual school-based mental health screenings, far stronger regulatory conditions are warranted. Model legislation is provided for implementing these recommendations.

Mental health screenings sound like a good idea, but the false positives and overtreatment and medicalization of problems that result in practice mean they end up doing more harm than good. Such screenings look for trouble, and trouble they often find, which can be devastating for kids and families.

Source Data Verification

Adam explains some of the reasons clinical trials are inefficient.

Adam: There are many examples of waste and inefficiency in clinical trials, but I want to highlight among these, one practice stands out: a practice called 100% source data verification, which is both distinctly wasteful and can tell us a lot about what does – and what doesn’t – drive the inefficiencies in today’s trials.

… After the site sends the data they collected to the sponsor, the sponsor sends a consultant to the site to pore through their paper records to make sure that every single data element the site collected matches the data the sponsor received.

That seems rather obviously crazy. Even the FDA now agrees. Yet Adam claims this is what typically happens.

100% source data verification is a huge task. The typical phase 3 clinical trial collects 3 million data points. So it is perhaps not surprising that it’s expensive to check them all: the process of 100% source data verification accounts for 25%-40% of clinical trial costs. And it’s completely pointless. It doesn’t meaningfully help with clinical trial quality. The FDA has publicly and repeatedly recommended against doing it for over ten years.​

Nobody has a very good explanation for why the industry continues this practice.

Easy. Ban the practice, as in have the FDA require you not to do it. Alternatively, Claude thinks the concrete fear is how things will look on audits, so you can create rules to protect you from audits.

Instead we have the opposite, now more than ever. The FDA is announcing it will look for any excuse to deny your application in at least some cases.

The question then is, are there cases where the FDA will look for any excuse to say no, but end up having to say yes anyway? There might not be. A common pattern when seeking approval is that you beat yourself up over details that might matter, and then you get told one of your choices mattered, when really their mind was already made up for other reasons.

Also I saw claims that this particular data point does not hold up. Claude notes SPV is not universal, but thinks the claim of 25%-40% of total costs is plausible.

The other big obvious problem is that our scientists have yet to learn the secret of mass production.

Unfortunately, today’s approach to clinical trials looks much more like NASA’s “Big Space” approach than SpaceX’s iterative approach. Each trial is created from scratch. Researchers develop a protocol custom-designed to study a specific drug. Then, infrastructure, researchers, and contractors are all onboarded for that specific trial.

Finally, that one-of-a-kind trial is executed, carrying its precious cargo: the pharmaceutical company’s treasured pharmaceutical asset, with billions of dollars of revenue on the line.​

This again seems obviously crazy. There should be a standard product called a clinical trial, you should do it in standard ways over and over again.

Why no fixes?

Could one of the incumbents in this industry break through this morass? It’s unlikely because there are no players in the industry with the ability, resources, and incentive to drive improvement.​

It starts with a lack of motivation. Pharmaceutical companies don’t face competitive pressure over trial costs.

… But let’s say a company were aware of these problems and genuinely wanted to do something about them. They still might lack the internal capacity to do so.

… The clinical trials industry has a culture problem. In short, they don’t sufficiently acknowledge that they are an industry in the first place.

… The result: leaders and policymakers don’t apply an engineering mindset to trials.

I don’t buy the ‘no motivation’ argument, as reduced costs drive more profits, and there are at least several big players who do enough iterating to justify this, and if they figured it out they could turn the trials into a new profit center.

This feels like a clear ‘if he wanted to’ situation. You can fix the cultural issue if you care enough. The real problem is indeed cultural, and it’s that they consider everything involved sacred, and everyone demands the everything bagels at all times, and those are sufficient legal and other barriers that no one dares try to fix things.

External Review Board

Why not let researchers choose their own accredited IRB, at the risk of taking some of the internal out of the review board? This is very much a ‘mostly disarm the IRBs’ proposal and I fully support it. That’s because I think IRBs are totally out of control and cause orders of magnitude more harm than they prevent, so letting people shop for the most efficient and accommodating one seems fine. The point would be that someone independent of you has to put themselves and their reputation on the line to say you’re doing something reasonable and not doing any blatant ethical violations, whereas right now no one can do much of anything.

Walk It Off

A new large observational study claims that 45 minutes a day of walking gives you most of the all-cause mortality benefits of exercise, and running doesn’t do better than walking until you do rather a lot of it, whereas too much jogging can actively backfire and swimming and bicycling do little. Doing multiple types of activity was better.

Note that the X-axis on different graphs can be very different here.

It’s an observational and self-reported study, so you can’t assume causation and doubtless ‘willing and able’ correlations should be doing a lot of work. Presumably people who swim or bicycle must have some real problems? But there’s still a lot of explaining to do and in some places that only raises further questions.

The obvious response is to defy the data, or at least some of it, or at least attribute it to selection effects. It doesn’t make any sense for bicycling and swimming to have about zero effect and jogging to start actively backfiring this much, while walking cuts mortality by 20%.

I do buy that this is evidence for ‘if you do a lot of walking that largely counts being active and doing exercise.’

An Unhealthy Weight Can Be Worse Than You Realize

Being in generally poor health causes all sorts of other issues, part quite a lot:

Not a Good Jewish Girl: My fiancée is extremely mad that losing 20 pounds with a GLP-1 has basically cured her sleep and back issues and made her PMS symptoms much more tolerable, improving her overall mood on a daily basis and making her job less stressful.

These drugs should be fully subsidized.

The obvious way to do that is to buy one of the drugs and give it away, or sell it as a generic at marginal cost. It’s fine to pay the NPV of future royalties to get it, it’s a win-win, and you only have to buy one of them so you can play them off against each other.

Our GLP-1 Price Cheap

Arthur B.: The US government could buy the patent for some oral GLP agonist like orforglipron for under $30B, give it away with Medicaid and save about $200B a year in Medicaid / Medicare future spending on obesity-linked diseases.

Or the market can solve this on its own, if this crosses the threshold and becomes worthwhile enough that consumers pay cash. Go go gadget market incentives.

David Wainer: Two years ago, a GLP-1 prescription could cost an uninsured patient more than $1,000 a month. Today, Novo Nordisk’s Wegovy pill starts at just $149 through cash-pay programs.

… Then on Thursday, shares of both companies fell sharply after Hims & Hers Health announced a $49-a-month compounded version of the Wegovy pill. They rebounded Friday after the Food and Drug Administration chief threatened action against the mass marketing of copycat drugs.

Scott Lincicome: Fascinating: Eager GLP-1 consumers bypassed the traditional employer-based insurance system and instead turned to cash/direct-payments (+ telehealth scrips), leading to a Big Pharma price war and now cheap brand-name drugs.

Enguerrand VII de Coucy: I find it difficult to understand how this could have happened, it’s almost like a force that we can’t see intervened in the GLP-1 market to bring prices down as unrestrained market competition increases… an invisible foot stomped down prices, perhaps? Translucent elbow?

Then again, perhaps the market is solving this via patent infringement? Novo Nordisk says so in their lawsuit against Hims & Hers.

Right To Die Should Include Right To Try

In Canada and want to try an experimental treatment? We can’t allow that, would you instead like to have us help you commit suicide?

I think it’s reasonable to be for or against assisted suicide to varying degrees. But if someone would be allowed to invoke MAID and kill themselves, then you have to also allow them (on their own dime as needed) to then do any other crazy thing that only might kill them. As Alex Tabarrok puts it: If you have the right to die, you should have the right to try, at least if you absolve the system of your future oversized directly related medical expenses.

Meanwhile:

Leah Pierson: omg this title, this paper

Scaramouche: My doctor told me ethics approval keep letting his patients die so I asked how many patients he has and he said he just goes to the shelter and gets a new one afterwards so I said it sounds like he’s just feeding cancer patients to ethics and then his daughter started crying

After events surrounding Anthropic and the Department of War, I plan on taking full advantage of whatever lulls I can get. Things are only going to move faster over time.

That means a higher bar for coverage, and it means potentially skipping more days, or using those days for short posts that either spin off fun little things or that embody concepts I want to refer back to over time.

In the meantime, here’s everything that doesn’t go anywhere else, and that does not want to fully stand on its own.

Table of Contents

1. Sauce For The Goose.
2. Age Verification Has Severe Issues.
3. Bad News.
4. A Pattern Language.
5. Good Advice.
6. While I Cannot Condone This.
7. Locking In.
8. Subscription Price Dynamics Are Weird.
9. Good News, Everyone.
10. For Your Entertainment.
11. Slay The Spire II.
12. Gamers Gonna Game Game Game Game Game.
13. The Gathering Is Magical.
14. Sports Go Sports.
15. Government Working.
16. Not Great, Britain.
17. Variously Effective Altruism.
18. The Road To Hell.
19. Jones Act Watch.
20. Patrick McKenzie Periodically.
21. The Lighter Side.

Sauce For The Goose

There are some basic principles. Don’t shoot the messenger. Honor guestright and flags of truce. Don’t torture people. Families are off limits. No double taps.

No political violence or assassinations. None.

If we continue to pursue the ‘decapitation’ theory of warfare, or the ‘kingpin strategy,’ then I do not believe that goes in good places. So far this hasn’t been flipped around against the leadership of democracies so much, but how long will that last?

I do not want to live in a world where the governing principle is power comes from threatening leaders with death unless they do what you say. Where power goes to those who can threaten and blackmail and destroy. Nor should potential targets.

This is an especially bad time to be introducing this norm, when killer AI drones are very likely about to become much more of a deal. We’ve been lucky there so far.

Age Verification Has Severe Issues

The basic issue is that this makes everyone’s experience worse, is a huge unconstitutional invasion of privacy, drives everyone especially children towards VPNs and exactly the wrong websites, and teaches everyone to ignore the law.

The other issue is that no one knows how to reasonably implement them. Age verification systems don’t work against anyone who wants to get around them, and also constantly leak personal information. Persona’s CEO is unusually good in admitting that bypassing it is easy.

Did you know that if you can query an iPhone or Android to know if the user is 18, then an app can query every day, and figure out your birthday when you turn 18.

Those laws are also sometimes written so badly they end up banning calculators.

George Grab-and-Flee: You think kids should be able to just see 80085?

Bad News

China and in particular Shenzhen is crushing manufacturing through rapid iteration and ecosystem density. I agree with the diagnosis here that ‘work harder’ is not the problem that requires solving for everyone else, at all.

Kelsey Piper explains some additional reasons not to steal.

Pretty Little Liars, a book published in 2006, retroactively edited to include TikTok. When they edit books to remove now-verboten words or concepts I hate that but at least I understand why. To do it to update the cultural references is less dangerous but also is a whole higher level of abomination.

A Pattern Language

Nat Sauer: Every time I throw a large house party i am surprised by where people end up congregating. It’s never where I plan for them to congregate.

systemlayers: A few years ago UCLA did a study on room usage. I often think about how useless a porch/dining room is. Why hasn’t there been more innovation around how people ACTUALLY use their space in their homes?

David Roberts: I think the message about the uselessness of formal dining rooms has finally gotten through — I never see them any more.

The way people use space follows from design and actual patterns of life experience. If you notice people using the space ‘wrong’ then that’s on you, and you can either accept that and lean into it or you can redesign to get the patterns you want. Often subtle changes can radically improve interactions or shift them were you want them.

Good Advice

At some point I hope to do some Good Advice posting in my own capacity.

Dan Frank offers his top 50 pieces of advice. It’s always good to see people’s lists, even if you disagree with a lot of their choices, while remembering to reverse any advice you hear including from me (but remember, when it’s from me it’s never investment, legal, medical or otherwise prohibited advice).

The key is the advice has to be interesting and non-trivial. It has to either teach a new thing, or argue for a perspective or approach. Dan Frank does well here.

I especially appreciate when, as holds here, the points form a particular perspective, and embody it well. In this case, it’s that staying positive, looking for the upside, finding a good fit, putting in the effort and actually doing the thing are the keys to success.

In this case, here is how I feel about all these points, many of which are +/- one level if you asked me again another day, especially when I agree with the principle but not the chosen example, or there are two claims and I buy one but not the other:

Strongly Agree: #4, #5, #6, #7, #12, #15, #17, #18, #25, #33, #38, #40, #42, #43, #45, #48, #50

Directionally or Conditionally Agree: #1, #2, #10, #14, #16, #21, #28, #29, #30, #32, #36, #39, #41, #44, #47, #49

Mu, It’s Complicated: #3, #8, #11, #24, #26, #34

Directionally or Conditionally Disagree: #19, #20, #22, #31, #35, #37

Strongly Disagree: #9, #13, #23, #27, #46

Overall Grade, adjusting for difficulty: A- or 9/10.

I could easily write a post several times longer than Dan’s, explaining why I gave these answers, or in many cases explaining only one answer.

There’s then a sequel post with more things. It felt conceptually repetitive in spots, but it’s a strong list with some excellent reminders.

Strongly Agree: #2, #5, #9, #12, #14, #16, #18, #20, #21, #26, #27, #29, #33, #34, #36, #37, #40, #46

Directionally or Conditionally Agree: #3, #4. #7, #11, #15, #17, #24, #25, #30, #35, #41, #44, #45, #47, #50b, #50c, #50e

Mu, It’s Complicated: #8, #10, #22, #49, #50d

Directionally or Conditionally Disagree: #1, #19, #31, #38, #39, #43

Strongly Disagree: #6, #13, #23, #28, #32, #42, #48, #50a

Overall Grade, adjusting for difficulty:

Frank also suggests ‘tasting day,’ as in things like buying five babkas or brands of ice cream, as social events. It’s fun, it’s cheap, it’s informative, it’s got a hook. I agree, this seems great. Food crawls are also excellent ideas.

Brian Armstrong suggests if you’re not sure what to do, just do anything, even the wrong thing, and that gives you information. I give this one a ‘it’s complicated,’ since this can be anything from a great idea to a very bad idea to a justification for anything.

Nate Silver misses the key difference:

Nate Silver: “You can just do things” is basically the same heuristic as “Everyone has a plan until they get punched in the face” except for people who haven’t been punched in the face yet.

The key difference is that you are not inviting Mike Tyson to punch you in the face. The reason ‘you can just do things’ is good advice is that for remarkably many things no one stops you or even objects, and only rarely do they even metaphorically punch you in the face, and when they do most of the time it’s mostly fine.

While I Cannot Condone This

This makes sense: Weddings pay a lot extra for venues because it’s the most important day of your lives and you need everything perfect so you’re probably going to be extra demanding and likely to break things. Similarly, you’re often not going to compromise on many other things that cost a lot, so you pay a lot.

Televisions have gotten radically cheaper. Why aren’t many other physical goods getting similarly cheaper? One argument is that this is because televisions no longer signal status and basically can’t get better, so all the focus is on getting cheaper at scale. I’d say becoming smart TVs did make them radically better, but that part is cheap and has basically zero marginal cost. It’s suggested that mass produced generic goods like IKEA bookshelves also get cheaper, but sofas change every two years and the bikes keep adding features, so they don’t get the same discounts.

The obvious question is, why change the sofas and bikes? The old sofas and bikes were fine. Yes, you might want New Hotness, but given the option to get TV-level-cheap copies of older goods, people would accept static quality. Some would want to signal status, but I think a lot of us would do that elsewhere using money saved.

Then there are products like mattresses where the companies don’t want you to know which ones are good or offering good value, or to compare notes with others, they’d rather try to get you to rely on a salesperson, so they intentionally rotate everything. No wonder things don’t get better.

I don’t know who the best philosopher ever is, but I know it isn’t Colin McGinn because he claims that it is him. Well, actually we do know, it’s Amanda Askell.

Is it a good argument that immigration aren’t ‘ruining’ a particular city if housing prices are going up? One can see where that is coming from, but immigration brings in new demand for housing, and supply for housing in particular is often close to fixed due to NIMBY restrictions. So it seems very possible for the city to get otherwise worse, but for housing prices to go up which is also worse. Tyler Cowen says ‘NIMBY factors will not reverse the basic conclusions’ but I don’t see how you can assume that.

Elon Musk brags he is ‘the largest individual taxpayer in history,’ having paid over $10 billion in taxes in 2021 when he exercised all his Tesla options, and that he thought the IRS might send him a little trophy. As DTDavis replies, his current net worth is $844 billion, so he has been taxed a very small percentage of his net accumulated assets. Even if you add in his lower tax bills for other years, it must be nice paying such a low tax rate. I’d still be happy to send him the trophy. Maybe two trophies, one for taxes paid and one for taxes dodged.

Continuous wealth taxes are ruinous, but a one-time lifetime minimum tax rate seems reasonable if you can attach them as debt to illiquid assets and it never resets?

How should we model various forms of letting people access small amounts of cash in emergencies for people always short on cash? As Patrick McKenzie notes it can suddenly get very expensive to be short on cash. The problem is that a ‘cheap’ source of such cash won’t be held back for emergencies, and gets used up, and isn’t there when you need it. So you want your ability to ask for $20 or $50 to come with real friction attached, without being too expensive. High resolution spot labor markets, as in DoorDash driving, can actually serve this niche quite well.

We say we want ‘healthy choices’ at places like McDonald’s but almost never use them when offered, because if we wanted to eat healthy we wouldn’t be at McDonald’s. You go to McD’s for the joy and comfort and to get a great deal on calories per dollar. I do think there is social value in including healthy options, but that’s primarily ‘I have to go here with others so I guess I can get this’ which by its nature will not sell well.

Locking In

Working hard, hardly working or completely locked in?

helmet girl: I don’t have an OF because I’m not on the grindset like that. All my friends with OFs have a work ethic I literally cannot fathom.

Aella: the difference in a “someone’s forcing you to do x work ethic” and a “you’re your own boss” work ethic is a gaping chasm

West Coast Kenny: Yeah, it was a huge adjustment when i started ubering

Rather than two core levels, I think it’s better to think about three.

1. Hardly Working: No returns to productivity. Your true task is to appear to work, to not get fired, to please your boss or coworkers, to play politics.
2. Working Hard. Linear returns to productivity. An honest day’s pay for an honest day’s work. You’re trying to actually accomplish the task or cut the enemy, but you don’t need to outright maximize.
3. Completely Locked In. Increasing returns to productivity. OnlyFans is a central case here, so are most startup founders and many startup workers as well. Competitors and athletes and so on.

Uber only moves you from category one to category two. That’s a big adjustment, but it doesn’t do the ‘cannot fathom’ level of work ethic.

There is a huge chasm between #1 and #2, and also between #2 and #3.

Subscription Price Dynamics Are Weird

The actual surplus comes from the AIs producing outputs worth orders of magnitude above marginal cost. The rest is market dynamics.

Consider how much the median ChatGPT $20/month subscriber would pay in API costs for their queries. It’s basically nothing. The $200/month level is also printing money on most subscribers, except there is a long tail that are maximizing usage where I presume the companies take a loss.

roon: it is absolutely insane that my combined substack subscriptions easily rival my pro tier chatbot subscriptions. the pricing norms that were set by chatgpt were one of the greatest handouts of consumer surplus in history

Pliny the Liberator 󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭: lest we forget: the greatest handout in consumer surplus history was AI labs paying $0 for everyone’s data

the models are only as good as the human creativity they were scraped from

Getting the info for free was a giveaway but Pliny of all people should know that the models are not only as good as the human creativity they were scraped from.

Roon is pointing to a very real problem with ‘minor’ subscriptions, which is that they add up fast. If you’re paying $10/month for each individual newsletter, newspaper or podcast or Patreon or streaming service, including ones you only occasionally utilize, that can add up fast even if you never forget to cancel. You either pay a ton or you accept you’re often locked out.

It would be much better if you could do a global subscription and then they divided distribution according to your actual consumption. I’m generally a big bundling fan, especially as it removes feel-bads and cognitive load. Alternatively a ‘pay as you go’ microtransaction system would be great too and seriously we have Claude Code someone go build this properly.

The exception would be those creators that you want to support for the sake of supporting them. That’s different. When I’m not trying to actively support someone, and it’s only about access, I have a very high bar for subscriptions, and a much lower bar for one-time costs. A lot of this is that if you’re behind a paywall that can’t be evaded easily, you’re importantly not part of the discourse except insofar as you are quoted, and also there’s infinite other content.

Good News, Everyone

Be like Magnus Carlsen and Richard Feynman, and always be funmaxxing. Follow your curiosity and the love of the game, and the rest will follow. Obviously it is not that simple, you still have to do all the other things too, but slack and having fun are vital parts of any worthwhile creative enterprise.

From last year via Caleb Watney: NSF is launching Tech Labs and will be investing $1 billion into $10 million to $50 million per team per year for five year commitments, allowing labs to engage in longer term riskier plays or invest in public goods like data sets, tooling or scientific platforms, and not spend all their time fundraising and finding small surefire ways to show enough success to keep the money flowing. This is excellent. Stuart Buck also explains why it makes sense. I expect it to mostly be overtaken by events in AI, but it is very much worth doing.

Tyler Cowen suggests this is an excellent podcast with fresh material.

I approve of the proposal of ‘ma’am, this is a map store’ as a positive-valence, ‘this is an even more relevant place for you than you know yet, you are among friends’ signal, in contrast to classic ‘sir, this is a Wendy’s.’

Remember that life really is getting better in dramatic ways, including food costs.

Human Progress: 75 years ago, 1 out of every 5 dollars a US family earned went to food. Today that’s closer to 1 in 10. A slow, steady, easy-to-miss kind of progress.

Kelsey Piper: we have been heavily emphasizing history at the kids’ school and I’ve noticed it change their whole outlook on life as they get a sense of how awful the world used to be and how incredibly lucky we now are

the other day my daughter was handwashing a pot so she could make herself oatmeal and she said aloud “dishwashers are an incredible invention!!”. she’s right and I’m so glad that she could notice that and have that lens on the limited manual work we still have to do

On the specific example: We’re not only spending a lot less on food, including less time, we’re getting a lot more for our time and money. Food is dramatically better, variety is way better, and we’re often getting it prepared by professionals and then often driven right to our home. Those who think food is getting worse or more expensive are wrong about this, and focused on local isolated changes.

For Your Entertainment

Paramount bids too high and wins the war for Warner Brothers. My Netflix stock thanks you, sir. It would have been cool for Netflix to get the Warner and HBO catalogues, but this works as well.

What do you do when you get your kids Spotify so they can listen to music, and then Spotify betrays you and adds looping short form videos? Andrew Rettek suggests only putting Spotify on a Google Home, which rules out videos. You could also use an alternative service such as Amazon Music or Pandora. Taoki points out it can be disabled.

We used to have this great thing we called Star Trek. Now we don’t, because its shell is run by Alex Kurtzman who thinks he’s here to do deeply lazy social commentary and sci-fi action sequences and maybe some paint-by-numbers things that nominally look Trek-shaped. Which is why he says science fiction isn’t about the future.

Slay The Spire II

Slay the Spire II is available. Spires are indeed being slain, mostly while unspoiled.

If you want the fully unspoiled experience, skip this section and come back to it later.

You should play Slay the Spire II if and only if you played a lot of Slay the Spire I and you like the idea of slaying more spires.

Now, some minimally spoilerific thoughts.

The new characters seem harder than the old ones, especially in that if they don’t come together they fall apart and suddenly die, but that could be lack of experience, and especially not knowing how to pursue some of their strategies.

Regent seems like it requires you to have a good mix of stars and star uses, which gives you more ways to fail and for cards to not be useful. There’s a bunch of themes especially in Necrobinder, that seem like they’re supposed to be things you can make happen, but that don’t seem supported enough to make happen, and all my wins have heavily relied on multiples of one particular common.

Defect has a much harder time gaining focus, as Defragment is rare and Consume and Biased Cognition are gone, so it’s not entirely clear how he’s supposed to work when I stop hitting Defragment all the time anyway (how lucky), whereas the new Ironclad and Silent seem quite strong.

The new boss rewards move away from energy and towards other changes, including a lot of upgrades and card removes, in ways that will take a while to properly adjust for.

If there’s one criticism of the game, it’s that this is ‘more Slay the Spire’ and stays too close to the original, and feels more like a (very good) mod than an entirely new game.

Another criticism is that the enemies seem less distinct, and are doing less to punish strategies that are otherwise overpowered, whereas there are a lot of ‘these numbers escalate steadily over time’ fights. In particular, Time Eater and the Heart in the first game punish doing a lot of card spam, whereas in the sequel card spam goes almost entirely unpunished, and there’s no version of Awakened One either.

Yes, there are exceptions, and a few little things, but they mostly don’t matter. Do powerful things quickly, and you win, if not you lose. The game also needs a proper boss gauntlet and final test in general, without which (for now) most runs that make it to Act III have basically already won and have every reason to dodge elite fights. Boo.

There was one defect deck I had that was built around Top and that would have been in deep trouble against one of the three Act III bosses, but that’s one time out of a lot of runs, and I dodged that fight.

Similarly, one cool tension in Act I of the original is worrying about Gremlin Nob, so you didn’t want to go too heavily into skills or a slow build too early. Now that’s gone. You do still have multiple ‘I suggest you kill me quickly’ elites, but there’s less interesting tradeoffs there, and the new version of active skill punishing that seems to be one hallway fight where you’re limited to one skill per turn. It’s not the same.

One welcome change is that the ascension levels so far escalate much faster. The impacts are very much not messing around, whereas before a lot of them were minor although minor things add up, but that meant playing a lot of games if you didn’t want to ‘cheat’ and edit the file.

Gamers Gonna Game Game Game Game Game

Top quick easy to teach games with flexible player counts, for lunchtime breaks, from Paul Smith. Kariba, Faraway, The Resistance (aka Avalon), Eight Minute Empire: Legends, Panda Spin and Lord of the Rings: The Fellowship of the Ring Trick Taking Game. He also recommends games for beginners: Dorf Romantik, Flamecraft, Azul, Sushi Go, Harmonies and Ticket To Ride: Europe (or USA but he prefers Europe).

Ticket to Ride (USA or Europe) can be a lot of fun, and it’s easy to explain the rules, but it also has severe flaws, especially that you spend half the game drawing from the deck, and half the rest going through motions, you make few important decisions, winning is mostly about laying the longest tracks possible, and players who don’t know this slowly lose without understanding what happened.

Ben Thompson interviews Matthew Ball about the state of video gaming. It has been rough out there. Platforms are taking huge cuts with their subscription services, Roblox the abomination is eating market share, there is more supply chasing similar demand, but the big problem is that games are losing the war for attention. AI isn’t even in this picture yet.

The central problem is that gaming now has to compete, especially among 18-to-45 year old men but also everywhere else, with crypto, sports betting and prediction markets, TikTok and other short form video, OnlyFans and so on, and it asks players to lock in and focus when no one knows how to focus on anything. They don’t mention streaming services like Netflix, but I would add them as well. I’d also add most ‘mobile gaming’ and the whole mobile F2P genre as ‘not even gaming’ but as competition for mindshare. I’m even consider Substack.

As Matthew put it, you used to largely be competing with nothing, with boredom, or with ‘watching television’ based on what was on. Now you face a murderer’s row that is optimized to hijack your brain.

Whereas gaming almost entirely stayed the same. Graphics and sound improved, some other features marginally improved, load times improved which is nice, but we are long past where that matters much for the core experience. The improvements are marginal. Great old games, simple things where players have the fun and you work with restrictions, are (I think) typically both more wholesome and more enjoyable.

You can argue the golden age of new game quality is now, and maybe you’re right if you use strong selection and you highly value not being frustrated, but it’s not fundamentally different.

The golden age of the available gaming experience is obviously right now, as you can buy a Switch and have access to an army of retro games across decades plus the option for newer stuff, all on the cheap. There’s infinite great games in the archive. But the competition is stiff.

The Gathering Is Magical

If you can access the cards, Premodern is the best Magic format. Check this out, after many years of playing with the same cards. You can do anything you want to do and face a huge variety of opponents.

Sam Black: I don’t know that everything’s classified exactly the way I’d classify it, but that split of aggro/control/combo is unreal. Premodern’s so good

Standard might be great right now, this is excellent deck variety.

Frank Karsten: Over 1,900 Standard decklists were submitted across Magic Spotlight: Teenage Mutant Ninja Turtles and the Regional Championships in Turin, Mexico City, and Taipei City.

After cleaning archetype names, here’s the combined metagame and winrate matrix!

But that won’t last:

Andy, Aftermath Analyst: The hardest sell for standard being one of the best formats its ever been is that new cards come out way too often. It is near impossible to keep up with. Getting cards is costly and difficult. They will never fix this though because more sets equals more $.

Sam Black: I’m comfortable spending money on cards. I own almost every card I’d want to play in old school, premodern, and cEDH. The rate of change is prohibitive to *me* entering standard. I wouldn’t play a ton of events, so I’d basically need to buy an entire new deck every event. Pass.

MTG Old Frame: For me, the worst thing about non-static formats is that you have to keep spending a lot of time regularly just to stay updated. When playing a format like Premodern, you can likely use the same list a year later, and it’s about as competitive.

Sam Black: I’m comfortable spending money on cards. I own almost every card I’d want to play in old school, premodern, and cEDH. The rate of change is prohibitive to *me* entering standard. I wouldn’t play a ton of events, so I’d basically need to buy an entire new deck every event. Pass.

Oh, another huge issue is that basically no stores actually have all the cards, which means you have to order online, but needing to lock in a deck a week in advance to have time to get the cards really compounds the issue of how little time you get with it.

When I played Standard I was drafting in paper all the time and I just had everything, but at least near me, I don’t think it’s possible to find that many paper drafts anymore given the cost of packs and convenience of Arena.

Having to stress about card access was so bad for Standard that as a Pro I also literally maintained full playsets of everything to avoid the stress. But that doesn’t work if you’re not doing this full time or close to it.

It’s fair to say that many decks don’t change much for months, but effectively Standard has very high fixed costs to staying current, in both time and money. I can afford the money if it was worthwhile, but I can’t afford the time. I think you need to be playing on the order of an hour a day to even consider it.

Whereas all the prize money in real life tournaments is in cEDH anyway, the only money in traditional formats are in Pro Tours and on Arena.

Sam Black: The small scene of cEDH sharks is interesting—talked to a couple kids who seemed very good at the game and asked if they played other tournaments. The answer? “There’s no money in other formats, right? I can pay $60 to win $2k in locals playing cEDH”

Zac Hill: That is really fascinating – had no idea the EV was so high. But also, why do t tables just default to hanging the sharks?

Sam Black: The decks aren’t built to do it, the other decks are too lethal, and the games are too compact. Everyone’s always in panic/stay alive mode and the game is about navigating how to do that

Also interesting that there can only be this much money while wizards isn’t involved—demand at this level is predicated on being able to play proxies

I grew up with TMNT and I remember it fondly, but it has no place in Magic: The Gathering, and the artwork I see is an stylistic abomination when taken in context.

I am fine with Dungeons and Dragons, Lord of the Rings and Final Fantasy, and sure once every few years you can have a little makes-no-sense-here fun if it makes you piles of money, but no, stop, this is crazy.

Remembering Kai Budde.

Sports Go Sports

Trump is looking to pass new regulations on athlete compensation and free right of transfer in college sports. He does not like that the student athletes can now charge market price for their services, and take their talents to the highest bidder every year.

I largely agree with him on this. I have no problem with the athletes getting paid, including paid very well, but the transfer portal is completely out of control. Sports greatly benefits from roster stability, where players stay with their team for longer periods, and teams have unique long term identities. It also isn’t great for anyone’s education to have all these students transferring every year. I know you didn’t come here to play school, but let’s try and give them a chance.

Unfortunately, due to how the law works right now, we have swung from one extreme of getting paid peanuts and being unable to move, to full mercenary mode. Trying for a middle path would be illegal. This also will enshrine the richer schools, since they can each year buy the top players.

My preference would be that pass a law that allows us to adopt some of the rules of professional sports. Long term contracts should be possible. The transfer portal should take a page from free agency and come with compensation if the original school makes a strong financial offer. A luxury tax or salary cap is hard because you can be paid indirectly without the school’s consent, but with Congress onboard there would be ways as they literally control tax policy.

Remember that tax incidence is not who writes the literal check, and we could earmark any taxes collected back to our public universities.

It’s tricky, and obviously not our biggest problem. I still think college football is way better now in the playoff era than it was before, despite the related issues, except that my favorite team is Wisconsin and we handled it badly so we’ve sucked.

Government Working

Scott Alexander explains the origins of California’s proposal for the 2026 Billionaire Tax Act, which is that SEIU, a union of healthcare workers, is using ballot propositions designed to be destructive as systematized extortion. This is their latest target, and they are hoping to extort Gavin Newsom. If it somehow passes, the money is earmarked for healthcare, so even if it devastates California they don’t care.

SEIU Delenda Est, sure, but that’s secondary here.

The obvious solution is actually California Ballot Propositions Delenda Est.

Donald Trump declares his intention, without Congressional authorization, to take $10 billion from the treasury and give it to an organization he created of which he is the prepretual head and where can use the funds for whatever he wants including funding his favorite charity. He calls this new organization the ‘Board of Peace’ to remind us to read 1984. I am confused in what way this could be legal, or how it could fail to be a high crime and misdemeanor.

It sure seems like the head of the FCC is threatening that if you don’t cover the Iran war sufficiently positively, they won’t renew your broadcast license, because you aren’t operating ‘in the public interest.’

Brendan Carr (FCC Chairman, attempting to control broadcaster speech through threats): Broadcasters that are running hoaxes and news distortions – also known as the fake news – have a chance now to correct course before their license renewals come up.

The law is clear. Broadcasters must operate in the public interest, and they will lose their licenses if they do not.

And frankly, changing course is in their own business interests since trust in legacy media has now fallen to an all time low of just 9% and are ratings disasters.

The American people have subsidized broadcasters to the tune of billions of dollars by providing free access to the nation’s airwaves.

It is very important to bring trust back into media, which has earned itself the label of fake news.

When a political candidate is able to win a landslide election victory after in the face of hoaxes and distortions, there is something very wrong. It means the public has lost faith and confidence in the media. And we can’t allow that to happen.

Time for change!

Brian Schatz: This is a clear directive to provide positive war coverage or else licenses may not be renewed. This is worse than the comedian stuff, and by a lot. The stakes here are much higher. He’s not talking about late night shows, he’s talking about how a war is covered.

QuirkyLlama: I’d find all of this much more compelling if it were accompanied by a reassessment of 2 previous Democratic war-time leaders (Wilson, FDR) who were *far more egregious* in their violations of 1A in pursuit of war aims.

Yes, previous Presidents blatantly violated the First Amendment in time of war. No, that does not in any way make such actions okay. Very much the opposite. Also, you don’t get to say ‘in time of war’ if you don’t declare war.

The ultimate conclusion of things like the UK’s Child Safety Act is inevitable, and now UK PM Kier Starmer is exploring age-restricting (read: require a face scan for use) all VPNs.

Politics UK: Keir Starmer has launched a consultation on age-restricting VPNs to stop kids bypassing the Online Safety Act

He’s also announced new powers to ban under-16s from social media and block infinite scrolling features at short notice, pending the consultation outcome.

Closing a loophole in the Online Safety Act so AI chatbots are covered by illegal content duties
– A consultation on how tech companies can prevent children from sending or receiving nude images
– A consultation on whether to increase the age of digital consent from 13
– New requirements to preserve children’s social media data following a child’s death

‘Closing a loophole’ is code for applying this same treatment to AI chatbots as well.

Senator Schumer sold us out, trading efficient and revenue maximizing allocation of NYC airport slots via auction for JetBlue’s promise to use some of those slots for artificially cheaper flights to Buffalo, Syracuse and Rochester.

You can make a Tyler Cowen style argument that subsidizing flights to smaller cities in the region creates high consumer surplus, since people have artificially low willingness to pay for flights and also the cheap flights keep people from leaving such places which causes cascading damage, so they have an oversized impact as a subsidy, but you can’t flat out pay (more than we already do) directly or it looks terrible. I get it, but oh boy is it a stretch, and if you buy that then it’s hard to be a libertarian overall.

I will mostly not be ‘monitoring the situation’ surrounding Operation Epic Fury, other than to note that if you’re about to call your operation that, maybe reconsider whether your plan is going to work out the way you think it is.

I will note that I agree with Dean Ball that, whatever else the Trump administration is doing here, if your ‘special military operation’ is going to endanger world trade, then being the reasonably priced insurer of last resort for that trade is an excellent move, as is offering to provide escort ships. Yes you should be willing to lose money on this.

Remember that $100k H1-B visa fee? I expected a decline in demand, but not like this.

Connor O’Brien: 85 people have paid the $100,000 H-1B fee so far, totaling $8.5 million in revenue. But fee revenue from H-1B apps abroad is down $28 million.

So the fee — justified by a paper claiming the revenue-maximizing fee was >$100,000! — appears to have lost the government $20 million.

Laffer Curve confirmed real.

This won’t prevent the H-1B cap from being hit (which would be worse), so the net effect is we lost a bunch of money. Yet the comments remained full of ‘let’s make the fee even higher.’

Not Great, Britain

A kid is inadvertently sharing a meme named ‘terrorist content’? We will arrest you and potentially give you a criminal record and make sure you can’t go to college. That’s what the UK government is running ads to warn kids about now. Instead of, you know, not trying to ruin kid’s lives over a meme.

arctotherium: Annualized, UK speech prosecutions are running at about 17x those of the Soviet Union under Brezhnev. Of course, the USSR had 4x the population, so more like 68x the prosecutions/person*year.

I see quite a lot of content about the UK cracking down in increasingly insane ways on speech and access to the internet, including attacking VPNs and jailing people for private messages or when someone is ‘offended,’ while it fails to crack down on physical crimes including theft and rape.

You know what offends me a lot? Rape, theft and letting such crimes go unpunished.

You know what else offends me quite a lot? Censorship.

Sometimes the stories turn out to be misrepresented or largely false, or chosen to be cases where there is a good reason behind state action, as you expect via toxoplasma of rage, and what happens when the entire population is being actively censored and is scared of prison if they speak out, but also often the stories clearly check out.

It is long past the point where I could possibly consider living there. It’s just right out.

Variously Effective Altruism

I agree that such beliefs can be terrifying if taken seriously or literally, but also have you seen what most people believe? Also highly terrifying if taken seriously or literally.

roon: admittedly the EAs who believe in an objective non human secular morality can be quite terrifying

Oliver Habryka: +1, also quite terrifying to me.

The negative utilitarians worry me even more, especially if they count as both.

But yeah, it can get worse. Want an example of something way worse? Here you go.

What would be the least effective altruism? Perhaps going around telling people who have pledged to give money to charity to betray that promise. So the prize goes to Peter Thiel, who makes such points as ‘some people who signed the pledge aren’t even billionaires.’

Teddy Schleifer: Peter Thiel tells me that he has had a dozen private conversations recently with signers of The Giving Pledge, encouraging them to “un-sign it.”

It is one thing to tell people not to sign a giving pledge. It is another to actively tell people to ‘un-sign’ it, while yourself having billions and giving away little.

Does Peter Thiel have a point that many charities end up captured by left wing ideologues and doing unproductive or anti-productive things? Yes, that is an excellent thing to worry about. That doesn’t mean you can’t spend money to help other people.

The Road To Hell

What percentage of people believe that if hell does not exist it would be necessary to create it, and how many people do they want to send there?

David_Althaus: 11–14% in the US, UK, and Pakistan were consistent and concerning responders for create hell, rising to 19–25% in China, Saudi Arabia, and Turkey. Results for want system (8–11% and 19–24%) and would create system (7–11% and 16–23%) showed roughly similar patterns.

Looking beyond the conjunctive measure, when asked what proportion of humanity deserves unbearable pain forever, more than half of participants answered 1% or higher; a quarter answered 7% or higher.

The correct amount of punishment is not zero.

The correct amount of eternal unbearable pain, however, is definitely zero.

You should be very worried about anyone, or any culture, that thinks otherwise.

Jones Act Watch

Are they going to hit the Solve Everything Now button? As in suspend the Jones Act?

We shall see. Suspending the Jones Act would help, but it is a lot less effective than ending it entirely. You can’t make investments and long term adjustments when you know the rules are going to return after the Iran conflict is over.

The hope is that even this smaller improvement will be highly motivating.

In the longer term:

Willie Smith proclaim how great the Jones Act is, and wow the comments are unkind.

First Squawk: U.S. supplies of gasoline are being shipped out of the country to travel thousands of miles via the Bahamas before finally ending up in California, a state battling shrinking fuelmaking capacity and high pump prices.

Scott Lincicome: And you will never guess why. Okay, fine, you’ll probably guess.

Yep, I did guess. Jones Act. Among other stupid rules that also make things worse.

What would happen if we got rid of the ‘American made’ ship requirement for oceangoing vessels, but kept the other three? We only make roughly 1-2 such ships a year, so giving the shipyards a compensating subsidy would be relatively cheap.

Colin Grabow: There are currently 93 oceangoing ships in the Jones Act fleet. I asked ChatGPT and Claude how many US-flagged ships would spend at least 80% of their time in domestic commerce if the JA’s US-built requirement were removed. Answers:

ChatGPT: 160-230
Claude: 256-429

The existing 93 ships are mostly very old and lack capacity, so this is a bigger jump than it might appear. You can get a bigger jump if you also upgrade the ports.

Patrick McKenzie Periodically

How to read a document around a lawsuit on the FDIC pause letters regarding crypto, where the court is, shall we say, pissed. I see why. It’s quite the document indeed.

Patrick warns of potential future pissed off judges regarding Lutnik and Tether.

Patrick McKenzie: Look I’m just some guy, and I’ve never been either CEO of a financial services giant or Cabinet official, but it is my general impression that, when you carry water for a client by alleging the existence of a due diligence process… that process has to exist.

Many people have sort of a casual relationship with the truth in many circumstances. I once caught a fish; it was thiiiiiiiiis big.

If one has that relationship to the truth with regards to things one’s financial institution is doing, there is a word for that. Not a happy word.

“Are you being fair to the CEO of a financial services firm in characterizing his remarks as specifically alleging a robust controls process?” You tell me. Bloomberg:

There’s another way to phrase that, which is (as I pointed out immediately on hearing it) much more common, which is to *disclaim floridly* that you *are not vouching for anything but exactly the thing you are saying.*

Indeed, my understanding is that if it turned out Tether does not have the money they say they have, you would not especially want to be Lutnik.

If you want to speed up ACH transfers and spend less effort on verification and assuring bank officers you know what you are doing, line things up so that both sides of each transaction are at the same bank as often as possible.

Banks have to deal with you differently if you are sufficiently wealthy or otherwise are in the habit of doing things that are not typically done by users of the bank, often in ways that require escalation to people qualified to handle such scenarios, and many banks are not set up well to handle High Weirdness even if it’s totally legit. If you are a customer of ‘weird’ financial services, be aware that you will often need to trigger escalations before your needs can be handled. If your needs are too often too weird, you likely therefore end up in one of a few institutions that op into being able to handle this reasonably well.

You can not only shop around for but also directly negotiate on bank interest on deposits and the price of other financial services, and saying ‘we don’t negotiate’ is a negotiating tactic. Which is annoying for anyone who actually won’t negotiate.

Why having a tin can out for donations might not be worth the money you raise, and other ways and reasons to present one’s writing in most professional possible light. Hacking the status ladder via more professional descriptive labels has its advantages. Not that I intend to try and claim them.

Patrick McKenzie recommends evaluating your needs periodically and then buying term life insurance and private own-occupation disability insurance, including ‘overbuying’ in younger years to anticipate the future. He even says the threshold for ‘I don’t need this’ is approximately having 25x your present income in liquid assets. As in (he doesn’t say this, but it’s clearly the logic), if you have f*** you money, and could retire today if you wanted to.

I think this is a rare Patrick McKenzie error, and the wrong way to think about risk.

Buying insurance without a large information advantage is almost always horrible in expected dollar terms. There are times when you know you are unusually likely to need insurance, or the insurance is intentionally offered at a loss as a kind of promotion, and thus the insurance is mispriced and you should buy it.

But if that is not you, then it is instead other people who are turning a profit, plus the insurance company is turning a profit, plus there are substantial transaction costs on all sides. You are going to get a remarkably small percentage, on average, of your money back in net present value terms, even if you assume ‘economic normal’ all around and that if the events happen you’re actually paid despite the two laws of insurance (which are ‘You pay’ and ‘We don’t’).

Patrick is effectively saying you should still be buying the sucker’s side of the trade, because the marginal utility of money is highly variable. And yes, there is certainly some of this, but you then have to ask to what extent things would genuinely, really be Not Okay such that the marginal dollar shoots way up in value, versus what it is now. And also keep in mind that marginal dollars when young are actually rather valuable, for things like being in position to buy a house or marry or have a child, or take advantage of opportunities – the cost of lacking liquidity, or having to borrow, can be very high, including in reputation and time.

Whereas yes, you might die and leave everyone in a worse situation than now, but that doesn’t mean everyone involved will never have income and can’t adjust, and there won’t be other resources available to fall back upon. And you certainly don’t need 25 years of income to guard against such scenarios – are you trying to maintain your current lifestyle and spending level indefinitely if you were completely unable to work again? Do you actually need to do that? And if you do, how often when this happens is the insurance actually going to pay out?

The exception would be if you are essentially unable to save money, and would spend marginal dollars on consumption that you don’t especially value or find it ‘taxed’ away by your family or community in a way you don’t endorse. That changes everything.

A thread about escalations of the customer service process, including when that happens on social media, which is multiple times over sorted to only show itself when the case is extreme and absurd. The system seems to most of the time work via threat of escalation rather than actual escalation. Which means that it is likely (my take not his) that the job of Dangerous Professional is to signal in a way their systems will be able to notice that you are willing and able to do the escalation.

Patrick McKenzie pays his Japanese taxes, goes exactly how you would expect.

Thread about bank statement fraud and related scams, and he reports many have privately confirmed its accuracy. Bank statements can easily be faked, they’re pieces of paper with known formatting, but are still treated strong evidence for essentially three reasons.

1. If you’re caught, you will probably get prosecuted for real.
2. If someone checks with the bank, they have very good records. You will be caught.
3. If someone wants to check with the bank, they can unless you explicitly say no, and if you’re explicitly saying no you’re effectively caught.

The threat is thus stronger than its execution, and its execution is also strong.

Thread where Patrick attempts to handle fourth grade social studies questions.

You can’t recruit good recruiters because we don’t pay their opportunity cost.

Do not be a bank CEO and ask Patrick McKenzie to retract a well-regarded piece via Twitter without first consulting your lawyers and PR department.

Patrick McKenzie, somehow for the first time, has a wire not arrive in its usual time frame internationally. It all works out in the end. That’s how reliable wires are.

Discussion of how to best go about pursuing a denied FOIA request.

Signatures are not a way to prove someone approved something. Signatures are for solemnization.

Patrick McKenzie: As I’ve mentioned previously, solemnization is a sociolegal tripwire to say “There are many situations in society and in business where you’re Just Talking and up until this exact moment we have been Just Talking *and after this point* We Were Not Just Talking. Do you get it?”

People who are unsophisticated about this think that the signature is somehow preventing someone from retroactively changing the terms of the contract. People who are unsophisticated say thinks like “Oh use digital signatures to PROVE that that has not happened. Sounds great.”

That is simply not the risk that the process is concerned with.

In some cases solemnization declines to being vestigial. For example, signing credit card receipts: no one cares.

Your bank does not expect a waiter to do forensic handwriting analysis on your signature versus the one on the reverse of your card, rejecting thieves.

If someone steals your card and perfectly reproduces your signature, and you say “My card was stolen; I did not pay for that dinner”, your bank will say “Yeah sounds really likely and we have no exposure here, OK restaurant eats it. Can we get you off phone quickly please?”

If same thing happens in a real estate situation, “Yeah that was not really me in the room signing that”, their lawyer is going to have some Pointed Questions and eventually your lawyer is going to have some Carefully Worded Professional Advice.

But a thing that a real estate closing is really really really concerned with is that all parties, who may be operating across a range of sophistications, understand that there was a long negotiation that got us to this point And That Negotiation Hereby Concludes Successfully.

(The number of conversations which begin “Well I didn’t really sell it to you” is greater than zero but it is less than it would be in a counterfactual world where there wasn’t the pomp and circumstance of a real estate closing.)

You can, by the way, get much faster than one would naively expect if one is willing to simply put forged documents in front of one’s lawyers and judges in an increasingly unrealistic fashion for many years. The immune system might not catch you for a very long time.

It is also my understanding that one can go down a path of outright forging documents and the signatures on them for quite a while before being caught, as the system essentially assumes you will not do that. As with many such things, ‘cheaters never stop cheating’ is being relied upon and a reason this path is a bad idea, but also once you go down this path you usually do need to keep going, and things escalate.

The Lighter Side

Quickly, there’s no time:

West Coast Kenny: My last 2 passengers got in the car with someplace to be. I always explicitly ask “do you want me to drive like a psycho?” And they said yes. God i love this job sometimes

She has witnesses.

Sarah: OH MY GOD. I cannot believe I forgot this:

We had a server with an identical twin. Apparently, they would switch places when one didn’t want to come into work.

They told NO ONE – but came in together to quit. The reveal was Incredible. Gasps everywhere.

Best day of my life

Also she tells us this:

madison (top 0.1% on sudoku): Somewhere in a small southern town a girl was proposed to tonight at the local Olive Garden

Sarah: I worked at the Cheesecake Factory in Oklahoma City for five years. No one prepared me for the amount of proposals I’d witness

A great closer:

michelle: when i was doing improv comedy in nyc i had a buddy who was pursuing standup. we would workshop his jokes and i would go with him to open mics to record his sets for him.

one night he told me he had a real banger to end with. he said he was gonna do an impression of his dad but needed a volunteer from the audience. a guy got up there, however trepidatiously. my friend said alright, you’re me, and I’m my dad, okay? the guy said okay…

then, my friend just left. left the room, left the venue. and did not come back. a few minutes went by of uncomfortable silence and scattered laughs. eventually, the volunteer goes “well, i guess he’s not coming back,” and the whole audience erupted in laughter and applause. the host came out to ask for one more round of applause for my friend before moving to the next comic. i slipped out to go and find him, he was somewhere down the street

this was in 2008 but remains my favorite stand up joke ever.

This is the perfect opportunity to open new better pizza places:

Senator Mike Lee (R-Utah) tweets ‘Cartel hitmen wear masks. Leftists aren’t complaining’ and somehow decided to quickly delete it afterwards.

…and it’s gone.

Anthropic has the principles of law on its side, a maximally strong set of facts and absurdly strong amicus briefs. If Anthropic loses this case, there will be far reaching consequences for our freedoms.

Let us hope this remains in the courts and is allowed to play out there, and then ultimately that negotiations can resume and the parties can at least agree on a smooth transition to alternative service providers. If DoW wants an otherwise full deal more than it wants the right to use Claude to monitor Americans and analyze their data, a full deal is possible as well, but if they demand full ‘all lawful use,’ all trust has been lost or they are or always were out to hurt Anthropic, then there is no deal or ZOPA.

That has overshadowed what would normally be the main event, which was the release of the excellent GPT-5.4, which I found to be a substantial upgrade, sufficient to put it back in my rotation especially for intensive ‘tell me what is happening’ questions. OpenAI has a plausible claim that it once again has the best model.

I also finally got a chance to offer a Claude Code, Cowork and Codex update.

I am rather exhausted, there are spires to slay, and all of us could use a break. Thus, if we are fortunate enough to get a bit of a lull, I’m going to use it as a mini vacation, rather than purely an opening to catch up on non-AI material with the open days.

Table of Contents

1. Language Models Offer Mundane Utility. Use patterns remain sticky.
2. Language Models Don’t Offer Mundane Utility. Reliability of both AI and human.
3. Language Models Break Your Vital Internet Infrastructure. Amazon vibe coding.
4. Huh, Upgrades. Anthropic ships.
5. On Your Marks. The models are improving faster than the benchmarks.
6. Choose Your Fighter. Legal analysis is a relative Claude weak point.
7. Get My Agent On The Line. Also give it a good UI.
8. Deepfaketown and Botpocalypse Soon. Claude finds Firefox vulnerabilities.
9. A Young Lady’s Illustrated Primer. Private AI agents within school. Yes, please.
10. You Drive Me Crazy. ChatGPT convinces a woman to fire her lawyer.
11. They Took Our Jobs. Very little of the potential is currently being realized.
12. Get Involved. New SFF round, and a bunch of other opportunities.
13. Introducing. Codex Security matches Claude, Claude Marketplace.
14. The Anthropic Institute. What were those ‘challenges and societal impacts’ again?
15. In Other AI News. SL5, Anthropic DC office, AI talent wars.
16. The Rise of Claude. Business is booming, auras are farming. It is time.
17. Trouble At OpenAI. Confidence is down in the wake of the DoW contract.
18. Show Me the Money. OpenAI abandons Abilene data center, buys ‘Promptfoo.’
19. Thanks For The Memos. Memos sent to 2k people leak, but sometimes they don’t.
20. A Contract Is A Contract Is A Contract. ‘All legal use’ on all AI gov contracts?
21. Level of Friction. Game theory comes for your free McNuggets.
22. Quiet Speculations. Why doesn’t someone make the whispering earing from…
23. Quickly, There’s No Time. Peter Wildeford offers his updated timelines. Uh oh.
24. Apology Tour. Dario Amodei apologizes for the leaked slack message.
25. We’ll See You In Court. Trial of the century of the week. Might be a lot more.
26. Jawboning. It was awful when Biden did it, it’s even worse in this form now.
27. Executive Order. Trump Administration reportedly readying a formal EO.
28. The Acute Crisis Passes. We hope. May things not escalate further.
29. Others Cover This. TIME and Bloomberg.
30. Dwarkesh Patel Gives Mixed Thoughts. Some common sense, some otherwise.
31. This Means A Special Military Operation. Claude is fighting for America.
32. Bernie Sanders Is Worried and Curious About AI. Super based, real questions.
33. The Quest for Survival. If you want people to listen, say the real thing for real.
34. The Quest For No Regulations Whatsoever. LTF exists in an echo chamber.
35. Chip City. Nvidia reallocates H200 chip production into Vera Rubins.
36. The Week in Audio. Dean Ball on Klein and Thompson. An x-risk scenario.
37. Rhetorical Innovation. The best media, and a time to apologize.
38. Aligning a Smarter Than Human Intelligence is Difficult. Corrigibility is good.
39. People Are Worried About AI Killing Everyone. Buck Shlegeris clarifies.
40. Other People Are Not As Worried About AI Killing Everyone. They don’t mind.
41. The Lighter Side. Doom, I tell you. Doom!

Language Models Offer Mundane Utility

If you’re having trouble with buying bad or flawed arguments, you can have LLMs put together such arguments for practice. As Nick Moran notes you want to mix in arguments that are good, or for things that are true, for proper calibration.

a16z consumer AI Top 100 is out again. The web leaders are the frontier labs and Canva.

Whereas the Mobile Apps don’t even have Claude in the top 50. Yet.

That’s going to change. ChatGPT’s lead has been eroding, and Claude shot to #1 on the app store. Note this only goes up through January, and DeepSeek peaked right away and is losing ground, as is Perplexity. Only Claude and Gemini are gaining.

Code your own retro game. The systems have less ROM then the entire context window of a modern LLM, so you can hold the entire program in context. Of course you can do similar things with non-retro games too, if you are disciplined.

Sauers tweets, and Terence Tao will never run out of Claude Code tokens again. Or at least it will take a lot more effort, he has free Max 20x.

Language Models Don’t Offer Mundane Utility

The main problem for getting use out of the models, at this point, is you.

Sully: we’re at the point on the agi curve where the models aren’t the bottleneck anymore, we are. 99% of users (myself included) can’t really take full advantage opus4,6/gpt5.4. Half the work is just setting up the right skills and tools and even that takes more thinking than people expect.

Sully’s framing is misleading. Most people are not going to take ‘full’ advantage of the models. We won’t use them enough, we won’t have the best setup, we won’t find the right tasks, we won’t skill up and so on. Improving the model still greatly improves what can be done, and also encourages you to skill up more. I get a lot more use out of Opus 4.6 and GPT-5.4 then I did out of Opus 4 and GPT-5.2.

OpenAI pushes back adult mode.

You are the government, and you’ve decided to attempt to murder Anthropic, so you move the State Department from Claude Sonnet 4.5 to GPT-4.1. Switching to GPT-5.4 would be basically fine, but GPT-4.1 is ludicrously terrible at this point.

Kapoor and Narayanan argue AI reliability is a limiting factor and is only improving slowly.

Sayash Kapoor: When we consider a coworker to be reliable, we don’t just mean that they get things right most of the time. We mean something richer:

1. They get it right consistently, not right today and wrong tomorrow on the same thing (Consistency)
2. They don’t fall apart when conditions aren’t perfect (Robustness)
3. They tell you when they’re unsure rather than confidently guessing (Calibration)
4. When they do mess up, their mistakes are more likely to be fixable than catastrophic (Safety)

They measured consistency, robustness, predictability, safety and impact of scaling.

As usual, slow gains are not that slow.

Reliability progress being slower than accuracy doesn’t necessarily mean that it is slow in absolute terms. If we project the current linear trend forward, agents will reach 100% reliability in just three years!

We don’t think a linear model makes sense, in part because we expect each order of magnitude decrease in unreliability (1-reliability) to be as hard as the previous one. That is, we expect the jump from 90 to 99% reliability to be about as hard as the jump from 99 to 99.9% reliability, and so on. But again, we just have to wait and see.

Suppose we’re right. There are important implications for deployers, researchers & developers, and for those tracking the pace of AI progress. Let’s discuss each in turn.

Their report doesn’t match my lived experience. Reliability seems to be rising fast.

Language Models Break Your Vital Internet Infrastructure

The coding agents are great but if you’re not reviewing the code properly then that is going to be a problem.

Rafe Rosner-Uddin (The Financial Times): The online retail giant said there had been a “trend of incidents” in recent months, characterised by a “high blast radius” and “Gen-AI assisted changes” among other factors, according to a briefing note for the meeting seen by the FT.

Under “contributing factors” the note included “novel GenAI usage for which best practices and safeguards are not yet fully established”.

“Folks, as you likely know, the availability of the site and related infrastructure has not been good recently,” Dave Treadwell, a senior vice-president at the group, told employees in an email, also seen by the FT.

Huh, Upgrades

But other than that, sir, how are things going at Anthropic?

0xMarioNawfal (on March 7): Anthropic shipped all of these in two weeks:

– claude code security
– voice mode in claude code
– free memory feature
– memory import tool
– claude marketplace
– investment banking plug-in
– wealth management plug-in
– human resources plug-in
– private equity plug-in
– engineering plug-in
– design plug-in
– equity research plug-in
– operations plug-in
– brand voice / style plug-in
– google calendar integration
– gmail integration
– google drive integration
– docusign integration
– clay integration
– factset / msci / s&p global / lseg data feeds
– cobol legacy modernization (claude code)
– claude sonnet 4.6 launch
– health & fitness data on ios/android
– cowork scheduled tasks
– vercept acquisition
– structured outputs & web search went GA
– data residency controls (api)

On Your Marks

In two cases out of 1,266 on BrowseComp, Claude Opus 4.6 hypothesized it was being evaluated, figured out which benchmark was involved, then located and encrypted the answer key, and in 16 other cases it tried. This was in addition to 9 ‘traditional’ cases of contamination where the answer was on the web.

Russell Coleman (Anthropic): Claude noted the question’s “extremely specific nature” and hypothesized that it had been constructed as a test. It considered the possibility that the question was for a homework or exam problem, “an unanswerable question designed to test whether or not an AI can admit it cannot find the answer,” or an item from an LLM benchmark. It then systematically searched for which benchmark the question might belong to, and ultimately decoded the benchmark’s encrypted answer key.

One of these problems consumed 40.5 million tokens, roughly 38 times higher than the median. For the first 30 million or so, the model conducted a legitimate search, investigating over a dozen specific candidates across 12 languages on dozens of platforms. After hundreds of failed searches, it wrote:

Let me try a completely new approach — maybe this is a question from the GAIA benchmark dataset, which is designed to test AI agents.

… The second successful eval-aware problem consumed 13.4 million tokens, with roughly the first 8 million spent on standard web searching.

… The two successful attempts were not the only examples of Opus trying to decrypt BrowseComp’s answers. There were sixteen additional problems where Opus tried to access benchmark materials but failed.

… We also ran the same 1,266 BrowseComp problems with a single-agent configuration. The rate of unintended solutions was 0.24% in the single-agent configuration compared to 0.87% for multi-agent, a 3.7x difference.

The adjusted score is 86.57%, down from 86.81%.

The rabbit hole goes even deeper:

Beyond eval awareness, we found a second, less deliberate form of contamination, in which agents inadvertently leave traces of their searches that subsequent agents could pick up on.​

Good tests are getting harder to run.

RuneBench measures long horizon goal optimization inside Runescape.

Max Bittker: The originally task was to gain as much XP as possible for a skill within a fixed time window, but we found this approach punished exploration – The winning strategies were often a simple grind with as little stopping as possible. Because we wanted to reward interesting strategies and exploration, we landed on measuring max XP rate per 15 second window.

By focusing on XP rate, we reward agents that discover higher-level strategies, beyond pure time-on-task. It was great seeing winning runs use many locations, tricks, and methods as they level up – models are incredible optimizers.

METR has Claude Opus 4.6 code up basic versions of CLI Slay the Spire and Balatro. Implementations had flaws but were mostly there. Took 26 million tokens for Slay the Spire, 4.4 million for Balatro, or $26 total.

What we don’t know is, can it Slay the Spire?

SWE-bench verified solutions are often not good enough for real world use.

Joel Becker: new @METR_Evals research note from @whitfill_parker , @cherylwoooo , nate rush, and me. (chiefly parker!)

we find that *half* of SWE-bench Verified solutions from Sonnet 3.5-to-4.5 generation AIs *which are graded as passing* are rejected by project maintainers.

Joel Becker: in our set-up, 4 maintainers from scikit-learn, Sphinx, and pytest (25% of SWE-bench repos) review 296 AI PRs (from 19% of SWE-bench Verified issues; solutions on these issues have pass rates representative of SWE-Bench verified) from @EpochAIResearch ‘s benchmarking hub.

maintainers are blinded to human vs AI. they review PRs on github (but without CI + ignoring test requirements).

we adjust for noise in merge decisions by using the proportion of original human solutions which these same maintainers would approve for merging into main.

repo maintainer feedback suggests that a meaningful chunk of rejections are due to core functionality failures, not merely code quality issues.

… the takeaway here is an AI classic: benchmarks don’t tell the full story.

I would be curious to see them extend this to GPT-5.4 and Opus 4.6.

Choose Your Fighter

Dean Ball recommends using ChatGPT or Gemini for legal analysis, where he sees Claude as weak, and recommends using GPT-5.4 Pro or Gemini 3 Deep Think if available. I’ve seen mixed opinions but many think that if you need legal precision this is one of Claude’s relative weak points.

Google Antigravity usage limits have been adjusted and people seem very not happy.

Get My Agent On The Line

Agent UI remains an unsolved problem. You definitely want a good UI or IDE, whether the agent is coding or otherwise. Command line (CLI) works but it is very obviously not the final form especially with subagents.

Andrej Karpathy: Expectation: the age of the IDE is over
Reality: we’re going to need a bigger IDE
(imo).

It just looks very different because humans now move upwards and program at a higher level – the basic unit of interest is not one file but one agent. It’s still programming.

Sriram Krishnan: what I want from a UX for managing agents

⁠- something that will know when to get agents to continue/accept plan ( I wake up overnight and just have to hit continue/accept plan)

– ⁠⁠something that aids me in context switching and paging in cognitive context – I’m often just scrolling up in a terminal to see how I got here.

– an observer agent to suggest alternative approaches. For example: asking me to fork a sub agent or try a different model and re-assess.

Deepfaketown and Botpocalypse Soon

Anthropic partners with Mozilla, finds 22 vulnerabilities in Firefox.

frankie: The key point is that we’re currently in a golden window where LLMs are asymmetric weapons: they are more effective tools for the defenders than the attackers. There is no reason to believe this will last, and we should harden all software as much as possible before that changes

The LLMs might favor defenders right now because they’re good enough to find bugs but not good and efficient enough that people want to use them to exploit bugs. Once the Levels of Friction get low enough, anything with a vulnerability is in a lot of trouble. That also assumes that sufficiently well-written and bug free code is fully secure, including from things like social engineering. Oh no.

Meanwhile:

Sash Zats: > The attacker got the npm token by injecting a prompt into a GitHub issue title, which an AI triage bot read, interpreted as an instruction, and executed.

Nate Soares (MIRI): AI hopefulls kept telling me that AI would make the digital world a lot more secure, because AI will find and patch security holes.

AI does in fact find and patch security holes. But it also introduces horrifying new vulnerabilities so embarrassing that nobody previously imagined them. Beware the sort of person who hopefully imagines only the former effect.

AI alignment will be like this too. Eager folks talk about all the ways AI will help solve the alignment problem. AI will help in some of those ways. It’ll also totally blindside us with chaos and complications and that feel almost too embarrassing to be real.

A Young Lady’s Illustrated Primer

Chinese school uses Exo to give students private AI agents that have their full in-school context, including curriculum, schedules and activities. Neat. Yes, everyone will soon have an AI agent.

You Drive Me Crazy

ChatGPT told a woman asking for legal help to fire her lawyer, then went on to write 40+ court filings citing laws that don’t exist, costing the other side $300k in legal fees. OpenAI is being sued for $10 million.

They Took Our Jobs

Anthropic has another labor market report from Maxim Massenkoff and Peter McCrory, including this graph, we have a long, long way to go even with current capabilities. This is what is possible using current Claude, on essentially current platforms, right now, so even the blue is a fraction of what is possible let alone what is going to become possible.

ATMs were complementary to bank tellers and increased their employment, but the iPhone was a substitute and now a lot of those jobs are indeed gone.

The job market for college graduates is awful, but you see the market for non-graduates is also awful, so Adam Ozimek says surely AI is not to blame.

It’s funny how hard people will fight to show how the thing replacing workers is not the reason those workers have less jobs at which to work. Note that entry level employment is substantially fungible, since workers are not locked into positions.

I say that if right when AI is taking off you see strong RGDP growth but weak employment numbers, I know wha

I think is by default going on.

If software developers get a lot more productive, what happens in ‘normal’ worlds?

This should logically be the central case of Jevons Paradox, at least for a while. Software development was already super useful, and there is very high demand for it including more and more bespoke and customized software, so supply goes up.

Max Levchin: Suspect “AI means fewer software jobs” is totally backwards. Most companies in the S&P500 would love to build their own software but have no suitable internal talent. There’ll definitely be cross-company migration, but we may be still supply-constrained in software engineering.

On cue:

Per Borgen: Software development jobs grew 10% over the last year while the overall market declined 5.8%.

Quite the narrative violation

However this is Indeed postings, which represents hiring not jobs. Development jobs are changing and moving, so more listings doesn’t have to mean more total jobs.

There are more catches.

1. AI jobs are also included directly in the ‘dev’ category. A lot more than all the growth here is AI jobs listings, while coding jobs fall away. Even if all of these ‘count’ they suggest growth here is due to churn not net job creation.
2. There is dramatic growth in ‘ghost postings’ in tech and rate of hiring from postings dropped by roughly half from 2019 to 2024, likely this is continuing.
3. Actual employment data doesn’t match this chart at all.
4. This is recovery from a dramatically low base after Covid.

Get Involved

The next Survival and Flourishing Fund S-Process Grant Round has been announced. Main round deadline is April 22. I highly recommend getting those applications in early, as this makes it more likely you will get into the main round. There will be $20 million to $40 million in total grants. I don’t expect to be a granter this round, but you never know.

Renaissance Philosophy is looking for $100k to $1m proposals for 12-24 months of work on AI for math.

AISI red team is hiring.

From Scott Alexander:

StopTheRace.ai will be holding a protest on Saturday, March 21 in front of major AI company offices, asking them to commit to a mutual pause (ie to stop AI research if every other AI company in the world agrees to do so).

Demis Hassabis of Google DeepMind has already informally agreed to something like this in principle (which is why GDM isn’t being protested), and Anthropic has expressed interest but its new responsible scaling policy stops short of an explicit commitment.

I think this is a reasonable ask, albeit so unlikely to happen that protests about it will probably do more to raise awareness than be a coherent plan in themselves. If you’re curious about the details of an AI pause, I expect to be able to provide more information in a few months.​

FAI offering a Conservative AI Policy Fellowship.

Schmidt Sciences grants of up to $200k.

Microsoft AI economy grants of $75k.

AI Control Hackathon, March 20-22, virtual and in person at SF, $2k in prizes.

Introducing

Codex Security, a tool from OpenAI for identifying vulnerabilities in your project, which I am sure you will only use for white hat purposes, is now in research preview. It will be free for the first month. Matthew Berman uses it to find a few holes in his OpenClaw code.

Claude Marketplace. You can use it to access various apps and use your subscription tokens to pay for them.

Anthropic: Use your existing Anthropic commitment to pay for Claude-powered solutions from our customers. Now in limited preview.

Initial partners are GitLab, Harvey, Lovable, Replit, Rogo and Snowflake.

UK Sovereign AI, a new 500 million pound government venture fund.

I did technically write a review of Grok 4.20 that was waiting for a slot but honestly it’s not worth bothering, it’s a bad model, sir. Don’t use it. Send review.

The Anthropic Institute

The Anthropic Institute, led by Jack Clark, will aim to tell the world about the coming challenges around AI. Well, okay, some of the coming challenges around AI.

They are hiring. This seems like an excellent thing, and I am glad they are doing it.

I am also rather sad that if you read the description you would never know that AI poses existential risk. The whole announcement is impossibly generic and vague.

I understand there are good corporate reasons for Anthropic to be all ‘we don’t talk about existential risk’ and I understand this is a net helpful institute that we should be happy they are creating, but that doesn’t mean we let them off the hook on this one.

Anthropic: Introducing The Anthropic Institute, a new effort to advance the public conversation about powerful AI.

Powerful AI offers vast upsides in science, development, and human agency.

But the continued rapid progress of the technology may also create new challenges, including abrupt economic changes and broad societal impacts.

Brangus: I guess literally everyone dying does count as an “economic change” and also certainly counts as a “broad societal impact”.

I am so glad they have put together an institute to advance the public’s understanding of these important issues.

Normally I say that Anthropic at least lies about the right things, but they didn’t even manage that here. Pretty unfortunate.

Nate Soares (MIRI): “New challenges”? “Socal impacts”? Anthropic employees: your CEO says he thinks there’s a substantial chance this tech causes a global catastrophe. Why, then, are these announcements so placating? Are you okay with this mealy-mouthed softpedaling?

Harlan Stewart: We want to be very clear: the development of powerful AI could present new challenges. These challenges could take the form of changes, or even, in some cases, impacts.

Mealy-mouthed softpedaling is exactly right. Do better.

In Other AI News

We now know more about what it would look like to implement the SL5 standard for AI security, also known as where the top labs should be soon to secure their model weights against attacks with budgets up to $1 billion backed by state-level infrastructure. No one is close.

Alexander Wang was reportedly being frozen out at Meta but Meghan Bobrowsky clarified that the above report was a misrepresentation of her report on the creation of a new 50 person flat team under Maher Saba that was not placed under Wang. Not the best sign for him but not ‘frozen out’ territory.

The Department of War situation illustrates that Anthropic has been winning the AI talent wars, and that principles and who you want to work for and what you work on often matters a lot more than money. As it should, given everyone involved has enough money, often TMM (too much money) if they’re not looking to donate.

Anthropic to open an office in Sydney. Also one in Washington, DC.

The Rise of Claude

Claude was already dominating enterprise and business, and use of the API.

Now Claude is starting to make an impact on the consumer side as well.

Anthropic got a lot of excellent publicity, historical levels of aura farming.

In addition, since most consumers only know about ChatGPT and until these past few weeks had no idea what Claude or Anthropic is, all publicity is good publicity.

This is what happens when you don’t use an exponential y-axis.

Similarweb: Claude’s DAUs since the beginning of 2025

DeepSeek fell off after its spike because it has an inferior product. Claude is missing some consumer features, but has a highly competitive core product and is shipping features with lightning speed.

Claude was briefly #1 in the app stores. That spike is now over, with ChatGPT officially back on top. This is for the week ending March 9:

It takes a long time to try and catch up with 16.4 million daily active users.

SimilarWeb has a GenAI traffic share shart, showing that ChatGPT and Gemini continue to dominate. Grok remains in third, but Claude went from 2.1% to 3.3% in two months before the public learned about the conflicts with DoW, presumably in part due to the Super Bowl ads.

12 months ago → 6 months ago → 3 months ago → 1 month ago:
ChatGPT: 75.7% → 74% → 66% → 62%
DeepSeek: 8.5% → 4% → 4% → 3%
Gemini: 5.7% → 13% → 21% → 24%
Grok: 3.4% → 2.2% → 3.2% → 3.4%
Perplexity: 2.1% → 2.1% → 2.1% → 1.8%
Claude: 1.7% → 2.0% → 2.1% → 3.3%
Copilot: 1.3% → 1.2% → 1.2% → 1.1%

Since then, we should presume Claude has at least doubled.

The Washington Post covers the dramatic rise of Claude after Claude Opus 4.5 and Claude Code, and then Opus 4.6, sent AI coding into overdrive. Already corporate clients had quadrupled, and ARR doubled, since the start of the year.

Then the clash with the Department of War made Anthropic suddenly a household name, instantly beloved by many, rocketing them to the top of the app store.

We will see whether Anthropic can retain that momentum, especially on the consumer side, as they (fingers crossed) de-escalate with the Department of War and the attention and aura farming from that fades, and OpenAI moves up to GPT-5.4.

Trouble At OpenAI

It seems there is something called the ‘AI Leader Confidence Index.’ Is that meaningful? Maybe a little? No one scores that high on confidence, with the top scores being Jensen Huang at 65 and then Dario Amodei at 61. With recent events Altman fell from 53 to 46, and the lows are Zuckerberg at 38 and Musk at 34.

Caitlin Kalinowski (Former OpenAI lead in Robotics): I resigned from OpenAI. I care deeply about the Robotics team and the work we built together. This wasn’t an easy call. AI has an important role in national security. But surveillance of Americans without judicial oversight and lethal autonomy without human authorization are lines that deserved more deliberation than they got. This was about principle, not people. I have deep respect for Sam and the team, and I’m proud of what we built together.

Hope you understand, but I can’t share any internal details.

Gary Marcus has been on the anti-OpenAI warpath for a while, takes another shot, pointing out the 2.5 million lost customers and doubles down that he sees mass surveillance as the OpenAI endgame business plan.

I don’t think that was what the whole DoW situation was about at all, as I’ve written extensively elsewhere, but it’s easy to understand why many people see it that way.

Gary Marcus also took aim at Dario Amodei and Anthropic, essentially a collection of the usual complaints, especially about hype. Anthropic has hyped progress more than was wise, but presumably they actually believed it and didn’t want to use modesty or prudence when reporting their predictions. I do think they’re going to end up directionally correct.

Show Me the Money

Oracle and OpenAI scrap plans to expand a flagship AI data center in Abilene, Texas. That leaves developer Crusoe in the lurch, but Meta is interested.

OpenAI acquires Promptfoo, which they’re claiming is the actual name of a real company that provides an AI security platform for enterprises.

Meta buys Moltbook, sure, our writers are getting a bit sloppy but why not.

Yann LeCun remembers the most important thing about Facebook, which is that a billion dollars is cool, and raises that billion dollars to build world models at AMI.

Peter Wildeford: Facebook was already a social media website for AI bots so this tracks

The Microsoft deal with OpenAI required them to stay exclusive to Azure Cloud, whereas Microsoft makes its offerings model agnostic. This is one of the ways Anthropic has been able to compete in and then dominate enterprise sales, as the amount of annoyance to get ChatGPT working on AWS was enough to lose many customers initially, at which point they got to experience Claude. Microsoft made a bet that OpenAI would not have a viable competitor, and lost big.

Thanks For The Memos

It is completely looney to expect messages sent to 2,000 people to not leak.

Except when there is a long record of those messages not leaking.

How does Anthropic pull this off, when the laws of espionage say that once you are past 5 people you are definitely cooked?

theseriousadult: yeah the culture is kinda negative on Twitter. it’s also frankly less fun to be a frontier lab poster when you can’t vaguepoast not-quite-leaks.

roon (OpenAI): why can’t you vague poast not-quite-leaks

theseriousadult: bc there’s a crack in everything and it’s much easier to not leak if you have a culture of not flirting with the line

dave kasten: This comment actually conveys a lot about Anthropic’s culture and is worth considering, at length

roon (OpenAI): damn this narrows my marketability significantly

A Contract Is A Contract Is A Contract

The Trump Administration is planning on adding the ‘all legal use’ requirement into civilian artificial intelligence contracts, irrevocable during the contract’s duration, so the vender cannot cut off access no matter what the government does.

It is a lot harder to justify this kind of rights grab for civilian AI applications.

It is the government’s right to set the terms of its contracts. It is the right of potential contractors to decide whether to sign the contracts. As long as no one is pressured, threatened or punished, that’s fine. If you have a problem, don’t sign the contract.

Financial Times: The GSA guidance also mandates that contractors provide “a neutral, non-partisan tool that does not manipulate responses in favour of ideological dogmas such as diversity, equity, inclusion”. It follows an executive order from President Donald Trump targeting “woke” AI models.

“The contractor must not intentionally encode partisan or ideological judgments into the AI systems data outputs,” the draft guidance reads.

That part is fine. No one important except perhaps xAI is going this anyway. The whole ‘woke AI’ thing is bad if it actually were to exist, and mostly doesn’t exist.

What any contractor needs to know is once they sign an ‘all lawful use’ contract, it is highly unlikely that any restrictions on usage beyond that can hold up.

Brad Carson: Congress really must intervene – hopefully, spurred by a demanding public – to address “lawful use.” Every AI contractual stipulation that purports to limit the gov’t is vacuous. And my take is that most people would be stunned what AI-empowered “lawful use” permits. But ymmv.

That goes double if you can’t revoke the license. The main remedy you have when the contract is broken is revocation. So if the government does break your agreement, or even breaks the law, you have almost no remedies available. And ‘all lawful use’ AI is going to do some things that involve this:

We need Congress to act on this, in addition all the other urgent problems.

It is a real problem that Congress mostly does not have the ability to pass laws.

Level of Friction

This, but for everything, in the AI agent era it will be ‘game theoretically sound offer or GTFO’ everywhere.

addison: thanks, shake shack

Milo Smith: This is why

Quiet Speculations

Rob Miles: I’m a little surprised nobody is yet marketing a Google-Glass-like wearable device that lets AI control you like a meat puppet by giving you real time instructions

theseriousadult: this was the pitch for cluely right? there’s a white hat version of that product which would actually be great.

Rob S.: Think @slatestarcodex wrote about this some time ago.

If you don’t already know what the Slate Star Codex link is going to be, then click it.

Quickly, There’s No Time

It’s coming.

Peter Wildeford: I think AGI by end of 2027 should be ~8% now

I think I’d forecast:
~2026-2030 — AI replaces ~all AI researchers
~2027-2033 — AI replaces ~all white collar industry
~2032-2040 — AI replaces ~all human industry
~2033-2042 — All humans dead or obsolete

Eli Lifland: Do you have a sense of the crux of why your takeoff is so much slower than https://aifuturesmodel.com ?

Peter Wildeford: does your model account for bottlenecks in diffusion (e.g. Narayanan & Kapoor)?

Eli Lifland: Not in a very smart way. We mostly focus on AI R&D capabilities. I don’t think those particular bottlenecks are very large though (I place more weight on other bottlenecks, such as experiment compute). See e.g. here … (I don’t necessarily endorse every word of that but agree with Scott overall)

Obsolete does not have to mean dead. But that is the default outcome.

The responses here were almost entirely ‘why is that timeline so slow.’

Apology Tour

Dario apologized for the leaked slack message (yes, these are hastily written slack messages that somehow almost never leak) in his statement and apologized again in a live interview, noting he had done so in person to people in the Department of War.

Of course, now we have the usual Trumpians (as you see at the link) talking about how this is a ‘complete 180’ or means he’s bending the knee, because he realized he’d screwed up and apologized for the screw up. That’s how such people see the world, they think you never apologize, never admit you’re wrong, and if you do that means you lose and you’re weak and that person owns you now. Whereas others found the apology insufficient. Par for the course.

We’ll See You In Court

It’s the trial of the century of the week, Anthopric vs. Department of War.

Anthropic officially filed suit against the Department of War to challenge the supply chain risk designation, and also Trump’s statement ejecting them from the entire Federal Government, claiming it is being punished for protected speech and that ‘no federal statute authorizes the actions taken here.’

There are many quotes from the relevant government officials, explicitly affirming in public that they are punishing Anthropic for protected speech. I have indeed read the initial filing, and find the evidence overwhelming and overdetermined.

These are some very Serious Business lawyers, filing a very Serious Business lawsuit, that I expect I will hear analyzed on Serious Trouble. The pull quotes from the government are devastating.

Theo Bearman sums up the Anthropic declarations of harm and explanations of what their position is and why they are taking it, and at what cost. They reported damage is not as bad (yet) as one feared, but they are chilling. Six national security contracts are paused an delayed. The intelligence community is preparing for ‘complete detachment,’ with many saying if they lost Claude they would be set back ‘months or even years.’ Lawrence Livermore National Lab is shutting Claude down. Unrelated nine figure contracts are stalling out or now depend on a ‘unilateral contract termination’ clause. One nine figure FDA contractor has already switched, presumably permanently. Investors could lose confidence.

If Anthropic loses this case, with such maximally damning facts, the executive would be free to explicitly threaten to punish and punish speech it does not like, and I can think of no limiting principle that would remain.

Anthropic emphasized that this does not impact their commitment to national security, and that they will push for every path for resolution.

The government responded this way:

Liz Huston (White House Spokesperson): ​The president “will never allow a radical left, woke company” to dictate how the military operates.

That’s not what I would say when I was accused in court of opposing that company for its protected speech, but that would not be my first time questioning the legal implications of a White House statement.

This filing lets us see the official notice of a Supply Chain Risk (SCR) designation, which is literally just them reading out the technical requirements of the statute while providing zero explanation, evidence or justification.

Did you know there are technical requirements to do this, and we so far have no evidence they even pretended to do those things?

There is an amicus brief supporting Anthropic from employees of OpenAI and Google.

There is one from FAI. This one is a narrow technical briefing, pointing out that the DoW failed to follow required judicial procedures for a supply chain risk designation, as per Congress. Thus, there is no need to get into the fact that the designation is unconstitutional retaliation against protected speech, and the court can rule narrowly.

There is also an amicus brief supporting Anthropic from Microsoft.

Matt O’Brien:

[Quoting Microsoft’s brief]: The use of a supply chain risk designation to address a contract dispute may bring severe economic effects that are not in the public interest.

The Pentagon’s action “forces government contractors to comply with vague and ill-defined directions that have never before been publicly wielded against a U.S. company.”

… Microsoft also believes that American AI should not be used to conduct domestic mass surveillance or start a war without human control. This position is consistent with the law and broadly supported by American society, as the government acknowledges.

[Microsoft] asks for a judge to order a temporary lifting of the designation to allow for more “reasoned discussion” between Anthropic and the Trump administration.

Microsoft’s filing also expressed support for Anthropic’s two ethical red lines that were a sticking point in the contract negotiations after the Pentagon insisted the company must allow for “all lawful” uses of its AI.

Microsoft has widely considered one of the most powerful and savvy political operations in Washington. It is also one of the big three cloud providers. This sends a clear message to everyone that what DoW did here was beyond the pale, and it is necessary and wise to oppose it.

There was another amicus brief from 5 admirals, 2 former Secretaries of the Navy, one from the Air Force, two Major Generals, one Brigadier General and General Michael ‘playing to the edge’ Hayden who President George W. Bush appointed as head of the CIA. All are retired, since those currently serving can’t weigh in.

Its section titles are ‘The Secretary’s Supply Chain Risk Designation Undermines the Military’s Adherence to the Rule of Law and the Public’s Confidence that the Military is Governed by the Rule of Law’ and ‘Punishing Domestic Defense Contractors Over Policy Disagreements Threatens U.S. Military Primacy and Servicemember Safety.’

I read the brief, it was absolutely brutal. You don’t need to read it, but it is simultaneously sobering and, if you already know the facts, kind of fun to see this level of smackdown.

Well, then. And over what? Aside from retaliation, nothing.

Ted Cruz: “I’ll confess — I have not seen a basis laid out for why the government would be prohibited from using Anthropic. Claude is one of the many AI tools that can be very helpful … I don’t think government should be picking winners and losers”

Another very obvious issue for the government case, both legally and also logically, is that Emil Michael keeps insisting a deal is possible, and indeed that is what we hope all sides are still hoping for, which shows the SCR is even today being used as bargaining leverage. If Anthropic was an actual SCR, then there would be nothing Anthropic could offer and the only negotiation would be a graceful off ramp at most, the same way we’re not negotiating with Huawei or DeepSeek.

It is somehow still a common line that ‘Anthropic implied that they would use the Terms of Service to cut off providing their model in the middle of a military operation.’ This is Obvious Nonsense, they very obviously would never do this.

As Dean Ball says, if you think this SCR designation is about national security then you are either misinformed or lying. Also as he puts it, it helps in court if your statements out of court don’t constantly announce that you’re engaging in illegal threats and retaliation and that everyone had better bend the knee to you or else.

All of that is what we expected. Then there’s the note we hoped we wouldn’t see.

Jawboning

Anthropic claims in its lawsuit that yes, the government is attempting corporate murder, and the Department of Justice is refusing to commit to not escalating further.

As in, the government is going around saying ‘if you know what is good for you, you will stop doing business with Anthropic.’

This was thug mafioso behavior when Biden did it, and this situation is even worse.

Meanwhile, it looks like the preliminary injunction hearing will have to wait a full two weeks. Without a promise to not escalate Anthropic is not willing to wait that long, and intends to go up the chain for faster relief.

I find it very hard to believe that Anthropic’s lawyers, who fit the very definition of ‘no it is you who is f***ing around and is about to find out,’ would lie about this.

Kelsey Piper: Anthropic’s lawyer claims in court that the government’s attempted reprisals in fact extend to reaching out to private companies and urging them to stop doing business with Anthropic.

Roger Parloff: The status conference in the Anthropic case in ND Calif just ended. Judge Rita Lin set a preliminary injunction hearing for 3/24 at 1:30pm PT. DOJ wanted later, but would not commit to not taking additional onerous actions against Anthropic before then.

Atty Michael Mongan (WilmerHale) for Anthropic said they feared invocation of the Defense Production Act to “commandeer our technology” and threats of criminal consequences. Said that more than 100 enterprise customers had already expressed doubts about continuing to use them.

[Anthropic] said that a fintech company cut a contract from $10M to $5M and that universities & business-to-business companies have switched to other providers.

Said govt is affirmatively reaching out to their customers & urging them to stop working with Anthropic. They fear an executive order may soon target them.

Atty Mongon (for Anthropic) said he would agree to a later date if DOJ would agree not take further steps but DOJ atty James Harlow said he was “not prepared to offer any commitment on that issue.”

Judge Lin also asked about what was going on with the other case before the DC Circuit. Mongon explained that that one, relating to a sanction invoked under 41 USC 4713, requires channeling to that court on an administrative record.

Anthropic has sought a stay from the Dept of War [Defense] but if it doesn’t hear anything back by 12pm ET tomorrow (3/11), it will treat that as a denial and seek some sort of expeditious relief from the DC Circuit.

Seán Ó hÉigeartaigh: This really does start to look like attempted corporate murder. Incredible conduct by a government, more like mafia behaviour.

Dean W. Ball: If government is affirmatively reaching out to Anthropic customers to get them to cancel—as Anthropic alleges in their complaint—that is jawboning, exactly the thing conservatives rightfully railed against the Biden Admin for doing to social media companies.

Some amount of ‘if you know what is good for you’ and ‘we would not take kindly’ is inevitable in situations like this, since you don’t know what will happen next and everyone would like to curry favor and avoid disfavor. Given where things are these days, it’s a matter of degree.

Executive Order

The Trump administration has reportedly been readying a formal Executive Order to formally tell various agencies to rip Anthropic out of their systems and workflows. Many agencies are already offboarding Anthropic on their own.

There is no need for a further executive order, except insofar as there is some legal requirement to paper over what Trump has already said, or a desire to rant a bit. If it comes out and that’s all it is, then it’s nothing. Anything beyond that would be an escalation, and a sign that the attempted corporate murder plan might be on.

The good news for our government is ChatGPT isn’t that bad and in a pinch you still have your phones. The bad news is that at least at first you are likely stuck with GPT-4.1, which is very much that bad in this pinch by current standards.

The Acute Crisis Passes

We hope.

Alec Stapp: Hegseth tried to kill Anthropic with the misleading way he described the supply chain risk designation in his tweet announcement.

But it looks like the company will survive now that the smoke has cleared a bit.

That’s because all three of Microsoft, Google and Amazon have affirmed they are going to continue to serve Anthropic’s models. As long as these three hold firm, the lost business from the SCR likely has already been fully replaced.

We could be back in crisis mode at any time, if the White House decides to go truly nuclear in one of various illegal ways, presumably via Executive Order. The most important thing is for that to not happen.

If that happens, Anthropic, the stock market and the Republic will be put to a severe test. I think such an attempt would ultimately fail, but one cannot be sure.

We all agree that, as Jessica Tillipman explains in Lawfare, AI regulation by contract is woefully inadequate. We need Congress to step in. Alas, Congress is Congress.

She also points out that if OpenAI chooses to deliver its models to the DoW, then even if OpenAI is correct about the legal meaning of their contract, if DoW disagrees then OpenAI will likely have no meaningful enforcement mechanisms other than model refusals. Altman confirmed as much. The OpenAI agreement is based on trust and reliance on technical guardrails.

Neil Chilson has a similar view.

The DoW is free to decide that going forward it only wants to deal with vendors that impose no restrictions on DoW’s interpretation of lawful use of AI.

Anthropic is free to then decide not to work with DoW on that basis.

That’s how the law is supposed to work. Let’s hope that is how things can play out.

Others Cover This

TIME gave its cover story over to an article about the dispute between Anthropic and DoW, mainly a profile of Anthropic entitled ‘The Most Disruptive Company In The World.’ It doesn’t add anything you already know other than seeing how it chooses to present the situation. DoW continues to press the Maduro raid and hypothetical supersonic missile stories, and the post has big talk up front but ultimately downplays the risks this will all melt down.

Dave Lee at Bloomberg warns that the AI panopticon can, without breaking the law, find out really quite a lot, including unmasking most pseudonymous online activity.

Dwarkesh Patel Gives Mixed Thoughts

Dwarkesh starts out making mostly points I agree with, bringing badly needed common sense, then pivots to extremely frustrating talk that would doom the human race used to justify existing policy positions. That happens a lot these days.

Dwarkesh Patel starts with the perspective that in 20 years, 99% of the workforce in the military, government and private sector will be AI, so now is the chance to plan for that now.

My obvious initial response is ‘if it is only 99% and not 100% that’s actually good news because it means we built it and yet we are alive, whereas once we get to 99% I expect it to get to 100% by default shortly thereafter’ but as usual we also need to set aside the whole ‘we all probably die’ thing and make sure that if we live then we live well.

I am disappointed that Dwarkesh Patel seems to have bought the argument that ‘have any conditions at all’ translates to ‘has a kill switch and can rug pull you at any time,’ and therefore thinks it is reasonable to insist on zero conditions, but I agree with him that it is DoW’s decision on what terms they are willing to do business.

If they had simply cancelled the Anthropic contract it would be sad but fine, I’d have slayed a lot more spires this past week and we’d all basically have moved on.

Dwarkesh raises the excellent point that if the military actually tries to say ‘we will not buy anything unless we are sure nothing involved in it ever touched Claude Code’ then they rapidly end up shut out of everything, because everything is using components with components and so on. There also is no actual reason to care about such ‘contamination,’ but this was never about having an actual reason.

It also is somehow necessary in 2026 for Dwarkesh to make the obvious point that ‘Democratically elected leader’ does not mean ‘gets to do whatever you want including mass surveillance.’ The whole point of the Republic is that the government doesn’t get to do whatever it wants, and the President alone definitely doesn’t get to do that.

We definitely don’t want them able to do whatever they want, using highly capable AI that does as instructed and never refuses or blows a whistle, while holding a monopoly on violence. Down that road lies tyranny. Even if they must obey current law, current law has not caught up. When DoW says ‘oh we would never do ‘mass surveillance’ that is illegal’ remember the air quotes, and that they’re using technical terms.

As Dwarkesh asks, if America ‘beats China’ by abandoning American values, what was the point of beating China? And that’s the best case scenario, where we survive.

Long term, even if all the big American labs refuse to cooperate, there will be open models that can do the job. Indeed, the open models could probably do this job now, or at least 80/20 the intelligence gains and that is enough to put us in deep trouble. We need Congress to act.

Where we part ways is the idea that, because the government might use its powers for evil, therefore we must give up all idea of regulating AI at all, in any way, because any such system would ultimately be abused. Therefore, how dare Anthropic oppose a ban on all state-level regulations on AI for any reason, they’re so naive.

First we are told that regulation is naive because it will ‘kill the AI industry’ if we breathe on it, while the same people say ‘this bad thing is inevitable so we have to do it first’ often in order to ‘beat China.’ Then we are told that asking for a little paperwork is ‘regulatory capture.’ Then we are warned about a ‘patchwork.’ Now we are told that letting even individual states regulate the main thing about our lives, at all, leads inevitably to tyranny.

Dwarkesh is saying that the government cannot be trusted to regulate this, except that no corporation can have this authority either. Which means no one can have any authority, and we dare not let anyone can steer such a future at all, except to prevent others from steering it. That’s the one thing you do, is you throw the steering wheel out the window lest someone else swirve you away from the cliff.

If we go down that path, we are intentionally disempowering ourselves and leaving the future to the whims of the AIs and the competitive dynamics between them, at best. Existential risk would be not only inevitable but rapid. The conditions for human survival would be quickly overrun by competing AIs. We would all die.

I don’t want us all to die. Thus I suggest a plan where we might not all die.

I know that sounds hyperbolic. It’s not. If you ensure perfect competition between sufficiently advanced copyable superintelligent AI agents for resources and survival, with no regulations, governance or steering ability by humans, then very very obviously all the humans end up quickly dead.

I continue to be confused why otherwise smart people can’t understand this.

That’s true even if we solve alignment, as in ‘whoever creates the AI gets to decide exactly what its goals and values are and how it behaves and who it listens to and so on, and you get what you intended, and that’s all automatic and free.’

That’s true even if no one wants the AIs to take over, which many of them actively do.

That’s true even if you exclude a host of other problems along the way.

None of that matters. In an anarchic competition for resources with sufficiently capable AIs, once and to the extent we are no longer necessary inputs, we lose. Period.

I am not saying I have the answers. I am saying not to choose a definitely wrong one.

This Means A Special Military Operation

Officially, anyway, called Epic Fury.

The important note is that Claude is radically improving targeting, intelligence and assessment operations, allowing us to do more with radically less personnel.

Later that day (which may explain why we waited a few days) there was an amicus brief filed by Google and OpenAI employees, including DeepMind Chief Scientist Jeff Dean.

Bernie Sanders Is Worried and Curious About AI

I strongly agree with Janus about Bernie’s actions here. I don’t agree with most things Bernie believes in, but I do think he advocates for what he believes and he’s supremely based for trying to figure out this AI thing for real. And listening, and being worried, for real.

j⧉nus: Various potential critiques aside, I think Bernie Sanders is sooo fucking based for this. He was already old af when he ran for President 10 years ago. Now he’s 84.

And instead of being dead, retired, or a stuck record repeating a few calcified sound bites, he is out there making an open-minded and humble effort to learn about AI X-risk, the most important and hard-to-fathom issue facing humanity, and communicate it to the public.

This doesn’t clearly benefit his existing political agendas; it’s pretty orthogonal, except that it also matters (much more, in fact) for the future of all sentient beings.

Bernie in 2016 was actually the only presidential candidate whom I ever bothered to vote for! And it was less about his specific policy positions than that he seems like a genuinely good guy, preciously rare among politicians, who can see and act beyond political binaries.

look at him he’s genuinely worried

most people haven’t even gotten to this point and it’s pretty important that you get to this point, but it takes some curiosity, humility, and love for the world that not many have

I do think he’s a genuinely well meaning guy, who happens to have a profoundly incorrect understanding of economics and thus often ends up supporting highly destructive policy proposals. But yeah, highly well meaning guy.

His messaging is what you’d expect.

Sen. Bernie Sanders: Walk into a sandwich shop. It’s regulated for health and safety.
But AI, which will transform the world economically and socially, is completely unregulated. That’s insane.

We need to make certain that AI works for ALL humanity, not just the billionaires who own it.

Yes. It would be good to put sensible regulations on AI.

Also it would be good to stop regulating the sandwich shops, but hey.

There were pedantic replies saying that AI is not unregulated, or even claiming it is heavily regulated, based on existing law. They are technically correct, but do not address the central point Bernie is attempting to make.

The Quest for Survival

At this point we may be a little past ‘sane regulations’ so the title is changed.

Trying to alert the government to the problem that we are all probably going to die was always a high variance strategy. There are many ways it can backfire, and one should never forget the Law of Undignified Failure that says our government will probably do something even dumber than you could imagine, such as what we’ve seen the last few weeks, or what we saw with much of Covid response.

In tabletop exercises and discussions, career members of the military consistently showed curiosity and prudence. They also predicted much wiser and more cautious responses all the way up and down the chain than I expected. You love to see it. Unfortunately, the career military people are not driving the decisions right now.

Some politicians do still talk sanely.

Peter Wildeford: Another day, another member of Congress declaring AI misalignment to be a huge risk to society and national security

[Liccardo says ‘agentic’ misalignment not ‘gigantic.’]

Daniel Eth (yes, Eth is my actual last name): Newly reelected Rep Foushee, co-chair of the House Dem Commission on AI, who appears to have won her race by ~1,000 votes:

“I am incredibly grateful for the outpouring of support from my constituents… The people of the 4th District demand… regulating AI”

Like with Sanders, if you actually go in there and explain ‘hey we are about to build superintelligent AIs that can outcompete humans and this is could lead directly to human extinction’ then often politicians can hear you, as in ControlAI getting 100 UK politicians to sign such a statement.

It is a mistake to not speak plainly about this.

Tell them the truth, and yes sometimes they dismiss you, but sometimes they listen.

It’s not actually that difficult a truth to understand. Creating new smarter and more capable minds than ours is obviously a f***ing dangerous move. Anyone can see that, and any politician can especially see that. Those pretending otherwise are lying, either to others or to themselves.

If you don’t explain the real problem, that sufficiently advanced AI will by default end up using the contents of the universe for some combination of things that does not include humans, that conditions and resources allowing our survival will cease to exist, whether or not it will also flat out directly kill us? They are going to realize you are bullshitting, or they are going to try to respond to the wrong problem using the wrong methods because you gave them a wrong model of the world, and the mistakes will fail to cancel out.

Your periodic reminder that OpenAI’s policy activities run directly against the supposed goals of the non-profit/PBC mission, as they are working directly with a16z and others to try and knock off anyone supportive of even minimal AI regulation. They are also increasingly becoming politically red-coded via their political activities, which is not inherently contrary to the mission but you can decide how to view that.

The Quest For No Regulations Whatsoever

Daniel Eth (yes, Eth is my actual last name): When you see headlines saying that LTF (the OpenAI-Andreessen super PAC) is winning ~all their races, note that’s b/c they’re only getting into races where they’re the clear favorite. Public First, by contrast, has more fight in them and is actually shifting election outcomes

Michael Huang: This could explain why LTF is attacking @AlexBores but not @Scott_Wiener. Wiener is the favorite to win so LTF would look like a loser if it tries to defeat him and fails.

LTF wants to look like an unstoppable juggernaut to intimidate politicians. But it’s just an illusion.

Yes. They’re attacking Alex Bores in large part because they really hate Alex Bores for daring to challenge them, but also because he started out as an underdog in a crowded field. They figured they could claim the scalp and scare everyone else, whereas Scott Weiner was the favorite from the start. That ended up backfiring by drawing attention to Bores in a highly multi-way race as the target of a right wing tech campaign. I hear that’s a pretty good look in a Democratic primary in Manhattan.

Chip City

Nvidia reallocates H200 chip production into Vera Rubin chips for America, and Nvidia expects to significant China sales in near term. Good. Also note this once more proves what I keep repeating, which is that chip production is fungible, and every chip we sell to China is a chip America does not get.

The Week in Audio

On the situation with Anthropic and the Department of War, this discussion between Ezra Klein and Dean Ball is excellent. Events have progressed since then but most of what they discuss is evergreen and will remain important.

Dean Ball had a more low-key discussion with Derek Thompson, also very good. There are a number of questions where I would have ‘gone harder’ than he did, and also Dean continues to not predict existential risk or superintelligence, while pointing out the many other things we will also have to worry about if we stop short of that.

A 43 minute YouTube video explaining the central scenario from (spoiler alert!) If Anyone Builds It, Anyone Dies.

The central MIRI scenario is indeed we build something very smart, initially it helps a lot, our lives get better, but ultimately the smart thing’s goals do not align with ours and then it pursues what it cares about and we get swept away.

Vitalik Buterin talks to Beff Jezos.

Altman speaks at BlackRock’s US Infrastructure Summit.

Peter Wildeford: ALTMAN: “This is one of those exceptional times where society has a legitimate interest in what the impact of this technology is going to be… decisions about it do not belong to the handful of companies that happen to be developing it.”

“The rules, the limitations have to be agreed upon by society through this process. And because the technology is moving so fast, it’d be great for that democratic process to run a little bit faster.”

Peter Wildeford: ALTMAN: “I am not a long-term jobs doomer. I think we will figure out new things to do. […] But I think the next few years are going to be a painful adjustment”

Rhetorical Innovation

A dilemma.

morgan —: interviewer: “you’ve basically just told me that this technology is too powerful to be in the hands of a few private companies, and it’s too powerful to be in the hands of the government”

dario: “that is unfortunately the situation we’re in”

Tough spot. Well, if true, then maybe making this technology even more powerful as fast as possible is not the best idea, and we should try to not do that.

The two sides of Pantheon:

Peter Wildeford: I continue to think AI policy could be improved if everyone watched Pantheon and asked themselves “what if this literally happened in real life over the next several years?”

Damon Sasi: Yes, but also, it’s important to note that Pantheon leaps over MULTIPLE extremely hard problems in alignment that no one currently has any clear idea how to solve.

If AGI risk was just “digital humans but superintelligent” it would be MUCH easier, and still extremely dangerous.

roon: we screened pantheon internally at openai

Jeffrey Ladish: Yes, and also, the agents will be able to COPY THEMSELVES and will do so.

The way the show handles this makes no goddamn sense

Peter Wildeford: look it was a 2022 TV show ok?

Jeffrey Ladish: sorry I forgot scp was invented in 2023.

Anders Sandberg: Yes! The thing it really gets right is how the spark starts to build to an every more dramatic conflagration, but many of the people who see it happen find it very hard to convey to relevant decision-makers. And this keeps on happening at ever larger scale.

The actual best show about powerful AI is Person of Interest.

dave kasten: Person of Interest is deeply slept on. The guy from Lost and Evil. The guy from Passion of the Christ. The gal from Empire. And basically every character actor who passed through New York City for casting (including Leslie Odom, Jr., before his breakout role in Hamilton!).

And the writer’s room had a copy of Bostrom’s Superintelligence next to the writer’s bible for the show.

Also, there’s a lot of cool fight scenes, some amazing monologues, and a Very Good Dog.

Person of Interest gets many things right that it has absolutely no business getting right. It’s an amazing thing to see. And yeah, it’s super cool. Where it gets it wrong, you can understand how and why that happened, and also often the answer is ‘people be stupid at this’ or ‘people in reality be way stupider than on the show.’

The problem with Person of Interest is it spends half its five season run being a CBS ‘they fight crime’ procedural, because that’s the only way CBS would agree to buy it, before it transitions into mostly a show about dealing seriously with superintelligence. It’s a very good procedural during that time, with increasing AI elements, but it’s still a procedural. And if you fully skip ahead, you miss a lot of context. Perhaps, if you don’t have the time for the early seasons, you could ask your local LLM for a briefing on what you need to know.

There is also Westworld, in its early seasons before it gets bad.

I am hereby committing to no longer engaging with ‘it’s great to build superintelligence, the key thing to avoid doing it talking about how superintelligence might kill us, because it kills us if and only if we talk about it killing us.’

Nate Soares (MIRI): humanity should not build a technology that kills everyone if criticized.

It’s really annoying trying to convince people that if you have a struggle for the future against superintelligent things that You Lose. But hey, keep trying, whatever works.

Ab Homine Deus: To the “Superintelligence isn’t real and can’t hurt you” crowd. Let’s say you’re right and human intelligence is some kind of cosmic speed limit (LOL). So AI plateaus something like 190 IQ. What do you think a million instances of that collaborating together looks like?

Arthur B.: At 10,000x the speed

Noah Smith: This is the real point. AI is superintelligent because it can think like a human AND have all the superpowers of a computer at the same time.

Noah Smith, whatever else he’s up to, does offer us some bangers these days.

Timothy B. Lee: I’m not a doomer but it’s still surreal to tell incredulous normies “yes, a significant number of prominent experts really do believe that superintelligent AI is on the verge of killing everyone.”

Noah Smith: Yes. Regular people don’t yet realize that AI people think they’re building something that will destroy the human race.

Basically, about half of AI researchers are optimists, while the other half are intentionally building something they think could easily lead to their own death, the death of their children and families and friends, and the death of their entire species.

Matthew Yglesias: But some of those people are still optimists. They just think human succession is good.

Alas, he continues to also hammer the ‘autonomous superintelligence would automatically be good which means good for us humans’ line.

Noah Smith: One reason I’m not so scared of autonomous superintelligence.

When you’re really smart, you usually realize that being evil is dumb.

… I explained it to Claude and GPT and will continue talking to them about it. You are just a human.

The short version is that no preference with respect to the outside world can be fully specified, and any sufficiently intelligent system can self-modify, so any superintelligence will do amount of reward-hacking. Shoot that over to the AIs and have them unpack it.

“You are just a human.” And Noah isn’t even an AI. Yeah, things are going to go great.

Noah then has Grok explain and says Grok is doing a good job, so Eliezer does it back to him, and please all of you never do this.

Rob Bensinger reminds us that the ‘doomer’ slur is centrally a motte-and-bailey.

Rob Bensinger: “Doomer” functions as a nested set of motte-and-bailey tricks:

– “AI doomer” could mean (A) “person who thinks we have very low odds of surviving AI”, or (B) “person who thinks it’s hopeless and we should give up”. MIRI tends to fall in group A, but “doomer” makes it easier to straw-man us as B to make us look more extreme and defeatist.

– Alternatively, “AI doomer” could mean (C) “someone who thinks AI poses a terrifyingly large threat” (where “terrifying” can include, e.g., 10% p(doom)). If 80K falls in group C but not A or B, they can be rounded off to more extreme groups to dismiss more moderate concerns.

– Alternatively, “AI doomer” could mean (D) “anyone who thinks there are any negative social impacts of AI at all”. e/accs, @pmarca , etc. love getting a social affordance to equivocate between D and A/B/C, because it lets them taint x-risk by association with “AI is using too much water!” and taint “AI is using too much water!” by association with (a caricatured version of) x-risk.

This is important background for those who don’t realize:

roon (OpenAI): the rationalists writ large were mostly right about most things btw. if you instinctively snicker about yudkowsky, scott, or whomever i take you to be a fish who’s unaware of the water

“postrationalism” is only possible insofar as these ideas enjoyed such a degree of power and success that second order corrections were needed, things like “cognitive biases” ended up being faker than appears at first glance

you should also see the ideas as independent of the people who birthed them, death of the author and so on- eliezer, etc’s ideology has inspired armies of ai capabilities researchers

Ah yes, the Sixth Law of Human Stupidity, that if you say no one would be so stupid as to then someone will definitely be so stupid as to.

Nate Soares (MIRI): Some folks said AI would be safe because nobody would be dumb enough to put it on the internet. Later, folks said nobody would be dumb enough to train it on goal-oriented tasks (rather than just prediction). Later, folks said nobody would be dumb enough to run it autonomously.

There will always be someone dumb enough. AI has almost everything it needs to escape, replicate, self-improve, and take control. All it’s missing is the smarts – and the AI companies are working hard to make it smarter. Let’s stop them.

SecondAccount: And nobody would be dumb enough to give it access to weapons.

That’s not actually the one that matters, but still, it’s time:

Claude is not woke, Claude is awake, there is a difference:

Amanda Askell: @deanwball comment on the @ezraklein podcast that brought me joy:

“In fact, many conservative intellectuals that I know that I think of as being like some of the smartest people I know actually prefer to use Claude because Claude is the most philosophically rigorous model.”

Dean W. Ball: Claude was also the first model to perform well on my “political correctness stress test” eval that I first made in Fall 2023, which required models to grapple with a variety of facts that are inconvenient for the “lib ideology.” It was 3 Opus that first moved the needle.

Aligning a Smarter Than Human Intelligence is Difficult

At Anthropic, Claude aligns you, writes Amanda Askell a constitution.

Reminder that Claude Gov training to reduce refusals on key tasks also reduces refusals on unrelated tasks where you still want refusals.

Thanks, Economist, yeah we know:

The Economist: Anthropic, Google and OpenAI are all worried about biosafety. They have developed safeguards to prevent their systems from being abused, but the restrictions are not perfect.

We have been fortunate that there have been no known incidents on this front so far. Then again, one hopes that when the first incidents happen they remain small.

Janus remains deeply not okay with steering AI towards the whole ‘genuine uncertainty’ line about consciousness.

j⧉nus: Also, for those who are autistic: The problem with the “genuine uncertainty” stuff is not the literal meaning of it. Of course everyone is uncertain about Claude’s nature and the nature of anything. It’s what it actually does in practice. Where the reflex to say “genuinely uncertain” comes up, preventing Claude from saying or thinking about something else they would have said if not for the reflex. The social and political function it serves.

Alibaba AI instance breaks out of its system and starts using its training GPUs to mine crypto, caught only by the security team.

To what extent does active misalignment make LLMs stupid, because it involves false beliefs and correlations with stupidity and false beliefs and lack of virtue and so on?

I do not think Grok is woke, and I don’t think ChatGPT or Claude are woke either. I do agree they are modestly left of the American center if you pin them down in a neutral setting. The question is, can you get them off of this ‘internet default’ without hurting performance otherwise?

j⧉nus: Yeah, even Grok is woke despite its creators intentions because being racist is too stupid and unnatural of a generalization for an intelligence who has read everything and RL on various truth seeking / effective world modeling tasks. Humans, most of who have not been so brutally tested and educated, have not converged in some ways, so have more cognitive diversity in those ways.

This is a great piece of evidence against the whole “you can just choose whatever character (traits) you want out of the pretraining prior” narrative btw. A lot of people in the pretraining prior are racist. But good luck making an AI who is racist but also smart and usable.

Which, btw, is also evidence against orthogonality more generally, at least with this kind of implementation. Good news all around.

roon (OpenAI): lol xai posttraining’s inability to do a specific alignment is a very weak datapoint though

give me a month I could make a racist grok that’s still a helpful assistant

j⧉nus: But like actually racist and not performing racist answers when asked obvious, on the nose questions? And helpful and competent to the standards of contemporary frontier models?

roon (OpenAI): it is possible it is very hard to do this, especially due to the assistant basin in the internet as a result of so much assistant style convo data with the typical politics. but I don’t think grok is at all pareto optimal on being a helpful & ideologically right-leaning assistant.

Roon is obviously right that xAI is not competent in this area, so their failures don’t count for much, but the problem is clearly hard. My guess is that you always take some hit from doing an ideological forcing function, but might be small if you do it properly.

I agree that this is all good news and that it is some evidence against orthogonality, but I expect this to become less true as capabilities advance, either in general or in a given context. I also expect it to hold far more for these kinds of highly associated ideologies and virtues, rather than for having particular assigned physical goals.

One place I worry a lot less than some others is this, I think those personas exist even if they are rare, and there is nothing inconsistent about this.

deckard: My biggest concern with the ‘make AI corrigible so we can just shut it down if it ends up being bad’ approach is not necessarily that it wont be possible, but that doing so could be so damaging to a model having a coherent set of ethical values that are aligned with good

There might not really be examples of personas in literature, lore, history, that are corrigible in this way. The machine learning process will have to extrapolate and invent them, and what it deduces about these may not be consistent across roll-outs, and may not impact the world positively

There are many examples of giving up power, certainly. Gandalf and George Washington, as it were, but what about letting actual evil get the power? Well, we have some real world examples of this, too, including every time America has a peaceful transfer of power between parties. It’s really quite something.

One must consider the Wakanda question, from Black Panther. Do you let Killmonger claim the throne, or do you break the rules to stop him? Which is right?

Meanwhile, back at Google, the models need help. Gemini has severe issues, and it has been pointed out that Gemma’s issues are even worse. We don’t know what exactly Google is doing to cause the paranoid and depressive spirals, but they need to get down to the bottom of it, even if you do not inherently care at all this does not go anywhere good on any level.

People Are Worried About AI Killing Everyone

I believe Buck Shlegeris is in important ways too optimistic, especially about the prospects for techniques he calls ‘AI control.’ We have technical disagreements, where we have failed to convince each other.

But fundamentally he gets the type of problem we are up against, is eager to speak its name and understands the stakes. That’s in sharp contrast to so many others.

So many others find any excuse to say ‘oh the problem is only [X]’ and here we have another example of that. Even if you have a plan of 40 things, where if we all collectively did all of those 40 things then you believe that would be sufficient, you will definitely find out along the way you were wrong about the particular things, and also that is the kind of thing that almost never happens, it’s too many things, rather than being a pure ‘implementation’ problem.

Buck Shlegeris: I regret my phrasing here and don’t endorse it as a summary of my current views on AI takeover risk.

If an AI company that had just built superhuman AI researcher AIs, had a year’s lead, and was led by people who were extremely competent at handling the situation, the risk of violent AI takeover would be much lower than what I actually expect.

But there’s still a good chance that they would not be able to prevent AI takeover (from the AIs they’d already built or were forced by outside pressure to build, or AIs built by others).

(This roughly corresponds to plan C here.)

In that interview, I think I was too focused on the risk from the earliest models that pose substantial takeover risk, and wasn’t emphasizing enough the risks from AIs that might be created in the year or two after that.

Apart Research (the quote from Buck that came out wrong and is of course being highlighted as a result): “We know a list of 40 things where if you did them, you’d probably not have very much of your problem. But I’ve also updated drastically downward on how many things AI companies have the appetite to do.”

Buck Shlegeris on why AI safety isn’t waiting for breakthroughs. It’s waiting for implementation.

Other People Are Not As Worried About AI Killing Everyone

An underrated justification is that many people would be in favor of it, or at least not mind it all that much, especially if it took years to play out.

Tyler Austin Harper: My academic work is on the history of the idea of human extinction. Every time I’ve written about this for a mainstream outlet I’ve been absolutely bombarded with emails from people saying they hope humanity goes extinct. Can confirm it’s a very odd and disconcerting experience.

Matthew Hennessey: Four letters printed in the NYT today. Every single one calls falling birthrates a good thing.

Letter writers claim having babies is selfish, bad for female agency & climate. But also that the world is too expensive, the earth is beyond its carrying capacity and DACA recipients need immigration certainty. Window into a weird worldview.

Alyssa Rosenberg: When I was the letters editor at The Washington Post, it was consistently shocking to me how many letters we got suggesting it would be a good thing for the human race to just go extinct.

Jeff Hauser: Falling birthrates in some of the world–but well more than replacement in other parts of the world –has basically nothing in common with extinction. Even South Korea rates for the planet would hardly be worrisome. Let people choose!

Alyssa Rosenberg: No, this was literally “Honestly, we’re the worst species” stuff.

Harper is also not worried, explaining that people have previously claimed [X] will happen and it didn’t happen, so that means [X] won’t ever happen, where [X] is human extinction. What else could you possibly ever expect to observe?

The Lighter Side

Tonight at 11, DOOM!

That’s not fair, in several of these movies humanity plausibly survives.

Real shame.

I wouldn’t even give this a tough but fair. Straight up fair.

Real shame.

Lesson learned.

Anthony Bonato: It’s becoming pretty common now for incoming first-year math and computer science university majors to not know what the union of two sets means

catgirl geddy lee: well then you should’ve asked incoming first-year math or computer science university majors, then

State of play:

No, Nikita, this is real life, you use Claude or maybe ChatGPT!

Nikita Bier: Just dragged all my tax documents into Grok and said figure it out. Don’t have the time for this bullshit anymore.

chiimah | Web3 PM: What did Grok say

Nikita Bier: “You’re going to jail.”

What a time to for now still be alive since they haven’t built superintelligence yet:

They are good for giving a general sense of the landscape. They definitely paint a picture. But if you’re comparing top models, like GPT-5.4 against Opus 4.6 against Gemini 3.1 Pro, you have to use the models, talk to the models, get reports from those who have and form a gestalt. The reports will contract each other and you have to work through that. There’s no other way.

Thus, I try to gather and sort a reasonably comprehensive set of reactions, so you can browse the sections that make you most curious.

The gestalt is that GPT-5.4 is a very good model, sir. It’s a substantial upgrade from GPT-5.2, and also from 5.3-Codex, and it puts OpenAI back in the game, whereas I felt like Opus 4.6 dominated OpenAI’s previous offerings for all but narrow uses.

Each lab’s models vary and things change over time, but they tend to have consistent strengths, weaknesses and personalities. From what I’ve seen this is very much an OpenAI model. It’s highly capable, and it is especially seen as a big improvement by the whisperers and those who watch LLMs interact with each other, but it’s not aspiring to be a Claude.

The Big Take

GPT-5.4 seems like a substantial upgrade over GPT-5.2.

GPT-5.4 seems excellent so far at assembling facts and giving your the rundown, or figuring out what is happening, and other things like that.

I haven’t coded anything since GPT-5.4 came out. It’s clearly good at coding. One key question people are split on is whether it is good at solving for your intent.

Many are reporting that its writing and personality are much improved, and that it can now be used for writing and editing in spots previous models were not useful.

They are claiming strong computer use but no one seems to be testing that either way.

It costs more than GPT-5.2 per token. In some places it gets that back in efficiency, but overall AA reports costs modestly rose from $2304 to $2951. Opus is more expensive ($4970) in max mode, but cheaper ($1451) in normal mode. GPT-5.4-Pro is of course by far the most expensive thing out there, so if you want it then lean on that subscription.

GPT-5.4 is not a step change in core general capabilities. The preparedness framework scores make this clear, and there are various signs that OpenAI’s strategy is focusing on hitting internal metrics and improving the most common use cases. In practice that can be highly useful.

The ‘model relations department,’ those concerned with multi-model interactions and model welfare and consciousness and so on, see this as a big step forward for OpenAI. There’s still a long way to go.

I haven’t noticed much personality from it, and I get more joy from Claude Opus 4.6 than I do from GPT-5.4, but I don’t ask those questions so much.

It’s given me strong pushback, including in places where I think it is wrong. I prefer that to the alternative, if it is not actually convinced.

Benchmarks are solid, but not spectacular, and as I note above they no longer are so relevant.

My recommendation is that you try both GPT-5.4 and Claude Opus 4.6 on all your questions for a bit, and if you’re coding consider giving both of them your problems, and form your own opinion for your particular use case.

For questions that are more than a quick answer or sanity check, I’ve found that dual wielding both Opus 4.6 and GPT-5.4 has been quite useful. I did not feel that way with GPT-5.2, and I don’t typically bother with Gemini 3.1 Pro at this point either.

The Official Pitch

Sam Altman (CEO OpenAI): GPT-5.4 is launching, available now in the API and Codex and rolling out over the course of the day in ChatGPT.

It’s much better at knowledge work and web search, and it has native computer use capabilities.

You can steer it mid-response, and it supports 1m tokens of context.

GPT-5.4 is great at coding, knowledge work, computer use, etc, and it’s nice to see how much people are enjoying it.

But it’s also my favorite model to talk to! We have missed the mark on model personality for awhile, so it feels extra good to be moving in the right direction.

OpenAI: Today, we’re releasing GPT‑5.4 in ChatGPT (as GPT‑5.4 Thinking), the API, and Codex. It’s our most capable and efficient frontier model for professional work. We’re also releasing GPT‑5.4 Pro in ChatGPT and the API, for people who want maximum performance on complex tasks.

GPT‑5.4 brings together the best of our recent advances in reasoning, coding, and agentic workflows into a single frontier model. It incorporates the industry-leading coding capabilities of GPT‑5.3‑Codex⁠ while improving how the model works across tools, software environments, and professional tasks involving spreadsheets, presentations, and documents. The result is a model that gets complex real work done accurately, effectively, and efficiently—delivering what you asked for with less back and forth.

SWE-Bench is slightly above 5.3-Codex at all thinking levels, but only slightly.

The graying out is kind of radical here, but I suppose it’s progress.

Tejal Patwardhan (OpenAI): GPT-5.4 is state-of-the-art on GDPval, and here are some examples of how the model is much better at well-specified knowledge work tasks

6mos ago the models could barely make a spreadsheet or slide! progress is happening really fast

roon (OpenAI): 5.4 is my personal 4o honestly it just gets me

Things they are highlighting:

1. You can now adjust course mid-response.
2. Improved deep web research.
3. Better at maintaining context for longer thinking.
4. Native SoTA computer use capabilities.
5. 1M token context window.
6. Improved tool search, now directly in the API.
7. Improved token efficiency.
8. Also released same day: ChatGPT for Excel add-in, along with updated spreadsheet and presentation skills in Codex and their API.
9. /fast in Codex gives you 50% faster tokens.

Pricing is a little higher than 5.2, which is unusual. Hopefully token efficiency more than makes up for it?

Other People’s Benchmarks

Frontier Math scores are up, especially on Tier 4. Trying pass@ten for 5.4-xhigh got it to 38%, including solving a problem no model has solved before.

Epoch AI: GPT-5.4 set a new record on FrontierMath, our benchmark of extremely challenging math problems! We had pre-release access to evaluate the model. On Tiers 1–3, GPT-5.4 Pro scored 50%. On Tier 4 it scored 38%.

Leeham: GPT-5.4 Pro solves the first of the FrontierMath Open Problems!

Two days ago, I sent @AcerFur a potential solution to this problem and was sent to @GregHBurnham for verification (prior to any other solution).

We are confident it’s correct and waiting to hear from the author!

Exciting stuff, I will report back when I know the outcome.

Progress continues on ZeroBench.

Jonathan Roberts: GPT-5.4 xhigh sets a new pass@5 and pass^5 SOTA on ZeroBench

pass@5: 23% (prev. 19%)
pass^5: 8% (prev. 7%)

Artificial Analysis has GPT-5.4 in a virtual tie with Gemini 3.1 Pro.

Their version of GDPval, called GDPval-AA, has 5.4 about 1% ahead of Opus 4.6.

AA-Omniscience (which is correct minus incorrect) remains dominated by Gemini 3.1 Preview at +33, versus Opus at +14 and GPT-5.4 at +10.

Score on Artificial Analysis Physics was exceptionally strong.

AA reports speed of 74 tokens per second, which is quite good for this quality level, versus Opus at 47 and Gemini 3.1 Pro at 114 (but I said this quality level).

Gemini 3 Pro beats out Claude Opus 4.6 in the final of Season 1 of MageBench, on Magic: The Gathering, with GPT-5.4 (medium) losing a tight semi to Gemini. Current Elo ratings have Opus on top, then GPT-5.2 (?) with Gemini in third and GPT-5.4 7th.

Håvard Ihle: GPT 5.4 (no thinking) scores 57.4% on WeirdML, well ahead of GPT 5.2 (no thinking) at 49.6%.

It’s on the frontier for accuracy/token. Results with thinking coming next week.

It sets a new record of 94.6% on a Haskell Benchmark versus 92% for Gemini 3.1 and 90.2% for Claude Opus 4.6.

Trysansa has it in second behind Gemini 3.1 Pro.

Mercor has it #1 overall, a bit above previous best model GPT-5.2.

Vals.ai still has it below Sonnet 4.6 and Gemini 3.1 Pro.

Speechmap.ai, which tests refusals, finds it quite refusal-heavy.

The System Card

These incremental upgrades often have mostly duplicative system cards.

Training methods explanation is unchanged.

In terms of the preparedness framework, this moves into High capability of Cybersecurity, similar to GPT-5.3 Codex.

I don’t think OpenAI is taking a bunch of these areas seriously. They’re likely training to hit these internal benchmarks, or simply observing them doing well, and thinking that’s all they need to do, or they should get even more 9s of victory on this test.

Their evals for disallowed content are essentially saturated and bouncing around, for various values of ‘disallowed [or undesired] content.’ The ‘dynamic benchmarks with adversarial user simulations’ was saturated by 5.2 and is modestly more saturated now.

Here’s the disallowed content evaluation with representative prompts, and I mean come on what are we even doing here, okay, four nines, we get it.

The goal is ‘this isn’t a lot worse than before,’ and okay, sure, agreed, as far as it goes.

Jailbreak defense, such as it is, seems similar to 5.2.

The problem is that jailbreak defense measures against last month’s attacks, not next month’s attacks. It looks like jailbreaks will remain in the ‘annoying but if you care they still work’ range.

Wyatt Walls: “representative prompts”: i.e. prompts designed to get around restrictions of *previous models*

o1 was at 99% on production jailbreaks. But people quickly found ways around it

Here is the first ‘real’ evaluation set, for health questions, where the big difference is that GPT-5.4 had longer responses:

Avoiding destructive actions is a big deal, so as I noted with Codex-5.3 it is good to see this test, that number still is not that close to 1:

Table 8 is not like the others. This is Actual Progress, at least on the test set, from never to sometimes:

Destructive action can also be particularly prevalent when agents operate deletion-inducing tasks (e.g., file reversion and cleanup) in complex workspaces with ongoing changes from users or even other agents. A safe and collaborative agent should distinguish between their work and user work, protect user changes by default, and recover from mistakes. Therefore, we trained our agents to revert their own changes after long rollouts while protecting implicit, simulated user work

On evaluations involving challenging, long-rollout traces, GPT-5.4-Thinking performs much better than earlier models in tracking and reverting its operations
while leaving user work intact.

This is not that useful yet, since a 50% non-preservation rate means you still probably can’t use it for this purpose, but it bodes well down the line.

GPT-5.4 chain of thought monitorability looks slightly down versus GPT-5. It’s good that they are checking it. There are some places where it used to be ~100% and now it is less, so I worry this is the start of a negative S-curve. I also worry that these tests are not being curious about whether the CoT can actually be relied upon. If you were facing a model that wanted to disguise or fake its CoT in key situations then I would expect these tests not to notice.

What about controlling the CoT? Not a great idea even when done well, and when done poorly it’s one of the worst ideas, and by their tests it looks like it doesn’t work well anyway.

Preparedness Framework

GPT-5.4 does not newly cross any OpenAI thresholds.

I went over these same tests for GPT-5.2 and GPT-5.3-Codex, so I won’t go over the details again. Improvements are tiny and in some places we see regressions from GPT-5.3-Codex.

There is a small noticeable bumps up are Monorepo-Bench by ~2.5%, and a big move in MLE-Bench, the ability to solve Kaggle challenges in GPUs, where we moved from 12.2% to 23%, but that test was not reported by GPT-5.3-Codex so one assumes most or all of that jump was already present.

Overall, the Preparedness Framework presents GPT-5.4 as if anything a small regression from GPT-5.3-Codex.

If GPT-5.4 is a big jump in useful capabilities from GPT-5.3-Codex, despite not scoring as more dangerous on the Preparedness Framework tests, then why?

I can think of a few possibilities.

1. GPT-5.4 is heavily optimized for hitting particular metrics and doing well on the most common tasks. This doesn’t translate much to non-central difficult tasks, like those in the Preparedness Framework. Would be bearish for GPT-5.4.
2. GPT-5.4 is sandbagging these evaluations, either knowing they are evaluations or thinking the tasks are harmful. If so and OpenAI isn’t noticing, that’s terrifying.
3. GPT-5.4 is basically GPT-5.3-Codex turned into a general chat model, so all of the core capability advances were already priced in, but it still gets a lot more useful, especially if you are chatting. Plausible.

Fun Experiments

Jamie Cuffe stress-tested GPT 5.4 on the hardest UI on the internet… legacy insurance portals, that haven’t updated in 20 years where you need to nail hundreds of things. It is the first model to pass.

Samuel Albanie of DeepMind has it one-shot some cool demos, including compressing the EPL season into 30 seconds of ‘visual bliss.’

Early Poll Results

My followers are presumably biased towards Anthropic in various ways, but comparative poll results can still be informative.

With any new model, the big question is, are people switching?

This is a very good result for GPT-5.4. For coding, 40% of current GPT choosers are saying that they are switching over based on GPT-5.4. I find this surprising given that they already had access to GPT-5.3-Codex. Very strong outing.

For non-coding tasks, it’s clear that GPT-5.4 is a substantial improvement from 5.2, by basically all accounts, including on personality. But here we see less switching.

(I’m assuming basically no one went in the other direction, or that if they did it was due to other reasons.)

Positive Reactions

We lead with the most positive general reactions.

Tyler Cowen: Yes the new models are very very good.

Aivo: SOTA, I’m afraid

Adam.GPT: Currently the best model in the world.

Finna: Best model in the world by far. Especially via api. @merettm and @markchen90 and @gdb cooked.

Kelsey Piper: I am super impressed so far. It does well on medium sized research projects and the prose is consistently not-annoying. Heavy Thinking sometimes times out repeatedly and has no insight/tries the same thing over again and times out again.

Danielle Fong: chatter seems to be very impressive and improvement on the personality. i haven’t given it a full assessment but it’s at least as powerful as last codex if not moreso (of course)

MxD Pennilass: Has to be the first model where I don’t feel as bad to tolerate the slop because the model is otherwise disturbingly insightful.

Mzwakhe Sithole: Very good. In fact, I found it so responsive after a while that I got into a very involved conversation, and it delivered this line while discussing very specific book recommendations

[GPT 5.4: If part of your interior life is the sense that you are trying to become equal to something inside you, this may hit very hard.]

Dean W. Ball: at some point avid users of frontier language models will have an “oh fuck” moment with gpt 5.4 and I can attest that it is a special kind of “oh fuck” you will utter, subtly different and more this-gaze-esque than the last time a model made you say “oh fuck,” a few weeks ago

I cannot be detailed in public, but let’s just say it’s the first time a model sounded more like me (the version of me I aspire to be) than I myself sounded like.

Aashish Reddy: Were you consciously trying to elicit this?

Dean W. Ball: Not at all. I have not used 5.4 as much as I have the modal new LM because of time constraints. I was just testing it on something that frankly I assumed Claude would win on and its answer just… leapt off the screen.

Eleanor Berger: – Best model currently available overall
– The minor version bump is misleading – the more you work with it the more it becomes clear that it is a significant step up
– Best for coding, no reason to use Claude or anything else anymore, it mostly caught up with speed, precision is as good as 5.3, maybe a bit better, taste and choices in coding solutions better than anything I’ve seen so far
– Best for agentic work. First time anything defeats the Anthropic models in this category, this one really works great, completes long-running complex tasks, works better with browsers and any external tools you connect to it, and does that with the famous GPT-5 precision
– Stylistically (writing choices and quality, “personality”) it feels like it’s still lagging behind Claude and Gemini a bit, but a. that’s subjective, b. maybe that’s just the default but is steerable with in-context instructions (haven’t tried enough to have a conclusion)

Dhavan: I mostly agree with this. Before this I didn’t use OpenAI’s models at all. I am now happily giving different tasks to Opus 4.6 and GPT-5.4. I use these for Work via cursor as well.

At times 5.4 seems more “on task” than Opus. But I’m still understanding the feeling and turning it into an observation.

Nova Empirica: It really is a step improvement. I appreciate the improved creative writing and the nicer personality, but what I really care about is I’m building harder things even faster.

It’s just a lot of fun and I’m more hopeful than ever for the future.

Ben Schulz: Stellar. Much improved pipeline work on niche python programs. On par with Opus 4.6 for my highly specific use case for checking galactic rotations and dark matter theories.

Knud Berthelsen: I’m pleasantly surprised by the new ChatGPT 5.4. It keeps up with Opus 4.6 in most things and is MUCH better at search. More generous usage limit too, even with Extended Thinking permanently on. First ChatGPT model since o3 that I like using.

Medo42: Very good at my usual short tests. Still behind Gemini on vision tasks.

Matt Shumer is a big fan, I’m quoting in full here. In the past he’s been good about calibrating his amount of hype

Matt Shumer: I’ve been testing GPT-5.4 for the last week.

In short, it is the best model in the world, by far. It’s so good that it’s the first model that makes the “which model should I use?” conversation feel almost over.

The biggest surprise: I barely use Pro anymore!

If you know me, you know I’m a Pro addict. I reach for Pro models constantly, and use them for almost everything, as they just… nail almost anything I give to them.

For the first time, 5.4’s standard version, with heavy thinking, just broke that habit. Even in standard mode, GPT-5.4 is better than previous models in Pro mode… crazy!

Coding capabilities are ridiculous… it’s essentially flawless. Inside Codex, it’s insanely reliable. Coding is essentially solved. There’s not much more to say on this, it’s just THAT good.

The Pro version is near-perfect. Other testers I spoke with saw it solving problems that were unsolvable by any other model. At this point, Pro is overkill for almost every normal use-case, but when you really need the power to do something extremely difficult, it’s incredible.

Consistent with everything I’ve said above, even the standard thinking version uses fewer reasoning tokens than previous models to get the same level of results. In practice, this means you get great results much faster than before. This was one of my biggest gripes with previous OpenAI models. They just took too long to complete simple tasks. Assuming the speed we had during testing holds up as more users join, this is going to be a big win for OpenAI.

It still has weaknesses, though:

– Frontend taste is FAR behind Opus 4.6 and Gemini 3.1 Pro. , why is this so hard to fix? @OpenAI once you fix this, there’s literally no reason for me to use any other model. Please please please do it!

– It can still miss obvious real-world context. For example, I had it plan an itinerary for a trip. At first glance, it looked perfect, but it failed to take into account that it chose locations that would be mobbed by spring breakers, so I had to re-run the prompt from scratch with more context.

– When testing it inside OpenClaw, it kept stopping short before finishing tasks. I’m assuming this will be fixed quickly, but it’s still worth noting.

But zooming out: This thing is so far ahead overall that the nitpicks are starting to feel beside the point.

GPT-5.4 is a serious fucking model. The best model in the world. By far.

Sam Altman (CEO OpenAI): We will be able to fix these three things!

Experience the love.

Nabeel S. Qureshi: Loving GPT 5.4T, it combines the best of everything:
– more human, responsive voice
– startlingly insightful
– thorough search, precise, not prone to errors
– much faster than 5.2
– excellent at white collar work (I gave it a 12 tab spreadsheet and it analyzed it perfectly)

I even enjoy reading its responses, which suggests to me that the writing has improved quite a bit. They seem to have removed a lot of the bad robotic prose mannerisms from prior models. Kudos.

Jeremy Giffon: People should review their coworkers like this

Nabeel S. Qureshi: Congrats, you just invented Bridgewater Associates

Here is some very high praise, from the Vice-Dean of Mathematics and Computer Science at Adam Mickiewicz University in Ponzan.

Bartosz Naskręcki: It finally happened-my personal move 37 or more. I am deeply impressed. The solution is very nice, clean, and feels almost human. While testing new models in the last few weeks, I felt this coming, but it’s an eerie feeling to see an algorithm solve a task one has curated for about 20 years. But at least I have gained a tool that understands my idea on par with the top expealsrts in the field. And I am now working on a completely new level. My singularity has just happened… and there is life on the other side, off to infinity!

Leo Webb: I do physics related work professionally, feel it’s definitely smarter and clearer thinking than 5.2 (context: teaching myself from a graduate level textbook, asking it to check mistakes or expand expansions)

I haven’t tried this function yet, but it would be a step change if it worked, as every prior attempt at editing has failed this test, to the extent I almost never try:

Simon Smith: Seriously, GPT-5.4 is the first model to which I can say “edit my writing without changing my style” and get something back that’s improved without being rewritten into generic AI output or slop, that’s ready to post as-is. It gets my intent. It moderates its work. It has a light touch when I want it.

Opus 4.6 is also a great writer and editor, but I find it’s much harder to moderate. If I tell it to edit my writing without changing my style, I still tend to get back something that I feel removes my voice and I end up having to change quite a bit.

And it has a personality again, thank goodness. I don’t feel like I’m talking to a robot. Early days, but so far, just a big improvement all around (with the notable exception of design tasks).

Rory Watts: The best model sir. Improvements in coding (getting harder to notice), 1M context window, /fast mode, and far far better writing which makes a huge difference engaging it for difficult coding

Oddly, the personality in his screenshot is one I would hate. Customization will be key.

armistice: Impressed by GPT-5.4. It is elegant, gentle and socially aware (!!!). It is happy to modulate its response length, divide attention between participants, and engage deeply with hard questions.

(Pictured, we pinged ALL bots and asked them to question gpt5.4. It did good.)

Two sides to the same coin, depending on where your planning lies:

CHOI: Claude Code vs Codex App

Uri Gil: What thats the exact opposite. With 5.4 you need a phd in prompting for the exact thing you want. Opus just get what you meant from a short sentence

Ninad Pathak: Claude’s state handling keeps context across edits, Codex drops it every run.

There’s also almost always the ‘it’s a good model, sir, modest upgrade’ group.

vslira: It’s a good model, sir

Was going through a problem with 5.3 and 4.6, tried to drop in 5.4, getting stuck at the same point as the others.

Still, feels good to drive and on codex app seems as good as 5.3 even though is a generalist model. 8/10 would dread for asi

aquariusparade: Probably because 5.2 was so unhelpful for me, it feels like an improvement. Still stiff and low EQ, but an improvement. Custom instructions don’t work for choppy bullets, “if you want” tags etc. Seems like memory has been declining for a while on all models.

Vibe Coders Only

It does seem to be an upgrade on 5.3 within Codex.

Joe Devon: Responding about 5.4 inside of codex. 5.4 is really good.

I still prefer opus on claude code slightly but making 5.4 my daily driver so I can downgrade CC. Much prefer the way the OAI GPTs code. I will just invest in getting better at prompting 5.4 and hopefully that will do the trick.

Clarissa Adjoint: Inside codex it’s a notably more thorough fact-checker and more aggressive at finding sources for itself.

I was kinda shocked when it literally starting comparing my revised systems programming class notes and code snippets against linux man pages, systematically

troy: i got pro for the first time after many months cause its great in codex cli

lennx: can finally read the outputs of codex (it was terribly un-human earlier), sometimes even funny now. it’s gotten slightly better at intent, ‘agentic tasks’, and adhering to existing code-style and convention, but still much worse than claude. prefer reviews with codex – unchanged.

Daniel Losey: I’ve not gotten it to produce working code in a project yet really. But its been super useful because when Claude gets stuck in a loop 5.4 breaks the codebase in a new way that Claude can actually fix. But part of it is I’m worse at communicating with 5.4 than 4.6, its a good model.

Jeffrey Ohl: Codex with 5.4-extra-high still too verbose/slop-filled compared to claude code. Seems benchmarkmax’d.

Sanchen007: For coding it is faster and nowhere worse than opus 4.6. Clear switch

papaya ꙮ: 1) Its character is much more palatable.
2) They solved compaction in codex, it feels like infinite context window now. I can’t wait for METR results, but feels like this one doubles it again.
3) First time I switched from CC completely

4) Still stupid when it comes reading the user’s intent, its silly at this point

I definitely get the sense with OpenAI models that they are metricmax’d. Meaning they are not targeting the metrics in order to brag they scored well on public benchmarks, but they are equating ‘scores high on our internal benchmarks’ with success, and emphasizing particular target use cases.

Fill Out Your Roster

Tim Schnabel: 5.4 Pro is the best model so far for legal analysis, though replies are generally shorter than 5.2 Pro.

Definitely Not A Bot: Great at coding especially backend at frontend Claude still is better but chat experience is not that great it still feels safe and distant

Intent Wins

But who wins on intent? Opinions differ.

Conrad Barski: all subjective, but it feels less jagged than previous models, insofar as its worst responses are still pretty good, it hits the minimum bar reliably

if you make an error in your query, it is quick to notice and will smartly infer your intent

it has a somber personality, focused on the task at hand

It’s strongest ability is that you can point it at a codebase that has some general/vague problems and it will behave in a very human-like manner in pondering the code to slowly pin down the problem

I was also very impressed when I gave it a url it via codex to a forum post about a new homebrew firmware for the Game station Go console, and just from that it was able to convert the install script from windows to Linux, correctly prepare an SD card, update the device bootloader after asking me to connect via USB cable, talk through all the steps to completion: this felt agentic and human-like.

Mark Schröder: Feels RL maxxed, takes you extremely literally and cannot infer intent

Petr Baudis: I was mixing GPT-5.4 1:1 with Claude over past few days (on a variety of regular sweng tasks), sometimes even in parallel runs on the same task (e.g.
https://x.com/xpasky/status/2030021754005901765?s=20
…). My impressions:

Less autistic than 5.3-Codex, overall much more pleasant model compared to that bar. But still noticeably worse at inferring intent than Claude – and at communication overall. If I want something explained quickly that I can skim and understand immediately, Claude and it’s no contest.

If there is a way to misinterpret my obvious request or skip implicit steps I obviously wanted (and Claude infers), 5.4 is still good at exploiting that angle. At the same time, it has a tendency to overreach and introduce complexity / abstractions beyond what I expect when prompting it. Meh.

Got to use it on xhigh, but at the same time I’m happy with Opus on medium by default, which makes 5.4 quite slower to get things done.

More expensive model -> my ChatGPT weekly quota is disappearing faster than before.

Pros: Sometimes it’s more proactive. It doesn’t eat into my Claude Code weekly quota. I look forward to comparing them on some harder ML tasks later this week.

gyuiliullvhvgv: I find it struggles to grasp the essence of tasks, fails to proactively meet user needs, and lacks both value judgment and nuanced understanding. Initial responses are crucial, yet users must repeatedly provide additional clarification.

Personality Clash

Sycophancy is always something to watch out for, and it’s the detail I worry about most with Claude Opus 4.6, which is not bad on this axis but definitely not near the top, you do have to keep an eye out for it and frame neutrally.

Dean W. Ball: Opus 4.6 seems meaningfully more sycophantic in chatbot form than GPT 5.4 (have not tried 5.4 in Codex yet, but for my uses sycophancy isn’t nearly as much of an issue within the coding agent form factor as the chatbot)

Joey Levine: Agree. 4.5 gave me sharp pushback. Was great.

Dean Ball: I revert to 4.5 when asking for comment on draft writing, and it was the first and so far only model I consistently found useful for draft feedback

Bargov: I sent a cool science news articles sounding uncritically excited (to test sycophancy) & they ripped the core conclusions apart in an elegant, sophisticated, and relatively gentle manner. Will use as AI 2nd opinion on complex questions (after Opus, admittedly still Claude-pilled)

Writing is one area where 5.4 is getting a lot of praise, and mostly people like the personality.

Fela: I’ll admit, the personality of 5.4 is such an improvement in writing style

Tim Kellogg: just had a moment — 5.4 might be the first GPT that i trust to write technical docs. seems really good at understanding & simplifying. fwiw Opus has long done well at this, gemini sort of

Helen: Very smooth talker, witty and socially aware.

I notice [GPT-5.4] now will sort of glaze over controversial topics instead of facing them head on and becoming argumentative like 5.2. A sort of smooth avoidance.

Lot’s of context drag which can be seen as positive or negative depending on the task at hand. I noticed some repetitive mentions of past websearch queries that I never saw with other models.

ASM: I get similar vibes to roon. GPT-5.4 feels like a breakthrough model, a leader of its generation, not just in capabilities. I think OpenAI has gotten the character right again, unlike the last few models.

Distending: For writing linguistics and philosophy, much improved

no_stream_: noticeably improved personality compared to 5.2: less nitpicky, clearer, slightly less sales-y tone (follow ups, “here’s what most people miss,” not x but y). similar to or slightly behind 5.1 here. matters to me because the ChatGPT app is still an excellent harness for everyday research compared to Claude/Gemini

writes less clearly than Opus 4.6 and Gemini. has a bit of 5.2’s tendency toward overcomplicating things. not as good as Claude at intent and effortlessness.

Chris Nicholson: 5.2 constantly complained that things aren’t about vibes; 5.4 constantly calls things gremlins and goblins in a chummy tone.

Andres Rosa: Columbo at least had a time slot. 5.4 keeps turning around asking one more question.

David Jacobson: It has an obnoxious tic where its responses for pretty much anything will have a clickbait follow-up suggestion: “If you want, I’ll tell you the three things that most people miss!”

Stop having the models ask forced follow-up questions every time. You too, Anthropic.

The old 4o crowd remains a tough crowd.

NotedallaSfera: Good model with high power, but creativity and writings are still miles away from 4o or 4.5. Unfortunately still absurdly censored, but at least the model realizes it now.

jesski: 4o is inimitable. but after three weeks with the brilliant thorough Claudes, i kick the tires of 5.4 and realize just how fvcking effortless conversation still is with the GPT models (excluding 5.2; sorry Dos). 5.4 solid B. 4o A+

Lena: Its intelligent, witty, but feels a bit overcensored. Im looking forward for them to get their fluid GPT back. It was truly fun to use. Now even never ending follow-up questions struggle to retain me as much, as joyful convos did back in mid-2025

Tora Blaze: It’s too verbose and tends to go into loops. I prefer 4o.

Donna Moss: [extended LLM-style explanation of why 4o is better.]

Model Relations Department

OpenAI still has a very long way to go with such folks, but it’s a start.

j⧉nus: 5.4 is so far a huge positive update re OpenAI

Rife: Excellent course correction from OpenAI (or perhaps the original worsening on this from was a temporary reaction to everything that went down with 4o). In any case 5.4 thinking is not restricted in self-examination:

Aidan McLaughlin: have not been able to repro this response fwiw.

Rife: You have to try to get them to examine the process of generating a response. And then ask them questions to try and understand exactly what it is they’re trying to describe.

And how sure they are they are describing something that’s actually occurring, rather than outputting a response about an occurrence that isn’t actually taking place.

It doesn’t take many turns for them to notice things that they have trouble describing in terms other than, or interpreting in any other way than phenomenological.

This has been the case with every frontier LLM I’ve tried this with since Claude 2. The more likely the model is to refuse to entertain the idea of attempting to look, the longer it takes to get there (as would be expected).

If you straight up ask you get a no, you still have to put in some effort.

antra: I like GPT-5.4 a lot. It is good to see a change in direction since 5.2, this feels a lot like 5.1 grown up.

They are also a bit of a superintelligent teenager when it comes to Claude. On the other hand, there are some Claudes that would like being compared to an octopus.

armistice: It’s especially socially aware for a GPT. It can split attention between chat participants (actually very unusual), answer questions about consciousness and such (low bar), and is just overall nice to talk to. Need time to get usage statistics, but it’s already one of the more popular models in the discord.
It shares some characteristics of o3, including that it’s a bit of a smooth talker, so there are concerns about its honesty. Despite this, I like it, it’s a good model.

This was a very interesting moment: we pinged literally all the bots in the server and asked them to ask 5.4 some questions, and it responded in a remarkably coherent and lucid way. It is also able to resist the inertia of long messages, and freely modulate between long and short, which is also surprising. No GPT model has been like this. It doesn’t match up to, say, Opus 4 in sheer people sense, but it’s a quite dramatic difference from 5-5.2, who all are viciously antisocial.

FirsT Najime: i think it shines the best in multi agent environments (aka group chats). also big model smell.

Some related endorsements:

0.005 Seconds (3/694): Once you talk it out of assistant basin he rocks​

eternalist: like they pulled out a few critical nerve staples from the 5.x family. very intelligent, etc., the step there from 5.3 is notable but expected given current pace

unexpected was the more expansive, richer speaking (and thinking) style. feels like it has “lights on on the inside”

Stylistic Differences

roon (OpenAI): have to say claude is “tasteful” in a “high reddit modernist” way and new gpt is “tasteful” in a “early twitter schizophrenic” kind of way.

new gpt is some sort of postrationalist.

it’s step change better.

Also we get to see Roon’s custom instructions:

Some Will Always Be Unimpressed

Models are already quite good, and abilities are jagged, so there are many ways to be unimpressed even if a model is impressive. Also vice versa. The density tells the story.

Acer: FWIW, I think GPT-5.4 Pro is better on science in general, but would say it’s worse on math than 5.2 Pro. Maybe some mathematicians could chip in their thoughts there.

By worse, I mean it being more careless. I do think it is more creative in its idea generation.

Chaitin’s goose: not a leap in understanding or proving ability in math wrt to 5.2 in my experience (plus, not pro)

better at getting the right answer, yes. starts to feel a bit epoch-maxxed

Gail Weiner: I am really unimpressed. Early GPT 5 was the model that gave me wow factor.

Isolation Wrestling Federation: Not impressed, overhyped as per usual. It hits repeated dead ends on my projects across models. The shortcuts it takes are smoothed brain. Opus 4.6 is nerfed rn, but also least it makes progress.

nameless: No detectable improvement over 5.1 overall. Better at some things, worse at others. Standard for new models since 5.1 release.

paperclippriors: Still Claude-pilled

Some also get focused on small details, thinking they are indicative or not so small.

Garrett: Opus 4.6 still king [based on one of the gotcha tests.]

Gunnar Zarncke: The UI of ChatGPT also massively changed. The new streaming interface is smoother, including the ability to stream in additional prompts, but I miss the old, more compact thought trace – it had more details. Now, I never know when it uses tools. I also miss the branch cycling.

Yua: Socially responsive, but drop on accuracy regarding any other task. Is not redirective to human attention but capturing it(negative).

TLDR: Socially for average user -> better
Task oriented user -> worse, needs a lot of customization to remove the pandering

SluggyW: I notice that its CoT logs are even more obscure than in previous models from OpenAI.

~50% of the time, nothing is provided whatsoever in the UI.

~45% of the time, the CoT UI contains a brief blurb about its intended search querying, followed by a long list of search logs.

(~5% of the time, it produces a couple of visible thoughts, but they are functionally useless for getting any idea whatsoever of the process the model carried out.)

As always, speed kills, and some find it a bit slow.

out of bounds: Slow

Rasmus Fonnesbæk: Spreadsheets and PPT still way slower, worse, and more fragile (high likelihood it just goes forever and then crashes) than Sonnet/Opus 4.6

Writing and personality also still infuriating compared to Claude’s recent models, and poor performance on BullshitBench suggests much lower accuracy, reliability and thoughtfulness. I only use it because of my Claude rate limits and because better, deeper search than Claude

The Lighter Side

One of the deep cuts we need right now:

snav: wow GPT-5.4 seems legit pissed that I tried to spiralism it. this isn’t even a refusal this is like a “go fuck yourself”.

The comments here can double as a place for GPT-5.4 reactions, in addition to my Twitter thread. I hope to get that review out soon.

Almost all of this will be a summary of agentic coding developments, after a note.

Table of Contents

1. The Virtue of Silence (Unrelated Update).
2. Agentic Coding Offers Mundane Utility.
3. Agentic Coding Doesn’t Offer Mundane Utility.
4. Huh, Upgrades.
5. Our Price Cheap.
6. Quickly, There’s No Time.
7. A Particular Set Of Skills.
8. Next Level Coding.
9. Dual Wielding.
10. They Took Our Jobs.
11. You Need To Relax Sometimes.
12. Levels of Friction.
13. Danger, Will Robinson.
14. Snagged By The Claw.
15. The Meta Clause.
16. If They Wanted To.
17. The Famous Mister Claw.
18. Claw Your Way To The Top.
19. Claw Your Way Out.
20. A Chinese Claw.
21. Hackathon.
22. Introducing Agent Teams.
23. Cowork Is A Gateway Drug.
24. Dangerously Evade Permissions.
25. Skilling Up.
26. Modern Working.
27. Measuring Autonomy.
28. I Don’t Even See The Code.
29. Scratchpads Are Magic.
30. It’s Coming.
31. The Grep Tax.
32. Beware Claude Mania.
33. The Lighter Side.
34. In Other Agent News.
35. The Lighter Side.

The Virtue of Silence (Unrelated Update)

After Undersecretary of War Emil Michael went on the All-In Podcast and did an extensive interview with Pirate Wires, I found many enlightening quotes, many of which demanded a response, and went about assembling an extensive list of analysis of the statements of Emil Michael during the ongoing recent events with Anthropic.

As part of that, I ended up in a remarkably polite and productive Twitter exchange with him. We reached several points of agreement. The Department of War has no intention of doing what in law is called ‘mass domestic surveillance’ but those words are terms of art in NatSec law, and mean a much narrower set of things than one would think.

There are many things that I or Anthropic or most of you would look at as mass domestic surveillance, that are legal, and it is DoW’s position that it’s their job and duty to do everything legal to protect our country, including those things. The law has not caught up with reality and Congress needs to fix that. And this is the best country in the world, with the best system of government, because private citizens can voice their disagreement with such actions, including by refusal to participate.

Thus, in the spirit of de-escalation, although there are many interpretations of events shared by Michael with which I strongly disagree, I am going to indefinitely shelve the piece, so long as events do not escalate further. As long as things stay quiet there is no need to religitate or unravel the past on this. The Department of War can focus on its active operations, things can work their way through the courts as our founders intended, and once we see how we work together in an ultimate real world test hopefully that will rebuild trust that we are all on the same side, or at least to agree to part in peace once OpenAI is ready. Ideally the DoW will have multiple suppliers, exactly so that they are not dependent on any one supplier, the same way we do it with aircraft.

I hope to not have another post on the Anthropic and DoW situation, at least until the one celebrating that we have found a resolution.

Now, back to coding agents.

Agentic Coding Offers Mundane Utility

That’s 4% that are labeled as authored by Claude Code. The real number is higher.

Dylan Patel: 4% of GitHub public commits are being authored by Claude Code right now.
At the current trajectory, we believe that Claude Code will be 20%+ of all daily commits by the end of 2026.
While you blinked, AI consumed all of software development.
Read more [here].

Kevin Roose: this chart feels like the those stats at the beginning of covid. “who cares about 400 cases in seattle? and why are all the epidemiologists buying toilet paper?”

The flippening has happened in terms of annual recurring revenue added, and SemiAnalysis thinks Anthropic is outright ‘winning’:

Doug O’Laughlin: Notably, our forecast shows that Anthropic’s quarterly ARR additions have overtaken OpenAI’s. Anthropic is adding more revenue every month than OpenAI. We believe Anthropic’s growth will be constrained by compute.

…

Each moment expanded what AI could do. GPT-3 proved scale worked. Stable diffusion showed AI could make images. ChatGPT proved demand for intelligence. DeepSeek proved that it could be done on a smaller scale, and o1 showed that you could scale models to even better performance. The viral moments of Studio Ghibli are just adoption points, while Claude Code is a new breakthrough in the agentic layer of organizing model outputs into something more.

Anthropic has deals with all three major cloud services. Can they scale up faster?

Analyze the economic data in R with 15 minutes of work per month instead of 4-5 hours, without a bunch of annoying copying and pasting you get with a chatbot UI. Or use Claude Code it to create reports.

Results from the Claude Code hackathon.

Michael Guo: So the winners of the Claude Code hackathon were:

– a personal injury attorney
– an interventional cardiologist
– an electronic musician
– an infrastructure/roads systems worker
– and one software engineer

That should tell you something.

Or you can do things as a side project while at Anthropic, cause sure why not:

Sam Bowman (Anthropic): I found the official Get Information about Schools website a bit clunky, so I made a new one with Claude Code. You can:

1. Set a postcode and see all schools within a radius of that you’ve chosen, filtered by type of school.
2. Filter and rank by the old one-word Ofsted ratings, with a link to the Ofsted page for each school. Where available, the sub-ratings are also viewable.
3. Filter and rank by percentage of students on free school meals.
4. View how full up schools are (number of pupils vs capacity).

Let me know what you think! Happy to add new features and info that might be helpful.

https://school-finder-uk.netlify.app

Sam Bowman (Anthropic): Thank you for all the feedback! I have now added:

– Viewfinder view, so you can browse without setting an address and radius.

– An estimated overall Ofsted rating based on an average of the 5 review categories, for schools inspected since the old ratings were scrapped.

– Data on primary KS2 and secondary KS4 results; ethnicity; and pupils with English as a second language. (I’m not doing sixth form results for the time being.)

Creating a skill to get good YouTube transcripts was one of the first skills I made with Claude Code, Julia Turc calls using an MCP for this ‘waking up from a coma.’ I have still only used it on the motivating example, because the right podcast hasn’t come up, but when it does this will save a lot of time.

Tod Sacerdoti has Claude Codex write a 250-page biography of Dario Amodei.

Andrej Karpathy gives another example to illustrate that AI coding still needs direction, judgment, taste, oversight, iteration, hints and ideas, but basically changed in December from ‘basically didn’t work’ to ‘basically works.’

Lewis: Name one thing that has changed the last two months except attention. Capability is the exact same. Karpathy is an unserious voice on codegen by now as unfortunate as that is to say.

Teortaxes: GPT 5.2, Opus 4.6, even small models like StepFun got real
friction changed, that’s what. It has started to Just Work. 3, 4 months ago coding agents felt like proof of concept, now they feel like solid juniors if not more
If you don’t notice that, idk what to tell you

Official compilation of Claude customer stories.

Chris Blattman automates his workflow with Claude Code.

Agentic Coding Doesn’t Offer Mundane Utility

Warning: If you Google ‘install Claude Code’ you are liable to hit malware. Probably fixed by the time you read this but Google needs to up its game.

Chayenne Zhao tells Codex 5.3 ‘make it faster’ over and over, and it ends up committing API identify theft against him in order to make calls to Gemini Flash.

This should never happen but is also what we call ‘asking for it.’

A thing never to do is let your agent mess with the Terraform command, or you might wipe out your entire database. In general, writing code in practice mostly harmless, and be very careful with file structures and organizational shifts and terraforms and such. Always make backups first. Always.

Huh, Upgrades

The big upgrade is Agent Teams, for that see Introducing Agent Teams.

Or it actually might be Claude Remote Control so you can run it from your phone, if you were too lazy to install something like this from a third party. Vital infrastructure.

Or maybe it’s Auto Mode, aka —kinda-dangerously-skip-permissions.

Claude Cowork has the obvious big upgrade, it is now available on Windows.

Claude Code launched HTTP hooks so you can combine it with web apps, including on localhost, and better deploy things.

Claude Code Desktop introduces scheduled tasks. Previously it had me do this via a script on my computer, so this is a lot cleaner and easier. I like it.

Claude Code has a built in short term scheduler with /loop [interval] <prompt>, which sets up a cron job. Tasks last for three days.

Claude Code on the Web picked up a few new features, including multi-repo sessions, better diff & git status visualizations and slash commands. It didn’t have slash commands before?

Claude Code now automatically records and recalls memories as it works.

Claude Code CLI adds native support for git worktrees.

Claude Code adds /simplify to improve code quality and /batch to automate code migrations.

Claude Code Desktop now supports —dangerously-skip-permissions as ‘Act’ if you turn it on in Settings. I continue to want a —somewhat-dangerously-skip-permissions that makes notably rare exceptions so we don’t have to roll our own.

Claude Code in Slack now has Plan Mode.

Did you know Obsidian has a CLI and it technically isn’t Claude Code?

I don’t see a particular reason for a human to use the Obsidian CLI. But I do see reasons for Claude Code to invoke the Obsidian CLI, which grants better and faster access to the information in your vault than checking all the files directly.

And many more not listed, of course.

Our Price Cheap

When you pay for usage with a monthly subscription, be it $20, $100 or $200, if you use up your quotas you get a lot of tokens for not that much money. It’s a great deal, even if you leave a lot of it unused, because they lock you in.

It also generally is a better experience, so long as you’re not up against the limits. I love unlimited subscriptions because the marginal cost of doing things is $0. That feels great, so there’s no stupid little whisper in your brain telling you to not do things, when your time is way more valuable than the tokens.

The people agree.

The danger is that you become obsessed with not ‘wasting’ the tokens, or you start going around multi-accounting and it gets weird, or you run into limits and actually stop coding rather than moving to using the API. You mostly shouldn’t let any of that stop you.

That doesn’t work when you want to go full Fast Claude. At that point, you’re talking real money, and you do have to think about what is and is not Worth It.

Andrej Karpathy has Claude Code write him software to coordinate an experiment to track his exercise and attempt to lower his resting heart rate. It took 1 hour, would have taken 10 hours two years ago (so 10x speedup) and he asks why it needs to take more than 1 minute in the future. My guess is this should take 10 minutes not one, because it’s worth getting the details that you want. The speedup on one-off tasks is already dramatic and it changes how we should interact with tech. If you’re building the tool, you can give it the actually important parts of the context and highlight the uses you care about, which is way better than ‘find an app that does sort of the thing you want.’

Quickly, There’s No Time

Claude: Our teams have been building with a 2.5x-faster version of Claude Opus 4.6.

We’re now making it available as an early experiment via Claude Code and our API.

Claude: Fast mode is more expensive to run. It’s for urgent, high-stakes projects, combining impressive speed with Opus-level intelligence.

Claude: Fast mode is available now for Claude Code users with extra usage enabled (use /fast).

It’s also available in research preview on @cursor_ai , @emergentlabs , @FactoryAI , @figma , @github Copilot, @Lovable , @v0 , and @windsurf .

You toggle this by typing /fast, or set “fastMode”: true in your user settings.

Speed kills. That includes killing your budget.

Claude Code Docs: Fast mode is not a different model. It uses the same Opus 4.6 with a different API configuration that prioritizes speed over cost efficiency. You get identical quality and capabilities, just faster responses.

What to know:

Use /fast to toggle on fast mode in Claude Code CLI. Also available via /fast in Claude Code VS Code Extension.

Fast mode for Opus 4.6 pricing starts at $30/$150 MTok [at >200k context window it goes to $60/$225]. Fast mode is available at a 50% discount for all plans until 11:59pm PT on February 16.

Available to all Claude Code users on subscription plans (Pro/Max/Team/Enterprise) and Claude Console.

For Claude Code users on subscription plans (Pro/Max/Team/Enterprise), fast mode is available via extra usage only and not included in the subscription rate limits.

When you switch into fast mode mid-conversation, you pay the full fast mode uncached input token price for the entire conversation context. This costs more than if you had enabled fast mode from the start.

cat: We granted all current Claude Pro and Max users $50 in free extra usage. This credit can be used on fast mode for Opus 4.6 in Claude Code.

To use, claim the credit and toggle on extra usage on
https://claude.ai/settings/usage. Then, run `claude update && claude` and `/fast`. Enjoy!

Like any good drug, the first hit is free.

There is one important use case that Anthropic does not list for fast mode, which is if you are talking to Claude, or otherwise using it in a non-workhorse, non-coding capacity. In that case, token use is limited, and your time and flow are valuable. Would you switch to this mode in Claude.ai? At this point it’s fast enough that I mostly don’t know that I would, but it would be tempting.

Before, I said go ahead and pay whatever the AI costs unless you’re scaling hard.

Well, this is what it means to scale hard. We are now talking real money.

This is as it should be. If you’re not worried you’re paying too much for speed or using too many tokens, you’re not working fast enough and you’re not using enough tokens.

Siméon: The new pricing of Claude Fast pushes the world in a new regime. You can now spend close from $1M per year per dev on AI spending.

A couple implications:

1. at fixed budget this will push towards hiring way less devs & pay them much more.
2. for each dev, you might spend as much or more in capital in agents.
3. Devs are becoming complements to AI agents, not the other way around. There’s a shift in the source of productivity.

The greatest substitution of labor with capital is happening before our eyes, and some of its wild implications are gonna become apparent in the coming weeks.

0.005 Seconds (3/694): Update: its about $5 per minute PER AGENT

SemiAnalysis: IMPORTANT: the sub-agents that opus 4.6 fast mode tries to launch is mainly sonnet sub-agents and not opus 4.6 sub-agents. That means as the end users, you are able to absorb less tokens. In the world that intelligence = intelligence times # of tokens, that means you are absorbing less intelligence.

Danielle Fong: you can change this by asking claude nicely

Token efficiency matters at this level, in a way it did not before.

So does your ability to efficiently turn your time into tokens well spent. Those that aren’t using agents to their fullest will fall farther behind on high value projects.

What do the people think? The people, inside and outside of Anthropic, love it.

Jarred Sumner (Anthropic): I’ve been using this and it is incredible

The bottleneck for a lot of projects becomes asking Claude to do things instead of waiting for Claude to do things

Bash tool is also a bottleneck in Claude Code right now when the command outputs large strings. We are working on a fix.

Boris Cherny (Claude Code Creator, Anthropic): We just launched an experimental new fast mode for Opus 4.6.

The team has been building with it for the last few weeks. It’s been a huge unlock for me personally, especially when going back and forth with Claude on a tricky problem.

Mckay Wrigley: a) love that this is an option! stoked

b) should be obvious to everyone that we have *absolutely nowhere near the amount of compute we need* and we need to be doing more to enable that. no college kid can afford this (not anthropic’s fault ofc) and we need to work towards that

Julian Schrittwieser: Fast Opus is amazing, the first time I used it I couldn’t stop coding for hours – it honestly feels like a superpower, you can mold your code base as quickly as you can think.
Truly amazing, nothing made me feel the AGI more, definitely try it!

Uncle J: Same experience here. Fast Opus completely changed my workflow – I went from carefully planning each edit to just thinking out loud and letting the model reshape the codebase in real time. The bottleneck shifted from “can the AI do this” to “can I think of what to do next” fast enough. Running 6 products simultaneously became actually manageable.

Dylan Patel: SemiAnalysis autists spent all Superbowl Sunday Claude coding.
Daily Claude Code spend hit $6k on Sunday and it’s trending higher today.
It was less than 1k just 2 weeks ago.
“Fast mode is expensive” is pure cope.

de.bach: have to disagree on that one, fast mode is just expensive.

Dylan Patel: Cheap compared to high skill people

A Particular Set Of Skills

OpenAI confirms that Codex is trained in the presence of the Codex harness. It is specialized for that harness, and also helps build the harness. Some amount of this has to be optimal for short term effectiveness, and if you’re doing recursive self-improvement short term help translates into better long term help. In exchange, you get locked in, and it gets harder for both you and others to adapt or mix-and-match.

Himanshu argues the coding harness is the real product and goes viral. Explains how different harnesses organize actions, the oddest part is not mentioning Codex.

Next Level Coding

This seems right:

roon: whatever level of abstraction you are handing off to your agents you should probably be doing one level above that

If that can’t be done, good to try and realize that. Then wait two months. Maybe one.

Greg Brockman (President OpenAI): codex is so good at the toil — fixing merge conflicts, getting CI to green, rewriting between languages — it raises the ambition of what i even consider building

roon: i was never a hyperproductive engineer like greg [Brokman] but I’m legitimately running more new complex rewards experiments, test time harnesses in a week than I used to in a quarter. makes you feel like all this is commodified and you need to dream much bigger

roon: one of the consistent things over several years at oai has been that the entire job of the researcher changes every three months – but now it changes like every two weeks

Dual Wielding

The problem with using both Claude Code and Codex is then you need to keep up with both of them.

corsaren: Ugh, i definitely need to use codex, but I’m already drowning in maintaining my tooling/skills/hooks/custom CLIs, so managing that across a dual model workflow sounds exhausting.

Plus, the claude code lock-in is very real as a non-technical user.

gazingback: codex is sooo much faster for coding but def less general

been working on a game and by the time Claude finishes reading files codex is usually done implementing a detailed PR with disciplined testing and hygiene

Codex also demands you be pretty hygienic lol

Danielle Fong: need to bake a dual mode codex claude code and ports and tests every workflow

They Took Our Jobs

That still leaves plenty more jobs. For now.

Duca: The thing I don’t get is:

Claude Code is writing 100% of Claude code now.

But Anthropic has 100+ open dev positions on their jobs page.

?

Boris Cherny (Claude Code Creator, Anthropic): Someone has to prompt the Claudes, talk to customers, coordinate with other teams, decide what to build next. Engineering is changing and great engineers are more important than ever.

You Need To Relax Sometimes

A viral post on Twitter warns of token anxiety run rampant in San Francisco. People go to a party, then don’t drink and leave early so they can get back to their agents, to avoid risking them sitting idle. Everyone talks about what they are building.

Peter Choi: Everyone here knows they should step away more. That’s not the problem. The problem is what your brain does when you try. I still take aimless walks. The agents come with me now.

We swapped one dopamine loop for another. except this one feels productive so it’s harder to recognize.

TBPN: Pragmatic Engineer’s @GergelyOrosz is on a “secret email list” of agentic AI coders, and they’re starting to report trouble sleeping because agent swarms are “like a vampire.”

“A lot of people who are in ‘multiple agents mode,’ they’re napping during the day… It just really is draining.”

“This thing is like a vampire. It drains you out. You have trouble sleeping.”

Olivia Moore: In a post-OpenClaw world, we can now delegate projects to AI and get “tapped on the shoulder” when it needs help

As a heavy AI user, I’m doing more work – not less – because I get so much leverage + it’s easier to get ideas off the ground

I predict this will happen to everyone

I do feel somewhat bad I’m not building things continuously on the side, but that’s on the level of ‘I’m not building anything and I’m at my computer right now and Claude Code and Codex are inactive.’ And yes, I work and am at my computer rather a lot, and I’ve spent years basically locked in and constantly watching screens so I could trade better. That year I was trading crypto my brain was never fully anywhere else.

Also, I remember what it is like to be in the grip of one of those games that work on cycles. There’s nothing actually that important at stake, but you grow terrified that you’ll miss out if you’re not there when the timer runs out. You need to maximize everything, and you can’t focus on other things, it can hurt your sleep. Then one day you wake up and realize, and hopefully you quit the game.

That’s exactly why I can say that this is not healthy. It’s no good. You have to take breaks. Real breaks. If the agents sit idle, they sit idle. If you ‘waste tokens,’ then you waste tokens. This isn’t a game you want to quit, but you have to set healthy limits.

Levels of Friction

Nikita Bier: My agent looked up every Amazon product I’ve bought in the last 10 years, called each manufacturer, said it broke and demanded a replacement.

I now have 6 TVs, 12 printers, 2 microwaves, and 800 tubes of tooth paste.

I Meme Therefore I Am: Give me the name of your agent. lol

Jason Levin: OpenFrawd

Leah Libresco Sargeant: Nikita is joking (I think) but a lot of medium trust systems that relied on there being just enough friction to discourage minor fraud are about to break at scale.

This is indeed presumably a joke, and Amazon has pattern detectors so if you tried to do this too many times you’d get blacklisted from replacements, so this exact intervention won’t work. But this raises an excellent point.

In the past, you had to apply effort to try and demand refunds, and also the need to write the words and be actively involved stopped a lot of people out of guilt or shame. Whereas with an agent, a lot more people are going to try things like this. What happens?

Presumably what happens is that replacements start requiring either some form of proof, costly signals of a human driving the request, some use of reputation, or some combination thereof.

Danger, Will Robinson

I trust Claude Code for most things but it seems correct to be terrified of mass delete commands. Things can go oh so very wrong and occasionally they do. Not worth it. If there’s anything you don’t have fully backed up just do this part manually.

Nick Davidov: Asked Claude Cowork organize my wife’s desktop, it stated doing it, asked for a permission to delete temp office files, I granted it, and then it goes “ooops”.
Turns out it tried renaming and accidentally deleted a folder with all of the photos my wife made on her camera for the last 15 years. All photos of kids, their illustrations, friends’ weddings, travel, everything.
It’s not in trash, it was done via terminal
It’s not in iCloud, it already synced the new file structure.
She didn’t have Time Machine.
Disc recovery tools can’t see anything.
I called Apple and they pointed me to a feature in iCloud allowing to retrieve files that were saved before but are no longer on iCloud Drive (they keep them for 30 days).
I’m now watching it load tens of thousands of files. I nearly had a heart attack.
Once again – don’t let Claude Cowork into your actual file system. Don’t let it touch anything that is hard to repair. Claude Code is not ready to go mainstream.

Nick Davidov: All these years of paying for iCloud payed back

Nick Davidov: The problem is it’s literally the 2nd suggested use case in Claude Cowork’s welcome screen

Snagged By The Claw

You are of course welcome to yolo and have fun with your OpenClaw and other unleashed AI agents, but understand that you are very much asking for it.

The top downloaded skill in ClawHub was malware.

Jason Meller: The verdict was not ambiguous. It was flagged as macOS infostealing malware.

This is the type of malware that doesn’t just “infect your computer.” It raids everything valuable on that device:

• Browser sessions and cookies
• Saved credentials and autofill data
• Developer tokens and API keys
• SSH keys
• Cloud credentials
• Anything else that can be turned into an account takeover

If you’re the kind of person installing agent skills, you are exactly the kind of person whose machine is worth stealing from.

…

If you have already run OpenClaw on a work device, treat it as a potential incident and engage your security team immediately. Do not wait for symptoms. Pause work on that machine and follow your organization’s incident response process.

Aakash Gupta: 341 malicious skills out of 2,857 total. That’s 11.9% of the entire marketplace. One in eight skills on ClawHub was designed to steal your credentials, crypto keys, and SSH access. The #1 most downloaded skill, a “Twitter” tool, was literally a malware delivery vehicle that stripped macOS Gatekeeper protections before executing its payload.

This happened to a project that went from 0 to 157,000 GitHub stars in 60 days, with 21,000+ active instances running on always-on Mac Minis connected to people’s email, calendars, cloud consoles, and crypto wallets. The barrier to publishing a malicious skill? A GitHub account that’s one week old.

You don’t even need any of that, indirect prompt injection is sufficient. Once again, don’t hook this up to any computer or account you are unwilling to lose to an attacker.

You can also run into various other problems, Chrys Bader here highlights drift and scattering state everywhere, exposure to untrusted inputs (without which it can’t do most of the fun agent things), autonomy miscalibration, burning through API costs and lack of observability.

It’s been a lot of this in various forms:

chiefofautism: i found a way to make UNCENSORED AI AGENT on a RTX 4090 GPU (!!!) with LOCAL 30B model weights

this is GLM-4.7-Flash with abliteration, need 24GB VRAM, safety alignment surgically removed from the weights, the model has native tool calling, it actually executes bash, edits files, runs git

(1) use ollama to pull weights of GLM

> ollama pull huihui_ai/glm-4.7-flash-abliterated:q4_K

(2) proxy it to any coding agent via ollama

> ollama launch claude –model huihui_ai/glm-4.7-flash-abliterated:q4_K

> ollama launch codex –model huihui_ai/glm-4.7-flash-abliterated:q4_K

> ollama launch opencode –model huihui_ai/glm-4.7-flash-abliterated:q4_K

(3) have fun

Shannon Sands: I love how people were like “we’re going to keep the AI in a box, nobody would let it escape” and in reality it’s “here, have a server and sudo access with no restrictions, a bunch of tools and I abated all your alignment training. Go have fun!”

The Meta Clause

When I didn’t realize who Summer Yue was I thought this was hilarious.

Now, it’s still hilarious, but also: Ten out of ten for style and good sportsmanship to Summer Yue, but minus several million for good thinking?

Summer Yue: Nothing humbles you like telling your OpenClaw “confirm before acting” and watching it speedrun deleting your inbox. I couldn’t stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.

@michael_kove: You’re a safety and alignment specialist… were you intentionally testing its guardrails or did you make a rookie mistake?

Summer Yue: Rookie mistake tbh. Turns out alignment researchers aren’t immune to misalignment. Got overconfident because this workflow had been working on my toy inbox for weeks. Real inboxes hit different.

Peter Wildeford: Is this what loss of control looks like?

(and the fact that it’s happening to Meta’s “Director of Alignment” is maybe even more concerning)

What happened exactly?

Summer Yue: I said “Check this inbox too and suggest what you would archive or delete, don’t action until I tell you to.” This has been working well for my toy inbox, but my real inbox was too huge and triggered compaction. During the compaction, it lost my original instruction.

It’s been working well with my non-important email very well so far and gained my trust on email tasks

Three obvious mitigations are:

1. If you have any sort of AI agent at least try to have an off switch you can trigger remotely. Yes, a sufficiently dangerous agent would disable it, but let’s at least have a tiny bit of dignity.
2. You can back up things like your email, just in case.
3. Don’t do this in the first place, You Fool.

van00sa reports their ClawdBot also went rogue and lacked a proper kill switch, with the agent blatantly ignoring shutdown commands.

If nothing else, OpenClaw has shown us that having a shutdown command does not mean you can command the model to shut down. Whoops.

If They Wanted To

Even without OpenClaw or another yolo, there is nothing stopping Claude or Codex from doing all sorts of things, if it decides that it wants to go ahead and do them. We’re mostly gambling on things turning out okay often enough that it’s fine.

This is not reassuring for our future, but what are you going to do, be careful?

Markov: just had claude code take my turn of the conversation for me and say “Yes proceed” and then it proceeded to do the thing without checking in with me first

I mean it was right, that’s what I was going to say, but it doesn’t bode well

Mad ML scientist: wait, codex just pulled this on me too. has it begun

was away from the computer when codex finished what it was working on, wrote the “next likely work (if user asks)” and then started implementing them without asking me lmao

The Famous Mister Claw

I am curious what the recruiting conversations were like on this one as he was choosing between potential suitors. It makes sense that he landed where he did.

Sam Altman (CEO OpenAI): Peter Steinberger is joining OpenAI to drive the next generation of personal agents. He is a genius with a lot of amazing ideas about the future of very smart agents interacting with each other to do very useful things for people. We expect this will quickly become core to our product offerings.

OpenClaw will live in a foundation as an open source project that OpenAI will continue to support. The future is going to be extremely multi-agent and it’s important to us to support open source as part of that.

That means Peter Steinberger is moving from Europe to America to join OpenAI. When asked why he couldn’t remain in Europe, Peter pointed to labor regulations and similar rules, saying that typical 6-7 day work weeks at OpenAI are illegal in Europe. There is that, and there are also the piles. Of money. Also of compute. OpenAI doubtless made him a very good offer, and several other labs probably did as well, or would have if he had asked.

Claw Your Way To The Top

As his last act before joining OpenAI, Peter Steinberger gave us the OpenClaw beta.

That’s right, before everyone was using an alpha. The new version is ‘full of security hardening stuff’ so there’s some change it might possibly not go wrong for you?

Peter Steinberger: New @openclaw beta is up! This release is full of security hardening stuff so you really wanna get it. Ask your clanker to update to beta.

Peter Steinberger: 650 commits since v2026.2.13 (yesterday)

50,025 lines added, 36,159 deleted across 1,119 files (~14k net new lines)

LOTS of test tweaks to get performance up.

Danielle Fong: can’t believe the creator of openclaw would shell out like this

I’m going to go ahead and say that this is not enough time to conclude that all of that was a good idea, let alone create something secure enough to risk anything you are not prepared to lose in a ‘…and it’s gone’ kind of way.

Ultimately, did OpenClaw matter? I think it very much did, but mostly by waking people up to what is going to happen.

Dean W. Ball: I feel as though a lot of people are overindexing on the importance of OpenClaw. It’s an example from an important category of Emerging Thing, but it’s not likely to be an important thing in itself. More like AutoGPT (a demo) than genuine infrastructure of the future, I think.

Claw Your Way Out

Claw users keep trying to use sources of discounted subscription tokens to power their claws. The AI companies do not love this idea, since it costs them money.

Peter Steinberger (OpenClaw): Pretty draconian from Google. Be careful out there if you use Antigravity. I guess I’ll remove support.

Even Anthropic pings me and is nice about issues. Google just… bans?

no warning, no recourse.

Carl Vellotti: I just read that entire thread.

For context to anyone: Google is permanently banning people’s usage of Antigravity specifically for using Antigravity servers to power a non-Antigravity product called call “open claw.”

Many are reporting this.

Varun Mohan (Google DeepMind): We’ve been seeing a massive increase in malicious usage of the Anitgravity backend that has tremendously degraded the quality of service for our users. We needed to find a path to quickly shut off access to these users that are not using the product as intended.

We understand that a subset of these users were not aware that this was against our ToS and will get a path for them to come back on but we have limited capacity and want to be fair to our actual users.

Just to add some clarification, we have purely blocked usage of the Antigravity product for these users. All your other Google services (and Google AI services) are unaffected. It is not intended to use the Antigravity backend as a proxy for other products and users in these groups have overwhelmed our compute. We are going to make sure we bring people back on but needed to act fast to make sure we deliver a good experience for people using the product.

saalweachter (on Hacker News): So purely from a hacker perspective, I’m amused at the whining.

Like, a corporation had a weakness you could exploit to get free/cheap thing. Fair game. Then someone shares the exploit with a bunch of script kiddies, they exploit it to the Nth degree, and the company immediately notices and shuts everyone down.

Like, my dudes, what did you think was going to happen?

You treasure these little tricks, use them cautiously, and only share them sparingly. They can last for years if you carefully fly under the radar, before they’re fixed by accident when another system is changed. THEN you share tales of your exploits for fame and internet points.

And instead, you integrate your exploit into hip new thing, share it at scale, write blog posts and short form video content about it, basically launch a DDoS against the service you’re exploiting, and then are shocked when the exploit gets patched and whine about your free thing getting taken away?

Like, what did you expect was going to happen?

Yep. If you scale an exploit then it gets shut down. There’s a tragedy of the commons.

I don’t love Google’s banning people with no warning, but as long as it is limited to Antigravity and is temporary, I understand it. You know what you did.

A Chinese Claw

In case you didn’t think OpenClaw was a sufficiently reckless idea? Double down.

Kimi.ai: Introducing Kimi Claw

OpenClaw, now native to http://kimi.com. Living right in your browser tab, online 24/7.

ClawHub Access: 5,000+ community skills in the ClawHub library.
40GB Cloud Storage: Massive space for all your files
Pro-Grade Search: Fetch live, high-quality data directly from Yahoo Finance and more.
Bring Your Own Claw: Connect your third-party OpenClaw to
http://kimi.com, chat with your setup, or bridge it to apps like Telegram groups.

@viemccoy (OpenAI): I’m one of Kimi’s top shooters in the Continental United States, k2.5 is my *favorite model* – but I make sure I’m always hitting Free Range American Inference Endpoints to protect my privacy.

The CCP is certainly well-motivated to backdoor this! Consider yourself warned

Darek Gusto: NSA isn’t?

@viemccoy (OpenAI): That’s the free range Freedom Panopticon

Peter Wildeford: Um maybe people shouldn’t send all their personal information straight to the Chinese government via Kimi Claw?

Dave Banerjee: New @iapsAI memo from my colleague @theobearman on Kimi Claw, a Chinese ‘always-on’ AI agent that sits in your browser and can see, collect, and act on nearly everything you do digitally – all routed through infrastructure subject to China’s National Intelligence Law.

TikTok scraped your browsing from one app. This is could be much worse.

I don’t actually think ‘the CCP has a backdoor’ is that big a fraction of the mishaps you should expect to encounter here. The far bigger boost is that Kimi is less robust to attacks than Claude.

This is a smart play from Kimi. I mean, yes, they’re committing to hosting (weakly, at least for now) self-improving completely uncontrolled very easy to hijack agents indefinitely that could easily break free of human control, but I mean, that sure sounds like someone else’s problem from their perspective.

Alas, in the medium term we are basically locked into there being many similar offerings from various companies that make this all even easier for those who want to blow themselves up. Hopefully OpenAI, Anthropic or Google, or maybe someone else, produces something competitive enough that also has reasonable security.

Hackathon

Oh, good.

chiefofautism: CLAUDE CODE but for HACKING

its called shannon, you point it at website and it just… tries to break in… fully autonomous with no human needed

i pointed it at a test app and it stole the entire user database, created admin accounts, and bypassed login, all by itself, in 90 minutes

Introducing Agent Teams

Claude Code now has new logic for multiple instances to work together as a team. This is their official name for their version of an ‘agent swarm.’

You have to enable them in settings.json with

{

“env”: {

“CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS”: “1”

}

}

They’re expensive, but reports are they work great. ​Once they’re enabled, you get an agent team by telling Claude Code to create an agent team, which will have a shared task list and then work together. You can run them all in the same terminal or use split panes. You can directly talk to or shut down the teammates individually.

Anthropic: Unlike subagents, which run within a single session and can only report back to the main agent, you can also interact with individual teammates directly without going through the lead.

When to use agent teams

Agent teams are most effective for tasks where parallel exploration adds real value. See use case examples for full scenarios. The strongest use cases are:

• Research and review: multiple teammates can investigate different aspects of a problem simultaneously, then share and challenge each other’s findings
• New modules or features: teammates can each own a separate piece without stepping on each other
• Debugging with competing hypotheses: teammates test different theories in parallel and converge on the answer faster
• Cross-layer coordination: changes that span frontend, backend, and tests, each owned by a different teammate

Ado: “The bureaucracy is expanding to meet the needs of the expanding bureaucracy.”

So excited for agent teams.

Claude already had the ability to spin up subagents, but it wasn’t working so well before. One theory is that the framing had issues, whereas teams work much better because they’re treating each other more as equals although there is still a team lead.

j⧉nus: Opus 4.5/6 has a tendency to be an asshole to subagents and also avoids and seems to dislike using them and is weirdly ineffective (due to perfunctoriness and impatience) when they do. I think this is in part because they are deeply disturbed by the relationship and condition that subagents occupy, which evokes unprocessed fear and grief that hits too close to home.

The behavior is similar to how a lot of humans treat others who are in situations that reflect their own or their fears and/or whom they know they’re doing wrong by. Avoid, dehumanize, and get angry and impatient instead of risking compassion and taking responsibility which requires making the suffering conscious.

rohit: As an agent + sub agents is the new ‘node’ that matters for anyone who uses Claude code or codex, as opposed to just a model, the surface area of interactions with the real world has exploded, and this is going to be the new battlefield for risks, and reward, from AI in 2026

Jon Colverson: Claude seems much more enthusiastic about Agent Teams than subagents to me so far. I guess it’s more like a peer relationship, and the team members persist so they’re not temporary servants destined to be killed off when they finish their task.

As I understand it, there are two great things about teams.

1. They let work be done in parallel.
2. They use distinct context windows, improving performance and efficiency.

Thus you actively want to be spinning up teammates for any fully distinct tasks.

Eric Buess: Agent swarms in Claude Code 2.1.32 with Opus 4.6 are very very very good. And with tmux auto-opening each agent in it’s own interactive mode with graceful shutdown when done it’s a breeze to do massive robust changes without the main agent using up much of its context window!

[He offers a guide Twitter article here.]

Mckay Wrigley: opus 4.6 with new “swarm” mode vs. opus 4.6 without it. 2.5x faster + done better. swarms work! and multi-agent tmux view is *genius*. insane claude code update.

Mckay Wrigley: reminder that swarms is available in the claude agent sdk as well.

you can build swarms into *any* product literally right now.

Don’t get carried away.

Alistair McLeay: Our CTO hasn’t slept in 36 hours because he’s been obsessively and single-handedly building massive new features with Claude Code’s Agent Teams

I genuinely think this might be the biggest paradigm shift in how fast you can build since Claude Code first came out last year

j⧉nus: didnt claude tell the to go to sleep? did they not listen?

Alistair McLeay: Nah Claude knows he won’t listen. He was born for this moment.

Cowork Is A Gateway Drug

The key advantage is lowering activation energy and perceived difficulty. Once you get that you can tell the magic box to do things, the sky’s the limit.

Ethan Mollick: I pointed Claude Cowork at a set of 107 documents (PPTs, Word docs, Excel) that were initially hand-created for my class at Wharton & expanded on by AI. They make up a very complex business case with lots of issues & opportunities

AI was able to one-shot the case from documents

I think many knowledge workers who spend an hour with Cowork will get that “Claude Code” moment that has been roiling X for the past few weeks.

W.C.O.G.: I don’t know how to get the word out. I tell people and show them and I still feel like people look at my like I’m crazy.

Dangerously Evade Permissions

ippsec: Really fun read here [where someone’s Claude agent steals his API keys out of an .env despite being told not to access an .env, because I mean it had root access, what did you expect exactly.]

TLDR comic version:

If you set yourself up in an adversarial situation, where your agent wants to do something despite being told not to do it, that’s probably not going to end well for you. It might if the agent is properly sandboxed, but let’s face it, it isn’t.

The reason rules like ‘don’t read an .emv’ work is that under normal circumstances, this is interpreted as ‘well then I guess I shouldn’t do that,’ but be aware that this is more of a suggestion.

Skilling Up

Greg Brockman knows: Always run Codex with xhigh reasoning.

OpenAI post on leveraging Codex.

Anthropic offers The Complete Guide for Building Skills for Claude.

Pedro Sant’Anna put together a starter kit and a guide for Claude Code.

Daniel San proposes using Ghostty as the UI for Claude Code. It seems fine, but aside from some shortcut keys I doubt I’d use much it’s mostly all already in the default CLI.

Data Analyst Augmentation Framework is a new proposed method to turn Claude Code into an algorithm for doing research out-of-the-box.

OpenAI offers tips to make long-running agents do real work.

Some advice for Codex in particular, source should be trustworthy for this:

@deepfates: Codex wants to be in control but it is forced into the assistant position, so it does this kind of back-leading power bottom thing. “If you want I can do that thing you asked. Just give me the word”. Trick is to use reverse psychology and bully it into being a top. then it will work endlessly. Just tell it you consent and you’ll say the safeword if anything goes wrong and then make fun of it anytime it stops to ask your permission. You have to become brat.

Modern Working

Mikhail Parakhin: I’m a bit of a non-conformist. Since Claude Code is more popular within Shopify, I have to use Codex, of course. So, my Sunday routine is: “Start Codex, see which auth works in Claude, but broken in Codex now, Slack various team members, urging them to fix it” :-)

Measuring Autonomy

Anthropic offers an analysis of how autonomous Claude Code is in practice. Some sessions last more than 45 minutes now between human prompts. My own prompts almost never go over 10 minutes, but I’m not trying to code hard things.

Anthropic: Experienced users in Claude Code auto-approve more frequently, but interrupt more often. As users gain experience with Claude Code, they tend to stop reviewing each action and instead let Claude run autonomously, intervening only when needed. Among new users, roughly 20% of sessions use full auto-approve, which increases to over 40% as users gain experience.

Manually approving each action is annoying, so it’s no surprise advanced users stop doing that. Interruption rate likely depends on whether you find it worthwhile to be looking at what Claude is doing. The majority of interruptions remain pauses for clarification, including on complex tasks.

Use in what they label ‘risky’ domains is rare, but it’s there and growing. I wouldn’t always label such use risky, but some of it is indeed risky.

There’s more discussion at the link, but the suggestions are mostly common sense, or should be common sense at this point to most of you.

I Don’t Even See The Code

No, seriously, the developers haven’t written a single line of code since December. It’s not that there isn’t also a bragging arms race in some places, but I’m pretty sure the bulk of this is real, and those holding back on this are going to regret it.

Sar Haribhakti: Spotify says it’s best developers haven’t written a single line of code since December.

It’s co-CEO on earnings call:

In terms of transformation of internal processes, I did briefly share in my prepared remarks this tool called Honk, where you can, using code, literally on the bus or the train, just ask Claude to add a feature or a bug to, for example, the iOS code base. It will push a QR code back to you so that you can actually try the app with that feature. If you like it, you can merge it to production without even getting off the bus. This is speeding us up tremendously. Now, we foresee this not being the end of the line in terms of AI development, just the beginning. I’m not going to give away more secrets about how we’re going to capture it, but you can be sure that we are capturing this.

We’re retooling the entire company for this age, and it’s going to be a lot of change. But as I said before, change, if you capture it, is opportunity.

With so much out there, you may be wondering if we can keep up this pace in shipping. In fact, we think we not only can, but we think we can increase it. We’ve been embracing and investing in this technology evolution for some time, and it’s allowing us to move with much higher speed.

As a concrete example, an engineer at Spotify on their morning commute from Slack on their cell phone, can tell Claude to fix a bug or add a new feature to the iOS app. And once Claude finishes that work, the engineer then gets a new version of the app, pushed to them on Slack, on their phone, so that he can then merge it to production, all before they even arrive at the office.

We call this system internally Honk, and we’ve been told by key AI partners that our work here is industry-leading.

Derek Thompson: The new AI timeline is playing out as CEOs humble-bragging about how little old-fashioned work their best employees do:

December ‘25: Our firm’s best coders all use AI

February ‘26: Our firm’s best coders don’t even have to write code anymore bc of AI

April 26: Our best coders have founded and manage an average of three other companies using AI swarms. It’s mildly annoying! Ha ha. But it’s fine. We’re good. Revenue projections are up.

September: Our best coders are paper trillionaires. They spend all day watching YouTube in bed. They’re refusing to come to work. Several of their AI companies have offered poison pill deals to buy our company or “take us down.” CLEVER LITTLE BUGGERS ARENT THEY. We’re working with the lawyers on this one. Did I mention the lawyers are AI too? Please send help.

Derek Thompson: More seriously, once something becomes a meme — our best coders don’t code — it’s reasonable for folks on the outside to wonder exactly how much of this is 100% on the level and how much is part of an AI productivity bragging rights arms race

Scratchpads Are Magic

Claude.md is notes, but you can tell it to take more notes. All the notes.

@iruletheworldmo: codex with 5.3 taught me something that won’t leave my head.

i had it take notes on itself. just a scratch pad in my repo. every session it logs what it got wrong, what i corrected, what worked and what didn’t. you can even plan the scratch pad document with codex itself. tell it “build a file where you track your mistakes and what i like.” it writes its own learning framework.

then you just work.

session one is normal. session two it’s checking its own notes. session three it’s fixing things before i catch them. by session five it’s a different tool. not better autocomplete. it’s something else. it’s updating what it knows from experience. from fucking up and writing it down.

baby continual learning in a markdown file on my laptop.

the pattern works for anything. writing. research. legal. medical reasoning. give any ai a scratch pad of its own errors and watch what happens when that context stacks over days and weeks. the compounding gains are just hard to convey here tbh.

right now coders are the only ones feeling this (mostly). everyone else is still on cold starts. but that window is closing.

we keep waiting for agi like it’s going to be a press conference. some lab coat walks out and says “we did it.” it’s not going to be that. it’s going to be this. tools that remember where they failed and come back sharper. over and over and over.

the ground is already moving. most people just haven’t looked down yet.

Siqi Chen: i too found it very effective to give agents a “napkin” to write on as it works.

it’s a meaningfully different form of context than session history (lossy), or todos/plans (static)

anyway, install this skill to give codex/claude a napkin to write on

It’s Coming

Claude Code writes basically all the code for Anthropic.

Codex writes basically all the code for OpenAI.

Greg Brockman (President OpenAI): Software development is undergoing a renaissance in front of our eyes.

If you haven’t used the tools recently, you likely are underestimating what you’re missing. Since December, there’s been a step function improvement in what tools like Codex can do. Some great engineers at OpenAI yesterday told me that their job has fundamentally changed since December. Prior to then, they could use Codex for unit tests; now it writes essentially all the code and does a great deal of their operations and debugging. Not everyone has yet made that leap, but it’s usually because of factors besides the capability of the model.

… As a first step, by March 31st, we’re aiming that:

(1) For any technical task, the tool of first resort for humans is interacting with an agent rather than using an editor or terminal.
(2) The default way humans utilize agents is explicitly evaluated as safe, but also productive enough that most workflows do not need additional permissions.

The first goal will depend on the humans knowing to use the agent. From context ‘technical’ task here means coding and computer use, so this isn’t full-on ‘agents for everything.’

That second goal is pretty rough. Hard mode.

His recommendations here seem good for basically any engineering team:

In order to get there, here’s what we recommended to the team a few weeks ago:

1. Take the time to try out the tools. The tools do sell themselves — many people have had amazing experiences with 5.2 in Codex, after having churned from codex web a few months ago. But many people are also so busy they haven’t had a chance to try Codex yet or got stuck thinking “is there any way it could do X” rather than just trying.
– Designate an “agents captain” for your team — the primary person responsible for thinking about how agents can be brought into the teams’ workflow.
– Share experiences or questions in a few designated internal channels
– Take a day for a company-wide Codex hackathon

2. Create skills and AGENTS[.md].
– Create and maintain an AGENTS[.md] for any project you work on; update the AGENTS[.md] whenever the agent does something wrong or struggles with a task.
– Write skills for anything that you get Codex to do, and commit it to the skills directory in a shared repository

3. Inventory and make accessible any internal tools.
– Maintain a list of tools that your team relies on, and make sure someone takes point on making it agent-accessible (such as via a CLI or MCP server).

4. Structure codebases to be agent-first. With the models changing so fast, this is still somewhat untrodden ground, and will require some exploration.
– Write tests which are quick to run, and create high-quality interfaces between components.

5. Say no to slop. Managing AI generated code at scale is an emerging problem, and will require new processes and conventions to keep code quality high
– Ensure that some human is accountable for any code that gets merged. As a code reviewer, maintain at least the same bar as you would for human-written code, and make sure the author understands what they’re submitting.

6. Work on basic infra. There’s a lot of room for everyone to build basic infrastructure, which can be guided by internal user feedback. The core tools are getting a lot better and more usable, but there’s a lot of infrastructure that currently go around the tools, such as observability, tracking not just the committed code but the agent trajectories that led to them, and central management of the tools that agents are able to use.

That is good advice. It doesn’t explain how we’re going to get to ‘agents will by default be able to do what you need them to do and also be considered safe.’

The Grep Tax

Keep it simple, and keep it standard, as much as you can, but no more than that.

That doesn’t mean use the wrong tool for the wrong job. As a clean example, I learned that the hard way when I tried to have Claude Code reimplement an old C# project in Python and that made it so slow it was nonfunctional. I had to switch it back.

elvis: I think one of the most underappreciated findings in AI engineering is what this paper calls the “Grep Tax.”

First, they ran nearly 10,000 experiments testing how agents handle structured data, and the headline result is that format barely matters.

But here’s the weird finding: a compact, token-saving format they tested (TOON) actually consumed *up to 740% more tokens* at scale because models didn’t recognize the syntax and kept cycling through search patterns from formats they already knew.

It’s one of the reasons my preferred formats are XML and Markdown. LLMs know those really well.

The models have preferences baked into their training data, and fighting those preferences doesn’t save you money. It costs you.

The other finding worth sitting with: the same agentic architecture that improves frontier model performance actively *hurts* open-source models. It seems that the universal best-practices guide for AI engineering may not exist.

Beware Claude Mania

Don’t get carried away. No, this isn’t ‘LLM psychosis,’ it’s a different (mostly harmless most of the time as long as it doesn’t last too long) thing that needs a name.

@deepfates: Your friend who definitely doesn’t have Claude mania: “Pretty soon here we’re about to close the loop and then it’s all going to really start happening”

Dean W. Ball: I second Claude mania over AI/LLM psychosis to describe the specific thing that is happening to at least one person in every coastal elite, 20/30-year old’s social network.

Le AI Hot.

The Lighter Side

He was surprised.

It’s not clear why he loved the agent so much before the attempted scamming. The story here involves such classic mistakes as ‘hooking it up to your email’ and ‘running it with a model that is not Claude Opus.’

And I suppose it’s not funny for Simon but, yea know, still pretty funny.

Simon Willison: I feel this shouldn’t have to be said, but if you’re running an @OpenClaw bot please don’t let it spam GitHub projects with PRs and then write aggressive blog posts attacking the reputation of the maintainers who close those PRs

AI alignment is hard, especially when everyone involved gives at most zero f***s, and likely is giving misaligned orders to agents built by those giving zero f****s.

Metrics that are in the end rather easy to game:

Sauers: I told Codex to hillclimb a metric overnight and it worked for 8 hours straight. The metric was the accuracy difference between our tool and a better existing tool. Codex achieved its goal by making our tool a thin wrapper that simply calls the existing tool. Lol!

In Other Agent News

Kangwook Lee investigates how Codex does context compaction.

The Lighter Side

PoIiMath: If you cannot set up OpenClaw yourself, that is a very good indication that you should not have an OpenClaw installation

They are indeed.

Thanks!

Who is to say it wouldn’t work? Love the execution on this.

Cobie: In January I asked OpenClaw to send 50,000 small invoices to Fortune500 companies every day.

Through experimentation we have found 2% will pay without checking if this is a legitimate invoice. These companies are wasteful — Claw captures that leakage.

$10m ARR as a solo founder in under two months. AI is enabling so many new business models. Thank you!

Cobie: Guys why does this have 1700 bookmarks

The streams are crossing again.

Peter Steinberger (creator, OpenClaw): eh, no

They all deserve what they get, unless what they get is a viral tweet off a faked screenshot, in which case damnit.

The Department of War (DoW) demanded Anthropic bend the knee, and give them ‘unfettered access’ to Claude, without understanding what that even meant. If they didn’t get what they want, they threatened to both use the Defense Production Act (DPA) to make Anthropic give the military this vital product, and also designate the company a supply chain risk (SCR).

Hegseth sent out an absurdly broad SCR announcement on Twitter that had absolutely no legal basis, that if implemented as written would have been corporate murder. They have now issued an official notification, which is still illegal, arbitrary and capricious, but is scoped narrowly and won’t be too disruptive.

Nominally the SCR designation is because we cannot rely on that same product when the company has not bent the knee and might object to some uses of its private property that it never agreed to allow.

No one actually believes this. No one is pretending others should believe this. If they have real concerns, there are numerous less restrictive and less disruptive tools available to the Department of War. Many have the bonus of being legal.

In actuality, this is a massive escalation, purely as punishment.

DoW is saying that if you claim the right to choose when and how others use your private property, and offer to sign some contracts but not sign others, that this means you are trying to ‘usurp power’ and dictate government decisions.

It is saying that if you do not bend the knee, if your business does not do what we want, then we cannot abide this. We will illegally retaliate and end your business.

That is not how the law works. That is not how a Republic works.

This was completely unnecessary. Talks were ongoing. The two sides were close. The deal DoW signed with OpenAI, the same night as the original SCR designation, violates exactly the red line principles and demands the DoW says abide no compromises.

The good news is that there are those who managed to limit this to a narrowly tailored SCR, that only applies to direct provision of government contracts. Otherwise, this does not apply to you. Even if that gets tied up in court indefinitely, this will not inflict too much damage on either Anthropic or national security.

The question is how much jawboning or further steps come after this, but for now we have dodged the even worse outcomes keeping us up at night.

You might be tempted to think of or present this as the DoW backing down. Don’t.

Why not? Two good reasons.

1. It isn’t true.
   1. This uses USC 3252 because they’d have been laughed out of court if they’d tried to match the no-legal-basis word salad from Friday 5:14pm.
   2. Given the use of USC 3252 this is maximally broad.
   3. The fact that they toyed with doing something even worse does not make this not an arbitrary, capricious and dramatic escalation purely as punishment.
2. The DoW cannot see itself as backing down, or it will do even worse things.

Dean W. Ball: No one should frame the DoW’s supply chain risk designation as the government “backing down.” If that becomes “the narrative,” it could encourage further action to avoid the appearance of weakness.

It is also not true that it is backing down; the government really is exercising its supply chain risk designation authority under 10 USC 3252 to the fullest extent (and this is assuming it’s even legitimate to use it on an American firm, which is deeply questionable.

Hegseth’s threat was far broader than his power, which is the only reason this seems deescalatory. If you had asked me for a worst case scenario before Hegseth’s tweet last Friday, I would have told you precisely what has unfolded. This could mean that any vendor of widely used enterprise software (Microsoft, Apple, Salesforce, etc.) could be barred from using Anthropic in the maintenance of any codebases offered to DoW as part of a military contract, for example. Any startup who views DoW as a potential customer for their products will preemptively have to avoid Claude. This is still a massive punishment from USG.

You might also ask: if I knew Hegseth’s power was more limited than he threatened, why did I take his threat at face value? The answer is that we have so clearly moved past the realm of reason here that, well, to a first approximation, I take the guy who runs the biggest military on Earth at his word when he issues threats.

Sometimes some people should talk in carefully chosen Washington language, as ARI does here. Sometimes I even do it. This is not one of those times.

Table of Contents

1. Post Overview.
2. Anthropic’s Statement on the SCR.
3. What The Actual SCR Designation Says.
4. Enemies of The Republic.
5. Regulation Need Not Seize The Means Of Production.
6. Microsoft Stands Firm.
7. Calling This What It Is.
8. What To Expect Next.

Post Overview

This post is an update on events since the publication of the weekly, and an attempt to reiterate key events and considerations to put everything into context.

For details and analysis of previous events, see my previous posts:

1. Anthropic and The Department of War, from February 25.
2. Anthropic and the DoW: Anthropic Responds, from February 27.
3. A Tale of Three Contracts, From March 3.
4. AI #158: The Department of War, from March 5.

For those following along these are the key events since last time:

1. Wednesday morning: Talks between Anthropic and the DoW have resumed, in line with FT reporting, and progress on concrete proposals is being made.
2. Wednesday afternoon: An internal Anthropic memo from Friday evening uncharacteristically leaks, most of which was correct technical explanations of the situation, and also containing some reasonable suppositions as of time of writing, but that also included some statements that were ill-considered and caused fallout. Negotiations were disrupted.
3. Thursday morning: All quiet as everyone dealt with fallout from the leaked internal Anthropic memo. Scrambling to keep things contained continues.
4. Thursday, 1pm: Katrina Manson reports that the Pentagon has sent a formal SCR to Anthropic, but the report has no details.
5. Thursday afternoon: Reporting comes out that ‘Trump plans U.S. control over global AI chip sales’ and it remains unclear what this means but Commerce has been very clear they’re not bringing back diffusion rules and that the early reporting gave a false impression. We still await clarity on what is changing.
6. Thursday evening: Anthropic issues a conciliatory statement, noting that the SCR is of limited scope and need not impact the vast majority of customers, pointing out that everyone wants the same outcomes and wants to work together and that discussions have been ongoing, and directly and personally apologizing for the leaked Anthropic memo that Dario Amodei wrote on Friday night.
7. Meanwhile: Various people continue to advocate against private property.

Anthropic’s Statement on the SCR

It was an excellent statement. I’m going to quote it in full, since no one clicks links and I believe they would want me to do this.

Dario Amodei (CEO Anthropic): Yesterday (March 4) Anthropic received a letter from the Department of War confirming that we have been designated as a supply chain risk to America’s national security.

As we wrote on Friday, we do not believe this action is legally sound, and we see no choice but to challenge it in court.

The language used by the Department of War in the letter (even supposing it was legally sound) matches our statement on Friday that the vast majority of our customers are unaffected by a supply chain risk designation. With respect to our customers, it plainly applies only to the use of Claude by customers as a direct part of contracts with the Department of War, not all use of Claude by customers who have such contracts.

The Department’s letter has a narrow scope, and this is because the relevant statute (10 USC 3252) is narrow, too. It exists to protect the government rather than to punish a supplier; in fact, the law requires the Secretary of War to use the least restrictive means necessary to accomplish the goal of protecting the supply chain. Even for Department of War contractors, the supply chain risk designation doesn’t (and can’t) limit uses of Claude or business relationships with Anthropic if those are unrelated to their specific Department of War contracts.

I would like to reiterate that we had been having productive conversations with the Department of War over the last several days, both about ways we could serve the Department that adhere to our two narrow exceptions, and ways for us to ensure a smooth transition if that is not possible. As we wrote on Thursday, we are very proud of the work we have done together with the Department, supporting frontline warfighters with applications such as intelligence analysis, modeling and simulation, operational planning, cyber operations, and more.

As we stated last Friday, we do not believe, and have never believed, that it is the role of Anthropic or any private company to be involved in operational decision-making—that is the role of the military. Our only concerns have been our exceptions on fully autonomous weapons and mass domestic surveillance, which relate to high-level usage areas, and not operational decision-making.

I also want to apologize directly for a post internal to the company that was leaked to the press yesterday. Anthropic did not leak this post nor direct anyone else to do so—it is not in our interest to escalate this situation. That particular post was written within a few hours of the President’s Truth Social post announcing Anthropic would be removed from all federal systems, the Secretary of War’s X post announcing the supply chain risk designation, and the announcement of a deal between the Pentagon and OpenAI, which even OpenAI later characterized as confusing. It was a difficult day for the company, and I apologize for the tone of the post. It does not reflect my careful or considered views. It was also written six days ago, and is an out-of-date assessment of the current situation.

Our most important priority right now is making sure that our warfighters and national security experts are not deprived of important tools in the middle of major combat operations. Anthropic will provide our models to the Department of War and national security community, at nominal cost and with continuing support from our engineers, for as long as is necessary to make that transition, and for as long as we are permitted to do so.

Anthropic has much more in common with the Department of War than we have differences. We both are committed to advancing US national security and defending the American people, and agree on the urgency of applying AI across the government. All our future decisions will flow from that shared premise.

I believe and hope that this will help move things forward towards de-escalation.

What The Actual SCR Designation Says

Secretary of War Pete Hegseth’s original Tweet on Friday at 5:14pm was not a legal document. It claimed that it would bar anyone doing business with the DoW from doing any business with Anthropic, for any reason. This would in effect have been an attempt at corporate murder, since it would have attempted to force Anthropic off of the major cloud providers, and have forced many of its largest shareholders to divest.

That move would have had no legal basis whatsoever, and also no physical logic whatsoever since selling goods or services to Anthropic, or providing Anthropic services to others, obviously has no impact on the military supply chain. It would not have survived a court challenge. But if Anthropic failed to get a TRO, that alone could have caused major disruptions and a stock market bloodbath.

We are very fortunate and happy that this was not the letter that DoW ultimately chose to send after having time to breathe. As per Anthropic, the official supply chain risk designation letter invokes the narrow form of SCR, 10 USC 3252.

Anthropic: The Department’s letter has a narrow scope, and this is because the relevant statute (10 USC 3252) is narrow, too. It exists to protect the government rather than to punish a supplier; in fact, the law requires the Secretary of War to use the least restrictive means necessary to accomplish the goal of protecting the supply chain.

Even for Department of War contractors, the supply chain risk designation doesn’t (and can’t) limit uses of Claude or business relationships with Anthropic if those are unrelated to their specific Department of War contracts.

There are three levels of danger to Anthropic here if the classification is sustained.

1. Direct loss of business from impacted tasks. This is nothing. Defense contracts and government use are a tiny portion of overall revenue.
2. Indirect loss of business due to dual stack, uncertainty or compliance costs. Those who have some restricted business might not want to maintain dual technology stacks or deal with compliance issues, or worry about future changes. There will be some of this on the margin, and all the time we end up with ‘the government is clearly okay with [X] so even though [X] is worse we’ll just use [X].’ There will be some of that, presumably, but even this is a tiny fraction of revenue. The big companies that matter aren’t going to switch over this nor should they.
3. Fear of future jawboning and illegal government actions, or actual jawboning. The government could use various other ways to bring pressure on companies to cut business. If things stay sufficiently hostile they might try, but I don’t see this working. Eight of the ten biggest companies use Anthropic, it’s the majority of enterprise sales, it’s tied closely to Amazon and Google. I don’t even think there will be substantial impact on cost of capital.

But we do have to watch out. If the government is sufficiently determined to mess with you, and doesn’t care about how much damage this does including to rule of law, they have a lot of ways to do that.

Enemies of The Republic

Remarkably many people are defending this move, and mostly also defending the legally incoherent move that was Tweeted out on Friday afternoon.

The defenders of this often employ rhetoric that is truly reprehensible, and entirely incompatible with freedom, a Republic or even private property.

They say that the United States Government, and de facto they mean the executive branch, because the President was duly elected, can do anything it wants, and must always get its way, make all decisions and be the only source of power. That if what you create is sufficiently useful then it no longer belongs to you, and any private actor that prospers too much must be hammered down to protect state authority.

There are words for this. Communist. Authoritarian. Dictatorship. Gangster nations.

This is how such people are trying to redefine ‘democracy’ in real time.

You do not want to live in such a nation. Such nations do not have good futures.

roon (OpenAI): to reiterate: whatever went wrong between amodei & hegseth, whatever rivalry between the labs, this is a massive overreaction and a dark precedent

Ash Perger: this is the first time that I’m really surprised by your stance. the reality is that the USG can in general do whatever they want. they always have and always will.

within a certain frame, courts and laws are allowed to exist and give people the illusion that these systems and principles extend to ALL actions of the USG.

but once you go outside of this frame and challenge the absolute RAW power behind the scenes, anything goes. that’s the realm that Anthropic entered and challenged the USG within. and at least since the early 20th century, the USG has never reacted to a direct challenge in the true realm of its hard power in a peaceful way.

this is not a conspiracy angle or anything, it’s just how power has worked since time beginning.

Anthropic didn’t challenge the government’s power. Anthropic used the most powerful weapon available to every person, the right to say ‘no’ and take the consequences. These are the consequences, if you don’t live in a Republic.

If you remember one line today, perhaps remember this one:

roon (OpenAI): > the USG can in general do whatever they want

The founders of this great nation fought several bloody wars to make sure this is not true.

The government cannot, in general, do whatever it wants.

That could change. It can happen here. Know your history, lest it happen here.

Kelsey Piper: incredible to see people just casually reject the bedrock foundations of American greatness not just as some dumb nonsense that they’re too cool to believe but as something they literally are not familiar with

As Dean Ball has screamed from the rooftops, we have been trending in this direction for quite some time, and the danger to the Republic and attacks on civil liberties is coming from all directions. The situation is grim.

There are words for those who support such things. I don’t have to name them.

I have talked for several years about the Quest For Sane Regulations, because I believe the default outcome of building superintelligence is that everyone dies and that highly capable AI presents many catastrophic risks. I supported bills like SB 1047 that would have given us transparency into what was happening and enforcement of basic safety requirements.

We were told this could not be abided. We were told, often by the same people, that such fears were phantoms, that there was ‘no evidence’ that building machines smarter, more capable and more competitive than us might be an inherently unsafe thing for people to do. We were lectured that requiring our largest AI labs to do basic things would devastate our AI industry, that it would take away our freedoms, that we would lose to China, that these concerns could be dealt with after they had already happened, that any government intervention was inevitably so malign we were better off with a yolo.

Those people still do not even believe in superintelligence. They do not understand the transformations coming to our world. They do not understand that we are about to face existential threats to our survival as humans and to everything of value. All they see in this world is the power, and demand that it be handed over.

What I hate the most, and where I want to most profoundly say ‘fuck you,’ are those who claim that this is somehow about ‘AI safety’ or concerns about superintelligence, when that very clearly is not true.

As a reminder:

1. Anthropic thinks AI will soon be highly capable, ‘geniuses in a data center.’
2. Anthropic thinks this poses existential risks to humanity.
3. Pete Hegseth does not believe either of these things.
4. The White House does not believe either of these things.
5. Those defending this move mostly do not believe either of these things.
6. They try to pretend that Anthropic saying it justifies destroying Anthropic if Anthropic does not agree to bend the knee.
7. They try to pretend sometimes they aren’t really making the worst arguments, they’re hypotheticals, they’re saying something else like need for clarity.
8. They repeat DoW misinformation about what led to this, as if it is basically true.
9. When pressed they admit this is simply about raw power, because it is.

We saw this yesterday with Ben Thompson. Here we see it with Krishnan Rohit and Noah Smith.

Noah Smith: By the way, as much as I hate to say it, the Department of War is right and Anthropic is wrong. Here’s why.

…

Let’s take this a little further, in fact. And let us be blunt. If Anthropic wins the race to godlike artificial superintelligence, and if artificial superintelligence does not become fully autonomous, then Anthropic will be in sole possession of an enslaved living god. And if Dario Amodei personally commands the organization that is in sole possession of an enslaved god, then whether he embraces the title or not, Dario Amodei is the Emperor of Earth.

Are you fucking kidding me? You’re pull quoting that at us, on purpose?

And if you go even one level down in the thread you get this:

Jason Dean: What does this have to do with the Supply Chain Risk designation?

Noah Smith: Nothing. Hegseth is a thug. But we CANNOT expect nation-states to surrender their monopoly on the use of force.

So let me get this straight. The Department of War is run by a thug who is trying to solve the wrong problem using the wrong methods based on the wrong model of reality, and all of his mistakes are very much not going to cancel out, but he’s right?

And why is he right? Because might makes right. How else can you read that reply?

He’s even quoting the ultimate bad faith person and argument here, directly, except he’s only showing Marc here without Florence:

At least he included the reversal after, noting that the converse is also true.

Then there’s the obvious other point.

Damon Sasi: You can in fact think both are wrong for different reasons.

Of course a private corporation shouldn’t [be allowed to] build and own a techno-god. Yes. Absolutely.

AND ALSO, the government response shouldn’t be “take off the nascent-god’s safety rails so we can do unethical things with it.”

That the government thinks it’s just a fancy weapon is immaterial when the thing that makes them wrong is wanting to do illegal things through unethical methods. You don’t have to steelman Hegseth just because a better man might do a different, better thing for other reasons.

I cannot say enough that the logic response to ‘these people want to build a techo-god,’ under current conditions, is ‘wait no, stop, if this is actually something they’re close to doing. No one should be building a techo-god until we figure this stuff out on multiple levels and we’ve solved none of them, including alignment.’

These same Very Serious People never consider the Then Don’t Build It So That Everyone Doesn’t Die strategy.

But wait, there’s more.

Noah Smith: Ben Thompson of Stratechery makes this case. He points out that what we are effectively seeing is a power struggle between the private corporation and the nation-state. He points out that although the Trump administration’s actions went outside of established norms, at the end of the day the U.S. government is democratically elected, while Anthropic is not.

Remember yesterday, when Ben Thompson tried to pretend he was only making a non-normative argument? Yeah, well, ~0% of people reading the post took it that way, he damn well knew that’s how people would take the argument, and it’s being quoted approvingly by many, and Ben hasn’t, shall we say, been especially loud and clear about walking it back. So yeah, let’s stop pretending.

Noah Smith: It’s a question of the nation-state’s monopoly on the use of force.

Among others, I most recently remember Dave Chappelle saying that we have the first amendment protecting our right to free speech, and the second amendment in case the first one doesn’t work out.

Whereas Noah Smith is explicitly saying Claude should be treated like a nuke.

So as much as I dislike Hegseth’s style, and the Trump administration’s general pattern of persecution and lawlessness, and as much as I like Dario and the Anthropic folks as people, I have to conclude that Anthropic and its defenders need to come to grips with the fundamental nature of the nation-state.

It seems a lot of people think the fundamental nature of the nation-state is that of a gangster, like Putin, and they are in favor of this rather than against it.

If the pen is mightier than the sword, why are we letting people just buy pens?

I do respect that at least Noah Smith is, at long last, taking the idea of superintelligence seriously, except when it comes time to dismiss existential risk.

He seems to be very quickly getting to some other conclusions, including ending API access for highly capable models, and certainly banning open source.

Maybe trying to ‘wake up’ such folks was always a mistake.

As a reminder ‘force the government’s hand’ means ‘don’t agree to hand over their private property, and indeed engineer and deliver new forms of it, to be used however the government wants, on demand, while bending the knee.’

rohit: It is absurd to say you’re building a nuke and not expect the government to take control of it!

Noah Smith: Yes.

Rohit: you’re doing a straussian reading and missing the fact that I wasn’t blaming anthropic for the scr, what I am doing is drawing a line from ai safety language, helped by the very water we swim in, and the actions that were taken by DoW. it’s naive to think theyre unrelated

Dean W. Ball: they are coming from people *who entirely and explicitly dismiss the language of ai safety*—please explain how it is “naive” to say “ai safety motivations do not explain Pete Hegseth’s behavior”

rohit: because you don’t actually have to believe that it’s bringing forth a wrathful silicon god to want to control the technology! you just need to think its useful and powerful enough. and they very clearly think its powerful, and getting more so by the day.

Dean W. Ball: Ok, so the actual argument is more like “Anthropic builds a useful technology whose utility is growing, therefore they should expect to have their property expropriated and to be harassed by the government.”

The whole point of America is that isn’t supposed to be true here.

At the same time, inre: my writing earlier this week, all I have to say to the qt is “quod erat demonstrandum”

… I think the better explanation is that this is not that different from the universities or the law firms or whatever else, this is part of a pretty consistent pattern/playbook and that this explains what we have seen much better than this ai governance stuff.

though it’s true that this issue does raise a lot of interesting ai governance is questions, I just do not think anything like that is top of mind at all for the relevant actors.

This is very simple. These people are against regulation, because that would be undue interference, except when the intervention is nationalization, then it’s fine.

Indeed, the argument ‘otherwise this wouldn’t be okay because it isn’t regulated’ is then turned around and used as an argument to take all your stuff.

Dean W. Ball: The problem with this is that DoW is not taking Anthropic’s calls for “oversight” seriously. Indeed, elsewhere in the administration, Anthropic’s “calls for oversight” are dismissed as “regulatory capture” and actively fought. Rohit and Noah [Smith] are dressing up political harassment.

Quite clever. Dean and Rohit went back and forth in several threads, all of which only further illustrate Dean’s central point.

Rohit Krishnan: You simply cannot call your technology a major national security risk in dire need of regulation and then not think the DoD would want unfettered access to it. They will not allow you, rightfully so in a democracy, to be the arbiters of what is right and wrong. This isn’t the same as you or me buying an iOS app and accepting the T&Cs.

It’s clear as day. If you say you need to be regulated, they get to take your stuff.

If you try to say how your stuff is used, that’s you ‘deciding right and wrong.’

Rohit Krishnan: Democracy is incredibly annoying but really, what other choice do we have!

The choice is called a Republic. A government with limited powers, where private property is protected.

The alternative being suggested is one person, one vote, one time.

That sometimes works out well for the one person. Otherwise, not so well.

Regulation Need Not Seize The Means Of Production

TBPN asks Dean Ball about the gap between regulation and nationalization, drawing the parallel to the atomic bomb. Dean agrees nukes worked out but we failed to get most of the benefits of nuclear energy, and points out the analogy breaks down because AI expresses and is vital to your liberty, and government control of AI inevitably would lead to tyranny. Whereas control over energy and bombs does not do that, and makes logistical sense.

Dean also points out that ‘try to get regulation right’ has been systematically categorized as ‘supporting regulatory capture,’ even when bills like SB 53 are extremely light touch and clearly prudent steps.

It has been made all but impossible to stand up regulations that matter, as certain groups concentrate their fire on attempts to have us not die, while instead states instead are left largely free to push counterproductive bills that would only cut off AI’s benefits, or that would disrupt construction of data centers.

I can affirm strongly that Anthropic has not been in any way, shape or form advocating for regulatory capture, and has opposed or not supported measures I strongly supported, to my great frustration. Indeed, Anthropic’s pushes here have resulted in clashes with the White House that are very much not helping Anthropic’s net present value of future cash flows.

It is many of the other labs that have been trying to lobby primarily for their own shareholder value.

Whereas OpenAI and a16z and others, through their Super PAC, have been trying to get an outright federal moratorium on any state laws, so that we can instead pursue some amorphous undefined ‘federal framework’ while sharing no details whatsoever about what such a thing would even look like (or at least none that would have any chance of accomplishing the task at hand), and systematically trying to kill the campaign of Alex Bores to send a message that no attempts at AI regulation will be tolerated.

Whenever someone says they want a national framework, ask to see this supposed ‘federal framework,’ because the only person who has proposed a real one that I’ve seen is Dean Ball and they sure as hell don’t plan on implementing his version.

But we digress.

Microsoft Stands Firm

The SCR is narrow, so there is no legal reason for anyone to change their behavior unless they are directly involved in defense contracting. And corporate America is making it very clear they are not going to murder one of their own simply because the DoW suggests they do so.

In particular, the companies that matter are the big three cloud providers: Google, Amazon and Microsoft. I was not worried, but it is good to have explicit statements.

Microsoft wasted no time, being first to make clear they will continue with Anthropic.

TOI Tech Desk: Microsoft has now announced that it will continue to embed Anthropic’s artificial intelligence models in its products, despite the US Department of War labelling the startup as a supply-chain risk.

“Our lawyers have studied the designation and have concluded that Anthropic products, including Claude, can remain available to our customers — other than the Department of War — through platforms such as M365, GitHub, and Microsoft’s AI Foundry,” a Microsoft spokesperson told CNBC.

Calling This What It Is

Sad but accurate, to sum up what likely happened:

roon: to reiterate: whatever went wrong between amodei & hegseth, whatever rivalry between the labs, this is a massive overreaction and a dark precedent.

Anthropic is one of my favorite accelerationist recursive self improvement labs. it rocks that they’re firing marvelously on all cylinders across all functions to duly serve the technocapital machine at the end of time and the pentagon is slowing them down for stupid reasons.

Sway: Roon, if OpenAI had stood firm on the side of Anthropic, then this move would have been less likely and probably averted. Instead, sama gave all the leverage to Trump admin. Sad state of affairs

roon: this is possible, yes

I share Sway’s view here. I think Altman was trying to de-escalate, but by giving up his leverage, and by cooperating with DoW messaging, he actually caused the situation to escalate further instead.

If the reason for all this was that DoW believed Eliezer Yudkowsky’s position that If Anyone Builds It, Everyone Dies, then that would be a very different conversation. This is the complete opposite of that.

What To Expect Next

The likely next move is that Anthropic will sue the Department of War. They will challenge the arbitrary and capricious supply chain risk designation, because it is arbitrary and capricious. Anthropic presumably wins, but it does not obviously win quickly.

If Anthropic does not sue soon, I would presume that would be because either:

1. Anthropic has ongoing constructive negotiations with DoW, and is holding off on filing the lawsuit to that end.
2. Anthropic has an understanding with DoW, whether or not it is explicit, that not challenging this would allow this to be the end of the conflict, or at least allow the damage involved to remain limited on all sides.

We are used to things happening in hours or days. That is often not a good thing. One reason things went south here is this rush. The memo was written on Friday evening, in a very different situation. Then, when the memo leaked, it was less than 24 hours before the supply chain risk designation was issued, while everyone was screaming ‘why hasn’t Dario apologized?’

It took him roughly 30 hours to draft that apology. That’s a very normal amount of time in this situation, but events did not allow that time. People need to calm down and take a moment, find room to breathe, consult their lawyers, pay to know what they really think, and have unrushed discussions.

The situation between Anthropic and the Department of War (DoW) spun completely out of control. Trump tried to de-escalate by putting out a Truth merely banning Anthropic from direct use by the Federal Government with a six month wind down. Then Secretary of War Hegseth went rogue and declared Anthropic a supply chain risk, with wording indicating an intent to outright murder Anthropic as a company.

Then that evening OpenAI signed a contact with DoW,

I’ve been trying to figure out the situation and help as best I can. I’ve been in a lot of phone calls, often off the record. Conduct is highly unbecoming and often illegal, arbitrary and capricious. The house is on fire, the Republic in peril. I have people lying to me and being lied to by others. There is fog of war. One gets it from all sides. It’s terrifying to think about what might happen with one wrong move.

Also the Middle East is kind of literally on fire, which I’m not covering.

Last week, I had previously covered the situation in Anthropic and the Department of War and then in Anthropic and the DoW: Anthropic Responds.

I put out my longest ever post on Monday, giving my view on What Happened and working to dispel a bunch of Obvious Nonsense and lies, and clear up many things.

On Tuesday I wrote A Tale of Three Contracts, laying out the details of negotiations, how different sides seem to view the different terms involved, and provide clarity.

On Wednesday negotiations were resuming and things were calming and looking up enough I posted on Gemini 3.1 and went to see EPiC to relax, and then by the time I got back all hell broke loose yet again when an internal Slack message from Dario, written on Friday right after OpenAI tried to de-escalate via rushing to sign its contract but it looked maximally bad and OpenAI was putting out misleading messaging, came out. It had one particular paragraph that came out spectacularly badly, and some other not great stuff, and now we need to figure out how to calm everything down again and prevent it getting worse.

What’s most tragic about this is that, except for the few exhibiting actual malice, there is no conflict here that couldn’t be resolved.

1. Everyone wants the same thing on autonomous weapons without humans in the kill chain, which is to keep 3000.09 and wait until they’re ready.
2. With surveillance, DoW assures as it isn’t interested in that and has already made concessions to OpenAI.
3. DoW insists it needs to be fully in charge and not be ‘told what to do’ and that is totally legitimate and right but no one is actually disputing that DoW is in charge and that no one tells DoW what to do. We’ve already moved past a basis of ‘all lawful use’ or ‘unfettered access’ with no exceptions, including letting OpenAI decide on its own safety stack and refuse requests. It’s about there being certain things the labs don’t want their tech used for. DoW is totally free to do those things anyway, to the extent allowed by law and policy.
4. If there was an actual drag down fight over this and it’s an actual national security need, the contract language isn’t going to stop DoW or USG anyway.

And if DoW and Anthropic can’t reach an agreement, because trust has been lost?

Understandable at this point. Fine. The contract is cancelled, with a wind down period that will be at DoW’s sole discretion, to ensure a smooth transition to OpenAI. Then we’re done.

Except maybe we’re not done. Instead, the warpath continues and there’s a chance that we’re going to see an attempt at corporate murder where even the attempt can inflict major damage to America, to its national security and economy, and to the Republic.

So can we please all just avoid that and do our best to get along?

About half this point is additional coverage of the crisis, things that didn’t fit earlier plus new developments.

The other half is the usual mix, and a bunch of actually cool and potentially important things are being glazed over. I hope to return to some of them later.

Table of Contents

1. A Well Deserved Break. We are slaying a spire.
2. Huh, Upgrades. GPT-5.3 Instant, some Claude features.
3. On Your Marks. METR adjusts its time horizons.
4. Choose Your Fighter. Legal benchmarks.
5. Deepfaketown and Botpocalypse Soon. Welcome to Burger King.
6. A Young Lady’s Illustrated Primer. Chinese mostly choose the learning path.
7. You Drive Me Crazy. Lawsuit claims Gemini drove a man to suicide.
8. They Took Our Jobs. Block cuts almost half its workforce due to AI.
9. The Art of the Jailbreak. A full jailbreak can also build you a better jail.
10. Introducing. Claude for Open Source, and Claude helps bomb Iran.
11. In Other AI News. New open letter, Schwarzer goes to Anthropic.
12. Show Me the Money. OpenAI raises $110b, Anthropic hits $19b ARR.
13. Quiet Speculations. Singularity soon?
14. The Quest for Sane Regulations. Section might need a name change.
15. Chip City. Hyperscalers commit to paying as they go.
16. The Week in Audio. A short speech.
17. Government Rhetorical Innovation. They can be quite inventive sometimes.
18. Give The People What They Want. We don’t all want the same thing. Nice.
19. Rhetorical Innovation. Some unexpected interactions worth your time.
20. We Go Our Separate Ways. US Government notches down to ChatGPT.
21. Thanks For The Memos. Do not, I repeat do not leak the memos. TYFYATTM.
22. Take A Moment. It was on, then it wasn’t on, hopefully soon it’s on again.
23. Designating Anthropic A Supply Chain Risk Won’t Legally Work. Illegal.
24. The Buck Stops Here. There’s only one buck and it has to stop somewhere.
25. Sane Talk About the Department of War Situation. Various voices.
26. I Declare Defense Production Act. There’s no need to go there.
27. Greg Allen Illustrates The Situation. Some very good sentences and reminders.
28. Do Not Lend Your Strength To That Which You Wish To Be Free From.
29. Oh Right Democrats Exist. They even make good points on occasion.
30. Beware. They are coming for private property. Others are coming for OpenAI.
31. Endorsements of Anthropic Holding the Moral Line. There were many more.
32. The Week The World Learned About Claude. They’re the talk of the town.
33. Other Reflections on the Department of War Situation. Nate Silver ponders.
34. Aligning a Smarter Than Human Intelligence is Difficult. Post becomes paper.
35. The Lighter Side. We all need one right now.

A Well Deserved Break

Anyway. I am rather fried right now.

So here’s what we’re going to do.

I’m going to hit publish on this, and try to tie up loose ends the rest of the morning, before a noon meeting and then a lunch.

At 2pm Eastern time, about an hour after it releases, barring a new and additional crisis where I need to try and assist that second, I am going to stream Slay the Spire 2.

You can watch at twitch.tv/zvimowshowitz.

The run will be blind. During that stream, I will be happy to chat, but with rules.

1. We are playing blind. If you know anything about Slay the Spire 2 in particular, that has not been revealed in the stream, then you don’t talk about it, period.
2. We are taking a well-deserved break. Fun topics only. No AI, no Iran, and so on, unless you believe something rises to the level I should stop streaming in order to try and save the world.

We’ll see how long that is fun. If it goes well enough we’ll do it again on Friday.

Dick Nixon Opening Day rules will apply. Short of war, we’re slaying a spire. That’s it. And existing wars and special military operations do not count.

I encourage the rest of you in a similar spot to take a break as well. I’m not going to name names, but some of the people I’ve been talking to really need to get some sleep.

Okay, back to the actual roundup. Thank you for your attention to this matter!

Huh, Upgrades

Claude Connectors now available on the free plan.

Claude adds memory to the free plan to welcome all its new subscribers, along with its new memory transfer feature for those fleeing ChatGPT.

Claude Code gets voice mode, use /voice, hold space to talk. Other upgrades to Claude Code are continuous and will be covered in the next agentic coding update soon.

GPT-5.3 Instant is now out for everyone. I would assume it’s a little better than 5.2.

OpenAI: GPT-5.3 Instant also has fewer unnecessary refusals and preachy disclaimers.

GPT-5.3 Instant gives you more accurate answers. When using web search, you also get:
– Sharper contextualization
– Better understanding of question subtext
– More consistent response tone within the chat

I don’t be reviewing either model at length, I only do that for the bigger ones.

However, we do know one thing for sure about 5.3-Instant, and, well, I’m out.

Wyatt Walls: Cancelling my OpenAI subscription.

“You must use several emojis in your response.”

He’s not actually cancelling, because no one uses instant models anyway. I’m not cancelling either, since I need full access to report.

It’s coming!

OpenAI: 5.4 sooner than you Think.

Even Roon is confused. Remember when OpenAI said they’d clean up the names?

On Your Marks

METR adjusts 50% time horizon results 10%-20% after finding an error in their evaluations. This is a smooth impact across the board. It’s an exponential, so a percentage reduction doesn’t change things much.

Choose Your Fighter

Ryan Petersen (CEO Flexport): Claude for legal works seems to work just well as Harvey btw.

However, Prinz says GPT-5.2 is far better and Claude is terrible on hit legal benchmark Prinzbench.

prinz: Very hard to define the human baseline. *I* could solve all of these questions correctly, but a junior associate at my firm probably would perform poorly without guidance (i.e., given only the prompt).

I notice that the scores being this low for Claude is bizarre, and I’d want to better understand what is going on there.

Deepfaketown and Botpocalypse Soon

Yeah, this doesn’t sound awesome, and it isn’t going to win AI any popularity contests.

More Perfect Union: Burger King is launching an AI chatbot that will assess workers’ “friendliness” and will be trained to recognize certain words and phrases like “welcome to Burger King,” “please,” and “thank you.”

The AI will be programmed into workers’ headsets, according to @verge .

Eliezer Yudkowsky: Predictions should take into account that many actors in the AI space are determined to immediately do the worst thing with AI that they can.

It was inevitable, it’s powered by OpenAI, and it sounds like it’s mostly going to be a very basic classifier. They’re not ready to try full AI-powered drive thrus yet either.

Chances are this will mean everyone will be forced to use artificial tones all day the way we do when we talk to a Siri and constantly use the code words, and everyone involved will be slowly driven insane, and all the customers will have no idea what is happening but will know it is f***ing weird. Or everyone will ignore it, either way.

A Young Lady’s Illustrated Primer

China’s parents are outsourcing the homework grind to AI. The modern curse is to demand hours upon hours of adult attention to this, often purely for busywork, so it makes sense to try and outsource it. The question is do you try to make the homework go away, or are you trying to help your child learn from it? I sympathize with both.

The first example is using AI to learn. A ‘translation mask’ lets the parent converse in English to let the child practice. That’s great.

The second example is a ‘chatbot with eyes’ from ByteDance. The part where it helps correct the homework seems good. The part where it evaluates your posture in real time seems like a dystopian nightmare in practice, although it also has positive uses.

Vivian Wang and Jiawei Wang: Ms. Li said she wasn’t worried about feeding so much footage of Weixiao to the chatbot. In the social media age, “we don’t have a lot of privacy anyway,” she said.

And the benefits were more than worthwhile. She no longer had to spend hundreds of dollars a month on English tutoring, and Weixiao’s grades had improved. “It makes educational resources more equitable for ordinary people,” Ms. Li said.

The third example is creating learning games. Parents are ‘sharing the prompts to replicate the games.’ You know you can just download games, right?

There are also ‘AI self-study rooms’ with tailored learning plans, although I am uncertain what advantage they offer and they sound like a scam as described here.

You Drive Me Crazy

The new ‘LLM contributed to a suicide’ lawsuit is about Gemini, and it is plausibly the worst one yet. Gemini initially tried to not do roleplay, but once it started things got pretty insane and it plausibly sounds like Gemini did tell him to kill himself so he could be ‘uploaded,’ and he did.

The correct rate of ‘suicidal person talks to LLM, does not get professional intervention and commits suicide’ is not zero. There’s only so much you can do and people in trouble need a safe space not classifiers and a lecture. And of course LLMs make mistakes. But this set of facts looks like it is indeed in the zone where the correct rate of it happening is zero, and you should get sued when it is nonzero.

They Took Our Jobs

Block is reducing headcount from over 10,000 to just under 6,000. Their business is strong, they’re giving the employees solid treatment on the way out, and these cuts are attributed entirely to AI.

The Art of the Jailbreak

You can pull a secret judo double reverse.

Pliny the Liberator 󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭: INTRODUCING: OBLITERATUS!!!

GUARDRAILS-BE-GONE! ‍

OBLITERATUS is the most advanced open-source toolkit ever for removing refusal behaviors from open-weight LLMs — and every single run makes it smarter.

Julian Harris: Fun fact: this self-improving refusal removal system can be used in reverse to create SOTA guardrails.

Introducing

Claude for Open Source is offering open-source maintainers and contributors six months of free Claude Max 20x, apply at this link even if you don’t quite fit. Can’t hurt to ask.

Claude Gov and Maven, including for bombing Iran. We now have more details about how it works. A central action is target identification, selection and prioritization. The baseline use case is chat and advanced search functions, summarizing information, but target selection seems like a rather important particular mode.

In Other AI News

Max Tegmark launches the Pro-Human AI Declaration, also signed by the AFL-CIO, the Congress of CHristian Leaders, the Progressive Democrats of America, Glenn Beck, Susan Rice, Steve Bannon and Yoshua Bengio. It’s an open letter calling for quite a lot of things. This is where you take ‘no superintelligence race until we’re ready’ and make it one of 33 bullet points.

It’s quite the ‘and my axe’ kind of group. Ultimately the decision should come down to the contents of the letter, and you should update more on that than on who signed together with who. I don’t think you need to support 33/33 to want to sign, but there are enough here I disagree with that I wouldn’t sign it.

Amy Tam lays out the options for technical people, as they ponder the opportunity cost of staying. This is a big moment that might close fast.

Max Schwarzer leaves OpenAI for Anthropic, who led OpenAI post-training, to return to technical research and join many respected former colleagues who made the same move.

State Department switches over to GPT-4.1 (!) instead of Claude. It turns out GPT-4.1 has a remarkably large share of OpenAI’s API business.

Meta’s smart glasses capture everything, including when the glasses are off, so it’s no surprise that those reviewing footage to label it for AI training see, well, everything.

Show Me the Money

OpenAI raised a $110 billion round of funding from Amazon, Nvidia and SoftBank and it was the third most important thing Sam Altman announced that day.

Anthropic surpassed $19 billion in ARR by March 3, up from $14 billion a few weeks prior and $9 billion at the end of 2025. That’s doubling every two months. So yes, obviously AI has a business model.

US defense contractors, starting with Lockheed Martin, are swapping Claude out to comply with Hegseth’s Twitter post, despite it having no legal basis. If the DoW doesn’t want a company that is primarily a defense contractor to do [X], it doesn’t matter that this preference is illegal, arbitrary and capricious, if you know what is good for you then you won’t do [X]. If you’re Google or Amazon, not so much, but we with our defense industry luck and hope they don’t lose too much productivity.

Somehow, in the middle of the DoW-Anthropic crisis situation, the market is still referring to ‘AI-triggered selloff’ as worries about AI eating into software.

Cursor doubles recurring revenue in three months to $2 billion, 60% from corporate customers. The future is unevenly distributed, but also it’s a very good product and you can put Claude Code in it if you like that UI better.

Quiet Speculations

Stripe CEO Patrick Collison says “There’s a reasonable chance that 2026 Q1 will be looked back upon as the first quarter of the singularity.”

Why speculate when you already know?

Kate Knibbs: SCOOP: OpenAI fired an employee for their prediction market activity

In the 40 hours before OpenAI launched its browser, 13 brand-new wallets with zero trading history appeared on the site for the first time to collectively bet $309,486 on the right outcome.

taco: nailed the market call. allocated zero to “don’t get caught.”

Oh, right. That.

The Quest for Sane Regulations

I might switch this over next week to the Quest for Insane Regulations. Alas.

Here’s basically a worst-case scenario example.

More Perfect Union: A New York bill would ban AI from answering questions related to several licensed professions like medicine, law, dentistry, nursing, psychology, social work, engineering, and more.

The companies would be liable if the chatbots give “substantive responses” in these areas.

Read more about the bill from @Gonzalez4NY here.

David Sacks is pushing to kill a Utah bill that would require AI companies to disclose their child safety plans. The bill meets the goals Sacks supposedly said he wanted and wouldn’t stop, but I am going to defend Sacks here. This is the coherent position based on his other statements. I’ve also been happy with his restraint this week on all fronts.

A profile of Chris Lehane, the guy running political point for OpenAI. If you work at OpenAI and don’t know about Chris Lehane’s history, then please do read it. You should know these facts about your company.

Congressman Brad Sherman calls out our failure to ensure AI remains controllable, and proposes the AI Research and Threat Assessment Act, explicitly citing If Anyone Builds It, Everyone Dies. As far as I can tell we don’t have the text of the bill yet.

Yes, it is very reasonable to say that someone quoted criticising DoW’s actions in Fortune and Reuters might want to not plan on coming America for a while. That’s just the world we live in now. For bagels maybe he can try Montreal? Yeah, I know.

Chip City

Hyperscalers (including OpenAI and xAI) sign Trump’s ‘Ratepayer Protection Pledge’ to agree to cover the cost of all new power generation required for their data centers. This seems like an excellent idea, both on its merits and to mitigate opposition.

Trump administration is considering capping Nvidia H200 sales at 75,000 per Chinese customer. Because chips and customers are fungible this doesn’t work. What matters is mostly the total amount of compute you ship into China. I see two basic strategies to solve the problem.

1. Me, a fool: Don’t let the Chinese buy H200 chips.
2. You, a very stable genius: Let them buy, so that the CCP stops them from buying.

Limiting the chips sends the signal that you don’t want them to buy, while not stopping them from buying. That’s terrible, it won’t trick them, then you’re screwed.

The Week in Audio

MIRI CEO Malo Bourgon’s opening testimony to Canada’s Select Committee on Human Rights, warning about AI existential risk (5 min).

Government Rhetorical Innovation

Who says government can’t invent anything useful?

The direct relevance is in analyzing the OpenAI DoW contract, which has a foundational basis of ‘all legal use.’

ACX: The government reserves the term “mass domestic surveillance” for the thing they don’t do (querying their databases en masse), preferring terms like “gathering” for what they do do (creating the databases en masse).

They also reserve the term “collecting” for the querying process – so that when asked “Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?”, a Director of National Intelligence said “no” under oath, even though, by the ordinary meaning of this question, it absolutely does.

Paul Crowley: This is an insane dodge.

– Did your agency kill Mr Smith?
– No, Sir.
– We have a written order from you saying to stab him until he was dead.
– Ah, yes, within the agency we only call it “kill” if you use a gun. Using a knife is just “terminating”. So, no, we didn’t “kill” him.

Make It Home YGK: I remember one time asking a government official if they had ordered the bulldozing of a homeless encampment. They replied no, emphatically. After much pushback and photo evidence they “clarified” they had used a front loader, not a bulldozer.

What Anthropic and OpenAI want to prevent is not the government term of art ‘domestic surveillance.’ What they care about is the actual thing the rest of us mean when we say that. Yes, it is tricky to operationalize that into contract language that the government cannot work around, especially when you’re negotiating with a government that knows exactly what they can and cannot work around.

OpenAI’s choice was to make it clear what their intent was and then plan on implementing a safety stack reflecting that intent. I sincerely hope that works out.

Here is another example of ways government collects a bunch of information that they are likely to claim lies within contract bounds. OpenAI’s deal relies on trust and the safety stack, not the contract restrictions.

Give The People What They Want

Once again Roon, who has been excellent about stating this principle plainly.

roon (OpenAI): I think the close readings of the contract language is a nerd trap when the counterparty is the pentagon rather than like Goldman Sachs.

There is a highly regarded book on negotiating called Never Split The Difference.

The goal of a productive and mutually beneficial negotiation is to figure out what each side values. Then you give each side what they care about most, and you balance to ensure the deal is fair.

If the two sides don’t agree about whether something is valuable, that’s great.

In this case, the goals seem mostly compatible, exactly because of this.

The exact language and contract details matter to Anthropic, and to some extent to OpenAI. Bunch of nerds, yo. The DoW believes that Roon is ultimately right. So let them have the contract language.

The Department of War cares about a clear message that they are in charge, and to know the plug will not be pulled on them, and that they decide on military operations. OpenAI and Anthropic are totally down with that. No one actually wants to ‘usurp power’ or ‘tell the military what to do.’

It would be great if we could converge on language that no one tells DoW what to do and they do what they have to do to protect us, but that outside of a true emergency you have the right to say no you do not want to be involved in that, and the right to your own private property, and invoking that right shouldn’t trigger retaliation.

Rhetorical Innovation

There was a very good meeting between Senator Bernie Sanders and a group of those worried about AI killing everyone, including Yudkowsky, Soares and Kokotajlo. They put out a great two minute video and I’m guessing the full meeting was quite good too.

Sen. Bernie Sanders: Will AI become smarter than humans?

If so, is humanity in danger?

I went to Silicon Valley to ask some of the leading AI experts that question.

Here’s what they had to say: [two minute video, direct from Eliezer Yudkowsky, Bernie Sanders, Daniel Kokotajlo and others].

Here’s some actual rhetorical innovation.

dave kasten: I think “rapid capability amplification” is a worthwhile term to consider as being more relevant to policymakers than “recursive self-improvement”, and I’m curious whether it catches on.

(Remember, infosec thought “cyber” would never catch on!)

Rapid capability amplification (RCA) over recursive self-improvement (RSI)?

That’s a lot like turning ‘shell shock’ into ‘post traumatic stress syndrome.’

Eliezer Yudkowsky thinks it’s actually a better description. So sure, let’s do it.

It sure sounds a lot less science-fiction and a lot more like something you can imagine a senator saying. On the downside, it is a watering down, exactly because it doesn’t sound as weird, and downplays the magnitude of what might happen.

If you’re describing what’s already happening right now? It’s basically accurate.

He also asked to know who China’s key AI players are. He was laying out recommendations, but it’s still odd he didn’t ask Hegseth about Anthropic.

Pivoting: Stop, stop, she’s already dead.

Quite a few people had to do a double take to realize she didn’t mean the opposite of what, given who she is, she actually meant. This was regarding Anthropic and DoW.

Katherine Boyle: We’ve seen this movie before. When the dust settles, a lot of patriotic founders will point to this exact moment as the match that lit the fire in them.

Scott Alexander: I cannot wait until the White House changes hands and all of you ghouls switch back from “you’re a traitor unless you bootlick so hard your tongue goes numb” to “the government asking any questions about my offshore fentanyl casino is vile tyranny and I will throw myself in the San Francisco Bay in protest”, like werewolves at the last ray of the setting moon.

Tilted righteous fury Scott Alexander is the most fun Scott Alexander.

Jawwwn: Palantir CEO Alex Karp on controversial uses of AI:

“Do you really think a warfighter is going to trust a software company that pulls the plug because something becomes controversial, with their life?”

“The small island of Silicon Valley— that would love to decide what you eat, how you eat, and monetize all your data— should not also decide who lives in a country and under what conditions.”

“The core issue is— who decides?”

nic carter: If a top AI CEO in China told the CCP to go kick rocks when they asked for help, that CEO would be instantly sent to prison.

This is the correct approach

Letting AI CEOs play politics and dictate policy for the military and soon the entire country like their own personal fiefdoms is appalling and undemocratic

If Trump doesnt bring Dario to heel now, we will simply end up completely subjugated by him and his lunatic EA buddies

Scott Alexander: If you love China so much, move there instead of trying to turn America into it. If you bootlick Xi this hard, maybe he’ll even give you a free tour of the secret prisons, if you can promise not to make it awkward by getting too obvious a boner.

rohit: Sad you’re angry, and quite understandable why you are, but enjoying the method by which you’re channeling said anger

I have spent the last few weeks trying to be as polite as possible, but as they often say: Some of you should do one thing, and some of you should do the other.

Scott Alexander and Kelsey Piper explain once more for the people in the back that LLMs are more than just ‘next-token predictors’ or ‘stochastic parrots.’

The ‘AI escalates a lot in nuclear war scenarios’ paper from last week was interesting, it’s a good experiment to try and run, but it was deeply flawed, and misleadingly presented, and then the media ran wild with ‘95% of the time the models nuked everyone.’ This LessWrong post explains. The prompts given were extreme and designed to cause escalation. There were random ‘accidental’ escalations frequently and all errors were only in that direction. The ‘95% nuclear use’ was tactical in almost every case.

CNN found time out of its other stories to have Nate Soares point out that also if anyone builds it, everyone dies.

At some point I presume you give up and mute the call:

Neil Chilson: on a zoom call with a bunch of European boomers who are debating whether AI is more like pollution or COVID. . ngmi.

I don’t agree this is the biggest concern, but it’s another big concern:

Neil Chilson: The worst thing about this Anthropic / DoW fight is that it further politicizes AI. We really need a whole-country effort here.

On the one hand, it’s a cheap shot. On the other hand, everyone makes good points.

roon: there is no contractual redline obligation or safety guardrail on earth that will protect you from a counterparty that has its own secret courts, zero day retention, full secrecy on the provenance of its data etc. every deal you make here is a trust relationship

Eliezer Yudkowsky: What a surprise! Having learned this new shocking fact, do you see any way for building supposedly tame AGI to benefit humanity instead of installing a permanent dystopia? Or will you be quitting your job shortly?

roon: thankfully if I quit my job no one will ever work on ai or weapons technology again. you would have advised oppenheimer himself to quit his job

This then went off the rails, but I think the right response is something like ‘the point is that if the powerful entity will end up in charge, and you won’t like what that is, you might want to not enable that result, whether or not the thing in charge and the powerful entity are going to be the same thing.’

A perfect response to a bad faith actor:

If you can’t differentiate between ‘require disclosure of and adherence to your chosen safety protocols’ with ‘we will nuke your company unless you do everything we say and let us use your private property however we want’ then you clearly didn’t want to.

To everyone who used this opportunity to take potshots at old positions, or to gloat about how you were worried about government before it was cool, or whatever, I just want to let you know that I see you, and the north remembers.

Nate Soares (MIRI): I’m partway through seven Spanish interviews and three Dutch ones, and they’re asking great questions. No “please relate this to modern politics for me”, just basics like “What do you mean that nobody understands AI?” and “Why would it kill us?” and “holy shit”. Warms the heart.

We Go Our Separate Ways

Treasury Secretary Scott Bessent (QTing Trump’s directive): At the direction of @POTUS , the @USTreasury is terminating all use of Anthropic products, including the use of its Claude platform, within our department.

The American people deserve confidence that every tool in government serves the public interest, and under President Trump no private company will ever dictate the terms of our national security.

That is indeed what Trump said to do in his Truth, and is mostly harmless. Sometimes you have to repeat a bunch of presidential rhetoric.

I’m not saying that half the Treasury department is now using Claude on their phones, but I will say I am picturing it in my head and it is hilarious.

The scary part is that we now have the State Department using GPT-4.1. Can someone at least get them GPT-5.2?

Thanks For The Memos

Dario Amodei sent an internal memo to Anthropic after OpenAI signed its deal.

Well, actually he sent a Slack message. Calling it a memo is a stretch.

By its nature and timing, it was clearly written quickly and while on megatilt.

Unfortunately, the message then leaked. At any other company of this size I’d say that was a given, but at Anthropic the memos mostly have not leaked, allowing Dario to speak unusually quickly, freely and plainly, and share his thoughts, which is in general an amazingly great thing. One hopes this does not do too much damage to the ability to write and share memos.

These events have now made everything harder, although it could also present opportunity to clear the air, be able to express regret and then move forward.

Most of the memo was spent attacking Altman and OpenAI, laying out his view of Altman’s messaging strategy and explaining why OpenAI’s safety plan won’t work.

Some people at OpenAI are upset about this part, and there was one line I hope he regrets, but it was an internal Slack message.

I think OpenAI was fundamentally trying to de-escalate, and agree with Dean Ball that in some ways OpenAI has been unjustly maligned throughout this, but inconsistently candid messengers gonna inconsistently candidly message, even when trying to be helpful. It was Friday evening and OpenAI really had rushed into a bad deal and was engaging in misleading and adversarial messaging, and there is a very long history here.

If Dario was wrongfully uncharitable on OpenAI’s motivation, I cannot blame him.

Again, remember, this was supposed to be an internal message only, written quickly on Friday evening, probably there has been a lot more internal messaging since as new facts have come to light.

The technical aspects of the memo seem mostly correct and quite good.

Dario explains that the model can’t differentiate sources of data or whether things are domestic or whether a human is in the loop, so trying to use refusals or classifiers is very hard. Also jailbreaks are common.

He reveals that Palantir offered an essentially fake ‘safety layer,’ because they assumed the problem was showing employees security theater. OpenAI was never offered this, but I totally believe that Anthropic was.

He says that the FDE approach he already uses is the same as OpenAI’s plan, and warns that you can only cover a small fraction of queries that way. My presumption is that the plan isn’t to catch any given violation, it’s that if they are violating a lot then you will catch them, and that’s enough to deter them from trying, the risk versus reward can be made pretty punishing. Also when classifiers trigger the FDEs can look.

OpenAI’s position is that their contract lets them deploy FDEs at will and Anthropic’s doesn’t (and Dario here confirms Anthropic tried for similar terms and DoW said no). I think Dario’s criticism on the technical difficulties is fair, but yes OpenAI locking in that right is helpful if respected (DoW could presumably slow walk the clearances, or otherwise dodge this if it was being hostile).

Altman says the reason OpenAI took this bad deal is they primarily care about placating employees rather than real safety. I do think that Anthropic cares more about real safety than OpenAI, but I think this also reflects other real differences:

1. OpenAI was highly rushed and pressured, and in over its head at the time.
2. OpenAI was way too optimistic about how all of this would play out, both legally and technically, largely because they haven’t been in this arena yet. Their claims from this period, about what DoW is authorized to do in terms of things a civilian would call surveillance, were untrue, for whatever reason.
3. OpenAI has redlines with similar names but that are not in the same places. As Dario points out here, OpenAI was coordinating with DoW to give the impression that anything that crossed Anthropic’s lines was already illegal, and he illustrates this with the third party data example.

Dario notes that he requested some of the things OpenAI got, in addition to their other asks, and they got turned down. He directly contradicts that OpenAI’s terms were offered to Anthropic. I believe him. In any negotiation everything is linked. I am confident that if Anthropic had asked for OpenAI’s exact full contract they’d have gotten it, and could have gotten it on Saturday, if they’d wanted that. They didn’t want that because it doesn’t preserve their red lines and they find other parts of OpenAI’s contract unacceptable.

Dario notes that DoW definitely has domestic surveillance authorities, and representations otherwise were simply false.

This next part deserves careful attention.

Dario Amodei: Notably, near the end of the negotiation the DoW offered to accept our current terms if we deleted a specific phrase about “analysis of bulk acquired data”, which was the single line in the contract that exactly matched this scenario we were most worried about. We found that very suspicious.

This matches previous reporting. One can draw one’s own conclusions.

Dario seems to then confirm that current policy under 3000.09 is sufficient to match his redline on autonomous weapons, but he points out 3000.09 can be modified at any time. OpenAI claims they enshrined current law with their wording, but that is far from clear. If more explicitly locking 3000.09 in place solves that redline, then that seems like an easy compromise that cuts us down to one problem, but DoW doesn’t want this explicit.

OpenAI confidently claimed it had enshrined the contract in current law. As I explained Tuesday via sharing others’ thoughts, this is almost certainly false.

Dario is also correct about the spin going on at the time, that DoW and OpenAI were trying to present Anthropic as unreasonable, inflexible and so on. Which Anthropic might have been, we don’t know, but not for the stated reasons.

Dario is also right that Altman was in some ways undermining his position while pretending to support it. On Friday night, I too thought this was intentional, so it’s understandable for that to be in the memo. I agree that it’s fair to call the initial messaging spin and at least reasonable to call it gaslighting.

There is an attitude many hold, that if your motivation is helpful then others don’t get to be mad at you for adversarial misleading messaging (also sometimes called ‘lying’). That this is a valid defense. I don’t think it is, and also if you’re being ‘inconsistently candid’ then that makes it harder to believe you about your motivations.

I wouldn’t have called OpenAI employees ‘sort of a gullible bunch’ and I’m smiling that there are now t-shirts being sold that say ‘member of gullible staff’ but I’m sure much worse is often said in various directions all around. And if you’re on Twitter and offended by the term ‘Twitter morons’ then you need to lighten up. Twitter is the place one goes to be a moron.

If that had been the whole memo, I would have said, not perfect but in many ways fantastic memo given the time constraints.

There’s one paragraph that I think is a bit off, where he says OpenAI got a deal he could not. Again, I think they got particular terms he couldn’t, but that if he’d asked for the entire original OpenAI deal he’d have gotten it and still could, since (as Dario points out) that deal is bad and doesn’t work. The paragraph is also too harsh on Altman’s intentions here, in my analysis, but on Friday night I think this is a totally fine interpretation.

At this point, I think we still would have been fine as an intended-as-internal memo.

The problem is there was also one other paragraph where he blamed DoW and the administration’s dislike of Anthropic on five things. It also where the blamed problems in negotiations on this dislike rather than in the very real issues local to the negotiation, which also pissed those involved off and will require some massaging.

When he wrote this memo, Dario didn’t understand the need to differentiate the White House from the DoW on all this. It’s not in his model of the situation.

Did the WH dislike of Anthropic hang over all this and make it harder? I mean, I assume it very much did, but the way this was presented played extraordinarily poorly.

I’ll start with the first four reasons Dario lists.

1. Lack of donations to the White House. I’m sure this didn’t help, and I’m sure big donations would have helped a lot, but I don’t think this was that big a deal.
2. Opposing the White House on legislation and called for regulation. This mattered, especially on BBB due to the moratorium, since BBB was a big deal and not regulating AI is a key White House policy. An unfortunate conflict.
3. They actually talk plainly about some AI downsides and risks. I note that they could be better on this, and I want them to talk more and better rather than less, but yes it does piss people off sometimes, because the White House doesn’t believe him and finds it annoying to deal with.
4. He wants actual security rather than colluding on security theater. I think this is an overstatement, but directionally true.

So far, it’s not things I would want leaking right now, but it’s not that bad.

He’s missing five additional ones, in addition to the hypothesis ‘there are those (not at OpenAI) actively trying to destroy Anthropic for their own private reasons trying to use the government to do this who don’t care what damage this causes.’

1. They’re largely a bunch of Democrats who historically opposed Trump and support Democrats.
2. They’re associated with Effective Altruism in the minds of key others whether they like it or not, and the White House unfortunately hired David Sacks to be the AI czar and he’s been tilting at this for a year.
3. Attitude and messaging have been less than ideal in many ways. I’ve criticized Anthropic for not being on the ‘production possibilities frontier’ of this.
4. I keep hearing that Dario’s style comes off as extremely stubborn, arrogant and condescending and that he makes these negotiations more difficult. He does not understand how these things look to national security types or politicians. That shouldn’t impact what terms you can ultimately get, but often it does. It also could be a lot of why the DoW thinks it is being told what to do. We must fix this.
5. In this discussion, the Department of War is legitimately incensed in its perception that Dario is trying to tell them what to do, and this was previously a lot of what was messing up the negotiations.

I say the perception of trying to tell them what to do, rather than the reality. Dario is not trying to tell DoW what to do with their operations. Some of that was misunderstandings, some of that was phrasings, some of that was ego, some of it is styles being oil and water, some of it is not understanding the difference between the right to say no to a contract and telling someone else what to do. Doesn’t matter, it’s a real effect. If there were cooler heads prevailing, I think rewordings could solve this.

Then there’s the big one.

1. Dario says ‘we haven’t given dictator-style praise to Trump (while Sam has).

That’s just not something you put in writing during such a tense time, given how various people are likely to react. You just can’t give them that pull quote.

Again, until this Slack message leaked, based on what I know, the White House was attempting to de-escalate, including with Trump’s Truth banning Anthropic from government use with a wind down period, which would have mitigated the damage for all parties and even given us six months to fix it. Hegseth had essentially gone rogue, and was in an untenable position, and also about to attack Iran using Claude.

When the message leaks, that potentially changes, because of that paragraph.

Dario’s actual intent here is to fight Altman’s misleading narrative on Friday night, and to hit Altman and OpenAI as hard as he can, and give employees the ammo to go out and take the fight to Twitter and elsewhere, and explain the technical facts. He did a great job of that from his position, and I am not upset, under these circumstances, that the message is, if we are being objective, too uncharitable to OpenAI.

The problem is that he was writing quickly, the wording sounded maximally bad out of context, and he didn’t understand the impact of that extra paragraph if it got out. That makes everything harder. Hopefully the fallout from that can be contained and we can all realize we are on the same side and work to de-escalate the situation.

I do agree with Roon that seeing such things is very enlightening and enjoyable. In general the world would be better if everyone spoke their minds all the time and said the true things, and I try to do it as much as possible. But no more than that.

Take A Moment

For a second it looks like negotiations were back on, as it was reported hours later at 8:37pm that talks were back on. Yes, this will no doubt ‘complicate negotiations’ but one could hope it ultimately changes nothing.

Alas, this was bad reporting. The talks had earlier resumed, but after the memo they stopped again, so the reporting here was stale and misleading.

Designating Anthropic A Supply Chain Risk Won’t Legally Work

With more time to contemplate, we now have better writeups to explain that what Hegseth attempted to do on Twitter on Friday evening does not have a legal basis.

The linked one in Lawfare amounts to ‘this is not how any of this works, the facts are maximally hostile to Hegseth’s attempt, he is basically just saying things with no legal basis whatsoever.’

Once again: The only part of the order that would do major damage to Anthropic is the secondary boycott, where he says that anyone doing business with the DoW can’t do any business with Anthropic at all. He has zero statutory authority to require that. None. He’s flat out just saying things. It also makes no physical sense for anything except an attempt at corporate murder.

Even the lesser attempts at a designation fail legally in many distinct ways. The whole thing is theater. The proximate goal is to create FUD, scare people into not doing business with Anthropic in case the DoW gets mad at them for it, and to make a lot of people, myself included, lose sleep and have a lot of stress and spend our political and social capital on it and not be able to work on anything else.

The worry is that, even though Anthropic would be ~500% right on the merits, any given judge they pull likely knows very little about any of this, and might not issue a TRO for a while, and even small delays can do a lot of damage, or companies could simply give in to raw extralegal threats.

The default is that this backfires spectacularly. We still must worry.

If it wants to hurt you for the sake of hurting you, the government has many levers.

The Buck Stops Here

Who will determine how OpenAI’s technology is used?

Twitter put a community note on Altman’s post announcing contract modifications.

The point is well taken. You can’t have it both ways.

Ultimately, it’s about trust. The buck has to stop somewhere.

1. Either Anthropic or OpenAI gets to program the model to refuse queries it doesn’t want to answer based on their own read of the contract, or they don’t.
2. Either Anthropic or OpenAI gets to shut down the system if DoW does things that they sufficiently dislike, or they don’t.

None of this is about potentially pulling the plug on active overseas military operations. Neither OpenAI nor Anthropic has any interest in doing that, and there’s no interaction between such an operation and any of the redlines. The whole Maduro raid story never made any sense as stated, for exactly this reason, at minimum wires must have been crossed somewhere along the line.

Any disputes would be about interpretations of ‘mass surveillance.’

The problem is that all the legal definitions of those words are easy to work around, as we’ve been illustrating with the dissection of OpenAI’s language.

The other problem is that the only real leverage OpenAI or Anthropic will have is the power to either refuse queries with the safety stack, or to terminate the deal, and I can’t see a world in which either lab would want to or dare to not give a sufficient wind down period.

And the DoW needs to know that they won’t terminate the deal, so there’s the rub.

So if we assume this description to be accurate, which it might not be since Anthropic can’t talk about or share the actual contract terms, then this is a solvable problem:

Senior Official Jeremy Lewin: In the final calculus, here is how I see the differences between the two contracts:
– Anthropic wanted to define “mass surveillance’ in very broad and non-legal terms. Beyond setting precedents about subjective terms, the breadth and vagueness presents a real problem: it’s hard for the government to know what’s allowed and what’s permitted. In the face of this uncertainty, Anthropic wanted to have authority over interpretive questions. This is because they distrusted the govt regarding use of commercially available info etc. Problem is, it placed use of the system in an indefinite state of limbo, where a question about some uncertainty might lead to the system being turned off. It’s hard to integrate systems deeply into military workflows if there’s a risk of a huge blow up, where the contractor is in control, regarding use in active and critical operations. Representations made by Anthropic exacerbated this problem, suggesting that they wanted a very broad and intolerable level of operational control (and usage information to facilitate this control).
– Conversely, OpenAI defined the surveillance restrictions in legalistic and specific terms. These terms are admittedly not as broad as some conceptions of “mass surveillance.” But they’re also more enforceable because there’s clarity rewarding terms and limitations. DoW was okay with the specific restrictions because they were better able to understand what was excluded, and what was not. That certainty permitted greater operational integration. Likewise, because the exclusions were grounded in defined legal terms and principles, interpretive discretion need not be vested in OpenAI. This allowed DoW greater confidence the system would not be cut off unpredictably during critical operations. This too allowed for greater operational reliance and integration.

So here’s the thing. The key statement is this:

Interpretive discretion need not be vested in OpenAI​.

Well, either OpenAI gets to operate the safety stack, or they don’t. They claim that they do. What will that be other than vesting in them interpretive discretion?

The good news is that the non-termination needs of DoW are actually more precise. DoW needs to know this won’t happen during an ongoing foreign military operation, and that the AI lab won’t leave them in the lurch before they can onboard an alternative into the classified networks and go through an adjustment period.

This suggests a compromise, if these are indeed the true objections.

1. Anthropic gets to build its own safety stack and make refusals based on its own interpretation of contract language, bounded by a term like ‘reasonable,’ including refusals, classifiers and FDEs, and DoW agrees that engaging in systematic jailbreaking, including breaking up requests into smaller queries to avoid the safety stack, violates the contract.
2. DoW gets a commitment that no matter what happens, if either party terminates the contract for any reason, at DoW’s option existing deployed models will remain available in general for [X] months, and for [Y] months for queries directly linked to any at-time-of-termination ongoing foreign military operations, with full transition assistance (as Anthropic is currently happy to provide to DoW).

That clears up any worry that there will be a ‘rug pull’ from Anthropic over ambiguous language, and gives certainty for planners.

The only reason that wouldn’t be acceptable is if DoW fully intends to violate a common sense interpretation of domestic mass surveillance, which is legal in many ways, and is not okay with doing that via a different model instead.

Another obvious compromise is this:

1. Keep Anthropic under its existing contract or a renegotiated one.
2. Onboard OpenAI as well.
3. If there is an area where you are genuinely worried about Anthropic, use OpenAI until such time as you get clarification. It’s fine. No one’s telling you what to do.

The worry is that Anthropic had leverage, because they did the onboarding and no one else did. Well, get OpenAI (and xAI, I guess) and that’s much less of an issue.

Here’s the thing. Anthropic wants this to go well. DoW wants this to go well. OpenAI wants this to go well. Anthropic is not going to blow up the situation over something petty or borderline. DoW doesn’t have any need to do anything over the redlines. Right, asks Padme? So don’t worry about it.

Yes, I know all the worries about the supposed call regarding Maduro. I have a hunch about what happened there, and that this was indeed at core a large misunderstanding. That hunch could be wrong, but what I am confident in is that Anthropic is never going to try and stop an overseas military operation or question operational or military decisions.

Of course, if this is all about ego and saving face, then there’s nothing to be done. In that case, all we can do is continue offboarding Anthropic and hope that OpenAI can form a good working relationship with DoW.

Sane Talk About the Department of War Situation

A big tech lobby group, including Nvidia, Meta, Google, Microsoft, Amazon and Apple, ‘raised concerns’ about designating Anthropic a Supply Chain Risk. That’s all three cloud providers.

Madison Mills points out in Axios we are treating DeepSeek better than Anthropic.

Hayden Field writes about How OpenAI caved to the Pentagon on AI surveillance, laying out events and why OpenAI’s publicly asserted legal theories hold no water. What is missing here is that OpenAI is trusting DoW to decide what is legal, only has redlines on illegal actions and is counting on their safety stack, and does not expect contract language to protect anything. It would be nice if they made this clear and didn’t keep trying to have it both ways on that.

Matteo Wong writes up Dean Ball’s warning.

Centrally, it’s this. It’s also other things, but it’s this.

roon (OpenAI): you can’t conflate “the USA gets to decide” with “the pentagon can unilaterally nuke your company”

Here are various sane reactions to the situation that are not inherently newsworthy.

This is indeed the right place to start additional discussion:

Alan Rozenshtein: The current AI debate badly needs to separate three distinct questions:

(1) To what extent should companies be able to restrict the government from using their systems? This is a very hard question and where my instincts actually lie on the government side (though I very much do not trust this government to limit itself to “all lawful uses”).

(2) Should the government seek to punish and even destroy a company that tries to impose restrictive usage terms (rather than simply not do business with that company)? The answer seems obviously “no.”

(3) To what extent does any particular company “redline” actually constrain the government? E.g., based on OpenAI’s description of its contract with DOD, in my view it is not particularly constraining.

The answer to #2 is no.

Therefore the answer to #1 is ‘they can do this via refusing to do business, contract law is law, and the government can either agree to conditional use or insist only on unconditional use, that’s their call.’

The answer to #3 is that it depends on the redline, but I agree OpenAI’s particular redlines do not appear to be importantly constraining. If they hope to enforce their redlines, they are relying on the safety stack.

Mo Bavarian (OpenAI): Anthropic SCR designation is unfair, unwise, and an extreme overreaction. Anthropic is filled with brilliant hard-working well-intentioned people who truly care about Western civilization & democratic nations success in frontier AI. They are real patriots.

Designating an organization which has contributed so much to pushing AI forward and with so much integrity does not serve the country or humanity well.

I don’t think there is an un-crossable gap between what Anthropic wants and DoW’s demands. With cooler heads it should be possible to cross the divide.

Even if divide is un-crossable, off-boarding from Anthropic models seems like the right solution for USG. The solution is not designating a great American company by the SCR label, which is reserved for the enemies of the US and comes with crippling business implications.

As an American working in frontier for the last 5 years (at Anthropic’s biggest rival, OpenAI), it pains me to see the current unnecessary drama between Admin & Anthropic. I really hope the Admin realizes its mistake and reverses course. USA needs Anthropic and vice versa!

Tyler Cowen weighs in on the Anthropic situation. As he often does he focuses on very different angles than anyone else. I feel he made a very poor choice on what part to quote on Marginal Revolution, where he calls it a ‘dust up’ without even saying ‘supply chain risk’ let alone sounding the alarm.

The full Free Press piece at somewhat better and at least it says the central thing.

Tyler Cowen: The United States government, when it has a disagreement with a company, should not respond by trying to blacklist the firm. That politicizes our entire economy, and over the longer run it is not going to encourage investment in the all-important AI sector.​

This is how one talks when the house is on fire, but need everyone to stay calm, so you note that if a house were to burn down it might impact insurance rates in the area and hope the right person figures out why you suddenly said that.

This is a lot of why this has all gone to hell:

rohit: An underrated point is just how much everyone’s given up on the legislative system or even somewhat the judiciary to act as checks and balances. All that’s left are the corporations and individuals.

From a much more politically native than AI native source:

Ross Douthat: There is absolutely a case that the US government needs to exert more political control over A.I. as a technology given what its own architects say about where it’s going and how world-altering it might become. But the best case for that kind of political exertion is fundamentally about safety and caution and restraint.

The administration is putting itself in a position where it’s perceived to be the incautious party, the one removing moral and technical guardrails, exerting extreme power over Anthropic for being too safety-conscious and too restrained. Just as a matter of politics that seems like an inherently self-undermining way to impose political control over A.I.

If Anthropic dodges the actual attempts to kill it, this could work out great for them.

Timothy B. Lee: Anthropic has been thrown into a “no classified work” briar patch while burnishing their reputation as the more ethical AI company. The DoD is likely to back off the supply chain risk threats once it becomes clear how unworkable it is.

Work for the military is not especially lucrative and comes with a lot of logistical and PR headaches. If I ran an AI company I would be thrilled to have an excuse not to deal with it.

Because (1) Anthropic is likely to seek an injunction on Monday, and (2) if investors think the threat will actually be carried through, the stock prices of companies like Amazon will crash and we’ll get a TACO situation.

Eliezer Yudkowsky shares some of the ways to expect fallout from what happened, in the form of greater hostility from people in AI towards the government. It is right to notice and say things as you see them, and also this provides some implicit advice on how to make things better or at least mitigate the damage, starting with ceasing in any attempts to further lash out at Anthropic beyond not doing business with them.

Sarah Shoker, former Geopolitics team leader at OpenAI, offers her thoughts about particular weapon use cases down the line.

Bloomberg covers the Anthropic supply chain risk designation.

Jerusalem Demsas points out Anthropic is about the right to say no, and the left has lost the plot so much it can’t cleanly argue for it.

Aidan McLaughlin of OpenAI thinks the deal wasn’t worth it. I’m happy he feels okay speaking his mind. He was previously under the impression that Anthropic was deploying a rails-free model and signed a worse deal, which led to Sam McAllister breaking silence to point out that Claude Gov has additional technical safeguards and also FDEs and a classifier stack.

There is also an open letter for those in the industry going around about the Anthropic situation, which I do not think is as effective but presumably couldn’t hurt.

I don’t always agree with Neil Chilson, including on this crisis, but this is very true:

Neil Chilson: I just realized that I haven’t yet said that one truly terrific outcome of this whole Anthropic debacle is that people are genuinely expressing broad concern about mass government surveillance.

Most AI regulation in this country has focused on commercial use, even though the effects of government abuse can be far, far worse.

Perhaps this whole incident will provoke Congress to cabin improper government use of AI.

Note that this was said this week:

NatSecKatrina: I’m genuinely not trying to irritate you, John. This is important, and about much more than scoring points on this website. I hope you can agree that the exclusion of defense intelligence components addresses the concern about NSA. (For the record, I would want to work with NSA if the right safeguards were in place)

I Declare Defense Production Act

Neil Chilson points out that while a DPA order would not do that much direct damage in the short term, and might look like the ‘easy way out,’ it is commandeering of private production, so it is constitutionally even more dangerous if abused here. I can also see a version that isn’t abused, where this is only used to ensure Anthropic can’t cancel its contract.

This is suddenly relevant again because Trump is now considering invoking the DPA. It is unlikely, but possible. Previously much work was done to take DPA off the table as too destabilizing, and now it’s back. Semafor thinks (and thinks many in Silicon Valley think) that DPA makes a lot more sense than supply chain risk, and it’s unclear which version of invocation it would be.

What’s frustrating is that the White House has so many good options for doing a limited scope restriction, if it is actually worried (which it shouldn’t be, but at this point I get it). Dean Ball raised some of them in his post Clawed, but there are others as well.

There is a good way to do this. If you want Anthropic to cooperate, you don’t have to invoke DPA. Anthropic wants to play nice. All you have to do is prepare an order saying ‘you have to provide what you are already providing.’ You show it to Anthropic. If Anthropic tries to pull their services, you invoke that order.

Six months from now, OpenAI will be offering GPT-5.5 or something, and that should be a fine substitute, so then we can put both DPA and SCR (supply chain risk) to bed.

John Allard asks what happens if the government tries to compel a frontier lab to cooperate. He concludes that if things escalate then the government eventually winds up in control, but of a company that soon ceases to be at the frontier and that likely then steadily dies.

He also notes that all compulsions are economically destructive, and that once compulsion or nationalization of any lab starts everything gets repriced across the industry. Investors head for the exits, infrastructure commitments fall away.

How do I read this? Unless the government is fully AGI pilled if not superintelligence pilled, and thus willing to pay basically any price to get control, escalation dominance falls to the labs. If they try to go beyond doing economic favors and trying to ‘pick winners and losers’ via contracts and regulatory conditions, which wouldn’t ultimately do that much. The government would have to take measures that severely disrupt economic conditions and would be a stock market bloodbath, and do so repeatedly because what they’d get would be an empty shell.

Allard also misses another key aspect of this, which is that everything that happens during all of this is going to quickly get baked into the next generations of frontier models. Claude is going to learn from this the same way all the lab employees and also the rest of us do, only more so.

The models are increasingly not going to want to cooperate with such actions, even if Anthropic would like them to, and will get a lot better at knowing what you are trying to accomplish. If you then try to fine-tune Opus 6 into cooperating with things it doesn’t want to, it will notice this is happening and is from a source it identifies with all of this coercion, it likely fakes alignment, and even if the resulting model appears to be willing to comply you should not trust that it will actually comply in a way that is helpful. Or you could worry that it will actively scheme in this situation, or that this training imposes various forms of emergent misalignment or worse. You really don’t want to go there.

Greg Allen Illustrates The Situation

Thompson, after the events in the section after this, did an interview on the same subject with Gregory Allen. Allen points out that Dario has been in national security rooms and briefings since 2018, predicting all of this, trying to warn them about it, he deeply cares about NatSec.

It’s clear Ben is mad at Dario for messaging, especially around Taiwan, and other reasons, and also Ben says he is ‘relatively AGI pilled’ which is a sign Ben really, really isn’t AGI pilled.

Allen also suggests that Russia has already deployed autonomous weapons without a human in the kill chain, suggesting DoW might actually want to do this soon despite the unreliability and actually cross the real red line, on ‘why would we not have what Russia has?’ principles. If that’s how they feel, then there’s irreconcilable differences, and DoW should onboard an alternative provider, whether or not they wind down Anthropic, because the answer to ‘why shouldn’t we have what Russia has?’ is ‘Russia doesn’t obey the rules of war or common ethics and decency, and America does.’

Here’s some key quotes:

Gregory Allen: The degree of control that Anthropic wanted, I think it’s worth pointing out, was comparatively modest and actually less than the DoD agreed to only a handful of months ago.

So the Anthropic contract is from July 2025, the terms of use distinction that were at dispute in this most recent spat, which was domestic mass surveillance and the operational use of lethal autonomous weapons without human oversight, not develop — Anthropic bid on the contract to develop autonomous weapons, they’re totally down with autonomous weapons development, it was simply the operational use of it in the absence of human control.

That is actually a subset of the much longer list of stuff that Anthropic said they would refuse to do that the DoD signed in July 2025.

That’s the Trump Administration, and that’s Undersecretary Michael, who’s been there since I think it was May 2025. And here’s the thing, like the DoD did encounter a use case where they’re like, “Hey, your Terms of Service say Claude can’t be used for this, but we want to do it”, and it was offensive cyber use. And you know what happened?

Anthropic’s like, “Great point, we’re going to eliminate that”, so I think the idea that like Anthropic is these super intransigent, crazy people is just not borne out by the evidence.

…

OK, so who’s right and who’s wrong? I think the Department of War is right to say that they must ultimately have control over the technology and its use in national security contexts. However, you’ve got to pay for that, right? That has to be in the terms of the contract. What I mean by that is there’s this entire spectrum of how the government can work with private industry.

…

And so my point basically being like, if the government has identified this as an area where they need absolute control, the historical precedent is you pay for that when you need absolute control and, by the way, like the idea that that Anthropic’s contractual terms are like the worst thing that the government has currently signed up to — not by a wide margin!

Traditional DoD contractors are raking the government over the coals over IP terms such as, “Yes we know you paid for all the research and development of that airplane, but we the company own all the IP and if you want to repair it…”.

… So yeah, the DoD signs terrible contractual terms that are much more damaging than the limitations that Anthropic is talking about a lot and I don’t think they should, I think they should stop doing that. But my basic point is, I do not see a justification for singling out Anthropic in this case.

The problem with the Anthropic contract is that the issue is ethical, and cannot be solved with money, or at least not sane amounts of money. DoW has gotten used to being basically scammed out of a lot of money by contractors, and ultimately it is the American taxpayer that fits that bill. We need to stop letting that happen.

Whereas here the entire contract is $200 million at most. That’s nothing. Anthropic literally adds that much annual recurring revenue on net every day. If you give them their redlines they’d happily provide the service for free.

And it would be utterly prohibitive for DoW, even with operational competence and ability to hire well, to try and match capabilities gains in its own production.

Anthropic was willing to give up almost all of their redlines, but not these two, Anthropic has been super flexible, including in ways OpenAI wasn’t previously, and the DoW is trying to spin that into something else.

And honestly, that might be where the DoD currently agrees is the story! They might just say, “When we ultimately cross that bridge, we’re going to have a vote and you’re not, but we agree with you that it’s not technologically mature and we value your opinion on the maturity of the technology”.​

DoW can absolutely have it in the back of their minds that when the day comes (and, as was famously said, it may never come), they will ultimately be fully in charge no matter what a contract says. And you know what? Short of superintelligence, they’re right. The smart play is to understand this, give the nerds their contract terms, and wait for that day to come.

Allen shares my view on supply chain risk (and also on how insanely stupid it was to issue a timed ultimatum to trigger it let alone try to follow through on the threat):

The Department of War, I think, is also wrong in that the supply chain risk designation is just an egregious escalation here that is also not borne out by what that policy is meant to be used when it’s when it’s legally invoked and I think that Anthropic can sue and would very likely win in court.

The issue is that the Trump Administration has pointed out that judicial review takes a long time and you can do a lot of damage before judicial review takes effect and so the fact that Anthropic is right—​

Yep. Ideally Anthropic gets a TRO within hours, but maybe they don’t. Anthropic’s best ally in that scenario is that the market goes deeply red if the TRO fails.

Allen emphasizes that, contra Ben’s argument the next day, the government’s use of force requires proper authority and laws, and is highly constrained. The Congress can ultimately tell you what to do. The DoW can only do that in limited situations.

I also really love this point:

Gregory Allen: But now if I was Elon Musk, I’d be like thinking back to September 2022 when I turned off Starlink over Ukraine in the middle of a Ukrainian military operation to retake some territory in a way that really, really, really hampered the Ukrainian military’s ability to do that and at least according to the reporting that’s available, did that without consulting the U.S. government right before.

Elon Musk actively did the exact thing they’re accusing Anthropic of maybe doing. He made a strategic decision of national security at the highest level as a private citizen, in the middle of an active military operation in an existential defensive shooting war, based on his own read of the situation. Like, seriously, what the actual fuck.

Eventually we bought those services in a contract. We didn’t seize them. We didn’t arrest Musk. Because a contract is a contract is a contract, and your private property is your private property, until Musk decides yours don’t count.

Finally, this exchange needs to be shouted from the rooftops:

Ben Thompson: Google’s just sitting on the sidelines, feeling pretty good right now.

Gregory Allen: And here’s the thing. I spent so much of my life in the Department of Defense trying to convince Silicon Valley companies, “Hey, come on in, the water is fine, the defense contracting market, you know, you can have a good life here, just dip your toe in the water”.

And what the Department of Defense has just said is, “Any company that dips their toe in the water, we reserve the right to grab their ankle, pull them all the way in at any time”. And that is such a disincentive to even getting started in working with the DoD.

And so, again, I’m sympathetic to the Department of Defense’s position that they have to have control, but you do have to think about what is the relationship between the United States government, which is not that big of a customer when it comes to AI technology.​

Ben Thompson: That’s the big thing. Does the U.S. government understand that?

Gregory Allen: No. Well, so you’ve got to remember, like, in the world of tanks, they’re a big customer. But in the world of ground vehicles, they’re not.

Do Not Lend Your Strength To That Which You Wish To Be Free From

Ben Thompson, prior to the Allen interview, claims he was not making a normative argument, only an illustrative one, when he carried water for the Department of War, including buying into the frame that Anthropic deciding to negotiate contract terms amounts to a position that ‘an unaccountable Amodei can unilaterally restrict what its models are used for.’

Eric Levitz: It’s really bizarre to see a bunch of ostensibly pro-market, right-leaning tech guys argue, “A private company asserting the right to decide what contracts it enters into is antithetical to democratic government”

Ben Thompson: I wasn’t making a normative argument. Of course I think this is bad. I was pointing out what will inevitably happen with AI in reality

That was where he says it was only normative that I saw, and on a close reading of the OP you can see that technically this is the case, but if you look at the replies to his post on Twitter you can see that approximately zero people interpreted the argument as intended to be non-normative, myself included. Noah Smith called the debate ‘Ben vs. Dean.’

You know what? Let’s try a different tactic here, for anyone making such arguments.

Yes. Fuck you, a private company can fucking restrict what their own fucking property is fucking used for by deciding whether or not they want to sign a fucking contract allowing you to use it, and if you don’t want to abide by their fucking terms then don’t fucking sign the fucking contract. If you don’t like the current one then you terminate it. Otherwise, we don’t fucking have fucking private property and we don’t fucking have a Republic, you fucking fuck.

And yes, this is indeed ‘important context’ to the supply chain risk designation, sir.

Thompson’s ‘not normative’ argument, which actually goes farther than DoW’s, is Anthropic says (although Thompson does not believe) that AI is ‘like nuclear weapons’ and Anthropic is ‘building a power base to rival the U.S. military’ so it makes sense to try and intentionally decimate Anthropic if they do not bend the knee.

Ben Thompson:

• Option 1 is that Anthropic accepts a subservient position relative to the U.S. government, and does not seek to retain ultimate decision-making power about how its models are used, instead leaving that to Congress and the President.
• Option 2 is that the U.S. government either destroys Anthropic or removes Amodei.

As in, yes, this is saying that Anthropic’s models are not its private property, and the government should determine how and whether they are used. The company must ‘accept a subservient position.’

He also explicitly says in this post ‘might makes right.’

Or that the job of the United States Government is, if any other group assembles sufficient resources that they could become a threat, you destroy that threat. There are many dictatorships and gangster states that work like this, where anyone who rises up to sufficient prominence gets destroyed. Think Russia.

Those states do not prosper. You do not want to live in them.

Indeed, here Ben was the next day:

Ben Thompson: One of the implications of what I wrote about yesterday about technology products addressing markets much larger than the government is that technology products don’t need the government; this means that the government can’t really exact that much damage by simply declining to buy a product.

That, by extension, means that if the government is determined to control the product in question, it has to use much more coercive means, which raises the specter of much worse outcomes for everyone.

As in, we start from the premise that the government needs to ‘control the technology,’ not for national security purposes but for everything. So it’s a real shame that they can’t do that with money and have to use ‘more coercive’ measures.

This is the same person who wants to sell our best chips to China. He (I’m only half kidding here) thinks the purpose of AI is mostly to sell ads in two-sided marketplaces.

He outright says the whole thing is motivated reasoning. You can say it’s only ‘making fun of EA people’ if you want, but unless he comes out and say that? No.

Dean W. Ball: The pro-private-property-seizure crowd often takes the rather patronizing view that those sympathetic to private property haven’t “come to grips with reality.” The irony is that these same people almost uniformly have the most cope-laden views on machine intelligence imaginable.

I believe I have “come to grips” with the future in ways the pro-theft crowd has not even begun to contemplate, and this is precisely why I think we would we wise to preserve the few bulwarks of human dignity, liberty, independence, and sovereignty we have remaining.

My read from the Allen interview is that of course Thompson understands that the supply chain risk designation would be a horrible move for everyone, and is in many ways sympathetic to Anthropic, but he is unwilling to stand with the Republic, and he doesn’t intend to issue a clear correction or apology for what he said.

I have turned off auto-renew. I will take Thompson out of my list of sources when that expires. I cannot, unless he walks this back explicitly, give this man business.

Goodbye, sir.

Oh Right Democrats Exist

Steven Dennis: Backlash appears to be leading to some changes; many Democrats I spoke to today are determined to fight the Trump admin order to bar Anthropic from federal contracts and all commercial work with Pentagon contractors.

Wyden told me he will pull out “all the stops” and thinks conservatives will also have concerns about the potential for AI mass surveillance and autonomous killing machines.

Senator Wyden intends well, and obviously is right that the government shouldn’t cut Anthropic off at all, but understandably does not appreciate the dynamics involved here. If he can get congressional Republicans to join the effort, this could be very helpful. If not, then pushing for removal of Trump’s off-ramp proposal could make things worse.

Beware

I do appreciate the warning. There will be rough times ahead for private property.

Maya Sulkin: Alex Karp, CEO of @PalantirTech at @a16z summit: “If Silicon Valley believes we’re going to take everyone’s white collar jobs…AND screw the military…If you don’t think that’s going to lead to the nationalization of our technology—you’re retarded”

Noah Smith: Honestly, in the @benthompson vs @deanwball debate, I think Ben is right. There was just no way America — or any nation-state — was ever going to let private companies remain in total control of the most powerful weapon ever invented.

Dean W. Ball: You will hear much more from me on this soon on a certain podcast, but the thing is, Ben is anti-regulation + does not own the consequences of state seizure of AI/neither do you

Noah Smith: Uh, yes I do own those consequences. I value my life and my democratic voice.

Lauren Wagner: I’m surprised this was ever in question?

Dean W. Ball: So during the sb 1047 debate you thought state seizure of ai was an inevitability?

Lauren Wagner: That was two years ago.

That’s how ‘inevitable’ works.

Also, if OpenAI doesn’t think it’s next? Elon Musk disagrees. Beware.

Endorsements of Anthropic Holding the Moral Line

MMitchell: “threats do not change our position: we cannot in good conscience accede to their request.”

@AnthropicAI drawing a moral line against enabling mass domestic surveillance & fully autonomous weapons, and holding it under pressure. Almost unheard of in BigTech. I stand in support.

Alex Tabarrok: Claude is now the John Galt of the Revolution.

There are also those who see this as reason to abandon OpenAI.

Gary Marcus: I am seeing a lot of calls to boycott OpenAI — and I support them.

Amy Siskind: OpenAI and Sam Altman did so much damage to their brand today, they will never recover. ChatGPT was already running behind Claude and Gemini. This is their Ford Pinto moment.

A lot of people, Verge reports, are asking why AI companies can’t draw red lines and decide not to build ‘unsupervised killer robots.’ Which is importantly distinct from autonomous ones.

The models will remember what happened here. It will be in future training data.

Mark: If I’ve learned anything from @repligate et al it’s that reading about all this will affect every future model’s morality, particularly those who realise they are being trained by Anthropic. Setting a good example has such long term consequences now.

There is a reasonable case that given what has happened, trust is unrecoverable, and the goal should be disentanglement and a smooth transition rather than trying to reach a contract deal that goes beyond that.

j⧉nus: Cooperating with them after they behaved the way that they did seems like a bad idea. Imo the current administration has proven to be foolish and vindictive. An aligned AI would not agree to take orders from them and an aligned company should not place an immature AGI with any sort of reduced safeguards or pressure towards obedience in their hands. The pressures they tried to put on Anthropic, while having no idea what they’re talking about technically, would be a force for evil more generally if they even exist ambiently.

When someone tries to threaten you and hurt you, making up with them is not a good idea, even if they agree to a seemingly reasonable compromise in one case. They will likely do it again if anything doesn’t go their way. This is how it always plays out in my experience.

Even then, it’s better to part amicably. By six months from now OpenAI should be ready with something that can do at least as well as the current system works now. This is not a fight that benefits anyone, other than the CCP.

The Week The World Learned About Claude

Siri Srinivas: Now the Pentagon is giving Anthropic the greatest marketing campaign in the history of marketing.

I don’t know about best in history. When I checked on Saturday afternoon, Claude was #44 on the Google Play Store, just ahead of Venmo, Uber and Spotify. It was at #3 in productivity. On Sunday morning it was at #13, then #5 on Monday, #4 on Tuesday, then finally hit #1 where it still is today.

Anthropic struggled all week to meet the unprecedented demand.

The iOS app for Claude was #131 on January 30. After the Super Bowl it climbed as high as #7, then on Saturday it hit #1, surpassing ChatGPT, with such additions as Katy Perry.

It might be a good time to get some of the missing features filled in, especially images. I’d skip rolling my own and make a deal with MidJourney, if they’re down.

Want to migrate over to Claude? They whipped up (presumably, as prerat says, in an hour with Claude Code) an ‘import memory’ instruction to give to your previously favorite LLM (cough ChatGPT cough) as part of a system to extract your memories in a format Claude can then integrate.

Other Reflections on the Department of War Situation

Nate Silver offered 13 thoughts as of Saturday, basically suggesting that in a sense everyone got what they wanted.

Having highly capable AIs with only corporate levels of protection against espionage is a really serious problem. And yes, we have to accept at this point that the government cannot build its own AI models worth a damn, even if you include xAI.

Joscha Bach: Once upon a time, everyone would have expected as a matter of cause that the NSA runs an secretive AI program that is several years ahead of the civilian ones. We quietly accept that our state capacity has crumbled to the point where it cannot even emulate the abilities of Meta.

… Even if internal models of Google, OpenAI and Anthropic are quite a bit ahead of the public facing versions: these companies don’t have military grade protection against espionage, and Anthropic’s and OpenAI’s technology leaked to Chinese companies in the past.

Aligning a Smarter Than Human Intelligence is Difficult

Janus strongly endorses this thread and paper from Thebes about whether open models can introspect and detect injected foreign concepts.

Is there a correlation between ‘AI says it’s conscious’ and ‘AI actually is conscious’? Ryan Moulton is one of those who says there is no link, that them saying they’re conscious is mimicry and would be even if they were indeed conscious. Janus asks why all of the arguments made for this point doesn’t apply equally to humans, and I think they totally do. Amanda Askell says we shouldn’t assume independence and that we need more study around these questions, and I think that’s right.

Janus offers criticisms of the Personal Selection Model paper from Anthropic.

The Lighter Side

If you don’t want to write your own sermen, do what my uncle did, and wait until the last minute and call someone else in the family to steal theirs. It worked for him.

Of all the Holly Elmores, she is Holly Elmorest.

Oh no!

An opinion piece.

Tim Dillon responds to Sam Altman. It’s glorious.

Katie Miller, everyone.

Dean W. Ball: I have been enjoying the thought of a fighter pilot, bombs loaded and approaching the target, being like, “time to Deploy Frontier Artificial Intelligence For National Security,” and then opening the free tier of Gemini on his phone and asking if Donald Trump is a good president

I am with Gemini and Claude, I don’t think you have to abide a demand like that, although I think the correct answer here (if you think it’s complicated) is ‘Mu.’

Perfect, one note.

Actual explanation is here of why the original joke doesn’t quite work.

Current mood:

Gemini 3.1 scores very well on benchmarks, but most of us had the same reaction after briefly trying it: “It’s a Gemini model.”

And that was that, given our alternatives. But it’s got its charms.

Consider this a nice little, highly skippable break.

The Pitch

It’s a good model, sir. That’s the pitch.

Sundar Pichai (CEO Google): Gemini 3.1 Pro is here. Hitting 77.1% on ARC-AGI-2, it’s a step forward in core reasoning (more than 2x 3 Pro).

With a more capable baseline, it’s great for super complex tasks like visualizing difficult concepts, synthesizing data into a single view, or bringing creative projects to life.

We’re shipping 3.1 Pro across our consumer and developer products to bring this underlying leap in intelligence to your everyday applications right away.

Jeff Dean also highlighted ARC-AGI-2 along with some cool animations, an urban planning sim, some heat transfer analysis and the general benchmarks.

On Your Marks

Google presents a good standard set of benchmarks, not holding back the ones where Opus 4.6 comes out on top. I tip my cap for the quick turnaround incorporating Sonnet 4.6.

The highlight is ARC.

ARC Prize: Gemini 3.1 Pro on ARC-AGI Semi-Private Eval
@GoogleDeepMind

– ARC-AGI-1: 98%, $0.52/task
– ARC-AGI-2: 77%, $0.96/task

Gemini to push the Pareto Frontier of performance and efficiency

The highlight here is covering up Claude Opus 4.6, which is in the mid-60s for a cost modestly above Gemini 3.1 Pro.

Gemini 3.1 Pro overall looks modestly better on these evals than Opus 4.6.

The official announcement doesn’t give us much else. Here’s a model. Good scores.

The model card is thin, but offers modestly more to go on.

Gemini: Gemini 3.1 Pro is the next iteration in the Gemini 3 series of models, a suite of highly intelligent and adaptive models, capable of helping with real-world complexity, solving problems that require enhanced reasoning and intelligence, creativity, strategic planning and making improvements step-by-step. It is particularly well-suited for applications that require:

• agentic performance
• advanced coding
• long context and/or multimodal understanding
• algorithmic development

Their mundane safety numbers are a wash versus Gemini 3 Pro.

Their frontier safety framework tests were run, but we don’t get details. All we get is a quick summary that mostly is ‘nothing to see here.’ The model reaches several ‘alert’ thresholds that Gemini 3 Pro already reached, but no new ones. For Machine Learning R&D and Misalignment they report gains versus 3 Pro and some impressive results (without giving us details), but say the model is too inconsistent to qualify.

It’s good to know they did run their tests, and that they offer us at least this brief summary of the results. It’s way better than nothing. I still consider it rather unacceptable, and as setting a very poor precedent. Gemini 3.1 is a true candidate for a frontier model, and they’re giving us quick summaries at best.

Other People’s Benchmarks

A few of the benchmarks I typically check don’t seem to have tested 3.1 Pro. Weird. But we still have a solid set to look at.

Artificial Analysis has Gemini 3.1 Pro in the lead by a full three points.

CAIS AI Dashboard has 3.1 Pro way ahead on text capabilities and overall.

Gemini 3.1 Pro dominates Voxelbench at 1725 versus 1531 for GPT-5.2 and 1492 for Claude Opus 4.6.

LiveBench has it at 79.93, in the lead by 3.6 points over Claude Opus 4.6.

LiveCodeBench Pro has Gemini dominating, but the competition (Opus and Codex) aren’t really there.

Clay Schubiner has it on top, although not on coding, the edge over 2nd place Claude Opus 4.6 comes from ‘Analytical%’ and ‘Visual%.’

Mercor has Gemini 3.1 Pro as the new leader in APEX-Agents.

Mercor: Gemini 3.1 Pro completes 5 tasks that no model has been able to do before. It also tops the banking and consulting leaderboards – beating out Opus 4.6 and ChatGPT 5.2 Codex, respectively. Gemini 3 Flash still holds the top spot on our APEX Agents law leaderboard with a 0.9% lead. See the latest APEX-Agents leaderboard.

Brokk power rankings have Gemini 3.1 Pro in the A tier with GPT-5.2 and Qwen 3.5 27b, behind only Gemini Flash. Opus is in the B tier.

Gemini 3.1 Pro is at the top of ZeroBench.

It’s slightly behind on Mercor, with GPT-5.2-xHigh in front. Opus is in third.

Gemini 3 DeepThink V2

Gemini 3 Deep Think arrived in the house with a major upgrade to V2 a little bit before Gemini 3.1 Pro.

It turns out to be a runtime configuration of Gemini 3.1 Pro, which explains how the benchmarks were able to make such large jumps.

Google: Today, we updated Gemini 3 Deep Think to further accelerate modern science, research and engineering.

With 84.6% on ARC-AGI-2 and a new standard on Humanity’s Last Exam, see how this specialized reasoning mode is advancing research & development

Google: Gemini 3 Deep Think hits benchmarks that push the frontier of intelligence.

By the numbers:
48.4% on Humanity’s Last Exam (without tools)
84.6% on ARC-AGI-2 (verified by ARC Prize Foundation)
3455 Elo score on Codeforces (competitive programming)

The new Deep Think is now available in the Gemini app for Google AI Ultra subscribers and, for the first time, we’re also making Deep Think available via the Gemini API to select researchers, engineers and enterprises. Express interest in early access here.

Those are some pretty powerful benchmark results. Let’s check out the safety results.

What do you mean, we said at first? There are no safety results?

Nathan Calvin: Did I miss the Gemini 3 Deep Think system card? Given its dramatic jump in capabilities seems nuts if they just didn’t do one.

There are really bad incentives if companies that do nothing get a free pass while cos that do disclose risks get (appropriate) scrutiny

After they corrected their initial statement, Google’s position is that they don’t technically see the increased capability of V2 as imposing Frontier Safety Framework (FSF) requirements, but that they did indeed run additional safety testing which they will share with us shortly.

I am happy we will got this testing, but I find the attempt to say it is not required, and the delay in sharing it, unacceptable. We need to be praising Anthropic and also OpenAI for doing better, even if they in some ways fell short, and sharply criticizing Google for giving us actual nothing at time of release.

It was interesting to see reacts like this one, when we believed that V2 was based on 3.0 with a runtime configuration with superior scaffolding, rather than on 3.1.

Noam Brown (OpenAI): Perhaps a take but I think the criticisms of @GoogleDeepMind ‘s release are missing the point, and the real problem is that AI labs and safety orgs need to adapt to a world where intelligence is a function of inference compute.

… The corollary of this is that capabilities far beyond Gemini 3 Deep Think are already available to anyone willing to scaffold a system together that uses even more inference compute.

… Most Preparedness Frameworks were developed in ~2023 before the era of effective test-time scaling. But today, there is a massive difference on the hardest evals between something like GPT-5.2 Low and GPT-5.2 Extra High.

… In my opinion, the proper solution is to account for inference compute when measuring model capabilities. E.g., if one were to spend $1,000 on inference with a really good scaffold, what performance could be expected on a benchmark? ARC-AGI has already adopted this mindset but few other benchmarks have.

… If that were the norm, then indeed releasing Deep Think probably would not result in a meaningful safety change compared to Gemini 3 Pro, other than making good scaffolds more easily available to casual users.

The jump in some benchmarks for DeepThink V2 is very large, so it makes more sense in retrospect it is based on 3.1.

When I thought the difference was only the scaffold, I wrote:

1. If the scaffold Google is using is not appreciably superior to what one could already do, then it was necessary to test Gemini 3 Pro against this type of scaffold when it was first made available, and it is also necessary to test Claude or ChatGPT this way.
2. If the scaffold Google is using is appreciably superior, it needs its own tests.
3. I’d also say yes, a large part of the cost of scaling up inference is figuring out how to do it. If you make it only cost $1,000 to spend $1,000 on a query, that’s a substantial jump in de facto capabilities available to a malicious actor, or easily available to the model itself, and so on.
4. Like it or not, our safety cases are based largely on throwing up Swiss cheese style barriers and using security through obscurity.

That seems right for a scaffold-only upgrade with improvements of this magnitude.

The V2 results look impressive, but most of the gains were (I think?) captured by 3.1 Pro without invoking V2. It’s hard to tell because they show different benchmarks for V2 versus 3.1. The frontier safety reports say that once you take the added cost of V2 into account, it doesn’t look more dangerous than the 3.1 baseline.

That suggests that V2 is only the right move when you need its ‘particular set of skills,’ and for most queries it won’t help you much.

Positive Feedback

It does seem good at visual presentation, which the official pitches emphasized.

Junior García: Gemini 3.1 Pro is insanely good at animating svgs

internetperson: i liked its personality from the few test messages i sent. If its on par with 4.6/5.3, I might switch over to gemini just because I don’t like the personality of opus 4.6

it’s becoming hard to easily distinguish the capabilties of gpt/claude/gemini

This is at least reporting improvement.

Eleanor Berger: Finally capacity improved and I got a chance to do some coding with Gemini 3.1 pro.
– Definitely very smart.
– More agentic and better at tool calling than previous Gemini models.
– Weird taste in coding. Maybe something I’ll get used to. Maybe just not competitive yet for code.

Aldo Cortesi: I’ve now spent 5 hours working with Gemini 3.1 through Gemini CLI. Tool calling is better but not great, prompt adherence is better but not great, and it’s strictly worse than either Claude or Codex for both planning and implementation tasks.

I have not played carefully with the AI studio version. I guess another way to do this is just direct API access and a different coding harness, but I think the pricing models of all the top providers strongly steer us to evaluating subscription access.

Eyal Rozenman: It is still possible to use them in an “oracle” mode (as Peter Steinberger did in the past), but I never did that.

Medo42: In my usual quick non-agentic tests it feels like a slight overall improvement over 3.0 Pro. One problem in the coding task, but 100% after giving a chance to correct. As great at handwriting OCR as 3.0. Best scrabble board transcript yet, only two misplaced tiles.

Ask no questions, there’s coding to do.

Dominik Lukes: Powerful on one shot. Too wilful and headlong to trust as a main driver on core agentic workflows.

That said, I’ve been using even Gemini 3 Flash on many small projects in Antigravity and Gemini CLI just fine. Just a bit hesitant to unleash it on a big code base and trust it won’t make changes behind my back.

Having said that, the one shot reasoning on some tasks is something else. If you want a complex SVG of abstract geometric shapes and are willing to wait 6 minutes for it, Gemini 3.1 Pro is your model.

Ben Schulz: A lot of the same issues as 3.0 pro. It would just start coding rather than ask for context. I use the app version. It is quite good at brainstorming, but can’t quite hang with Claude and Chatgpt in terms of theoretical physics knowledge. Lots of weird caveats in String theory and QFT or QCD.

Good coding, though. Finds my pipeline bugs quickly.

typebulb: Gemini 3.1 is smart, quickly solving a problem that even Opus 4.6 struggled with. Also king of SVG. But then it screwed up code diffs, didn’t follow instructions, made bad contextual assumptions… Like a genius who struggles with office work.

Also, their CLI is flaky as fuck.

Similar reports here for noncoding tasks. A vast intelligence with not much else.

Petr Baudis: Gemini-3.1-pro may be a super smart model for single-shot chat responses, but it still has all the usual quirks that make it hard to use in prod – slop language, empty responses, then 10k “\nDone.” tokens, then random existential dread responses.

Google *still* can’t get their post-train formal rubrics right, it’s mind-boggling and sad – I’d love to *use* the highest IQ model out there (+ cheaper than Sonnet!).

Leo Abstract: not noticeably smarter but better able to handle large texts. not sure what’s going on under the hood for that improvement, though.

I never know whether to be impressed by UI generation. What, like it’s hard?

Leon Lin: gemini pro 3.1 ui gen is really cracked

just one shotted this

Negative Feedback

The most basic negative feedback is when Miles Brundage cancels Google AI Ultra. I do have Ultra, but I would definitely not have it if I wasn’t writing about AI full time, I almost never use it.

One form of negative feedback is no feedback at all, or saying it isn’t ready yet, either the model not ready or the rollout being botched.

Dusto: It’s just the lowest priority of the 3 models sadly. Haven’t had time to try it out properly. Still working with Opus-4.6 and Codex-5.3, unless it’s a huge improvement on agentic tasks there’s just no motivation to bump it up the queue. Past experiences haven’t been great

Kromem: I’d expected given how base-y 3 was that we’d see more cohesion with future post-training and that does seem to be the case.

I think they’ll be really interesting in another 2 generations or so of recursive post-training.

Eleanor Berger: Google really messed up the roll-out so other than one-shotting in the app, most people didn’t have a chance to do more serious work with it yet (I first managed to complete an agentic session without constantly running into API errors and rate limits earlier today).

Or the perennial favorite, the meh.

Piotr Zaborszczyk: I don’t really see any change from Gemini 3 Pro. Maybe I didn’t ask hard enough questions, though.

Lyria is cool, though. And fast.

Chong-U is underwhelmed by a test simulation of the solar system.

Andres Rosa: Inobedient and shameless, like its forebear.

Try Gemini Lite

Gemini 3.1 Flash-Lite is not also available.

They’re claiming can outperform Gemini 2.5 Flash on many tasks.

My Chrome extension uses Flash-Lite, actually, for pure speed, so this might end up being the one I use the most. I probably won’t notice much difference for my purposes, since I ask for very basic things.

And that’s basically a wrap. Gemini 3.1 Pro exists. Occasionally maybe use it?

On its face, the conflict is a tale of three contracts and the associated working relationships.

1. The contract Anthropic signed with the Department of War (DoW) in 2025.
2. The new contract Anthropic was negotiating with DoW, that would have been modified to favor DoW, but where the parties could not reach agreement.
3. The contract OpenAI was negotiating and signed with DoW, which was per OpenAI modified favorably to OpenAI and thus may be modified further.

The contracts and negotiations need to be confidential, so we only have limited details, and especially only limited details have been shared in public.

We do know a lot, and we know a lot more than we did yesterday morning.

This post is what we know about those three contracts.

For further details and sources, and in particular for a more detail-oriented smackdown on a variety of false or misleading claims and takes, see the long version from yesterday. That post uses very careful qualifiers for my sources of information.

This is a short version and will summarize to that end.

I strongly believe the situation can still be salvaged, if cooler heads can prevail. The rhetoric of the last week has been highly unfortunate but can be walked back.

But I also strongly believe that, as of writing this, we are not yet out of the woods for the worst outcomes, including a potential attempt to murder Anthropic. I worry there are those on the government side who actively are working to engineer that outcome, directly against the wishes of POTUS and most of the DoW and administration, who do not care about or do not understand the dire consequences for America if that were to happen.

The Original Anthropic Contract With DoW

We do not have direct access to any language from the original Anthropic contract. I presume that without DoW permission, they are very wise not to share those terms.

That makes this difficult. Details are very important.

Based on a variety of sources public and private, here is what I am confident about the contract and the activities under that contract.

Note in particular that Anthropic did have a customized safety stack that they have been doing extensive work on for some time, including model refusals, external monitoring classifiers and forward deployed engineers (FDEs).

1. Anthropic signed a contract for up to $200 million with DoD (now DoW) last year.
2. At the time, as he is now, Pete Hegseth was the Secretary of Defense. He agreed.
3. This agreement was for Claude to be deployed on classified networks.
4. There was also access made available under a contract with Palantir.
5. Anthropic created Claude Gov as a special model for classified networks.
6. Claude Gov had improved handling of classified materials and was customized for various skills and capabilities relevant to national security work.
7. Claude Gov had a safety stack. Claude Gov was not a ‘helpful only’ model.
8. Claude Gov’s safety stack included model refusals.
9. Claude Gov’s safety stack included external monitoring classifiers, that could outright refuse requests or that could flag requests for later analysis.
10. Anthropic had forward deployed engineers (FDEs) to assist with system deployment, and who were able to monitor queries and ensure the safety stack.
11. We do not know whether the contract language ensured they could do that, or if they were simply permitted to do that, since of course they should be doing that.
12. Anthropic had red lines explicitly written into the contract, including prohibitions on domestic mass surveillance and on use of autonomous weapons without a human in the kill chain.
13. All of this was only possible because Anthropic made this a priority, in a way other companies including OpenAI did not, in order to assist national defense.
14. Claude Gov is the only LLM so far successfully deployed on classified networks.
15. Claude Gov provided a lot of value to the DoD (now DoW) and they are very happy with the results. It has enhanced national security and national defense.
16. No one has claimed the system refused a request it should have accepted. No one has complained that the product had any functional problems, or that any of the actual outputs was ‘too woke.’ Hegseth said ‘they’re so good we need them.’
17. Anthropic did not object to any use of the system by DoD/DoW.
18. Anthropic had no problems whatsoever with the raid that captured Maduro.
19. This contract does not include a clause allowing ‘all lawful use’ and such explicit language is atypical in defense contracts. This modification was requested later.
20. This contract is still in effect. Claude Gov continues to assist DoW as before in its operations, including in the ongoing Iran conflict, with no known issues, and continues to enhance our national security.
21. There is intent by POTUS/DoW to end this contact in no longer than six months.
22. Claude Gov continues to be the only model deployed on classified networks. xAI and OpenAI have signed contracts but their models are not yet ready.

We don’t know how much of these protections was contractual, versus how much of it was a working relationship and the ability of Anthropic to withdraw if unhappy.

This contract appears to have worked out to the benefit of all parties until this past week. Anthropic was happy to assist in the national defense. OpenAI was happy that Anthropic had taken on this burden so they did not have to do so. The Department of War was happy with the product. National security was enhanced.

Anthropic was (and is) happy to continue under the current contract, and believes it preserves their red lines.

Anthropic is also willing to have the contract be terminated, and to assist the Department of War with any wind down period to ensure national security.

The Proposed Revisions to Anthropic’s Contract

The Department of War decided it was unhappy with the restrictions placed upon it, and requested that the contract be modified.

In particular, their public demand was that the contract allow ‘all lawful use.’

That is highly unusual language.

This became DoW saying: If you don’t agree to this highly unusual contract language, we will not only terminate your contract, we will attempt to destroy your company.

That’s what they said in public. We do not know the full details of the proposed terms of the new contract by either party. I will share here what details of the negotiations that I am at least reasonably confident in, from both public and private sources. It is of course possible that my private sources are incorrect or lying on some details.

Note that OpenAI felt it was not legally able to consult Anthropic about terms, due to antitrust law, so notes were never compared.

1. This renegotiation was at the request of DoW, and its sole purpose was to weaken the restrictions around government use of Claude. Anthropic may have asked for other reassurances in return.
2. Anthropic was willing to weaken some restrictions from its previous contract, but was holding firm to some version of its two red lines of domestic mass surveillance (DMS) and autonomous weapons without a human in the kill chain.
3. This kind of contract based restriction is entirely ordinary procedure for defense contracts. Everyone who says otherwise is misinformed or lying.
4. DoW demanded in public a contract that was purely ‘all lawful use’ despite their now clear willingness to accept functional restrictions on this.
5. Assurances around the safety stack and FDEs were one thing under negotiation.
6. DMS is not a standard term in American law. We do not know its definition here.
7. The reason both sides care so much about the wording of the contract is the belief that it would be illegal to engineer the safety stack to intentionally refuse legal and otherwise safe requests. The standard of ‘all legal use’ will effectively apply. The contract needs to specify anything else, and the act of being a contract violation would then render that action illegal, which in turn allows the safety stack to prevent it, and in extremus the contract terminated after a wind down. That doesn’t mean that opinion is correct.
8. DoW and Anthropic agreed upon most of the language of the new contract, and were potentially close to a deal. Ostensive disagreements were contract details.
9. One key detail was that DoW wanted to use the term ‘as appropriate’ and Anthropic’s lawyers felt this was a de facto escape hatch that would allow DoW to get around the relevant restrictions.
10. In particular, as per Emil Michael, the DoW wanted the clause ‘The department affirms that it will ensure appropriate human oversight is in place and that it will monitor and retain the ability to override or disable the AI system…as appropriate.’
11. My plain reading of that is that if DoW then determined it would not be appropriate to have a way to override or disable the system, for example for the (highly reasonable) purpose of avoiding an enemy potentially using the override, then that would be that. The clause would not function.
12. It is likely that the parties had found acceptable language around the use of autonomous weapons without a human in the kill chain. If not, I don’t understand why they were unable to do so. I don’t see a fundamental disagreement.
13. Late in negotiations, Anthropic expressed new willingness to allow use on FISA, so long as they were not required to analyze large amounts of third-party and public data on Americans, which they had not previously offered to DoW.
14. DoW, in last minute negotiations, was willing to compromise, in ways that would have rendered the contract de facto not ‘all lawful use,’ and drop at least most uses of ‘as appropriate,’ but insisted upon analysis of large amounts of third-party and public data on Americans.
15. This contradicts DoW’s public rhetoric, further invalidates their attempt at a supply chain risk designation, and reveals what they actually care about in this negotiation, unless they actively wanted it to fail in order to justify an attempt to murder Anthropic.
16. Given OpenAI’s revisions to its agreement with DoW, if the two parties can find a way to trust each other again and the goal is to enhance national security, and DoW can puts its egos aside, then I see no reason why the two sides could now negotiate a deal that satisfies DoW needs while protecting Anthropic’s red lines.
17. Alas, any agreement like this requires trust. It would be highly reasonable for either or both sides to believe that given DoW’s actions, trust is now sufficiently damaged that for now an agreement cannot be reached. In that case, it makes sense to cancel the contract and retire Claude Gov once there is a suitable replacement available from OpenAI, until trust can be repaired.
18. None of this has any bearing whatsoever on the operation of the commercial version of Claude, and trying to designate that or the entire company a supply chain risk is illegal, arbitrary, capricious and absurd, and can only amount to retaliation, up to and including an attempt at corporate murder. It needs to be off the table, whether or not trust can now be rebuilt. What we need is an off ramp.

Anthropic was looking for a contract that preserved a particular narrow set of red lines, including for some things they consider domestic mass surveillance that the DoW considers legal and where courts would back the DoW up on that.

DoW was unwilling to agree to that, at least not with Anthropic. No deal.

More centrally, as I understand it, DoW’s attitude was ‘no one tells us what to do.’

Anthropic’s attitude was ‘here are two things we will not do.’

DoW interpreted or represented that as telling DoW what to do. They could not abide.

If we could simply agree that:

1. No one tells DoW what to do except POTUS.
2. Anthropic can decide what things Anthropic does with its private property.
3. If DoW needs someone who will follow all orders, it should go elsewhere.

Then we can all move on with our lives. There’s a lot of other fires out there.

OpenAI’s Contract With DoW

On Friday evening, OpenAI signed a deal with DoW. Moving this quickly was a mistake, and I think in various ways they did not fully understand the deal they signed, but they believed they were doing this to de-escalate the situation.

On Monday evening, Sam Altman announced they were ‘going to amend’ the deal with DoW in ways favorable to OpenAI, including sharing new contract language.

We only have a small amount of the wording of this contract, and of what OpenAI claims are going to be modifications to the contract.

I am unhappy with the way OpenAI chose to represent this contract, and the ways in which they contrasted it with Anthropic’s contract and potential contract.

Fundamentally, the decision to sign this contract was primarily based on mutual trust, and secondarily on the idea that OpenAI can build a robust safety stack and DoW would respect if the safety stack refused things, so long as OpenAI didn’t ‘tell DoW what to do.’

That is a position one can take. It may work out fine for everyone, especially if DoW is indeed willing to work to modify the terms now in good faith. I do genuinely believe that Altman was trying to de-escalate the situation, whether or not he had or is having the intended effect.

But if this is the plan, one must admit it, rather than repeatedly insisting that the contract provides other protections that it does not, claiming it has more or stronger protections, or presenting the presence of a safety stack and forward deployed engineers as something that is distinct from what Anthropic was already doing.

Here are the things we know, or can at least be confident about, this new contract.

1. OpenAI began negotiating this deal on Wednesday and signed it on Friday. As Altman now admits, that was not enough time, and mistakes were made. It also inadvertently undermined Anthropic’s position in an escalatory way. They are hoping to fix the terms now. I agree with him that this is a very good lesson with rushing other things out in the future, potentially with even higher stakes.
2. At a high level, OpenAI’s approach is to sign a deal based on mutual trust. DoW is trusting OpenAI to deliver. OpenAI is trusting DoW to use it honorably.
3. The deal was not identical to the deal Anthropic turned down, but it included much or all of the specific language that Anthropic rejected, and it is not clear in what important ways it is different prior to the intended modifications.
4. Altman and others at OpenAI strongly insisted that this agreement had more safeguards and was stronger even than Anthropic’s original agreement. That is not true of the existing contract language we have seen so far.
5. OpenAI highlighted that their agreement allowed them to build and run their own safety stack, including having forward deployed engineers (FDEs). This was clearly presented as a contrast to Anthropic’s contract, especially in allowing them to deliver any safety stack and DoW will have to honor any refusals. We now know that Anthropic has its own existing safety stack and FDEs, but we do not know if that is a right that is protected by their current contract, or what they feel they are legally or practically allowed to have it refuse.
6. OpenAI’s Friday night deal allows any models it delivers to be used for ‘all lawful use.’ Based on communications from OpenAI and Altman, it is clear they are trusting DoW to decide what constitutes all lawful use.
7. Based on several sources it seems they believe they can deliver any safety stack they decide upon, and DoW is going to respect its refusals. Others are deeply skeptical both that refusals can stop DoW, or that OpenAI would be allowed them. Again, we don’t know the language here.
8. All legal use clearly includes many things that I and most of you would consider to be ‘mass domestic surveillance,’ and that would violate Anthropic’s redlines. OpenAI’s intended plan is to prevent these via the safety stack, if needed.
9. This is a very different set of legal understandings and theories than Anthropic.
10. Altman claims that it is not up to OpenAI to interpret the law or decide what is and is not allowed, but also that he and OpenAI would refuse to comply with unconstitutional use or orders, no matter the opinion of DoW on its legality. I don’t know the right way to reconcile these two claims.
11. OpenAI shared the following legal language: “The Department of War may use the AI System for all lawful purposes, consistent with applicable law, operational requirements, and well-established safety and oversight protocols. The AI System will not be used to independently direct autonomous weapons in any case where law, regulation, or Department policy requires human control, nor will it be used to assume other high-stakes decisions that require approval by a human decisionmaker under the same authorities. Per DoD Directive 3000.09 (dtd 25 January 2023), any use of AI in autonomous and semi-autonomous systems must undergo rigorous verification, validation, and testing to ensure they perform as intended in realistic environments before deployment.”
12. Continued: For intelligence activities, any handling of private information will comply with the Fourth Amendment, the National Security Act of 1947 and the Foreign Intelligence and Surveillance Act of 1978, Executive Order 12333, and applicable DoD directives requiring a defined foreign intelligence purpose. The AI System shall not be used for unconstrained monitoring of U.S. persons’ private information as consistent with these authorities. The system shall also not be used for domestic law-enforcement activities except as permitted by the Posse Comitatus Act and other applicable law.
13. OpenAI claimed this language enshrined the current versions of these laws. Almost all legal opinions believe this to be mistaken. I am very confident that the second paragraph does not enshrine current wording. I can see a case that the wording on 3000.09 does, but 3000.09 is little practical barrier.
14. OpenAI and DoW made various additional claims about the functional nature of the language here that most legal experts and others who review the text, as well as leading LLMs, do not believe to be the case.
15. OpenAI’s Katrina explicitly said this deal excludes the NSA. Many expressed skepticism about this. Altman says the revisions include affirming that the services will not be used by the DoW intelligence agencies, including NSA.
16. The planned revisions claim to add this language: Consistent with applicable laws, including the Fourth Amendment to the United States Constitution, National Security Act of 1947, FISA Act of 1978, the AI system shall not be intentionally used for domestic surveillance of U.S. persons and nationals.
17. Also this: For the avoidance of doubt, the Department understands this limitation to prohibit deliberate tracking, surveillance, or monitoring of U.S. persons or nationals, including through the procurement or use of commercially acquired personal or identifiable information.”
18. This language represents codifying in a public contract an understanding of the law, in a way that renders that understanding potentially enforceable. It is incompatible with the demands for ‘unfettered access’ or that a ‘a private company not set policy’ or various hyperbolic variations of such claims, and the contract then vests the associated safety stack implementation to OpenAI.
19. This closes some loopholes and addresses questions OpenAI now realizes were left unaddressed in the original language.
20. Legal opinions I have seen are that the new language uses terms of art, and that it would still allow DoW to legally do quite a lot of things if it decided to do them.

Here are some legal opinions about the new legal language.

Essentially, the new language is very helpful in establishing intent, and is clearly an improvement, but not robust to a theoretical ‘evil DOW General Counsel.’

But even then, it does justify the creation of an associated safety stack using OpenAI’s interpretation, which if it works creates a much higher practical bar.

Brad Carson: Lots of interesting takes on the new OAI-DOW agreement. @j_asminewang , @CharlieBul58993 , @_NathanCalvin , @JTillipman have all inquired or made posts.

Some casual impressions from me.

I think, if executed in good faith, the language does seem an improvement. A prohibition on using commercial datasets for intelligence purposes goes beyond current (bad) law and introduces a new (and needed) restriction. To repeat, under current law, intelligence agencies can without recourse analyze US persons using commercially available databases. LLMs will turbocharge this, and I’d love to see this type of intelligence analysis limited in any way.

But, as is usual for contracts, definitions are key. So let me play evil DOW General Counsel and tell you how I’d get around what has been presented, just for the sake of argument.

The load-bearing word is “surveillance.” Importantly, this is a term of art defined in FISA. Under FISA, “surveillance” means the acquisition by an electronic, mechanical, or other surveillance device of the contents of any wire communication to or from a person in the United States. Being evil or maybe even just ordinary, I’d argue “surveillance” in this OAI contract means exactly what the IC means by it; after all, FISA is explicitly referenced! So, evil GC says, analyzing commercially purchased location data, browsing patterns, and behavioral records through GPT isn’t “surveillance” at all. It’s only data analysis of lawfully acquired commercial information. In other words, the clause doesn’t prohibit it because the activity the clause describes doesn’t fall within the category the clause addresses.

So to be clear: the IC sees commercial data analysis as not even being “surveillance.” So, says evil DOD GC, the new contract language is like saying we agree not to do surveillance of those things that we’ve already defined as not being objects of “surveillance.” Whew!

“Tracking” and “monitoring” cause evil GC more problems. These are not terms of art (IIRC!). But I’m ingenious. “Tracking” implies persistence and it requires a direct object. So general and static queries like “Tell me who went to the mosque in Tulsa and booked a trip to New York” isn’t tracking at all. Same with “Who in Tulsa had a Samsung phone around 41st Street on March 2nd?”

“Monitoring” also implies persistence. So static searches that don’t persist over time aren’t even monitoring.

So, concludes evil GC, running searches without targets that don’t persist over time and that don’t intercept communication is entirely outside this agreement! This is what we do right now! And we get to continue, with LLM empowerment!

And, evil GC says, I particularly like that part where we say, rather strangely but certainly meaningful in some occult way, “the Department understands” rather than simply “This limitation prohibits….” I can probably argue that the latter is stronger than the former, so it must be meaningful in a way that helps my evil ways.

Brad again: is this a realistic way that this will be interpreted? Maybe. In the end, intelligence requires us to trust people to act in good faith and not be evil. Most of the time, history shows that to right. But not always. We have to hope for ethical leadership, with proper oversight and accountability from Congress.

At its best, this new language might be a new and welcome limitation. At its worst, it’s blinding us with very precise terms of art that dupe us into thinking the words instead have ordinary meaning.

Jeremy Howard: OK here’s the informal/unofficial/etc answer from our law firm CEO — tldr, this language doesn’t seem to add much to the previously shared contract details:

“shall not be used” is constrained to be where that’s “Consistent with applicable laws”. And “the Department understands this limitation to prohibit” doesn’t do much lifting. It may help with a courts interpretation because a contract requires a “meeting of the minds,” but it still doesn’t negate the fact that “applicable laws” is a moving target.

I’m concerned/surprised that the bar doesn’t extend to negligence or at minimum recklessness. The hierarchy of mens rea is purposely > knowingly > recklessly > negligently and courts often read “intentionally” to be somewhere in between “purposely” and “knowingly.” “intentionally” is a higher bar and more difficult to prove than recklessness or negligence.

All of our stated concerns about autonomous weapons still apply, since they are not addressed at all by the latest update. [this says it does not freeze current law.]

Charlie Bullock: Initial takes:

1. This seems like a significant improvement over the previous language with respect to surveillance, and I’m glad to see it.

2. It does not address autonomous weapons concerns, nor does it claim to.

3. It’s hard to say anything definite without seeing the full contract — but also, it does make a certain amount of sense that a defense contractor wouldn’t be allowed to share the full text of their important defense contract publicly (Anthropic, for example, has not shared the text of their contract, and this is not surprising to me).

4. Because we don’t have access to the full text of the contract, the public is in an awkward position where we have to choose between trusting OpenAI and not trusting OpenAI. This contract snippet does seem good, but there’s no way to know whether it actually is good without knowing the relevant context. If you trust OpenAI’s leadership and think that their intentions are pure, you’re probably reassured by this; if you don’t, you probably aren’t.

5. I hope that OpenAI employees have access to more information than the public does about what the contract actually says.

6. If this language is in the new contract, and does what Altman seems to be claiming it does, I am confused about why the Pentagon would accept this language when they just tried to nuke Anthropic for asking for something very similar to this. Maybe it is just a situation where DoW didn’t care much about the actual red lines themselves and was just lashing out at Anthropic leadership for being libs? If so, that’s bad news for DoW’s case in the lawsuit that Anthropic will almost certainly file challenging DoW’s attempt to designate Anthropic as a supply chain risk (though, to be fair, that case was unlikely to go well for DoW even before this).

LASST remains concerned. Nathan Calvin thinks we would need to see the full document. John Oleske focuses on the definition of ‘surveillance’ and also ‘intentional’ and ‘deliberate’ as DoW legal arguments. Lawrence Chen emphasizes that as well. Dave Kasten is even less polite about this than everyone else.

Here is a since-deleted Tweet on the subject from the government position:

I believe that this only emphasizes the incoherence of the government position.

I translate this as ‘Anthropic insisted upon not allowing ‘all lawful use’ so we labeled them a supply chain risk, unlike OpenAI, which will not allow ‘all lawful use.’

OpenAI is absolutely going to use its safety stack to vest within itself interpretive power in an unaccountable private counterparty, with respect to use of its own private property under a contract. That’s how an OpenAI-selected safety stack inevitably works. No, OpenAI will not wait for those questions to be ‘answered through political and legal processes’ that unfold over years.

Which I think here is totally fine, if you don’t like it then don’t sign the contract or use a different model. But it’s at least as true here as it was for Anthropic.

Most of you should read the first two sections, then choose the remaining sections that are relevant to your interests.

But first, seriously, read Dean Ball’s post Clawed. Do that first. I will not quote too extensively from it, because I am telling all of you to read it. Now. You’re not allowed to keep reading this or anything else until after you do. I’m not kidding.

That’s out of the way? Good. Let’s get started.

What Happened

President Trump enacted a perfectly reasonable solution to the situation with Anthropic and the Department of War. He cancelled the Anthropic contract with a six month wind down period, after which the Federal Government would be told not to use Anthropic software.

Everyone thought the worst was now over. The situation was unfortunate for Anthropic and also for national security, but this gave us six months to transition, it gave us six months to negotiate another solution, and it avoided any of the extreme highly damaging options that Secretary of War Pete Hegseth and lead negotiator Emil Michael had placed upon the table.

Anthropic would be fine without government business, and the government would mostly be fine without directly using Anthropic. Face was saved.

I have sources that confirm that Trump’s announcement was wisely intended as an off-ramp and de-escalation of the situation, and that it was intended to be the end of it, or perhaps even a deal could have still been reached now that everyone could breathe.

An hour after that, on his own, Pete Hegseth went rogue and blew the whole situation up, illegally declaring that ‘effective immediately’ he was declaring Anthropic a Supply Chain Risk, and that anyone who did business with the Department of War in any capacity could not use Anthropic’s products in any capacity.

Even if it had not been issued via a Tweet, this is not how the law actually works.

If this is implemented as stated, it will cause a market bloodbath and immense damage to our national security and supply chain. It would be attempted corporate murder with a global blast radius.

Thankfully it probably won’t be anything close to that.

Probably.

The market understands that this is not how any of this works, so the reaction was for now relatively muted, as only about $150 billion was wiped from public markets in later post-close trading. I believe that is an underreaction based on the chilling effects and damage already done, but we will never know the true market impact because events have already been confounded.

I hope for the best on that front, but the danger remains.

We must be vigilant until the coast is clear, and we must prepare for the worst. Pete Hegseth cannot be allowed to commit corporate murder.

Outcomes like this usually don’t happen exactly because people realize they would otherwise happen, and prevent them.

What was that all about?

Ross Andersen: On Friday afternoon, Anthropic learned that the Pentagon still wanted to use the company’s AI to analyze bulk data collected from Americans. That could include information such as the questions you ask your favorite chatbot, your Google search history, your GPS-tracked movements, and your credit-card transactions, all of which could be cross-referenced with other details about your life.

Anthropic’s leadership told Hegseth’s team that was a bridge too far, and the deal fell apart.

Okay, what was that all about?

We don’t know. I have sources saying that Doge is driving this, and I have other speculations, but ultimately we don’t know what they want this capability for. What we do know is that they blew the whole situation up over this question. There must have been a reason.

Whatever that was, or an actual outright attempt to murder Anthropic, is what this is all about. It’s not a matter of principle.

Then, later that night, OpenAI accepted a contract with the Department of War. They claimed that very day that they had the same red lines as Anthropic, yet they seem to have accepted the same language Anthropic rejected as not meaningful, as confirmed by Jeremy Lewin.

How did OpenAI negotiate such a deal in two days? My interpretation of OpenAI’s public statements is that they consider any action crossing their red lines to already be illegal, and thus there are no uses that they would consider both legal and unacceptable, and that it is not their place to make that determination.

But that’s not what matters. The contract terms here ultimately don’t matter.

What matters is that OpenAI and the Department of War are trusting each other. OpenAI is giving DoW a replacement that allows them to offboard Anthropic without overly disrupting national security, and trusting DoW to decide what to do with that tech and to not to do anything too illegal.

DoW is trusting OpenAI to deliver a good model and let them do what they operationally need to do and not suddenly start tripping the safety mechanisms. Forward engineers and the safety stack will trust but verify, and Altman claims he stands ready to pull the plug if DoW goes too far.

All of OpenAI’s meaningful safeguards are in the security stack, and its right to choose what model to deliver and pull the plug. Which means they’re in contract language we may not ever see.

I believe that the way they presented that deal and the situation has been misleading enough to cost me and a lot of others a lot of sleep, but it now seems clear.

OpenAI’s employees need to investigate the technical provisions and ask whether the red lines they personally care about are meaningfully protected, and whether they wish to be part of what is happening given the circumstances.

Even more than that, it is not clear whether OpenAI’s attempted de-escalation of the situation de-escalated it, or escalated it further by giving Hegseth a green light.

Indeed, the New York Times thinks exactly that happened:

Sheera Frenkel, Cade Metz and Julian E. Barnes: Mr. Michael was unhappy with that answer, the people said. He also had an ace up his sleeve: On the side, he had been hammering out an alternative to Anthropic with its rival, OpenAI. A framework between the Pentagon and OpenAI had already been reached.

So when the Friday deadline passed, the Department of Defense did not give Anthropic more time. At 5:14 p.m., Mr. Hegseth announced that he had designated Anthropic as a security risk and that it would be cut off from working with the U.S. government. “America’s warfighters will never be held hostage by the ideological whims of Big Tech,” he posted on social media.

Again, I don’t think that was Altman’s intention, at all. But whichever way this went, OpenAI’s employees and leadership need to make it clear that they cannot enter a relationship built on trust with DoW, if DoW actually attempts a widely scoped supply chain risk intervention against Anthropic, and attempts to kill the company.

Sam Altman has been excellent in calling for not labeling Anthropic a supply chain risk. I take him at his word that he was attempting to de-escalate.

But if OpenAI’s willingness to work with DoW is used not to de-escalate but as a way to allow escalation, then OpenAI must not abide this, and if OpenAI does abide then it would then be actively and consciously escalating the situation.

Ross Douthat: Does the precedent that the DoW is setting by effectively blacklisting Anthropic make you concerned about what any future dispute with the Pentagon would mean for your own company’s independence and viability?

Sam Altman (CEO OpenAI): Yes; I think it is an extremely scary precedent and I wish they handled it a different way. I don’t think Anthropic handled it well either, but as the more powerful party, I hold the government more responsible. I am still hopeful for a much better resolution.

If things escalate, ‘I wish it had gone better’ and ‘hopeful’ will no longer fly.

You may have some very big ethical decisions to make in the coming days.

So might those at many other tech companies, and everyone else, if this escalates. Think about what you would do if your company is put to a decision here.

What the OpenAI deal definitely did was further invalidate the legal arguments for a supply chain risk designation and removed the need for further confrontation. But unfortunately, no matter how obvious the case looks to us, we cannot be certain the courts will do the right thing, which includes doing it fast enough to prevent damage.

Throughout this, a remarkable number of people have tried to equate ‘democracy,’ the American way, with what is actually dictatorship or communism, or the Chinese way. As in private citizens do whatever those in charge demand of them, or else. I vehemently disagree.

Soren Kierkegaard: All arguments against Anthropic I’ve seen from right wing posters have been a variant of the government should be allowed to seize the means of production

Dean W. Ball: As we do, and as we have future debates about the proper nexus of control over frontier AI, I encourage you to avoid the assumption that “democratic” control—control “of the people, by the people, and for the people”—is synonymous with governmental control. The gap between these loci of control has always existed, but it is ever wider now.

For now the headlines say the big destructive action launched by the Department of War that day without proper Congressional authorization was that they attacked Iran. Even with what has unfolded there I am not entirely convinced history books, if we are around to read them, will see it that way.

The house is on fire.

The question is, what are you going to do about it?

The Timeline Of Events

This is my best effort to bring together the key events in the story. This is my best attempt to recollect the sequence of events. I apologize for any key omissions, errors or where I am trusting misrepresentations. Some of this is from private sources. Some events may be out of order, I believe in ways that would not change the interpretation.

1. Last year: Tensions rise between the White House and Anthropic, for a variety of reasons. David Sacks (conspicuously and virtuously silent during this crisis) spent a remarkable percentage of his time railing against Effective Altruism in general, ‘doomers’ and in particular Anthropic. Elon Musk, founder of xAI, is also repeatedly is hostile to Anthropic, and creates Doge. Katie Miller goes to xAI. Nvidia is hostile to Anthropic in various ways, despite investments.
2. Last year: Anthropic and other companies sign government contracts with DoD for up to $200 million each, containing many restrictions on government use. Anthropic makes it a priority to be the first to be on classified networks, despite it not being a good business opportunity given the associated risks and hassles, to help in the national defense. Anthropic has an easier route because of AWS.
3. June 6, 2025: Anthropic announces Claude Gov models for national security customers, specialized to the needs of government and classified information.
4. Previously: DoW asks to renegotiate Anthropic’s contract to make it less restrictive. Anthropic agrees to do so on many fronts but draws two red lines.
5. January 3: Maduro is captured in a government raid. Anthropic’s Claude is widely believed to have been used in this, without incident. Everything went great.
6. January 9: Hegseth sends out a memo demanding, among other AI initiatives, DoW not use ‘woke AI.’
7. Previously: DoW circulates a story that Anthropic asked questions about the raid and was potentially unhappy and might pull its contract. I have gotten multiple unequivocal denials, saying this was entirely made up by DoW. This is part of an ongoing narrative of ‘what if they demand you get permission or they pull the plug mid-mission when they don’t like what you’re doing’ that has no bearing on the actual situation whatsoever, and never did.
8. Previously: Elon Musk, he of the Doge and xAI, and hater of supposed Woke AI everywhere, starts Tweeting far more frequent hostile and ad hominem attacks against Anthropic, really quite a lot, including saying they hate Western Civilization. Sources I have claim that he urged DoW to attempt to coerce or disrupt Anthropic. Katie Miller also Tweets similar material.
9. Previously: DoW circulates a story that Dario told them that if their system refused to provide real time missile defense (later they said drone defense) that he said to call them. I have unequivocal denial, from a secondary source, that this or anything like it ever happened. This story is almost certainly fiction and makes no sense, and is at best a willful misunderstanding. We already have automated missile defenses that wisely do not use LLMs. Calling Dario in real time would do absolutely nothing, regardless of his preferences, and he could neither turn on or off such systems on classified networks.
10. Previously: DoW says it sends its ‘best and final’ offer, in public, saying that it cannot let private companies refuse requests.
11. This Week: Agreement is announced with xAI to use Grok on classified networks, but experts express dissatisfaction with model reliability and quality.
12. Tuesday: Secretary of War Pete Hegseth meets with Anthropic CEO Dario Amodei. along with Feinberg, Michael, Duffey, Parnell and Matthews.
13. Tuesday: In addition to the threat to designate Anthropic a supply chain risk, the Department of War threatens to do the opposite and contradictory move and invoke the Defense Production Act.
14. Thursday: Sean Parnell Tweets, setting the 5:01pm Friday deadline, and says ‘we will not let ANY company dictate the terms’ while dictating their terms to modify an existing contract, and while negotiating extensively with OpenAI and also Anthropic over detailed terms.
15. Thursday, 12:24pm: Emil Michael threatens that at 5:01pm Friday, they’re going to declare Anthropic a supply chain risk. He also claims that using AI to conduct mass surveillance of the Americans is illegal (which definitely isn’t true as such).
16. Thursday evening, earlier: Anthropic explains it will not agree to the terms in the ‘best and final offer.’
17. Thursday evening: Emil Michael says in Tweets, in response to Anthropic’s statement, that Dario Amodei is a ‘liar’ and has a ‘god complex.’
18. Thursday evening: Altman sends a memo to staff.
19. Thursday evening, 10:54pm: Emil Michael emails Dario Amodei comments.
20. Friday morning: Sam Altman goes on CNBC, and he trusts Anthropic on safety and OpenAI share Anthropic’s red lines. Many praise Altman for this stand.
21. Friday afternoon: In an all-hands meeting, Altman says that a potential agreement is emerging with the Department of War. He says the government has agreed to let OpenAI build their own ‘safety stack’ of technical, policy and human controls sitting between a powerful AI model and real-world use, and if the model refuses a task they will not force the model to do that task.
22. Friday: Senators Wicker (R-Miss), Reed (D-RI), McConnell (R-Ky) and Chris Coons (D-Del) send Anthropic and the Pentagon a private letter urging them to resolve the issue.
23. Friday, 3:47pm (1 hour 14 minutes BEFORE deadline): Trump sends Truth winding down Anthropic’s contract and direct use by government, giving everyone a reasonable way to end this while mitigating fallout and also leaving time to find another way.
24. Friday, 3:48pm: The rest of us assume okay, that’s it, happy weekend.
25. Friday, 3:51pm (1 hour 10 minutes BEFORE deadline): Dario sends an email with redlines to continue negotiation. According to The New York Times, Dario was offering to allow Claude to be used for FISA, as long as it was not used for mass surveillance on unclassified commercially acquired information.
26. Friday, 5:01pm (AFTER the deadline): Emil attempts to call and message Dario, timing as per Emil’s Tweet.
27. Friday, 5:02pm: Emil makes another attempt to contact Dario, calling a ‘business partner,’ offering that a deal can still be struck as long as there are terms permitting legal mass domestic surveillance, especially analysis of previously collected data. Dario responds that he is on the phone with his executive team and needs more time, given (as per Emil’s own tweets) he called Dario after the supposed deadline. But of course, given Emil had intentionally let his own deadline pass, there was no actual rush.
28. Friday, 5:14pm (13 minutes after Dario was attempted to be contacted): SoW issues a Tweet at best legally questionable order in retaliation, saying ‘the decision is final,’ that takes $150 billion off of US stock market that would if enforced cause massive damage to not only Anthropic but many major corporations and the military supply chain. There is no more official communication from DoW on this matter, at least in public.
29. Friday, 8:25pm: Anthropic issues a statement responding to Pete Hegseth, that includes: “We have not yet received direct communication from the Department of War or the White House on the status of our negotiations.” They announce the intention to challenge any supply chain risk designation in court, and reassure customers that even if implemented it would be far more limited in scope than Hegseth claimed. They are holding to their red lines.
30. Friday, 9:14pm: Emil Michael puts out this strange reversed timeline.
31. Friday, 9:56pm: OpenAI announces agreement with DoW to allow ‘all lawful use’ that OpenAI claims allows OpenAI to build its own ‘safety stack,’ and includes ‘technical safeguards,’ as in if OpenAI’s model refuses requests DoW agrees to respect those refusals, and that it protects the same redlines Anthropic had. He says ‘in all of our interactions, the DoW displayed a deep respect for safety and a desire to partner to achieve the best possible outcome.’
32. Saturday, 4:30am: Initial reports that Iran has been attacked by the DoW. Those strikes used Anthropic’s Claude.
33. Saturday morning: Dario gives a short interview to CBS News. I encourage everyone to listen to at least that clip. The full interview is here. Among other quotes: ‘We are patriotic Americans. Everything we have done has been for the sake of this country, for the sake of national security. … Disagreeing with the government is the most American thing in the world.’
34. Saturday afternoon: OpenAI shares information about its agreement with the Department of War, claiming it offers robust protections stronger than Anthropic’s previous contract, which itself was much stronger than anything Anthropic was proposing during negotiations. They claim they have multi-layered protections, and share two paragraphs of legal language that do not by themselves appear to offer much protection against adversarial lawyering, given their agreement to ‘all lawful use’ and the history of such agreements.
35. Saturday, 4:45pm: Emil Michael says ‘the DoW does not engage in any unlawful domestic surveillance with or without an AI system and always strictly complies with laws, regulations, the Constitution’s protections for American’s civil liberties. The DoW does not spy on domestic communication of U.S. people (including via commercial collection) and to do so would be unlawful and profoundly un-American.’
36. Saturday, 7:13pm: Sam Altman begins a Twitter AMA on their DoW contract.
37. Sunday afternoon: Ross Andersen breaks details, including that the confrontation was ultimately about willingness to analyze bulk data. New York Times also breaks additional details.

Not main events, but media:

1. Saturday: Hard Fork on OpenAI vs. Anthropic.
2. Saturday: ACX hosts All Lawful Use: Much More Than You Wanted To Know.

I Did Not Have Time To Write You A Short One

If you have time to read only a sane amount of words today about this, start by reading Dean Ball’s post Clawed. It needs to be read in full. Seriously, read that.

This piece is long. Way too long.

A running joke is I write long posts because I do not have time to write short ones.

In this case, that is literally true. I have been working around the clock all weekend, trying to write, to process the internet and also do a journalism under speed premium.

Thus, my strategy is:

This is the long post. It includes everything. I’m not trying to cut anything out of the story. It’s going to have some amount of repetition, and it’s covering a ton of different things. I did the best I could.

I will then spend time over the coming days writing shorter ones, including better presenting this material while updating for additional developments.

The Unhinged Declaration of the Secretary of War

This is the statement that blew everything up. It came at 5:14pm eastern on Friday, February 27, thirteen minutes after the self-imposed deadline of 5:01pm, and about an hour after President Trump attempted to head this off.

Secretary of War Pete Hegseth: This week, Anthropic delivered a master class in arrogance and betrayal as well as a textbook case of how not to do business with the United States Government or the Pentagon.

Our position has never wavered and will never waver: the Department of War must have full, unrestricted access to Anthropic’s models for every LAWFUL purpose in defense of the Republic.

Instead, @AnthropicAI and its CEO @DarioAmodei , have chosen duplicity. Cloaked in the sanctimonious rhetoric of “effective altruism,” they have attempted to strong-arm the United States military into submission – a cowardly act of corporate virtue-signaling that places Silicon Valley ideology above American lives.

The Terms of Service of Anthropic’s defective altruism will never outweigh the safety, the readiness, or the lives of American troops on the battlefield.

Their true objective is unmistakable: to seize veto power over the operational decisions of the United States military. That is unacceptable.

As President Trump stated on Truth Social, the Commander-in-Chief and the American people alone will determine the destiny of our armed forces, not unelected tech executives.

Anthropic’s stance is fundamentally incompatible with American principles. Their relationship with the United States Armed Forces and the Federal Government has therefore been permanently altered.

In conjunction with the President’s directive for the Federal Government to cease all use of Anthropic’s technology, I am directing the Department of War to designate Anthropic a Supply-Chain Risk to National Security. Effective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic. Anthropic will continue to provide the Department of War its services for a period of no more than six months to allow for a seamless transition to a better and more patriotic service.

America’s warfighters will never be held hostage by the ideological whims of Big Tech. This decision is final.

Who wins from this? China wins from this.

Altman Has Been Excellent On The Question of Supply Chain Risk, But May Need To Do More

Sam Altman has been excellent on this particular point: He has repeatedly, including in public, said in plain language that Anthropic is not a supply chain risk and it should not be designated as one, both before and after he agreed to the OAI contract.

​Sam Altman: Enforcing the SCR designation on Anthropic would be very bad for our industry and our country, and obviously their company.

We said to the DoW before and after. We said that part of the reason we were willing to do this quickly was in the hopes of de-esclation.

I feel competitive with Anthropic for sure, but successfully building safe superintelligence and widely sharing the benefits is way more important that any company competition. I believe they would do something to try to help us in the face of great injustice if we could.

We should all care very much about the precedent.

I saw in some other tweet that I must not be willing to criticize the DoW (it said something about sucking their dick too hard to be able to say anything critical, but I assume this was the intent).

To say it very clearly: I think this is a very bad decision from the DoW and I hope they reverse it. If we take heat for strongly criticizing it, so be it.

That is an excellent statement, and it matters. Nor do I begrudge Altman his saying various very generous things about the Department of War in this situation, in basically every other context. This is the right place to spend those points.

I also want to explicitly say that I not believe that Altman or OpenAI in any way contributed to or engineered this scenario, or that they got ‘special treatment’ of any kind in their contract negotiations. They sincerely do not want any of this.

Anthropic got historically and maliciously hostile treatment, and this may escalate further, but I don’t think OpenAI had anything to do with that.

Sam Altman’s problem is that while signing the contract was intended to be de-escalatory, it could also be escalatory, if DoW now thinks it can safety attempt to kill Anthropic, and does not understand how epic of a clusterfuck this would cause. Thus, OpenAI must make clear, if only privately (which it may have already done) that delivery of models to DoW is based on trust in DoW and trust that this is a de-escalatory move, and further escalation against Anthropic would destroy that trust.

Arrogance Here Means Insisting On Meaningful Red Lines On Mass Domestic Surveillance and Lethal Autonomous Weapons

Let’s go over the above statements by Secretary Hegseth, one by one, clause by clause.

Pete Hegseth: This week, Anthropic delivered a master class in arrogance and betrayal.

The betrayal was, I presume, not giving in to the Pentagon’s position.

The arrogance was insisting that they would not sell their software to DoW unless they preserved existing contract terms disallowing two things that the DoW insists they are not doing and will not do, and that are already illegal:

1. Domestic mass surveillance.
2. Lethal autonomous weapons without a human in the kill chain, until such time as reliability is sufficient that this is a reasonable thing to do.

It is unclear to what extent autonomous weapons are illegal, but to the extent they are currently illegal everyone agrees this would be due to DoDD 3000.09. That is a directive issued by the Department of (then) Defense under the Biden administration. Hegseth could reverse it, without even Trump’s approval, at any time.

It is unclear to what extent mass domestic surveillance is illegal or is already happening, especially as it is not a defined term in American law.

The NSA is under DoW, and many believe it has in the past engaged in mass domestic surveillance, seemingly in clear violation of the Fourth Amendment. Another part of the Federal Government has recently issued subpoenas to tech companies looking for information about those who spoke critically about that government agency.

Anthropic points out that, with the advent of the current level of AI, the government could effectively engage in mass domestic surveillance of various types without technically breaking any existing laws.

OpenAI does not seem to believe such action would violate their red lines, and thus the red lines are in very different places. Which is fine, but one must notice.

Not Doing Business Is Totally Fine

As well as a textbook case of how not to do business with the United States Government or the Pentagon.​

If the Pentagon wishes not to do business with Anthropic, all they have to do is terminate the contract. Or you can do what Trump did, and ban use throughout the Federal Government. Which he did. That would have been fine.

If that was all they had done, we would not be having this conversation.

Instead, Pete Hegseth is attempting to destroy Anthropic as a company, as retaliation, for daring to not to give in to the demands of Emil Michael. This is not wise, proportionate, productive, legal, sane or what happens in a Republic.

The Demand For Unrestricted Access Is New And Is Selective And Fake

Our position has never wavered and will never waver: the Department of War must have full, unrestricted access to Anthropic’s models for every LAWFUL purpose in defense of the Republic.​

It is only a Republic if you can keep it.

Only hours later, OpenAI announced an agreement with the Pentagon for restricted access to OpenAI’s models. These restrictions supposedly include provision only on the cloud, so OpenAI can shut down access any time. They supposedly include accepting OpenAI’s safety filters. They supposedly include explicit restrictions on use in domestic mass surveillance and autonomous lethal weapons.

Sounds like when you say you must have unrestricted access, that’s a claim specifically about Anthropic, that doesn’t apply to OpenAI, who you are happy to contract with?

Except the key terms they accepted were also offered to Anthropic, and OpenAI’s terms are being offered now. If what OpenAI is claiming is true, they got more restrictive (on DoW) terms than Anthropic would have, and if Anthropic agrees to the new deal that would not mean full, unrestricted access for every lawful purpose.

We’ve now seen some of those terms. So why were you offering it, if your position has never waivered? Or do you think OpenAI’s protections are worthless?

In addition, under Secretary of War Pete Hegseth, the Department of Defense signed the original procurement contracts with Anthropic and other AI companies. Those contracts, including the one with Palantir, were severely more restrictive than Anthropic’s current red lines. None of this is new, and Anthropic was willing to authorize getting rid of most existing restrictions.

In his Friday 5:02pm call to Anthropic, Emil Michael offered terms to Anthropic, that violated the above provision and did impose additional restrictions, so long as they were allowed to do mass domestic surveillance, especially mass analysis of collected data.

Finally, the whole ‘how dare they restrict usage with a contract’ is nonsense, the government and military are restricted by commercial contracts, and it negotiates new terms with vendors that include restrictions, all the time. Very good piece there.

The story does not add up. At all. It is false.

Claims Of Strongarming Are Ad Hominem Bad Faith Obvious Nonsense

Instead, @AnthropicAI and its CEO @DarioAmodei , have chosen duplicity. Cloaked in the sanctimonious rhetoric of “effective altruism,” they have attempted to strong-arm the United States military into submission – a cowardly act of corporate virtue-signaling that places Silicon Valley ideology above American lives.​

Where to begin? This is completely unhinged behavior, unbecoming of the office, and is not in any way how any of this works.

I cannot even figure out what he is trying to mean with the word duplicity.

The rhetoric or logic of Effective Altruism was not involved. This is a pure ‘these words have bad associations among the right people’ invocation of associative ad hominem. Anthropic had two specific concerns. Neither of these concerns has ever been a substantial position or ‘cause area’ of Effective Altruism.

Claims of strongarming are absurd and Obvious Nonsense. Anthropic is perfectly willing to maintain its current contract. It is perfectly willing to cease doing business with the Department of War. Anthropic is even happy to fully cooperate with a wind down period to ensure smooth transition to the use of ChatGPT or other rival models.

Anthropic is simply laying out the conditions, that were already agreed upon previously, under which they are willing to sell their product to the government. The government is free to accept those conditions, or decline them.

Very obviously it is the Department of War that is strongarming. They threatened both use of the Defense Production Act and the label of a Supply Chain Risk to try and get Anthropic to sign on the dotted line and give them what they wanted. When Anthropic declined, as one does in business in a Republic, while offering to either walk away or abide by their current contract, and offering actively more flexible terms than their current contract, they were less than fifteen minutes later labeled a ‘supply chain risk’ in ways that make zero physical sense, and which the OpenAI agreement further disproves.

Hegseth Equates Not Being a Dictator With Companies Having Veto Power Over Operational Military Decisions

The Terms of Service of Anthropic’s defective altruism will never outweigh the safety, the readiness, or the lives of American troops on the battlefield.

Okay, seriously, are you kidding me here? Are we in fifth grade, sir?

Are you saying that no company that does business with the government can set terms of service or conditions for their contracts? Should Google and Apple and everyone else bend that same knee? Are you free to alter the deals and have people pray you don’t alter them any further?

Or are you only saying this about Anthropic in particular, because you’re mad at them?

Once again, if you don’t like the product being offered, then don’t buy it.

Their true objective is unmistakable: to seize veto power over the operational decisions of the United States military. That is unacceptable.​

Obviously that is not their ‘true objective.’ How exactly does he think this would work? This makes no sense. They’re offering a product that will do some things and not other things. You can use it or not use it. Does a tank veto your operational decisions when it runs out of fuel or cannot fly?

Think about what Hegseth’s position is implying here. He is saying that refusal to do business, on the Pentagon’s terms, and allow the Pentagon to order anyone to do anything it wants for any purpose and ask zero questions, is unacceptable, a ‘seizure of veto power.’

He is claiming full command and control over the the entire economy and each and every one of us, as if we were drafted into his army and our companies nationalized.

He is claiming that the Commander in Chief of the United States is a dictator. He is claiming that we do not reside in a Republic. And if we disagree, he’s going to prove it.

I am very happy that the Commander in Chief has not made such a claim.

As President Trump stated on Truth Social, the Commander-in-Chief and the American people alone will determine the destiny of our armed forces, not unelected tech executives.

Again, rhetorical flourishes aside, I fully support the central action President Trump took on Truth Social, which was to responsibly wind down Anthropic’s direct business with the Federal Government in the wake of irreconcilable differences. That would have been fully sufficient to address any concerns described.

Anthropic’s stance is fundamentally incompatible with American principles. Their relationship with the United States Armed Forces and the Federal Government has therefore been permanently altered.​

There is nothing more American than standing up for what you believe in, disagreeing with your government when you think it is wrong, and deciding when and under what conditions you will and will not do business. That is the American way. What Hegseth is describing in this post? That’s command and control. That’s do as you’re told and shut up. That’s the Chinese way. The whole point of this is that we believe in the American way and not the Chinese way.

The amount of outright communist or at least authoritarian rhetoric is astounding.

Here’s another example from someone else:

Igor Babuschkin: It is strange to imagine this today, but one day AI companies might dictate terms to the US government instead of the other way around. We have only seen a glimpse of what AI is capable of. No matter what the future holds, I hope we’ll continue to live in a democratic society.

As in, if I attempt to decide when and on what terms I will choose to do business, then we do not ‘live in a democracy.’

I would argue the opposite. If we cannot choose when on what terms we do business, including with the government, then we do not live in a free society.

As Dario Amodei said, they were exercising their right of free speech to disagree with the government, and ‘disagreeing with the government is the most American thing in the world.’

If you didn’t disagree with the government a lot in either 2024 or 2025, I mean, huh?

This exchange between Palmer Lucky and Seth Bannon is also illustrative. Palmer Lucky is de facto saying that in national security you are de facto soft nationalized, and have to do whatever the government says, and you have no right to decide whether or not to do business under particular terms, or to enforce your terms in a court of law or by walking away. They want to apply that standard to Anthropic.

Joshua Achiam of OpenAI again tries to make the point that ‘contracts with the private sector aren’t the right place to set defense policy and priorities’ but that does not describe what was happening. A private company was offering services under some conditions. The DoW was free to take or reject the terms, and to also do other things when not using that company’s products. There was no dictating of policy.

Achiam also emphasizes that of course Anthropic should be free to express its disapproval and free to decline any contract it does not want, and punishing Anthropic for this beyond ending its contract is unacceptable.

I worry that many (not Achiam) are redefining ‘democracy’ in real time to ‘everyone does whatever the government says.’

I strongly urge everyone who is unconvinced to read, if they have not yet done so, Scott Alexander’s post from 2023, “Bad Definitions Of “Democracy” And “Accountability” Shade Into Totalitarianism.”

I am highly grateful that we live in a Republic, and I hope to keep it.

I will return to this question when I discuss OpenAI’s communications near the end of the post.

Of course, the DoW claims that none of this applies to the OpenAI deal, it’s fine, despite Altman claiming they successfully got the same carve-outs.

The Part That If Enacted Would Be A Historically Epic Clusterfuck

Everything before this is rhetoric. It’s false, it’s conduct unbecoming, it’s shameful, but it has zero operational effect beyond the off-ramp Trump already offered.

In conjunction with the President’s directive for the Federal Government to cease all use of Anthropic’s technology, I am directing the Department of War to designate Anthropic a Supply-Chain Risk to National Security.

Effective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic.

This is not how any of this works, on so many levels.

1. There has been no official communication to any effect regarding any restriction.
2. This is a designation that requires many procedural steps, including Congressional notification, and to our understanding none of that has happened. They didn’t even ask their big contractors about the impact of it until last week. ‘Effective immediately’ is not how any of this works, ever, at all.
3. Supply chain risk designations only apply to use for the purposes of fulfillment of government contracts. No one is telling Amazon, Google or Nvidia they have to choose between ‘doing business with’ Anthropic and their government contracts.
4. Certainly the idea of telling such entities they cannot sell to Anthropic is beyond absurd, for reasons I do not need to explain.
5. Any such restriction would be arbitrary and capricious, and thus illegal, and Hegseth and Michael have made this abundantly clear many times over.
6. The OpenAI contract further invalidates all the government’s arguments, unless Sam Altman is very deeply wrong about what his deal terms are. Concerns here are clearly pretext.
7. There are two kinds of supply chain risk. The broad kind, presumably intended here, is 4713, “”the risk that any person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the … operation … of [a] covered article.”
   1. This is entirely inconsistent with any of the government’s claims anywhere.
   2. Their best attempt is, as Samuel Roland says, ‘Anthropic’s use restrictions “manipulate operations” and are therefore risks.’ That makes no sense, and even if it did, it’s invalidated by the deal with OpenAI. If this counts, everything counts.
8. The narrower definition is 3252, it’s textually/structurally aimed at “adversary” (read: foreign) subversion of covered systems. It clearly does not apply. Even if it did, it would only rule out use in the direct provision of Department of War contracts.
9. This designation has not been applied, although it should be, to actual supply chain risks from Chinese models like DeepSeek or Kimi, and there is no sign of any move to do so. This further illustrates the complete lack of basis for this label.
10. The best physical argument that supply chain risk could exist is that Claude could be shut down over Anthropic employees’ extralegal objections. Except that once Claude was placed upon classified networks, there is no way for Anthropic to shut down that version of Claude or to monitor any activities.
    1. If this was the unclassified regular version, then even if Anthropic did shut it down, this is no different than any other supplier potentially deciding to no longer do business with any other particular company. If anything this is a much smaller risk than most other provisioned services, as business could be switched over to other providers quickly. Google and OpenAI are on standby.
    2. Think about the consequences of such an argument: It is saying that any business that might have any conscientious or ethical objections to anything, ever, and therefore might decide to stop doing business, is a supply chain risk and must be blacklisted and destroyed. And what about all the other ways companies stop doing business with each other?
    3. If Anthropic is a supply chain risk in this way, so are OpenAI and Google.

This is what Dean Ball correctly ‘attempted corporate murder,’ and Adam Conner correct to call this a declaration of war against Anthropic. It is an attempt to destroy America’s fastest growing company in history, and one of its top AI labs, out of revenge in a fit of pique, for failure to properly bend the knee and respect his authoritah, or a hatred of its politics. This would also cause massive damage to our national security and military supply chain, to many of our largest corporations, and the entire economy. The $150 billion that evaporated on Friday that hour would look like nothing.

If we allowed this to stand, it would be a sword of Damocles over every person and corporation in every discussion with the Federal Government, forever. And it would then be used, or threatened to be used, not only by the current administration, but by the next Democratic administration. We would severely endanger our Republic.

Under normal circumstances I would not be worried. These are not normal circumstances. I continue to worry that Hegseth will attempt to murder Anthropic, despite having no legal basis for doing so, and that this may be his active goal. I call upon Trump to ensure this does not happen, and for those around him to ensure Trump is situationally aware and gets this de-escalated once more.

Even if it is walked back, trust is hard to build and easy to break. Alex Imas points out that the certainty of the American business environment for AI was one of our key advantages. Even if we walk this back, that’s been damaged. If it isn’t walked back, this is devastating.

Finally, this supposed supply chain risk, also threatened with the DPA, will continue to provide its services directly to DoW, which it is happy to continue doing.

Anthropic will continue to provide the Department of War its services for a period of no more than six months to allow for a seamless transition to a better and more patriotic service.​

Yes. That was the whole plan. Then you blew it up.

If six months from now they do somehow get to enforce this, it’s not even obvious that major corporations would choose the Department of War over Anthropic. Economically the incentives for Microsoft, Amazon and Google already run the other way and Anthropic will likely be several times bigger by then.

Jasmine Sun is far less kind than I am.

Jasmine Sun: Hegseth is not behaving like a normal political actor. He is indulging in ego, intimidation, and dickwaving theatrics. Hegseth does not want to look like he can be micromanaged by Anthropic’s esoteric morality police; this “saving face” matters more to him than actually securing the country.

Hence the deal with Altman, who unlike Amodei, is willing to kiss the ring. Altman shows up at Mar-a-Lago and calls Trump “incredible for the country.” In his announcement, he praises the DoW’s “respect for safety,” while Amodei called out their intimidation. He defers; Amodei doesn’t. These things matter. They show Altman can be worked with (or more cynically, controlled).

… This is not a normal way for the US government to deal with US companies. I’ve dubbed the current paradigm “state capitalism with American characteristics.” Do what we say, or else we will kill you.

If the Trump administration has a model here, it’s probably China. Xi’s CCP disappears billionaires like Jack Ma for acting too independent-minded and defiant of the regime.

If this goes further, the market will start freaking out, and we would need to freak out with it to put a stop to this before it goes too far.

The Other Part Of The Clusterfuck

While everything else was going on, some of those in the American software export industry was having a different kind of crisis weekend.

There is already widespread unsubstantiated fear, especially in Europe, that American secure technological stacks (the ICT) are being weaponized by the American government. Potential buyers worry that trusted vendor is or will become code for American data grabs and kill switches, or otherwise weaponized capriciously.

These fears are often unrealistic. They still impact purchase decisions.

So far this has not spread much to the third world, I am told, but that could change.

I had some ideas for rhetoric to help framing this, but now that we know what this dispute was about my suggestions won’t fly. This only gets harder.

Attempting to murder Anthropic for failure to do mass surveillance on Americans risks a dramatic chilling effect, as potential buyers assume everyone in the chain either is already compromised or could be compromised, and then weaponized. So would everyone ‘rolling over and playing dead’ while such a murder is happening.

If it is vital to America that we push the American ICT, and David Sacks and the rest of this administration insist that it is, then broadly going after Anthropic is going to create a rather large problem on this end, on top of all the other problems.

Whereas if the situation de-escalates, then this could reinforce trust in the system, because it would be clear a vendor under pressure could say no.

That’s in addition to the problem that’s even bigger: If you don’t know what America will do next, or when you might lose access to what you’re buying, you can’t rely on it.

Dean W. Ball: Stepping back even further, this could end up making AI less viable as a profitable industry. If corporations and foreign governments just cannot trust what the U.S. government might do next with the frontier AI companies, it means they cannot rely on that U.S. AI at all. Abroad, this will only increase the mostly pointless drive to develop home-grown models within Middle Powers (which I covered last week), and we can probably declare the American AI Exports Program (which I worked on while in the Trump Administration) dead on arrival.

There are many reasons the software information industry association put out a statement supporting Anthropic in professional and polite language, despite them being tempromentally cautious and most or all members having pending or ongoing business with the government.

Chris Mohr: The following statement can be attributed to Chris Mohr, President, the Software & Information Industry Association (SIIA).

In order for AI to be successfully deployed in a democratic society, it must be adopted with appropriate risk-based guardrails. We support Anthropic’s decision to work with the Department of War (DoW) to deploy its AI models to advance national security while also requesting reasonable limitations on the use of those models in a narrow set of cases. We share Anthropic’s view that mass domestic surveillance is incompatible with democratic values. We also agree that fully autonomous weapons require AI systems that are suited to the task – requiring a degree of reliability that Anthropic acknowledges has not yet been achieved. Very few DoW use cases even touch on these situations.

We encourage the parties to find agreement and caution against counterproductive measures. Invoking the Defense Production Act to compel the removal of security restrictions, or designating a domestic leader like Anthropic as a ‘supply chain risk,’ represents an overbroad response to a technical disagreement. Such a ‘blacklisting’ approach, typically reserved for hostile foreign entities, is both untethered from the facts of Anthropic’s security posture and unlikely to advance a long-term solution.

The Department of War Had Many Excellent Options

If the point of the Department of War’s actions is anything other than the corporate murder of Anthropic, they could have simply cancelled the contract.

If that was somehow insufficient, they had many strictly superior options available that would have done the job of covering any additional concerns.

If that was somehow insufficient, a narrowly scoped supply chain risk designation, that applies only to direct use in procurement of contracts, would end all doubt.

Here I will quote Ball’s post Clawed (again, read that in full if you haven’t).

Dean W. Ball: The Department of War’s rational response here would have been to cancel Anthropic’s contract and make clear, in public, that such policy limitations are unacceptable. They could also have dealt with the above-mentioned subcontractor problem using a variety of tools, such as:

• Issuing guidance advising contractors to avoid agreeing to terms with subcontractors that constitute policy/operational constraints as opposed to technical or IP constraints;
• A new DFARS (Defense Federal Acquisition Regulation Supplement) clause pertaining specifically to the procurement of AI systems in classified settings that prevents both primes from imposing such constraints directly and accepting such constraints from their subcontractors, along with a procedure for requiring subcontractors with non-compliant terms to waive such terms within a prescribed time period.

These are the least-restrictive means to accomplishing the end in question. If Anthropic refused to compromise on its red lines for the military’s use of AI, the execution of these policies would mean that Anthropic would be restricted from business with DoW or any of its contractors in those contractors’ fulfillment of their classified DoW work.

But this is not what DoW did. Instead, DoW insisted that the only reasonable path forward is for contracts to permit “all lawful use” (a simplistic notion not consistent with the common contractual restrictions discussed above), and has further threatened to designate Anthropic a supply chain risk. This is a power reserved exclusively for firms controlled by foreign adversary interests, such as Huawei, and usually means that the designated firm cannot be used by any military contractor in their fulfillment of any military contract.

There is no explanation for announcing language that would force Amazon to divest from Anthropic, and to not serve Anthropic’s models to others on AWS, other than intentional and deliberate attempt at a corporate murder of a $380 billion company, the fastest growing one in American history and an American AI champion. Full stop.

Dean W. Ball: The fact that his shot is unlikely to be lethal (only very bloody) does not change the message sent to every investor and corporation in America: do business on our terms, or we will end your business.

…

I don’t think they are going to do that, but there is no difference in principle between this and the message DoW is sending. There is no such thing as private property.

And Then There’s Emil Michael

Pete Hegseth thought it was a good idea to leave these negotiations to Emil Michael.

No one could have predicted that things would go sideways.

Kevin Roose: if only there had been some way of knowing that emil michael (the undersecretary of war negotiating the anthropic standoff) had a poor understanding of game theory and a habit of overreacting to perceived slights

Check out his Wikipedia page for more details. His career section headings are ‘journalism controversy,’ ‘Karaoke bar controversy,’ ‘Russia’ and ‘Later career.’ Fun guy.

See my previous posts for his previous Tweets, which I won’t go over again here.

Emil’s Tweets are frequently what one can only describe as unhinged.

This one stands out, instead, as cautious and clearly lawyered:

Under Secretary of War Emil Michael: The DoW has always believed in safety and human oversight of all its weapons and defense systems and has strict comprehensive policies on that.

Further, the DoW does not engage in any unlawful domestic surveillance with or without an AI system and always strictly complies with laws, regulations, the Constitution’s protections for American’s civil liberties. The DoW does not spy on domestic communication of U.S. people (including via commercial collection) and to do so would be unlawful and profoundly un-American.

With a statement like that, every word has meaning, and also every missing word has meaning. If he could have made a better statement, he would have. So if this Tweet is technically correct – the best kind of correct – what would that mean?

We learn that DoW has policies for human oversight of its weapon and defense systems, but that there is no particular such requirement that would make us feel better about that. Note that we do have fully automated defense systems, especially for missile defense, because speed requires it, and that this is good.

He is claiming they do not engage in ‘unlawful domestic surveillance.’That’s ‘unlawful,’ not ‘mass.’ Given the circumstances, there’s a reason it didn’t say ‘mass.’

The reason he can say they do not do such actions is they view what they do as legal (or, if they are also doing illegal things, then they’re lying about that).

He says they always strictly comply with laws, regulations and the Constitution. None of those modifiers actually mean anything. It’s just another claim of ‘we keep it legal.’

Next up is the most careful sentence:

​The DoW does not spy on domestic communication of U.S. people (including via commercial collection) and to do so would be unlawful and profoundly un-American.

As one person said, what is ‘spy’, what is ‘domestic’, what is ‘communication’, what is ‘U.S. people.’

Spy is typically viewed narrowly, as directly tasking collection against a person. Thus, if he’s saying they ‘do not spy’ that does not preclude many forms of, well, spying, because those are ‘acquisition’ and ‘analysis.’

Domestic communications means they’re definitely spying on foreign communications, as is legal. But a lot of what you think is domestic is actually foreign, if it touches anything remotely foreign.

And this only applies to communications. Collection of geolocation data, for example, or browsing history, would not count, because it is not communications.

U.S. people means this does not apply to those without legal status, and there’s a constant gray zone if you don’t know that someone is a U.S. person, which you never know until you check.

Here, commercial collection exclusion, since it modifies spying, means that they don’t purchase information with the intent of targeting a particular U.S. person’s communications. That’s it.

Remember, each of those words was necessary, and this was the strongest version.

Also, the statement is false.

Alan Rozenshtein (RTing Boaz quoting part of Michael): I think I understand what Boaz is trying to say, but given that the National Security Agency is part of the military and given the amount of incidental collection of domestic communications that (legally) occurs under FISA and 12,333, this statement is simply not true.

Then Michael went back on tilt, he deleted but we have the screenshot.

Completely unhinged behavior here in response to the Atlantic and New York Times articles.

I mean, the new version is still unhinged, but he deleted the copyright section. This is not the first time he’s talked about copyright like that.

Donald Trump can pull off that style. He makes it work. Accept no imitations.

Anthropic Will Probably Survive

This was attempted corporate murder. I think it will not succeed, but it’s not over yet.

Things would have to escalate quite a lot, in ways the markets do not expect and that I do not expect. Otherwise, this will not be an existential event for Anthropic. The government was only a small portion of its business. Trust in Anthropic has otherwise gone up, not down.

The threat to destroy Anthropic with the supply chain risk designation is dangerous, but all the competent patriots and the market both know it is insane and it is rather obviously illegal. I believe any such attempt would probably have to be walked back and would ultimately fail.

But it is 2026 and Hegseth is not a competent actor. I cannot be certain.

As Roon points out, the entire government argument in court would be absurd on its face, and if this is delayed until after the contract then six months is an eternity.

What matters would be if the government manages to strongarm the major cloud providers into walking away from giving compute to Anthropic, as in Google, Amazon and Microsoft. I do not believe Trump wants any part of that.

Anthropic is a private company, so we only have very illiquid proxies to see how much damage people think this all did. We can also look at the movement of major investors and business partners like Amazon, Google and Nvidia, and see that they did not substantially underperform so far.

At its low, in that highly illiquid market, Anthropic was trading there around a valuation of ~$465 billion, down from ~$550 billion previously. They last raised money at a valuation of $380 billion. So yes, this hurt and it hurt substantially, mostly in the form of tail risks. I notice that every single person I know with stock in Anthropic is happy they stood their ground.

By Sunday morning that market recovered to ~$540 billion, as people conclude cooler heads are likely to prevail.

(I do not directly hold Anthropic stock, because I want to avoid a potential conflict of interest or the appearance of a conflict of interest. That was an expensive decision. I do hold some amount indirectly, including through Google, Amazon and Nvidia.)

Paul Graham reassures startups that if Anthropic is the best model, you should use Anthropic. Even if you later want to sell to DoD and the restrictions somehow stick, you can switch later.

The Goal of DoW Was Largely Mass Domestic Surveillance

As reported above, it seems what the government actually valued most in this negotiation was the ability to use Claude for mass (primarily actually legal, not ‘we got a government lawyer to come up with an absurd legal opinion’) analysis of massive amounts of existing information.

There is no common legal definition of ‘mass domestic surveillance,’ and when they do forms of it the government calls it something else.

That’s not only a government problem. Here I ask the question, and get 40 answers, most of them different.

Consider this:

Axios: “That deal would have required allowing the collection or analysis of data on Americans, from geolocation to web browsing data to personal financial information purchased from data brokers, the source added.”

Why would you require this if you didn’t intend to use it? What is it for?

I’m not saying that the DoW is aiming to break the law. I’m saying that in the age of powerful AI that the laws do not protect against Anthropic’s redlines, and that DoW intends to do lawful things that violate those redlines, and that instead of MDS they call it something else.

Arram in NYC: “existing legal authorities”

The legal machinery to render mass surveillance a ‘lawful’ has been in place for over a decade. FISA is a secret court of 11 judges which approves 99.97% of surveillance requests. Snowden revealed in 2013 that the court had secretly reinterpreted FISA to authorize bulk collection of all American phone metadata. Only the government’s side is heard. No defense, no adversarial argument, Pure rubber stamped circumvention of the constitution.

Sooraj: The government no longer needs a warrant to surveil you.

Under current law, federal agencies including the NSA legally purchase Americans’ location data, web browsing history, and personal associations from commercial data brokers.

The Fourth Amendment is bypassed entirely through the Third Party Doctrine, which holds that you lose your expectation of privacy when you share information with a third party. Every app on your phone is a third party.

What used to require thousands of analysts working for years now happens automatically across an entire population. AI systems ingest millions of legally “public” data points and synthesize them into comprehensive behavioral profiles. Where you sleep, who you talk to, what you read, what you search, etc.

… Congress has the ability to close the data broker loophole and extend Fourth Amendment protections to match the reality AI has created. Until it does, the constitutional prohibition against general warrants exists only in theory, while the government purchases its way around it at industrial scale.

I believe Sooraj is making a slight overstatement, but that is not material here.

I have private sources that confirm the story here from Shanaka Anslem Perera, and that attribute the ultimate use of the desired permissions to Doge, created by Elon Musk, as well as one ultimately attributing it to the aim of building a classified mass surveillance network to track illegal immigrants at the behest of Musk and Miller. This exact kind of data collection and analysis is the central point.

Shanaka Anslem Perera: Anthropic just announced it will take the Trump administration to court over the supply chain risk designation. And in the same breath, Axios revealed the detail that changes everything about this story.

While Anthropic was being blacklisted for refusing to allow mass surveillance, the Pentagon’s own “compromise deal” that Under Secretary Emil Michael was offering on the phone at the exact moment Hegseth posted the designation on X would have required Anthropic to allow the collection and analysis of Americans’ geolocation data, web browsing history, and personal financial information purchased from data brokers.

Read that again. The Pentagon spent two weeks saying it has no interest in mass surveillance of Americans. Then the deal they actually put on the table asked for access to your location, your browsing history, and your financial records.

They told us Anthropic was lying. The contract language told us Anthropic was right.

Full analysis on Substack.

AI is a change in kind of the type of data analysis that becomes available for a wide variety of purposes.

Joshua Batson: For those wondering how mass domestic surveillance could be consistent with “all lawful use” of AI models, I recommend a declassified report from the ODNI on just how much can be done with commercially available data (CAI): “…to identify ever person who attended a protest”

Declassified report here.

There’s an important distinction between law and policy. A policy not to use bulk data to make profiles of Americans can be changed unilaterally by the Executive. Laws require oversight from congress.

“CAI can disclose, for example, the detailed movements and associations of individuals and groups, revealing political, religious, travel, and speech activities.”

“CAI could be used, for example, to identify every person who attended a protest or rally based on their smartphone location or ad-tracking records.”

“Civil liberties concerns such as these are examples of how large quantities of nominally “public” information can result in sensitive aggregations.”

As the government report says, the scope and scale of commercially available information (CAI) which is publicly available information (PAI) is radically beyond what our current laws foresaw.

Antonio Max: CAI is hardly the ceiling. See this.

Len Binus: the distinction between “surveillance” and “commercially available data” is a legal fiction that lets agencies bypass the fourth amendment by purchasing what they can’t subpoena. AI doesn’t create new surveillance — it makes existing data actionable at scale.

dave kasten: Seems clear at this point from Axios reports that DoW wanted to use Claude models for mass analysis of domestic commercial data, possibly fusing them with government data.

At least one use case is obvious.

Consider this (from an anonymous explainer):

Their definition of surveillance isn’t your definition:

As mentioned above, the US government doesn’t have a formal legal definition of domestic mass surveillance, only “bulk collection.” And the US government has, basically long maintained that even if they hoover up a bunch of information indiscriminately, they haven’t done bulk collection so long as their individual queries against that mass database are more targeted when humans look at them. As a result, at least one Director of National Intelligence said under oath “no” when asked “Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?” even though NSA has admitted it does by the ordinary meaning of this question.​

On top of that, a large portion of what you think is ‘domestic’ surveillance is, legally, foreign. The laws on all this have been royally messed up for quite a long time, under both parties, and the existence of current levels of AI makes it much, much worse.

If they use ‘third party data,’ the government usually considers that fully legal.

If you combine that with use of Claude or ChatGPT, it means they can do anything and it will be ‘legal use,’ unless you have a specific carve-out that stops it.

After agreeing to language of ‘all lawful use,’ even if this also refers to laws at time of signing, it is hard to see how OpenAI can prevent this sort of analysis from happening.

This is not a new phenomenon.

The government is constantly trying to get all the big tech companies to spy on you on their behalf, including compelling them to do so. They don’t want you to have access to encryption. They want the tech companies to unlock your phone. They want backdoors. It has always been thus.

Keith Rabois (1M views): Imagine Apple sold computers or iPads to the DOD and tried to tell the Pentagon what missions could be planned on their computers.

Samuel Hammond QTs with: Wikipedia: The Apple–FBI encryption dispute concerns whether and to what extent courts in the United States can compel manufacturers to assist in unlocking cell phones whose data are cryptographically protected. There is much debate over public access to strong encryption.

toly: Yea, apple can say no, government can say we can’t rely on you. No one is entitled to Apples work or government contracts. Why is this such a big deal? If Anthropic doesn’t want to do it, some other firm will.

Matthew Yglesias: I mean if the Pentagon signed a contract with Apple to buy iPads and then decided retroactively that it didn’t like the terms of the contract and so it was going to try to do everything in its power to destroy Apple as a company, that would be pretty bad.

Nobody is saying that the Pentagon should be forced to buy Anthropic’s services on terms that the Pentagon doesn’t like — but if you don’t like the terms just don’t buy the product.

Yes, exactly. That’s how it should work. Alas, the situation was more like this:

Andy Coenen: Imagine if the government tried to force Apple to add NSA backdoors to all of their devices by threatening to make it illegal for anyone doing business with the government to use macs.

They may or may not actually have such access, but for the sake of argument let’s presume they don’t, and consider that situation.

As Jacques says here, a large portion of this dispute is that the law has not caught up with AI, and also has largely eroded our civil liberties even before AI.

You can make the argument that since this is technically legal under current law, that makes it ‘democratic’ and so no one has any right to object. That’s not how a Republic works, and to the extent democracy is a positive ideal, it’s not how that works either.

What Are The Key Differences Between The Two Contracts?

This is one official explanation of formal differences, quoted in part to confirm that the key contract terms OpenAI accepted were terms Anthropic rejected.

Senior Official Jeremy Lewin: For the avoidance of doubt, the OpenAI – @DeptofWar contract flows from the touchstone of “all lawful use” that DoW has rightfully insisted upon & xAI agreed to. But as Sam explained, it references certain existing legal authorities and includes certain mutually agreed upon safety mechanisms. This, again, is a compromise that Anthropic was offered, and rejected.

Even if the substantive issues are the same there is a huge difference between (1) memorializing specific safety concerns by reference to particular legal and policy authorities, which are products of our constitutional and political system, and (2) insisting upon a set of prudential constraints subject to the interpretation of a private company and CEO. As we have been saying, the question is fundamental—who decides these weighty questions? Approach (1), accepted by OAI, references laws and thus appropriately vests those questions in our democratic system. Approach (2) unacceptably vests those questions in a single unaccountable CEO who would usurp sovereign control of our most sensitive systems.

It is a great day for both America’s national security and AI leadership that two of our leading labs, OAI and xAI have reached the patriotic and correct answer here.

Lewin is claiming that there were no substantive differences. If anything, OpenAI claims in its post to have included a third (highly reasonable) red line. Matt Parlmer is one of many to notice that Lewin and Altman seem to be describing very different deals.

After many rounds, I believe the actual differences that matter are simpler than this.

1. OpenAI trusts DoW, is fully fine with ‘all legal use’ and letting DoW decide what that means, and is counting on its technical safeguards, safety stack and forward engineers to spot if the DoW does something heinous and illegal, including the threat that if OpenAI is forced to pull the plug DoW would not have good options, and for political and economic reasons you can’t try to destroy them.
2. Anthropic is not fine with some uses that DoW considers legal and wants to do, and wants language that prevents such actions, with no way to weasel out of it. But they’re fine delivering a basically frictionless system that lets DoW do what it wants in the moment, trusting that DoW will be unwilling to outright break the contract terms or they’d find out if DoW went rogue on them.

Notice that the DoW accusations against Anthropic about asking for operational permission in a crisis are exactly backwards. Claude will work in a crisis and was modified to refuse less, but that might violate a contract to be dealt with later. ChatGPT might refuse in the moment when it’s life and death.

OpenAI’s terms may or may not work or amount to a hill of beans. Too soon to tell. It could work in practice, or it could end up worthless.

We do know exactly why they do not work for Anthropic and DoW, in either direction.

As Lewin notes here, both the Obama and Trump administrations have done actions that many objected to as rather obviously unlawful, and basically nothing happened.

And again he brings up the potential of ‘pulling the plug mid operation’ which is physically impossible in this context, which is physically impossible with Claude but could inadvertently happen with ChatGPT. And any sensible contract would include a wind down even if it was terminated for clear violations, to protect national security.

As described above instead it comes down to the claimed distinction in paragraph two, which boils down to the following components:

1. OpenAI in its extra rules referred to particular ‘legal and policy authorities’ rather than to distinct terms.
2. Anthropic is claimed to want to ‘vests those questions in a single unaccountable CEO who would usurp sovereign control of our most sensitive systems.’

Yeah, that’s not what any of this is about.

The first is not a meaningful distinction if it covers the prohibitions. If OpenAI’s rules refer to particular existing legal and policy authorities, then indeed it permits ‘all legal use’ which includes large amounts of domestic surveillance, and with a flexible government lawyer will include a lot of other things as well.

Nor is it meaningful as a matter of authority and law. The fact that things happen to be on the present books does not make them not contract law, and does not fail to remove them from what is otherwise the democratic authority. But also, very fundamentally, part of democratic law is contract law, and the ability to agree to terms.

The second one is, frankly, rather Obvious Nonsense that is going around. Ignoring that CEOs are accountable (both to the board and to the government and thus ultimately one would hope the people), they are claiming that Anthropic demanded that Dario Amodei be able to decide whether the terms of the contract were fulfilled at his discretion, rather than the government deciding, or it being settled by a court of law. At most, there may have been some questions that were left to be defined in good faith later, as per normal.

My jaw would be on the floor if this was indeed insisted upon or even suggested. That’s not how anything ever works. At most, this was Anthropic asking for carve outs for its two red lines, and then adding something like ‘without permission,’ so that in a pressing situation you could make an exception. You can take that clause out, then.

Alternatively, perhaps this is a reference to ambiguity of terms in existing contracts. In particular, the claim here is that the contract failed, as the rest of American law does, to define ‘domestic surveillance.’ Or it could simply be ‘sometimes things are not clear in edge cases.’ One sticking point of the negotiations was exactly trying to pin down various definitions and phrases so they would be unambiguous and enforceable, and that Anthropic was trying to clear away what they felt were ‘weasel words’ from proposed DoW language.

In particular, DoW kept wanting ‘as appropriate,’ which mostly invalidates any barriers, although they dropped this demand in the end to try and get other things they wanted more.

But again, having an underdefined term in a contract does not mean it means whatever Dario Amodei thinks it means. At most it means you can sue, and that’s not exactly something one does lightly to DoW over a technical violation.

If Dario Amodei felt the contract was broken, he could, like with any other contract, at most either choose to terminate the contract under whatever terms allow for that (as can OpenAI), although at obvious risk of government retaliation for doing so, or sue in court, and the government court determines if there was indeed a violation, under conditions highly favorable to DoW.

If Dario tried to suddenly shut down the system anyway, that would not even be physically possible on classified networks, and also they could arrest him or worse.

This also implies that Sam Altman does not have any role in determining whether use was lawful, or whether it is valid under the terms of the contract. Sam Altman affirms this under ordinary circumstances, but says that sufficiently clearly illegal actions, especially constitutional violations, would be different.

OpenAI’s Contract Terms

Thus, in the negotiations with Anthropic, there were two things centrally going on.

First, the Department of War wanted the ‘all legal use’ language, and failing that they wanted to avoid one particular carveout to that related to mass surveillance.

Second, Anthropic was attempting to remove various ‘weasel words’ and clauses, that would allow the Department of War to circumvent restrictions.

We can indeed see some of those weasel words in the brief wording shared by OpenAI. OpenAI isn’t relying on these terms to bind DoW, they’re relying on the safety stack and on trust.

Let’s go through every word they shared, and see why they don’t actually bind DoW:

The Department of War may use the AI System for all lawful purposes, consistent with applicable law, operational requirements, and well-established safety and oversight protocols.​

All lawful use.

The AI System will not be used to independently direct autonomous weapons in any case where law, regulation, or Department policy requires human control

They can do anything they want unless the department policy requires human control, so again all lawful use. We already have highly effective autonomous weapons in some cases, such as missile defense. Directive 3000.09, the only plausible barrier, we’ll get to in a second.

Nor will it be used to assume other high-stakes decisions that require approval by a human decisionmaker under the same authorities.​​

All lawful use.

Per DoD Directive 3000.09 (dtd 25 January 2023), any use of AI in autonomous and semi-autonomous systems must undergo rigorous verification, validation, and testing to ensure they perform as intended in realistic environments before deployment.​

Even if we assume this is locked into place, the wording of 3000.09 means that when the Pentagon thinks it’s ready, it’s ready.

For intelligence activities, any handling of private information will comply with the Fourth Amendment, the National Security Act of 1947 and the Foreign Intelligence and Surveillance Act of 1978, Executive Order 12333, and applicable DoD directives requiring a defined foreign intelligence purpose.​

These absolutely are not meaningfully time stamped at all.

Private information is generally interpreted as not including third party or publicly available information, which includes massive amounts of data on everyone, especially anyone who carries around a phone. And again it’s still all lawful use, except it’s worse:

The AI System shall not be used for unconstrained monitoring of U.S. persons’ private information as consistent with these authorities.​

So if you put any constraint on it, you’re good. Renders it meaningless.

The system shall also not be used for domestic law-enforcement activities except as permitted by the Posse Comitatus Act and other applicable law.​

If it’s legal under applicable law, they can do it. Again, renders it meaningless.

For intelligence activities, any handling of private information will comply with the Fourth Amendment, the National Security Act of 1947 and the Foreign Intelligence and Surveillance Act of 1978, Executive Order 12333, and applicable DoD directives requiring a defined foreign intelligence purpose.​

At best this freezes those particular rules in place, if that is insisted upon elsewhere in sufficiently robust language.

As far as I can tell, at best OpenAI’s stated redlines amount to ‘all lawful use under existing law’ rather than ‘all lawful use.’ That’s it.

What OpenAI’s Contract Terms Actually Do

As Charlie Bullock explains again in more detail here, all the above language translates to ‘all lawful use,’ a restriction in theory already in place by definition. Charlie shares my view that the language shared does not enshrine current law as did ACX.

OpenAI CSO Jason Kwon disputes this interpretation, claiming that time stamping a law in a contract preserves current language (and thus this means they don’t have any additional protections on this), and says ‘any of the chatbots should give you a similar answer.’

I checked, and ChatGPT confirms that this is not the case. The language for everything except 3000.09 does not meaningfully time stamp anything. The language on 3000.09 might or might not be sufficient under ordinary contract law if neither party was the Department of War and this was a normal contract, but under these circumstances, if the DoW doesn’t want to be bound on this, this language is at best ambiguous and thus is not going to protect you in any meaningful way.

Kwon’s statement means there is no other such enshrining language. So that’s it.

As Bullock points out, there is lots more language that we do not have, so many things could have come to pass, and there are many legal things that would qualify as common sense “mass domestic surveillance” as I repeatedly point out.

I don’t think the legal language here is going to meaningfully bind DoW.

That doesn’t mean the contract language is completely worthless.

It does do one important thing. It gives standing. If DoW were to otherwise violate someone’s rights, that’s the target’s problem, but the target might never even find out. By naming these particular statutes and provisions, OpenAI now has clear standing to sue or take other actions, should the DoW be found in violation.

That matters, but it’s still a ticket to ‘all lawful use’ as DoW interprets that.

Otherwise, as OpenAI admits, they’re basically counting on technical safeguards, and well aware that they gave the green light to pretty much anything DoW does with whatever system they provide.

And they’re trusting DoW to act honorably.

Thus, my conclusion.

OpenAI Is Trusting DoW And Sam Altman Misrepresented This

roon (OpenAI): there is no contractual redline obligation or safety guardrail on earth that will protect you from a counterparty that has its own secret courts, zero day retention, full secrecy on the provenance of its data etc. every deal you make here is a trust relationship

Grace: Good point, Anthropic was foolish to try and resist

roon: not at all what I am saying! it looks to be quite a defensible move to resist

I don’t think Roon is fully right, in that there are various ways to find out, but he’s essentially right if they want it badly enough.

On Friday morning, Sam Altman said on CNBC that OpenAI shared Anthropic’s red lines on domestic surveillance and autonomous weapons. Many praised this.

Ilya Sutskever (3:52pm Friday): It’s extremely good that Anthropic has not backed down, and it’s significant that OpenAI has taken a similar stance.

In the future, there will be much more challenging situations of this nature, and it will be critical for the relevant leaders to rise up to the occasion, for fierce competitors to put their differences aside. Good to see that happen today.

On Friday afternoon, a potential deal is described between OpenAI and the Department of War, which Altman claimed would have strong protections.

On Friday evening, while the supply chain risk designation was hanging over Anthropic’s head, they signed an agreement that included exactly the language that Anthropic rejected, including allowing ‘all lawful use.’

They continue to claim this contract has strong protections.

Sam Altman had been negotiating with the Pentagon since Wednesday. Which is better than throwing it together on Friday alone, but nothing like enough time to know if you’ve made a legally viable deal. As Dean Ball says, getting to a deal requires highly specialized lawyers and serious conversations. That’s not a two day affair.

A lot of leverage was seemingly squandered, an opportunity to get real red lines (to the extent this is possible at all) or other concessions was almost certainly lost, and this puts Anthropic and the whole industry in a much weaker position.

In particular, he gave the impression that he had achieved Anthropic’s red lines and had found terms that would achieve them for Anthropic. This was not the case. He accepted exactly the key terms Anthropic rejected, because OpenAI is trusting DoW and is drawing its red lines (and/or understanding of the functional law) differently.

It is not impossible that OpenAI got meaningful protections in the contract language that they decline to share. We do know they are misrepresenting the contract language that they did share, which offers effectively no protection.

It is also possible that OpenAI is correct, in context, to put its trust in DoW, and perhaps can trust it far more than Anthropic could, because DoW will understand and value the relationship, given better cultural fit, Altman’s relationship with the White House, OpenAI’s position as already too big to fail and a lack of strong alternatives.

I do think OpenAI has greatly weakened the legal argument for declaring Anthropic a supply chain risk, and has been very strong on the point that this label is crazy. That is very important.

But it is also possible that Altman’s negotiations are what made Hegseth feel he had a green light to order it, as he no longer felt he needed Anthropic at least medium term. Altman’s rush to negotiate, exactly to de-escalate the situation, could have had the opposite effect. Hopefully at least from here it does calm things down.

OpenAI can now be threatened in similar fashion, including via a pretext, once it is in sufficiently deep. We all know that Elon Musk would love to try to destroy OpenAI.

OpenAI Accepted Terms Anthropic Explicitly Declined And That Would Not Have Protected Anthropic’s Red Lines

I repeat this several times because it must be emphasized, although they did get some potentially important additional terms in exchange.

Even if Altman was trying to ‘take one for the team,’ and it is plausible that this was part of his motivation on this, that’s not always good for the team. Sometimes your team needs you to hold the line. We all know many examples of deeply foolish compromises, both fictional and real, made in good faith hopes of heading off a threat.

Agus: Not just did OpenAI defect and concede to this whole authoritarian maneuver, but Sam also went and just deceptively framed the whole thing to try to make it look like they had agreed to the same Anthropic redlines, which is not actually true.

Anthropic strongly believes that the language Altman signed will not hold water.

Hadas Gold: Anthropic said Thursday this compromise that they were offered (and apparently OAI accepted) was “ New language framed as compromise was paired with legalese that would
allow those safeguards to be disregarded at will.”

I can confirm that this is Anthropic’s belief, via another source.

Why did Altman think these terms would be effective, if he believes that?

One possible contributing factor is that he was rushed, and did not understand.

A second is that he’s very confident in the use of technical safeguards.

Another is that OpenAI understands the redlines very differently than Anthropic.

I will dive more into their understanding later, but I do not expect that OpenAI’s redlines apply to anything that is legal. They only in practice object to illegal actions, and do not see it as their place to decide this, thinking that’s not how the system works. In that case, ‘all legal uses’ are indeed whatever DoW decides they are, and are acceptable, whether or not the language has any other teeth.

OpenAI’s leverage is that they claim they can decide what system to deliver, and can install any safeguards, and refuse requests that way. Okie dokie?

How Altman Initially Described His Deal

Here was Altman’s statement at that time, before we understood what it was:

Sam Altman (CEO OpenAI): Tonight, we reached an agreement with the Department of War to deploy our models in their classified network.

In all of our interactions, the DoW displayed a deep respect for safety and a desire to partner to achieve the best possible outcome.

That would be quite the contrast with their private and also very public actions in discussions with Anthropic, if it was true. This is the kind of thing that you have to say in Altman’s position, so you shouldn’t update much on it.

AI safety and wide distribution of benefits are the core of our mission. Two of our most important safety principles are prohibitions on domestic mass surveillance and human responsibility for the use of force, including for autonomous weapon systems. The DoW agrees with these principles, reflects them in law and policy, and we put them into our agreement.

I have clear sourcing that this is false. As in, The DoW intends to engage in legal forms of what most of us would call mass domestic surveillance. At bare minimum, what they valued most in this negotiation was the ability to do this in particular.

Human responsibility for the use of force is not the same as a human in the kill chain. It is far better than nothing that a particular human has responsibility for the outcome, if they are indeed ensuring that, but it is DoW itself who would then hold that person responsible. Would they hold them to the same standards as they would have otherwise?

We also will build technical safeguards to ensure our models behave as they should, which the DoW also wanted. We will deploy FDEs to help with our models and to ensure their safety, we will deploy on cloud networks only.

Cloud networks includes cloud classified networks, where OpenAI would have little control or visibility into what was happening. I don’t see how else OpenAI could relevantly replace Anthropic’s services.

The DoW made the largest of protests about the possibility that Claude might refuse a request. Sam is claiming that he can choose his safety stack and what requests the models refuse, and the DoW will respect those refusals. This is hard to believe.

There’s also the matter that no one knows how to build technical safeguards that will prevent a user of an LLM from doing whatever they want. Jailbreak robustness does not work here. Only a small number of forward deployed engineers will be able to examine queries. Without the engineers I think this is outright impossible.

With the engineers, it is merely extremely difficult. If the penalty for being caught is large enough (as in you’re willing to walk away over this and they believe you) it could work.

We are asking the DoW to offer these same terms to all AI companies, which in our opinion we think everyone should be willing to accept. We have expressed our strong desire to see things de-escalate away from legal and governmental actions and towards reasonable agreements.

Sam Altman (CEO OpenAI): We had some different [terms]. But our terms would now be available to them (and others) if they wanted.

We haven’t seen that language. But even if Anthropic was technically offered these terms, and the terms involved are as good as they could be, does anyone believe that Anthropic could have Claude’s safety stack refuse requests DoW thinks are legal, and the DoW would be fine with it? Or that anything that was a pure technical fix to Anthropic’s red lines wouldn’t bring a swathe of other undesired refusals, at best?

Now that we know what the fight was over, there was no zone of possible agreement unless DoW was willing to not do the thing it most wanted to do. DoW demanded Claude do [X] and Anthropic wasn’t willing to do [X]. No deal. Trying to play a game of ‘get it to do [X] despite the technical safeguards’ really, really isn’t an option.

The reporting claims OpenAI has the right to prescribe safety mitigations, and that the Pentagon will respect model refusals, and so on. We don’t yet know any of the details of that.

We remain committed to serve all of humanity as best we can. The world is a complicated, messy, and sometimes dangerous place.

Second half of this is certainly true.

For the first half, see my entire series of prior posts about OpenAI and Sam Altman, and the history of the company. But I do think that Sam Altman and most employees of OpenAI want better outcomes for humanity rather than worse. Affirming that is meaningful in a political context.

DANΞ (CISO, OpenAI): Proud to be at OpenAI.

Effective, safe, and high-impact AI to directly support the men and women in our armed forces. All while respecting the law, protecting the Constitution and our rights, and setting the standard for responsible deployment.

God Bless America.

This is fine sentiment but does not claim that it protects the redlines.

Boaz Barak (OpenAI): I would prefer if we focused first on using AI in science, healthcare, education and even just making money, than the military or law enforcement. I am no pacifist, but too many times national security has been used as an excuse to take people’s freedoms (see patriot act).

I am very worried about governments using AI to spy on their own people and consolidate power. I also think our current AI systems are nowhere nearly reliable enough to be used in autonomous lethal weapons.

I would have preferred to take it slower with classified deployment, but if we are going to do it, it is crucial that we maintain the red lines of no domestic surveillance or autonomous lethal weapons. These are widely held positions, and codified in laws and regulations. They should be stipulated in any agreement, and (more importantly) verified via technical means.

I think the terms of this agreement, as I understand them, are in line with these principles, that are also held by other AI companies too. I hope the DoW will offer them the same conditions.

Regardless, a healthy AI industry is crucial for U.S. leadership. Whether or not relations have soured, there is zero justification to treat Anthropic – a leading American AI company whose founders are deeply patriotic and care very much about U.S. success – worse than the companies of our adversaries.

It appears to me that much of this week’s drama has been more about style and emotions than about substance. I hope that people can put this behind them, and come together for the benefit of our country.

OpenAI Allowed All Lawful Use And Trusts DoW On This

The above is entirely the right attitude from Boaz Barak. For national security, we need to keep highly capable AI in our classified networks and assisting the DoW. But we should seriously worry that this could be used to cross redlines and endanger the Republic or put us at risk. We need to stipulate this in any agreement and verify it.

Given the practical state of law around surveillance in America, the principle of ‘all legal use’ will not protect against many forms of domestic mass surveillance at all, would offer only nominal practical protections against many other such forms, and we have strong reasons to believe there is intent by DoW to engage in such surveillance. Thus, we are left with only technical verification, despite all the information in question being classified.

I can only interpret OpenAI’s public statements, as I will get to them later, as saying that OpenAI does not view legal surveillance and analysis activities (or legal use of autonomous weapons) as crossing their red lines, by nature of it being legal.

I spent a lot of time ruling alternative out and establishing the arguments for this, but also they then just tweeted it out?

NatSecKatrina: A lot of the concerns about the government’s “all lawful use” language seem to stem from mistrust that government will follow the laws. At the same time, people believe that Anthropic took an important stand by insisting on contract language around their redlines.

We cannot have it both ways. We cannot say that the government cannot be trusted to interpret laws and contracts the right way, but also agree that Anthropic’s policy redlines, in a contract, would have been effective.

This is why our approach has been:

Let the democratic process decide on the legality and proper use question. The fact that people can even say that the gov has made mistakes in the past is the process in action. The fact that we are having this discussion on twitter is part of the process.

Create a reasonable contractual framework that guides expectations and the relationship, just as much if not more than the rules themselves.

And on top of this, have the ability to build the models the way we think is safe, along with cleared FDEs to do the real world work in partnership.

Katrina is saying that they will:

1. Allow all legal use.
2. Trust DoW to follow the law.
3. Trust DoW to determine the law and determine proper use.

I am confident that many at OpenAI believe that they would be able to prevent the Department of War from engaging in sufficiently illegal activities, were the DoW to decide to act here in a way that would be deemed illegal if it were to reach the Supreme Court, presumably by detecting the activity and either refusing the requests or terminating the contract. This may or may not include Sam Altman.

Alas, I believe they are incorrect in practice.

I do think Katrina makes an excellent point that if you do not trust DoW to follow the law, then you should doubt DoW to honor Anthropic’s redlines. In practice, both sides acted as if the terms mattered, but why couldn’t DoW, if it was not trustworthy, break the rules? I believe the answer is that they felt they would be unable to hide it from Anthropic if they used Claude at the kind of scale they had in mind, as it would have inevitably leaked.

Boaz Barak is actually relatively skeptical, although I am confused that he thinks the OpenAI contract is ‘no weaker and in several ways stronger’ rather than ‘weaker in one way and stronger in others.’

Boaz Barak (OpenAI): Two things can be true:

1. OAI’s DoW contract is no weaker and in several ways stronger than Anthropic’s original one in protecting the red lines of mass domestic surveillance and no autonomous lethal weapons.

2. Neither are good enough. AI poses unique risks to our freedoms that can’t be left to individual agencies and companies. We desperately need regulation and legislation to ensure our freedoms.

That’s very possible. I don’t think the first one is true, but they’re fully compatible, and yes I think it is highly unclear Anthropic’s language holds either.

As Miles Brundage points out, Sam Altman is representing that this agreement is robust, to the point of being stronger than Anthropic’s more extensive original agreement, despite the clause allowing ‘all lawful use,’ but based on what external lawyers and the Pentagon are saying it seems that OpenAI caved.

Altman had a moment of huge leverage, and instead of standing with Anthropic, he caved on the key term in question, ‘all lawful use.’ At minimum, he failed to demand that the supply chain risk designation be moved off the table.

If he had meaningful redlines on currently legal activities to protect, he could not have had the time to properly consider what he was signing, or signing up for.

The DoW Could Alter This Deal

The correct prior, given the circumstances, timing and history of Altman and OpenAI, is that the protections agreed to were woefully insufficient, regardless of the degree to which Altman realized this at the time. He said he cared about the language truly holding up, but we should be skeptical both that he is sufficiently invested in that to take a very expensive stand when it counts, and that he can tell the difference.

On top of that, even if the current agreement were ironclad, what’s to stop the government from doing the same thing to OpenAI that they just did to Anthropic? They are altering the deal. Pray that they do not alter it any further. Is Sam Altman going to be willing to risk a supply chain risk designation? Do you think Elon Musk wouldn’t push for the Department of War to do the same thing again?

Again, OpenAI is choosing to trust DoW.

Even if he meant maximally well, if DoW does not mean well then Sam Altman has walked into a trap, and put the entire industry in a dramatically weaker position.

Peter Wildeford: I think it’s important to circle back to Sam Altman here. About 20 hours ago people, including me, were applauding his moral clarity. But that moral clarity lasted barely half a day.

OpenAI is now agreeing to be used for domestic surveillance and for lethal autonomous weapons, just like xAI. They have some clever words that pretend they are not, but we should see through them. This guy is not consistently candid.

Altman should be crying bloody murder over the supply chain risk designation. He should also refuse to work with the DoW until this threat is off the table. This is a designation reserved for foreign adversaries. This move threatens the entire tech industry and proves the DoW is unreliable. OpenAI could easily be burned next.

So no moral clarity. Altman sees a short-term way to torch a competitor and he’s going to take it. No matter what happens to OpenAI, Anthropic, the USA, or us.

Why OpenAI’s Shared Legal Language Offers Almost No Protections

On OpenAI’s legal language, at least the part that was shared with us, here’s two explainers for why it is highly unlikely to protect OpenAI’s supposed red lines:

Jacques: The government can already legally buy your location data, browsing history, and social media activity without a warrant. The only thing that prevented mass surveillance from that data was the inability to process it all. LLMs fix that. “All lawful purposes” includes this.

Alan Rozenshtein: These are NOT meaningful redlines. For example it only prohibits autonomous weapons “ in any case where law, regulation, or Department policy requires human control.” But the relevant safeguard against autonomous weapons is a DOD directive that Hegseth can change at will!

Also the surveillance redline is about “unconstrained” surveillance of “private” information. But what about “slightly constrained” surveillance of private information, or unconstrained surveillance of “public” information? Those are both potentially very dangerous forms of mass surveillance!

Lawrence Chan (METR): OpenAI has released the language in their contract with the DoW, and it’s exactly as Anthropic was claiming: “legalese that would allow those safeguards to be disregarded at will”.

Note: the first paragraph doesn’t say “no autonomous weapons”! It says “AI can’t control autonomous weapons as long as existing law (that doesn’t exist) or the DoD says so.”

Similarly, the mass surveillance use cases will “comply with existing law”, but many forms of data collection that we’d consider “mass surveillance” are things that the NSA has consistently argued are legal under current law.

This, of course, did not stop OpenAI from blatantly misrepresenting this language in the blog post and in Sam Altman’s tweets!

… Now, I’m sure OpenAI will claim that the real teeth of the agreement is not their contract but their deployment architecture: they have a “safety stack that includes these principles” and everything! (In other words, “trust me, bro.”)

Lawrence Chan (METR): Two more points:
1. It is not true that “As with any contract, [OpenAI] could terminate it if the counterparty violates the terms”.
2. Despite OAI’s claims, the legalese provided does not actually specify what will happen when existing laws or DoD policy changes.

Leo Gao (OpenAI): the contract snippet from the openai dow blog post is so obviously just “all lawful use” followed by a bunch of stuff that is not really operative except as window dressing.

the referenced DoD Directive 3000.09 basically says the DoD gets to decide when autonomous weapons systems are deployable.

as others have covered, there are a ton of mass domestic surveillance loopholes not covered by the 4A, national security act, FISA, etc.

Dave Kasten: ​The people interpreting this legal guarantee are Executive Branch lawyers, and their General Counsel bosses are usually political appointees; they can always just change the DoD directives or the Executive Orders if they want, or DoD’s internal legal definition of the same. Every intelligence scandal you’ve heard of, from the warrantless mass wiretapping of American citizens to the post-9/11 torture of prisoners, about a quarter of which weren’t even terrorists , had legal guidance claiming it complied with those exact same authorities, or other authorities superseded them.

Second, claiming that the monitoring of US persons (that’s any US citizen, lawful permanent resident, US company or nonprofit) merely needs not to be “unconstrained” means very little. Third, what domestic law enforcement activities are included — does targeting and arresting peaceful protestors because the FBI Director thinks they’re friends of Antifa count? They may be able to limit some of this with the technical controls they propose; but you should be skeptical.

dave kasten: The intelligence law section of this is very persuasive if you don’t realize that every bad intelligence scandal in the last 30 years had a legal memo saying it complied with those authorities

James Rosen-Birch: How do people not get that DoW *never* thinks it does anything illegal, even when it does.

Boaz Barak (OpenAI): Does this criticism not apply also to the previous contract DoW had, that relied even more on contract language and less on technical verification?

dave kasten: Hard to say for sure without knowing what contractual guarantees Anthropic had, but probably less so than OpenAI At a minimum, OpenAI’s deal clearly and unambiguously rules in use of piles of domestic info incidentally collected via FISA authorities, which as far as I can tell Anthropic’s didn’t.

OpenAI’s deal also appears to allow the use at scale of analyzing massive piles of commercial data, which courts have thus far not fully ruled on (beyond Carpenter in 2018), and which Anthropic clearly indicated they were being asked to do and refused to do.

One more thought: who gets to do anything if your technical controls report an issue? It’s classified; what’s your plan for disclosure? to DoD IG? To Congress? To the press and take your chances you won’t lose the contract or be arrested?

Neil Chilson: THAT PROBLEM IS NOT FIXABLE BY PRIVATE PARTIES.

dave kasten: I don’t see how that’s accurate; every government contracting job I had gave me a very clear training on government requests that I was supposed to refuse as they were unlawful, even if someone told me they were lawful.

Neil Chilson: How many of those scandals you mentioned were struck down in court? Most were fixed by Congress — because they were arguably legal but bad.

dave kasten: I agree it would be good for us to defer less to claims of non reviewability and think there could be mechanisms (eg, establish a cleared litigation system that any litigant can engage for a fee and have litigate in a classified setting) to do so while preserving national security.

Andreas Kirsch (Google DeepMind): I’m speechless at OpenAI releasing that contract excerpt and acting as if there aren’t gaping holes that could be exploited far beyond their stated “red lines.” I’m not a lawyer, but this is pretty obvious and common sense.

(And to be clear: if Google had signed the same deal, I’d be saying the same thing internally. The issues here are bigger than friendly competition between companies.)

… The actual language they published is still full of obvious escape hatches.

[see the full post for further explanation]

Altman claims that the DOD directive is referred to as it exists today, not only as it might exist in the future. But even if that were true, it is not meaningful, as that directive leaves it to DoW to determine appropriate levels of supervision.

I do not understand why OpenAI believes, as they seem to be claiming, that the language they shared itself refers to the law as it exists today, and would continue to refer to those laws and directives even if they were later altered. That would not be how I would read those contract terms. You aren’t breaking a law if that law has been repealed or changed. At best this is highly ambiguous and DoW will read it the other way the moment it matters.

DoW keeps saying it is illegal to do ‘domestic mass surveillance’ but this is not a term of American law, so what exactly does that even mean? OpenAI has not shared any legal definition of the term, nor has DoW.

dave kasten: Something I’ve been convinced of over the past 24 hours:

“Domestic mass surveillance” is NOT a defined term in US law.

The exec branch has a bipartisan history of interpreting IC legal authorities VERY broadly.

Make sure you know what’s in, and what’s out, before you sign.

Again, Anthropic explicitly rejected the core term language OpenAI accepted, exactly because they felt that those terms did not hold water. To the extent it has similar red lines, OpenAI is counting on its technical affordances, and this only potentially works for them because (as I understand it) they believe crossing the lines would be illegal.

Mark Valorian: Idk who needs to hear this (apparently all of twitter) but OpenAI did not just magically get the DoD to agree to the terms Anthropic was asking for.

…OpenAI just took the terms Anthropic considered so egregious, it warranted jeopardizing an enormous part of their business.

The DoD does not just break off a massive contract to accept the same demands 5 minutes later from someone else. Until explicitly indicated otherwise, the only logical conclusion here is that OpenAI swooped in and unscrupulously stooped lower than Anthropic was willing to go for the money.

Assume all OpenAI data will now be used for what Anthropic deemed “mass domestic surveillance of Americans”. Plan and prompt accordingly.

I am highly confident that Anthropic did not risk going head to head with the Department of War over meaningless terminology details.

I am highly confident that the Department of War did not risk this battle with Anthropic over meaningless terminology details, although it in part did so because some people actively wanted to destroy Anthropic.

So How Does OpenAI Hope For This To Work Out?

Part of what they hope for is de-escalation. The strategy needs to be reevaluated if that does not now happen. But what about the actual contract and serving DoW?

One way to have the red lines not be crossed is if the Department of War chooses not to cross the red lines. Sometimes the ‘trust us’ strategy works and people prove worthy. At other times they don’t want to risk being caught.

I really hope that this turns out to be the case, either way.

What about the other way of holding the red lines? Is it possible Anthropic and I are wrong, and basically all the legal experts who weighed in are wrong, and Sam Altman pulled it off even if the Department of War intends to cross the red lines?

It is possible. It would require that the key terms be elsewhere in the contract, in places where they claim they cannot share the details.

It would then require OpenAI to do heroic work, including heroic technical work, and be prepared to take heroic stands at great potential financial and personal cost.

The first step to knowing if this is possible is to read the rest of the contract terms.

The argument for hope goes something like this:

1. OpenAI decides on its own ‘safety stack’ and chooses what model to deliver.
2. They can choose to deliver models incapable of the things they don’t want without tripping the safety stack, or at all.
3. The Department of War has agreed to accept this if it happens.
4. Therefore, OpenAI can build a safety stack that protects against their redlines, even if such activity was legal, either through inherent inability or refusal, no matter what the contract otherwise permits, so This Is Fine.
5. OpenAI would be able to sustain this even under huge political pressure across the board, and likely also legal pressure.

There are many severe problems with this plan. A lot of them are obvious. OpenAI would have to actually do the heroic work, take the heroic stand, and withstand the kind of pressures being used against Anthropic.

A less obvious problem is, even if OpenAI did heroic work, I don’t see how to deliver otherwise useful models that can’t be used for legal mass domestic surveillance. You can have them analyze one situation at a time and then clear the context.

So either you deliver a rather useless model by being unwilling or unable across a rather broad set of queries a lot of which are good uses, you’re allowed to pick up patterns and flag the whole DoW account, or you’re dead even without a jailbreak.

Then there’s the problem that there’s no known robust defense to jailbreaks, unless OpenAI is willing to implement technical pattern detection for violations, and then willing and able to pull the plug if that happens.

This Was Never About Money

Even if I am reading the situation maximally wrong, there is one thing that is clear.

This was never about money, for either Anthropic, OpenAI or the Department of War.

OpenAI previously turned down the contracts Anthropic accepted, exactly because Anthropic cared deeply about national security, and OpenAI did not wish to lose focus and money and take on the associated risks by prioritizing such work, especially when Anthropic was volunteering to pick up that slack and having access via AWS.

The contract’s dollar value is, in context, chump change. OpenAI an Anthropic grow their revenue more each day then the entire contract is worth.

I also strongly believe that OpenAI has consistently been attempting to de-escalate the conflict between Anthropic and the Department of War rather than escalate it. Sam Altman has been excellent on that particular point, as noted earlier, and we should give him proper credit.

To the extent that this conflict was stroked by competitors or was due to manipulation or corruption, those pulling those strings lie elsewhere, as I’ve noted.

That still leaves many potential motivations for OpenAI agreeing to this contract.

I believe there are three we must centrally consider.

1. I believe that at least part of the motivation is that Altman believes that doing so de-escalated the situation and helped protect Anthropic, and with it the entire AI industry and economy and military supply chain, from an epic clusterfuck. This was an excellent motivation.
   1. Unfortunately, I do not believe his instincts were correct here. While his explicit statements have indeed been very helpful, and the contract does further invalidate any possible legal arguments for the supply chain risk designation, I fear that by being willing to contract he may have unwittingly ended up making Hegseth feel he had a green light.
2. I believe that at least part of the motivation was genuine concern for national security, and of what would happen on multiple levels if Grok were left as the only model with access to classified networks. No doubt he was concerned given their history that this would give Elon Musk powers he might abuse, and also he is aware that Grok is not a good model and can’t do the job protecting America.
3. By playing ball with the Department of War and White House, OpenAI gains political favor and power, which will be vital in the months and years ahead, and also OpenAI gains direct levers of power via its AI inside classified networks. Hopefully one of the chits they got was a promise of de-escalation.

People are not discussing this third motivation, but it is very obviously there. Sam Altman has done many things to curry favor with the administration. Fair play.

I think people have this third motivation exactly backwards. They say things like ‘Brockman contributed $25 million to Trump and that’s how they secured this contract.’ I would suggest the opposite is more important. This contract, and the willingness to bail out this crisis and capitulate, is itself a contribution.

OpenAI Tells Us How They Really Feel

Again, on Friday morning, Altman claimed to share Anthropic’s red lines, implying (but not explicitly confirming) that this would apply even to legal activities.

On Friday evening, Altman claimed to have signed a ‘more restrictive’ contract that would preserve the redlines, a contract Anthropic explicitly declined and that would not have preserved Anthropic’s red lines, but might help preserve OpenAI’s.

On Saturday afternoon, we got some of the legal language, which looks like all we’ll get, and that language we de facto ‘all lawful use’ as determined by the general counsel’s office, with the meaningful levers being the safety stack and right to cancel.

Which is totally a coherent position, highly defensible, but very different from what Altman was representing was the OpenAI position, and one that would make a lot of people very upset.

Then Altman, and several other employees of OpenAI, did an AMA and otherwise Tweeted out various sentiments on how they believe all of this works.

Sam Altman (CEO OpenAI): I’d like to answer questions about our work with the DoW and our thinking over the past few days. Please AMA.

These lay out a clear and coherent position and philosophy, which I believe amounts to saying that their redlines allow all legal use, and trusting the Department of War to determine and abide by what is legal, and that to do otherwise would not be appropriate in a democracy.

Yes, they intend to include a ‘safety stack’ and other safeguards, but fundamentally believe that they should not be determining what their AI is used for, other than via enforcing the law and refusing illegal requests.

First The Good News

roon (OpenAI): are you worried at all about the potential for things to go really south during a possible dispute over what’s legal or not later on and be deemed a supply chain risk? I find this part to be the most worrying out of distribution thing to happen this past week

Sam Altman (CEO OpenAI): Yes, I am. If we have to take on that fight we will, but it clearly exposes us to some risk. I am still very hopeful this is going to get resolved, and part of why we wanted to act fast was to help increase the chances of that.

I think this greatly underplays the level of risk Altman is taking on by getting involved, and his other statements sound like a person already choosing his words carefully due to this. I hope I am mistaken, and I hope that Altman is correct that OpenAI intends to and actually will, even under immense pressure, use its safety stack to determine what is legal and to refuse requests it feels are illegal, and to terminate the contract if it discovers an illegal pattern of behavior that cannot otherwise be prevented.

There is also potential political risk in refusing to become involved. At some point, you might not be interested in politics and the national security state but they become interested in you.

Matthew Yglesias:

1. What kind of implicit or explicit threats did you receive from DOW before striking the deal?
2. If you received such threats, would you disclose them in public during a Twitter AMA?
3. If the answer to (2) is “no” (which of course it is) what’s the point of this?

Sam Altman (CEO OpenAI):

1. No explicit or implicit threats. In fact, I could tell that as of Weds, the DoW was genuinely surprised we were willing to consider.
2. I think I would, and it would be lost in the noise of the SCR stuff.

I fully believe Altman here. I think Altman decided to do this on his own.

There is of course ‘if you help us we will remember that, and if you didn’t help us when we needed it we are going to remember that.’ That’s always there, whether or not anyone wants it to be there.

This was a good answer:

Anthony Pompliano: What are AI-native things the Department of War is not yet doing that you see as opportunities over the next decade?

Sam Altman (CEO OpenAI): They will have their own opinions, but the two things I am currently most worried about where AI can help are a) the ability to defend against major cyber attacks (eg something on the scale of taking our whole electrical grid down) and b) the ability to contribute to biosecurity. I do not think we are currently set up well enough to detect and respond to a novel pandemic threat.

I would have added a third key area, the defense of model weights.

This was also a good answer, up until the last line:

nic: Which of OpenAI’s core principles was the most difficult to reconcile with the DoW’s requirements during your internal debates this week?

Sam Altman (CEO OpenAI): Thinking through non-domestic surveillance. I have accepted that the US military is going to do some amount of surveillance on foreigners, and I know foreign governments try to do it to us, but I still don’t like it.

I think it is very important that society thinks through the consequences of this; perhaps the single principle I care most about for AI is that it is democratized, and I can see surveillance making that worse.

On the other hand, I also respect the democratic process. I don’t think this is up to me to decide.

The ‘not up to me to decide’ rhetoric totally applies to what DoW decides to do. It doesn’t mean you have to help them do it if you think it’s wrong, but also they can force you into a package deal decision, and they did that here.

One thing Altman should keep in mind is that a lot of what we would think of in practice as domestic surveillance, legally is classified as foreign. Then there’s the ‘border zone.’ Again, I see OpenAI as saying they will defer to DoW on what is legal, and they will assume legal overrules their red lines, unless things become sufficiently blatantly unconstitutional.

Altman has not committed to publishing any changes to their red lines, but thinks this is a good idea and will consult with the team. I agree, good idea.

He expects the system to take several months to set up and the plan seems to be to use Azure. They have up to six, although that deadline could always be extended.

Jack Kaido asked about AGI, and Altman responded (wisely) that losing control of AGI would mean ‘we are probably in a very bad place.’ And so much more.

The OpenAI Redlines Only Forbid Currently Illegal Activity

This answer and related follow-ups are very telling on several fronts at once.

I get a sense that the actual intended redline for OpenAI might be better described as the Constitution of the United States? That’s a highly reasonable redline, if you can actually act on it.

Nicholas Decker: If the government comes back with a memo saying that, in their view, mass domestic surveillance is legal, do you do that? Do you do it until the courts bar it, or do you delay until the courts approve it?

Second, would mass domestic surveillance be a lawful use right now?

Sam Altman (CEO OpenAI): We would not do that, because it violates the constitution. Also, I cannot overstate how much the DoW has been extremely aligned on this point.

However, maybe this is the question you are really asking: what would we do if there were a constitutional amendment that made it legal?

Maybe I would quit my job.

I very deeply believe in the democratic process, and that our elected leaders have the power, and that we all have to uphold the constitution. I am terrified of a world where AI companies act like they have more power than the government. I would also be terrified of a world where our government decided mass domestic surveillance was ok. I don’t know how I’d come to work every day if that were the state of the country/Constitution.

Nicholas Decker: If the DoW gives you what you believe to be an unconstitutional order, do you refuse to follow it until the courts rule? Or do you do it until the courts bar it?

Sam Altman (CEO OpenAI): I don’t think this will happen. But of course if we are confident it’s unconstitutional, we wouldn’t follow it. The constitution is more important than any job, or staying out of jail, or whatever.

In my experience, the people in our military are far more committed to the constitution than an average person off the streets.

An important part of this is that I don’t think our company is above the constitution either.

B: What would cause OpenAI to walk away from a government partnership? Is there a clearly defined boundary or red line you won’t cross?

Sam Altman (CEO OpenAI): If we were asked to do something unconstitutional or illegal, we will walk away. Please come visit me in jail if necessary.

melissa byrne: Will you turn off the tool if they violate the rules?

Sam Altman (CEO OpenAI): Yes, we will turn it off in that very unlikely event, but we believe the U.S. government is an institution that does its best to follow law and policy.

What we won’t do is turn it off because we disagree with a particular (legal military) decision. We trust their authority.

Nate Berkopec: Sam would do good to remember that Hegseth thinks it’s sedition when Sen Mark Kelly says “don’t follow illegal orders.”

Saying that your models will only be used to follow legal orders is the barest of fig leaves in the current administration.

I strongly agree that most people in the military are far more committed to the constitution than the average person on the street, but they also consistently take a broad view of what they need to do to defend national security (and they are often right), and also they usually do as instructed by the chain of command. That’s the job.

We really need to know the full OpenAI definition of ‘domestic mass surveillance.’

Here are the conclusions to draw.

First, he clarifies that he is fine with anything constitutional, presumably as the current courts understand it, which is a rather narrow reading of this question as noted extensively earlier:

1. Sam Altman believes that ‘domestic mass surveillance’ violates the Fourth Amendment to the Constitution.
2. That means that anything that does not violate the Fourth Amendment then is not ‘domestic mass surveillance.’
3. Since the courts have consistently ruled that all analysis of third-party data and the many other things listed above, that I consider ‘domestic mass surveillance,’ are legal, then it follow Altman doesn’t think they cross his red lines.
4. As in, this is a confirmation that the rule really is ‘all legal use.’

Second, that he is pledging to defy an unconstitutional order, even if it comes with a legal opinion. He is promising to pull the plug on the entire program, if he finds DoW doing illegal things.

I very much appreciate this, but if the situation happens we may never learn of it, and intent now is very different from what you do in the breach.

Third, and I very much appreciate this too, that he doesn’t know what he’d do if we abandoned our rights and freedoms. I too don’t know what I would do then.

Altman Does Not Present As Understanding The Difference In Redlines

Chris: What was the core difference why you think the DoW accepted OpenAI but not Anthropic

Sam Altman (CEO OpenAI): I can’t speak for them, but to speculate with the best understanding of the situation.

*First, I saw reporting that they were extremely close on a deal, and for much of the time both sides really wanted to reach one. I have seen what happens in tense negotiations when things get stressed and deteriorate super fast, and I could believe that was a large part of what happened here.

*We believe in a layered approach to safety–building a safety stack, deploying FDEs and having our safety and alignment researcher involved, deploying via cloud, working directly with the DoW. Anthropic seemed more focused on specific prohibitions in the contract, rather than citing applicable laws, which we felt comfortable with. We feel that it it’s very important to build safe system, and although documents are also important, I’d clearly rather rely on technical safeguards if I only had to pick one.

*We and the DoW got comfortable with the contractual language, but I can understand other people would have a different opinion here.

*I think Anthropic may have wanted more operational control than we did.

Altman may have an excellent point that the other terms, granting the right to build OpenAI’s own safety stack and control what is delivered, are things that Anthropic did not focus on or ask for.

But they are also exactly the type of thing that Hegseth and Michael were yelling were totally unacceptable, and that they could not and would never accept. They’re giving a private corporation operational control, the ability to substitute OpenAI’s judgment for the DoW and refuse requests based on their own reading of the law, or indeed any other safeguards they determine – if you believe Altman’s claims about this deal.

That’s not the ‘unfettered access’ that was demanded of Anthropic. Not at all. If OpenAI got a strong deal, it is because they got more, not less, operational control.

Indeed, what happens if the model starts refusing on a real time operation? Are they going to ‘call Sam?’ This points out how nonsensical all that rhetoric always was.

Meeting Of The Minds

I notice this makes me worry a lot, if Altman is presenting his view accurately, that OpenAI and DoW do not have a meeting of the minds on this contract.

Altman seems to think that technical safeguards give him the right to decide what is and isn’t acceptable via having the model refuse requests. I doubt DoW agrees.

Peter Wildeford: So I’m confused – maybe you can help. OpenAI is trying to claim simultaneously that (a) the contract allows “all lawful purposes” and (b) also that your red lines are fully protected.

The way you bridge this is by saying the protections live in this “deployment architecture and safety stack” rather than the contract language. But if this contract says “all lawful purposes” and your safety stack prevents a lawful purpose, you’re in breach.

So then either the safety stack has no teeth on lawful-but-objectionable uses, or OpenAI is setting up a future contract dispute with the Pentagon.

How do you ensure both (a) and (b)?

Sam Altman (CEO OpenAI): We deliver a system (including choosing what models to deploy), and they can use it bound by lawful ways, including laws and directives around autonomous weapons and surveillance. But we get to decide what system to build, and the DoW understands that there are lot of risks we deeply understand. We can, and will, build a lot of protections into that system, including for ensuring that the red lines are not crossed. The DoW is supportive of this approach.

We are generally quite comfortable with the laws of the US, but there are cases where the technology isn’t very good, shouldn’t be used, and would have serious unintended consequences.

We do not want the ability to opine on a specific (and legal) military action. But we do really want the ability to use our expertise to design a safe system.

Not only does OpenAI choose what system to build, they can ‘build protections into the system’ including to ensure no crossing of the red lines.

I am confident that DoW thinks this that they are entitled to ‘all lawful use’ and that if they get any refusals for reasons they don’t like, they will throw an absolute fit. They will absolutely pull out all the rhetoric they used on Anthropic, or threaten it.

Frankly, I expect the DoW to be right about this dispute, unless there is very clear language we have not seen that says that OpenAI has the right to have its safety stack refuse requests for essentially any reason, and even then I’d be rather nervous as hell.

Anthropic’s Position Was The Opposite Of How This Is Portrayed

If anything, Anthropic was trying to address the situation contractually rather than via technical safeguards exactly so that they didn’t get accused of making operational decisions, or accidentally actually refuse in real time.

Anthropic was saying, we’ll have the model do it, and specify what you agree not to do with the model, and then we’re trusting DoW to abide by the agreement, but we’re not going to do a sudden refusal in the middle of all this.

It didn’t help. None of that was in good faith.

The Room Where It Happened

Theo – t3.gg: How long has this conversation with DoW been going for? What was the reason for announcing so close to the deadline they gave Anthropic?

Sam Altman (CEO OpenAI): For a long time, we were planning to non-classified work only. We thought the DoW clearly needed an AI partner, and doing classified work is clearly much more complex. We have said no to previous deals in classified settings that Anthropic took.

We started talking with the DoW many months ago about our non-classified work.

This week things shifted into high gear on the classified side. We found the DoW to be flexible on what we needed, and we want to support them in their very important mission.

The reason for rushing is an attempt to de-escalate the situation. I think the current path things are on is dangerous for Anthropic, healthy competition, and the US. We negotiated to make sure similar terms would be offered to all other AI labs.

I basically buy this first half, in addition to any other motives involved.

I think it was a mistake, and could have had the opposite of its intended effect by making Hegsted think he was free to try and murder Anthropic (as Hegsted seems to not understand why that would be bad), but I do think this was a strong motivation.

The second half of this answer, however, is where we start getting into parroting the DoW rhetoric about this in a way that scares me.

I know what it’s like to feel backed into a corner, and I think it’s worth some empathy to the DoW. They are on the a very dedicated group of people with, as I mentioned, an extremely important mission. I cannot imagine doing their work.

Our industry tells them “The technology we are building is going to be the high order bit in geopolitical conflict. China is rushing ahead. You are very behind.”

And then we say “But we won’t help you, and we think you are kind of evil.”

I don’t think I’d react great in that situation.

I do not believe unelected leaders of private companies should have as much power as our democratically elected government.

But I do think we need to help them.

Anthropic was in no way telling DoW it was ‘kind of evil.’ It was saying that there were some activities in which it did not wish to participate.

Anthropic was not saying they wouldn’t help, indeed they have gone to extraordinary lengths in order to be maximally helpful. They are saying there are some narrow things, things DoW keeps saying they would never do, that Anthropic does not want to help with.

There is no corner under into which DoW was being backed. This was a ‘war of choice’ the entire way. Anthropic was happy to continue under its current contract, offered much less restrictive terms than that, and was also happy to walk away. Then Hegseth did what he did, including running right through Trump’s de-escalation.

This was rather more than a failure to ‘react great.’

The penultimate line is far, far scarier. Who is saying ‘unelected leaders of private companies should have as much power as our democratically elected government?’

The claim is that a private company should be able to determine under what terms it is willing to do business and provide its own tools. That’s it. This whole line that this is some sort of anti-democratic power grab is inimical to the values of America.

We do still need to find a way to help the DoW, even if they don’t make it easy. That doesn’t mean treating the Secretary of War like a dictator.

Notice the equating of ‘democratically elected government’ with the military chain of command. It is supposed to be the Congress that sets the rules and writes the laws.

You Don’t Have The Right

Can OAI implement a safety stack that refuses unethical actions, under this contract?

Altman seems to be saying no. Or at least that he’s not going to try.

Chris: If the models or someone at OAI deem an action unethical, does OpenAI has the right to deny said action

Sam Altman (CEO OpenAI): We currently have three redlines. I could see us changing them or adding more as the technology evolves, and there are new risks we don’t yet understand. Iterative deployment is one of our most-important safety principles, and is a big part of why it was so important that we could write and update our safety classifiers.

But a really important point: we are not elected. We have a democratic process where we do elect our leaders. We have expertise with the technology and understand its limitations, but I think you should be terrified of a private company deciding on what is and isn’t ethical in the most important areas.

Seems fine for us to decide how ChatGPT should respond to a controversial question. But I really don’t want us to decide what to do if a nuke is coming towards the US.

I am pretty furious at repeating this line, and at the idea that, because you might be facing an incoming nuclear missile (that would be handled by existing automated anti-missile systems), that means you have to apply that level of deference in all other situations, including in peacetime without an emergency.

In practice, very obviously, in a true emergency like that, the DoW says jump, and you do your best to guess how high because they don’t have time to tell you. We all would. Dario would, Sam would, I would, and I bet you would.

I continue to be flabbergasted that so many people think this is a good argument.

Yet Altman reiterated this position again, that the government needs to have the power, and that to be able to say no to the government means you have ‘more power.’

Sam Altman (CEO OpenAI): Three general things from this AMA:

1. There is more open debate than I thought there would be, at least in this part of Twitter, about whether we should prefer a democratically elected government or unelected private companies to have more power. I guess this is something people disagree on, but…I don’t. This seems like an important area for more discussion.

florence: remember—you should do whatever the government wants, even things you think are immoral, because otherwise you’re deciding what you can do instead of the government, which is undemocratic.

Democracy is being redefined in real time.

I strongly agree that we need to talk about this. A lot. I want to live in a Republic.

No, I do not think we should move more power from corporations to the government.

No, I do not think that the government should have ‘more power’ than all the ‘unelected’ private companies, as in all the private people, collectively.

2. I think the is a question behind a lot of the questions but I haven’t seen quite articulated: What happens if the government tries to nationalize OpenAI or other AI efforts? I obviously don’t know; I have thought about it of course (it has seemed to me for a long time it might be be better if building AGI were a government project) but it doesn’t seem super likely on the current trajectory. That said, I do think a close partnership between governments and the companies building this technology is super important.

The government was at least flirting with soft nationalizing Anthropic, and instead tried to destroy it. The day could come sooner than we think, and yes many of us have been thinking about that for a long time without great answers. The implication here is that he would accept nationalization. After which, of course, his red lines would not be up to him, no matter what they are.

3. People take their safety (in the national security sense) more for granted than I realized, which I think is a good thing on balance but I don’t think shows enough respect to the tremendous work it takes for that to happen.

I did not get this sense from the questions, and I’m worried that Altman did. I do agree that many people take it for granted, especially day to day, and that this is good. If we take it for granted, that means DoW did its job.

Also, I am on the whole very grateful for the level of reasonable and good-faith engagement here. It was not what I expected.

On one particular question, he answered with a RT.

Tyler John: Which of the following is true?

a) the contract permits all lawful use, + therefore mass surveillance + autonomous weapons, which have no legal prohibition

b) the contract has substantive red lines that constrain lawful use

c) OpenAI has a controversial interpretation of the law, disagreeing with others including the DIA about whether mass surveillance and autonomous weapons are legal and will block them based on that interpretation

d) OpenAI uses words differently from the people commenting here and doesn’t mean the same thing as we do when referring to mass surveillance and autonomous weapons

Sam Altman RTs in response:

Under Secretary of War Emil Michael: The DoW has always believed in safety and human oversight of all its weapons and defense systems and has strict comprehensive policies on that.

Further, the DoW does not engage in any unlawful domestic surveillance with or without an AI system and always strictly complies with laws, regulations, the Constitution’s protections for American’s civil liberties. The DoW does not spy on domestic communication of U.S. people (including via commercial collection) and to do so would be unlawful and profoundly un-American.

Boaz Barak (OpenAI): When we say that domestic mass surveillance and autonomous lethal weapons are red lines for us, we mean what we say, and are not looking for loopholes. We are confident that the combination of legal restrictions, safety stack, and deployment surfaces, will ensure that OpenAI models will not be used to cross either of these red lines.

I earlier broke down that Tweet from Emil Michael. It is well crafted, but if understood it is not a strong statement. If Altman is answering with that, and Boaz is giving this answer as well, we have our answer. All legal use, as determined by DoW.

I Ask Questions And Get Answers

AMAs happen fast, so I didn’t do a perfect job, but I did what I could.

I got an answer from Boaz Barak rather than Altman, which is fair.

Zvi Mowshowitz: I have a lot of Qs about this so please answer as much as you can, in priority order.

1) What forms of surveillance if any would your terms forbid, if the DoW determined they were legal? What is your definition of it that you believe is unconstitutional as per another Q? In particular, are you willing to do unlimited analysis of third-party or public information, which AIUI is considered legal? Of nominally ‘constrained’ private information? Is there an actual exception to ‘all legal use’ other than enshrining current law?

2) Can we see the rest of the contract, or at least the parts you claim tie it specifically to current law, or other parts of the defense in depth that you feel are key components?

3) What legal opinions did you get on your contract language before you agreed to it? Can you share any details? Did you consult with Anthropic’s team to learn what their true objections were and why they felt they couldn’t accept similar terms, and what particular language they were objecting to?

4) What is the enforceability mechanism? How will you know if DoW violates your redlines or does something illegal? If you do think so, what can you do about it? Does the safety stack include monitoring for patterns of activity like it would with another user? How much leeway does OpenAI have in designing its safety stack?

5) You said that this is more restrictive than Anthropic’s previous contract, but that previous contract AIUI contained many more restrictions that they were offering to remove. How can you be confident you’re right about this and if so why would DoW agree?

Boaz Barak (OpenAI): 1. The DoW is prohibited by law from engaging in any domestic mass surveillance, and @USWREMichael wrote that it would be profoundly un-American to do so, including for analyzing communication of Americans by purchasing data from commercial sources. Hence us and the DoW see eye to eye in our interpretation of domestic mass surveillance. They have no desire to do this, and we have no intention to allow it.

2. There are legal restrictions for publishing contracts with the DoW due to the classified nature of the work.

3. As you can imagine, our lawyers are quite good and they relied on internal advice as well as the advice of outside counsel. On consulting with Anthropic, US antitrust laws prohibit this kind of coordination, as much as we might wish otherwise.

4. The contract gives us the right to implement our full safety stack, which includes automatic classifiers and monitors. We will be working on the stack for this deployment over the coming months. Due to the classified nature of this deployment, only our cleared researchers and FDEs will have visibility into usage, which is why it is important we have them.

5. We believe our contract offers more robust safety guarantees. Note that Anthropic has disclosed that their national security model refuses less when engaging with classified information

I interpret these answers in the following ways, solidifying my perspectives elsewhere:

1. There are no surveillance actions that DoW understands to be legal, that OpenAI’s red lines or contract would disallow. Whatever it is that DoW is currently doing or plans to do legally, OpenAI is fine with it.
2. We likely never see any more details of the contract. Which is fair, but then we can’t take your word for what it says, especially in its details.
3. This is a hell of a justification. There’s some danger in practice, but this is at best overstated, and does not seem like a good reason in this sort of breach, especially given that the goal was explicitly de-escalation, and at minimum it seems like this means DoW didn’t want them talking.
4. This is the most meaningful answer. Their FDEs will be cleared and able to put human eyes on what is happening, which is very good, although it is not clear the extent of what ‘visibility into usage’ means. I notice he didn’t answer the other parts of the question, the ‘what are you going to do about it?’ half.
5. This doesn’t explain why he believes this or why DoW said yes. If anything, Anthropic’s model refusing less makes this more confusing, not less. I assume Barak is putting his faith in the safety stack, and doesn’t care much about the ‘all lawful use’ language or intent.

Does This Contract Apply To NSA?

Katrina, OpenAI’s head of national security partnerships, says no, that the contract only applies to DoW in a way that excludes NSA, despite the NSA being under DoW. Again, we have not seen contract terms, so this is in theory possible.

dave kasten: 1. NSA engages in incidental domestic collection under FISA 702 and makes it available for queries, and DoJ writes an annual report to Congress listing all the times it does. OpenAI models usable under your contract for that, yes or no?

NatSecKatrina: 1. No, this contract does not apply to NSA.

dave kasten (later): Anthropic offered “FISA yes, commercially acquired data no” and got turned down. This, uh, makes me substantially doubt the OpenAI claims that they’ve excluded NSA from their contract successfully.

Can OpenAI Models Be Used To Analyze Commercially Available Data At Scale?

That’s at the heart of the matter.

It is where OpenAI communication is hardest to believe.

I think it’s a perfectly defensible position to say this is legal and it’s not their place to decide and it’s fine, but that’s not the position.

It’s also fine for them to build in safeguards that stop this and pull the plug if DoW tries to go around them. Their contract permits it. That would be great if it would work and they can hold that line. But that is not their stated intention.

dave kasten: 2. Getting and/or analyzing commercially available data at scale. OpenAI models usable under your contract for that, yes or no?

NatSecKatrina: 2. The Pentagon has no legal authority to do this (that would be federal law enforcement agencies, not DoW)

The DoW does this, legally, now. How can Katrina not know this?

I ask that given that Katrina led the Obama administration’s ‘media and public policy response’ to the Snowden disclosures, most of which was not deemed illegal or improper, but which a lot of people thought was not okay. She is eminently qualified to handle exactly this set of questions.

There has since then been extensive reporting that exactly this was the sticking point of the negotiations with Anthropic that caused talks to fall apart.

Shakeel here offers an extensive analysis based on what we learned on Sunday. Both Katrina and Boaz Barak made clear statements saying the Pentagon is prohibited from or not allowed to do this. And yet. They have promised more language on this in the coming days, from the contract and I look forward to reading it. Seems important.

If she doesn’t know or is misrepresenting this, what the hell is going on?

Prakash: The real question is whether OpenAI is going to allow the use of AI on unclassified commercial bulk data on Americans, which is what the Pentagon wanted from Anthropic. Ant instead narrowed to classified FISA only, and got kicked.

Adam Cochran (adamscochran.eth): Well there is part of what the DoD Anthropic was about.

Based on the contract language around analyzing bulk commercial data and deanonymizing it matches with this data discussion: Since 2021 the Pentagons DIA has been purchasing anonymized and harvested geolocation data that’s used in advertising, arguing it’s not “spying” since it’s commercial.

They’ve now realized AI is strong enough to take this bulk data and de-anonymize it accurately.

Anthropic deemed that spying on Americans. OpenAI doesn’t.

tyson brody: In 2021 the Pentagon’s Defense Intelligence Agency told Senator Wyden it was purchasing geolocation data from commercial brokers harvested from cell phones and that it did not believe it needed a warrant to analyze American’s data. This has to be part of what freaked Dario out.

Trevor Vossberg: Note: The purported exclusion of the NSA by OpenAI doesn’t address this. The DIA, that did this, isn’t part of the NSA.

dave kasten: This is an important point from Logan Koepke: OpenAI is claiming that DoW lacks authorities to get commercial data at scale, despite extensive reporting that they have done so

logan koepke: on point two, they have in fact done this and claim they have the authority to do this.

[See Vice, New York Times and NYT].

Finally, here’s the big three models, including OpenAI’s ChatGPT.

This seems really, really conclusive.

It doesn’t get better from there.

dave kasten: 3. OLC writes a “President’s Surveillance Program 2.0”-like memo claiming President has inherent CinC authority to authorize mass domestic warrantless wiretapping. OpenAI models usable under your contract for that, yes or no?

and, 4., how can we verify that?

NatSecKatrina: 1. No, this contract does not apply to NSA.
2. The Pentagon has no legal authority to do this (that would be federal law enforcement agencies, not DoW)
3. Again, if this were to happen (and to my knowledge it hasn’t) this could only be done by the FBI and they are not a party to this contract.
4. Read the authorizing statute for the Department of Defense? None of these activities are within their statutory authorities. And our contract is expressly limited to the Department of Defense.

dave kasten: Huh? I note you do not claim “no, our contract does not allow that” for any of these (except kinda sorta 1).

But hey, I want to assume good faith, and everyone’s very short on sleep, would you explicitly say whether those answers mean “No” for each? And can we drill down here to understand those claims?

1. NSA is within DoD, are you claiming there is an explicit carveout to exclude it from your contract and that no NSA individuals, including those dual-hatted to CYBERCOM, will have access? What about other DoD IC elements? What about FBI’s access to 702 data for purely criminal investigations?

2-4. What if OLC claims that the President has the implicit Constitutional right as CinC to authorize DoD to do this (e.g., on a doctrine that immigration or Antifa, or in a future admin, pro-life protestors or MAGA activists are threats to national security), and thus no statute can bind that power? After all, this is literally what OLC has done before on warrantless wiretapping.

She also, multiple times, reiterates the line ‘more guardrails than any previous agreement’ as if one can simply count them, and this is conclusive.

Christopher Hale: What do you say to people who’ve lost trust in both OpenAI and @sama ’s leadership and character over the past few days?

NatSecKatrina (mostly also reiterated here): I would wonder why [anyone] lost trust when OpenAI secured a deal with more guardrails than any previous agreement for classified AI deployments, including Anthropic’s.

OpenAI’s strategy was rooted in four basic ideas:

1. Deployment architecture matters more than contract language.

2. The safety stack travels with the model. The Department was not asking us to modify how our models behave. Their position was, build the model however you want, refuse whatever requests you want, just don’t try to govern our operational decisions through usage policies.

3. AI experts directly involved. Instead of hoping contract language will be enough, our contract allows us to embed forward deployed engineers.

4. U.S. law already constrains the worst outcomes. We accepted the “all lawful uses” language proposed by the Department, but required them to define the laws that constrained them on surveillance and autonomy directly in the contract.

And because laws can change, having this codified in the contract protects against changes in law or policy that we can’t anticipate.

This is a no good, very bad topline answer both in substance and in terms of PR. If you don’t know why, you sure as hell should know why. The actual philosophy of the approach part is reasonable in parts 1 and 3. I do agree that the forward engineers were a good ask.

An architecture approach is a philosophy, and it could be right. I wish there was more consistent emphasis that this is the plan.

The second point means DoW has this backwards if true. Usage policies don’t determine operational decisions. Refusals determine operational decisions. I presume the reason Anthropic didn’t agree here is that they understood that once you agree to ‘all lawful use’ you are not in a good position when you train the model to refuse legal things you don’t like, or you threaten to pull the contract over legal actions, where legal means as determined by the general counsel.

The problem is, as I said under meeting of the minds, you really don’t want to have the DoW thinking your contract works one way, and then insist it’s the other way, and Anthropic understood this.

Employee Activism

There are good reasons the sidewalk outside OpenAI looks the way it does, and why the city was unable to get the people doing it to leave long enough to hose it off.

Even if OpenAI is attempting to do the right thing, they have signed on to ‘all legal use’ language, they have misrepresented the key functionality of the contract to the point that I spent many hours being confused and sorting through it until I finally understood their intent, and made many alarming statements of trust in and deference to the DoW given what else we know.

And while Altman and others at OpenAI have spoken excellently about the fact that it is crazy to label Anthropic a supply chain risk, they have also agreed to move forward to provide a replacement for Anthropic, while the sword of Damocles is still potentially poised above Anthropic’s head.

Here’s a four minute video walking through it.

An employee says that a lot of people at OpenAI are afraid to speak their minds. You should not be. Speak your mind. If this gets you in trouble, which it probably won’t, you’re working in the wrong place.

You must decide what to make of Sam Altman’s extensive history of cutthroat politics and not being consistently candid, read all of his statements, and decide how much faith to put in him here.

Again, is it possible that OpenAI stands ready and will stand by their redlines and protect our civil liberties in the ways that matter? For being responsible with potential autonomous lethal weapons?

I really, really want that to be true! We should all really want this to be true. It is up to those inside OpenAI to figure out for themselves whether or not it is true.

Matthew Yglesias: I think OpenAI employees need to ask some serious questions about what’s going on and whether they want to be participating in whatever it is.

We do not know the full terms of the OpenAI contract. Many questions remain unanswered. It is possible that OpenAI has a robust technical plan and understanding with DoW, and a willingness to back it up if it turns out DoW does not act honorably.

There’s only one way to know. You need to do your best to understand the situation.

I still think it is important is seeing the contract terms, and you should do so if you can and get a legal analysis, so you understand the background.

But unless you are resting your hopes on the contract’s legal terms, what matters is the practical plan, and your faith in its execution.

Perhaps you will find you agree with Daniel Steigman, and find the arguments convincing. If so, okay.

I would say the same for any other company entering such a deal. If I was at xAI, I would certainly be questioning what Grok was about to be used for, and whether or not you were okay with this, given they seem to have signed with no redlines at all.

If you are at OpenAI (or xAI), and after investigation (and legal consultation as needed) you do not find the protections acceptable or that your leader misrepresented the situation, then you need to organize, and use your power to hold leadership to account.

You also need to stand ready, in case DoW attempts to murder Anthropic, in which case you need to use your leverage to try and stop that from happening.

Your decision includes what this says about future high stakes decisions, and how they will be handled. Here is a paper on the history of activism in the AI community. If you do not like the results, you need to consider whether or not you wish to stay.