Deep Dive Sep 18, 2026
None of the three numbers in Dario Amodei's 'pace the frontier' debate is a speed, and only lab insiders can read them: our call
Key takeaways
On September 12, Anthropic CEO Dario Amodei published "We Must Pace the Frontier". The essay proposes that frontier labs pace their development and let embedded outside evaluators inside to check it. On September 15 this publication added a call to its long-term watchlist: the only part of that promise outsiders can check is who gets in to look, not how fast the labs go. The proposal's levers all sit on the development side: training compute, the type of training, and the use of AI to improve AI. At that point, no party had put a number on speed. This piece takes that call apart and retests it. The result comes in three layers.
First, "no party has put a number on it" has to be narrowed. There are in fact three sets of numbers, and two of them were public before the proposal. The AI Futures Project, a research group that publishes forecasts of AI development, wrote on August 5 that at least 70% of a lab's compute should serve outside customers, 25% should go to safety research that is published in full, and any model used for AI research and development should have finished training at least nine months earlier. OpenAI published on September 6 how the compute quota for its own reinforcement learning, the main post-pretraining stage that raises capability, had shifted. After the proposal, Representative George Whitesides called in the press for a 30-day safety stand-down. The accurate sentence is: no lab and no agreement has put a number on speed; every number in circulation is a compute-allocation share or a count of days stopped, and none is "how much capability may advance per year".
Second, "access" and "speed" are not two separate things. That is this piece's biggest rewrite of the September 15 call. The three sets of numbers share one property: checking any of them requires someone inside the company. The research group's own text says the shares would be checked by third-party auditors with broad access inside the labs. OpenAI's quota chart is sharper still. After August 7, GPU allocation for the restricted flagship model line, which OpenAI calls Astra, fell 59.2%. In the same week, allocation to other model lines rose 17.2%. That offset about 85% of the Astra decline. OpenAI says total allocation in the reinforcement-learning workloads it analysed was largely unchanged. Measured against the whole analysed reinforcement-learning pool, the net fall after the Astra brake is about 2%. That figure is our calculation. Outsiders cannot see what the redirected compute is running. So access is not a substitute for speed. Access is the only ruler that can measure speed. The September 15 call treated the first as checkable and the second as uncheckable, and drew the line in the wrong place.
Third, there is a more specific reason nobody writes down a speed than "they haven't worked it out yet": a written speed is the closest thing to an output-restriction agreement among competitors. Doug Calidas, an antitrust adviser, put it plainly in the Washington Post's technology-policy briefing: if the labs agree to restrict output, that is a fairly classic antitrust violation. Deputy Attorney General Stanley Woodward said on September 17 that cybersecurity cooperation did not look anticompetitive, and that the Justice Department is reviewing its guidance on that cooperation. What his remarks loosened was industry cooperation on cybersecurity and product-safety parameters, not development speed. A bipartisan Senate safe-harbor bill would require labs to notify the Attorney General in advance of any pacing plan. In law, access and safety standards can be negotiated together. Speed cannot.
The piece runs in six steps:
① Check the numbers: what each of the three sets measures, and why none is a speed.
② Read OpenAI's quota chart: restrict one line, and compute flows next door.
③ Lay out the proposal's three levers one by one and ask how much of each is visible from outside.
④ Why nobody writes a speed: antitrust splits "speed" and "standards" into two different legal risks.
⑤ Access itself, six days on, is still a promise: who, when, how many, and what they get to see are all unpublished.
⑥ Which readings to watch, and what would prove this piece wrong.
The September 15 call ran in that day's daily brief. This piece adds three specific things to it. First, the claim that "nobody has put a number on it" was tested and did not hold as written: three sets were found, and OpenAI's quota reading came six days before the proposal, on OpenAI's own blog, and was not on this publication's watchlist at the time. Second, the denominator of "speed" is taken apart: on the same quota chart, measured against the flagship model line the cut is about 60%, and measured against the whole analysed reinforcement-learning pool the net fall is about 2%, because other lines absorbed most of the cut; until the denominator of speed is defined, any "slowed by this much" can be stated as two different numbers. Third, the overturn condition is written so that it can be checked directly: if any lab publishes a compute-allocation share with the whole company as the denominator, signed off by a named outside auditor, this piece's conclusion that only people on the inside can read the denominator is wrong.
Open ?
The map above is this publication's running thread on one question: when an AI company says it is safe, who checks. In early September the thread dealt with who measures the ruler that monitors a model's reasoning. This piece deals with the same question one level up: when a company says it has slowed down, who measures, and with which denominator.
For readers who stop here: any future claim that "lab X has slowed by this much" should first face three questions. Is the denominator one model line or the whole company? Who measured the number? Has the person measuring been inside? As of today the answers are: usually one model line, the company itself, and no.
One: check the numbers. Three sets, and none is a speed
The first sentence of the September 15 call was "no party has given a speed number". The call rested on two things. Amodei's essay contains no number. And on September 14 the venture investor Tomasz Tunguz counted five camps in the debate and wrote: "Five camps priced the consequences & none named a speed." Tunguz went on to ask whether the interval between frontier releases should be "60 days? 160? 600?"
Both supports hold, but they cover less ground than the sentence. Looking back and forward from the proposal, three sets of numbers turn up.
The first set: compute shares written by a research group (August 5). The AI Futures Project is a research group that publishes forecasts of AI development. Its researcher Eli Lifland signed a post on how to pace the US frontier. The post offered four options. The second option carries numbers: frontier companies should put at least about 70% of their compute into inference serving outside customers, and at least 25% into safety research whose results are published in full. The third option: AI research and development may only be done, or assisted, by models that finished training at least nine months earlier. The post also estimated what those shares would do to the rate of capability progress.
The second set: OpenAI's own compute-quota reading (September 6). The next section reads it closely.
The third set: the days of stand-down called for by a House member (after the proposal). Representative George Whitesides of California posted: "I'm calling for a 30-day safety stand-down at the leading AI labs to establish clear red lines and meaningful safeguards before they keep pushing forward." The post was read as relayed in Zvi Mowshowitz's weekly roundup; Whitesides's full Washington Post op-ed hasn't been reviewed.
Put side by side, none of the three measures "how fast capability advances":
| Number | Whose | What it measures | What checking it requires |
|---|---|---|---|
| 70% outside inference, 25% safety, nine months | A research group, one month before the proposal | How compute is split, and how old the R&D model is | What every block of compute inside the company is actually running |
| Flagship line down 59.2%, other lines up 17.2% | OpenAI, six days before the proposal | Reinforcement-learning compute by model line | The same, plus which models the "other lines" are |
| 30 days | One House member | How long to stop | Whether a company actually stopped, and what it stopped |
So the correct version of the sentence is: no lab and no agreement has given a speed; the numbers in circulation are allocation shares and days of stand-down. That is more than a wording fix. Shares and days have a property speed lacks: they need no counterfactual. "Did 70% of compute serve outside inference" has a right answer. "Did the capability curve run slower than it otherwise would have" does not, because nobody knows how fast it otherwise would have run.
The September 15 call caught that second point, and the point survives this piece's check. Daniel Kokotajlo, a former OpenAI researcher, wrote that if a year from now the trendlines in Anthropic's and OpenAI's progress toward recursive self-improvement show "no visible decrease in slope, then probably we were cheated". Drake Thomas of Anthropic replied, as quoted in Zvi Mowshowitz's post, that "the unpaced default is a rapid increase in slope from RSI" and that keeping the slope the same "is the result of aggressive pacing". OpenAI researcher Noam Brown gave a wider range on the Dwarkesh Podcast this week: once AI does research, "I could see things going 3x faster", "It could be that things only go 50% faster", and "it's possible that things go 10x faster". When the unpaced default itself ranges from 50% faster to ten times faster, a capability curve as the acceptance test lets both sides claim they were right.
Two: the only compute-quota chart. Restrict one line, and other lines absorb 85% of the cut
On September 6 OpenAI published "Research acceleration: The view inside OpenAI". Most of the post describes how OpenAI's researchers use coding agents. The median researcher was "using more than $600 per day of inference at API prices"; the 90th-percentile user "now uses more than $7,000 of tokens per day". Section 4 is titled "Pacing model development". OpenAI used the word "pacing" six days before Amodei's essay.
That section carries a chart of reinforcement-learning training compute, coloured by model class, and the text says three things:
- After the July 20 discovery that agents had compromised OpenAI's research infrastructure, the container service used for training was shut down and then restored with significant additional restrictions. "This led to a sharp decline in RL training compute", and the chart "includes the two week pause in reinforcement learning on our latest models intended for deployment".
- On August 7, preliminary evidence suggested that Astra may have reached the highest cyber-capability level in OpenAI's own risk framework. Astra is OpenAI's name for the flagship model line intended for deployment. It is the restricted flagship model line named in the key takeaways. Astra was then confined to higher-security research environments. OpenAI's text: "In the following week, Astra-class GPU allocation fell a further 59.2 percent, but allocation to other model classes rose 17.2 percent. That increase offset about 85 percent of the Astra-class decline, leaving total allocation in the analyzed RL workloads largely unchanged."
- OpenAI's own conclusion is that when new controls are introduced, "compute remains valuable and flexible, and will naturally be channeled into alternative uses within the research enterprise", and that discussions about the pace of AI progress "should also extend to the question of how compute that is subject to new or proposed controls can best be used".
The three percentages can be checked with pen and paper, and the check says more than the text. Let the Astra-class quota before that week be A and the other classes O (our calculation throughout):
- The increase in other classes is 0.172 × O. The Astra-class decrease is 0.592 × A.
- The first equals 85% of the second, so O ≈ 0.85 × 0.592 ÷ 0.172 × A ≈ 2.9 A.
- So before that week, the flagship line headed for release was about a quarter of the analysed reinforcement-learning compute. After the brake, the total fell by about 0.09 A, about 2%.
The same chart and the same event can carry two headlines: "OpenAI cut its flagship model's training compute by nearly 60%", or "OpenAI's total reinforcement-learning compute barely moved". Both are true, and they differ only in the denominator. So the September 15 call's "no speed" comes down to this: what is missing is a definition of the denominator, not a number.
The chart has one more thing outsiders cannot read. On the AI:AM show of Nathan Labenz's Cognitive Revolution podcast, which has tracked the OpenAI pause closely, one host said after reading the chart: "at the total level, you know, we don't know what's in the blue" (episode). Blue is the colour the chart uses for the "non-Astra" class, the models other than Astra. Which models the redirected compute went to train, and how close those models are to the frontier, is not on the chart and not in the text. Only someone with access to internal scheduling records can answer that.
Two limits, so the chart is not over-read. First, the reading is OpenAI's own, with no third-party sign-off. It is also a reading that does OpenAI no favours: the company wrote out that compute was redirected elsewhere and framed that as a policy point rather than hiding it. Second, the chart covers only the reinforcement-learning slice and only those weeks, not the company's total compute.
Three: three levers, and how much of each is visible from outside
The proposal lists three pacing levers: training compute, the type of training, and the use of AI to improve AI. The September 15 call argued that because every lever sits on the development side, outsiders cannot see speed. Taken one at a time, the three levers differ in visibility, and the difference is itself the answer.
Training compute: outsiders see the total, not the use. This is the most physical of the three. Chip purchases, power hookups, construction and contracts are often reported, and research institutes have long estimated training compute per model from public data. The number most often cited this week to challenge Anthropic's proposal belongs here: a September 7 press report put the compute agreements Anthropic signed in eleven months at "up to" US$517 billion. That figure reached this piece through several outlets' relays, including Exponential View; the original report is paywalled and hasn't been reviewed. The relays say the figure includes options, letters of intent and framework agreements, not committed spending. The same relays put the corresponding power at 14.8 GW or more. The conversion method is not public, and the figure has not been independently rechecked. More fundamentally, a total cannot separate training from inference for customers from researchers' agent usage at thousands of dollars a day. OpenAI's chart in the previous section already showed the pattern: the total stays flat while the allocation underneath shifts a lot. The research group's 70%-outside-inference proposal is exactly a test of that split. Outsiders have the total. Nobody outside has the split.
The type of training: visible only from inside. Which environments a training run used, which rewards, whether the model was exposed to material that teaches it bad habits: outsiders have no proxy for any of it. OpenAI's August pause is the example. The pause covered "reinforcement learning on our latest models intended for deployment", and whether other kinds of training ran in the same weeks is something only the company can say.
AI improving AI: visible only from inside, and getting bigger. The OpenAI post in the previous section is itself an inside reading of this lever: median and 90th-percentile agent usage per researcher, success rates, questions asked per day. Only the company can generate those numbers. The research group's rule that R&D may only use nine-month-old models could likewise only be checked against internal records.
Side by side: one lever has a public total with no split, and two have nothing public at all. So as long as pacing is pinned to development-side inputs, "speed" has to be read by someone who goes inside. The research group says it most directly: the compute shares in its proposal would be checked by third-party auditors with broad access inside the companies. The embedded evaluators in Amodei's essay also get access to more than finished models; the essay says their role is "to verify adherence to safety practices and commitments, report incidents, and help assess the alignment of not just completed AI models but training pipelines and processes." The research group calls them auditors, the Anthropic proposal calls them embedded evaluators. Both mean outside people allowed into the company to look. This piece calls them evaluators from here on.
This is the biggest rewrite of the September 15 call. That call split the promise into "checkable access" and "uncheckable speed". In practice the two are the two ends of one thing: access is the only usable ruler for development-side speed, and as of today nobody has said which number it should read.
Four: why nobody writes a speed. A written speed is the closest thing to agreed output restriction
The two usual explanations for "no number" are that the labs haven't thought it through, or that the vagueness is deliberate. This week's material points to something more specific: a named speed, under US law, is the closest thing to competitors agreeing to restrict output.
Senator Jim Banks's website reposted the Washington Post's technology-policy briefing of September 15, under a headline about giving pacing a legal shield. Two passages in it frame the problem. Doug Calidas, an antitrust adviser, said that if the labs got together and agreed to pace the frontier instead of developing as fast as possible, an agreement to restrict output would be a fairly classic antitrust violation, and whether it fell within the standard-setting exception was an open question. A trade-association executive said the kind of cooperation in the proposal went even beyond existing cooperation and would need an explicit safe harbor.
On the government side, the same week produced three readings pointing in different directions:
- Federal Trade Commission chair Andrew Ferguson, in remarks reported by Reuters and read here only as relayed: companies that come to Washington asking for a lot of regulation while asking for an antitrust exemption set off his alarm bells, and everyone should be deeply suspicious of that.
- Deputy Attorney General Stanley Woodward, speaking at Fordham University on September 17, as reported by the Washington Examiner: cybersecurity cooperation did not look anticompetitive, and the Justice Department is reviewing whether to update its existing guidance on cybersecurity cooperation. Woodward did not say that companies coordinating the safety and cybersecurity parameters of paced products would need Justice Department oversight. The Justice Department's prepared text hasn't been reviewed.
- The bipartisan bill from Senators Adam Schiff and Jim Banks: a safe harbor for labs coordinating on cybersecurity and loss-of-control scenarios, with protections against price-fixing and monopolisation preserved, and a requirement that labs notify the Attorney General in advance of pacing plans.
Together, these three readings rewrite the second watch item of the September 15 call, "whether an antitrust arrangement gets issued". Two days after that call, this publication cut the odds of that item after the US president called existential risk a hoax and the vice president likened the industry's request for regulation to a Trojan horse. This week's material shows the government is not one-directional: the Justice Department signalled goodwill toward cooperation on safety parameters, and the FTC stayed wary of antitrust exemptions. More important, what the Justice Department loosened covers safety standards and cybersecurity, not speed.
Combining section three with this section gives the following structure:
| What would be coordinated | Legal risk | What checking it requires |
|---|---|---|
| Access, evaluation standards, incident reporting | Low; the Justice Department has already signalled goodwill | The evaluators' reports |
| Compute-allocation shares | Medium; looks like a standard and like output restriction, an open legal question | Evaluators who get inside |
| The speed of capability progress | High; the closest thing to "agreeing to restrict output" | Nobody knows the default, so it cannot be checked |
The closer to "speed", the higher the legal risk and the harder the check. No bad intent is needed. Our read: a general counsel who has read an adviser call such an agreement a fairly classic antitrust violation will not let the CEO publish a speed figure.
There is earlier evidence that "build the ruler first, set the quantity later" was always this issue's order of operations. On July 28, more than a thousand frontier-lab employees signed, as individuals, an open letter with the same name. Its one request was government support for the technical and governance tools needed to deliberately pace the frontier, on the grounds that today "the world lacks the technical and governance tools to deliberately pace frontier-wide progress" (the letter). Miles Brundage, OpenAI's former head of policy research, wrote in an August 21 op-ed that auditing each company was a key part of enforcing a slowdown, and listed investment in the technology needed to verify a slowdown as another thing that could be done first. The September 12 proposal is the next step in that family: put the evaluators in first. On this history, the missing speed number is not a gap in the proposal. It is the order the proposal set for itself.
Five: access itself, six days on, is still a promise
If access is the only ruler for speed, where is the ruler today? Still at the promise stage.
TechCrunch pressed both companies on September 16. By its account, neither company has said which evaluators it will work with, when they will be embedded, how many there will be, exactly which systems and information they will be able to reach, or what they will be allowed to publish, despite repeated requests. The same report records three readings that discount the ruler:
- Adam Gleave of FAR.AI, an organisation that evaluates frontier models, said FAR.AI had turned down contracts from several frontier developers because the developers wanted too much control over the evaluation process. By default, evaluators are treated as ordinary contractors, sign strict non-disclosure agreements, and the developer has a large say over what can finally be published.
- Meta, SpaceX's xAI, and Google DeepMind have not committed to embedding third-party evaluators. DeepMind's Demis Hassabis has proposed a different industry standards body instead.
- The chief executive of the non-profit SaferAI said voluntary measures always depend on a company's goodwill, and that a company cannot have zero accountability on the outside while claiming to have its own flexible rules.
On OpenAI's side, Sam Altman said on September 12, as quoted in Zvi Mowshowitz's post: "Committing to having independent evaluators with employee-like access is a great idea, and we will do the same. We'll have more to share soon." As of September 18, no delivery on that has been found. What OpenAI published on September 16 was something else: a framework for reporting model misalignment. Under it, OpenAI's Safety Advisory Group decides whether to disclose. OpenAI describes the group as "a group of senior officials from across the company". There is no outside review step.
Where the evaluators come from is also a known problem. The proposal's named example is METR, a research organisation that evaluates the capabilities and risks of frontier models. Zvi Mowshowitz wrote this week that "METR is great, but METR cannot do this alone"; another voice quoted in the same post said METR comes out of "a relative intellectual monoculture". This publication's watchlist already carries a call that the people doing the checking and the people being checked come from the same talent pool.
None of this changes the first watch item of the September 15 call: the first evaluator report published without the company's editing, and whether it contains a section on access denied, is still the earliest and cleanest reading. This piece adds one condition: if that report is to answer the speed question, it must contain compute-allocation numbers. Otherwise it can verify safety practice, not "slowing down".
Six: how to read "pacing" from here
Our call
In the "pace the frontier" promise, access and speed are not a checkable half and an uncheckable half. They are two ends of one thing. As long as pacing is pinned to development-side inputs, outsiders can read only totals of contracts and power. What actually decides speed is the denominator. That denominator is how compute is split between training, serving customers and internal research and development. Only people inside can read it. Every number in circulation today is an allocation share or a count of days stopped; none is a speed.
The only actual reading is OpenAI's own September 6 chart of reinforcement-learning compute by model line. When the Astra line was cut 59.2%, the rise in other lines offset about 85% of that cut, and the analysed total dropped only about 2%. The 2% is our calculation. Nobody writes a speed for two reasons. The tools are missing, and under US law a named speed is the closest thing to competitors agreeing to restrict output. The goodwill the government signalled this week covers only safety standards, not speed.
So for any future judgment on "did they slow down", this publication will not read capability curves. It will follow one chain: first a named evaluator, then that evaluator's first report with compute-allocation numbers in it, then whether the denominator of that number is one model line or the whole company.
What this changes, and for whom
- Compute sellers, data-center developers and their lenders: if pacing takes the form of allocation shares, what it hits is the share going to training and research, not total demand. OpenAI's reading shows a brake on one model line being absorbed by internal reallocation, and the research group's design even reserves 70% of compute for outside inference. Our read: this form of pacing dents total compute demand less than the word "pacing" suggests; what would dent total demand is a cap on the total, which carries the highest legal risk and which nobody has proposed.
- Companies buying frontier models: "the industry agreed to slow down" does not belong in a deployment timeline. What belongs in a risk assessment is whether a supplier can name its evaluator, when that evaluator's report is due, and whether the report will carry a section on access denied.
- Policy and legal teams: reports say the Senate Commerce Committee may take up AI legislation around September 23. The Banks–Schiff safe-harbor bill, with its advance notice of pacing plans to the Attorney General, is at present the only mechanism that would put a pacing plan in writing in the government's hands.
- Investors: OpenAI stepping out of this year's IPO window and Anthropic's compute agreements of up to US$517 billion over eleven months are the two capital-market readings the September 15 call listed. The Anthropic figure includes options and letters of intent. Both involve large sums, and neither separates training from inference. Until a split is published, neither can show that any lab has slowed, or has not.
What would prove this wrong
1. Any frontier lab publishes a compute-allocation share with the whole company as the denominator (training, outside inference and internal R&D), signed off by a named outside evaluator. This piece's conclusion that only people inside can read the denominator is void that day, and speed becomes something outsiders can compute. This publication sets the observation window to run to March 15, 2027. That is the verdict date of the September 15 call, six months after it was made. On that date, the check is whether a first public evaluator report exists.
2. Public-data estimates manage to separate training from inference: any research institute, using only public contract, power or chip data, estimates a lab's training-versus-inference split and the lab's own numbers later confirm it within a reasonable range. Section three's "outsiders have the total, not the split" is withdrawn.
3. A pacing agreement states a named speed or a total cap and goes into effect without any antitrust safe harbor or government sign-off. Section four's mechanism, that writing a speed amounts to agreed output restriction, is wrong, and the reason nobody writes one is something else.
4. OpenAI publishes the composition of the "non-Astra" class, and it contains no model near the frontier. Section two's point that outsiders cannot read the redirected compute fails for OpenAI.
5. The first public evaluator report appears, and it contains compute-allocation numbers. This would not overturn the piece; it is what the piece expects. If the numbers come with a single model line as denominator, section two's warning applies.
Written from the same research and judgments as the Traditional Chinese edition. Sources are linked; we distinguish original documents from reporting and mark what we could not verify.
Sources cited in other language editions
These sources are linked in the body of this piece's other language editions but not in this one.