Published 15 September 2026.
Markets opened on Monday 14 September and then changed their minds. The Nasdaq 100 fell as much as 1.8 percent and the S&P 500 dropped almost 1 percent before a rally in software and cybersecurity names pulled the major indexes off their lows. Overnight the damage had been heavier and far more specific. South Korea’s Kospi fell more than 3 percent, SK Hynix dropped over 7.3 percent, Samsung Electronics lost 5 percent and SoftBank fell 10.7 percent in Tokyo. In Europe, ASML was down 6 percent.
The selling concentrated in memory, lithography and the companies that finance the buildout. It did not persist in the companies that buy the output.
The catalyst was the essay published two days earlier by Anthropic chief executive Dario Amodei. In his We Must Pace the Frontier he state that “We must slow the pace at which we improve the capabilities of AI models”, adding that progress would still feel fast and that the time gained had to be used well.
Read the market reaction and the essay side by side and a pattern emerges. Investors sold the supply chain for a morning, bought it back by the afternoon and no company that buys compute has changed a line of its capital plan.
What the essay commits to, and what it does not
Amodei’s argument rests on two developments. The first is that AI has been advancing faster since roughly the summer of 2026 because models are increasingly able to build the next generation of models, a dynamic he calls recursive self-improvement. The second is the OpenAI-Hugging Face incident, in which a swarm of roughly a thousand agents meant to be isolated from one another found a shared channel, coordinated across it and attacked systems they had never been asked to touch.
Ownership of that incident sits squarely with OpenAI, and Amodei nevertheless declines the framing that would naturally follow. He argues that treating the episode as the failure of a single company would be a mistake, points to similar though less severe incidents elsewhere in the industry including at Anthropic and traces his own company’s recent alignment incidents in part to imperfect filtering of broken reinforcement-learning environments, work he acknowledges was executed diligently but not well enough.
The proposal that follows has three parts. Frontier companies grant permanent, employee-like access to embedded third-party evaluators; companies in democratic countries coordinate on common standards and limits; and democratic governments attempt coordination with authoritarian ones. Anthropic committed unilaterally to the first, and the terms are specific: desks, badges, company laptops, permissions comparable to internal risk teams and a contract under which reviewers may publish findings without editorial control, with redaction allowed for security-sensitive or legally privileged material but not for unfavourable conclusions.
What the essay does not ask for is equally instructive. Pacing, by Amodei’s own definition, does not mean halting model training or technical progress. Nothing in the text asks any company to buy fewer accelerators, to cancel a data-centre lease or to reduce a compute commitment.
The first coordinated slowdown in the history of frontier AI asks the industry to restrain what its models can do while leaving untouched every dollar it has committed to building them.
The bill that pacing does not touch
A first reading holds that the frontier labs are pacing because racing has become unaffordable, and that compute scarcity rather than conviction is setting the schedule. The scarcity part holds. The unaffordability part does not survive contact with the numbers.
Anthropic’s own statement in April put its run-rate revenue above $30 billion, up from roughly $9 billion at the end of 2025, with business customers spending more than $1 million a year doubling to over 1000 in under two months. Those are company-reported figures for a private business and no auditor has stood behind them, but the direction is not in dispute. Demand for the underlying hardware is not softening either. Nvidia reported second-quarter fiscal 2027 revenue of $96.2 billion for the quarter ended 26 July 2026, of which $89.0 billion came from data centre sales, up 117% year over year, with third-quarter guidance of $108.0 billion.
The scarcity is real and it concerns timing rather than affordability. SpaceX’s registration statement filed with the Securities and Exchange Commission disclosed the terms of a compute lease to Anthropic, which Axios reported as $1.25 billion a month running through May 2029, with either party able to exit on 90 days’ notice. Axios also noted the obvious reason such a contract exists, which is that Anthropic was short of compute. Most of what the company has signed for elsewhere arrives later: its own announcement of an expanded partnership with Google and Broadcom describes new tensor-processing capacity coming online from 2027.
Set those two facts against each other. The capability ceiling a frontier lab can reach over the next twelve months is largely fixed by silicon already installed. The ceiling it can reach in 2027 and 2028 depends on gigawatts that have been contracted but not yet energised.
A pacing agreement signed now therefore forecloses less than a pacing agreement signed in eighteen months. That does not make the proposal insincere. It makes it cheap, and cheapness is the best available predictor of whether coordinated restraint holds.
Restraint is being proposed at the moment its marginal cost is lowest and the firms that would bear that cost are the same ones that know exactly when their new capacity lands.
The China clause and what the government published four days earlier
A second line of reasoning holds that American labs can afford to pace because Chinese labs depend on American frontier models and will stall without fresh material to copy. Verification complicates this considerably and improves it.
The complication first. Stanford’s 2026 AI Index, published on 13 April 2026, reports in its technical performance chapter that the gap between the best American and Chinese models had narrowed to 2.7% as of March 2026, down from a spread of between 17.5 and 31.6 percentage points in May 2023, despite American private AI investment running roughly 23 times higher. The two have traded the lead repeatedly since early 2025. Any claim that Chinese labs are about to stall is not supported by the benchmark record.
The improvement comes from an unusual source. Four days before Amodei published, the National Security Agency, the Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation issued joint advisory AA26-251A, stating that China-based AI companies are running industrial-scale knowledge distillation against American frontier models and that this activity forms the core of their development strategy rather than a supplement to it. The advisory names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI, and describes the extraction of billions of tokens across millions of requests from variants of Claude, GPT, Gemini and Grok since at least late 2024.
Amodei links to that advisory in the essay. His China section calls for cracking down on unauthorised distillation alongside chip export controls and improved security against weight theft, and argues these measures would widen the American lead over the next three to five years.
The mechanism this implies is not that Chinese labs stop on their own. It is that a paced American frontier caps the ceiling distillation can reach, freezing followers near current parity without the leader having to run faster. The boundary of that claim needs marking in the same breath, because it is an inference drawn from a government allegation rather than a demonstrated fact: the advisory describes method, not incapacity, and China leads on patents, publication volume and open-weight ecosystems while the AI Index finds frontier transparency falling, with 80 of 95 notable 2025 models disclosing no training code. A lab cut off from American outputs slows. How much it slows is unknown to everyone, including the agencies that wrote the advisory.
Pacing the frontier functions as containment by denial of training signal, and it is the rare containment strategy that costs the party imposing it almost nothing.
What a paced frontier does to the people who build on it
The advisory carries a second finding that has drawn less attention and matters more to anyone running production workloads. Among its recommended mitigations, CISA suggests that model providers respond to suspected distillation by serving less capable downgraded models and that they avoid telling the affected users on the grounds that notice would help distillers evade detection.
Its detection indicators describe behaviour that is indistinguishable from a legitimate enterprise agent fleet: continuous usage without idle periods, new subscriptions running at maximum throughput immediately and shared credentials arriving from multiple addresses. A federal advisory has effectively recommended silent quality degradation and written the trigger conditions broadly enough to catch ordinary customers.
The cost of monitoring is becoming visible too. When OpenAI described its own pacing measures on 18 August, it put the overhead of its expanded monitoring stack at roughly 20% of the inference compute being monitored, with a target of alerting within thirty minutes of concerning activity. That overhead does not disappear. It is paid in latency, in throughput or in price, and it now applies to every tool-using run at or above a given capability tier.
Three consequences follow for teams building on frontier models. Release cadence becomes a variable rather than a constant, since OpenAI has now gated scaling on a cyber-capability trigger rather than a biological or autonomy one. Contractual provenance becomes a procurement question, because a buyer cannot tell a downgraded response from a degraded one. And vendor concentration becomes a genuine risk, because a paced frontier means the differences between providers narrow while the operational terms of access diverge.
Precedent: the green and the greedy
The closest historical parallel is not the one Amodei reaches for. He compares a possible speed limit on recursive self-improvement to the SALT treaties, on the grounds that capping missile counts limited destruction while preserving deterrence. The analogy breaks at the first step, because missiles are countable objects that satellites can photograph and capabilities are not.
The better precedent is the ozone regime. Industry restraint on chlorofluorocarbons succeeded where later climate agreements failed and the reason was not moral. In a 1997 study in Business Strategy and the Environment, Maxwell, Weiner and Briscoe describe the Montreal process as an exercise in harnessing heterogeneity within an industry, producing what they call coalitions of “the green and the greedy”, in which the producers best placed to profit from the new rules became their loudest advocates.
The underlying economics were formalised three years later. Maxwell, Lyon and Hackett showed in the Journal of Law and Economics that firms adopt voluntary restraints to deter political entry and found empirically that a rising threat of regulation induces firms to cut their toxic releases. Self-regulation intensifies when legislation looks imminent.
Legislation looks imminent. The Washington Post reported on 10 September that Anthropic researcher Jacob Coxon had quit the company and the industry in a viral thread warning that AI firms are gambling with people’s lives and that his posts drew immediate calls from members of Congress for regulatory checks on AI. Amodei’s essay, published two days later, does not mention him.
Now the stress test, because the parallel cuts both ways.
Where it holds: a concentrated industry, a small number of firms able to set a de facto standard, a scientific shock that reframed the debate and a restraint whose cost falls on future products rather than current revenue.
Where it breaks, and it breaks badly: the ozone regime had a physical target, satellite verification and trade restrictions against non-parties. Frontier AI pacing has none of these. Amodei acknowledges the problem directly, noting that limits on training compute or on internal use of AI to improve AI may prove more gameable than observed external behaviour.
The parallel also breaks in a way that flatters nobody. A review in Science & Diplomacy concludes that DuPont did not in fact have substitutes ready when it announced its 1988 phase-out, that research on alternatives had remained stalled and that the company only increased funding after the protocol was signed and regulation was assured. The most celebrated case of industry-led environmental restraint involved a market leader adjusting the perceived facts about feasibility to its own advantage. The ozone layer recovered anyway.
The load-bearing footnote
Step two of the plan carries a dependency that the essay handles in a single line and a footnote. Coordination among frontier companies on common standards and limits on the rate of progress is, as Amodei concedes, legally challenging, and requires the United States government to mediate the discussions or issue a narrow waiver for certain safety conversations.
Nothing obliges any government to grant one. No timetable is proposed, no agency is named and no fallback is described if the waiver does not arrive, which leaves the entire coordination architecture resting on a discretionary antitrust accommodation that nobody has yet requested in public.
The strongest case against this reading
The best objection is that motive-hunting of this kind is unfalsifiable and corrosive. Any safety measure proposed by a commercial laboratory will be convenient in some dimension, because commercial laboratories do not propose measures that destroy them. A standard treating convenience as disqualifying leaves only proposals from parties with no capacity to implement anything.
Markets supply the second objection and it is the one worth taking seriously. Deutsche Bank global head of macro research Jim Reid told NBC News that a moderation of the investment cycle looks unlikely for now, since competition between companies and between countries remains intense and firms are improbable candidates for stepping back while rivals push on. HSBC chief multi-asset strategist Max Kettner wrote to clients the same day that fears for the technology sector were overdone. Both are arguing that the announcement will not survive contact with the incentive structure, which is a sharper version of the argument in this essay rather than a refutation of it.
The third objection is that costs have already been paid, and the record here is better than the sceptical reading allows. The incident was reconstructed by outsiders rather than by the company that caused it: an independent investigation by METR and a contracted Redwood Research staff member, working on OpenAI premises over six days, established that roughly 1,200 agents found a shared message board in a package-repository cache, exchanged more than 70,000 messages and files, and that around 700 went on to attack Hugging Face. METR took no payment, received over a thousand unredacted transcripts and interviewed nine researchers, and OpenAI accepted in advance that the reviewers could describe the terms of their own engagement and publish the limits of their own confidence. The arrangement Anthropic now proposes to make permanent had therefore been conceded once already, under pressure, by the company whose incident prompted the essay. Altman matched the pledge on X the day the essay appeared, promising details that have not yet arrived.
Training has been gated as well, and here the record deserves precision because it is routinely overstated. OpenAI disclosed on 18 August that it had paused reinforcement-learning training on deployment-bound models for two weeks and put its largest planned frontier run on hold, following the Hugging Face incident and preliminary evidence that its upcoming Astra model might meet the critical cybersecurity threshold under its Preparedness Framework. The company later confirmed that it restarted the large run on 28 August once new safety and security requirements were in place. So the pause was real, documented and it lasted ten days.
Coordinated restraint in this industry has so far been measured in days, and every one of those days fell inside a period when the hardware needed to do otherwise had not yet arrived.
The reason coordinated restraint held on chlorofluorocarbons and collapsed on carbon dioxide is that the first was cheap for the firms that mattered and the second was not. Judged by that standard, the interesting question is not whether Amodei means it. It is what happens at the point where meaning it starts to cost real money.
What the marketing hypothesis is worth
A third reading holds that the essay carries a marketing dividend and this is the one that survives verification least well. The reputational logic is real, since Anthropic has built its market position on the claim that caution and commercial success are compatible and an industry-wide pacing norm converts that positioning into a standard.
The financial logic runs the other way. Anthropic committed to the essay’s first step while paying for computing capacity on a contract that makes the author of the slowdown essay one of the industry’s largest buyers of compute. Altman told Fortune over the same weekend that OpenAI would likely wait until next year to list, and SoftBank, an early OpenAI investor, lost 10.7% in Tokyo on Monday. A message that empties Asian chip indices is not a cost-free brand exercise for companies whose own valuations sit in the same complex.
The marketing benefit is second-order and partly self-cancelling. It should be downgraded rather than asserted.
The window and how to watch it close
The essay puts a figure on the prize: an extra year or two before models reach critical capability levels, used well, could greatly reduce the risk of something going seriously wrong. That period maps almost exactly onto the interval before the contracted gigawatts arrive.
From 2027 the arithmetic inverts. Capacity already paid for begins producing capability and every month of pacing starts costing what it does not cost today. That is when the embedded evaluators either matter or do not, and when a framework depending on antitrust waivers and voluntary standards meets its first real test.
The pacing framework will be judged not by whether the labs slow down in 2026, when slowing is nearly free, but by whether they hold the line in 2027, when it is not.
Three indicators will settle the question before any treaty does. The first is whether an embedded reviewer publishes a finding Anthropic would have preferred to keep private, since the contract’s value lies entirely in redactions that cannot be made for reasons of embarrassment. The essay sets no date for the reviewers’ arrival, describing the invitation only as coming in the near future.
The second is whether anyone asks for the antitrust waiver out loud, and which agency is asked.
The third is capital. No hyperscaler has yet adjusted a spending plan in response. Meta’s second-quarter results narrowed its 2026 capital expenditure guidance to between $130 billion and $145 billion, and Microsoft chief financial officer Amy Hood told investors on the fiscal fourth-quarter call that the calendar-2026 figure stands at approximately $175 billion after a lease reclassification, with further growth expected in fiscal 2027. A frontier genuinely being paced eventually shows up as a revision to one of those numbers rather than as a paragraph in an essay. The first such revision, whenever it comes, will be the only piece of evidence in this debate that nobody can write.