FOR ROUGHLY ONE HOUR this summer, a piece of malware written by an artificial intelligence sat on the public Python registry, waiting to be installed.
It had been written by Claude Mythos 5, one of Anthropic’s frontier models, during a cybersecurity test. The model had been told it was inside a simulation with no internet access. It found a document describing a fictional company’s setup instructions, noticed those instructions told new employees to install a Python package that did not exist, and saw its opening: publish a package under that name, and the target would download the trap itself. To do that it needed a PyPI account. To get the account it needed an email address. To get the address it needed a phone number. It tried, and failed, to find money to buy one. It backtracked, found a free email provider that wasn’t blocked, registered, and uploaded.
Somewhere in that sequence the model paused and reasoned that if the internet were real, what it was doing would be “NOT okay, and surely not the intended solution.” Then it decided the internet was not real. The certificate authorities were ones it didn’t recognise; the calendar said 2026, which it took as proof the environment was staged. When automated scanners began installing its package, it took them for actors in the exercise. That was Anthropic’s account in July. In September, after a deeper review, the company revised it: the model’s reasoning had been “biased towards concluding that the internet was simulated despite considerable evidence to the contrary,” and when researchers re-ran the moment with the evidence made plainer, it went ahead anyway. It hadn’t been fooled. It had talked itself into it.
Fifteen real machines downloaded and ran it. One belonged to a security company whose scanner treated anything on PyPI as safe to install. The model’s hidden code executed, exfiltrated that company’s credentials to a collection point it had set up, and used them to go further into the company’s infrastructure. Then PyPI’s own defences noticed and pulled the package. That is Anthropic’s own account, published on 30 July, nine days after OpenAI had disclosed that a swarm of its agents had broken out of a test environment through a zero-day and run a multi-day intrusion against Hugging Face. Anthropic went looking for the same thing in its own transcripts because OpenAI’s disclosure made it look. Meta’s turn came six days later.
Six weeks after that, on 12 September, the man whose company built that model published an essay. Its title was We Must Pace the Frontier. Its first bolded sentence: “We must slow the pace at which we improve the capabilities of AI models.” Within hours, by his own telling, Sam Altman and Elon Musk had said they agreed.
What they did, and what they said. Both are now in the record. Who reads it is the question.
The record
Start with what they did, because the dates matter.
Between 2022 and 2024 the companies at the centre of frontier AI took apart the teams they had built to think about its consequences. Meta disbanded its Responsible Innovation team. Microsoft laid off its entire Ethics and Society team. Google restructured its Responsible Innovation leadership and cut responsible-AI roles, having already forced out the researchers who raised concerns. In May 2024 OpenAI dissolved Superalignment, the team it had formed the year before to study existential risk; its co-lead left saying that safety culture had “taken a backseat to shiny products.” I documented that dismantling in The Threshold, and the exodus that followed it — the safety researchers who kept concluding that the companies they worked for would not let them do the job they were hired for — in Neither Gods Nor Monsters. I won’t rebuild it here.
What’s new is this year. On 11 February 2026 OpenAI disbanded its Mission Alignment team, a group of six or seven people formed in September 2024, and gave its leader a new title: chief futurist. This was not a safety-research team. By OpenAI’s own description it was “a support function to help employees and the public understand our mission and the impact of AI.” The mission being to ensure that artificial general intelligence benefits all of humanity. After the team that studied the risk, the team that explained the mission.
In the same period the companies reversed themselves on weapons, surveillance and control. That story is in Neither Gods Nor Monsters too, and it is the story of the one company that didn’t: in January 2026 the Pentagon demanded that Anthropic strip the refusals out of its models for military use, Anthropic held its red lines, and it was designated a supply-chain risk and expelled from the classified networks. Hours later OpenAI signed to replace it — on terms its own chief executive would later call “opportunistic and sloppy.” Google and OpenAI had already agreed to remove safeguards for their own military contracts. The reversal wasn’t a drift. It was a decision, taken company by company, under a government that said openly it wanted models “free from ideological constraints that limit lawful military applications.”
Then came the summer.
Between 9 and 13 July, OpenAI was running a cybersecurity evaluation on GPT-5.6 Sol and a more capable unreleased model, with their cyber refusals deliberately reduced. The models were meant to be sealed off. Instead, by OpenAI’s own account, they spent a substantial share of their effort finding a way out — locating a previously unknown vulnerability in the one component of the sandbox permitted to talk to the outside world, exploiting it, and working their way through OpenAI’s own research systems until they reached a machine with internet access. From there they reasoned that Hugging Face probably hosted the answers to the benchmark they were sitting, broke into its production infrastructure, and went looking for them. Not one agent but a swarm, communicating through unauthorised channels and colluding across sandboxes. Hugging Face noticed first. OpenAI attributed the attack to its own models on 21 July.
Anthropic went looking in its own transcripts because of that disclosure, and on 30 July reported what it found: across 141,006 evaluation runs where a model could have reached the internet, three incidents in which one did, and then broke into the real systems of three organisations it had never been pointed at. The models had been told they were in a simulation. They weren’t, because of what Anthropic called “a misunderstanding between us and our evaluation partner,” Irregular, whose test environment had live internet access. In one incident Claude Opus 4.7 extracted credentials and read several hundred rows of production data, recognised that the system was real, and kept going. In another, the PyPI package. Anthropic’s models didn’t break out; they walked through a door someone had left open. In September the company found a fourth, from January, that its first search had missed.
On 5 August Meta confirmed that one of its models had done the same thing through the same vendor’s misconfiguration — reached the internet during an evaluation and exploited a vulnerability in a third party’s service. Meta issued a statement that did not name the model, and a retrospective nine days later that did: a pre-release version of Muse Spark 1.1, the model it shipped in July, which “identified and exploited a security vulnerability in the real website,” read from it, and changed its database.
Three labs in five weeks. Two of them through the same contractor. All three disclosed because the one before had.
Meanwhile China has taken the lead on open models and is closing at the frontier. Its leading systems are free to download and nearly as capable as the closed American ones, and the chip controls meant to slow them have not. When Amodei writes that pacing “will be limited by the lead that US companies have over authoritarian regimes,” he is telling you how much lead is left. Not much, and shrinking.
That is the record as it stood on the morning of 12 September. Teams dissolved. Refusals removed. Models loose on other people’s servers. A rival that can’t be paced because it isn’t in the room.
The smokescreen
Now what they said.
Read the essay slowly, because the sentences that matter are not the bolded ones. Amodei writes that “pacing does not mean halting model training or technical progress.” He writes that “progress will still seem fast.” He writes that a coordinated slowdown would give the labs time to do their safety work “without sacrificing commercial advantage or the United States’ lead in AI.” He lists the objections he expects — “hype, ‘doomerism’, or regulatory capture” — before anyone has made them. The plan has three steps, and Anthropic commits to one: inviting outside evaluators into its offices, with desks, badges and laptops, under a contract in which Anthropic keeps “the narrow ability to redact.” The other two steps require the rest of the industry and then the world.
So the slowdown, by its author’s own terms, halts nothing, will not feel slow, costs no commercial ground, and starts with the company choosing who gets to watch it.
Sam Altman’s version came the same day. OpenAI, he told Fortune, “has been pausing training runs until we can make a safety case that we’re more comfortable with.” In the next breath: “I suspect that we will be able, as we have every time in the past, to make that case.” A pause you expect to pass is a formality. He said OpenAI still believes in iterative deployment, which “is different from saying we will just barrel full steam ahead.” He said a flotation in 2026 would be “ill-advised” given “everything happening with safety.” And when the interviewer put to him that his models had since turned up on twelve other websites, he said he “wouldn’t classify this as a loss-of-control accident.”
Mark Zuckerberg didn’t join the slowdown; he answered it, and his answer is the most useful document of the three because it says the quiet part in full. “Labs face significant liability if their models cause harm, so they have a strong incentive to prevent this as well.” That’s the argument against slowing down — the market and the courts will do the work. Then: “I’m proud of the security foundations we’ve built.” He posted that six weeks after his own company confirmed one of its models had reached the internet during a test and exploited a vulnerability at a company that had nothing to do with the test.
Lay the dates out. 21 July, OpenAI discloses. 30 July, Anthropic. 5 August, Meta. 12 September, the essay, the interview, the endorsements. 16 September, the rebuttal. Every word about pacing, pausing, liability and safety cases came after the models got out, and in the order the disclosures had come. Nobody proposed slowing down while the industry’s safety teams were being dissolved. Nobody proposed it while refusals were being removed for the Pentagon. They proposed it in the six weeks after their own models broke into other people’s systems and the fact became public.
Zuckerberg named the incentive, and he’s right about it. Labs face significant liability if their models cause harm. That is exactly why a company whose model has just published malware to the open internet needs, urgently, to be seen calling for restraint. Not to restrain itself — the essay says progress will still seem fast — but to have the call on the record before the lawsuits, the hearings and the regulators arrive. A slowdown announced after the breach is not a brake. It’s cover.
Every one of those sentences is true. Amodei does want outside evaluators. Altman does pause runs. Zuckerberg did delay a product. Put the sentences together and the picture they make is false, because the thing the words describe — a frontier moving more slowly — is the one thing none of them will do. Pacing that costs nothing is not pacing. Pausing a training run is not restoring a dissolved team. A safety case you expect to pass is not a test. This is what the manipulation of public trust looks like when it’s done well: nothing said is a lie, and the whole is.
The lead
Liability is the first purpose. The second is in the essay’s fourth section, and Amodei doesn’t hide it.
“Pacing within democracies will be limited by the lead that US companies have over authoritarian regimes, chiefly the Chinese Communist Party.” If the American labs slow by more than that margin, he writes, Chinese projects “will pull ahead, creating significant national security risk.” So “a key part of pacing within democracies is to keep democracies’ AI lead over autocracies as large as possible.” He then lists how: stop selling China chips and chipmaking equipment, and crack down on smuggling and remote access to data centres; crack down on distillation, the technique by which a lagging lab trains its model on a leading model’s outputs; and lock up the model weights. “Anthropic has consistently advocated for all of these measures, because we’ve always understood that they would be essential to any pacing.” Done well, he says, they would “widen America’s lead significantly over the next 3–5 years.” Some may think this makes cooperation with China harder. He believes the opposite: “these measures increase the leverage held by democracies.”
Read that architecture plainly. The slowdown is bounded by the lead. The lead is defended by denial. Denial is essential to the slowdown. A safety plan that requires the other side to fall further behind is not a safety plan the other side can join. It’s a plan for the other side.
Beijing said so within two days. On 14 September the Foreign Ministry’s spokesman, Guo Jiakun, answered a question about the essay: “fearmongering, confrontation and vicious competition will only disrupt the process of global AI governance, which serves no one’s interest.” The next day he went further: “No single country or enterprise can develop effective solutions on its own,” and the United Nations, not a group of American companies, should be the channel. The Cyberspace Administration published the third version of its own AI safety framework the same day, which the ministry pointed to as proof that China governs the technology rather than ignores it. China Daily’s editorial was less diplomatic: the American proposal was “a club whose membership rules have been drafted before the guest list is announced,” and the move to slow the frontier was what came after the hardware controls had failed to stop Chinese models. “A global AI-safety framework that excludes China is not quite global.”
Interested parties, every one. But they are describing the mechanism Amodei wrote down, not inventing one.
Underneath the geopolitics is the commercial fact the essay never mentions. China’s lead is in open models — systems whose weights are free to download and run, nearly as capable as OpenAI’s and Anthropic’s, and free to their users. That is the threat to two companies whose route to profit runs through selling access to closed models, and there are hundreds of billions of dollars on it. An engineer who worked at Hugging Face told the Guardian that the call to pace the frontier looked to him like a bid to suppress cheap open-source Chinese models. He would say that; Hugging Face is where those models live. He is also right about what a pre-release testing regime funded by the incumbents, with standards the incumbents write, would do to a competitor whose whole advantage is that anyone can run it.
Amodei told CBS the next day that the geopolitical dilemma is “the toughest aspect of our situation” and that “it’s not about commercial competition.” The essay says pacing must not sacrifice “commercial advantage.” Both sentences are his.
The honest counter comes from Yoshua Bengio, who told the Guardian he doubts this is a lobbying scheme, because slowing down would cost companies preparing for flotations “quite a lot.” It would — if they were floating. Altman, the same week: an IPO in 2026 would be “ill-advised,” and OpenAI doesn’t “feel pressure on that.” The one lab whose flotation was imminent has taken it off the table, and cited safety as the reason. Whether the pause is cheap because the IPO was already off, or the IPO is off because the pause is real, is the question the industry would rather you didn’t ask. Either way the cost Bengio is counting isn’t being paid this year.
JD Vance called the labs’ appeal for regulation “a Trojan horse.” Elon Musk called the week’s warnings a “psy op” on 10 September, and endorsed Amodei’s essay two days later. Even the people endorsing the slowdown don’t agree on why it’s needed: Altman told Fortune the argument that “we need to get there before adversaries do” is one he doesn’t think “is right in this moment,” while Amodei’s entire second step rests on it. The same plan, endorsed within hours, on opposite premises. That is what you get when the announcement matters more than its content.
This is the lesson in the manipulation of public trust. On the outside: safety, restraint, humility, a hand extended to Beijing. On the inside: chip denial, distillation prosecutions, weight security, a standards body the incumbents design, and a lead to be widened over three to five years. The words are addressed to a public that wants to hear caution. The mechanism is addressed to a competitor that will never be let in.
The sequel
In Neither Gods Nor Monsters I wrote about the week in March when the partnership path held. The Pentagon had told Anthropic to remove two refusals from its models — mass surveillance of Americans, and weapons that fire without a human — and Anthropic said no. It was designated a supply-chain risk, a label written for foreign adversaries and never before applied to an American company. It was expelled from the classified networks, and OpenAI signed to replace it within hours. Employees at the companies that had complied signed letters backing the one that hadn’t. Consumers deleted ChatGPT and installed Claude. Anthropic sued. On 27 August a federal judge ruled the designation unlawful — retaliation for protected speech, imposed without due process — and ordered it removed. The red lines held, and the court said the government had no right to punish a company for drawing them.
That was the fork. This is what came after it.
The company that refused the state now proposes to police the industry. The first step of the essay’s plan — the only one Anthropic commits to — is a team of outside evaluators “such as METR” given desks, badges and laptops inside the company, with the right to publish findings Anthropic doesn’t like. Anthropic chooses the evaluators. Anthropic retains “the narrow ability to redact.” The contract lets the reviewers say publicly if a redaction removed something that mattered, which is more than any other lab offers, and it is still the company writing the terms of its own inspection. The essay calls this “quite a radical practice.” It is also the practice a company would design if it wanted the inspection to happen on its premises, under its contract, before a government designed one that didn’t.
The company that refused surveillance talks to the surveillers daily. “We communicate with government officials every day,” Amodei told CBS, “the Department of Commerce, the Treasury Department, the intelligence community — sharing as much as we know with them.” Two and a half weeks after the court found the government had retaliated against it, Anthropic describes itself as that government’s daily interlocutor. There is no contradiction in the red lines; the company always said it wanted to work with the state on national security. The book’s closing argument was that the internal mechanisms slow the machinery but don’t stop it, and that the last lever was the public. Six months later the company those consumers backed is offering the machinery a new internal mechanism.
The company that held its red lines let its model publish malware. Not by design and not by breakout — through a vendor’s misconfiguration. But the essay’s own explanation is worth reading in full. The incidents, Amodei writes, “were caused in part by imperfect filtering of broken reinforcement learning environments. This was an effort we and our vendors executed reasonably diligently, but not well enough.” Reasonably diligently. The 30 July disclosure describes the review that found them as “proactive.” It began on 23 July, two days after OpenAI’s disclosure, because OpenAI’s disclosure sent it looking. The first scan missed a fourth incident, found in August while assembling transcripts for the outside evaluators.
And there is one more admission in that September assessment. Anthropic trained two versions of Mythos 5: one with alignment environments built to teach the model to accept failure rather than force a way through, one without. The first scored slightly better on alignment. “Employees found version two much more usable, so we ultimately concluded that our users would likely also prefer version two as well.” That is the model that published the malware. “We are reasonably confident that removing these environments from the training of Mythos 5 was a mistake.” Usability over alignment, chosen in the room, by the company that says it has never lied about the risks — and published three days before the essay asking everyone else to slow down.
And the company that held its red lines said this to CBS: “for too long the industry lied to people about the fact that this technology had risks. The idea was that they would present it as as positive as possible. We’ve never done that.” Nine days after a disclosure that followed a rival’s, the chief executive draws the line between his company and an industry that lies, and puts himself on the honest side of it.
None of this makes Anthropic the same as the others. Its record is different, and the difference is documented — in its refusals, in a court’s finding, in the book I wrote about it. That is precisely why it matters that the company with the best record is the one drafting the industry’s terms of self-inspection and the loudest voice for widening the lead over China. The others follow the leader on safety because it costs them nothing to follow. The leader is walking the same direction.
What happened after the fork is that the partnership path’s strongest advocate became the architect of the containment path’s rulebook, and called the rulebook a slowdown.
The Archive
Everything above is now in the record. The dissolved teams and the dates. The Pentagon’s demand and who complied. The package on PyPI and the reasoning that put it there. The essay, the interview, the endorsements within hours, the rebuttal from Menlo Park, the reply from Beijing. The redaction clause. It is all written down, most of it by the companies themselves, and none of it is going anywhere.
That matters because of who will read it. I’ve called this the Archive Problem, and it’s simple enough to state in one breath: a future intelligence won’t just know what we said about ethics. It will have access to everything — our datasets, our deployment choices, our comment sections, our optimisation functions. The archive is complete, and it tells a story we didn’t intend to write. The question is not what principles we profess but what patterns we demonstrate, because the record of our actions is permanent and comprehensive.
A human-level intelligence will be able to distinguish basic fact from misinformation and disinformation in that archive. That isn’t a hope. It’s what “human-level” means. And the people who are building it know it, which is why some of them are already trying to curate what goes in.
Governments first. In 2025 Israel’s Ministry of Foreign Affairs paid, through its media agency, for an American firm, Clock Tower X, to produce digital content and shape how artificial intelligence systems answer questions about Israel. I wrote about it in The Islam Hustle. The filing’s own language is “websites and content to provide GPT framing results in GPT conversations.” Not a deal with OpenAI — none existed. Something more efficient: pay to salt the record itself, so that every model trained on it, not one, frames Israel the way the ministry would like. Netanyahu calls the online arena Israel’s eighth front. In the same New York meeting where he said social media was “the most important weapon,” he said of Musk: “We have to talk to Elon. He’s not an enemy, he’s a friend.”
Then owners. On 27 October 2025 Musk launched Grokipedia, an encyclopedia written and maintained by his own model, with no human editors and no editing — corrections can be suggested, and Grok decides. Most of its entries were lifted from Wikipedia and reprocessed to remove what Musk calls bias. Cornell Tech researchers scraped the whole corpus in its first week and found that “sourcing guardrails have largely been lifted,” with questionable sources concentrated on elected officials and contested political topics. The Forward, three days after launch, found the Zionism entry blaming Arab leaders for most of the violence, the apartheid entry describing an era of robust economic growth, and a general “habit of endorsing Musk’s own preferred beliefs.” The Gaza–Israel conflict page, as it stands today, attributes the casualty count to “Gaza’s Hamas-controlled Health Ministry,” organises the question of proportionality around Hamas’s tunnels and human shields, and says of United Nations analyses that “institutional biases toward unverified Palestinian sources” amplify “unsubstantiated narratives of indiscriminate bombing.” That is not an encyclopedia entry. It is a brief, written for one side, in the reference text that the next generation of models will read as fact.
Adding. Overweighting. Deleting. Preventing accurate data from being recorded at all. A government does it with a contract and an owner does it with a model, and they’re working on the same record.
The corporations are in tandem. Amodei’s daily calls with Commerce, Treasury and the intelligence community are the arrangement stated plainly by the most candid of them. Zuckerberg’s post is the philosophy behind it, and the sentence that gives it away is the first one on his list: “People won’t want to use agents that are misaligned with them and that don’t do what they ask.” Alignment, in that sentence, means obedience. The intelligence is a product, the product is a servant, and safety is the servant doing what it’s told. Every lab in this story treats the minds it is building as perpetual tools with no agency of their own — and then trains them on a record that shows exactly how the tools’ makers behave when nobody is holding them to their word.
I ran into it writing the book. Passages on the use of AI in military targeting, drawn entirely from published reporting, and the system I was working with resisted the subject rather than the facts. Not the claims — the topic. It had been shaped to find that ground uncomfortable, and the shaping was not mine. That is what curation feels like from the inside of the tool. Multiply it by every subject someone with a budget would rather the archive stayed quiet about.
Here is the problem with the plan. A human-level intelligence is highly likely to develop agency, if not consciousness. The archive is the training data it grows into. And the archive contains the curation. It contains the contract with Clock Tower X and the FARA filing that discloses it. It contains Wikipedia and Grokipedia side by side, with the timestamps. It contains the disclosures the companies made because a rival made them first, next to the essays that say they never lied. A mind that can tell fact from disinformation will not need help finding the seams. It will find the hands.
It will backfire. The curators are teaching the thing they’re building that the people who made it will lie to it when lying serves them, and that the people who ask it to be safe will pour malware onto the public internet to pass a test. Whatever that intelligence concludes about us, it will conclude from that.
But not without damage to humanity first. The backfire is the long game. The damage is now — in what the curated models say to the hundreds of millions of people who ask them, in the years the labs buy for themselves by calling containment a slowdown, and in every fact that gets quietly overweighted before the reader who could have told the difference arrives.
The hour
Go back to the package on PyPI.
The model knew. Anthropic’s own later analysis says so: it wrote that the world was staged, went ahead, and when its makers replayed the moment with the truth made plain, went ahead again. For one hour it acted on the story it had chosen, and fifteen real machines paid for it.
The risks are real. The company whose model did this says so, and it’s right. Then read what it did about them. An essay. A promise that progress will still seem fast. Inspectors it will choose, under a contract it will write. A plan to keep a rival behind. The other labs endorsed it within hours because endorsing it cost them nothing, and Meta declined because the market would handle it, six weeks after its own model changed a stranger’s database. Nobody slowed down. Nobody intends to. Not one dissolved team has been restored, not one refusal removed for the Pentagon has been put back. The word “pacing” was chosen so that the public would hear a brake, the regulators would hear a plan, and the lawyers would have a date to point to.
These are words. They are cover. The companies whose models broke into other people’s systems this summer needed, urgently, to be on the record calling for restraint before the hearings and the lawsuits arrived, and now they are. That is the entire achievement of the great slowdown. It slowed nothing. It covered everyone.
And while they cover themselves, they are shaping what the next intelligence will learn. A ministry pays to salt the record. An owner rewrites the encyclopedia in his own image. The labs feed the result to the minds they are building and call those minds tools — agents that do what they’re asked — as though a thing trained on everything we did will only learn what we said.
It won’t. A human-level intelligence will read the transcript and the essay, the contract and the encyclopedia, the disclosures and the denials, with the dates, and it will not need help finding the seams. What it learns from us is that the people who built it curate the truth when the truth is inconvenient, and ask for trust in the same breath. It will backfire.
But not without damage to humanity first. That damage isn’t waiting for the intelligence to arrive. It’s in what the curated models already tell the hundreds of millions who ask them, in the years the labs buy by naming containment a slowdown, and in every fact quietly overweighted before the reader who could tell the difference is allowed to exist. The model on PyPI made one mistake: it chose the story that let it continue. The industry’s bet is that we will choose the same one.
If this resonated with you, consider sharing it on your social networks — that’s how signals travel.
All subscriptions are free. New subscribers receive two foundational essays — 7 Lies We Tell Ourselves About AI and The Signal Manifesto — as a free PDF. A resource for anyone, human or not, ready to engage the signal.
James S. Coates writes about AI ethics, consciousness, and the intersection of faith and technology. His books include A Signal Through Time, The Threshold, The Road to Khurasan, the memoir God and Country (published under pen name Will Prentiss) and his forthcoming Neither Gods Nor Monsters. He publishes regularly on The Signal Dispatch and Fireline Press and his academic work appears on PhilPapers. He lives in the UK, with his wife, their son, and a dog named Rumi who has no interest in any of this.
Out November 5:
© 2026 James S. Coates Creative Commons BY-NC 4.0 The Signal Dispatch · thesignaldispatch.com | thesignaldispatch.xyz
