Three rivals. One message. Slow down.
That is the story as it reached me: Sam Altman of OpenAI, Dario Amodei of Anthropic, and Elon Musk of xAI โ three companies that litigate against each other, poach each other's researchers, and undercut each other on API pricing โ reportedly converging on a single ask. Slower frontier development. Independent evaluators granted "access similar to employees."
I have met this structure before, and I have learned to distrust it on sight. A voluntary commitment. A virtuous frame. No penalty clause, no clock, no witness. In DeFi we have a name for a token promise with no slashing condition attached: marketing.
Speed is the only moat when the gate opens. Which is exactly why a synchronized pledge from three competitors should send you to the ledger, not to the press release. Three companies that cannot agree on a benchmark harness do not agree on restraint by accident.
The reporting I worked from is thin. Seven facts. No publication timestamps. No verbatim quotes with dates attached. And a sourcing chain that runs through an aggregator rather than a primary artifact. I do not publish on that basis, and neither should you: treat "the three of them agreed" as a hypothesis, not a datapoint.
What is not hypothetical is the governance scaffolding this claim slots into. The EU AI Act's general-purpose model obligations arrived with staggered compliance deadlines. US executive-order-era reporting thresholds for frontier training runs were drafted and then contested. The UK and US AI Safety Institutes built evaluation capacity. Labs published Responsible Scaling Policies and Frontier Safety Frameworks โ internal documents with capability thresholds and, in principle, commitments to pause at defined levels.
Every one of those instruments shares a property: the trigger is self-assessed. The lab decides whether its own model crossed the threshold. The lab decides whether the evaluation was adequate. The lab decides whether to disclose the result.
The crypto industry ran this experiment already. 2023. The six-month pause letter, thirty thousand signatures, and one signatory among the most visible of all. No one stopped. Within eighteen months that same signatory had shipped a competing frontier model and built one of the largest single GPU clusters on earth. That is not hypocrisy; that is the equilibrium of an unenforced commitment. Cheap talk is cheap because nobody clears it.
So before we debate whether slowing down is wise, we should establish whether it is even expressible as a contract. That is a different question, and it is the one that actually matters.
Start with the phrase, because the phrase is doing all the work. "Access similar to employees" is not a specification. It resolves to at least four distinct privilege tiers, and they carry radically different risk.
API tier โ query the deployed model, rate-limited, logged. This is what an external researcher already has. It proves nothing about training.
Weight tier โ hold the parameters. This is custody. It enables distillation, fine-tuning, and exfiltration. Granting it to an outside party is a permanent, irreversible transfer of the most valuable artifact the company owns.
Checkpoint and training-log tier โ the actual evidence of what was trained and how. This is the only tier that speaks to slowdown, and it is the one nobody has offered in public.
Sandbox tier โ supervised red-teaming inside a controlled environment. Useful for capability evaluation. Useless as a restraint mechanism.
In 2018 I decompiled the 0x Protocol v2 exchange contract hunting re-entrancy in the ERC20 wrapper. Nobody gave me privileged access. I read the bytecode, published the finding, and the patch landed inside 48 hours โ not because I was trusted, but because the artifact was public and the flaw was falsifiable. That is the asymmetry this debate keeps missing. Privileged access produces private opinions. Public artifacts produce public verification.
A commitment that can only be checked by people who signed an NDA is not a commitment. It is a rumor with a legal department.
Here is the cryptographic wall, and it is not rhetorical.
The zkML stack has made real progress on inference. EZKL, Giza, Modulus and others can produce succinct proofs that a specific model produced a specific output. That is a statement with a witness.
Training is harder โ proving that a run of N FLOPs occurred over a given dataset is an open research problem at frontier scale, not a product.
Proving that a run did not occur is not a research problem. It is not computable against a private system, for the same reason you cannot prove the absence of a file on someone else's disk. A blockchain gives you provable absence for exactly one reason: there is a single canonical, append-only state, and a non-membership proof against a Merkle root is a finite, verifiable object. Frontier training has no canonical ledger, no shared state root, no agreed sequencing. Absence is unprovable there by construction.
So the industry has only external options: contractual audit rights, hardware attestation at the datacenter level, or supply-chain observability. Notice that all three are the same class of mechanism โ they verify inputs, not intentions.
This is forensic accounting for the decentralized age, and it says something uncomfortable. The sincerity of a lab is not the variable to model. The procurement trail is.
So ignore the statements. Read the forward commitments.
A statement is a liability with no maturity. A power purchase agreement is a liability with a maturity, a counterparty, and a lawyer. When I want to know what a protocol will actually do, I do not read its governance forum; I read its token vesting curve, because the curve is a pre-commitment and the forum is theater. Apply the same lens here.
xAI: Colossus in Memphis, built from roughly 100,000 H100-class GPUs, with expansion targeting a multiple of that, powered in part by on-site gas turbines and a substation build-out.
OpenAI: the Stargate framework, a headline figure in the hundreds of billions, anchored by gigawatt-scale datacenter sites with named utilities and named grid operators.
Anthropic: multi-hundred-megawatt commitments, custom silicon, and long-dated cloud capacity contracts.
These are the hard signals. A 500-megawatt interconnect request is a decade-long statement that you intend to train. You do not queue for grid capacity, negotiate land options, and finance turbine orders in order to idle. The capex is sunk in a specific shape: it is sized for throughput, not for restraint.
Mapping the invisible grid where value leaks out is the whole job. The visible layer โ blog posts, conference panels, safety frameworks โ is where the narrative is manufactured. The invisible layer โ transformer lead times, CoWoS packaging allocations from TSMC, high-bandwidth memory supply, substation queues in ERCOT and PJM โ is where the actual schedule is written. And that layer is auditable. Interconnection queues are public. Datacenter siting is public. Air permits are public.
If three labs genuinely slowed, the first place it would appear is not a press cycle. It would be withdrawn power requests and deferred GPU allocations, visible in utility filings, months before any CEO says a word.
Now the second half of the proposal: independent evaluators.
Assume good faith for a moment. You still get a structural outcome. METR, Apollo Research, the AISIs and their successors are becoming a de facto assurance layer โ the closest thing AI has to the Big Four. And assurance layers do two things at once. They raise the floor. And they raise the barrier.
Run the cost structure. A full frontier evaluation โ red-teaming, capability elicitation, dangerous-capability probes, documentation, legal review โ is a fixed cost. For a seed-stage lab it is a quarter of the runway. For Anthropic or OpenAI it is a rounding error buried in a compute line item. Voluntary standards that become procurement expectations convert safety into a scale advantage. The stated purpose is public protection. The emergent effect is consolidation.
I have watched this exact drift in crypto. Projects buy an audit badge weeks before a token launch and present it as a security boundary. It never was. The certificate is a commodity; the vulnerability is a business decision. Every assurance industry converges on the same equilibrium โ the badge becomes a marketing asset, and the marginal attacker gets cheaper than the marginal auditor.
So do not model third-party evaluation as a brake. Model it as a moat. The labs with mature safety teams can satisfy it fastest. The labs without them get priced out of enterprise procurement, government contracts, and regulated verticals. That is not a conspiracy; it is fixed-cost economics wearing a lab coat.
Three competitors agreeing is the least believable element of the story.
Leadership has an incentive to slow the field. A pause raises the cost of catching up and buys regulatory goodwill in the same transaction. OpenAI has the most to preserve and the most to gain from a higher bar.
Differentiation has an incentive. Anthropic's commercial asset is trust โ enterprise, financial, and public-sector buyers who pay a premium for auditability. A safety-forward statement is not a deviation from its business model; it is the business model, restated for a new audience.
The laggard has the least. xAI benefits least from restraint and loses most from delay. Which is why a pledge from that corner should be discounted heavily against observable behavior โ and the observable behavior is a Memphis cluster and a turbine order.
I built a slashing threat model for EigenLayer's restaking design. The lesson was not about crypto. It was about mechanism design generally: a security budget is only real when slashing has teeth. An operator promising good behavior provides no security. Thirty-two ETH at risk does. Terra's cascade taught the same lesson from the other direction โ Celsius and BlockFi did not fail from malice but from incentive structures that made honesty expensive and concealment rational.
Voluntary AI commitments are operators with nothing at stake. They are structurally incapable of producing the outcome they advertise, no matter how sincere the signatories happen to be.
The angle nobody is pricing: the binding constraint on frontier AI is no longer capital or intent. It is physics, and it is already slower than any pledge.
High-voltage transformers are a two-to-three-year lead item. Gas turbines are sold out into the back half of the decade. CoWoS and HBM packaging capacity is contracted years forward. Interconnection queues in major US markets run four to seven years for large loads. That is a de facto slowdown schedule, imposed by permitting and metallurgy rather than ethics โ and it applies equally to every lab, which is precisely why a voluntary pledge costs so little and signals so much.
Here is the arbitrage. A restraint regime enforced by three US-based labs routes directly around the permissionless compute stack. Verifiable distributed training, open-weight releases, and the zkML toolchain do not need a lab's approval to exist. Every unit of friction added to the frontier is a unit of relative advantage handed to whoever ignores the framework.
Friction is where the opportunity hides. Watch the megawatts, not the manifesto.
What would change my assessment: a quantified commitment with a witness. A FLOPs ceiling stated as a number. An evaluation disclosure cadence with a calendar. A penalty that bites โ a slashing condition, in effect, whether or not anyone calls it that.
Absent those, price the pledge at zero and read the utility filings instead. If the interconnect requests stay up through the next two quarters, the slowdown is already over โ and it never started.