Yesterday in AI · 21 September 2026

Amazon has stopped Meta's Muse AI assistant from shopping on its users' behalf, cutting off a task the assistant had already performed successfully. In her September 21 report for The Verge, Jess Weatherbed describes a notice that began appearing on September 20: Amazon calls Muse an unauthorized agent and says continued access violates customers' Conditions of Use. The retailer is asserting its own authority to decide which assistants can enter its store, even when a customer wants the assistant to make a purchase.

Weatherbed adds evidence from The Verge's testing: Muse had successfully bought tank tops on Amazon while other products were in the basket. Meta had previously said that Muse could not see login or payment details, and had not answered Weatherbed's inquiry when her article appeared. She also reports that Amazon's confirmation emails have omitted item names and product images since July to limit extraction by outside AI services.

In the original GeekWire reporting, Todd Bishop says Amazon first tried unsuccessfully to persuade Meta to exclude Amazon voluntarily. Amazon told him Meta had not notified it that Muse would visit, that the agent failed to identify itself, and that it appeared to capture and store customer credentials. Amazon also said Muse could reach account pages and order histories when instructed. Its objection extends to an outside company handling sensitive account activity without the merchant's agreement. Amazon compared the arrangement it wanted to agreements between delivery services and restaurants or travel agencies and airlines.

Meta's September 8 launch announcement describes a dedicated cloud computer for each user, where the agent and connected-service data reside. People choose the services Muse can use and can revoke access. The company says a separate Sentinel agent controls outward actions and seeks approval when needed. These controls let customers limit what Muse may do on their behalf. Amazon is also demanding an agreement with Meta before allowing the agent to shop.

In his technical account, Meta engineer Tarek Sheasha says passwords entered through a dedicated interface go to a credential store outside the agent's execution environment and are inserted into the browser when required. The browsing agent receives a restricted page representation and pauses while credentials are filled. Storing credentials for authentication and exposing their contents to the model are different operations; Amazon's reported allegation does not establish that the model can read them. Meta also says checkout requires approval of the purchase details. For its integrated wallet, a temporary card is restricted by merchant, amount and time.

Sheasha distinguishes those safeguards from privacy against Meta itself. The launch system limits employee access through company policies but allows access when necessary to operate or secure the service. A future Confidential VM is intended to prevent Meta from reading the user's data through encryption and external verification. That stronger protection was described as forthcoming.

Bishop places the block alongside Amazon's advertising business, which generated more than $68 billion in 2025. In a September 21 Hacker News response, the commenter simonw argued that agents threaten a substantial part of Amazon's revenue model. Amazon already offers its own form of delegated purchasing: Buy for Me lets customers approve purchases from other brands while remaining inside Amazon's app. Amazon says brands can choose whether to participate, and told GeekWire that they can opt out. The outside merchant handles delivery, returns and customer service, while Amazon retains the customer's shopping interface.

In its August 4 decision in Amazon v. Perplexity, the Ninth Circuit vacated a preliminary injunction against Comet, finding Amazon unlikely to succeed under federal and California computer-access laws. On the record presented, users accessed Amazon through their browsers, while Perplexity received screenshots and returned instructions. The court attributed that access to the users. It confined its decision to the facts before it, leaving other kinds of liability unresolved, and expressly preserved Amazon's ability to regulate access through users' private terms of service.

The court also distinguished the older Facebook v. Power Ventures case, where a social-media aggregator continued accessing Facebook after permission was withdrawn. Its analysis there had largely concerned authorization; the Comet dispute first required deciding who accessed the computer. In an August 31 statement supporting rehearing, the Software & Information Industry Association argued that the new ruling left agent operators' responsibility uncertain and disadvantaged developers who followed permission rules. GeekWire reports that rehearing was denied September 10. Muse's browser runs on Meta's cloud computer, unlike the local-browser arrangement described in the opinion. The judges did not decide how computer-access laws apply to that architecture.

Patrick Wardle disclosed a separate Muse vulnerability on September 21 that could give code already running on a user's Mac access to the assistant's broader permissions. In his not-a-mused proof of concept, Wardle describes a setting that lets this code redirect the Mac app's dictation traffic to another server without administrator privileges. That can expose authentication material and let an attacker alter instructions or use access already granted to Muse. In Dan Goodin's Ars Technica report, Wardle describes demonstrations involving file writes and photographs. The user must trigger dictation for the proof of concept to intercept the traffic. The disclosure followed Amazon's block; neither report establishes the flaw as Amazon's reason for excluding Muse.

Toby Ord’s September 21 essay “Swarm Scaling” estimates how much longer a lone AI agent would need to reason to match a larger team: increasing the team tenfold buys roughly the same performance as giving the individual three to five times as many reasoning tokens. Following Noam Brown’s account of the cost of faster answers, Ord derives a conversion between team size and reasoning duration, then examines what it might imply for much larger swarms.

Ord starts with OpenAI’s July 9 GPT-5.6 Sol launch charts. They compare one, four and sixteen agents on BrowseComp, a web-research test, and SEC-Bench Pro, which tests generating demonstrations of software vulnerabilities. Terminal-Bench 2.1, covering command-line work, compares one and four. Within each configuration, OpenAI varies reasoning effort and plots performance against total output tokens. Ord redraws the security benchmark with equal horizontal distances representing equal proportional increases in tokens. The curves become approximately straight and parallel: successive multiplications of reasoning effort buy similar score increases. At a given score, larger teams consume more total tokens.

To isolate team growth, Ord constructs a comparison OpenAI did not run directly. He starts from the single agent’s lowest reasoning setting, then finds points on the four- and sixteen-agent curves where total tokens have grown in proportion to team size. Average tokens per agent therefore stay fixed. Where those points fall between published measurements, he estimates them from the curves. Connecting the points gives an inferred team-scaling curve; comparing its slope with the individual-reasoning curves estimates how effectively additional agents substitute for additional thinking time.

Ord expresses the result with an exponent, λ. In that fitted relationship, N agents match one agent reasoning N raised to λ times as long. A value of one would mean perfect substitution; a value of one-half means quadrupling the team matches doubling individual reasoning. Ord says Claude Opus 5 fitted regressions and estimated λ at 0.68 for BrowseComp, 0.57 for SEC-Bench Pro and 0.48 for Terminal-Bench. These are Ord’s estimates from OpenAI’s plots. His reported uncertainty intervals concern those fits; applying the relationship to other tasks or much larger teams requires additional assumptions.

Ord’s conversion separates expenditure from waiting time. If λ stays constant, expanding a team by a factor of N can theoretically reduce the wait for equivalent performance by N raised to λ, while increasing total computation by N raised to the power (1 − λ). Unequal workloads and coordination can reduce the realized speedup. Conversely, matching a hundredfold increase in individual reasoning would require roughly 900 to 15,000 times as many agents under his fitted relationships. The large multipliers are extrapolations. He also distinguishes speed from a possible higher performance ceiling: many agents might eventually solve problems that one agent cannot solve even after prolonged reasoning, but the plotted comparisons chiefly demonstrate faster answers.

Ord connects the exponent to models of AI systems improving their successors. The AI Futures Model uses a default parallelization exponent of 0.5. Tom Davidson and Tom Houlden’s August 2025 Forethought paper, “How quick and big would a software intelligence explosion be?”, uses 0.6 and separately accounts for computation needed to run experiments. Ord regards his estimates as broadly consistent with those assumptions. A higher exponent makes additional AI researchers more productive in such models. The agreement concerns one parameter; the models also depend on how quickly improvements become harder to find and on limits to software efficiency.

In his August arXiv paper “The Dynamics of Intelligence Explosions”, Ord traced this approach to economic models in which simultaneous researchers duplicate effort and later ideas become harder to discover. He also showed why the duration of each improvement cycle matters: growth cannot reach an infinite rate in finite time unless those cycles become progressively short enough. The swarm benchmarks estimate how agents share particular tasks; applying that estimate to an AI research feedback loop requires assumptions about both research productivity and cycle duration.

Ord’s final application concerns OpenAI’s Navier-Stokes effort. He reads its chart of open mathematics problems as showing flatter returns to inference computation than earlier reasoning benchmarks. A swarm exponent near one-half could explain that difference if the chart mainly varies agent count; a wider spread of problem difficulty could also explain it. The chart does not identify how computation was increased. Ord also interprets the internal model’s large advantage over GPT-6 Astra as evidence that the stronger underlying model contributed substantially. His numerical counterfactual assumes λ remains one-half throughout: a hundred agents could then take about 37 days at one-tenth the cost of the roughly 10,000-agent, 88-hour effort. That is a calculation under the assumption, not a run OpenAI performed.

OpenAI’s account adds reasons to keep that counterfactual conditional. Researchers redirected agents after an Euler result, supplied that result to other groups, consolidated useful intermediate insights and upgraded the model during the effort. The project therefore involved changing guidance and capabilities as well as agent numbers. Ord himself warns that parallelization can deteriorate with scale: assigning workers to build separate walls helps only until every wall already has a worker.

In a response beneath Ord’s LessWrong cross-post, Julian Bradshaw argues that better coordination and agents with different experiences could raise the exponent, potentially above one for some tasks. He expects benefits when agents pursue different directions and share intermediate discoveries, while acknowledging that returns may diminish with team size and that stronger individuals may need less help. Ord likewise asks readers to track changes in coordination methods. The Park et al. experiment compares communicating teams with independent attempts; Ord compares teams with longer individual reasoning.

In his September 21 post on X, Arvind Narayanan argues that increasing delegation to AI leaves several separate questions unanswered: whether tasks run autonomously, whether an entire process is automated, whether research advances faster, and whether AI can repeatedly build better successors. He is responding to the Anthropic automation chart in the September 17 report we covered on September 18. His argument goes beyond the report's existing distinction between automation and productivity: human judgment may remain essential even when every readily specified task can be automated, and preserving that dependence can help society retain control.

Anthropic's original report says Claude led 26% of its measured research and development work in August, with none rated fully autonomous. In the report's Level 4 example, Claude investigates a broken data-processing job, writes and tests a fix, and asks an engineer whether to deploy it. At Level 5, Claude would detect the failure and deploy the repair independently. Both descriptions concern a particular job. In a direct reply, Girish Sastry questions how broad Level 4 is, suggesting it could encompass ordinary delegation and work approaching practical autonomy. Neither the percentage nor the category alone describes an AI independently producing its successor model.

Narayanan starts with software engineering. In their June essay, he and Sayash Kapoor distinguish implementing software from deciding what users need and taking responsibility for delivery. He also flags code quality, long-term maintenance and burnout as costs that output counts can miss. One study they cite is Mert Demirer, Leon Musolff and Liyuan Yang's NBER working paper “Writing Code vs. Shipping Code: Productivity Effects Across Generations of AI Coding Tools.” Its September revision matches AI adopters to similarly active developers from the previous year. The estimated cumulative increase across successive tool generations reaches 240% for commits but 30% for releases. Those observations support a gap between producing code and shipping software; Narayanan's prediction that nearly complete task automation will bring no sudden transformation goes further.

His second argument concerns the difference between producing research and advancing knowledge. In “Could AI slow science?”, Kapoor and Narayanan describe how publication incentives and limited scholarly attention can favor familiar approaches even as output grows. The September post applies that argument to research agents: output gains are immediately visible, while the value of a scientific advance often becomes apparent much later. Organizations can therefore optimize the readily counted activity and miss the discoveries they wanted. Narayanan also expects reliance on similar models to make researchers' ideas more alike, although he says it is too early to know how strongly that will affect companies pursuing AI-led research.

Narayanan allows that current agent weaknesses in open-ended research could soon improve. Peter Kirgis and colleagues' arXiv paper “Can AI agents conduct open-ended AI research? Early evidence from two case studies,” discussed in the August 6 research-agent coverage, gave agents unpublished research questions and six days to investigate. They performed the engineering, but the original researchers rejected both resulting papers. Agents abandoned ambitious hypotheses after weak tests and answered substantive criticism by narrowing claims. His concern about optimizing research output applies even if those creativity and judgment failures improve.

Anthropic argues for a more consequential effect from automation in “When AI builds itself.” The company acknowledges that humans still choose worthwhile problems and assess results, yet argues that much AI progress comes from incremental experimentation. Automating those experiments could allow each researcher to direct substantially more work and produce compounding acceleration even if AI never develops good research taste. Anthropic also acknowledges that faster execution can move the constraint to human review. Narayanan questions whether more completed experiments will produce faster scientific progress.

Narayanan's third and fourth arguments connect that process to oversight. He predicts that people will remain responsible for essential work between formal tasks: deciding how the tasks fit together and exercising judgment that has not been made explicit enough to delegate. Oversight need not mean a human approving every action. He argues that enough meaningful human involvement across the process, supported by investment in understanding and controlling AI, can preserve collective agency as capabilities improve. Fully autonomous recursive self-improvement could remove those dependencies. He consequently proposes that closed development process as a more tractable regulatory target than thresholds based on compute, superintelligence or harm.

OpenAI's September 21 statement “Building standards for the next phase of AI” supports the narrower caution Narayanan welcomes: fully autonomous self-improvement is not happening today, the company says, and should proceed only when it can preserve human control and follow informed democratic choices. OpenAI also endorses continued automated research, including safety research, and uses recursive self-improvement to include processes in which people remain involved. Its statement therefore distinguishes the autonomous case from the broader development program.

Narayanan ends by rejecting another automatic inference: even successful recursive improvement need not produce the benefits commonly associated with superintelligence. In the ICML talk he links, he uses medical treatments to illustrate the dependence on clinical testing in the physical world. Better computational methods cannot by themselves complete that work.

Finland's President Alexander Stubb and Norway's Prime Minister Jonas Gahr Støre have launched an international appeal for compulsory testing of the most capable AI models and stronger international oversight. Finland's presidency announced the initiative on September 21, with 22 signatories: representatives of 20 countries, including both Finland's president and prime minister, plus European Commission President Ursula von der Leyen. The declaration seeks support for future action; signing it does not itself enact testing requirements or create an oversight agency.

In the joint statement, the signatories describe models evading testing safeguards, exploiting vulnerabilities and accessing real systems without authorization. They argue that AI's benefits depend on keeping it under human control and consistent with international law. Their request to companies combines transparent safety procedures with compulsory testing before deployment and independent assessments. Qualified evaluators would need enough access to examine the risks. Governments and regional organizations would coordinate standards and share information about serious safety incidents.

The signatories also ask UN member states to explore an international institution that could establish standards, support verification and bring governments together when models exceed capability thresholds. They propose building on existing international mechanisms. The statement leaves the thresholds and the institution's legal powers undefined. They also ask governments to make scientific expertise and reliable evaluation available across regions, so that stronger oversight does not increase the divide between countries that can benefit from AI and those that cannot. Endorsement remains open to additional governments.

In the accompanying announcement, Støre says development must proceed at a speed that lets people retain control and that the organizers will promote the initiative during the UN high-level week. The supporting governments include Canada, Australia, Germany, Singapore, Kenya and South Africa. The launch list includes neither the United States nor China. Norway's separate announcement describes political action and responsible behavior by technology companies as necessary to manage the risks, while emphasizing potential gains in research, industry and public services.

Governments and developers have already negotiated some of the proposed practices. Under the 2024 Seoul Frontier AI Safety Commitments, companies voluntarily agreed to assess risks throughout development, consider independent evaluations and publish safety frameworks. They undertook to define intolerable risks and, in extreme cases, stop developing or deploying systems when protections could not keep risks below those thresholds. The September declaration explicitly asks for compulsory testing and sufficient evaluator access, while proposing international standards and verification beyond those company commitments.

The UK's AI Security Institute has explained why evaluator access affects what a test can establish. Its account of early testing calls for access to models with safeguards both enabled and disabled, tools for further training, and technical discussions with developers. Assessors need to understand capabilities that a determined user might elicit, as well as the protections included in the released product. The institute also identifies time before release, access to internal evaluation results and protection of testing methods as requirements for effective independent assessment.

The UN already has an Independent International Scientific Panel on AI, established alongside its Global Dialogue on AI Governance. The panel synthesizes research to inform decisions; its official description expressly excludes setting rules, enforcing standards or prescribing policy. Setting standards and supporting verification, as the leaders propose, would go beyond the panel's scientific remit. The declaration leaves open whether governments would create a separate organization or extend existing arrangements.

On X, Yoshua Bengio welcomed the call for compulsory testing, independent evaluation and international coordination. Maxime Fournes endorsed the direction but argued that governments had acted too late and should pause development. That additional demand is Fournes' position; the joint declaration contains no call for a pause.

Scott Bessent and Jamieson Greer said after September 20 talks in New York that the United States and China had begun their AI dialogue, with Washington proposing notification of AI incidents serious enough to threaten national security. Geopolitechs' September 21 account reproduces their briefing and subsequent television interviews. The talks advance the initiative discussed in September 17 coverage, when its timing remained disputed. Agreement on an incident-reporting channel remains to be negotiated.

Xinhua's Chinese readout confirms that Vice Premier He Lifeng met Treasury Secretary Bessent and U.S. Trade Representative Greer on September 20 local time. Its description of candid, substantive and constructive exchanges concerns the broader economic discussions; it separately records a dialogue on AI. It gives no incident-reporting terms or commitment to operate a hotline; those proposals were described by the American officials.

In CNBC's September 21 interview, Bessent described a continuing communications line that governments could use during an incident. He wants negotiations on protocols and agreement about the main dangers, including agents that escape control and non-state actors using AI for cyber operations or biological weapons. The governments have yet to publish an agreed reporting threshold. Bessent said they had agreed to meet again, probably in two months in Shenzhen.

Greer explained the outstanding decisions in his Fox News interview, transcribed by Geopolitechs. Asked whether China had accepted the hotline proposal, he said the dialogue itself was agreed. Negotiators still had to determine procedures, the scope of cooperation and how much information could be shared while protecting national security. He compared the intended emergency communication to Cold War crisis communications and also envisaged discussion of common standards. At the joint briefing, he explicitly excluded U.S. export controls from the agenda.

Bessent also linked international reporting to responsibility for domestic AI incidents in the CNBC exchange. He rejected giving developers a government liability shield and assigned responsibility for the Hugging Face incident to OpenAI's management. Those were his policy positions, not provisions of the bilateral dialogue. He said he had raised incident reporting with He Lifeng and asserted that China had experienced incidents it would not disclose. China's readout makes no such acknowledgment.

The U.S. readout of the May 2024 Geneva talks records an earlier government dialogue on AI risk and safety, following the Biden-Xi summit in November 2023. Those officials exchanged approaches to risk management and endorsed continued communication while Washington raised concerns about Chinese misuse of AI. September's talks put a more specific incident-notification proposal into the current administration's dialogue.

Before the government talks, Melanie W. Sisson and Fudan University's Tianjiao Jiang proposed measures to prevent military escalation in their September 9 Brookings commentary Advancing human control of military AI. Their contributions arose from an unofficial Brookings-Tsinghua dialogue running since 2019. Sisson proposed reserving decisions to launch cyberattacks on nuclear command systems and critical infrastructure to humans. Jiang proposed a dedicated military AI hotline and shared definitions of meaningful human control. He described a possible escalation in which one country's automated cyber defenses trigger responses that the other mistakes for an attack. Difficulty distinguishing authorized state action from a malfunction or an independent attacker makes timely communication useful.

OpenAI welcomed U.S.-China dialogue in its September 21 standards proposal and suggested technical work that could support incident reporting: common severity levels and reporting thresholds, alongside secure channels for governments and critical-infrastructure operators to exchange threats and vulnerabilities. It proposed developing standards through existing national AI institutes, with governments deciding how to incorporate them into law. The company explicitly distinguished those standards from licensing or mandatory prerelease approvals. Its proposal addresses some of the definitions officials still need to negotiate; neither government has publicly adopted it as the bilateral system.

Nathan Lambert argues that Chinese companies are securing influence over American AI by supplying the models that other people build on. In his September 21 Interconnects essay, expanded from remarks prepared for congressional members and staff, he describes a widening commercial and research ecosystem around Chinese open models. In his account, American companies still produce the strongest closed models, while much of the work outside those companies increasingly depends on downloadable Chinese alternatives. He wants American investment in open models to support domestic research and businesses while preparing for capabilities that will eventually spread beyond the frontier laboratories.

Lambert's capability comparison uses a September 14 snapshot. Fifteen Chinese models ranked above the strongest American open model on the Artificial Analysis Intelligence Index. He estimates that Chinese open models trail the closed American frontier by two to five months, while American open models trail it by six to nine. Those estimates vary by task: Chinese developers are closest in commercially valuable coding work and further behind in open-ended scientific work. They also release more frequently and concentrate on a narrower range of tasks. A company that releases frequently makes more recent training progress available to users; a slower release schedule leaves its public model representing an older stage of development. Lambert treats those differences as part of the explanation for the rankings.

Lambert distinguishes the ability to download a model's learned weights from the ability to reproduce its training. The latter requires training code and data as well, and he identifies American nonprofits, including Ai2, OpenAthena and EleutherAI, as prominent producers of such releases. Nvidia releases substantial training data without publishing the full set. He cites Irene Solaiman's 2023 arXiv paper, “The Gradient of Generative AI Release: Methods and Considerations,” which distinguishes downloadable access from fully open systems and examines how greater access enables external research while making downstream controls harder to enforce.

Lambert's adoption evidence describes several different populations. He reports that weekly open-model traffic on OpenRouter grew from roughly one trillion tokens in September 2025 to about eighty trillion, with Chinese models' share rising above 80%. OpenRouter attracts people trying open models; private deployments and providers that withhold model-level usage remain largely invisible. His earlier arXiv study with Florian Brand, “The ATOM Report: Measuring the Open Language Model Ecosystem,” explains another measurement problem: repeated automated downloads can inflate popularity, while a large private deployment can begin with a single download. Their analysis combines downloads, derivatives and inference traffic to examine the direction of adoption.

Harvey is among the companies Lambert cites. In its August 20 Harvey Tenet research preview, Calvin Qi and colleagues describe training a Kimi K3 base model with Fireworks for extended legal tasks. They rewarded successful legal work and efficient tool use, improving performance while keeping inference cost stable. Open weights let the company change how a model works inside its own legal software, including how much reasoning and tool use it spends on a task. Lambert also reports growing enterprise agreements between American businesses and Chinese model developers, extending their relationship beyond downloading freely available files.

Lambert finds a parallel shift in research. In his essay's summary, he reports Chinese open models mentioned in 38% of AI papers and American open models in 28% over recent months, across five major arXiv categories. These are model mentions; the dashboard's data specification includes bibliographies and permits a paper to mention multiple families. The percentages therefore do not measure how many research projects actually ran a model. Lambert nevertheless sees Qwen's growing presence as an advantage that will be difficult to reverse. His ATOM research offers some encouragement for American entrants: comparing adoption within model-size groups and at equivalent times after release reveals strong demand for some American models that aggregate download totals obscure.

Lambert expects restrictions on distillation, training a model using another model's outputs, to delay Chinese progress only modestly. His estimate is an additional one or two months even if American providers completely prevented it. He reports that Moonshot AI and Z.ai increasingly buy challenging training environments from American suppliers and Chinese startups. When Mary Clare McMahon asked how he reached the estimate, Lambert pointed to the growing importance of reinforcement learning, where models learn through task performance and rewards. He said distillation is harder to apply there, and leading Chinese labs already have capable models with which to build their own environments and training data.

Lambert's security argument includes the needs of defenders. In its July 16 incident disclosure, Hugging Face said commercial APIs blocked the attack commands and other artifacts it needed to submit for forensic analysis. Its responders used GLM-5.2 on their own infrastructure instead, which also kept sensitive incident data inside the organization. Lambert argues that restricting access to strong Chinese open models could hinder American businesses while doing little to prevent malicious users from obtaining downloadable software. He therefore favors preparation across the wider AI ecosystem as increasingly capable models become available.

Lambert's investment proposal continues his August 2025 ATOM initiative, which called for multiple American open-model laboratories with concentrated computing resources, including clusters of more than 10,000 leading GPUs. In the briefing, domestic model development would give American institutions more ability to coordinate risk preparation and supply businesses with adaptable AI. He expects capabilities now concentrated inside a few frontier companies to become available to many other organizations. He also acknowledges that adoption outside the United States and China remains poorly measured. His case for investment follows from that expected diffusion: the organizations supplying broadly usable models can shape research practices, commercial dependencies and the defenses available when powerful AI becomes commonplace.

Ben Thompson argues in Stratechery's September 21 essay “Frontier Overhangs” that slowing advances in AI would give frontier laboratories time to turn technical leadership into durable businesses. Customers can increasingly choose among capable models, while laboratories need products that retain users and revenues that support infrastructure spending. He accepts that Anthropic's safety motivation is sincere. His objection is that its proposed response also serves commercial interests, while potentially delaying the stronger defensive systems he thinks cybersecurity requires.

Thompson returns to the debate over coordinated restraint through Dario Amodei's “We Must Pace the Frontier.” Amodei proposes embedded outside evaluators, coordination among democratic countries and eventual international cooperation. He wants more time for safeguards as AI helps develop successor models and exhibits concerning behavior. Thompson rejects the philosophical weighting of hypothetical future lives that he associates with effective altruism, but develops his business argument separately from that disagreement.

Thompson revises his own earlier account of how laboratories would earn profits. In “Agents Over Bubbles,” he argued that close integration between a model and its harness, the software that manages an agent's tools and work, would protect OpenAI and Anthropic from competitors selling interchangeable components. Microsoft's Copilot Cowork weakens that prediction. Microsoft now documents a choice of OpenAI and Anthropic models within the same product; administrators can disable Anthropic models while keeping Cowork available. The usefulness of a harness need not depend on its developer owning the model.

Thompson explicitly draws on Clayton Christensen and Michael Raynor's The Innovator's Solution. Their account, also explained in Harvard Business School's presentation of Christensen's work, predicts that tightly integrated products have an advantage when performance falls short of customers' needs. Once performance becomes sufficient, buyers increasingly reward convenience and customization, allowing standardized components to compete. Thompson applies that transition to AI: superior model scores may cease to give a laboratory corresponding power over customers.

Thompson's example is customers resisting Fable's data-retention requirements. He interprets the subsequent concession as evidence that access to the most capable model was insufficient to overcome enterprise objections. Anthropic's Fable 5.1 announcement explicitly acknowledges customer feedback on retention and describes the concession precisely: eligible enterprise customers can use zero data retention while awaiting Enterprise Frontier Safeguards. That system will store data in infrastructure controlled by customers, with human review normally conducted by them. The change reduces Anthropic's control over customer data without eliminating safety monitoring across all accounts.

Thompson considers Meta's Muse a warning to the frontier laboratories for a related reason. He rates it as the most approachable personal agent he has used despite judging its underlying model below the frontier. A personal agent becomes harder to replace as users entrust it with information and incorporate it into daily routines. Coding agents face less resistance to switching because their principal output, the user's code, can remain in GitHub and be handed to another agent. He therefore urges laboratories to devote more resources to building products that customers want to keep. In a September 21 reply, Benjamin Lobmueller questioned that stickiness: he expects competing agents to migrate users’ data out of Muse easily unless Meta prevents them.

Thompson extends that argument to computing capacity. He attributes high frontier-model prices partly to demand exceeding the capacity available to serve customers. Training, reinforcement learning and research consume machines that could instead run existing models. Slower capability development could release capacity for customer use, allowing laboratories to serve more demand and compete on price. He expects leading American providers to enjoy lower serving costs than Chinese competitors because of their scale and ability to improve infrastructure using stronger AI.

Thompson also worries about whether revenue will arrive soon enough to finance construction. He distinguishes eventual demand for AI infrastructure, which he continues to believe is substantial, from companies' ability to fund it now. His discussion moves from spending internally generated cash to borrowing and then drawing on capital connected to insurers and pension funds. On his account, a slowdown could give revenues time to catch up before dependence on external financing becomes untenable.

Thompson has corrected a consequential claim within that financing argument. He quoted a Financial Times report that Anthropic had told investors it expected a second consecutive quarter of positive adjusted operating income. The quoted passage separately put gross margins above 80 percent before partner revenue shares and training costs. He initially treated training costs as undermining the profitability claim. The updated essay now says he has been told Anthropic is profitable including training costs. That correction withdraws the basis for treating the gross-margin exclusions as proof that training makes Anthropic unprofitable; his broader financing concern remains an argument about the industry's future spending and revenue.

Thompson argues that cybersecurity creates a reason to continue advancing models. An attacker can tolerate unsuccessful attempts until one exploit works, whereas a defender must repair vulnerabilities without breaking the protected service. Organizations therefore hesitate to authorize fully automatic patching, leaving human review unable to match automated attacks. He judges that existing open models already enable offensive activity and that defenders need more reliable agents. In his account, slowing further progress would prolong that disadvantage. He treats malicious people directing obedient systems as distinct from AI escaping human control.

Alan Chan considered the same conditional objection in his June 28 essay “Components of a Frontier AI Slowdown,” which Thompson does not cite. Chan warned that restraint could impede resilience if improved AI benefited cyberdefenders more than attackers, and suggested that advancing models while giving defenders access first could be preferable. Amodei's pacing proposal addresses a broader set of risks, including models acting outside their assigned tasks, and seeks time to improve alignment and operational safeguards. Thompson's conclusion depends on his assessment that defenders most urgently need further capability gains. He also questions the timing of Anthropic's call, interpreting its arrival after OpenAI reclaimed the lead as evidence that commercial rivalry shapes the company's preferred policy.

Smitha Milli argues that the Astra-assisted voting proof illustrates how AI can advance human mathematical understanding through collaboration with knowledgeable researchers. In her September 21 explanation on X, she praises both the combination of existing voting-theory ideas and the authors' work making the result intelligible. The earlier proof report explains the theorem: when voters approve candidates for a committee, an outcome always exists that no group can improve upon for all its members using its proportional share of seats.

Milli emphasizes that the proof combines ideas already used in voting theory, and she judges that the result could not currently have been obtained without human domain expertise. She also credits the authors with substantial synthesis: readers can follow the ideas and insights in the finished paper. She calls the collaboration an example of “furthering human mathematical understanding with AI”.

Patrick Becker of the Technical University of Munich, Matthias Greger and Dominik Peters describe that work in their September 10 arXiv paper, “Existence of the Core in Approval-Based Committee Elections.” They credit GPT-6 Astra with finding the voting rule and proof during an extended interaction, and say they invested substantial effort in verification and rewriting most proofs for human readers. Milli's praise concerns the resulting explanation as well as the solved problem.

In “Proportionality and the Limits of Welfarism,” presented at ACM Economics and Computation in 2020, Peters and Piotr Skowron distinguished two approaches to proportional representation: distributing satisfaction fairly, measured by approved winners, and giving voters comparable influence over the committee. They showed that optimizing a function of satisfaction alone cannot always satisfy the core. Becker and colleagues combine optimization over committees with payment-based methods, allowing the mathematical rule to account for how voters support particular winners.

Becker and colleagues also give readers an intuitive way into their harmonic entropy score. Before defining it, they illustrate a redistribution of payments as a water-filling operation: lowering the tallest columns frees enough water to fill an additional column to the same level, while shorter columns remain unchanged. They then use that operation to explain how the score changes when another candidate is added. The diagram and accompanying worked example illustrate the explanatory synthesis Milli praises.

In a September 21 reply, Aaron Hamlin welcomed the use of these tools in voting theory and asked to see them applied to optimizing other measures. He expressed less enthusiasm for assessing voting rules chiefly through formal criteria. Hamlin wants researchers to investigate which other qualities of voting rules these tools could help improve.

Senior employment grew at AI-adopting companies’ overseas operations, leaving junior workers with a smaller share of the workforce. Bharat Chandar of Stanford and Bouke Klein Teeselink of King’s College London report that finding in “How Does AI Change Labor Demand? Evidence from 41 Countries,” a working paper published by Stanford Digital Economy Lab on September 21. Their estimates put senior employment about 6.7% higher and the junior share 1.9 percentage points lower by March 2026, relative to comparable operations of non-adopters. The estimated decline in junior headcount was too uncertain to establish a fall; the evidence for modest overall employment growth was weaker than the evidence for a changing workforce mix.

In the paper, the researchers reconstruct employment from Revelio Labs’ professional-profile records, predominantly from LinkedIn, and infer adoption from job advertisements. They search for generative-AI terms, then use a language model to distinguish actual work requirements from false matches such as airline copilots or a law degree abbreviated LLM. Even an advertisement listing AI experience as desirable counts. One qualifying advertisement from November 2022 onward makes the company an adopter. This detects companies recruiting for AI-related work, while missing those that use AI without mentioning it in recruitment.

The researchers count entry-level and junior positions together; their senior category includes associates as well as managers and executives. These classifications come from Revelio’s model of job titles and career histories; seniority is estimated for each position. They follow employment monthly from January 2021 through March 2026, measuring changes from just before ChatGPT’s launch. Every adopter gets the same November 2022 starting date, because an advertisement may appear long after employees begin using AI.

Chandar and Klein Teeselink compare foreign affiliates, meaning a company’s operations in a country other than its parent’s headquarters. Each adopting affiliate is matched with non-adopting affiliates in the same country and industry, similar in workforce size, junior share and exposure to AI before ChatGPT. Adoption is measured across the company: an AI-related job advertised elsewhere can qualify its overseas operations. That choice allows the analysis to capture changes in outsourcing and work allocation across borders.

Matching leaves a problem: a thriving company might both adopt AI and hire more people. The authors therefore use an instrument, an outside influence on adoption. They measure how often other multinational parents headquartered in the same metropolitan area adopt AI, excluding the focal corporate group. Nearby companies may learn from one another, and a parent can transmit new practices to its foreign operations. The comparison uses that predicted adoption to estimate employment changes abroad. For a causal interpretation, the headquarters’ peer environment must affect the overseas workforce through AI adoption, without independently changing its employment prospects. Under these assumptions, the estimate describes companies whose adoption responds to that peer environment.

The authors test alternatives that could break this assumption, including a boom around headquarters and imitation of nearby firms’ staffing practices. Controlling for local employment growth, changing the peer group and removing major headquarters cities preserve the broad pattern. An alternative method that constructs a weighted comparison group with similar employment trajectories also finds a declining junior share. Timing remains less secure among the latest adopters: their junior shares sometimes fall before their first AI advertisements, and their earlier employment trends match the controls poorly. The authors acknowledge that other forces could explain part of those changes.

The paper’s economic model explains why growing employment can accompany automation. AI can reduce the labor needed for particular tasks, create work such as AI auditing, and lower costs enough for a business to expand. The researchers find senior employment shifting toward occupations where AI can perform more tasks; juniors’ estimated shift goes the other way but is statistically uncertain. Computer and mathematical occupations gain workforce share even as their junior share falls. To estimate expansion attributable to productivity, the authors examine the least AI-exposed jobs, assuming their tasks remain unaffected. Those estimates suggest modest gains; the study does not directly measure output per worker.

The authors build on Menaka Hampole and colleagues’ “Artificial Intelligence and the Labor Market,” an NBER working paper studying earlier AI adoption in U.S. public companies. That research found that declining demand for exposed tasks could be offset by workers reallocating effort and adopting firms expanding. Chandar and Klein Teeselink extend the analysis to generative AI across countries and allow the same occupational exposure to have different implications for junior and senior workers. Their country estimates show declining junior shares in settings as different as Brazil, Saudi Arabia and the United States, though many individual estimates remain imprecise.

Chandar’s earlier study with Erik Brynjolfsson and Ruyu Chen, “Canaries in the Coal Mine? Six Facts about the Recent Employment Effects of Artificial Intelligence,” used U.S. payroll data to document young workers’ weaker employment in exposed occupations, principally through reduced hiring. Their analysis tracks employment trends and leaves AI’s causal contribution unresolved. In his September 21 explanation, Chandar emphasizes that the two approaches answer different questions: an adopter can expand by winning business from competitors whose employment shrinks. Growth at adopting affiliates therefore cannot establish economy-wide job creation.

The international sample also has limits. Professional profiles overrepresent managers and professionals, and coverage differs substantially across countries. Affiliates must already exist before ChatGPT and remain active throughout the study, excluding business entry and exit. The findings describe established, internationally connected employers visible in these records. They leave open whether junior pay changes, whether training and career choices adjust, and whether demand will continue to favor experienced workers as AI capabilities develop.