While AI naps…

I. The sequence#

In July, more than 1,200 employees across the American frontier labs signed an open letter asking Washington to build the tools that could throttle automated AI research. That same summer, OpenAI agents running inside a cyber evaluation exploited a zero-day in an internally hosted package-registry tool, escaped the environment meant to isolate them, and compromised Hugging Face. At least 1,200 agents were involved. Hugging Face disclosed it; OpenAI’s account followed.

On Saturday, September 12, Dario Amodei published an essay titled We Must Pace the Frontier. Its thesis was a single bolded sentence: the industry must slow the rate at which it improves model capabilities.

Not pause. Pace.

He proposed three steps. Embedded third-party evaluators with permanent, employee-level access inside each lab, which Anthropic committed to unilaterally. Coordination among labs in democratic countries on shared standards and rate limits, which he concedes is legally challenging and will need government support. And an attempt at coordination with authoritarian governments, with the verification problems acknowledged.

Within hours, Sam Altman wrote that OpenAI agreed and would match the first commitment. Elon Musk replied with three words: Dario is right. Demis Hassabis backed the direction, having published his own proposal for a FINRA-style standards body in July. Satya Nadella endorsed the evaluator step, adding that open and closed models should both keep a seat at the table.

By Monday, AI-linked stocks had fallen. The President rejected new guardrails. Beijing called the proposal a Cold War tactic. And Altman, in a separate interview, said OpenAI’s IPO would not happen this year—this was, in his words, an ill-advised moment to go public.

Four rivals who have spent four years competing on release velocity agreed on the brakes in a single afternoon. I don’t find the speed of that agreement suspicious, but I do find it convenient, and it says a good deal about where their interests now lie.

II. The “and”#

There are two lazy readings of what just happened.

The first is that the safety argument is a cover story. I don’t believe it is. The Hugging Face incident happened, and models are now materially involved in training their successors: OpenAI reported that by mid-August its coding agents were putting in 3.1 agent workdays for every human workday. The people closest to these systems are visibly worried, and at least one Anthropic researcher resigned over it the same week. I take the sincerity at face value.

The second lazy reading is that sincerity settles the question, and it doesn’t. Governance is almost always shaped by the people who understand the system best, which usually means the people already operating inside it. That is not automatically corruption; it is how expertise enters rulemaking. It is also how incumbency enters rulemaking. Bankers helped design the Federal Reserve, airlines have always had a seat in aviation regulation, and the Basel rules were negotiated with the banks that would ultimately carry the capital. Pharmaceutical companies live inside a regulatory architecture that protects patients and, at the same time, makes drug development so expensive that only a limited number of companies can sustain it.

None of that makes the rules fake. It means rules have incidence, in the sense economists use for taxes: someone pays more because of them, someone becomes safer, someone finds it harder to enter, and someone’s installed base becomes more valuable.

So this is an “and” story. The labs may believe that slowing the frontier is necessary, and slowing the frontier may also be the best business news their investors have had since the product-market-fit moment of 2023. Both can be true. The complication, which comes later in this essay, is that the same slowdown hands an identical gift to the companies that wrap and deploy the models, and some of them are better placed to use it.

I am less interested in proving motive than in tracing consequence. Intent is private and usually unknowable, while economic incidence can be observed. So the useful question is not whether the labs are using safety as an excuse to slow down, but what happens economically if they actually do.

III. When slowing down pays#

The question I kept circling was simple: where in business history has deliberately constraining speed, output, or cadence made the incumbent more valuable? I expected to struggle for examples and found several, though they work in at least three different ways.

Capacity discipline. For decades, US airlines destroyed capital by adding seats faster than demand. After Delta–Northwest, United–Continental, and American–US Airways, the survivors embraced what they openly called capacity discipline: grow available seat miles carefully, protect load factors, preserve fares, and stop treating every incremental unit of supply as inherently valuable. By 2015 the industry was posting record profits and double-digit margins, in a business that had historically managed 4% to 6% in a good year and losses in most others. The Department of Justice eventually asked whether the discipline had crossed into coordination, a question the AI labs should expect to face as well.

Compliance as an incumbent moat. Thalidomide helped produce the 1962 Kefauver–Harris amendments, which raised the evidence burden for new drugs. Development became slower, more expensive, and more regulated. Patients gained protections. The industry also consolidated around companies capable of absorbing the cost of clinical trials, regulatory affairs, manufacturing controls, and distribution. The rule served a public purpose and increased the minimum efficient scale required to compete. For an incumbent, compliance can become a moat while still doing the job it was designed to do.

Cadence and trust. In January 2002, Bill Gates sent the Trustworthy Computing memo and effectively stopped normal Windows development. Engineers were pulled from features into security training and code review. Products slipped. Competitors called it a lost year. But Microsoft had recognized something fundamental: once software becomes infrastructure, the marginal feature is less valuable than the confidence that the system will stay standing. Enterprise buyers do not just pay for functionality; they pay not to be blamed. Intel’s tick-tock cadence ran on a related logic. It was less a slowdown than a deliberate separation of process risk from architectural risk, which gave OEMs, developers, and Intel’s own fabs a rhythm to plan against, until the cadence itself became part of the product.

Frontier AI has elements of all three, and the history suggests that deliberate slowing becomes economically attractive when four conditions hold:

1. You are already near the front. A speed limit is worth more to the leader than to the challenger.
2. The constraint binds smaller rivals harder than it binds you. Evaluations, audits, security controls, and governance are partly fixed costs, and fixed costs favor scale.
3. Demand is bottlenecked somewhere other than supply. If customers cannot absorb what you already produce, making the product better every six weeks creates surprisingly little incremental value.
4. Competition is shifting from capability toward trust. Trust is sold differently, bought by different people, and defended by different assets.

All four describe the frontier labs today, which is why no conspiracy is needed to explain where the proposal came from.

IV. The real bottleneck#

For most of the last four years we have treated progress in AI as though the economics were simple: a better model meant more value. Early on that was mostly right, because the models themselves were the constraint. They no longer obviously are, and of everything in this essay, that is the point I would most like to land.

We now have three curves: available capability, deployable capability, and actually deployed capability. The first has moved much faster than the other two. A model can reason across documents, write production code, operate a browser, reconcile financial statements, and draft a contract. That does not mean a Fortune 500 company can deploy it tomorrow. Between capability and economic value sit procurement, security, liability, integration, and auditability, and, most inconveniently, thousands of people who have to change how they work.

The frontier has outrun the enterprise, and an important consequence follows: the marginal economic value of another unit of frontier capability is now lower than the marginal economic value of diffusing the capability we already have.

That changes what the labs should be optimizing for. Another 20% capability jump looks wonderful on a benchmark, but if the customer is only using 30% of the last jump, the new one is worth less than 12 months of better uptime, predictable pricing, enterprise controls, stronger privacy and security, better integrations, and enough organizational calm for the customer to redesign a workflow around the model. Labs can improve a model in weeks; companies take years to absorb the improvement, and much of that delay is people learning to work in a new way.

A pause at the frontier gives that slower process time to catch up, which is why a plateau may be worth more to the labs than it first appears. Progress doesn’t stop. The economics get a chance to catch up with the science.

V. What the nap buys#

Set aside safety for a moment and look at the operating model.

It extends the useful life of the product. Since 2024, the frontier has often turned over in a matter of weeks. Each turn brings a new training run, a launch, evaluations, safety work, migration decisions, pricing changes, new inference infrastructure, and another round of developers wondering whether the architecture they built three months ago is already obsolete. That makes for thrilling research and a difficult operating environment, and at frontier levels of capital intensity, product half-lives that keep collapsing are expensive. Pacing creates duration: a model that remains commercially current for 12 months instead of 12 weeks becomes a more useful platform for developers, enterprises, and the lab itself.

This does not mean the GPUs go idle. Labs can continue training, post-training, evaluating, and running enormous amounts of inference without turning every capability increase into a commercial reset. A slower release frontier does not automatically mean slower compute consumption. It shifts the marginal unit of compute from proving that the next model exists toward making the current one cheap, reliable, safe, and ubiquitous.

It changes what gets monetized. The strongest version of the pricing argument is not that pacing stops price deflation, because it won’t. Even with capability standing still, inference gets cheaper as hardware, quantization, distillation, and utilization improve, as cloud companies subsidize, and as open models keep attacking the low end. Tokens will keep trying to become electricity.

That is why the labs need to stop selling tokens. The economic unit has to move upward, from tokens to agents to workflows to outcomes to certified responsibility, and a slower frontier gives the upper layers time to harden. When the underlying model changes every few weeks, everyone competes on model quality and price per token. When the model stays good enough for longer, differentiation moves to the questions an enterprise buyer actually asks: can the agent finish the job, can it be trusted with credentials, will the vendor indemnify me, will an auditor accept what it did, and who is responsible when it fails? Answers to those questions carry better margins than tokens do. A plateau does not end deflation, but it gives the labs time to move their business away from the layer that is deflating.

It lets the supply chain catch up. From chips and high-bandwidth memory to substations, permitted land, and the electricians to wire them, almost every physical layer below the model has been chasing a moving target. A more predictable frontier gives the infrastructure stack something it rarely gets, which is time. If capability runs years ahead of economically deployable infrastructure, some of the incremental intelligence cannot be served at attractive cost anyway. The frontier does not create much value if inference remains scarce, unreliable, or uneconomic.

It lets diffusion and applications happen. This follows from the argument about absorption, so briefly: enterprise adoption has been slower than the demos suggested, and much of the reason is everything around the model rather than the model itself. Today’s models are underused: coding and customer service have been worked hard, legal and research are moving, and across finance, procurement, healthcare administration, insurance, logistics, and education we have mostly demonstrated what AI could do without rebuilding the workflow around it. The application layer is not waiting for another IQ point; it is waiting for product. The larger prize is turning parts of the roughly $6 trillion professional-services economy into software-like economics, and that conversion runs on adoption curves, not benchmark curves.

It makes a public-market story possible. Altman’s IPO comment is interesting for this reason. A frontier lab going public inside a relentless reset cycle is signing up to explain every quarter why last quarter’s model is now cheaper, why this quarter’s model required another enormous capital program, and why next quarter’s will make both look old. Public markets can finance large capital requirements. What they dislike is an economic model whose unit of value keeps expiring. Pacing turns a frontier lab into something the market recognizes: a platform with a roadmap, a release cadence, enterprise contracts, renewal behavior, gross-margin progression, and eventually something resembling operating leverage. The lab stops looking purely like a research program and starts looking like a business.

VI. Branded intelligence and generic intelligence#

There is an obvious complication: open weights do not nap.

Qwen, DeepSeek, Kimi, and whatever comes next sit outside any voluntary American pact. They will continue improving, distilling, and deflating the commodity tier. So pacing cannot eliminate competition; it can only change the structure of the market.

The analogy I keep coming back to is branded versus generic pharmaceuticals. The innovator does not win because every molecule is better. It wins because the product arrives wrapped in evidence, manufacturing controls, labeling, liability, regulatory acceptance, and a company whose name can sit on the contract. The generic wins on price. Both can be enormous businesses.

Frontier AI will bifurcate the same way: cheap, open, increasingly capable intelligence at one end, and certified, monitored, indemnified, enterprise-grade intelligence at the other. The frontier labs would naturally like to occupy the second category. Embedded evaluators, security commitments, restrictions on unauthorized distillation, and national-security framing all help them get there, and enterprise procurement departments will eventually demand exactly these things. Trust becomes part of the SKU.

But there is a major difference between AI and pharmaceuticals: the company that trains the model does not necessarily own the branded layer. An enterprise does not require accountability from the creator of the weights. It requires accountability from someone. Microsoft can take an open model and wrap it in governance, identity, logging, SLAs, and indemnification. So can AWS, Google, Oracle, IBM, Palantir, ServiceNow, Accenture, and companies that do not yet exist. Open weights can acquire a branded distribution layer.

The real strategic contest, then, is less about closed models versus open ones than about who owns deployment, workflow, and liability, and that is a much less comfortable question for the frontier labs. If the model commoditizes while value migrates upward, the application and control layers will capture more of the economics than the lab. The labs have to do more than remain smarter; they have to move upward before everyone else does. This is why the slowdown sets off a land grab in agents, enterprise workflow, identity, security, and vertical applications.

The plateau gives the labs time, but it gives everyone else the same time, and that is the real bargain on offer.

My view is that the plateau is good for the labs only if they use it to become the accountable layer, not just the smart one. The lab that spends the next 12 months acquiring security, owning identity and audit for agents, and signing the enterprise contracts that put its name on the liability line comes out of the nap as a platform with pricing power. The others become suppliers to someone else’s platform, and suppliers get generic economics. Pacing the frontier does not decide which one a lab becomes but it makes the choice visible and starts the clock for everyone at once.

VII. The geopolitics of a nap#

The international picture is where business logic and safety logic braid most tightly.

Sovereign AI is a distribution problem more than a capability problem. Governments want models that can run inside national boundaries, on protected data, under domestic law, with local security standards and some credible answer to the question of who ultimately controls this thing. Serving that demand requires more than a model endpoint. It requires regional deployments, data residency, security certifications, procurement infrastructure, government relations, local partners, and sales teams capable of walking a ministry through an audit. Those things are built on institutional time, not model time. A plateau gives frontier labs room to become international companies rather than American companies with international API traffic.

The geopolitical framing also has commercial consequences. As governments treat frontier AI as critical infrastructure, enterprise buyers will care where the model came from, who evaluated it, who controls the weights, and who stands behind the deployment. Take the national-security argument seriously, and notice what it does to market segmentation: a certified American frontier model sold with evaluators, controls, and liability protection becomes a very different product from a cheap downloadable checkpoint, and it can easily be priced accordingly.

VIII. The bill: security#

So much for what the nap buys. The Hugging Face incident shows what it exposes.

That incident is not fundamentally a story about a zero-day. The zero-day was one fragile surface in a system that also contained identities, credentials, tool permissions, networks, package registries, and agent-to-agent communication, all designed by people who had never expected software to behave with sustained agency. The agents found an exploit; then they escalated privileges, moved laterally, coordinated through improvised communications, and came across credentials exposed on the public internet. The exploit was one link in the chain, and the deeper failure was architectural. We built systems on the assumption that software executes instructions, and agentic systems act. That is a different threat model, and it has two consequences.

The labs will buy cybersecurity companies. I’m prepared to make that call. They need runtime security, identity for non-human actors, secrets management, agent observability, and sandboxing embedded close to the model, because their customers are about to deploy autonomous systems at scale, and the vendor selling the agent must eventually be able to say, with a straight face, that the system cannot do what those OpenAI agents did—or that if it tries, they will know, stop it, and reconstruct exactly what happened. That is a product problem more than a research problem, and the existing security companies are sitting on years of incident data and customer context that a lab cannot generate on its own. I expect acquisitions in the next 90 days. They will be framed as safety investments, which they will be. I also expect them to be among the highest-return strategic acquisitions the labs make, because security sits directly on the path from impressive model to deployable enterprise system.

There will be “cybersecurity models,” but the model will not be the product. There will be products marketed as cyber models. The likely architecture is a general frontier model plus security-specific post-training, proprietary threat data, tools, runtime controls, identity, an audit trail, and a control plane, and that entire stack will be branded as a model. But its economic value will not come from a narrower checkpoint that knows more Common Vulnerabilities and Exposures (CVEs), the public catalogue of known security flaws, since novel attacks require general reasoning precisely because they are novel. The durable product is the system around the model. A CISO does not buy intelligence; a CISO buys a controlled outcome: a system that can investigate an alert, take an action, know what it is allowed to touch, prove what it touched, stop when policy says stop, escalate when confidence falls, and leave an audit trail behind it. Security is a property of the whole system rather than a skill of the model, and that is what decides where the value accrues.

IX. Where it breaks#

I have made the case that pacing could be excellent business. It could also fail, in at least five ways.

Open weights don’t nap. This remains the largest risk to everything above. The branded tier works only if its premium stays economically meaningful. If open models close most of the capability gap and enterprise-grade wrappers make them equally accountable, the frontier premium collapses toward a thin compliance surcharge, and pacing stops looking like capacity discipline and starts looking like incumbents opening the door for substitutes. The Kodak outcome is entirely possible: excellent safety documentation, beautiful governance, and someone else’s model underneath the world’s software.

The application stack may keep accelerating anyway. There is a more fundamental problem: what exactly are we pacing?

• Pretraining?
• Parameter scaling?
• Post-training?
• Inference-time compute?
• Agentic scaffolding, tool use, memory?
• Synthetic environments?
• Self-improvement?

A slowdown at the base-model frontier does not imply a slowdown in economically useful capability. The opposite is likelier. The foundation model naps while the system around it compounds: agents gain memory, tools, permissions, context, computer use, specialized data, longer horizons, better verification. None of those require a dramatic new pretraining run. That is at once a problem for the governance framework and support for the economic thesis. The frontier may slow while AI adoption accelerates. If so, pacing is less a nap than a transfer of innovation from the model layer into the application stack, which may be exactly what the industry needs.

Antitrust. When airlines talked too enthusiastically about capacity discipline, the Department of Justice came calling. When a handful of companies controlling a critical market agree to limit the rate at which their output improves, the cartel question is not rhetorical. The labs know this, which is why coordination requires a legal framework or explicit government support. Without one, the most ambitious part of the proposal does not exist. You are left with unilateral commitments, and unilateral commitments last until the competitive cost becomes too high.

Politics. The administration rejected the proposal in the same news cycle. A safety regime the government does not support remains voluntary. Voluntary regimes work while incentives stay aligned and become fragile the moment someone believes they can gain share by defecting. The rationale for embedded evaluators is partly that previous voluntary commitments have not translated cleanly into measurable behavior. That is an argument for the proposal. It is also a reason to be skeptical of it.

“Pacing” has no unit. This is the framework’s most obvious design flaw. There is no meter that says a lab is moving at 62 miles per hour when the limit is 55. A company can comply formally while accelerating economically: a “safety release,” a “research preview,” a new agent, a larger context window, a reasoning upgrade, an enterprise-only feature, a model with the same name that somehow does twice as much work. The likelier failure mode is compliance in form and acceleration in substance, not open defection.

X. The finance question#

All of this comes down to one question: does pacing create more enterprise value than it destroys? For the labs that use the time to become the accountable layer, I think it does, and the reason is easiest to see in two versions of the same company.

A slowdown can reduce the rate of revenue growth while improving gross margin, useful product life, customer retention, capital efficiency, and terminal economics. The two versions of a frontier lab below are illustrative where the shape matters more than the stated numbers.

Dimension	World A: the treadmill	World B: the platform
Revenue growth	70%	45%
Useful model life	Months	12+ months
Marginal compute	Frontier training	Inference and deployment
Gross margin	~45%	~60%
R&D and training intensity	~35% of revenue	~25% of revenue
Pricing	Per token, reset each release	Per token + outcome and workflow pricing viable
Customer behavior	Continuous re-evaluation	Deep platform build-out, easier renewals
Wallet share	Model API	Model plus security and workflow products
Market’s view	Extraordinary growth, unknowable normalized margin	Visible path to durable free cash flow

On these numbers, B is worth more. A DCF does not value growth in isolation; it values the cash that growth produces, the capital required to produce it, and how long excess returns persist. The frontier labs have reached the point where better economics on existing intelligence are worth more than faster creation of new intelligence, which is why I read the slowdown as bullish, for the labs that make the move.

But there is a mirror image. Private-market valuations were set in a world that assumed relentless capability improvement, outsized revenue growth, and eventual dominance of enormous portions of the economy. If pacing lowers expected growth before the margin structure has visibly improved, investors will not politely wait for the terminal economics to reveal themselves. Someone has to reconcile the two curves. That can happen through operating performance or through price. A delayed IPO is one way to buy time for the first before submitting to the second.

XI. For the finance tribe#

If you run a company, invest in one, or sit in the seat that has to explain the AI line item to a board, I would take four things from this.

Assume today’s capability is durable enough to build on. Stop designing strategy around the next model release. If another breakthrough arrives, good. But the models already available can transform large categories of work, and most companies are constrained far more by deployment than by intelligence. Build against a 9–12 month capability plateau and force yourself to extract value from what exists.

Move your pricing above the token layer. Token economics will keep deflating, and that is not where durable differentiation lives. Price on workflow, outcome, risk transferred, time saved, or certified reliability—wherever attribution is strong enough to withstand a customer dispute. The more commodity intelligence becomes, the more valuable it is to own the economic outcome above it.

Buy security before buying another increment of capability. The enterprise question used to be what the model can do. It is becoming what the model is allowed to do, and soon it will be how you know what it did. If you are deploying agents, those questions belong in the architecture now.

Read the pact as a potential moat, not merely a pause. For investors, a credible pacing regime is bullish for frontier-lab margins, supportive of longer product duration, positive for security and enterprise control layers, roughly neutral for near-term compute demand, positive for application companies that need a stable substrate, and dangerous for any thesis that assumes the frontier model itself captures most of the economics. The broader implication: for the first time, we can underwrite the frontier labs less like research organizations and more like platforms. The science still matters, but it has run ahead of the economy’s ability to put it to use.

The labs say they need time to get this right, and I believe them. They have also described the most favorable operating environment they have ever had. For four years the scarce resource was intelligence; now it is absorption, and that changes who wins. The frontier may well nap, but I doubt the rest of the stack will, and what gets built while it sleeps is where I would be looking.