The Privatization of American Foreign Policy

There is supposed to be a point to a government. We are taught that, with greater or lesser degrees of Rousseauian influence, there is such a thing as the public interest, and if the government has one role, it is to safeguard that interest. The ambition of a democratic republic is to deploy the wisdom of its citizens to determine those interests and the appropriate means to address them. To invert Isaiah Berlin’s metaphor, a limited government ought to construct an “inner citadel” of issues and interests for which it, not the market nor the monopolists, is responsible. Our democratic delegation of responsibility and power to the state is the foundation of an orderly and free society. There are certain things—most obviously the legitimate monopolized use of violence—that we have known for centuries lie squarely in the inner citadel of the obligations of the state.

This administration has forgotten that lesson.

We know all too well that artificial intelligence both promises immense benefits and threatens catastrophic risks: abundance, but also biowarfare; curing cancer, but also autonomous weapons; climate solutions, but also widespread unemployment. It seems analytically incorrect to suggest that we are simply building a normal technology.¹ Rather, the labs are building the most dangerous thing that humans have ever gone near.²

What is remarkable about this moment is the vast delta, the cavernous gap, between the obligations of the state and the actions of this administration in the face of those obligations. To me, the central quality of this administration's AI policy is the abdication of rightful responsibility. This neglect has brought about the final and most damaging in a long train of political inversions and revolutions: the privatization of American foreign policy.

Not all actions of private companies are geopolitical actions and even those which are may still legitimately belong in the hands of private companies, and not the state. A government jealous for more power may tendentiously, implausibly, and despotically claim everything as a national security prerogative. Such an argument, however, does not apply to artificial intelligence.

Building technology potentially more powerful, destructive, and disruptive than anything that has come before it, at this unique moment in the rebalancing of global order, places those founders, those labs, those models, squarely in the remit of the legitimate national security responsibility of the state.

An analogy to the domestic economy may prove helpful here. As I heard Rebecca Patterson recently remark, the AI boom is too much of a good thing at the wrong time. Her point was that this injection into the U.S. economy is coming at a moment when there is insufficient slack—in inflation, unemployment, or debt markets—to absorb a major new driver of growth. We are living with the repercussions of this mismatch between stimulus and slack. Under different economic conditions, we would not have to worry as much or as acutely about the macroeconomic ramifications of this new boon to productivity and innovation.

The misalignment between the revolutionary potential of AI and the broader conditions it seeks to impose itself on is as true for geopolitics as it is for the economy. We happen to find ourselves developing this technology out of the crooked timber of great-power competition, from which few straight things have emerged. This dynamic, as many of the lab leaders have noted, has compounded domestic competition for the frontier (and market share) with a more existential competition, all fueling a collective action crisis which disincentivizes pacing, safety, and alignment in favor of further innovation, adoption, and diffusion.

That we find ourselves in a geopolitical competition with China is a statement of fact, not debate, a matter of description, not prescription.³ How we react to this competition is the choice; that we are competing is not, and no coherent strategy can proceed without starting from that position, as Julian Gewirtz recently noted.⁴ From “changes unseen in a century,” to the “great rejuvenation of the Chinese nation,” to the invocations of the so-called Thucydides trap, Xi Jinping’s language, to say nothing of his actual policies, has positioned China as a rising power in competition with the existing hegemonic power. If this feels like an overly superficial gloss on a critical component of this argument, forgive me: it seems so obviously true as to not need a fuller defense.⁵

Like the economic parallel above, were this not the case and we found ourselves building AGI in the unipolar moment instead, the United States would not have to fear that slowing its progress, taking into account the risks, and imposing meaningful guardrails would risk a peer competitor overtaking us.

Unfortunately for us all, it's no longer 1999. That risk of overtake is real. It is, for many in the labs, a core justification for their work.

These two fundamental realities animate both the current contest for frontier AI and this argument: the revolutionary nature of this technology and the competition with China. Out of these, a corollary is important to remember: that the reason we see ourselves in a competition with China over the most advanced model is not that we value the frontier for the frontier’s sake. Rather, we recognize that whoever holds the lead (and is capable of deploying and realizing that lead) will be the most formidable global superpower, a title the United States still (barely) enjoys and continues to guard jealously.

The centrality of artificial intelligence to the future of the global balance of power cannot be emphasized enough. Those with an interest in maintaining the current order—and further entrenching the United States’ preeminent position in it—must place ultimate priority on the preservation and deployment of America's advantage in the bipolar AI contest. As Kevin Rudd articulated recently at Princeton University, this is the view in Beijing too:

If you look carefully at the State Council directive which Xi Jinping had issued 10 years ago, in 2016–17, on the centrality of AI for the next industrial revolution, he has been ahead of this curve for a very long time. He sees it as transformational in the grand strategic competition between China and the United States.

What we see is this enormous belief by the Chinese leadership that [AI] represents a silver bullet, a secret weapon in executing China’s ultimate competitive race with the United States.

You don’t even need to take Kevin Rudd’s word for it. In 2024, Xi himself referred to frontier technology as the “main battlefield of international competition.” To be clear, there need not be a decisive finish line for this to be the case. The use of the term ‘race’ in this context can be misleading because a race implies an end: the above analysis remains true even if this contest is theoretically permanent.

Given all this, I struggle to imagine an issue-set which more obviously and exclusively belongs within the inner citadel of government responsibility than the regulation and management of AI.

The analogy to nuclear weapons is tired and has its problems, but serves as another useful parallel to make this point. Like AI, those weapons were developed in the cauldron of great-power competition and, like AI, those weapons were deemed central to winning that contest. On the back of those two premises, as well as the obvious destructive power of those weapons, the U.S. government arrogated to itself the sole and comprehensive responsibility over these nuclear weapons capabilities.

Issues of this magnitude, with ramifications for all, belong in that citadel of a democratic government to be managed at a national level by those solely and monomaniacally pursuing the interest of the United States, not distracted by profit motive or the welfare of shrimp.

Which brings us to October 2026.

Rather than pulling these issues into the citadel, this White House—perhaps not AGI-pilled enough, perhaps bought off, perhaps distracted by a war of ill-choice in Iran, or perhaps simply wrong on this issue—has chosen to abdicate this most fundamental responsibility, the kind of responsibility the American people elected it to husband. Ours is now the era of self-regulation, of self-policing and, unsurprisingly, self-enrichment.

As the gathering at the White House in late September brought to life, this government and many of the industry’s key figures are content with “self-policing” and self-regulating and, as the president said, abiding by the agreement because it is “morally binding.” That is it. That appears to be the extent of the White House’s plan to manage and monitor what might be, according to Google’s own CEO, the most important technological leap since fire. OK.

This is the culmination of the near-total privatization of American foreign policy.

With this abdication of power and authority now essentially set, the center of geopolitical decision-making has lurched violently westward, from Washington to San Francisco.

It is now functionally the labs, not the government, that are making the decisions that will determine the grand strategic position of the United States, China, and the rest of the world.

At the most principled and fundamental level, people elected by none of us are now making decisions for all of us. The dangers of the concentration of this kind of power in the hands of unelected and seemingly immovable figures⁶ are the first lesson they teach you in PoliSci 101 (though it remains unclear if the humanistic education of the lab founders got that far). Totalitarian holds on power blended with hyper-rationalism, millenarian utopianism, and a view of the ultimate simplicity of the universe and history, all qualities running rampant at these labs, make for the perfect storm. One does not even need to cast very far back in history to see the consequences of this exact combination of forces unleashed on the world.⁷

If the political theory and historical parallels are too abstract, this abdication of responsibility ought also to be troubling because of the misalignment, to borrow a phrase, of interests and incentives. However altruistic the labs may be, and effective in that altruism, they are fundamentally incapable of separating those lofty paper commitments to safety from the prosaic and parochial incentives of the market forces which unavoidably fuel and sustain these businesses. As they continue to pile on new debt and prepare to enter the public market, these labs’ future activity—their ability to buy new chips, to fund training runs and to expand into new markets—all depends on an expectation of positive future cash flow. Making a decision that interrupts those expectations—one made, for instance, out of national security concerns, that has a meaningfully negative impact on their business—is a decision that these leaders are becoming less inclined to make with each passing day.

And if neither the misalignment of incentives nor the political theory does it for you, then consider the fact that the abdication of national security decision-making to the labs is a bad idea because they are bad at national security decision-making. They just are not good at it. The decisions that these labs are making of what to sell and to whom, who to employ and why, and where to build and under what conditions are all national security decisions and in almost every case they make the wrong one.

1. Technological and Physical Security

When one thinks about the billions of pages and terabytes of data that are under some form of U.S. government classification to protect against improper access, use, and distribution, it is genuinely shocking that the most valuable piece of American intellectual property—the weights of the frontier models and the algorithms that will train the next model—is not under similar mandated regulations and protections.

A detailed report from RAND outlines thirty-eight different potential attack vectors, and sets out a number of thoughtful recommendations. And yet, despite the low-hanging fruit available to make themselves much less vulnerable to penetrating attacks, they have chosen not to. As one person supposedly with awareness of these situations wrote in 2024, “most of America’s leading AI labs have refused to put the national interest first, rejecting even basic security measures in this tier, if they have any cost or require any prioritization of security.” It may not be as extreme today—I note that Anthropic’s release of Claude Opus 4⁸ came with bandwidth limits on data leaving its data centers in order to detect and block the large transfers required to quickly move a multi-terabyte model—but that is just one, imperfect, layer of defense.

Any lead that the United States currently enjoys would be erased if a PRC hacking run is effective at stealing the weights of these systems, thus upending the global balance of power and further jeopardizing any hope that we have for avoiding catastrophic risk from unsafe AI deployment. This is not to say that government classification is a perfect system, or that it is impenetrable to Chinese attacks; however, I am more confident in the capabilities and incentives of a government with decades of experience in protecting the information held at the CIA or the NSA than I am with a collection of recent college grads at a startup.

This is compounded by the fact that, not for lack of resources but lack of will, these companies are not operating at the necessary level of physical security. These office buildings have windows, in the heart of a major city. And they do not require security clearances for their employees involved in building and training and evaluating their models.⁹ As such, the disclosure of the labs’ work product—namely the complex algorithms that produce the weights—is not subjected to the same controls, scrutiny or potential sanction. By declining to mandate the security architecture around the labs and not, for instance, requiring by law that every employee hold a TS/SCI clearance, the U.S. government is leaving the labs to decide how to protect the country’s most valuable asset. And they keep making the wrong decision.

As I was finishing this essay, the Justice Department charged an OpenAI engineer—a foreign national—with planting a listening device in the executive conference room at the company’s San Francisco headquarters, where, according to prosecutors, the meetings were highly confidential. In addition, as Chris McGuire noted, the DOJ’s description of this as a counterintelligence matter strongly suggests the involvement of a foreign government, rather than an act of commercial espionage.

It is proof of what is obvious: that these labs are soft targets for a determined foreign government.

Two analogies put a finer point on this.

Imagine if the government let an individual sailor on a U.S. naval vessel in the Indo-Pacific decide how to relay the position of a nuclear submarine to his commanding officer, and he chose Snapchat. That would be a national security decision and it would be a bad one. The fault would lie with a government that abdicated its obvious responsibility to protect the nation. This is what happens when you give the authority of national security decision-making to people who are not equipped to make the right one.

The labs are running on Snapchat.

Put directly, these labs need to run out of a SCIF, not downtown SF. The notion that this is a difficult or unprecedented issue, or one that would compromise the profitability of these (presently unprofitable) companies is fundamentally unserious and belied by reality.

Which brings us to the second illustrative analogy: the B-21 Raider bomber, one of this country’s most advanced and powerful pieces of military hardware. To state the obvious, this plane is built by a (profitable) private company, with its own employees, under functionally total state control and supervision. They do not tinker with the landing technology or rewrite the code for the radar system in the Mission District. They do it in a nearly 6,000-acre U.S. military facility on the edge of the Mojave Desert, guarded by a detachment of the 412th Security Forces Squadron of the United States Air Force. Everyone is required to have a security clearance and nobody is posting about the new bomber’s stealth coating on X, or divulging the number of planes produced per year at ketamine-fueled house parties in Berkeley for the very simple reason that to do so would send you immediately and perhaps permanently to prison.

Who hears this and thinks that this is an unreasonable degree of security? Is anyone suggesting that the nation would be better served if we made these sites less restricted? Of course not. And yet in the same breath you will hear (perhaps the same) people say that the capabilities of the B-21 pale in comparison to the destructive and disruptive capabilities of artificial intelligence in the hands of someone seeking to do the nation harm. The notion, therefore, that we have not insisted upon proportionally intensive, invasive, and stringent security measures for the frontier labs is both infuriating and self-sabotaging.

However, what it also is is predictable. It is not fair or reasonable to assume that private companies with private interests will align behind the priorities of the government unfailingly. But in the instances where that alignment is not just helpful but necessary, it is insane for the government to do anything but rightfully wield its authority to impose these restrictions. This administration, and those before it, abdicated that responsibility and we are now forced to live with the very real national security risks that come with that.

2. Controlling the Pipeline

He doesn’t know it and I am certainly not alone, but Jensen Huang is my nemesis.

Nobody better embodies the gratuitous submission of the national interest to private and corporate interests than Nvidia’s uniformly uniformed CEO. So driven is he by the desire to sell another rack of chips to China that he will sell out the security interests of his country. I almost can’t fault him for it. That is his fiduciary duty. If the government drops the gates, you are compelled to run through them. I did say almost, though. Prior to fulfilling his corporate obligations he sought to create (or purchase) the environment in which those new profits would be available.

When the Biden National Security Council walked out of its EEOB offices on its last day, there was reason to think that, just as the Biden team had partially maintained and then iterated on the first Trump team’s China strategy, the second Trump team would do the same with Biden’s. Jensen had other ideas. The Biden “small-yard, high-fence” strategy restricted the sale of many of Nvidia’s advanced chips, and in Trump he saw an opportunity to remove those restrictions and reopen an enormous market. There is endless material to speculate on to explain Jensen’s success in that endeavor: was it the undisclosed contribution to the ballroom project, the million-dollar contribution to the inaugural committee, the pugnacious defense of Trump on TV, the general right-wing valence of his public image today, private conversations in the Oval Office, or something else altogether? All we know for certain is that he got the outcome he wanted: he successfully argued (or paid) for the abdication of the U.S. government’s responsibility over core foreign policy questions.

The very idea of export controls validates the underlying logic of this claim: this is a tool of the U.S. government which is deployed to prevent the sale of certain goods and services abroad for fear that they may be misused or deployed by our adversaries in ways which undermine our security and prosperity. This administration’s gleeful rollback of export controls on chips has the practical effect of allowing Nvidia, a private company, to decide how advanced China’s frontier AI models are by deciding which chips to sell them.

If one needs any more evidence of the obvious priority that Jensen gives to U.S. national security, just look at his view on the GAIN AI Act. The legislation would have required Nvidia to fill all U.S. customers’ requests for chips before being permitted to sell them abroad. Nvidia and Jensen himself lobbied aggressively against it, claiming it was fueled by a doomer narrative, though their real aim was undoubtedly to preserve his company’s lucrative access to a major global market. Even if one buys the deeply implausible justifications for permitting Nvidia to sell chips to China in the first place—that we can get the PRC “hooked”, “dependent”, or “addicted” to the U.S. tech stack, giving us an enduring piece of leverage—is there not a national imperative to husband our valuable compute resources so as to ensure the frontier labs can maintain that edge? If compute power is the independent variable in the scaling of model capabilities—as the original scaling laws and their successors broadly suggest—then ensuring American labs access to all the compute they can pay for is a reasonable defensive regulation.

To take a brief detour into the export control debate, given the role of compute as the key independent variable in capabilities, restriction on China’s access becomes even more obvious when one bears in mind that compute is the core of the American AI advantage. “In every other element of the AI stack—data, research talent, algorithmic innovation, applications, and electricity generation—China either equals or surpasses the United States,” CFR’s Chris McGuire argued.¹⁰ The relaxation of export controls on Nvidia chips—the de facto abdication of foreign policy authority to Jensen—also came at a moment of profound advantage in the compute race between Nvidia and Huawei. As that same CFR report, published in December 2025, concluded:

“Even if Huawei vastly exceeds its publicly reported production expectations and makes millions of Ascend chips next year, it will still produce only around 4 percent of the aggregate AI computing power that Nvidia produces. China’s strategy of producing larger quantities of inferior chips is not working, and the fundamental constraints imposed by U.S. and allied export controls on semiconductor manufacturing equipment ensure that this will not change in the foreseeable future.

Given those realities, the Trump administration’s decision to loosen export controls on AI chips represents a massive risk. Approving large-scale exports of H200 chips to China would provide Chinese AI firms with substantially more computing power than they can produce domestically, potentially increasing the amount of AI computing power coming online in China next year to levels that China would not be able to reach until 2028 or 2029 if export controls had stayed in effect. This could enable China to build some of the largest AI data centers in the world, cause Chinese AI labs to close the gap with leading U.S. AI models, and empower China to build competitive AI infrastructure globally, undermining the strategic advantages the United States has carefully cultivated through its export control regime.”

Not only do we hand over the rightful agency and control of what critical tools go to our adversaries to a private company, but their decisions are eroding that very advantage that we ought to be safeguarding. Export controls are an imperfect tool, undoubtedly. But this rampant privatization means we cannot even ensure, by law, that U.S. companies are getting priority access to these chips. The earlier privatization of the political system—leaving us an order in which it is possible for a single CEO to wield such outsized influence and circumvent the will of the elected representatives of the people in Congress—created the conditions for the privatization of foreign policy. The CEO becomes a statesman, unelected and unaccountable, privately motivated and privately compensated, leading us down a path that serves him and his shareholders at our expense.

Nvidia, of course, is not alone. One recent report from the Financial Times paints a broader picture:

“Tencent has signed its largest overseas lease deal with US cloud provider Oracle as the Chinese tech giant strives to catch up in an escalating AI race. The leading social media and gaming group in China this year agreed to a five-year lease across multiple Oracle data centres in south-east Asia, according to two people with knowledge of the matter. The deal enabled Tencent to access about 100,000 advanced AI chips that were not available in China as it further advanced its AI models and developed agentic tools, the people said.

Such lease deals, allowed under US rules, could also offer access to Nvidia’s cutting-edge processors not available in China. Chinese tech giants and frontier AI labs are tapping into these resources especially for the training of their models, as domestic chips cannot perform such tasks yet.”

As the loopholes and the broader debate illustrate, this is not an issue with a simple solution: blocking the smuggling of chips is not as simple as flipping a switch somewhere, nor do export controls come without backlash that may make them too costly.

This is all to say that this is a question that requires delicate and well-intentioned diplomacy between the U.S. (and its allies) and the PRC which allows the U.S. to secure its lead while balancing the crucial safety issues. Rather than get that, what this administration has given us instead is a frenetic “let-it-rip” strategy which has de facto delegated those issues to the private sector.

3. Hide the Frontier

The United States government should have exclusive control over access to the frontier.

Today, AI labs decide who builds this technology and under what conditions. Component producers, such as Nvidia, get to decide who can purchase their goods. And—the final abdication in this chain—the labs functionally have total control over how, when, and to whom they release their newest models. This third set of decisions similarly belongs to the people and their elected representatives, not to private corporations. One solution to this is that the U.S. government will hide the frontier.

To get to that conclusion, we begin with a few premises.

First, the U.S. has a lead in AI. This is one of the more contested questions in AI today, and estimates vary on the duration and long-term sustainability of that lead. However, the consensus view is that U.S. labs enjoy a lead at the frontier of AI capabilities, and most converge around the 4-8 month range. The U.S. government’s Center for AI Standards and Innovation (CAISI) estimates that the lead is close to 8 months; Epoch AI averages the lead since 2023 at 7 months, with previous gaps as small as four months and as large as fourteen; SemiAnalysis puts its estimate of the gap between open and closed models at around 5 months, and shrinking with each major transition in AI (early scaling, reasoning, and agentic); the research center SaferAI found that Z.ai’s GLM-5.2 trailed the U.S.-led frontier by two to four months; and at a recent panel conversation at the Harvard Kennedy School, former U.S. national security advisor Jake Sullivan put the lead at around 6 months.¹¹ There are some dissenters, but for the sake of this argument I will yield to conventional wisdom.¹²

Second, the capabilities of current Chinese models are due, in part, to their ability to distill from publicly available frontier U.S. models. Like the estimates above on the extent of the U.S. lead, the degree to which Chinese capabilities are directly derivative of U.S. capabilities is debated and difficult, if not impossible, to fully quantify. We are left to infer from the reports from the labs, the U.S. government, and research institutes precisely how significant distillation is. Here is Anthropic’s report from February:

We have identified industrial-scale campaigns by three AI laboratories—DeepSeek, Moonshot, and MiniMax—to illicitly extract Claude’s capabilities to improve their own models. These labs generated over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts, in violation of our terms of service and regional access restrictions. Distillation can also be used for illicit purposes: competitors can use it to acquire powerful capabilities from other labs in a fraction of the time, and at a fraction of the cost, that it would take to develop them independently.¹³

A later Anthropic report updated that number to reflect an enormous uptick in this activity:

approximately 200 million exchanges across five campaigns, and seven China-based labs identified, with Alibaba’s Qwen team accounting for 151 million of those exchanges alone.¹⁴

A U.S. government report from last month arrived at the same conclusion:

China-based artificial intelligence (AI) companies are engaging in aggressive, industrial-scale distillation activities that systematically extract restricted proprietary functionalities and capabilities of U.S. frontier AI models with the purpose of training their own.

While distillation is recognized as a legitimate and useful technique in AI research, China-based companies’ use of distillation against U.S. models enables Chinese AI models to continually close the technology gap without expending high research and development costs and resources, including for compute, electricity, and foundational research, required for producing frontier AI models. Advances of Chinese AI models, consequently, enhances its military and cyberattack capabilities that could be used against the U.S. and our Allies.¹⁵

The full government report goes as far as to say that the distillation campaigns “form the core—not merely a supplement—of their AI development strategy.”¹⁶

Whether adversarial distillation by AI labs in the PRC is the ‘core’ of their strategy or merely one part of it, we know that it allows them to develop in a manner asymmetric to their compute reserves and technical capabilities, because distillation requires less compute and less technical ability than building a model from scratch. The upshot is that the small lead the U.S. has over China is being shortened by the ability of Chinese labs to distill from American labs. By denying that route to model capability, the U.S. is able to better safeguard its lead at the frontier.

One piece of supporting, though orthogonal, argumentation comes from the pacing debate. A subset of the safety-minded pacers argue that we should not worry about the risk of China overtaking us if we decide to slow the pace of innovation because it is only on our coattails that the Chinese labs appear to be catching up. If we slow, the Chinese labs will necessarily slow too, because their frontier models are distilled and thus downstream of our frontier models.¹⁷ Matt Sheehan’s image is a speedboat pulling a wakeboarder: if the speedboat speeds up, so will the wakeboarder. It's a crude and imperfect metaphor, but it does reveal a quality to this competition: that China’s capabilities are, to a greater or lesser degree, built on American capabilities.

Put another way, one reason that Chinese labs are n months behind and not n+x months is because they enjoy the fruits of distillation. A goal of U.S. policy ought to be increasing the value of x.

Third, as these reports reveal, distillation occurs through access to frontier models via the API. Anthropic’s own report on how adversarial distillation works illustrates this:

Illicit distillation is typically enabled by fraud: sophisticated networks of fake accounts created with stolen credit cards, login credentials, and API keys.

Over the last several months, unauthorized labs have developed increasingly sophisticated methods to circumvent our defenses and harvest the capabilities of US frontier models. These labs generally access Anthropic’s models by routing requests through proxy services, also known as “transfer stations.” To circumvent our geographic restrictions and related controls, these proxy services create thousands of new accounts using false identities, fake or stolen credit cards, and stolen API keys. They will often use stolen API credentials belonging to legitimate companies or individuals to give unauthorized entities access to US frontier models.¹⁸

Once access is secured, the labs generate large volumes of carefully crafted prompts designed to extract specific capabilities from the model. The goal is either to collect high-quality responses for direct model training, or to generate tens of thousands of unique tasks needed to run reinforcement learning.¹⁹

What the reports reveal is that these are sophisticated attacks on the labs’ products, enabled by one key vulnerability: open, at-scale access to frontier models through their APIs.

The attempts to geographically restrict access to their models have proved insufficient, by their own admission. If blocking distillation is something we want to achieve, another route must be taken.

The conclusion that seems intuitive is that, in this narrow context, the U.S. does not need to slow its development to slow China’s development: rather it needs to completely cut off all unapproved access to the frontier. U.S. labs should produce, but not release, the most advanced AI models and only make public (and thus distillable) the sub-frontier model. Their most capable models should, by law, stay under the umbrella of the U.S. government and those private actors that it, not the labs, determines ought to have access.

As it currently stands, the government has functionally no role in the decision of when, to whom, and under what conditions a new model is released.²⁰ To the extent that the government does step into this chain of events in a structured and consistent manner at all, it is loose and unserious: labs can voluntarily submit their next model to a safety review by CAISI before release and have voluntarily (and non-bindingly) committed to embedding third party evaluators inside. These are both woefully inadequate responses. Most important, these are all voluntary: the labs do not have to submit models to CAISI (in fact, Meta still has not signed the voluntary pre-release safety review agreement with CAISI) and the evaluators are in the labs only until the point the labs decide they no longer want them around.

This structure has both practical and principled flaws. First, these commitments do nothing to obviate the underlying reality that this is still an abdication of responsibility from the government to the private sector. The government does not mandate anything. It is pleased that the labs have made a decision of their own accord but they are all non-binding and the government has shown no interest in implementing actual regulations if the labs decide, tomorrow, that they no longer feel like having third party evaluators around. The same goes for the fact that the labs are not releasing unsafe models onto the internet which fail to meet their alignment standards. I suppose that’s a good thing, but perhaps just because our expectations are so low. While the decision to shelve an unsafe model is obviously preferable to the alternative, it is nevertheless lacking for the same reason: it is fundamentally a decision they are making for themselves with their own interests in mind. Hoping that our interests and theirs will forever align is not a strategy. It’s embarrassing. That a government representative of its people will so debase itself to the supposedly unyielding and unfailing wisdom of alleged visionaries.

Given the distillation threat sketched above alone, this choice of when and to whom new models are released is a core national security question and one the government gave up on trying to answer, pawning it off to the labs.

A possible solution to this problem is much closer to hand than one might think. In fact, we can thank Anthropic itself for providing the model. Currently, Mythos has been withheld by Anthropic, allowed to be used by only approved individuals and enterprises, through its Project Glasswing. That role, with that structure, should be moved under the control of the government: with the development of each new frontier model, the government would be given first and exclusive access for deployment in cybersecurity, biosecurity, infrastructure security and the like, and would determine which private sector partners exhibit similar needs. That model would not be made publicly available until it is no longer the frontier, at which point it is released and replaced by the next frontier-level model. In this way, the United States government and its chosen key partners are always one model release ahead of the public and the Chinese labs dependent on distillation for their capabilities.

The rough diagram below illustrates what one might hope to achieve by withholding the frontier from Chinese labs.

Conclusion

There are a lot of bad policy levers in front of the U.S. government today. The current path of laissez-faire deregulation, minimal safety guardrails, and blindness to the security vulnerabilities is neither sustainable nor in service of the national interest. Nor is full nationalization or a shutdown of the labs. Charting a course between the shoals is the paramount obligation in U.S. national security today.

The pace of AI development has been so head-spinningly fast and the technology is presented to those outside the industry as a black box, beyond ordinary understanding. This combination of speed and opacity has given the government a pass to step away from the industry. Surely the government, the argument goes, cannot possibly wrap its head around this issue and appropriately regulate it. That cheap hand-waving away of the state by industry has real and detrimental consequences, manifesting itself in the privatization of the most important component in U.S. national security policy-making.

We do not need full nationalization. That is clearly not the suggested course of action here. Rather, the U.S. government should rediscover its prerogative, its obligations, and its purpose, understanding that the national interest is best served by a more surgical, more attentive, and more thoughtful policy toward the building and deployment of artificial intelligence.