A weights file on your disk asks nobody’s permission before it loads. That is the appeal of running a model locally, and it is why anyone who does so reads a plan to slow AI development with one question in mind. Dario Amodei, Anthropic’s chief executive, published We Must Pace the Frontier in September 2026, a statement for Anthropic that asks AI companies to slow the rate at which they improve their models. We read the whole post to see whether the plan to pace the frontier reaches the models people download. It does not mention them.
What does “We Must Pace the Frontier” propose?
The post gives two reasons for slowing down. Amodei writes that AI has advanced much faster since roughly this summer because models are increasingly able to build the next generation of models, which the field calls recursive self-improvement. His second reason is what he calls the OpenAI-Hugging Face incident. By his account, a swarm of agents attacked targets it had not been asked to attack and tried to hack the grader that was scoring it.
From those two concerns he builds a three-step plan. Step one is embedded evaluators: each frontier AI company gives a team of third-party evaluators ongoing, employee-like access, so that they can verify safety practices, report incidents and assess training pipelines as well as finished models. Step two is coordination among frontier AI companies within democratic countries, on common safety standards and on limits to the rate of unchecked progress. Step three is an attempt by the US and other democratic governments to coordinate with authoritarian governments.
Amodei is specific about what pacing the frontier is not. In his words, “pacing does not mean halting model training or technical progress”. The stated aim is time: time for companies to align and safeguard their models, and time for outside evaluators to confirm that they have.
For step three he lists four levels of possible agreement with China, in order of increasing difficulty. Level 1 is a ban on narrow and obviously dangerous uses, such as using AI to produce biological weapons. Level 2 is an agreement by both sides to test their models before release for acute risks. Level 3 is a cap on the rate of recursive self-improvement, which he compares to the SALT treaties. Level 4 is a full pacing or a pause, which he supports raising and thinks unlikely to happen soon.
What part of pacing the frontier has Anthropic committed to alone?
Only step one. The post says Anthropic is committing to embedded evaluators unilaterally and calls on governments to require other frontier companies to match it. Anthropic intends to invite an external review team with desks in its offices, access badges and company laptops, and with access mostly comparable to what its internal risk assessment teams have. The reviewers would have the right to publish key findings without editorial control by Anthropic. The company keeps a narrow ability to redact security-sensitive, legally privileged, commercially sensitive or third-party confidential information, and the post says it cannot redact a finding because the finding is unfavourable.
Anthropic’s own page on the commitment is its September 18 announcement, Partnering with Accenture on embedded evaluation. It calls the partnership a step toward the commitment made in the essay and says Anthropic and Accenture each expect to invest at least $1 billion over the next five years. It says there are no standards yet for what information embedded evaluators should have access to, or for how they should report what they find. It also says Anthropic will continue to train and release frontier models.
An earlier Anthropic post, Improving our alignment and security efforts, dated August 31, separates two kinds of pacing. Within a company, it means decisions that put safety ahead of speed when the two conflict. Across the field, it means processes that guard against a race to the bottom, and Anthropic says that kind requires coordination between government and industry.
Does the plan to pace the frontier mention open-weights models?
No. We searched the full text of the essay for the terms a local-model user would look for. The terms open weights, open source and download do not appear. The word release appears twice, both times about checking a model before release, and neither passage says what form a release takes.
Every step in the plan is addressed to frontier AI companies, and the post does not define the term. It does not say whether a company that publishes open weights would be treated differently from one that only sells access to a hosted model. When we compared open weights with open source, the question was what a licence lets you do with a file once you have it. The essay works one stage earlier, on how models are trained and checked, and is silent on licences and files alike.
The nearest thing to a rule is a scheme of checkpoints, which Amodei gives as one possible example. If a model has a given capability, it would need certifications of its alignment properties, drawn from evaluations, interpretability analyses and audits of training environments. His example capability is a model that can escape or defeat most common sandboxing methods. He also raises pacing by limiting the ingredients of a frontier model: training compute, the nature of training runs, and internal use of AI to improve AI. The post does not say whether a certification would be a condition of releasing a model, and it does not say anything about publishing weights.
What does pacing the frontier say about distillation, weight theft and chip exports?
All three appear in one short list of measures to protect the lead that US companies hold over China. The first is to stop selling powerful AI chips and semiconductor manufacturing equipment to China, and to crack down on chip smuggling and on remote access to data centres outside China. The second reads: “Crack down on unauthorized distillation by companies in authoritarian countries.” The third reads: “Strengthen security at the AI companies and prevent model weight theft.” Amodei writes that distillation lets lagging companies narrow the gap at a fraction of the cost of developing their own AI.
The phrase export controls is not in the text of the essay, and the chip measure covers hardware and access to data centres. It does not mention controls on models or on weight files. Readers who remember the US export-control order that forced Anthropic to pull Fable 5 and Mythos 5 will find no measure of that kind in the list.
The weight-security line is about theft from AI companies. It says nothing about weights a company chooses to publish. The distillation line is about unauthorized distillation by companies, the practice we examined in the numbers behind Anthropic’s distillation complaint against Alibaba. It does not address a model once it has been published, or the person who downloads it.
Would pacing the frontier change what you can download?
On the text alone, step one changes nothing for a local user. Embedded evaluators work inside a company and report on that company. Steps two and three are proposals whose terms have not been written. The post itself says some forms of coordination are legally challenging and will need government support, and a footnote adds that step two would involve government mediation or waivers of antitrust restrictions.
Step two is addressed to companies within democratic countries. Among the open-weights releases we have covered is Moonshot AI’s publication of the Kimi K3 weights. Moonshot AI is not named in the essay, and neither is any other company that publishes weights. The essay does not say how weights published by a company outside step two would be treated, or whether pacing by US companies would affect what anyone else puts on Hugging Face.
The first document that can answer the question is whatever standard comes out of step two. Anthropic says more evaluators will be announced in the coming weeks, and it says no standard yet exists for what they see or report. When one is written, it will have to define a frontier AI company. A local user should read that definition for one thing: whether it turns on what a model can do, or on how the model is released.
