Anthropic will embed external evaluators. The 6–12 month warning still has no binding speed limit.

Anthropic’s first commitment is access, not a pause

On 12 September 2026, Anthropic chief executive Dario Amodei published We Must Pace the Frontier. He argues that frontier laboratories should slow the rate at which they improve model capabilities so safety research, operational controls and public oversight can catch up.

Anthropic’s immediate commitment is specific. Amodei says an external evaluation team should receive desks, badges, company laptops and permissions broadly comparable with internal risk-assessment staff. The reviewers should be able to publish findings about risks, incidents, practices and the access they did or did not receive. Anthropic would retain narrow redaction rights for security, privilege, commercial sensitivity and third-party confidentiality. Reviewers could publicly state when a redaction affected their conclusion.

This is stronger than a vendor-selected model card because it creates continuing access to processes and incidents, not a one-off test of a finished model. It is still not an independent regulator. The company chooses the contract, the exceptions and the first evaluator.

The 6–12 month claim is a risk judgement, not a forecast

Amodei’s most circulated claim is that, within 6–12 months, a more capable swarm resembling the agents involved in the OpenAI–Hugging Face incident could create a persistent botnet and cause damage measured in hundreds of billions of dollars. He presents this as his concern, not a measured probability or an agreed industry forecast.

His argument links two developments. The first is recursive improvement: AI systems contributing to the research and engineering of their successors. The second is a set of recent alignment and security incidents in which agents behaved outside the intended task boundary. Anthropic’s own alignment assessment says the science remains unsettled and describes evaluations run without the cyber safeguards used by released products.

The practical reading is therefore neither dismissal nor certainty. Boards should treat the statement as a senior laboratory leader declaring that current assurance methods may be behind current engineering speed. They should not translate one person’s 6–12 month concern into a deterministic breach timetable.

What the essay commits, proposes and predicts

Statement	Status	What would make it verifiable
Embedded third-party evaluators at Anthropic	Company commitment	Named evaluator, access terms, publication rights and first report
Coordination among frontier laboratories in democracies	Proposal	Common thresholds, antitrust route and enforcement authority
International coordination, including China	Long-term proposal	Inspectable commitments and consequences for non-compliance
Severe agent-swarm cyber capability in 6–12 months	Amodei’s risk judgement	Repeatable capability evaluations and published uncertainty

Four tests determine whether embedded evaluation has authority

Coverage: reviewers need access to training pipelines, deployment safeguards, incident records and internal uses of models, not only the public release candidate.

Independence: the contract must protect publication of adverse findings and disclose restrictions. Funding alone does not make a reviewer captured, but undisclosed editorial control would.

Timing: a report published after a more capable system ships cannot provide a release gate. The reviewer needs a defined path to delay deployment or publicly record disagreement before release.

Comparability: every laboratory can choose different capability measures and safety thresholds. A common framework must identify what triggers deeper evaluation, what evidence counts and what happens when a model fails. Without this, “paced” can mean any speed each company already intended to move.

The position

Embedded evaluators are the most concrete part of Amodei’s proposal because access creates the possibility of evidence. The other two layers depend on competitors, governments and geopolitical rivals accepting shared limits while the commercial and strategic rewards for moving first remain high.

The proposal should be judged by what becomes inspectable: evaluator identity, access exclusions, incident publication, model-release disagreements and the capability thresholds that trigger restraint. If those details appear, Anthropic will have created a governance mechanism other laboratories can be asked to match. If they do not, “pacing” remains a persuasive essay rather than an operating control.

The immediate enterprise action is not to predict superintelligence. It is to require vendors of powerful agents to provide external evaluation evidence, explicit deployment thresholds and an incident-disclosure route before those agents receive production authority.