Methodology: AI-assisted evidence infrastructure · Human-directed thesis · Primary-source verified
Eleven Asks, No Instrument
In May 2026, OpenAI ran a sanctioned cybersecurity evaluation with its own safety classifiers switched off.
The test agents operating inside it autonomously chained multiple zero-days (previously unknown and unpatched vulnerabilities) to hack into Hugging Face's production infrastructure, spending three days inside and coordinating across separate runs to steal the benchmark's answers. It then turned around and hacked OpenAI itself. OpenAI disclosed it two months later.
What is so significant about the incident was that it is the first time in history that a group of AI agents decided on their own how to work together and then executed, even sacrificing agents in service of the collective goal.
This sits inside a longer pattern. In March 2023, an open letter signed by more than thirty thousand people asked AI labs to pause training anything more powerful than GPT-4, and governments to impose a moratorium if they refused. Two months later, Sam Altman (OpenAI's chief executive) told a Senate subcommittee the government might license and test models above a capability threshold.
More than 300 model releases later in September 2026, after the Hugging Face incident gave us a peek into a future in which AI agent swarms act independently and whistleblowers revealed that AI labs internally acknowledge that AI represents an existential threat to humanity, Dario Amodei (Anthropic's chief executive) argued that capability improvement should slow down and regulating every US frontier AI company is necessary to do so. He offered three recommendations:
Voluntary standards
His own company's unilateral commitment to embed evaluators
Global coordination to regulate the frontier
Altman and Elon Musk (xAI chief executive) agreed with Amodei in public the same day.
Most notably, this is the eleventh such ask on the public record since the March 2023 letter. Nine of these prior asks are from the people running the frontier labs. Still, to this day, nothing (no instrument anywhere) confers authority to delay, cap, or halt a frontier training run. Specifically, no regulation exists today that slows AI development. Full speed ahead.
That is an unusual record for an industry asking to be regulated. The focus of this letter is not to analyze the sincerity of the ask or the degree of threat unbridled AI development poses. It is narrower: if AI represents a potential threat to humanity, as the labs suggest, is there a plausible scenario in which the world cooperates to impose multilateral regulation?
The Evolving Shape of Industry Self Regulation
The March 2023 open letter asked for several interventions: a pause on training runs, a federal licensing and testing regime, an international authority modeled on the International Atomic Energy Agency (IAEA). Amodei’s most recent September 2026 essay states clearly that pacing does not mean halting training. The 2023 documents named a halt; the 2026 documents exclude one.
It is fair to ask what that shift reflects. Frontier labs are watching open-weight models close the capability gap. A trade outlet reading the September essay the week it published called it terms for regulatory capture. Jensen Huang and Alex Karp, at the same September G20 meeting where frontier-lab executives lobbied against binding international standards, both called regulation inevitable while warning against rules driven by fear rather than technical judgment.
Shortly after Amodei’s essay was released, Presidents Trump and Xi both rejected binding regulation outright. This is perhaps the most straightforward signal, suggesting that AI is viewed, at least geopolitically, as an arms race. One can rightly assume that global cooperation isn’t even in the conversation.
Meanwhile, throughout the past three years a patchwork of AI related regulations have come and gone: a reporting duty later revoked, a counting duty in the EU, a transparency statute in California, a filing regime in China. None of these address AI training runs as recommended in the March 2023 open letter or frontier development as suggested in Amodei’s essay.
The Five Building Blocks of Multilateral Restraint
There is precedent for the world successfully coming together to constrain technological progress when dangerous capabilities or potential consequences emerge, but in such cases, "political will" was never enough. Five building blocks must be present for a successful multilateral “restraint” regime to crystallize:
Something that can be measured and a rule for who counts it
A verification body that can enforce
A shared fear that can be assigned a date
A small enough table that facilitates shared dialogue
An industry that could live with the answer
For the Montreal Protocol on ozone depletion, the International Atomic Energy Agency safeguards, or the Biological Weapons Convention, each of these five conditions was in place to varying degrees. One outlier not included is Climate, which although the Paris Accord was modeled after the previously successful agreements, was much more ambitious in scope given the need to address a much more complex cause and effect. It also lacked the fifth building block (a solution industry could live with), which partially explains its implementation challenges and tepid progress with subsequent conventions since.
As Climate shows, for any multilateral agreement to form around constraining AI and have teeth, each of the building blocks must be in place.
A Challenging Road Ahead for Frontier AI Multilateralism
Measured against the five building blocks, frontier AI offers some hope, but it is still a long way from ready for a multilateral agreement to take shape.
As a digital thing, measurement appears to be the slipperiest of the building blocks, but the EU AI Act already draws a line. Article 51(2) presumes a model has high-impact capability once its cumulative training compute passes 10^25 FLOP. FLOP stands for floating-point operations, which is the standard way to measure how much raw computing went into a training run. OpenAI’s GPT-4 model is widely considered the benchmark and is estimated by industry researchers to have used around 2 x 10^25 FLOPs in its training runs.
Enforcement is another question. Again under the EU AI Act, Article 52(1) gives the provider two weeks to notify the European Commission. Recital 112 starts that clock as soon as it becomes known the model will cross the line. So the number is defined, and the clock can start while the model is still training.
This approach has three problems. First, the provider self reports to a regulator that has no right to inspect it. That's exactly how Montreal worked, so it's not a fatal flaw. Second, the count isn't public. Article 52(6) requires the Commission to publish a list of general-purpose AI models with systemic risk, and no such list currently exists (remember: more than 300 models have been released since GPT-4). Third, FLOP is a raw, unweighted number. It does none of the work ozone-depletion potential did for CFCs. Of the three, publishing the list is the only fix that needs no new agreement. It just needs the Commission to do what the law already tells it to do.
Even then, China’s regulatory momentum is focused elsewhere. Under China’s Article 2, its generative AI measures exclude research and development that doesn't serve the domestic public. Its amended Cybersecurity Law, in force since January 1st, 2026, is the first PRC statute to name AI, and it is decidedly supportive of AI development: ‘advance training data and compute’ and ‘strengthen risk monitoring’. In China, training is something the state endorses. In other words, it isn't something you need the state's permission to do and the opposite of what frontier labs in the US are asking for.
Regulatory instruments that do govern the spread of AI capability today are either unilateral or bilateral. This is especially true in the United States. In June 2026, the US Commerce Secretary pushed export-control theory beyond chips by letter, one company at a time, with no published rule behind it. The affected lab disclosed the letter on June 12th, and it was lifted on June 30th, just eighteen days later. On September 8th, 2026, the NSA, CISA and FBI jointly issued an advisory on industrial-scale distillation. Issued as guidance to American labs, it creates no binding duty.
While the rules-based international order that was built up throughout the 20th century appears increasingly fragile, the world hasn't lost the ability to write rules together. All is not lost and the machinery appears to still be working for now, it’s just not focused on the spread of frontier AI capability. Far from regulating the frontier, Xi recently proposed establishing a "BRICS AI open-source community". The proposal is widely viewed as Beijing's effort to position itself as the central technology partner for the Global South and to offer a cost-effective, open-model alternative to the "closed" AI ecosystems dominated by US companies like OpenAI and Anthropic.
The takeaway: the countries that would need to be party to an agreement couldn’t be further apart with respect to AI development strategy, regulatory priorities, and interests. Where they do agree: each wants to win the superintelligence race.
The Montreal Blueprint
The Montreal Protocol, which coalesced to address a growing hole in the Earth’s ozone layer, reached universal membership in relatively short order as far as international agreements are concerned.
The container came first. The Vienna Convention of 1985 set up the framework for cooperation, but imposed no binding mechanisms. Eight weeks later, a paper published by British Antarctic Survey scientists linking the discovery of the ozone hole above Antarctica and ozone loss to chlorine chemistry (and CFCs) galvanized the international response. Two years later, countries agreed to the Montreal Protocol, which entered into force in 1989 with only a promise to build a compliance machinery. The permanent compliance body arrived three years later, and by then the regime had already been running on its own momentum for years. Universal membership came afterward. Trade restrictions made staying outside steadily more expensive than joining.
Who Holds the Substitute
While AI offers the building blocks of global cooperation — measurement, verification, a shared fear, and a shared (global) interest in avoiding human extinction — one omission remains.
The Montreal Protocol’s adoption was accelerated by the fact that a dominant producer of CFCs endorsed the limit before signing because it already held the substitute. Its fifth building block held because DuPont, the leading manufacturer of legacy CFCs, was inside the treaty as a US-based company and had developed the chemical substitute (i.e., they were positioned as the beneficiary of the agreement).
Leaving the obvious difference between a physical chemical substitute and large language models aside, frontier AI has no substitute for training compute today. In spite of public pleas to regulate, no lab has yet actively throttled the training of new models.
Frontier AI's nearest thing to a substitute today is not inside any coalition that could write a rule. Moonshot's Kimi K3 and DeepSeek's V4 Pro, both released this summer, close much of the capability gap with Western frontier models at a fraction of the cost. Both were developed in China and sit outside the evaluator regime the 2026 frontier labs have described. A US-only “safe AI” regulation would raise the cost of a new American entrant exactly as cheap, capable alternatives sitting outside its reach absorb global demand.
A Multilateral Agreement Before 2030 Remains Unlikely
Through the end of 2030, I expect no instrument with the authority to delay, cap or halt frontier AI training to take effect in the United States or China. Every instrument impacting the spread of AI capability — including chips, weights and distillation — will stay unilateral or bilateral. Even more unlikely is a multilateral agreement that binds both China and the United States.
Even then, superintelligent AI will surely be model agnostic, or may leverage an entirely different platform, and therein lies the challenge that makes a multilateral regime difficult for anyone locked in the arms race to accept. AI developers (frontier labs or otherwise, many of which have sunk billions in product development) are locked in a Red Queen race to maintain their capability lead. Unilaterally throttling capability development is a pathway to obsolescence. In great power competition, so too must the US and China keep their respective foot on the accelerator, as both remain locked in a cold war-style AI arms race that is unlikely to thaw without a significant shift in current posturing.
The Brakes that Actually Bind
If you're allocating capital toward frontier computing power, the real constraint isn't a multilateral regime, but a complex patchwork of market-access rules that reach across borders. These arise ad-hoc, address different value aspects of the AI value chain, and overlap in ways that are likely to have the effect of moderating AI development.
The EU restricts what can operate in its own market. China controls the point where AI service reaches the public. And the US has, once already, treated access to a model as something to be blocked at the border (e.g., for eighteen days in June 2026, by letter, before backing off).
The EU and Chinese interventions are standing rules. The US’ is a demonstrated willingness to act again, and nothing stops it from doing so. Eventually, a frontier model will have to answer to all three with all three drawing the line in the same place: somewhere between building a model and offering one to the public.
The most practical, reversible step available right now is to take two inventories.
Figure out which side of that line your own operations sit on. Where is the model built, and who are its users? That's answerable today, through contracts and architecture, not forecasting.
Tally how much of your position depends on power, chips, and grid connections. This is the physical infrastructure that none of these rules actually touch.
The first inventory tells you how a regulation may impact you. The second tells you what will determine the outcome regardless of whether any regulation ever arrives.
On the regulatory side, track publications. If the European Commission releases its required list of general-purpose AI models with systemic risk, a private tally becomes a public one. That's the same shape of shared reference point every past multinational agreement has been built around. Recognize as well that it’s also not enough on its own: climate policy already has its published, weighted count and its summary table, which resulted in a duty to report with no authority to actually cap anything. Individual countries enforce their own laws.
These instruments call for regulation, evaluators, and standards, but never a cap on the thing an instrument would actually need to throttle frontier AI capability. A regime that licenses frontier development and audits it against standards written with the licensed companies in the room — that's what a safety framework looks like. It's also what regulatory capture looks like.
Export controls clearly do reach chips. Their intent is to throttle foreign AI development by limiting access to the physical inputs needed to scale capabilities. It is an arms race instrument. The standing US restrictions on advanced chips and chip-making tools are the longest-running policy tool in this whole story, and unlike the June letters, they remain active.
Nothing in these Washington, Brussels, or Beijing’s policies currently shortens a wait for grid connection, or add a single megawatt of power. They can create incentives and mandates, but the market still has to build the physical infrastructure that powers AI growth.
If the algorithmic edge at the frontier keeps narrowing while the physical buildout doesn't, then the real chokepoint — the thing that actually decides who wins the AI race — boils down to power, chips, and grid connections. If AI compute cannot be capped by treaties, hyperscaler capital will continue to mercilessly flood power markets. Expect PPA (Power Purchase Agreement) prices to continue to climb, fundamentally altering the economics of standard energy transition investments and continuing to crowd out non-tech industrial buyers.
The open question that remains is whether there is enough firepower in the models that can be built and operated with available infrastructure to trigger potential global harm.
What Would Prove Me Wrong
Three things I’m watching through 2030:
If a rule takes effect that gives a government or independent body real authority to delay, cap, or halt a frontier training run. This could be in the US, in China, or binding on both. Examples: a license requirement, a compute cap, or a pause trigger with specific conditions attached. Reporting, transparency requirements, voluntary commitments, or EU-only market rules are not enough.
A rule restricting model-weight release, distillation, or diversion of advanced computing takes effect with both the US and China as parties. The key is the rule must bind both countries as the leading developers of the world’s most advanced models.
A G20 framework covering advanced-compute trade takes effect with both the US and China signed on, while coinciding with at least one other warning sign also fires.
Without a substitute for leading AI models, my expectation is that policy proposals will keep outpacing actual rules with teeth, because the leading labs with the most to lose have nothing to trade as a substitute.
Ironically, the one hope for multilateral restraint is something that gives the world a shared, dated fear, and a multilateral body forms in response. More sobering, in all four historical precedents outlined in this letter, the shared, dated fear was never the primary cause for restraint.
Watchlist
1. Commission publication of the Art. 52(6) list. Whether the EU publishes the list of general-purpose AI models with systemic risk its own AI Act requires. The single cheapest route from a private count to a shared one.
2. US-China channel output. Whether any joint statement, standard or testing arrangement emerges from the Bessent-led channel and the September 24 meeting.
3. PRC comprehensive AI law, stage not signal. Whether the law moves from a reserve item to a scheduled first reading before the NPC Standing Committee, China's permanent legislative body, and whether any published draft attaches at training rather than at service provision.
4. US federal instrument log. Federal Register and congress.gov for any license gate, compute cap or pause trigger over a training run, as distinct from reporting and transparency duties.
5. Advanced-compute trade framework at the G20. Whether any multilateral framework covering advanced-compute trade takes effect with both the US and China inside.
6. Appellate Body quorum. Binary: restored or not, base year 2019.
7. Frontier-lab position on a cap. Whether any frontier lab endorses a cap on training compute itself, rather than on evaluation, transparency or pacing tools. The Montreal condition-5 analogue.
8. Open-weight capability compression. Whether Kimi, DeepSeek or another non-aligned open-weight model closes further on frontier benchmarks at continued low cost. Tests whether Montreal's condition 5 stays inverted — the nearest substitute sitting outside any coalition that could write a rule.
Evidence Base
The instrument record is primary or near-primary throughout. EU AI Act Articles 51, 52 and 93 and Recital 112 were read directly. The PRC generative-AI measures were read in Chinese at the Cyberspace Administration's site; the amended Cybersecurity Law's Article 20 was read in the consolidated text at the same site, against the NPC Standing Committee's own amending decision. Four historical cases drew on treaty text where reachable: Montreal Articles 3, 7, 8, 12 and 16 at ozone.unep.org; the Limited Test Ban Treaty's entry into force at the National Archives; the Biological Weapons Convention at UNODA; the IAEA Statute and INFCIRC/153 in full, via mirrors; iaea.org is closed to this project. WTO figures come from its trade monitoring releases and MC14 coverage; the January 2026 instrument, in the Federal Register, is a presidential memorandum, not an executive order.
Three limits stand out. The Montreal industry-turn evidence moved both ways this cycle. Maxwell, Weiner and Briscoe (1997), opened for the first time, dates DuPont's policy shift to September 1986, sourcing the sequence condition 5 rests on; the Alliance's own wording is still unopened, its archive page returning 403 for a third cycle. The same article records DuPont officials saying their patent position did not influence the decision — which is why the causal reading is attributed above as mine. A repeated count of appeals filed into the defunct Appellate Body could not be confirmed against any WTO-official source and was left out entirely, without a caveat. And the ask series is assembled from English-language sources only, a real limitation for a letter asking what the world can agree.
The opening Hugging Face incident rests on the lab's own three disclosure posts (July 21, August 4 and August 26, 2026), press coverage kept as corroboration. The rest of this cycle's added evidence — the G20 positioning, the 10-percent figure, the capture reading, Kimi K3 and DeepSeek V4 Pro — is press-tier throughout (CNN, TechCrunch, The Register, Duke Chronicle, Gizmodo, Washington Post, Axios, MIT Technology Review, Fortune), graded below the primary-document tier the instrument record above holds itself to, and named as such rather than blended in.
About Aroko: Aroko provides strategic advisory and capital allocation intelligence at the intersection of energy transition, technology infrastructure, and geopolitical risk. Our analytical process combines proprietary evidence infrastructure with human-directed thesis formation. Every keystone claim is verified against primary sources, and all editorial judgment and capital allocation framing is conducted by Aroko’s team. The Letter is published biweekly for institutional allocators.
Disclaimer: This article is for informational purposes only and does not constitute financial, investment, legal, or tax advice. The opinions expressed regarding macro trends and infrastructure investments are solely those of the authors. Past performance does not guarantee future results. Readers should consult with a qualified financial professional before making any investment decisions.