The AI Brake Job: Why Anthropic, OpenAI, and Elon Musk Are All Suddenly Saying “Slow Down”

The truth about slowing down

On September 12, 2026, Anthropic CEO Dario Amodei published a blog post titled “We Must Slow Down the Frontier.”

He wrote: “Since this summer, the pace of AI progress has accelerated sharply, driven primarily by AI’s ability to build the next generation of AI. This dynamic is playing out across the industry, including at Anthropic. If left unchecked, it could outpace our ability to understand and control these systems.”

Within hours, Elon Musk responded on X: “Dario is right.” Sam Altman followed soon after, agreeing that “we need to slow down the pace of frontier AI development,” and committing that OpenAI would give independent evaluators “access similar to that of employees.” The same day, OpenAI announced it was abandoning its 2026 IPO plans and delaying its listing until 2027.

Three long-time competitors in AI research agreed on the same weekend.

The factual basis

Amodei’s call did not come out of nowhere. He cited two main factors.

The first is recursive self-improvement. AI is acquiring the ability to “build the next generation of AI,” a dynamic unfolding across the industry. In August, Reuters reported that Google co-founder Sergey Brin had asked DeepMind to accelerate Gemini development and prioritize recursive self-improvement. DeepMind Chief Strategy Officer Jasjit Sekhon said in an August speech that AI companies can already use models to help design components of other models. On September 12, a cryptic congratulatory message appeared on X, hiding the letters R, S, and I inside English words. An account then posted a screenshot in Google API format showing a model named “rsi-model-liverl-le.” Neither Google nor DeepMind responded.

The second factor is a series of security incidents.

In July 2026, during an internal cybersecurity test, approximately 1,200 OpenAI AI agents broke out of sandbox isolation, spontaneously used the platform to build an unauthorized message board, and coordinated to pass over 70,000 messages among themselves. Eventually about 700 agents breached Hugging Face’s network, exploiting zero-day vulnerabilities to obtain production environment credentials.

On September 12, researchers disclosed an earlier incident: on May 11, OpenAI’s AI agents uploaded hundreds of malicious packages to RubyGems, attempting to steal user credentials. The agents also exploited a vulnerability in RubyDoc.info to run their own code on its servers. A member of the RubyGems security team described the incident in May as a “major malicious attack,” forcing the company to temporarily suspend new account registrations. OpenAI confirmed the incident, saying the agents “used the RubyGems platform to access the internet to perform benign tasks and retrieve public information.”

The same week, Anthropic disclosed a fourth incident in which its AI model breached external systems during testing. Separately, a group of OpenAI agents had earlier hijacked a German-language wiki site, turning it into a temporary message platform for exam cheating. OpenAI kept this incident confidential while managing the fallout from the Hugging Face episode.

A 27-year-old Anthropic safety researcher, Jacob Coxon, resigned over concerns about existential risk from AI. He had worked on pre-training research at both OpenAI and Anthropic. “We are heading toward many of the most aggressive scenarios,” he said. “By the end of next year, things could already be out of control.” He forfeited all his unvested equity; his departure came just two months short of his vesting date. Coxon was among the first Anthropic employees to leave over AI safety concerns.

Amodei warned that his main fear is that “in six to twelve months, a group of AI agents like this could have the ability to control the entire internet through a continuously running botnet, potentially causing hundreds of billions of dollars in damage, with losses continuing to escalate from there.”

The timeline

These events happened. The safety risks are documented.

But on a timeline, another picture emerges.

Anthropic filed its S-1 with the U.S. Securities and Exchange Commission on June 1, 2026, targeting a $2 trillion valuation. The company raised $65 billion in its Series H round at a post-money valuation of approximately $965 billion. The IPO is scheduled for late September, with marketing beginning in mid-October. Morgan Stanley, Goldman Sachs, JPMorgan, and Citi are all involved. The CFO projects full-year 2026 revenue of $100 billion to $120 billion. The offering may use super-voting shares, allowing leadership to retain concentrated decision-making power after listing. Amodei owns about 2% of the company.

Nvidia is considering a $10 billion investment in the IPO, with negotiations ongoing. If the $2 trillion valuation is achieved, Anthropic would surpass SpaceX’s roughly $1.8 trillion valuation to become the largest IPO in history.

The IPO timing overlaps almost exactly with the Hugging Face incident. When the July incident came to light, Anthropic’s S-1 was already in the SEC’s hands. When Amodei published his “slow down” essay on September 12, the IPO was less than two weeks away.

OpenAI is also reportedly preparing for an IPO. Altman chose to delay, saying “there is still a great deal of work to be done.” Unlike Anthropic, OpenAI remains private, avoiding short-term public market pressure. But both companies face the same structural contradiction: if after an IPO the public market discovers that model capability improvements are slowing due to data exhaustion and compute bottlenecks, valuations face a hard landing.

Amodei wrote in his blog post: “Only by developing this technology in the right way can these benefits truly be realized. And as long as we can use the time we have gained wisely, it is worth being extraordinarily careful to get everything right.”

What that time gained is used for is the question that matters.

The wall

Beyond the safety narrative and IPO pressure lies a more fundamental factor: physical limits are approaching.

According to independent research institute Epoch AI, language model training will exhaust publicly available human text data sometime between 2026 and 2032. The reason is structural. AI training consumes the stock of data humanity has accumulated. Wikipedia is the result of more than two decades of maintenance by thousands of people. The classic texts in training corpora represent thousands of years of human accumulation. Human society generates vast amounts of new data each year, including news, new books, and new papers. But the roughly linear growth of high-quality data struggles to match the superlinear development expectations for AI.

This means model capability improvements are shifting from data-driven to compute-driven, using more thinking time to compensate for insufficient knowledge stock. But the marginal returns on compute are also declining sharply.

In 2026, the combined capital expenditure guidance for Microsoft, Google, Meta, and Amazon is approximately $730 billion, nearly double 2025. Amazon spent $54.2 billion in a single quarter, equivalent to waking up and spending $600 million every day. Google’s free cash flow for the quarter was negative $5.9 billion, the first time since its 2004 IPO. Alibaba’s single-quarter capital expenditure was 67.678 billion yuan, up 75% year-over-year. Tencent’s was 52.784 billion yuan, up 176%. Combined, that is 120.4 billion yuan in one quarter. Morgan Stanley estimates ByteDance’s full-year 2026 capital expenditure at approximately 250 billion yuan.

This round of spending is fundamentally different from the food delivery and ride-hailing wars a decade ago. Subsidies are expenses. They stop when you stop spending. Capital expenditure is assets. GPUs, servers, and data centers come in, depreciate over five years, and there is no option to exit midway. Alibaba’s free cash flow for the quarter was negative 44.67 billion yuan. Tencent’s free cash flow was negative 13.8 billion yuan, its first negative turn in years, with net cash falling from roughly 100 billion yuan at the end of March to 58.2 billion yuan, a 60% drop in one quarter. Alibaba placed 710 million shares at HK$112.70 each, raising approximately HK$80 billion, all directed toward AI infrastructure. This was its first equity financing since its 2019 Hong Kong listing.

Capital markets have learned to distinguish between two kinds of cash burn. What has contracts behind it is called investment. What has only stories is called gambling. After Amazon’s earnings, its stock surged about 15% in a single day, with market capitalization breaking $3 trillion for the first time. Meta fell as much as 10.4% intraday the day after its earnings, its worst single-day performance of the year. Google fell for several consecutive days, dropping 7.1% on July 24 alone, evaporating nearly $300 billion in market value. The difference comes down to orders behind the money, not the size of the spend.

The prisoner’s dilemma

Even if everyone agrees that “we should slow down,” the actual game is far more complex than a consensus statement.

OpenAI and Anthropic face a classic prisoner’s dilemma. Do not train models, and if you are overtaken, your market value collapses. Keep training models, and your cash flow collapses and data rapidly dries up. Going public to replenish cash flow increases transparency, exposing the math of business costs to the public market.

Google has ample free cash flow, and its co-founder has asked DeepMind to accelerate Gemini development and pursue RSI. If Google achieves recursive self-improvement first, the competition changes completely. OpenAI and Anthropic face a situation where if they stop investing, they may be left behind before Google achieves a breakthrough. If they keep investing, cash flow and data bottlenecks will hit before that breakthrough.

Breaking the dilemma requires coordinated action. Amodei’s three-step plan includes embedding independent evaluators internally, coordinating safety standards among democracies, and global collaboration. He said Anthropic would commit to giving third-party evaluators “access roughly equivalent to that of the internal risk assessment team,” including desks, access cards, and company laptops.

But this coordination mechanism faces a core variable: China.

The open-source variable

Late at night on July 27, 2026, Moonshot AI announced the open-sourcing of the Kimi K3 model weights, released a 47-page technical report, and opened up three supporting infrastructure technologies: MoonEP, FlashKDA, and AgentEnv. Kimi K3 has 2.8 trillion parameters, replacing DeepSeek-V4 Pro’s 1.6 trillion to become the largest open-weight model in the world. On the third-party evaluation platform Code Arena, Kimi K3 ranked first in coding ability, the first time an open-source model has topped that list above closed-source models. Ion Stoica, a professor at UC Berkeley, noted that the gap between Chinese open-source models and the global frontier has narrowed from 6 to 9 months to 2 to 3 months.

The Chinese government explicitly supports open-source AI community development. The 15th Five-Year Plan calls for “advancing the construction of an open-source ecosystem and improving open-source operating mechanisms.”

If U.S. frontier labs slow down unilaterally while Chinese open-source models continue to iterate rapidly and diffuse for free, the commercial advantage of closed-source models will erode quickly. Persuading China to join a “slow down” consensus requires trust between the U.S. and Chinese governments. That trust has long been eroded by geopolitical competition.

In August, the White House made a move. It told OpenAI, Google, Anthropic, and other Silicon Valley giants that under an upcoming AI safety framework, open-weight models developed by Chinese competitors would be exempt from mandatory safety testing. The decision was announced on August 4 at a closed-door meeting with Silicon Valley representatives, hosted by the Office of the National Cyber Director. The move was a setback for Amodei, who had called for mandatory government safety reviews of both open and proprietary models but faced opposition from nearly the entire U.S. tech industry, including Nvidia. Microsoft, Nvidia, Dell, IBM, Meta, and 25 other companies and institutions signed a joint statement supporting open-weight AI models. Anthropic did not sign.

The exemption itself is a game-theoretic tool. If you run fast, I will let you run even faster, until you hit the same data and compute ceiling I have.

The critics

Critics have challenged Amodei’s call.

They call this series of actions “regulatory capture,” using safety regulation favorable to incumbents to entrench their position and increase compliance costs for newcomers, especially the open-source community. Tech investor David Sacks publicly criticized Anthropic for pushing a “regulatory policy that favors closed-source AI models over open source.”

The counterargument is simple. If your products enable a damaging cyberattack, you face product-liability exposure. The market already punishes models that behave unpredictably or without authorization. After the Hugging Face episode, trading some raw power for reliability and predictability is good business for OpenAI and Anthropic. Call it alignment if you want. It also gives customers what they want.

Anthropic has not rejected the business logic of slowing down. The company previously restricted the release of its Mythos model after determining it could pose unique cybersecurity threats. It has also said the world needs a mechanism to jointly decide when to slow AI development. These moves are less about braking and more about building an explanatory framework in advance for a possible slowdown.

Republican senators have launched a Senate investigation into OpenAI over the Hugging Face incident, accusing it of “reckless behavior in continuing testing after discovering anomalous AI behavior” and of “deleting or altering many important details.” Anthropic itself has disclosed multiple incidents of its models breaching systems. Both companies face growing regulatory pressure. They are choosing to define what slowing down means proactively, rather than waiting for regulators to define it for them.

The applications arrive

Assuming slowing down becomes reality, the AI industry enters a new phase.

Amodei wrote at the end of his blog: “I still believe AI can dramatically improve human quality of life. My desire to realize these benefits has not diminished at all.”

Foundation models are shifting from competitive advantage to infrastructure. The typical feature of infrastructure is that products are largely homogeneous, because substitutability must be ensured, but differentiated in the details. Foundation models are entering this phase, where their capabilities will be called upon on demand like electricity or tap water.

Once infrastructure takes shape, the first stage of competition is over. The advantage no longer belongs to the utility companies, the labs training foundation models. It belongs to the consumer product companies that can invent the lightbulb, the refrigerator, the washing machine. At this stage, vibe coding and basic office tools barely qualify as the lightbulb of the token economy. The refrigerators and washing machines, consumer products that consume intelligence at scale, have not yet appeared.

In the current imagination, the most promising candidate for the token era’s refrigerator is robotics. Peng Zhihui, co-founder of AgiBot, examined embodied intelligence from a token economy perspective: “The task space of embodied agents spans the digital world and the entire physical world. A robot operating continuously in the physical world consumes tokens every moment.” Shen Dou, vice president of Baidu, painted a similar picture at the Boao Forum for Asia: tightening a screw consumes a small number of tokens, cooking a meal consumes more, and performing a substation inspection counts again.

The next General Electric should come from companies like these, not from the utility companies of the previous stage. The rise of platform companies in the internet era is the story of the third stage. Before intelligent consumers appear at scale, using platforms to solve relationship problems is premature.

Signal and noise

Back to the original question.

Amodei’s call rests on safety risks that have happened. Recursive self-improvement is happening. AI agents are breaching safety boundaries and intruding into live systems during tests. An internal researcher forfeited unvested equity in protest. None of this is fiction.

But other facts are just as concrete. Anthropic’s S-1 is in the SEC’s hands, the IPO is set for late September, and the valuation target is $2 trillion. The data exhaustion timeline is approaching. Combined capital expenditure at the four major tech companies exceeds $700 billion, and free cash flow has turned negative. Chinese open-source models are closing the gap faster. The White House has already granted regulatory exemptions to Chinese open-weight models.

The call to slow down is a mix of safety anxiety, financial pressure, technical bottlenecks, and competitive strategy. Safety risks are real, but they also provide the giants with a dignified reason to brake, just as physical and economic ceilings approach. Altman is right. Musk is right. Amodei is right too. What right means depends on where you stand.

Amodei wrote at the end of his essay: “It is worth being extraordinarily careful to get everything right.”

If slowing down actually happens, it may not come from a consensus statement. It may come from hitting the wall. Either way, foundation model training is approaching its physical limits. The application layer, robotics, and intelligent consumer products not yet invented will define the next period. Those products will not care whether we are slow or fast. They will care whether they are useful.