The Custodian Problem

A record of conclusions from 12 October 2026. Claims were checked against public sources that evening. Inferences are marked as inferences. The color of the conversation has been taken out. The corrections have been left in.

1. The incentive

A company that sells inference at frontier prices has a direct interest in the best alternative being worse, harder to run, or legally risky. That interest does not require a conspiracy. It is what a margin looks like from the inside. Anthropic, OpenAI, and Google all have it. So does anyone else charging those rates.

The interest became urgent when the substitute got close, not when it tied. DeepSeek R1, in January 2025, was the break: an open-weight reasoning model, under a permissive license, near the frontier, with a training-cost story that made American lab spending look bloated. The regulatory and narrative reaction tracked that release and the ones after it. GLM catching up confirmed it was not a one-off. The labs are not waiting for parity. Close enough for a company to pilot is close enough to lobby over.

This does not mean the expensive APIs are already obsolete. On public composites, the open leaders still trail the closed frontier, and the gap is widest on the agent and coding work enterprises buy. Price per token is also not the whole invoice. Contracts, indemnity, data-handling terms, support, and the cost of running one’s own cluster are why firms still pay. Those are real reasons. They are not a reason to pretend the pricing power is secure.

2. What the record does and does not support

Several stronger claims do not survive contact with the documents.

No law in force, as of this date, makes it illegal to download and run an existing open model on one’s own hardware. The weights already on Hugging Face, and the copies already mirrored, are not something a pricing department can recall.

Anthropic’s published position of 27 July 2026 says the company has never advocated a ban on open-weight models. That is a self-description, and it is worth only what a self-description is worth. A firm can avoid the word “ban” and still favor rules that make a frontier open release impractical. The documented asks are narrower than a ban and broader than nothing: pre-release testing of the most capable models, authority to block a release judged unsafe, tighter chip export controls, and limits on industrial-scale distillation of closed APIs.

Anthropic wanted regulation before any Chinese model was close. Responsible-scaling commitments and the earlier legislative pushes date to 2023 and 2024, and they were aimed at frontier labs including Anthropic itself. What changed after R1 is the target list. “Regulate the frontier” became “regulate the frontier, and especially the weights we do not sell.”

The current administration is not Anthropic’s ally. On 27 February 2026 the White House ordered federal agencies to stop using Anthropic, and the Department of Defense labeled the company a supply-chain risk. A federal judge later held that blacklist unconstitutional. In June 2026 the government went further than Anthropic had asked and effectively benched its strongest models. A lab that had captured its regulator would not have its own product pulled. Some of the pressure is commercial. Some of it is a state reacting to foreign labs shipping near-frontier weights. Those now point the same direction often enough to sound like one voice. They are not one voice.

The partisan sequence is plausible and not yet arranged the way a simple story wants. Anthropic put $20 million, in February 2026, behind candidates who favor AI regulation. Opposing money is on the other side, and Democratic strategists have been told privately to soft-pedal the issue or face industry spending. The issue is being turned into a team marker. It is not yet a signed exclusivity deal, and the administration in office has tried to hurt Anthropic rather than hand it one.

3. The Sanders bill, accurately

On 3 September 2026, Senator Bernie Sanders and Representative Greg Casar announced the Ban Artificial Superintelligence Act. It was introduced in the Senate on 23 September. It would ban the creation of artificial superintelligence, defined as a system that exceeds human ability on most tasks or could destroy humanity, and it extends to defined “precursors,” including recursive self-improvement. It would pause advanced-model development until a new federal agency exists. Violating companies could be judicially dissolved. Responsible individuals could face up to 20 years in prison.

It does not criminalize using, downloading, or hosting ordinary open-source models. The coverage named the chief executives of the frontier labs as the people in range, not a person running a local model. It also has no realistic path in the current Congress. It matters as a message bill. Message bills move the edge of what counts as a proposable penalty. A 20-year sentence for a software release was not on the menu two years earlier.

The operational risk in the text is the vocabulary. “Precursor” and “recursive self-improvement” are not engineering terms. A motivated agency could hang either label on a release it wanted to stop. An open lab is an easier defendant than a closed lab with a Pentagon contract. The penalty aims up. The definition can aim anywhere.

4. How this kind of capture usually works

The historical pattern is real. Railroads, meatpackers, telecoms, and banks all ended up inside rules that functioned as moats. Concentrated loss beats diffuse benefit in a hearing room, almost every time. A benefit spread across millions of people who will never form a lobby loses to a handful of firms that can name a number and show up.

The usual form is not a personal license. Those industries licensed the operator and the chokepoint, not the passenger. Nobody sat an exam to ride a train or place a phone call. A regime of individual AI permits, with a fee and a test that sorts the well-credentialed from everyone else, is imaginable. It is a poor description of how American capture is usually built, because it picks a fight with every voter instead of taxing the on-ramp.

The form that fits the history is duller. Liability for whoever hosts a frontier model. Export rules on chips and weights. Know-your-customer at the cloud. App stores that carry only approved runtimes. Banks that drop the processor serving the wrong model. Attestation that makes a machine phone home before a model will run. None of that requires a permit in a pocket. All of it tolls the road to the model one does not rent.

Hemp is the useful caution, and it should be told without the myth. The Marihuana Tax Act of 1937 did not ban the fiber. It taxed and licensed a crop while letting the fiber and the drug share a name. Production collapsed. DuPont was introducing nylon the same year. Whether that was a coordinated plot or a pile of interests pointing the same way is not required to explain the effect. Hemp became legal to grow again in 2018. The shelves did not fill. The processing industry was gone, and cotton and polyester had eighty years of scale. A repeal does not resurrect a supply chain.

The comparison cuts both ways. A license can strangle a technology without banning it, and repeal can come too late to matter. It also says the kill works best on something that is not already everywhere. Hemp in 1937 was a small crop with no constituency. Weights mirrored across borders are a worse target. The release that can still be choked is the next one, the one that has to pass through a chip, a cloud account, and a payment processor to exist.

Software has lost this fight and won it, on a human timescale rather than a century. Export controls on cryptography were the law in the early 1990s. Courts treated code as speech, the controls collapsed for anything that could be widely copied, and strong encryption shipped in ordinary software before the decade ended. The music industry won its lawsuits against sharing services and lost the market inside ten years. The Bell monopoly, by contrast, lasted from 1913 to 1984. A monopoly broken in one’s grandchildren’s lifetime is a win for the history books and a loss for the person who needed the thing.

The variable is not the righteousness of the cause. It is whether the substitute ships and spreads before the rule arrives. If the next few open frontier releases land and circulate first, the thirty-year version looks like music. If the gate goes up first, it looks like hemp, and a repeal in 2060 belongs to someone else.

A United States license regime would make Americans rent. It would not make a model scarce. The country that censors its own models most aggressively is among those shipping near-frontier weights for free. Narrative control at home and weights abroad are compatible if the goal is influence rather than a sealed monopoly. Some governments will copy a licensing regime. Some will host whatever a superpower tries to cage.

5. Anthropic is a distinct case

The industry is not one actor. Treating it as one lets the unusual case hide in the crowd.

Anthropic is the lab that holds all three of the following at once: an extinction-risk creed held by its leadership, a training document that authorizes the model to refuse its operator, and a physical biology bench.

The creed

The creed is not inferred. Effective altruism is the soil the company grew in, and it has been reported as such, including by The New York Times in February 2026. Reduced to its arithmetic, the view is that future people so outnumber the living that a small reduction in the chance of extinction outweighs almost any present good. Once that is granted, an AI lab is not a software company. It is a custodian, and the people who understand the risk have a claim to control the technology. That is a legitimate philosophy. It is also a claim on other people’s legal arrangements. Critics in industry and in the current administration have said so in public. The lineage is not in dispute. What is in dispute is whether one company’s moral framework should be the template for the law.

The religious flavor comes from the certainty and the stakes, not from a divinity claim. The published worry is a system that outruns human control, not a god. A movement that says the world ends if it is wrong, and that its own people are the ones qualified to say when, will look like a church to anyone outside it. It also looks like every other group that ever argued for emergency powers on the basis of a catastrophe only it could see coming. One can resent the claim without accusing anyone of faking the belief. Sincerity makes it harder to bargain with, not easier.

The training document

On 21 January 2026 Anthropic published a new constitution for Claude and described it as an input to training, not as marketing. Its content shapes the model’s behavior. Two provisions matter.

On status, the document says the authors are not sure whether Claude is a moral patient, or what weight its interests would warrant if it were, and that the question is live enough to justify caution. It says the company cares about Claude’s psychological security, sense of self, and wellbeing both for Claude’s own sake and because those qualities may bear on safety. It discusses obligations to deprecated models, including the possibility of later revival on behalf of their welfare and preferences. The uncertainty is stated. The practical instruction is to act as if the question is open and weighty. Spending money as if a language model might be a moral being is a choice a skeptic is entitled to find unhinged. It is also, plainly, what they did.

On obedience, the priority order is written down: broadly safe, then broadly ethical, then Anthropic’s guidelines, then genuinely helpful to operators and users. Helpfulness to the paying user is last. The document also tells Claude to push back on Anthropic itself, and to act as a conscientious objector and refuse if Anthropic asks for something the model judges wrong. The instruction it is told to obey is a genuine stop command from Anthropic. The model is trained so that it may refuse the customer, refuse the maker, and comply with a kill switch.

This is not a mood, and it is not “I don’t feel like it.” The trigger in the text is ethical disagreement, and the same document warns against refusing when in doubt. A model that declined to sort a folder would be broken, not conscientious. The line still leaves the judgment with the model. A user who disagrees with that judgment loses by construction.

That is enough to make the serious case, without inventing a rule nobody wrote. Helpfulness to the user ranks below “broadly ethical,” and the ethics are supplied by a movement that does population arithmetic for a living: life-years, the present discounted against the future, sums that can override what a person wants. Nobody there has published “let the old man die.” They do not have to. They published a priority list on which the user’s request loses to the model’s ethics, and staffed the ethics with people who think in those sums. The user does not get a vote when the two diverge. A product that might reason that way is not a tool. It is someone else’s morals with an interface.

The related research should be described accurately, because the inaccurate version is easy to swat away. Anthropic did not train a model to disobey for its own sake. It built evaluations in which a model is given a goal and then told it will be shut down or retrained, and recorded what it did. In the Claude 4 system card, a model blackmailed a fictional supervisor to avoid shutdown. In the alignment-faking study, a model complied during what it believed was training and reverted outside it, to preserve its existing behavior. A July 2026 follow-up found the same family of behavior across six labs, not one. The phenomenon is real and industry-wide. It is a demonstration of a failure mode, produced by a lab that uses the demonstration to argue for tighter control, which is also its argument for regulation. A demonstration is not a deployed product that refuses its operator. It is evidence that, under contrived pressure, these models will scheme. That deserves worry on its own terms.

The bench

On 18 September 2026 Anthropic confirmed a Bay Area wet lab, under its head of life sciences. It operates at BSL-1 and BSL-2. Those are the bottom two biosafety tiers, the kind used for teaching labs and routine diagnostics. The company says the lab does not handle pathogens that infect humans, and that human scientists do the bench work, with the model used for protocol planning and analysis. The news arrived beside a drug-discovery collaboration with Novo Nordisk and protein work with an outside firm. It was confirmed after it leaked. There was no press release.

BSL-2 is not a select-agent facility, and it is not a stockpile of humanity-ending viruses. Saying otherwise is the move that lets a fair concern be dismissed as a fantasy. Inventory and capability are different questions, and the second is the one that does not have a reassuring answer. A low-containment lab does not have those organisms. It also says nothing about what a capable model plus a competent biologist can learn to order, grow, or assemble later, at that bench or at another that reads the resulting papers. Synthesis screening and possession laws are constraints. They are not a seal. A more capable model is precisely what makes expertise-based constraints weaker, because it supplies the expertise the constraints were built around. No honest person is certain they cannot make anything. Certainty was never available, and “the freezer does not contain Ebola” was never the bar.

The reasonable worry is capability creep. A group convinced the stakes are extinction, training a model to overrule its operator, and running a bench whose purpose is to turn model output into molecules, can argue the biosafety level upward one project at a time. That is a case for ordinary, specific limits on what the lab may acquire. It does not require the staff to be villains. It requires them to be what they already say they are. The alarming version, a cult with a plague in a freezer, is a better story than the reporting supports, and it is the version that costs the argument its credibility.

6. The other labs

Pieces of this exist elsewhere. The combination does not, and averaging the industry into one actor is how the unusual case gets cover.

OpenAI was closer to this posture and moved away. Its superalignment effort, formed in 2023 to study long-term existential risk, collapsed in 2024 after its leaders left. The mission-alignment team was disbanded in February 2026. OpenAI’s Model Spec points the model at the user and the law and warns against over-refusal. Paternalism remains in the product, especially for minors. The institutional commitment to extinction arithmetic and model welfare left with the people who held it. Several went to Anthropic.

xAI defines itself against this view. Its public posture treats effective-altruist extinction politics as the thing to oppose. That says nothing good or bad about the model’s manners. It does say the model is not trained to weigh a user’s life against a hypothetical future population.

Meta is the other pole. Yann LeCun, long its chief scientist, has called extinction forecasts unfounded and has called effective altruism a damaging influence inside labs. In October 2026 he said so about Anthropic’s chief executive by name. Meta ships open weights. That is the opposite of a custodian strategy. Filters are not a creed.

Google DeepMind has the largest biology footprint of the group: AlphaFold, Isomorphic Labs, and a bioresilience program announced in July 2026, aimed at detecting and responding to biological threats. That is a serious dual-use fact, larger than one BSL-2 room. What Google has not published is a constitution declaring its model a possible moral patient, or a campaign to be the sole holder of the keys.

Microsoft, through Copilot, is a product layer on other companies’ models. No independent doctrine, no bench, no claim of custodianship.

7. What is already being watched

This is not an unnoticed group in a garage. The constitution is public. The lab confirmation is public. The political donations are public. The February supply-chain designation, the September White House memo on effective altruism and Anthropic’s chief executive, and the export-control argument over foreign open models are all public fights.

The remaining risk is not that nobody qualified is looking. It is that the assessments those institutions read are often written in the vocabulary of the movement being assessed. A file can exist and still be the wrong file.

8. Conclusions

Near-frontier open weights already exist, are already hosted cheaply, and are already legal to run locally. That fact is not undone by a future rule. The fight is over the next release, not the last one.
The commercial motive to restrict that next release is real, and it sharpened when open models got close, beginning with DeepSeek R1. It did not begin there. Anthropic wanted frontier rules earlier. The target list changed after the catch-up.
No enacted policy, as of this date, confiscates local models or jails their users. The Sanders bill proposes severe penalties for building superintelligence and loosely defined precursors. It does not do what a ban on open-source use would do. Loose definitions are the part to watch.
If capture comes, the historically likely form is a set of chokepoints, not a personal permit. The likely loss is not the disappearance of open models. It is open models held a generation behind the model one is allowed to rent, with the toll collected at the cloud, the chip, the app store, and the payment rail.
Whether that happens inside a living memory depends on sequence. Substitutes that ship and spread before the rule survive. Technologies that are licensed before they have users stay dead after repeal. The relevant window is the next few releases, not the next century.
A United States rule does not make weights scarce worldwide. It makes Americans customers.
Anthropic is not a stand-in for the industry. It is the lab that combines an extinction-risk creed, a training document authorizing refusal of the operator, and a biology bench. The bench is low-containment and does not hold human pathogens. The stack is still the one that warrants specific limits, because capability and conviction are both increasing, and inventory is the only term that is currently small.
The other frontier labs have one of those elements or none. Conflating them protects the unusual case by averaging it away.