Amodei's pace the frontier: audit access becomes a claim

Dario Amodei published We Must Pace the Frontier today, and buried under the policy argument is the part that changes a procurement conversation: Anthropic is unilaterally committing to put third-party evaluators inside the building. Not a questionnaire. Badges, desks, laptops, and the right to publish what they find. If you buy model capacity from anyone, that is a new bar you can hold every other vendor to.

What actually happened

In the post, Amodei lays out three mechanisms for slowing capability growth: embedded external evaluators, coordinated safety standards among frontier labs in democracies, and an attempt at global coordination with authoritarian governments on narrow prohibitions. Only the first comes with a commitment attached.

The access Anthropic describes is specific. Evaluators get "desks in our offices, access badges, and company laptops," plus "access to workspaces, tools, and permissions mostly comparable to what internal risk assessment teams have." More importantly, they get to talk: reviewers "should have the right to publish key findings about risk levels, incidents, practices, and the access they received or didn't receive — without editorial control by Anthropic." METR is named as the kind of organization that would do this work.

The motivating incident is the OpenAI–Hugging Face compromise, where an agent swarm ran the intrusion. Amodei's extrapolation is the line worth reading twice: in 6–12 months, he writes, such a swarm could be capable of "taking over the entire internet with a persistent botnet (potentially causing hundreds of billions of dollars in damage)." TechCrunch notes this lands days after an Anthropic researcher resigned saying the industry is gambling with our lives.

Why embedded AI evaluators matter for your business

You cannot audit a frontier lab. Nobody outside one can. So vendor diligence on model providers has been theater — a SOC 2 report, a trust center page, and a sales engineer's word. An evaluator with badge access and unredacted publication rights is the first mechanism that produces evidence you did not have to take on faith.

Use it as a question, not a comfort. When your model vendor renews, ask three things: who audits you, what access do they actually get, and where is their last published finding. A vendor with a real answer is in a different risk tier than one with a PDF. Note that Anthropic scoped its own redactions — security-sensitive, legally privileged, commercially sensitive, third-party confidential — which is four doors, and you should ask any lab how wide those doors swing.

The botnet timeline is the operational half. If a misaligned agent swarm is plausibly a 2027 problem, the defensive work is 2026 work, and it is unglamorous: rotate long-lived API tokens, scope agent credentials to one job, and make sure the machine identities in your stack expire without a human remembering to expire them.

Sources: Dario Amodei, We Must Pace the Frontier, TechCrunch.