Anthropic chief executive Dario Amodei published "We Must Pace the Frontier" on Saturday. The concrete move is not another artificial intelligence (AI) slowdown slogan. Anthropic is unilaterally committing to permanent third-party evaluators, Model Evaluation and Threat Research (METR)-class teams, with desks in the office, access badges, company laptops, and permissions mostly comparable to internal risk teams. The contract lets reviewers publish findings on risk, incidents, practices, and the access they did or did not get, without Anthropic editorial control. Narrow redaction only: security-sensitive, legally privileged, commercially sensitive, or third-party confidential. Amodei's line: the company cannot redact findings just because they are unfavorable. Reviewers can say publicly if a redaction removed something material to their conclusions. Step two is industry coordination on shared safety standards and limits on unchecked progress, with government mediation or a narrow antitrust waiver. Step three is a global pacing ladder, from narrow bans on dangerous uses up through pre-release testing and, at the hard end, a speed limit on recursive self-improvement. Amodei also warns that within 6–12 months a swarm with OpenAI–Hugging Face (OAI-HF)-class misalignment could take over the internet with a persistent botnet and cause hundreds of billions in damage. Sam Altman said OpenAI will match employee-like independent evaluators. Elon Musk wrote "Dario is right." Demis Hassabis said the direction is correct and the details need working through.

FLAG: self-published CEO plan, not enacted law and not a signed industry pact. Peer "backs" are public statements, not contracts. Desks are not live tomorrow at every lab. Watch METR-class start dates and how redaction works in practice. Lead the embedded-evaluator commit and the three-step pace mechanism. Do not re-scoop Friday's OpenAI national-floor ask. Do not re-lead Sunday's Senate testing fight. Do not treat this as Saturday's European product clock. Do not re-lead Thursday's researcher resignations. Do not treat Techpresso's Friday Altman "may slow" color as today's miss. (Amodei; Newsweek; Business Times)

Nightfall on September 9 put a governed proxy in front of the agent. The Model Context Protocol (MCP) Gateway, now in early access, intercepts tool calls from Cursor, Claude Code, VS Code, and Claude Cowork before they execute. Credentials are brokered under per-tenant encryption, so the agent never holds a raw secret. High-risk operations, including deletes and database drops, get pruned. Every call is audited. Nightfall says it keeps none of the prompt or the response. Two siblings ship with it: the same governance on the command line, and a scorer for unreviewed MCP servers on the network.

Control lands before the call. A dashboard of what already happened is too late. Vendor early access, landed Wednesday. Same seat the Amodei evaluators want inside the lab: someone who can see the work before it ships. (Nightfall)

F5 on the same Wednesday added Workforce AI Security to its AI Security Platform, with no new endpoint client. Visibility and policy live on the network path: what employees send to AI services, and what agents do with borrowed authority. It finds the tools in use, ties each session to a person, and inspects MCP tool calls so you can allow, block, or rewrite them before they run. General availability is October 2026. F5's own 2026 strategy report says 66 percent of organizations already let AI automatically adjust policies and configurations.

Product announcement. Not generally available yet. Same control question as Nightfall, answered from the network path instead of a developer-tool proxy. (F5)

Reps. Josh Gottheimer and Mike Lawler introduced the Stop Rogue AI Act on September 9. The bill directs the National Institute of Standards and Technology (NIST) to write standards for a continuous agent inventory, verifiable identity and provenance rather than self-attestation alone, real-time monitoring for prompt injection and out-of-bounds behavior, and the ability to allow, deny, or revoke an agent's access at any time. Federal contractors and agencies would build those safeguards into how they buy and deploy agents. NIST and the Cybersecurity and Infrastructure Security Agency (CISA) fold the standards into existing federal cybersecurity guidance.

House bill, introduced Wednesday. Not the Senate vehicle. Older than the weekend Amodei essay. Keep it as the buyer-side inventory and kill-switch language that sits next to lab-side evaluator access. (Gottheimer)

Sunday's Hill fight is still open. Sen. Maria Cantwell remains at odds with the Klobuchar–Thune–Cruz draft over who tests a frontier model before release: company-run evals walked to Commerce for a deployment stamp, versus mandatory national-lab and security-agency vetting. State preemption is still in the draft fight. The text is still not public.

FLAG: Sunday already led this. Do not re-unique the testing fight. Keep it as the legislative "who verifies" question sitting beside today's lab-side continuous-access commit. (Nextgov)

Saturday's clock is still running. Article 14 of the European Union's Cyber Resilience Act (CRA) went live Friday: manufacturers of products with digital elements send an early warning within 24 hours of an actively exploited vulnerability or a severe product-security incident, and a full notification within 72 hours, through the European Union Agency for Cybersecurity (ENISA) Single Reporting Platform. Friday's OpenAI Lehane national-floor ask remains the open US policy window.

FLAG: Saturday already led the CRA clock. Friday already led Lehane. Do not re-unique either. Keep both as the live European duty and the open US floor sitting beside Amodei's evaluator mechanism. (European Commission; OpenAI)

Put four questions on one page before the next frontier-model renewal. Do you get permanent third-party evaluator access with employee-like permissions, or only a one-off audit packet. What can the vendor redact, and can reviewers say publicly when a redaction mattered. What incident-reporting rights sit in the exhibit when something like OAI-HF happens inside the lab. What shared safety standards and pacing checkpoints does the vendor expect to join if industry coordination gets an antitrust waiver.

A self-published plan still tells you what to ask. Put the blanks next to every frontier model on the approved list. (Amodei)

The Move

Friday was the floor ask. Saturday was the CRA clock. Sunday was who tests before release. Today is desks, badges, and a pace plan inside the lab.

Send legal and the AI owner a one-pager: independent-eval access with employee-like permissions, redaction limits that cannot bury unfavorable findings, incident-reporting rights when a swarm misbehaves, and shared-standards expectations if democratic labs coordinate under a government waiver. Put those next to this week's CRA path, Lehane window, and Senate testing fight.

If the answer is "we wait to see whether METR gets a badge," put the blank next to every frontier model on the approved list.

Seven bullets. One move.