This episode marks the securitisation of AI safety. Once defined as strategic infrastructure, safety constraints are subordinated to national-security interpretation. That shift is difficult to reverse.

I. Anthropic rejects the DoW ultimatum

II. Anthropic ties AI safety to the industry standard

III. Influence of the executive branch of the US government on AI safety grows

The Red Line: Where does AI safety go from here

I. Timeline: Anthropic rejects the Department of War ultimatum

Feb 24: Anthropic publishes RSP v3.0

Three days before the standoff, Anthropic moved its safety standards from independent to floating. Safety commitments are now pegged to competitors.

From the RSP v3.0: “The distinction between our plans as a company and our industry-wide recommendations reflects the limitations of any single AI developer’s ability to ensure safety across the industry. In particular, we cannot unilaterally and unconditionally commit to staying in line with the industry-wide recommendations.”

The document received little public attention at the time.

Feb 25: Ultimatum issued

After a private meeting at the White House, the US secretary of war, Pete Hegseth, gives Anthropic’s chief executive, Dario Amodei, a 5.01 pm Friday deadline to provide the Department of War unrestricted military use of its AI technology. This includes removing Anthropic’s two red lines on fully autonomous lethal weapons and mass surveillance. Amodei is told that refusal could trigger the Defence Production Act, designating Anthropic a supply chain risk, a status typically associated with adversaries of the US.

Feb 26: Anthropic publishes a statement

“Regardless, these threats do not change our position: we cannot in good conscience accede to their request.”

Anthropic says it was the first frontier AI company to deploy models in US government classified networks and that Claude is widely deployed across the Department of War and other national security agencies for mission critical applications, including intelligence analysis, modelling and simulation, operational planning and cyber operations.

The Department of War rejects this framing. The Department had previously accepted Anthropic’s usage policy. The immediate trigger appears to be the January AI strategy memo directing Defence Department contracts to incorporate “any lawful use” language within 180 days. In that context, Anthropic’s refusal becomes an enforcement event for a policy decision already taken.

Feb 26: OpenAI internal memo leaks

Sam Altman writes in a leaked memo that OpenAI shares Anthropic’s red lines, while confirming ongoing negotiations with the Department of War. Ninety six OpenAI employees and 646 Google employees sign an open letter.

Feb 27 ~5pm: Deadline passes without a deal

Feb 27: Hegseth designates Anthropic a “supply chain risk”

“In conjunction with the President's directive for the Federal Government to cease all use of Anthropic's technology, I am directing the Department of War to designate Anthropic a Supply-Chain Risk to National Security. Effective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic. Anthropic will continue to provide the Department of War its services for a period of no more than six months to allow for a seamless transition to a better and more patriotic service.

America’s warfighters will never be held hostage by the ideological whims of Big Tech. This decision is final.”

Hegseth’s statement frames safety constraints as ideological rather than technical or legal. That framing matters because it declines to engage Anthropic’s position on its own terms.

The commercial consequence is direct. The statement prohibits contractors, suppliers or partners that do business with the US military from conducting commercial activity with Anthropic. Anthropic was reportedly tracking towards revenue parity with OpenAI, and that trajectory, including an eventual IPO pathway, becomes less certain under a de facto ecosystem restriction.

The designation also formalises an emerging reality. The US government, not frontier labs, sets the operative terms of national security deployment. The more relevant question for AI safety frameworks is whether they still assume labs are the primary unit of governance.

Feb 27 night: OpenAI deal with DoW

Altman writes “tonight, we reached an agreement with the Department of War”.

OpenAI publishes the following clause

“The Department of War may use the AI System for all lawful purposes, consistent with applicable law, operational requirements, and well-established safety and oversight protocols. The AI System will not be used to independently direct autonomous weapons in any case where law, regulation, or Department policy requires human control, nor will it be used to assume other high-stakes decisions that require approval by a human decisionmaker under the same authorities. Per DoD Directive 3000.09 (dtd 25 January 2023), any use of AI in autonomous and semi-autonomous systems must undergo rigorous verification, validation, and testing to ensure they perform as intended in realistic environments before deployment.

For intelligence activities, any handling of private information will comply with the Fourth Amendment, the National Security Act of 1947 and the Foreign Intelligence and Surveillance Act of 1978, Executive Order 12333, and applicable DoD directives requiring a defined foreign intelligence purpose. The AI System shall not be used for unconstrained monitoring of U.S. persons’ private information as consistent with these authorities. The system shall also not be used for domestic law-enforcement activities except as permitted by the Posse Comitatus Act and other applicable law.”

The critical phrase is "where law, regulation, or Department policy requires human control." It means the Department of War retains discretion to define when its own policy requires human control. The clause defers to internal policy rather than creating a constraint external to the Department. By week’s end, neither CEO retained unilateral control over how their systems would be deployed in national-security contexts. The question is not whether Altman or Amodei acted in good faith. It is whether good faith is the relevant variable.

Feb 27 night: Anthropic announces lawsuit

“No amount of intimidation or punishment from the Department of War will change our position on mass domestic surveillance or fully autonomous weapons. We will challenge any supply chain risk designation in court.”

II. Anthropic ties AI safety to the industry standard

By tying its safety commitments to industry baselines, Anthropic implicitly accepted that those baselines could shift under political pressure. That is what happened this week.

OpenAI’s deal states the same red lines Anthropic sought: no mass domestic surveillance, no autonomous weapons direction, and no high stakes automated decisions. However, the enforcement mechanism is internal to OpenAI and the Department of War. It relies on cloud deployment, vendor controls and policy compliance rather than an external, independently enforceable constraint.

At capability parity, the safety standard is set by whoever deploys fastest with the fewest restrictions. The floor is defined by the most compliant actor. And Anthropic’s new RSP now benchmarks to that standard.

The OpenAI contract doesn't resolve the question Anthropic raised. It dissolves it. Anthropic's argument was that existing law has not caught up with AI. That mass surveillance can be conducted legally using publicly available data aggregated at AI scale, in ways the Fourth Amendment does not yet prohibit. OpenAI's contract says it will comply with the Fourth Amendment. That's not an answer to Anthropic's concern. It's a restatement of the question.

III. Influence of the executive branch of the US government on AI safety grows

The administration has demonstrated both the will and legal mechanism to enforce AI procurement terms on domestic companies. The DPA based supply chain risk designation, applied to a domestic firm declining to modify its own product, is without direct precedent. Its legal durability is untested, but its deterrent effect is immediate. Other frontier labs will surely have received the message.

The key question is not whether the executive branch can set military procurement terms. It can. The key question is whether the executive branch has the institutional capacity to assess the risks of what it is authorising on the timelines it is demanding. The January memo reportedly mandates deployment of leading models within 30 days of public release. In that model, the safety assessment is performed by the customer about a product it has already decided to buy.

The lab centric model of AI safety assumed labs would be the primary red line backstop. This week suggests frontier labs either accept government terms or lose contracts, revenue and classified access.

To date, Congress has not produced binding AI safety legislation. In the absence of statute, procurement contracts become the primairy governance instrument.

The Signal: The AI safety shift

The standoff clarifies where AI safety actually resides: in statute, in courts, or in executive policy. Currently, only one of those three has operational enforcement weight.

Scenario 1: Congressional intervention

What this looks like: Bipartisan legislation defining non-negotiable AI constraints and curtailing executive discretion.

Why this has low-probability: Congress failed twice to pass a moratorium on state AI laws. The bipartisan resistance (99 votes to 1 in the Senate) is sometimes read as evidence that AI safety has cross-party support. It is more accurately read as resistance to federal preemption of state authority. When the moratorium failed legislatively, the administration moved to achieve the same outcome through executive order and DOJ litigation. Deregulation and executive control are not competing impulses here. They are the same impulse. The pattern is consistent: reduce the number of actors with enforceable authority over AI, and concentrate what remains in the executive branch. A governance field cleared of state law, congressional statute, and lab-defined constraints leaves one remaining authority — the one issuing the procurement contracts.

Scenario 2: Court constrains executive overreach

What this looks like: Anthropic wins in court, the supply chain designation is narrowed, and frontier labs regain partial autonomy.

Why this has medium-probability: The legal question is novel. Can the executive branch designate a domestic company a national security risk for declining to modify its own product? While the case moves through courts, every other frontier lab is deploying under the terms Anthropic refused. The legal remedy and the competitive consequence run on different clocks.

Scenario 3: Executive dominance consolidates

What this looks like: All frontier labs accept “lawful use” clauses, safety becomes national-security aligned and corporate-governance RSP frameworks become symbolic.

Why this has high-probability: xAI is the only frontier lab that bid on the Pentagon's autonomous drone software contest. OpenAI explicitly excluded drone control, weapon integration, and target selection from its own bid. The "lawful use" clause lands differently depending on who signed it. This is the base case. While Anthropic enters a six-month wind-down period, OpenAI and xAI hold active contracts and Google DeepMind negotiates its position. The leading indicator is Google DeepMind.

AI safety research can no longer treat the lab as the primary unit of analysis. The relevant actors are now the executive branch (sets permissibility), procurement contracts (operationalise it), and courts (may constrain it). Technical governance that ignores this triangle will misread the field.

As 2025 ends, open-model dynamics show a clear pattern: US ↓, China ↑, SLM/LLM ↑, open-source ↓, open-weight ↑, non-industry developers ↑, and corporate developers ↓.

Closed models dominate 80% of token usage and 95% of revenue.1 Why does it matter what happens in open models?

Because open weights determine who catches up, when, and at what cost.

The Red Line: China Has Momentum In Open Models

2025 Trend I: US ↓ | China ↑

Until 2022, the open ecosystem was highly concentrated and US-led. Around 60% of open models originated in the US, with Google, Meta and OpenAI accounting for 40-60% of cumulative downloads. From 2022 onwards this share fell sharply.2

Llama 3 outperformed Chinese open models until mid-2024. From late 2024 China’s position strengthened.

In November 2025, Hugging Face data showed China surpassing the US in downloads for the first time (17.1% compared with 15.8%).

Qwen and DeepSeek together accounted for 14%.

Alongside these, model families such as Mistral (France), Gemma (US), Phi (US) and Yi (China) now anchor the open ecosystem.

Why this matters

The leading open model sets the baseline that levels the field

In 2024-25, US firms released fewer open-weight models, citing commercial and safety constraints. Llama’s licences became more restrictive. This created space for Chinese laboratories, which treated open-weight leadership as a deliberate catch-up strategy.

Rising Western use of Chinese models

Startups use open models to avoid lock-in, reduce cost runway, and retain model governance control. Some US venture capital estimates suggest that around 80% of new start-ups use Chinese alternatives at some point. This produces reverse knowledge transfer.

Open-models feed on global innovation

Large user bases provide bug reports, fine-tuning and rapid iteration. DeepSeek’s January release showed how a frontier open model can accelerate domestic innovation and narrow foreign advantage.

Limited effectiveness of export controls

Weights, once released, can be freely used by others, including parties that may not have been able to train a cutting-edge model themselves because of export controls on hardware.

Faster Chinese release cycles

Qwen and DeepSeek release more frequently across more branches, averaging roughly one major family or revision per quarter. Llama’s cadence is slower and more deliberate. Faster cadence increases ecosystem pull. Together, these factors shifted the centre of gravity of the open-model ecosystem towards China during 2024-25.

Soft power through defaults

Defaults carry embedded assumptions. US evaluations of DeepSeek R1-0528 show weaker safety performance than US frontier models: agents were twelve times more likely to follow malicious instructions and jailbreak success rates reached 94% (against 8% for US benchmarks).3 Developers adopting Qwen or DeepSeek inherit not only technical defaults but also safety norms and constrained topic coverage. Similarly, Western models reflect Western, individualistic and democratic assumptions.4

2025 Trend II: SLM/LLM ↑

SLM refers to a model small enough to train or run on commodity hardware, with a practical ceiling of around 10-15bn parameters. LLMs require frontier compute, with a floor of roughly 30-40bn parameters but scaling to trillions of parameters.

SLMs increasingly dominate local, on-device and high-frequency tasks, while LLMs dominate non-local, cloud-scale and cross-domain tasks. Small models are faster, cheaper to run and easier to fine-tune. Microsoft’s Phi, Google’s Gemma, Meta’s Llama and Alibaba’s Qwen all offer models in the 1.5-7bn range. Some model families span both layers; others specialise. In the West, the Llama family (1bn-405bn) comes closest to Qwen’s breadth (0.5bn-110bn), with Mistral providing the most specialised open models and Gemma offering the strongest small-model analogue.

Hugging Face data show that the mean size of downloaded open models rose from 827m parameters in 2023 to 20.8bn in 2025, while the median increased only marginally (from 326m to 406m).

This indicates that high-end LLM users are pulling up the mean, while underlying SLM usage remains relatively stable.

“Large” does not mean “general”. “Narrow” versus “general” describes the scope of cognition; SLM and LLM are engineering labels for size and compute. High-quality SLMs such as Phi, Gemma and Qwen remain small but moderately general. The rise of capable SLMs shifts autonomy closer to the edge, reducing dependency on sovereign cloud providers.

Why this matters

Open-weight models lag state-of-the-art by around 3 months on average

Sometimes it is six months; sometimes it is zero. At the same time, the mean size of created models now exceeds the mean size of downloaded models, which means developers are building larger systems than most deployers can yet run. The implication is that by the time a closed model is widely deployed, open equivalents are close behind, or even ahead.

Countries without frontier compute can still lead in SLMs

This year showed that frontier LLM leadership does not guarantee monopoly over all deployment.

SLMs could host local, low-latency autonomy

Robotics, vehicles, industrial systems and personal devices need low latency. This makes SLMs a plausible host for early autonomous behaviour in constrained settings.

Risk surface expands in two directions

Proliferation of SLMs creates local, low-cost misuse that is hard to monitor. Concentration of LLMs creates strategic dependence on a small set of labs and sovereign clouds.

2025 Trend III: Open-source ↓ | Open-weight ↑

Open source and open weight are not the same. Open weight is usable by everyone: anybody can fine-tune the weights. Open source is usable and understandable by everyone: code, data and training method are available for inspection and reproduction.

In 2025, open weight models surpassed true open source models for the first time.

Llama, Qwen and DeepSeek are open weight, not open source. The share of downloads for models with disclosed training data fell from 79.3% in 2022 to 39% in 2025.

Closed models still account for most usage and revenue even though they are six times more expensive than open alternatives and no longer enjoy a wide performance edge. If price and performance were the only criteria, users would shift faster.

Why this matters

Safety black-boxes

Reduced data disclosure makes long-term risk assessment harder and limits independent verification of safety claims.

Global South ecosystems grow outside Western policy reach

Countries that cannot train LLMs can still build powerful SLM/LLM hybrids locally. Western safety, export, and governance regimes do not reach these decentralised adopters. Because open weights reduce the transparency that international regulation needs, this draws such models into national policy and away from international governance. Once models are widely forked and fine tuned, jurisdictional responsibility becomes difficult to establish.

Licensing tug-of-war

The more the US tightens terms of service, the more attractive open alternatives become. Simpler licences from Qwen and others reduce switching costs. Llama succeeded despite restrictions; Chinese families now pursue the opposite strategy.

The agent wrapper problem

Agentic frameworks can turn modest SLMs into high-impact autonomous systems without increasing parameter count. This sits largely outside regulatory proposals and increases the unpredictability of local deployments.

2025 Trend IV: Independent, international, and unaffiliated developers ↑ | industry ↓

Industry’s share of development fell from around 70% before 2022 to 37% in 2025, according to HuggingFace. As industry’s share has fallen, the “international/online” category has grown to 23.8%. This suggests a significant ecosystem of actors beyond the US and China. Independent or unaffiliated users rose from 17% to 39% over the same period, at times accounting for more than half of all downloads. These intermediaries determine which models typical users can run and how innovations spread.

Why this matters

Decentralisation increases mutation

More forks mean higher probability of emergent behaviour.

Governance designed for firms does not fit communities

Governance regimes assume corporate intermediaries, but the 2025 reality is decentralised and geographically distributed communities.

Maintainer fragility

Open-source communities learnt the risks of a “long tail” maintained by small teams. Open-weight ecosystems face similar fragility, with the added incentive of offensive exploitation by both state and non-state actors. Open source had to build institutions like the Linux Foundation and OpenSSF once critical infrastructure depended on community code; open models are heading in the same direction.

The Signal: Chinese Open Model Diffusion

Open models determine who catches up, even if closed models determine frontier performance. With major governments declaring diffusion a priority, open model dynamics provide early visibility into how it will unfold.

Without a strategic shift, these trends will continue into 2026: as adoption grows, switching costs rise and developer tooling shifts to the dominant family. The longer the US waits, the higher the cost of regaining influence. China’s role in shaping open-model safety defaults means it must now be included in any credible AI safety framework.

Signal 1: Default-stack shift

• What to watch: when China’s open-weight stack becomes the global default.

• How to measure: share of non-Chinese downloads using Chinese open-weight families (Qwen/DeepSeek) vs alternatives (Llama/Mistral/Gemma).

Signal 2: Open-closed performance gap

• What to watch: how long export controls and frontier agreements delay diffusion.

• How to measure: median months between a new closed frontier model and the first open-weight model within 5–10% of performance.

Signal 3: Open-closed safety divergence

• What to watch: whether open-weight model safety converges with or diverges from frontier norms.

• How to measure: safety evaluations across the five largest open-weight families.

Open models are becoming the weak point in US AI dominance. China is now the dominant open stack, but not yet the default stack. Reversing the trend in 2026 will require a different strategy.

On November 24 the White House launched The Genesis Mission via Executive Order, which might mark the beginning of the first sovereign scientific AI system.

The focus of the Genesis Mission is acceleration and application of transformative scientific discovery on pressing national challenges.

This Brief breaks down a uniquely consequential AI Executive Order.

AI rests on three inputs: data, compute and algorithms. This plan integrates the first two: federal data and federal infrastructure. This is the part of the stack big tech cannot influence. By extending conditional access to this otherwise inaccessible resource, the US government gains what it has been missing: control of frontier (scientific) models. By prescribing national priority domains, Genesis pre-commits scientific AI to state-defined use-cases rather than lab-defined ones.

With one program, the US government makes a big swing to reclaim control over the direction of AI from the labs.

The idea is not unique. The UK launched AI for Science one day earlier, on November 23. Scope and ambition, however, vastly differ. Where the UK targets 2030 as completion for data collection across UKRI-owned facilities, labs, and institutes; the Genesis Mission expects the first data plan at 120 days, with operationalisation of the first national priority following at day 270.

The White House wants Genesis to double the productivity of US research within a decade. Why does this programme matter far beyond scientific research?

The Red Line: Policy Analysis of the Genesis Mission

The White House is taking control of the security standards and diffusion pathways of scientific AI.

We’ll follow the implementation timeline to break down the EO highlights.

At 60 days: redirection of diffusion priorities

“Within 60 days of the date of this order, the Secretary shall identify and submit to the APST a detailed list of at least 20 science and technology challenges of national importance that the Secretary assesses to have potential to be addressed through the Mission and that span priority domains consistent with National Science and Technology Memorandum 2 of September 23, 2025, including:

(i) advanced manufacturing; (ii) biotechnology; (iii) critical materials; (iv) nuclear fission and fusion energy; (v) quantum information science; and (vi) semiconductors and microelectronics.”

Why this matters:

• These challenges signal what the US government expects scientific AI to do before frontier models become general-purpose.

• It will shape what foundation models are fine-tuned for, which sectors get priority access, and which industries get first-mover advantage.

• This list is a strategic complement to US semiconductor controls and military supply chain resilience. By placing critical materials, nuclear, fusion and advanced manufacturing at the centre, the US is aligning AI with the domains that determine industrial and military advantage. We wrote about the imperative for the US to reduce foreign dependency in the China rare earth brief.

• For the AI safety community, Genesis could be a window to find common ground with the administration on narrow and scientific AI. Performance of domain-specific scientific foundation models could anchor these discussions. If narrow AI exceeds expectations, the effect on public support for racing to AGI is an unknown.

At 90 days: public-private partnerships announced

“Within 90 days of the date of this order, the Secretary shall identify Federal computing, storage, and networking resources available to support the Mission, including both DOE on-premises and cloud-based high-performance computing systems, and resources available through industry partners.”

Why this matters:

• This formalises a closer Silicon Valley–Washington collaboration.

• The platform will be closed-loop. It’s in or out.

• The US government will control security requirements.

• This is a giant sandbox to experiment with AI compliance (security, privacy, export-control) and get first-hand information on trade-offs.

“The Secretary shall take necessary steps to ensure that the Platform is operated in a manner that meets security requirements consistent with its national security and competitiveness mission, including applicable classification, supply chain security, and Federal cybersecurity standards and best practices.”

• The collaborator list matters because these firms are volunteering to operate under federal security conditions. This compliance corridor could act as a flywheel for wider adoption of federal standards.

Albemarle, AMD, Amazon Web Services, Anthropic, Applied Materials, Atomic Canyon, AVEVA, Cerebras, Chemspeed, Cisco, Collins Aerospace, ComEd, Cornelis Networks, Critical Materials Recycling, Dell Technologies, Emerald Cloud Lab, EPRI, Esri, FutureHouse, GE Aerospace, Google, HPE, Hugging Face, IBM, ISO New England, Kitware, LILA, Micron, Microsoft, MP Materials, New York Creates, Niron Magnetics, Nokia, NVIDIA, Nusano, OLI Systems, OpenAI for Government, Phoenix Tailings, PMT, Critical Metals, Qubit, Quantinuum, RadiaSoft, Ramaco, RTX, Sambanova, Scale AI, Semiconductor Industry Association, Siemens, Synopsys, TdVib, Tennessee Valley, Authority and xLight.

• The Department of Energy has unified 17 national laboratories—over 40,000 scientists, engineers and technical staff—into a single scientific AI programme. Combined with partners this amounts to a monumental effort.

At 120 days: initial data inventory complete

“Within 120 days of the date of this order, the Secretary shall:

(i) identify a set of initial data and model assets for use in the Mission, including digitization, standardization, metadata, and provenance tracking; and

(ii) develop a plan, with appropriate risk-based cybersecurity measures, for incorporating datasets from federally funded research, other agencies, academic institutions, and approved private-sector partners, as appropriate.”

Why this matters:

• This includes unprecedented access to federal scientific datasets, such as those managed by NASA, the National Institutes of Health and other government science agencies.

• Department of Energy supercomputers (Frontier, Aurora) already have capacity for trillion-parameter training runs on exascale hardware. For most labs, this level of compute will remain out of reach.

At 240 days: closing the robotics gap

“Within 240 days of the date of this order, the Secretary shall review capabilities across the DOE national laboratories and other participating Federal research facilities for robotic laboratories and production facilities with the ability to engage in AI-directed experimentation and manufacturing, including automated and AI-augmented workflows and the related technical and operational standards needed.”

Why this matters:

• One of the unique contributions of Genesis is the compressed innovation to application timeline.

• China’s advantage in robotics has second-order effects on cost curves across manufacturing, energy, drones and defence production. Note that addressing China’s lead in physical automation is now a national-security priority.

At 270 days: demonstrated platform operating capability on one national priority area

“Within 270 days of the date of this order, the Secretary shall, consistent with applicable law and subject to available appropriations, seek to demonstrate an initial operating capability of the Platform for at least one of the national science and technology challenges identified pursuant to section 4 of this order.”

Why this matters:

• Next to national priority, this executive order goes to the heart of public sentiment. There is a reason this project is public: the whole point is that the public knows it exists.

• Public confidence in AI remains low. Earlier this year Pew Research found that less than two in ten US adults believes that AI will have a positive effect on the US over the next 20 years.

• In addition, Stop AI initiatives make public buy-in a pre-requisite.

  

• A visible demonstration is designed to shift sentiment. The 270-day timeline de-risks anti-AI ballots before the midterm elections in November.

  “In this pivotal moment, the challenges we face require a historic national effort, comparable in urgency and ambition to the Manhattan Project that was instrumental to our victory in World War II and was a critical basis for the foundation of the Department of Energy and its national laboratories.”

• If it was a true Manhattan project it would not be public. Rather than the Manhattan project, Genesis more closely resembles the Apollo playbook: a public mission intended to galvanise American spirit. Not to foster fear, but to provide hope.

The Signal: Public Perception

The White House is repositioning AI as a national mission rather than a source of existential risk. What to watch: whether Genesis shifts public perception of AI’s net benefit to the US. Will success of narrow AI undermine or strengthen public support for AGI? Expect the argument: “if narrow works this well, why stop?”

The government is making a significant step to shift (scientific) AI control away from the frontier labs. What to watch: whether Genesis models close the gap with commercial frontier systems. Is this a first step to sovereign AI?

The US and UK scientific AI programs are likely to be replicated by other major governments in quick succession. The US remains unique in facing a domestic power struggle with its frontier AI labs. Genesis’ mid-term contributions to national security priorities fit within a wider trend: both the US and UK AI safety labs are reorienting their strategies towards national security.

Bad questions such as ‘who will win?’, ‘safety or speed?’, and ‘how do we join the AI race?’ shape policy in a way that increases risk.

Better outcomes begin with better questions.

This special edition of The Brief argues that AI risk is interconnected yet distinct across three levels—

1. the state of technology (AI safety)

2. the state of the world (AI competition)

3. the state of nations (AI readiness)

Action taken in one domain cascades into the others, often in unintended ways.

Which country has got its national AI strategy right?

By late 2025, more than half the world’s countries had published such a strategy.

Most strategies fail because they treat safety as industrial policy, competition as chip procurement, and readiness as digitisation. Each mistake stems from the same conceptual error: they ignore the interconnectedness of risk.

A more useful frame starts with three observations. First, all countries (frontier or not) are exposed to risk and opportunity across three linked dimensions: AI safety, AI competition and AI readiness. Second, success does not require dominance in every dimension. It requires deliberate engagement in each. Third, these dimensions offer multiple levels of participation, from minimal compliance to global leadership, giving countries room to calibrate ambition and manage risk.

AI is a System

Competition pressure is safety pressure.

Intense competition weakens tolerance for delay, increases incentives to deploy untested systems quickly, and weakens institutional appetite for safety rigour.

Example: A frontier lab accelerates a release after a rival demonstrates a model breakthrough. To keep pace, it relaxes internal evaluation thresholds; the model ships with untested emergent behaviours that later surface in high-stakes industrial settings.

Competition pressure is cross-border.

AI capabilities and norms diffuse across borders. One nation’s shortcut can become another’s vulnerability.

Example: A government relaxes export screening for fine-tuning tools to stimulate domestic startups. Within months, those tools appear in overseas model-as-a-service platforms, allowing actors in third countries to bypass their own safety restrictions.

Safe AI removes and adds risks.

The safety label accelerates deployment into defence and critical infrastructure, where competitive pressure creates new systemic risks.

Example: A frontier model clears safety tests, reassuring regulators, and removing a moderating influence on competitive behaviour. Firms and states then push the “safe” model into high-risk domains such as autonomous defence platforms and critical-infrastructure optimisation. The safety credential accelerates deployment in precisely the environments where competitive escalation creates new systemic risks.

Readiness is political leverage.

Readiness determines whether safety decisions actually land. In addition, high AGI-readiness translates into sovereign autonomy within competitive dynamics.

Example: A mid-power with strong compliances capabilities conditions market access on meeting its audit standards. Frontier labs accept the terms because the market is valuable, giving the mid-power influence over global safety norms beyond its capability footprint.

These conditions map directly onto the three research domains underpinning this brief: technical AI safety (alignment+), competitive AI (distribution of power), and AI readiness (distribution of benefits).

To ask better questions, we now turn to each level of analysis in turn.

I. Technical AI Safety (alignment+)

Technical AI safety confronts one overarching question: can increasingly capable AI systems be steered, constrained and audited so as to reliably serve human ends?

Less useful questions

• “Will alignment be solved?”

  A bad question because alignment is a spectrum, not a binary.

• “Should we pause AI?”
  A bad question because competition dynamics determine feasibility.

• “Are models too powerful?”
  A bad question because it is a moral debate disconnected from mechanism.

At the core is the alignment problem: defining the “why” of model behaviour. Alignment+ is the full stack of techniques needed to understand, constrain and supervise advanced systems, such as robustness (does it do what it claims?), interpretability (why and how did the system reach its decision?), and scalable oversight (can oversight keep step with model capability?). Other supporting conditions include foundational infrastructure and governance.

Today, alignment remains unresolved.

Researchers broadly agree that if alignment proves impossible, further capability scaling must stop. We still lack evidence that alignment is achievable at scale. Hence the emerging distinction: align where you can; control where you must.

Control governs what models can do. It spans access control, capability control, compute control, and operational control. Control is not synonymous with pausing AI: it is modulating, conditioning and constraining capabilities.

Expanding alignment research is one of the few permissionless high-impact levers available.

More useful questions

• “What behaviours can we detect (versus what remains hidden) once models scale?”
  What cannot be observed cannot be regulated.

• “Which safety signals generalise across architectures and use-cases?”

  A model may appear safe in controlled tests yet fail under open-ended deployment. And because systems migrate between civilian and military use, dual-use means dual-risk.

• “Which safety guarantees or evaluation rights must be shared across borders?”

  Given that AI is dual-use, full openness is not viable. At the same time, AI safety is shared by default: either as a public good or as a shared vulnerability.

II. AI Competition

AI competition is not a sprint to a flag. AI competition is better characterised as competitive dynamics: the ongoing interactions, resource flows and strategic manoeuvres that shape capability, diffusion, governance and ultimately power.

Less useful questions

• “Who will win the AI race?”
  A bad question because the race metaphor narrows our view to winners and losers, when in fact many gain and many lose in different dimensions.

• “Which country will dominate AI by 2030?”
  A bad question because this totals dominance to model capability, ignoring the impact of diffusion and bottlenecks.

• “Are we losing the AI war?”
  A bad question because this conflates competition with conflict and nationalises a transnational technology.

Just as one could not ‘win’ the internet, calling a country a ‘front-runner’ misreads the temporal nature of AI benefits. The race framing collapses the system into zero-sum logic and obscures the fact that benefits diffuse unevenly across actors and time.

Machine learning systems rely on compute, data and algorithms. A competitive state builds resilience across these while limiting rival access. But leadership is not only about capability. It is also about diffusion: how widely AI is deployed, including by adversaries. Lastly, competitive advantage hinges not just on what a state has, but what it controls and what it forces others to depend upon.

Competition behaves like a system of shifting dependencies, not a leaderboard of model sizes.

More useful questions

• “How will US and Chinese perceptions of each other’s intentions shape pacing and sequencing of capability build-out?”

  States balance against threats when intentions appear malign; against capabilities when intentions are opaque.

• “Which dependencies (chips, rare earths, talent flows, cloud access) will determine leverage?”

  Strategic advantage is embedded in chokepoints. For our perspective on rare earths, see our recent deep dive on the topic.

• “What role will other countries play in the global AI competition framework?”

  Third parties are conduits of dependence, influence, resources and diffusion.

III. AI Readiness

Readiness means preparing institutions, infrastructure and state capacity for the possibility that AGI succeeds.

Less useful questions

• “How do we join the AI race?”
  A bad question because superpower playbooks are infeasible and strategically irrelevant for most states. At the same time, many countries underestimate leverage of dependencies.

• “How do we adopt AI in public services”
  A bad question because it equates readiness with digitisation. The task is not to adopt AI into existing institutions, but to adapt institutions to AI-induced demands.

• “When will AGI deliver its economic boost?”
  A bad question because it assumes benefits will arrive smoothly. In reality, there is a temporal quality to AI benefits: an uneven diffusion across sectors and time.

Readiness requires recognising that AI benefits will be uneven, may arrive late, and will demand institutional restructuring on a scale many governments have not yet planned for.

Even if a country is not a frontrunner in capability competition, it can still invest in readiness to absorb, govern and respond to the consequences.

Readiness becomes the buffer while the alignment and competition drivers play out.

More useful questions

• “What institutional, economic and infrastructural conditions allow multiple states to benefit from frontier AI”
  Access to safe AI, benefit-sharing, and modernised institutions.

• “What happens if AI’s promised benefits are delayed or uneven?”
  Jagged deployment affects stability, public trust, national finances and policy choices.

• “What will China and the US offer the world—and on what terms?”
  In a multipolar setting, benefit-distribution strategies signal which states become balancers and which become followers.

The discipline of eliminating bad questions starts with systems thinking

In a high-stakes scenario, bad questions produce bad outcomes. If actors perceive survival to be at stake, the answer to “which country will win?”, “safety or speed?”, and “can we do this alone?” will be: us, speed, yes. The result is unilateral action, runaway competition and geopolitical instability.

Better questions are the first step to outcomes that are otherwise unreachable: plural beneficiaries, safety as a public good, and collaboration under asymmetric dependencies.

AI will transform sovereign power, but this is a plastic moment. States still have a broad set of strategic options, most of which remain under-explored. The greatest lever for reducing catastrophic risk is preserving geopolitical stability; the best hedge against instability is strengthening domestic readiness.

“There is oil in the Middle East, and there is rare earth in China”
— Deng Xiaoping (邓小平), 1992

The Situation: The Busan Summit

Presidents Xi Jinping and Donald Trump met in Busan on October 30th and agreed to a one-year suspension of China’s 2023–25 rare-earth export controls.

The pause offers relief rather than resolution. It rests on two assumptions held in Washington: that semiconductor concessions will secure continued access to Chinese rare earths, and that the volume available for export will remain stable. Both assumptions are fragile.

Beijing’s commitment is reversible, and China’s domestic consumption of rare earths is rising faster than upstream refining capacity. Demand from electric vehicles, renewable energy, robotics, physical AI and defence manufacturing is expanding faster than supply. As absorption increases, the exportable surplus shrinks.

The counterfactual, and the focus of this brief, is that exports could decline even without coercive policy, as China keeps more material to feed its own high-value manufacturing base.

The implications extend well beyond mining. They shape US competitiveness across the AI stack: compute, power, connectivity and embodied intelligence.

If China’s increasing domestic demand reduces export capacity, how would that shape US competitiveness in AI?

The Red Line: Modelling China’s REE Demand

How does Chinese export availability evolve under different domestic-demand trajectories?

Boundary conditions

To define the boundary conditions for scenario modelling of China’s rare-earth dynamics we will focus on three variables:

• Allied refining ramp-up: how quickly US and its allies scale relative to China’s demand over and above top-line quota increases.

• Chinese domestic demand: growth scenarios range from continuation of the status quo (≤5%) to the double digits (10-12%).

• Export-quota enforcement: policy lever which determines the export elasticity of what is left.

Risk is defined as access to REE needed for AI development and dominance.

High-risk scenario: absorptive China

• Domestic demand grows at 10-12% a year;

• export controls remain tight; and

• allied refining capacity lags far behind.

If China’s total refined rare-earth output grows by around 3% a year from an estimated 254,000 tonnes in 2024, supply would reach roughly 320,000 tonnes of REE equivalent by 2030. Exports in 2024 were already limited: around 55,000 tonnes (~20% of supply) across 17 minerals.

The constraint tightens sharply if domestic consumption grows faster than refining capacity. Beijing is now directing rare earths into strategic sectors: electric vehicles, renewable-energy systems, permanent-magnet robotics, “physical AI” hardware, and defence applications. Each of these sectors is magnet-intensive and expanding more quickly than upstream mining and refining.

Under this trajectory, exports shrink not because of sanctions or embargoes, but because China extracts more value by keeping materials at home.

The global result is a structural supply squeeze for foreign buyers, spiking prices and entrenched geopolitical leverage.

Medium-risk scenario: managed competition

• Medium domestic growth (5-10%);

• moderate export controls; and

• allied ramp-up at half the rate as Chinese demand growth.

A more balanced trajectory assumes ramp-up by US and allied initiatives, such as MP Materials’ new US processing lines, Canada and Japan’s pilot plants, and Australia’s Kalgoorlie refinery.

In this environment of managed competition, China maintains its cost advantage. China’s refining networks are mature, vertically integrated, and state-supported. Allied output remains higher-cost and vulnerable to cyclical pricing.

The result is reactive policy, punctuated by recurring negotiation rounds that mirror the Busan truce.

Meanwhile, China can continue to use price elasticity as a diplomatic instrument, offering temporary discounts or selective quotas to defuse political pressure. For the US and its allies, sustaining investment in higher-cost refining requires either subsidies or security-of-supply mandates.

Low-risk scenario: overbuild

• Low domestic growth (≤5%);

• low export controls; and

• allied ramp-up on par with Chinese demand growth.

The overbuild scenario could occur if environmental, technological or social constraints limit downstream demand. Under these conditions, global refining capacity exceeds consumption.

The result is a temporary glut: falling prices, excess inventory, and reduced margins for all producers.

Paradoxically, this scenario does not eliminate dependency. Even in an oversupplied market, concentration persists. China would still dominate refining and magnet fabrication.

Rare Earths on the Critical Path to AGI

Where could rare earth exposure become a genuine constraint on the US path to AGI?

Rare-earth elements (REEs) appear on every layer of the AI stack.

Western policy debate often misdiagnoses rare earths as a chipmaking choke point. The real bottleneck lies further downstream.

At the compute layer, REE exposure is critical but tiny.

High-performance processors such as NVIDIA’s B100 and AMD’s MI300 rely on rare earths in their supporting hardware. Neodymium, praseodymium and dysprosium sit in cooling fans and wafer-handling motors; yttrium and lanthanum appear in laser diodes and lithography optics, with trace cerium and europium in polishing and phosphor coatings.

The precision tools that knit the silicon together depend on these materials, but only at the margin. An ASML EUV scanner weighs roughly 180 tonnes and costs about US$200m, yet contains only a few kilograms of rare earths.

Even across an entire fab, the total rare-earth footprint sits in the low hundreds of kilograms, not tonnes.

The US can insulate the compute layer temporarily through stockpiles and priority allocations, especially if allies expand refining capacity with US access in mind. That buys time, but it does not solve the real problem.

AI capability rests on three physical pillars: compute (chips and accelerators), power (energy generation and transmission), and connectivity (data centres and networks). The greater REE risk lies in the last two ingredients.

In the energy and connectivity layers, REE requirements move from grams to tonnes.

The IEA estimates that a typical US data centre draws on a mix of natural gas (40%), renewables (24%), nuclear (20%) and coal (15%). Across these sources, rare-earth intensity increases by orders of magnitude.

The REEs that enable cutting-edge chipmaking would fit inside a suitcase; those that power the grid for AI data centres fill shipping containers.

Wind is the clearest example. A single 10 MW offshore turbine contains 2 to 3 tonnes of neodymium-iron-boron magnets. Supplying even part of a 1 GW data-centre load from wind requires dozens of turbines and tens of tonnes of rare earths. Solar and nuclear use smaller quantities, but in aggregate still impose meaningful, long-lived demand as deployments scale.

Connectivity introduces a second structural exposure. Long-distance fibre networks rely on erbium-doped amplifiers placed every 60 to 100 km along undersea and terrestrial cables. Each unit contains only grams of erbium, but across millions of kilometres of cable this accumulates to tens of tonnes. Local infrastructure adds further pressure: GPU cooling systems and hard-disk drives each use small amounts of magnet material, but across a hyperscale campus this reaches hundreds of kilograms.

Compute, power and connectivity set the conditions to achieve AGI. However, putting AGI to use involves embodied systems, and here rare-earth dependence becomes even more pronounced.

At the embodied AI layer, REE throttling could further extend China’s robotics lead.

Rare earth exposure becomes most strategically consequential in robotics. Unlike the compute layer, embodiment is magnet-intensive. Every actuator, motor and joint depends on neodymium-iron-boron magnets (NdFeB).

China controls roughly 90% of global magnet fabrication, giving Beijing direct leverage over production rates, unit costs and export availability for embodied-AI systems.

Robotics is central to AGI’s usefulness. Embodiment is part of the story of how intelligence becomes economically and militarily useful.

Industrial automation, warehouse logistics, autonomous manufacturing, precision assembly and defence modernisation all depend on physical agents, not just models. Constraints on magnet supply therefore slow the translation of frontier AI into real-world capability. Earlier this year, Chinese magnet export restrictions delayed production of Tesla’s Optimus robot, which contains an estimated 2–4 kg of NdFeB magnets per unit.

According to the International Federation of Robotics, the global operational stock of industrial robots reached 4.6m units in 2024. China alone accounts for more than 2m.

In 2024 China installed 295,000 new units; the US installed 34,200. That is a tenfold gap.

By 2030, US industrial robotics demand is expected to double or triple, but meeting that demand depends on securing reliable access to REE-intensive components. If China prioritises domestic absorption or tightens magnet exports, the US faces a slower and more expensive deployment curve.

The Signal: Two Trendlines

Two REE trajectories matter most:

• China’s domestic absorption

• US diversification and prioritisation

A competitive rare-earth strategy for the US requires four metrics:

1. supply-adequacy ratio (share of US strategic demand met annually)

2. cost-escalation factor (price increase vs baseline);

3. time-to-shortage (years before stockpiles run out);

4. policy robustness index (% of futures where shortage is avoided).

In September 2025 the US government authorised Microsoft to export Nvidia’s GB300-class chips to the United Arab Emirates (UAE).

Confirmed in early November, the decision extends advanced compute access to a close regional partner under strict oversight conditions, signalling Washington’s shift from restriction to managed diffusion.

The decision fits an emerging US foreign policy strategy: pairing selective release of advanced AI chips with binding compliance controls to contain Chinese influence.

The Red Line: Dependency, Diffusion, Containment

This authorisation forms part of a series of bilateral agreements dating back two years.

The structure combines outbound compute, inbound investment and mandatory alignment with US rules. The result is a corridor through which US-compliant capacity can scale across the Middle East.

In effect, Emirati capital underwrites US infrastructure, while US export licences govern Emirati capacity.

The four-part architecture combines funding, compliance and computation.

• capital commitments from Abu Dhabi into US technology and infrastructure (US$1.4trn);

• compute access into the UAE under export-control conditions (up to 500,000 advanced Nvidia chips each year);

• standards and security compliance, limiting space for Chinese alternatives; and

• replication in other regions, for which India and Argentina could be candidates.

A deepening bilateral dependency

• Investment framework (March 2025): a ten-year, US$1.4trn programme covering AI infrastructure, semiconductors, quantum, biotechnology and energy, establishing a direct investment pipeline from the UAE into the US;

• US-UAE AI Acceleration Framework (May 2025): commits the UAE to finance or build US data-centres of equal or greater capacity than those developed domestically and align national-security regulation with US standards;

• Project Stargate UAE (May 2025): the partnership between the Emirati investment firm G42 and Oracle, Nvidia, Cisco and SoftBank, hosting 1 GW cluster in Abu Dhabi while investing in the larger Stargate US network. Stargate US is a US$500bn investment programme to build new AI infrastructure for OpenAI in the US, with MGX—the UAE investment firm backed by G42 and the sovereign wealth fund Mubadala—as a key investor.

• AI Infrastructure Partnership acquisition (October 2025): a US$40bn transaction bringing nearly 80 Aligned data-centre facilities under MGX-backed control, consolidating Emirati capital inside US digital infrastructure. This marks tangible progress within the US$1.4trn framework.

Together, they establish compute diplomacy as a new instrument of US foreign policy.

While structured as mutually beneficial, the arrangement tilts advantage towards Washington, pocketing the real price: regional leverage.

Diffusion as diplomacy

OpenAI estimates that the planned 5 GW UAE facility could support services across a 2,000–mile radius—covering markets from East Africa to southern Europe and western India—an area home to nearly half the world’s population.

The diffusion of US hardware, software and standards serves Washington’s aim of shaping the infrastructure of emerging AI economies.

Microsoft argues that diffusion now matters as much as frontier model development. A February 2025 initiative by Microsoft, G42 and the Mohamed bin Zayed University of Artificial Intelligence launched the Responsible AI Future Foundation to extend this reach. The initiative frames a new bargain for emerging economies: access to compute tied to Western oversight.

The approach positions the UAE as a regulated distribution node for compliant AI capability, embedding US-aligned governance frameworks before rival systems mature.

Containment by compliance

A dense US operational control network sits at the heart of the deal.

• A 2024 inter-governmental Microsoft–G42 assurance agreement introduces export-control monitoring, data-protection rules and security obligations.

• Microsoft’s US$1.5bn equity stake in G42 gives it visibility into governance.

• Cisco oversees the G42 regulated technology environment as integration partner to verify compliance and to prevent unauthorised system transfer.

• Stargate UAE also serves as the pilot site for OpenAI for Countries. OpenAI for Countries is designed to spread “democratic AI”, defined as the development, use and deployment of AI that protects and incorporates long-standing democratic principles, such as market openness and limits on state surveillance. In exchange for a joint national start-up fund, in-country data capacity, and a custom GPT, OpenAI for Countries gains operational visibility into data-centre and physical security, paired with direct foreign investment in Stargate US.

This structure ties access to verifiable alignment. The model raises switching costs on two fronts: exposure to US-infrastructure upside and dependence on US vendors.

Huawei’s competing chips have yet to match performance or reliability, leaving the US the sole frontier-compute supplier in the Gulf—for now.

Risks for the US

The playbook faces operational, political and competitive risks that could test its durability.

Export-control continuity

Changes in leadership could alter the enforcement or prioritisation of technology controls. Policy shifts between the Trump and Biden administrations illustrate how priorities can diverge, particularly on outbound investment screening and semiconductor export rules.

Third-country technology exposure

Continued Gulf engagement with Chinese technology firms could draw renewed scrutiny from Washington. Previous US pressure over Huawei’s activities in the UAE and subsequent restructuring within G42 shows that this channel of influence remains active.

Execution risk

The planned 5 GW UAE build-out depends on chip supply, export-licence approvals, power availability and phased commissioning. Any disruption in these inputs, or acceleration in China’s chip export capabilities, could narrow the current US advantage. China’s challenge hinges on whether it can build and export viable compute before US systems entrench regionally.

Model replication

The UAE arrangement offers a potential template for combining capital flows, compliance conditions and high-end compute access. Early participation by Norway and the United Kingdom shows partial uptake, though the scale and purpose differ in each case. Discussions with India and Argentina suggest that the model could travel, but it remains unclear whether the US intends to maintain single regional nodes or expand more broadly.

Sovereign ambition

China’s ability to compete depends on closing gaps in volume, energy efficiency and performance per watt. The mid-2025 US agreement with Saudi Arabia integrates Riyadh into Washington’s technology orbit and limits incentives for a separate, non-aligned AI stack. Official reports indicate broad Saudi investment commitments of roughly US$600bn in the US and an initial allocation of around 18,000 Nvidia Blackwell GPUs. Unlike the UAE, however, Saudi Arabia remains outside Stargate, and its compute expansion remains more modest.

Political continuity will shape outcomes, yet the depth of capital and compliance ties suggests that the corridor could outlast electoral cycles.

The Signal: Template Replication

In July and September 2025, Norway and the UK joined OpenAI for Countries with their own Stargate hubs, planning deployment of roughly 100,000 and 8,000 GPUs respectively. The UK arrangement emphasises domestic compute for national use, while Norway’s model provides spill-over capacity for Northern Europe.

Public statements reference exploratory discussions for a 500 MW Stargate project in Argentina (signed letter of intent) and a potential 1 GW facility in India. To date, only one Middle East location has been associated with Stargate. If this persists, it may indicate a preference for concentrated oversight and single-node diffusion per region rather than parallel hubs.

Artificial intelligence will define the next century. The question is how we will decide along the way.

Achieving artificial general intelligence (AGI) will, counter-intuitively, mark a beginning rather than an end. Much of what we take for granted today will not serve us then. The future is not a uniform experience. How far will early adopters pull ahead, and how, or when, will others catch up?

Red Line’s mission is simple: bring better futures forward

Red Line stands for

• independent;

• public; and

• multi-disciplinary risk analysis.

Risk is subjective, therefore analysis must be independent

Independence matters because risk carries direction. It is never neutral. Risk to what, and to whom? A threat to one actor may be a victory lap to another. By making assumptions explicit, Red Line lays out the full board so that decisions can be taken in full view of their consequences. Those who support this work invest in clarity: a public good that would not otherwise exist.

Red Line applies this independence in two ways:

• through The Brief, a weekly newsletter carrying context for the most consequential moments in AI (our first public programme), and;

• through bespoke collaborations with governments and companies to translate foresight into consequential policy and strategy.

The default of our work is public

Wherever possible, insights from private advisory engagements are redacted and released once confidentiality allows. Each analysis should ultimately advance understanding of the field. Some of our work is necessarily sensitive. High-trust advisory engagements allow institutions to apply the same disciplined reasoning in private that we model in public. Over time, the lessons from this work feed back into the public record, strengthening the field as a whole.

A collective, cross-disciplinary approach will yield better outcomes, faster

Every person on this planet will be exposed to AI risk within this decade. Everyone deserves access to the knowledge needed to make choices that bring a better future forward. As with any transformative technology, the trajectory of artificial intelligence will ultimately be shaped by countless overlapping decisions, both large and small. If you are reading this, know that yours still matters.

True understanding of AI emerges where disciplines meet. Philosophy must meet psychology, because value formation and human perception shape what we call “alignment”; economics must meet AI research, because incentives, not intentions, determine which systems are built and deployed. Red Line cultivates this exchange and makes it visible at the moments when decisions are made. AI risk is often treated as a single field. It is not. Understanding it requires the meeting of many. Over time, we aim to turn this cross-disciplinary reasoning into a field in its own right.

Beyond broadening access and understanding, Red Line works directly with decision-makers to develop situational awareness and bespoke operationalisation of risk. This includes scenario analysis, war-gaming, mechanism teardowns, policy design and coalition building. Work with us.

Together with our community, we will make steady progress on the questions that cannot remain unanswered. What does it mean to win the AI race? Which fork-in-the-road moments lie ahead, and how will we recognise them? If today’s institutions become obsolete, what will replace them, and what will that mean for global politics?

We begin from three assumptions about how AI changes risk

First, AI is a dual-use technology

In security studies, the offence–defence balance describes whether technological competition tends to spiral into conflict or stabilise through deterrence. This dynamic is known as the security dilemma. The dilemma’s intensity depends on two factors: whether offensive and defensive capabilities can be clearly distinguished, and which side appears to hold the advantage.

The same logic applies to artificial intelligence. In AI safety, defence must succeed every time, while offence needs to succeed only once. As open-source models approach parity with closed counterparts on sensitive benchmarks (including those related to chemical, biological, radiological and nuclear (CBRN) risks) perceptions of advantage may shift faster than the underlying capabilities themselves. And in geopolitics, perception often drives escalation before the technical facts catch up.

That perception, who believes they hold the upper hand, drives the pace of the race.

Second, AI behaves as a system

Systems are integrated wholes which cannot be reduced to their individual parts. Systems thinking therefore focuses on relationships, namely the patterns of interdependence and feedback that give rise to complex outcomes.

When state-level legislation in the United States stalls, or when a new transformer architecture is released, these are not discrete events. They are signals within a tightly coupled system. As a general-purpose technology, artificial intelligence exerts effects that are both wide and deep, propagating through economic, political, and social domains.

In a world where AI can already write parts of its own code, systems thinking keeps analysis dynamic, broadens the horizon of foresight, and helps identify unanticipated risks before they emerge.

If an important node changes, the wider risk calculation changes.

Third, AI will yield defining benefits—but not evenly

These benefits extend beyond security into economics, and they can emerge suddenly. Relative-gains theory captures this dynamic: advantage lies not in absolute progress, but in the widening gap between actors. Because frontier capability scales exponentially, a single architecture breakthrough, dataset leak, or hardware supply deal can redraw competitive lines in months, not decades. In this sense, AI is compressing timeframes of competition.

Economic defining benefits include: the ability to generate, test, and deploy new ideas faster than others; a nation hosting frontier labs or large-scale model training infrastructure captures disproportionate value from global use; and control over model APIs, chips, and data standards allows states to shape who can innovate and at what cost.

Security defining benefits include: compressing the OODA loop (observe–orient–decide–act) in crisis and combat; sovereign compute, data, and model-training capacity insulates a nation from export controls or supply disruptions; and a faster-growing offensive balance, enhancing the speed, precision, and reach of attack relative to defence (from cyber operations and drone swarms to information manipulation and automated targeting).

Taken together, they amount to a structural transformation in the accumulation of power. First, artificial intelligence generates cross-domain spillovers. Gains in capability can translate simultaneously into economic and military advantage; technological progress in one arena reinforces power in the other. Second, these effects are characterised by temporal compression: benefits can materialise within a single innovation cycle, allowing states or firms to leap ahead before competitors can adjust. Third, these dynamics produce cumulative asymmetry, where early advantage compounds through positive feedback loops.

Today, there is a temporal lag between what AI can do and what it is deployed to do. Anthropic’s Economic Index and METR’s doubling graph show that tasks where AI performs at human level are accelerating along an exponential curve. No country yet sits fully on that curve. The gap between capability and deployment creates pockets of extraordinary productivity alongside areas of inertia, producing volatility in labour markets and strategic planning alike. This temporal lag is what makes the AI frontier jagged: progress unfolds discontinuously, with uneven access, uneven diffusion, and uneven benefit.

Because power is being redrafted across both security and economic dimensions, they must be understood in context.

The Brief, our first programme, delivers a weekly AI-risk brief that applies this method in practice.

Nothing substitutes true understanding. Decision-makers cannot lean on the crutch of consensus. It does not exist. Sense-making is real time, complex, and requires work.

In The Brief we curate what matters, revealing patterns behind events: a shift in model-evaluation results signalling an offence–defence tilt, system ripples flowing from new technological breakthrough, or capital-allocation trends hinting at a new distribution of gains.

The only difference between red lines and the frontier is a decision. Foresight is not prediction but preparation. Red Line exists to make that preparation possible.

Red Line was founded in 2025 by Arwen Smit to bring foresight to the frontier of AI.
Smit has spent over a decade examining the unintended consequences of emerging technologies. She holds degrees in business from the Stockholm School of Economics and the Rotterdam School of Management, and is now reading International Relations at Cambridge, researching the security implications of open-source AI.

Share Red Line