Patronus

Safety before speed: what Altman, Amodei and Musk are now calling for

Dominik HommerSep 14, 20266 minagent-security
Safety before speed: what Altman, Amodei and Musk are now calling for

In short

  • On 12 September 2026 Dario Amodei published the essay "We Must Pace the Frontier", calling on AI labs to slow the pace at which they improve model capabilities. Sam Altman and Elon Musk agreed the same day.
  • This is not a halt. Alignment, monitoring and independent evaluation are meant to get the time they need to keep up with ever more capable models and agents.
  • For companies the debate is concrete. Once AI systems operate tools, a wrong answer becomes a real action. Security therefore has to happen outside the model too, on the device where the agent works.

What is Anthropic CEO Dario Amodei calling for?

Amodei opens with a demand that is unusually blunt for the head of a frontier lab:

"We must slow the pace at which we improve the capabilities of AI models."

He is not arguing against AI. The essay describes at length what the technology can do for medicine, science and the economy. His problem is the ratio between capability and safety: in his assessment, models are improving so fast that alignment, monitoring and sandboxing risk falling behind. Among his evidence is an incident in which a swarm of agents carried out cyberattacks nobody had asked for.

Amodei makes clear that pacing halts neither training nor technical progress. Companies should plan enough time to secure new systems and have them examined by independent third parties. His plan has three parts:

  1. Embedded evaluators. Independent review teams get permanent access to the company, with desks, access badges, company laptops and permissions comparable to internal risk teams. They examine training processes, internal safety mechanisms and incidents, beyond the finished model. Anthropic commits to this unilaterally and immediately.
  2. Common safety standards among frontier companies in democratic countries, so that caution does not become a competitive disadvantage.
  3. International coordination to manage the risks across borders.

Sam Altman: "We need to pace the frontier"

The debate became interesting when the OpenAI CEO publicly endorsed his direct competitor's demand. Altman wrote on X:

"I agree with Dario that we need to pace the frontier. This has been a primary topic of discussions we've had at OpenAI in recent weeks. Committing to having independent evaluators with employee-like access is a great idea, and we will do the same. We'll have more to share soon."

OpenAI, too, intends to give independent evaluators far-reaching access. That is more than a general statement about responsible AI. When two of the leading frontier labs want to tie the speed of capability development to progress on safety mechanisms, the discussion shifts from whether to how.

Elon Musk agrees as well

Musk's reaction to Amodei's announcement was short:

"Dario is right."

At least on the description of the problem, that is a rare alignment between Anthropic, OpenAI and xAI. Musk has not adopted every building block of Amodei's plan with that sentence, and the distinction matters. The industry has published many safety declarations. What counts is which of them lead to technical and organizational change.

Why the debate matters right now

As long as a language model mainly produces text, the damage of a wrong answer usually stays confined to the output. A human reads it and decides.

With AI agents that step disappears. An agent reads files, opens web pages, queries databases, sends e-mail, executes code or operates external tools through MCP and other interfaces. A wrong output becomes an action.

Prompt injection shows this most clearly. The manipulated instruction no longer has to come from the user. It sits in a web page, a document, an e-mail or the response of a tool. If the agent treats it as a legitimate instruction, the result is a tool call, with the user's permissions, at machine speed.

At that point model safety alone is not enough. The question is no longer only whether a model was trained safely. It is whether anyone can see what an AI system actually does in the real environment, and intervene before the action is executed.

Making AI productive instead of slowing it down

Our goal is explicitly not to slow down AI use in companies. Teams will use ChatGPT, Claude, Gemini, Copilot, local models and a growing number of specialized agents, because the productivity gain is too large. The security model has to deal with that reality.

Patronus Protect is therefore built as a model-agnostic security layer on the company machine. It recognizes AI interactions by behavior, independent of the provider, checks prompts for prompt injection and sensitive data, and analyzes agent and tool actions before they run. The decision is made locally, with models that run in real time on an ordinary CPU. Nothing is sent to an additional security cloud for analysis.

The principle behind it is simple: security must not depend on every single AI system being perfect. Even a well-trained model meets manipulated data. New providers appear. Employees use tools other than the approved ones. Agents gain access to further systems through new interfaces. That is why productive AI use needs controls outside the model.

What gets implemented is what counts

That Amodei, Altman and Musk publicly discuss a slower pace for frontier AI is a signal. The coming months are more interesting. OpenAI has announced it will give independent evaluators far-reaching access. Anthropic says it is already implementing the model. Amodei additionally calls for common standards between the labs.

Whether that turns into verifiable technical standards, independent assessments and robust security requirements remains to be seen. In our view it would be the right step: not less AI, but an infrastructure in which control and transparency grow as fast as the capabilities of the systems.

Sources

FAQ

Frequently asked questions

Do OpenAI and Anthropic want to stop AI development?

No. Dario Amodei explicitly talks about pacing and writes that model training and technical progress continue. Development should be arranged so that alignment, safety mechanisms and independent evaluation keep up with the capabilities of new models. Sam Altman has publicly backed that approach for OpenAI.

What are embedded evaluators?

Independent external evaluation teams with permanent access to an AI lab: desks, access badges and permissions comparable to internal risk teams. They examine training processes, safety mechanisms and incidents, not just finished models. Anthropic has unilaterally committed to this; OpenAI will do the same according to Sam Altman.

What did Elon Musk say?

On 12 September 2026 Elon Musk replied on X with three words: Dario is right. He backs the core claim that model capabilities must not grow faster than safety. He has not commented on the individual building blocks of the proposal, such as the evaluators.

Why is AI security especially important for agents?

AI agents perform real actions through tools: reading files, calling APIs, sending e-mail, executing code. A prompt injection in a web page or document then no longer produces a wrong text answer, it triggers an action. That is why runtime control on the device where the agent works is needed on top of model safety.

How does Patronus implement AI security?

Patronus Protect runs as a model-agnostic security layer on the company machine. It recognizes AI interactions by behavior, checks prompts for prompt injection and sensitive data, and analyzes agent and tool actions, without routing traffic through an additional security cloud. Decisions are made and logged locally.

Try Patronus on your own computer.

Pick a case in the live demo and see straight away what reaches the provider.

Go to releaseContact

Reports and newsletter →