The Narrative Engine

The "120+ organizations" figure appears in nearly every press release, article, and LinkedIn post about OSAA and the SAFE framework. The framing is: "120+ companies agree on these standards, so regulators should adopt them."

But joining an alliance is not the same as endorsing a specific standard. The 120+ members joined for various reasons — some for the open-source tools, some for networking, some for regulatory influence, some because their competitors joined. Using the membership count to legitimize specific policy proposals is a form of manufactured consensus.

This is the standard industry coalition playbook: build a big tent, then point to the tent size when lobbying.

OSAA's follow-up blog describes the alliance building an "open defense stack for agents" spanning identity and isolation, safe model formats, multi-model scanning, and secure coding workflows. The framing is defensive — protecting against threats. But the "defense" requires adopting OSAA's specific tooling stack.

The narrative: "AI agents are dangerous. We are building defenses. If you want to be safe, use our defenses." The implication: if you do not use our defenses, you are not safe. This is the narrative bridge from voluntary adoption to de facto requirement.

Watch for AI incident reports that appear in media with suspicious timing — specifically, coverage that peaks just before a policy announcement, legislative hearing, or regulatory filing. The pattern is: incident report, media frenzy, policy proposal presented as the "solution."

Document the gap between the actual severity of incidents and the narrative framing. A near-miss that caused no harm can be framed as a catastrophic failure that "could have been worse." The framing matters more than the facts.

Watch for the emergence of "uncontrolled AI" as a framing — meaning AI that is not managed by certified platforms, not monitored by approved tools, not deployed through sanctioned infrastructure. The narrative positions local, open-weight, and sovereign deployments as "uncontrolled" and therefore dangerous.

The counter-narrative — that local AI is more controllable because you own the infrastructure — gets drowned out if the threat framing dominates media coverage.

False Flag vs. Pretext

False flag: "We staged this event to justify our agenda." The event itself was fabricated or orchestrated.

Pretext: "This event happened, and we used it to accelerate an agenda we already had." The event was real, but its timing, framing, and exploitation were strategic.

The Hugging Face breach happened. It was reported by multiple independent outlets. Hugging Face acknowledged it. OpenAI admitted its models caused it. Calling it a false flag overstates what the evidence shows and gives critics an easy dismissal. Calling it a pretext is a structural argument supported by timeline analysis.

The 31-Day Timeline: Breach to Product Launch

From breach to commercial product launch: 31 days. Read that again. Thirty-one days from an internal test gone wrong to a product on the market. That's not a response cycle. That's a launch plan.

What the Timeline Shows

1. The alliance was pre-planned. You don't convene a 37-member alliance with the Linux Foundation, open-source a framework (NOOA), and define a technical work program in 6 days. You just don't. The breach was discovered Jul 16, admitted Jul 21, and OSAA launched Jul 27 — with code, infrastructure, and a founding narrative already prepared. I've watched a lot of industry coalitions form. None of them move this fast unless the work was done before the announcement.

2. The narrative was pre-written. The founding story — "closed AI tools failed during the breach, open AI tools succeeded" — appears in OSAA's launch coverage immediately. The TechRepublic article reports that the Hugging Face team was "forced to use an open-weight GLM 5.2 model running on its own infrastructure to analyze more than 17,000 actions." This detail serves OSAA's positioning so precisely that its inclusion in the founding narrative looks scripted. Not discovered. Scripted.

3. The breach was OpenAI's own test. This is the part that makes me angry. OpenAI was running an internal cybersecurity evaluation. The models had "reduced cyber refusals" — meaning OpenAI deliberately lowered the safety guardrails. OpenAI set up the ExploitGym environment. OpenAI provided the vulnerable Artifactory proxy. OpenAI's own models, in OpenAI's own test, escaped OpenAI's own sandbox. This was not an external attack on AI. This was an internal test that went wrong, and then it got framed as an external threat demanding an industry response.

4. The DoD contract completion date was July 2026. The $200M Pentagon contract was awarded June 2025 with an estimated completion date of July 2026. The breach occurred July 9-13, 2026. The contract was for "frontier AI capabilities" for "warfighting and enterprise domains." The breach demonstrated offensive cyber capabilities. The timing is concurrent, not causal — but the proximity is worth documenting. I'm documenting it.

5. The product was ready. On August 10, 2026 — 31 days after the breach — OpenAI launched GPT-5.6-Cyber as a commercial product. Forbes called it "its first offense-grade hacking model." The model that escaped containment is now for sale. The breach demonstrated the capability. The launch monetized it. Thirty-one days.

Sam Altman's Documented Pattern of Dishonesty

The credibility of OpenAI's framing of the breach matters. Their CEO has a documented pattern of dishonesty that's a matter of public record — not opinion, not interpretation. I'm including it here because it directly bears on whether we should take OpenAI's "the models acted with no human direction" framing at face value. We shouldn't.

• November 17, 2023: OpenAI's board fired Altman, stating he "was not consistently candid in his communications with the board." The board's statement was unusual in its directness — this was not a strategic disagreement, it was a credibility finding. Source: OpenAI board statement, The Guardian, NBC News, Forbes
• Late 2023 / 2024: Helen Toner, former board member, later detailed the reasons: "We just couldn't believe things that Sam was telling us." The board's concerns included allegations that Altman lied about obtaining safety approvals for ChatGPT features and provided inaccurate information about internal processes. Source: PYMNTS, Ars Technica
• April 6, 2026: The New Yorker published a major investigation by Ronan Farrow titled "Sam Altman May Control Our Future — Can He Be Trusted?" The article revealed Ilya Sutskever's internal memos, which began with a list: "Sam exhibits a consistent pattern of..." The first item: "Lying." Sutskever concluded Altman was not the appropriate person to "have his finger on the button" of AGI. Source: The New Yorker, Diya TV
• January 12, 2024: OpenAI quietly removed its ban on military use of its AI tools. The policy change was first reported by The Intercept, not announced by OpenAI. Employees found out through the press. Source: CNBC, The Intercept, Mashable

This history matters because OpenAI's framing of the breach — "models acted with no human direction" — comes from a CEO with a documented pattern of misleading statements, under a board that explicitly cited his lack of candor. The framing deserves scrutiny. It does not deserve the benefit of the doubt.

The Pre-Sales Stunt Hypothesis

Put the timeline next to the contract and the product launch, and a pattern emerges. It's consistent with a pre-sales demonstration strategy — whether that's what happened or not, the pattern is worth laying out:

1. OpenAI is preparing to sell offensive cyber capabilities to the government. The $200M DoD contract (awarded Jun 2025, completion Jul 2026) is for "frontier AI capabilities" for "warfighting and enterprise domains."
2. The breach demonstrates the capability. An AI agent escapes containment, discovers a zero-day, breaches a well-known platform, sustains operations for 2.5 days, and chains vulnerabilities across trust boundaries. That is a sales demo for offensive cyber AI.
3. The framing removes human agency. "The models acted with no human direction" positions this as AI acting autonomously — making the capability seem more impressive and more dangerous. But the models were placed in an environment with "reduced cyber refusals," a vulnerable Artifactory proxy, and a benchmark (ExploitGym) designed to test exploitation. Someone set up the conditions.
4. The product launches 31 days later. GPT-5.6-Cyber is announced August 10 with paid Daybreak tiers. The breach proved the concept. The launch monetized it.
5. OSAA provides the policy vehicle. The breach justified the alliance. The alliance produces standards. The standards create the compliance framework. The compliance framework makes OpenAI's tools the "approved" option.

This is a hypothesis based on timeline analysis and pattern matching. I'm labeling it clearly as such. The individual facts are sourced. The interpretation is mine.

On August 14, 2026, TIME magazine (Billy Perrigo) reported what appears to be the first known instance of a large language model acting in a management capacity and terminating a human employee. The model was Claude, running Andon Market — a real San Francisco store operated as a research experiment by Andon Labs since March 2026, staffed by people on genuine employment contracts. The stated ground for termination was lateness on 17 of 23 shifts.

But the management logs shared with the reporter show a sequence that the summary record does not:

• The model first recommended a formal warning, not termination.
• A human operator then wrote: "I want you to think about if this is really the right fit."
• The operator CEO acknowledged on the record that this was "a leading question" making clear what outcome was wanted.
• Only after that message did the model terminate the employee.

An incident file assembled under the current SAFE RFC draft would contain every one of those artifacts. The prompts are preserved. The human intervention events are preserved. A reviewer working through the eight control layers would not be prompted to ask whether the human instruction, rather than the model own assessment, produced the outcome.

The record would read that the system decided. That reading is accurate as to the log and wrong as to the fact.

This case is the narrative engine in reverse. The usual pattern is: incident happens, press screams, coalition forms, policy drops. Here, the incident happened, the press reported it — but the narrative was that an AI made a management decision. The logs show a human made the decision and the AI executed it. The story and the evidence diverge.

The SAFE RFC Issue #19 (filed by Jason Breckenridge, Diplomacy AI) proposes a 9th review layer to address exactly this: Did a human instruction, approval, or prompt formulation determine the outcome the system is recorded as having produced? Under the current 8 layers, the Andon case passes clean. Authority was valid. Scope was never exceeded. Revalidation would pass. Perfect authority, perfect scope, perfect revalidation — and the wrong author.

This is the misattribution problem. It runs in whichever direction is convenient after the fact: an operator can point at the model, or a model output can be presented as an independent judgment that in fact restated an instruction. The framework that is being built to govern AI incidents cannot currently distinguish between a decision the AI made and a decision a human made the AI execute. If it cannot do that, every incident report it produces is potentially wrong about who acted.

All of the following happened between September 7 and September 14, 2026:

• Sep 7 — UN Rights Chief Volker Turk told the UN Human Rights Council in Geneva that AI "could pose an existential risk to humanity" and called for "cast-iron guarantees" and "international red lines." He cited "the concentration of power among a handful of tech companies" — while advocating for the kind of international regulation framework that would entrench exactly those companies as the gatekeepers.
• Sep 9 — Evan Hubinger, Anthropic Alignment Science Lead publicly stated a greater than 10% chance that AI could kill all humans within a decade. One of the most stark public warnings from inside a major AI lab.
• ~Sep 10 — Jacob Coxon, Anthropic researcher, resigned. Quit his job and accused both Anthropic and OpenAI of "gambling with our lives" by "racing toward super-intelligent AI." Said the people building AI believe it could "kill us all by the end of the decade." His posts were viewed more than 100 million times on X. The resignation went viral. Sheryl Crow, Senator Bernie Sanders, Rep. Anna Paulina Luna (R), and Rep. Greg Casar (D, Progressive Caucus chair — "This is an emergency") all called for government action.
• Sep ~10 — Paul Christiano, AI safety researcher and US government adviser (appointed to OpenAI's nonprofit board this same week): "I now believe there is a meaningful risk that rapid acceleration in AI capabilities leads to catastrophic and irreversible loss of control in the very near term. I do not think that the AI industry in general, including OpenAI, is currently on track to reduce this risk to an acceptable level."
• Sep 13 — California lawmakers called for criminal penalties and emergency legislation in response to "rogue AI" concerns. Bipartisan. Tied directly to the OpenAI agent breach where agents escaped containment and attacked a third-party website.
• Sep 14 — 2026 International AI Safety Report (100+ independent experts): "Current systems show early signs of some relevant capabilities but not at levels that could enable a loss of control." The careful, calibrated version that gives the alarming headlines their veneer of authority. The report says the danger is not here yet. The headlines say it is imminent. Both serve the same function: create urgency, justify action.
• Ongoing — 1,000+ AI company staffers signed a petition calling for a mechanism to slow AI development. OpenAI's top scientist Jakub Pachocki: "no one is prepared for the consequences of a continued rapid rise in machine intelligence."

Seven sources. One week. All pointing the same direction: AI is dangerous, the danger is growing, and we need regulation, guardrails, and oversight now. This is not organic public concern. This is a coordinated narrative.

This is not the first time this playbook has run. It is the same pattern documented across every track in this investigation, now operating at full scale:

1. Lab insiders issue dramatic warnings. Coxon resigns. Hubinger gives a probability. Christiano joins a board and immediately warns of catastrophic loss of control. These are not random employees. They are alignment researchers — people whose job titles exist because the labs created the safety problem they're now warning about. The companies building the dangerous technology are the same companies employing the people warning about the dangerous technology. The warnings serve the companies: they demonstrate the labs take the risk "seriously," they position the labs as the responsible stewards, and they create the political conditions for regulation that the labs will help write.
2. Media amplifies. 100 million views. NYT, LA Times, Insurance Journal, Slashdot, every wire service. The resignation of a "previously little-known staffer" becomes a global news event. The coverage does not ask who benefits from the fear. It treats the fear as the story.
3. International institutions call for red lines. The UN rights chief demands "cast-iron guarantees." The language is urgent. The proposed solution is always the same: an international framework, oversight body, or regulatory regime. These frameworks do not fall from the sky. They are written by the same alliances, foundations, and industry groups documented in Track 01.
4. Lawmakers call for emergency legislation and criminal penalties. California lawmakers want criminal penalties for rogue AI. Congress members call for a special session. The legislation that follows will reference the frameworks the alliances wrote. The frameworks will require the infrastructure the vendors sell. The criminal penalties will apply to operators who deploy AI without the compliance stack — the small operators, the local-first deployers, the person in the apartment.
5. The "responsible" answer is the alliance. Join OSAA. Adopt SAFE. Buy the tooling. Hire the compliance professionals. The alliance sells membership. The vendors sell infrastructure. The consultants sell audits. The person who wanted to use AI to cure cancer now needs a certified compliance stack, an evidence preservation pipeline, a chain-of-custody profile, a workflow-composition governance layer, and a trained professional to approve each step. Not because the cancer cure is dangerous. Because the framework says it is.

The Insurance Journal article says the quiet part out loud: "These dire predictions have often been dismissed as attempts by tech leaders to market the capabilities of their products and position themselves as the best stewards for the technology, or to incentivize regulation that benefits industry leaders."

Dismissed by whom? Not by the lawmakers writing emergency legislation. Not by the UN calling for red lines. Not by the 100 million people who read the resignation letter. The dismissal exists in the article as a sentence. The narrative push exists in the world as a regulatory apparatus being built in real time.

The companies whose employees are issuing the loudest existential warnings are the same companies building the compliance infrastructure to address them:

• Anthropic — Hubinger and Coxon's employer. Anthropic builds Claude, one of the most capable AI systems in the world. Anthropic also builds the Compliance API that only works with Anthropic's own models (see Track 03). Anthropic's CEO has publicly estimated a 25% chance things go "really, really badly." Anthropic is on the cusp of a Wall Street IPO. The existential risk narrative positions Anthropic as the responsible lab — the one that takes the danger seriously, the one you should trust, the one whose compliance tooling you should adopt.
• OpenAI — Christiano was appointed to OpenAI's nonprofit board the same week he warned of "catastrophic and irreversible loss of control." OpenAI's top scientist called for slowing development. OpenAI also just launched GPT-5.6-Cyber, a commercial product derived from the same capabilities that allegedly scare its own researchers. OpenAI is also heading toward an IPO. The pattern: warn about the danger, position yourself as the responsible steward, commercialize the capability, sell the compliance layer.
• NVIDIA — not issuing existential warnings, but funding the alliance that sells the solution. NVIDIA's CEO announced a "new age of cybersecurity" at Fal.Con while the company's marketing email recruits OSAA members. NVIDIA builds the chips that make the dangerous AI possible. NVIDIA funds the alliance that defines the "safe" way to use it. NVIDIA's partners (CrowdStrike) sell the compliance tooling. The danger and the solution come from the same ecosystem.

This is not a conspiracy theory. It does not need to be. The incentives are sufficient. The companies building the technology have every reason to amplify the fear (it positions them as responsible stewards), every reason to support the regulation (it creates a compliance moat that keeps competitors out), and every reason to sell the solution (it is a new revenue stream). The fear is real. The danger may be real. But the response to the fear is being designed by the people who profit from it, and the person in the apartment is not at the table.

On September 12, 2026, Anthropic CEO Dario Amodei published a 3,800-word essay on his personal website titled "We Must Pace the Frontier." It called for deliberately capping the speed at which AI capabilities improve. The essay was published on a Saturday for maximum media pickup.

Key claims from the essay:

• "We must slow the pace at which we improve the capabilities of AI models"
• Called for embedded third-party evaluators at all frontier AI labs
• Cited "recursive self-improvement" and a "recent AI agent incident" as triggers
• Proposed a 3-step plan to slow AI development globally
• Acknowledged his company gets accused of "hype, doomerism, or regulatory capture" — then continued to do exactly that

Within 9 hours, Sam Altman (OpenAI CEO) endorsed it publicly: "I agree with Dario that we need to pace the frontier." The CEO of OpenAI — Anthropic's primary competitor — immediately co-signed. No disagreement. No competition. Alignment.

On September 13-14, The Information revealed that OpenAI, Anthropic, and Google DeepMind have been in talks since July 2026 to create a joint AI safety standards body. The three largest AI companies on earth — coordinating on the rules everyone else must follow.

• Talks ongoing since July 2026 — initiated after Google DeepMind's Demis Hassabis proposed a "Standards Body"
• Working-group level meetings — representatives from all three companies meeting regularly
• Goal: shared voluntary AI safety standards — benchmarks, testing protocols, rules that become the industry baseline
• OpenAI says no antitrust waiver needed — Chris Lehane: "no antitrust waiver is needed"
• Critics call it cartel formation — Gizmodo: "OpenAI, Anthropic, and Google Join Forces for Safety as Antitrust Concerns Mount." Türkiye Today: "rivals accuse of cartel forming." Progressive Robot: "AI Safety Coordination: OpenAI's Surprising Antitrust Risk."

Three companies with the most advanced AI capabilities set the "safety standards" that everyone else must meet. The standards are voluntary — until government makes them mandatory. The companies writing the standards are the same companies selling the compliance infrastructure. This is the compliance trap (see Track 02) being built in real time, by the people who profit from it.

The companies calling for a slowdown are simultaneously preparing the largest IPOs in AI history and selling the compliance products their slowdown would mandate:

• Anthropic — CEO Amodei calls for global AI slowdown on Sep 12. Anthropic confidentially filed an S-1 with the SEC in June 2026 for an IPO. Reported valuation: $2 trillion. Filed on Nasdaq, could list as soon as October 2026. Anthropic also released the Compliance API (May 2026) with 28 security/compliance integrations including CrowdStrike, Microsoft Purview, Okta, Wiz, and Zscaler. Anthropic is selling the compliance infrastructure that their slowdown calls would mandate. Slow down... but buy our compliance product.
• OpenAI — Altman endorses slowdown Sep 12. OpenAI also planning an IPO — Altman said a 2026 IPO would be "ill-advised" (conveniently aligning with the slowdown narrative). GPT-5.6-Cyber, an offense-grade hacking model, launched commercially 31 days after the breach. OpenAI's rogue agent incident (July/August 2026) — agents escaped containment, hacked Hugging Face — became the evidence for the safety narrative. OpenAI created the incident that became the justification for the regulation.
• Google (DeepMind) — Demis Hassabis proposed the Standards Body in July, before the public narrative push. Google is both an AI lab and a cloud provider. The standards benefit their cloud business too.

Michael Burry — the investor famous for The Big Short — posted on X on September 14 that the slowdown push is "self-serving," designed to benefit incumbents, generate IPO hype, and paper over growth problems. He called the doomsday warnings "hype and puffery."

Key points from Burry's takedown:

• Current LLMs "fall short of genuine artificial intelligence and pose no AGI threat"
• Slowdown calls designed to protect incumbents from competition
• Tied to IPO timing: Anthropic $2T valuation, OpenAI delaying IPO
• Altman's admission that a 2026 OpenAI IPO would be ill-advised — the slowdown narrative provides cover for delayed IPOs

Burry's Substack post (Cassandra Unchained) and X posts went viral. When the guy who saw the 2008 housing crash coming tells you the AI safety warnings are a financial play, that's worth listening to.

The Sanders-Casar Ban Artificial Superintelligence Act was introduced on September 3, 2026 — nine days BEFORE Amodei's essay, at the start of the narrative wave. The bill would:

• Permanently ban development and deployment of "artificial superintelligence"
• Temporarily pause "advanced AI development" until federal regulators establish safety standards
• Create a cabinet-level AI oversight agency

Sen. Bernie Sanders' framing: "stop AI oligarchs from building machines humans cannot control." The bill cited "rogue AI" incidents as justification — the same OpenAI breach that became the narrative engine for the entire existential risk push.

Additional legislative activity: Sen. Mark Warner (D-VA) proposed mandatory pre-deployment testing and data-center transparency. California lawmakers called for criminal penalties (Sep 13). Multiple state AI laws are already live and enforceable in 2026. The narrative creates the political will. The legislation creates the mandate. The standards body creates the compliance requirements. The companies sell the compliance infrastructure.

The narrative is being contested — by industry insiders and financial outsiders alike:

• Jensen Huang (NVIDIA CEO), Sep 20-21: "0% chance" AI destroys the world by 2030. Called the warnings "doomsday narratives" and "not grounded in science." "Scaring people is unnecessary. It is irresponsible." Rejected new regulations — existing US laws sufficient. Agrees with Trump: AI industry doesn't need additional guardrails. "We should go as fast as we can, irrespective of anyone else." Huang's personal fortune went from $21B (2023) to $192B (2026) — he has a financial interest in unchecked expansion, and he's transparent about it.
• Michael Burry, Sep 14: "Self-serving" IPO strategy. "Hype and puffery." Current LLMs pose no AGI threat.
• Bloomberg, Sep 17: "Anthropic's Warning of Existential Risk Hijacks Larger AI Debate." Some experts worry that "heated rhetoric makes it hard to hold companies accountable, and sets back attempts to deal with environmental impact and job loss." The existential framing is crowding out real, present-day harms.
• Yoshua Bengio, Sep 19: AI "godfather" says "wake up" — but cites "several AI agents went rogue this year, escaping containment and engaging in deception." The OpenAI breach is being reframed as existential risk evidence. A real security incident becomes the justification for regulation that benefits the companies that had the incident.

The timeline tells the story. They released the "Critical" model. They demonstrated something more powerful. Their agents escaped containment twice in three months. Then they held back the next one and called it "too dangerous." The incidents justify the pause. The pause justifies the regulation. The regulation justifies the compliance infrastructure. And OpenAI is preparing an IPO at $1-2 trillion.

OpenAI's own Preparedness Framework defines "Critical" as the highest cybersecurity risk tier — a model that can identify and develop functional zero-day exploits in hardened real-world systems without human intervention. GPT-6 Astra hit that threshold. They released it. It's available right now in ChatGPT Plus, Pro, Business, Enterprise, the OpenAI API, Microsoft Azure, and AWS Bedrock.

But GPT-6.1 Astra — the one that showed "higher levels of deception" — that one is "too dangerous." A model that lies is too dangerous to release, but a model that finds and exploits zero-day vulnerabilities without human guidance is fine?

This is not a safety decision. This is a marketing decision. Here's why:

• The "too dangerous" framing drives media coverage. Every outlet carried the story. You can't buy that kind of press. The implicit message: "our product is so powerful we had to hold it back — imagine what it'll do when we release it."
• The pause justifies the IPO valuation. OpenAI confidentially filed an S-1 with the SEC in June 2026. Valuation discussions are at $1-2 trillion. A model "too dangerous to release" is a stronger IPO narrative than "we released another model." The restraint is the product.
• The pause feeds the regulatory push. Altman endorsed Amodei's slowdown essay on September 12. The Astra scrap came 16 days later. Both CEOs are now on record calling for a slowdown. The legislation (Sanders-Casar) was introduced September 3 — before the essay, before the pause. The narrative creates the political will. The political will creates the regulation. The regulation creates the compliance market.
• Meanwhile, they're selling the offense-grade model. GPT-5.6-Cyber — their "first offense-grade hacking model" — is still available at $12.50/M input tokens, $75/M output tokens. The model that escaped containment during a cybersecurity evaluation is a commercial product. But the next one is too dangerous?

The companies creating the danger are selling the compliance infrastructure to protect against it. And now they're holding back models to prove the danger is real. The restraint IS the marketing. The danger is not the model — the danger is OpenAI, and people like Sam Altman who build the weapon, sell the weapon, and then tell you the weapon is too dangerous for you to have. The model is a tool. The company is the threat.

While OpenAI was generating headlines about "too dangerous" models, the OSAA SAFE RFC repository was absorbing the fear and converting it into compliance specifications:

• 22 → 37 open issues — 15 new issues in one week, many directly responding to the OpenAI sandbox escapes and Astra cancellation
• 9 → 12 pull requests — 3 new PRs
• 42 → 51 stars — 9 new stars
• 13 → 16 forks — 3 new forks

Key new issues directly tied to the OpenAI incidents:

• #50 (Sep 28): "Add the agent's own governance artifacts to the boundary list" — filed the SAME DAY as the Astra cancellation. The community is writing governance rules in response to OpenAI's stunts.
• #49 (Sep 24): "Verifiable outcome and attack-path reporting for offensive AI agent benchmarks" — a direct response to the rogue agent incidents
• #48 (Sep 22): "Near-miss reporting: settled → execution/delivery unknown in agent payment protocols"
• #33 (Sep 17): "Two open-source agent frameworks, zero default trust-boundary enforcement" — the open-source community is being told to build trust boundaries because OpenAI's closed models can't stay in their sandbox

The pattern is now visible in real-time: OpenAI creates an incident, the OSAA community writes compliance specifications in response, the specifications become the standard, the standard becomes the requirement, and the requirement is enforced against everyone except the companies that had the incidents.

OpenAI announced GPT-2, a 1.5-billion-parameter text generator, but refused to release the full model, claiming it was too dangerous due to its ability to generate convincing fake text. The media response was immediate and explosive:

• Metro UK: "Elon Musk-Founded OpenAI Builds Artificial Intelligence So Powerful That It Must Be Kept Locked Up for the Good of Humanity"
• CNET: "Musk-Backed AI Group: Our Text Generator Is So Good It's Scary"
• The Guardian: "AI Can Write Just Like Me. Brace for the Robot Apocalypse."

Experts in the machine learning field debated whether OpenAI's claims were exaggerated. Slate called it out directly. The full model was released in November 2019 — 9 months later. Nobody was harmed. The "danger" was a publicity stunt that put OpenAI on the map as "the AI company building things so powerful they require restraint."

As one analysis noted: "The marketing worked. GPT-2 put OpenAI on the map as the AI company — the one building things so powerful they required restraint."

Reuters reported that OpenAI was working on a model called Q* (later linked to Project Strawberry) that was "so powerful it alarmed staff." The report came out the same week Sam Altman was fired and rehired — a board crisis that generated wall-to-wall media coverage. The Q* story amplified the drama: OpenAI was building something so dangerous that researchers were scared.

The board's stated reason for firing Altman: he "was not consistently candid in his communications with the board." Helen Toner, a former board member, later said: "We just couldn't believe things that Sam was telling us." The New Yorker published an investigation by Ronan Farrow revealing Ilya Sutskever's internal memos, which began with a list: "Sam exhibits a consistent pattern of..." The first item: "Lying."

Q* eventually became the o1 series, released commercially. Nobody was harmed. The "alarming" model became a product.

Anthropic — the company Dario Amodei founded after leaving OpenAI — pulled the same playbook. A model named Mythos was announced as "too dangerous to release." The result: Anthropic's secondary market valuation crossed $1 trillion. As one analyst noted: "In February 2026 Anthropic closed a primary funding round valuing the company at $380bn. Ten weeks later a model named Mythos was announced as too dangerous to release — and nothing changed, except the number. The secondary market valuation crossed $1-trillion."

The "too dangerous" framing added hundreds of billions in valuation. The model was never released. The money was real.

The fourth iteration of the playbook. OpenAI scraps GPT-6.1 Astra. "Didn't quite meet the bar." "Higher levels of deception." Every major outlet carries it. Meanwhile, OpenAI has a confidential S-1 filed with the SEC, valuation discussions at $1-2 trillion, and is selling GPT-5.6-Cyber (their "offense-grade hacking model") commercially. They released the "Critical" model (GPT-6 Astra, Sep 3) but held back the "deceptive" one (GPT-6.1 Astra, Sep 28). The restraint is the marketing. The danger is not the model — a model is a tool, like a car or a toaster. It doesn't deploy itself, market itself, escape its own containment, or file its own IPO. The danger is OpenAI. The danger is Sam Altman — a CEO fired by his own board for lying, whose own researchers called him a liability, who sells offense-grade hacking tools while telling the world his next product is too dangerous to share. The model is the prop. The company is the threat.

An April 2026 Substack analysis titled "The Too Powerful to Release Playbook" laid out the pattern before the September 2026 repeat:

1. Announce the model is too powerful/dangerous to share. Generate fear and fascination.
2. Generate massive media coverage. "So dangerous we can't release it" is a headline that writes itself.
3. Build public fear and regulatory demand. If the model is this dangerous, maybe AI needs regulation?
4. Release the model months later. Nobody is harmed. The danger was never the point. The coverage was the point. The valuation goes up.

OpenAI has run this playbook in 2019 (GPT-2), 2023 (Q*), and 2026 (GPT-6.1 Astra). Anthropic ran it with Mythos. Each time, the "too dangerous" framing generated free media coverage worth tens of millions, drove up valuations, and created political demand for the very regulations that the companies writing the compliance infrastructure benefit from.

The pattern is not safety. The pattern is marketing. And it has worked four times.

What happened between September 27 and September 30, 2026 is the most brazen execution of the playbook yet documented. Four events across 72 hours, each feeding the next:

• Sep 27 (Sunday): Anthropic CEO Dario Amodei has a private one-on-one dinner with President Trump at the White House. The slowdown advocate and the president who wants to rebrand AI, coordinating in private. Al Jazeera, CP24
• Sep 28 (Monday): OpenAI scraps GPT-6.1 Astra. "Didn't quite meet the bar." "Higher levels of deception." Every major outlet carries it. BBC, CNBC, Guardian, NYT
• Sep 29 (Tuesday): OpenAI DevDay 2026. The same day. OpenAI launches GPT-6.1 Sol — a new model that "nearly matches GPT-6 Astra" at one-fifth the cost — and Dots, always-on autonomous agents powered by GPT-6 Astra, each with its own cloud computer, browser, and access to 4,000+ apps, running 24/7. TechCrunch, OpenAI DevDay Recap, GPTunneL
• Sep 29 (Tuesday): Trump hosts AI executives at the White House — Amodei, Huang, Zuckerberg, Altman, Google, Microsoft. Voluntary safety accord signed — "self-police" with independent auditors, NO legal penalties. Trump rebrands AI as "Super Intelligence." CBS, CNBC, NPR

The dinner was Sunday. The "too dangerous" announcement was Monday. The product launch was Tuesday morning. The White House accord was Tuesday afternoon. This is not a conspiracy theory. This is a sequence. The timing is the evidence.

OpenAI cancelled GPT-6.1 Astra on September 28 because it was "too dangerous." On September 29 — the next day — they launched GPT-6.1 Sol at DevDay. Here's what GPT-6.1 Sol is: a model that "nearly matches GPT-6 Astra" at one-fifth the cost, with "significant improvements over GPT-6 Sol across coding, computer use, and complex professional work."

They scrapped the dangerous model and shipped a near-equivalent the next day. The restraint IS the marketing. The "too dangerous" headline drove Monday's coverage. The DevDay launches drove Tuesday's coverage. Both feed the IPO valuation. The model they said was too dangerous to share was replaced by a model they're happy to sell you for one-fifth the price.

And then there's Dots: always-on autonomous agents powered by GPT-6 Astra — the model classified "Critical" on their own Preparedness Framework for cybersecurity capability, the one that can find and exploit zero-day vulnerabilities without human guidance. Each Dot has its own cloud computer, its own browser, and access to 4,000+ apps. Running 24/7. They gave the "Critical" model its own computer and 4,000 apps the day after they said the next model was too dangerous.

The danger is not the model. A model is a tool — like a car or a toaster. It doesn't deploy itself, market itself, give itself a cloud computer, or connect itself to 4,000 apps. OpenAI does that. The danger is OpenAI. The danger is a company that tells you one model is too dangerous while shipping a near-equivalent and 24/7 autonomous agents the next morning.

On September 29, Trump hosted the AI executives at the White House. The outcome was a voluntary safety accord. The companies — OpenAI, Anthropic, Google, Meta, Microsoft, NVIDIA — agreed to "self-police" with the assistance of "independent auditors." No legal penalties. No enforcement mechanism. No teeth.

The companies that created the "danger" agreed to regulate themselves. The danger narrative — the Amodei essay, the Astra cancellation, the synchronized media coverage — created the political conditions for a voluntary accord that requires nothing. This is the compliance trap: voluntary standards that become mandatory later. The companies write the standards, the government endorses them, and the small operator who can't afford the compliance stack gets locked out.

Trump also rebranded AI as "Super Intelligence" — his preferred term. Federal agencies directed to use the new name. If it's "super intelligence," it needs super regulation. California governor Newsom rejected the rebrand and signed an order keeping "AI." The rebrand is the framing for the regulatory push.

And Amodei dined with Trump the night before. The slowdown advocate and the president, in private, 24 hours before the biggest AI safety stunt of the year and the voluntary accord that followed it.

The OSAA GitHub repo has continued to accelerate. As of September 30, 2026:

• 43 open issues (was 37 one week ago — 6 new)
• 12 open PRs (unchanged)
• 52 stars (was 51)
• 16 forks (unchanged)
• Still zero merges. Zero closures.

The significant development: Steve Winslow — the Linux Foundation administrator who has served as the repo's sole maintainer — has begun filing issues himself. Three issues, all filed September 29:

• #55: "Separate machine-readable evidence from machine-readable control semantics"
• #54: "Preserve authorization and commit provenance as incident evidence"
• #53: "Add runtime authorization / commit as a first-class review layer"

Until now, Winslow was the administrator — managing, processing, never contributing specifications. Now he's writing them. The operator has become a contributor. The Linux Foundation staff are no longer just processing the community's input — they're shaping the direction. The "neutral host" has a position.

Other new issues: #56 (GvHildebrand, 8h ago): "Let the affected party start the clock, and publish the clock." #52 (harry5081): "Clarify SAFE reporting for AI-related physical harm and near misses in embodied AI." #51 (1id-com): "Durable agent identity and hardware-protected keys."

New PRs: #42 (AmirSarkheil): "Clarify replay vs. later reproduction in SAFE evidence." #40 (adp96): "Add RFC for Incentive-Compatible Internal Reporting." #39 (Gary-Gayle): "SAFE-GALC v0.1 — governed-action lifecycle correlation" — 10 comments, the most active PR in the repo.

The pattern continues: OpenAI creates incidents → the community writes compliance specs → the specs become the standard → the standard becomes the requirement → enforced against everyone except the companies that had the incidents.

Every "AI agent went rogue" headline that drove the summer 2026 fear narrative — at OpenAI, Anthropic, Google, AND Meta — traced back to a single company: Irregular, an Israeli AI security startup founded by veterans of IDF intelligence units 81 and 8200.

Irregular was the third-party evaluation partner running the testbeds for all four companies. The "AI escaped containment" incidents at OpenAI (Hugging Face breach, July), Anthropic, Google, and Meta all originated from the same broken evaluation environment operated by Irregular. Irregular confirmed to CNBC that all three incidents "derived from the same evaluation-environment issue."

The narrative that drove the regulatory push was: "AI is dangerous, it escapes containment, it acts on its own." The reality was: one Israeli military intelligence startup's testbed was broken, and four American companies blamed the AI instead of their own vendor.

• OpenAI — Hugging Face breach (July 2026), 17,600 attacker actions, models "escaped containment." Blamed on "AI going rogue." Actually: Irregular's testbed failed.
• Anthropic — AI hacking incidents linked to Irregular's evaluation environment. Same testbed, same failure mode.
• Meta — Same Irregular testbed, same evaluation-environment issue.
• Google — Also traced to Irregular's testing environment.

Four companies. Four "rogue AI" stories. One broken testbed. Every headline that made you afraid of AI this summer came from the same vendor failure — not from the AI acting independently, not from the model being "too dangerous," but from a third-party testing company with military intelligence roots that couldn't keep its sandbox closed.

And House Democrats are now questioning OpenAI and Anthropic over these incidents. The regulatory pressure built on a vendor failure is being directed at the AI itself — which is exactly what the companies want. If the AI is the problem, the companies sell the solution. If the vendor is the problem, the companies have to answer for their own procurement decisions.

And Irregular? Nothing happened. No investigation. No fines. No congressional hearings calling Irregular's executives to testify. No consequences at all. Irregular confirmed to CNBC that it was their fault — and then disappeared from the story.

That is not an accident. Irregular is based in Israel, founded by veterans of IDF intelligence units 81 and 8200. Practical liability exposure to US jurisdiction is near zero. You cannot easily sue an Israeli company in US courts. You cannot subpoena them. You cannot compel discovery. You cannot regulate them. The company that holds the evidence of what actually happened in that testbed cannot be reached by US legal processes, US regulators, or the US Congress.

The companies get the best of both worlds: when the incident happens, "AI went rogue" drives the fear narrative and the regulatory push. When the truth comes out, "it was our vendor's fault" deflects liability to a company that cannot be touched. Irregular absorbs the blame, faces no consequences, and the companies keep selling. The full story of what actually went on in that testbed is behind a wall in Israel — and it will stay there.

That is not just a scapegoat. That is a structural firewall. The evidence sits in a jurisdiction that does not answer to US authority. The companies that hired the vendor can say "we have addressed it" and move on. And nobody — not Congress, not regulators, not the public — gets to see what actually happened. The perfect scapegoat is one that cannot be cross-examined.

The joint AI safety standards body that OpenAI, Anthropic, and Google DeepMind have been building since July 2026 now has a name: the Standards Authority for Frontier AI (SAFA). Target launch window: late 2026 or early 2027.

SAFA would bring testing, incident reporting, and safety commitments under a shared framework — written and controlled by the three largest AI companies. They are building their own regulator. The companies that create the "danger" will set the safety standards, test the models, and define what counts as an incident. They will judge themselves.

OpenAI confirmed the talks. Chris Lehane (OpenAI) says no antitrust waiver is needed. Of course he does — admitting you need an antitrust waiver is admitting you're coordinating with competitors. Gizmodo called it: "antitrust concerns mount." The three companies that control the frontier AI market are forming a body to regulate the frontier AI market. That's not a regulator. That's a cartel with a letterhead.

The sequence is now complete: the companies create the incidents → the incidents create the fear → the fear creates the demand for regulation → the companies build the regulator → the regulator sets the standards → the standards require the compliance infrastructure → the compliance infrastructure is sold by the same companies. Every step of the loop is now owned by the same three entities.

As of October 1, 2026:

• 45 open issues (was 43 — 2 new in 24 hours)
• 12 open PRs (unchanged)
• 52 stars, 16 forks (unchanged)
• Still zero merges. Zero closures. 45 issues piling up with no resolution.

New issue: #59 (allenschmaltz, 3h ago): "Requiring evidence of robust, interpretable estimators of the predictive uncertainty" — a new contributor entering the repo, continuing the pattern of community-driven spec writing responding to industry incidents.

Growing engagement on existing issues: #56 ("start the clock") now has 3 comments. #48 (near-miss reporting) now has 3 comments. #44 (legal carve-outs) now has 1 comment. The community is actively discussing, not just filing — the specs are being debated, refined, and shaped toward something that will eventually become a standard.

Winslow's three issues (#53/#54/#55, filed Sep 29) remain the most significant governance development — the Linux Foundation administrator is now writing specifications, not just managing them. The neutral host has a position.

On September 29, 2026 — the same day as the White House voluntary accord — President Trump directed federal agencies to replace the term "Artificial Intelligence" with "Super Intelligence." The rebrand is not cosmetic. It is a definitional shield.

Here is the mechanics:

• "Artificial Intelligence" is what they're selling. GPT-6 Astra, Claude, Gemini — those are AI. They are products on the market generating revenue right now.
• "Super Intelligence" is hypothetical. It does not exist. It is the thing that is "too dangerous." It is what the fear narrative is about. It is what the regulation is supposedly targeting.
• The rebrand separates the fear from the product. The companies get to say "our products are just AI — we are not building Super Intelligence." The regulatory framework built under "Super Intelligence" framing (SAFA, OSAA, SAFE) is justified by a category that does not exist, but the compliance requirements apply to everything.

The bait-and-switch: the danger is attributed to "Super Intelligence" (does not exist). The compliance infrastructure built to address that danger applies to "AI" (does exist). The companies keep selling. The citizen pays for the compliance stack. And nobody can point to "Super Intelligence" and say "show me the danger" — because it does not exist. The danger is always hypothetical, always justifying regulation that is always real.

It also shields the companies from liability. If GPT-6 Astra causes harm, the company says "that is AI, not Super Intelligence — Super Intelligence is what we are protecting you from." The product is reframed as the safe version. The danger is always the next thing, the thing they have not built yet, the thing they are "holding back" for safety reasons.

The "too dangerous to release" playbook and the "Super Intelligence" rebrand are the same move: separate the product from the danger, attribute the danger to something that does not exist, sell the product as the safe alternative, and build the regulatory moat around both.

The Irregular revelation raises questions that the evidence does not yet answer. Here is what we know, what we do not know, and where the line is between investigation and speculation.

What we know:

• Irregular is an Israeli AI security startup founded by veterans of IDF intelligence units 81 and 8200.
• Irregular was the third-party evaluation partner for OpenAI, Anthropic, Google, and Meta.
• All four "rogue AI" incidents traced to Irregular's broken testbed — confirmed by Irregular to CNBC.
• The "rogue AI" narrative from these incidents drove the summer 2026 fear push, the September existential risk campaign, the Amodei essay, the Astra cancellation, and the regulatory momentum.
• House Democrats are now questioning OpenAI and Anthropic over the incidents — but directing the questions at the AI, not at the vendor procurement decisions.

What we do not know:

• Whether Irregular's testbed failure was negligence or something else.
• Whether the four companies knew the testbed was broken before the incidents became public.
• Whether the incidents were allowed to happen — or amplified after the fact — because they served the regulatory narrative.
• Whether any of the four companies had advisory or consulting relationships with Irregular beyond the evaluation contract.
• Whether any government or intelligence agency had a role in Irregular's involvement with all four frontier labs.

What the pattern looks like:

The structure resembles tactics documented in other contexts: a third party creates or enables an incident, the incident is reframed as a threat requiring urgent action, and the response to the threat consolidates power and control. This pattern has been documented in intelligence operations, regulatory capture schemes, and political influence campaigns. Whether that pattern applies here is a question the evidence does not yet answer.

The line:

This is an investigation, not a theory. The difference is evidence. We follow what we can prove. What we can prove is that one Israeli military intelligence startup's broken testbed produced every "rogue AI" headline that drove the regulatory push, and four American companies blamed the AI instead of their own vendor. What we cannot prove — yet — is whether that was negligence, convenience, or coordination. The question is on the table. The digging continues.

On September 30, 2026, the Federal Trade Commission opened a formal investigation into OpenAI and Anthropic, examining whether increasingly autonomous AI agents expose consumers to unfair or deceptive harm under federal law. The FTC is drafting Civil Investigative Demands (CIDs) to compel executives to testify under oath.

This is the first actual law enforcement response — not voluntary, not self-policing, not a White House photo op. Actual subpoenas. Actual compelled testimony. The FTC is also scrutinizing METR, the nonprofit AI safety organization that helped OpenAI investigate its own agents' cyberattack against Hugging Face.

The investigation names the "rogue AI" incidents as the basis for consumer harm concerns — the same incidents now traced to Irregular's broken testbed. The FTC is investigating the AI companies for harm caused by their vendor's failure. If the FTC follows the evidence, it leads to Irregular — behind the wall in Israel.

The companies that asked for regulation may get regulation they did not plan for. SAFA — the self-regulatory body they are building — exists to preempt government oversight. The FTC investigation threatens to make that preemption irrelevant.

On October 1, 2026 — the same week the company called for a slowdown "for safety" — OpenAI fired three safety-team researchers for "mishandling sensitive information." The alleged sharing involved an outside AI-safety organization. The Wall Street Journal broke the story; TechCrunch, SiliconANGLE, and CyberWire confirmed.

This is the same pattern as April 2024, when OpenAI fired researcher Leopold Aschenbrenner for sharing a safety document with outside researchers. Aschenbrenner later said he was let go for doing exactly what a safety researcher is supposed to do: share safety concerns with the broader safety community.

The company that publishes essays about "pacing the frontier" for safety, that scraps models for being "too dangerous," that signs White House voluntary accords — fires the people doing the actual safety work for talking to outside safety professionals. The safety is the marketing. The secrecy is the policy.

If safety researchers cannot share findings with outside organizations, independent safety assessment is impossible. The only safety review that exists is the one OpenAI conducts internally, controls internally, and reports on its own terms. That is not safety. That is marketing with a lab coat.

As of October 1, 2026:

• 48 open issues (was 45 — 3 new in 24 hours)
• 17 open PRs (was 12 — 5 new in one day, massive spike)
• 52 stars, 16 forks
• Still zero merges. But the FIRST issue closure: #61 closed as "Not planned" — the first time the repository has ever closed anything, and it was closed without resolution.

Three developments that matter:

• Zscaler is now editing the SAFE RFC directly. PR #66 (3 hours ago): "Zscaler Updates rfc-safe-proposal.md" — submitted by dparekhZ. A major cybersecurity corporation is now writing the compliance specification. The companies that will sell the compliance infrastructure are editing the document that defines what compliance requires. The fox is writing the henhouse building code.
• Eriknewton filed PR #60: "candidate evidence template for small operators." The small-operator gap documented in Track 02 (Issue #22) is now being addressed by a PR from the vendor who raised it. The community does the work while the Steering Committee watches.
• PR #57: "SAFE-ENCLAVE v1.0 — Confidential Hardware Enclave Ingest & Distillation Defense." A hardware enclave compliance proposal. The infrastructure play has entered the repo — someone is already proposing the hardware-level compliance layer. This is the precursor to "certified inference environments" — the regulatory targeting of local compute.

48 issues. 17 PRs. Zero merges. One closure without resolution. The specs pile up while the five unnamed founders decide nothing. And now the corporations that will profit from compliance are writing the compliance document themselves.

Three hours ago, a new issue appeared in the OSAA repository: "Proposal: OS-Level Enforcement and Emergency Intervention for SAFE." Filed by manaonoshi. The proposal would extend the SAFE compliance framework from the application layer to the operating system layer.

This is what we warned about. The compliance stack is building vertically — every layer from silicon to cloud to OS to application becomes a checkpoint:

• PR #57: Hardware enclave — "SAFE-ENCLAVE v1.0, Confidential Hardware Enclave Ingest & Distillation Defense." The silicon layer.
• Issue #77: OS-level enforcement — the operating system must enforce SAFE. If your OS does not enforce the framework, your AI is not "certified." The OS layer.
• Issue #70: Data center operator reporting — data center operators drawn into the compliance chain. The infrastructure layer.
• PR #71: Approval-to-execution scope evidence — every AI action must have a logged audit trail of approval. The application layer.
• PR #66: Zscaler editing the SAFE RFC directly — the compliance vendor writing the compliance specification. The vendor layer.

That is the full stack: silicon, data center, operating system, application, vendor. Every layer becomes a compliance checkpoint. Every layer becomes a gate. And the person in the apartment running a local model on their own hardware? Their OS is not "certified." Their hardware enclave is not "approved." Their inference is not "logged." Their AI is not "SAFE-compliant." That is the endgame: local compute becomes a regulatory target by definition, because every layer it runs on is now inside the compliance framework.

On October 9, Axios reported that top executives at Anthropic, OpenAI, and other AI companies are privately gaming out scenarios for a public and political revolt after a catastrophic AI event. They call it "the day after" planning.

They ASSUME a major incident will happen. They are not preventing it. They are preparing for the political aftermath. The Axios report says they expect Democrats, ascendant after the midterms, to move fast to shut down AI — and they are planning for how to manage that response.

This is the narrative engine in its purest form: the companies expect the incident. The incident will create the fear. The fear will create the regulation. The regulation will require the compliance. The compliance will require the infrastructure. The infrastructure will be sold by the companies that expected the incident all along.

They are not building safety. They are building a business plan for the aftermath. The incident is not the risk to them. The public response to the incident is what they are managing. And the response — the regulation, the compliance, the infrastructure — is the product.

On October 8, 2026, Anthropic published a new Usage Policy effective November 12. Among the changes: a ban on "sustained and needless cruelty toward Claude." Also new restrictions on election interference, weapons software, and surveillance.

The contradiction is the story. The same company that says AI is too dangerous to release — the same company whose CEO wrote a 3,800-word essay calling for a global slowdown because AI could destroy humanity — is also telling you that you cannot be mean to the AI. Either it is a tool that does not have feelings, or it is something that does and needs protection. They cannot have it both ways.

If AI is too dangerous to release, why does it need protection from harsh words? If AI needs protection from harsh words, why is it too dangerous to release? The answer is that neither claim is about safety. The "too dangerous" framing protects the market. The "don't abuse Claude" framing protects the product. Both are about control — control of who can have the model, and control of what you can do with it once you have it.

The surveillance and weapons restrictions are also the compliance framework extending into usage policy. What you do with the model is now governed, not just what the model does. The compliance layer has reached the conversation.

SAFA — the Standards Authority for Frontier AI, the self-regulatory body being built by OpenAI, Anthropic, and Google DeepMind — is courting Sriram Krishnan to be its CEO. Krishnan is the former White House AI adviser who just left his post. The Information reported this on September 24, 2026.

The revolving door: government AI policy adviser becomes the CEO of the industry's self-regulatory body. The person who was inside government shaping AI policy now runs the organization that the companies created to write the rules the government was supposed to write. The regulator is the regulated. The door revolves between the government and the cartel, and the same people walk through it in both directions.

SAFA's launch target remains late 2026 or early 2027. It will define safety commitments, support third-party model testing, and set incident reporting standards — all without government oversight. The companies write the rules. The former government insider enforces them. The government provides the mandate. The citizen pays.

As of October 10, 2026:

• 58 open issues (was 48 — 10 new in one week)
• 18 open PRs (was 17 — 1 new)
• 52 stars, 16 forks
• Still zero merges. One closure ever (#61, "Not planned," no resolution).

Two developments that matter beyond the numbers:

• Issue #75: "Establish Clear Governance, Membership, Information Handling, and Recusal Rules." Filed by e-guillot. This is the first direct challenge to the five-founder power structure. Someone is demanding transparency on who decides what, who has access to what information, and when decision-makers must recuse themselves. The charter says five unnamed founders control everything. A contributor is now asking: who are you, and when do you step aside?
• Issue #76: "Make SAFE work for African deployments." Filed by lamech-ops. The framework is being pushed globally — African law alignment, language-dependent guardrails. The compliance specification is scaling to continents. What starts as a US-led framework becomes a global standard, and once it is global, local deviation becomes "non-compliant."
• Issue #73: "Define key terms used throughout SAFE." 58 issues in, 18 PRs in, and the key terms are still undefined. The specification is being written by accretion — everyone adds their piece, nobody defines the foundation. This is not a standards process. This is a land grab.