The last few months have seen revolutionary changes in the artificial intelligence landscape.
In April, Anthropic announced that its latest AI model, Mythos, was so adept at penetrating most cybersecurity systems that the company limited its release to a few clients so they could develop countermeasures to secure their systems. Gen. Joshua Rudd, head of the National Security Agency and U.S. Cyber Command, told Sen. Mark Warner (D-Va.), "This tool broke into almost all of our classified systems, not in weeks, but in hours… we are not going to solve this problem if we rely on a less ethical CEO operating on the basis of plain voluntary testing alone.”
The Trump administration initially banned Mythos and another Anthropic AI model, Fable, from being exported and only recently lifted the restrictions. Since then, the administration has issued a new executive order on managing the risks of frontier AI that seeks to prevent individual states from creating their own AI regulatory regime while overseeing the release of potentially dangerous AI systems. It's a good start in that it allows for the rapid release of potentially revolutionary models (a 30-day review) while ensuring the safety of the public and businesses by slowing down the headlong rush to get new models to market.
"The order is best understood as an attempt to engineer a cybersecurity window of opportunity," observes The Council on Foreign Relations. "It grants defenders preferential access to frontier cyber capabilities while attempting to delay adversary access through a prerelease evaluation period and a classified National Security Agency-run process for designating 'covered frontier models.'”
OpenAI is offering the government a 5% stake in the company, ostensibly to give the government the ability to "share" the benefits of AI with the public. More to the point, the 5% stake in a trillion-dollar company is meant to ease the regulatory pressure on Sam Altman and OpenAI.
In fact, "Altman suggested a stake of that size in early discussions with the Trump administration, as part of a broader arrangement under which Washington would hold 5% of each of the leading U.S. AI developers via a government vehicle," according to the Financial Times.
The development of artificial intelligence models and the systems that use them is moving too far and too fast for our 250-year-old, hidebound government to adequately respond. This creates the illusion of chaos when innovation is being driven by artificial intelligence itself.
The faction in the government and industry that wanted a light regulatory hand on AI businesses has lost the argument. Clearly, some kind of serious regulation is necessary. But how do you develop a regulatory regime that satisfies the need for safety with the necessity of allowing AI companies to thrive in an open, competitive environment?
Francis Fukuyama, writing in Persuasion:
The problem up to now was that pro-regulation advocates could not define clearly the sorts of harms regulation was meant to protect against. Now there is a clear harm (cybersecurity), and so a more thoughtful institutional design effort can begin. Such an effort would need to answer the following questions:
Do we need a specialized regulator for AI, or is this a function that can be added on to existing bodies like the NSA or the Defense or Commerce Departments?
Regardless of which government entity does the regulation, how do we get sufficient capacity into the bureaucracy so that it can make well-informed decisions? U.S. government capacity in this area is woefully deficient. The typical approach in the past has been to outsource state capacity to private actors, but under present circumstances this could easily lead to regulatory capture by big, self-interested players.
How does a regulator do surveillance and enforcement of any rules that it creates? The AI industry is huge and growing bigger by the day; moreover, foreign countries like China also have significant capabilities very close to those of the United States. If we deem a certain AI capability to be dangerous, how will we know that it is being developed, and how will we enforce rules limiting it? As Senator Warner’s remarks indicate, we are currently dependent on the good intentions of the CEOs running today’s large companies.
To what extent should we delegate discretionary authority to the new regulator? In the past, statutes have spelled out the specific rules that the regulator was meant to enforce. But the AI field is evolving so quickly that any effort to write such specifications into hard law will be almost immediately overtaken by technological change.
"It is time to stop talking about whether we need an AI regulator; the dangers are here and now, and we need to move quickly," writes Fukuyama. "The discussion needs to shift to a much deeper and more specific analysis of how to regulate, understanding that the dangers posed by AI are likely to change over time."
No government, especially one governing 340 million people, is capable of moving at the speed at which companies innovate. Streamlining the regulatory process risks issues falling through the cracks, while reviewing every change in an AI model would mean excruciating delays in releasing frontier AI.
The biggest danger is that before we figure it out, either China races ahead in AI integration or the worst fears of AI skeptics come true. Getting it right the first time would be preferable.
