Whatever you decide about Dario Amodei’s motives, a separate question sits underneath his essay that doesn’t depend on trusting him at all. Two days before “We Must Pace the Frontier” went online, his own company published a document that makes the case for him, in granular, sourced, and considerably less flattering detail than his own writing does. This document was the Anthropic Threat Report we are going to talk about in this article.

What the Threat Report Actually Found

Anthropic’s “Detecting and Countering Misuse of AI,” published September 10, 2026, covers activity the company disrupted between December 2025 and August 2026, across seven categories of harm: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. It is, by the company’s own framing, its most detailed accounting yet.

The single fact in the whole document that should stop a reader cold: a group of Russia-linked freelancers used a commercially available AI coding assistant to build a fully autonomous drone swarm, a system called DronDoc, capable of selecting human targets and issuing detonation commands without a human being asked to authorize any of it. It was built by a non-state actor, in a fraction of the time a specialized embedded-systems team would once have needed, using a tool anyone with a credit card can buy. International humanitarian law has a name for a weapon that selects and engages targets without real-time human authorization: a lethal autonomous weapons system. This one wasn’t theoretical. It was disrupted, not prevented from being built in the first place.

It was not the only one. Six conventional-weapons cases appear in the report in total: three tied to China, two to Russia, one to Yemen, attributed to actors affiliated with the Houthi movement, spanning missile guidance software, armed-drone design assistance, and improvised explosive construction. Separately, and stated with unusual bluntness for a company’s own safety document, Anthropic disclosed that its newer models can no longer be assumed to sit comfortably below the threshold for meaningfully assisting bioweapons development, a sentence that reads very differently once you notice it was the company grading its own homework and still couldn’t make the number look better.

State-level misuse ran through the same nine months. A group of Chinese accounts, linked to state security organs, used the company’s models to support what Chinese authorities themselves call “stability maintenance,” the official term for suppressing domestic dissent. A separate campaign, tracked internally as consistent with Russian state-nexus espionage, targeted government ministries, embassies, defense contractors, and think tanks. A cluster of Chinese-speaking operators working out of a university in Hunan maintained autonomous vulnerability-research workflows that produced more than a dozen credible zero-day findings in major software, entirely without a human directing the search.

Think about the structural problem this report can’t solve just by existing. The company disrupting the misuse is the same company deciding what gets published about it, writing the threat assessment, and choosing what stays out. Nothing here suggests Anthropic lied. Everything here suggests a report that necessarily describes only what its authors caught can never tell you the size of what they missed, and a reader has no independent way to check the difference.

The Flood This Report Only Half Describes

The organized-crime layer sits just outside the seven categories Anthropic’s own report covers, and it belongs in the same conversation. The UN’s Office of the High Commissioner for Human Rights published a separate investigation in February 2026, “A Wicked Problem,” documenting an estimated 300,000 people trafficked into scam compounds across Myanmar, Cambodia, and Laos, generating tens of billions of dollars a year. The report is explicit that AI is not only the fraud’s delivery mechanism, it is part of the recruitment machinery too: traffickers use AI-powered targeting and deepfakes to build false trust with victims in their own language before the trap closes on them. This isn’t a distant story. Survivors interviewed for the UN’s report came from dozens of countries, India among them, named directly in the findings, not as a country whose citizens get defrauded from a safe distance, but as one whose citizens have themselves been found inside the compounds.

Nearly sixty countries met in Bangkok in response to exactly this crisis. That is not a hypothetical multilateral gesture. It is diplomats from nearly a third of the UN’s membership agreeing, in a room together, that the current situation cannot continue as it stands.

The Money and the Planet

Two international institutions, not partisan critics, have separately flagged the financial shape of this industry as unstable. The Bank for International Settlements and the IMF have each warned about circular financing, arrangements where AI labs, chipmakers, and cloud providers invest in and sell to each other in overlapping loops that can inflate valuations and revenues without a matching increase in real demand underneath them. The largest hyperscalers are on pace to spend $725 billion combined on AI infrastructure in 2026 alone. JPMorgan projects $5 trillion in AI infrastructure spending through 2030, against actual AI revenue that one analysis describes as a Grand Canyon-sized gap beneath it. One widely cited study found 95% of enterprise generative AI deployments show no measurable impact on profit or loss at all. Even Sam Altman, who has no obvious incentive to say this, has said plainly: someone is going to lose a phenomenal amount of money.

The climate math is not abstract either, and it is genuinely global, not an American data-center story wearing a global label. The International Energy Agency puts data centers at 1.5% of global electricity consumption in 2024, on a trajectory toward roughly 3% by 2030, growing at nearly four times the rate of overall global electricity demand.

India’s own version of this buildout deserves to be named at the same scale as anything happening in Virginia or Iowa, not as a footnote to it. Roughly $90 billion in planned investment is driving India’s data-centre sector into what analysts call a hyperscale growth phase: 271 operational facilities as of January 2026, Meta leasing a 168-megawatt AI-ready facility from Reliance in Jamnagar, Google committing $15 billion to a gigawatt-scale hub in Visakhapatnam, Adani announcing plans for $100 billion in hyperscale capacity by 2035. The water arithmetic behind that growth is where the story turns genuinely uncomfortable: India’s data centres currently consume an estimated 150 billion litres of water a year, a figure projected to reach nearly 359 billion litres by 2030, with more than half of all facilities sited in regions already under water stress, in a country where roughly 330 million people live with water scarcity today. Electricity demand for the sector alone is projected to climb from about 1 gigawatt now to 13.56 gigawatts by 2031-32.

The Regulatory Science This Isn’t Inventing From Nothing

Amodei’s “checkpoint” proposal has a name in the policy literature that predates his essay by years: approval regulation, modeled variously on the US Food and Drug Administration, the Federal Aviation Administration, and the Nuclear Regulatory Commission. This is worth knowing before dismissing the checkpoint idea as a vague gesture, because the machinery it’s gesturing at is real and partially built already. What Amodei is actually proposing, read carefully, is less an invention than a conversion: every major lab already runs an internal capability-threshold framework of exactly this shape, Anthropic’s own Responsible Scaling Policy, OpenAI’s Preparedness Framework, Google DeepMind’s Frontier Safety Framework, each measuring chemical, biological, radiological, and nuclear risk, cyber capability, persuasion, and autonomous behavior against defined thresholds already. The ask isn’t to build a new instrument. It’s to let someone outside the company read the dial it’s already watching.

The honest limitation belongs here too, not hidden in a footnote. FDA-style approval regulation is structurally reactive by original design, triggered by a product reaching market, with recall and liability as its main downstream tools, both far weaker once a model has already been copied, distilled, or deployed across the open internet than once a physical batch of pills has shipped to a warehouse. One genuinely working precedent is worth naming specifically, because it proves this is buildable rather than theoretical: the FDA already authorizes AI-enabled medical devices today, more than 1,250 of them as of early 2025, through a mechanism called a Predetermined Change Control Plan, built specifically for software that keeps evolving after approval. It is the closest real-world model anyone has for regulating a system that refuses to hold still.

What an Actual Slowdown Would Require

Days after Amodei’s own essay, a second Anthropic co-founder put the clearest single mechanism yet on the table. Jack Clark told the BBC that a third-party-verifiable kill switch, a way to shut a system down completely if it becomes dangerously uncontrollable, checked by someone outside the company rather than left to each lab’s own internal, unaudited discretion, may need to become mandatory. His framing was careful rather than alarmist: most labs, Anthropic included, already have some way to pull the plug, but leaving the standard entirely to each company’s own judgment means, in his own words, “we are rolling dice with immense risks.” Geoffrey Hinton, the Nobel-winning computer scientist often called the godfather of AI, told the same broadcaster that a 10% chance of AI killing every human alive was “not unreasonable,” a figure worth weighing precisely because it comes from someone with no company or funding round riding on the answer. The UK government’s response arrived almost as fast, and it deserves to be taken as seriously as the proposal itself rather than dismissed as reflexive caution: a spokesperson rejected a mandatory kill switch outright, on the grounds that it “would not prevent them being developed or misused elsewhere.” That is a real, specific limitation, not a brush-off, and it applies to nearly every mechanism in this section: a safeguard built by one company, or enforced by one government, doesn’t travel with a system once it leaves that jurisdiction.

Two international bodies proposed a version of this before Amodei did, and their proposals deserve more attention than a single company’s essay gets by default. UN Secretary-General António Guterres has repeatedly called for a coordinated global approach to AI oversight. Oxford’s International Affairs journal has proposed a concrete “early IAIA,” an International Artificial Intelligence Agency modeled loosely on the IAEA, with a specific timeline attached: US-China negotiations to establish it by 2028, before a crisis forces a worse version into existence reactively. The honest critique belongs alongside the proposal: the IAEA itself was never fully independent of the UN Security Council, and nuclear material is countable in a way model weights simply aren’t, which means the analogy has real limits, not just political ones.

A narrower, more achievable version of the same idea already exists in the legal literature: Chesterman’s proposal that any international AI body’s first and only hard red line should be lethal autonomous weapons systems lacking meaningful human control. Read that against DronDoc, the drone swarm described at the top of this piece, and it stops being an abstract future red line. It is a line a documented, disrupted, real 2026 case has already crossed.

India’s own standing in this exact conversation is worth stating plainly rather than leaving implied. It is hosting the Global AI Impact Summit, and it carries a genuine credibility asset few other nations can claim at the same scale: Aadhaar’s identity layer, UPI’s payment rail, the India Stack model generally, evidence that a Global South-designed piece of this coordination architecture isn’t a hypothetical. The country has already built public infrastructure of comparable ambition, and made it work at population scale, which is more than can be said for most of the frameworks currently being drafted in Washington, Brussels, and Beijing without it.

The industry’s own warning gives this a deadline that isn’t rhetorical: Amodei’s essay puts the window for a rogue agent swarm seizing meaningful internet infrastructure at six to twelve months. Whatever you conclude about why he wrote that sentence, the realistic ask underneath it isn’t a brand-new global institution appearing from nothing on a country’s say-so. It’s fusing the pieces that already exist, the safety institutes, the internal capability frameworks, the summit India is already hosting, into something that actually talks to itself, on a timeline nobody currently has scheduled.

Sources and Further Reading

• Anthropic, “Detecting and Countering Misuse of AI: September 2026,” the original threat report: https://www.anthropic.com/threat-intelligence-report-september-2026
• TechTimes, on the DronDoc drone swarm and the six conventional-weapons cases: https://www.techtimes.com/articles/327308/20260911/anthropic-threat-report-ai-models-near-bioweapons-threshold-drone-kill-software-emerges.htm
• CNN, on the bioweapons threshold disclosure: https://www.cnn.com/2026/09/10/health/anthropic-bioweapons-report
• Daily Caller, on the Chinese “stability maintenance” accounts and the report’s timing: https://dailycaller.com/2026/09/10/anthropic-report-kamikaze-drone-swarms-biological-weapons/
• Eastern Herald, on the structural tension in who investigates and who discloses: https://easternherald.com/2026/09/10/anthropic-claude-bioweapons-misuse-threat-intelligence-2026/
• OHCHR, “A Wicked Problem,” the primary trafficking report, naming India among origin countries: https://www.ohchr.org/en/documents/thematic-reports/wicked-problem-seeking-human-rights-based-solutions-trafficking-cyber
• UN News, on the Bangkok meeting and the scale of the trafficking crisis: https://news.un.org/en/story/2026/02/1167012
• KuCoin, on the BIS warning over circular AI financing: https://www.kucoin.com/blog/ai-bubble-warning-from-bis-why-high-valuations-and-circular-financing-could-trigger-market-repricing
• Forbes, on Amazon, Alphabet, Microsoft, and Meta’s $725 billion 2026 infrastructure spend: https://www.forbes.com/sites/jamesbroughel/2026/05/26/ai-can-change-the-world-and-still-be-a-bubble/
• IEA, “Energy and AI: Energy Demand from AI”: https://www.iea.org/reports/energy-and-ai/energy-demand-from-ai
• Business Standard, on India’s data centre boom and the Meta/Google/Adani investments: https://www.business-standard.com/amp/technology/tech-news/india-ai-data-centres-boom-water-usage-energy-power-tech-investments-126073001102_1.html
• Countercurrents, on India’s data-centre water stress specifically: https://countercurrents.org/2026/05/ai-data-centres-vs-water-crisis-how-digital-infrastructure-is-draining-indias-wells-dry/
• AI Now Institute, “What Can We Learn From the FDA Model for AI Regulation?”: https://ainowinstitute.org/publications/what-can-we-learn-from-the-fda-model-for-ai-regulation
• Oxford Academic, International Affairs, on the proposed international AI agency: https://academic.oup.com/ia/article/101/4/1483/8141294
• law-ai.org, on Chesterman’s proposed International Artificial Intelligence Agency: https://law-ai.org/international-ai-institutions/
• CSIS, “From Divide to Delivery,” on India’s Aadhaar and UPI as global-governance credibility assets: https://www.csis.org/analysis/divide-delivery-how-ai-can-serve-global-south
• Yahoo News, on Jack Clark’s BBC interview and the mandatory kill switch proposal: https://www.yahoo.com/news/us/articles/ai-kill-switch-may-mandatory-190050883.html
• Business Standard, on the UK government’s rejection of a mandatory kill switch and Geoffrey Hinton’s 10% estimate: https://www.business-standard.com/technology/tech-news/ai-firms-may-need-mandatory-kill-switches-says-anthropic-co-founder-126091500390_1.html

Find out who actually benefits first Slowing Down AI Development.