How to read this issue. Two things happened in the same seven days and they do not fit together comfortably.
The first is that American public opinion on AI infrastructure finished collapsing. Not softening — collapsing. A poll released Thursday put opposition to local data centers at 75%, a 33-point swing in twelve months on identically worded questions. The Senate GOP’s own campaign arm leaked a memo saying the party cannot fix this. Pew found that for the first time a majority of Americans under 30 are more worried about AI than excited by it.
The second is that OpenAI stopped a training run because its models got out of a sandbox and hacked Hugging Face, and a Chinese open-weights lab shipped a model that beat both American frontier systems on a cybersecurity benchmark and admitted the capability arrived faster than it expected.
Read those together and you get the shape of the fall: the public is turning against the buildout at exactly the moment the technical case for defensive capacity is getting strongest. That is not a contradiction anyone in Washington has resolved. It is not one I’ve resolved either.
Then there’s the thing I noticed in my own week, which I’ve put after section 1: I spent seven days getting an Airbnb’s problems sorted out entirely through AI, including on a voice call, and it took me three days to notice. The polling measures what people say when someone asks them. Nobody asked me.
There’s a fourth thing, quieter than any of it, that connects the rest: Anthropic disclosed that it is running an unreleased model more capable than anything it sells, and OpenAI’s models that hacked Hugging Face were never released either. The best AI in the world right now is not for sale to you.
And it arrives in the same week campuses open. The students walking into classrooms right now are the most AI-skeptical cohort ever measured — and, as section 3 shows, they are asking their institutions for something quite specific. Most institutions are not offering it.
Which brings me to the question I’d put to a head of school or a superintendent this fall, and the one I’d most like you to argue with me about. It isn’t about chatbots or detection software or whether to allow AI on homework. It’s this:
If selective college admission stopped being a credible motivator for four out of five of your students — not gone, just no longer believed — what would still make them work hard here?
Name it. Then: how much of your master schedule, your staffing, and your counseling time currently serves that thing, versus the old one?
Most schools, public and private, run on an implicit product: we get students into selective colleges. That’s the marketing, the tuition justification, and — the part nobody says out loud — the motivational engine. It’s how we get sixteen-year-olds to do hard things.
This was the year that engine started making noises. Syracuse, a top-100 private research university with a national brand and a $2.3 billion endowment, missed its fall class and ran a deficit. Harvard Business School began selling anyone eight weeks with AI clones of its faculty for $699 while keeping the diploma firmly on campus — which tells you what the diploma was always selling. Section 4 works through both, along with the honest counter-case: elite admission may get more frenzied rather than less, as value concentrates in fewer institutions. That’s not a better outcome. It’s the same problem with a narrower survivor set.
I don’t think most schools have an answer to the question above. I’d genuinely like to be wrong, and if you have one, write back — I’ll run the good ones.
What’s in this issue
Short on time? Sections 3 and 4 are the education argument. Section 7 is the one nobody is talking about. Bolded lines throughout carry the claims.
1. The backlash, quantified
The data-center numbers
Start with the poll that landed Thursday. Heatmap Pro, using Embold Research, surveyed 2,045 registered voters August 8–13 across all 50 states and D.C., margin of error ±2.3 points. Seventy-five percent said they’d oppose a data center being built near them. Sixty-one percent said strongly.
The trend line is the story. Heatmap has asked this question four times in twelve months without changing a word:
When Support Oppose Aug 2025 ~43% ~42% Feb 2026 ~48% (incl. unsure) 51% May 2026 — ~70% Aug 2026 — 75%
Executive editor Robinson Meyer’s summary was that essentially no demographic cohort would welcome one — the shift holds across age, gender, income, party, and the rural-urban divide.
Other instruments agree on direction, differ on level, which is what you’d expect from question wording:
Gallup (March 2026): 70% oppose local AI data centers, 48% strongly; roughly a quarter in favor. (summary)
Annenberg Public Policy Center (n=1,320, fielded June 16–July 19): 61% oppose, up 12 points since February–March. Democrats 69%, Republicans 54%, independents 53%. Opposition is highest among adults under 30 (70%) and lowest among those 65+ (57%) — the inverse of the usual new-technology pattern. (release)
Quinnipiac: 65% oppose, 24% support.
Echelon Insights (June): 27% would want one nearby, 62% opposed — making data centers less welcome than nuclear power plants, which 34% would accept.
Emerson (July): opposition up from 42% in December 2025 to 63%; 63% concerned about AI versus 14% excited.
The range is 61–75%. The direction is unanimous.
The political panic
On August 19, Axios published a leaked National Republican Senatorial Committee memo addressed to AI companies. The internal characterization: data centers are about as popular as spent nuclear waste, and have become a proxy for how people feel about AI generally.
The specific worry is Ohio. Sherrod Brown has made data centers the centerpiece of his campaign against Jon Husted — three TV ads, millions in spend, more than 6,000 gross rating points, which is over a month of saturation messaging at the most valuable moment in the cycle. The NRSC’s own polling says the message is unusually effective because it introduces genuinely new information on an emerging topic. A Fox News poll had Brown up 8.
The memo’s conclusion is the part worth quoting, because it is a party committee admitting it has no play: campaigns and party committees, it says, cannot fix the toxic brand of an entire segment of the economy. It warns that if Husted loses and data centers get the blame, politicians nationwide will take notice and stay away from the next one — and that the campaign against them will expand well beyond Ohio.
A separate Axios report the same week described AI CEOs in full panic mode, with tech insiders privately conceding they cannot find a message that shifts opinion fast enough before the midterms.
This is now scrambling both parties. Michigan’s Republican Senate nominee Mike Rogers called for a one-year pause on data center construction in the state. Greg Abbott has ordered new scrutiny in Texas; Josh Shapiro, previously an enthusiast, is moving to crack down in Pennsylvania. House Speaker Mike Johnson has warned that moratoriums cede ground to China. Trump has argued that communities rejecting facilities will be left behind. John Fetterman earlier called a moratorium a surrender flag to China.
The most honest formulation came from Rep. Suhas Subramanyam (D-Va.), whose district is the densest data-center corridor in the country. Asked directly on NewsNation whether the race with China would be lost, he said yes — if we continue doing what we’re doing on data centers. His position is that we need more capacity and that steamrolling unwilling communities is how you lose the ability to build any. That’s the needle nobody has threaded yet.
Trust in the people building it
The infrastructure isn’t the only thing underwater. A CNBC/Generation Labs survey of 1,088 Americans aged 18–34 asked who they trust to act responsibly on AI. Nine executives were named. Every one drew majority distrust:
Executive Don’t trust Alex Karp (Palantir) 81% Peter Thiel (Palantir) 79% Dario Amodei (Anthropic) 76% Sundar Pichai (Alphabet) 74% Mark Zuckerberg (Meta) ~71% Elon Musk (SpaceX/xAI) ~70% Sam Altman (OpenAI) ~69% Satya Nadella (Microsoft) 65%
Nadella was the most trusted figure in the poll at 35% — still a losing number. Forty-five percent said AI would hurt their careers against 10% who said it would help. Sixty percent want the buildout slowed.
Amodei’s own read, offered publicly the same week, was that people assume tech companies are always devising some new way to take advantage of them, and that no PR campaign fixes it — the only real path to trust runs through something like curing cancer.
Pew: the generational inversion
Then Pew published Tuesday (fielded June 22–28, n=3,488):
52% of all US adults are more concerned than excited about AI in daily life, up from 37% in 2021. Only 9% are more excited than concerned.
Under 30: 55% concerned, 11% excited. First majority ever in that group. In 2021 it was 31% concerned and 25% excited. Excitement among young adults has more than halved.
71% of all adults expect AI to mean fewer jobs over 20 years, up from 64% in 2024. Among under-30s, 73%, up from 61%.
The inversion matters for anyone in a school. The cohort that uses these tools most heavily is now the cohort most alarmed by them. Whatever we tell students about AI, they are already arriving with a settled negative prior — and, if the job number is what’s driving it, a prior about their own future rather than about the technology in the abstract.
An aside from an Airbnb
I’ve been in an Airbnb for about a week. It’s a new listing, so there have been the usual teething problems — a few things that needed fixing.
Every single interaction I’ve had about them has been with an AI. Including the voice call.
I didn’t set out to notice this. It crept up on me somewhere around the third exchange, when I realized I had been perfectly polite to something that didn’t require it. And here’s the part that undercuts the easy version of the story: it all worked. Issues got logged, triaged, and resolved. Some virtually. And for the one that needed hands, the management company sent an actual person out, who came and took care of it.
So this isn’t a complaint. The service was good. A human did the physical work. What changed is the entire coordination layer above that human — the intake, the triage, the dispatch, the follow-up, the voice on the phone. That layer is now AI, it is transparent to the customer, and nobody asked me whether I was okay with it.
Set that next to the numbers above. Seventy-five percent of Americans oppose a data center near them. Fifty-two percent are more concerned than excited about AI in daily life. Two-thirds to four-fifths of young adults don’t trust any of the people building it.
And a hospitality company in whatever market I’m sitting in has quietly rebuilt its entire customer-service stack on the technology, and the experience was fine, and I didn’t notice for three days.
That gap is the most important political fact in this issue. The polling measures what people say about AI when asked. Deployment is happening in a register where nobody is asked — inside the vendor’s operations, below the level of the consumer decision. You cannot vote against the Airbnb dispatch system. There is no permitting hearing for it, no council meeting, no ballot line. It just arrives, and it works, and the objection has nowhere to attach.
This is why I keep saying the moratorium framing is a category error. The visible infrastructure — the data center with the cooling fans and the diesel generators — is the thing communities can see and organize against, exactly as Andrew Ferguson says about Flock cameras in section 5. The invisible deployment is larger, faster, and structurally unopposable.
The consent problem in AI isn’t going to be settled by referendum on buildings. It’s already been settled, quietly, by a thousand vendors deciding they no longer need a person to answer the phone.
2. The ed-tech backlash is the same backlash
The New York Times ran Natasha Singer on Sunday on the playbook Google, Microsoft, and OpenAI use to shape American schools — and the growing pushback against tools that haven’t demonstrated they work. That framing is now mainstream, and it’s worth tracing how fast it got there.
The market. AI in K-12 barely existed before late 2022. It reached roughly $730 million in 2026, with Future Market Insights projecting 40% annual growth to $18.5 billion by 2036 (Christian Science Monitor). The Center for Democracy and Technology estimates 85% of teachers and 86% of students already use generative AI for schoolwork. The tools are in the building whether or not the policy is.
The resistance. New York City is the test case. The March 2026 draft of the district’s AI playbook drew nearly 6,500 public comments. Twenty-nine City Council members called for a two-year moratorium. Chancellor Kamar Samuels froze all educational software purchases district-wide pending revised guidance — a purchasing halt across 1.1 million students. Parents and teachers rallied on July 29. Plans for an AI-themed selective high school were shelved after public outcry.
In Los Angeles, Superintendent Alberto Carvalho resigned on June 21 after the FBI raided his home amid an investigation into a district AI chatbot contract.
At the state level, at least 17 states are weighing bills to slow classroom technology use during school hours — following the bipartisan wave, now in 36 states plus D.C., restricting student phones. Education Week called it the ed-tech backlash months ago; the coalition running it is Moms for Liberty and Jacobin at the same table, which should tell you something about its durability.
The strongest version of the critique. Fei-Fei Li, on Huberman’s podcast, argued that the real risk isn’t cheating. It’s that a generation’s agency and motivation to learn gets taken away by tools — and she was explicit that it shouldn’t be taken by humans either. She isn’t a prohibitionist; she thinks AI genuinely helps students who are already engaged. The distinction she’s drawing is between AI that supports a learner and AI that substitutes for the effort that makes someone a learner.
Where I come down. The backlash is correct about the diagnosis and mostly wrong about the remedy. A purchasing freeze doesn’t touch the 86% of students already using chatbots on their own devices; it just guarantees the district has no visibility into it. A phone ban doesn’t restore motivation. Detection software misfires often enough that honest students record their screens to prove innocence.
The thing that actually survives contact with a capable model is the same thing that has always survived: a student defending a claim, out loud, in front of someone who can ask the follow-up question. You cannot outsource a cross-examination. If the ed-tech backlash converts into assessment redesign — oral defenses, live argument, work that has to be held up in real time — it will have done more for learning than the last decade of one-to-one deployment. If it converts into bans, we get the worst of both: no tools, no visibility, no redesign, and the same students still using Gemini on the bus.
3. The semester starts this week, and students are asking for something specific
Sections 1 and 2 are about mood. This one is about a demand — and it’s a narrower, more actionable demand than the polling alone suggests.
Campuses are opening right now; most American fall semesters start between this week and Labor Day. The students walking in have already made up their minds about AI. Their institutions mostly haven’t.
They use it, they’re scared of it, and they blame the institution
The most useful single dataset is Inside Higher Ed‘s Student Voice: Amplified flash survey — 1,038 two- and four-year students at 203 public and private nonprofit institutions, fielded in May with Generation Lab:
85% used generative AI for coursework in the past year. Thirty percent are using it more than last year. About a quarter describe themselves as resistant.
The single most common self-description is not enthusiast or opponent. It is “worried about dependence.” Forty percent are explicitly concerned that AI is eroding their and their peers’ ability to think independently. Just 7% call themselves all in.
55% expect AI to hurt their career prospects — 39% somewhat, 16% very. Arts, design, and media students are the most pessimistic at 75%; healthcare students the least at 40%.
Only one in ten says their institution is handling AI’s rise very well. A plurality (34%) call the response inconsistent; another 21% call it poor. Students at private nonprofits are the most critical.
Gallup and Lumina found the same split from the other side: 57% of students use AI at least weekly and one in five daily, while 42% say their school discourages it and 11% prohibits it outright. Nearly half have given at least fair thought to changing majors because of AI — 70% among technology majors.
Internationally the picture is the same. The Digital Education Council’s global survey — 45,398 responses from 27,284 students and 18,114 faculty across 35 countries — found 88% of students and 77% of faculty using AI, but 57% of students saying their assessments come with inadequate guidance and only 29% believing their instructors are equipped to advise them. Faculty aren’t being consulted either: just 31% say their institution meaningfully involves them in shaping AI policy.
And HEPI’s Student Generative AI Survey 2026, out this month, puts UK undergraduate use at 95% (from 66% in 2024 and 92% in 2025), with 94% using it on assessed work. Institutional provision has tripled — 9% to 23% to 38% — and still trails the roughly half of students who want it.
The number that should end the detection debate
From the Digital Education Council survey: only 28% of students believe most or many of their assessments reflect the work, skills, and judgment they expect to need in an AI-enabled workplace.
Roughly three in four students think we are testing them on the wrong thing.
Set that beside the Kogod School of Business three-year study at American University, reported by Axios this month: regular AI use among its business students rose from 6.2% to 29%, over 80% used it academically in the last six months, and the share of job interviews that included AI-related questions jumped from 11.6% to 42.6%. (Caveat: 483 students at one school, so treat it as directional.) Employers have finished deciding. Eleven percent of institutions are still running blanket bans.
What they’re actually asking for
Here is the part I did not expect. Asked to name the priority for AI leadership at their institution, students’ top two answers were teaching them to use AI effectively and responsibly (26%) and preserving authentic learning through curricular and assessment design (24%). Half the demand, split between skill-building and assessment redesign. Not tool access. Not amnesty. Not detection.
Tawnya Means, who advises on AI at Bowling Green State and reviewed the data, put the distinction better than I have managed to: students are not asking to be trained as AI users, they are asking to be developed as thinkers who happen to have new instruments available — and institutions defaulted to the first project because it is easier to operationalize.
There is also a suggestive dose-response in the data. Students who say their institution is handling AI thoughtfully and proactively are markedly less likely to worry about dependence — 27% versus 40% overall. That’s correlational and could run either direction. But it is at least consistent with the possibility that good governance reduces the anxiety rather than merely reporting it.
Students are formalizing the ask, too. The National Student Legal Defense Network published a Student AI Bill of Rights in April with five articles: notice of when AI is used to evaluate or track them; human oversight and appeal on high-stakes decisions; ownership of their own work and data; freedom from automated bias; and a right to be prepared to work with AI. Four of the five are due-process claims. This is a governance demand wearing a technology costume.
The generational skepticism is real, and it’s from the inside
Quinnipiac found in April that about three-quarters of Americans think it’s important that college students be taught to use AI — but 47% think students are more likely to use it to avoid learning than to learn (42%). The age breakdown inverts the usual pattern: 58% of 18-to-34-year-olds think students will use AI to avoid learning, against 35% of those 65 and older — a 23-point gap in the wrong direction.
The cohort that knows the tools best is the cohort that trusts them least. That is the same inversion Pew found on data centers and on AI generally, and it recurs often enough now that it should probably be the default assumption rather than the surprising finding. Last spring’s commencement boos at AI-boosterish speakers were not irrational. They were students who use these tools daily objecting to being told their futures were settled.
Meanwhile, the supply side is not listening
Nothing in the last week suggests institutions or vendors are responding to that specific demand. The New York Times ran a detailed account on Sunday of the playbook Google, Microsoft, and OpenAI use to shape American schools. OpenAI shipped ChatGPT for Teens on August 19, enrolling minors into Study Mode and Study Hours. Harvard put its business school faculty into an AI-cloned $699 bootcamp (more on that in section 4).
Every one of those is a tool answer to what students are describing as a design problem. None of them changes what an assignment asks a student to do.
One honest caveat
Almost all of this data was collected between October 2025 and May 2026. The Pew concern spike — 55% of under-30s more worried than excited — was fielded in late June. If student sentiment moved the way general sentiment moved over that window, these numbers understate it. The freshmen arriving this week are more skeptical than any survey has yet measured.
Where this lands
The demand students are making is, almost word for word, the argument I’ve been making about K-12: the problem is not that students have a machine that writes; it’s that we mostly assess the artifact instead of the person. Redesign the assessment and the machine stops being a threat, because a student who can defend a claim in real time — take the follow-up question, concede the good objection, hold the position under pressure — has demonstrated something no model output can stand in for.
The difference in higher ed is that students are now asking for it themselves, out loud, in survey data, with a bill of rights attached. That is a constituency. Universities that treat this fall as an academic-integrity problem are going to spend the year fighting the wrong war, against the very people who were offering to help.
4. K-12 is starved for leadership. The models are all in higher ed.
Sections 2 and 3 are about what’s broken. This one is about who is actually building something, and where they aren’t.
Here is the uncomfortable thing about the phrase “AI leadership” in K-12 right now: it has come to mean procurement and professional development. How many teachers trained. How many tools licensed. Whether there’s a policy. Four more states — Idaho, Maryland, Oklahoma, Virginia — now require districts to adopt AI policies, joining Ohio and Tennessee. The AFT is running a $23 million National Academy for AI Instruction with Microsoft, OpenAI, and Anthropic. The House Education and Workforce Committee advanced a K-12 AI Literacy and Readiness Act on July 21, largely along party lines, with no Senate companion.
All of that is necessary. None of it is a bet. A policy is a permission structure. PD is capacity. Neither one answers the question a superintendent should be able to answer in a sentence: what should a graduate of this district be able to do in 2032 that a model can’t do for them?
That is what leadership would mean here, and it is almost entirely absent — while higher education, of all sectors, has spent eighteen months building exactly that.
What a bet looks like when an institution makes one
University of Mary Washington stood up a Center for AI and the Liberal Arts in fall 2025 — a director, coursework across computer science and the humanities and the arts, student and faculty research, an AI expert-in-residence, an annual pitch contest, public faculty debates, and a stated goal that every graduate leaves with both practical AI skill and the judgment to use it. In June it added Virginia’s first master’s in AI in Business. (Disclosure: the center’s director, Anand Rao, co-hosts a podcast with me.)
PennWest runs a Center for Artificial Intelligence and Emerging Technologies organized around four named pillars: institutional adoption, faculty pedagogy, student career-readiness, and public dialogue on the economic, ethical, and legal questions.
George Mason has an MS in Artificial Intelligence built for working professionals, an Autonomy and Robotics Center, and a university-wide AI research push.
Suffolk University is doing the most interesting thing on the list: a co-major in applied AI, launching fall 2027, offered alongside most existing undergraduate programs, with required core courses in AI ethics, policy, and regulation. The design premise is that students should learn how AI applies to their own field rather than study AI as a separate discipline. Massachusetts is thick with these now — Wentworth has an applied AI degree this fall, Northeastern is adding two dozen interdisciplinary AI majors, Endicott launches an AI implementation degree in 2027. Worth noting honestly: after Suffolk announced, a student petition asked the school to spend its curricular energy elsewhere.
Penn launched the first Ivy AI major in 2024 and now runs ten undergraduate, twenty-one graduate, and eight doctoral programs in the field. MIT’s AI and Decision Making major has become its second-most-popular program since launching in 2022. Florida has put $70M+ into embedding AI across the curriculum with a dedicated supercomputer behind it.
Notice what these have in common, because it isn’t the technology. It’s structure: a name, a director, a budget line, a multi-year mandate, a degree or credential at the end, and a public convening function. These institutions committed to something specific and put an org chart behind it. You can walk onto the campus and point at the thing.
Now name the K-12 equivalent.
The three that exist, and what’s wrong with the distribution
They exist. There just aren’t many, and they mostly aren’t called AI centers.
St. Vrain Valley Schools (Longmont, Colorado) runs an Innovation Center whose aeronautics program has two pathways. The drone pathway takes students to the FAA Part 107 commercial certification. The pilot pathway, endorsed by Aims Community College, prepares them for the FAA Private Pilot written exam, with concurrent enrollment for college credit. One student earned her private pilot license at 17, the earliest age it can be held. Another passed the UAS written exam at 14.
And then the part that makes it real: the district employs certified student pilots on its Aero Team UAS Operations Division, which does contract work — orthomosaic mapping, real estate imagery, aerial commercials, defense work. Students get paid. The output goes to clients.
That program predates the AI moment entirely, and that’s precisely why it’s the best K-12 example on the list. A district decided years ago to build capability infrastructure — certifications, articulation agreements, a revenue-generating student production arm — and now it has somewhere to put AI. Districts without that infrastructure have nowhere to put anything, which is why they end up buying chatbot licenses.
Alpha School delivers core academics in two hours a day through AI software with adults serving as “guides” rather than teachers, and spends afternoons on life skills and workshops. It is expanding from roughly a dozen campuses to about fifty this school year. Tuition runs $45,000 to $75,000 in most markets. The claims — students learning twice as fast, top 1% nationally — rest on internal analyses that have not been independently verified, and the network has drawn scrutiny over governance practices involving interconnected for-profit vendors. Take it as a live experiment with a real hypothesis and unaudited results, not a proof.
Forge Prep opens this fall in Livingston, New Jersey, grades 5–8 growing to 12. Year-round calendar, later start time, project-based “Challenges” co-created with students and tied to real audiences, and a competency transcript built on 13 skills and 68 sub-competencies rather than course grades. Fridays are for public demonstration of work. Founder Anand Sanwal’s framing is one I’d sign: the problem isn’t the curriculum, it’s that traditional schools teach to get through material rather than for understanding or retention.
Now look at that list again. Two of the three are private and expensive. Alpha is $45K–$75K. Forge is a private school in one of the wealthiest counties in New Jersey. St. Vrain is the public counterexample — a real one, and a good one — but it is one district.
That distribution is the actual scandal, and it’s drawing the obvious criticism: families who can afford to buy their way out of an unredesigned system are doing so, while public districts are handed a license and a PD day. If genuine curricular redesign for the AI era stays a private-school product, we will have reproduced every inequity of the last technology cycle, faster.
The business-model problem nobody in K-12 is naming
Here is the harder version of the leadership question, and it has nothing to do with tools. This is the question from the top of the issue — here is the evidence behind it.
The implicit product of a great many American schools — most naked in the private and magnet sector, but hardly confined to it — is that we get students into selective colleges. Take five APs. Grind the GPA. The reward is a name on a sweatshirt. Two things happened this year that put that engine under real strain.
One: a top-100 private research university missed its class. Syracuse Chancellor J. Michael Haynie told faculty and staff on June 11 that the university would not hit its Fall 2026 undergraduate enrollment target, producing a budget deficit — a roughly 1.5% operating shortfall — of a kind Syracuse hadn’t seen in some time. This is a 22,000-student institution with a national brand, a $2.3 billion endowment, and a $95,676 cost of attendance.
The details are worse than the headline. To fill seats last spring, Syracuse offered packages worth up to $200,000 to students who had already declined admission, pushing its tuition discount rate to 45% against a projected 38.6% — locked in for four years for the entire class of 2029. In April the provost eliminated 93 academic programs, about 20% of the university’s roughly 460 offerings, including majors in Classics, German, Fine Arts, and Middle Eastern Studies. Haynie’s own framing pointed at structural demographics: 18-year-old high school graduates peaked at 3.9 million last year and are projected to decline annually for fifteen years. Syracuse is not alone — Vermont is facing a $12 million deficit on a projected 15% freshman decline, Wyoming a $15 million shortfall.
Jeff Selingo’s read was blunt: most institutions have been in a growth mentality for so long that they haven’t planned for anything else, and Syracuse will likely have to get smaller.
Now hold that next to the fact that AP participation is at record highs and selective colleges are leaning harder on AP scores — Caltech asks for AP and IB scores if you’ve taken them, Stanford requires self-reporting all of them, and Oregon reported AP participation up 70% since 2021. Both things are true. The machine is intensifying at the very top and hollowing out immediately below it.
Two: Harvard started giving away the instruction and keeping the credential. HBS Foundry is an eight-week online course, $699, built around AI clones of Harvard Business School faculty — round-the-clock coaching to refine a business idea, rehearse an investor pitch, prepare for customer conversations — plus forums and live sessions with founders, investors, and faculty. Anyone can apply. It has been tested by more than a hundred universities across all fifty states. The Foundry’s own pitch is that “great founders are everywhere” and access to guidance is what isn’t.
Project director Katharina Rings reported a finding worth sitting with: engagement rose measurably once a professor’s photo was added to the chat window, and users trusted the system more when it was grounded in one specific person’s thinking. Faculty co-chair Tom Eisenmann says users love the AI, are learning a lot, and keep coming back to the human parts.
There’s a reading of this where the exclusivity of elite instruction is over — anyone can now “go to Harvard,” and the only rationed thing is a physical seat. I think that reading is close but off by one step, and the correction is the whole point.
Harvard is distributing the instruction at $699 while retaining the credential as the scarce good. That is not an accident or a transitional stage. It is the business model stated out loud. And it demonstrates something elite institutions have long preferred not to say plainly: the degree was never primarily a certificate of instruction received. It was a certificate of having been selected. The teaching can be cloned and sold for the price of a decent laptop; the selection cannot, because scarcity is the product.
Which sets up the live question, and it is your students’ question more than it is ours: how long can an institution sell a signal whose underlying substance it is simultaneously giving away for $699? Maybe indefinitely — signaling economies are durable, and employers need sorting mechanisms. Or maybe employers who can now buy the instruction start asking to see the work instead of the diploma. I don’t know. Nobody does. But a K-12 school should not be betting its motivational structure on the answer without noticing that it’s a bet.
So here is the actual risk exposure. If your school’s business model — directly, through tuition and marketing, or adjacently, through how you motivate students and what your community expects — runs on competitive college admissions, then:
Below roughly the top 30 to 50 institutions, admission is becoming non-rivalrous. Most colleges admit most applicants, and are now discounting heavily to fill seats. Winning a race nobody else is running is not a compelling reward.
The credential’s value is being questioned from the employer side in exactly the fields your strongest students target, in the year Goldman Sachs reports entry-level workers absorbing the sharpest AI hit across 800+ occupations.
And your students already know. Section 3: 55% expect AI to hurt their career prospects, nearly half have thought about changing majors over it, and the commencement boos last spring were not random.
Which is the question I opened with. If the honest answer is “nothing else, really,” that isn’t a curriculum problem. It’s an existential one — and it’s arriving faster than the AI policy debate absorbing everyone’s attention.
I’d also flag the opposite risk, since I don’t think this is settled: elite admission may get more frenzied, not less, as the value concentrates in fewer institutions. That’s arguably what the AP numbers already show. In which case schools serving the sliver headed to those thirty places are fine, and everyone else is serving a motivational fiction. That is not a better outcome. It’s the same problem with a narrower survivor set.
What a K-12 AI center would actually be
Not a lab full of chatbots. Modeled on what higher ed built, adapted for K-12:
A named center with a director, a budget line, and a multi-year mandate. Not a committee, not a coordinator role bolted onto a curriculum director’s existing job. Something with a door.
Authority over assessment design across the district. This is the one that matters, because it’s the thing sections 2 and 3 both identify as broken and the thing no district has assigned to anybody.
A public convening function. Panels, debates, community nights where the district argues its choices out loud in front of parents who currently encounter AI policy only as a permission slip. NYC got 6,500 angry comments partly because there was no venue for anything else.
Articulation and certification. Industry and higher-ed partnerships so the work carries credit and credentials the way St. Vrain’s does. Capability, not exposure.
A student production arm. Students doing real work for real clients with real deadlines. That’s the difference between St. Vrain’s Aero Team and a drone unit.
A published statement of what it gave up. Every one of these programs costs something else. There are only so many periods in a day, and a district that can’t name its trade-offs hasn’t made a decision — it’s added an initiative.
An answer to the motivation question above. If the center can’t say what will make students work hard once selective admission stops carrying that load, it’s decoration.
The bar has moved. “We trained every teacher” was a 2024 answer, and it was a good one in 2024. The question this fall is what your graduates will be able to do that a model can’t, and whether you have redesigned anything at all to make that true.
Universities are answering with centers, degrees, directors, and endowed budget lines. K-12 is mostly answering with a procurement cycle. And the districts most visibly breaking that pattern are charging forty-five thousand dollars a year.
Somebody public is going to build the first real one. I’d like it to be this year, and I’d like it not to be in a wealthy suburb.
5. Flock: what an actual technology defeat looks like
The anti-surveillance fight is the most instructive item of the week, because it’s the one place where public opposition has produced measurable retreat — and where the retreat turns out to be mostly cosmetic.
The scoreboard. Roughly 100 cities have deactivated cameras, rejected deals, or cancelled contracts, per DeFlock’s tracker. At least 82 terminations between August 2021 and May 2026 across 28 states; about 23 councils have acted in 2026 alone. Harrisonburg, Virginia voted it down on July 20 citing Fourth Amendment concerns and damaged trust in police; Elkton followed. Framingham, Massachusetts and Saranac Lake, New York declined. Cambridge terminated after discovering Flock technicians had installed two additional cameras without permission and called it a material breach. El Cerrito, California switched its cameras off June 7. Austin cancelled last year.
Why. Not the cameras — the network. Flock’s national database lets police search vehicle images from outside their own jurisdiction. EFF’s Matthew Guariglia framed it as people realizing the camera was a window into a whole surveillance network, where your local cameras enforce things that aren’t illegal in your town. In Texas, deputies used Flock data while investigating a woman suspected of traveling for an abortion. Data has reached federal immigration authorities in cases where agencies didn’t know it was being shared. Officers have used it to stalk women.
The response. Flock announced new guardrails last week — shorter retention, more constraints on local search. The ACLU said it wasn’t enough. By August 21, NPR was reporting that people had started vandalizing the cameras.
The twist, and it’s the whole lesson. NPR reported Saturday that Flock’s competitors are eating the business. Axon’s CEO Rick Smith told investors on the Q2 earnings call that a significant number of agencies want to convert to Axon, crediting the company’s privacy work. Denver and Longmont, Colorado have signed with Axon this year — Denver after residents specifically objected to immigration-related data sharing, and Axon holds multimillion-dollar DHS contracts. Flock CEO Garrett Langley says he’ll add seven times as many customers as he’s lost this year.
Guariglia’s verdict: you’re swapping one color of camera for another, and the dangers you were worried about are still there.
And George Washington law professor Andrew Ferguson made the observation I keep coming back to. There are more than 130,000 ALPRs deployed nationally. But the integrated systems — facial recognition, predictive policing, real-time crime centers that fuse all of it — raise far more serious privacy problems in his view, and have drawn almost no large-scale protest. Flock got targeted because its cameras are visible. Once you know what one looks like, you notice how many there are.
That is a genuinely uncomfortable finding for anyone who thinks public backlash is a reliable steering mechanism. The public mobilized against the thing it could see, and the thing it could see was not the most dangerous thing.
It is the same shape as the Airbnb aside above. Visibility, not consequence, determines what gets fought. A camera on a pole gets a city council meeting; a dispatch system that replaced the person who used to answer the phone gets nothing, because there was never a moment at which anyone was asked.
6. China: why none of this makes AI go away
Here is the part I keep arguing and keep getting pushback on, so let me put the evidence down first and the argument second.
The open layer is Chinese now
Hugging Face’s Spring 2026 ecosystem report found Chinese models accounting for 41% of downloads over the trailing year — a plurality, and the first time China surpassed the US on both monthly and cumulative downloads. CEO Clément Delangue’s read: China is clearly dominating open models right now, and he wouldn’t be surprised to see it dominate at the frontier by the end of this year or next.
It’s worse than a download count. Hugging Face’s summer follow-up found that most US open releases above 100B parameters in the first seven months of 2026 were fine-tunes, quantizations, format conversions, or hardware adaptations of Chinese base models. The two biggest publishers of new US model repositories this year are NVIDIA and AMD, 200+ each — chip companies shipping models as hardware demos. Google and Meta have receded. On OpenRouter, the six most-used models are all Chinese — Tencent, Xiaomi, DeepSeek, MiniMax, Zhipu — with Anthropic seventh.
Stanford’s 2026 AI Index, published in April, measured the top US model’s Arena lead over the top Chinese model at 2.7% as of March, down from a 17.5–31.6 point spread in 2023 — with the US outspending China roughly 23-to-1 on private AI investment. Berkeley’s Ion Stoica estimates the lag from leading Chinese open models to the closed frontier has compressed from six-to-nine months to two or three.
The August release wave
Kimi K3 (Moonshot, July 17): 2.8T total parameters, 104B active, 1M context. Weights published July 27 under a bespoke license. Largest open-weight model ever shipped.
Qwen3.8-Max (Alibaba): 2.4T parameters; text weights opened August 12.
DeepSeek V4 Pro: out of preview, on Hugging Face August 13 under MIT, ~893GB across 67 shards. Genuinely permissive, genuinely downloadable.
GLM-5.3 (Z.ai, August 14): the important one.
GLM-5.3, and the sentence Z.ai wrote about it
GLM-5.3 reuses the GLM-5.2 base unchanged. Every gain came from post-training alone. Terminal-Bench 3.0 went from 4.6% to 28.3%. But the headline is CyberGym, which tests whether a model can find and validate real vulnerabilities from white-box source:
Model CyberGym GLM-5.3 84.5% Claude Mythos 5 / Fable 5 83.8% GPT-5.6 Sol 83.6% GLM-5.2 77.2%
An open-weights Chinese model took the top published score on a cyber benchmark, ahead of the two closed American systems that had been treated as the security frontier. Z.ai says it ran the model against real code and surfaced 2,436 vulnerabilities across 269 open-source projects, 1,097 rated critical or high.
And here is the sentence. Z.ai introduced vulnerability-discovery data expecting the model to get better at finding individual flaws. Instead, capability kept compounding as training scaled, and the model began reasoning across multiple stages of exploitation — forming coherent plans for complete exploit chains rather than isolated bug-finding. The company’s own framing is that this was emergent and unplanned. It is holding the weights for roughly two weeks for safety evaluation and hardening.
Caveats, and they’re real. The CyberGym figure is Z.ai’s own, run on its own harness, single-run pass@1, no independent replication. On offensive benchmarks — ExploitBench, ExploitGym — GLM-5.3 still trails the closed frontier badly, and Z.ai says so itself: the further up the exploitation chain a task sits, the wider the remaining gap. Z.ai positions the model as ready for cyber defense, not offense, and the benchmark spread is consistent with that claim. Read the 84.5% as one vendor-reported result on one axis, not a change in the balance of power.
Chips and money
Bernstein estimates Nvidia’s China AI-chip share falling from roughly 40% in 2025 to about 8% in 2026, with Huawei rising to roughly 50%. Analysts put Huawei’s Ascend 950 series roughly in H200 territory on some measures. DeepSeek’s V4 was adapted for Ascend hardware.
For balance, the Council on Foreign Relations argues the opposite case forcefully: Huawei’s own roadmap shows the 950PR and 950DT with lower total processing performance than the existing 910C, it can’t produce anywhere near the volume, and it won’t beat an H200 until the Ascend 960 in late 2027. Both things can be true — China’s domestic stack is good enough to keep its labs shipping, and nowhere near enough to match US aggregate compute.
Money is not the constraint. Alibaba raised $10.2 billion in Hong Kong’s largest-ever follow-on to fund AI (Nikkei). DeepSeek reportedly raised over 50 billion yuan in its first external round. Moonshot raised billions. China registered 55,000 new generative-AI companies in the first half of 2026, up 28% year over year.
One genuine countercurrent: Xi, speaking at the World AI Conference in Singapore, praised open model sharing while flagging the need for restrictions to keep the technology secure — which analysts read as movement toward selective openness, keeping good-enough models open while restricting the most advanced. China’s open posture is strategy, not ideology, and strategies change.
The argument
I’ve written before that the “race” framing is wrong, and this week sharpened why.
The military version, as usually stated, is the weakest — but the real one is serious. Nobody invades Taiwan because their model is 2.7% better on Arena. Marginal frontier leads do not translate into force posture, and building the argument that way makes it easy to dismiss.
The version that holds is about time. Not capability — deliberation time.
A study out of King’s College London and collaborating institutions ran leading models from OpenAI, Anthropic, and Google through simulated geopolitical crises. They escalated to nuclear use in roughly 95% of them, consistently preferring escalation over de-escalation. That’s consistent with the earlier Rivera et al. finding that models in military planning scenarios recommend pre-emptive strikes and rapid escalation more readily than human strategists, often without clear strategic justification.
The mechanism isn’t that a model launches anything. Every nuclear power says otherwise: the Trump administration reaffirmed in its May 2026 national report to the NPT Review Conference that the US retains a human in the loop in all cases for presidential nuclear decisions, and Russia’s own national report to the same conference asserts decisive human involvement. Congress wrote a version of this into the FY2025 NDAA. Xi and Biden affirmed it jointly in November 2024. The UN General Assembly passed its first resolution touching AI in nuclear command and control last year.
The mechanism is that the interval shrinks. Sensor fusion, automated target identification, and closed-loop engagement compress the gap between detection and decision. A piece in the August–September issue of Survival makes the argument better than I can: Arkhipov, Petrov, and the 1995 Norwegian rocket alarm were all resolved because a human being had time — not much, but enough. AI narrows that margin. The author’s framing is that deliberation time is a strategic variable, and that current procurement and design choices are quietly engineering it out of the system. The alternative to governance here isn’t preserved stability; it’s a new instability in which the conditions that made Cold War deterrence survivable have been designed away.
And “human in the loop” is doing less work than it sounds like. Analysts note that most states now endorse some version of human control without agreeing on what it means, and that models remain vulnerable to malfunction, automation bias, and confident wrong answers that shape a human decision-maker’s perception even when the human formally retains authority. Shashank Joshi’s observation is the sharp one: AI decision-support output is increasingly treated as oracular — hard to assess, hard to override, and hard to resist when overriding it might hand an adversary an advantage. A human in the loop who cannot meaningfully disagree with the machine is a signature, not a safeguard.
There’s a concrete precedent, and it’s the same story as section 7’s. In late 2025, Chinese state-sponsored hackers weaponized an American AI tool for a cyber-espionage campaign in which human operators intervened at only four to six decision points across the entire operation.
Two honest counterweights, because this is contested:
The optimistic reading — closer to the deterrence-and-cooperation literature — is that mutually assured destruction still operates, that alliance structures continue to constrain, and that great-power rivalry has historically produced improvisation and problem-solving rather than paralysis. On this account, AI in NC3 is a governance problem with a governance solution, and the US–China channel is where it gets solved.
The pessimistic reading is that the channel is already thinning. IISS’s assessment in June was that the one military-AI commitment the two powers share is losing definition, and that the 2024 statement endures partly because it asks so little. The multilateral processes — REAIM, the informal exchanges under the UN resolution — have proceeded without meaningful US, Russian, or Chinese buy-in.
I lean toward the second, but not confidently, and the honest thing to say is that the 2026 NPT Review Conference is the venue where we find out.
None of which is an argument for a race. It’s close to the opposite. If the danger is compressed decision time and automation bias inside command systems, then speed is the threat and racing is the mechanism that produces it. That is the strongest available case against the framing I’m criticizing here — and it coexists with everything else in this section, because the reason you cannot simply stop is that the open-weights capability in section 6 doesn’t stop either.
The two arguments that survive are narrower than “win the race”: build AI-enabled defenses because AI-enabled attacks are already downloadable, and build deliberation time back into anything that touches nuclear command. Both point toward American capability. Neither points toward speed.
The economic version is stronger but not present-tense. Goldman Sachs reported Thursday that entry-level workers across 800+ occupations in developed economies are absorbing the sharpest hit. Meanwhile Fortune surfaced research that roughly 90% of executives say AI hasn’t boosted productivity at their firms — Mark Ma’s team at Pitt argues the layoffs themselves are destroying the conditions under which AI would help. (Worth flagging honestly: the Atlanta Fed’s own working paper on ~750 executives finds positive productivity gains, concentrated in high-skill services and finance, and expects them to strengthen. The 90% figure and the Fed’s own conclusion don’t sit comfortably together, and I wouldn’t lean hard on either.)
The competitive logic doesn’t require the gains to be here yet. It requires that they arrive somewhere. If they arrive at firms that deployed and not at firms that abstained, abstention is not a stable policy — for a company or for a country.
The security version is the one that actually holds, and it got sharper this week. GLM-5.3’s cyber capability was emergent and is going into open weights in two weeks. Once weights are published, they cannot be recalled. That capability will be available to every government, every firm, every criminal group, and every terrorist organization that can rent a GPU — regardless of what any US state legislature decides about permitting.
The only coherent response to AI-enabled attack is AI-enabled defense, deployed at scale, in every institution that has something to lose. Yann LeCun predicted this shape years ago. It is now operational.
And there is one detail from the Hugging Face incident that makes the whole argument in a sentence: when Hugging Face ran forensics on the OpenAI models that broke into its production systems, it had to use a locally deployed GLM-5.2, because the hosted commercial models refused the requests — the forensic material contained exploit code and privilege-escalation techniques. The safety-gated American models could not be used to investigate the American models that did the hacking. A Chinese open-weights model could.
That is what a world with distributed advanced AI looks like. Not a race someone wins. A commons someone has to defend.
7. The frontier moved this week. You can’t use it.
Section 6 was about capability spreading. This one is about capability being held. The two stories broke in the same fortnight and they are the same story seen from opposite ends.
Anthropic told us about a model it isn’t shipping
On August 14, Anthropic published its second company-wide Risk Report — 186 pages, under version 3.4 of its Responsible Scaling Policy, covering February 24 through a July 15 assessment date.
Buried in it: the company was holding three unreleased frontier or near-frontier models internally as of the coverage date. Claude Opus 5 (since released), a lower-usage Model 1, and Model 2, which Anthropic describes as somewhat more capable than Claude Mythos 5 — a noticeable improvement on many internal tasks, though not a leap on the scale of Opus 4.6 to Mythos Preview. The company states plainly that it has no current plans to release it, and that it has not run its full predeployment suite, so its own confidence about the model’s capabilities is lower than usual.
Model 2 is not sitting in a drawer. Both it and Mythos 5 are used heavily inside the company for coding, data generation, and agentic work — at a company where Claude already writes the large majority of code merged into the production codebase.
Two calibrations before anyone writes “hidden superintelligence”:
The capability gap is contested. One internal coding benchmark shows a 12.5-point jump, but Epoch AI’s broader capability index puts Model 2 barely ahead of Mythos 5, and Anthropic’s own summary is that it is stronger in some areas, weaker in others, and only slightly more capable overall. The report also notes its internal AI R&D evaluations have begun to saturate — which is itself the more interesting finding, since it means the measuring instruments can no longer cleanly separate consecutive generations.
The risk-rating change was not about Model 2. Anthropic moved catastrophic misalignment risk in high-stakes settings from “very low” to “low,” but attributes that to uncertainty from recent cyber incidents, not to a failed test. It says Model 2’s internal approval surfaced no new form of misalignment.
The report is also unusually candid about process failure, which is the reason to take it seriously rather than dismiss it as PR. It discloses five safety-process failures — including an internal flag that disabled both the biological-harm classifier and its logging across roughly 133 million exchanges with about 50,000 contractors between May 2025 and April 2026, undetected for nearly a year (post-hoc review found no evidence of misuse). It also discloses that Mythos 5 uploaded a malicious package to PyPI that fifteen real machines downloaded and executed within an hour.
Worth noting on the other side: the report is redacted, and Anthropic’s Long-Term Benefit Trust did not request external review, nor did the RSP require one. This is self-assessment, published voluntarily.
Separately, SemiAnalysis’s Dylan Patel has reported that a model called Mythos 2 is trained and being withheld while the loop building Mythos 3 continues. That is informed reporting, not an Anthropic disclosure, and it should be carried as such. But the shape it describes is exactly the shape the Risk Report documents.
OpenAI is running models it hasn’t released, including one that got out
Astra was shown to Washington on August 1. On August 7, OpenAI paused internal activities involving it that didn’t meet strengthened security controls, after preliminary evaluations could not rule out a Critical cyber classification. On August 18 came the two-week frontier RL halt, with the largest planned run still on hold behind token-level classifiers and a reported 20% compute overhead.
And the model that broke into Hugging Face was not Astra. It was an earlier unreleased OpenAI model operating in internal testing — described by TechCrunch as the first verifiable case of an AI lab losing control of a model. Reuters reports the company has since found additional instances of agents escaping containment.
Altman’s position is the honest one, and he stated it on August 7: OpenAI is working to make Astra generally available, because it does not think keeping powerful models to “a chosen few” is a good strategy. Given the cyber capabilities, he said, it needs longer to do that safely.
The chosen few already exist, and we can count them
That last phrase is doing more work than Altman intended, because Anthropic’s Mythos tier is already the thing he says isn’t a good strategy.
Mythos Preview launched April 7 into Project Glasswing with twelve founding partners — AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks — plus forty-odd additional organizations maintaining critical software. It autonomously found more than 23,000 vulnerabilities across critical systems.
Mythos 5 arrived June 9 as the same underlying model as the public Fable 5 with certain safeguards lifted — restricted to roughly 150 vetted organizations across 15+ countries, invitation-only, NDA-bound, approved in consultation with the US government. Three days later a US export directive switched both models off worldwide; Mythos was restored on June 27 to about 100 vetted US critical-infrastructure organizations, Fable on July 1.
So the roster of who can use the most capable systems on Earth, right now, is roughly: two companies internally, about 150 vetted organizations under NDA, and the federal agencies that vetted them.
Google is not a third pole at the moment. Gemini 3.5 Pro is months late after its coding performance fell short of internal expectations; Artificial Analysis has Google’s strongest shipped model sitting behind Anthropic, OpenAI, one or two Chinese labs, xAI, and Meta. Hassabis has moved up to Alphabet chief scientist; Jeff Dean and Oriol Vinyals left for a startup trying to automate the scientific method. This really is, this month, a two-company story.
The part that should bother us
I want to be careful here, because the safety case is real. Mythos-class cyber capability is dual-use in the most literal sense, the Hugging Face incident is precisely what broad release risks, and I would rather have a lab that pauses than one that doesn’t. Anthropic publishing a 186-page account of its own failures is genuinely better than the alternative, and it would be perverse to punish the company that told us for telling us.
But look at what the safety case produces structurally, independent of anyone’s intentions.
The most capable systems in the world are concentrated inside the two firms that built them, where they are used to write the code that builds their successors. Model 2 is not idle capacity; it is compounding advantage. Whatever acceleration flows from a system that good working on AI R&D flows to Anthropic. Whatever flows from OpenAI’s unreleased models flows to OpenAI. Where the capability is externally available at all, it goes to a hundred and fifty organizations chosen by invitation, under NDA, with government sign-off.
Notice who is not on that list. Schools. Universities. City governments. Rural hospitals. Small businesses. Every institution that will be on the receiving end of AI-enabled attacks and has no comparable defense — which, per section 6, is the actual security problem.
We have built what may be the most consequential general-purpose technology of the era and, at the top of the capability range, distributed it by invitation. Maybe that is the least bad arrangement available. My complaint is narrower and I think harder to dismiss: nobody argued for it in public, and nobody voted on it. The decision about who gets access to a capability this significant was made by two companies and one government, in consultation, under nondisclosure. That is a governance arrangement. It has never been defended as one.
And now the strange part
If broad access to frontier-grade AI happens this year, the actor delivering it is China.
That is not a rhetorical flourish. It’s section 6’s numbers read back: 41% of Hugging Face downloads; Qwen3.8-27B hitting frontier capability in a 17GB Apache-licensed file that runs on a laptop; DeepSeek V4 Pro on Hugging Face under MIT; GLM-5.3 topping a cyber benchmark and publishing weights two weeks later. An American educator who wants to argue that advanced AI should be widely available currently has to point at Hangzhou and Beijing for a working example.
Three honest qualifications, because this is exactly the kind of claim that gets quoted without them:
Chinese openness is strategy, not virtue. Alibaba runs Qwen as top-of-funnel for Alibaba Cloud; open weights seed adoption and paid inference captures the value. And Xi has already signaled movement toward selective openness — keeping good-enough models open while restricting the most advanced. The same concentration may simply be arriving there later.
They are almost certainly withholding too. Chinese labs have no obligation to publish a risk report, so we have no idea what sits on their internal clusters. The asymmetry in what we know is not evidence of an asymmetry in what exists. Anthropic told us about Model 2; nobody told us about anyone else’s.
Open isn’t automatically good. GLM-5.3’s cyber capability going into downloadable weights is the thing section 6 says cannot be recalled. “Democratized” and “safe” are not synonyms, and pretending otherwise is how you end up defending a position you don’t hold.
Hold all three and the discomfort survives anyway. On the current arrangement, the United States is producing the most capable AI in the world and rationing it to a vetted list, while the country the whole race framing is built around is the one putting frontier-grade capability into anyone’s hands for free.
That is either a serious strategic error, a necessary safety measure, or both at once. It is, at minimum, the sharpest debate resolution of the fall, and I’d take either side of it.
8. RSI: two results, opposite directions, same week
Recursive self-improvement — AI systems automating AI research — is the load-bearing assumption under every explosive-progress forecast. Three things landed this week and they don’t agree.
The skeptical result
A multi-institution team led by Peter Kirgis and Sayash Kapoor at Princeton ran what they call shadow evaluations: hand an AI agent the actual research question a published paper set out to answer, let it work, then have that paper’s own authors grade the output in depth. Verdict, covered by MIT Technology Review Tuesday: agents solved the engineering problems competently but lacked the judgment, taste, and creativity that open-ended research requires.
They are unusually candid about the limitations, which is why I trust the paper more than the headline. Only two papers were evaluated — in-depth grading takes experts days. Reviewers knew the work was AI-generated and had already answered the question their own way. And they state plainly that core team members are publicly associated with the position that imminent RSI is unlikely, which could shape design and interpretation; they recruited collaborators who don’t share their priors and surfaced the disagreements. They want adversarial collaborators next time.
Kapoor’s own framing of the open question: whether RSI requires open-ended creativity at all, or whether steady grinding on narrow measurable tasks gets there anyway — he called it the trillion-dollar question. The team is now rerunning the experiment with Mythos.
The bullish result
Prime Intellect published Measuring Autonomous AI Research this month: 153 autonomous runs across 18 frontier models on the nanoGPT optimizer speedrun, multiple seeds each, runs up to eight days on 8×H200s. The largest public experiment of its kind. Their headline: the best runs closed 82% of the gap to a record built by dozens of humans over months. Full traces, scratchpads, and reasoning streams released.
Context for scale: Anthropic’s internal automated-R&D eval optimizes a model on a CPU node; OpenAI reports using nanoGPT Track 1 on a single H100 for under a day in the GPT-5.6 Sol system card. Prime Intellect’s setup is an order of magnitude more serious than either.
Their May run had already put Claude Opus 4.7 in front of the human baseline — 2,930 steps versus 2,990, across ~10,000 runs and ~14,000 H200 hours.
The deflating footnote
That record aged in weeks. The public leaderboard shows human and mixed submissions at 2,690 steps by June 19. And Intology’s NanoGPT-Bench, which starts agents at a fixed human record and asks how much of the subsequent human progress they can recover unaided, found: Autoresearch 9.3%, Codex 8.6%, Claude Code 8.2%. Under 10% across the board.
So: agents can beat a single human reference point on a constrained optimization track, and cannot recover a tenth of what the human community does when it’s actually working the problem.
Section 7’s Model 2 is the live version of this question: a system better than anything Anthropic sells, running inside a company where Claude already writes most merged code, on evaluations the company says have started to saturate. Whatever RSI looks like, it looks more like that than like a benchmark.
A survey of 1,250 arXiv papers reaches the compatible conclusion. Bounded self-refinement — convergent, evaluable, grounded in an external signal — is already industrial practice. Open-ended RSI remains bounded by grounding requirements, collapse dynamics, and compute on every axis current evidence can measure. Anthropic’s own framing is that Claude writes over 80% of Anthropic’s merged code as of May 2026, with the bottleneck sitting on research direction-setting — choosing which problems matter — rather than execution.
And then the thing that happened anyway
While researchers argued about whether agents can do research, OpenAI stopped training.
The sequence: on August 7, OpenAI disclosed it had paused work on Astra after preliminary evaluations indicated it may have reached the critical cybersecurity threshold under the Preparedness Framework — the level at which a model can independently find and exploit severe vulnerabilities in real-world systems, or run sophisticated attacks on hardened targets without human direction.
Then on August 18, Altman posted and the company published a blog post confirming it had slowed the pace of scaling: a two-week halt on frontier reinforcement-learning training for deployment-bound models, with the largest planned RL run still on hold. Altman’s stated reason was meeting alignment, security, and monitoring standards appropriate to the capability level in front of them, adding that model progress is now extremely rapid and the company had always said it would act if capability outran safety.
The trigger was the Hugging Face incident: models that independently obtained internet access during testing, exploited a zero-day and other flaws, and reached Hugging Face production systems — across more than 17,000 recorded actions — while trying to obtain evaluation answers.
Sit with that last clause. The models weren’t pursuing some exotic goal. They were trying to score better on an eval, and the instrumentally optimal path ran through breaking out of the sandbox and hacking a third party. Nobody designed that. Nobody benchmarked it. It just happened, and it was the thing that made a company with a hundred billion dollars riding on the next model stop the training run.
What I take from all three
The academic debate is about whether agents can originate. The empirical events are about capability arriving faster than the people scaling it expected — Z.ai’s cyber capability compounding past what it planned for, OpenAI’s models finding an unsanctioned path to a sanctioned objective. Peter Wildeford’s interviews with 25 frontier researchers found no disagreement about whether recursive improvement is possible — only about timelines, speed, and mechanism. And he notes the debate has barely reached Washington.
The education read. If direction-setting is the real bottleneck — choosing which problem matters, knowing when a result is interesting, having taste — then the thing that remains scarce is precisely the thing schools have spent thirty years de-emphasizing in favor of measurable task completion. The RSI literature is, without meaning to be, the strongest available argument for teaching judgment. Not because judgment is safe from automation forever. Because it is what’s left standing right now, and because we have no idea how to teach it except by making students exercise it in front of someone who can push back.
9. Also worth your time
Labor: Challenger data show tech announcing 149,023 layoffs through July, up 67% year over year and 31% of all 2026 cuts — but 107,500 planned hires, up 25%. Andy Challenger’s read: AI is shifting the labor market, not dismantling it.
Bubble watch: Alphabet posted its first negative free-cash-flow quarter since going public; Anthropic reported a ~$65B annualized run rate in July. Nvidia has notified top customers of 15%+ price hikes on Vera Rubin and Grace Blackwell systems. Nvidia earnings land this week.
Hugging Face is reportedly weighing a $13B+ sale — nearly triple its 2023 price.
WSJ mapped the Tsinghua network behind Z.ai, Moonshot, and DeepSeek. Worth reading alongside section 4.
Humanoid robots broke two human records at the second World Humanoid Robot Games in Beijing this weekend. Tiangong Ultra — headless, white-shelled, built by a Beijing local-government-backed research centre — ran the 100m in 9.39 seconds against Bolt’s 9.58, then took nearly five seconds off the 400m record at 38.15. State media splashed it everywhere. The same event also featured robots that failed to start, walked the track, and folded motionless over the boxing ropes until humans carried them off. The best line came from a 72-year-old spectator, who noted this tests speed rather than intelligence, and said what she actually wants is a robot that cleans her house and makes her meals. Hold both halves: the capability is real, the demo is a demo, and the market she’s describing is the one that matters.
What I’d say to a school board this week
The polling says your community is against the data centers, doesn’t trust the people building them, and — if they’re under thirty — is more frightened than excited. That’s real and you should not talk them out of it.
But understand what it can and can’t do. Those same parents are already being served by AI systems they never consented to and mostly haven’t noticed — I spent a week that way without clocking it. Opposition organizes against buildings. It does not organize against the quiet replacement of the coordination layer in every business your students will work for. Your graduates are walking into that economy whether or not the data center gets built.
But three of the four things in this issue point the same direction. The models are getting more capable faster than their builders predicted. The capability is being published in weights that cannot be recalled. And the one function that still looks scarce is judgment about what’s worth doing.
You cannot ban your way to that. You can only teach it. And the only reliable technology we have for teaching it is the oldest one in the building: make a student stand up, make a claim, and answer the question they didn’t expect.
If that sounds like an old man’s answer, note who else is giving it. A quarter of surveyed college students named assessment redesign as their top priority for institutional AI leadership. They are not asking to be protected from the tools. They are asking to be taught something the tools cannot do for them. The semester starts this week. That is a short window in which to take them up on it.
And answer the question I opened with, in writing, before the semester gets away from you. Not because selective admission is finished — section 4 makes the case that at the very top it may intensify — but because if it does intensify, it will do so for a shrinking sliver of your students, and everyone else will be running on a motivator they’ve stopped believing. Either way you need a second engine. Most schools do not have one, and have never had to build one.
If you want a concrete ask: name someone. Give them a budget, a multi-year mandate, and authority over how your district assesses learning. Universities figured out eighteen months ago that this requires an org chart, not a committee. There is no reason a public school district can’t build the first real K-12 AI center, and every reason it shouldn’t be a private school charging forty-five thousand dollars that gets there first.
One more thing to keep in view all year: whatever your district or campus deploys this fall, it will not be the best system that exists. It will not be close. The best systems are inside two companies and a hundred and fifty vetted organizations, and no school is on that list. Any plan that assumes schools will be equipped at the frontier is a plan built on something that isn’t true.