Where we stand. The call to “pace the frontier” cannot be answered from inside the industry, because every participant is individually better off building. That much was clear a fortnight ago. What has become clear since is why each company took the position it did — and it is not conviction, it is accounting. Meanwhile two constraints nobody proposed have begun to bind on their own, and they pull against each other: the price of money, and the antitrust laws.

Why the brake cannot come from inside

Two companies, each choosing between building flat out and slowing down to make the technology safer. Whatever the other one does, you are better off building: if they slow and you don’t, you take the market; if they build and you slow, you lose it. Both end up racing even though both would prefer the careful world. That is not a failure of character — it is what the incentives pay.

Two forces weld it shut. Slowing alone does not make the frontier safer, it hands the frontier to whoever doesn’t slow. And capital rewards the racer — slow too much and the funding dries up, including the funding for safety work. This is the part everyone already agrees on. It is what follows that has changed.

There are only three ways out of a trap like this: trust built by dealing repeatedly, behaviour made transparent, or enforcement imposed from outside. Every proposal on the table reaches for one of them, and each fails for its own reason.

And the cost of an accident falls on everyone, including the billions of people who are not in the game and never agreed to play. No deal between two competitors can price that.

Who needs intelligence to be scarce?

Not who is sincere — everyone claims that. The question you can actually answer from public disclosure: does this company’s revenue need frontier capability to stay scarce and expensive, or does it need intelligence to become cheap and everywhere? One axis, read off what each company sells. The question was prompted by a market map published by the independent analyst Devansh (18 September), worth reading in its own right; the axis, reasoning and conclusions below are ours.

The first auditor is appointed — and the company being audited is paying

On 18 September, the transparency exit was tested in public. Anthropic named Accenture its first embedded evaluator: outside staff working inside the company with access comparable to an employee’s, observing training and deployment decisions, red-teaming models, documenting incidents and reporting publicly. Each side expects to invest at least $1bn over five years — though both describe these as expectations rather than contracted spend, and neither has disclosed a term, a fee or a headcount.

The most candid line is Anthropic’s own. It will fund the work directly, but states that in the long run “funding should come from pooled or government sources.” The company has named the conflict in the document that creates it. It is also non-exclusive, with further evaluators to follow and a separate nonprofit in discussion to run a pilot on its own funding — which is the structurally clean version of the same idea.

On the same day, more than a hundred researchers — among them Geoffrey Hinton, Stuart Russell and Yejin Choi — published minimum conditions for exactly this kind of arrangement. The letter named no company. Scored against it:

The pattern is old and the profession that learned it is auditing. An assurer paid by the assured — while also selling that client a great deal of other business, with scope and fees undisclosed — is the configuration financial auditing ran before the reforms of the early 2000s. It was not fixed by finding more virtuous auditors. It was fixed by mandated disclosure, independence rules and a regulator — after a scandal, not before. Read that way, the researchers’ conditions are an attempt to write auditor-independence rules for AI in advance. Whether that has ever worked is a fair question.

The brake nobody designed

While the industry argued about whether it should slow down, its lenders began, quietly, to make it more expensive not to. This is the development that matters, and it received almost no attention.

The build-out is externally financed. The anchor customer of the largest project loans is not profitable: OpenAI’s own projections, reported by the Financial Times, show roughly $278bn of negative cash flow through 2030, against a raise at around $1.2 trillion and a listing pushed to 2027. Against that backdrop, three things happened in quick succession.

• A marquee project loan failed to clear at par. The roughly $18bn financing behind the Oracle-leased New Mexico data-centre campus — built for that same anchor customer — was quoted in the secondary loan market at 89–91 cents on the dollar, with syndication stalled and banks holding more than planned. This level originates with the Financial Times and every subsequent report we can find traces back to it; Reuters attributes it to the FT expressly, and Oracle, Santander and Jefferies did not respond to its enquiries. Dealer runs are not public documents. Treat it as single-origin reporting, not as a corroborated price. The borrower’s own coupon does not change either way; the loss sits with the lenders, and the borrower’s cost rises at the next site.
• Comparable paper repriced by 100 basis points in twelve weeks. CoreWeave closed a facility in May at SOFR plus 450, oversubscribed and tightened during syndication. It closed a comparable facility in August, same ratings, at SOFR plus 550 — also oversubscribed. The price moved; the access did not. That distinction matters: this is repricing, not a funding strike.
• But not for everyone. Between those two, in July, QTS, the data-centre platform owned by Blackstone, upsized a term loan from $1bn to $3.25bn — twice — reported at SOFR plus 225 with a zero floor, at the tight end of talk, through JPMorgan, the same lead bank as the August deal. Reported by PitchBook in July; we have not seen the credit agreement, and one transaction cannot describe a market. So the sequence is 450 in May, 225 in July, 550 in August — and that is the point. Credit did not shut. It tiered. Strong sponsors clear cheaply; weaker credits pay two to three hundred basis points more than a year ago. The spread between borrowers opened before the weakest of them repriced.

And one pattern that runs the length of the stack

Look at where the operating cash is actually coming from. In its most recent quarter, 49% of Oracle’s operating cash flow came from a single line — customer prepayments carrying a significant financing component — against zero in the same quarter a year earlier. At CoreWeave, 40% of first-half operating cash flow came from working capital, most of it deferred revenue.

The clearest case is Nscale, which filed to go public on 18 September — because a registration statement has to show the mechanism. The figures are below.

Three layers are being funded by the customer standing in front of them. That is not fraud and it is not unusual in infrastructure. But it means the chain has a single point of failure, and it is not the models. It is whether the companies at the top can keep raising capital.

And Nscale’s own accounts say what happens if they cannot. Its financial statements disclose that because the funding plan relied on financing not yet committed, this initially raised substantial doubt about its ability to continue as a going concern — doubt management concludes is resolved, because if the money does not arrive it can defer, reduce or cancel capital expenditure. That conclusion is management’s and the statements are prepared on a going-concern basis; this is a disclosed dependency, not a qualified audit. But read what the mitigation actually is. A company holding $56bn of contracted backlog says that if financing tightens, it stops building. That is the brake, written into the accounts, by the party who would apply it.

The second brake: it may be illegal to agree to slow down

Section one said law was a dead end because no government will force its own companies to slow while it is racing other countries. That was the wrong worry.

On 18 September — the same day the first evaluator was appointed — four people who pay for AI subscriptions sued Anthropic, OpenAI, SpaceXAI and Google in a California federal court. Their claim is simple. Competition law forbids rivals from agreeing to hold back what they sell. Agreeing to improve your products more slowly, they say, is exactly that: the customer gets less than they would have. They are suing on behalf of everyone in America who has paid for one of the four assistants since 12 September, and they want the practice stopped and the money paid back three times over.

None of this has been tested, and none of the four companies has said anything. Bloomberg Law reported on the day it was filed that none had responded to its request for comment, and we can find no statement since. One housekeeping point for anyone who cites the case: the filed document and the court’s own listing show slightly different case numbers. We note both and read nothing into it.

What makes it worth a few minutes is not the money. The entire case is built out of things the companies said in public — the September essay, the rivals who agreed with it within hours, and a reported working group meeting since July.

And their argument is ours, turned around. We have said that a company which slows down on its own loses ground, so restraint only works if they all do it together. The lawsuit says: exactly — and that is what a cartel is. Rivals agree to hold something back so that none of them loses out by going first. Usually the thing held back is production, or price competition. Here, the plaintiffs say, it is the speed at which the products get better. Same facts. Opposite conclusion.

Why the first real move looked the way it did

The people suing are careful about what they are not attacking: a company testing its own systems, a company slowing down by itself, safety research, following government rules, or normal industry standard-setting. They are going after companies agreeing with each other, not companies being careful. And that maps exactly onto the pacing plan, which has three steps: put examiners inside your own company (needs nobody’s permission); get competing labs to agree common limits (needs the legal exemption); get authoritarian governments to join in (needs an opponent to agree).

So the first real act of the slow-down era was one company hiring one supplier, rather than an industry agreement. That is not a governance choice. It is the only one of the three that can be done without anyone’s permission.

And that is why the examiner question matters far more than it first appears. Agreeing common limits with rivals may be unlawful without an exemption no government has granted. Getting authoritarian states to join in is, for now, wishful. Which leaves the entire weight of self-restraint resting on the one step that is actually available — an evaluator hired and paid by the company it is evaluating, drawn from a firm that is already one of that company’s largest commercial partners. If that arrangement is not genuinely independent, there is nothing else holding.

What we are watching

• Loan pricing, not the benchmark. The US ten-year closed the week at 5.01% against 4.97% a week earlier. Round numbers circulate as the level at which build-out financing seizes; we do not carry one, because the binding level is not visible in the ten-year — it shows up first in the spread over it. Wider than August on the next syndication means the tiering is deepening.
• Whether the labs’ equity window stays open. This is the load-bearing assumption under the prepayment chain. Everything else is second-order to it.
• Any large company taking a position against its own economics. The single question in section two sorts every public stance we can see, and a test that explains everything after the fact should be held loosely. One major participant arguing against what its own revenue needs would break it — and would tell us far more than another company arguing for it.
• Whether the evaluator arrangement acquires teeth — specifically, any published protection for an evaluator who reports something adverse, and any disclosure of the commercial relationship alongside it. The bar to watch is the one the labs set themselves: the September essay says an evaluator should have the right to publish its findings, and the access it did or did not receive, without editorial control by the company. The September announcement does not say it.
• What the four companies say, and the first ruling from the judge. If the case is allowed to proceed, coordinating on pace becomes a real legal risk rather than a theoretical one. If it is thrown out early, the industry gets its freedom to try back. Either way a court decides it, not the industry — which is the whole point.
• Whether any government grants the narrow exemption the essay asked for. The cleanest single test in the whole argument: it is the only route by which competing labs can lawfully agree limits between themselves. Without it, self-restraint stays confined to what one company can do on its own.
• Whether “pooled or government” funding for evaluation gets legislative traction anywhere. If a jurisdiction funds it, assurance becomes an industry. If not, it stays a vendor relationship.

What it means for portfolios

The pacing debate is not an investable event. It has produced no binding constraint and, on the analysis above, cannot. Positioning around the rhetoric — either the fear or the reassurance — is positioning around a negotiation whose outcome was determined by its structure before it began.

The financing of the build-out is investable, and it is where the information is. The relevant questions for any portfolio with exposure to this complex are not about model capability. They are: how much of this company’s cash flow is customers paying in advance? What does its next refinancing cost? And does its business need the model layer to be expensive or cheap? That last question, more than any view on artificial intelligence itself, determines which side of the next repricing a holding sits on.

And a caution about the assurance layer. The market for evaluating AI is being created now, and it will attract capital on a narrative of inevitability. It is worth remembering that the comparable profession took a generation and a scandal to establish what independence required — and that the first arrangement of this kind is, on its own published terms, only partly there.