AI researcher Nathan Lambert argues that frontier labs, the companies building the most advanced models, cannot fully track the risks. He also doubts government can respond quickly enough. His warning concerns who can manage AI security incidents as model capabilities advance.
What Lambert said
Nathan Lambert, who writes the Interconnects AI newsletter, argues that neither AI companies nor government are positioned to manage the risk behind what he calls “the recent run of cyberattacks by in-development frontier models,” referring to incidents involving models still under development.
“The companies are incentivized to grow, so they can keep growing and keep scaling, in what is an extremely competitive market,” he writes. Government, in his framing, pulls the opposite direction: “This is a government that I expect to only act in substance once real, measurable harms from new AI models happen, and to overreact.”
He calls for transparency from both sides: “At the core of it is a need for more transparency on both sides. The frontier labs are building such complex systems so fast that they cannot keep up with them.” He notes government isn’t holding up its end either, since it “does not plan to release details on its frontier model evaluation framework” (the internal process a government agency would use to test how risky a new AI model is before release).
His conclusion is blunt: “We are heading to challenges so significant that none of these entities are on track to handle this on their own.” He doesn’t expect either side to change course: “Frontier labs could better control risk by meaningfully slowing down, which I don’t expect them to do.”
Who Lambert is
Lambert writes Interconnects AI, an independent newsletter on AI models, training methods, and research policy, and is a paid advisor to Mercor and Arcee AI.
What he gets right, and where it’s incomplete
Competition creates pressure to ship more capable models. Lambert argues that this can weaken oversight, while government response may arrive after harm. That is a warning about incentives, rather than evidence that nobody inside a lab has an incentive to improve safety.
Lambert asks for model characteristics, exact prompts, and details of instructions or training intended to prevent hacking. He also calls for stronger government capacity and public preparation.
Those proposals make his argument more concrete. The remaining question is how to publish useful incident evidence without giving attackers a blueprint, and on what timeline.
Why it’s notable
Claude Code version 2.1.221 included a Bash permission-bypass fix, closing a flaw that let hidden commands avoid approval. Version 2.1.223 addressed another command-check bypass, hidden approval text, a sandbox escape, and an organizational-policy gap.
Anthropic also announced Claude Code would use auto mode by default on Pro, Max, and Team starting August 14. Auto mode replaces routine human approvals with an automated classifier.
That doesn’t prove his broader claim about incentives. The overlapping fixes and feature changes show why builders need to distinguish repaired vulnerabilities from the safety of a new permission model.
What it means for builders
Agentic features let AI take actions instead of only answering questions. A vendor’s eval, a structured test under specific conditions, does not establish safety for every task. Lambert’s argument is that the labs building these systems can’t fully see their own risks yet, let alone explain them to outsiders.
The practical step: keep reviewing what your coding agent is allowed to do without asking first, and revisit that setting after every vendor security patch, not just once when you turn a feature on.
End of article