Walking into doom, smiling

What the closed labs actually do

It's become fashionable to sneer at frontier-lab safety theater, so let's be precise about what the theater contains before we watch someone skip it. Anthropic ships Fable 5 with active rerouting: higher-risk cyber, bio, chem and distillation queries get diverted to the less-capable Opus 4.8 instead of being answered at full strength. The full-strength variant — Mythos 5 — is gated to roughly 150 vetted organizations under Project Glasswing, with the whole stack sitting under the Responsible Scaling Policy v3. OpenAI published a system card for GPT-5.6 that rates all three variants "High" risk in cybersecurity and bio/chem under its Preparedness Framework, documents the model's over-agency problem, and wires mandatory confirmation prompts around high-risk actions. In June, the Commerce Department briefly switched Fable and Mythos off entirely pending export review, and put Sol behind customer-by-customer approval.

You can call this regime paternalistic, clumsy, anticompetitive — this blog has, and OpenAI's card documenting a file-deleting model it shipped anyway shows the regime leaks. But it exists. It's a stack of brakes, each individually mockable, collectively load-bearing.

Now the comparison. Kimi K3's launch materials contain — per a genuinely thorough search — no system card, no red-team report, no preparedness rating, no CyberGym score (a gap other analysts flagged too), and no stated gating plan for the July 27 weight release. A model measured 2.8 points off the world frontier, with Terminal-Bench agentic scores above Grok's, is scheduled to become a download. The safety documentation is a release date.

Ten minutes to jailbreak, forever to take back

Whatever refusal behavior K3 ships with is best understood as a decal. In May, the FT demonstrated — recounted by NPR — that a free tool called Heretic strips the safety alignment out of open-weight models in under ten minutes on consumer hardware. Not a lab, not a nation-state: a journalist, before deadline. Once weights are public, refusal training is a suggestion, permanently, for everyone, at once. Economist Kevin Bryan drew the line within a day of K3's launch: "it's clearly very capable writing code → if they release weights, it will be jailbroken… with effectively no limits → hard to see how you won't have a major cyber or safety incident → frontier OS will be highly limited after." Note the structure of that last clause: even the optimistic ending is that open frontier models get banned after the incident, not before it.

The genre press has already found the register for this. Exhibit A, and I'm linking it as a specimen, not a source: ZeroHedge's "'This Is Concerning': Why Everyone Is Freaking Out About China's Kimi K3 Model" — from the site whose masthead literally reads "on a long enough timeline, the survival rate for everyone drops to zero." The funny part: under the shrieking headline sits a fairly sober market analysis. The doom sells the click; the body copy hedges. Remember that shape — it's this whole moment in miniature.

Once weights are public, refusal training is a suggestion — permanently, for everyone, at once.

Anthropic keeps asking. Nobody answers.

On June 4, Anthropic published "When AI builds itself", and buried in it the sentence that should have been the headline: "We believe it would be good for the world to have the option to slow or temporarily pause frontier AI development to enable societal structures and alignment research to keep up with the advance of the technology." Six days later Dario Amodei followed with "Policy on the AI Exponential": frontier models, "like airplanes, should be required to go through technical testing and auditing, and their release should be blocked or reversed as a threat to public safety if they do not meet high standards of safety." Twice, in five weeks, in writing.

The response: no lab echoed it. No government acted on it — the June 2 executive order created a voluntary 30-day pre-release review that, as Lawfare lays out, structurally cannot touch a Beijing lab publishing weights: "The US can gate its own closed frontier models. It cannot gate open weights." The EO's actual observed effect, per CNBC, was to gate the American models and push enterprise demand toward the ungated Chinese ones. And yes — Anthropic's own essay concedes the hard part: a real pause needs every frontier lab in every country to stop simultaneously and verifiably, and "training runs are far easier to conceal than missile silos." They're asking for a coordination mechanism that doesn't exist, from competitors who won't build it. Self-serving? Maybe — a moratorium conveniently freezes the leader's lead, and Bernstein's analyst already reads it as "regulatory capture as a strategy." But notice that the cynical reading and the sincere reading predict the same observable world: warnings published, warnings ignored, weights shipped.

The steelman, because it's strong

The open-weight camp is not stupid and this post argues with its best version. Delangue: regulating open source "would hurt the very people regulation is supposed to protect… while risking killing competition, slowing AI progress, and reducing transparency even more." LeCun has argued for years that open platforms end up more secure, the Linux way — a thousand red-teamers you didn't hire. Thinking Machines showed the responsible version is possible, shipping their open model with published CBRN/cyber uplift evals, including refusal-stripped variants — proving you can hand out weights and a risk assessment. And Transformer's sober take on K3 specifically: it's below the true frontier by its own maker's admission, its release "poses few risks and significant geopolitical benefits," and Beijing will hit the same restrictive incentives Washington did within months. Maybe. Probably, even.

But every one of those arguments has the same load-bearing assumption: that the capability level at which openness stops being safe is still comfortably ahead of us. That assumption gets re-tested every release, the gap is 2.8 points and closing, and the entity making the call each time is whichever lab is currently behind and needs the goodwill. Moonshot published no evaluation showing K3 is below the danger line. They may well be right that it is. We are now in the position of hoping they checked.

Smiling all the way down

• If you deploy K3 after July 27: treat it like this blog treats every agent — sandboxed, snapshotted, least-privilege, blast radius engineered in advance. Assume the copy running near you has had its refusals shaved off, because statistically, someone's has.
• If you're in the open-weight camp: the Inkling release is your existence proof. Demand K3-grade releases come with Inkling-grade evals. "We'll publish the tech report later" is not a risk assessment.
• If you think Anthropic's calls are self-serving: fine — then answer them with a counter-proposal instead of silence. Silence is the one response that's wrong in every branch.
• If you're just watching: the tell to watch for is boring paperwork — whether July 27 comes with a model card and eval suite, or just a magnet link and a party.

So: are we walking into our doom with a smile on our face? Here is the most honest answer this desk can produce. The smile is earned — part 2 is real, the clinics and the co-ops and the collapsed cost floor are real, and nobody gets to wave that away as naivety. The walking is also real: capability one notch below the frontier, spreading to every hard drive on earth, safety-carded by nobody, while the only lab asking to slow down gets told — by the market, by its rivals, by the government that briefly unplugged it — to keep dancing. Doom is not certain. It's just, for the first time, undocumented. The models that could hurt us come with system cards describing exactly how. The one going open on the 27th comes with a countdown timer. Smile if you want. I'd keep one hand on the snapshot button.