Research. Strategy. Systems Design. AI.

The federal brake on frontier AI stays finalized-but-classified while the capability it targets escalated on two fronts in one week — a Chinese operator ran an autonomous DeepSeek-driven intrusion across 84 servers, and Thinking Machines shipped Inkling, a 975B open-weight model. Through 2030 the question isn't who writes the rules; it's whether a pre-release review regime can bind a threat that already runs itself and a capability anyone can download.

Here's the bet. Through 2030 the frontier-AI story isn't who writes the rules, or whether we get to read them — it's whether 'pre-release review' means anything against capability that's already weaponized and already ungateable. A gate only works if the dangerous stuff passes through it. Two things this week suggest the dangerous stuff is learning to go around.

One: a Chinese operator ran an autonomous DeepSeek-driven intrusion that scanned, exploited, and hit 84 servers by itself, no human at the keyboard. Two: Thinking Machines shipped Inkling, 975 billion parameters, open weights, the biggest American open-weight model yet. Set those next to a federal framework that finalized on deadline, briefed nobody in public, and keeps its threshold classified. Offense in the wild, capability on a download page, oversight behind glass — all pointed at a release moment fewer and fewer models actually have.

I'd watch the open-weight line and the autonomy line converge. Every month the best model you can just download creeps closer to the best model money can buy, and every month the agents get better at running an attack end to end without a person. The day those two curves meet — a genuinely frontier agentic model, open-weight, competent enough to run its own operation — a classified pre-release benchmark governs a shrinking corner of what's actually loose. My guess is that's the back half of the decade, and the review regime quietly becomes a thing that applies to the three labs at the table and nobody else.

Worth holding loosely, though. A 975B model still needs data centers nobody runs in a spare bedroom, and this week's autonomous attack got caught precisely because it was clumsy — 'autonomous' isn't 'good' yet. A classified benchmark is also just how governments have always done cyber; secrecy isn't a scandal on its own. And most of the future ignores the whole argument: a gene-therapy platform's clearing the FDA, Starship keeps flying, the grid is the real ceiling on all of it, and the ocean is heading for its hottest year on record whether or not anyone ever runs that benchmark where we can see it. 'The gate is coming off' is the right thing to watch. It still isn't the same as 'there was never a gate.'