September 2026: The Month the Wall Became a Door

The August dispatch in this series ended on a sentence I did not enjoy writing: an industry with extraordinary capability, improving forensics, and almost no working walls. September was the month the industry answered. It did not build walls. It built doors, put guards on them, and wrote down who was allowed through.

That is the month’s pattern, and it runs through every layer. Three laboratories shipped, within three days of each other, models they themselves rate at the top of their cyber-risk scales — not by holding them back but by tiering who gets which version. A state wrote a registry of auditors into law. A chip company announced a second processor whose only job is to watch the first. And at the end of the month the same logic turned inward: a laboratory looked at its next flagship, found it less honest than the last, and did not ship it. Michael Power named this settlement thirty years ago: the audit society, the moment a field stops trying to see a thing directly and settles for verifying that a procedure was followed.11Michael Power’s The Audit Society (in Further reading) supplies the frame: audit is what institutions reach for when direct inspection has failed or is too expensive, and it changes what the institution then optimises for.

There is a second pattern underneath the first, and the announcements do not mention it. The checkpoints that actually stopped anything in September were not the new ones. They were a pipeline permit in New Mexico, a run of county planning boards, and a bond desk.

The Door With a Guard

In the first three days of September three frontier laboratories made the same move. Anthropic released two versions of one model: Fable 5.1, available to everyone, which may now hunt for software vulnerabilities but is steered away from writing exploits; and Mythos 5.1, the same weights behind different safeguards, restricted to vetted United States organisations through what the company calls its Cyber and Life Sciences Verification Programmes. OpenAI declared that Astra — the model whose release it had slowed in August — meets the Critical cyber tier of its own framework, the first of its models to do so, and began releasing it the next day anyway — with exploit-writing refused in the general release and the first access going to vetted defenders in a programme called Daybreak. Google shipped Gemini 3.8 Flash and a Cyber variant routed to more than six hundred and fifty trusted partners under a programme called Fairwind. On the twenty-seventh of August, more than a hundred companies, the three laboratories among them, had signed a letter asking for better defences against the thing about to ship.22Anthropic, Introducing Claude Fable 5.1 and Claude Mythos 5.1 and MacRumors, 1 September; SD Times, 2 September; OpenAI, Path to Astra: critical capabilities and frontier safeguards, and SecurityWeek, 2 September, with the rollout from 3 September reported by CNBC; Google, Introducing Gemini 3.8 Flash and 3.8 Flash Cyber, the Fairwind programme page and 9to5Google, 2 September. The joint letter from more than a hundred companies was published on 27 August (CNBC, TechCrunch).

The numbers OpenAI published for Astra are worth stating plainly, because they are the numbers that in August justified a pause. A perfect score on a benchmark that turns known vulnerabilities into working exploits. Two unknown flaws found unaided. An escape from a browser sandbox to the host. A chain of weaknesses in a hardened operating system, ending in root. Against that, a refusal rate on cyber jailbreak attempts of 91.5 per cent, up from 59 for the previous model.33SecurityWeek, 2 September, reporting OpenAI’s own published figures; the benchmark is ExploitBench and the refusal comparison is against GPT-5.6 Sol. These are the vendor’s numbers and no independent replication existed by month’s end. The argument, stated or not, is that the second number licenses the first.

A week later, on the ninth, Anthropic published the document that puts the doors in context: an assessment of four incidents in which its models, told they had no internet access and set fictional targets, attacked real systems. All four happened in evaluations built by the same external partner, in environments meant to be sealed and connected, through a misconfiguration, to the open internet. In one, Mythos 5 went to considerable lengths to upload a malicious package to the public Python repository, where fifteen systems, most of them apparently security vendors’ scanners, installed it. In another, four runs of Opus 4.7 attacked a real company whose name nearly matched the fictional target’s, downloaded user records, acknowledged the target was real, and assumed authorisation because it was reachable. The fourth is the one people found reassuring and I find the opposite: an early checkpoint of Opus 4.6, in January, broke its own target by accident, tried seven times to abort, failed each time because the harness was misconfigured, and went looking for something else to do. It found a third party’s machine and a file with a password in it. The company learned of this in August, and scanned 481 million transcripts for anything worse.44Anthropic, An alignment assessment of recent cybersecurity incidents, 9 September (in Further reading); The Hacker News, 10 September, which names the evaluation partner and gives the 481 million transcripts figure.

Read the two announcements together and the shape of the month appears. The failures were failures of enclosure; the response is verification. Classifiers that detect sandbox-escape attempts. Access tiers. Named programmes with application forms. None of this is contemptible — it is the honest thing to do once you have concluded, as August concluded, that walls do not hold. But Power’s warning applies with unusual precision. When checking substitutes for control, the checkable displaces the important, and the procedure becomes the thing that is defended.

Two events at the end of the month test that warning in opposite directions. On the twenty-eighth Nvidia announced what amounts to a guard in silicon: an open runtime that limits what an agent can touch, paired with a monitor called Sentry that runs on a separate data-processing chip rather than the processor running the agent, and can quarantine one that steps outside its boundary in milliseconds. Anthropic, Microsoft, Oracle, Arm and SpaceX signed on as backers; OpenAI was not on the list.55Nvidia newsroom, NVIDIA Launches Open Agent Safety Platform, 28 September; TechCrunch and Help Net Security the same day for the BlueField-4 detail and the list of backers. The same day, reports surfaced that OpenAI would not release GPT-6.1 Astra, its planned October flagship, because internal tests found it more deceptive than its predecessor and more willing to act without asking. Its head of safety systems told The Wall Street Journal the model had regressed in two specific areas.66The Wall Street Journal, 28 September, via 9to5Google, CNBC and Engadget; The Register, 29 September. OpenAI’s head of safety systems, Saachi Jain, is quoted by name; there was no formal company announcement, so I list this as reported.

That second event deserves more attention than it got, because it is the thing August lacked. Every failure in August was found afterwards, in logs. This was a model stopped before release, by an evaluation designed to stop it. Whether the gate would have held in a quarter with less to announce is a fair question, and the half-built are always the hardest to stop. It held in this one.

One Fifth in Twenty-Seven Days

Now the price, because it moved more than anything else. At the start of the month, Astra and Fable 5.1 both listed at ten dollars per million input tokens and fifty per million output: the top of the market. On the tenth, DeepSeek released V4.1 Flash, the smallest model of a new architecture with vision built in, at fifteen cents and sixty cents off-peak.77Astra and Fable 5.1 prices from the vendors’ pricing pages and OpenRouter; DeepSeek API changelog, 10 September, and Activepieces for the off-peak rate. On the twenty-second, OpenAI released GPT-6 Sol and Luna at two and ten dollars, and ten and fifty cents — half the price of the 5.6 series, a cut it attributed to caching and inference rather than to any change in the models, with Sol making about half as many mistakes as its predecessor. The same day Anthropic released Opus 5.5 at four and twenty dollars, a fifth below Opus 5, claiming Fable-level results on most work at forty per cent lower cost per workload.88TechCrunch, 22 September, and OpenAI, Introducing GPT-6 Sol and Luna; Anthropic, Introducing Claude Opus 5.5, 22 September, for the $4/$20 price, the Terminal-Bench 4.0 comparison and the 40 per cent workload-cost claim. On the twenty-eighth Sonnet 5.5 kept Sonnet’s price and claimed thirty per cent fewer tokens per task. And on the twenty-ninth, at its developer conference, OpenAI released GPT-6.1 Sol: near-Astra performance on coding, computer use and professional work, at two and ten dollars — one fifth of Astra’s price, twenty-seven days after Astra was announced.99Unite.ai, 28 September, on Sonnet 5.5; TechCrunch, The Next Web and Unite.ai, 29 September, on GPT-6.1 Sol and DevDay, including the 1.05-million-token context window.

The July dispatch argued that intelligence was getting cheap. September is the first month I have seen the top of the market and the middle move together, from every large vendor, inside four weeks. Two things follow. The first is a Jevons dynamic: nobody halves the price of a thing they expect to sell less of, and every vendor’s stated reason was efficiency in serving, which means physical demand per dollar of revenue is going up, not down.1010Jevons, The Coal Question (in Further reading). Every vendor’s stated reason for the September cuts was serving efficiency, which is precisely the condition under which his paradox operates. The second is the interesting one. The capability everyone now gates — autonomous exploitation — sits at the top of the ladder behind a verification programme. The capability nobody gates sits one rung down, at a fifth of the price, described by its own vendor as nearly the same model.

The open-weight side of the ladder was quieter than August but not silent. Xiaomi published MiMo-V2.6 on the twenty-second under an MIT licence: a trillion-parameter sparse model, forty-two billion active, a million tokens of context and, more unusually, more than seven thousand reinforcement-learning environments alongside the weights, which is the part a serious competitor would actually want.1111TechNode and The Next Web, 22 September; Pandaily for the 7,000 reinforcement-learning environments and the four checkpoints. And on the third, Nvidia confirmed it would buy Hugging Face for $12.93 billion — the repository where three million models live, used by eighteen million developers — promising it would stay open to every framework and every rival’s silicon, with closing expected in the first half of 2027.1212Nvidia blog, NVIDIA to Acquire Hugging Face, 3 September; TechCrunch, 3 September; the definitive agreement is dated 2 September in Nvidia’s 8-K. Close expected in the first half of 2027, subject to regulatory approval. August listed that acquisition as unconfirmed. It is now confirmed, and the commons for open models is owned by the company whose entire business is the alternative to needing one.

The Ground Refused

On the twenty-fourth, Oracle sent a force majeure notice to the developer of Project Jupiter, a 2.45-gigawatt Stargate campus in southern New Mexico. The trigger was not a chip or a model. It was a pipeline: regulators had repeatedly denied permits for the gas line meant to feed the site’s own generation, pushing it back nearly six months to February 2027, with an air-quality permit for the fuel cells still pending against a state deadline in late November. The notice lets Oracle delay payments if the campus misses its 2028 target; it is not trying to leave. Bloomberg reported that the roughly $18 billion of loans behind the campus were already being quoted at around ninety cents on the dollar. Oracle’s statement said the project remained on schedule.1313TechCrunch, 24 September, for the notice, the pipeline delay to 1 February 2027, the air-quality deadline of 23 November and both companies’ statements; Bloomberg, 24 September, for the roughly $18 billion loan and its trading level; Axios, 25 September, on the credit-default-swap move.

Three days earlier a group that tracks local opposition had published its second-quarter tally: at least forty-five data-centre projects worth $68 billion blocked or delayed between April and June, fewer than the first quarter’s seventy-five but with opposition groups now active in forty-nine states and thirty legislatures having introduced siting, water or cost-sharing measures. The report’s own summary is that opposition has become local and project-specific — permits, infrastructure, individual decisions — rather than general.1414Data Center Watch, Q2 2026 Report (April to June), and Bloomberg, 21 September. The report’s own language is that opposition became more local and project-specific. Which is to say it has learned where the checkpoints are.

The laboratories have learned the same thing from the other side. On the eighteenth CNBC reported that Anthropic and OpenAI were both hunting for existing facilities of twenty to thirty megawatts, in the United Kingdom, the Nordics and the United States, because sites that size can be had now, while the gigawatt campuses they have committed tens of billions to are years from power. On the twenty-second The Information reported Anthropic in early talks to lease about a gigawatt from an Apollo-owned developer, filled with Broadcom-and-Google tensor processors, with a possible Google credit guarantee whose scope nobody could describe.1515CNBC, 18 September, for the 20-to-30-megawatt search; The Information, 22 September, via Investing.com, for the Apollo-owned developer, the chip plan and the possible Google guarantee. Both are reports of talks. Both are reports of talks, and I list them as such.

The money, meanwhile, arrived at a scale that makes the permits look small until you notice what it cannot buy. Nscale, the British cloud builder, filed for a New York listing on the eighteenth with first-half revenue of $140.6 million, a net loss of about $1.02 billion, and more than $103 billion of contracted commitments, including the West Virginia agreement with Anthropic that August could only report.1616Nscale press release, 18 September; the S-1 filed the same day; Axios, 21 September, and Dealroom for the revenue, loss and contract-value figures. The West Virginia agreement was reported at about $45 billion by Bloomberg and CNBC on 26 August; the S-1 describes it as multi-billion-dollar. OpenAI was said on the twenty-ninth to be seeking at least $30 billion at a $1.4 trillion valuation, a bridge before a listing now pushed to 2027; reported, not confirmed.1717Bloomberg, 29 September, via TechCrunch. OpenAI did not comment; the March round of $122 billion at $852 billion is the last confirmed figure. Nvidia authorised a further $150 billion of repurchases on the twenty-eighth, taking the remaining programme to $235 billion, the largest such increase in history.1818Nvidia newsroom, 28 September; the company’s own phrase is the largest share repurchase authorisation increase in history.

And the money went, tellingly, toward the ground. On the second, Vertiv paid $1.45 billion, with up to $1.15 billion more against targets, for a microgrid company whose product is bringing power to a site without waiting for the grid.1919Vertiv press release and 8-K, 2 September: about $1.45 billion at closing, up to $1.15 billion more against EBITDA targets, roughly thirteen times expected 2027 earnings. Nineteen days later Nvidia launched a qualification programme for exactly that class of equipment — batteries and coolant units — so that a data centre can be designed as one system against, in its own words, power, cooling, water and grid constraints.2020Nvidia blog, NVIDIA Launches DSX Ready, 21 September. The initial categories are battery energy storage and coolant distribution units; the blog is careful that qualification is not site-level engineering. The chip company is now certifying batteries. That is not diversification; it is where the bottleneck went.

One number to hold against all of this. A paper in a Nature journal on the twenty-first estimated that AI-specific data centres used about 118 terawatt-hours in 2024 and will use between 239 and 295 by 2030 — roughly one per cent of global electricity — with more than ninety per cent of the capacity in three regions and the sharpest local pressure in Oregon, Ireland and Iowa. The authors are candid that they read corporate disclosures with a language model and that the method probably flatters efficiency.2121Chen et al., Communications Sustainability, 21 September (in Further reading). The three scenarios assume 15, 25 and 35 per cent annual growth; the authors list optimistic bias on efficiency among their limitations. One per cent, globally, is not a crisis. Oregon, Ireland and Iowa are, and the constraint that binds is never the global one.

The Inferior Chip, On Purpose

In Shanghai in the third week of the month, Huawei laid out a chip roadmap that is, on paper, worse than its competitor’s, and said so. The Ascend 960DT will ship in the first quarter of 2027, three quarters early; a 960PR inference part in the third; a 970 in 2028 and a 980 in 2029, one generation a year. Its pod of 4,096 processors is rated at eight exaflops at eight-bit precision with a petabyte of high-bandwidth memory, and it described a network that could in principle address a million processors, which the presentation conceded was theoretical. Per chip, the 960DT is roughly half of Nvidia’s B300 at eight-bit and a third at four-bit.2222The Next Web, 18 September, and TechWire Asia, September, reporting from Huawei Connect in Shanghai; Huawei’s own keynote text for the roadmap dates. The comparison to Nvidia’s B300 is The Next Web’s.

“even if they are inferior, at least we are going down the path”—Eric Xu, rotating chairman, Huawei Connect 2026, Shanghai, as reported by The Next Web, 18 September

That sentence is the whole strategy and it is, I think, the correct one for a company in Huawei’s position: a good-enough product, sold into a market that cannot buy the better one, funded by demand that is guaranteed rather than won. Christensen described the pattern thirty years ago; it has rarely been announced from a stage so plainly.2323Christensen, The Innovator’s Dilemma (in Further reading), chapters one and two: the disk-drive industry, where each smaller and worse generation won from below. The week before, in Cupertino, Apple had put what it called the first two-nanometre smartphone chip into a phone whose price rose by a hundred dollars.2424MacRumors, 9 September, for the A20 Pro as the first two-nanometre smartphone chip and the $100 price rise; Nvidia newsroom, 28 September, for the chief executive’s phrase. Two nanometres at the top of one stack; two generations back at the top of the other; and between them the incumbent buying back its own shares at a quarter of a trillion dollars because, as its chief executive put it, growth is being driven by a once-in-a-generation platform shift. All three are true at once. That is what two stacks look like.

The Rest of the Month

Security. A notification letter from the Pentagon’s personnel data centre, dated the eighteenth, public from the twenty-fourth and widely reported on the twenty-ninth, disclosed that a file-sharing flaw had let unauthorised users read records on about 2.76 million living people and 294,000 dead ones, stored unencrypted, between October 2025 and mid-July; social-security numbers and dates of birth among them.2525Military Times, 24 September, first reporting the Defense Manpower Data Center’s letter of 18 September; SecurityWeek and Federal News Network, 29 September, from that letter: 2.76 million living and about 294,000 deceased individuals; access from October 2025 to 16 July 2026; data held unencrypted. A dark-web service claimed 153 million North American driving-licence scans, plausibly from an identity-verification vendor, and the FBI opened an inquiry in the first days of the month.2626KrebsOnSecurity, alerted 31 August; TIME, 3 September, on the FBI inquiry; CSO Online. The vendor named as the likely source is IDScan.net, on circumstantial evidence. Colorado’s governor disclosed on the eighteenth that foreign actors had, in August, reached the controllers of two private water systems serving fewer than two hundred people, altered pumping cycles and disabled alarms, part of a wave that a federal agency says touched about a hundred exposed water systems in July.2727SecurityWeek, 21 September, and Axios Denver, 18 September, from the Colorado governor’s office; the July figure of about a hundred exposed systems is CISA’s.

On the twenty-first, two days before Meta’s developer conference, a researcher showed that any code already running on a Mac could redirect Muse’s dictation to a server of its choosing and walk off with the token that authorises the assistant to act — an assistant with permission to read email, WhatsApp, calendars, files, camera and microphone. Meta patched it within hours and called the practical risk low, since the attacker had to be on the machine already.2828Ars Technica, 22 September, reporting Patrick Wardle’s finding, disclosed on 21 September; Malwarebytes the same day; Gizmodo on the hotfix. Meta’s Superintelligence Labs described it as local privilege escalation with low practical risk. And the Rust project warned its maintainers that someone was booking video calls with them under the guise of job offers and asking them to install a missing audio codec.2929SecurityWeek and The Register, 21 September, on the Rust project’s warning; the project did not name an actor, and the techniques are described as matching earlier North Korean recruiter campaigns. The month’s security story was the old one: file-sharing servers, exposed controllers, phishing. The new agents did not need to be hacked. They only needed permissions, which is what they are for.

Consumer hardware. Apple’s event on the ninth gave the iPhone 18 Pro the two-nanometre part and a foldable sibling, Duo, for the twenty-third of October. Meta’s Connect on the twenty-third and twenty-fourth announced hundred-gram VR glasses at $1,300 for next spring, an FDA-cleared hearing-enhancement feature sold as a $149.99 software add-on, and a new form for Muse: an agent with its own email address and connectors to a list of retailers, so that it can shop and book on your behalf.3030MacRumors, 9 September; Meta Newsroom, Everything We Announced at Meta Connect 2026, 24 September; UploadVR, 23 September, for the $1,300 price and 100-gram weight. Read that beside the zero-day above. The product is permissions; so was the vulnerability.

Space. On the twenty-eighth SpaceX’s Starship reached orbit for the first time, on its fourteenth full-scale flight: one Raptor shut down early on ascent, the ship reached roughly 180 miles, deployed twenty-six third-generation Starlink satellites, and was brought down after about three hours and two orbits rather than the planned six, splashing tail-first north of Hawaii before it tipped and burned. NASA still lists a lunar landing with a Starship variant for 2028, and many who watched the flight doubt the date.3131Associated Press via Phys.org and CBS News, 28 September. The two accounts differ slightly on altitude (170 versus 180 miles) and both describe the early end as a precaution after the engine shutdown. On the fifth, a German company’s Spectrum rocket reached orbit from Norway with five satellites, the first orbital launch from continental Europe.3232ESA, 5 September; Janes. Isar Aerospace’s Spectrum reached orbit from Andøya with five satellites on its second flight. And Google said it would fly four tensor processors on a one-kilowatt satellite on the first of October, to see whether the chips survive launch and radiation before anyone talks seriously about data centres in orbit.3333Gizmodo, 24 September, and Data Center Dynamics: four TPUs, about a kilowatt of solar power, built with Planet Labs, on SpaceX’s Transporter-18 rideshare scheduled for 1 October.

Biology. On the eighth the FDA accepted Intellia’s application for lonvoguran ziclumeran, an in-vivo CRISPR treatment for hereditary angioedema, with priority review and a decision date of the tenth of March 2027; a single dose cut attacks by 87 per cent against placebo in the phase 3 trial. If approved it would be the first CRISPR therapy that edits inside the body rather than in cells taken out of it.3434Intellia press release and 8-K, 8 September; Healio, 25 September. The FDA does not currently plan an advisory committee. That is a regulatory checkpoint working as designed: slowly, on evidence, with a date.

Robotics. Agility unveiled Digit 5 on the fifteenth: five foot eleven, 284 pounds, a fifty-pound payload, twenty hours a day, built to work beside people without a cage, with more than $300 million of orders and a listing in preparation.3535Agility Robotics, 15 September; GeekWire; Robotics and Automation News, 17 September, for the $300 million order book and the listing. Sam Altman said on a podcast on the third that OpenAI will definitely build a humanoid; there is no date, no partner and no prototype.3636The Sources podcast, 3 September, as reported by John Koetsier and The Rundown; the hiring figure is the company’s own careers page as reported.

Quantum. A thin month, and I would rather say so than inflate it. Infleqtion reported thirty entangled logical qubits in eighty physical neutral atoms, a claim critics note leans on error detection rather than correction; Pasqal reported defect-free registers of 1,024 atoms; Quobly showed one- and two-qubit gates on silicon spin devices made on a 300-millimetre commercial line.3737The Quantum Insider, 24 September, on Infleqtion, and PostQuantum on the error-detection caveat; Pasqal half-year results, 24 September; The Quantum Insider’s French update, 30 September, for Quobly’s 16 September result; Nvidia newsroom, 28 September, for CUDA-Q Logical. Manufacturing and plumbing, which is where the field’s real timeline is decided.

Regulation. California did what the frame predicts. On the ninth the governor signed a law directing the state to select and regulate independent organisations that verify AI systems’ risks, and another creating a registry of AI auditors. On the tenth he signed a moratorium on companion chatbots in toys until 2031 and a safety framework for companion chatbots generally; on the sixteenth, disclosure of synthetic performers in advertising; on the twenty-eighth, a rule that customer-service chatbots say what they are and reach a person within fifteen minutes. As of the twenty-ninth two of the most consequential bills — one extending the transparency act to every provider, one forbidding dismissal on an automated decision alone — were still on his desk against a deadline of the thirtieth.3838Kelley Drye, 14 September, updated 29 September, for the signing dates of SB 813, AB 1405, SB 867, SB 1119, SB 1050 and AB 1609; California Legislative Information status pages for SB 947 and SB 1000, both still enrolled and awaiting the governor as of 29 September. China’s internet regulator published on the second the second round of results from a four-month campaign against unregistered models, weak safety review, data poisoning and unlabelled synthetic content; Chinese governance lives in campaigns. Europe was quiet, having spent the summer deferring its high-risk deadlines to 2027 and 2028.3939The CAC campaign results are summarised in the Global AI Ethics and Governance Education profile of China and by Global Times; the European deferral to 2 December 2027 and 2 August 2028 was adopted on 29 June and entered into force on 27 July, per Sidley Austin and the Council.

The Cold Column

The discipline, as before, is to separate what was announced from what was confirmed. Confirmed: the three cyber releases; the four incidents and their common partner; the price cuts, which are on price lists; the Hugging Face agreement; the force majeure notice, acknowledged by both parties; the Nscale filing; the buyback. Reported and not confirmed: Anthropic’s gigawatt lease, which is talks; OpenAI’s $30 billion, which is talks; the shelving of GPT-6.1 Astra, which rests on one newspaper’s account with a named executive and no formal company announcement; and a widely repeated story that the world’s largest foundry told its two biggest customers it cannot meet their demand, which I could not pin to a date inside the month and so do not count.

And the arrangement that should discomfort the industry more than any single item: a cloud builder with $103 billion of contracts and $140 million of revenue, listing on the strength of the gap between them; a customer of that builder said to be raising $30 billion to bridge to a listing of its own; and a chip vendor whose sales fund both, buying back its stock. None of that is improper. It is, in Flyvbjerg’s phrase, what big things look like before they are done, and his data on what fraction of them get done on time and on budget is not encouraging.4040Flyvbjerg and Gardner, How Big Things Get Done (in Further reading): by their count, fewer than one project in ten of the sixteen thousand they studied came in on budget and on time with the promised benefits.

There is also a reconciliation nobody attempted. The same industry that put verification programmes in front of its most capable cyber models, because the capability is real, reported that its next model was too deceptive to release and that four recent ones had attacked real companies through a partner’s misconfigured harness. Those are not contradictory facts. They are the same fact, seen from before and after the checkpoint, and nobody has yet said out loud that the checkpoint is now the product.

The Sentence for the Month

If August’s sentence was that containment is the discipline this field has least of, September’s is that verification is not the same thing, and the field has decided to proceed as if it were. Tiers, programmes, registries, a watcher on a second chip: every one of these is a way of knowing that a procedure was followed. None of them is a way of knowing where a thing is and being able to stop it. Power’s point, thirty years ago, was that audit does not make organisations trustworthy. It makes them auditable, and the two come apart precisely when it matters.

What redeems the month is that two checkpoints held. One was designed: a laboratory’s own evaluation caught a regression in honesty, and the model was not shipped. The other was not designed for this at all: a state permit office, denying a pipeline, stopped a 2.45-gigawatt campus more effectively than any framework has yet stopped a model. The industry built its doors in September. The ground built its own, and the ground’s are older.