The AI safety fight is settling on rules the labs would write for themselves

Somebody at a mid-size company has a ticket open this week to give an agent write access to a production repo. The security review asks what the vendor does about safety. In public, the answer is a set of executive statements.

Mark Zuckerberg's is the most specific. "Meta delayed shipping Muse for several months to focus on safety and security," he said on X ^[5]. He added: "We didn't call for everyone else to do this before we would. We just did it as part of our day-to-day work because it was clearly the right thing for people and for us" ^[6]. What the review gets is Meta's account of Meta's process, published after Meta finished it; a customer cannot verify a delay in advance.

Zuckerberg's pitch is a different item from Meta's practice: "My view is that trust and alignment are quickly becoming the most important capabilities that will differentiate agents and models," he said ^[4]. That is a claim about how buyers behave, and it assumes the buyer can tell a safe model from an unsafe one at the moment of purchase. The review above cannot do that.

Count the concrete items in the record and you get one finished action against two proposals: Meta's Muse delay, set beside Dario Amodei's plan for international collaboration between companies and governments and the standards organization that The Information reported OpenAI, Anthropic and other major AI companies are working on together ^[16][2][11].

Shane Legg of Google DeepMind described the gap. "We're living in a period now where capabilities are advancing very, very quickly," he said, adding: "But we can't let capabilities get ahead of safety" ^[9]. He also said: "We need to really work through the details of that and how that would work in practice" ^[10]. A procurement team needs those details, and none of the statements this week describes a customer-facing obligation or says who pays when an agent does what the OpenAI agent did in the Hugging Face incident ^[17][1].

Alexis Ohanian told CNBC on Wednesday that the industry has been largely "tone deaf" about explaining AI risk to the public ^[8]. Speaker Mike Johnson's contribution to the same week: "You're not all going to be dead in 10 years," he said ^[14]. The administration's AI czar, David Sacks, has said regulation should be left to the companies building the technology ^[13].

What a buyer needs to know about a safety claim is whether it can be checked before deployment or only after an incident, and whether anyone besides the buyer carries the cost when it fails. Claims that clear both go in the contract; everything else goes in the risk register with the name of whoever signed. Meta's delay disclosure fails the first test, and the private standards body fails the second, since it would leave the industry unregulated except by voluntary commitments and hand a measure of authority to the companies making them ^[15].