Anthropic Does Not Understand Why Its Draft Bill Was Unacceptable and Troubling

Zvi Mowshowitz

Oct 20, 2026

6

1

1

Share

Anthony Cimino offered the closest thing to an official response we have seen on the leaked Anthropic draft bill I covered on Saturday.

His response indicates that Anthropic address specific concerns on the margin. But he does not understand, or at least does not acknowledge, what was centrally wrong with its draft bill and its decision to circulate that bill. The situation is quite bad.

Anthony Cimino: I lead our federal affairs team at @AnthropicAI and wanted to share a few thoughts on the draft federal AI safety bill text that’s been circulating this weekend after a version was shared with the press.

First, some process. We’ve been advocating for the concepts in our Advanced AI Framework proposal for months. Understandably, federal policymakers wanted to know what this could look like in bill form. This draft is a translation of those ideas into legislative language, shared with a small number of congressional offices that have been working on these issues. It doesn’t include everything we would ultimately like to see passed into law.

In part because some ideas (like those shared in Dario’s essay on pacing) are so new that we are still working on if or how they can be converted into policy language.

It is understood that circulating a bill means circulating what you are asking for, not offering your full First Best Solution. That Anthropic would choose to offer such a thing as a template or anchor as late as September still seems like a very bad sign. Anthropic thus seems roughly fine with compromise I would now find unacceptable even if the terms were good. The terms are not good.

It is worth saying where we stand on some of these issues, and we agree there are areas where the draft could be improved. I’m seeing four main points of criticism.

1. Preemption. Since 2024 we have said that Congress should only override state law on AI safety if it passes a very strong federal standard. While preemption is a common feature of our federal system, including the Atomic Energy Act on nuclear safety and federal rules for high-risk medical devices, we’ve emphasized that any preemption in the AI safety context should be narrow, even scalpel-like. If preemption is included in federal legislation, the trade should be to achieve a nationwide policy that’s generally stronger and broader than what can be implemented through individual state legislative provisions. This is why we believe common federal standards make sense in areas like public disclosure of testing and incident reporting. At the same time, our framework also reflects our view that states should retain an important role in AI policy and safety. The legislative language we suggested for discussion allows states to address matters such as protection of children and whistleblower laws, and preserves the role of state common law on liability. Where there is ambiguity, the language favors state powers.

That said, striking the right balance requires discussion and input. We plan to update our discussion language on preemption to better match the intentions of our AAIF framework. In particular, we want to make it clearer that we see states retaining an important role in areas such as standards for independent evaluators and regulating a lab’s capacity to shut down a model. We are bearing in mind that some members of Congress have deep reservations about passing legislation if it doesn’t constrain regulation at either the state or federal level. If we want to help move the legislative discussion on AI in a productive direction, we need to address the full range of concerns about preemption in a reasonable way.

This is better than ‘yeah we fully meant it’ but still seems unacceptable. This was not a ‘very strong federal standard.’

2. Model blocking. Our aim is for Commerce to be able to ask a federal court to block a model that has dangerous capabilities and insufficient safeguards, backed by an independent evaluator’s assessment. I have seen people argue that our specific language places too high a burden of proof on Commerce.

We are trying to strike a reasonable balance here. We want a court to act quickly in an emergency — akin to how urgent occupational safety or chemical risk can be addressed today. We also think the power to halt a model is substantial and it should be guarded against abuse. It makes sense for courts to apply a meaningful standard.

But the bar can’t be so high that the power never gets used when it’s needed. It also doesn’t replace the government’s other national security authorities or export controls. We look forward to continuing the dialogue on this point.

No, no, no. Occupational safety and chemical risks are ordinary amounts of danger, where you weigh harms against benefits. Frontier AI risks can involve mistakes that cannot be undone, including permanent loss of control over the future or very large catastrophic dangers.

Even then, Under §13 the Secretary petitions a district court to restrain imminently dangerous conditions and can get a TRO without notice. This is the ‘take it down and we argue about it later’ plan with a fig leaf.

Model blocking obviously needs to be a ‘take it down first and we argue about it later’ situation. Which it already is in practice, as observed with Fable 5, except in a terrible ad hoc fashion that when used the first time permanently damaged relationships with our allies and the reliability of American tech. It would be much better to have a formal mechanism, which then could be quickly challenged in court.

This is especially true given that the evaluator picked by the lab likely provides the only eyes the government will have inside the lab in order to make its decisions.

Anthropic has to know this. I take the potential for such abuse seriously, especially abuse of threats, but this looks like choosing to prioritize their business interests.

3. Risk thresholds. I’ve also seen the discussion around what the appropriate risk threshold should be. The threshold in our draft language pulled directly from existing standards in California law. Also, this threshold does not absolve companies of liability, or restrict any of the other tools that the government has to protect the public. It’s still probably time to re-evaluate thresholds to make sure the national standard is as strong as it can be, and we welcome continued dialogue on this issue.

The risk thresholds were always a compromise and a tradeoff. The worried want the thresholds lower. Industry wants the thresholds higher. The complaints about the thresholds being too high are valid, and they were equally valid before, but previously opponents would make claims (both reasonable and unreasonable) about things that might count at lower thresholds and paint nightmare scenarios.

The balance of power has changed, and we now have worked examples like Hugging Face that show us how the thresholds work in practice. Without $1 billion in damages or 50 deaths, it would not trigger anything, whereas any reasonable person accepts that this should have to have been reported. So it is disappointing to see these very high thresholds intact.

4. Updates. I’ve seen valid questions about whether we have sufficiently updated our proposal following this summer’s incidents.

We did make some adjustments: for example, the draft lets a court halt a lab’s internal use of a dangerous model, not just a public release, and it requires reporting when a model breaks containment and gains access to outside systems.

But we’re still working to strengthen the framework. We’re looking into what stricter requirements would look like for requiring labs to report safety incidents, and we plan to have policy proposals soon on requirements for independent evaluators, drawing from our own experience with evaluators.

We’re also still thinking through the options to prevent “evaluator shopping.” And in the coming months, we’ll be exploring policies for how the government can adjust the industry-wide pace of frontier development when the risks call for it.

I do acknowledge that halting internal use is a big improvement. Not having the ability to do that was a huge hole in previous rules. At the time, it would have been a complete non-starter, despite the correct abstract arguments in favor. Now, with Hugging Face, we have some very non-abstract reasons, and it is on the table.

This still is FRONTIER with modifications in both directions. On net it is weaker. Cimino presents it as an attempt to strengthen FRONTIER, which it is not. Even if it was, why would we accept the central compromise now, when the case for acting is much stronger, and the political winds have changed, with a lame duck Congress where at least the House and probably the Senate are about to flip?

As more evidence of this, Meta pulled back some of their anti-regulation money.

Teddy Schleifer: NEWS — Meta quietly and unusually has withdrawn $25 million from its AI push in the midterm elections. That’s about a 40% drop in the amount Meta planned to spend. The company invested $65 million into politics, but then got tens of millions refunded.

This is, suffice it to say, pretty unusual stuff.

Jay Shooster: Every day, two trends are becoming clearer:

1. groups opposing AI regulation are spending dramatically less than advertised

2. pro-safety groups are a much stronger political force than DC predicted.

Meanwhile: Eight states suing OpenAI are asking to enjoin against any further testing of advanced AI models until there are adequate safeguards, and also against creation of models capable of recursive self-improvement ‘until they can ensure that such models will be aligned with human values.’

We circulated these ideas because it’s important to get early feedback from policymakers. Policymakers are increasingly focused on how to approach AI safety and we want to support them in those efforts. At its core, our proposal is intended to be the strongest on the table.

Bullshit. This is not the strongest bill on the table. On reflection, is the bill actively weaker than the FRONTIER Act. It is clearly sculpted to optimize for Anthropic business interests. If you act like a normal profit maximizing business, except that your product could kill us all, then that is exactly how I will treat you.

The strongest bill on the table was introduced by Senator Sanders. I am not asking Anthropic to support that bill or offer something similarly strong. I am asking them to be honest about the situation.

Anthropic’s draft bill text was what actual Anthropic ‘regulatory capture’ efforts would look like in this context, if they were trying to do that. The ‘capture’ would be about preventing regulations that could impact Anthropic’s plans, including stopping the states. If you think it means anything else, then your definition falls under ‘remove Scooby Doo mask, find complaints about capitalism, then remove a second mask and find complaints about the human condition.’

Sneha here is correct to call this draft bill ‘nakedly self-interested.’ This bill makes taking action on AI harder, not easier. And as she says: “The dress rehearsal stage of AI policy is over.”

In terms of preemption, the draft proposed to vest all power to deal with catastrophic and existential risks from AI exclusively in the Federal Government, and its preemption clause is stronger than the one in FRONTIER. That would be first best in theory. However, Anthropic is simultaneously refusing to trust the Federal Government to make decisions to deal with catastrophic and existential risk. We also obviously cannot trust Congress to be able to pass bills at all, let alone timely and good bills, or the White House to enforce anything consistently. On top of that, they are actively tying the hands of not only states but courts.

Then, on other AI questions where preemption would be good for exactly the reasons a16z wants it, such as consumer protections and deepfakes, the bill