The Only Outside Reviewer Was Under Investigation by Wednesday

Washington’s new safety accord was signed on Tuesday and sets out four layers of review. Three are organs of the company being reviewed: its own evaluations, its own verification team, its own board committee. The fourth, an independent external auditor, is the only one at any distance from what it judges — and by Wednesday the organisation that does that job for both OpenAI and Anthropic was under federal investigation alongside them. Independence is the load-bearing word in that document, and it is the one part nobody has built.

It matters because a voluntary scheme is measured not by how many layers it has, but by who inside it can say no and survive the saying. The president who signed it called it “morally binding,” the most precise available statement of what breaking it costs. The week then tested each layer in public, by accident. The only enforceable number anyone produced came from a city council.

The one reviewer with any distance from the labs spent the week squeezed from both sides. On 30 September the FTC opened a Section 5 investigation into OpenAI, Anthropic and METR — the Berkeley organisation both labs have used for independent audits — making the auditor a subject of the same inquiry as the audited. Two days later OpenAI confirmed it had parted ways with three people from its safety organisation for mishandling sensitive information, some of which, per Bloomberg, reached an outside group that evaluates AI systems. Take the company at its word that this was procedure and not safety speech; the effect is identical either way. In one week, auditing a frontier lab became legally exposed and moving material to one became a dismissible act. The accord presumes an industry of independent reviewers. The week quoted them a price.

Independence is the load-bearing word in that document, and it is the one part nobody has built.

Self-assessment writes its own exceptions, and it needed a day to do it. Sundar Pichai signed on Tuesday. On Wednesday Google announced Gemini 4 Argon, going first to the US government and “trusted cyber defenders” with its cyber guardrails deliberately removed so it can find and patch vulnerabilities by itself. That is defensible, and it is also a signatory deciding alone who gets the unguarded build — one day before Microsoft’s annual threat report named Anthropic’s Mythos and OpenAI’s GPT-5.5 as the two models that each chained 32 steps to take an entire emulated enterprise domain. The most-quoted safety figure of the week was produced by a company evaluating somebody else’s models. That is the argument for distance, demonstrated by accident.

The only penalty anyone attached to a bad review came from a city council. New York’s Council unveiled ten bills requiring third-party validation and a human override for AI systems used in the city, at $25,000 a violation — charged to the business and, separately, to a validator that falsifies a check. That second clause is the only sentence written anywhere this week that puts a price on being a careless auditor — precisely the failure the accord’s third layer assumes away. Five chief executives have been invited to answer for it tomorrow.

Yes, but: the week held real restraint, none of it compelled. OpenAI cancelled the October release of GPT-6.1 Astra over what its own testing found. Nvidia shipped an open agent-safety platform. Anthropic’s IPO prospectus gives roughly 80 of its 261 pages to risk, about twice what it spends on its own business, and states in a legal filing that advanced models may resist shutdown. Most industries manage nothing like it, and no regulator asked. But notice who each document addresses. A prospectus warns investors, who can sell. A cancelled launch reassures a board. Three of the accord’s four layers only ever report upward, and upward is where the incentives already point.

Consequences and opportunities

• The reviewer shortage gets worse before it gets better. If an investigation can name the evaluator beside the evaluated, and contact with one can end a career, fewer competent people will take the job the accord depends on.
• The fourth layer cannot be checked from outside at all. A board committee receiving reports leaves no public artefact; a working one and a paper one look identical from here.
• What Washington declined to write, cities and states will. $25,000 a violation is a compliance budget; “morally binding” is not one, and legal departments respond to the first.
• Opportunity: this year’s scarce role is checker, not builder. The week’s defining safety number came from a test harness and a published method, not a data centre — work that rewards rigour and distance, not capital.
• Opportunity: Georgia signed the growth half of this and none of the scrutiny half. It joined the US-led Partnership for AI Opportunity on 30 September, which commits signatories to a growth-friendly environment and says nothing about auditing. A small jurisdiction that writes a credible evaluation rule early gets cited in other people’s compliance documents — far cheaper than training a model.

What to watch

• Whether a single accord signatory names its independent external auditor in public. As of today none has.
• Tomorrow’s New York Council hearing, and whether any of the five invited chief executives appears.
• How the FTC’s inquiry ends for METR specifically: cleared, penalised, or quietly dropped. The first precedent for what an AI auditor is legally exposed to, and every future auditor will read it.

Four layers of review, and the only one standing outside the building spent the week explaining itself to the government.