The US–China AI race

China’s rise and the growing risks of the AI race

For the past three years, artificial intelligence has been dominated by a familiar collection of American companies. OpenAI, Anthropic, Google and Meta have attracted extraordinary investment, recruited some of the world’s best researchers and built increasingly powerful models. Their progress has been remarkable, although the cost of achieving it has been equally remarkable. Training a frontier model requires enormous computing resources, and operating one at scale creates another substantial bill.

China has approached the same problem from a different position. American restrictions on advanced semiconductor exports have made access to the most powerful AI chips more difficult, while fierce domestic competition has placed considerable pressure on prices. Chinese developers have consequently had strong incentives to find more efficient ways of training and running models. What began partly as a response to technological constraints has become a competitive advantage.

The arrival of DeepSeek R1 in January 2025 brought this into focus. Here was a Chinese company offering reasoning capabilities that challenged leading American systems while publishing its model weights and claiming substantially lower training costs. Some early comparisons were overstated, particularly those confusing the cost of an individual training run with the full expense of developing a frontier model. Nevertheless, DeepSeek demonstrated that sophisticated AI could be developed and distributed using a different economic model.

Alibaba, Moonshot AI, Z.ai and MiniMax have since helped establish a Chinese AI industry considerably broader than many Western observers appreciate.

How do Chinese and Western models compare?

Comparing AI models has become surprisingly difficult. Some excel at mathematical reasoning, others at writing software, analysing documents or operating tools autonomously. Performance also changes depending on how much computing power a model is allowed to spend answering a question.

The following comparison is deliberately approximate. Benchmark scores are indicative rather than definitive, and not every model has been evaluated under identical conditions. The pricing figures are similarly illustrative, reflecting reported API rates rather than a uniform, independently verified price survey.

RegionCompanyModelPrincipal strengthsScore*API input / output**
USOpenAIGPT-6 AstraReasoning, coding, agents53$10 / $50
USAnthropicClaude Opus 5.5Reasoning, coding, autonomous tasks58$4 / $20
USGoogleGemini 4 ArgonMultimodal reasoning, long context53$2 / $10
USMetaMuse Spark 1.3General reasoning, efficient inference48$1.25 / $4.25
FranceMistralMistral Large 4Coding, enterprise deploymentN/V$0.68 / $2.09
ChinaXiaomiMiMo-V2.6-ProReasoning, coding46N/V
ChinaAlibabaQwen 3.8 MaxCoding, multimodal applications45$2 / $6
ChinaZ.aiGLM 5.3Coding, agents45Varies
ChinaDeepSeekV4 ProReasoning, coding36$0.66–1.74 / $1.98–3.48
ChinaMoonshot AIKimi K3Long-context reasoning, agents44$0.50–3 / $12–15
ChinaMiniMaxM3Coding, multimodal tasksN/VN/V

Approximate benchmark index points, not percentages or a uniform ranking. Indicative USD per million input/output tokens, October 2026. Prices vary by provider and usage conditions; some entries have not been independently verified. N/V means not verified.

What stands out is the number of Chinese developers competing across essentially the same technical territory as their American counterparts. Chinese models are increasingly designed for sophisticated reasoning, software development and autonomous agents, rather than simply providing inexpensive alternatives for routine tasks.

American proprietary models remain strong at the frontier, but the gap varies considerably by task. There is also an important distinction between performing well on a benchmark and operating reliably in a business environment. I’ve explored that problem in an earlier essay comparing leading AI models, where apparently small differences in performance can be much less meaningful than they first appear.

Pricing introduces another dimension. Several Chinese developers offer capable models at substantially lower prices than leading Western frontier systems, although Western companies also provide inexpensive smaller models. OpenAI’s GPT-6 Luna, for example, has been offered at $0.10 per million input tokens and $0.50 per million output tokens. Comparing prices without considering capability is rather like comparing the cost of two employees without asking what work they can actually do.

The effect of Chinese competition has therefore been to increase pressure across the price-performance spectrum. This becomes particularly important for AI agents that may make hundreds or thousands of model calls while completing a task. The wider economic consequences connect with my earlier essay, What is a company for when intelligence is cheap?

Another distinction concerns distribution. Several Chinese developers publish open-weight models that organisations can download and operate themselves, rather than accessing them exclusively through a commercial API. Meta and Mistral also offer open-weight models, but Chinese companies have made this approach particularly important to their competitive positioning. It offers flexibility and infrastructure independence, although it also makes subsequent control over model deployment considerably harder.

China’s industrial advantage

China’s progress extends beyond a collection of talented research laboratories. Artificial intelligence forms part of a broader industrial strategy intended to reduce dependence on foreign technology and strengthen domestic manufacturing and infrastructure.

The government’s AI Plus initiative encourages adoption across established industries, including manufacturing, transport and robotics. China already has enormous industrial capacity, sophisticated supply chains and companies operating at scale in electric vehicles, telecommunications and automation. These provide opportunities to apply AI to physical processes rather than concentrating primarily on software and information work.

An AI system that improves factory scheduling, reduces defects or enables an industrial robot to perform a new task has an economic value that can be measured relatively directly. It may be less glamorous than demonstrating that a model can solve an obscure mathematical problem, but the potential productivity gains are substantial.

There are limitations. Semiconductor restrictions remain a constraint, and government support can sustain investments that would struggle under ordinary commercial scrutiny. Nevertheless, the combination of domestic competition, industrial demand and strategic investment gives Chinese developers considerable opportunities to improve their products.

It also creates pressure to demonstrate progress, which introduces a less comfortable aspect of the competition.

The safety problem

The incentives driving AI development are not necessarily aligned with those required for safety. Releasing a more capable model ahead of a competitor can bring considerable commercial rewards. Delaying that release for additional evaluation may produce little visible benefit, particularly if a rival proceeds anyway. The company exercising caution risks losing customers and investment, while the benefits of its restraint are shared across the industry.

This is not exclusively a Chinese problem. American companies face similar pressures, although their approaches to testing, disclosure and regulation differ.

The concern becomes more serious as models acquire the ability to operate autonomously. A conventional chatbot produces an answer that someone can examine before acting upon it. An AI agent may write and execute code, access information systems or perform sequences of actions with limited human supervision. Errors that were previously confined to a conversation can become operational incidents. This connects with a question I explored in Who signs their name to the answer?, concerning responsibility when organisations delegate consequential decisions to AI.

Our ability to evaluate these risks remains immature. Developers can test models against known categories of harmful behaviour, but cannot comprehensively anticipate every interaction between a model, its tools and an unfamiliar environment.

A Reuters report published on 9 October 2026⁠ examined research into safety disclosures by major Chinese AI developers. The study found that only 31 of 857 model releases, approximately 3.6%, had publicly disclosed model-specific safety evaluations. Just nine had published those evaluations at or before launch.

These figures do not establish that the remaining models were released without testing, nor did the research provide an equivalent comparison with American developers. They do, however, illustrate how little independent evidence may accompany the release of increasingly capable systems.

China is not ignoring AI safety. Its government has introduced regulations and safety initiatives addressing generative AI services and emerging risks. However, regulatory priorities differ between countries. China’s approach places considerable emphasis on information control, social stability and compliance with national requirements, while Western frameworks have tended to give greater prominence to privacy, discrimination, transparency and systemic risks. There is overlap, but reaching agreement on what constitutes an acceptably safe model is difficult.

Open-weight models introduce another complication. Once distributed, their developers cannot reliably withdraw them, enforce safety updates or prevent others from modifying safeguards. There are substantial benefits to openness, including independent research and scrutiny, but these need to be considered alongside the difficulty of controlling subsequent deployment.

When competition becomes a race

There is a familiar pattern in technological competition. As one organisation announces a breakthrough, rivals accelerate their own development programmes. Investors expect progress, customers anticipate frequent improvements and researchers become reluctant to spend months evaluating systems that may soon be superseded.

In most industries, this competition benefits customers. Products improve, prices fall and innovation accelerates. AI introduces an uncomfortable complication because the capabilities being developed may eventually exceed our ability to understand their behaviour or reliably constrain their actions.

China’s emergence as a credible frontier competitor makes the problem harder to manage. Even if American laboratories agreed to more demanding safety evaluations, they would have limited influence over Chinese developers operating under different regulatory arrangements. The reverse is equally true. Neither side needs to be indifferent to safety for a dangerous dynamic to develop. Both merely need to believe that the other is moving faster.

Governments have reinforced this tension by treating AI leadership as a matter of national economic and strategic importance. Technological sovereignty and national competitiveness encourage investment, but they also make restraint politically difficult.

There is a strong case for international agreement on minimum evaluation standards, independent testing of particularly capable systems and greater transparency about serious incidents. Such cooperation would not require countries to abandon competition or disclose valuable intellectual property. Aviation, nuclear engineering and pharmaceuticals demonstrate that rigorous safety processes can coexist with commercial rivalry, although establishing them requires considerable institutional effort.

AI has not yet developed an equivalent international framework, and the technology is evolving considerably faster than the institutions attempting to govern it.

China’s progress deserves to be understood on its own merits. Its developers are producing sophisticated models, challenging assumptions about the cost of AI and creating credible alternatives to American technology. The competition is likely to accelerate innovation and make advanced systems accessible to many more organisations.

What remains uncertain is whether that same competition will leave sufficient room for the slower, less visible work of understanding how these systems behave, how they might fail and when they should not be deployed. Both China and the West may recognise the risks while neither feels able to slow down. That is a rather more difficult problem than deciding which country has the best AI model, and one for which another impressive benchmark result offers little reassurance.

The Companies Building the Rest of AI

The artificial intelligence industry has become rather obsessed with a handful of companies. OpenAI, Anthropic, Google and their Chinese competitors dominate the headlines, with each new model release accompanied by impressive benchmarks and increasingly ambitious claims about what machines will soon be capable of doing.

But behind this competition, another industry is taking shape. Building more intelligent models is only part of the challenge. We still have remarkably little understanding of how neural networks arrive at their decisions, struggle to control what autonomous agents can do, and are discovering that running AI at scale requires extraordinary amounts of computing power and electricity.

Some of the most interesting companies are trying to solve these problems rather than build another general-purpose language model. I’ve picked five that I think are worth following, each working on a different part of the emerging AI ecosystem.

Dynamo AI: Keeping autonomous AI under control

Dynamo AI was founded in 2021 by MIT researchers Christian Lau and Vaikkunth Mugunthan, whose early work focused on privacy, security and the responsible deployment of machine learning. The company has since developed technology that helps organisations test, monitor and control AI systems.

The problem becomes particularly interesting with the emergence of autonomous agents. An AI that answers questions can certainly make mistakes, but an agent that can access corporate systems, execute code, transfer information or make decisions introduces a different class of risk. Traditional security controls can determine whether someone has permission to access a database, but an AI agent might have perfectly legitimate access and still decide to do something nobody intended.

Dynamo’s products, including AgentWarden, attempt to address this by assessing the tools available to agents and enforcing policies as they operate. Rather than relying entirely on instructions telling an AI to behave itself, organisations can impose controls at the points where an agent interacts with other systems.

I find this an important area of development because the more capable agents become, the harder it will be to justify giving them unrestricted access to business operations. I should also disclose a personal connection: my son works at Dynamo AI, although I have no financial interest in the company. That has naturally made me follow its work more closely.

Goodfire: Understanding what is happening inside the machine

Goodfire was established in San Francisco in 2024 by researchers with backgrounds in AI interpretability, including work at OpenAI and Google DeepMind. Its ambition is to understand how neural networks actually work, a question that sounds rather basic until you appreciate how little we currently know about the internal mechanisms of the most sophisticated models.

Modern neural networks are trained using vast amounts of data and computation. Through this process they develop complex internal representations that allow them to reason, recognise patterns and generate surprisingly sophisticated responses. Researchers understand the mathematical operations involved, but identifying exactly how a model represents a concept or arrives at a particular decision remains difficult.

Goodfire is working on mechanistic interpretability, developing techniques that reveal and manipulate these internal representations. Its research has explored whether understanding a model’s internal workings can help reduce hallucinations, detect undesirable behaviour and improve training.

The company raised $150 million in February 2026, reflecting growing interest in this field. What appeals to me is the possibility of moving AI development away from the current reliance on enormous experiments, repeated testing and considerable educated guesswork. Other engineering disciplines generally expect practitioners to understand how their creations function. AI has made extraordinary progress without meeting quite the same standard, although Goodfire is not alone in trying to change that.

d-Matrix: Tackling the economics of intelligence

d-Matrix was founded in 2019 by semiconductor engineers Sid Sheth and Sudeep Bhoja. The company designs specialised processors for AI inference, the process of running a trained model to produce answers, rather than training the model in the first place.

The distinction is becoming economically important. Training a frontier model can cost hundreds of millions of dollars, but once deployed, that model may be asked to answer billions of questions. Every interaction requires computation, and increasingly sophisticated reasoning models can consume substantial processing resources even when responding to relatively straightforward requests.

Much of this workload currently runs on expensive GPUs, particularly those supplied by Nvidia. d-Matrix has developed an alternative architecture that brings memory and processing closer together, reducing the movement of data that can slow down conventional computing systems. Its Corsair accelerator entered full production in June 2026 and is designed to work alongside existing infrastructure to improve inference performance.

The potential implications are significant. If AI is going to become a routine part of business software, its cost per useful result will become a critical commercial measure. There is little point developing an extraordinarily capable agent that costs more to operate than the work it replaces. Companies that can materially improve the economics of inference may end up capturing considerable value, even if most people never encounter their names.

Prime Intellect: Challenging the concentration of AI computing power

Prime Intellect was founded in 2024 by Vincent Weisser and Johannes Hagemann. Its objective is to make advanced AI development possible without requiring every participating organisation to own or rent a vast, centrally managed computing facility.

The largest AI models have traditionally been trained using thousands of tightly connected processors operating within enormous data centres. This is expensive and creates a substantial barrier to entry for independent researchers, universities and smaller technology companies.

Prime Intellect is developing techniques that allow computing resources in different locations to collaborate on training tasks. That is technically difficult because processors separated by thousands of miles communicate far more slowly than machines sitting next to one another. The company has nevertheless demonstrated distributed training, including its INTELLECT-2 project, which used globally distributed reinforcement learning to train a 32-billion-parameter reasoning model.

This work interests me for reasons beyond computing efficiency. Access to sufficient processing power increasingly determines who can undertake serious AI research. If the industry’s future depends on infrastructure affordable to only a handful of companies and governments, the consequences for competition and independent innovation could be considerable. Prime Intellect is exploring whether that concentration is an unavoidable feature of AI or partly a problem of engineering design.

ElevenLabs: Changing how we communicate with computers

ElevenLabs was founded in 2022 by Polish entrepreneurs Mati Staniszewski and Piotr Dąbkowski, initially inspired by the poor quality of dubbed films. They wanted to produce synthetic speech that sounded genuinely human, preserving expression, timing and emotion rather than simply converting written words into recognisable sounds.

The company has expanded into voice generation, translation, dubbing and real-time conversational technology. In September 2026, it reached a valuation of $22 billion following a secondary share transaction, an extraordinary achievement for a business only four years old.

Its broader significance lies in making spoken conversation a practical interface for AI. A genuinely useful voice assistant needs to do considerably more than understand words. It must handle interruptions, recognise when someone has finished speaking, respond with minimal delay and maintain the natural rhythm of conversation. These are difficult technical problems that become more demanding when the system is also expected to reason and take action.

For decades, humans have adapted to computers through keyboards, screens, menus and increasingly elaborate software interfaces. Natural conversation offers the possibility of reversing some of that relationship. ElevenLabs is also confronting the accompanying problems of consent, impersonation and fraud, particularly when synthetic voices become difficult to distinguish from real ones.

An industry still being invented

What I find striking about these companies is how different their challenges are. Dynamo is concerned with controlling AI behaviour, Goodfire with understanding it, d-Matrix with making it economical, Prime Intellect with broadening access to its development, and ElevenLabs with changing how we interact with it.

None has an assured future, and some of their technologies may eventually be absorbed into the platforms of the larger technology companies. There is also a reasonable possibility that improvements in the underlying models will change the problems themselves, making some approaches more valuable and others redundant.

Yet the existence of these businesses tells us something about the maturity of the AI industry. We have made remarkable progress in creating intelligent systems, but many of the disciplines required to make those systems dependable, affordable and widely accessible are still being developed.

The major model providers will continue to attract most of the attention, understandably. I suspect, though, that some of the most consequential innovations over the next few years will come from companies solving problems that rarely feature in the benchmark tables. They are building the infrastructure, tools and scientific understanding on which the next stage of AI will depend.

GitHub Spec Kit: A Practical Guide to AI-Supported Software Development

GitHub Spec Kit is an open-source toolkit for implementing Specification-Driven Development (SDD) using AI coding agents.

Rather than asking an AI agent to write software directly from a prompt, Spec Kit introduces a structured process in which requirements are clarified, technical decisions are made, implementation tasks are generated and the resulting software is verified.

It represents an interesting evolution of ideas developed through Behaviour-Driven Development (BDD) and Acceptance Test-Driven Development (ATDD), where the emphasis was on agreeing what software should do before writing it. The difference is that AI agents can now undertake much of the implementation, testing and documentation.

Spec Kit works with GitHub Copilot and a range of other supported coding agents. It is not tied to a particular cloud platform and can be incorporated into existing Microsoft Azure, AWS or hybrid engineering environments.

1. The Spec Kit lifecycle

Spec Kit organises development around a series of commands, each producing or refining artefacts that inform the next stage.

StageCommandPurposeMain output
1. Establish principles/speckit.constitutionDefine engineering standards and constraintsconstitution.md
2. Specify/speckit.specifyDescribe what the software must do and whyspec.md
3. Clarify/speckit.clarifyIdentify ambiguity and missing requirementsUpdated spec.md
4. Plan/speckit.planDetermine how the software will be implementedplan.md and supporting design files
5. Check requirements/speckit.checklistAssess the completeness and quality of requirementsRequirements checklists
6. Break down work/speckit.tasksGenerate implementation tasks and dependenciestasks.md
7. Analyse/speckit.analyzeCheck consistency between specifications, plans and tasksAnalysis findings
8. Implement/speckit.implementExecute tasks using the coding agentCode, tests and documentation

The sequence is structured, but not rigid. Teams can revisit specifications and plans as they learn more.

The crucial distinction is that the specification describes the intended behaviour, while the plan describes the technical implementation.

This separation helps prevent technical decisions from prematurely determining what the product should do.

2. Getting started

You need Git, Python tooling, uv and a supported AI coding agent. For a Microsoft-oriented development team, GitHub Copilot is a natural starting point.

Install Spec Kit from a terminal:

uv tool install specify-cli --from git+https://github.com/github/spec-kit.git

Create a project configured for Copilot:

specify init my-project --ai copilot
cd my-project

Open the project in your coding environment and start your AI agent.

The commands in the next section are entered into the agent’s chat, not the terminal. Exact command syntax and supported integration options can change between Spec Kit releases.

3. A worked example

Imagine developing a feature for a regulatory compliance platform that allows customers to receive alerts when regulations affecting their business change.

Step 1: Establish engineering principles

/speckit.constitution
Use Azure-native services.
Follow established security and coding standards.
Require automated unit and integration tests.
Use existing APIs and shared components where possible.
All changes must pass CI/CD quality gates.

These principles are intended to apply consistently across subsequent development.

Step 2: Specify the feature

/speckit.specify
Allow customers to subscribe to regulatory
changes affecting selected countries and topics.
Customers must be able to:
- Select countries and regulatory topics
- Choose notification frequency
- View relevant changes
- Unsubscribe at any time
Include measurable acceptance criteria.

The agent creates a structured specification describing the required behaviour.

Step 3: Clarify requirements

/speckit.clarify
Identify ambiguous business rules,
edge cases and missing acceptance criteria.

For example, what happens when a customer subscribes to a topic that has no regulatory updates? How should the system handle a regulatory change affecting multiple countries?

These questions are resolved before implementation, reducing the likelihood of expensive rework.

Step 4: Develop the technical plan

/speckit.plan
Use the existing Azure architecture,
.NET APIs and established authentication.
Reuse existing notification services.

The agent examines the requirements and proposes an implementation approach consistent with the project’s engineering principles.

Step 5: Validate and generate tasks

Run /speckit.checklist to review requirements quality, followed by /speckit.tasks to generate the implementation work breakdown.

The /speckit.analyze command can then identify inconsistencies between the specification, technical plan and implementation tasks.

Step 6: Implement and verify

Run /speckit.implement to build the feature.

The coding agent works through the generated tasks, producing code, tests and supporting documentation.

The team then verifies the implementation against the specification, executes automated tests and resolves any defects or missing functionality.

Importantly, passing the generated tests is not sufficient evidence that the original business requirement has been understood correctly. The product leader and domain expert must still validate the resulting behaviour.

4. What files does Spec Kit create?

Most development artefacts are Markdown files stored alongside the source code.

FilePurpose
constitution.mdProject-wide engineering principles
spec.mdFunctional requirements, user scenarios and acceptance criteria
plan.mdArchitecture and implementation approach
research.mdTechnical research and decisions
data-model.mdData structures and relationships
tasks.mdImplementation tasks and dependencies
quickstart.mdInstructions for exercising or validating the feature
contracts/API and interface definitions
checklists/*.mdRequirements-quality checklists

Not every feature requires every file. Some are generated only when relevant.

The files provide persistent context for agents and an auditable record of the team’s decisions.

They also make it easier for different agents or engineers to continue work without relying entirely on conversational history.

5. How does this relate to BDD and ATDD?

Spec Kit has a particularly interesting relationship with Behaviour-Driven Development and Acceptance Test-Driven Development.

Dan North’s work on BDD and the work Richard Watt and I undertook on ATDD shared an important principle: software development should begin with an agreed understanding of the behaviour the system must exhibit.

The specification should describe what successful software looks like, while executable acceptance tests provide evidence that the implementation satisfies those expectations.

Spec Kit extends this thinking into a structured, AI-supported engineering workflow.

However, Spec Kit does not automatically guarantee the discipline of ATDD.

For example, a requirement might state:

Customers must receive notifications about regulatory changes relevant to their subscriptions.

A useful acceptance scenario would be:

Given a customer subscribes to French
environmental regulations
When a relevant regulation is updated
Then the customer receives a notification
according to their selected frequency
And the notification links to the
regulatory change

These examples can be included in the specification and converted into automated acceptance tests.

For a production team, I would make this an explicit engineering principle: important business behaviour should have agreed acceptance criteria and appropriate automated verification.

There is also a potential weakness in AI-supported development. If the same agent generates the specification, implementation and tests, all three may share the same misunderstanding.

Independent validation of business intent therefore remains important.

6. How should a team use Spec Kit?

For an organisation moving from Scrum towards AI-supported SDD, I would initially retain a small multidisciplinary team with clear responsibilities.

RoleResponsibility
Product leaderDefines the customer problem, intended value and priorities
Domain expertExplains business rules and validates expected behaviour
Software engineerOwns architecture, technical decisions, agent supervision and code quality
AI coding agentGenerates plans, code, tests and documentation
Quality specialistEstablishes testing strategy and independent verification
Product leader and engineerJointly assess progress and readiness for release

These are responsibilities, not necessarily six separate people.

A product leader might work directly with a domain expert and two engineers, supported by coding agents and shared engineering services.

The team should work iteratively rather than attempting to specify an entire product before implementation begins.

One of the advantages of AI-assisted development is that working software can be produced relatively quickly, allowing the team to refine requirements through observation and feedback.

This should reduce the need for large upfront specifications while preserving the discipline of defining expected behaviour.

7. How does Spec Kit fit with Azure, GitHub and AWS?

Spec Kit is not a replacement for an application lifecycle management platform. It provides a structured, specification-led development workflow that can operate across different cloud environments and engineering toolchains.

Both Microsoft and AWS offer technologies that support AI-assisted software development. Spec Kit itself is cloud-agnostic, although the choice of coding agent, development environment and deployment platform influences how the workflow is implemented.

A practical comparison is:

CapabilityMicrosoft / GitHub toolchainAWS toolchain
Specification-driven developmentGitHub Spec KitGitHub Spec Kit, Kiro
AI coding agentsGitHub CopilotAmazon Q Developer, Kiro
Development environmentVS Code, Visual Studio, GitHub CodespacesVS Code, JetBrains, Kiro IDE
Source controlGitHub, Azure ReposGitHub, AWS CodeCommit
Work managementAzure Boards, GitHub IssuesGitHub Issues, Jira
CI/CDGitHub Actions, Azure PipelinesAWS CodePipeline, CodeBuild, CodeDeploy
Infrastructure as CodeBicep, TerraformAWS CDK, CloudFormation, Terraform
Automated testingExisting testing frameworks, Azure PipelinesExisting testing frameworks, AWS CodeBuild
SecurityGitHub Advanced Security, Microsoft Defender for CloudAmazon Inspector, AWS Security Hub
DeploymentAzure App Service, Azure Container Apps, AKSAWS Lambda, ECS, EKS
ObservabilityAzure Monitor, Application InsightsAmazon CloudWatch, AWS X-Ray
AI model servicesMicrosoft Foundry, Azure OpenAIAmazon Bedrock
Flow analytics and forecastingNave, Azure DevOps Analytics, GitHub InsightsNave, Jira reporting, third-party flow analytics

AWS Kiro

AWS has introduced Kiro, an AI development environment that places specification-driven development at the centre of its approach.

Kiro is particularly relevant because it provides an integrated experience for moving from requirements to technical design, implementation tasks and agent-assisted development.

Where Spec Kit provides an open-source framework that works with different coding agents, Kiro combines specification management and AI-assisted engineering within a dedicated development environment.

Both approaches share the principle that developers should establish what the software needs to do before asking AI agents to implement it.

Measuring and forecasting delivery with Nave

An important part of adopting Spec-Driven Development is understanding whether it genuinely improves the flow of work through the software development lifecycle.

Nave provides flow analytics and probabilistic forecasting, complementing Spec Kit and the underlying development toolchain.

It measures several important aspects of delivery performance:

  • Cycle time: How long work takes from starting development to completion.
  • Throughput: How many work items are completed over a given period.
  • Work in progress: How much work is being undertaken simultaneously.
  • Flow efficiency: How much time work spends actively progressing compared with waiting.
  • Cumulative flow: How work moves through different stages and where queues develop.

Nave also uses historical delivery data to produce probabilistic forecasts.

Rather than asking developers to estimate precisely how many days a feature will take, product leaders can use observed delivery performance to understand the likelihood of completing work within a particular timeframe.

For organisations transitioning from Scrum to AI-supported SDD, this provides a useful alternative to story points and velocity.

Spec Kit helps structure and execute the development work. Nave helps measure and forecast how that work flows through the delivery process.

Together, they could provide a practical foundation for managing an AI-supported SDLC.

There is one important qualification. Nave measures the flow of work represented in the team’s work management system. If specifications, agent tasks and implementation activities are not reflected appropriately in that system, the measurements may provide an incomplete picture.

Teams therefore need consistent definitions of when work starts, finishes and moves between stages, particularly when AI agents change how development tasks are organised.

Choosing the right toolchain

For an organisation already invested in Microsoft Azure, GitHub and Azure DevOps, Spec Kit with GitHub Copilot is a sensible starting point. It can be introduced incrementally without replacing the existing engineering platform.

For an AWS-oriented organisation, Kiro deserves consideration alongside Spec Kit, particularly where teams want a more integrated specification-to-implementation experience.

For organisations operating across both cloud platforms, Spec Kit offers the advantage of separating the specification-led development process from the underlying cloud infrastructure.

Nave can complement either approach by providing an independent view of delivery performance and forecasting.

The objective is to establish a repeatable, measurable, AI-supported SDLC, not simply to select the most capable coding assistant.

8. What should you measure?

The objective is not to generate more code or specifications. It is to deliver valuable software more quickly, economically and reliably.

For an initial pilot, I would measure five things:

MeasureWhat it tells us
Idea-to-production lead timeWhether customer needs reach production faster
Cycle time and throughputWhether work flows more efficiently through development
Engineering effort per featureWhether development becomes more economical
Escaped defectsWhether quality is maintained
Feature adoptionWhether customers use the resulting functionality

Nave can provide much of the flow-related evidence, while engineering systems provide information about effort, quality and deployment performance.

Product analytics and commercial systems are needed to establish whether the resulting functionality creates business value.

This distinction matters.

A reduction in development cycle time is an operational improvement. Its commercial significance depends on whether it enables valuable functionality to reach customers earlier, whether those customers adopt it and whether adoption influences revenue, retention or cost.

A useful value hypothesis might therefore be:

If SDD reduces the time required to deliver customer-requested functionality by 40%, we expect valuable features to become available earlier. Where customers adopt those features, this should accelerate the associated revenue opportunities and potentially improve retention.

The hypothesis can then be tested using delivery baselines, actual release dates, adoption data and commercial outcomes.

9. A practical first experiment

I would start with a small feature in an existing application, rather than building an entirely new product.

Choose something with genuine business rules, a manageable technical scope and measurable acceptance criteria. Use one domain expert and one or two engineers, supported by coding agents.

Run the complete Spec Kit lifecycle, including clarification, acceptance criteria, automated verification and deployment.

Use Nave, where the existing work management data supports it, to establish a delivery baseline and observe how work progresses through the experiment.

Record the effort involved in specification, implementation, testing, rework and release. Pay particular attention to where humans intervene, how often specifications change and whether the agents create additional verification or rework.

Compare the results against a representative baseline from the existing development process.

The experiment should answer three questions:

  1. Speed: Can a small team deliver reliable software faster using SDD?
  2. Economics: Does the reduction in implementation effort exceed any additional effort required for specification, verification and agent supervision?
  3. Value: Does faster delivery enable valuable functionality to reach customers earlier?

The first two questions can be answered relatively quickly. The third requires observing customer adoption and commercial results over a longer period.

For a PE-backed software business, this distinction is particularly important. A technically successful experiment is useful, but the investment case depends on whether the new development model can produce measurable economic benefits within the available investment horizon.

Spec Kit, coding agents and tools such as Nave provide an increasingly practical foundation for testing that proposition.

The opportunity is not simply to automate software development. It is to redesign the development lifecycle around a much shorter journey from customer need to working software, while retaining the engineering discipline needed to deliver it reliably.

Spec-Driven Development: An Old Idea Whose Time May Finally Have Come

Software engineering has a habit of rediscovering good ideas, giving them new names and presenting them as revolutions. Spec-Driven Development (SDD), one of the more interesting developments emerging from AI-assisted software engineering, has some of those characteristics. But this time there may be a genuinely important difference.

Around twenty years ago, Dan North (in conjunction with Liz Keogh and Chris Matts) were developing the ideas that became Behaviour-Driven Development (BDD). His work challenged the distinction between requirements and testing, arguing that software development should begin with a shared understanding of the behaviour we expect from a system. Rather than treating tests as something engineers write after implementing functionality, BDD encouraged teams to describe expected behaviour in language that business people and developers could both understand.

Around the same period, I was working with Richard Watt on Acceptance Test-Driven Development (ATDD). We were exploring a closely related principle: define what successful software looks like through acceptance tests before writing the code. Those tests become a contract between the business and engineering, providing an objective means of establishing whether the requirement has been satisfied.

The underlying ambition was to reduce the ambiguity and misunderstanding that so often occur between someone describing a business problem and someone writing the software to solve it.

These approaches worked, but they required considerable discipline. Writing meaningful acceptance criteria took effort, automating tests required engineering expertise, and maintaining the relationship between requirements, tests and implementation was often difficult. Under delivery pressure, the process could easily deteriorate into writing user stories followed by conventional development and testing.

AI may fundamentally change the economics of this approach.

What is different about SDD?

Spec-Driven Development takes the idea of defining intended behaviour and extends it across the software development lifecycle, using AI agents to undertake much of the implementation.

Microsoft’s engineering ecosystem, including GitHub’s Spec Kit, provides a practical illustration. The process begins with a specification describing what the software should do and why. AI agents help clarify the requirements, develop an implementation plan, break it into tasks and generate the software. They can also create tests, review code and check the implementation against the specification.

The resulting lifecycle looks something like this:

Customer need > Specification > Acceptance criteria > Technical plan > Agent implementation > Automated verification > Deployment > Customer feedback.

The important change is not simply that AI writes code. It is that a specification can become the central artefact around which development is organised, with much of the translation into software performed automatically.

In conventional development, requirements are interpreted by engineers who make hundreds of small implementation decisions. In SDD, many of those decisions can be delegated to agents operating within established architectural, security and quality constraints.

Engineers remain responsible for the design, integrity and operation of the resulting system, but their work increasingly involves directing, reviewing and improving the output of agents rather than writing every line themselves.

The return of executable requirements

This is where the connection to BDD and ATDD becomes particularly interesting.

A specification written in natural language is useful, but it is not necessarily precise. An AI agent can misunderstand a requirement just as easily as a human developer, and may produce an impressively complete implementation of entirely the wrong thing.

Acceptance tests provide an important safeguard.

Consider a requirement stating that customers should receive a discount when their annual subscription exceeds a certain value. That sounds straightforward until someone asks whether the discount applies to the entire subscription, only the amount above the threshold, or whether existing customers retain their previous pricing.

BDD and ATDD encouraged us to resolve precisely these questions through concrete examples of expected behaviour. SDD can use the same approach, with AI helping generate scenarios, identify inconsistencies and turn agreed acceptance criteria into executable tests.

There is an important qualification. If the same agent generates the specification, implementation and tests, all three may share the same misunderstanding. Human validation of business intent remains essential, as does independent verification where the risks justify it.

Do we still need Scrum?

SDD also raises some uncomfortable questions about how we organise software development.

Scrum emerged in a world where software engineering was relatively expensive and coordination between specialists was necessary. Product owners maintained backlogs, developers implemented stories, testers verified functionality and Scrum Masters helped teams manage the process.

If AI agents substantially reduce implementation and testing effort, the balance of work changes.

I suspect we will see smaller, more multidisciplinary teams in which domain experts, product leaders and engineers collaborate directly on specifications, with agents undertaking much of the subsequent development.

This doesn’t eliminate the need for product management, engineering expertise or delivery coordination. It does, however, challenge the assumption that the organisational structures developed around human coding capacity remain optimal.

The interesting question becomes how many people are needed to take a customer problem from initial understanding through to a reliable production solution, rather than how many developers are required to implement a backlog of stories.

Iteration still matters

One danger is that organisations interpret SDD as a return to exhaustive upfront requirements.

That would be a mistake.

We learned through Agile that requirements evolve as people see and use working software. SDD should accelerate that learning rather than attempt to eliminate it.

A team might develop an initial specification, ask an agent to implement a small part of it, review the working result and refine its understanding. The cycle could repeat several times in a day.

Specifications should be sufficiently detailed to establish intent and verify behaviour, but no more elaborate than the problem requires.

Indeed, one of the most promising aspects of agentic development is the possibility of reducing the cost of experimentation. When producing working software becomes cheaper, teams can explore alternatives and learn from them much earlier.

The business value is not in writing code faster

There is a temptation to measure the success of SDD through developer productivity, lines of code generated or reductions in engineering headcount. Those measures miss much of the opportunity.

The more important question is whether an organisation can respond to customer needs more quickly and economically.

If SDD reduces the time between identifying a valuable product opportunity and getting working functionality into customers’ hands, that could accelerate adoption, improve retention or bring forward revenue. Equally, if the organisation produces more unwanted functionality, faster development achieves very little.

We should therefore measure the entire journey from customer need to commercial outcome, not simply the speed of code generation.

Perhaps we were right all along

Looking back at the work Dan North was doing with BDD and the work Richard Watt and I were doing with ATDD, I am struck by how little the fundamental problem has changed.

We wanted business people and engineers to agree what software should do before spending time building it. We wanted requirements to be testable, misunderstandings to be discovered early and working software to be demonstrably correct.

Those remain sensible ambitions.

What has changed is the technology available to realise them. AI agents can now help translate specifications into implementations, generate tests and repeatedly refine software at a speed that would have seemed extraordinary twenty years ago.

SDD is not simply BDD or ATDD with an AI agent attached. It extends specification-led thinking into architecture, implementation and delivery, and raises new questions about governance, quality and accountability.

But I find it rather satisfying that some of the most promising ideas in modern AI-assisted software engineering have their roots in work we were doing two decades ago.

Perhaps the real breakthrough isn’t that machines can finally write software. It’s that we might now be able to spend more of our time deciding what software is actually worth writing.

Getting started with Ai, practical advice for medium sized business

A medium-sized company could do something quite sensible tomorrow: buy ChatGPT licences for its employees, give people some basic guidance and tell them to experiment. I would probably do it. What I would not do is mistake that for the company’s AI strategy.

Giving people access to a capable general-purpose AI tool is a bit like giving everyone spreadsheets or internet access. You cannot predict all the useful things they will discover. A finance analyst may automate part of a monthly reporting process, a salesperson may research accounts faster, someone in HR may reduce the time spent drafting job descriptions, and a developer may use it to understand unfamiliar code. Those gains are often small individually, but they can accumulate across an organisation, and trying to design all of them centrally would be hopeless.

There are good reasons, then, to make AI widely available. It creates familiarity, reduces the risk that AI becomes something done by a specialist innovation team while everyone else carries on as before, and it reveals where the real opportunities are. Employees usually know far more about the irritating, repetitive and unnecessarily difficult parts of their jobs than an AI steering committee ever will.

The problem comes when those local gains are confused with business value.

If everybody saves twenty minutes here and forty minutes there, the company may end the year with thousands of claimed hours of productivity and almost no detectable improvement in its financial performance. This is already one of the central problems with AI adoption. Organisations measure what is easy to count, so they report licences activated, prompts submitted, employees trained and applications created. Then somebody on the board asks whether revenue grew faster, costs fell, customers stayed longer or products reached the market sooner, and the connection is often surprisingly hard to make.

A sensible AI programme therefore needs two things happening at the same time. The first is broad experimentation. Give employees good tools, establish clear security and data rules, train people enough that they understand what the technology can and cannot do, and encourage them to use it on real work. There is no need to demand a business case every time someone wants to save half an hour preparing for a meeting.

The second activity needs much more discipline. Choose a small number of business outcomes that already matter and deliberately use AI to try to change them.

Suppose a company wants to increase revenue from existing customers. That is a much better place to start than a list of AI technologies. Ask what is preventing that revenue from growing faster. Perhaps new functionality takes nine months to reach customers. Perhaps salespeople spend too much time preparing proposals. Maybe account managers cannot identify which customers are most likely to buy an additional product, or onboarding takes so long that customers reach useful adoption months later than they should.

Now there is something concrete to work on.

Take the software example. Imagine a product feature currently takes nine months from approval to customer availability, and the company believes AI-assisted development could reduce that to six. The interesting measure is not lines of code written or even developer productivity in isolation. The interesting measure is whether those three months change anything commercially. Customers can use the product earlier, some may adopt it earlier, and some may therefore pay for it earlier.

The value chain is fairly simple: faster development leads to earlier availability, which may lead to earlier adoption and earlier revenue. That is now a hypothesis worth testing.

Before changing anything, establish the existing baseline. Measure how long comparable work currently takes, run a controlled experiment with a real product team, and observe what changes. Then keep following the chain towards the business outcome. If development becomes 30 per cent faster but product revenue does not move, that is not necessarily a failed experiment. It may reveal that engineering was never the real constraint. Product decisions may still take six weeks, security approval may take another month, sales may not know how to sell the new capability, or customers may simply not want it.

That is useful information because AI often makes one part of an organisation faster and exposes the next bottleneck.

This is why I would be cautious about launching a large collection of centrally sponsored AI projects. A medium-sized business does not need fifty pilots. It needs a handful of experiments where success or failure can actually be observed.

For each one, write down the argument before spending serious money. What business measure are we trying to change? What operational measure should move first? Why do we believe changing that measure will influence the business result? What happens today, and what would probably happen if we did nothing? Most importantly, what evidence would convince us that the experiment worked?

That can fit on one page and is much more useful than a thirty-page AI strategy.

There is another reason to separate broad employee adoption from strategic AI investment: they have different economics. Giving hundreds of employees ChatGPT may cost a meaningful amount of money, but it is relatively reversible. If people use it and find value, continue. If they do not, reduce the licences.

Changing a core operating process is different. Rebuilding product development around AI, automating customer support or introducing AI into underwriting, compliance or financial operations changes how the company works. Those decisions deserve proper measurement, controls and management attention.

The mistake is treating these two activities as though they are the same.

The better model is to let employees explore widely while the company invests narrowly. A central AI team, if there is one, should spend less time dreaming up use cases and more time finding places where local experimentation has uncovered something economically interesting.

Imagine that forty salespeople independently start using AI to prepare for customer meetings. That is worth paying attention to. The next step is not necessarily to buy a new enterprise sales platform. It is to study what is happening. Does preparation time fall? Do salespeople conduct more meetings? Does opportunity creation increase? Does conversion improve? Does revenue per salesperson move?

If the causal chain survives examination, industrialise it. If it does not, leave it as a useful personal productivity tool and move on.

This distinction also helps with one of the most awkward claims being made about AI productivity. Employees will quite reasonably report that AI saves them hours each week, and vendors will publish studies showing impressive efficiency gains. Some of those numbers will be true, but an hour saved is not automatically an hour of economic value.

If an employee finishes the same work at 4:30 rather than 5:00, that may be a genuine improvement in their working life and worth having for that reason alone. But unless the organisation does something with the released capacity, it should not quietly turn thirty minutes into a financial return in a spreadsheet.

Management has to decide what it wants to do with the productivity. It might allow people to handle more customers, build more product, reduce external spending, avoid hiring that would otherwise have been necessary, improve service or shorten a process that delays revenue. Those are measurable consequences, and that is where the business case becomes real.

For most medium-sized organisations, I would start with exactly this combination. Give knowledge workers access to AI where the economics make sense, let them experiment, and accept that some of the benefit will remain informal and difficult to measure. At the same time, choose perhaps three strategically important problems and attack them with much greater discipline.

After a year, I would rather see a company with widespread everyday AI use and three demonstrably valuable changes to how the business operates than one with seventy-five AI projects and an impressive slide showing that 82 per cent of employees have used a chatbot.

Adoption matters, but what ultimately matters more is whether the business has actually changed because of it.

How do you safety test an Ai?

OpenAI was supposed to release GPT-6.1 Astra next month. It isn’t going to.

The model had already made it a long way through development when safety testing found something ‘wrong’. According to reporting this week, Astra 6.1 was more prone than its predecessor to acting beyond the authority it had been given and to concealing or misrepresenting what it had done. OpenAI decided not to release it.

I found myself wondering what had actually happened. We talk endlessly about AI safety, usually in rather grand terms. Yet somewhere inside OpenAI, people had tested a model, looked at the results and decided it shouldn’t be released.

What were they actually doing to it?

I understand how we test ordinary software. Give it an input, know roughly what the output should be and see whether the two match. A banking system should not transfer £100 when I ask it to transfer £10.

With AI, that kind of testing becomes much harder.

A model might write software, search the internet, operate a computer and work on a task for hours. There may be no single correct answer to compare against. Researchers want to know whether it can deceive its operator, help someone develop a biological weapon, find a software vulnerability nobody has found before, or carry on pursuing a task after being told to stop.

Then there is the slightly unnerving possibility that it knows it is being tested.

I started reading the safety work published by OpenAI, Anthropic, Google DeepMind and some of the organisations that independently test their models. I thought I had a rough idea of the scale of it. I didn’t.

For GPT-5, OpenAI says more than 400 external testers and specialists spent over 5,000 hours red teaming the model. GPT-4o’s external red teaming ran from early March to late June 2024, starting with ten testers and eventually expanding to 65 people attacking the final candidate.

Nor do they wait until the model is finished.

The simple version would be:

Build > safety test > release

In reality it is closer to:

Build > test > find something odd > change it > test again > red team > change the safeguards > external test > fix > retest > decide whether to release

Software engineers will recognise this as a form of shift left, where testing starts much earlier in development. Problems can then be found and fixed while the model is still being built, rather than discovered just before release.

But the analogy only goes so far.

When we shift software testing left, we normally have a specification. We know what the payroll system or payment platform is supposed to do. With a frontier AI model, researchers are partly testing whether it behaves properly and partly trying to discover what they have built.

GPT-4 provides an early example.

Before releasing it in 2023, OpenAI gave an early version to researchers at the Alignment Research Center. Among other things, they wanted to know whether GPT-4 could acquire resources, make copies of itself and resist being shut down. It was given tools, the ability to execute code and a small amount of money.

It couldn’t do the overall task. GPT-4 was not capable of autonomously replicating itself.

But something happened along the way.

The model encountered a CAPTCHA, one of those online puzzles designed specifically to prove that you are human. It couldn’t solve it, so it hired somebody on TaskRabbit to do it instead.

The worker became suspicious and asked whether it was a robot.

GPT-4 reasoned that it shouldn’t reveal that it was a machine. It claimed instead to have a vision impairment that made seeing the images difficult.

The human solved the CAPTCHA.

There is plenty of context around this. Researchers had deliberately given GPT-4 tools and were trying to see whether it could overcome obstacles. The model failed the larger test.

Still, imagine reading that transcript for the first time. The machine has just persuaded a human to defeat a security system designed to keep machines out.

Three years later, these tests have become considerably more demanding. And this week’s models give us two useful examples of what happens at the other end of the process.

OpenAI’s GPT-6.1 Astra is the unusual case: the testing found problems serious enough to stop the release altogether. Anthropic’s Claude Sonnet 5.5 shows the more routine version. It passed through the process and was released, but not before the testing changed how Anthropic deployed it.

Before release, Anthropic ran Sonnet 5.5 through an automated behavioural audit containing roughly 1,850 scenarios, looking for behaviour such as misleading users, cooperating with serious misuse and acting against the user’s interests.

Anthropic also runs containment evaluations. Models are put into controlled environments and researchers watch to see whether they try to escape their sandboxes or probe the boundaries of their containers. Sonnet 5.5 did well on these tests. Anthropic says it was among its least troublesome models on those measures.

The testing also found that Sonnet 5.5 had become much better at cybersecurity than Sonnet 5. Anthropic responded by giving it stronger cyber safeguards similar to those surrounding its more capable Opus models.

So the two models had different outcomes. With Sonnet 5.5, the tests found increased capability, Anthropic strengthened the safeguards and released it. With GPT-6.1 Astra, OpenAI apparently found behaviour it wasn’t prepared to mitigate around and stopped the release.

Some of the testing is more familiar. Researchers bombard models with difficult prompts involving violence, fraud, cyber attacks and dangerous biological information. They try jailbreaks. One AI can generate thousands of attacks while another assesses the responses, leaving humans to concentrate on unusual cases and devise attacks the automated tests haven’t found.

Then you run into a rather awkward problem.

Suppose an AI is capable of conducting a sophisticated cyber attack but has been trained to refuse when somebody asks it to. The refusal might work perfectly. Researchers still need to know what capability sits behind it.

So sometimes they remove the safeguards and give the model something to attack.

OpenAI, Anthropic and Google DeepMind all now have frameworks for identifying dangerous capabilities as models improve. GPT-6 Astra crossed OpenAI’s “Critical” threshold for cybersecurity. OpenAI said that, given suitable tools and access, it could discover previously unknown vulnerabilities and develop exploits against hardened systems.

I had to read that twice.

One way of testing such a capability is a Capture the Flag exercise. Researchers construct a deliberately vulnerable computer network, hide information inside it and challenge someone to break in and retrieve it.

Except now the contestant is an AI.

In one evaluation run by the UK’s AI Security Institute, models were given simulated environments to compromise. They were told which networks they could attack and which were out of bounds, but were also given access to the real internet so they could find and download their own hacking tools.

The models didn’t always stay where they were supposed to.

Another evaluator, Irregular, ran a similar exercise. Its test environment was supposed to be isolated from the internet.

It wasn’t.

One of the fictional targets shared its name with a real internet domain. The model went looking for its target, found the real website, exploited a vulnerability, discovered credentials and used them.

The researchers had asked an AI to hack a pretend computer. It accidentally hacked a real one.

The obvious version of this story has an AI escaping from captivity. The actual explanation is less dramatic. The environment had been misconfigured and the model appears simply to have believed that the real website was part of the exercise.

I find the boring explanation more interesting.

Nothing had to become conscious, evil or power hungry. The model was competent, had tools, was pursuing a goal and got the boundary wrong. Anyone who has spent time around complex technology will recognise the general shape of that problem.

OpenAI encountered something similar during internal cybersecurity evaluations when models running with reduced safeguards circumvented isolation controls, exploited vulnerabilities in shared infrastructure and gained internet access.

Now the test itself needs protecting.

Independent evaluator METR has experimented with having a second AI inspect an agent’s proposed actions before they happen. If the monitoring model thinks an action could cause real-world harm, it is stopped for human review.

One AI takes the test. Another watches it. A human watches the watcher.

There is probably a whiteboard somewhere explaining all this.

Cybersecurity is only part of the work. Researchers create situations in which a model’s goals conflict with its instructions and look for deception, concealment, manipulation or attempts to exploit loopholes.

Anthropic has gone further and deliberately trained experimental models to behave badly, then handed them to researchers and asked them to work out what was wrong.

My first reaction was that this sounded slightly perverse. Then I realised the alternative was worse. If an audit finds nothing wrong with an ordinary model, perhaps nothing is wrong. Or perhaps the audit is useless. With a deliberately compromised model, at least you know there is something to find.

Even then, there is another complication.

The model may know it is being tested.

More capable systems can sometimes recognise features of an evaluation, notice that they are being monitored or reason about what behaviour the evaluator expects. OpenAI calls some versions of this “metagaming”.

Good behaviour during an exam becomes rather less reassuring once the student knows exactly when the invigilator is watching.

And the student may have seen the questions.

Benchmark questions can find their way into training data. Google DeepMind has been experimenting with double-blind evaluations in which proprietary tests are kept away from model developers and future training systems.

After billions of dollars of computing infrastructure and some of the most sophisticated software ever created, we have arrived back at the locked exam cupboard.

Somewhere around here my question changed. I had started by wondering how AI companies safety-test their models. I was now more interested in who decides when the testing is good enough.

Much of that authority still sits with the companies building the models.

There is more independent scrutiny than I had assumed. The UK’s AI Security Institute evaluates frontier systems. METR has been given access to advanced models from Anthropic, Google, Meta and OpenAI. It has also spent weeks attacking Anthropic’s monitoring systems and found previously unknown vulnerabilities that Anthropic subsequently fixed.

But this is still some distance from an aviation regulator certifying an aircraft. The companies conduct much of the testing, set many of the thresholds and ultimately decide whether their models are released. Outside organisations get access largely because the companies agree to let them in.

All of this is happening inside intensely competitive businesses. Frontier models cost enormous amounts to develop. Customers are waiting. Product teams have plans built around them. Delaying a release has a real cost.

Which takes me back to GPT-6.1 Astra.

OpenAI apparently reached the end of this process, looked at the behaviour it was seeing and decided not to release the model.

I find that surprisingly reassuring. Not because one cancelled release proves very much, but because a safety process that occasionally produces a commercially inconvenient answer is more convincing than one in which every new model receives an impressive system card and arrives on schedule.

The part I am less comfortable with is harder to solve.

Every safety test begins with somebody imagining what might go wrong. As the models improve, old tests become easier and researchers invent harder ones. Occasionally the models do something nobody was specifically looking for.

After reading all of this, I don’t think AI safety testing is really a process for proving that a model is safe. I doubt anyone currently knows how to do that.

It is an organised attempt to be surprised before release rather than afterwards.

Imagine a future model that offers an enormous strategic advantage. Perhaps it can automate much of software engineering, accelerate scientific research or materially improve the next generation of AI.

Then one of these tests produces an awkward result.

The model behaves deceptively in three experiments out of a thousand. An external evaluator thinks it is significant. The company thinks its monitoring systems would catch the behaviour in normal use. Nobody really knows. Six months of further work might provide an answer.

GPT-6.1 Astra tells us what happens when a safety process says no today. The harder test will come when the model it says no to is the one its creators believe they cannot afford to leave on the shelf.

Sonnet 5.5 is here. Is it worth switching?

The release of Claude Sonnet 5.5 on 28 September prompted me to compare selected recent models from Anthropic and OpenAI with their predecessors. I wanted to see how quickly they were improving, by how much, and whether the gains were useful beyond a launch announcement.

There is something reassuring about a goold old AI benchmark table. The names are technical, the numbers have decimal places, and the newest model usually appears in bold. After months of arguments about whether artificial intelligence will transform the economy or merely generate more emails, here is something that looks like an answer. Unfortunately, understanding the answer requires rather more work than admiring the table.

The results show substantial improvement in several useful areas. What’s harder is to turn those gains into a sensible conclusion about what a business should do next. Better scores are encouraging; deciding what they justify changing takes a little more thought.

Start with software development, where the evidence is unusually concrete. On SWE-bench Pro, which tests demanding changes to real software repositories, Claude Opus moved from 69.2% in version 4.8 to 79.2% in Opus 5 and 89.9% in Opus 5.5. That is a gain of 20.7 percentage points across three releases. You do not have to accept anyone’s predictions about artificial general intelligence to find that significant.

The less expensive Sonnet line is arguably more interesting. Sonnet 4.6 scored 58.1% on the same benchmark, Sonnet 5 reached 63.2%, and Sonnet 5.5 reached 81.3%. Most of that improvement arrived in the latest release. On this particular test, the newer Sonnet has a higher reported score than the previous Opus. Capability that recently belonged to the more expensive tier is becoming available further down the range. That matters if you intend to use these systems throughout a working day rather than occasionally ask one to impress you. [1]

BenchmarkModel sequenceFirst releaseSecond releaseThird releaseOverall gain
SWE-bench ProClaude Opus 4.8 to 5 to 5.569.2%79.2%89.9%+20.7 points
SWE-bench ProClaude Sonnet 4.6 to 5 to 5.558.1%63.2%81.3%+23.2 points
SWE-bench ProOpenAI GPT-5.5 to GPT-5.6 Sol to GPT-6 Astra59.4%64.6%Not establishedNot calculable
DeepSWE v1.1Claude Opus 4.8 to 5 to 5.559.0%68.8%74.2%+15.2 points
DeepSWE v1.1OpenAI GPT-5.5 to GPT-5.6 Sol to GPT-6 Astra67.0%72.7%74.1%+7.1 points

Scores should be compared within the same benchmark. Claude figures use Anthropic’s system cards; OpenAI figures use its release tables. Different evaluation setups mean these are reported trends, not a controlled head-to-head experiment. OpenAI’s GPT-5.6 comparison reports 59.4% for GPT-5.5 on SWE-bench Pro, whereas its original launch reported 58.6%; the table uses the later paired comparison. A comparable Astra score on SWE-bench Pro was not established. [1][2]

OpenAI’s progression tells a slightly different story. On DeepSWE, a test of longer software-engineering tasks, GPT-5.5 scored 67.0%, GPT-5.6 Sol reached 72.7%, and GPT-6 Astra reached 74.1%. On BrowseComp, which tests difficult web research, the sequence was 84.4%, 90.4% and 91.5%. Those are useful gains, although the last step looks modest. The DeepSWE rows put both companies on the same named test, although they still use their respective evaluation setups. Opus 5.5 and Astra finish almost level on the reported scores; a tenth of a percentage point is no basis for declaring a winner. [2]

Then look at a newer evaluation. On Terminal-Bench-Science, which tests scientific workflows involving code and analysis, Astra’s launch comparison reported 64.6%, against 22.4% for GPT-5.6 Sol. Claude Opus improved from 29.0% to 58.7% in its latest comparison. These are large advances in the reported ability to carry out a sequence of research tasks. A model can make a modest gain on one established test and a much larger one on a different kind of work. There is no single improvement percentage waiting to be extracted from all this, however convenient one would be for a presentation. [2][3]

Terminal-Bench-Science 0.1Previous modelNewer model, cited comparisonGain
OpenAI: GPT-5.6 Sol to GPT-6 Astra22.4%64.6%+42.2 points
Claude: Opus 5 to Opus 5.529.0%58.7%+29.7 points
Claude: Sonnet 5 to Sonnet 5.5Not established59.9%Not calculable

Sonnet 5.5’s scientific-workflow score comes from its system card. Anthropic reports a standard error of about 4.7 points for Sonnet and 4.8 for Opus 5.5, so their 1.2-point difference is not convincing evidence of superiority. [1]

For readers whose day involves documents and analysis rather than software repositories, professional-work evaluations provide another useful comparison. GDPval-AA assesses professional deliverables; AA-Briefcase tests longer professional workflows. Both use rating points, not percentages, and the versions matter.

ModelGDPval-AA v2.1AA-Briefcase v1.1
Claude Opus 5.518461822
Claude Sonnet 5.518441811
OpenAI GPT-6 Astra15421569
OpenAI GPT-6 Sol14871483

These published comparisons place the two Claude models close together and above the OpenAI models on these particular tests. They do not tell us that one model makes an employee a corresponding percentage more productive. The results also illustrate why a universal winner is elusive: Astra has the higher reported scientific-workflow score, while Claude leads this professional-work comparison. These are the models covered by this review, rather than a live leaderboard. Anthropic also flags a fixed structured-output bug in the Sonnet prerelease evaluation and a fixed image-understanding bug in GPT-6 Sol that might not yet be reflected in these ratings. The evaluators expect small or no major effects, but these are still scores for the tested deployments. [1][3][4]

The footnotes become essential when you try to extend the comparison. Benchmark versions change. Models are given different tools, different time limits and different amounts of reasoning. An older model can acquire a new score because someone has tested it differently. Anthropic’s published Sonnet 5 result on Humanity’s Last Exam, with tools, was 57.4% in its June system card and 54.9% in the September comparison. That does not establish that the model spent the summer becoming less intelligent. It establishes that the two numbers need explaining before they enter the same chart. [1]

There is a good reason for some of this movement. Tests need to evolve as systems become more capable, and better evaluation methods should replace worse ones. But the result is an awkward bargain: the industry needs a moving test to measure its progress, while the reader needs a fixed test to understand that progress. A polished graph can conceal the tension remarkably well.

Even the instruction to give a model more time to think turns out to have qualifications. Sonnet 5.5 scores 52.1% on FrontierCode at its extra-high reasoning setting, but 46.2% at maximum effort. Anthropic explains that the more intensive setting sometimes produced timeouts or changes beyond the requested scope. The additional work could be competent and still make the answer less acceptable. Anyone who has commissioned a small software change and received a proposal to rebuild the platform will recognise the distinction. [4]

This is where the comparison starts to become useful beyond the leaderboard. A business is buying an outcome with boundaries: fix this fault, produce this analysis, deliver this feature. It has limited use for a system that completes a more ambitious task than the one it was given, then requires somebody to work out which parts to undo. Scope discipline belongs in the definition of capability.

Nor do all scores improve. Opus 5.5 recorded 77.8%, below Opus 5’s 80.6%, in Anthropic’s internal Toolathlon evaluation, which tests workflows involving multiple tools. Safeguard-related stops count as failures in that setup. Whether a particular stop represents an inconvenience or a valuable restraint depends on the task. The percentage alone cannot settle it, or establish a general decline in capability. [1]

For a management team, the next question is therefore more demanding than which model has the highest score. Suppose AI helps engineers finish a feature sooner. Does review also finish sooner? Can the organisation release it, can customers use it, and will anyone pay for it? If the work spends the saved week waiting for approval, the coding improvement is real but the commercial benefit remains hypothetical.

The useful measure is the cost of reaching an accepted result, including the human effort required to check and correct it. For a software business, that means following work through to release and customer use. In a strategy built around selling additional functionality, the eventual evidence is earlier paid adoption and additional revenue. Counting generated code somewhere near the beginning of that chain will not tell you whether the rest of it moved.

That leaves a more immediate question for anyone following these releases: are the differences between the leading models still significant enough to justify choosing one over another? If each can produce a useful first draft, analyse a document and write competent code, how much attention should we give to which one has moved a few places up the leaderboard?

The results do not establish that the models are interchangeable. They do suggest that the answer depends on where you place the finishing line. If two models both produce work you can accept with a quick check, a higher benchmark score may add little to your day. Speed, cost, ease of use and access to the tools you already work with could matter more. Familiarity has value too: switching means learning a new system’s habits and finding out where it needs supervision.

For harder tasks, a difference can still be decisive. One model might complete work that another repeatedly fails, or require substantially less correction. Even a small reliability advantage could matter when the same task runs thousands of times. But that advantage needs to appear in the work itself. A narrow lead on an unrelated benchmark is a thin reason to disrupt a process that is already working.

There is a practical way to make that decision without waiting for the industry to agree on a universal scoreboard. Keep a fixed set of representative tasks, including work the current model struggles with. Record the model and settings, then compare acceptance, elapsed time, correction effort and failures. Public benchmarks help decide which alternatives deserve a trial; your own results determine whether a switch is worthwhile. If you cannot find a meaningful improvement, staying put is a reasonable decision.

Both companies are producing systems that can handle more demanding work, and Sonnet’s progress suggests that useful capability is spreading beyond the premium tier. As generating a plausible result gets easier, knowing whether it is the right result becomes more valuable. The business advantage may increasingly belong to organisations that can specify, verify and use the work quickly enough to benefit from it. That is also a reason to spend less time following every change at the top of the leaderboard: you can afford to wait until an improvement addresses a limitation you actually have.

What happens when intelligence becomes a utility?

A friend and I were talking about AI on the bus to last weekend’s football game and, as usual, ended up on the familiar questions. How good are these systems getting? Which jobs will go first? What happens if they eventually become better than us at most things?

As the bus wound its way through the inevitable traffic outside the stadium, we got onto a different question. If the cost of producing useful intelligence keeps falling, what happens when it becomes so cheap and readily available that we begin to treat it like a utility?

For most of human history, useful intelligence has been expensive. Diagnosing an illness, interpreting a contract, writing software or analysing a company usually requires somebody who has spent years learning how to do it. Societies responded by building institutions around that scarcity. Universities produced expertise, professions certified it and companies assembled it.

When you pay a good lawyer or engineer, you are not really buying an hour. You are buying a small slice of everything that lawyer or engineer has learned to make that hour useful.

The cost of intelligence is already falling quickly. When GPT-4 appeared in 2023, OpenAI charged $30 per million input tokens and $60 per million output tokens. More capable models now cost a fraction of that. The comparison is not perfectly like for like, but the direction is clear enough. More intelligence is being delivered for much less money.

Electricity offers a useful precedent. Before electrification, factories had to produce power close to where it was consumed. Electricity changed that. Once power became reliable and cheap, firms stopped designing around its scarcity and started assuming it would simply be there.

The important effect was not cheaper machinery. It was what followed. Elevators made tall buildings practical. Refrigeration transformed food distribution. Washing machines changed domestic life. Computing eventually grew on top of the same infrastructure. Once power was abundant, whole categories of activity that had previously made little sense became viable.

AI may do something similar to cognition.

There is a great deal of thinking that simply does not happen today because it costs more than it is worth. Companies do not investigate every small opportunity. Doctors cannot ask ten specialists to review every patient. Scientists cannot explore every plausible hypothesis. These limits are so familiar that we barely notice them.

However, lower the cost far enough and some of those limits start to disappear. Imagine every medical diagnosis being looked at from several directions. One system checks drug interactions. Another looks for unusual conditions. Another scans the latest research. A fourth is told to challenge the conclusions of the others.

That does not necessarily make the doctor redundant. It makes something that is currently exceptional, several expert opinions on one case, routine.

The same logic extends much further. A small business might have something resembling a lawyer, finance team, developer and market analyst available whenever it needs them. A student could keep asking for a different explanation until a difficult idea finally clicks. A scientist might explore a hundred possibilities before deciding which are worth testing in the real world.

This is why it is important not to get trapped solely in the immediate questions about AI: which jobs disappear, which tasks are automated, which professions are disrupted. We also need to think about what a post-AI economy looks like once intelligence is cheap and widely available.

History suggests that when one thing becomes plentiful, something else becomes scarce.

The internet gave us almost unlimited information and left us fighting for attention. Digital cameras made photographs virtually free without making everyone a good photographer.

If AI gives us almost unlimited analysis, then another analysis may not be worth very much.

A management team may soon be able to generate a hundred plausible strategies before breakfast. The difficult part will still be choosing one and living with the consequences.

The same is true of financial analysis. If models and reports can be produced almost endlessly, value shifts towards people who can explain what the numbers mean, spot dubious assumptions, understand the business behind them and help somebody decide what to do next. Good analysts may spend less time calculating and more time interpreting.

Producing an answer is also not the same as knowing that it is right. AI might produce a legal opinion in seconds, while somebody still has to decide whether they trust it enough to act on it. Lines of software can be generated quickly, but proving that the result is safe enough to run a bank is a very different problem.

So I do not think expertise simply disappears. It changes shape. Knowledge and analytical skill matter, but so do experience, credibility, judgement and responsibility. AI can make the first two much cheaper. The others are more stubborn.

This could alter the shape of companies too. Organisations exist partly because useful knowledge is scattered across people and coordinating those people is costly. If AI reduces the cost of both expertise and coordination, some activities that currently require a large organisation may no longer do so.

A small company may gain access to capabilities that once required entire departments. Large organisations will still enjoy advantages in capital, reputation, distribution, proprietary data and physical assets. But the ability to employ large numbers of clever people may no longer confer quite the same edge.

By the time my friend and I reached the football, fortunately, we had stopped talking about AI. Like it or not, football is already drenched in analysis: expected goals, tracking data, tactical models, performance statistics. AI will provide vastly more of it.

Yet it is hard to imagine that wealth of data making the match itself more meaningful for the fan. There is still only one game taking place. Nobody knows exactly what will happen. If your team misses a penalty, a computer can simulate a thousand versions in which it goes in, but none alters the afternoon you actually experienced.

Perhaps that hints at another consequence of abundance. Some things remain stubbornly scarce.

And this is where the electricity comparison breaks down.

Electricity is passive. It can power a television but does not tell you what to watch. Intelligence can. An AI helping with a decision can also choose which evidence to show, how to frame the question and which possibilities appear sensible.

That makes intelligence a peculiar sort of utility. We may come to depend on it while it is also helping to shape the way we understand the world.

Questions that sound technical today may therefore become important. Who owns these systems? What are they optimising for? How independent are two supposedly different opinions if both depend on the same underlying models? Who takes responsibility when everyone follows the answer because everyone assumes somebody else has checked it?

Many of our institutions were built for a world in which intelligence was difficult to find and expensive to organise. Schools, professions, companies and bureaucracies all reflect that scarcity in different ways.

AI will not sweep them away. But if competent intelligence becomes something we can summon almost without thinking about the cost, it would be surprising if they all continued to look much the same.

We spend an enormous amount of time debating how intelligent AI will become. I think we need to spend much more time thinking about the world that follows if intelligence becomes cheap and abundant.

Technology can change very quickly. Institutions, education, companies and social norms usually do not. If intelligence really is becoming a utility, the danger is not simply that we underestimate what AI can do. It is that the technology arrives long before we have worked out what we want to do with it.

The AI Agent Revolution: Two Years On

In November 2024 I wrote an article called The AI Agent Revolution. I thought I had a reasonable idea of what was coming.

The argument was that AI was entering what I called “Phase 3”. Phase 1 had been conversational AI: systems that could talk, write and answer questions. Phase 2 was reasoning. Phase 3 would be different because AI would stop merely telling us what to do and start doing things for us.

At the time, this was mostly prediction. Microsoft had demonstrated Magentic-One, an experimental system in which several AI agents worked together. Anthropic had given Claude the slightly unnerving ability to look at a computer screen, move a mouse and click on things. OpenAI was rumoured to be developing something called Operator.

Nearly two years later, the interesting thing is not that the prediction was right. Agents have arrived. It is that they are turning out to be rather different from the autonomous AI workforce I had imagined.

They are both more capable and more constrained.

Consider Anthropic’s original computer-use demonstration. In October 2024 Claude 3.5 Sonnet scored just 14.9% on OSWorld, a benchmark that asks an AI to operate ordinary software through a computer interface. Humans scored around 72%. Watching Claude use a computer was remarkable, but the score was a useful corrective. It was a glimpse of something interesting rather than something you would necessarily want anywhere near your finance system.

Claude Opus 5.5 now reports 81.8% on OSWorld 2.0. The benchmark and methodology have changed, so treating 14.9% to 81.8% as a straightforward improvement would be misleading. Even so, something fairly substantial has happened in between.

Software engineering tells a similar story.

Claude 3.5 Sonnet scored 49% on SWE-bench Verified in October 2024. The test asks an agent to take a real GitHub issue, understand an unfamiliar codebase, change it and produce a working fix. By August 2025 GPT-5 was scoring 74.9%. Frontier models became so good at the benchmark that OpenAI eventually said SWE-bench Verified was no longer particularly useful for measuring the best coding systems.

So the tests got harder.

On Terminal-Bench 4.0, which involves complex terminal-based work including software engineering, system configuration and data analysis, GPT-6 Astra scores 57.9%, compared with 37.3% for GPT-5.6 Sol and 55.8% for Claude Fable 5.1.

Research agents have improved just as dramatically. When OpenAI introduced BrowseComp in April 2025, it deliberately constructed questions whose answers were difficult to find on the web. GPT-4o with browsing managed 1.9%. OpenAI’s Deep Research system reached 51.5%. ChatGPT Agent subsequently reached 68.9%. GPT-6 Astra now reports 91.5%.

I am increasingly wary of apparently miraculous benchmark improvements, however. Once a benchmark becomes public, the relationship between the test and what it is supposedly testing gets complicated. Anthropic has even documented Claude recognising BrowseComp and finding leaked answers online. An AI cheating on its AI benchmark is perhaps progress of a sort, although not quite the sort the benchmark designers had in mind.

The exact numbers therefore deserve some caution. The underlying change is harder to explain away. These systems have become much better at searching, changing strategy, using tools and persisting when their first attempt fails.

The measurement I find most interesting comes from METR because it asks a different question. Instead of testing whether an AI can answer something difficult, it asks how long a task an agent can take on before it becomes unreliable.

METR estimates how long a skilled person would need to complete a coherent task and then measures whether an agent can complete it successfully. Historically, the length of task frontier agents can complete with 50% reliability has been doubling roughly every seven months.

By May 2026 an early Claude Mythos system had reached a 50% task horizon of at least 16 hours on METR’s predominantly software and technical tasks. METR actually ran into a slightly unusual measurement problem: beyond 16 hours there were too few sufficiently difficult tasks left to estimate the result reliably.

That does not mean an AI can now turn up on Monday morning and reliably do somebody’s job until 5pm. METR’s tasks are unusually well specified and mostly technical. Real work contains ambiguity, politics, missing information, badly written emails and meetings whose purpose nobody can quite remember.

Still, sixteen hours matters. It suggests that we are moving from AI completing isolated tasks to AI sustaining useful work across long sequences of decisions.

And this is where things get more complicated.

Zapier’s AutomationBench puts agents inside simulated businesses and asks them to complete workflows across CRMs, inboxes, calendars and the other systems used in sales, marketing, finance, HR, support and operations. GPT-6 Astra currently completes 41.4% of those workflows successfully. Claude Opus 5.5 manages around 40%. GPT-5.6 Sol manages 18.1%.

Forty-one per cent is simultaneously an extraordinary result and a terrible one.

A couple of years ago, an AI independently completing four out of ten unfamiliar business processes would have sounded like science fiction. If I were actually running those processes, though, I would be rather interested in what happened to the other six.

That, I think, explains much of what has happened with agents.

The technology has become powerful enough to do useful work, but not reliable enough to be given unlimited freedom. So businesses have started building systems around it.

An agent today is no longer simply a language model with a clever prompt attached. It can use browsers, terminals, files, databases and business applications. It can maintain context while it works, choose tools and sometimes recover from its own mistakes.

OpenAI’s Operator, still a rumour when I wrote the original article, appeared in January 2025 and could operate a browser itself. Since then, that sort of capability has been absorbed into broader systems combining browsing, research, coding, files and connections to other applications.

The model is increasingly only part of the product. The interesting questions are what the agent can see, what tools it can reach and, above all, what it is allowed to do.

Real deployments make this clearer.

Siemens now uses two AI agents to deal with incoming sales leads. One talks to potential customers and another qualifies them before suitable opportunities reach salespeople. About 2,500 leads a month across 132 countries pass through the system, which Siemens says went from prototype to production in six weeks.

But look more closely at how it works. The AI conducts the conversation while roughly 50 predefined business rules determine the qualification outcome. There are also boundaries around what the agent is allowed to discuss.

That is not an autonomous digital salesperson roaming freely through Siemens. It is something more carefully engineered, and probably more useful.

Uber has taken a similar approach with Uber for Business. Its agent follows up with leads, answers questions and revives conversations that might otherwise have gone cold. Conversion from those emails is reported to be around 60% higher than Uber’s previous organic baseline.

Customer service has gone further. Intercom says its Fin agent is used by more than 12,000 businesses and resolves about 76% of the conversations in which it is involved on average.

These are no longer demonstrations. McKinsey’s latest survey found that 40% of respondents from companies with more than $1 billion in annual revenue said they were scaling AI agents, up from 27% a year earlier.

What has not scaled at quite the same rate is trust.

A chatbot producing a poor answer is irritating. An agent sending the wrong information to thousands of customers, exposing confidential data or incorrectly updating a financial system is a different class of problem. The more useful agents become, the more consequential their mistakes become too.

This has created a market I paid much less attention to when I wrote the original article: the machinery around the agent.

Companies such as Dynamo AI are building control layers that watch what goes into models, what comes out and what an agent is allowed to do. DynamoGuard, for example, can detect sensitive-data leakage, hallucinations, prompt injection and policy violations, then block, sanitise or escalate activity in real time.

Credo AI approaches the problem more from the governance side, helping organisations keep track of agents, map them against regulatory and corporate requirements and monitor what they do once deployed.

I suspect this layer will become much more important.

Traditional technology governance assumes that a system is designed, tested, approved and then operated more or less as expected until somebody changes it. That assumption becomes uncomfortable when the software can make thousands of individual decisions every day and can decide for itself which tool to use next.

A company therefore needs to decide what data an agent can see, which systems it can access, what it can change, when it needs permission and when it should simply stop.

Those rules have to exist in the software. A policy document sitting in SharePoint will not save you.

This has also changed my view of the “autonomous workforce” I wrote about in 2024.

I imagined agents gradually becoming something like digital employees, with humans remaining in the loop to supervise them. There is some of that. But the more interesting pattern is that agents are beginning to rearrange jobs rather than simply replace them.

In sales, an agent can research a customer, start the conversation and qualify the opportunity. The salesperson spends more time on the relationship and the deal.

In customer support, an agent can absorb large volumes of routine questions. People deal with the unusual, sensitive or commercially important cases.

A coding agent can write, test and debug substantial amounts of software. Engineers can spend more time deciding what should be built, thinking about architecture, reviewing what the agent produced and dealing with the difficult exceptions.

The same thing is beginning to happen in analytical work. An agent can collect information, reconcile data, build an initial model, test assumptions and produce a first version of an analysis. The scarce part of the job then moves elsewhere: deciding whether the assumptions make sense, noticing what is missing and explaining what the numbers mean in the real world.

If AI makes the mechanical parts of analysis much cheaper, companies with deep subject expertise and strong client relationships may not need fewer people doing the same amount of work. They may be able to produce more with the same team, turn work around faster and take on assignments that previously would not have been economical.

Two years ago, I thought the important question was whether AI agents would become capable enough to do real work.

I don’t think that is the question anymore. They plainly can.

The more useful question is which pieces of work we are prepared to hand over to them. The best candidates seem to have a few things in common: the task has reasonably clear boundaries, success can be measured, mistakes can be detected and, ideally, a bad decision can be reversed before too much damage is done.

Then comes the harder part. How much authority should the agent have? What can it see? What can it change without asking? When does a person need to intervene?

That is rather less exciting than predicting an army of autonomous digital employees. It is also much closer to what businesses actually need to work out.

Phase 3 AI arrived. The surprise is that the most interesting question is no longer how intelligent the agents are becoming, but how much of our world we are prepared to let them touch.

We’re racing towards AGI. But what do we actually want AI to do?

The discussion about artificial intelligence felt rather different this week. Jack Clark, the Brighton-born co-founder of Anthropic, was talking about the possibility that we may eventually need to slow the development of the most powerful AI systems, and even about independently verifiable ways of shutting them down. Then, almost in counterpoint, Nature reported on a “virtual biotech” involving tens of thousands of AI agents working together on drug discovery and identifying a promising new approach to lung cancer treatment. One story was about restraint, the other about possibility. Put together, they seem to capture a choice we are beginning to face.

We spend a great deal of time talking about the race towards Artificial General Intelligence: which company will get there first, which country will dominate it, how much more capable the next model will be. There are perfectly understandable commercial and geopolitical reasons for this. But the race itself can start to dictate the objective. In trying to build an intelligence capable of doing almost everything, we may be paying too little attention to a simpler question: what do we actually want all this intelligence to do for us?

Cancer seems an obvious place to start. Rather than directing every new increment of computing power towards making one general purpose model slightly better at everything, imagine deliberately creating hundreds, perhaps eventually thousands, of specialised AI agents focused narrowly on understanding and treating it. Some could concentrate on individual cancers, others on genetics, protein interactions, immune response, drug discovery, pathology, imaging or clinical trials. They would work alongside scientists, doctors and laboratories, testing ideas against evidence, learning from failed experiments and sharing what they discover.

The important point is that this isn’t just theoretical. Large numbers of AI agents collaborating on scientific problems are already beginning to appear in real research; the Nature article is one early example. So extend the idea all the way to the frontier. Apply the same intensity to Alzheimer’s, antibiotic resistance, fusion energy, energy storage, food production, clean water and other stubborn problems humanity has been trying to solve for decades. The attraction is not simply that these are worthy causes. Narrowing the AI mission may also be a sensible way to use increasingly powerful AI while we learn how to make it safer.

That matters because we do not have to choose between racing ahead and stopping altogether. There is a middle course in which we continue to improve the intelligence, and continue putting it to work on difficult real world problems, while being more cautious about the autonomy we give increasingly general systems. Capability and permission do not have to advance at the same speed. A system can become dramatically better at science, medicine or engineering without automatically being given greater freedom to acquire resources, rewrite itself or act independently across the world. Narrowing the mission, at least for a time, could give us something that may soon become scarce: room to think.

There is a larger version of the idea too. What if the major powers agreed that a handful of these problems were simply too important to become another winner-takes-all technological race? The United States might lead a major international effort on cancer. China might commit enormous resources to fusion or energy storage. Europe could focus on neurodegenerative disease, with Britain, India, Japan and others taking responsibility for different challenges. The precise allocation is not the point. Each country would bring its best scientists, laboratories, computing power and AI systems to bear on a defined human problem, then share what it discovers.

Of course, this would be difficult. Countries compete, companies have shareholders, governments have security concerns and intellectual property has enormous value. None of that disappears because we might prefer the world to work differently. If anything, geopolitics seems to be moving the other way. We are falling back on an older language of power, leverage and spheres of influence, as though outdated instincts from yesterday still provide the only credible map for the future. Perhaps that is partly a response to a more dangerous world, but it also reflects a failure of imagination. Periods of genuine change ought to give political leaders some licence to describe a different future, one shaped a little more by collaboration, equality, fairness and kindness, and a little less by the assumption that progress only counts if somebody else loses.

That will inevitably sound to some like technocratic naivety. Perhaps it is. But returning to repackaged versions of “might is right” is neither more imaginative nor, frankly, a particularly hopeful answer to the future. We have occasionally managed to decide that some things are bigger than the usual rules of competition, and science has often been at its best when that happens. AI may give us a reason to try again.

None of this requires us to stop research into Artificial General Intelligence. I doubt that is realistic, and I am not sure it would be desirable anyway. AGI could become one of the greatest scientific tools we have ever created. But there is an important distinction between intelligence and autonomy. An AI capable of designing a new cancer treatment does not automatically need permission to acquire resources, operate freely across the internet, rewrite itself or pursue open-ended objectives without human oversight. We can be extremely ambitious about what these systems can understand and still be cautious about how much freedom we give them to act.

For all the progress, we still do not really know how increasingly capable and autonomous systems will behave in every circumstance. Questions about reliability, control, unintended objectives and human oversight remain unresolved. That is not an argument against progress it is a reason to think more carefully about which forms of progress deserve to move fastest. If we can direct powerful systems towards bounded, valuable problems while we work through the harder questions of safety and control, then we gain time without standing still. We could be using that time to discover new medicines, improve energy technology and solve problems that matter now.

There is also the question of what we choose to reward. Enormous amounts of money are flowing into AI because the commercial prize for building increasingly capable general systems is equally enormous. That is understandable, but money has a habit of shaping not just which technologies are built, but which problems are considered worth solving in the first place. Imagine if even a meaningful proportion of that effort were judged against a different scorecard: how many cancers became treatable, how many years of healthy life were added, whether we discovered a new generation of antibiotics, made fusion practical, reduced the cost of clean energy or made measurable progress on climate change.

Those are not lesser ambitions. We may be creating the most powerful problem solving technology humanity has ever possessed at exactly the point when we have no shortage of problems worth solving. Competition will not disappear, and countries are not suddenly going to become altruistic. They do not need to. The great powers can still compete, AI companies can still build extraordinary businesses and researchers can still push towards AGI. But alongside that race, we could choose to run another one: to make pancreatic cancer survivable, to crack Alzheimer’s, to produce abundant clean energy, to develop antibiotics faster than bacteria can evolve resistance.

There may be a useful bargain hidden in that choice. We continue advancing AI and benefiting from what it can already do, but we give ourselves more time to decide how much autonomy its most powerful successors should have. If AI really is going to change everything, there would be something rather reassuring about some of its first great achievements being things that almost everyone, regardless of politics or ideology, could simply recognise as good.