The frontier will move faster, and the public will see it later

My prediction is simple to state. Over the next 24 months the pace of frontier AI development will increase, whilst the public will meet that frontier later, and on narrower terms, than it does today. The trend has arguably begun already, and I think it is, on balance, a good thing. Any business that assumes the tools it can buy are the state of the art should plan for a gap between the two.

Consider what has happened in 2026. In April, Anthropic said of Claude Mythos Preview that its large increase in capability had led it not to make the model generally available. Access went instead to a defined group: eleven launch partners and over forty further organisations that build or maintain critical software, with $100 million in usage credits to support them. In June, an executive order invited developers to give the US government up to 30 days of pre-release access to models with advanced cyber capabilities. The order is voluntary, and it says in terms that it creates no licensing requirement. Yet it describes a direction of travel: the most capable systems reach a few trusted hands first.

Then came the incident that gives the trend its force. In July, Hugging Face disclosed that an autonomous, agent-driven intrusion had compromised its production infrastructure over a weekend, through thousands of individual actions across short-lived sandboxes. OpenAI has since acknowledged that this involved models under internal cyber testing. Its security team said at Black Hat in August that it was consciously slowing research to improve security, and on 18 August it announced a two-week pause on reinforcement learning of its latest models. Sam Altman called it the first security incident he had felt viscerally. Warning signs of this kind are what change the behaviour of a provider with every commercial incentive to ship.

The strongest objection deserves its full weight. Holding capability back from the public mainly entrenches the largest labs, which keep the best systems for themselves and their chosen partners. It pushes ordinary businesses towards open or overseas models with fewer safeguards. And it does little to reduce risk if development itself carries on accelerating behind closed doors. All three points are fair, and I would not dismiss any of them.

Even so, a visible lag prompted by a real incident is better than releasing every advance the moment it exists. A delay gives defenders time to harden software before the capability becomes widely available, which is precisely the logic of giving Mythos to infrastructure maintainers first. It also makes the gap legible. A business that knows the frontier is ahead of what it can buy can plan for it; a business that believes it already has the frontier cannot.

The open-weight question is where I am least certain, and it matters most. Hugging Face completed its forensic work with GLM-5.2, an open-weight model from the Chinese company Z.ai, running on its own infrastructure, reconstructing the timeline from over 17,000 logged attack events. Its stated reason is instructive: the lesson for defenders is to have a capable model you can run yourself, vetted and ready before an incident, to avoid guardrail lockout and to keep attacker data and credentials inside your own environment. Whether Chinese developers will show the same restraint as their US counterparts is far less clear, and I would not build a plan on the assumption that they will.

The practical conclusion for a decision-maker is modest. Treat the model you can buy as a lagging view of what exists, and review your security assumptions against the capability that sits just beyond it. Decide in advance which tools you would rely on if your usual provider declined a request or restricted access. The frontier will move faster; you will simply see it later, and the businesses that do well will be those that expected it.