Hold the Bottom Line

On 12 September, Anthropic's Dario Amodei published a long essay, "We Must Pace the Frontier," arguing that leading labs should deliberately slow the rate at which they push model capability, "to reduce the risk that something goes seriously wrong." The safety case is genuine and it is the headline. But the essay does not treat China as a bystander to that risk. It argues that if China holds the lead in frontier AI, that itself is a danger to US national security, and it pairs the call for a slowdown with a set of China-facing measures, tighter export controls on high-end chips, enforcement against model "distillation," and hard protection of model weights. Slowing down, in other words, is proposed alongside keeping China behind. (CNBC.)

Two days later, on 14 September, President Trump rejected the premise wholesale. He called warnings that AI could destroy humanity a "HOAX," likened them to climate warnings, and told the industry not to "kill the Golden Goose." His frame was the race, not the risk. He said "whoever wins AI wins," and cast himself as the only guardrail the technology needs. Sam Altman and Elon Musk voiced qualified sympathy for pacing. The President did not. (Bloomberg.)

Both positions sit on a concrete factual dispute. Since February 2026, Anthropic says, seven China-based labs have run industrial-scale campaigns to "distil" Claude, copying its behaviour by pumping it with queries and training on the answers. It describes an Alibaba-affiliated operator running "the largest distillation attack we have ever measured," roughly 151 million exchanges between May and July, peaking near three million a day across more than 3,500 fraudulent accounts, and names DeepSeek, Moonshot (Kimi) and MiniMax among the others. It also reports sensitive traffic caught in the net, including a request from a user it links to the People's Liberation Army and, separately, credentials for a Russian government database. (The Hacker News.) Take the charge at face value. It is a real account of Chinese labs cutting corners to catch up. The question this issue asks is not whether that happened. It is whether the much larger claim built on top of it, that China is the reckless, un-governing party in AI, survives contact with what China's own government was publishing that same week.

Strip the exchange down and one assumption carries almost all of the weight. It is not stated as a claim, because it does not have to be. It is the shared floor both sides stand on. The assumption is that China is the party in AI that will not govern itself. In the pro-acceleration telling, that is why the United States cannot slow down. Pause, and a heedless Beijing simply runs through the gap. In the pro-slowdown telling, that is why any pause has to come bundled with export controls and containment. China cannot be trusted to pace itself, so it must be paced from the outside. The two camps disagree about the brakes. They agree about the driver.

This is worth isolating because it is doing so much and is examined so little. "Whoever wins AI wins" and "we must pace the frontier" are opposite instructions, but each takes for granted that restraint is a Western burden and recklessness is a Chinese trait. It is a claim about China's domestic posture, the kind of claim that is checkable against China's domestic record. And in the same week the claim was circulating in Washington, that record was unusually easy to check, because the Chinese state was busy putting it in writing.

守牢底线 (shǒuláo dǐxiàn), "hold firm to the bottom line," is a standing phrase in Chinese Party-state language for the limits that must not be crossed whatever the cost. It is the phrase the security minister reached for.

On 13 September, one day after Amodei's essay, the Minister of State Security, Chen Yixin (陈一新), published a signed article in the Party journal 《中国网信》 (China Cyberspace, the Cyberspace Administration's magazine), 《全面筑牢人工智能安全屏障 推动人工智能健康有序发展》, "Comprehensively Build a Security Barrier for AI, and Promote the Healthy and Orderly Development of AI." (full text, mirror.) It is not a growth document. It is a threat assessment, and its posture is that AI is dangerous and must be brought under control faster than it is arriving. "We must both see the opportunities and seize the initiative," Chen writes, "and recognise the risks and hold the bottom line" (既要看到机遇、抢占先机，也要认清风险、守牢底线). The instruction that follows is to "coordinate development and security, and speed up the drafting and refinement of the relevant laws and regulations" (统筹好发展和安全，加紧制定完善相关法律法规). Govern harder, and govern sooner.

The article then enumerates 六类风险, six categories of risk. Read them in order.

1. 系统性影响政治安全环境: AI "systemically affects the political-security environment," through public-opinion war (舆论战) and cognitive war (认知战), deepfake audio and video fabricating rumour and inciting division. Chen writes that this "directly threatens our political security, institutional security, and ideological security" (直接威胁我政治安全、制度安全、意识形态安全).
2. 颠覆性升级网络攻防态势: it "disruptively escalates the cyber offence-defence posture," industrialising the discovery of vulnerabilities and automating attack.
3. 规模性放大窃密泄密风险: it "massively amplifies the risk of espionage and leaks," via intelligent crawlers and data exfiltration.
4. 垄断性加剧科技发展失衡: it "monopolistically worsens the imbalance in technological development," through export controls and the monopolising of standards. (That is, the Amodei bundle, seen from the other side of the table.)
5. 结构性冲击社会治理体系: it "structurally shocks the social-governance system," outrunning existing law and ethics.
6. 根本性变革军事斗争形态: it "fundamentally transforms the form of military struggle," as AI moves from a supporting role to a decisive one on the battlefield (智能化战争, intelligentised warfare).

Hold that list. Every item on it is a risk to the state, its information environment, its secrets, its social order, or its military position. Not one is the risk the Western essay that week was about.

The next day, 14 September, the Foreign Ministry spokesperson Guo Jiakun (郭嘉昆) was asked directly about the American calls to slow down and about Amodei's claim that Chinese AI leadership threatens US security. His answer took the high ground of stewardship. "The development of AI concerns the common welfare of all humankind. All parties should jointly promote AI that is open, inclusive, universally beneficial and oriented to good (开放、包容、普惠、向善). Spreading various threat narratives (威胁叙事), and pursuing confrontation and malicious competition, will only disrupt the process of global AI governance, and serves no party's interest." (Foreign Ministry, via chinanews.) China, in this telling, is not the danger. It is the responsible steward, and the "threat narrative" is the actual threat.

The commentary filled in the accusation the diplomats left implicit. On 13 September, Global Times (环球时报) read Amodei's essay as a 冷战剧本, a "Cold War script," a bundle of chip controls, anti-distillation enforcement and weight protection dressed as safety, whose real function is to keep China behind. (Tencent mirror.) Between the three, the same 72 hours that produced "ungoverned China" in Washington produced, in Beijing, a security ministry demanding tighter control, a foreign ministry claiming the moral lead on governance, and a state paper calling the slowdown a containment plot.

So the "ungoverned China" claim does not survive the week. Whatever else Beijing is, it is not a state that declines to govern AI. Its security minister spent the same 72 hours demanding more control, more law, and faster, and framing AI as an urgent danger to be barriered in. If the charge is that China will run heedless through any gap the West leaves open, the Chinese-language record from that exact week is close to the opposite.

But the record refuses to comfort the other side either, and this is the part worth slowing down for. A Western safety reader, seeing Beijing so alarmed about AI, might reach for the hopeful conclusion, that the two frontiers are converging on the same worry, that China too is up at night about loss of control. Read the six risks again. Not one of them is about a model deceiving its operators, resisting shutdown, or acting beyond human control. The word doing the work in Chen's article is 安全 (ānquán), and it does not mean "safety" in the sense the frontier debate uses. It means security: political security, institutional security, ideological security, the security of the state's secrets and its social order. The danger Beijing is racing to barrier is not the machine slipping the leash. It is the machine in the wrong hands, or aimed at the wrong target, weakening the Party's hold.

That is why the two records, laid side by side, do not actually meet. Washington and Beijing are both talking about "AI safety," using the same English word when the exchange is translated, and they mean two different things by it. One vocabulary is organised around loss of control: deception, autonomy, catastrophic misuse, the frontier model as the hazard. The other is organised around loss of authority: subversion, leakage, foreign leverage, social disorder, the frontier model as a weapon someone might point at the state. Each side hears the other say "we must make AI safe" and fills in its own meaning. It is the same trap this publication flagged in Issue 5 around a single word, distillation, now scaled up to the whole idea of safety. The accusation and the evidence never touch because they are indexed to different dictionaries.

Which leaves the honest reading, the one neither Washington camp will like. China is not the reckless outlier of the pro-race story, and it is not the closeted ally of the pro-safety story. It is a state governing AI with real intensity toward an end of its own, and reading its own documents, rather than the caricature or the projection, is the only way to see which end that is.