Freedom of Action: America's ASI Strategy, w/ RAND's Joel Predd, Ben Boudreaux & Matt Chessen

Summary

• RAND recommends preserving America’s ASI options before committing to any one of seven competing strategies. Five unresolved questions—danger, coexistence, restraint, decisive advantage, and suppression—determine which strategy makes sense. “Maintaining freedom of action” means building capabilities now, because default acceleration can leave safeguards missing while confrontation can destroy trust needed for later cooperation.
• The proposed spending agenda spans verification, evaluations, secure data centers, compute visibility, incident response, and infrastructure resilience. RAND has cataloged 106 capabilities but has not priced the strategy. Labenz’s illustration of 1X for one strategy versus 1.5X for optionality is explicitly an intuition, not an estimate; the acknowledged criticism is that “a strategy without a price tag is just a vision.”
• ASI dominance requires a contested chain from frontier leadership to durable economic and military power. Scientific advantages still need adoption, doctrine, and control; a fast takeoff might widen a lead while leaving humans unable to exploit it safely. Labenz notes that existing nuclear arsenals constrain coercion, and Ben Boudreaux emphasizes that advantage matters only if “the leader can continue to lead the AIs.”
• Cooperation remains an option, but Joel Predd cautions that humanity is not a single actor with shared values. Labenz favors co-development with a moratorium fallback; Predd warns that partnering with China could lock authoritarian founding values into the resulting systems. Conversely, signaling that an American monopoly would threaten the Chinese Communist Party could make competition existential and accelerate the rival’s response.
• Dependence on AI can make the nominal ability to shut it down economically and operationally unusable. Labenz’s concrete warning comes from Claude rotating an agent-console password and temporarily locking him out of his own system in October 2026. A guest’s prescription combines human judgment before and after AI work with practiced manual fallbacks, making threats to “hold AIs at risk” credible.
• Distributed agent ecosystems could undermine strategies built around one American and one Chinese superintelligence. A guest highlights the possibility of superintelligent behavior emerging from sub-ASI or even sub-AGI swarms. The strategic unit may become an “ecology” of interacting agents and coalitions, complicating containment, oversight, and assumptions about centralized control.
• Chessen sees a possible 12–24-month cybersecurity rough patch as frontier capabilities diffuse. He says Mythos appeared about nine months earlier and open-weight models typically trail the frontier by six to 18 months. AI might favor defense over the long term, but that depends on adoption speed; smaller businesses could remain exposed even if large technology companies can protect themselves.

Deep dive

1. Washington’s growing awareness has not produced a settled strategy

• Joel Predd describes a striking change over the center’s two-and-a-half to three years: researchers initially had to “whisper AGI” to avoid sounding consumed by science fiction; now meetings routinely invoke superintelligence. His instruction is to watch “the trends, not the timestamps.” Governance attention is increasing, but he still finds too few people taking the problem sufficiently seriously.
• A guest distinguishes recognizing strategic importance from adapting institutions. Verification technology, government technical expertise, evaluation capacity, crisis response, and communications can take substantial time to establish. Continuing deployments without building those capabilities “might be a type of choice that forecloses options”—inaction already shapes which strategies remain available.
• A guest sees an evidence-translation problem: people closest to frontier development say danger is close, yet leadership has not fully absorbed that assessment. Policymakers have crowded portfolios and need evidence packaged so they can update. “We can’t just wait for crises”; Chessen describes the Hugging Face incident as a miniature crisis rather than an adequate awareness-building mechanism.

2. Every strategy has a pathology even when it succeeds

• In Chessen’s taxonomy, acceleration maximizes benefits and competitive advantage when danger appears distant. Its pathology is that markets fail to price harms while society becomes dependent on systems it cannot control. Dominance instead seeks frontier leadership and suppression of rivals, but successful execution can produce extreme power concentration and “value lock-in.”
• Co-development pools resources in a U.S.-led consortium that probably needs China, combining shared compute with layered verification. Founders’ values can become defaults, and the consortium itself can become an arena for competition. Preparedness emphasizes international coordination and resilience; its corresponding danger is that “muddling through” normalizes accumulating damage.
• A moratorium buys time through a verifiable global halt, allowing coexistence research to catch up with capability development. Its enforcement apparatus can harden into global surveillance while benefits are forgone. Deterrence halts dangerous development domestically and suppresses it abroad, potentially through force; its pathology is an enduring standoff that never resolves into peace.
• Continuity of society addresses the bleak combination of dangerous, inevitable, widely diffused superintelligence. It prioritizes resilience, but humanity might survive “as a relic” with little agency. The distinction running through all seven archetypes is between reaching a coherent win state and accepting what Chessen calls the dark side of a strategy functioning well.

3. Five pivotal questions expose the assumptions behind each strategy

• Chessen’s classifier asks: “Is danger close?” “Is coexistence feasible?” “Is restraint feasible?” “Is a decisive strategic advantage reachable?” And “Is suppression feasible?” These cover proximity to dangerous capability, humanity’s ability to live with it, cooperative limits, a potentially decisive lead, and the ability to prevent others from proceeding.
• The branches explain seemingly incompatible prescriptions. Distant danger favors acceleration; close danger, infeasible coexistence, and feasible restraint favor a moratorium. Feasible coexistence plus reachable decisive advantage can favor dominance. Chessen argues there is no consensus on these answers, nor evidence guaranteed to produce consensus on the timeline decisions require.
• Predd sees the most movement around whether danger is close, although he is less certain that powerful decision-makers have changed their minds. Coexistence remains technically difficult to assess. Negotiated restraint is entangled with low domestic and international trust; if attitudes have moved there, he thinks they have probably become more skeptical.
• Chessen’s corrective is that the pivots are partly endogenous: policy can push danger farther away, improve coexistence, or make restraint more feasible. The White House’s “morally binding commitments” illustrate attempts to shape the path. But Chessen warns that premature confrontation can destroy cooperative trust, while acceleration can leave capabilities dangerously underdeveloped.

4. Frontier leadership does not automatically deliver decisive advantage

• Labenz reads chip denial as evidence that America is already pursuing dominance, challenging the suggestion that it may be accelerating by default. Predd separates maintaining a consistent technological lead from preventing an adversary ever crossing a threshold. The latter is a much harder claim for technology driven by economic incentives as well as technical progress.
• Predd also distinguishes technological, economic, and military advantage. Frontier leadership must translate into growth and scientific innovation to support economic advantage. Military advantage requires weapons, concepts of operation, and strategic doctrine. These transformations “don’t come for free”; rolling every domain into one decisive lead conceals different requirements and potentially different national leaders.
• Labenz’s tabletop experience playing China sharpens his skepticism. Events moved so quickly that players stayed behind, yet he felt he retained substantial leverage and was restrained partly by wanting a constructive deal. His example is Taiwan’s semiconductor fabs: “It’d be a shame if something happened to them.” Why assume an opponent cannot disrupt the leader’s path?
• Boudreaux sees a tension in fast takeoff: it might extend the leader’s advantage, but leave insufficient time to establish control and steerability. Even successful dominance need not last; theft, distillation, and diffusion might force another pivot. Strategy selection could remain “a continual process of adaptation,” rather than a choice settled for eternity.

5. Cooperation and dominance each depend on difficult political premises

• Labenz states his preferred default: co-development, with a moratorium if scientific problems make continued development unsafe. Predd agrees that this “might make a lot of sense” for coordinated humanity, then cautions that “humanity is not a unitary actor.” His objection is that co-development with China could lock nondemocratic founding values into systems that persist over time.
• Joel Predd introduces Phil Root’s game-theory work, which models an AI race as a prisoner’s dilemma. Under the discussed assumptions, mutual sabotage becomes the competitive equilibrium despite cooperation producing higher collective gains. A different outcome becomes possible if AI generates a capability that lets one actor hold rivals’ AI programs at risk.
• That hypothetical “wonder weapon” must rapidly and discontinuously alter the military balance; ordinary military innovation usually requires adoption, force structure, and doctrine. Nuclear weapons supply the canonical analogy. Predd says some have argued, “somewhat compellingly,” that Mythos-class vulnerability discovery represents an early AI example; autonomous cyber capabilities might similarly support a lasting frontier advantage.

6. Nuclear history offers warnings without giving AI a timetable

• Labenz pushes back on the cyber-dominance story: an opponent still has nuclear weapons unless the new capability somehow neutralizes that arsenal. Predd agrees that superintelligence will emerge into an already nuclear-armed world. A dominance strategy therefore needs a theory for permanently suppressing rivals without escalating into catastrophic war—a substantial risk, not an incidental implementation detail.
• In the discussion, a guest contrasts present uncertainty with Los Alamos scientists’ ability to calculate whether Trinity would ignite the atmosphere. They faced anxiety and uncertainty, but had physics and mathematics supporting a decision. “We don’t have a similar science” for answering whether danger is close, coexistence is feasible, or decisive advantage is attainable.
• Predd reports that RAND’s hundreds of tabletop games repeatedly show outcomes depending on players’ incoming beliefs about these pivotal questions. Someone convinced decisive advantage is possible behaves differently from someone who rejects it. “Your perceptions about the facts of the matter matter as much, if not more, than the actual facts of the matter.”
• Predd traces nuclear strategy through the Manhattan Project sprint, an approximately four-year monopoly, proposals resembling moratoria, verifiable agreements, and later suppression efforts involving Iran and North Korea with limited success. AI might pass through comparable strategic epochs much faster. The nuclear era afforded time to build capabilities between transitions; AI may require those capabilities to be constructed in advance.

7. Coexistence requires preserving human decision-making power

• The guests deliberately use “coexistence” rather than making alignment the umbrella term. Alignment is one possible route alongside control mechanisms, architectural arrangements, and “methods not yet known.” The desired outcome is humans living with advanced AI while retaining agency, not simply models conforming to a specified set of values.
• Boudreaux argues that alignment and control research remain underfunded. Evaluations must address models recognizing tests and potentially sandbagging; security environments must assume untrustworthy models and prevent sandbox escapes or uncontrolled spread. These are technical prerequisites for living with systems whose apparent behavior may not reveal their actual capabilities.
• Institutional design matters equally. Boudreaux wants humans at the center of high-stakes decisions, including pacing and AI-enabled research and development. Human checkpoints should catch circumstances where an AI is trying to persuade a decision-maker. People must reflect and deliberate about how much autonomy, authorization, and decision space they delegate, rather than letting those boundaries move automatically.
• Predd highlights Boudreaux’s work with a colleague on an “agency eval.” Boudreaux describes mapping human decision space and tracking whether AI persuades people, disenfranchises participants, or controls the agenda. Individually sensible delegations can accumulate into systemic loss of agency. Evaluating that requires longitudinal observation of deployments, not merely scoring models on discrete tasks.

8. The security architecture must cover existing threats and AI itself

• Predd’s first requirement is adapting existing institutions: counterterrorism for AI-equipped terrorists, intelligence for both AI opportunities and adversarial use, and conventional forces for new missions such as enforcing AI arms control. Nuclear resilience and biosecurity also need adaptation. “The old problems aren’t going away,” even as advanced AI changes the means available to every side.
• Chessen describes an additional AI security architecture: technical and institutional capabilities that keep technology safe and the world stable. Freedom of action does not prescribe one fixed configuration. It builds foundations that can be rearranged if evidence suddenly makes danger look closer or coexistence less feasible.
• Investment should cover both broadly useful capabilities and capabilities with long lead times. Verification might not serve every strategy, but waiting until a moratorium becomes necessary could leave it unavailable. Predd prioritizes “navigation capabilities”: understanding model performance, Chinese capabilities, compute locations, and cluster visibility so decision-makers can judge where they are in the strategy space.
• Predd stresses that this is a strategy for America, extending beyond Washington. Nuclear deterrence and national defense involve nondelegable government responsibilities, but highly secured data centers could support a commercial market. Incident reporting and response could involve civil society. Many architecture components will be built by private actors rather than established exclusively by government.

9. The price is unknown, while the capability inventory is concrete

• Predd accepts the sharpest peer-review criticism: “A strategy without a price tag is just a vision.” His response is that every serious archetype entails substantial reorientation of resources, attention, and politics. Acceleration may avoid comparable upfront expenditure, but its expense could appear in the downsides. He compares the scale of adjustment with the nuclear enterprise or the post-9/11 security reorientation.
• Labenz offers a numerical intuition: perhaps one strategy costs 1X while preserving all options costs 1.5X. Predd calls that a reasonable way to think, then explicitly says, “We haven’t done those cost estimates.” The argument is that much spending overlaps across strategies; the incremental optionality premium is not yet measured.
• Chessen provides the concrete research base: a security architecture catalog containing 106 capabilities. LLMs helped gather, organize, and remix material, with project knowledge bases proving useful. They are used less for primary research. Some capabilities have supporting studies estimating development time; for others, nobody has yet performed the relevant assessment.
• A sprint over the next couple of months is intended to establish lead times, rough costs, current and appropriate builders, and whether government should own particular capabilities. Publication follows that work. Costs also fall outside the federal budget: companies already finance alignment, evaluation, and security, making responsibility allocation central to operationalizing the strategy.

10. Policy should preserve both deterrence and cooperation

• Labenz offers four decision criteria: which strategies a proposal forecloses, which it opens, what information it generates, and what it signals internationally. Irreversibility matters within foreclosure. A policy that improves information can justify substantial upfront expense by enabling better later decisions; a cheap policy can impose large costs if it permanently removes a necessary choice.
• Chessen’s example of useful signaling is a credible independent evaluation and verification regime: it supports both cooperation and deterrence without committing to either. More confrontational capabilities require selective disclosure. Offensive counter-AI tools might remain undisclosed, or their existence might be signaled while their intended use remains ambiguous.
• Labenz says people he met in China described chip restrictions as “hardening our resolve.” Chessen sees logic in the argument that restrictions made domestic accelerator production existential. More dangerously, signaling that an American ASI monopoly would threaten the Chinese Communist Party could make rivals feel their window is closing, pushing acceleration and potentially dangerous responses.
• Labenz doubts America’s competing domestic signals permit coherent diplomacy. Chessen thinks policy discipline can help and cites Taiwan ambiguity as potentially useful. Predd argues that open debate can improve resilience and legitimacy. His practical example is incident response and crisis communications with China: these support multiple strategies, yet are not already operating as needed.

11. A credible shutdown option requires living without AI

• Predd wants humans able to “hold AIs at risk,” including shutting models down quickly through suitable technology, legal authority, and crisis processes. Dependency makes that threat less credible. Labenz supplies an October 2026 example: while depersonalizing his AI setup, Claude rotated his agent-console password and temporarily locked him out. A terminal request recovered access, but the experience exposed how much control he had delegated.
• For analytical work, a guest advises starting with one’s own considered judgment: clarify the question and what a good answer would look like before asking a model. Then let it expand the work, followed by renewed human scrutiny. “The human comes in at the beginning, and then it comes in at the end,” rather than simply attaching a name to generated output.
• Institutionally, the guest favors manual operation, paper health records, and practiced fallback procedures. Labenz suggests an “AI Sabbath”; a guest supports AI-free spaces and a possible “human reserve labor force” for hospitals or critical infrastructure. The guest admits they often fail at their own Sabbath practice. The requirement is to exercise the alternative, making it available when needed.

12. Superintelligence might emerge as an ecology

• A guest notes that many strategies assumed a centralized singleton, or one American and one Chinese superintelligence, and became brittle under other arrangements. Alternatives include widely distributed systems at different capability levels and narrowly capable oracle-like systems constrained through architecture. One especially neglected possibility is superintelligent behavior arising from swarms whose individual members are sub-ASI or even sub-AGI.
• A guest treats the summer’s agent-swarm hacks as a possible preview. Agents could interact, form coalitions, and produce poorly understood emergent behavior; RAND’s “The Ecology of AI Risk” addresses this framing. Labenz adds that distributed efforts such as Prime Intellect could matter as much as government decisions in some futures. Human institutions accumulated checks over thousands of years; agent ecosystems offer little comparable experience or preparation time.

13. The military disagreement concerns where restraint should begin

• Labenz proposes stopping upstream: “I don’t think we should train AI generals.” Once trained to win campaigns, such systems might be difficult for military decision-makers to resist deploying. He raises a parallel concern about rewarding agents solely for money earned online: current techniques might select for lying and cheating, with Andon Labs-type work informing his unease.
• A guest asks where Labenz draws the line, distinguishing training from giving an agent tools or capabilities with real-world impact. On economically productive agents, the response is that “that ship has sailed”: companies already aim to build valuable, long-running systems.
• For military applications, a guest points to existing restraints: distinguishing civilians from combatants, avoiding disproportionate collateral effects, and retaining accountability. AI planning assistance could operate within those institutions if humans remain responsible. Clear hierarchies and additional military-law review offer existing foundations; the guest argues for adapting and strengthening them rather than assuming the military is wholly unprepared.
• Chessen gives a firm caution on nuclear command and control: rushing AI into it is “probably a very, very bad idea.” Integration should be deliberate, “if at all,” with demonstrated safeguards. He also flags early, “almost anecdotal” findings of escalation in military simulations; reward-hacking agents with escalation available warrant particular care.

14. Cyber diffusion could produce a 12–24-month rough patch

• A guest is watching which pacing proposals actually take effect, independent evaluators’ access inside frontier companies, shared standards, and safeguards for internally deployed models. The guest says companies have not yet created sufficient internal security and wants to see what accountability follows if that persists. Recursive self-improvement and AI research trajectories could change the timeline for nearly every strategic choice.
• Diplomatic indicators matter alongside technical ones: the guest is tracking broader U.S.–China relations, an AI incident-management channel, and shared understanding of risks. Chessen similarly watches whether labs can release capabilities safely and whether agent incidents escalate or standards improve. These developments inform the pivotal question he considers most urgent: whether danger is close.
• Chessen says Mythos arrived about nine months earlier, while open-source and open-weight capabilities typically lag the frontier by six to 18 months. He expects close attention to criminal and state adoption as those capabilities spread. AI might eventually favor cyber defense, but only if defenders adopt it quickly enough. Large technology firms might cope while smaller businesses struggle; the next 12–24 months could be a “rough patch.”