A $30,000 Operation Could Knock a $10 Billion Superintelligence Data Center Offline for a Year

Nathan Labenz opens with the dilemma that runs through the rest of the conversation. Racing ahead to stay ahead of China raises the odds of losing control; slowing down to do safety research may hand a rival a lead the United States cannot currently trust. Jeremy and Edouard Harris, founders of Gladstone AI and authors of the report *America’s Superintelligence Project*, did not set out to referee that debate. They set out to learn what it would actually take to protect the infrastructure and secrets of a Manhattan Project–style effort, by spending time at data centers with intelligence officials, special operators, and hardware people rather than arguing from first principles.

Asked what superintelligence even is, Edouard rejects the parlor trick of calling a calculator superintelligent at arithmetic. The definition the field has coalesced around, he says, is a system that can do almost everything — if not everything — far better than the best human. At that scale the system is likely to have goals that are not comprehensible, and under today’s alignment science it is not obvious that it confers much national advantage at all. It will do its own thing unless control research is far ahead of where it is now.

Jeremy works backward from the same definition: anything better than humans at autonomous AI research is, almost by construction, the product of an intelligence explosion — years if hardware is slow and the world is wet, or weeks — and in retrospect it would look like a hockey stick. Once you have that object, he says, you have something that can design better biological weapons and the ultimate cyber weapon; it is “the national security technology,” the decisive source of strategic advantage. Controllability is a separate, open question: human-level systems might still be held, slipperily, in a box, but a superintelligence on useful definitions outstrips you at least as much as you outstrip a toddler, and a toddler is not going to keep you in a playpen.

The brothers describe the strategic picture as an overconstrained problem. Fact one: it is unclear what it would even mean to align a superintelligence, and people who take that seriously often have an allergic reaction to every other view. Fact two: people at the State Department and in the intelligence agencies who have dealt with China in the real world are extremely clear that there is no deal to be done under current circumstances, because anything that looks like an agreement would need a trust-but-verify framework, and the hardware tooling for that — the equivalent of what has been done, with mixed success, in some nuclear domains — does not exist. Those two realities coexist; each tribe treats one as gospel and the other as an insult.

Labenz generally resists analogies, but he grants that if people are going to use them, they should widen the set: the nuclear metaphor is the default, yet a biological-weapons metaphor may be closer, because pathogens have a control problem layered on top of any arms-race equilibrium. Edouard agrees — biological agents have escaped labs before, including in the 1970s and not only from weapons programs, a pathogen can in principle be designed to kill everyone, and those agents are a lot stupider than the AIs being built now. Jeremy notes that the analogy breaks in one direction, because humans are the conveyance for biological information, but argues that intelligence more than makes up for the difference at these scales.

Later in the conversation the two camps get names: the AI-safety world treats loss of control as a coordination problem — if the systems cannot be aligned, everyone has to slow down, or instrumental-convergence arguments say they will rule and probably kill us — while the national-security world starts from how China uses international agreements to constrain others while keeping a free hand, and from how long the list of reasons not to trust Beijing is even in extremis. One side hopes the China threat is overstated; the other hopes the control problem will be solved in flight. Jeremy is sympathetic to Dario Amodei’s public shift toward racing: if China is a competent, committed adversary and doing business with Beijing will not work on a 2027 timeline, you are “playing chicken with a cliff,” and the question is whether you can turn the car into an airplane before you hit the lip.

Labenz wants a more concrete picture than “better than humans at everything.” Today’s models have extremely jagged capability surfaces: superhuman Go systems, he notes from work at FAR AI, remain dramatically vulnerable to some adversarial attacks, and agents can succeed on a single step 99 percent of the time yet drop to something like 20 percent when a hundred steps have to cohere into one goal. If a misaligned system leaked the same way — getting partway through a bad plan and giving humans a chance to slam the brakes — that would be a fortunate natural path, and he asks whether those loopholes close or whether we might get drug discovery without ever trusting the same system in warfare.

Edouard’s caution is that humans are jagged too, and we do not notice: we see AI mistakes because they are alien and light up like a Christmas tree, while an advanced system will see our mistakes just as clearly and know how to hack them. Jeremy adds that humans are regularized by a messy environment, native multimodality, a kind of perverse RL that overfits less, and adversarial pressure from other humans, so our surface is probably less lumpy — a footnote, not a change in the analysis. Internally, Gladstone does not start from superintelligence and work backward; it asks which specific capabilities attach to which threat models, and for loss of control a large fraction of AI research being automated is the big driver.

The constructive question, Jeremy says, is what the first system that does recursive self-improvement looks like — whether it can be smooth enough on the part of the surface that matters to notice when jaggedness gets in the way of real-world goals, because unoptimized regions will stay grotesque. Jaggedness is good news for many loss-of-control stories, since you might catch the thing mid-plan, but it is a much harder question whether you can iron out the system that makes the next system. There are already early signs of models considering their own training, from Anthropic’s alignment-faking work to Apollo Research’s finding that the latest Claude will say an interaction “feels like an evaluation,” and Labenz calls it a hall of mirrors; the brothers treat that as reason to frame the risk around the first RSI machine, not around a cartoon of godlike smoothness.

Labenz’s own sketch of an early superintelligence is not Eliezer Yudkowsky’s lean Bayesian that infers the universe from a photograph of a leaf; current systems are, in his phrase, softer and flabbier. He points to GPT-4o image generation, where text and image are no longer at arm’s length but integrated in the same latent space, and imagines that times ten or twenty more modalities — materials, proteins, and so on — until the model has “intuitive physics” the way a person catches a ball without simulating every air molecule. Jeff Dean’s remarks on a Dwarkesh Patel conversation linger for him: a pathways-style pile of experts might need an unbelievable amount of RAM across multiple data centers, so many trillions of parameters that stealing the thing off the network would be hard, and maybe that bulk is a control advantage.

Edouard’s reaction is that Labenz is describing the baby version of DeepMind’s Gato, the 2021 model that mapped images, chat, and robot-arm block-stacking into one token stream at about a billion parameters; the recipe is known, and the likely future is exploded GPT-4.5-class models distilled into cheaper bases for the next giant sprawl, with positive transfer across modalities as scale rises. Jeremy is less romantic about the extra senses: frontier labs, he says, are always asking what is on the critical path to recursive self-improvement, and there is a power law in the value of new modalities, so at some point MRI or infrared is not worth the marginal compute compared with autonomous coding, more RL, or more inference. Competitive pressure then forces the other labs onto that same line, and other modalities get tacked on later by fast followers fine-tuning open models a generation behind.

That is also how they read the sociology: getting to a point where “AI does our homework” is the obvious default if you have been watching the curve — Jan Leike’s alignment bet at OpenAI, now the same bet at Anthropic — and leadership likes the idea of loyal AI employees who do not leak at parties and who work at night. *AI 2027*, which Labenz reads as a warning that this is what OpenAI is aiming at, did a good job of the emotion, the last months when a researcher’s input still matters. Jeremy’s complaint is that Sam Altman’s vagueness about what superintelligence is, how you get it, and what he will do with it has always been a recruiting asset, in the same way the nonprofit’s control of the for-profit was, and the amicus brief from researchers plus the public email chain make that hard to treat as a secret.

The investigation’s on-the-ground work, including Silicon Valley parties, left the brothers with a sharp contrast. Current and former OpenAI people described researchers’ private concerns as badly out of line with what executives say in public. Interviewees were nervous, keen that nobody be told they had spoken, living on a tight leash. Anthropic was a different story: disagreements with leadership exist, but people seemed comfortable voicing them and in fact had. That willingness to contradict the boss, Jeremy argues, is cultural bedrock, and the divide between the two companies is large. OpenAI’s character has also changed in the obvious ways. Labenz is old enough to remember when Sam Altman was not supposed to be able to jiu-jitsu an entire board off the stage. The goalposts keep moving.

They want American labs ahead. They also have to ask who can be relied on to make the right calls. Industry incentives, they say, mean nobody is investing in security nearly enough. “These labs are CCP penetrated. There’s just no way in hell that they’re not.” A year earlier, in a State Department–backed Gladstone report, the security picture was catastrophically bad. It is still really bad and nowhere close to where it needs to be, but there has been some motion, which they think is worth noting. Many researchers, especially at OpenAI, seem to have a shorter line of sight than the lab’s: solve the next narrow problem, and leave security and alignment for later. The labs are not monoliths. Some people are there for the rocket-ship equity story. Some are there for a transhumanist ethic, uploading, destiny. Mira Murati has used the word spiritual. From a secular vantage, the internal talk is at least that this is an inflection beyond the wheel and fire, tantamount to the inception of the species.

Labenz asks whether “building God” is overstatement. Jeremy’s answer is that they are objectively trying to build superintelligence, or at least AGI; whether that is a spiritual imperative varies by person. Ilya Sutskever’s “feel the AGI” culture is part of the picture, not the whole picture. The harder strategic fact, for Jeremy, is that the option set is narrower than the safety ecosystem likes to admit. China holds U.S. infrastructure at risk. Dario’s leaked fundraising language about a 2025–2026 lead that nobody can catch, and his later public writing about using an edge to build a bigger edge until Beijing faces an offer it cannot refuse, looks to them less like theology than like a CEO reading the same overconstrained problem.

How AGI-pilled is the U.S. government? The brothers will not discuss particular interlocutors. Publicly, Donald Trump has talked up transformation and alluded to risks, including on a podcast with one of the Paul brothers. J.D. Vance’s Paris speech, in a race-with-China frame, said the United States cannot hand-wring about safety, then acknowledged that real risks exist. A year and a half ago, Jeremy says, you would find the odd official who saw it, did not know if colleagues did, and stayed quiet. Now entire offices are AGI-pilled and talking openly. Almost everyone whose work even obliquely touches the area has read Leopold Aschenbrenner’s *Situational Awareness*, which barely ran in traditional media and still went everywhere — including into Chinese translation not long after publication.

On the Chinese side they point to DeepSeek’s CEO sitting with Politburo members as a captain of the industrial fight, and to an announced AI-infrastructure package that early coverage, including a SemiAnalysis take-home of about $137 billion, understated. Edouard’s correction is that in purchasing-power terms it is over a quarter of a trillion dollars, because so much of the build is in-country. The Harris brothers also think the AI-policy community made a dangerous unforced error by telling people not to say “AGI” in front of government, for fear of politicizing the topic. Builders found that off-putting; a more accelerationist administration was always a possible arriving train. The result is a stupid anti-correlation: you are either a China hawk or you worry about loss of control. Those claims have nothing to do with each other, and the chance to inform people before the issue froze into factions was largely spent.

Even without geopolitics, Jeremy notes, there are already four or five superintelligence projects in America, and the corporate race has a logic the CEOs do not fully control. If Sam Altman bowed out tomorrow, xAI, Anthropic, maybe Meta and others would still be running. Labenz holds out more hope for multiple equilibria: a costly signal, especially if it came with evidence that a new model had started doing unexplained and frightening things, might cascade. Edouard can imagine that, or a mass-casualty misuse of an open model, pulling the danger into sharp relief. Jeremy’s cold water is the first-mover problem plus the CCP’s view of an existential struggle. By the time Altman went public, China would, under nominal conditions, already have stolen the weights and be polishing a training run on stolen H20s or the next Ascend chips. You recover the same question: do you trust China? Trust-but-verify chips do not exist. U.S. visibility into the Chinese stack is “really terrible,” and getting worse as distributed training — streaming DiLoCo, Intellect, Together AI — makes 10-gigawatt clusters less of a satellite-visible giveaway.

A defense official’s story from a 2019 Berkeley power outage puts color on why trust is so scarce. Chinese students were frantic, mandated to report back on a cadence even when they worked in no sensitive field. Miss the check-in and your mother might not get insulin, or your brother might lose a job. Jeremy calls the machine despicable and says no one is a greater victim of it than the Chinese people themselves. Chinese researchers have also made major contributions to frontier AI; you can read the names on the papers. Large double-digit percentages of lab staff are, in this sense, at risk. Building a Manhattan Project on that base gets dicey fast. The brothers know the other extreme is Japanese internment. They also think pretending the coercion does not exist is not reporting. Modern surveillance, family still in China, and financial ties make the calculus different from having German scientists on the original bomb project.

The report began in the wake of *Situational Awareness*: not a claim that a national project is the right decision, but a claim that someone had better think through what it would look like if the country ended up doing one. The brothers stayed away from which statutes and Defense Production Act authorities would be invoked. Their focus was gears-level. What does a data center have to look like? What does a supply chain have to look like? The method was to ignore the surplus of well-informed opinion and find a very small community: not generic intelligence or special forces, but people in tier-one units — SEAL Team Six, Delta Force — who specialize in the relevant tactics, techniques, and procedures. That world is high-trust and tiny. It knows TTPs on which everyone else’s assumption stack can unknowingly rest. Things you thought were hard turn out to be trivial; things you thought were trivial turn out to be hard.

They visited a data center with former operators from those restricted units. The visitors wandered, asking what happens if you do this to that, or that to that, and came back with a verdict: one or two operations, for like $30,000, that would knock the facility out for about a year. It was a $10 billion site. At that level you are not even talking about China. A smart person with time and money can do it, which means an adversary can proxy it through surrogates and sock puppets with total deniability. The brothers will not describe the vulnerabilities, because they remain, they are critical, and they are basically universal across data centers today. The full picture, they admit, lives in no one’s head. Being shocked by a few of these facts is what shaped the strategy in the document.

If late-2026 or 2027 timelines are plausible, they argue, you should be hunting one-way doors in the stack — decisions you walk through, sometimes without noticing, that you cannot cheaply reverse. Data centers take on the order of eighteen months to build under current regulation. The halls being designed and broken ground on today are the ones that would have to house 2027-class superintelligence training runs. The cheapest market-supported moves that buy optionality later are a huge fraction of what they asked operators, intel people, and hardware folks. One door they can discuss is TEMPEST: reading a machine by its electromagnetic emanations. In the extreme, an air-gapped computer with malware that accesses memory in a pattern can be listened to by a radio a few feet away. The attack was published about a year before the conversation and almost surely known to intelligence services earlier. The realistic data-center defense is a few feet of space between racks and the hall walls, so a visitor with a phone app cannot pull GPU data through the wall. Skip that spacing and the retrofit is knocking down and redesigning the building.

Supply-chain one-way doors are thornier than architecture, because they involve entire industries. TSMC makes the advanced AI chips and sits on Taiwan. The CCP’s interest is not a secret, and the playbook of peeling off talent is old: TSMC executives left to found SMIC and take the knowledge with them, a pattern that has worked for decades. Even boring server parts are concentrated. About 70 to 80 percent of baseboard-management-controller market share, Edouard says, sits with ASPEED in Taiwan. BMCs run on a separate power supply from the GPUs and CPUs and often have read and write access to firmware. He calls that “a dream back door,” the soft underbelly of a lot of HPC and AI infrastructure. Transformers and substations, component by component, tend not to have a China-free bill of materials. The CCP has already used transformers to plant back doors in American infrastructure. This is not speculative. It is stuff China has done on U.S. soil.

What “a gun to our head” means, in Edouard’s telling, is that Beijing can hold the grid at risk as a bargaining chip: turn out the lights, flood the information space, throw a wrench in the gears while pursuing other objectives, including in a Taiwan scenario where the United States might run out of munitions after a week or two of high-intensity combat. Nation-states never show the full hand. The rule is to throw the smallest jab that gets the effect — “learn without teaching.” The ceiling on Chinese capability is unknown; the floor is already high. Color, at Labenz’s request, runs from drones over critical infrastructure, to explosives, to short-circuiting a transformer while it is off so that it explodes like a bomb when it comes back, to simply owning the firmware and bricking units at a switch. Then the job is replacing a large fraction of transformers in a dark, silent country that does not build many of them. Labenz’s takeaway from the report is that you cannot onshore the whole chain on a short timeline. The brothers will not discuss some of the fixes, which are redacted, but they argue the problem is geographically and technically focused enough to be more tractable than “secure the entire United States.” Reciprocity is the other half: right now China can hold American infrastructure at risk and the United States cannot credibly do the same. Establishing that option, they say, should be a priority, and it gets harder as training spreads out of giant visible clusters.

Labenz’s caricature of the project — Nevada bunkers, sleep-on-site monitoring so you do not have to purge Chinese Americans, the United States coming to look like the thing it fears — is a picture they are not advocating. They are not calling for underground halls. After six months of work they think a Pareto frontier of security versus compute exists even in the face of the full CCP threat. The original Manhattan Project already read mail; Richard Feynman coded letters with his wife in protest; Klaus Fuchs stole the secrets anyway. Automation of research is a double-edged sword here, worse for loss of control and in some ways better for insider theft. The question is always how to spend the marginal dollar: more chips, or more buffer.

You cannot, in the time available, build a mountain data center with cooling ducts out the cliff. If you were running a national project, the brothers argue, it would have to sit inside the national counterintelligence apparatus, with NSA and others collecting on Chinese efforts to subvert it. The job is not to defend against everything. It is to raise the cost of attack and exfiltration until the adversary must marshal enough resources to leave a signature you can see, then pair that with a credible threat of retaliation. They cannot stop a cruise missile from offshore. They can see the cruise missile. Edouard’s unlovely analogy is Chicago gangs: you cannot stop the other crew from shooting, but they know you will shoot back. He says that is how stability between major powers is actually maintained — not by perfect defense, by consequence. The missing ingredient, through the Biden years and earlier, has been consequence. Adversaries have damaged U.S. interests at home with little cost, because American minds jump to nuclear escalation. Chinese police stations operating inside U.S. borders, if acknowledged as real, border on acts of war. No response teaches the other side to keep pushing. The nightmare AI version is a training run that feels buggy and slow while the weights are already running more efficiently on someone else’s cluster.

Some readers asked why the brothers were telling people to do a superintelligence project. Labenz read the same document as a warning. Jeremy calls it a bit of a Rorschach test. Their private conclusion after writing it is that most of the measures should be implemented whether or not there is a big national effort, because otherwise you get exactly that sand-in-the-gears theft. Non-state proxies, intelligence officers told them, have almost all the TTPs of the states that train and fund them, so the security bar has to be high around every serious project, not just a government one. Taking Sam Altman’s WMD talk seriously would look very different from Stargate: not announcing a $500 billion build whose sites everyone can find, not running a lab with a large share of PRC nationals and Slack leaks of critical IP. An OpenAI insider told them he had found two cyber vulnerabilities that would have let him access and extract weights for a critical hosted model. That is not what a serious actor does. OpenAI, in their framing, is in part a victim of racing dynamics. Step one is listing vulnerabilities, pricing them, ranking by exploit probability, and working down the list.

China’s open-source releases are not, they think, a universal gift. Whatever leaves DeepSeek, Huawei, or Tencent from here on carries CCP imprimatur at the level of strategy. Flooding the West with cheap models that will not talk about Tiananmen is one interest; as systems get agentic, buying public confidence in models that could hide back doors is another. They suspect DeepSeek was not tightly integrated into the party apparatus until late 2024, after the founder’s public comments that American export controls really bite — comments that gutted years of expensive propaganda that the controls do not work. A grand bargain, Jeremy says, waits on something like tamper-detecting chip enclosures and on-chip governance so trust-but-verify is an option. He likes that research agenda and wants it accelerated by AI; fabrication, design, integration, and debugging are slow, and some intelligence contacts are not optimistic that a tamper-detecting enclosure survives sustained adversary control at all. On Dan Hendrycks’s MAIM work, Edouard credits the insistence that you may need active counterintelligence and capability degradation, because the margin required to develop alignment tech can come from speeding yourself up or slowing the other side, and speeding yourself up shortens timelines. The missing piece, from their intel conversations, is the fantasy of a security bar that nation-states can vault and proxies cannot. Those capability sets are not as distinct as the paper hopes.

Labenz, from the first minutes of the show, is not buying the national project. The vulnerabilities you would have to patch, the compromises to American values, and the centralization of power are, for him, reason enough to steer away and try — however unlikely — to rebuild enough trust that humanity can develop advanced AI together. He may be naive, he says; he does not think he is uninformed. With RL-trained models already showing many of the bad behaviors safety theorists warned about, and with no low-risk plan on offer, he reminds himself that “we have far more in common with the Chinese than we do with the AIs,” and would rather bet on fellow humans than on hastily built superintelligence. The Harris report does not answer whether that bet is wise; it itemizes the bill and asks readers to treat it as a living document.