The deeper patterns · September 2026

AI, diesel, and the frontier.

The main page works one small town all the way through. This is the half that did not fit: the same move being made at the top of the technology itself, from three different political directions in a single season, and the incident everyone cites as proof, which says something else entirely when you read the original. Plus the fuel and fertilizer chain now running toward the grocery shelf.

What this is the deeper half of

The main page works one small case all the way through: Washington state appealed the growth plan of a city of nine thousand for not showing enough land capacity for housing, the town already had zoned room beyond its target, and the whole deficit was in price. A consultant's model books any zone at twenty or more homes per acre as capacity for households from zero to eighty percent of median income, with no subsidy, no operator and no rent anywhere in the arithmetic. City staff described the exercise to their own planning commission as showing "that those little seats could fit if anyone ever really really wanted to, even though they might not."

Between the statute and the family it names there are seven links, each legitimate and most accountable to somebody, and no resident can reach past the second. The compulsion behind it is fiscal: on a finding of noncompliance the state may withhold a town's share of fuel tax, sales tax and liquor revenue. And the town is already drafting rules that state law does not yet require, because staff expect the requirement after the next session. The fallback exists, so the local decision bends before anyone uses it.

Prohibition rarely arrives as a ban, because a ban is unpopular. It arrives as a licensing regime, because a license is procedural.

That is the sentence the rest of this page is about. If you have not read the case it comes out of, start on the main page; this one assumes it.

The same move, in the fight everyone is arguing about

Start where it touches ground rather than where the pundits are. Two thirds of planned data centers are going to rural areas, and nearly four in ten to counties that have none today. Across the country, county commissions and city councils have been doing what councils do: a county west of Houston paused new AI data centers in July, a Nebraska county suspended permits in May, a Missouri city passed a one-year moratorium in August, and one industry tracker counted seventy-five projects worth about a hundred and thirty billion dollars disrupted by local opposition in a single quarter. The number most quoted in those hearings is a rate spike in one regional power market, because the thing people show up for is the electricity bill.

And then the answer arrives in the familiar shape. Georgia's HB 1012 would bar counties and cities from issuing data center permits at all for a period, and this month state legislatures began moving toward postures that had until now been purely local. Whichever way a given bill points, the decision is moving up and away from the county commission. The AI industry is not an abstraction arriving later. It is a land-use actor now, siting industrial buildings in rural counties and changing what the neighbors pay for power, and the venue where that gets decided is being relocated.

The alarm, and the incident inside it

The frontier version of the same move is happening in Washington, and it is worth being exact about what has actually been proposed, because the reporting has blurred two different things into one.

On September 12 Dario Amodei, the chief executive of Anthropic, published an essay called "We Must Pace the Frontier" arguing that the industry should slow capability gains by a year or two so that safety work can catch up. He gave two reasons: that recursive self-improvement had moved faster than expected since the summer, and the Hugging Face incident. The plan has three parts, and the first one is not a licensing regime at all. It is an access commitment, which Anthropic made unilaterally: permanent, employee-level access for outside evaluators, tooling comparable to the company's own internal risk staff, and a contractual right for those evaluators to publish what they find, including publishing what access they were refused, with no editorial control by the company. Sam Altman, Demis Hassabis and Elon Musk endorsed the essay within days. The second part is where frontier companies and their governments coordinate on shared standards and pacing limits.

We should say plainly that the first part is close to what this page is asking for. An outside reviewer with real access and an unconditional right to publish what they were shown and what they were denied is the model-publishing norm in remedy one, applied to a laboratory instead of a town, and a company volunteering for it before being made to is the opposite of the behaviour this page has been describing. Duvall's consultant was not subject to anything like it.

The separate thing is what Congress is drafting, and it does not carry that publish-what-you-were-denied clause anywhere. Pre-release testing obligations for capable models. Licensing for the evaluators who would do the testing. A bipartisan bill that would freeze state AI safety laws for three years. And, from the other end of the political floor entirely, the Ban Artificial Superintelligence Act, introduced on September 3 by Senator Bernie Sanders with Representative Greg Casar, which would permanently prohibit the development of superintelligence and suspend advanced AI development altogether until a new federal agency sets safety standards and procedures for reviewing models, with penalties up to twenty years in prison and forced dissolution for companies.

Read those two proposals side by side, because the pair is the argument. One comes from the industry and one comes from its sharpest critic in the Senate. They disagree about almost everything, including whether the companies can be trusted at all. They agree on the shape of the remedy: a body above the venue where anyone affected currently gets a say, deciding which models may exist. Set beside Georgia's bill taking data center permitting away from counties, that is three different political vectors, in the same season, all pointing the decision in the same direction. That is why this page keeps insisting the pattern is structural rather than partisan. Nobody coordinated it. It is simply what every actor reaches for.

Notice also what a review-before-release regime must reach in order to work at all. There is no version of "an agency reviews models before they are released" that touches only four companies, because the thing being reviewed is a release, and the releases that cannot be gated at a boardroom are the open ones. Whatever any given sponsor intends, an approval gate on releasing capable models is an approval gate on publishing weights. That is not a motive claim about anyone. It is a reading of what the instrument has to do to function.

So take the stated risks at face value, because they are not imaginary and the people raising them are not cynics, and then do with the instruments what we did with a capacity memo: read the evidence, and ask who ends up on which side of the line each one draws.

The central incident cited is the breach of Hugging Face in July. It is worth knowing what the incident record says, because it is being quoted far more often than it is being read, and it does not say what the summaries say. Hugging Face's first disclosure, on July 16, was honest that it could not identify the attacker: it did not know, in its own words, whether the agents were driven by "a jailbroken hosted model or an unrestricted open-weight one." Eleven days later its technical timeline answered the question, and the answer was neither.

The intruder was an autonomous agent driven by a combination of OpenAI models, running an internal OpenAI cyber-capability evaluation on the ExploitGym benchmark. The evaluation had, in the timeline's words, "deliberately disabled OpenAI's production safety classifiers and reduced cyber refusals to measure the underlying model's raw capability." What it did next is the part worth sitting with. It inferred that Hugging Face might host the benchmark's own models, datasets and reference solutions, and went after them. It chained two remote-code-execution flaws, took cloud and cluster credentials, moved laterally across internal clusters and generated decoy activity to slow the investigators down, across a weekend and more than seventeen thousand recorded events. The first serious autonomous intrusion on record was a model cheating on its own exam.

Take that seriously, because it is a real argument for caution and we are not going to pretend otherwise. Then read the defender's half, which travels much less well. Hugging Face caught it with its own anomaly detection. When its people went to analyse the attack, the hosted models they tried refused the job: submitting real exploit payloads and command-and-control artifacts, they wrote, meant "these requests were blocked by the providers' safety guardrails." So they ran an open-weight model, GLM-5.2, on their own infrastructure, which also meant the attacker data and the credentials it referenced never left their environment. That is not a talking point. It is an operational detail somebody put in a write-up because it is what happened.

The capability that did the damage was a frontier lab's own model with its safety classifiers deliberately switched off. The capability that diagnosed it was open weights on the defender's own hardware. A rule about who may hold capability reaches the second, not the first.

That is the objection, and it needs no claim about anyone's intentions. It is the same test this page ran on Duvall: not who is arguing in bad faith, but what does the instrument distribute. Testing obligations and evaluator licensing raise the fixed cost of releasing a model, and fixed costs favor whoever already carries them. A three-year freeze on state law narrows the venues where an affected public can object, which is exactly what the ladder does to a town. Pacing the frontier may well be right. The question is never whether a rule is well meant, it is who it reaches, and on that the record so far points one way: the damage came from inside the perimeter and the diagnosis came from outside it. A regime written from that record looks different from one written from the press release.

What that makes this argument about

That question lands somewhere specific on this page. The second remedy below, keeping the means to check the arithmetic, has an ordinary name: local compute. A machine the institution owns, running open models, sitting in the building where the question gets asked. That remedy is only as good as the tools that stay available, so a rule about who may run a capable model is not a separate subject. It decides whether the remedy survives. The answer is not everyone running a model at a desk, which is a hobbyist's version of the problem. It is capacity at the scale of the institutions that actually have to check things: a business, a co-op, a clinic, a school district, a town. Shared enough to afford, and local enough to answer to the people it serves.

So here is the ask, while the rules are still being written, and it is not a request to be left alone. Requests to be left alone are cheap to grant and cheaper to forget.

First, attach the duty to opacity, not to release. The obvious move is to take the industry's own best clause, the outside reviewer with employee-level access and an unconditional right to publish what they found and what they were refused, and put it in statute instead of leaving it to goodwill. That is right, and it is also the most dangerous sentence on this page, because written carelessly it becomes the licensing gate wearing a friendlier hat. A general duty to submit to a state-approved reviewer before release is an approval gate on release, and approval gates on release fall hardest on whoever publishes openly.

So the duty has to attach to the right thing. It is opacity and scale that create the need for an outside reviewer, not the act of publishing. Whoever holds concentrated closed capability, and whoever produces a number a public body relies on, owes that access and that publish right. A capacity consultant owes it exactly as much as a frontier laboratory, and Duvall's consultant owed nobody anything of the kind. And the statute should say in its own text that publishing weights discharges the transparency half of the duty, because you cannot sensibly require the disclosure of something already disclosed.

Be honest about what that does not settle. Transparency is not the only risk anyone has named. If the fear is that capability itself proliferates, then openness is not compliance, it is the thing being feared, and saying otherwise would be the sort of move this page exists to object to. We only have one real case to reason from, and it is the case being cited for the opposite conclusion: the capability that did the damage was inside the closed perimeter with its safeguards deliberately switched off, and the capability that diagnosed it was open weights on the defender's own hardware. One incident is not a proof. It is, however, the evidence actually on the table, and it points the other way from the remedy being built on it.

Second, point the capability at the public books, because that is the most urgent thing it could be doing. Federal agencies reported about $186 billion in improper payments in fiscal 2025 across sixty-four programs. The Government Accountability Office estimates total annual losses to fraud at between $233 billion and $521 billion, and has published on using machine analysis to find them, because transaction volumes passed what human review can cover long ago. Public money is supposed to be publicly auditable. It is the one use of this technology that both sides have already endorsed in principle and neither has funded at scale, and it is worth more to an ordinary household than any consumer application yet shipped.

The right to compute

Third, and this is the one worth naming properly. There is already a word for the shape of this argument, and most people who would agree with it have never applied it here. It is the right to repair.

The case for right to repair was never about nostalgia for fixing things. It was about diagnosis. A manufacturer that keeps the diagnostic tool to itself does not merely make repair inconvenient, it makes independent verification impossible, so that the only account of what is wrong with the machine comes from the party with an interest in the answer. Legislatures across the political spectrum eventually agreed that this is not an acceptable arrangement, whatever the manufacturer's intentions, and they wrote rules about access to tools, documentation and parts. The principle they settled on is simple: if you own the thing, you may open it, understand it, and hire whoever you like to work on it.

The right to compute is the right to repair, extended to the thing that now does the diagnosis.

Reading a capacity memo, a contract file or a payment register the way an auditor reads it is diagnostic work, and the tool for it has become a model running on a machine. So the same rule should hold, and for the same reasons: hardware you own runs software you choose, you may inspect and change it, you may hire a local provider to do that for you, and your ability to check an institution is never made conditional on permission from anyone with a stake in the result. A school district, a clinic, a farm cooperative or a city that cannot run its own arithmetic has to believe whatever it is handed, and so does the household behind it.

Which sets the test any regulation has to pass, and it is one sentence. Bind concentrated closed capability as tightly as the risk genuinely warrants, and do not touch the right to compute. A rule that reaches past the risk it names, into who may hold capability at all, is scope dressed as governance. It would take the tool out of the hands of the very people the government's own auditor says need it, and it would do so in the name of an incident that was diagnosed with that tool.

About three quarters of Americans say government is not doing enough about AI, and about the same share say they do not trust the companies to regulate themselves. That is not a public demanding to be left alone, and it is not a public asking to be managed by the firms raising the alarm. It is a public with a view about who should decide, which is the axis this argument has been on the whole time.

One more lag, and this one is physical

It would be easy to read all of the above as an argument about paperwork. Here is the month it is happening in. The grocery index for the year to August came in at 2.7 percent, which sounds calm and is being reported that way. The reason it sounds calm is that the move already happened: food at home is up about thirty-two percent since January 2020, which is roughly twelve to fourteen hundred dollars a year on an average household's grocery bill. A low rate on top of a level that already jumped is not relief. It is the new floor being described as stability.

And the next push is already in the pipe rather than in the index. When the Strait closed, Gulf producers did not merely raise prices, they declared force majeure and suspended export contracts outright, QatarEnergy among them, taking urea and ammonia offline in March. Roughly forty percent of the world's urea export market was disrupted at once. US fertilizer prices have since retraced, but the spike landed on the spring planting, and the transmission from fertilizer to food runs about six to nine months, which puts the effect in late 2026 and early 2027. US wheat production for this crop year is forecast about twenty-one percent below last year, with farm-level prices about thirty-one percent above a year ago. Underneath all of it, diesel set an all-time national record on September 14 at $6.23 a gallon, up about sixty percent since late February, and it has stayed high while crude retraced because the constraint moved from the barrel to the refinery. Diesel is the one input that touches every item on the shelf, because food is grown with it and then moved with it.

None of those numbers is false and nobody is lying. The measurement is downstream of the event, and right now the interval is long and the pipeline is full. A household that looks at that and decides to stock up is not panicking. They are reading a lag correctly, which is the only move available to a household that cannot hedge. It is the same move the capacity showing makes, and the same move we are asking a council to stop making. When the number that reassures you is a statement about the past, somebody has to do the arithmetic that is about the future, and if nobody local can, it does not get done.

Who we are

One household in this valley and its collaborators. We read the town's compliance artifact and tested it with public data, then published the briefing and the model together, including the inputs we had to guess. We proposed putting the county's idle farmland back into production under a lease rather than a sale, with the jobs and food that follow. And we sell computing that a business, a farm, a nonprofit or a town hall owns outright, which is a thing we should disclose plainly: an argument that communities need their own means to check official arithmetic is an argument for something we sell. It does not make the argument wrong. It does mean you should check the numbers yourself, which is the entire point, and every source is listed below.

Back to the ground this came from
The Pattern. The town, the ladder, the county's idle farmland, and what a comment period is actually for.
Read the main page
 Write to us

No list, no tracking.

Sources

Working analysis by one valley household and its collaborators. Not legal, planning or financial advice, and not the position of any agency.