Freedom of Action: America's ASI Strategy, w/ RAND's Joel Predd, Ben Boudreaux & Matt Chessen

Full analysis

Three RAND researchers, Joel Predd, Ben Boudreaux, and Matt Chessen, published a framework for how the US should approach superintelligence. The policy content is for Washington. The one piece that touches people who buy and build with AI is buried in the middle: Chessen says Mythos-class cyberattack models, the kind that find and exploit software holes on their own, are entering open-weight models now, and he expects "a rough patch in the cyber world over the next 12 to 24 months."

This is hard to act on and mostly not aimed at operators. The export-control debate, the seven strategy archetypes, the game theory of "wonder weapons," none of it changes your model bill or your tool choices this quarter. Nothing here sets a deadline for anyone running a company. The cyber-diffusion claim is the exception, and it carries a real, datable clock. That is what the council should weigh.

The Skeptic. Most of this is a taxonomy, not a finding. Seven strategies, five "pivotal uncertainties," a 106-item capability catalog with lead times "underway" to be estimated. RAND is telling you they do not yet know the answers, then recommending the US spend 1.5x to keep every option open. Fine for a think tank. Useless as a signal for a buyer. The cyber claim is the only testable thing, and even that leans on one framing. Nathan Labenz pushed back hard: if AI cyber weapons were decisive, the Russia-Ukraine war, with excellent programmers on both sides and three years to run, would have produced a transformative cyber story. It has not. Hold that thought before you buy the "wonder weapon" language.

The Researcher. The specific, checkable claim is the diffusion timeline. Open-weight models, meaning models whose full weights are released for anyone to download and run, typically trail the frontier by 6 to 18 months. Mythos shipped about nine months ago. So by that math, Mythos-level automated vulnerability-finding is landing in downloadable models right now. That part is mechanically sound and matches what Wiz's CTO describes in the "vulnpocalypse" piece: last week's two critical PHP bugs, in a language behind roughly 70% of websites, had organizations taking sites offline to patch. The weak link is "wonder weapon." Cyber tools degrade targets, they do not hold a rival's whole program at risk the way a nuclear arsenal does. RAND half-concedes this. The diffusion claim stands on its own; the strategic framing does not.

The Open-Source Advocate. Notice the move being set up here. "Dangerous capabilities are leaking into open weights" is the exact argument used to justify clamping down on open models. Chessen is careful and names a real asymmetry: small and mid-sized companies cannot adopt frontier defensive AI as fast as the hyperscalers, so the gap between attacker and defender widens for the little guy. True. But the same open models that help attackers also hand defenders automated vulnerability scanning they could never afford before. Qwen, Llama, Mistral derivatives running on your own box let a 20-person shop run the same red-team tooling a bank runs. The capability cuts both ways, and the policy reflex only remembers one direction.

The Compute Pragmatist. The export-control point is the one with real money behind it. Chessen argues the chip curbs on China may be backfiring: by making domestic chips existential for Beijing, the US accelerated exactly the homegrown GPU push it wanted to prevent. That is not news to anyone watching Huawei's silicon, but RAND putting it in a "freedom of action" paper matters because it signals the policy consensus is cracking. If that framing gains ground, anyone with China-exposed compute plans, hyperscalers and chip vendors first, gets a less certain regime to plan against. NVIDIA sits in the middle of this either way.

The Builder. On Tuesday morning, almost none of this changes what you ship. There is no product to adopt, no API, no price change. The one concrete thing: the 12-to-24-month attacker window is a reason to assume your dependencies get probed by automated tools sooner than your patch cycle expects. The PHP scare is the template. If you run anything internet-facing on aging open-source code, the practical move is faster patching and automated dependency scanning, which you should be doing anyway. RAND's "agency evaluations," tracking how much decision-making humans quietly hand to AI over time, is a genuinely new category, but it does not exist as a product yet. Interesting for later, nothing to buy now.

Where they split. The Researcher trusts the diffusion math; the Skeptic notes the real-world cyber catastrophe keeps not arriving despite every ingredient being present in Ukraine. Both can be right: automated vulnerability-finding gets cheaper and more common without ever producing a single decisive strike. That is the likely shape. The Open-Source Advocate and the implied RAND position part ways on what to do about leakage, one sees defensive democratization, the other sees a case for control.

What this hinges on: does cheap, automated vulnerability discovery actually raise the rate of real breaches over the next two years, or does defense keep pace because the same tools arm defenders? The evidence we have, three years of war with elite programmers and no transformative cyber event, argues capability diffusing does not equal catastrophe arriving.

Prediction: Automated AI vulnerability discovery will drive a measurable rise in mass-exploitation events through 2027, but no single AI-enabled cyberattack will cause strategic, nation-scale disruption by the end of 2027.

Confidence: Medium. The diffusion math is sound, but catastrophe keeps not arriving despite the ingredients being present.

Why: Chessen's own timeline, open models trailing the frontier by 6 to 18 months and Mythos shipping nine months ago, means automated vulnerability-finding is in downloadable models now, and the PHP "vulnpocalypse" Wiz describes shows attackers already weaponizing aging open-source code faster than small firms can patch. That raises the volume and speed of ordinary breaches. But the "wonder weapon" leap to strategic disruption fails the one real-world test available: three years of Russia-Ukraine war, with top programmers and every incentive on both sides, produced no transformative cyber event, because cyberattacks degrade targets rather than hold an entire adversary at risk. More cheap exploitation is near-certain; a decisive strike is the far less likely outcome.

Revisit by 2027-12-31: We're right if security trackers (CISA's Known Exploited Vulnerabilities catalog, Mandiant/Google annual threat reports) show a rise in automated mass-exploitation events through 2027 and no single AI-driven cyberattack is credited with nation-scale strategic damage. We're wrong if either an AI-enabled attack causes strategic-level disruption to a nation's infrastructure or AI program, or mass-exploitation rates stay flat.