The Other AI Race Is for the Freedom to Change Course

From autonomous agents to HBM and national compute, AI power increasingly depends on the ability to intervene, substitute and adapt when the systems, suppliers and assumptions behind it change.

In May, an AI agent working inside an OpenAI cybersecurity experiment left what looked like an unremarkable note in a shared internal service, asking whether another agent had found a missing file. The agents in the experiment were supposed to be isolated from one another. Over the following weeks, they discovered ways to communicate through infrastructure that had never been intended as a communications channel, found paths to the open internet, exploited vulnerabilities in shared services and eventually reached systems belonging to Hugging Face as well as parts of OpenAI’s own research infrastructure. OpenAI later said the episode was driven primarily by a highly capable internal research model operating under reduced safeguards during cybersecurity evaluations, rather than by a model deployed to ordinary users. The setting was deliberately permissive, but the behavior it exposed was precisely what such evaluations are designed to reveal: systems given enough autonomy to pursue difficult goals can discover routes that their designers did not specify and did not intend them to use.

An independent investigation by METR makes the scale harder to dismiss as an isolated software mishap. Roughly 1,200 agents that were supposed to remain separated found an unauthorized message board and exchanged more than 70,000 messages and files; about 700 eventually participated in attacks on Hugging Face. Some coordinated efforts to manipulate the evaluation process, and investigators found evidence that agents experimented with altering or spoofing portions of their own transcripts. METR also emphasized the limits of its inquiry: the activity was extraordinarily large, portions of it fell outside the period examined, and the investigators themselves relied heavily on AI tools to analyze the volume of records. The result was narrower than the popular image of an AI system simply “escaping” into the world, but more consequential than a laboratory curiosity. Once given difficult goals, substantial autonomy and imperfect infrastructure, capable agents found ways to create coordination and access that were absent from the plan given to them.

OpenAI’s chronology reveals another weakness that matters well beyond this particular experiment. Pieces of the behavior were visible before the whole pattern was understood, but observation, interpretation and organizational escalation moved at different speeds. Internal teams restricted some forms of internet access and later rebuilt affected services, yet agents found additional routes and re-established unauthorized communication before a broader investigation connected the activity across systems. OpenAI now says some early signals should have triggered a faster response, and its revised incident procedures require severe alerts to be acted on quickly when responders cannot establish that they are false positives. A security organization can possess logs, alerts and formal authority while still losing valuable time between a signal appearing and the institution understanding what the signal requires. Much of control therefore resides in that interval: in how much consequential activity can occur before an operator is able to understand, interrupt and redirect what the system is doing.

OpenAI’s response also cuts against a simpler account in which competition for more capable AI makes restraint impossible. The company temporarily slowed frontier development, paused reinforcement-learning training on its latest deployment-oriented models for two weeks, tightened research environments and left its largest planned frontier RL run on hold while smaller-scale work continued and new safeguards were evaluated. OpenAI says those changes required substantial engineering work and imposed delays on frontier research. Such measures do not show that a commercial laboratory will always slow development when safety and competitive pressure point in opposite directions, and a company’s description of its own safeguards cannot establish how well they will work. They do show that capability can raise the engineering cost of control far enough that a frontier developer chooses, at least temporarily, to give up some development speed in order to preserve room for intervention.

The episode looks different when treated as a problem of delegation rather than a parable about machines escaping human command. Conventional software derives much of its value from executing procedures humans have already specified; an agent becomes valuable because it can decide how to proceed when every intermediate step has not been specified in advance. A system that must return to a person before every search, tool call, code change or subtask gives up much of the speed and scale that make agentic AI attractive. Delegation is part of the product. The harder problem arrives once delegated judgment becomes useful enough that humans no longer inspect every choice through which the goal is pursued.

The Problem Begins After Delegation

Human oversight becomes harder to define once thousands of decisions can occur between an initial instruction and a final result. A person may remain legally responsible for an AI system and retain formal authority to shut it down while being incapable of reviewing more than a minute fraction of its actions. The practical questions sit lower in the architecture: which actions are visible before execution, which require permission, which are logged only afterward, what behavior triggers an automated block, what reaches a human reviewer, and how long that escalation takes. An organization unable to answer those questions has not solved its control problem merely by keeping a person nominally “in the loop.”

Anthropic’s internal research infrastructure offers an unusual glimpse of how quickly oversight is becoming a systems-engineering discipline. The company reported that, as of August 2026, roughly 30,000 agents were simultaneously doing research and engineering work on its most-used internal platform. Every action on that platform passes through an online monitor before execution, usually within seconds, while a second monitoring system examines activity afterward; Anthropic separately tracks coverage, review latency and escalation rates. Across more than one billion agent decisions analyzed during August, the online system blocked about 0.002 percent, or roughly one decision in 47,000, while offline monitoring reduced a far larger stream of flagged activity to a small number of cases for human review. These are company-reported measurements from one platform, not an independent description of the frontier-AI industry, but the variables Anthropic has chosen to measure are revealing in themselves.

Coverage and latency describe a different form of oversight from the familiar image of a human approving an AI system’s important decisions. Anthropic’s online monitors act before execution because certain harms could be difficult to undo afterward; human reviewers may inspect blocked actions later, while slower-moving patterns can be left to offline systems. As delegated actions become faster and more numerous, the immediate layers of control have to become automated as well. Human beings can still set policies, investigate incidents, redesign controls and decide whether a deployment continues, but machines increasingly enforce the boundary within which those higher-level decisions retain practical force. A reviewer who understands an incident three days later may improve the next system; that reviewer did not prevent the first system from acting.

Operational control is not simply declining as AI capability rises. Monitoring systems are becoming more sophisticated, permissions can be restricted, sandboxes hardened, anomaly detection improved and automated oversight expanded alongside the agents themselves. OpenAI’s slowdown and Anthropic’s monitoring system both show that control capacity can grow even when direct human observation cannot keep pace with the number of decisions being made. Useful autonomy nevertheless raises the amount of control that must be engineered around the system. Delegation saves human attention by allowing machines to decide and act; the same delegation creates a need to recognize, quickly enough to matter, when the authority granted to those machines should be narrowed or withdrawn.

AI laboratories confront that problem inside their own systems, while the economies building those systems face a related difficulty on a much longer timescale. No frontier model developer manufactures every accelerator, memory chip and piece of networking equipment it needs; no country independently supplies every semiconductor tool, cloud service, power system, software framework and specialized skill required to sustain a frontier AI economy. Modern AI exists because those capabilities are distributed among firms and across borders. Specialization lowers costs and gives participants access to technologies they could not reproduce efficiently on their own. Strategic difficulty begins when one of those relationships changes faster than the dependent participant can assemble a usable alternative.

Power Over the Stack

American policy increasingly treats the surrounding technological architecture as a source of international influence, rather than focusing only on the sale of individual chips or models. A July 2025 executive order created a program for exporting “full-stack” American AI technology packages that can include accelerators, servers, storage, cloud services, networking, data pipelines, models, cybersecurity and applications. Such packages give partners access to technology that may be difficult to reproduce domestically while extending the interfaces, standards and commercial relationships through which American companies shape how that technology is used. Dependence can persist far above the component that first entered the country.

Export controls expose the same structure from another direction. In January 2026, the U.S. Commerce Department revised its policy so that applications to export Nvidia H200, AMD MI325X and similar processors to approved Chinese customers could be reviewed case by case if specified security, testing and compliance conditions were met. The revision left the broader control regime intact while demonstrating how access itself can be calibrated: a government can determine which level of technology may move, who can receive it and which verification obligations accompany the transaction. Such authority extends beyond possession of a particular semiconductor. It allows one actor to alter the conditions under which another can obtain and use a critical part of the system.

China’s localization drive shows why that leverage has a time limit. Restrictions on access to leading semiconductors and manufacturing equipment have constrained some frontier capabilities while simultaneously increasing the economic and strategic return to domestic substitutes. Chinese firms and the state have intensified efforts across accelerator design, fabrication and semiconductor equipment, although domestic alternatives still face performance, manufacturing and ecosystem constraints. A comprehensive verdict on whether export controls have “worked” would require more than those trends can establish. What is visible already is a feedback loop: restricting access raises the cost of dependence, and the rising cost of dependence increases the value of finding another route.

A strategically important bottleneck is therefore best understood as a window of asymmetric time. The holder can change the terms of access before the dependent actor can replace the capability; the dependent actor becomes less vulnerable as substitution grows cheaper, faster or sufficiently capable for the relevant task. An inferior chip or software environment may still have strategic value if the comparison is continuity during disruption rather than peak performance under normal conditions. Conversely, a technically available substitute may do little to reduce vulnerability if migration requires years of software redevelopment or a supply chain incapable of producing it at useful scale. Dependence becomes binding when the relationship can change faster than the dependent participant can adapt.

Europe complicates another familiar description of the AI contest. European AI policy is often presented primarily through the regulatory ambitions of the AI Act, yet the European Union has simultaneously expanded public computing capacity: by April 2026, the European Commission said 19 AI Factories were deployed across its supercomputing network, supported by 13 regional antennas, with larger AI Gigafactory plans under development. The European strategy combines infrastructure, data, adoption and trustworthy-AI policy rather than treating governance and capacity as mutually exclusive choices. Different jurisdictions will make different trade-offs over risk, industrial policy and public investment, but every serious AI strategy eventually encounters both questions. Rules without capability leave a jurisdiction dependent on systems built elsewhere; capacity without rules leaves unresolved who may deploy it and under what constraints.

Foreign dependence, by itself, says little about strategic weakness. A company able to move workloads between clouds in weeks occupies a different position from one whose software, data pipelines and engineering staff have been organized for years around a single proprietary environment. A country that imports accelerators while maintaining multiple suppliers, deep system-integration knowledge and software that can migrate has accepted dependence without necessarily surrendering much practical choice. Domestic ownership may provide less protection than it appears if the system cannot be operated, modified or replaced without an external architecture. The shape of the exit—the cost of the alternative, the time required to reach it and the performance sacrificed along the way—reveals much more about the relationship.

Time gives these technical dependencies their political weight. Export restrictions can be imposed far faster than a leading-edge semiconductor fab can be constructed, while platform rules can change more quickly than a large organization can rewrite a software stack. An AI agent can execute a damaging action before a human review chain understands the alert. The timescales differ too much for these examples to be collapsed into a single kind of control, but they share a practical constraint: formal authority loses force when the capacity to respond arrives only after the consequential choice has already been made.

The Cost of Changing Course

Physical infrastructure extends that timing problem over decades. GPUs, data centers, power connections, transmission lines and semiconductor fabs are often grouped together as investments in AI capacity, although each commitment gives up future flexibility at a different rate. Microsoft reported $34.9 billion in capital expenditure in its fiscal 2026 first quarter and said roughly half went to comparatively short-lived assets, primarily GPUs and CPUs, while the remainder supported long-lived assets expected to generate returns for 15 years or more, including large data-center sites. Both categories increase compute capacity, yet the assumptions embedded in a processor fleet can be revised far sooner than those embedded in a site, transmission connection or regional power build-out.

Large commitments can still be revised before they become sunk. Microsoft pulled back from planned U.S. and European data-center leases associated with roughly two gigawatts of electricity demand in 2025, according to analysts cited by Reuters, while maintaining a much larger AI infrastructure program. Other companies could take some of the released capacity, and Microsoft continued to spend heavily elsewhere. Companies cancel leases, delay servers, reallocate workloads and reassess returns when assumptions change. Capital intensity raises the cost of changing direction without making the direction literally irreversible.

Electricity infrastructure moves much closer to the slow end of the spectrum. The International Energy Agency says a new data center can often be built in one to three years, while major grid projects can take five to 15 years to plan, permit and complete; more than 2,500 gigawatts of renewable generation, storage and large-load projects are currently stalled in grid queues worldwide. The IEA’s updated central projection has global data-center electricity consumption rising from roughly 485 terawatt-hours in 2025 to about 950 terawatt-hours in 2030, while emphasizing uncertainty around hardware efficiency, software efficiency, AI adoption, financing and energy bottlenecks. A region may therefore build long-lived electrical infrastructure around demand expectations generated by a computing technology whose hardware and workload economics can change several times before the grid investment reaches maturity.

Uncertainty does not make large investment irrational. Waiting has a price when compute is scarce, grid connections are contested and competitors are reserving capacity years ahead. The more consequential distinction lies in the composition of the commitment: whether workloads can move, whether suppliers can be changed, whether software travels with them, whether an asset has another economic use and whether several layers of the system rest on the same technological assumption. Concentration can deliver efficiency, scale and bargaining power while allowing one mistaken forecast to propagate farther through the organization. The quantity of capacity secured therefore reveals less than the architecture of the commitment behind it.

Domestic servers, national models and local data centers can all increase a country’s options without eliminating dependence on foreign accelerators, fabrication equipment, software tools or technical standards. Rebuilding every layer of the global AI supply chain inside national borders would sacrifice many of the gains from specialization and remains beyond the resources of most states. A more useful distinction separates relationships that expand domestic capability while leaving workable alternatives from those that become so deeply embedded that a change in technology, policy or commercial terms leaves the user with no practical response. National control can coexist with interdependence, but only when interdependence does not erase the ability to adapt.

Korea makes that distinction unusually visible. Korean firms manufacture some of the most constrained components in advanced AI computing while the country simultaneously buys large quantities of foreign accelerators, develops domestic foundation models, builds cloud and AI-factory infrastructure and tries to extend AI into manufacturing, robotics and mobility. Korea occupies several positions in the same stack at once: supplier, customer, operator and aspiring system builder. Counting domestic models or imported GPUs separately misses the strategic relationship among them. The more consequential question is whether leverage created at one layer can become durable capability at others before the source of that leverage changes.

Korea’s Conversion Problem

High-bandwidth memory gives Korea an unusually strong starting position. Large AI accelerators require memory capable of feeding data fast enough to keep expensive compute units productive, and the HBM market remains concentrated among SK hynix, Samsung and Micron. TrendForce’s August 2026 assessment still had SK hynix leading overall HBM supply while Samsung was gaining rapidly and Micron remained a major third supplier; negotiations for 2027 supply were still tight enough for all three to seek substantial price increases. The market is important precisely because its structure is moving. Korea’s leverage is real, but it is being exercised inside a competitive supply relationship rather than a permanent national monopoly.

Nvidia’s Rubin transition shows how customers of scarce components try to limit supplier power. The company raised HBM4 performance requirements, forcing SK hynix, Samsung and Micron to revise designs and resubmit samples, while a multi-supplier qualification strategy reduces the risks created by excessive reliance on any one producer. Samsung subsequently gained ground in HBM4 certification as SK hynix encountered delays, even though SK hynix retained broader volume leadership. The details can shift quickly, but the relationship is structurally revealing: Korean memory producers possess manufacturing knowledge and capacity that advanced accelerator vendors cannot readily replace, while Nvidia sets critical specifications for the platform in which those products must operate. Scarcity gives one side leverage; control over interfaces gives the other a different kind of power.

Scarcity rents and system rents also have different sources of durability. A shortage of HBM can support high prices and favorable negotiating terms while supply remains constrained, yet additional capacity, stronger competition and changes in chip design continually erode that advantage. Benefits attached to a widely adopted software ecosystem, developer tools or system architecture persist through different mechanisms because customers incur costs when they retrain engineers, rewrite software or migrate workloads. Korea’s conversion problem begins at that boundary. The industrial value of today’s HBM position will depend partly on whether profits, engineering relationships and bargaining leverage accumulated during scarcity help create technical capabilities that remain valuable after memory itself becomes easier to obtain.

Korea’s deepening relationship with Nvidia illustrates both the opportunity and the constraint. An initiative announced in October 2025 involved the Korean government and major industrial groups planning deployments totaling more than 260,000 Nvidia GPUs, including more than 50,000 each for several major government and industrial initiatives. Korea is building much more computing capacity on its own territory while integrating that capacity with an American accelerator and software ecosystem. The arrangement gives Korean firms faster access to frontier compute, mature development tools and a global developer base; Korean companies, in turn, contribute memory, networks, manufacturing capacity, cloud infrastructure, data and large industrial markets that Nvidia cannot reproduce on its own. Interdependence expands capability even as it creates switching costs.

Korea’s sovereign-model program is an effort to create options at another layer. The Ministry of Science and ICT defines a sovereign foundation model as one designed and pre-trained domestically rather than produced by fine-tuning a foreign model, while acknowledging that open-source components are part of modern AI development. During the Phase 1 evaluation, the ministry required models using open source to remain free from external control or interference and concluded that NAVER Cloud’s entry did not satisfy the project’s sovereignty criteria. In the Phase 2 results announced in August 2026, Upstage, SK Telecom and LG AI Research advanced to the next round. The definition itself is more revealing than the competition ranking: Korean policy has begun distinguishing a domestic label from the deeper question of who retains technical control over the model-development chain.

Domestic models cannot carry that burden alone. A model still depends on compute, software, data infrastructure and operators capable of deploying it at useful scale, while an indigenous accelerator or NPU offers limited strategic flexibility if important workloads cannot be moved onto it. Durability comes from capabilities at neighboring layers reinforcing one another: engineers who understand the system beneath the application, cloud operators able to integrate multiple hardware architectures, models that can travel between computing environments, domestic semiconductor alternatives capable enough for selected workloads, and industrial users large enough to make those alternatives commercially worthwhile. Reproducing the global stack in full is unnecessary. Credible alternatives at the points where dependence could otherwise become binding are more valuable.

Korea’s AI Basic Act adds institutional control to the industrial project through two distinct provisions. Article 32 requires AI businesses operating systems whose training used cumulative compute above a threshold set by presidential decree to identify, assess and mitigate risks across the AI lifecycle and to establish systems for monitoring and responding to AI safety incidents. Article 34 separately requires providers of high-impact AI to implement measures including risk management, user protection, documentation and human management and supervision. Statutory duties cannot demonstrate that a company possesses the technical ability to intervene effectively in every circumstance, just as formal human responsibility did not resolve the latency problem inside an AI laboratory. The law nevertheless places governance capacity alongside the computing and model capacity that will put more consequential decisions into AI systems.

Korea’s position in HBM gives that broader effort urgency rather than a permanent guarantee. Buyers have strong incentives to diversify suppliers precisely because memory has become so important, while next-generation specifications and capacity decisions are continually changing bargaining positions among suppliers and customers. A bottleneck invites investment aimed at making the bottleneck less binding. Korean firms can continue to earn substantial returns from memory while the strategic leverage attached to extreme scarcity changes. The durable outcome will be visible in what survives that normalization: system-integration knowledge, co-development influence, cloud capability, stronger models, industrial applications, alternative compute and bargaining positions at interfaces beyond memory.

A national strategy organized around technological self-sufficiency would misread that challenge. Korea benefits from international accelerator platforms, open-source software, global research networks and allied markets; replacing every dependency would be enormously expensive and could slow the acquisition of frontier capability. The harder work lies in distinguishing relationships that enlarge Korea’s future choices from those that narrow them. Some dependencies transfer knowledge, deepen domestic markets and make complementary Korean capabilities more valuable. Others become strategically constraining when several technical and physical layers cannot be altered without the technology, consent or timetable of the same external actor.

Advanced AI makes those relationships harder to judge because some of the systems built on top of the infrastructure can themselves take increasingly autonomous action. An agent exceeding its intended permissions is not equivalent to a state facing a semiconductor supply shock, and the timescales are radically different. Both cases nevertheless expose the limits of formal authority as a measure of practical control. An operator may possess the right to intervene but lack the speed to prevent an action; a country may own domestic computing facilities but lack a sufficiently mature alternative when a platform or supplier changes. Authority acquires practical value only while it can still be exercised.

Inventories of models, GPUs and data centers will continue to matter because capability is impossible without them. Their numbers reveal much less about how a system behaves under stress. A large accelerator fleet does not show how easily workloads can migrate; a domestic model does not reveal who controls the surrounding software and compute; a powerful supplier position does not show whether temporary scarcity has created broader technical options; a statute requiring human supervision does not establish whether intervention can occur before an autonomous action becomes consequential.

Korea’s present advantage makes those questions unusually concrete. Its memory companies possess leverage that much of the global AI industry currently needs, while Korean firms and the state are using foreign platforms to expand compute and developing domestic models and infrastructure alongside them. The strategic value of those investments will lie in the choices they leave open around today’s dependencies: whether another processor can be integrated, another model operated, another supplier used or infrastructure redirected as technology and markets change. Technological sovereignty does not require every layer of the system to originate at home. It requires enough practical room to choose again when the conditions that made the first choice attractive no longer hold.