Every commercial airliner carries a box that will, in a genuine emergency, tell the pilot to climb while telling the pilot of the oncoming aircraft to descend. For that to work, both boxes must run the same logic, negotiate over the same data link, and agree in advance who yields. Rival carriers, rival manufacturers, one shared protocol. Nobody calls it a cartel. It is simply the only arrangement in which the geometry works out.
That is roughly the shape of the argument now sitting between Anthropic and Nvidia. In 2026, Jensen Huang publicly criticized an Anthropic AI safety proposal, and the criticism traveled fast. The specifics of what was proposed, and what exactly Huang objected to, have not been made public. So treat what follows as analysis rather than reporting, because the interesting part is not the quote. It is the structural question underneath it, which anyone building agent systems will eventually have to answer.
Why safety coordination is an architecture problem
Most safety work at a single lab is local. You align a model, red-team it, write a system card, ship it behind rate limits and refusal policies. That work stays inside your own boundary, and competition arguably makes it better: reputational risk is a real incentive, and labs poach each other’s ideas about evaluation constantly.
Agent systems break that neat boundary. Once models act — call tools, hold credentials, spawn subagents, transact with other agents built by other companies on other stacks — the failure modes stop being properties of a model and start being properties of an interaction. A few examples of what only exists between systems:
- Identity and provenance. When an agent contacts a service, does that service know it is an agent, whose agent, and acting under what delegated authority? That requires a shared credential format, not a proprietary one.
- Interruption semantics. If an agent’s plan needs to be stopped mid-execution across three vendors’ infrastructure, someone has to define what “stop” means and who is obligated to honor it.
- Incident information sharing. A jailbreak that generalizes across architectures is useful intelligence for defenders and dangerous intelligence to publish. The disclosure channel between competitors is the thing that has to be designed.
- Escalation thresholds. If two labs independently discover a capability that neither wants to release, both know the other faces the same commercial pressure to release it anyway.
That last item is where antitrust law becomes non-hypothetical. A conversation between competitors about jointly withholding a capability from the market looks, from a purely legal angle, uncomfortably like a conversation about restricting output. Intent does not launder structure. This is why safety-motivated waiver requests keep surfacing, and it is a real problem, not an imagined one.
Two ways to read the objection
Huang’s stated position, as reported, was that such a waiver is unnecessary. Without the details, there are at least two defensible versions of that view, and they lead to different engineering futures.
Version one: the existing rules already permit it
Standards bodies exist. Joint safety research exists. Shared benchmarks, interoperability specs, and information-sharing organizations exist across industries that carry far more physical risk than inference does. On this reading, a waiver is not a shield anyone needs; it is a request for permission to do something that is already allowed, and asking for it implies the activity is more legally fraught than it actually is.
Version two: the waiver would do more than safety work
The less charitable reading is about who benefits. A formal exemption that lets a small set of frontier labs coordinate on what capabilities reach the market is also, mechanically, a mechanism for setting the ceiling of the market. Whoever sits inside the room defines the ceiling. Whoever sits outside — open-weight projects, smaller labs, hardware vendors whose business depends on broad demand for compute — inherits it. Nvidia sells to everyone, so a policy that narrows who may legitimately build at the frontier is not a neutral policy from where it stands.
What I would actually want to see
Both readings can be true at once, which is why “necessary or unnecessary” is the wrong axis. The useful question is scope. Coordination on interfaces — identity, provenance, kill-switch semantics, incident reporting formats, evaluation methodology — is closer to the collision-avoidance case: it enables competition on capability while making the shared environment survivable. Coordination on what to withhold is closer to the thing antitrust law exists to catch, and it deserves the friction it gets.
The unsatisfying part of this story is that we are debating a proposal whose text has not been laid out publicly, refracted through a criticism whose reasoning has not been laid out either. For those of us who care about how agent systems actually interoperate, that is backwards. Publish the mechanism. Then we can argue about whether it is safety infrastructure or a fence.
🕒 Published: