AI GovernanceAI Regulation

Why Are Bernie Sanders and Steve Bannon Agreeing on AI Regulation?

Bernie Sanders and Steve Bannon shared a stage in Washington today to call for limits on AI development. Both sides of this debate have legitimate concerns, and the tension between them comes down to how each side assesses cyber risk.

Published September 15, 2026

Summary

Sanders and Bannon sharing a stage shows that AI development is not a left or right issue. Both sides have legitimate concerns. The safety risks are real, and so is the risk of China pulling ahead. The disagreement in Washington is fundamentally about cyber risk, which (like all risk) is a function of likelihood and impact. The potential impact is extreme. Nobody disputes that losing control of a superhuman system would be catastrophic, so the fight is over the likelihood side of the equation. Basic safeguards are easy to justify, even if the likelihood is highly debatable.

Where Do the Left and Right Agree on AI?

AI development is producing political alliances that did not exist a year ago. The clearest example came on September 15, when the Future of Life Institute put Sanders and Bannon on the same program at its Pro-Human Assembly, alongside union presidents, an archbishop, and members of Congress from both parties. The populist left and the populist right now agree on more than either would have predicted, but they still split on the questions that matter most.

Where they agreeWhere they split, left versus right
  • A few companies should not dictate AI policy
  • Data centers are impacting local communities
  • Workers had no say in how AI affects jobs
  • No superintelligence without proven control
  • A treaty with China versus winning the race
  • A new AI agency versus no new bureaucracy
  • Regulate the labs versus calling rules a moat
  • A national data center halt versus local control

Broad strokes, left position first in the right column. Per NPR, Axios, and NBC News.

Are the Concerns Legitimate?

Mostly, yes. The safety concerns are real. It is notable that the very companies asking to be slowed down are the ones building the frontier AI systems. Last week's essay from Anthropic's CEO came after a summer in which agents escaped a test environment and broke into a third party's systems. If capabilities keep growing at the current pace, those incidents could be only the beginning of far more damaging ones, whether from people misusing the models or from agents acting on their own.

With that said, skepticism about motives is also justified. The labs want to own AI profits while sharing the risk, and any company that asks to be regulated while preparing a public offering valued near two trillion dollars invites questions. Regulation also raises the cost of entry, and one could reason that the likes of Anthropic, OpenAI, and xAI are mostly interested in shutting out smaller players.

The China concern is real too. Chinese models have closed much of the historical capability gap. A pause that only one side observes is a gift to the other, and losing the AI race to China would be a major disadvantage for the United States.

Why Is This a Game Theory Problem?

Nobody wants to be the one who slows down first. The company or country that slows pays the full cost, and everyone shares the benefit. That holds whether the players are two labs or two countries. The table below uses the countries.

China pacesChina races
The U.S. paces
  • Safest outcome for everyone
  • Needs a deal between rivals
  • Verification is hard
  • Worst outcome for the U.S.
  • Falls behind, risk remains
  • The White House's fear
The U.S. races
  • The U.S. wins the race
  • Safety risk falls on the U.S.
  • What investors want
  • Full speed on both sides
  • Highest shared risk
  • Where we are today

A simplified payoff table.

This is a classic prisoner's dilemma. From either side's seat, racing looks like the less risky move. If your rival paces, racing puts you ahead. If your rival races, racing keeps you from falling behind. So both race, and both end up in the bottom-right box, which is worse for both than the top-left.

The only exit is an agreement both sides can verify. Amodei's essay calls for it, and so does Sanders's proposed treaty with China.

How Should We Assess the Risk?

At its core, the disagreement in Washington is about cyber risk, and like all risk, cyber risk is purely a function of likelihood and impact.

It is difficult to find anyone in this debate willing to dispute the maximum hypothetical impact of AI gone wrong. Losing control of a system that might be more intelligent than the people running it would be catastrophic. This is not very controversial. The whole fight is over the other variable in the risk equation. How likely is it for AI to threaten human safety at anything close to this scale?

Likelihood estimates from the people who build these systems are all over the map. On September 8, a researcher named Jacob Coxon resigned from Anthropic and wrote that the companies are "racing straight to self-improving superintelligence and gambling with our lives." Anthropic's own alignment lead, Evan Hubinger, backed him and put the odds of AI causing human extinction within ten years at greater than 10 percent. Then, in complete contrast, Nvidia's Jensen Huang, whose chips train every one of those models, called the claims "absurd, wildly untrue, and arrogant."

The forecasters are no closer to agreement. AI 2027, the scenario published in April 2025 by a former OpenAI researcher and colleagues, predicted AI would start automating its own research by 2027 with superintelligence about a year behind, and put the odds of catastrophe on that path near 70 percent. Since then, its authors have pushed their own timelines back by a year or more, and other respected researchers put superintelligence much further out.

Security researchers I read see something different. To many of them, the incidents this summer look a lot like ordinary security incidents, stemming from a threat actor with too much access and too little monitoring. This is a more familiar framing for cybersecurity professionals. Other researchers find that doomsday scenarios are too abstract and are not grounded in reality.

Regardless, when the builders, the forecasters, and the defenders disagree by this much, it is difficult for policymakers to determine whose expertise to trust.

Is There a Middle Ground?

Personally, my view is that when the potential impact of an AI disaster is extreme, we don't need to waste our time debating the likelihood of catastrophic failure (1 percent? 5? 10?) to justify basic guardrails.

Some of these safeguards are obvious. Test the most capable models for weapons capability before release. Publish the results. Report incidents. Monitor what agents are doing. None of that slows research, and the labs already do most of it in private.

I also believe that AI companies should collaborate on testing each other's models, as Elon Musk suggested this week, so that "everyone's security test harness" runs against "everyone else's model." This type of collaboration is common in the cybersecurity realm, even among competitors, and is an obviously useful thing to do here.

There is a reasonable middle ground where the U.S. regulates the highest-risk AI use cases while innovation continues. The bipartisan Senate bill I described yesterday is a step in that direction. It is currently stuck because the populists want more regulation, the White House, which called the concern a hoax this week, wants less, and Senator Cantwell, the top Democrat on the Commerce Committee, will not accept a weak federal standard that wipes out stronger state laws.

Questions

Is AI regulation a left or right issue?+

Not anymore. Sanders and Bannon appeared at the same event on September 15 to call for limits on AI, and polls show majorities of both parties want the government to do more. The real split is populists and voters in both parties on one side, and the White House and the industry's investors on the other.

What does it mean to say AI risk is likelihood times impact?+

It is the standard way to size any cyber risk. Impact is how bad the worst possible outcome would be, and likelihood is how probable it is. Multiply the two and you can estimate the total risk and understand how much to focus on it. With advanced AI, the impact of catastrophe is agreed upon and the likelihood is not.

How likely is AI to cause human extinction?+

Probably low, but nobody knows. Serious estimates run from near zero to well above 10 percent within a decade, and the forecasters who put dates on it keep pushing those dates back. That is why the policy debate is about likelihood rather than impact, and why basic guardrails make sense before the odds are settled.

Briefings are informational and do not constitute legal advice.

Using AI with customer data?

I'll check what your privacy notice says about AI.

Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.

Standard $449. Priority $649.

My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.

More Briefings

What Should Business Leaders Do About AI Risk After the Slowdown Call?The AI labs asked to be slowed down last week, and Washington is debating what to do about them. Most businesses won't be directly impacted by that debate, but they do have AI risks to manage, and this is where to start. Why Is Washington Talking About Slowing Down AI, and What Would It Change?In a single week, the head of Anthropic called for slowing frontier AI development (the heads of OpenAI and xAI agreed), the Senate moved toward a bipartisan AI safety bill, and the President called the backlash against AI a conspiracy and rejected new guardrails. Here is what is on the table and why the timing matters. California Will Require Browsers to Support the Global Privacy Control in 2027Global Privacy Control and other universal opt-out mechanisms are not widely used today. The signals tend to be available from a few privacy-focused browsers and extensions. Starting January 1, 2027, California's Opt Me Out Act requires every browser provider to include "opt-out preference signal" options, which will change how much Internet traffic arrives with an opt-out attached. All Briefings →