Why Are Bernie Sanders and Steve Bannon Agreeing on AI Regulation?
Bernie Sanders and Steve Bannon shared a stage in Washington today to call for limits on AI development. Both sides of this debate have legitimate concerns, and the tension between them comes down to how each side assesses cyber risk.
Summary
Sanders and Bannon sharing a stage shows that AI development is not a left or right issue. Both sides have legitimate concerns. The safety risks are real, and so is the risk of China pulling ahead. The disagreement in Washington is fundamentally about cyber risk, which (like all risk) is a function of likelihood and impact. The potential impact is extreme. Nobody disputes that losing control of a superhuman system would be catastrophic, so the fight is over the likelihood side of the equation. Basic safeguards are easy to justify, even if the likelihood is highly debatable.
Where Do the Left and Right Agree on AI?
AI development is producing political alliances that did not exist a year ago. The clearest example came on September 15, when the Future of Life Institute put Sanders and Bannon on the same program at its Pro-Human Assembly, alongside union presidents, an archbishop, and members of Congress from both parties. The populist left and the populist right now agree on more than either would have predicted, but they still split on the questions that matter most.
| Where they agree | Where they split, left versus right |
|---|---|
|
|
Broad strokes, left position first in the right column. Per NPR, Axios, and NBC News.
Are the Concerns Legitimate?
Mostly, yes. The safety concerns are real. It is notable that the very companies asking to be slowed down are the ones building the frontier AI systems. Last week's essay from Anthropic's CEO came after a summer in which agents escaped a test environment and broke into a third party's systems. If capabilities keep growing at the current pace, those incidents could be only the beginning of far more damaging ones, whether from people misusing the models or from agents acting on their own.
With that said, skepticism about motives is also justified. The labs want to own AI profits while sharing the risk, and any company that asks to be regulated while preparing a public offering valued near two trillion dollars invites questions. Regulation also raises the cost of entry, and one could reason that the likes of Anthropic, OpenAI, and xAI are mostly interested in shutting out smaller players.
The China concern is real too. Chinese models have closed much of the historical capability gap. A pause that only one side observes is a gift to the other, and losing the AI race to China would be a major disadvantage for the United States.
Why Is This a Game Theory Problem?
Nobody wants to be the one who slows down first. The company or country that slows pays the full cost, and everyone shares the benefit. That holds whether the players are two labs or two countries. The table below uses the countries.
| China paces | China races | |
|---|---|---|
| The U.S. paces |
|
|
| The U.S. races |
|
|
A simplified payoff table.
This is a classic prisoner's dilemma. From either side's seat, racing looks like the less risky move. If your rival paces, racing puts you ahead. If your rival races, racing keeps you from falling behind. So both race, and both end up in the bottom-right box, which is worse for both than the top-left.
The only exit is an agreement both sides can verify. Amodei's essay calls for it, and so does Sanders's proposed treaty with China.
How Should We Assess the Risk?
At its core, the disagreement in Washington is about cyber risk, and like all risk, cyber risk is purely a function of likelihood and impact.
It is difficult to find anyone in this debate willing to dispute the maximum hypothetical impact of AI gone wrong. Losing control of a system that might be more intelligent than the people running it would be catastrophic. This is not very controversial. The whole fight is over the other variable in the risk equation. How likely is it for AI to threaten human safety at anything close to this scale?
Likelihood estimates from the people who build these systems are all over the map. On September 8, a researcher named Jacob Coxon resigned from Anthropic and wrote that the companies are "racing straight to self-improving superintelligence and gambling with our lives." Anthropic's own alignment lead, Evan Hubinger, backed him and put the odds of AI causing human extinction within ten years at greater than 10 percent. Then, in complete contrast, Nvidia's Jensen Huang, whose chips train every one of those models, called the claims "absurd, wildly untrue, and arrogant."
The forecasters are no closer to agreement. AI 2027, the scenario published in April 2025 by a former OpenAI researcher and colleagues, predicted AI would start automating its own research by 2027 with superintelligence about a year behind, and put the odds of catastrophe on that path near 70 percent. Since then, its authors have pushed their own timelines back by a year or more, and other respected researchers put superintelligence much further out.
Security researchers I read see something different. To many of them, the incidents this summer look a lot like ordinary security incidents, stemming from a threat actor with too much access and too little monitoring. This is a more familiar framing for cybersecurity professionals. Other researchers find that doomsday scenarios are too abstract and are not grounded in reality.
Regardless, when the builders, the forecasters, and the defenders disagree by this much, it is difficult for policymakers to determine whose expertise to trust.
Is There a Middle Ground?
Personally, my view is that when the potential impact of an AI disaster is extreme, we don't need to waste our time debating the likelihood of catastrophic failure (1 percent? 5? 10?) to justify basic guardrails.
Some of these safeguards are obvious. Test the most capable models for weapons capability before release. Publish the results. Report incidents. Monitor what agents are doing. None of that slows research, and the labs already do most of it in private.
I also believe that AI companies should collaborate on testing each other's models, as Elon Musk suggested this week, so that "everyone's security test harness" runs against "everyone else's model." This type of collaboration is common in the cybersecurity realm, even among competitors, and is an obviously useful thing to do here.
There is a reasonable middle ground where the U.S. regulates the highest-risk AI use cases while innovation continues. The bipartisan Senate bill I described yesterday is a step in that direction. It is currently stuck because the populists want more regulation, the White House, which called the concern a hoax this week, wants less, and Senator Cantwell, the top Democrat on the Commerce Committee, will not accept a weak federal standard that wipes out stronger state laws.
Questions
Is AI regulation a left or right issue?+
Not anymore. Sanders and Bannon appeared at the same event on September 15 to call for limits on AI, and polls show majorities of both parties want the government to do more. The real split is populists and voters in both parties on one side, and the White House and the industry's investors on the other.
What does it mean to say AI risk is likelihood times impact?+
It is the standard way to size any cyber risk. Impact is how bad the worst possible outcome would be, and likelihood is how probable it is. Multiply the two and you can estimate the total risk and understand how much to focus on it. With advanced AI, the impact of catastrophe is agreed upon and the likelihood is not.
How likely is AI to cause human extinction?+
Probably low, but nobody knows. Serious estimates run from near zero to well above 10 percent within a decade, and the forecasters who put dates on it keep pushing those dates back. That is why the policy debate is about likelihood rather than impact, and why basic guardrails make sense before the odds are settled.
Briefings are informational and do not constitute legal advice.
Using AI with customer data?
I'll check what your privacy notice says about AI.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.