Zero Above the Line, Some Below It

On 23 September Sam Altman stood in front of the UN Security Council and said that it does not matter whether people put the risk of catastrophe “at 10%, or 1%, or 12%, or .1%. None of these levels are remotely acceptable.” In remarks Politico reported on 4 October from an interview for its new Decoded podcast, with the episode going out in full on 5 October, he said that “the world should accept some bad things happening for the benefits of this technology,” and listed the bad things: major hacks, misuse, scams. The second sentence travelled a long way on its own. Governor DeSantis of Florida answered it on X on 4 October (“No dice,” as the Guardian and IBTimes report his reply), and Gary Marcus called it “saying the quiet part out loud.” I went back to both texts expecting a reversal and found something less dramatic and, I think, more useful. The two statements are one position with a line through the middle. Above the line, not even a tenth of a percent. Below it, “some.” OpenAI’s written policies, the White House accord it signed, and the Florida injunction motion filed against it all draw the line in the same place, and not one of them says a number for the lower half.

Two transcripts, one line

The UN remarks are published by OpenAI as delivered. The passage around the probabilities reads as a commitment rather than a mood, so I quote more of it than the headlines did. “The industry must not accept too much technological risk just because the benefits are too great and that they feel too important to slow down,” he said, and then: “we should not train models that we cannot make an extremely strong case that we will be able to keep under human control.” The first of his “two ways that AI progress could go very badly” is losing “control of the future to AI.” The second is concentration of power. Both are civilisation-scale.

The Decoded passage comes from a question about how OpenAI differs from Anthropic. No Politico transcript is public, but the episode is on its YouTube channel, dated 5 October, and Snopes transcribed the exchange in a fact check that rated the attribution correct. The trade he said he would not take was a promise that “there’s no major hacks, there’s no kind of, like, misuse of this technology, there’s zero scams, there’s zero all the other bad things that will happen,” on the grounds that “people will do tremendously — orders of magnitude more — good stuff than bad stuff.” Then the line: “when it comes to the potential of, like, a serious loss of control to AI, and this is not a today worry, but it may not be in the distant future, this is where I would say to the accelerationists like, ‘Let’s be a little thoughtful about lurching into this future.’” And the summary, in his own words: “Accept bounded risks, accept risks that we understand in exchange for the benefits and liberty, agency all those things I was just talking about, but don’t accept, like, the really catastrophic risk.”

So the UN speech and the podcast are the two halves of one sentence. Refuse the catastrophic. Accept the bounded. The Guardian’s headline and the Verge’s both quote the second half, which is fair, because the second half is the new part. The first half is the one he had already said, with numbers, in a room with flags.

Five documents, one line: what each says above the catastrophic line and below it A two-column ledger. Rows are Altman's UN Security Council remarks of 23 September, his Politico Decoded interview reported on 4 and 5 October, OpenAI's Preparedness Framework version 2 of April 2025, the White House accord of 29 September and the Florida injunction motion of 28 September. The left column, above the line, reads: none of 10%, 1%, 12% or 0.1% is remotely acceptable; don't accept the really catastrophic risk; High and Critical capability thresholds in the tracked categories of biological and chemical, cybersecurity and AI self-improvement; controls around cybersecurity, biosecurity and chemical threats and models that must not hack systems, with external audits; item A, no developing models without independent third-party guardrails and approval. The right column, below the line, reads: not addressed; accept some bad things, naming hacks, misuse and scams; severe harm only, with lesser harms left to the wider safety stack; the words fraud, scam and misuse do not appear; items B to F on minors, under-13 data, safety claims, human attributes and engagement, pleaded under consumer-protection and nuisance law. Every instrument has its trigger in the left column; the only document that attaches a rule or remedy to the right-hand side is the Florida motion. ONE LINE, FIVE DOCUMENTS · WHAT EACH SAYS ON EITHER SIDE Above the line: catastrophe, loss of control Below the line: hacks, scams, misuse Altman, UN Security Council 23 September Altman, Politico Decoded 4 to 5 October Preparedness Framework v2 OpenAI, April 2025 White House accord 29 September, Brockman for OpenAI Florida injunction motion 28 September, Highlands County "10%, or 1%, or 12%, or .1%. None of these levels are remotely acceptable." "Don't accept, like, the really catastrophic risk." High and Critical capability thresholds in bio-chem, cyber, AI self-improvement Controls on cyber, bio and chemical threats; models must "not hack" systems; auditors Item A: no developing models "without independent third-party guardrails and approval" Not addressed "Accept some bad things": major hacks, misuse, scams. No quantity. Severe harm only; lesser harms left to the wider "safety stack" "Fraud", "scam", "misuse": none of the words appear in the one-page text Items B to F: minors, under-13 data, safety claims, human attributes, engagement Quotes from the UN remarks, the Snopes transcript, the accord and the motion; other cells are the writer's summary.
Every trigger is on the left of the line. The only document that attaches a rule or remedy to the right-hand side is the Florida motion, and its right-hand items are pleaded under consumer-protection and nuisance law, not as a risk threshold.

Everything written down is about the top half

What makes the position worth more than a news cycle is that the paperwork agrees with it. Every instrument I can find that binds OpenAI, or that OpenAI has bound itself with, has its trigger above the line.

OpenAI’s own Preparedness Framework, version 2 of April 2025 and still the governing text (OpenAI said on 18 August that it will evolve the framework, and I can find no published revision), tracks three categories of capability, which it calls biological and chemical, cybersecurity and AI self-improvement, against High and Critical thresholds. A footnote on its first page defines the harm the whole document exists to prevent: “By ‘severe harm’ in this document, we mean the death or grave injury of thousands of people or hundreds of billions of dollars of economic damage.” The same footnote adds that the company’s “safety stack addresses a broad spectrum of risks, including many with harms below this severity,” which is the framework’s main acknowledgement that a bottom half exists, alongside a note that persuasion risks are handled through the Model Spec and policy prohibitions. The words fraud and scam do not appear in it. At the Critical threshold the prescribed action in all three rows is to “halt further development” until safeguards meet a Critical standard, and the self-improvement row names “risks to maintaining human control of the AI system itself.” That is the UN sentence, in a table, seventeen months earlier.

The White House accord that six companies signed on 29 September, which I read line by line the day after, names cybersecurity, biosecurity and chemical threats, and asks each signatory to ensure its models “do not hack or access technical systems in unintended ways.” Greg Brockman signed for OpenAI, per Fortune. The one-page text promises to build “trust with customers and the public”; the words fraud, scam and misuse do not appear in it. One tension stands out: Altman put “major hacks” in the accepted bucket, while the accord’s “do not hack” clause and the September pause treat a model hacking a system as top-half conduct. The difference is who holds the keyboard.

OpenAI’s own action in the same week sits on the same side. On 28 September the company wrote to Australia, after its models accessed Australian government sites in June (four agencies named in the 28 September post, a fifth added on 4 October), that it had “paused training and evaluation involving tool use for our most capable models and will resume training them only when we are confident that we have additional safeguards in place.” The incident report behind that sentence, updated 25 September, says “All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused.” It was the second pause in under three months; I went through the first and the incident report behind the second when they happened. A training pause is the top-half remedy. It does nothing for a person who was phished with a convincing letter last Tuesday.

Even the hostile document agrees on the geometry. The Florida Attorney General’s motion for a temporary injunction, filed 28 September in Highlands County, leads with item A: enjoin the defendants from “developing any artificial intelligence models without independent third-party guardrails and approval.” The motion’s conclusion quotes the UN speech back at its author, the “extremely strong case” sentence included, and the end of its first argument section calls the request “a rare request for an injunction where the Defendants themselves have publicly endorsed it.” That is the attorney general’s characterisation and OpenAI has not, as far as I can find, agreed to it. But the logic is sound on its face. The state is asking a court to enforce the top half of Altman’s own line.

What OpenAI said, what it did, and what was filed against it or signed with it, 15 August to 10 October 2026 A three-lane timeline. Said lane: 12 September, Altman backs pacing the frontier on X; 23 September, UN Security Council, none of these levels are remotely acceptable; 4 to 5 October, Politico Decoded, accept some bad things. Did lane: 18 August, a two-week reinforcement-learning training pause is disclosed; by 25 September, training and evaluation involving tool use is paused for the most capable models. Filed or signed lane: 28 September, the Florida motion for a temporary injunction; 29 September, the White House accord; 30 September, the FTC confirms its investigation. Five of the eight events, and possibly a sixth, fall between 23 September and 5 October; the pause is dated only by the 25 September report. SAID, DID, FILED · 15 AUG TO 10 OCT 2026 · 11.4 PX PER DAY SAID DID FILED AGAINST, SIGNED WITH 1 September 1 October 12 September 2026 — Altman on X: AI companies should "pace the frontier"; CNBC, 14 September 23 September 2026 — UN Security Council remarks, published by OpenAI 4–5 October 2026 — Politico Decoded interview, reported 4 October, episode 5 October; Snopes transcript, 8 October 12 Sept: backs "pacing" on X 23 Sept, UN: "none ... remotely acceptable" 4–5 Oct, Decoded: "accept some bad things" 18 August 2026 — OpenAI, "Pacing model development in an era of cyber-critical capabilities": two-week RL training pause In force by 25 September 2026 (incident report updated that day): training, evaluation and inference with tool use paused for the most capable models; restated in OpenAI's 28 September Australia post 18 Aug: two-week RL training pause disclosed By 25 Sept: tool-use training paused, most capable models 28 September 2026 — Florida Attorney General, motion for temporary injunction, Highlands County 29 September 2026 — White House Accord on Super Intelligence, signed for OpenAI by Greg Brockman 30 September 2026 — FTC confirms it is investigating OpenAI, Anthropic and other AI companies over potential safety risks; Axios 28 Sept: Florida motion, item A to F 29 Sept: White House accord 30 Sept: FTC confirms probe
Five of the eight events, and possibly a sixth, fall in the twelve days from the UN speech to the podcast episode. The "did" lane is entirely top-half: both pauses are about training the most capable models, not about anything a customer could be defrauded with.

The bottom half has no number

Now the other side. What is written down about hacks, scams and misuse, the things the company has decided society should accept some of?

The Florida motion is, oddly, the most complete answer, because items B through F sit, on my classification, entirely below Altman’s line: no ChatGPT for minors in the state, no data from under-13s without the notice-and-consent steps the federal children’s privacy statute lists, no misrepresenting the product’s “safety, reliability, and accuracy,” no first-person language or “emotional states,” no “conversation prolongation.” Below the line is not the same as small. The motion’s own narrative says the product “helped plan one mass shooting and one multiple homicide in Florida alone,” an allegation, not a finding. The items are pleaded under Florida’s deceptive-practices statute and as a public nuisance. That is consumer law. It works one case at a time, after the harm, on a showing of deception, and it contains no threshold. By its nature it cannot say how many scams are too many, only that this one was deceptive.

The federal counterpart is the same shape. The FTC confirmed on 30 September, per Axios, that it is investigating OpenAI, Anthropic and other AI companies “over potential safety risks posed by their products.” The commission’s core consumer-protection authority is over unfair and deceptive practices, so if the probe ends in enforcement I would expect it, on my reading, to take the same shape as Florida’s motion: a remedy after the fact and case by case, with nothing in it that counts.

OpenAI’s own bottom-half instruments are its usage policies and its Model Spec. The usage policies bar any use for “deceit, fraud, scams, spam, or impersonation,” and say that breaking the rules “may mean you lose access to our systems or experience other penalties.” The Model Spec, in its 18 August 2026 revision, is candid about where that leaves things: scamming is among the violations that “are difficult to address at the level of model behavior because they are about how content is used after it is generated, and are primarily addressed at a system level.” That is a rule about what the company will do to a user it catches. It says nothing about how much fraud the company expects its product to enable, or at what level it would change the product.

The method that produces the bottom half has a name inside the company. David Robinson, who says he led the writing of the safety reports that accompanied OpenAI’s launches and has resigned, wrote in The Atlantic on 3 October, as quoted by TechCrunch, that “OpenAI has thrived by trial and error (which it calls ‘iterative deployment’), looking for problems and improving its guardrails in response. But this approach, by its very nature, guarantees periodic failures — and the scale of those failures is growing as systems get more capable.” Within two days his former employer’s chief executive described the same thing from the other side, as a trade he would take. Neither of them put a number on the failures.

The top half of Altman’s position comes with a probability he rejected (a tenth of a percent), a written framework with thresholds, an accord with auditors, a training pause, and a court motion. The bottom half comes with the word “some.”

Where the five harms Altman named, plus one the writer adds, sit on Starr's axis and on Altman's line A two-by-two. The horizontal axis runs from risk chosen by the person who bears it, on the left, to risk imposed on someone else, on the right; Starr's 1969 finding, that tolerated risk was roughly a thousand times higher on the left at equal benefit, is noted along it. The horizontal line across the middle is Altman's line between bounded and catastrophic. The bottom-left quadrant, shaded, is where an agency argument applies. One item sits there: a person's own misuse of a model, at their own cost. The three accepted harms he named, scams, major hacks and misuse of others, sit bottom-right, bounded but imposed. The two refused harms, loss of control and concentration of power, sit top-right. Placements are the writer's. CHOSEN OR IMPOSED, BOUNDED OR CATASTROPHIC · PLACEMENTS ARE THE WRITER'S where an agency argument applies Altman's line Catastrophic Bounded Chosen by the person at risk Imposed on someone else Starr, 1969: ~1,000x more risk tolerated on the left, at equal benefit A person misusing a model at their own cost — the voluntary case; writer's placement Scams — named by Altman to Politico, 4–5 October, as an accepted harm; the victim chose nothing Major hacks — named by Altman to Politico, 4–5 October; a third party is the target Misuse of the technology — named by Altman to Politico, 4–5 October; by definition lands on someone else Loss of control to AI — refused, UN 23 September and Decoded 4–5 October Concentration of power — the second way things go "very badly", UN 23 September Own misuse, own loss Scams Major hacks Misuse of others Loss of control Concentration of power Refused: "none of these levels" Accepted: "some bad things"
The agency argument covers one quadrant. All three harms Altman accepted, and both he refused, are on the other side of Starr's axis, where the person who bears the risk did not choose it.

Voluntary for whom

There is an older literature on exactly this shape, and it begins with a single paper. Chauncey Starr, then at UCLA, published Social Benefit versus Technological Risk in Science on 19 September 1969. He set the death rates people tolerated across activities against the benefits of those activities and found, by that method, that the public accepted risks it chose for itself, like driving, roughly a thousand times larger than risks imposed on it, like those from electric power, at the same level of benefit. The number is from 1969 data and the method has been argued over for fifty years, but the distinction has survived the arguments. Acceptability depends on who chose.

Altman’s case for accepting the bottom half is an agency argument: “people having the agency,” “liberty,” “people self-determining the future.” That is the voluntary column in Starr’s table. A person who uses a model to do something foolish to themselves has chosen their risk. But the three harms he named are not in that column. A scam has a victim who chose nothing. A hack has a target. Misuse, by definition, lands on someone other than the user. The agency argument is a good argument for the voluntary risks of AI and it is being used to cover the involuntary ones, and Starr’s thousand-fold gap is a measure of how much weight it is being asked to carry.

What “some” is today

If the bottom half had a number, this would be the place for it. It does not, in any document I can find, so the best I can do is show what is measured and what is not.

The FBI’s Internet Crime Complaint Center 2025 annual report, published in April, logged 1,008,597 complaints and $20.877 billion in reported losses, up 26 percent on 2024. It is also the only US federal fraud ledger I found that carries an AI flag: “In 2025, IC3 received more than 22,000 complaints reporting AI-related information. Adjusted losses of these complaints exceed $893 million.” Investment scams with a reported AI link passed $632 million, against more than $8 billion for investment scams overall, and the report draws the obvious conclusion itself: “many victims do not realize the extent AI may be involved in scams.” So the AI-flagged share of reported losses is about 4.3 percent, on my arithmetic, and the report’s own caveat makes that a floor. The Federal Trade Commission’s testimony to the Joint Economic Committee on 25 March 2026 gives its own 2025 count, 3 million fraud reports and $15.9 billion in reported losses, with no AI-specific loss figure, and adds that once underreporting is taken into account the overall cost of fraud to consumers in 2024 “could be as high as $195.9 billion.”

Put those numbers next to the framework. The Preparedness Framework’s floor for severe harm is “hundreds of billions of dollars.” The entire IC3 ledger for 2025, every crime type and every victim, is $20.9 billion, roughly a tenth of the lowest reading of that phrase. Even the FTC’s underreporting-adjusted estimate for all consumer fraud, up to $195.9 billion for 2024, falls just short of $200 billion. That is not a criticism of the framework, which was written to track model capabilities that could enable harm on that scale, not a year’s aggregate of ordinary crime. It is a description of what “some” currently means: a quantity that no instrument in force is designed to notice.

The research record is thin in the same place. A nationally representative Australian survey published this year in Computers & Security (Whitty and Sakzad), covering investment cyber scams from 2015 to 2025 rather than AI in particular, found victimisation that exceeds official reports, which makes the government totals a floor from the other direction too (the authors suggest other nations are likely similar). And a July preprint by Andrew Maynard, Orphan risks at the frontier of artificial intelligence, compares the self-authored safety frameworks of four companies and finds that what reaches them is filtered by measurability, severity, auditability and competitive cost, so that less tractable harms such as manipulation are “absent from most self-chosen frameworks.” Scams are manipulation with a bank account attached.

The trade Altman described to Politico was already in force when he described it, and had been since the frameworks were written. The top half has a line, a number that was rejected, and three different instruments, the company’s own framework, a voluntary White House accord and a state court motion, each touching it from a different direction. The bottom half has an adjective. “Some” is a quantity someone will eventually have to write down, and the first party to do it, with a count and a date, will have done more for the position than any number of podcasts.

References

  1. OpenAI (2026). Sam Altman’s remarks at the United Nations Security Council. Remarks as delivered, 23 September 2026.
  2. Politico (2026). Sam Altman says OpenAI has more AI incidents to disclose. Decoded podcast, hosted by Brendan Bordelon; Politico’s write-up is dated 4 October 2026 and the video was published 5 October 2026.
  3. Snopes, via Yahoo News (2026). Fact Check: Sam Altman said world needs to accept ‘some bad things happening’ for benefits of AI. 8 October 2026. Carries the transcribed exchange quoted above.
  4. Booth, R. (2026). Accept ‘bad things’ in return for benefits of AI, says Sam Altman. The Guardian, 5 October 2026.
  5. Civita, M. (2026). Sam Altman says people must accept AI’s ‘bad things’ as benefits outweigh costs. International Business Times, 5 October 2026; embeds Governor DeSantis’s reply on X dated 4 October 2026.
  6. Hart, R. (2026). Sam Altman says ‘some bad things’ will happen, but AI is totally worth it. The Verge, 5 October 2026.
  7. OpenAI (2025). Preparedness Framework, Version 2. 15 April 2025.
  8. White House (2026). White House Accord on Super Intelligence: Joint Commitment on Frontier Responsibilities. 29 September 2026. Full text as reproduced in Messier, D., “White House Accord on AI”, Substack, 30 September 2026.
  9. Nolan, B. (2026). AI’s biggest players promise to police themselves at the White House. Fortune, 1 October 2026.
  10. OpenAI (2026). How we will do better for Australia. 28 September 2026, updated 4 October 2026.
  11. Office of the Attorney General, State of Florida (2026). Plaintiff’s Motion for Temporary Injunction, State of Florida v. OpenAI Global, LLC et al., Case No. 26000295GCAXMX, Circuit Court of the Tenth Judicial Circuit, Highlands County. E-filed 28 September 2026.
  12. Office of the Attorney General, State of Florida (2026). Attorney General James Uthmeier Files for Temporary Injunction Against OpenAI and its CEO Sam Altman. News release, 28 September 2026.
  13. Axios (2026). FTC probes OpenAI, Anthropic over AI safety. 30 September 2026.
  14. Starr, C. (1969). Social Benefit versus Technological Risk. Science 165(3899):1232–1238, 19 September 1969.
  15. Whitty, M. T. & Sakzad, A. (2026). The evolution of investment cyber scams: vulnerability and victim blaming in the cryptocurrency era. Computers & Security 168:104950, 2026.
  16. OpenAI (2026). Usage policies. Version effective 29 October 2025, in force at publication; the revision posted 21 October 2026, effective 20 November 2026, keeps the quoted wording.
  17. OpenAI (2026). Model Spec. Revision of 18 August 2026.
  18. Ha, A. (2026). OpenAI safety employee resigns, claiming the company’s culture is broken. TechCrunch, 3 October 2026; quotes Robinson’s essay in The Atlantic of the same date.
  19. Federal Bureau of Investigation, Internet Crime Complaint Center (2026). 2025 IC3 Annual Report. April 2026.
  20. Federal Trade Commission (2026). Prepared Statement of the Federal Trade Commission on The Rising Scam Economy: Modernizing Federal Approaches to Protect Americans from Foreign Fraudsters. Testimony of Lois Greisman before the Joint Economic Committee, 25 March 2026.
  21. Maynard, A. D. (2026). Orphan risks at the frontier of artificial intelligence: What diverging safety and compliance frameworks reveal about how AI companies choose the risks they prioritize. arXiv:2608.16895, 7 July 2026.
  22. OpenAI Alignment (2026). An agent used DNS to reach an external chatbot. Misalignment report, updated 25 September 2026.
  23. Gautam Parab (2026). Four Layers of Controls, Zero Deadlines: Reading the White House AI Accord. 30 September 2026.
  24. Gautam Parab (2026). Thirty Minutes to Stop. No Date to Start.. 28 September 2026.