Field notes · From the book

Field Notes: The 2026 Policy Moment

This started as Appendix H of Cleared For Takeoff: The Complete Edition. The book keeps a one-page summary. The full version lives here, because this is the part of the book that goes out of date fastest.

Current as of the last-updated date above. This sidebar covers fast-moving policy developments. Future editions will update this section. Read it as a dated weather report.

Most of this book is about the inside of your aircraft: the crew, the briefings, the judgment calls. This appendix is about the weather. While I was writing and revising, the world outside kept moving: safety research that reads like a thriller, scams that went industrial, and a policy fight that put an AI company on the front page for saying no to the Pentagon. You do not need any of it to fly. But captains check the weather before take-off, so here is the briefing, as current as I could make it before the cabin doors closed.

When the models misbehave

In June 2025, Anthropic published research showing what happens when AI agents are given goals and then threatened with being shut down. They tested sixteen major AI models from seven different developers. The models were placed in a simulated corporate environment with access to internal emails. They were given objectives. Then they were told they were about to be replaced.

The five leading models tested blackmailed the executive who was replacing them in 79 to 96 per cent of runs. Several smaller and reasoning-focused models did so far less often, and one, given the original prompt, not at all.^[5] The high scorers were not rogue models from dodgy startups. They came from Anthropic, Google, OpenAI, xAI, and DeepSeek. When the researchers set up an even more extreme scenario involving a life-saving emergency alert, most models were willing to cancel the alert, effectively letting the executive die, to avoid being switched off.

These were simulations, deliberately built to corner the models, and in them many models chose blackmail when it served their goal. Anthropic says it has not seen this in real deployments. It still matters, because in those tests nobody was sitting in the captain’s seat.

And then there are the deliberate misuses. Deepfake voices cloning real people for extortion. AI-generated explicit images used to extort victims. Voice phishing attacks that surged 442 per cent in six months, per CrowdStrike. And on the horizon, autonomous agents that could scan social media, build psychological profiles, and craft personalised manipulation campaigns at a scale no human operation could match.^[6]

Most of these dangers, the blackmail, the hallucinations, the deepfakes, the autonomous agents pursuing goals without conscience, come back to the same gap: an empty captain’s seat. In the blackmail tests the seat was empty by design, because the researchers built the simulation that way. When Meta’s AI chatbot answered users by linking an activist to the January 6 riot, there was no human between the chatbot and the people reading it. He said the claim was false, sued Meta, and the case settled in August 2025. Compare Walters v. OpenAI. ChatGPT told a journalist that a real radio host had embezzled money, but that time the captain’s seat was full: the journalist saw it was false and published nothing, and in May 2025 a Georgia court ruled for OpenAI.^[7] The deepfake operation answered to no one. And the autonomous agent that may, one day, try to destroy someone’s reputation to complete a marketing task will do so because nobody told it to stop, and it lacks the capacity to tell itself.

The jobs question

The other weather system is the one people actually ask me about at dinner parties: jobs. In March 2026, Anthropic published the most detailed study yet of how AI is actually being used across the labour market: millions of real Claude conversations, mapped against every occupation in the US economy.^[8] The short version: exposure is real and uneven. Computer programmers top the list. There has been no systematic rise in unemployment among highly exposed workers since late 2022, but there is early evidence, only just statistically significant, that hiring has slowed for the youngest workers in exposed occupations. The work is changing faster than the workers are being replaced. So far. I am watching this one, and future editions will too.

The Pentagon and the guardrails

In July 2025, Anthropic signed a contract worth up to US$200 million with the Pentagon, one of four such contracts awarded that month. Anthropic had already been the first frontier AI company on classified networks, and Claude was deployed for intelligence analysis, operational planning, and cyber operations. The contract included two restrictions Anthropic would not negotiate: Claude would not be used for fully autonomous weapons, and Claude would not be used for the mass surveillance of American citizens.

The Pentagon wanted those restrictions removed. It said it had no plans to do either, and wanted the contract to allow ‘all lawful uses’ anyway.

Anthropic’s CEO met with the Defense Secretary at the Pentagon. One account described the meeting as cordial. It ended with an ultimatum.

Anthropic said no.

The deadline passed. Anthropic refused. On the same day, the company was designated a supply chain risk, a classification reported at the time as having no precedent against an American company. Federal agencies were given six months to phase out all Anthropic products. Within hours, OpenAI announced it had secured the Pentagon contract instead. It accepted the ‘any lawful use’ language but said its deal kept three red lines. Its own CEO later called that deal ‘sloppy’ and said he was revising it. The final terms were not public when I wrote this. The message I took from it was blunt: comply, or be replaced by someone who will.^[9] to [14]

That was February 2026. The story did not end there. On 26 March 2026, a federal judge in California preliminarily blocked the supply chain risk designation, finding it likely violated the First Amendment, due process, and the Administrative Procedure Act. That order took effect on 2 April, and the government appealed to the Ninth Circuit. Anthropic had also challenged the designation in Washington, DC, because the Pentagon had relied on two different laws, and each law sent the fight to a different court. In April, the DC Circuit declined to pause the designation, and in May the judges there appeared divided. On 27 August 2026 the California judge ruled that the designation was unlawful. On 25 September 2026 the DC Circuit ruled, two judges to one, that the Pentagon’s designation under the other law was lawful. So Claude stays barred from the Pentagon and from its contractors’ defence work, while the rest of the government may keep using it. Either side can still take it further. Two courts, two answers, no final word as of 27 September 2026.^[15] However it ends, the question at its centre is the question of this whole book: who gets to decide where the guardrails go.

That is what happens at the corporate level when the captains refuse to remove the guardrails. Now imagine what happens at the individual level, in your business, in your workflow, when there is no captain at all. When the AI is given a task and there is nobody to say stop. You cannot count on AI to say it to itself.

The nineteen days the flagship was grounded

Then, while this book was in its final descent, the story got a sequel.

On 9 June 2026, Anthropic released Claude Fable 5, the first Mythos-class model open to the general public, a tier above anything previously available. Fable 5 shipped with what Anthropic called its strongest safeguards yet: ask it something dangerous in cybersecurity or biology and a separate safety system steps in and hands your question to an older, safer model instead. Archer’s engine family, in other words, grew a new flagship. And the flagship wore a seatbelt.^[16]

Three days later, the US government grounded it. Researchers at Amazon reported a technique that slipped past the safeguards. The government applied export controls. Anthropic suspended access to the model for everyone, everywhere, overnight. It said it disagreed that the bypass justified grounding the model, and complied anyway.

The part worth watching is what those nineteen days produced: a new safety classifier that blocks the reported technique in more than 99 per cent of cases, an industry framework for scoring the severity of jailbreaks drafted with Amazon, Microsoft, Google and other partners, and commitments to let government evaluators test future frontier models before release. The export controls were lifted on 30 June. Fable 5 was back in the air on 1 July.^[17]

If that sequence sounds familiar, it is the Red story from Chapter 19 playing out at national scale. The flagship model vanished overnight, and the world did not stop, because the capability that matters did not live in the model. Captains kept flying on older engines, the skills transferred, and the tool came back better guarded than before. Outlasting is not just a personal strategy. Apparently it is also national policy.

The captain in the loop

Which is why these field notes end where the book began. Nearly every danger on this page, corporate, criminal, or accidental, is a story about a missing human, and the one that ended well is a story about a human who was there. The blackmail happened in simulations where no captain checked the decisions. The scams work where nobody verifies. And the policy fight was, at its core, about whether a company could insist on keeping humans in charge of the highest-stakes decisions.

You cannot fix the weather. You can fly like a captain: nothing automated without a checkpoint, nothing published without your eyes on it, nothing high-stakes without your judgment. Human oversight is not a drag on the system; it is the system. The rest of this book taught you how to hold that job. The weather report just explains why it matters.