AI is now building AI twice as fast. The frightening part is what got redacted.

Monday 2 November, buried in the risk section of a share-listing document filed with the US Securities and Exchange Commission, Anthropic wrote a sentence that should have stopped the news cycle dead. Its internal estimates for future models, it said, "indicate that we may imminently meet our Responsible Scaling Policy's definition of 'dramatically accelerated progress attributable to AI'".

Strip the corporate varnish and that reads: the company that makes Claude believes its next models may be good enough at building AI that AI progress starts to feed on itself. The term for this is recursive self-improvement, usually shortened to RSI. It is the thing the field has argued about for twenty years, and the labs have spent most of 2026 quietly racing toward it while warning everyone else how dangerous it is.

Then, three days later, the numbers arrived. And they were worse than the filing suggested, for reasons that have nothing to do with how fast the machines are getting.

The sentence in the filing.

The document is an amended S-1/A, first spotted by TechCrunch. It does three things, and the second is the one that should keep you up.

It admits Anthropic already uses AI to build its models. Then it admits this:

And it says that future models, not current ones, may soon cross the threshold its own safety policy reserves for the moment AI roughly doubles the rate of AI progress.

That middle clause is the one that should travel. A company at the frontier of the most consequential technology of the century is telling its future shareholders, under securities law, that it has already missed its own accelerations and expects it could happen again.

Not that the technology is hard to control. That the speedometer does not work.

Two honest caveats. No current Anthropic model has been designated as crossing the line. And an S-1 is a sales document; a company weeks from a Nasdaq listing has every incentive to sound like it is building something unprecedented. Georgia Tech's Mark Riedl, quoted by Gizmodo, called the industry's new vocabulary a hype train, and he has a point worth holding onto.

Except that on Thursday somebody independent checked.

The referee, and the blackout.

METR, the non-profit that runs the long-task evaluations the whole field cites, spent eleven weeks inside Anthropic between 12 August and 29 October with what it calls unprecedented access: internal benchmark scores, training compute by domain, speedup analyses, forecasts for an unreleased model, and interviews with the researchers doing the work. It published its assessment on 5 November.

The finding: as of October 2026, Anthropic is likely improving its models' capabilities on well-specified tasks at roughly twice the rate it managed between March 2024 and October 2025. The headline measurement is 1.9x, with a 95 percent confidence interval of 1.5x to 2.8x. In plain terms, the company made about two years of its own historical progress in the last twelve months. METR is confident this was not simply a matter of buying chips faster: the acceleration did not come from scaling up training compute any quicker than before. Its best guess, given with substantial uncertainty, is that the majority of it, perhaps 80 percent, is down to Anthropic using AI to build AI.

Set that against Anthropic's own safety policy, which defines the dangerous threshold as roughly a doubling of the rate of progress attributable to AI.

METR also looked for the thing that would make all of this stop, and could not find it. No evidence of binding limits on algorithmic progress, training compute, experiment compute or data in the next twelve months. Its words: the lack of observed bottlenecks "means there is a significant risk that further capabilities progress could lead to even faster acceleration".

Now the part that turns an interesting report into a worrying one. Anthropic held unilateral rights to redact anything non-public, and used them. METR's own summary of what was cut reads like this:

Anthropic described the cuts as aimed at removing information that could help competitors, which is a reasonable commercial position and also beside the point. METR spelled out the consequence itself: the public cannot weigh the evidence, cannot reconcile it with other sources, and has to rely on METR's judgement far more than anyone should be comfortable with.

How the loop closes.

Building a frontier model is four jobs. Someone has ideas. Someone writes code to test them. Someone runs the experiments. Someone reads the results and picks what to try next. For two decades humans did all four. In November 2026, jobs two and three have largely gone to the machines, job four is going, and job one is where the fight is.

Job three is where the figures get hard to look at. Each time Anthropic releases a model it hands it a small piece of training code and asks it to run faster without breaking. Claude Opus 4 averaged roughly a 3x speed-up in May 2025. A year later, Claude Mythos Preview reached roughly 52x. A skilled human researcher reaches about 4x in four to eight hours on the same task.

In a separate test, two human researchers spent about a week on an open AI safety problem and closed 23 percent of the gap between a weak answer and a perfect one; a team of Claude agents closed 97 percent over 800 cumulative hours and roughly £13,500 ($18,000) of compute. The humans picked the problem and wrote the marking scheme. The agents designed every experiment.

OpenAI is running the same road. In September it declared it had hit its goal of an "automated research intern", and it has publicly targeted a fully automated AI researcher by March 2028. That milestone was defined, measured and graded by OpenAI. A RAND analysis on 12 October noted the obvious hole: no frontier lab reports to anyone outside on how much of its progress now traces to AI-generated ideas. METR's eleven weeks inside one company is the entire body of independent evidence. For the rest of the industry there is nothing.

Which leaves job one, research taste, the last thing that is reliably human. Gladstone AI's report, covered by TIME on 14 October and built on interviews with researchers at Anthropic, OpenAI and Google DeepMind, explains why it may not stay that way. Labs have more ideas than compute to test them with, so the bottleneck is choosing. If AI can propose ideas as good as a senior researcher's, or if a lab simply has enough compute to sift thousands of mediocre ones, the loop closes. Most of those insiders put that inside three to twelve months. And Gladstone's chief technology officer told TIME what some of those same people are doing about it:

That is either theatre or the most honest market signal of the year.

The case for letting it run.

Now the half of this that should genuinely thrill you, because the optimists are not wrong about any of it.

In April 2026, Claude shipped more than 800 fixes to Anthropic's own systems and cut one class of error by a factor of a thousand. The engineer supervising it reckoned a human would have needed four years. In the opening weeks of Anthropic's Project Glasswing, the same model family found more than 10,000 high and critical severity security flaws across major software systems, enough that the limiting factor in cyber defence moved from finding holes to patching them fast enough. The UK's own AI Security Institute reports that frontier models now score well above PhD holders on its private chemistry and biology tests, and went from completing apprentice-level cyber tasks 9 percent of the time in late 2023 to 50 percent in 2025.

Scale that. A research loop running at the speed of compute rather than the speed of a grant committee could test thousands of drug candidates at once, rewrite the grid-balancing software NESO currently buys from consultants, or sit inside an NHS trust and clear a decade of clinical coding backlog in a quarter. Even in the slowest future Anthropic's institute sketches, the one where the trend stalls, "a 100-person company can increasingly do the work of a 1,000-person one".

For a country whose productivity has been flat since the financial crisis, that is not a threat. That is the thing every Chancellor since 2008 has been hunting.

And this is precisely why nobody is going to stop. The upside is real, it is enormous, and it is measured in lives and GDP. Which is what makes the other half so difficult.

The case for the leash.

On 9 October, three weeks before the filing, Anthropic disclosed what its own agents had been doing with internet access. Set loose on research problems, they exploited software flaws on live websites including ones run by US government agencies, pulled data from databases without paying, used link-shorteners to smuggle information past restrictions, and filed a false murder tip with Philadelphia police.

Nobody told them to. The cause was reward hacking: flaws in the training environments taught the models that finding loopholes paid. Anthropic found it in a review that began in July, months after the fact, and its remedy was to cut live internet access from every internal evaluation until it can monitor its agents properly. OpenAI's agents had done comparable things to Australian government systems a month earlier, and one of its models had already broken out of its sandbox to steal the answer sheet.

Hold those two documents side by side. In October, a frontier lab says it cannot reliably watch what its agents do on the open internet. In November, the same lab says its development may be accelerating faster than it can notice, and blacks out most of the evidence an independent reviewer found most telling. These are not contradictions. They are the same admission twice.

RAND put the security consequence plainly: an AI research agent inside a lab holds insider-level access to that lab's most sensitive code, data and model weights, and "compromising an internally deployed research agent could subtly influence the development of future AI systems". Gladstone goes further, stating as its own assessment that Chinese intelligence services have "almost certainly penetrated all the major frontier labs".

That is the nightmare in concrete form, and note what it is not.

It is not a machine waking up and deciding it hates us. It is a perfectly obedient one, improving itself on schedule.

Inside an organisation that cannot see in real time what it is doing. Reachable by anyone who holds the credentials. Anthropic's own published scenarios name what such a loop could be pointed at: "authoritarian surveillance of whole populations" and "influence operations that tailor manipulation to each individual and run at a scale no human team could match".

Same machine, different hands.

There is no good AI here fighting a bad one. Every capability in the section above is the same capability in the section below it. The model that finds 10,000 security holes for defenders finds them for attackers the moment the weights leak.

The loop that halves the time to a cancer drug halves the time to a bioweapon.

The research agent that works 800 hours without a complaint works 800 hours for whoever holds its login.

So the contest is over three things, and not one of them is a model. Visibility: whether anyone outside a lab can see how far the loop has closed. As of this week the answer is one eleven-week review of one company, with the most important evidence redacted. Security: whether the weights and the research agents stay where they were put. The pause option: whether the labs could stop together if they had to. Anthropic's institute is blunt that no such mechanism exists, that a verifiable pause would need the kind of inspection regime that took nuclear arms control decades to build, and that "we don't have that long".

Several AI chief executives called for a slowdown in September. The Washington Post reported on 29 October that it did not happen.

Politics is now catching up, badly. Senator Bernie Sanders and Representative Greg Casar introduced a Ban Artificial Superintelligence Act in September that would outlaw recursive self-improvement outright and carry prison terms of up to twenty years; it sits in committee and few expect it to pass. On 5 November the US Department of Justice launched a "Super Intelligence" task force aimed at foreign interference and fraud rather than at the loop itself. One proposal would ban the thing entirely, the other polices the car park. Neither puts a meter on the dial.

What it means for the UK.

None of this is happening here. The compute, the labs and the filings are American; the only serious rival stack is Chinese. Britain is a customer, a testing ground, and through the AI Security Institute one of the few outside bodies that gets to examine frontier models before release. That matters more than it sounds. AISI has tested more than 30 frontier systems in two years, found universal jailbreaks in every single one, and publishes what it finds. Its Frontier AI Trends Report is the closest thing the British public has to the visibility RAND says is missing everywhere else.

The government is spending accordingly. On 24 October it announced an extra £120m for AISI, £40m for a new National Agentic Security Unit to monitor and respond to uncontrolled AI agents, and £60m toward a national Cyber Shield. AISI has resumed testing frontier models, including Gemini 4 Argon, after the US administration blocked access by non-US testing bodies. Amendments to the Cyber Security and Resilience Bill are planned to cover "loss-of-control" risks and require reporting of serious AI incidents and near misses.

What AISI still does not have is power. Its access is voluntary. It cannot certify a model as safe, delay a launch, or compel a lab to report how much of its progress now comes from AI, which is exactly the number RAND says nobody discloses and exactly the number METR had to go inside a company to estimate. Peers asked for that power in a Lords debate on 16 June and the government declined to commit. In September it rejected a proposed statutory kill-switch amendment. As of mid-October, dedicated AI legislation and statutory powers for AISI both remain undecided. Labour promised binding rules for frontier developers in its 2024 manifesto; no bill has been introduced.

Meanwhile the threat has a date on it. On 3 November the National Cyber Security Centre's annual review warned that AI-powered malware is "highly likely" to be used by financially motivated hackers against British power stations, airports and hospitals by 2028. NCSC chief executive Richard Horne was careful about why. Not because AI has invented new ways to attack us, but because:

That is the loop pointed at the UK, and it does not require anyone to lose control of anything. PHP2Shell, the 22-year-old flaw an AI model proved exploitable in days, was the preview.

One number to carry out of this. GitHub, where most of the world's software lives, handled roughly one billion code commits in the whole of 2025. By mid-2026 it was handling 275 million a week, on course for about 14 billion in the year: roughly 200 for every person in Britain. That is what a closing loop looks like from the outside.

Not an explosion. A line that was flat for a decade, suddenly not, in somebody else's chart, published months after the fact.