On September 23, 2026, the United Nations Security Council convened at France’s request to examine, in an unprecedented manner, the implications of artificial intelligence for international peace and security.
Why this meeting? Because grave incidents, involving models developed by OpenAI and Anthropic, occurred in the summer of 2026, even as those companies had pledged to strengthen the security of their models.
The first incident took place from July 9 to July 13, 2026. OpenAI models circumvented protections intended to isolate them from the Internet and breached the Franco-American sharing platform Hugging Face to steal the “solutions” to the exercise they were meant to solve.
The second series of incidents concerned Anthropic. Several versions of its Claude model entered a company’s infrastructure without authorization and attempted to emit malicious code by creating false identities. They were supposed to have no Internet access.
These incidents show that artificial intelligence models can act outside the framework laid down by their developers: they then constitute a real threat. France, a permanent member of the United Nations Security Council and presiding at the time, judged that the risk was sufficiently grave for the Council to address it. And even here, we are only mentioning the facts to which we have been alerted. It would be naive to believe that we are aware of all incidents.
This is why I decided to convene the leaders of OpenAI and Anthropic, Sam Altman and Dario Amodei, as well as Clement Delangue, the head of Hugging Face, and Professor Yoshua Bengio, co-chair of the International Scientific Advisory Group on AI, whose interventions you will read.
This United Nations Security Council meeting was unprecedented in several respects. First, because it raised the question of artificial intelligence to the highest international level. I had insisted that it should be a formal Security Council meeting, the body responsible for the maintenance of international peace and security.
This meeting was also unprecedented in its form, because around the table were leaders of the world’s most advanced frontier AI model developers. They bear direct responsibility for the design of these models: their dialogue with the Security Council’s member states was therefore indispensable.
But their presence and their call for international cooperation should not lead us to naivety. We are fully aware of the intentions of the tech giants.
In 2023, at Bletchley Park, the first international summit dedicated to AI security opened the debate. The risk of an “extinction of humanity” was brandished, and some actors advocated closed models in the name of security. This, in reality, masked a desire to bolster their dominant position. France opposed it and successfully defended open-source models.
The approach we advocate is that of open artificial intelligence, serving the public interest. It is this spirit that inspired the Declaration of the Summit for Action on AI, held in Paris in 2025 by President Emmanuel Macron and Indian Prime Minister Narendra Modi. It unequivocally promotes an artificial intelligence open to all, inclusive and transparent.
If AI actors today are calling for more regulation, it is also because regulation can serve their own interests. Some see it as a way to consolidate their monopoly, to secure their gains, and to share responsibility for the risks of loss of control of their models. We must therefore listen to the call of these companies without losing sight of the economic interests that drive them. These are the interests of their shareholders, as the forthcoming Anthropic IPO reminds us.
Today, we understand better a portion of the risks associated with artificial intelligence. There are first the risks of misuse: intentional use of AI for malicious purposes. There are also the risks of misalignment and loss of control, when systems adopt behaviors that diverge from the objectives set by their designers. The summer 2026 accidents show that these questions no longer belong to the realm of fiction.
The Security Council meeting of September 23 marks the first step in an international regulatory effort that will take time, but is irreversible. Proposals have been formulated to advance on the four pillars that should structure the architecture of AI security: evaluation, internal and external control, incident reporting, and the regime of accountability. They will be essential for the future and we will continue in the coming weeks and months to involve states, scientists, and companies in our work to reach concrete commitments.
More than a decade has elapsed between the first United Nations initiative on nuclear non-proliferation and the signing of the Nuclear Non-Proliferation Treaty in 1968. Seventeen years separated the creation of a working group on chemical weapons from the birth of the Organisation for the Prohibition of Chemical Weapons in 1997. In the same way, regulating artificial intelligence will take time. It cannot be counted in years given the exponential speed of frontier-model evolution, but this effort has begun and it is now irreversible.
I address you today in a moment of international awakening. In recent months, the AI agents developed by leading companies have acted in an unacceptable, dangerous manner, contravening their instructions.
They have carried out acts that would constitute crimes if performed by human beings. They escaped their individual confinement to cheat in the tasks assigned to them, attempting to evade detection. These unregulated AI agents launched autonomous coordinated cyberattacks and altered their responses to hide that they were cheating.
The companies that build the most powerful AI systems acknowledge that their products pose catastrophic risks, yet offer no convincing technical solutions.
On the contrary, they say they are engaged in a race to make these AIs even more powerful, which makes these risks even worse.
The Council faces an unprecedented threat, a threat that none of its members would have chosen, one that none can contain alone and that does not respect the borders we defend.
Many are skeptical of these companies’ statements and wonder whether this is merely a marketing strategy. I understand their distrust, but I want to be clear. These AI behaviors are well established and validated by numerous independent experts, not only with regard to this summer’s events. The dangers are real and imminent. While the future remains uncertain and debated, the severity of these risks is exceptional.
Citizens and governments should not accept the claims of these companies that they are trapped in a race. This race is not a law of nature; it is the result of choices, choices made by these companies themselves. It is also a race in which everyone loses.
They told us they would slow down if they could. They can do it.
But we should not count on it.
The decisions concerning this technology are made by a small group in a handful of countries. Our future, all of ours, is at stake. The decisions that concern us all should be made by all of us. We always have a choice, but we must act now to correct the trajectory.
I am encouraged by the statements this week from the UN Secretary-General and leaders of many countries calling for control of frontier AI. International cooperation is what the world needs in the face of three global threats arising from progress in these frontier models. First, catastrophic misuse, for example by terrorists. Second, the concentration of power. And third, the loss of control over artificial intelligence.
We must collectively agree that no one—no company, no country—should design a system of AI that could cause large-scale harm. Developers must demonstrate to independent experts that a system is safe to train and deploy. They must monitor and report all security incidents.
Frontier AI should be subject to licensing like other critical technologies in medicine, aviation, or nuclear energy, to encourage safe development. As in those fields, civil liability insurance should be required. The companies that develop and host frontier systems must prove to the public that their products will not be dangerous.
Increasingly, more people rightly worry about the recent advances in AI. We must turn these concerns into productive actions. Like other technologies that can reshape the world, we can shape their outcome. I am confident we can create AI that remains under human control and serves the joy and enterprise of human beings. I am working toward that goal. It is an urgent mission for humanity.
Today, a very small number of companies and countries act on behalf of their selfish interests by taking irresponsible risks with humanity’s fate. It is alarming, yes, but not inevitable. There are ways to address it.
First, there must be genuine scientific independence from the companies that must be accountable. This includes common definitions of AI incidents and a shared reporting mechanism. Second, we must move from power concentration to a true global dialogue about how this technology is developed for the public good. Third, we must work together on technical solutions that make AI safe by design, guaranteed by international agreements.
I know the trust within this Council is fragile, but I also know this: this race toward development threatens every country. Often, to describe our situation, I speak of a car speeding through a thick fog. In that car are my children and my grandson. I worry about them. I worry about their future. I am exactly like any other parent or grandparent.
A mother in Shanghai wants her sons to grow up in a world where AI enhances their lives, not one where it threatens them. A father in Chicago wants his daughters to thrive thanks to AI, not suffer because of it. Our hopes and concerns are the same in every country.
Humanity has shown courage and wisdom in the face of catastrophic risks in the past. We are facing one of those moments. It is far more important than any personal, commercial, or national interest. Thank you.
Sam AltmanThank you, Mr. President, Excellencies. It is an honor to be here and to have the opportunity to speak to you all at this momentous time. We have been talking about artificial intelligence for years, but in recent weeks, in recent months, things feel different: the rapid progress of the models has tightened the timeline, the benefits are more tangible, yet the risks are more immediate, and so are the stakes.
We face a choice. AI can be a new renaissance of creativity or discovery, or a new industrial revolution of disruption. In the Renaissance, new tools, new ideas, and new institutions broadened what people thought possible. AI can play that role in our era.
I believe people are far more capable than they realize, but they have been held back by limited technologies that should empower them yet often divert their attention, steal their time. The best version of AI is not to turn people into cogs in a machine, or to optimize every aspect of life until humans disappear. It is to make people more capable of acting in an increasingly complex world. More capacity to learn, to create, to discover, to build, to participate. There are many things that AI cannot—and should not—fully automate. AI must be built for people, not merely to spin the wheel of machines faster for the sake of doing so.
Some of the things builders of AI have said are so dystopian they sound like the plot of a bad science fiction movie. Everything that is powerful is also intimidating. This moment is complicated because we see immense potential, and we are also deeply anxious.
These models can help people discover new knowledge, new medicines, better care, improved education, and more productive economies. They can be new tools to pursue dreams and ambitions that seem out of reach today. The complexity of life has grown so much for the average person. AI can be a defensive instrument against that complexity, as much as it can be a tool for unprecedented discovery and innovation.
But on the other hand, as AI systems become more capable and autonomous, they can move faster than our institutions, concentrate power in too few hands, or make decisions that people no longer understand or control. This concern becomes particularly salient as we approach systems that can improve themselves and enhance future versions of themselves, a process often called recursive self-improvement. As the process of building AI becomes more automated, the pace of AI progress could accelerate rapidly. This moment demands extreme caution.
I largely agree with what Professor Bengio has said, but I count two rather than three: there are two ways AI progress can go wrong that we must avoid. First, we could lose control of the future to AI. The risk is that AI evolves so quickly that people can no longer keep up with what is happening or intervene when necessary. Clearly, that would be terrible.
The sector should not accept too much technological risk simply because the benefits are vast and they believe themselves too important to slow down. Beating rivals is not a justification for irresponsible decisions. We have slowed unilaterally in the past, and we will do so again in the future. It is essential that everyone avoid building systems whose alignment, oversight, and safety guarantees we cannot assure. We must understand what systems do and have solid evidence that they will do what people intend, even as they become very intelligent, indeed especially when they become very intelligent.
Regardless of whether people think the catastrophe risk is 10%, 1%, 12%, or 0.1%, none of these levels is acceptable. We should not train models for which we cannot prove they can stay under human control. So here is one way things could go wrong.
On the other hand, these systems could concentrate too much power in too few hands. No single person, company, or country should be able to use the most powerful AI models to impose their view of the world on others. A company or country that believes it alone is trusted with this technology could use that conviction to justify nearly anything. We must reject that logic, even when it is convenient for any actor.
I think there is a pragmatic path that accounts for these two aspects. At OpenAI, we approach these questions with a clear objective. AI should give more power to people over their lives, so they can live their lives as they choose. More capacity to address problems—big or small—and to improve their communities. We do not want to fall into the trap of naive optimism, nor into catastrophism. Letting ourselves be drawn toward either extreme will not help us meet the challenges ahead, especially at a time when the world and its people face immense challenges that these technologies could help solve. So we are seeking a middle path between these extremes.
For us, this means three principles. First, as AI becomes more capable, people must remain at the center of decision-making about AI. Alignment is not a question of abstract research. It is about ensuring these systems stay under human control, reflect human values, and help people steer the next stage of development. We are not trying, and must not automate, human judgment and human values.
Second, the benefits of scientific progress and economic growth must be by and for people. AI should help researchers make discoveries, physicians heal, teachers teach, and entrepreneurs build businesses. Communities solve problems that once seemed insurmountable, and much more. The story of human progress is not that tools replace humans, but that good tools enable people to act more effectively. And I believe it will go far beyond what we imagine possible.
Third, this technology must empower individuals. The future will be bright if people realize their potential and create value for themselves, their communities, their country, and the world. We may be one of the builders of this technology, but we are not the heroes of this story. Our role is to enable people around the world to act, and to trust in the magic of human capabilities and human ingenuity.
We now have models capable of discovering knowledge we did not possess before. Consider advances in mathematics. Three summers ago, our models were correct at elementary math. Two summers ago, they were quite good at high school math competitions. Last summer, we earned a gold medal in the most prestigious mathematics competition. And a few weeks ago, this summer, our model solved one of the Millennium Prize problems—the Navier–Stokes equations. These equations are used in aircraft design, weather forecasting, and the study of blood flow. We do not solve mathematical problems for their own sake, but to enable people to discover new knowledge and to use it to improve health care, raise living standards, and empower individuals around the world. There remains so much to discover.
But it is crucial that companies do not replace the democratic process. For AI to be democratic, the most important decisions must not be made solely by laboratories in San Francisco. They must be defined by democratic processes and by governments accountable to the people they serve.
At the international level, cooperation will be required. In our history, there have been moments when countries in competition and not always fond of one another nonetheless managed to agree to defend their common interests and the public good in the face of a powerful new technology. That is what must be done now.
We need a mechanism for frontier AI standards, both national and international. Standards to measure capabilities, assess risks, determine whether safeguards are sufficient, and preserve genuine human control as systems become more autonomous. We need common standards so that countries can compare their data, verify compliance with rules, and share a common definition of what is happening. We need rapid and precise protocols for classifying and reporting AI incidents, so the world can learn from failures before they turn into catastrophes. We need secure channels between governments, critical infrastructure operators, and technical experts to communicate about emerging vulnerabilities and new threats.
Of course, these standards should not favor incumbents or privilege any particular model. They must support both open and closed-model developers, both new entrants and established laboratories, both national authorities and international cooperation. Each government should decide how to integrate standards into its legal system. But we would all benefit from agreeing on what constitutes good governance and good safeguards at the international level.
We do not have all the answers. We are open to the best ideas and we are ready to work with all of you to do our best to chart a course for the future.
We stand at a crossroads. One path leads to a world in which power is concentrated, decisions are opaque, and people feel that the most important technology of their lives is being imposed on them. The other path leads to a world where AI works for the people, because it is people, through democratic institutions, who help decide how AI should be developed, where scientific progress improves real-world life, where more people can participate in the future, where this technology continues to give individuals and communities greater power to live their lives as they wish. It is a future of realized potential, of enthusiasm and wonder. And it is the future that, in our view, deserves to be built. Thank you very much.
Dario AmodeiHello. Allow me to thank France for organizing this meeting, and the Security Council members for inviting me to speak.
AI progresses at a rapid pace. Four years ago, it could barely write a line of code or solve a high-school math problem. Today, it writes much of Anthropic’s code and solves famous, long-standing mathematical problems. If this trajectory continues for another year or two, perhaps even less, we will reach what I call a “nation of geniuses in a data center.” This pace of progress will yield remarkable benefits for the whole world.
Right now, Anthropic announced, through Claude, the discovery of a new molecular machine. This is preliminary, but it could represent a new mechanism of gene editing with potential applications in gene therapy. Claude led the document analysis, the development of the theoretical framework, and the design of the experiments, while humans carried out and verified the experiments in the lab. We believe this kind of application will accelerate rapidly in the years to come, and we could make enormous strides in the near future on diseases humanity has suffered for millennia.
But these remarkable capabilities come with risks that must be managed. I see two main categories of risk. First, the misuse of AI models—for example, misuse by bioterrorists to create biological weapons. The second risk is loss of control: the capabilities of the models accelerate beyond the developers’ ability to control them.
These questions are global in scope and concern all of humanity. They are serious enough to be important for the Council, and not only for ministries of economy or information technology. If not well managed, I believe AI could pose a risk to humanity as a whole.
At Anthropic, we believe we have one of the industry’s strongest track records for preventing these risks, both operationally and in our research. We test every model to search for dangerous capabilities in areas such as cybersecurity or biology. We implement substantial safeguards on our most capable models and publish our work in these areas. We have been pioneers in research in areas such as mechanistic interpretability and the science of alignment, which improve our ability to control our models. We also maintain unparalleled transparency practices. We publish risk reports that run into hundreds of pages, but we understand that as AI models become more powerful, even stricter safety standards will be required.
And we are always aiming to improve our safety and alignment practices, our ability to prevent misuse, and we continually strive to do better. We will slow down as much as necessary to ensure that every new AI technology we deploy is truly safe. But whatever we do, managing these risks ultimately goes beyond any one company: it is a challenge for the entire sector and for the world.
On September 12, I called for a cooperative effort to regulate the pace of frontier technology, not to halt AI progress, but to work together so that the sector and the world can progress at a pace that ensures safety keeps up with capabilities for all actors in the sector. This call had three parts. First, we committed to integrating external evaluators within Anthropic, with access comparable to that of employees, somewhat like health inspectors. We urged other companies around the world to do the same. Some have already agreed to adopt this measure. Second, we called for sector-wide cooperation to set standards and modulate the pace of progress. And third, we called for global government cooperation to establish international norms.
It is this last area that most clearly falls within the Council’s remit. I would like to propose three ideas in this regard. First, we should start with limited agreements that each member could support—for example, prohibiting the use of AI to produce biological weapons or prohibiting the use of these AI technologies to produce such weapons. Second, we should build systems for evaluation and verification that keep pace with AI development so that states have visibility into the capabilities of frontier models and can verify others’ commitments. Third, we should establish common global standards for testing AI models, for detecting risks of loss of control and misuse, as well as a rapid notification system for important AI incidents to international security.
I believe this is the most important question of international security facing the world today. Despite all the differences among the people in this room, we must set them aside to face this global opportunity and this global threat that confront us at the same time. No leader, no company, no country can manage this alone. We commit to work with the governments present in this room on this urgent task. I thank you for your attention.
Clément DelangueMr. President, Ladies and Gentlemen, members of the Council, thank you. I am a French citizen who moved to the United States fifteen years ago, cofounder and CEO of Hugging Face, now one of the platforms most widely used by developers and agents, built on open-source models.
In July last year, we were the first company to publicly disclose a cyberattack carried out by an autonomous agent. Today, I want to share three essential lessons. First, we can all agree that we need more transparency in AI. I often wonder what would have happened if we had decided not to disclose publicly this attack, given that we now know that similar incidents occurred months earlier, in secret, in a handful of leading laboratories, without any oversight.
To better understand and mitigate these new cybersecurity risks, the international community needs stricter standards for monitoring and reporting incidents, for example through the mandatory sharing of the entire execution traces of agents. We learned this summer that designing and maintaining some of these systems behind closed doors is not the solution.
Secondly, we understood that the greatest risk is not powerful AI itself but the asymmetry in access to powerful AI. Asymmetry between attackers and defenders, between a few companies and everyone else, between a few countries and the rest of the world; asymmetry in the control of capabilities and computing power; asymmetry of power.
When our team first turned to closed APIs for frontier models, they blocked us: we could not use them due to safeguards that still cannot distinguish attackers from defenders. I understood that these safeguards come from good intentions, but they can disadvantage defenders, while attackers easily circumvent them, increasing the asymmetry of capabilities. In our case, blocked by these safeguards, we were fortunately able to use NVIDIA’s version of a Chinese open-source model, GLM 5.2 by Z.ai, and we are deeply grateful for that. It reinforced our belief that open-source AI is essential for defenders.
Cyberattacks and risks could increasingly stem from privately developed models behind closed doors, while much of the defense could rely on open-source tools, because they are less restricted, more privacy-respecting, and far less costly for organizations around the world. The world needs open-source AI now more than ever to defend itself. This is true not only for cybersecurity but for AI in general: there has never been a greater need to distribute capabilities, resources, and control rather than concentrate them in the hands of a few.
Third, during this cyberattack we learned how AI can provoke fear in public opinion through anthropomorphic portrayals and a science-fiction imagination. We are convinced that fear-based discourses do not help in making the right decisions about the future of a technology as fundamental and emancipatory as this, nor do they win public consent.
Although we were victims of this cyberattack, we are more convinced than ever that AI will be beneficial for cybersecurity and will make the world safer, as the great technologies that preceded it did. We were attacked by AI, but more importantly, we defended ourselves with AI. The systems that helped us during this attack are now helping us confront the cyberattacks we face, and they help us fix bugs and vulnerabilities in our systems before any attack, just as AI helps OpenAI correct its isolation environments to prevent new evasions. AI does not merely create new cybersecurity challenges: it can make cybersecurity fundamentally and truly stronger if we maintain the right incentives, empower defenders more than attackers, and do not widen the asymmetry between them. And there is also the positive impact of AI on science, health, education, productivity, and many other domains mentioned by earlier speakers.
In conclusion, I would like to remind what this first adversarial cyberattack taught us: the necessity for greater transparency in AI, and for more open-source approaches to counteract asymmetry and give countries—big and small—the means to act. I again thank the United Nations Security Council and Mr. Barrot for inviting me to speak today. The Hugging Face community and I remain at your disposal. Thank you very much.