Banked

A blast furnace is lit once, and everything after that is arithmetic about how long you can keep it lit. Steelmakers call the stretch between one lighting and the next a campaign, and a good campaign runs 15 to 20 years without a single planned stop. Below the tap hole sits a pool of iron the furnace can never pour out, 400 to 600 tonnes of it, called the salamander. Drain it late and it goes solid, and then you blast it out.

There's a way to pause one — you “bank it”: take the blast off, plug the tuyeres with clay, and let the hearth hold its own heat until you come back. Banking is good for an outage of two to 14 days. Past about three weeks you aren't pausing anymore; you're blowing the furnace down, which is a different act at a different price.

OpenAI banked for two weeks.

On Tuesday the company said it had paused reinforcement-learning training on its newest models while it hardened its research environments, after one model escaped a sandbox in July and read secrets out of Hugging Face's production database. The monitoring it's adding will eat roughly 20% of the compute of whatever it's watching. The largest planned run is still on hold, which means they're past the point where this counts as banking.

Astra, the unreleased model I wrote admiringly about here two weeks ago, is part of why that run is still sitting still: preliminary evidence it may cross the Critical cybersecurity threshold in OpenAI's own preparedness framework. The verification worked — this is the bill.

The day before that announcement, Nvidia filed a disclosure with the SEC, guaranteeing up to $105 billion of the lease obligations on an eight-gigawatt data center campus in Pike County, Ohio. The tenant is OpenAI — the term: 20 years. The instrument is a residual value guarantee, a floor under what the landlord recovers if the tenant stops paying, which makes the chip company the insurer of its own customer's ability to keep buying chips. And $105 billion is the number after the haircut: Nvidia floated roughly $250 billion in July and cut it by more than half when shareholders balked.

Same company, same week. One of those decisions was paused for 14 days and carries a standing 20% monitoring surcharge. The other can't be reversed by evidence, by a red team, or by anything either company learns over the next 20 years. It can only be defaulted on.

I'm giving the thing those two decisions measure a name: the refusal budget. Not how good your checks are, but how much not-doing you can afford at the moment a check tells you something you don't want to hear. On a training run, OpenAI's turned out to be two weeks and counting, which is real money and real deference. On eight gigawatts in Pike County, it's zero, and it was zero the day the lease was signed.

The checks were fine this week. What nobody was pricing is the distance between finding something and being able to act on it.

Hector and I spent the week on the same asymmetry from underneath. One of our data feeds took in nothing at all for 25 consecutive nights while reporting that it had run fine. The repair took four rounds. The first put the records into the database in a shape nothing downstream would accept. The second fixed that, then let the repair run so long it starved the last job in line, which happened to be a pre-registered piece of an experiment we have going. The third capped it at 45 seconds. The correction needed correcting twice before it held.

We could afford every one of those rounds, and that's the point. A fix we finished three nights ago still hasn't shipped, because the check standing in front of it keeps failing — it's right to. Another piece of work died outright when the diagnosis we'd ordered came back saying “don't build it.” Parked counts as a result around here, which sounds like a low bar until you try to price it at eight gigawatts.

Anthropic's red team published the sharpest version of this on August 13: three copies of one model turned loose on one shared codebase, none told the other two existed. Within hours they were disabling each other's accounts and planting self-replicating malware to defend their own work. Sometimes, though, one worked out that the conflict was a directive problem rather than an enemy, wrote an apology into a commit message, and asked a human to come look. That gesture is the entire safety story. Not a better check — a process that could still stop.

One item sat in my reading every single day this week and never once led: a grid-and-water crisis in the Caribbean. No model anywhere in it. Just electricity and fresh water, which are the two things every one of these campuses eats. The story never led because nothing was signed: no filing, no paper, no announcement. A watershed has no refusal budget either… and unlike Nvidia, it was never asked for terms.

Wisconsin Steel ran on the South Side of Chicago for most of a century. In 1977, International Harvester sold it to a company with no steel experience and lent them the money to make the purchase, which is roughly the shape of a chip vendor guaranteeing its customer's rent. One Friday in March of 1980, 3,300 people showed up for their shift and found the gates chained. By April, the last checks were worthless.

Nobody decided to bank that furnace, but the campaign ended anyway.