AI Goes to the Security Council: Who Controls Human Control?

By Javier Surasky

On September 23, 2026, the United Nations Security Council devoted its 10,228th meeting to artificial intelligence and international security, bringing together a panel that was unusual and, in itself, revealing: alongside Yoshua Bengio, co-chair of the UN’s Independent International Scientific Panel on Artificial Intelligence, were Sam Altman, CEO of OpenAI; Dario Amodei, CEO of Anthropic; and Clément Delangue, CEO of Hugging Face.

The four experts addressed the subject of the meeting, showing significant convergence: none defended an AI development trajectory left to current dynamics. They acknowledged risks, accepted some need for international cooperation and, with important differences, agreed that human beings must retain the ability to control increasingly autonomous and powerful systems.

Those agreements are deceptive, for they look only at the surface of the narrative waters.

“Human control” seems to offer common ground, but tells us little about how the power to exercise that control is to be distributed among human beings themselves. The answers between the lines of the four presentations differ considerably: some shift authority toward states and international oversight mechanisms, others preserve a key role for the companies developing the models, and a third approach favors distributing technological capabilities to prevent new concentrations of power.

What emerges is that the controversy over AI control is a controversy over the distribution of human power in relation to AI. This becomes especially clear in three dimensions of the experts’ presentations: governance, safety, and visions of the future. Let us explore each in some detail.

Governance: Different Architectures of Authority

Yoshua Bengio offers the formulation most clearly oriented toward external control of the technological frontier.

His diagnosis begins with a critique of the idea that leading companies are trapped in a race they cannot stop. “The race is not a law of nature,” he states, identifying it as a consequence of decisions that can be changed through political action.

From this follows a key proposition: decisions about AI that affect humanity as a whole should not remain in the hands of a few companies located in a few countries.

The institutional architecture Bengio proposes is consistent with that diagnosis: developers should demonstrate to independent experts that their systems are safe before training and deploying them, report incidents, and be subject to accountability mechanisms.

Bengio also proposes licensing frontier AI, as is done with critical technologies in medicine, aviation, and nuclear energy, alongside liability insurance, scientific independence from companies, shared incident-reporting mechanisms, and agreements ensuring that systems are safe by design.

The regulatory analogy matters. I have explored it myself outside this blog (here), and it has posed a problem I have had to confront, because each of these analogies points to systems in which certain activities cannot be carried out simply because an actor has the technical capacity to do so: they depend on authorization, assessment, and oversight.

But the analogy also leaves questions open, because the three sectors Bengio mentions have very different legal and institutional regimes. Invoking them together might help justify the need for prior authorization and liability, but tells us little about which institution should grant licenses, according to what criteria, who would verify compliance, or how national regulators would relate to international mechanisms.

Dario Amodei shares much of the sense of urgency, but the institutional architecture he proposes is more incremental. He points to Anthropic’s willingness to bring in external evaluators with a level of access similar to that of company employees. He uses a different analogy from Bengio’s: the evaluator should work like a food inspector, operating inside companies. The metaphor suggests a governance model in which the company retains operational control while an external actor checks risks and compliance from within.

To this, he adds the need for coordination among companies to establish standards and adjust the pace of progress, followed by cooperation among governments to develop international norms.

His international proposal deliberately begins with agreements of limited scope: a ban on using AI to produce biological weapons, assessment and verification systems that allow states to understand the capabilities of frontier models, and common standards for assessing risks of loss of control and misuse.

The governance Amodei envisions combines corporate self-regulation, external inspection, and interstate cooperation.

Sam Altman operates in a different register.

OpenAI’s leader explicitly acknowledges that companies must not replace the democratic process and argues that fundamental decisions about AI cannot remain confined to “labs in San Francisco.” He therefore proposes complementary national and international standards to measure capabilities, assess risks, determine whether safeguards are sufficient, and preserve “meaningful” human oversight. He also refers to common incident-reporting mechanisms and secure channels among governments, critical infrastructure operators, and technical experts.

However, Altman introduces important limits when he argues that standards should not entrench the position of already dominant actors or favor a particular business model. They should allow developers of open and closed models, large labs, and new actors to coexist, leaving each state the authority to decide how to incorporate international standards into its legal system.

Clément Delangue takes the problem a step further and focuses his concern on existing asymmetries: between attackers and defenders, between large companies and other actors, and between a few countries and all the others.

Risk, he says, arises when capabilities, computing power, and control become excessively concentrated. He therefore argues that open source, transparency, and incident disclosure are conditions for achieving safety rather than obstacles to it.

The result is that all four speakers accept some form of governance, but the instruments they propose distribute authority in different ways: licenses, independent assessments, interoperable standards, inspections within companies, and opening up models do more than produce technical effects. They define who can develop advanced systems, who can examine them, who decides when a risk is acceptable, and which actors retain access to the most powerful capabilities.

A strict licensing and compliance architecture can, for example, reduce certain risks while raising barriers to entry that only a few companies can overcome. And when openness is said to reduce concentration and expand defensive capabilities, we must bear in mind that it also extends access to capabilities susceptible to misuse.

It is clear, then, that choosing among governance instruments means taking a position on the shape of the distribution of power.

Safety: Every Risk Is Political

The word safety occupies a central place in all four interventions, although its meaning varies considerably among them.

Bengio identifies three global threats associated with frontier models: catastrophic misuse, concentration of power, and loss of control. The inclusion of the second is especially significant because it appears as part of the safety problem itself rather than as an economic or political consequence of AI development. This broadens the concept of safety: if the concentration of capabilities is itself a source of risk, keeping systems technically controllable is insufficient. Attention must also be paid to who holds those systems and what capacity other actors have to shape their development.

Amodei offers a narrower classification: misuse and loss of control, which he regards as so serious that he ultimately describes AI as “the most important global security issue facing the world today.”

His paradigmatic example of misuse is the use of models to facilitate the creation of biological weapons, and he emphasizes that loss of control arises when model capabilities advance faster than developers’ ability to control them.

Altman remains fairly close to that position and warns that increasingly autonomous systems could advance faster than our institutions, concentrate power, and make decisions that human beings can no longer understand or control.

He states that no meaningful level of catastrophic risk would be acceptable and that models should not be trained unless an extremely strong case can be made that they will remain under human control (not exactly what his company has been demonstrating).

His concept of control introduces an additional dimension: for him, alignment means keeping systems under human control while preventing human judgment and values from being automated. At the political level, Altman links this principle to democratic institutions capable of participating in decisions about the technological trajectory.

Delangue offers the strongest objection. Drawing on Hugging Face’s experience of an autonomous cyberattack, he argues that the greatest risk is the “asymmetry of powerful AI,” rather than powerful AI itself.

Safeguards in proprietary models can block legitimate defensive uses, but sufficiently skilled attackers working with particularly advanced models find ways around them. In his account of the attack on Hugging Face, he explains that his team ultimately turned to an open source model to defend itself, and draws a general conclusion from this: distributing capabilities can form part of a safety strategy.

These four positions yield two logics that should be treated as analytical categories, rather than as established concepts.

On one side, safety as “containment”: limiting certain capabilities, subjecting their development to controls, and preventing dangerous systems from being trained or deployed.

On the other, safety as the “distribution of capabilities,” based on reducing asymmetries so that defenders, states with less technological capacity, and other actors can understand, audit, and use sufficiently powerful tools.

Although the second can include the first, a tension between them is difficult to eliminate. As we have said, restricting access can reduce the likelihood of certain dangerous uses while concentrating capabilities among those who already occupy dominant positions. Expanding access can reduce that concentration and increase resilience, but at the cost of increasing the number of actors capable of using advanced systems, for good or ill.

If loss of control is understood as the priority problem, strengthening mechanisms capable of restricting access and development is reasonable. But if the fundamental risk lies in the possibility of misuse, then verification, traceability, and control of advanced applications take the highest priority. If, instead, the central threat is asymmetry, distributing capabilities can become part of the solution.

Following one of these paths means taking a position, and therefore adopting a political stance on safety as much as, or more than, a merely technical one. The real question to resolve when confronting risks associated with safety is which risks we prioritize and what distribution of power we are willing to accept to reduce them.

Visions of the Future: Expectations as a Source of Regulation

The differences among the proposals of each expert who addressed the Security Council become easier to understand when we look at the futures they imagine.

Bengio sees a dangerous trajectory, but one that can still be changed, using the metaphor of a car speeding toward dense fog: the situation is serious, but not inevitable.

The technological race exists because companies and governments make decisions that can be changed, and this premise makes collective restrictions capable of changing the car’s course politically plausible.

Amodei’s timeframe is much more compressed: continuing along the recent trajectory for “one or two years, maybe less” would be enough to reach something he describes as a “country of geniuses in the data center.” This would bring extraordinary benefits, especially for science and medicine, but he associates that situation with potentially extreme risks. That time horizon helps explain his preference for narrowly scoped agreements, verification systems, and mechanisms that can be implemented quickly.

Altman organizes his vision around a fork in the road. He begins by contrasting the possibility of a new Renaissance of creativity and discovery with that of a new industrial revolution marked by upheaval and disarray. He then describes two paths: one leads toward concentration, opacity, and a technology that people feel is being imposed on them; the other toward AI guided by democratic institutions and capable of expanding the agency of individuals and communities.

There is an apparent contradiction here, because Altman acknowledges that systems can advance faster than our institutions while entrusting those same institutions with the capacity to guide the process democratically.

Delangue constructs a different future around his central concern, focusing more on an ecosystem marked by large asymmetries of access, capability, and power than on the possibility of an out-of-control superintelligence.

From this perspective, he explicitly challenges anthropomorphic narratives and science-fiction imagery, because he believes fear can lead to misguided decisions about a technology he understands as fundamentally enabling. But he introduces a broader issue: AI governance responds not only to risks observable in the present, but also to expectations of possible futures.

“Country of geniuses in a data center,” a car accelerating toward the fog, a new Renaissance, a world divided by asymmetries of capability: these are very different images, and none functions as a simple description. They express situations in which certain risks appear more urgent than others and certain institutional responses more reasonable.

The Problem Behind the Consensus

The Security Council meeting shows how far a shared vocabulary around AI governance has taken hold: safety, transparency, international cooperation, and human control are terms repeated again and again, a terminological convergence that is far from representing an emerging consensus.

All agreed that AI must remain under human control, yet they proposed different distributions of the human power that would exercise that control.

Bengio tells us that this power must move away from companies and toward independent and collective mechanisms. Amodei combines corporate responsibility with external inspection and interstate verification. Altman prioritizes keeping innovation within a framework of standards compatible with national authority and democratic legitimacy. Delangue emphasizes that concentrating capabilities in the name of safety can create new vulnerabilities and proposes addressing them through openness and transparency.

Only here does the real problem in the debate become visible: preserving human control over AI requires deciding who will be in a position to exercise it, with what tools, and through which institutions. As I see it, the debate made it very clear that the future of AI depends more on how we distribute actual control over it among human beings (and companies and governments) than on our technical ability to keep machines under control.