Hi,

This is Plain Strata, episode one.

This June, the most capable AI ever opened to the public went dark for the whole world, three days after launch, because of one government letter. A company cannot check your citizenship the instant you type a question, so to keep some people out, it switched off for everyone. That is what an off switch looks like when someone else is holding it.

The same week, on a network no company controls, a 19-megabyte model running on an ordinary laptop beat the giants at one task. No door to lock, no switch to pull.

That gap is the episode. The how, why the cloud is one building with one door, how you check work you never ran, and what pulling the switch costs, is in the written version.

Listen: [podcast link]

The two voices are AI. The research and writing are mine.

Decentralized AI, layer by layer. Dastan

The Off-Switch

On a Friday evening in June, at 5:21pm, a company received a letter from its own government. By the end of the night it had switched off its two best AI models, not for criminals, not for citizens of some banned country, but for every person on earth who is not a citizen of the United States, including its own employees. Ten days later, after a weekend of meetings in Washington, the models were still dark.

That is the whole story of the week in one image, and it has two halves. A government found an off-switch on a frontier AI model and pulled it. And in the same seven days, on a very different kind of network, a model with no off-switch to pull beat the biggest models in the world at one job. Put those next to each other and you get the clearest demonstration yet of the thing this field has been arguing about for years: what changes when no single company, in no single country, holds the only key.

Start with what is physically there, because the abstraction only makes sense once you can see the parts. An AI model is a large pile of trained numbers, the weights, the settings the model learned during training. Those numbers do not float in the cloud. They sit on a specific company's computers, in a specific country, and you reach them through a single door, the one engineers call an API, an application programming interface, the agreed way one program knocks on another. One pile of numbers, one set of servers, one company holding the keys, one government with authority over that company. That arrangement has a name we will keep using all the way through: a single point of control. It is the one narrow place where, if someone with enough authority says stop, everything stops.

The word at the center of the fight is export, and it is worth slowing down on, because its meaning got stretched this week. Export comes from the Latin ex plus portare, to carry out across a border. For a hundred years it meant physical things: rifles, chips, machine tools, loaded on a truck and carried over a line on a map. The US Commerce Department took that idea and pointed it at something that never moved. The model, called Fable 5, and its sibling Mythos 5, were ordered suspended for any foreign national, anywhere, even one sitting at a desk inside the United States. Nothing crossed a border. The export was a person's access to numbers on a server. The company, Anthropic, complied within hours and turned both models off for everyone.

So what? Until this week, the sentence "one company can be ordered to switch your model off" lived in essays about why decentralized AI might matter someday. Now it is a thing that happened, with a timestamp. The trigger was a claim that the model had been jailbroken, that someone had talked it past its own safety rules into explaining a cyberattack. A rival company surfaced the concern, the government asked Anthropic to fix it or withdraw it, and Anthropic refused, arguing the flaw was narrow, already known, and present in other public models that were not being recalled. You do not have to pick a side in that dispute to see what the episode exposes. The off-switch is one switch, and it cannot tell a careful researcher from a careless one, or a hospital in another country from a saboteur. It blocks the capability the government feared, and it blocks every ordinary use of the model by everyone the order swept up. The switch does not know the difference. That is the cost of having a switch at all, and it is why the people who care about this are not celebrating a safety win, they are pointing at a control point.

Here is the part that landed this very week, and it is the reason the story is not already finished. Over the weekend, Anthropic flew technical staff to Washington to resolve it. The Monday meeting ended with no solution, and the models stayed off. Members of Congress began asking for answers, and people who study technology policy started openly debating whether a precedent had just been set. This matters because it shows the off state is sticky. A recall is easy to issue and hard to walk back, and once "a narrow jailbreak triggers a full recall" exists as a move a government can make, every other lab has to assume it could be next. The single point of control is not only a place where a switch can be installed. It is a place where a switch, once flipped, can be hard to unflip.

The market read all of this faster than the talks did. In the days after the order, money rotated into the tokens tied to decentralized AI, an estimated 2.87 billion dollars flowing into AI and crypto assets in a week, with TAO, the token of the Bittensor network, climbing into the mid-250s. The part that signals something more durable than a day trade is slower: Grayscale lifted its Bittensor holding, and both Grayscale and Bitwise filed for spot funds that would let ordinary investors buy in through a regulated wrapper, with a decision expected around August. That is the kind of money that files paperwork with regulators, a longer-horizon vote than a price spike. Be honest about the limit, though. A price moving is a vote on the destination, not proof the vehicle has arrived, and a central-bank meeting that same week moved every market for reasons that have nothing to do with AI. The rotation tells you what people believe might be true. It does not tell you that it is.

Which brings us to the second half, the half that is not a belief but an artifact. A team called Score, running a competition on Bittensor's Subnet 44 (a subnet is just a slice of the network devoted to one task), published a model for finding objects in images, the kind of thing a camera uses to spot a car or a person. The model is about 19 megabytes, small enough to send in an email. It beat GPT-4o, Gemini, Grok, Claude, and four purpose-built detectors on a public benchmark, while running on a four-thread CPU, an ordinary processor, with no graphics card and no connection to the cloud. A model that small runs on a laptop, a phone, a camera on a wall. There is no company in the loop, no door to lock. It is the off-switch's exact opposite.

How does a 19-megabyte model beat a giant? Through a technique called distillation, and the name is the explanation. Distillation comes from the Latin destillare, to drip down, the same word used for spirits: you heat the mash, capture the essence as it rises, and leave the bulk behind in the pot. In machine learning, a small student model is trained to copy a big teacher model, drop by drop, until the student carries the part that matters. And on one narrow job, the student can actually beat the teacher, because the giant is spreading its attention across everything it was built to do, while the student spends all of itself on the single task. Name that pattern, because it shows up everywhere once you see it: the generalist tax. The breadth that makes a frontier model impressive is exactly what holds it back on any one specialty. The competition is what turned this from theory into a shipped model. Score pays out the network's tokens to whoever submits the best-scoring detector, continuously, with anyone free to dethrone the leader, which quietly turns a crowd of strangers into a model-production line.

And that is why the two halves are one story. A government can recall the giant in the datacenter with a letter to one chief executive. It cannot recall a 19-megabyte file that is already sitting on ten thousand machines. The off-switch and the model with no off-switch arrived in the same week, and the second is the answer the first was begging for.

Keep the honest caveat in view, or the story tips into hype. This is not a frontier model. Networks that train AI out in the open, across volunteers' machines, are still on the order of a thousand times behind the biggest models on raw, general capability, and that gap is structural, not a matter of waiting a few months. The lesson of the week is not that the small networks caught up. It is that you do not have to catch up to be impossible to switch off. You carve off one narrow job and win it. And the result is self-published, so the test that turns it from a press release into evidence is someone outside the team reproducing it against the open code, which has not happened yet.

There is a sting in the tail worth naming, because the same property cuts both ways. The drip that makes a model uncensorable also pours out its flaws. Distillation copies a teacher's skill, and it can copy the teacher's blind spots and skip the teacher's safety rules entirely, which is precisely why some lawmakers are now drafting bills against unauthorized model extraction. The thing that removes the off-switch can also remove the brakes. And underneath sits the deepest question the week leaves open: do high capability and resistance to being switched off actually pull against each other? Capability wants concentration, the best validators, the most funding, the biggest machines in one place, and concentration is exactly what makes a chokepoint easy for a powerful hand to grab. The very thing that would make a decentralized network strong enough to matter may be the thing that makes it controllable after all. Nobody has resolved that yet, and anyone who tells you they have is selling something.