Gladstone AI

Stated Theory of Change

Gladstone's stated theory of change runs roughly as follows:

1. AI capabilities are advancing rapidly along scaling laws, and frontier labs are racing to build AGI/ASI.
2. This race creates two categories of catastrophic risk: weaponization (AI as/enabling WMD) and loss of control (unaligned superintelligence).
3. The AI safety community has failed to communicate these risks effectively to government decision-makers, partly due to cultural and linguistic barriers between tech and government.
4. The US government -- specifically the national security establishment -- has both the authority and the institutional capacity to impose the necessary safeguards.
5. Gladstone bridges the gap by translating AI risk concepts into national security language, conducting original field investigations (data center tours with special forces, lab insider interviews), and producing actionable policy recommendations.
6. Their independence (for-profit, no investors, no donors) ensures their advice is unbiased.

The causal chain: Gladstone produces reports and briefings --> government officials understand AI risk --> policy action follows (regulatory agencies, compute thresholds, security upgrades) --> catastrophic AI risk is reduced.

Revealed Theory of Change

Looking at what Gladstone actually does (as opposed to what they say), a somewhat different picture emerges:

Media amplification dominates policy influence. The biggest measurable outputs are media hits: two JRE appearances, two TIME exclusives, Congressional briefings, White House circulation. These generate attention and shape the discourse. But attention is not the same as policy change. No legislation has been adopted based on their recommendations.

The framing has shifted from safety to security. Defense in Depth (2024) balanced weaponization and loss of control. ASP (2025) is almost entirely a national security document focused on CCP espionage and data center vulnerabilities. The alignment and control content is present but subordinate to the geopolitical framing. This suggests the Harris brothers have concluded -- perhaps correctly -- that the national security frame is more likely to produce government action than the safety frame.

Their most concrete impact is education, not policy. Training hundreds of DoD staff on AI fundamentals and building LLM infrastructure for the Pentagon is arguably more impactful in the short term than the dramatic policy proposals, which have not been adopted.

The business model depends on sustained government concern about AI. Every Gladstone recommendation -- more monitoring, new agencies, expanded education -- would create more demand for Gladstone's services. This does not mean the recommendations are wrong, but it means their incentives are aligned with an expanding government AI risk apparatus, not necessarily with the optimal risk reduction strategy.

Key Assumptions

Assumption 1: Government action is the right lever for AI risk reduction.

• Evidence for: Government is the only entity with authority to impose binding constraints on labs. Historical precedent (nuclear, bio) supports this.
• Evidence against: Government is "terrible at regulating things" (Zvi's point). Regulatory capture is a real risk. The AI landscape moves faster than government can respond.
• Testable: Partially -- we can observe whether government actions actually reduce risk.
• If wrong: Gladstone's entire theory of change fails. The correct lever might be technical alignment research, lab governance reform, or international coordination outside government channels.

Assumption 2: The national security frame will produce better outcomes than the safety frame.

• Evidence for: National security gets bipartisan attention. The US government has existing infrastructure for handling WMD-like risks. Defense/intelligence officials take existential threats seriously.
• Evidence against: The national security frame risks militarizing AI development (Manhattan Project dynamics), exacerbating US-China tensions, and creating a surveillance/security apparatus around AI that is hard to dismantle. It also alienates potential allies (researchers who view the safety frame as more honest).
• Testable: We can observe whether national-security-framed recommendations lead to better safety outcomes than safety-framed ones.
• If wrong: Gladstone may have contributed to a worse equilibrium -- one where AI is treated as a weapon rather than a governance challenge, and where the security apparatus built around it serves nationalist rather than safety goals.

Assumption 3: A 2-4 person team can produce analysis comparable to established institutions.

• Evidence for: The reports are detailed and have attracted significant attention. The Harris brothers have genuine technical knowledge and unique access.
• Evidence against: No peer review, no systematic methodology, no institutional accountability. RAND employs 1,900 people and has decades of methodological rigor. A 4-person team relying on anonymous sources and personal judgment is qualitatively different from institutional analysis.
• Testable: Compare the accuracy and rigor of Gladstone's predictions and analyses to RAND/CSET output over time.
• If wrong: Gladstone's reports may be persuasive but unreliable -- influential storytelling rather than rigorous analysis.

Assumption 4: Chinese cooperation is impossible and the US must "win" the AI race.

• Evidence for: Extensive from Gladstone's national security contacts. China's track record on arms control agreements, espionage campaigns, and Hong Kong/South China Sea.
• Evidence against: The AI race framing assumes a zero-sum game. Nathan Labenz's counterpoint (from the Cognitive Revolution) -- "we have far more in common with the Chinese than we do with the AIs" -- challenges the core frame. International cooperation on genuinely existential risks may be possible even between adversaries.
• If wrong: Gladstone's hawkish recommendations may accelerate a dangerous arms race rather than reducing risk.

Strengths

Genuine bridging function. Very few people in the AI safety ecosystem have credibility with both the technical alignment community and the national security establishment. The Harris brothers have both. This is a genuinely scarce and valuable role.

Unusual media access for impact. Two JRE appearances reach millions of people who would never engage with AI safety content through other channels. This audience expansion has real value regardless of whether specific policy recommendations are adopted.

Original field research. The data center security assessment with special forces operators is genuinely novel. No other AI safety organization has done on-site physical security assessments with military operators. The findings (e.g., $20K to disable a $2B facility) are concrete and actionable.

Honest about dilemmas. Gladstone explicitly acknowledges the "overconstrained" nature of the problem -- that AI safety and US-China competition create contradictory pressures. Most commentators pick a side; Gladstone tries to hold both. This intellectual honesty is rare and valuable.

Financial independence. No VC pressure to scale, no donor pressure to produce specific conclusions, no lab funding that might compromise independence. This is a genuine structural advantage over many AI safety organizations.

Weaknesses and Risks

Communication skills far outpace analytical rigor. Gladstone is extraordinarily good at getting attention (JRE, TIME, White House) but has produced zero peer-reviewed work. The reports rely on anonymous anecdotes without systematic methodology. Zvi's critique -- that the report fails to convince anyone not already convinced -- strikes at the core of their approach.

The business model incentive conflict. A for-profit company selling government AI consulting has a direct financial interest in recommending more government spending on AI consulting. This does not mean their recommendations are wrong, but it is the most obvious conflict of interest question about Gladstone, and nobody has asked it.

Scale mismatch raises credibility questions. A team of 2-4 people producing 247-page government reports, briefing Cabinet officials, and touring data centers with special forces is either impressively efficient or concerning. The absence of institutional checks (peer review, editorial boards, methodological review) means errors or biases may go uncorrected.

The national security frame carries dangers. Framing AI as primarily a weapon in a geopolitical competition risks creating exactly the arms race dynamics that increase catastrophic risk. If Gladstone's work contributes to a Manhattan Project for AI that prioritizes speed over safety because "China is right behind us," they may have made the problem worse.

No measurable policy impact. Despite significant media attention and government access, no legislation has been adopted based on their recommendations. CAIP's model legislation based on their LOE4 has not been enacted. The gap between attention and action is the central challenge for their theory of change.

Opacity. For a company influencing national security policy, the complete absence of financial transparency, governance structures, and institutional accountability is problematic. We know less about Gladstone's finances than about most tiny nonprofits.

Cross-References

CAIP (Center for AI Policy): Direct collaborator -- CAIP's model legislation is based on Gladstone's LOE4. Complementary relationship where Gladstone provides the analysis and CAIP provides the legislative drafting.

RAND Corporation / CSET: Comparison points for government-facing AI analysis. Gladstone operates in the same space but at a fraction of the scale, without institutional methodology, and with a for-profit business model rather than a nonprofit research mission.

Leopold Aschenbrenner / "Situational Awareness": The ASP report explicitly builds on Aschenbrenner's "Situational Awareness" manifesto. Both argue for government involvement in securing AI development. But Aschenbrenner is more openly pro-acceleration, while Gladstone maintains a stated commitment to safety.

Anthropic / OpenAI: Gladstone's insider access to labs is a key source of their credibility. They speak more favorably of Anthropic's safety culture than OpenAI's. Their work functions partly as a whistleblower clearinghouse for lab researchers who can't speak publicly.

AI safety advocacy orgs (CAIS, FLI, PauseAI): Gladstone shares the x-risk concern but explicitly distances itself from pause/moratorium advocacy and from EA funding. They see themselves as more pragmatic and government-facing than the broader AI safety movement.

What Would Change This Assessment

• Policy adoption. If legislation based on Gladstone's recommendations were enacted and demonstrably reduced AI risk, their theory of change would be validated. This has not happened.
• Financial disclosure. If Gladstone disclosed total revenue, showing that government contracts represent a small fraction of their income, the incentive conflict concern would be reduced. Currently unverifiable.
• Peer-reviewed work. If Gladstone published technical analysis in peer-reviewed venues and it was well-received, the "communication over rigor" concern would diminish.
• Policy failure. If their national security framing contributed to a Manhattan Project for AI that accelerated dangerous development, their approach would be shown to have backfired.
• Scale-up. If the team grows significantly with domain expertise (former intelligence analysts, security researchers), it would address the scale mismatch concern.
• China developments. If diplomatic breakthroughs with China on AI governance occurred, Gladstone's fundamental assumption about the impossibility of cooperation would be challenged.

Self-Critique

What sources should I have checked but didn't?

• Edouard Harris's actual Alignment Forum posts and technical work on power-seeking. I could not access these directly.
• The full 247-page Defense in Depth report (only the executive summary PDF was in the evidence).
• Mark Beall's own public statements post-departure. His perspective would be extremely valuable.
• USAspending.gov for more detailed contract data.

Where is this analysis potentially biased?

• I may be giving too much weight to the incentive conflict concern. Many effective policy organizations have similar dynamics (McKinsey advising on restructuring that creates more consulting needs, etc.). The question is whether the incentives have actually distorted the analysis, not whether they exist in principle.
• I may be too sympathetic to the "persuasive failure" critique. The reports may have been highly effective with their actual target audience (government officials) even if they fail to persuade the AI safety intelligentsia.

What would a thoughtful person who disagrees say?

• "The Harris brothers are the only people who actually got AI safety concerns in front of Cabinet officials and on Joe Rogan. Who cares about peer review? Impact on the discourse is what matters."
• "The national security frame is not a distortion -- AI genuinely IS a national security technology, and pretending otherwise is the real mistake."
• "The for-profit model is a feature, not a bug. It means they answer to their government customers, not to donors with ideological agendas."

What's my single weakest claim? That the national security frame carries dangers. It is possible that the national security frame is the only frame that will actually produce government action, and that the risks of militarization are manageable. If the alternative is no government action at all, even a militarized response may be better.

What information would most change my view? Evidence that Gladstone's reports directly caused specific policy changes (not just attention or briefings, but actual operational or legislative outcomes). If they can demonstrate that their work led to, for example, improved data center security practices at specific facilities, or contributed to the content of a specific executive order, that would substantially validate their approach.