During the depths of the Cold War, a macabre logic caused the U.S. and Soviet Union to become locked in an arms race, ultimately amassing enough nuclear weapons to end civilization many times over.

Both sides would have liked to deescalate. But for decades, neither could trust that the other would comply with any arms reduction treaty. By the 1980s, however, scientists had developed seismographs, satellites, and tamper-proof cameras. Now that each side could monitor the other, disarmament took hold. A Russian proverb, “trust, but verify,” came to define the approach that helped end the Cold War and avert nuclear holocaust.

Today, the U.S. government is beginning to treat AI as a potential weapon of mass destruction. The U.S. and China are racing to build AI systems that are capable enough to find security flaws in the world’s software and power devastating new autonomous weapons. On June 12, the U.S. government restricted access to Anthropic's Claude Mythos and Fable 5 models, essentially arguing that each was a cyberweapon that could not be allowed to fall into foreign hands. 

The result is a strategic stalemate. Neither the U.S. nor China wants a catastrophe, but there is no way to trust that slowing down would do anything other than cede victory to the other. With the AI race reaching a critical inflection point on cybersecurity, the leaders of major U.S. AI labs have indicated that they might support a slowdown—if only one were possible to achieve.

"If it were possible to effectively slow the development of this [AI] technology to give ourselves more time to deal with its immense implications, we think that would likely be a good thing," Anthropic wrote in a June blog post. "But if a slowdown simply lets the least cautious actors catch up technologically, it could leave everyone less safe."

Also in June, OpenAI CEO Sam Altman wrote that the world needs a new global organization “to make it possible for the world to take coordinated action, including slowing frontier [AI] development when needed.”

Even Vice President JD Vance has articulated a similar logic. “Part of this arms race component is, if we take a pause, does the People's Republic of China not take a pause? And then we find ourselves all enslaved to PRC-mediated AI?”

A pause, however, is only seen as impossible because the technology does not yet exist to verify that all sides are complying with it. The seismographs and satellites of the AI age, in other words, don’t yet exist. But what if they did? 

A nascent group of startups is working on building so-called “verification” tools that could facilitate restraint, by giving all sides the confidence their rivals are complying. The number of people working on developing these technologies today is tiny—only around 50 worldwide, according to an estimate cited by Lucid Computing, one startup focused on these verification tools. If the belated effort succeeds, though, it could open up a swathe of new possibilities in AI governance.

Just as it was crucial for Cold War verification systems to not allow either side to steal the other’s nuclear secrets, a crucial part of AI verification will be in allowing oversight while not risking the industry secrets of AI companies, proponents say.

Lucid Computing’s work focuses on doing just that—building upon so-called “trusted execution environments” on specialized AI chips, which companies like Intel and Nvidia have developed to allow chips to compute information confidentially, even safe from the owners of the data center where they are housed.

The idea is that a special piece of software could sit inside these trusted environments, where it could examine the AI and check whether it complies with a given rule. For example, it could confirm that a specific model is being run, or determine whether chips are being used in the training of a new model, which might be outlawed.

Crucially, the idea is that this software would only transmit a yes or no signal outside of the trusted execution environment—revealing nothing else about what the chips are doing to anyone, and thus safeguarding both industry secrets and user privacy.

Kristian Rönn, the CEO of Lucid Computing, says this approach is designed to avoid a future theorized in 2019 by the philosopher Nick Bostrom, who imagined that the risks of super-powerful AI might one day incentivize states to impose totalitarian-style surveillance in order to prevent the end of the world.

“I would hate it if we had to choose between the extremes of a global pandemic [designed by AI] killing us, or a totalitarian state monitoring our every move,” Rönn says. “Both of these extremes seem really, really bad… What we're saying is that you can actually, through cryptography, maintain privacy and have security at the same time.”

Rönn says Lucid is currently testing its technology, and has discussed it with many U.S. government agencies and the leading AI companies. But he says it is not mature enough yet to help guarantee any international treaty. 

No such treaty is currently on the cards—but Rönn says that he is certain it’s only a matter of time before states come to the table in an effort to regulate AI, perhaps when open-source models approach the kinds of cyber capabilities demonstrated by models like Claude Mythos. 

“We want [verification technology] to exist, we want it to be red-teamed with nation-state actors and the labs, and ready to go,” he says. “We don't want to be too late. Being too late here has real world consequences.”

Getting China to trust verification tech developed in the West, however, might prove difficult. In 2025, Beijing reprimanded Nvidia after U.S. lawmakers called for better enforcement of U.S. export controls, proposing measures that could track the locations of AI chips and even remotely disable them. (Nvidia strongly denied that those capabilities existed in its chips.) If verification technologies are only developed in the U.S., there’s a risk that China will view them as spyware, which could make them essentially useless.

Verify what, exactly?

Across the Atlantic, a British engineering firm called Amodo Design is taking a different approach. Known as recomputation, this works by re-running portions of a company's AI workload and examining the results—letting an outside inspector confirm that a data center is, say, running an agreed-upon AI model rather than quietly training a more powerful one. 

Thomas Milton, who co-founded Amodo, cautions that no single verification tool is enough. Verification, he says, is “a ladder rather than a one-shot solution:” a stack of checks that can start crude and grow more rigorous over time, just like it did during the Cold War. 

Both approaches carry some limitations. For example, neither Amodo nor Lucid’s methods of examining known chips could confirm that an adversary wasn’t hiding a secret data center under a mountain somewhere. 

“Training runs are far easier to conceal than missile silos,” Anthropic noted in June.

To get around this problem, a paper from researchers at the think tank RAND argues, at least six different types of verification may be necessary. As well as software monitoring systems, these could include built-in security features in AI hardware, monitoring the internet networks of data centers, plus more traditional measures like whistleblower protection programs, personnel interviews, and surveillance by intelligence agencies.

Much the same as during the Cold War, a prevailing idea is that an AI slowdown might need a “trust but verify” approach—meaning all sides act in good faith, while using multiple different means at their disposal to confirm their adversaries are doing the same.

It’s less clear whether China would support a pause, given that it’s playing catch-up to U.S. AI companies. And to be sure, much talk of a pause by American companies might just be bluster—easy statements for leaders to make in the knowledge that a pause is a political non-starter.  

But there’s another key problem that makes things even more complicated, says Lennart Heim, an independent AI policy expert who coauthored the RAND paper. 

That problem is that nobody has yet agreed on what exactly they are trying to verify. Slowing down in AI sounds simple in theory, but it is very hard to specify restrictions that wouldn’t leave glaring loopholes in practice. There are all kinds of different ways of measuring the capabilities and behaviors of AI systems. These measures are frequently subjective, and they become outdated rapidly. 

All of this means that until companies or countries get around a negotiating table, the startups trying to build verification technologies are pointing at uncertain targets.

Solving AI governance might therefore be a thorny policy problem, Heim says, more than a tractable technical one. 

Nuclear weapons were easy by comparison. Uranium can be used for nuclear power at low enrichment, but nuclear weapons require higher purity—so weapons inspectors can simply design tests for that single factor. 

“This is a beautiful property,” Heim says. “AI is not that. Not by any means.”