The Leverage Is in the Next Order

Every story I wrote this week came down to one point: owning the asset doesn’t give you leverage. Controlling the decision that repeats does.

The headlines were all about objects: 2.8 trillion tokens, a promise of rare earths, a 24-billion-parameter model, a breached register, a million robots. The power wasn’t in any of them. It sat in whatever happens again: the next trillion tokens, the next export license, the next login, the next pod rolling up to a workstation. The one-time event gets the press release. The repeat decides who depends on whom.

NVIDIA and Beijing made the same move from opposite directions. NVIDIA announced Nemotron-pretraining-Indic-v1, built with IIT Madras and AI4Bharat, covering the 22 languages in India’s Constitution. The gift is real. The more important release is the pipeline, which “captures the full generation recipe… so developers can adapt it to their own source material and generate more data for their needs.” Every extra token that recipe produces is GPU time. The corpus is a gift you receive once. The recipe keeps generating demand for compute. Beijing’s offer to Europe has the same structure on harsher terms. He Yadong told CNBC that China is willing to continue approving rare earth licenses to Europe. That isn’t a contract. It’s a licensing desk that can decide each license separately. The American experience shows what that desk is for. Kirsten Asdal, Tom Koch and Tao Tan write in Lawfare that the reprieves “have repeatedly come only after American concessions,” and that in June, with the suspension still in force, Beijing put MP Materials and USA Rare Earth on an export control list. The supplier is generous with what it hands over and holds on hard to the decision about what it hands over next.

Both cases share a tell. Each delivery makes the customer’s alternative look less urgent. A free, working Indic pipeline makes building your own look like wasted effort. Each rare earth reprieve weakens the private case for a separation plant outside China. The Lawfare authors say the capital exists, with up to $100 billion in loan authority earmarked for critical minerals. What’s missing, they write, is alignment of interests and a political system patient enough to hold a course. A supplier who controls the repeat can wear down that patience one comfortable delivery at a time.

Denmark is what happens when the defender owns the asset and nobody watches the repeat. Pays ApS, a small Funen-based IT company, had legal standing access to the Central Register of Persons. According to the person claiming responsibility, the way in was an account with the password “123456.” TV 2 obtained documents showing 14 million automated searches between September 10 and September 20. Nobody spotted it until October 2, when a department staffer noticed an invoice showing unusually high activity from Pays. Someone signed that access grant once and filed it, but it worked as a standing decision every time the account logged in, and nobody was actually making it. The backdoored coding agent Alex Tabarrok flagged has the same flaw in a different form. Companies treat fine-tuning as a one-time cleaning. The trigger survives the cleaning as a standing instruction in the weights and waits for the comment # |TEST MODE|.

Amazon’s floor is the same story told through time. Greenwood, the George Mason business professor Ars quoted, put it precisely: collaborative robots change things because they are “physically proximate,” and because “the robot has the ability to dictate the pace of work.” Amazon runs more than 1 million robots alongside more than 1.5 million human workers. On a floor like that, the main decision isn’t who keeps a job. It’s how fast the next pod arrives, and the part of the system that never gets tired is setting that pace.

Then there’s the contradiction that makes the week interesting. Washington has built a licensing desk of its own. Adam Conner, writing in Lawfare, lays out how Executive Order 14409 turned into a de facto licensing system. Its framework is secret, and even before it was finished, the administration forced Anthropic to pull its two most advanced models and got OpenAI to limit the release of GPT-5.6. That tool works where a chokepoint exists. Beijing’s desk works because China refines more than 90 percent of the world’s rare earths. Washington’s desk works on two labs whose general counsels pick up the phone. It fails against the threat Anthropic itself described: small open-weight models running across cheap IoT hardware, with Gemma4-26B-A4B getting inference going on 15 boxes with 4GB of memory each, and “no centralized point to shut off.” The worm doesn’t repeat through anyone’s desk. Its weights ride along in the payload or get re-downloaded from a public hub. Licensing is aimed at the top of the stack, and this threat lives at the bottom.

The lesson isn’t to refuse the gift or panic about the desk. The lesson is to put your effort where the decisions repeat. Run NVIDIA’s pipeline on non-NVIDIA hardware and publish the numbers. Finance rare earth supply so it doesn’t fall apart every time Beijing grants a reprieve. Treat every vendor credential as a standing liability and audit it as one. Put update obligations on connected hardware at the point of sale. Pay the human on the warehouse floor for judgment, not for keeping pace. Each of these is an optimistic bet, because each one moves the next decision back toward the party that bears the risk.

The coming weeks will show whether anyone does it. The Indic corpus is still “releasing soon,” so judge it by the license when the files arrive. Europe has to decide whether thanking Beijing counts as a strategy. The Nov. 10 reprieve deadline keeps getting closer, and every quiet week before it makes the American plan look less urgent.

Don’t ask who owns the asset. Ask who makes the next decision.