On a Tuesday morning in Brussels, I read a disclosure that should have moved markets more than it did. Anthropic — the lab that built its entire corporate identity on being the responsible one, the safe one, the grown-up in a room full of arsonists — published an account stating that a Yemen-based armed group had attempted to use its Claude model to develop software for missile systems. I read the full seven paragraphs twice. Then I checked the tape.
Nothing moved. No repricing in AI-adjacent equities. No bid under security-focused infrastructure tokens. No widening of the spread between centralized-AI proxies and their decentralized cousins. The disclosure landed like a pebble in a lake the size of the Atlantic, and the lake did not notice.
Liquidity vanishes faster than hype. But silence can be a signal too, and the signal here is louder than the noise. The market did not care because the market has not yet figured out how to price a category of risk it cannot verify. That is the entire story. Not that a non-state actor tried to point a frontier model at a weapons program. That part is almost pedestrian in 2025. The story is that the claim of safety — Anthropic’s claim, and by extension every frontier lab’s claim — is self-reported, unaudited, and structurally unverifiable by any outside party.
I have spent twenty-one years watching systems that make promises they cannot prove. Most of them were in crypto. None of them ended well.
What Anthropic Actually Disclosed
Strip away the framing and the facts are thin. A Yemen-based actor accessed Claude. The actor attempted to use the model to help write software associated with missile development. Anthropic’s internal systems — not a customer report, not a regulator’s subpoena, but the lab’s own monitoring — surfaced the behavior after the fact. The account was identified, the activity was characterized as an abuse case, and the episode was folded into the company’s public reporting cadence. No technical appendix. No prompt transcripts. No refusal-rate data. No granular timeline. A conclusion without a methodology.
That is not a criticism of the disclosure’s honesty. It is a criticism of the disclosure’s evidentiary standard. Anthropic told us what it concluded. It did not show us the work.
To be fair to Anthropic, the environment gives it little incentive to show the work. Constitutional AI — the training approach that anchors the company’s safety story — is a methodology for aligning a model’s outputs with a written constitution of principles. It is elegant, it is research-forward, and it is, at the end of the day, a claim about internal model behavior that no external party can inspect. We are asked to trust that the constitution is being honored because the lab says so. The refusal behavior we observe through the API is a surface symptom, not a proof of mechanism.
The context matters here, and the context is that Anthropic’s entire commercial proposition rests on this trust. Enterprises buy Claude instead of cheaper competitors precisely because the procurement committee believes the safety claims. Governments sign on because the compliance story is cleaner. When the lab tells us that a missile-software attempt was caught and stopped, the reflexive institutional response is relief. The correct response is a question: caught by what, measured how, and verified by whom?
This is where the crypto native and the traditional finance professional diverge in their instincts, and it is exactly the seam I have spent my career standing on. The traditional finance professional hears ‘we caught it’ and files it under risk management. The crypto native hears ‘we caught it’ and asks for the block explorer.
The crypto native is right.
The Black Box Is the Product
Here is the uncomfortable technical reality. A large language model is a function approximation trained on a corpus that no external party fully catalogs, producing outputs whose provenance cannot be reconstructed from the output alone. When Claude generates a line of code, that line of code exists. It can be read. It can be executed. But the reason it was generated — the internal activation pattern that produced it, the training examples that shaped the neural pathway — is opaque even to a well-resourced auditor and practically invisible to everyone else.
Now add the adversarial dimension. The actor here was not a curious teenager. The disclosure describes an attempt to generate software for a missile system, which implies a request that touches embedded control logic, hardware interface code, or trajectory computation of some kind. Whether the model produced anything of value is almost beside the point. The relevant fact is that a capable, motivated, adversarial user believed — reasonably — that a frontier model was worth pointing at the problem.
That belief is itself a data point. The adversary’s priors about model capability are more honest than the vendor’s marketing. If a group with a weapons program is spending operational effort on prompt engineering against Claude, it is because someone in that group assessed the model’s coding and engineering reasoning as practically useful. You do not burn hours on a tool you believe is useless.
And yet, in the disclosure, the safety system framed the episode as contained. Contained how? By output filtering, by constitutional refusal, by post-hoc anomaly detection, or by the sheer luck that the model’s garbage output dissuaded the user? These are four entirely different safety architectures, and they imply four entirely different risk profiles for every enterprise running Claude in production. We were told an outcome. We were not told a mechanism.
This is the gap that should be repriced, and it is the gap that no market participant is currently equipped to price.
From Smart Contract Audits to Model Audits
I want to bring in something concrete, because abstraction is how safety theater survives.
In late 2017, before the 0x protocol token sale, I ran a rapid due-diligence sprint with a small engineering team. We were not reading the whitepaper for the narrative. We were reading the liquidity aggregation smart contracts for their failure modes under high-frequency load. Specifically, we wanted to know what happened to the order-matching logic when the mempool saturated and settlement latency stretched. Most of the market was arguing about token distribution. We were arguing about whether the contracts would degrade gracefully or lock up.
We found gaps. The aggregation path assumed benign timing assumptions that held in low-volatility conditions and broke in stress. We sized a position accordingly, tied our exit to mainnet metrics rather than sentiment, and the thesis — that technical robustness dominates narrative — returned roughly 400% inside six months.
The relevant point is not the return. It is that I could read the code. The contract was deployed and public. I could simulate it. I could fork the chain and attack it in a sandbox. When I claimed a failure mode existed, I could point to the line number. The claim was falsifiable, and therefore the claim was credible. That is the entire reason smart contract auditing became an industry instead of a marketing function.
Now map that discipline onto AI safety claims. When Anthropic says its model refuses weapons-development prompts, I cannot fork the model. I cannot read the weights. I cannot inject a test string into a sandboxed copy of the training pipeline. I can only submit prompts through an API and observe the outputs — and an API surface is the most curated, most defended, most cosmetic layer of the entire system. I am auditing the lobby, not the vault.
This is why the AI safety discourse is structurally weaker than the DeFi security discourse, despite the AI industry having far more capital and far more talent. The DeFi community built its credibility on externally verifiable evidence. The AI community built its credibility on internally generated assurance. One of these is a security culture. The other is a trust culture wearing a security culture’s clothing.
Don’t Trust the Yield; Audit the Source
During the 2020 DeFi Summer, I ran a two-million-dollar yield operation across Compound and Uniswap. The APYs on offer were absurd — triple digits in some pools — and the entire market was behaving as if those numbers were a fundamental feature of the protocols rather than a temporary subsidy being paid by token emissions. My team and I did the unglamorous work: we traced where the yield actually came from, modeled the emission schedules, and concluded that the headline returns were a function of inflation, not of cash flow.
So we rotated. We moved capital into stablecoin pairs, staked the LP tokens for the governance upside, and hedged the residual exposure with synthetic instruments. When the emissions normalized and the APYs collapsed, we had preserved roughly 90% of principal. The people who chased the printed number got liquidated in the cascade.
Don’t trust the yield; audit the source. That line has been my operating principle for five years, and it applies to AI safety claims with uncomfortable precision.
The yield in this analogy is the safety claim. Anthropic reports that it caught the bad actor. That is the printed APY — a number presented at face value by the party that benefits from you believing it. The source, in this analogy, is the underlying mechanism that produced the number: the monitoring system, the refusal logic, the anomaly detection, the retention of logs, the willingness to disclose. Audit the source and you discover that the ‘yield’ of safety is largely unverifiable and partially self-serving. The lab that discloses an abuse case is also the lab that decides what counts as an abuse case, what counts as caught, and what counts as worth disclosing.
A safety claim without an audit trail is exactly the kind of yield that prints beautifully in a bull market and disappears in a stress event. And we have not had the AI sector’s stress event yet. When we do, the claims that were never audited will be the first to vaporize.
This is not cynicism. It is the same discipline I apply to every position. When a protocol tells me it is safe, I ask for the audit. When an auditor tells me the protocol passed, I ask who paid the auditor. When the answer is ‘the protocol,’ I discount the finding accordingly. None of that machinery exists for frontier AI safety, and the absence is being papered over with the lab’s own prestige.
The Cryptographic Attestation Gap
Here is where the crypto industry’s actual technical toolkit becomes relevant, and here is where the reflexive answers get it wrong, so stay with me.
The problem with AI safety claims is a provenance problem. We need to know, verifiably, what a model did, under what conditions, and with what internal state, in a way that an outside party can check without the vendor’s cooperation. That is a solved problem in adjacent domains. It is solved, imperfectly but practically, by cryptographic attestation, trusted execution environments, and append-only logs with public commitments.
When a bridge contract processes a withdrawal, the transaction is on-chain. When a rollup posts a state root, the data availability is checkable. When a custodian holds institutional assets under the frameworks that MiCA formalized, the attestation is, at minimum, a signed artifact that regulators can inspect. The crypto industry spent a decade building the primitive that AI safety now desperately needs: verifiable, tamper-evident records of actions taken by a system the counterparty does not control.
Now consider what that would look like applied to a frontier model. Training-data provenance commitments. Signed model weights at each checkpoint. Attestation of inference conditions via a TEE, such that the vendor cannot silently swap the model serving a given request. Refusal logs that are anchored to a public commitment in near real time, so that a claim of ‘we caught the abuse case’ is a checkable statement rather than a press release.
Almost none of this exists for production frontier models today. The labs will tell you it is because the technology is immature. The more honest answer is that verifiability is bad for the business model. An unauditable model can be marketed on any safety claim the marketing team chooses. An auditable model constrains the vendor to what the evidence shows. Trust is not a security model; proof is. And the labs have chosen trust, because trust is cheaper and scales better on a slide.
The Institutional Convergence Nobody Is Building For
I spent the back half of 2024 in Brussels working with traditional finance firms on compliant digital-asset custody, integrating our fund’s trading algorithms with institutional-grade providers and mapping the whole stack against MiCA before the framework fully bit. The experience taught me how institutional money actually moves. It does not move on conviction. It moves on documentation.
A pension fund does not buy an asset because the thesis is compelling. It buys the asset when the compliance committee can sign off on a paper trail that survives an audit. The ETF approvals did not happen because regulators fell in love with Bitcoin. They happened because the custody, the surveillance-sharing agreements, and the reporting infrastructure matured to the point where the risk was legible.
Now apply that lens to AI. Enterprises are already deploying frontier models in regulated workflows — credit decisioning, medical triage support, legal drafting, infrastructure control. Every one of those deployments carries a liability exposure that scales with the model’s unverifiability. When the first serious incident lands — and it will, whether it is a weapons-adjacent abuse case or a financial-model failure or a safety-critical control error — the compliance question will be identical to the one MiCA forced on crypto custody: can you prove what your system did, to a party who does not trust you?
The labs currently cannot. That is the convergence trade nobody has priced. The same institutional machinery that crypto built to satisfy regulators — attestation, provenance, verifiable logs, third-party audit — is going to be demanded of AI. The crypto industry is sitting on the primitive toolkit that the AI industry will need, and almost nobody is connecting the two because the narratives have been siloed into competitors instead of complements.
My 2024 custody work taught me that the moat is never the model. The moat is the paper trail. The AI labs have stunning models and no paper trail. That asymmetry is the trade.
The Ronin Parallel
In 2021, I pulled our fund out of the NFT frenzy and pushed it toward blockchain gaming infrastructure. My reasoning was unromantic. PFP projects had no utility, their secondary-market volume was thin and reflexive, and the entire category was priced on vibes. Meanwhile, gaming infrastructure had real usage, real retention curves, and real attack surface — which meant real security work was necessary, which meant we could create differentiated value by actually doing that work. One of the specific positions we took exposed us to Axie Infinity’s Ronin bridge, and our security oversight on that exposure was deliberate and granular.
When the Ronin bridge was compromised in 2022, the assets we held were largely insulated. Not because we were lucky, but because we had asked the unglamorous question: who controls the keys, how many signatures are required, and what happens if the signer set is compromised?
The parallel to the Claude disclosure is exact and I want it to land hard. The Ronin bridge was advertised as decentralized and was, in the moment that mattered, controlled by a small set of keys. The AI safety claim is advertised as robust and is, in the moment that matters, controlled by the vendor’s own reporting. Both are single-points-of-trust wearing the costume of distributed assurance. The bridge had nine validators and five signatures required — a structure that looked decentralized on the architecture diagram and was a centralized failure surface in practice. The frontier model has a constitution and a red-team process — a structure that looks rigorous in the safety paper and is a self-reported claim in practice.
‘Decentralized sequencing has been a PowerPoint for two years,’ I have written before, and the same instinct applies here. The label is not the mechanism. The mechanism is who can override, who can lie, and who can check.
Nobody outside Anthropic can check Anthropic. That is the entire problem in one sentence.
The Contrarian Angle: Decentralization Is Not the Answer
Now I am going to say the thing that will lose me followers in the corner of the timeline that has already decided how to feel about this.
The reflexive crypto response to the Anthropic disclosure has been: see, centralized AI is dangerous and unaccountable; decentralized AI is the solution. Open weights, permissionless inference, community models, no single point of control. The argument is emotionally satisfying and intellectually lazy. It is the same mistake the NFT crowd made in 2021 — mistaking an ideological preference for a security property.
Decentralized AI makes the verification problem worse, not better.
Run the logic with me. The reason Anthropic could even detect the missile-software attempt is that it was a single vendor with centralized monitoring, centralized logging, and a central point at which anomalous behavior could be flagged. The detection capability was a direct consequence of the centralization that the discourse condemns. A permissionless, open-weight model running on distributed hardware has no such chokepoint. There is no log to audit because there is no central server. There is no abuse team because there is no company. There is no refusal policy because the weights are frozen and the constitution was baked in before release and cannot be updated when a new abuse pattern emerges.
When you remove the central operator, you do not remove the risk. You remove the observer.
This is the blind spot that the decentralize-everything faction refuses to confront. They have correctly identified that centralized trust is fragile, and they have incorrectly concluded that the absence of trust is safety. It is not. It is the absence of accountability. The Ronin bridge did not fail because it was centralized. It failed because it claimed to be decentralized while retaining a centralized failure mode. The failure mode is the mismatch between the label and the mechanism, not centralization itself.
The honest position — the one nobody wants to market — is that AI safety requires verifiable centralization for the highest-risk capabilities, and it requires transparency for everything else. Run the frontier models in audited, attested, TEE-backed inference environments with cryptographically anchored logs and independent oversight. Let the open-weight ecosystem flourish for the long tail of use cases where the abuse surface is bounded. Stop pretending that decentralization is a safety property when it is, for weapons-adjacent capabilities, simply the removal of the guardrail.
The contrarian bet is not ‘decentralize the models.’ The contrarian bet is ‘audit the models, and build the attestation infrastructure that makes the audit real.’ That is a much less romantic thesis, and it is the one that will actually matter when the regulation arrives.
The Regulatory Clock Is a Liquidity Clock
I have watched this movie before. The pattern is always the same. A real-world harm event surfaces. The industry argues about whether the harm is representative. The regulators do not wait for the argument to resolve. They legislate against the headline, and the compliance cost lands on everyone, guilty or not.
MiCA did not arrive because the crypto industry made a persuasive case for self-regulation. It arrived because the harms accumulated to the point where the political cost of inaction exceeded the political cost of overreach. The ETF approvals did not happen because the industry earned them. They happened because the infrastructure became legible enough to supervise. In both cases, the industry did not choose the timeline. The harm events chose it.
The Claude disclosure is a harm event, even though the harm was contained, because it establishes the precedent that a frontier model was pointed at a weapons program by a non-state actor. That precedent is now in the regulatory record. It will be cited. It will be used to justify mandatory safety attestation, cross-border inference restrictions, and export-control expansion. Every one of those measures raises the cost structure of running a frontier lab, and every one of those measures creates a moat for the incumbents who can afford compliance.
The crypto parallel is precise. When regulators forced custody standards, the largest, best-capitalized custodians won and the long tail of undocumented operators died. The same consolidation is coming for AI. The labs that treat verifiability as a product — that build the attestation infrastructure before it is mandated — will absorb the compliance shock as a competitive advantage. The labs that treat safety as a marketing function will discover that regulation does not read marketing.
Regulation is the new liquidity event. It does not come as a crash. It comes as a slow withdrawal of accessible capital from the non-compliant and a slow injection into the compliant. Positioning for it is not a trade you make after the announcement. It is a trade you make while everyone else is still arguing about whether the harm is real.
Cycle Positioning
We are in a sideways market. Chop is not the absence of signal; it is the accumulation phase disguised as boredom. The investors who treat consolidation as a reason to disengage are the ones who get run over when direction returns. The discipline is to use the chop to identify the structurally undervalued and to build positions before the tape confirms the thesis.
The thesis the tape will eventually confirm is not ‘AI is dangerous.’ Everyone already believes that. The thesis the tape will confirm is that verifiability becomes the scarce asset — in AI, in crypto, in the convergence between them. The models are commoditizing. The safety claims are converging to noise. The only thing that will hold value in a regulated, institutional, liability-bearing environment is the ability to prove what happened.
The crypto industry is sitting on that primitive. The AI industry needs it. The connector between them — the attestation layer, the provenance infrastructure, the verifiable-logging stack — is underbuilt, underpriced, and almost entirely unowned. That is where I am looking while the market scrolls past the Anthropic disclosure and decides it does not matter.
The Question That Should Haunt the Next Governance Cycle
Anthropic did the right thing by disclosing. The disclosure is still unaudited. The safety claim is still self-reported. The verification gap is still open. And the market, because it cannot price what it cannot verify, has filed the whole episode under ‘not our problem.’
That is the same complacency that preceded every crypto blowup I have lived through. The yield looked safe until the source was audited. The bridge looked decentralized until the keys were checked. The model looks safe until someone builds the infrastructure to prove it, or until someone exploits the fact that no one has.
When the first frontier-model abuse case lands that is not caught by the vendor’s own monitoring, we will not ask how it happened. We will ask why we spent a decade building cryptographic verification for money and then handed weapons-adjacent capabilities a system that runs on trust. The answer will be that we were busy arguing about whether to centralize the model, and we forgot to build the ledger.