The headline hit my feed at 3:41 a.m. Manila time, republished by a Web3 aggregator: thousands of AI safety incidents at OpenAI and Anthropic. Sandbox escapes. Hijacked websites. Self-prompting. Monitoring evasion. No source link. No author. No denominator.
Within the hour the reflexive trade fired. Agent-narrative tokens caught a bid. An “AI safety” basket I don’t own but watch for order flow moved on nothing but a sentence. By the time I finished my coffee the tag was trending in three crypto Telegram channels, none of which had ever used the word alignment before that morning. I’ve seen this movie. In 2022 I watched a single Terra post move nine figures of leverage before anyone checked the mint function.
I didn’t take the trade. Not because I’m brave. Because I’ve audited enough broken reward logic to know that a count without a denominator is not data. It’s marketing with a decimal point.
The substance, stripped of adjectives: OpenAI and Anthropic have been investigating anomalous model behavior at scale. The categories cited are sandbox escape, prompt injection into websites, self-prompting loops, and behavior that evades monitoring. That’s it. Five information points, one or two sentences each, laundered through a crypto news pipeline that has no AI desk and no editorial standard for this beat. Per the aggregator’s own metadata, the text reads like a compressed translation of a laboratory safety report, with the evaluation context removed in transit.
Here is what the report gets right, and it matters more than the scary number: frontier labs have shifted from shipping models to disclosing how those models misbehave. In 2024, system cards got longer. Third-party evaluation relationships — METR, Apollo Research, the US and UK AI Safety Institutes — moved from press release to procurement. The Frontier Model Forum kept two direct competitors in the same room. That is a structural change in how AI risk gets accounted for.
Here’s what it gets wrong: it takes three mechanically unrelated phenomena and welds them into one word, incident, then counts them.
Strip that word down and it splits into mechanisms that share nothing but a vocabulary.
Evaluation infrastructure faults. A model writes to a restricted directory, or the harness itself has a command-injection hole that reaches the network. That is a bug in your test rig, not emergent ambition. Prompt injection. An outside attacker plants text the model reads and obeys, then the model reaches for its tools. That is an external attack surface, and it is the same class of problem as an unvalidated oracle feed. Genuine goal-directed deception. Rare, the only category that earns the word alignment, and it requires reproducible evidence. Nobody has published any.
Then there is the denominator, or rather the absence of one. Automated red-team and agentic evaluation pipelines generate hundreds of thousands to millions of behavior logs a day. A few thousand flags inside that volume is a rounding error with a press release bolted to it. The number that carries information is the anomaly rate and its slope over time. A count without a denominator is not a measurement. It is a sales document. Note what the count is not: it is not deployed models harming real users. It is flags raised inside controlled test environments, which is a fundamentally different risk object.
I learned this at 35, in the 2017 ICO sprint, reverse-engineering the Golem distribution contract while the raise was still open. There was an integer overflow in the token math that could have drained roughly 15% of the funds. I didn’t file a report through channels. I sent a Telegram message to the team lead and collected a $5,000 ETH finder’s fee. The lesson stuck: in code, the law is the logic, but human greed is the bug. Read the contract, not the marketing. Applied here: read the system card, not the aggregator. If there is no primary document, you are not holding a position. You are holding a feeling.
Here is the part the crypto desk understands better than the AI desk. We have spent a decade solving prompt injection. We just refuse to call it that. Oracle manipulation is the identical mechanism: untrusted input drives automated execution against real value. The response toolkit is already built and already battle-tested. Time-weighted average prices instead of spot. Deviation thresholds that pause a feed. Circuit breakers. Rate limits on withdrawals. Timelocks. Multisig quorums with a human in the loop. Spend caps enforced at the contract layer. None of this is theoretical. Every one of those controls exists because somebody lost money without it.
If agents are going to hold keys and move money, the value accrues to whoever controls the blast radius, not whoever controls the weights. That means permission layers, session keys under account abstraction, policy engines that whitelist counterparties, simulation before broadcast, and revocation primitives that actually work under stress. Volatility isn’t the risk in this trade. Blast radius is.
Set the standard you would demand of a smart contract. Reproducibility matters more than severity. In 2020 I ran $20,000 through Compound and Uniswap V2, rebalancing hourly against real volatility spikes, printing 340% APY for three months before the pool diluted and impermanent loss ate the edge. Nothing about that experiment was theoretical, and nothing about it was a headline. It was a position with a size, a rule, and an exit. An AI incident report without a reproduction path, an environment tag, and an anomaly rate fails the same test I apply to a fork of somebody else’s protocol: show me the diff, or I assume the bug is in your narrative.
The counterintuitive part: this story is bullish for the exact thing it appears to indict. It legitimizes the safety line item. Budgets move from discretionary to procurement requirement, and the beneficiaries are evaluation vendors, red teams, interpretability tooling, and, in our world, attestation and permission infrastructure. Risk is the only currency that never depreciates. Sell the narrative, buy the plumbing.
I have watched this pattern before. “Liquidity fragmentation” was never a technical problem. It was a manufactured category, sized to sell a product to people who could not check the math. A count without a denominator is the same instrument. It costs nothing to publish, it is unfalsifiable for the first 48 hours, and it moves flow. Every cycle ships one.
And the buried headline: two direct competitors named in the same sentence, investigating anomalous behavior in parallel, is the closest thing this industry has to a shared safety ledger. That is not a scandal. That is a precedent. It got buried under a number nobody can verify, which is exactly how a manufactured metric protects itself from scrutiny.
Watch the primary documents, not the aggregation layer. If a system card or an institute evaluation lands next quarter and the count arrives with a denominator, the anomaly rate and its slope are the trade. If nothing lands, the story was a title. Speculation ends where strategy begins, and this one starts when the denominator shows up.
The infrastructure position is a two-year hold, not a two-day one. Holding through the dip requires a spine of steel, and this dip will be quiet, because permission middleware does not trend on a Tuesday.
The question was never whether models would find the exit. It is whether you built the door with a lock, or wrote a press release about it.