Two of the most powerful companies on earth spent a recent quarter in a locked room, quietly rehearsing the end of the world. Not a climate scenario. Not a nuclear exchange. An AI-driven cyberattack โ severe enough to move markets, darken a power grid, and send legislators sprinting toward the nearest microphone. According to reporting that surfaced this week, OpenAI and Anthropic ran that exercise together, and they prepared to brief Congress the moment the fiction threatened to become fact.
Read it again, slowly. The two firms that build the most capable models on the planet are war-gaming their own product's failure mode. And the first deliverable is not a patch, a kill switch, or a distributed failsafe. It is a communications plan.
That is the detail that should stop you cold. Not the scenario. The sequence.
I have spent the better part of a decade auditing systems that promise safety and deliver theater. Centralized exchanges. Yield protocols. Oracle networks. Every one of them built a monument to trust and called it security. So when I read that the leading AI labs are preparing to brief Congress before they have published a single continuous audit of their own catastrophic-risk controls, my instinct is not reassurance. It is pattern recognition.
Context: What the Two Labs Actually Said, and What They Didn't
Let me lay out the ground truth, because the framing matters more than the rumor. OpenAI runs something called a Preparedness Framework โ a tiered document that scores model capabilities against catastrophic thresholds and prescribes safeguards once a model crosses them. Anthropic runs a Responsible Scaling Policy, a near-identical architecture with different nomenclature. Both documents share a common ancestor: the idea that a frontier lab can self-assess its own danger and self-administer the remedy.
That is the entire governance model. A company grades its own homework, decides which capabilities are dangerous, and then decides whether it has mitigated them. There is no independent auditor. There is no continuous attestation. There is a policy, a red-team report, and a press release.
The reporting on the joint war-game adds a new layer: these labs are not only modeling the technical catastrophe. They are modeling the political aftermath. They are rehearsing who calls whom, what gets disclosed, and how the narrative gets shaped in the forty-eight hours after an AI-assisted attack takes something important offline.
Now connect this to the institutional backdrop I have been tracking since the 2024 ETF cycle. Over the past twenty-four months, roughly $40 billion of traditional asset-manager capital has flowed into crypto vehicles, and the same institutional convergence is happening in AI. Sovereign wealth funds, defense primes, and hyperscalers are now embedded in the cap tables and the policy circles of both industries. When capital and state power converge on the same handful of entities, the entity stops being a company. It becomes infrastructure. And infrastructure that grades its own safety is a single point of failure wearing a compliance badge.
I wrote a 40-page paper on the scalability trilemma back in 2017, back when I was still translating corporate security strategy into Ethereum client analysis. The lesson then is the lesson now: every system that centralizes a critical function to move faster is quietly borrowing against its own resilience. The bill always comes due in a crisis, and it comes due at the worst possible moment.
Core: The Proof-of-Reserves Playbook, Applied to AI
Here is where my forensic instinct kicks in. I have watched this exact choreography before, and I can map it line by line.
In the aftermath of the 2022 collapses, every major centralized exchange rushed to publish a "Proof of Reserves." Merkle trees. Attestation letters. Screenshots of wallet addresses. The market cheered. The tokens bounced. And then, one by one, the fine print surfaced: these proofs demonstrated assets, not liabilities. They captured a single point in time, not a continuous state. They were audits of a photograph, not a film. Celsius had a balance sheet that looked solvent on the day it was signed and was hollow by the following week.
That is exactly what an AI lab's Preparedness Framework is. It is a Proof of Reserves for catastrophic risk. It proves the existence of a safety policy. It does not prove the absence of unmitigated danger. It is a snapshot taken by the party with the strongest incentive to make the snapshot look good.
Code doesn't confuse volume with value. It executes what it is written to execute. A Merkle root proves a set of balances existed at a block height. It says nothing about whether those balances were borrowed, rehypothecated, or promised to three other counterparties. A safety framework proves a document exists. It says nothing about whether the guardrails hold under adversarial pressure at three in the morning when nobody is watching the dashboard.
The war-game disclosure is the tell. If the labs genuinely believed their technical mitigations were sufficient, the crisis drill would be an engineering exercise โ patching, containment, model rollback. Instead, the drill is a communications exercise. That tells you where they believe the real exposure sits. Not in the model. In the narrative.
Let me be precise about what a real safety architecture would look like, because the distinction is everything. A genuine catastrophic-risk control has four properties: it is continuous, it is independent, it is adversarial, and it is reversible. Continuous means it runs every second, not once a quarter. Independent means the auditor does not report to the audited. Adversarial means it assumes the system is already compromised and tries to prove it. Reversible means there is a kill switch that a party other than the vendor can trigger.
Now score the industry against that rubric. Continuous? No โ frameworks are updated episodically, often aligned to funding rounds and model launches. Independent? No โ the labs self-assess. Adversarial? Partially โ red teams exist, but they are internal or contracted by the same firm. Reversible? Almost never โ the emergency shutdown authority rests with the company that built the model.
Four for four. The industry fails every test. And it fails them in precisely the way that centralized exchanges failed them before 2022, and the way oracle networks fail them today, and the way Layer 2 sequencers fail them right now.
Take oracles. The dominant oracle network solved a decentralization problem by routing data through a set of nodes that, in practice, concentrate around a small number of operators and a governance token that a foundation controls. The pitch is decentralization. The reality is a curated committee with a marketing budget. The latency between an off-chain price and an on-chain execution is the gap where liquidations happen and where users get liquidated at prices that never existed in the real market. I have watched a $200,000 position get liquidated on a feed that lagged the spot market by nine seconds. Nine seconds is an eternity when leverage is open.
Now take Layer 2 sequencers. The entire scaling narrative rests on the promise of decentralized sequencing. That promise has been a slide deck for roughly two years. In production, a single operator orders the transactions, decides what gets included, and controls the upgrade keys. The security guarantees that get quoted in the marketing are potential guarantees โ the ones that would exist if the system were what the documentation claims. In the meantime, the sequencer is a centralized node wearing a rollup costume.
I am describing the same disease three times. A critical function is centralized for speed and convenience. A trust layer is bolted on top to reassure the market. The trust layer is audited by the party that benefits from the audit. And everyone agrees not to look at the man behind the curtain until the curtain catches fire.
The AI labs are the newest patient, and they have the most advanced case. Their product is more powerful than any exchange, oracle, or rollup. Their failure mode is not a bad liquidation or a delayed block. It is a capability that could be pointed at critical infrastructure โ power, finance, communications โ by an actor who does not need the lab's permission. And the industry's response, per the reporting, is to rehearse the press conference.
History rhymes. This isn't a new verse; it is the same verse with a bigger amplifier.
Let me bring in the empirical layer, because this is where the analysis stops being philosophy and becomes position-sizing. When the DeFi liquidity stress test hit in 2020, I had $200,000 deployed across Aave v2 and Compound, and I was auditing their liquidation algorithms in the same week I was farming them. That dual posture โ participant and auditor โ is the only honest way to hold this asset class. You cannot trust a protocol you have not stress-tested yourself, and you cannot stress-test a protocol whose risk controls you are not allowed to read. When the leverage cycle turned, the protocols with transparent, continuous, on-chain liquidation parameters survived. The ones with opaque, off-chain risk committees did not. The market did the auditing for them, and the audit was brutal.
The same logic applies to counterparty risk, which I learned the hard way in 2022. When Terra/Luna unwound, I did not wait for confirmation. I liquidated 60% of my book into stablecoins and shorted ETH/USD derivatives, preserving roughly $1.2 million while the broader market lost 70%. That was not a genius call. It was a mechanical one: I had mapped the contagion graph, identified the centralized lenders with the largest exposure to a now-worthless collateral, and positioned ahead of the cascade. The lesson was not about price. It was about dependency. Every entity that depends on a single counterparty for its solvency is a node waiting to be infected. Celsius was a counterparty to its own depositors, its own borrowers, and its own token. When one edge of that graph broke, the whole structure fell.
AI labs are that graph, scaled up and wired into the state. They depend on a handful of cloud providers for compute. They depend on a handful of chip vendors for silicon. They depend on a handful of data suppliers for training corpora. And, per the reporting, they now depend on a coordinated political narrative to survive the aftermath of a failure. Every one of those dependencies is a concentration risk. Every concentration risk is a counterparty. And in a crisis, counterparty risk is the only macro variable that matters.
This is why I keep returning to the 2024 institutional convergence thesis. When $40 billion of traditional capital enters an asset class through a small number of regulated wrappers, it does two things. It flattens volatility, because the new holders are slower and more diversified. And it concentrates governance, because the new holders all answer to the same regulators, the same index providers, and the same custodians. The asset looks safer. It is actually more fragile, because the fragility has been moved from price to plumbing. The 2024 ETF flows did not eliminate counterparty risk. They relocated it into the custody stack, the market-maker stack, and the policy stack.
The AI war-game is the policy stack, made visible. Two labs, one narrative, one briefing to Congress. That is not safety. That is the formation of a cartel of the prepared โ a small set of firms positioning themselves as the responsible incumbents before the rules are written.
Contrarian: The Real Story Is Not AI Risk. It Is Regulatory Capture Wearing a Helmet.
Here is the angle almost nobody is pricing. The market reads this story as evidence that AI companies are taking risk seriously. I read it as evidence that they are taking regulatory positioning seriously, and that the two are not the same thing.
Think about the incentive structure. If a catastrophic AI event occurs, Congress will not subpoena the model. It will subpoena the company that trained it. The labs know this. So the rational move is not necessarily to reduce the risk โ it is to pre-negotiate the blame. Rehearsing the congressional briefing is not a mitigation; it is an insurance policy against accountability. It converts the firm from "suspect" into "informed party." It buys the most valuable asset in any crisis: the benefit of the doubt.
And notice who is in the room. Two labs. Not a standards body, not an independent auditor, not a civil-society group, not a competitor. The firms that stand to gain the most from a favorable regulatory outcome are the firms writing the crisis narrative. That is the definition of a conflict of interest, and it is being dressed as prudence.
This is the same trap that the exchange Proof-of-Reserves era set. The firms that published the loudest attestations were not the safest firms. They were the firms with the most to gain from the appearance of safety. The market mistook the theater for the substance, and the substance, when it finally surfaced, was a hole in the balance sheet.
The crypto-native answer to all of this has always been the same, and it is the answer the AI industry refuses to adopt: do not trust the attestation. Verify the state. Continuous, independent, adversarial, reversible. If you cannot verify it, you do not own it. You are renting it, and the landlord decides when the lease ends.
Takeaway: Watch the Plumbing, Not the Press Release
The signal to track is not whether the labs can model a cyberattack. It is whether they will ever submit to a continuous, independent audit of their own catastrophic-risk controls โ the same standard they will inevitably demand of every industry they touch. If the answer stays no, then the war-game was never about preventing the disaster. It was about surviving it with the reputation intact.
Position accordingly. In every cycle I have traded, the entity that controls the narrative controls the outcome, right up until the plumbing fails. The plumbing always fails last, and it fails all at once.
So ask the only question that matters: when the model goes dark and the grid follows, who holds the kill switch โ and did anyone outside the room ever get to test it?