Hook
Somewhere in a conference room with no windows and a door that locks from the inside, two companies that spend most of their public lives competing for the same enterprise contracts sat down to rehearse the end of the world. The story, as it reached me, is thin to the point of translucent: executives at OpenAI and Anthropic are allegedly war-gaming the political fallout of an AI-driven cyberattack, and preparing to brief Congress the moment the lights go out. No named sources. No date. No venue. No list of participants. Three facts and a vibe, wrapped in the adverb "quietly" and sold as a scoop.
I have traded on worse-sourced signals and lost money on cleaner ones. In 2017, as an undergraduate in Toronto, I rotated fifty thousand dollars across three ICOs on nothing but order-book asymmetry between Poloniex and Bittrex — a fifteen percent spread, a forty-eight-hour window, and a Python script that didn't care what the whitepaper said. The lesson wasn't that narratives are useless. It was that narratives are a lagging indicator and liquidity is a leading one. So when a story arrives with no verifiable spine, I don't ask whether it's true. I ask what its shape implies — because even a fabricated rumor reveals the shape of the fear that made it circulate.
And the shape here is unmistakable. Two of the most powerful AI labs on earth are rehearsing not how to stop a catastrophe, but how to survive the politics of one. That is the tell. Not the war-game. The framing of it.
Context
Let me lay out what's actually on the table before I start pricing it.
The reported premise is a war-game — a structured scenario exercise, the kind militaries and central banks have run for decades. The scenario, as described, is an AI-driven cyberattack severe enough to trigger political consequences. The preparation, as described, is a rapid congressional briefing. That's it. Everything else — the technical assumptions, the probability estimates, the mitigation protocols, the actual defensive posture — is absent. This is a story about the communications plan for a disaster, not the disaster itself.
Now, the two named parties are not strangers to safety theater or to safety substance, and the distinction matters. Anthropic has built its entire commercial identity on a Responsible Scaling Policy — a document that ties model deployment to capability thresholds, like a rating agency for its own danger. OpenAI, the other lab, runs a Preparedness team and publishes a framework that reads like an internal threat model made public. Both companies have spent years arguing, in policy papers and Senate testimony, that frontier models carry catastrophic risk and that only a handful of organizations are positioned to manage it.
Here's the part the cheerleaders skip. The same companies that warn about catastrophe are the companies that would be subpoenaed first if catastrophe arrived. If a frontier model is used to breach a power grid, a hospital network, or a financial clearing system, the question Congress asks is not "how do we regulate AI." It's "why didn't you stop it." The war-game, if it happened, is not altruism. It's legal and political pre-positioning — a rehearsal for the deposition, not the defense. That is rational. It is also revealing. It tells you what these labs believe is inevitable enough to rehearse, and it tells you which stakeholder they fear most. It isn't the public. It's the committee.
I've watched this pattern before. In June 2022, when Celsius froze withdrawals and the market discovered that "yield" had been a euphemism for a leverage chain, the survivors weren't the ones who panicked first. They were the ones who had already rehearsed the exit. I shorted LUNA/UST on dYdX with a two-hundred-thousand-dollar margin position, coordinated on-chain flow reads with three other analysts, and closed forty-eight hours before the bankruptcy filing. The profit was real. So was the lesson: the people closest to the blast radius are always the first to write the press release. The AI labs are now doing, in a boardroom, exactly what the smart money did in that collapse — getting the story straight before the story exists.
But there's a third party in this war-game that the report never mentions. And it's the one that will actually get hit.
Core
Here is where I diverge from every AI-safety commentator who will write about this. They will frame the scenario as an attack on critical infrastructure — the grid, the water supply, the financial system. That framing is comfortable because it's abstract and because the targets are old and hardened and insured. It is also, I think, wrong about where an AI-driven attack would land first.
Crypto is the path of least resistance for an autonomous attacker, and almost nobody is war-gaming that.
Run the logic. An AI agent optimizing for impact-per-unit-effort doesn't start with a bank. Banks have fraud departments, chargebacks, regulatory backstops, and — critically — time. A fraudulent wire can be reversed. A compromised account can be frozen. The attack surface is defended by humans who get to wake up and respond.
Crypto has none of that. It has instant finality, no chargebacks, pseudonymous counterparties, 24/7 operation, and an aggregate of tens of billions of dollars sitting in smart contracts whose code is public and whose behavior is deterministic. Gas is the toll for chaos, and chaos is cheap. A permissionless, irreversible, always-on financial system is the single most attractive target an autonomous agent has ever been handed. There is no fraud department in a smart contract. There is no one to call at 3 a.m. The code executes. That's the whole point, and that's the whole vulnerability.
I spent the DeFi summer of 2020 doing exactly this math from the other side. I allocated a hundred and twenty thousand dollars into a synthetic yield strategy — borrowing against ETH to buy WETH, supplying to Compound, farming the UNI airdrop — and I managed liquidation thresholds every six hours because I understood that in DeFi, risk is not a feeling. It's a number, and the number moves while you sleep. That's the same property an attacker exploits. Bots don't sleep. Humans do. The asymmetry that made me forty percent APY is the same asymmetry that makes a protocol exploitable at 4:02 a.m. on a Sunday.
Now let me quantify the surface, because vague warnings are how you lose money.
Start with the automation gradient. Autonomous attacks are not a future scenario in crypto. They are the status quo. The entire MEV economy — sandwich attacks, arbitrage bots, liquidators racing to seize collateral in the same block — is a live, functioning market of machine-versus-machine competition running twenty-four hours a day. The dark forest isn't a metaphor here; it's infrastructure. When I built my ICO arbitrage script in 2017, I was one node in a network of bots that had already colonized every inefficiency in the order books. That was proto-AI: narrow, mechanical, relentless. The frontier models the labs are worried about are simply that same relentless loop, generalized. The attackers don't need to invent a new capability. They need to point an existing one at a bigger target.
Take the bridge layer first. Cross-chain bridges are the highest-value, lowest-defense targets in the ecosystem — not because the teams are incompetent, but because bridges are, by design, giant pools of locked liquidity with a small number of privileged keys or validators guarding the door. Ronin. Wormhole. Nomad. The list of nine-figure bridge losses is long enough to be a genre. Each one was a multi-sig compromise, a signature-verification bug, or a validator-takeover — the exact class of attack that scales beautifully under automation. A human attacker has to find the bug, write the exploit, fund the gas, and exit before the response. An AI agent does the same thing in a loop, across every fork of every contract, at machine speed, and it never gets tired or greedy or sloppy. The human attacker has a budget and a risk of being caught. The machine has neither in the way you and I understand the words.
Now take the oracle layer. Most lending protocols price collateral by trusting an external feed. Manipulate the feed — through a flash loan, a thin-liquidity pool, a stale price on a low-volume pair — and you can mint debt against nothing. This is a well-understood attack. It is also a search problem: find the pool, find the window, find the deviation that the protocol's own parameters won't catch. Search problems are what language models and their tool-using descendants are for. The thing that makes oracle manipulation hard for humans — the combinatorial space of pools, parameters, and timing — is precisely the thing that makes it trivial for a machine. A human reasons about one pool at a time. A model reasons about the entire parameter space at once, and it does it in the time it takes you to read this sentence.
And then the third layer, the one nobody wants to say out loud: the exchanges themselves. Not the on-chain protocols. The custodians. I've spent years arguing that most Proof of Reserves exercises are theater — they prove a snapshot of assets against an undisclosed fraction of liabilities, with no continuous audit and no negative confirmation. If an AI-driven attack hit a major exchange's hot wallets, the public would learn the true size of the hole only after the withdrawals froze. And by then, the irreversible part is already done. Liquidity dries up when fear sets in, and fear sets in faster than any human committee can convene. The proof-of-reserves dashboard would show green until the moment it showed red, and by the time it showed red, the coins would be gone and the exchange would be explaining itself to a regulator who never got a real balance sheet.
This is why the war-game matters to me and should matter to you. The AI labs are rehearsing the political aftermath of an attack. But the attack, when it comes, will most plausibly land on infrastructure that has no political representative, no deposit insurance, and no seat at the table where the war-game is happening. The crypto market is the unattended vault in the building everyone is busy locking. Everyone is checking the doors of the bank and the grid. Nobody is checking the basement where the bearer bonds are kept.
Let me stress-test my own thesis, because a thesis I won't stress-test isn't a thesis — it's a position I'm defending.
Objection one: crypto is too small to matter. Total value locked across DeFi is a rounding error next to global banking. True. But impact is not proportional to size when the goal is political — and the war-game tells you the goal is political. A successful AI-orchestrated drain of a major exchange doesn't need to topple the financial system. It needs to produce a headline, a freeze, a congressional hearing, and a narrative that says "AI did this." The attacker's objective function, if it's an adversary rather than a profit-seeker, is spectacle, not scale. And crypto is the most spectacular place to lose money in public, in real time, on a block explorer, with everyone watching. You cannot stage a bank run on a blockchain explorer in high definition with timestamps. You can stage one in crypto, and the whole world can watch it happen.
Objection two: AI isn't capable enough yet. Maybe. But the labs are rehearsing as if it will be, and they know their own models better than I do. When the people with the best information about a capability start rehearsing its consequences, the honest move is to update — not to argue the capability away. I learned this in the ETF trade in January 2024: I read whale accumulation on-chain while retail read the price spike as a top, and I positioned for the funding decay instead of the headline. The people closest to the flow were right, and the crowd was loud and wrong. When the labs rehearse, they are the whale. You should read their positioning, not their press.
Objection three: this whole story is unverified. Correct. And I've already flagged that. But the sourcing quality changes the probability of the event, not the shape of the risk. A rumor about a war-game is weak evidence that the war-game happened. It is strong evidence that the category of fear — AI-driven catastrophe — has become the organizing anxiety of the most powerful labs in the world. And you don't need the rumor to be true to price the anxiety. You need it to be representative. The rumor is a mirror held up to the industry's own internal weather, and the weather is a storm.
Here's the deeper point, and I'll put it in bold because it's the thing I want you to keep: the AI labs are not preparing for a technical failure. They are preparing for an attribution failure. The scenario that keeps a general counsel awake is not "our model was used to break something." It's "we cannot prove it wasn't." In a world where the same model architecture is deployed by a dozen actors, where weights leak, where APIs are resold, and where the tooling to build an autonomous attacker is increasingly commoditized, attribution becomes the hardest problem in the room. The war-game is a rehearsal for the moment when Congress asks "whose model was it" and the honest answer is "we don't know, and neither do you."
And that is exactly the property that crypto shares. Code is law, but bugs are fatal — and in a system with no identity layer, no reversibility, and no central authority, attribution is the entire ballgame. When a bridge is drained, the first question is never "how do we fix it." It's "who did it." And the answer is usually a wallet with no name, funded through a mixer, exited through a bridge, and laundered through a swap that took eleven seconds. The AI labs and the crypto protocols are rehearsing for the same nightmare: an irreversible event by an unattributable actor, with a public demanding a name. The difference is that the labs are rehearsing it in a boardroom with lawyers present, and the protocols are not rehearsing it at all.
Now let me connect this to what I actually do — because a warning without a trade is just anxiety with better vocabulary.
If AI-driven exploitation is a rising risk, then the assets that hedge it are not the ones the market currently rewards. The bull market is rewarding throughput, TVL, and vibes. It is not rewarding the boring infrastructure that would catch an automated attack: real-time anomaly detection, formal verification, continuous audit, decentralized insurance, and — the least glamorous of all — the on-chain monitoring that tells you something is wrong in the four minutes before it's catastrophic. In a bull market, risk infrastructure is the most underpriced asset class in the building, because nobody buys a fire alarm while the party is going well. The repricing of that infrastructure is where the asymmetric return lives, not in predicting which bridge gets hit.
I know this instinct from the other side of the trade. In May 2021, I treated the Bored Ape launch not as art but as a supply-side liquidity event — five freelancers, a Discord bot tracking wallet activity, twelve mints secured for a hundred and eighty thousand dollars, eight flipped at a three-hundred-percent markup within seventy-two hours. I made my money on speed of execution, not on the cultural thesis. The same discipline applies here. The alpha isn't in predicting the disaster. It's in being positioned in the infrastructure that gets repriced the moment the disaster becomes plausible. The NFT floor and the security-token bid are both liquidity events; one is priced in art, the other in fear, and fear has the better bid-ask when it finally moves.
And that repricing is a funding-rate event as much as a spot event. I ran the ETF pairs trade in January 2024 — long spot futures, short perps, capturing funding decay on the back of whale accumulation that the retail crowd misread as a top. The lesson generalizes: when a structural risk becomes legible, the derivative markets reprice it before the spot markets do. If an AI-attack scenario enters the collective consciousness, the first thing that moves isn't BTC. It's the insurance premium, the funding rate, the volatility skew, and the price of the tokens that claim to solve it. The spot market is the last to know. The options market is the first to guess.
Let me be specific about what I'd watch, without pretending to know the future.
First, on-chain forensics and monitoring. Any protocol or token whose value proposition is detecting anomalous flows — the infrastructure that turns a silent drain into a loud alarm — becomes structurally more valuable in a world where the attacker is a machine. The human attacker can be fooled by a good disguise. The machine attacker can't be fooled by scale, and scale is where monitoring earns its keep. A model that reads every transaction in every block and flags the one that deviates is the only thing that runs at the same clock speed as the attacker.
Second, formal verification and audit. In a bull market, audits are a checkbox and the logo on the website matters more than the findings. In a world with autonomous attackers, formal verification is the only defense that scales, because you cannot out-hire a machine with humans. The protocols that have verifiable, formally-checked code — not "audited by a logo" but provably correct within a bounded specification — will separate from the pack. The specification is the moat. The audit is the receipt.
Third, decentralized insurance and the capital that underwrites it. If the tail risk rises, the price of covering it rises. The people who sell that coverage early, at pre-panic prices, capture the same spread I captured on the ICO books in 2017. Insurance is a short-volatility position on catastrophe, and catastrophe just became a line item in a war-game. The underwriting spread is the trade.
Fourth — and this is the contrarian one — the negative signal. Watch for the tokens that claim AI-security exposure without any verifiable product. The bull market will produce a wave of "AI threat defense" narratives attached to nothing but a landing page and a Telegram. Strip the promotional adjectives and read the tokenomics. I learned that in 2017 and it has never stopped being true. A token with no revenue, no users, and a whitepaper about "AI-powered security" is not a hedge. It's a liability wearing a hedge's clothes.
Here's the part of the analysis that most people will get exactly backwards, and it's where I want to plant a flag.
The war-game is not a warning that AI is dangerous. It's a demonstration that AI safety has become a competitive moat.
Think about the incentives. If two labs successfully brand themselves as the only organizations capable of responsibly deploying frontier models, they don't just get good press. They get regulatory capture. They get to write the standard that their smaller competitors can't meet. They get to testify — credibly — that the industry needs gatekeepers, and that the gatekeepers should be the ones already at the gate. The war-game, the congressional briefing, the Responsible Scaling Policy, the Preparedness Framework — these are not just safety measures. They are barriers to entry dressed as public service.
I don't say this to accuse anyone of bad faith. I say it because I've watched the same move in crypto, over and over. The exchanges that lobbied hardest for "reasonable regulation" were the exchanges that could afford compliance and whose smaller rivals couldn't. Proof of Reserves became a marketing asset precisely because it was unverifiable enough to be flattering. Every industry discovers that safety, framed correctly, is the most defensible moat there is — because you can't argue against it without looking like you're arguing for catastrophe. The moment a competitor questions your safety standards, they've branded themselves reckless. That's not a policy debate. That's a kill switch dressed as a comment letter.
So when I read that OpenAI and Anthropic are "quietly" war-gaming an AI catastrophe, I don't read it as humility. I read it as positioning. The adverb "quietly" is doing enormous work in that sentence. It implies they don't want credit — which, if you've ever met a PR department, is not how credit works. "Quietly" is the tell that the leak was calibrated. Either someone wanted this out, or someone wanted it to look like it leaked. In both cases, the message is the same: we are the adults. We are preparing. Trust us with the keys. The quiet is the pitch.
And that should make you suspicious — not because preparation is bad, but because the preparation being rehearsed is political survival, not technical prevention. Notice what's missing from the story. There's no mention of a kill switch. No mention of disclosure to the affected public. No mention of coordinating with the infrastructure operators who would actually take the hit. The rehearsal is for the hearing room, not the data center. The people who would suffer the catastrophe are absent from the war-game about the catastrophe. That asymmetry is the story, and almost no one will report it, because "two labs plan to brief Congress" is a cleaner headline than "two labs rehearsed how to avoid blame while the public stays uninformed."
Let me push the systemic point one layer deeper, because this is where the crypto reader should feel the cold air. The war-game assumes that the response to an AI-driven catastrophe is a political one — brief the committee, control the narrative, manage the blame. But the actual catastrophe is technical and financial, and it resolves on a timescale of seconds. By the time Congress convenes, the money is gone, the bridge is drained, and the exchange has frozen withdrawals. The political response is downstream of an event that finished before the first subpoena was drafted. The war-game is rehearsing the press conference for a fire that will already have burned the building down. That gap — between the speed of the attack and the speed of the politics — is the entire risk, and it's a gap the labs cannot close from a conference room.
This is the same gap I traded against in 2022. Celsius froze withdrawals, and the political and legal machinery took weeks to catch up. The people who understood that the technical event was already over — that the money had already moved, that the leverage had already unwound — positioned correctly. Everyone else waited for a statement. There is no statement that arrives fast enough. Code is law, but bugs are fatal, and the fatal part is always faster than the law.
Contrarian
Let me put the counter-intuitive claim as plainly as I can.
Everyone is worried about the wrong target and the wrong actor.
The wrong target: the public imagination fixates on AI attacking banks, grids, and defense systems — the cinematic targets. But those systems are defended, redundant, and slow. The right target is the one with no defense, no insurance, and no reversibility: the crypto rails. An autonomous attacker optimizing for speed and impact-per-effort doesn't need to breach a bank. It needs to drain a bridge, manipulate an oracle, or empty a hot wallet — and it can do all three in a single night, at machine speed, while the humans are asleep. The bank is a fortress with a night watch. The bridge is an open vault with a camera that records the crime it can't stop.
The wrong actor: the public imagination casts the AI labs as the potential villains. But the labs are not the ones who will pull the trigger — they're the ones rehearsing how to survive being blamed for it. The actual attacker is unattributable by design, and the actual victim is the market that never got a seat at the war-game table. The labs are rehearsing the deposition. The crypto market is rehearsing nothing, because it doesn't know the trial is coming.
And here's the blind spot even the skeptics miss. They assume the danger is that AI becomes capable enough to attack. The subtler danger is that AI becomes capable enough to defend — and that the defense consolidates into the same handful of players. If the only organizations that can protect against autonomous attacks are the ones that can afford frontier-scale compute, then "AI safety" becomes a toll booth on the entire digital economy. Gas is the toll for chaos. Compute is the toll for order. Either way, someone with capital collects the fee while everyone else pays it.
That is the future the war-game is quietly building. Not a world where AI is stopped. A world where AI is managed — by the people who own it.
Takeaway
So what do you do with this?
You don't panic. Panic is a position, and a bad one. You price the tail. You treat the AI-attack scenario the way I treated the Celsius collapse — as a stress test you run before the market runs it for you. You ask, for every position you hold: if the lights went out tonight, who takes the loss, and can it be reversed? If the answer is "me" and "no," you've found your unhedged exposure, and you size accordingly.
You watch the boring infrastructure — monitoring, formal verification, insurance — because the bull market won't, until it has to. You strip the promotional adjectives from every "AI security" narrative and read the tokenomics underneath. And you remember the oldest rule in this business: profit is taken, not hoped for. The people who survive the next catastrophe will not be the ones who predicted it. They'll be the ones who had already rehearsed their exit.
The question worth sitting with isn't whether two labs war-gamed a disaster. It's this: if the people closest to the blast radius are rehearsing how to survive it, and the people standing in the blast zone are rehearsing nothing — who exactly is the war-game protecting?