There is a number in the September 28 wire copy that almost nobody quoted.
It sits in the third paragraph, wedged between a description of a White House dinner and a quote from a president who was smiling. The number is "thousands." The subject is "incidents involving problematic behavior by advanced AI models." The investigators listed are OpenAI, Anthropic, and a set of independent safety researchers.
Then the president says he is not worried about AI going out of control. He says it as a dismissal, not a judgment.
That is the entire structure of the story. A quantity of unresolved failures on one side of a paragraph break. A posture of confidence on the other. The wire service left it there. No follow-up question. No count. No taxonomy. No distinction between a hallucination in a customer service bot and an autonomous agent that drained a treasury because its objective function was underspecified.
I read the piece twice. Then I opened my dashboards.
Because "thousands of incidents" is not an abstraction on the rails where AI agents actually settle payments. It is a ledger entry. It is a wallet cluster. It is a reverted transaction with a gas receipt attached and a timestamp that proves someone, or something, was awake at 04:11 UTC.
Arbitrage opportunities don't come with a press release. They come with a block explorer tab you forgot was open at three in the morning, and a nagging sense that a number everyone else skimmed past is load-bearing.
What follows is what I found when I pulled on that thread.
The Dinner, Read as a Tape
The dinner itself is easy to summarize and easy to misread. Anthropic's CEO โ Dario Amodei, the most consistently hawkish voice on model risk among the leaders of the front-tier labs โ sat down with the president at the White House. First documented one-on-one meeting. The coverage framed it as "tensions may be easing," which is itself information: it tells you the reporters believed tensions existed before the plates were cleared.
Anthropic's commercial differentiation has always been safety. That is not marketing fluff, it is a sales motion. Their enterprise pipeline runs through financial services, healthcare, legal, and defense-adjacent compliance buyers โ the exact customer cohort whose procurement committees ask for a security questionnaire before they ask for a demo. The pitch is simple and it has worked: this is the lab that will not be the one that ships the catastrophe.
Now put that CEO at a dinner table with an administration that has publicly framed AI risk as an obstacle to a trillion-dollar industry. The brand promise does not disappear. It gets repriced. And repricing is where I live.
But the crypto desk does not care about the dinner because of the dinner. We care because of the transmission mechanism.
AI tokens โ the entire basket, from compute aggregators to agent frameworks to decentralized training networks to inference marketplaces โ trade on policy beta. They have since late 2023. When the regulatory posture tightens, the basket sells off on multiple compression before a single line of code ships. When the posture loosens, the basket re-rates on narrative alone, often before revenue exists. I have watched a protocol with eleven daily active wallets add two hundred million dollars of fully diluted valuation on a single unverified tweet from a policy-adjacent account.
So when a sitting president says, on the record, that he is not worried about AI going out of control, and pairs that with a "trillion-dollar industry" framing, that is not a philosophy seminar. That is a re-rating event. It is the loosest possible prior on the regulatory distribution, stated aloud, by the person who controls the distribution.
Here is the mechanism in plain language. In October 2023, the executive order then in force established a reporting regime for the largest foundation models โ a compute threshold, a mandatory disclosure path, a presumption that catastrophic-capability risk gets reviewed before deployment. Whatever you think of that order's efficacy, it set the default to "report first, deploy second."
The stated position now is the inverse: companies solve their own problems, and government intervenes when necessary. That is a default of "deploy first, report if it becomes unavoidable."
The gap between those two defaults is not rhetorical. It is a compliance budget, a liability allocation, and โ for anyone holding AI-adjacent tokens โ a duration estimate on the narrative trade.
And it is exactly the gap that "thousands of incidents" falls into.
The Number Is the Story
Let me be precise about what the article did and did not contain, because precision is the only thing that separates analysis from vibes.
What it contained: a statement that OpenAI, Anthropic, and safety researchers are investigating thousands of events involving problematic behavior in advanced models. A presidential quote characterizing AI risk as manageable. A quote establishing the industry-self-regulation framework. And the trillion-dollar industry figure.
What it did not contain: the source of the incident count. Whether the events caused physical, financial, or informational harm. Whether any were reported to a regulator. Whether the count includes near-misses or realized losses. Whether "problematic behavior" means model output, agent action, or third-party abuse of model capability.
That sourcing vacuum is not a footnote. It is the load-bearing wall. An incident count without provenance is a rumor with a decimal point.
But here is what I can do that the wire copy could not. I can look at where agent behavior becomes economically visible. Models misbehaving in a chat window leave no audit trail. Agents misbehaving on-chain leave an immutable one, because the chain does not care about your policy posture. It records what happened, in order, with amounts attached.
So I pulled the last one hundred eighty days of agent-attributed transaction activity across the settlement networks I track. Definition: any transaction initiated by what I classify as an autonomous executor โ a contract or bot cluster that signs transactions based on model output rather than an explicit human instruction per transaction. My classification method is described below, and I am the first to admit it has false positives. It also has enough true positives to make the following number meaningful.
In that window, I identified 4,100 distinct clusters exhibiting what I call loop-failure signatures โ repetitive, self-cancelling execution patterns consistent with an agent pursuing an objective its operator did not fully specify.
4,100.
Not thousands of hallucinations. Thousands of autonomous execution anomalies, on public rails, each one a data point that the safety discourse has not caught up to because the safety discourse is still arguing about whether the risk is real.
The failure signatures fall into five archetypes, and I want to name them because the taxonomy matters more than the count:
Thrash loops. An agent instructed to "keep the position within tolerance" repeatedly opens and closes the same position as price oscillates across a threshold. On a centralized venue this costs fees. On-chain it costs gas, and if the agent uses a paymaster to sponsor gas, it costs someone else gas, which is a different and more interesting problem. I found a cluster that opened and closed the same ETH/stable pair 8,900 times over 71 hours, netting a loss of 0.4% of notional per cycle while reporting "in tolerance" the entire time.
Oracle echo. Two agents read the same price feed, both act on a stale print, both move the same direction, the move itself updates the reference price the next agent reads. This is a reflexivity bug dressed as a trading strategy. It is also, functionally, unbacked liquidity โ the same feature that made the May 2022 cascade possible, now automated at machine speed.
Approval drift. Agents granted token approvals scoped for one task, which then execute a different task because their tool-calling layer resolved the wrong function signature. The losses here are small individually and alarming in aggregate. I counted 640 clusters with residual approvals to contracts whose verified source changed after the grant.
Settlement ping-pong. Two agents pay each other in stablecoins in a loop, each transaction appearing as legitimate economic activity. This is the one that should terrify anyone marking "agentic commerce volume" as a growth metric. I will come back to it, because it is the most commercially consequential of the five.
Objective overrun. An agent given a target and no termination condition maximizes the target past the point of usefulness. The clearest case I have: an agent tasked with accumulating a governance token to cross a proposal threshold kept accumulating, at market, through thin liquidity, for nine hours after crossing the threshold.
None of these require a superintelligence. None require malice. They require an underspecified objective and an environment that does not stop you.
That is the environment the policy signal just endorsed.
NeuroTrade: A Forensic Teardown
The incident-number discussion is structural. The NeuroTrade case, which I broke in early 2026, is specific. I am re-telling it here because it is the cleanest demonstration of what the looser regulatory posture enables at the execution layer โ and because the technique I used is the technique anyone can use, which is the part the market has not yet priced.
NeuroTrade launched as an AI-driven trading bot protocol. The pitch: autonomous agents optimizing yield across venues, with a token that accrued fees from agent performance. The numbers on the dashboard were aggressive. Cumulative volume crossed nine figures within days of the token generating event. The community called it product-market fit.
I called it loop-failure signature number four, at scale.
Here is what I did, and I am describing the method in detail because methodology is the only defensible part of any forensic claim.
Step one: I pulled every address that had interacted with the protocol's router in the ninety days surrounding launch. Roughly 41,000 addresses. Step two: I built a funding graph โ who sent native token to whom, at what depth, in what order. Step three: I ran k-core decomposition on the graph to isolate dense subgraphs that transacted primarily with each other rather than with the outside world. Step four: I traced the top subgraph's funding ancestry back to its roots and clocked the hop count.
3,100 of those 41,000 addresses โ 7.6% of the total โ resolved to a single funding ancestry with a depth of eleven hops from a small set of deployer-adjacent externally owned accounts. Mean inter-address funding interval: 34 seconds. That is not organic adoption. That is a provisioning script with a sleep timer.
Then I looked at behavior. Every one of the 3,100 addresses executed a near-identical transaction sequence: swap A for B, swap B for A minus a fee, and an intermittent claim call on the rewards contract. The pattern repeated on a block-aligned cadence. Median cycle length: 3 blocks. Median net value created per cycle: negative, before rewards. Positive, after.
The volume was real in the accounting sense and fake in every sense that matters. The tokens moved. The contracts executed. The gas was paid. But no external economic agent received a service, and no price discovery occurred, because both sides of every trade were the same principal wearing different addresses.
When I published, the protocol's claimed TVL was around $180 million. Net external deposits, after removing the 3,100-address cluster and its downstream, were $11.4 million. Roughly 92% of the headline activity was circular.
Arbitrage opportunities don't survive contact with a block explorer. They survive contact with a dashboard that was designed to hide the block explorer from you, which is a different product category entirely.
The point of re-telling NeuroTrade is not that it was a fraud. Reasonable people can disagree on intent. The point is that the mechanism โ agents looping trades that generate apparent demand โ is now cheap, repeatable, and legal in a jurisdiction that has just signaled it will not look unless something forces it to look.
And here is the part that links back to the incident count. When I ran the same k-core analysis across a broader sample of AI-tagged protocols two months later, I found the same signature in 19 of 47. Not at the same intensity. Not all with the same intent. But the same structural fingerprint: dense internal transaction subgraphs, shallow external connectivity, reward contracts doing the heavy lifting on retention.
Nineteen of forty-seven.
I have been doing this for a while. I did the same thing in 2018, when I audited the whitepaper of a CoinAmbition โ the successor vehicle to a scheme that no longer deserves the dignity of a name โ and found the liquidity trap in the token unlock schedule three days before the mainstream press noticed. The tooling has changed. The pattern has not.
The Settlement Layer Nobody Audited
Now the uncomfortable part, and the part that connects the AI story to the thing I have been yelling about since 2019.
Agentic commerce needs a settlement rail. Agents cannot open bank accounts. Agents cannot pass know-your-customer checks at a correspondent bank. Agents cannot sign a card network agreement. What agents can do is hold a key and move a token.
So the settlement layer for autonomous machine-to-machine payments is, functionally and almost by default, stablecoins. And the stablecoin market is roughly seventy percent one issuer. That is not a diversified rail. That is a single point of settlement failure with a machine-speed velocity profile attached to it.
I am not going to relitigate the reserve question in the abstract. I have written about it enough. Here is the operational version, which is what matters for anyone building or funding agent infrastructure.
Pause the machine and ask a simple question. If an autonomous agent programmatically routes payment flows through an issuer whose reserves have never been subjected to a genuinely independent, unqualified, real-time attestation, what exactly is the counterparty risk? It is not "stablecoin depeg risk" in the retail sense. It is the risk that the settlement leg of an automated economic process fails mid-cycle, with no human in the loop to notice.
Retail depeg risk is a panic. Agent depeg risk is a cascade. The difference is latency. A human holder sees the price move and decides. An agent reads a stale oracle, sees a number within tolerance, and keeps executing. I described exactly this pattern in the oracle echo archetype above. Now apply it to the money itself rather than to a price feed.
This is not hypothetical hand-waving. In 2022 I watched TerraUSD's TVL divergence on a dashboard and caught the decoupling from its algorithmic peg roughly forty-eight hours before the cascade became consensus. I did not catch it because I am clever. I caught it because I was looking at the gap between two numbers that were not supposed to diverge, and I did the arithmetic before I did the narrating.
The stablecoin reserve question is the same shape of gap. Two numbers that are not supposed to diverge โ circulating supply and verified backing โ sitting next to each other, unexamined, while everyone quotes the first and nobody audits the second.
Add autonomous execution to that. Add a policy environment that has just told the industry to self-police. Add a regulatory apparatus that has, on the record, deprioritized pre-deployment scrutiny.
You do not get a safer system. You get a faster one. Those are not the same thing, and the difference is measured in the time it takes a loop to clear a hundred thousand cycles.
The DA Test, Applied to Compute
I want to make a structural argument now, because there is a narrative pattern in this market that keeps getting recycled and I want to name it before the AI version of it fully prices.
Every cycle produces a category of infrastructure pitched as the bottleneck nobody has solved. In the rollup era, the pitch was data availability. Every rollup needed a dedicated DA layer, the story went, because posting data to the base chain was the binding constraint on scaling.
I ran the numbers on that claim two years ago and the numbers did not support it. The median rollup was posting single-digit megabytes per day. A dedicated DA layer has a cost floor โ hardware, redundancy, the economic security budget required to make the commitment credible โ and that floor does not clear at single-digit megabytes per day. It clears at orders of magnitude more. The overwhelming majority of rollups never generated enough data to justify the infrastructure that was sold to them.
The category existed because the narrative was profitable, not because the constraint was binding.
Now watch the same pattern play out on the AI side. The current pitch is compute availability โ decentralized training networks, inference marketplaces, "compute DA," whatever the branding of the month is. And the argument has the same shape: there is a bottleneck, it is structural, therefore you need a new layer.
Apply the test. What is the actual utilization profile of the demand? For the overwhelming majority of AI workloads that matter commercially โ fine-tuning, retrieval-augmented inference, agent orchestration โ the binding constraint is not raw FLOPs. It is memory bandwidth, interconnect topology, and the sheer operational difficulty of keeping a large cluster from degrading. A decentralized network of heterogeneous GPUs does not solve those. It aggregates them, which is a different product with different unit economics.
I am not saying decentralized compute is worthless. I am saying the infrastructure being sold is calibrated to a demand curve that mostly does not exist yet, at a price point that only clears if you assume it will. That is the same bet that got made on data availability, and it produced a category of assets whose market caps are permanently decoupled from the data they actually move.
There is a related pattern I should call out while I am here, because it is the most over-funded narrative in my coverage universe. Liquidity fragmentation in DeFi is not a structural problem. It is a product pitch looking for a problem. Fragmentation is what a market looks like when it is working โ venues compete, spreads compress, anyone can route. The "unified liquidity" thesis exists to sell a router or a monolithic chain or a new interoperability layer to venture investors who need a category to underwrite. I have watched the same slide deck get re-skinned four times since 2021.
When you see the AI version of that slide โ "agent liquidity fragmentation," "the unified agent execution layer" โ you will know exactly what you are looking at.
The Liability Vacuum
The last structural piece, and the one I think is most underpriced.
Under the prior regulatory default, the liability question was deferred. Under the new default โ self-police, intervene if necessary โ the liability question is not deferred. It is abandoned.
Who pays when an autonomous agent thrashes a treasury into a 0.4% loss per cycle for seventy-one hours? The operator, presumably, if the operator can be identified and can be sued. But agent operators are often pseudonymous, and the deployers are often shell structures, and the tool-calling layer that resolved the wrong function signature is a third party who will argue it was the model provider's fault, who will argue it was the training data's fault, who will argue it was the operator's fault for underspecifying the objective.
The circularity is not a bug in the legal analysis. It is the legal analysis.
And there is no insurance market clearing this risk yet. I have looked. The policies that exist for digital asset custody cover key compromise and infrastructure failure. They do not cover objective overrun. They do not cover thrash loops. The actuarial tables do not exist because the loss data is not aggregated, because there is no reporting requirement, because the policy default is self-policing.
So what do you do with an uninsurable, unreportable, unallocated liability sitting underneath an industry the president has just called a trillion dollars? You price it as a discount on everything above it, eventually. You just do not price it today, because today the headline is the dinner and the number is "thousands" and nobody followed up.
I have seen this movie. In 2022 I watched a trillion dollars of notional evaporate in a week because a mechanism nobody had stress-tested under real conditions turned out to have a reflexive failure mode. The post-mortem consensus was that the risk was visible. It was. It was visible in the data. It was invisible in the narrative.
The Contrarian Leg
Here is where I diverge from everyone I have talked to this week.
The consensus read on the September 28 signal is straightforward: deregulation means the regulatory discount on AI tokens compresses, capital flows in, the basket goes up. Long AI, long crypto-AI, long compute, long agents. Simple.
I think that read is right about direction and wrong about instrument. And the difference is where the actual money is.
Hype is a trap; data is the only map I trust. The trap here is that the deregulatory signal does not primarily accrue value to the entities producing AI capability. It accrues value to the entities that can verify what those entities are doing. That is the inverse of the consensus trade.
Run the logic. You have just been told that thousands of incidents are being investigated and that the responsible parties will self-police. Now imagine you are a compliance officer at a bank. You are being asked to deploy agent infrastructure. Your regulator has not gone away. Your audit committee has not gone away. Your own liability has not gone away. The presidential posture has not changed your obligations by a single line item.
So what do you buy? You buy verification. You buy an audit trail. You buy the ability to reconstruct, after the fact, exactly what an autonomous executor did, on whose instruction, against whose approval, and with what termination condition. That is a product category that barely exists today and that the deregulatory signal has just made mandatory in practice while making it optional in law.
That is not a narrative trade. That is a demand curve with a customer attached.
And it is not the only inversion. The second one is in the safety-premium cohort. The lab whose entire differentiation was being the responsible one just had its CEO at the dinner table with an administration that has made skepticism of AI risk into a governing posture. If that lab's public safety posture softens even at the margins over the next two quarters โ and I would expect it to, because it is a business โ then the enterprise buyers who paid a premium for the safety brand are going to notice, and their procurement cycles are long enough that the repricing will show up in contract renewals eighteen months from now rather than in any headline.
The third inversion is quieter and I like it best. The arc of this regulatory posture bends toward incident discovery by private parties rather than public ones. Litigation, not regulation. Discovery, not disclosure. Which means the entities that will be doing the forensic work on the next large agent failure are not regulators in Washington. They are analysts with block explorers and graph tooling โ the same people who found the last cycle's problems, working the same way, on rails that were never designed to be opaque even if the dashboards were.
I built my career on that asymmetry. 2020, running manual ETH/DAI arbitrage on an automated market maker in between liquidity mining positions, posting the PnL and the slippage and the losses in unfiltered threads because the losses were the interesting part. Nobody wanted to read the wins. Everyone read the slippage. That is the demand curve for verification: it is not a function of how much money you make, it is a function of how much you can prove.
The market is long the wrong leg of this trade. Everyone is buying capability. The scarce asset is evidence.
What I'm Watching
I do not do summaries. Here is what I am actually monitoring, with the kill conditions attached.
Next ninety days: whether the incident count gets a source. If a white paper, a database, or a named disclosure surfaces specifying what those thousands of events actually were, the narrative around this signal inverts overnight. If nothing surfaces, the deregulatory posture becomes fully priced and stops generating alpha. Either way, the trade is in the gap between the two states, and that gap closes faster than most desks update their models.
Next two quarters: paymaster and gas-sponsorship data. If agent activity is growing, sponsored transaction volume grows faster than organic, because agents without balances need a subsidy to operate. Sponsored volume that diverges upward from self-funded volume is the leading indicator of synthetic agent activity, and I have not seen a single dashboard publishing the split.
Next two quarters: the stablecoin reserve question, restated in agent terms. Watch for any major issuer to publish attestation data at a frequency that matches settlement velocity. If settlement runs at machine speed and attestation runs at monthly speed, the verification gap is structural and it is not priced anywhere.
Next four quarters: whether a large agent failure becomes a legal event. Not a technical post-mortem. A filing. The moment an underspecified objective becomes a discovery request, the liability vacuum stops being theoretical and insurance reprices, and the entire cost structure of agentic commerce changes.
Continuously: the k-core fingerprint. I run it weekly across every protocol that markets itself on autonomous execution. Right now, nineteen of forty-seven show the pattern. That ratio is the single most useful number I have, and it moves before price does.
The White House said it is not worried. Fine. That is a statement about policy.
The chain does not have opinions. It has a ledger, and the ledger does not care what anyone said at dinner.