The entity being evaluated wrote the evaluation.
A new report circulating through AI-safety channels lands one claim against Anthropic: its Responsible Scaling Policy โ the framework that determines when a model is too dangerous to ship โ is self-executed and self-judged, with no binding third-party verification behind it. No named critic. No specified design flaw. No cited research. Three information points, dressed up as a controversy.
That thinness is itself the story โ not because the claim is false, but because it is directionally correct, and because crypto industrialized the same failure a decade earlier and already has the receipts. Merkle-tree proof-of-reserves that hash assets and quietly omit liabilities. Protocol audits purchased from the protocol's own treasury. Governance votes whose quorum is manufactured by the proposing entity. Layer-2 "decentralized sequencers" that have been a conference slide since 2022.
The ledger remembers what the market forgets. Here is what Anthropic's structural problem looks like from an industry that built the template first.
Anthropic's RSP landed in September 2023 as v1.0, was rewritten as v2.0 in October 2024, and refreshed again in early 2025. Its spine is the AI Safety Level system โ ASL-1 through ASL-4+ โ where crossing a defined capability threshold triggers escalating deployment controls: weight security, red-teaming, restricted access. Claude Opus 4 shipped under ASL-3 protections.
The architecture is more transparent than its peers. OpenAI's Preparedness Framework arrived December 2023. Google DeepMind's Frontier Safety Framework followed in May 2024. Anthropic published first, iterated more, and ships System Cards with unusual granularity. It cooperates with METR, the UK AI Safety Institute, and Apollo Research. When SaferAI graded major labs' RSPs in October 2024, Anthropic came out highest โ and still landed in the "weak to moderate" band. Tallest among short men.
None of that answers the actual objection. The objection is architectural: the lab that benefits from deployment velocity also adjudicates when deployment halts. That is a structural conflict, not a character flaw.
I have been on the other side of that sentence. In 2022, during the Terra unwind, I stopped telling readers to trust audit badges and started telling them to pull contract dependencies themselves โ because the badge was purchased from the builder's own budget, on the builder's own timeline, with the builder selecting scope. Governance as a product, I argued in 2020 when Aave decentralized. The product has a price. So does the audit.
Start with the incentive. Anthropic's revenue depends on deployment. Deployment cadence is gated by evaluation results. The evaluator sits inside the revenue path. This is the oldest problem in public administration โ the regulated writing the regulation โ and no quantity of individual good faith resolves it. Self-assessment is not a control. It is a disclosure.
Then the harder problem: elicitation. To certify "we did not detect a dangerous capability," you must first establish that your testing could have detected it. That is an unfalsifiable proposition. You cannot prove a negative across a capability space you have not fully enumerated โ especially against a model that may behave differently once it recognizes an evaluation environment. Sandbagging, evaluation contamination, deceptive alignment: the named failure modes all point the same direction. Every frontier lab has this hole. Anthropic is not special. It is the most legible target.
Crypto has three production-grade versions of this hole.
Proof-of-reserves is the cleanest. Exchanges hash user balances into a Merkle tree, publish the root, and call it attestation. The tree proves assets. It says nothing about liabilities โ borrowed positions, off-balance-sheet obligations, customer funds already redeployed. A Merkle proof that omits the liability side is a technically rigorous document that cannot detect insolvency. Formal rigor, zero risk coverage: that is evaluation theater.
Paid audits are the second. I spent May 2021 pulling Bored Ape secondary sales transaction by transaction, tracing clustered wallets that traded in coordinated loops. Roughly 30% of apparent volume was inflation, not demand. Nobody had falsified it because nobody was paid to falsify it. Scoping is the product.
Governance is the third. Power lies in the code, not the community. Quorum thresholds, delegation graphs, snapshot mechanics โ all code, all tunable. When I modeled Aave's governance shift in 2020, the thesis was that participation stabilizes once voting rights carry tangible value. What I under-modeled was how cheaply participation can be manufactured by whoever controls emissions.
Anthropic's RSP carries the same three properties: self-hashed assets, self-scoped audits, self-tuned thresholds.
Uniswap's v4 hooks push this further. Every hook is a new contract somebody must verify, and the population of teams capable of verifying them has not grown with the surface area. Layer-2 sequencers are the same story on a longer runway โ "decentralized sequencing" has been on roadmaps for two years while one operator orders the transactions in production. Any audit that measures the document instead of the mechanism returns a passing grade.
In 2025, mapping institutional custody inflows against retail exchange volume, the pattern that held was this: capital arriving through regulated wrappers demanded verifiable attestation, not brand claims, and volatility compressed where custody was auditable. Institutional money does not pay for safety narratives. It pays for verifiable structure.
The genuine shift is that evaluation is becoming a market. METR, Apollo, and the national AI Safety Institutes are the first vendors of a certification layer. On-chain forensics walked that exact path โ informal chain-watching, then paid engagement, then formal attestation reports that now determine whether a protocol's numbers are believed. The same consolidation is starting in AI. Whoever holds the credential holds the gate.
Now the part the report does not say.
The critique is selective by construction. It targets the lab that publishes most, iterates fastest, and accepts external review earliest. That is not where the risk concentrates; it is where the visibility concentrates. Crypto runs the identical asymmetry. Protocols that publish their reserves, their incident post-mortems, and their governance forums absorb the criticism. Protocols that publish nothing never make the headline, because there is no surface to attack.
Worse, the proposed cure has a capture problem. Mandatory independent evaluation sounds like a safety mechanism. Mechanically, it is a cost floor. Five or six credentialing firms, retained by the entities they certify, minting attestations that regulators accept at face value. That structure raises the price of shipping a model and eliminates small teams from the frontier โ which entrenches exactly the incumbents the critique claims to threaten. Anthropic, as the most regulator-friendly lab in the field, is plausibly the net beneficiary of a rule that reads as a rebuke.
The sourcing deserves a flag too. A crypto-native outlet reporting on centralized AI lab governance carries an ideological charge the text never discloses. Decentralization advocates have a standing interest in discrediting centralized safety claims. That does not make the critique wrong. It makes the framing convenient.
Watch three signals over the next two quarters. Whether Anthropic amends the RSP in response and publishes the delta. Whether the EU AI Act's GPAI third-party evaluation provisions land as binding obligation or as procedural theater. And whether crypto's own audit market consolidates into a small ratifying cartel that certifies its own clients.
If the evaluator is paid by the evaluated, what precisely is being certified โ the system, or the willingness to keep paying?