Hook
On September 21 — and the source that carried the news declined to specify the year, a detail I will return to because it changes everything — a single sentence crossed the wires: OpenAI and Anthropic were in talks to mutually stress-test each other's frontier models. No primary source. No scope. No arbitration clause. No disclosure mechanism. Just two of the most valuable private companies on the planet reportedly agreeing to audit each other's most sensitive intellectual property and then, presumably, telling the rest of us it went fine.
I have watched this exact architecture fail before, and I watched it fail in real time with real capital on the line. In crypto, we gave it a name. We called it proof-of-reserves. A custodian attests that the assets exist. A friendly auditor signs the attestation. The attestation is not an audit. It covers assets but not liabilities. It is a snapshot, not a system. It is a document that says "trust us" rendered in the font of a document that says "we verified this." And it worked — right up until it didn't. FTX published a proof-of-reserves. FTX is now a case study in why attestation without verifiability is theater.
So when two direct competitors in the API market — Claude versus GPT, Codex versus Claude Code, ChatGPT versus Claude — announce that they will police each other's failure modes, the first question is not "is this good for AI safety?" The first question is the one crypto learned the hard way: who verifies the verifier?
The chart whispers. The ledger screams the truth. And there is no ledger here. There is only a sentence, in a bull market, wrapped in the vocabulary of prudence.
That is worth unpacking slowly, because the AI-crypto convergence trade I spend my days mapping runs straight through this problem. If you care about the agent economy — and you should, because that is where the next liquidity frontier sits — you cannot ignore the trust layer underneath it. And this reported stress test is, at its core, an attempt to build a trust layer by hand.
Context
Let me establish what "mutual stress testing" actually means, because the term is borrowed, and the borrowing is the story.
In traditional finance, a stress test is a formal, institutional exercise. The Federal Reserve runs the Comprehensive Capital Analysis and Review and the Dodd-Frank Act Stress Test on an annual cycle. Banks submit their portfolios to standardized, published scenarios — a sharp recession, a housing collapse, a rates shock, a liquidity freeze — and the regulator produces a pass/fail judgment with real consequences. Fail, and you cannot return capital to shareholders. Fail badly enough, and you face supervisory action. The mechanism has teeth because it has three components: a mandatory regulator with authority to fail a bank, a standardized library of scenarios every institution faces identically, and public disclosure of the verdict. Remove any one of the three and the exercise degrades into a reporting ritual.
AI has none of the three. There is no regulator with the authority to fail a frontier model. There is no shared scenario library. And there is no agreed-upon pass/fail threshold. What AI has instead is a patchwork of self-authored frameworks. OpenAI's Preparedness Framework grades capabilities across low, medium, high, and critical tiers. Anthropic's Responsible Scaling Policy grades by AI Safety Level — ASL-2, ASL-3, ASL-4 — with each level triggering a specific deployment and security protocol. Google DeepMind's Frontier Safety Framework grades by Critical Capability Levels.
The vocabulary rhymes. The math does not. Two labs can both say "we tested for CBRN uplift" and mean entirely different things, with different threat models, different elicitation techniques, different scoring rubrics, and different definitions of where the red line actually sits. This is not a technicality. It is the central obstacle. You cannot mutually recognize a standard that does not exist, and you cannot build a stress test on a foundation of incompatible scorecards.
The background timeline matters too, and it is why the missing year is not pedantry. Through 2024, both OpenAI and Anthropic signed model-access agreements with the US AI Safety Institute — since renamed the Center for AI Safety Institute, CAISI — and with the UK AI Safety Institute. Those were government-backed third-party evaluations. An external referee, however imperfect, with statutory standing. If the reported talks are real, they should logically be understood as a supplement to that government evaluation, not a replacement for it. But the report names no government body. That silence is a data gap, and in my line of work, silence in the sourcing is where the risk hides.
There is a second timeline that changes the meaning of the sentence entirely. From August 2025, the EU AI Act's general-purpose AI obligations entered force, imposing documentation, evaluation, and disclosure duties on providers of frontier models sold into the European market. If the talks happened in September 2024, they sit in the gap after the AISI signing wave and before the EU rules landed — an early, experimental gesture. If they happened in September 2025, they sit inside a world where the EU already demands compliance evidence, the US AI Action Plan has been published, and a bilateral safety arrangement begins to look like compliance infrastructure under construction. The same sentence means "interesting experiment" in one world and "the beginning of a certification regime" in the other. I will flag both readings where they diverge, because the strategic weight of this event is not fixed. It floats on a date.
Now, to the core, which is where the real analysis lives.
Core
The standards don't compose, and that is the whole game.
Here is the technical reality the headline flattens. Frontier safety evaluation is not a single test you can run and score. It is a stack: threat modeling, capability elicitation, red-teaming, environment fidelity, and scoring. For two labs to "mutually stress test," every layer of that stack has to be interoperable between them. They are not interoperable, and they are not interoperable for structural reasons that have nothing to do with goodwill.
Consider elicitation first, because it is the layer people underestimate. A capability benchmark is only as good as the methods used to pull the capability out of the model. If Lab A uses simple prompting and Lab B uses sophisticated agentic scaffolding with tool access, memory, and multi-step planning, Lab B will find more dangerous capability — not because its model is more dangerous, but because its test is harder. When A tests B, A's weaker elicitation will understate B's risk. When B tests A, B's stronger elicitation will overstate A's risk. The result is not a ranking. It is noise dressed as a verdict, and it is precisely the kind of noise that can be weaponized selectively when the finding is convenient.
Consider reproducibility. A language model is a stochastic system. The same prompt produces different outputs across runs. A red-team finding that appears once may not appear again on a re-run. A jailbreak that succeeds at temperature 1.0 may fail at temperature 0.2. Establishing a reproducible evaluation protocol — one that a third party could re-run and get a statistically stable result — is itself an open research problem. This is the part the eventual press release will never mention: the mutual stress test requires solving a problem that no lab has fully solved even internally. My honest read, based on a decade of watching evaluation infrastructure mature in crypto, is that the industry is at least eighteen months away from a reproducible frontier capability protocol that two independent teams would both sign off on.
Consider environment fidelity. A capability that is harmless in a chat interface can be dangerous in a deployed agent with tools, memory, and access to external systems. A model tested in a sandbox and deployed as an autonomous assistant arranging payments, booking logistics, and calling APIs is a different risk object. Two labs cannot meaningfully compare results unless they agree on the deployment configuration they are testing — which, for competitive reasons, neither has an incentive to standardize. The whole commercial edge of a frontier lab is that its deployment is different from everyone else's.
So the honest read is this: the collaboration, if real, is far more likely to be intelligence-sharing than standard-setting. A shared database of attack vectors, jailbreak patterns, and red-team findings is cheap, fast, confidential, and genuinely useful. A mutual certification regime is expensive, slow, leaky, and requires both sides to expose the proprietary methods that constitute their edge. When you cannot verify the verification, the rational move is to share threats and skip the certificate. That is almost certainly what an early-stage negotiation looks like from the inside. It is also exactly what you would describe to the public using the most impressive available vocabulary, which is why the word "stress test" got chosen over the words "informal threat exchange."
The verifier problem is a crypto problem, and crypto already lost this round once.
I spent part of 2022 watching the crypto industry learn what "attestation" really buys you. After the Terra collapse, the industry demanded proof-of-reserves. Exchanges complied. The reports looked official. They were not audits. They were attestations — point-in-time, no liabilities, no internal controls, no penetration testing, no segregation-of-funds verification. When FTX failed, the lesson crystallized with brutal clarity at a cost of billions: an attestation from a related party is not evidence; it is a press release with a balance sheet stapled to it.
The AI mutual stress test is that exact structure, one level up and with higher stakes. Two competitors, each with strong commercial incentives to look safe and to avoid embarrassing the other into retaliation, agree to evaluate each other. What enforces honesty? There is no regulator to sign off, no shared standard to fail, and — as reported — no named third-party arbiter. In the absence of an independent referee, the mechanism has two equilibrium states, and neither is the one safety advocates want.
Equilibrium one: both sides find nothing alarming. This is the outcome the incentives predict, not because the models are safe, but because reporting a finding is a costly act of aggression that invites symmetric disclosure. Equilibrium two: one side finds something real and then faces a decision — weaponize it publicly and trigger a reputational war, or bury it and preserve the relationship. Neither path produces the public good of genuine visible safety. Both paths preserve the appearance.
This is the verifier problem, and it is not a new one. It is the oldest problem in cryptography. It is the reason the entire crypto industry is built on the principle that you do not trust a counterparty; you verify them, and you make verification public so that no one has to trust anyone. The AI safety world is now reaching for bilateral peer trust — the exact model crypto spent fifteen years learning to distrust. That is the structural tell, and it is the hinge of this entire analysis.
Thesis versus reality.
I run every consequential claim through a Thesis-versus-Reality filter, a habit I picked up the hard way in 2022 when I shorted overleveraged DeFi positions based on exactly this kind of framing while most of the market was still chanting. So let me apply it here.
Thesis: two frontier labs are collaborating on safety, and this represents the maturation of AI governance. Reality: two competitors are negotiating over what each is willing to expose to the other, in a context where exposure is commercially toxic and the only likely output is a shared threat library. The word "collaboration" is doing enormous work in the public framing, and none of it is verifiable.
Thesis: a mutual stress test is more credible than self-reported safety because it introduces an adversarial check. Reality: an adversarial check without arbitration and disclosure is a liability, not an asset — it creates the power to privately threaten rather than the power to publicly certify. Asymmetric information under competitive pressure is a recipe for either silence or selective leakage, never for honest reporting.
Thesis: the absence of a named third party is a reporting gap. Reality: the absence of a named third party is probably a substantive fact. If a neutral arbiter like METR or a government institute were involved, that involvement would be the first thing announced, because it is the highest-credibility element available. Its absence in the reporting implies its absence in the arrangement. That inference is the single most important conclusion of this analysis, and it is the one that should drive how you price the entire story.
Compliance theater is not a bug; it is the default output of voluntary self-regulation.
I want to be precise here, because "theater" gets thrown around loosely and loses its edge. Compliance theater is not lying. It is the production of the appearance of compliance at the lowest possible cost consistent with that appearance. It emerges whenever three conditions hold: the cost of genuine compliance is high, the cost of being caught faking is low, and the audience cannot tell the difference. Financial attestation was theater because the audience — depositors, counterparties, lenders — could not see the liabilities. Voluntary safety testing becomes theater the moment the audience cannot see the test.
This connects directly to something I have written about in an entirely different domain. Most KYC in crypto is theater too. The compliance cost is enormous, it is borne almost entirely by honest users through friction, documentation, and de-banking, and any determined actor routes around it with a fresh wallet, a compliant front, or a jurisdiction with lighter touch. The theater is real; the security is largely not. The cost is passed entirely to honest users, and I have said so publicly more than once. The AI safety version of this writes itself: a mutual stress test that produces no public report and no external arbitration is a compliance ritual that costs the participants some reputation-management effort and buys them a regulatory talking point. The honest users — in this case, the public, who must trust that machine intelligence is being managed responsibly — pay in misplaced confidence.
There is a deeper symmetry worth naming. In both crypto KYC and AI safety theater, the apparent rigor is designed for an audience that cannot verify it. The theater works on the credulous, the busy, and the regulated. It fails on the adversarial, the technical, and the patient. And eventually, markets reward the adversarial, the technical, and the patient. That is not a moral claim. It is a market-structure claim, and it is one that has been tested to destruction many times.
Regulatory capture is a business model, and the moat is the standard.
Let me quantify the moat, because this is where the money lives and where the reported talks acquire their real strategic meaning. I have spent the last several years quantifying institutional moats for clients, from ETF flow modeling to sovereign allocation behavior, and the pattern is consistent: the durable moat is never the product. It is the standard the product is measured against.
Anthropic's private valuation sits in the tens of billions, built on a thesis of high-quality output plus high-safety positioning. It is materially smaller than OpenAI on revenue and distribution. Its safety brand is not a moral accessory; it is the load-bearing pillar of its differentiation. OpenAI, meanwhile, has spent 2024 and 2025 rebuilding governance credibility after the dissolution of its superalignment team, a wave of safety-staff departures, and a growing stack of litigation. Both companies face a wall of regulatory and legal pressure: California SB 1047 and its successor efforts, federal rulemaking, the EU AI Act, and copyright suits over training data.
Against that backdrop, a mutual safety arrangement is cheap insurance. It signals to regulators that the industry can self-govern — the classic argument against hard mandates — and it signals to enterprise buyers that these two vendors are the responsible ones, which is a procurement advantage worth real money in a market where Fortune 500 legal teams are choosing AI vendors for the next decade. The direct financial effect on the two companies is close to zero. The reputation effect is meaningfully positive. That asymmetry is the tell, and it is the reason the news leaked the way it did.
The deeper prize is the standard itself. History does not repeat, but it rhymes in code. When a dominant player co-authors the rulebook, the rulebook is written so the dominant player passes. This is the Basel Accords for banking, where capital requirements were calibrated in ways the largest institutions could absorb and smaller ones could not. This is GMP for pharmaceuticals, where manufacturing standards evolved into a barrier that favored incumbent scale. This is the textbook regulatory capture pattern: the lobby does not fight regulation; it writes regulation. The first mover in defining a "frontier AI stress test" owns the certification regime — and certification regimes are gates. Governments buy through them. Enterprises do diligence against them. If the gate is designed to require resources only two or three labs possess, then the gate is a moat, and the moat is unassailable by construction.
Capital flows where intelligence meets speed — and here, speed means who sets the benchmark first. The first lab to define the test defines the market. That is why this story matters far more than the surface safety narrative suggests. It is not primarily a safety event. It is a standards-power event dressed in safety clothing.
The absent parties are the loudest signal.
The report names two companies. The silence names everyone else, and I want to read that silence carefully because it is more informative than the text.
Google DeepMind is a peer of both — arguably the strongest safety research bench of the three, with its own Frontier Safety Framework and a deep bench in interpretability and alignment. It is absent. Is that because it was not invited, or because it declined? The answer determines whether this is a broad industry effort or an exclusive club. If DeepMind is out, the "duopoly standard" reading strengthens considerably, and the framework becomes bilaterally constructed rather than industry-wide. Given DeepMind's competitive position and its parent company's incentive to shape rather than follow standards, its absence is more likely a signal of exclusion than disinterest. That is the first crack in the "industry maturation" narrative.
China's frontier labs — DeepSeek, Alibaba's Qwen, Moonshot — are absent too. That is expected in a geopolitical sense, but it carries a consequence the framing never admits: any "international" AI safety standard that excludes half the world's frontier capability fails the way a nuclear treaty fails when the largest arsenals abstain. A standard with no adversarial enrollment is not a safeguard. It is a coordinate among friends, and coordinates among friends do not constrain the actors they are nominally designed to constrain.
The open-weight ecosystem — Meta's Llama line, Mistral, the sprawling Hugging Face constellation — is structurally excluded by design, and this is the part that should concern anyone who thinks safety is the real goal. An open-weight model cannot be red-teamed inside someone else's clean room without surrendering the very property that makes it open: inspectability without gatekeeping. Under a mutual-recognition regime, open models get sorted into the "high-risk, unverified" bucket — not because they are more dangerous, but because they cannot afford the ticket. This is the standard-exclusion problem in a single sentence: the cost of proving your safety becomes the barrier to entry, and the barrier to entry entrenches the incumbents. The entire Layer 2 scaling debate taught us this lesson from the opposite direction — when execution gets repriced after a data bottleneck saturates, the players who provisioned early capture the market, and everyone else discovers that "cheap" was a subsidy, not a policy.
The evaluation supply chain is the real trade.
If mutual stress testing becomes a norm, it does not happen in a vacuum. It requires neutral tools and neutral auditors. That demand flows to the small set of organizations that already do this work: METR, Apollo Research, the safety divisions of the larger data companies, and the government institutes themselves. This is the emerging evaluation-industrial complex, and it is a genuine business with genuine barriers to entry — you cannot improvise a frontier red team in a quarter.
The more interesting downstream market is insurance. AI liability and model-failure insurance need quantifiable risk ratings. A mutual stress test that produces a scored report could become a pricing input — the AI equivalent of a Moody's or S&P rating on a corporate bond. Once that happens, the raters gain enormous power, and the labs gain a new dependency they did not previously have. The analogy is not decorative. Ratings agencies became systemically important precisely because regulation hard-wired their judgments into capital requirements. If AI regulation hard-wires mutual stress tests into compliance, the testers become the new gatekeepers, and the gatekeepers become the systemic risk they were meant to mitigate.
There is a second-order supply-chain effect almost nobody is modeling. If safety testing standardizes on data provenance and copyright compliance as evaluation criteria — a plausible direction given the current litigation environment — then the negotiating power of content and data owners rises further, reinforcing the copyright-holder position I flagged earlier. And in a multipolar world, the standards body that defines AI safety gets to define AI legitimacy, which is a foreign-policy asset, not merely a technical one. Whoever certifies frontier models certifies which nations get to participate in the frontier economy. That is not a safety conversation. That is a sovereignty conversation.
The clean-room problem is the part nobody will solve for free.
Here is the commercial objection that kills most ambitious versions of this plan, and it needs to be stated plainly because it is the reason the reported talks are almost certainly narrower than the headlines imply.
To stress-test a model deeply, you need access — at minimum, internal behavior data, likely model weights, possibly circuit-level introspection. That is the crown jewel of a frontier lab. No competitor opens its weights to a rival, and no board approves it without an isolation regime that is itself unprecedented. So the negotiation, if it is real, is really about clean rooms: shared testing environments where each side's model runs under the other side's probe or a third party's probe, with outputs logged, weights protected, and findings compartmentalized so that a discovered vulnerability cannot be turned into a commercial weapon. This is a hard engineering and legal problem. It is also its own market opportunity — a testing-isolation service niche that the government institutes or specialized vendors could own.
And here is the crypto tie-in that most analysts miss entirely, and the reason I care about this story beyond the governance angle. The infrastructure for verifiable, privacy-preserving computation already exists in this industry. Zero-knowledge proofs, trusted execution environments, verifiable computation, on-chain attestation registries — this is the crypto-native toolkit built for exactly one purpose: proving something is true without revealing the underlying data. The AI safety mutual stress test is a verifier problem. Crypto spent a decade solving verifier problems under adversarial conditions, with money on the line, against actors actively trying to cheat. The convergence is not hype. It is the logical intersection of two industries that both live or die on the question of who can trust whom, and under what evidence.
I have argued before that verifiable attestation is the honest ledger, and that the ledger, not the chart, is where truth lives. The AI safety world is now reinventing peer attestation from scratch and calling it novel. Crypto readers should recognize the shape of it instantly, including and especially its failure modes. We have run this experiment. We know which configurations break. The blob economics of Layer 2 are a preview of how a "free" guarantee gets repriced the moment it has to be actually verified — nothing verifiable is free, and the bill arrives precisely when the subsidy ends. Every safety framework built on unverifiable promises will be repriced the same way. The bill for AI safety theater will arrive as a trust collapse, not an invoice, and by then the cost will be systemic.
The AI wallet is the sleeper, and it is the reason this story is a crypto story.
Step back to the commercial layer and connect the dots to what I have been building models around for the past year.
Both OpenAI and Anthropic operate closed platforms. Payment flows to them; agents do not pay each other. But the next frontier — the one I have been mapping with a small team and a university research partner — is the agent economy, where autonomous software pays autonomously for data, compute, and access. That is a microtransaction problem at machine speed, and microtransactions at machine speed are a crypto problem. When agents transact with each other millions of times a day, they need a settlement layer that is programmatic, verifiable, and cheap — not an invoice from a cloud vendor cleared on a monthly cycle.
Here is the connection that makes the mutual stress test more than a governance curiosity. Whoever controls the safety standard controls the trust layer of the agent economy. If an agent's "safety certificate" determines whether it can transact with regulated counterparties, access primitives, or plug into distribution channels, then the safety standard is not a compliance cost — it is the access key to the machine economy. The two labs are not merely testing models. They are positioning to be the trust registry of agentic commerce, and the registry is where the margin concentrates.
That is the institutional moat, fully quantified: not model quality, not compute, not distribution — the standard. The standard is the gate, the gate is the tollbooth, and the tollbooth is where the durable margin lives. I modeled a potential ten-billion-dollar market for autonomous machine-to-machine commerce within five years, and the single largest uncertainty in that model is not technology. It is who owns the trust layer. This reported stress test is an early move in the contest to own it.
Contrarian
Now the counter-intuitive angle, because the consensus read gets the mechanism backwards and the error is instructive.
The popular critique of voluntary safety testing is that it is too weak — a fig leaf that lets labs smile for regulators while doing whatever they want. That critique is correct as far as it goes. But the more interesting truth is that mutual stress testing between genuine adversaries may be structurally more honest than any single lab's self-assessment — and that is precisely why the labs will resist making it real.
Here is the logic, stripped down. A single lab's internal safety report has one author, one incentive to pass, and no adversarial check. A mutual test introduces a party with a genuine interest in finding fault. Anthropic has every incentive to find a dangerous capability in a competitor's frontier model, because finding one is a competitive and reputational win. That adversarial dynamic is the only thing that makes peer review mean anything at all. It is the same reason academic peer review, whatever its well-documented faults, still beats self-publication. Adversaries are better verifiers than friends, because adversaries do not want to be fooled.
But adversarial honesty can only survive under two conditions. First, an independent arbiter to adjudicate disputes, so that a finding can be reported without the reporter being accused of commercial sabotage. Second, public disclosure of results, so that the finding reaches the audience that would actually benefit. Without the arbiter, the adversary cannot safely report what it finds — reporting becomes an act of war, and war is bad for business. Without disclosure, the finding never escapes the room. So the two conditions that make the mechanism honest are exactly the two conditions the labs have the least incentive to accept. That tension is the entire story, and it is why the presence or absence of a named third party is the single most important detail in the reporting.
This is where the crypto blind spot becomes genuinely useful. The crypto industry's answer to the verifier problem was not peer review. It was to make verification public and trustless — to remove the need to trust either party by making the ledger visible to everyone. The AI safety world is reaching for peer trust; crypto already tested peer trust and found it insufficient. The synthesis — an AI safety framework with cryptographic, publicly verifiable attestation — is the only version of this that closes the loop. Any mutual stress test that stops at bilateral assurance is the FTX proof-of-reserves of AI. It will look like safety. It will function as marketing. And it will fail on exactly the timeline you would expect: not in the calm, but at the moment of maximum consequence.
The blind spot in the entire discourse is this: no one is asking who audits the auditors. The report names no arbiter because there probably is none yet. And if there is none, then "mutual stress testing" is a phrase, not a mechanism — a coordinate among friends dressed as a safeguard for strangers. Markets eventually discover the difference, and the discovery is rarely gentle.
Takeaway
Two developments turn this sentence into either fact or fable, and neither has arrived.
First, disclosure. If an independent arbiter — METR, Apollo, a named government institute — publicly confirms participation, and if a report is ever published, the mechanism is real and worth tracking closely. If the next development is another unnamed brief, treat it as reputation management and price it at zero.
Second, adoption. If the EU AI Act compliance guidance or the US CAISI formally recognizes bilateral mutual testing as compliance evidence, the standard-setting game is live and the moat is being poured. Watch whether DeepMind joins and whether China is engaged. A standard that excludes half the frontier is not a standard. It is a cartel, and cartels invite arbitrage.
For the AI-crypto convergence trade, the signal is directional and slow. Verifiable attestation of machine behavior is coming, because it is the only solution to the verifier problem that does not require trusting a competitor. When it arrives, the instinct that built on-chain transparency will finally meet the instinct that built frontier models, and the settlement layer for the agent economy will be the prize both are circling.
The chart whispers. The ledger screams the truth. The question for 2026 and beyond is whether AI will let the ledger speak — or whether two trillion-dollar rivals will keep signing each other's homework and calling it safety while the rest of us are asked to look away.