Six months.
That is the shelf life Anthropic's CEO just stamped onto the open internet. His claim: rogue AI agents, left unsupervised, could seize control of critical systems within two quarters. Crypto Briefing carried the quote. No model architecture. No attack chain. No red-team data. No starting date for the clock.
Three sentences of opinion, dressed as a forecast.
What interests me is not the prediction. It is the tick reaction. Within roughly 48 hours of that story circulating, security-themed tokens, identity protocols and "agent governance" tickers all caught a bid. Nobody verified a single claim. The claim was simply loud enough to trade.
The algorithm doesn't read press releases. It reads settlement. And the settlement layer is telling a very different story than the one being sold.
Anthropic's commercial position is not a mystery, and it is not the point of the article either, but it is the frame. Claude ships through API access, consumer subscriptions, Amazon Bedrock, Google Vertex. Enterprise contracts skew toward regulated verticals. The brand equity sits on Constitutional AI and the Responsible Scaling Policy. Safety is not a value proposition bolted onto the business. Safety is the business.
Which is why "we need an emergency regulatory framework for AI agents" deserves a second read. If agent deployments eventually require licensing, independent audits or certification, the compliance cost lands hardest on open-source maintainers and two-person teams, while incumbents absorb it the way a whale absorbs slippage. I have watched this exact structure before, in a different market.
The SEC's regulation-by-enforcement posture toward crypto was never a misunderstanding of the technology. It was a deliberate decision to withhold clear rules and let ambiguity do the work that enforcement could not. When a regulator declines to draw the boundary, the boundary gets drawn by whoever can afford the lawyers. AI agents are now walking into that same room, and the furniture has not moved.
Notice also what the piece did not contain. No operational definition of "take over the internet." No attack vector. No observed incident. A single-source opinion, filed by a crypto outlet, containing no crypto, which tells you it was placed to harvest attention, not to inform allocation.
Let me be precise about the technical gap, because this is where the six-month framing collapses under its own weight.
As of mid-2024, production agents do four things tolerably well: browse, call APIs, generate code, route tickets. The failure modes are documented and unglamorous. Long-horizon planning degrades. Memory stays shallow. Errors cascade. And prompt injection remains unsolved at the architectural level. That last one is the entire game. An agent is not a hacker. An agent is a very fast, very obedient intern holding your credentials.
Look at how agent signing authority actually works on-chain. ERC-4337 account abstraction. Session keys with expiry. Permissions modules that scope which contracts can be called and for how much. Policy engines that simulate a transaction before it lands and revert if the calldata does not match the stated intent. None of that machinery assumes the agent is trustworthy. All of it assumes the agent will eventually be compromised, and it builds the blast radius in advance.
Based on my audit experience during the May 2022 liquidation cascade, I can describe what that discipline feels like under stress. I was holding leveraged Aave positions into the Terra unwind. The move was not a sentiment event; it was a mechanical event, a cascade of forced sells into liquidity that had already thinned out. I ran a pre-written script that exited 80% of the book at the top of the flash crash, saving roughly $120,000 in potential losses, and then spent six hours auditing every approval I had ever signed across every protocol I had ever touched. Three allowances, all still live, any one of which would have been a total drain if something had invoked it.
The lesson was never that AI is dangerous. The lesson was that the vulnerability is not the tool. It is the standing permission that nobody revoked.
Run that forward. In 2026 I deployed a model to scan developer-activity patterns across Solana memecoins, surfaced a project the social layer had mispriced, and sized into 500 ETH. It returned 4x in 72 hours. The model gathered and ranked data. It did not place the order. Entry, size, and exit were pre-committed before the position existed, because an agent with discretionary capital and open tool access is just a leveraged liability with a polished interface.
So here is the honest risk ranking, and it is not the one that made the headline. First: a malicious human operating an AI agent, already live, already profitable, drainer kits, AI-generated phishing farms, automated social engineering at a scale a 2021 human scammer could never reach. Second: prompt injection hijacking a legitimate agent, one poisoned tool response, one misread webpage, and the agent dutifully signs what it was told to sign. Third, and last on the list where it belongs: a fully autonomous rogue intelligence deciding, unprompted, to seize infrastructure.
The first two have on-chain receipts. The third has a press cycle.
Map the actual chain and the gap widens further. To take over the internet, an agent would need persistent long-term planning, reliable self-replication, working exploit discovery across heterogeneous systems, detected evasion, and cross-system coordination, all simultaneously. The internet is not one door. It is millions of independently authenticated, continuously patched doors, each with its own logging. An agent that can reliably pick one lock is a research result. An agent that picks all of them in six months is a marketing slide.
This is where retail and smart money stop sharing a conversation.
Retail is debating whether the model is conscious. Smart money is pulling revocation rates, session-key expiry policies, and the share of agent-held wallets running unlimited token approvals. The alpha is not inside the AI. The alpha is in the permission layer, and it has been sitting there, unbought, since account abstraction shipped.
I have watched the RWA trade for three years, the conferences, the pilot programs, the press releases, while nobody wanted to say out loud that institutions do not need a public chain to move a treasury. The AI safety narrative is structurally identical. It produces panels, policy papers, and token pumps. It does not produce auditable risk reduction.
What it does produce is a moat. Anthropic warning the world about rogue agents is Anthropic setting the vocabulary of the conversation before the vocabulary gets set for it. And the tell is in the placement. If Anthropic had red-team data showing autonomous agent takeover, it would be a technical report with appendices, not a quote in a crypto news feed. We would have attack chains, timelines, mitigations. We got adjectives.
Track three numbers instead of three headlines: total value sitting in agent-controlled wallets, weekly value drained through compromised session keys, and the percentage of approvals older than 90 days that have never been revoked. Those are the only metrics that will move before the narrative does.
We bet on code, but we pray to volatility. If the six-month clock is real, it will show up in exploit volume long before it shows up in a model benchmark, and if it is not, the approvals will still be sitting there, untouched, waiting.
In DeFi, speed is the only currency that doesn't debase. Right now the fastest thing on-chain is not a rogue agent. It is a human with an unrevoked approval.