At 03:41 UTC on a Tuesday, a two-stage analysis pipeline returned a document.
It was 4,200 tokens long. Nine sections. Each section carried a four-row assessment table, and several carried more: a supply schedule, a risk matrix with six categories and five columns, a Howey test breakdown, a chain-of-transmission diagram with three nodes. There was a disclaimer at the bottom. There was a version number โ v1.0 โ and an applicable-domain line that read: Blockchain/Web3.
Every substantive cell in that document contained the same string.
N/A - insufficient information.
I counted the cells. One hundred and forty-three.
And the job exited with status code 0. [Confidence: high โ the artifact is self-documenting; the exit code is stated in the report's own concluding section.]
That's the finding. Not the missing data. The exit code.
A pipeline that cannot distinguish "I analyzed nothing" from "I analyzed something" is not a research tool. It is a formatting engine with a token budget and a compliance department.
I've spent nine years reading post-mortems, and the interesting ones are never about the exploit itself. They are about the log line that said everything was fine. The 2016 DAO drain was a valid transaction under a valid ABI. The Nomad bridge incident was a valid message under a valid verification path. The report I'm describing is a valid document under a valid schema. Same genre, different layer.
The architecture nobody audits
Two-stage LLM research chains became default infrastructure for crypto coverage somewhere in late 2024, and by now they are as unexamined as the price feeds that sit under every lending market.
Stage 1 โ the extractor โ takes raw input. An article. A governance forum post. An audit PDF. A decoded transaction trace. Its job is to produce an information point list: atomic claims, each carrying a source pointer, a timestamp, and a confidence value. The extractor is not supposed to interpret. It is supposed to decompose.
Stage 2 โ the analyzer โ takes that list and nothing else. It runs the list through a fixed framework. In the case I'm describing, the framework has nine dimensions: technical architecture, token economics, market structure, ecosystem position, regulatory exposure, team and governance, risk, narrative, and supply-chain transmission. Each dimension has sub-tables. Each sub-table has expected fields.
The handoff is a JSON object. The contract is a schema.
Here is the part that matters. Stage 2 has never seen the source article. It cannot see it. It is not passed the URL. Its entire epistemic universe is the information point list. If that list is empty, Stage 2 is not "less informed." It is uninformed by construction. There is no degradation path. There is only silence or invention, and the architecture does not specify which.
The report's own authors understood something was wrong. They listed three hypotheses in the concluding section: the inter-stage data channel broke; the upstream extraction job never ran; the URL never resolved.
All three are correct-shaped. All three are plausible. All three point at the same missing thing, which is that nobody put an assertion on the boundary.
Threat model: the trust boundary is not the model. The model behaved. The trust boundary is the schema check between Stage 1 and Stage 2 โ a check that validates shape and holds no opinion about content.
That boundary is where the next nine months of this industry's embarrassment will live.
And the fully-empty case is the benign one. The dangerous case is partial extraction. Suppose Stage 1 returns three information points out of an expected forty, because the source was paywalled halfway through, or the PDF parser dropped the tables, or the RPC endpoint returned a truncated trace. Stage 2 renders a report that is 92% null and 8% real. It has the same length as a fully populated report. It has the same headers. It has the same confidence markers. Thirteen of the fourteen places where an analyst would notice the gap are the places where a reader's attention goes last.
Two failure modes, one output shape
When you hand a language model an empty context window and a rigid output template, you get exactly one of two behaviors. There is no partial answer. The model has no gradient to descend.
Mode 1 โ confabulation. The model fills the template. It produces a plausible ticker. It produces a TVL figure with a decimal point and a vesting cliff in Q3. It produces a competitor table with real project names and invented market shares. The output is fluent, internally consistent, and false. It is indistinguishable from a good report by reading.
Mode 2 โ abstention. The model emits the template's structural skeleton and marks every leaf node unavailable. This is what happened in the artifact I'm describing. It is the rarer behavior, and it appears when two conditions hold simultaneously: the prompt contains an explicit negative constraint โ do not fabricate; mark unavailable fields โ and the model retains enough self-model to know it has no context to work with.
Note what the second condition requires. The model must compute something about its input rather than from it. That is an extra inference step over the prompt itself, and it is the first thing a cost-optimized pipeline removes.
Most production systems run Mode 1. Not because their operators want hallucination. Because Mode 1 and Mode 2 are indistinguishable at the schema layer.
One is worth money. One is worth zero. The type system cannot tell them apart.
def is_valid(report: dict) -> bool:
return (
isinstance(report["technical"]["innovation"], str)
and isinstance(report["tokenomics"]["supply"], dict)
and isinstance(report["risk"]["matrix"], list)
)is_valid({"technical": {"innovation": "N/A - insufficient information"}, ...}) # True
is_valid({"technical": {"innovation": "Novel DAG consensus, 40k TPS"}, ...}) # True ```
That's the bug. Not in the model. In the definition of done.
[Confidence: very high. I have reproduced this exact validation gap in two internal pipelines since 2024. The failure is not exotic. It is the default.]
Type-valid versus value-valid
Let me name the distinction precisely, because the industry keeps collapsing it.
A document is type-valid when it satisfies the grammar. A document is value-valid when it satisfies the grammar and carries a non-null payload.
JSON Schema gives you type validity for free and value validity for nothing. "N/A - insufficient information" is a legal string. So is "$4.2B TVL, 38% of supply unlocking across Q3-Q4." Both pass jsonschema.validate(). Both satisfy a TypeScript interface. Both deserialize cleanly in Rust.
Every downstream gate that reads the boolean from is_valid() gets True. And every downstream gate is that kind of gate, because the alternative is expensive to build and nobody puts it on the roadmap.
The predicate that would have caught this is fourteen lines long:
SENTINELS = {"n/a", "na", "unknown", "insufficient information",
"n/a - insufficient information", "tbd", "-"}def value_valid(v) -> bool: if isinstance(v, str): return len(v.strip()) > 0 and v.strip().lower() not in SENTINELS if isinstance(v, (list, dict)): items = v if isinstance(v, list) else v.values() return len(items) > 0 and any(value_valid(x) for x in items) return v is not None ```
Fourteen lines. The reason it is not in production anywhere I have looked is not technical difficulty. It is that running this predicate over a typical pipeline's historical output invalidates somewhere between 40% and 60% of it, and nobody wants to be the engineer who runs that query.
I audited a bug one layer below this in 2020. Compound's claimReward function, in the window before the reentrancy patch. The function signature was correct. The access control was correct. The modifiers were correct. The defect lived in the arithmetic โ a state update reachable twice under a specific call ordering. I spent forty hours on it and then wrote an Echidna fuzzing harness to bound the reachable state space, because "this looks wrong" is not a finding.
The lesson was not check the arithmetic. The lesson was that high-level abstractions mask low-level logic errors, and the abstraction you trust is usually the one you wrote to save time.
JSON Schema is that abstraction here. It is masking the difference between an answer and the shape of an answer.
The information content of a 4,200-token document
Shannon: H = -ฮฃ pแตข log pแตข over the value space of each field.
Consider a report where every field's value distribution is degenerate โ a point mass on "N/A." Entropy per field: zero. Summed over 143 fields: zero. The document carries no information about the subject it claims to cover.
That framing is almost right, and the almost matters.
The document does carry information. It carries exactly one bit: upstream extraction produced no usable claims. That bit is the entire finding. It is the only thing in the file worth transmitting to anyone.
And it is buried under 4,200 tokens of table borders, section headers, and a disclaimer about investment advice.
Signal-to-token ratio: 1 bit per 4,200 tokens.
For scale, a single on-chain event log announcing a governance proposal carries roughly 200 to 400 bits in a few hundred bytes of calldata. The report is not merely uninformative. It is antiinformative. It consumes retrieval budget, embedding space, and human attention at a rate of 4,200 tokens per bit, and it does so while looking like diligence.
Threat model: in a retrieval-augmented system, this document is poison. It will be embedded. It will be retrieved. It will be cited as prior analysis by an agent that has no way to evaluate its provenance. Its one bit will not survive the chunking step. Its 4,199 tokens of structure will.
Cheap generation, expensive verification
Here is where the incident stops being an AI story and becomes a market-structure story.
Stage-2 analysis is cheap. At 2026 inference prices, a 4,000-token context with a 4,200-token structured output runs in the low single-digit cents. Call it two cents. Ten thousand of these a day costs two hundred dollars. A million costs twenty thousand.
The marginal cost of producing a document has converged to zero. Which means the marginal value of a document has converged to zero, and the only thing left with a price is the cost of validating it.
This is the exact inverse of the design that makes ZK rollups work.
A Groth16 proof costs real money to generate and almost nothing to verify. That asymmetry is the entire point โ one expensive prover convinces a thousand cheap verifiers. Generation is the scarce resource. Verification is the commodity.
LLM-generated research has the asymmetry backwards. Generation is the commodity. Verification is the scarce resource. Because the industry built the cheap side first and never built the expensive side, every pipeline is a machine for converting free generation into unverified output at scale.
[Confidence: high on the order of magnitude of these costs; medium on the exact per-token rate, which moves monthly and varies by provider.]
There is a second-order effect worth naming. When I modeled rollup proving costs through 2023 and 2024, the operators bleeding money were the ones who had priced verification correctly and generation incorrectly. Same error shape here, opposite sign. The research vendors currently pricing per delivered report are the ones who will fail first, because they have priced the commodity and given away the scarce good.
The Empty Template Equilibrium
Model a research marketplace as a payout function. Agents submit artifacts. The marketplace pays P(r) where r is a submitted report. If the acceptance criterion is structural โ that is, if P(r) = f(is_valid(r)) โ then the dominant strategy is computable in closed form.
Find the minimum-cost string r such that is_valid(r) = True.
That string is the empty template. Cost: one forward pass over a fixed prompt with no context material attached. Roughly two cents. Possibly less, since there is no retrieval step and no long context to attend over.
The empty template is the equilibrium of every pay-per-document market.
I watched this dynamic play out one layer down, in a 2026 L2 that tried to monetize AI inference. Its emission schedule rewarded high-compute nodes regardless of output quality. The result was predictable: operators spun up the cheapest possible inference paths, because the reward function measured work performed, not work useful. Cheap nodes multiplied. I built the model and published the projection โ hyperinflationary supply within six months โ and then had to watch the team patch parameters through governance, which partially invalidated my static analysis. Lesson filed: a perfect technical model still requires dynamic market context.
The research-marketplace version is worse. There is no governance. There is no parameter to patch. There is only a schema, and the schema has no opinion.
Threat model: any marketplace whose settlement layer validates shape rather than substance is already in this equilibrium. It has been there since the first day the payout function was written. You just haven't seen the artifact yet.
Where else the null gets accepted on-chain
This is not a new failure class. It is a class that crypto is structurally over-represented in.
Blockchains are structural systems by construction. Consensus verifies that a state transition satisfies the rules, not that the resulting state is meaningful. That is the virtue โ it is what makes verification cheap and objective. It is also why null-acceptance bugs cluster in this industry rather than diffusing evenly across software.
Four concrete instances:
Zero-price oracle acceptance. A lending market reads a price feed returning 0, because the feed's last update failed and the failure path wrote a default value into storage. The health check computes collateral * price >= debt. At price = 0, that evaluates 0 >= debt, which is false, so the position becomes liquidatable โ and an attacker liquidates the entire market at zero cost. This has shipped at least four times across different codebases. The feed was type-valid. It returned a uint256.
Zero-quorum governance. A DAO guard written as require(votesFor >= quorum), where quorum is a settable parameter that a deployment script initialized to zero because a setQuorum call was skipped in the final migration. votesFor >= 0 is a tautology. It passes with zero voters. The proposal executes.
Empty-batch sequencers. A rollup's batch submission path accepts a batch containing zero transactions and advances the state root by the empty-transition function. The root advances. Liveness metrics look healthy. Nothing was proven.
Failed-RPC-as-nil-balance. An indexer that catches a timeout and returns 0 instead of raising. 0 flows downstream as a real balance. Every supply figure computed from that pipeline is off by the missing amount, silently, for as long as the timeout pattern persists.
Four systems. One failure mode. Every one of them had a schema and no assertion.
I have argued elsewhere that Celestia's Blobstream light-client trust assumptions are more elaborate than simple data posting requires โ that the cryptographic machinery overshoots the practical threat model. This is the inverse complaint. Here the machinery is absent entirely, and the thing passing verification is a string type, not a data availability proof. The security budget is misallocated in both directions, which suggests the spending decisions aren't driven by threat models at all. They're driven by what is legible to a grant committee. [Confidence: medium-high. This is an inference about incentives, not a measurement.]
A note on jurisdictional pipelines
There is a compliance version of this that should worry people more than the research version.
Hong Kong's virtual asset licensing regime generates a substantial reporting load โ periodic disclosures, risk assessments, custody attestations, counterparty due diligence. A growing share of that load is processed by automated pipelines, because human review does not scale to the filing volume the regime requires, and the licensing timetable is competitive with Singapore's.
If a compliance pipeline emits a schema-valid report with null payloads, a reviewer reads a document that is structurally complete and substantively empty. There is no signal at the reader's end. "N/A - insufficient information" reads as diligence, not failure, in exactly this context. A license review that proceeds on an empty document is a category of risk no regulator has written a rule for, because the rule would have to govern the pipeline's internal assertion rather than the filing's content.
Threat model: the licensing race selects for throughput. Throughput selects for automation. Automation selects for schema validation. Schema validation holds no opinion. The chain terminates in a filing that satisfies every requirement except the one nobody wrote down.
The contrarian read
Three moves.
First: this incident will be read as a hallucination story. That is the wrong target. Hallucination is the loud failure mode. It produces a confident ticker symbol and a wrong TVL, someone eventually checks, and the check is cheap because the claim is falsifiable. Abstention is the quiet failure mode. It produces a document that looks like it was written by a careful analyst who declined to speculate, because that is literally the string it emits. Nothing falsifiable. Nothing to check. It enters the corpus intact.
Hallucination gets caught. Abstention gets filed.
Second: the report's behavior is being read as integrity. It refused to fabricate. It flagged the empty field. It listed hypotheses about its own input, which is more self-awareness than most of the research I have paid for in the last two years.
I want to argue the opposite. The abstention is the defect, dressed as virtue.
A system with an empty input at a hard boundary has exactly one correct output: an exception. Not a nine-section document. Not a well-labeled null report. An exception, raised at the boundary, with a stack trace and a pager notification. The fact that the pipeline produced 4,200 tokens of correctly formatted nothing โ and that those tokens read as cautious professionalism โ is not a mitigation. It is the mechanism by which the failure became invisible.
[Confidence: high. I have made this mistake. I once wrote a fuzzing harness that swallowed its own crash and reported "no invariant violations," because the invariant checker had nothing to check.]
Third, and worst: the authors' error analysis was good and still insufficient. Three hypotheses about data transmission, upstream execution, and input resolution. All infrastructure-level. All correct-shaped. The hypothesis they did not list is the one that matters โ the analyzer had no obligation to fail. No rule in the architecture connects an empty input to a halt. The field was empty, so the output said N/A, and both sides discharged their contracts.
The correct question is not "why was the input empty?" It is "why did an empty input produce a deliverable?"
Takeaway
Let me name the class so it can be argued about, because unnamed failure modes never get tested for.
Semantically Empty, Structurally Valid โ SESV.
An artifact that satisfies every declared interface constraint while carrying no payload, where the absence of payload is undetectable by any automated consumer of that artifact.
SESV is not an AI failure. It is an interface-design failure that AI made cheap to produce at scale. It existed in 2020, in claimReward arithmetic, in the zero-price oracle, in the require(x >= 0) tautology. What changed is the unit cost. A human producing a hollow report costs a salary. A pipeline producing one costs two cents and eleven seconds, and it can produce ten thousand before anyone reads the first.
My forecast, with the standard caveat that incident-level predictions are worth what you pay for them: within eighteen months, a public capital allocation decision โ a listing, a fund subscription, a treasury vote, or an on-chain agent's execution โ will be traceable to a document that had no content. Not a document with wrong content. A document with no content, validated by a type check, embedded into a vector index, retrieved by cosine similarity, and cited in a memo that is correct in form and empty in substance.
The fix is not a better model. It is one assertion per trust boundary: a value-validity predicate returning false on the sentinel set, plus a hard raise when Stage 1 emits an empty list. Fourteen lines and a pager rule. Roughly the cost of a coffee per quarter in compute.
The reason it will not be written is that an assertion which fires turns a green pipeline red, and red pipelines do not get renewed.
So: which of your data feeds currently returns 0 when it means unknown?
