A crypto publication ran a headline this week that had nothing to do with crypto. Crypto Briefing reported that Anthropic โ the lab that built its entire brand on responsible scaling โ used undisclosed sources in its AI research capability evaluations, a practice the report framed as raising concerns about transparency and accountability.
Read that again. Crypto outlet. AI governance story. No token, no chain, no protocol, no yield. The reflexive move is to file this under AI news and scroll past. I did the opposite. I filed it under infrastructure arbitrage. Because the failure mode Anthropic is being accused of โ staking a safety claim on sources no outsider can inspect โ is the exact class of problem this industry has spent five years and several billion dollars of venture capital trying to engineer out of existence. The report is a crypto story wearing an AI costume. And the people who recognize the costume are the ones positioned to price the arbitrage.
Precision first, because the headline blurs three separate things. Anthropic's Responsible Scaling Policy defines what it calls AI Safety Levels โ ASL-2, ASL-3, and upward โ and gates deployment on passing dangerous-capability evaluations. CBRN. Cyber. Autonomy. And AI R&D, which is the one that keeps governance researchers awake at 3 AM: can a model accelerate AI research itself? If yes, the recursive loop tightens and every oversight window collapses inward before a regulator can schedule a hearing.
These evaluations are semi-public by design. Labs publish the framework and the conclusion. They withhold the test set. Any benchmark you release becomes training data for the next model, which means the evaluation stops measuring capability and starts measuring memorization โ benchmark gaming, the terminal disease of every public leaderboard since GLUE. Publish your eval suite and you have, within one training cycle, published a target.
So "undisclosed sources" is not automatically a scandal. It is frequently a technical requirement. The problem lives at the other end of the chain. If no external party can reproduce the evaluation, then "the model passed" is an unfalsifiable claim. An unfalsifiable safety claim is not a guarantee. It is a marketing asset with a compliance wrapper.
This arc is not new. Financial auditing walked it across the twentieth century โ from management self-report to independent attestation โ not because auditors are smarter, but because the incentive to selectively report is structural. Clinical trials walked it before that. AI evaluations are still in the self-certification phase, and this report is that phase's inherent defect poking through the floor.
Here is where crypto stops being a spectator and becomes a supplier. The verification problem Anthropic faces has a name in this industry. It is the oracle problem, wearing a lab coat. A claim โ "the model passed" โ is produced off-chain, inside a private environment, by an interested party. You must convince a skeptical counterparty that the claim is true without surrendering the raw inputs. Surrender them and you destroy their validity. Withhold them and you destroy your credibility. That is a cryptographic problem before it is a governance problem, and we have been solving that exact class of problem since 2016.
There are three general approaches, and they map cleanly onto AI evaluation.
The first is trusted execution environments. Run the evaluation inside a hardware enclave, produce a signed attestation that a specific binary ran on a specific input and emitted a specific output, then publish the attestation without publishing the test set. Projects like Phala Network and Marlin have been iterating on this primitive for years. The attestation is the disclosure. The content stays sealed. It is not elegant, and it is not trustless โ but it converts an unverifiable claim into a verifiable one with a known trust root.
The second is cryptographic proof of computation โ ZKML. Prove that a computation executed correctly without revealing the inputs. The field is young and the overhead is brutal for large models, but for a narrow evaluation workload โ running a fixed prompt suite and scoring pass/fail against a hidden rubric โ the circuit is far smaller than the model. EZKL, Modulus Labs, and Giza have all shipped variants. You are not proving a frontier model end-to-end. You are proving the harness. That is tractable today, and it is underappreciated.
The third is decentralized economic verification โ commit-reveal with slashing. Multiple independent evaluators run the assessment, stake collateral, and get slashed if their reported results diverge from consensus. This is the restaking logic applied to claims rather than blocks. And the phrase that has been rattling in my head since I built a slashing-condition simulator for EigenLayer back in 2023 is this: Restaking isn't a yield trade โ it's a narrative shift in security. We stopped treating security as a property a chain has and started treating it as a bond a participant posts. The same reframe applies to AI claims. An evaluation is not trustworthy because a lab says so. It is trustworthy because someone has capital at risk on its accuracy.
I want to be careful here, because this is where most crypto-AI commentary gets lazy. The claim is not "crypto solves AI safety." The claim is narrower and more defensible: this industry has a mature toolkit for making unverifiable claims expensive to lie about. AI labs have a verifiability deficit. The toolkit and the deficit are matching. That is an infrastructure gap, and infrastructure gaps get funded before they get validated.
Let me put numbers on the mismatch, because abstractions hide the real cost structure. When my team and I simulated slashing conditions across restaked protocols in early 2023, the thing that surprised me was not the mechanics. It was the parameter sensitivity. A slashing condition that is too loose has no deterrent effect โ the expected value of cheating stays positive and rational actors cheat. Too tight, and honest participants get punished by noise, and the security budget inflates until posting collateral is no longer rational. There is a narrow band where the incentive gradient actually points toward truth. We spent three weeks just mapping that band for one protocol.
AI evaluation has the same band. Require full disclosure and you get contamination; the evaluation degrades into theater. Require zero disclosure and you get unaccountable self-certification. The governance problem is finding the band โ and crypto's contribution is not a "solution," it is a design space that already contains the relevant trade-offs, parameterized, with a decade of adversarial testing behind it.
Now connect this to where the money actually is, because a governance debate is not a trade. An infrastructure gap is. The AI agent economy โ the machine-to-machine layer I modeled in 2026 โ runs on verifiable inputs or it does not run at all. If an autonomous agent is executing transactions, rebalancing across decentralized exchanges to minimize slippage, posting collateral, settling with counterparty agents, then every decision it makes depends on an input it did not generate. It trusts a price feed. A risk score. An evaluation result. If that upstream claim is unverifiable, the agent is not autonomous. It is a puppet with an unauditable hand.
So the Anthropic story is not a morality tale. It is a demand signal. The more capable and autonomous AI systems become, the more the economy built on top of them depends on claims that can be verified without being disclosed. That is a primitive. And primitives get priced before they get productized.
Be concrete about where I would look, and where I would stay skeptical. Three categories structure the verifiable-AI stack. Attestation hardware and protocol layers โ TEE-based inference and evaluation, where value accrues to whoever controls the attestation root. Proof systems โ ZKML and succinct proof markets, where the bottleneck is proving overhead and the moat is circuit optimization. And evaluation markets โ decentralized networks where independent validators are paid to run assessments and slashed for divergence.
Category one is the most defensible near-term and the least differentiated. It inherits Intel's and Nvidia's roadmap, and its trust assumptions are only as strong as the silicon underneath โ which is to say, historically breakable. Category two has the widest theoretical application and the worst current economics; proving overhead is a tax that nobody wants to pay until the alternative is regulator-imposed disclosure. Category three is the most crypto-native and the most exposed to the "who verifies the verifiers" regress.
None of these are clean. That is the point. In a sideways market, the trade is not picking the winner. It is positioning in the category the narrative will need regardless of which implementation survives. I have watched enough narrative cycles to know that the category outlives the token.
There is one more structural parallel I want to draw, because it is the one the crypto press will miss. Regulation. My long-standing view on compliance is that most project KYC is theater โ the cost falls on honest users while a few wallet hops routes around the gate. AI evaluation faces the identical pathology. If regulators mandate disclosure, labs will disclose in the way that satisfies the letter of the requirement while preserving the substance of opacity. Compliance theater scales. That is what bureaucracies select for. The honest participants eat the cost; the sophisticated ones route around it.
Which means the durable answer is not regulatory. It is cryptographic. You do not get verifiability by asking institutions to be transparent. You get it by making the cost of a false claim exceed the benefit of the lie. That is an economic primitive, not a legal one. And economic primitives are what this industry builds. It is the same logic that led Bitcoin miners to concentrate into a handful of pools after the fourth halving โ decentralization as a slogan is hollow, but decentralization as a measured, priced, verifiable property is a product. The hollow version is what everyone markets. The priced version is what actually matters.
I will flag one analogy that I think is more load-bearing than it looks. There are dozens of AI evaluation startups now, and roughly the same thin base of paying customers. That is not an ecosystem scaling. That is scarce demand being sliced into fragments โ the same structural error the Layer2 market made, and the same reason most of them will consolidate or die. Watch who consolidates evaluation, not who launches it.
Now the part the crypto crowd will hate. The reflexive answer โ make everything trustless, verify everything on-chain โ is itself a narrative, and a fragile one. TEEs are not trustless. They trust Intel, or AMD, or whatever silicon vendor signs the attestation, and they have a documented history of side-channel breaks. ZK proofs are trustless in the mathematics and trusted in the trusted setup. Decentralized evaluation markets are trustless in the slashing and trusted in the collusion resistance of the validator set. Every layer of "verification" has a trust root. You are not eliminating trust. You are relocating it and pricing it. Anyone who tells you otherwise is selling a token, not a primitive.
And here is the sharper contrarian point. This report came from a crypto outlet, covering a non-crypto governance topic, with no cited AI safety researcher, no quoted Anthropic response, and no technical distinction between undisclosed-because-contamination-resistant and undisclosed-because-inconvenient. A competent AI-safety reporter would not collapse those two cases. Their safety implications are opposite. One is a defensible design choice. The other is a conflict of interest. The headline treats them as identical.
Two things can be true simultaneously. The underlying verifiability deficit is real and important. And this specific report may be a content-aggregation artifact rather than an evidentiary document. I have watched narratives get priced on weaker foundations than this, and I have watched them die the same way. Terra's narrative did not collapse because sentiment turned. It collapsed because the math failed, and the math always eventually fails anyone selling an unfalsifiable claim. This one might fail when someone finally asks what "undisclosed sources" actually means โ dataset, methodology, funder, or contractor โ because each answer carries a completely different weight, and the report provides none of them.
So here is the discipline. Restaking isn't a yield trade โ it's a narrative shift in security, and we learned that when the narrative arrived before the infrastructure, the drawdown was brutal. The same rule applies to verifiable AI. The theme is correct. The timing is a function of whether the primitives can ship before the sentiment prices them. Verify the claim before you lever into the theme.
The next narrative is not "AI safety." It is "verifiable AI" โ and the capital that arrives for it will route through infrastructure this industry already built. Watch the attestation layers, the proof-system economics, and the evaluation markets. Watch whether Anthropic responds, and whether any technically credible outlet asks the right question, because the answer determines whether this is a governance story or a headline. The window where you can research the primitive before the market prices the theme is open right now. It will not stay open past the next capability release.
