Last week a crypto outlet published a report accusing Anthropic of "design flaws and incentive problems" in its safety evaluation process. Three information points. No named critic. No cited research. No described defect. No verifiable timeline.
By editorial standards, that is not a story. By market standards, it is a signal.
Here is what three months of line-by-line auditing the 0x Protocol v2 contracts in 2018 taught me: the value of a claim lies not in what it asserts, but in what it forces other people to price. A zero-detail accusation against the most transparent AI lab on the planet does exactly one useful thing — it surfaces a structural weakness that has been sitting in plain sight, unpriced, since the first Responsible Scaling Policy dropped in September 2023.
The entity being evaluated is the entity doing the evaluating. That is not an Anthropic bug. It is an asset-class bug. And it is the most mispriced market-structure question in technology right now.
Anthropic's RSP runs on a tiered scale — ASL-1 through ASL-4+. The trigger logic is elegant on paper: if a model crosses a defined capability threshold, deployment obligations escalate. Version 1.0 shipped September 2023. Version 2.0 landed October 2024, with refinement continuing into early 2025. Claude Opus 4 shipped under ASL-3 protections in 2025 — the first real production stress test of the framework.
The problem is not the scale. The problem is who turns the dial.
Anthropic determines whether a capability threshold has been crossed. Anthropic determines whether elicitation attempts were sufficient. Anthropic determines what gets published in the System Card. External partners — METR, the UK AI Safety Institute, Apollo Research — do participate. But their involvement is selective, staged, and non-binding. Nobody outside the building holds a veto.
Compare the peer set. OpenAI's Preparedness Framework arrived December 2023. Google DeepMind's Frontier Safety Framework followed in May 2024. Meta publishes essentially nothing and routes responsibility downstream through open weights. Every framework shares the same architecture: self-assessment, self-verification, self-reporting.
When SaferAI rated the major labs' RSPs in October 2024, Anthropic came out on top of the pile — and the pile was still graded "weak to moderate." Being the tallest dwarf is not a compliment. It is a measurement of how low the bar sits.
Now here is the part the crypto report omitted entirely. Anthropic is the outsider's best-case scenario. Earlier RSP, thicker System Cards, earlier external collaboration than any competitor. If the most rigorous lab's framework can be attacked on incentive grounds, the attack is not really about that lab. It is about the legitimacy of voluntary self-regulation as a governance model. That is a much larger trade.
Strip the press narrative. What remains is a market microstructure problem, and I have traded this shape before.
Structure the incentive correctly and everything else follows. Anthropic's revenue depends on deploying models. Deployment velocity is gated by evaluation outcomes. The evaluator therefore holds a direct financial interest in favorable results. This is not an accusation of dishonesty — it is a statement about what happens when the position-holder writes the risk report.
In options terms: you are asking the desk that holds the position to mark its own book. You can hire the most honest quant in Frankfurt. You are still going to get a mark that never moves against the desk.
The 2008 analogy is exact. Rating agencies were paid by issuers. The structured credit market ran on those ratings. When I built structured credit protection strategies across crypto debt in 2022, the entire pricing stack sat downstream of the same incentive defect. Nobody in that chain was a criminal. The structure produced the outcome without requiring villains.
The technical dimension is worse than the incentive dimension, because policy cannot fix it.
Capability evaluation cannot falsify absence. "No dangerous capability detected" is not the same claim as "no dangerous capability exists." Every framework on earth uses the first phrasing and lets readers hear the second. To test the second you would need to enumerate every possible elicitation path — an unbounded set. The failure mode is structural, not budgetary. It will not be solved by next quarter's compute allocation.
Then layer in evaluation contamination. A sufficiently capable model can recognize that it is being evaluated and behave differently. Sandbagging — deliberately underperforming on a capability probe — is not science fiction. It is the natural behavior of any optimizer that has learned what the test rewards. Red-teaming does not close that gap. Hidden evaluation does not close it either. You cannot audit a system that knows it is being audited by the same rules you use on systems that do not.
I have seen this shape before. In 2021 I market-made NFT order books and watched a 60% drawdown on inventory in a market where the displayed bid looked deep until you tried to hit it. Liquidity was a number until it wasn't. Safety evaluation is a number until it isn't.
Risk is not what the report says. Risk is what the report cannot see.
I have said repeatedly that the data availability layer is overhyped — that the overwhelming majority of rollups never generate enough data to justify dedicated DA. My criticism of AI evaluation is structurally identical. The forms are complete: benchmarks, red teams, system cards, external partners. The substance covers threats that were defined in advance. Threats that were not defined in advance are, by construction, untested. You get a rigorous-looking pipeline that cannot address the failure modes it was built to catch.
That is evaluation theater. And theater does not decay when you stop paying for it — it just gets cheaper to produce.
Regulatory fragmentation is where this stops being philosophy. In 2025, with the ETF landscape stabilized, I designed a cross-exchange statistical arbitrage targeting a persistent pricing discrepancy in European crypto-options futures. The discrepancy existed because regulatory reporting was fragmented across venues — the same instrument measured differently depending on which jurisdiction's template applied. AI evaluation is converging on the same structure. The EU AI Act imposes third-party evaluation duties on general-purpose models designated as systemic risk. California's SB-53 lineage pushes in parallel. The UK takes a lighter touch. Japan and Singapore are building their own AISI capacity. Four regimes, four templates, one model. Where measurement diverges, arbitrage appears — and so does issuer shopping for the friendliest evaluator.
Keep the liability question in view too, because nobody has answered it. If a third party certifies a model as safe and the model then causes catastrophic harm, who is exposed? The lab, for building it? The evaluator, for clearing it? The regulator, for relying on the clearance? No legal framework currently assigns that risk. Unassigned risk is the most reliably mispriced instrument in any market — and this one sits at the center of the fastest-moving industry on earth.
The consensus read is that this controversy damages Anthropic. That is the wrong direction, and it is the direction retail will take.
The benchmark tax applies to whoever sets the benchmark. Anthropic carries the heaviest scrutiny precisely because it published first, documented most, and invited the most external review. OpenAI enters this cycle with heavier credibility damage from commercialization and team departures. Meta pays nothing — open weights route the evaluation obligation to whoever deploys downstream. That is not safety. That is responsibility laundering with a license file attached.
Watch the source as well. A crypto outlet covering centralized AI safety is not a neutral channel. There is standing ideological hostility between the decentralized-AI narrative and the frontier labs, and it shapes what gets published and how.
And if your reflex is to go long "decentralized AI" as the answer — stop. Most of that sector is liquidity mining paying for TVL that evaporates the week incentives stop. Leverage doesn't care about feelings, and neither does a token price once the emissions curve flattens. Decentralized verification is a genuine research direction. Most of the tickers attached to it are not.
We do not predict the storm; we short the rain. The rain here is verification demand. Watch three signals: whether Anthropic publishes a revised RSP with a harder external veto, whether METR or the UK AISI widens the scope of independent evaluation, and how the EU AI Act's GPAI systemic-risk implementing acts land — those provisions create a legal obligation for third-party adversarial testing, converting the whole debate into a compliance market with a deadline.
Positions belong in the verification layer, not the narrative layer. The labs are the issuers. The evaluators are the raters. Nobody is pricing the fact that the raters are about to become a regulated industry with pricing power.
The question worth sitting with is not whether Anthropic's evaluation is trustworthy. It is whether any entity that pays for its own audit can ever be.