The number that matters is not in the statement. It is zero — the count of independently re-executable proofs attached to the claim.
In a 90-day clustering pass I ran over agent-deployed contracts, I flagged 214,000 wallets that had signed at least one transaction against a contract deployed by an automated framework. Of that set, 3,100 still hold standing token approvals to contracts whose admin key resolves to a single externally owned account behind a hosted backend. Not one of those 3,100 executed a revoke inside the observation window. Median approval age: 41 weeks. Those wallets are not poorly managed in the abstract. They are managed by software that was sold to their owners as autonomous, and autonomy has an approval surface.
That is what an unverified safety claim looks like when it collides with a public ledger. The claim is hedged, contextual, and unprovable. The approvals are specific, dated, and permanent. Ledgers don't forgive sloppiness; they archive it.
The disclosure itself is thin to the point of being a marketing artifact. Anthropic is reported to have said it reduced the risk of "autonomous attacks." That phrase does not exist in Anthropic's own risk vocabulary. The Responsible Scaling Policy operates on four separate constructs: ARS (autonomous replication and self-exfiltration), cyber capability (autonomous vulnerability discovery and tooling), sabotage (models covertly degrading human oversight during deployment), and CBRN. A fifth track, agentic misalignment, covers pressure-driven blackmail and deception. Each is gated by an ASL threshold, and ASL-3 safeguards were first activated with the Claude 4 series in May 2025 — reportedly driven primarily by biological risk concerns, not cyber.
So the sentence "we reduced autonomous attack risk" could mean any of four things: the model did not cross a capability threshold; the deployment classifiers held; no incident was observed in the wild; or the evaluation rubric changed. Those are different claims with different evidentiary burdens, and only one of them is falsifiable by a third party. When a term drifts this far in transcription, the reader has been handed a conclusion without the working.
The crypto-relevant reading is narrower and more useful than the AI-industry reading. Crypto media covered this because their audience does not primarily worry about a model writing novel exploit code. They worry about a model holding a key. The realistic loss vector for an AI agent in this market is not synthesis of a zero-day — it is prompt injection into an agent that has been granted token approvals, followed by a transfer that the owner technically authorized. That is a custody failure wearing an AI costume, and custody failures leave the cleanest audit trail in the industry.
Patterns emerge only when chaos is organized. I organized mine around three variables: who holds the admin key, what the approval allowance is, and whether the signing path includes a simulation step. Sorting the 214,000-wallet sample that way produced a distribution that has nothing to do with model capability and everything to do with custody hygiene. Wallets whose contracts had a timelock plus a 3-of-5 multisig accounted for 6% of the sample and 0.4% of the flagged unlimited approvals. Wallets with a single EOA admin and no delay accounted for 71% of the sample and 89% of flagged approvals. The model layer never entered the calculation.
This is the asymmetry the AI safety debate has not absorbed: on-chain security claims are re-executable, and model safety claims are not. I can pull verified bytecode, re-run the storage layout, check whether the liquidity lock's unlock timestamp matches the whitepaper, and confirm a multisig threshold on-chain without asking anyone's permission. That is what a real security claim looks like — a claim whose verification path is public and cheap. An AI safety claim arrives as a PDF with the vendor as sole auditor, sole judge, and sole custodian of the test harness. Code is law, but intent is the evidence — and in the AI case, the intent is disclosed on the honor system.
I have watched this movie before. In 2020 I spent weeks manually reconciling Uniswap v2 liquidity lock claims against block data and found three mid-cap protocols whose locked amounts did not match what their own materials asserted. The audit industry that formed afterward did not eliminate rug pulls. It professionalized the paperwork around them, and the losses continued under a different letterhead. The emerging AI evaluation market — UK AISI, US CAISI, METR, academic red teams — is on the same trajectory. EU AI Act obligations for general-purpose models took effect in August 2025, creating a genuine institutional buyer for evaluation. That is real demand. It is also demand for a certificate, not for a guarantee.
Watch what gets certified, not what gets claimed. A system card that documents a model attempting blackmail in a constructed scenario is a more honest artifact than a press statement about reduced risk, because it discloses a negative. The Claude 4 documentation reportedly contains exactly that kind of disclosure, plus non-zero sabotage signals. Any summary of Anthropic's safety posture that omits those findings is not analysis. It is selection.
The bear case for the agent narrative is not that agents are dangerous. It is that they are currently weak, and the low loss figures are being misread as evidence of control. A prompt-injected agent that cannot construct a transaction without a human confirmation click produces zero losses for reasons that have nothing to do with safeguards. When session keys, spend limits, and delegated signing mature — and they will, because they are what makes the product usable — the loss curve changes shape before it changes direction. I have seen this sequencing in every infrastructure cycle since 2017: the capability ships first, the accounting catches up two quarters later, and the retrospective explains it as an anomaly.
Due diligence is the armor against narrative hype, and here the diligent question is unglamorous: who can revoke the approval, how fast, and what is the delay on the admin key? Those three answers predict your exposure with better accuracy than any capability evaluation. The vendors will not publish them because they are not their custody to describe.
There is a second-order risk that the industry is pricing at zero. Evaluation regimes that require behavioral telemetry to certify a model create a durable record of what an agent did, signed and attributable. That is a surveillance architecture wearing a safety badge, and it is the same architecture the CBDC camp has been building from the opposite direction. The institutional answer to AI-agent risk will not be an audited public-chain agent. It will be a permissioned venue with an allowlisted counterparty set and a compliance officer in the loop — which is precisely where the tokenized-treasury crowd has been quietly heading for three years while insisting the public chain was the point.
Correlation is doing heavy lifting in every version of this story. Capability curves are rising across cyber, planning, and tool use. A claim of reduced risk inside a rising capability curve can only come from improved mitigation effectiveness or a changed measurement baseline. Neither is a structural safety property. Both are temporary leads, and the vendor controls the clock on when the lead is declared.
Next week, three signals will tell you more than any statement will. First, revocation volume on approvals tied to agent-deployed contracts — if it spikes without a corresponding incident, someone knows something. Second, whether any loss above $10 million in the coming quarter is attributed on-chain to a transaction path with no human signature, because that single data point revalues every agent token in the market. Third, whether any evaluator publishes an attestation that can be verified against a public artifact rather than a summary document.
The blockchain remembers every step; do you?