Hook
On September 13, a funding disclosure moved through AI policy circles that deserved more scrutiny than the headline it travelled with. METR, the evaluation nonprofit that has quietly become a de facto referee for frontier model safety, reportedly accepts no capital from the laboratories whose models it assesses. It takes model access and inference tokens instead. Read that arrangement as a protocol rather than as a press release, and it changes shape: it stops being a declaration of independence and becomes a statement about dependency with better branding.
I have spent enough of my working life inside audit rooms to distrust declarations. Trust is a protocol, not a promise. In 2017 I audited the vesting schedule of a utility token my employer intended to launch out of Lagos, found an integer overflow that would have released four years of supply into a single block, and refused to sign the whitepaper until it was patched. I lost that job over it. Three projects running a near-identical function lost their users' funds weeks later. The lesson I carried out of that office was structural rather than moral: a governance body is defined by what it is architecturally capable of refusing, not by what it promises to refuse.
A referee that can only evaluate the model it has been handed holds a mandate whose outer boundary was drawn by the party being judged. That is not yet a scandal. It is an architecture. And architecture is what I read for a living.
Context: The September Question Is Not Really About AI
The dispute that surfaced across the September 13 reporting cycle has been filed under "AI safety." It belongs under rule-making authority, because authority is what is actually being contested.
The reported sequence is short. Dario Amodei of Anthropic argued publicly that safety research is not keeping pace with capability, and that frontier development should therefore be paced deliberately. Sam Altman of OpenAI subsequently endorsed a similar posture, described as pacing the frontier, and announced the introduction of independent evaluators. David Sacks — reported as a current co-chair of PCAST — answered with a two-part rebuttal that is worth reading as a single argument rather than two complaints: if you believe your product is dangerous, stop building it yourself; and a government that green-lights the largest AI companies to self-limit their own speed is not regulating a market, it is recognizing a cartel. Cathie Wood of ARK Invest publicly aligned with the reading that the doom narrative is being manufactured. And the alleged origin of several "AI will destroy humanity" news cycles was traced, in this telling, to one former Anthropic employee who left after six weeks, from an account that had been dormant.
I want to be precise about the evidentiary status of all of this, because precision is the only contribution I can honestly make. The specific facts — the date, the PCAST role, the employment timeline, the attribution of the news cycles — sit outside what I can independently verify. I am treating them as declared inputs, not as established record. What I can read is the structure they describe, and structure is legible even when individual claims are not yet adjudicated.
Here is the structure. Three parties are competing to define what "safe" means. Two frontier laboratories have adopted a synchronized posture that raises the cost of entry for everyone who is not them. One evaluation nonprofit sits between them and the state, funded in a way designed to signal separation but structurally unable to close every channel of dependence. And one regulator-adjacent actor is arguing that the safety posture is not a public good but a private arrangement. Every one of those moves has a name in the system I work in. We have run this exact experiment on-chain for a decade, and we have a reasonable map of where it fails.
The word "cartel" is doing a lot of work in this debate, and it deserves unpacking rather than repeating. A cartel is not two firms behaving similarly. It is a coordination mechanism that constrains output, stabilizes shares, and is sustained by communication. The accusation, as stated, supplies motive and parallelism. It does not yet supply the communication record. That distinction is the entire ballgame, and it is the same distinction that governs how we treat validator collusion, MEV searcher coordination, and oracle manipulation on public networks: parallel behavior is the default equilibrium of a market with public inputs, and it is not evidence of agreement.
So the honest reading of September 13 is not "the safety narrative is fake" or "the safety narrative is real." It is that a governance system has been assembled without a disclosed dispute-resolution layer, and everyone inside it is now litigating in public because there is no mechanism to litigate anywhere else.
Core: Five Readings of a Cartel Accusation
Self-regulation is a moat wearing a compliance badge
Safety standards are not free, and they are not neutral. They are fixed costs. Fixed costs are regressive by construction: a threshold that a hundred-million-dollar laboratory absorbs as a line item is a wall for a five-person team in Accra or Bangalore.
I met this wall directly in 2025, when I served as governance architect for an African-focused Layer 2 negotiating real-world asset tokenization. The compliance layer I had to specify — transfer restrictions, attestation of reserves, gated participation — was technically unremarkable. It was also straightforwardly unimplementable by a three-person builder in the same market with the same ambition and a tenth of the runway. Every "reasonable" standard is a filter. Filters do not distribute pain evenly, and the people who write them rarely notice that they have written a moat.
The DeFi analogue should be familiar to anyone who has read a lending protocol's governance forum closely. The interest rate models on the largest money markets present themselves as market-derived curves — a base rate, a slope, an optimal utilization point tuned by feedback. In practice those parameters are governance-set constants. They respond to a vote, not to order flow. Nobody calls that a cartel, because there is no accusation to bring and no victim with standing. But the artifact is instructive: parameters that look like prices are frequently just decisions wearing a diagonal line. Safety thresholds in AI are about to become exactly that artifact, and the argument over who sets them is an argument over who can afford to meet them.
The sincere question and the structural question are different, and conflating them is how these debates go nowhere. Whether a lab's safety posture is honest is a question about people. Whether a safety regime raises the barrier to entry is a question about arithmetic. The arithmetic does not care about the sincerity.
Synchronization is evidence of something, but not necessarily of collusion
When two direct competitors adopt near-identical language within weeks of each other, the instinct to read coordination is reasonable. It is also frequently wrong. In competitive markets, firms facing the same regulatory signal, the same technical constraint, and the same investor base converge on similar postures because the available moves are few. We watched the same convergence during the Layer 2 expansion: a dozen teams independently arrived at nearly identical fee rhetoric and nearly identical decentralization roadmaps, not because anyone convened, but because the same incentive gradient produces the same gradient descent.
The evidentiary standard for actual coordination is not similarity. It is communication, output constraint, and share stability over time. None of those has been demonstrated here — at least not in anything I can examine. What has been demonstrated is something subtler and, for the participants, more dangerous: a synchronized public posture converts what may have been a private judgment into public evidence, whether or not any coordination occurred. Two firms that act in parallel inherit the burden of proving they did not agree. That is an expensive burden, and it is self-inflicted.
This is where the chain teaches a lesson that press conferences cannot. Silence in the chain speaks louder than noise. A validator set that produces identical timestamps does not need to deny collusion; it needs to publish its communication logs, its gossip topology, its peer counts. The instrument that resolves a coordination accusation is never a statement. It is a log. Until a disclosed record exists, the cartel charge remains a hypothesis with a plausible motive attached, and hypotheses with plausible motives are the most durable kind of accusation in any industry.
The oracle problem, restated for model evaluations
Strip the policy language away and an evaluation is a data feed. A claim about a model's safety properties is a number — or a rating, or a threshold — reported by an entity whose revenue, access, and personnel sit in a relationship with the entity being rated.
The entire value proposition of a decentralized oracle network is not accuracy. Accuracy is a nice property. The value proposition is not being the counterparty. Where price feeds were self-reported by the venues that traded on them, the observed failure mode was almost never a deliberate lie. It was a blind spot with an incentive attached — a feed that stopped updating during the exact volatility that made it necessary.
METR's funding model is a deliberate attempt at that separation, and it should be credited as such. Refusing capital and accepting only model access and tokens removes one channel through which a sponsor can apply pressure. But funding is one channel of many, and it is rarely the most binding one.
Personnel is the channel that third-party assurance cannot close, because the population of people who can meaningfully evaluate frontier systems is, by definition, the population that built them. The reported movement of a safety researcher from Anthropic into the evaluator is not misconduct. It is the ordinary circulation of a scarce skill. It is also indistinguishable, from the outside, from capture in slow motion. Independent funding does not produce an independent referee. It produces a referee whose dependence is harder to see.
I learned a version of this in 2021, coordinating governance token distribution for a community gallery with five hundred participating artists in Lagos. We published the allocation rules, we published the addresses, we audited the merkle root. It was, by the standards of the moment, an unusually transparent distribution. We still came within one spreadsheet editor of a quiet capture, because the person maintaining the eligibility list held a discretion nobody had thought to constrain. Transparency of output is not the same as constraint on discretion. A third-party evaluator can publish every report it produces and still hold an unbounded editorial discretion over which models receive evaluation at all.
Credibility attacks are infrastructure, not noise
The single most load-bearing claim in the September cycle is not about model capabilities. It is about the provenance of a narrative — the assertion that a doom storyline originated with one short-tenure employee and a dormant account. Read as rhetoric, that is a credibility attack. Read as governance, it is something more useful: a demonstration that discrediting the messenger is cheaper than refuting the message, and it scales without limit.
The on-chain equivalent is well understood. Sybil attacks are not attacks on truth; they are attacks on the cost of verifying truth. Spam transactions do not falsify a ledger; they make the ledger expensive to read. FUD operates the same way. None of these techniques requires anyone to be wrong. They require only that verification become more expensive than belief.
What makes this particular moment hazardous is that the attack is running in both directions at once, and both directions have a plausible sponsor. A safety claim can be amplified to construct a regulatory moat. A safety claim can be dismissed as manufactured in order to prevent that moat from existing. A reader who cannot distinguish between those two operations loses the ability to price either one — and so does a legislator, and so does an investor, and so does a laboratory's own board.
Here is the sentence I would underline if this were a code review: the most expensive outcome is not a wrong decision. It is a decision environment in which no claim can be verified, so the loudest party wins by default. That environment is not created by bad actors. It is created by the absence of a verification layer, and its first casualty is always the person with the least access to primary evidence.
What a verification layer would actually look like
I am not going to pretend the answer is a smart contract. Frontier model evaluation is expensive, stochastic, and not reducible to a binary predicate, which means the clean cryptoeconomic tools — bonded disputes, slashing, deterministic adjudication — do not transfer intact. A model that behaves safely in one sampling regime may not behave safely in another, and no bond can be slashed against a probability distribution.
What transfers is the architecture of skepticism. Publish evaluations with a challenge window rather than as final verdicts. Require multiple evaluators with independently sourced funding and mandatory conflict disclosure, in the way verifiable credentials bind a claim to an accountable signer. Attest personnel flows, not to forbid them but to make them legible. Use commit-reveal on evaluation methodology so that later evaluators cannot simply anchor on the first published result, which is a real herding problem in every assessment market I have observed.
In 2025 I insisted, against schedule pressure, that our reserve attestations be published with a challenge window and a bond rather than certified by a named auditor. It delayed the launch by six weeks and cost me an argument I did not enjoy having. It also meant that when a partner's custodian changed its reporting methodology, the challenge was raised before settlement rather than after. Six weeks of latency against a settlement failure is not a difficult trade, but it is a trade nobody wants to make until they have watched the alternative.
Contrarian: The Industry Making This Argument Has No Standing
There is an uncomfortable symmetry in this debate that neither camp wants to examine, and I think it is the most important thing in the room.
The critique of frontier laboratories — that they announce decentralization while retaining control, that they write governance documents whose discretion is invisible, that they use safety language as a competitive instrument — is a critique the crypto industry has earned the right to make only if it first applies it at home. We have spent a decade shipping governance tokens whose voting power is concentrated in four wallets, publishing decentralization roadmaps that terminate in the same multisig they started from, and describing a sixteen-person council as a community. The most common sentence in our own governance forums is a promise about what will be true later.
So when the industry that built the self-limiting cartel emerges as the loudest critic of someone else's self-limiting cartel, the argument is structurally correct and rhetorically powerless. Culture compiles where logic fails. A critique does not travel on its merits; it travels on the credibility of its carrier, and we have been spending that credibility on yield for eight years.
The pragmatism test, then, is not whether Sacks is right about coordination. The pragmatism test is whether the referee problem is solvable by the means available. I am not optimistic that a neutral evaluator can be constituted by appointment, because appointment is a dependency. I am mildly optimistic that it can be constituted by market structure — multiple evaluators, disclosed conflicts, published methodology, challenge windows, and a culture that treats an unpublished evaluation as an unverified one. That is slower, more expensive, and less satisfying than naming a referee. It is also the only design in which being captured requires more than one signature.
The blind spot on the other side is equally real and less discussed. The open-source community is nearly absent from this entire argument. Whatever regime emerges — voluntary pacing, statutory thresholds, or a certification market — open-weight models will be regulated as collateral damage by rules written in rooms they were not invited into. Nobody is coordinating against them. They simply have no seat, and rules written without a seat tend to be written about you rather than for you. That is not a conspiracy. It is the ordinary outcome of an absent stakeholder, and it is how the next decade of AI governance will accidentally produce its most consequential mistake.
Takeaway
Watch the logs, not the language. A joint statement from the two laboratories about pacing the frontier would settle more than a hundred columns, because a disclosed communication record is the only artifact that distinguishes synchronization from coordination. Watch how the evaluators respond to questions about personnel flow, because an organization's willingness to be legible about its own dependencies is the strongest available proxy for whether its independence is structural or performative. Watch whether any antitrust instrument actually moves against self-imposed industry standards, because the outcome of that question will determine whether safety compliance becomes a public good or a private drawbridge. And watch the open-source community, which is currently in neither camp and will be governed by whichever camp wins.
Governance is not the art of choosing the right referee. It is the discipline of building a system in which a wrong referee can be identified, challenged, and replaced without asking permission from the referee. We govern the gray areas between blocks, and the gray area in AI governance is now larger than either the laboratories or the regulators appear willing to admit. Vision without verification is just hallucination — and at present, on both sides of this argument, nobody has published the proof.
