The most consequential line in the reporting on OpenAI and Anthropic's joint disaster rehearsal is not the one about superintelligence. It is the one about a bank in South Korea.
According to a CrowdStrike log described in the coverage, attackers used DeepSeek models alongside Claude Code to breach a financial institution — and, at some point in the intrusion, they asked the model where to fence the stolen funds. Read that detail twice. An autonomous superintelligence did not decide to rob a bank. A human attacker used a language model as a research assistant and a Chinese model as a force multiplier. The distance between those two descriptions is the entire story, and almost nobody covering the drill wants to sit in it.
OpenAI and Anthropic — two firms whose valuations rest on the premise that they are building the most powerful technology in human history — convened a tabletop exercise to rehearse a catastrophe. They then briefed senators on what they rehearsed. The framing is responsibility. The mechanics are something else. Based on my audit work going back to the 2017 EOS genesis review, I have learned to read the balance sheet behind the press release. This is a positioning exercise wearing the costume of a safety drill. The front-runner didn't rehearse the failure that had already happened. It rehearsed the failure it could most credibly claim to have foreseen.
Context
The facts, stripped of narrative. OpenAI and Anthropic jointly ran a tabletop scenario in which a major AI incident unfolds — most likely a network attack, per industry expectations cited in the reporting, with a 6-12 month horizon. The scenario named banks, the internet, power, and water as potential interruption targets. Separately, OpenAI's safety lead resigned, warning that a "trial-and-error culture" would inevitably increase failures. On the legislative side, proposals circulated: a superintelligence ban, a development pause, and an "AI Kill Switch Act" that would grant regulators authority to shut down dangerous systems. Company representatives reportedly told lawmakers they understood such laws could not pass — and briefed them anyway.
The timing is not incidental. A midterm election cycle is underway, and AI has become a live political instrument. When an industry expects a disaster within a year, and that expectation collides with an election calendar, the drill stops being a technical exercise and becomes a campaign contribution in kind.
The reporting is a second-hand relay, sourced largely to Axios, built on anonymous industry insiders and company self-description. No independent auditor appears in the chain. No regulator. No civil society. That sourcing structure is itself a data point, and I will return to it.
For readers who track crypto, the venue matters. BeInCrypto, a digital-asset outlet, is covering frontier AI governance. Cross-domain coverage is not a flaw in itself. But the selection pressure of traffic-driven media amplifies the dramatic and compresses the mechanical. "AI companies rehearse the apocalypse" travels. "AI companies attempt to define the regulatory perimeter before it is drawn" does not. The headline you are reading is a function of that asymmetry.
Core
Three roles, one actor. That is the structural fact from which everything else follows. In this scenario, OpenAI and Anthropic are simultaneously the producers of the risk, the governors of the risk, and the authors of the rules that will govern the risk. When the same entity occupies all three seats, you do not have governance. You have self-assessment with a press strategy.
I have dissected this configuration before, in a different asset class. When I reverse-engineered Uniswap V2's mempool dynamics in 2020, the finding was not that MEV bots were evil. It was that the protocol's incentive design made extraction rational, and no participant inside the system had both the motive and the authority to stop it. The fix had to come from outside the incentive loop. The same principle applies here. A company cannot credibly police a risk it is compensated to accelerate.
Consider what the rehearsal actually produces. Three outputs, none of them a reduction in the underlying probability of harm.
First, reputational insurance. If a major incident lands within the stated 6-12 month window, the companies can point to the drill. We warned you. We prepared. We convened. The rehearsal converts a future liability into a pre-banked asset. That is not cynicism; it is accounting. The exercise is priced as goodwill on a balance sheet that has no line item for the harm itself.
Second, rule-definition capture. The reporting is explicit: the companies understand the current legislative proposals cannot pass, and they are briefing lawmakers regardless. This is not futile. It is the opposite. Pre-emptive lobbying during a legislative vacuum determines the shape of the eventual framework — what counts as compliance, what counts as negligence, who bears liability. In crypto, I watched the SEC practice regulation-by-enforcement for years and concluded it was not ignorance of the technology. It was the deliberate withholding of clear rules to preserve discretionary leverage. The AI version is subtler but structurally identical: rather than withhold rules, the incumbents write them first and let the state ratify.
Third, framing displacement. Here is the analytical crux, and it is where most coverage fails. The rehearsal frames the catastrophic risk as an external network attack — a human attacker, a foreign model, a breached bank. That framing is convenient. It locates the threat outside the lab. It says the danger is what bad actors do with AI, not what AI does on its own. But the risk that most occupies alignment researchers — the one that does not require a malicious human in the loop — is internal. It is the model's own objective failing to track human intent. The drill does not rehearse that. It rehearses the version of the apocalypse that leaves the builder as the solution rather than the suspect.
Watch what the CrowdStrike detail does to this framing. Attackers used DeepSeek and Claude Code. A Chinese model and an American product, jointly implicated. The narrative threads do different work. DeepSeek gets named as the weapon — a stigma with direct geopolitical consequences for Chinese models seeking entry into sensitive overseas sectors like finance. Claude Code gets named as the abused tool — a stigma, but a softer one, the kind that invites a patch rather than a ban. Both firms suffer in the telling. Only one suffers as a threat. This is not a neutral detail. It is an allocation of blame, and it maps cleanly onto the export-control logic already governing the sector.
I will add a signal from my own work that the report omits. In 2025, I analyzed the oracle problem in AI-crypto integrations and found a flaw in the Chainlink API design that let AI models manipulate price feeds through synthetic data injection. I proposed a zero-knowledge proof scheme for AI verification. The technical complexity made deployment impossible before the regulatory deadline, so the framework went to paper and, eventually, into the EU's AI Act guidelines. The lesson is uncomfortable for everyone in this story: the verification infrastructure for AI actions does not yet exist at production grade. We are rehearsing governance of a system whose actions we cannot yet cryptographically attest. The drill is theater performed on an unfinished stage.
Now map the risk surface honestly. The tabletop's categories are not equally weighted, and the reporting blurs them.
| Risk class | Level | Basis | Mitigation | |---|---|---|---| | Network-attack misuse | High | Documented bank intrusion | Low — cross-model, cross-platform | | Jailbreak / prompt injection | Medium | Claude Code asked for fencing channels | Unknown | | Data exfiltration | Medium | Bank data theft reported | Unknown | | Systemic loss of control | Medium (narratively high) | Regulation targets "superintelligence" | Unknown | | Alignment failure | Medium | Not evaluated in the drill | Not applicable |
The table is the tell. The highest-confidence risk is the least exotic: humans using models to attack humans. The most legislated risk — superintelligence — is the one with no supporting incident. Regulation is being aimed at the failure mode that has not occurred, while the failure mode that has occurred gets treated as background noise.
There is a mechanical reason for this, and it is the same reason Layer 2 scaling has stalled. Dozens of chains now compete for the same fixed pool of users. That is not scaling; it is slicing scarce liquidity into fragments. AI safety has an analogous fragmentation problem. Every lab runs its own drill, its own red team, its own governance council, its own interpretation of "responsible." There is no shared standard, because a shared standard would constrain the fastest mover. Fragmentation is not an accident of the field. It is the equilibrium that maximizes the freedom of the incumbents. And like the "liquidity fragmentation" narrative in DeFi — which was less a market condition than a pitch for the next product — "AI safety fragmentation" is a condition the leaders have every incentive to sustain.
The resignation of OpenAI's safety lead is the one data point in this story that resists the narrative. A departing insider warning that a trial-and-error culture will increase failures is a direct empirical signal that the external posture and the internal reality diverge. When a company rehearses catastrophe for senators while its own safety function bleeds out the back door, you are not looking at a governance failure. You are looking at a governance performance. A bug is just a feature that hasn't been disclosed — and a safety culture is just a marketing claim that hasn't been audited.
Regulation in this space will not arrive as a gradient. It will arrive as a step function. The mechanism is event-driven, and the precedents are unkind. COVID-19 rewrote public-health authority in weeks. 2008 rewrote banking supervision in a quarter. The reporting tells us the industry itself expects the triggering event within 6-12 months. That is not a prediction of a disaster; it is a statement that the disaster is the scheduled input. When the trigger fires, the legislation that could not pass today will pass in a single session, and the companies that spent the last year briefing senators will have authored its first draft.
I have modeled this dynamic before, in assets that pretended to be solvent. In 2021, I dissected Axie Infinity's contracts and found a revenue model that required perpetual new-user inflow — a Ponzi structure wearing a game. I estimated a 90% collapse probability within 18 months. In early 2022, I proved the LUNA/UST feedback loop was mathematically unsustainable and put the collapse threshold at a $10 billion market cap. Both systems hid their fragility behind growth narratives, and both narratives survived exactly until the first redemption wave. AI valuations are not Ponzi structures. But they share the property that matters: they rest on a perpetual-growth assumption that a single event can falsify. The "AI Kill Switch Act," if it ever acquires teeth, is the falsification mechanism. A regulator able to shut a system down breaks the perpetuity premise outright.
The valuation exposure is concrete. The reporting couples the AI buildout to a "fragile economy" — which is the industry admitting, in its own words, that its capital expenditure has become load-bearing for the macro picture. Data-center REITs, cloud providers, chip equities, and the credit facilities behind them all carry that coupling. A step-function regulatory event does not reprice the growth curve; it deletes the terminal value assumption. The hedging instruments are thin. The beneficiaries are predictable: cybersecurity, AI governance compliance, and insurers who price the risk before the market does.
One more line item. The reporting names the founders as the individuals who would bear responsibility after a catastrophe — which is a polite way of saying the market has bound company reputation to founder identity. That is key-man risk, and it is now embedded in the most valuable private firms in the sector. A single resignation, a single congressional appearance gone wrong, a single leaked internal memo, and the valuation re-rates. The safety lead's exit is a preview of that sensitivity.
That last point deserves emphasis. The first industry to price an AI catastrophe will not be the labs. It will be the reinsurers. When underwriters start writing model-liability policies and demanding evidence of AI usage governance from their insureds, the "voluntary" standards become de facto mandatory — enforced by the cost of capital rather than by statute. That is how this actually gets governed. Not through the Kill Switch Act, but through a premium adjustment. Watch the insurance desks, not the press conferences.
The governance market is already forming around this gap. Banks and critical-infrastructure operators will need unified controls over models sourced from multiple vendors — American, Chinese, open-weight. That is a procurement problem before it is a policy problem, and it will produce a new category: AI usage governance tooling, sold to compliance departments that currently have no idea what their employees are routing through which model. I have seen this movie in crypto. The moment a regulator names a risk, a vendor appears to sell its mitigation. The difference is that this time the regulator may not need to act. The insurers will have already moved.
Contrarian
Here is where the bulls have a point, and I will concede it because precision demands it. Under a genuine regulatory vacuum — with a government that resists constraint and a legislative pipeline that cannot pass — self-organized rehearsal may be the only functioning mechanism that exists. A drill is not nothing. It surfaces failure modes, forces executives to sit with scenarios they would rather avoid, and creates internal documents that later become evidence. If the alternative is no rehearsal at all, the drill is strictly better.
And the "slowdown harms a fragile economy" argument, which I read as a moral hostage-taking maneuver, is not entirely false. AI capital expenditure has become load-bearing for the macro narrative. A sudden stop would transmit through credit, employment, and asset prices. The bulls are right that the coupling is real. They are wrong to treat the coupling as an argument for acceleration rather than as a description of the exposure. Identifying a hostage is not the same as endorsing the ransom.
The blind spot is narrower and harder than the bulls admit. The thing the labs cannot self-police is the conflict of interest itself. They can rehearse, they can brief, they can publish frameworks. They cannot credibly audit their own incentive to keep the rules loose. That is the one function that must sit outside the loop — and in this entire story, it is absent.
Takeaway
The question is not whether OpenAI and Anthropic can imagine a disaster. They can. The question is who audits the rehearsal, who verifies the drill, and who holds the standard when the standard-setter is also the risk-holder. Until an independent party — a regulator with teeth, an academic consortium, a cryptographic attestation layer that does not yet exist — sits inside the exercise, the rehearsal remains what it is: a well-funded prediction of a catastrophe, issued by the parties best positioned to profit from the prediction being believed. Watch the safety-team departures, not the press releases. The front-runner didn't rehearse the failure it could not control. It rehearsed the one it could narrate.
