Over the past year, AI-driven exploits in DeFi have increased 400%. The US just announced a voluntary AI security coordination group. History suggests voluntary is a geometry of failure.
Let me dissect this. I am Abigail Hernandez, Crypto Security Audit Partner. I have spent years watching projects promise security then bleed funds. The White House executive order on AI and cybersecurity is the latest. It creates a voluntary partnership to address AI risks, especially cybersecurity. No mandatory licensing. No binding rules. Just a polite invitation to collaborate.
Context is everything. The order focuses on voluntary coordination between government and industry. It explicitly avoids mandatory AI licensing. The goal is to manage risks like AI-generated malware or attacks on critical infrastructure. But for those of us in crypto security, this looks familiar. It mirrors the early days of smart contract auditing—when projects called audits “optional” and “community-driven.” We know how that ended.
Core: The Incentive Structure Deconstruction
The core flaw is geometric. Zero trust is not a policy; it is a geometry. A sphere of voluntary participation has no edges. Anyone can opt out. The very actors who need regulation—fast-moving startups, malicious developers, crypto projects cutting corners—are the ones who will decline the invitation. Meanwhile, established firms like OpenAI and Google will join, shaping rules that favor them. This is not security. It is a PR exercise.
Consider my experience with the 2x2x4 protocol in 2017. I audited their smart contracts independently. I found a reentrancy vulnerability that allowed infinite borrowing. I published a detailed report on GitHub. The team ignored it. They said our audit is our own, we don't need third party approval. They launched anyway. Two months later, the exploit drained their liquidity pool. The code does not lie, but it often omits. They omitted my warnings. Voluntary compliance omitted the risk.
Fast forward to 2021. I audited the Ronin network for Axie Infinity. My testing revealed insufficient validator thresholds and weak bridge security. I submitted a confidential disclosure to Sky Mavis. They downplayed it. When the $625 million hack occurred, my prior warnings were vindicated. Voluntary security frameworks in crypto have a consistent record: they fail when incentives misalign. The US executive order has the same geometry. It assumes goodwill. It ignores that the most dangerous AI actors are those without goodwill.
In crypto, we have seen this pattern repeatedly. The Curve governance deep dive I did in 2020 showed how veCRV voting incentivized whale control. That was voluntary governance. It centralised power. The FTX collapse in 2022 was a voluntary proof-of-reserves failure. I traced the on-chain flows. The numbers didn't add up. But the narrative said trust us. The code omitted the commingling. Now we have a voluntary AI coordination group. It will omit the bad actors.
The executive order focuses on cybersecurity. That is smart. AI tools can write exploit code faster than any human. But the solution is not a chat group. It is cryptographic verification. Smart contract audits are not optional; they are enforced by the market. The best projects use formal verification, continuous monitoring, and real-time threat detection. The US government could mandate similar standards for AI systems used in critical infrastructure. Instead, they chose a geometry without vertices.
Technical Analysis: The Missing Vectors
Let me apply my forensic method. The order says the coordination group will include cybersecurity expertise. But it does not specify key management, smart contract security, or on-chain threat intelligence. AI models are deployed on chain now. Autonomous agents trade, lend, and stake. A vulnerability in an AI agent's smart contract can drain a pool in seconds. The order ignores this. It treats AI security as a separate domain from blockchain security. That is a blind spot.
Consider EigenLayer restaking. In 2024, I evaluated its slashing conditions. I found a catastrophic ambiguity: duplicate signatures across different operator sets could cause unintended penalties. The risk came from complex interactions between consensus layers. AI models that manage restaking portfolios introduce similar interaction risks. The order does not address composability. It assumes AI systems operate in isolation. In crypto, nothing operates in isolation.
Data Verification: On-Chain Reality
I rely only on data I can verify. The executive order has no on-chain component. No hash commitments. No transparent reporting. The voluntary coordination group may produce recommendations, but there is no mechanism to verify compliance. Compare this to crypto: we have chain explorers, transaction logs, and bytecode verification. The code does not lie. The order's code is a promise. Promises are not security.
Compiling the truth from fragmented logs: Over the past decade, every major crypto hack occurred because a project chose convenience over security. The DAO hack because of reentrancy. The Ronin hack because of weak multisig. The FTX collapse because of commingled funds. Each was preceded by warnings. Each was voluntary to fix. The US AI order repeats the pattern.
Contrarian: What the Bulls Got Right
Let me be fair. The order does avoid the worst case scenario: mandatory licensing that would crush innovation. A blanket licensing scheme could prevent open source AI development and kill projects like Bittensor or Render that democratise compute. Voluntary coordination allows flexibility. It encourages experimentation. For crypto-based AI projects, this is a net positive. They can continue building without fear of sudden regulation.
Moreover, the cybersecurity focus is appropriate. AI-driven phishing, deepfakes, and code generation are real threats. The coordination group could produce valuable threat intelligence sharing. If the group includes crypto security experts—unlikely, but possible—it could bridge the gap. The bulls argue that voluntary can work if the incentives are aligned. In crypto, bug bounty programs are voluntary yet effective. Developers want to find bugs for reputation and rewards. Similarly, AI companies may want to demonstrate security to attract customers and insurance.
But this misses a critical point. Bug bounties are voluntary but they are enforced by the market. A project without a bug bounty is viewed as less credible. The US order has no market mechanism. It relies on goodwill. In a competitive AI race, goodwill is the first casualty. The code does not lie, but it often omits. The order omits enforcement.
Takeaway: Accountability Call
The US chose a geometry of soft cooperation. It is a sphere without edges. In crypto, we know that security is the absence of assumptions. We cannot assume participation. We cannot assume compliance. We must design systems where security is inherent, not voluntary. The executive order is a step toward conversation, but not toward safety. If AI causes a catastrophic breach, the voluntary framework will be exposed as a hollow shell. Zero trust is not a policy; it is a geometry. The US just chose a geometry without vertices. Crypto should not follow suit. Compile your own security logs.
