The headline crossed my desk on a slow Tuesday, the kind where bitcoin is sideways and nobody on Crypto Twitter wants to talk about governance. According to The Information, OpenAI and Anthropic are in discussions to stress-test each other's frontier models for safety. Cooperative safety. Shared red teams. A possible precedent for how artificial intelligence gets governed.
Read that again and count what is missing. No agreement. No schedule. No roster of who sits in the room. No independent observer. No disclosure mechanism. One verb carries the entire story: discuss.
I have spent the better part of a decade auditing governance systems that look exactly like this — two counterparties agreeing to police each other while everyone outside the arrangement takes the outcome on faith. It rarely ends the way the press release promises.
Bulls react to headlines. Bears reflect on structure. We build. So let me reflect, because this AI story is the crypto governance story with a different logo pasted on the front, and we have already run this experiment on-chain. We know how it ends.
The Precedent Stack Nobody Mentions
Strip away the novelty and you find a well-worn groove. AI safety testing is not virgin territory. The Frontier Model Forum launched in July 2023 with OpenAI, Anthropic, Google and Microsoft at the same table. MLCommons has been building AI safety benchmarks in the open. Since 2024, the US and UK AI Safety Institutes have pushed pre-deployment testing protocols into practice. The White House extracted voluntary commitments back in 2023; Bletchley and Seoul layered declarations on top of those.
So the honest reading forks in two directions. Either this is another brick in a wall that already exists, in which case the news value is close to zero, or it is a genuinely new bilateral arrangement in which two direct competitors test each other's models directly, in which case it matters a great deal. The report gives us no way to distinguish the two. That is not a small gap. It is the entire question.
I want to be careful here, because the source is thin. One secondary account, roughly four information points, no test scope, no firewall design, no third-party verifier. When I audited more than 150 project whitepapers during the 2017 ICO bubble, I learned to grade my own confidence honestly. On the facts of this specific story, my confidence is low. On the structural pattern it belongs to, my confidence is high. Those two statements are not in tension. They are the whole point.
A Two-of-Two Multisig Wearing a Lab Coat
Here is where my scars become useful to you.
In blockchain governance, we spent years chanting a slogan — code is law — as if software could replace the messy human question of who decides. Then we grew up and read the actual contracts. Every major DAO I have audited, without exception, routes its most consequential powers through an upgrade key held by a handful of multi-sig signers. The token holders vote. The signers execute. And if the signers disagree with the vote, the vote is decoration.
That is the honest anatomy of "decentralized" governance: a two-of-three or a four-of-seven multisig at the root, and a beautiful governance forum on top. The community is real. The upgrade authority is not distributed the way the diagram suggests.
Now map that onto two AI labs agreeing to test each other. Who holds the upgrade key on this arrangement? The two labs. Who verifies that a test actually occurred, at what depth, with what adversarial pressure? The two labs. Who decides whether a dangerous capability finding gets disclosed or quietly patched before anyone outside the room hears about it? The two labs.
A safety pact between two competitors is a two-of-two multisig with no external verifier. In cryptographic terms, that is not a trustless system. That is two humans in a trench coat calling themselves a protocol.
I mean that precisely, not as a jab. A two-of-two multisig with no timelock and no challenge window is the weakest possible threshold configuration. It offers no protection against collusion, because collusion is exactly two-of-two. It offers no protection against an individual party going quiet, because a dead signer blocks the path. It offers no protection against a quiet policy change, because the parties who would object have no seat and no key.
I have watched this configuration fail in DeFi. I have watched it fail in NFT treasury management. I have watched foundations quietly swap signers while the governance forum debated a temperature check that had no binding force. The pattern is not exotic. It is the default state of any system that trusts a small group to check itself and calls the arrangement decentralized because the word appears in the docs.
The Parameters That Decide Everything
When I consult on governance design, I insist on three parameters before I will call any mechanism meaningful. Test them against this AI story and the thinness becomes painful.
First, the depth of scope. Does the testing actually reach dangerous capability evaluations — chemical, biological, radiological, nuclear, offensive cyber, autonomous replication? Or does it stop at the polite layer of jailbreak prompts and benchmark suites that a determined attacker optimizes against in a weekend? A safety test that avoids the dangerous capabilities is theater with a budget.
Second, the independence of the tester. Mutual testing between competitors is a strange hybrid. On one side, each lab has an incentive to find flaws in the other's model, because a documented weakness is competitive intelligence dressed as public interest. On the other side, each lab has an incentive not to find too much, because today's finding about a rival becomes tomorrow's finding about yourself. That is not independence. That is bilateral hostage-taking with a shared interest in the ceiling.
Third, the disclosure mechanism. Is the result published, privately reported to a regulator, or filed in a drawer? A finding that never leaves the room cannot be verified by anyone outside it, which means the mechanism cannot be distinguished from its absence. From the outside, a test that happened and a test that was claimed are literally indistinguishable.
Remove any one of those three parameters and you have a machine that produces the appearance of safety without the substance. The industry has a name for this in finance. We call it greenwashing. The AI version deserves its own noun, and safety washing is the obvious candidate.
The Goodhart Trap Built Into the Format
There is a deeper structural flaw that crypto has already priced, and AI is about to learn.
Verify the code, trust the community. That is the slogan I have used in every lecture I have given since founding The Decentralized Mind, and it cuts against the naive assumption that a passing test equals a safe system. Any evaluation benchmark, once public, becomes a target. Models are trained, fine-tuned, and prompt-tuned against known rubrics. The moment a stress test standardizes, the incentive shifts from be safe to pass the test, and those are not the same objective.
We learned this with oracle design. A price feed that reports one number from one region with no redundancy looks decentralized until the block that breaks it, and then everyone discovers that a single point of failure dressed in a network diagram is still a single point of failure. The lesson generalizes. A safety certification is only as strong as the weakest surrounding assumption, and the weakest assumption is always that the certification reflects the thing it claims to certify.
Goodhart's law is not a philosophical curiosity here. It is a design constraint. Any standard that becomes a procurement checkbox becomes an optimization target, and any optimization target will eventually be gamed by the party with the most engineers.
What Voluntary Standards Are Actually For
I have to hold two truths at once, because the advocates are not entirely wrong.
In the absence of enforceable regulation, voluntary industry standards can be genuine self-rescue. A sector that polices its own worst actors buys itself credibility and time. That is a real function, and it has worked in pockets of finance and aviation.
But I have also watched enough regulatory cycles to know the second function, the one nobody prints on the slide: voluntary standards are most useful as a substitute for mandatory ones. A cheap promise made now can defer an expensive obligation written later. When the EU's AI Act obligations for general-purpose models move into implementation, and when US state-level legislation keeps advancing, a well-timed public commitment to mutual testing is worth more to a lab's legal team than to its research team.
That does not make the labs villains. It makes them rational actors in a system that rewards preemptive self-regulation over waiting to be regulated. I would probably do the same in their position. But it does mean we should stop reading cooperation as a moral statement and start reading it as a compliance posture.
Here is the sharper consequence. If mutual testing or safety attestation becomes a de facto procurement requirement — a box that enterprise buyers and governments tick before signing — it becomes a moat. Not because anyone drew one on purpose, but because small labs, academic groups, and open-weight projects cannot afford the expert labor, the legal scaffolding, and the audit cycles that certification demands. Big-lab standards quietly raise the cost floor for everyone else. That is the same asymmetry I watched build up in Layer 2 fragmentation, where dozens of rollups chased the same small pool of users and liquidity until the distinction between scaling and slicing became a matter of marketing.
The Missing Parties Speak Loudest
Look at who is not in this story. Google DeepMind sits in the Frontier Model Forum but appears nowhere in the bilateral framing. Meta has spent years arguing the open-source case and opposing pre-deployment licensing. Mistral, xAI, and the Chinese labs are structurally locked out of cross-border compliance conversations they cannot influence.
Their absence is the signal. A bilateral testing pact between the two most prominent safety-branded labs is not the same thing as an industry standard. It is a private arrangement that may, if it sticks, define what industry standards look like for everyone who was not at the table. That is the definition of a closed shop, arrived at politely.
The release channel compounds my suspicion. This came out through a paid technology publication, not a joint press conference, not a signed blog post, not a regulator's filing. Reading between those lines: the two parties likely have not agreed on how to describe the arrangement publicly, or they want to test market and regulatory reaction while preserving the option to walk it back. That is a hedge. Hedges are rational. They are also, by definition, not commitments.
Where I Land, Honestly
Tech changes. Values remain. The values here are not complicated. If two organizations claim to protect the public from dangerous systems, the public deserves to know what was tested, who tested it, and what was found. Everything else is branding.
So my test for this arrangement is not whether smart people are talking. It is a single question asked at six months: does an external party — a safety institute, an academic group, an independent auditor — get a seat, a key, and a publication channel? If yes, this becomes a genuine institution and I will revise my skepticism upward. If the answer stays inside the room, then what we have is a two-of-two multisig explaining that it protects you.
Bulls react. Bears reflect. We build. And what we build, in crypto and now in AI, should always be the version where the outsider can verify the claim without trusting the insider. That is the covenant. The code is just the paper it is written on.
