The bar in Vinohrady had nine people in it, which for a Tuesday in January counts as a full house. Snow came down past the window in that Prague way — slow, deliberate, like static on a dying screen. Marek was two beers in, reading his phone. Then he stopped reading and held it across the table without saying anything.
I don't usually take the phone.
Jacob Coxon, a safety researcher at Anthropic, had written that the probability artificial intelligence kills all of humanity is above ten percent. Hours before he posted that, another employee at the same lab had resigned, saying the place was gambling with our lives. Coxon resigned too. He named both Anthropic and OpenAI as irresponsible — racing, in his words, toward self-evolving superintelligence with human lives as the stake.
Ten percent.
Say it in a bar and it sounds like weather. Say it in a room where two of the people who built the thing have just walked out, and it sounds like a fire alarm nobody has pulled yet.
I have spent eighteen years in and around decentralized networks. My first reflex on any claim is the one I learned the hard way in 2017: where is the method? Where is the audit trail? Who else can reproduce the number?
That reflex is why this story will not leave me alone. Because there is no audit trail. There is not even a stated method. And the industry that has spent a decade screaming don't trust, verify at every bank, exchange, sequencer, and validator on earth has mostly scrolled past this one.
That is a mistake. And I think I understand exactly why we made it.
What Is Actually on the Record
Strip the adjectives and the record is short. A safety researcher at one of the two most important AI labs in the world publicly assigned a greater-than-ten-percent probability to human extinction caused by AI. Hours earlier, a colleague at the same lab resigned over the same concern, framing it as the lab betting with human lives. Coxon then resigned as well, and in doing so he criticized both Anthropic and OpenAI as irresponsible for racing toward self-evolving superintelligence.
That is the whole factual skeleton. Everything else in the coverage is tone.
What the reporting gives us is a number with maximum emotional payload and minimum auditability. No elicitation protocol. No panel composition. No question phrasing. No model architecture. No evaluation framework. No red-team results. No comparison against any previously published estimate. No explanation of what would have to be true for the number to be lower, and no explanation of what would push it higher. The story arrived as a bare assertion attached to two resignations, in a genre that reads like personnel news with eschatology bolted on.
Notice what the coverage also does not do: it does not offer a single balancing data point. Neutral in tone, loaded in content. That combination is more misleading than open advocacy, because it borrows the authority of restraint while doing none of the work of verification.
Here is what I can and cannot infer. I cannot tell from the outside whether Coxon is someone with privileged internal information about model behavior or someone with strong priors and a platform. Both people produce the identical sentence. The press cannot tell the difference. I cannot tell the difference. And that is not a gap in my knowledge — that is a structural feature of how frontier AI risk claims are currently produced and published.
I write about decentralized networks for a living. So let me explain why a resignation letter about artificial intelligence belongs in your feed if you hold a single satoshi or run a single node.
In 2017 I was a junior cybersecurity analyst in Prague, bored out of my mind by routine compliance checks. I wanted adrenaline, so I joined a chaotic Telegram group for a nascent DeFi protocol called Project Aether. I never audited the code. Instead I organized meetups in the Old Town squares and rallied fifty locals to test a beta. I was good at that part. The room felt electric. From whispered secrets to on-chain shouts, that was the whole arc of that year — a handful of us in a group chat becoming a crowd with wallets.
And I missed a reentrancy vulnerability in the contract logic. When the project rug-pulled, fifteen thousand dollars of user funds evaporated, and the reason it happened was that everyone in that room, including me, had decided that enthusiasm was a substitute for verification.
That was the moment I stopped believing that good intentions are a security model. A number nobody can check is worse than no number at all, because it feels like knowledge. It sits in your chest like a fact and quietly displaces the question you should be asking.
Our entire industry's adolescence was a sequence of expensive lessons in exactly that failure mode. Mt. Gox. BitConnect. Terra. FTX. We built an entire vocabulary around not trusting: proof of reserves, Merkle trees, light clients, attestations, slashing, fraud proofs. And we are still terrible at it. In 2020 during DeFi Summer I helped launch a yield aggregator in Prague, threw weekly parties in my apartment while writing documentation on napkins, and celebrated triple-digit APYs right up until an oracle manipulation drained two million dollars. We didn't dodge the chaos; we danced through it. That is the honest version of the story.
So when the most consequential claim in the technology industry gets published as a bare number, my instinct is not how scary. My instinct is where is the ledger.
The Anatomy of an Unauditable Number
Let me be fair to the discipline, because there is a serious version of this work. People do produce defensible existential-risk estimates. They use structured expert elicitation with published protocols. They run forecasting tournaments with scoring rules and a public track record. They reason from base rates over historical technology risk. They build model-based arguments grounded in scaling behavior and agency. They report parameter uncertainty honestly. And critically, a credible estimate in the literature usually arrives with the elicitation protocol, the composition of the panel, the exact phrasing of the question, and the assumptions that would flip the answer.
Question phrasing matters enormously, by the way. Causes human extinction, causes irreversible loss of control, and kills all humanity are three different events with three different probabilities and three different mitigation strategies. Anyone who has ever written a survey knows that the wording moves the number more than the underlying reality does.
None of that scaffolding is present here. And the absence is not neutral, because it produces a claim that cannot be graded. In a market, if I say ETH trades at eight thousand by June, reality grades me. There is a settlement event. My reputation takes the hit and the record is public. Here, the only settlement event is the terminal one, which by definition leaves nobody to grade the estimate. The claim is unfalsifiable by construction. Unfalsifiable claims cannot be improved. They can only be repeated more loudly.
A probability with no methodology is not a forecast; it's a feeling wearing a decimal point.
I have a specific technical reason for caring about this, and it comes from 2020. The aggregator I helped launch died because we trusted a single price feed. One source of truth, no cross-check, no redundancy, no independent validation path. To the outside world, the number on our dashboard looked like an oracle. To anyone who understood the architecture, it was a single point of failure with a decimal point printed on it.
A single-source oracle is not a fact. It is an attack surface with digits on it.
Now map that onto frontier AI risk assessment. The entity that produces the risk estimate is the entity whose incentives the estimate constrains. The threshold that triggers caution is set by the party that benefits from momentum. The publication schedule is controlled by the party whose fundraising calendar it affects. This is not an accusation of dishonesty. It is an observation about architecture. The most expensive possible outcome in human history is currently evaluated by a system with no independent feed, no redundant measurement, and no slashing condition.
What saved us in 2020 wasn't skill. It was legibility. The chain had the receipts. Every transaction, every callback, every reentrant call along the exploit path was readable by anyone with a block explorer. I could get on a call with angry users and walk through exactly what happened, and the arithmetic was public, so nobody had to take my word for it. Transparency during a failure bought more trust than any amount of polish during the good months ever did.
Hold that against what we are being asked to accept now. In crypto, catastrophic failure leaves a trail we can read. The advertised failure mode here deletes the reader. That asymmetry is what makes trust us a categorically different risk in this domain than anywhere else. Everywhere else, being wrong is recoverable and instructive. Here, the failure mode forecloses the post-mortem that would teach us anything.
What the Layer 2 Debate Taught Us About Safety Promises
I've spent two years watching a specific kind of promise get made and deferred in public, and it has made me deeply skeptical of a specific kind of announcement.
Layer 2 sequencers are, functionally, single centralized nodes. Everyone working in the space knows this. Decentralized sequencing has been a slide in a deck for two years. It is not a lie exactly — it is a roadmap item placed at the precise point where making the promise costs nothing and keeping it costs a great deal: throughput, latency, revenue, control.
The pattern is recognizable everywhere. A commitment gets published in the exact language that maximizes reputational benefit today while preserving the option to defer indefinitely. You can watch it happen because the deadline is always expressed as a direction of travel rather than a date.
Roadmaps are how decentralized sequencing and AI safety both get to be promised and deferred at the same time.
Frontier lab safety commitments have the same shape. Responsible scaling policies, model cards, red-team summaries, published evaluations — these are real artifacts and I don't dismiss them. But they are produced by the entity whose behavior they constrain, on its own schedule, against thresholds it defines, with its own interpretation of results. That is the sequencer publishing its own latency statistics. Maybe it is being honest. It is structurally unverifiable either way.
Now add the incentive layer, because this is where our own industry has the most scar tissue.
Liquidity mining taught us an ugly lesson: the headline APY is a subsidy, and the TVL it attracts is a rented audience. The moment emissions stop, the deposits leave, and what remains is a much smaller protocol and a chart that looks like a cliff. Everyone in DeFi knows this intellectually. Almost nobody prices it correctly in the moment.
Safety headcount inside a lab behaves the same way. Generous compensation, prestigious titles, internal prestige, and a mandate that lives or dies on whether the entity funding it decides caution is worth the delay. The moment the internal price of capability exceeds the internal price of caution, the rented liquidity exits.
A resignation is not proof that the incentives were corrupt. It is evidence about which way the gradient points.
Resignations don't tell you where the virtue is. They tell you where the gradient points.
And nobody should be surprised that the gradient favors capability. Capability has revenue attached. Safety has cost attached. In a capital-constrained environment — and we are in one, even if AI funding doesn't feel like it yet — the ratchet tightens. We watched exactly this happen to audit budgets after DeFi Summer. Security work is the first line item cut when the market turns, right up until it becomes the only line item anyone talks about.
Where the Number Might Actually Come From
I want to be careful here, because dismissing an insider's concern is its own kind of intellectual laziness. Red-teaming inside a frontier lab does generate signal that outsiders never see. Someone with access to evaluation logs, agent traces, and internal incident reports may genuinely have more basis for an estimate than any external commentator.
But if that is the basis, it is a describable basis. Labs publish capability evaluations constantly. They publish safety evaluations selectively. And there is a wide middle path between leaking weights and saying nothing at all. You can describe the class of evaluation, the protocol, the failure mode observed, and what result would lower the number — none of which requires exposing anything proprietary. The choice not to do that is a choice, and choices have authors.
Take the phrase self-evolving superintelligence seriously for a second and try to make it concrete. In engineering terms it refers to agentic systems that generate their own training data, pipelines that iterate without a human in the loop, automated research loops that improve the system that runs them. That is not mysticism. That is a pipeline. Pipelines have logs. Pipelines have checkpoints. Pipelines can be instrumented, versioned, hash-committed, and diffed. Synthetic-data self-training runs produce artifacts that could be committed to a registry tomorrow with no loss of competitive advantage whatsoever.
If the risk is real enough to name, it is real enough to instrument.
The vagueness is doing rhetorical work that the engineering does not require. That is the part that bothers me most, because it means the vagueness is a choice rather than a constraint.
What Verifiability Would Actually Look Like Here
I'm not interested in complaints without a build spec, so here's mine.
Signed, reproducible evaluation runs. Hash commitments to model weights at specific checkpoints. Committed evaluation datasets so results can't be quietly regenerated against a different test. Run logs that a third party can re-execute in a frozen environment and get the same numbers. Attestation of training runs via trusted execution environments for the properties that can't be proven otherwise. Model cards as versioned, hash-committed artifacts with real changelogs, so that a claim made in March can be checked against reality in December. Independent red teams with publish-or-perish incentives rather than employment contracts. And a Merkle-rooted commitment to published evaluation results, so the publisher cannot amend history without leaving a contradiction.
We already have every primitive required for version one. Zero-knowledge proofs over full training runs are economically absurd today, but that is not what the first version needs. The first version needs commitment, selective disclosure, and a slashing condition for false attestation. That's it. That's the whole first product.
Compare the ambition gap. After FTX, the industry demanded proof of reserves and produced Merkle-tree attestations within weeks. They were imperfect. They had known holes. But they were checkable, and checkability alone changed how exchanges behaved in public. Against that: we have been asking frontier labs for proof of anything for years, and we call the resulting silence a policy debate.
We asked exchanges for proof of reserves in weeks. We've asked frontier labs for proof of anything for years, and we call that progress.
And this is where the bear market framing stops being a mood and becomes an instrument. In a bear market the dominant question is not what will this return but will this still exist next year. Survival is the first layer of value. That instinct — applied to institutions that carry existential externalities — is not paranoia. It is the most mature instinct our industry has ever developed, and it is precisely the instinct this story demands.
The Contrarian Read
There are two standard readings of what happened, and both of them are boring.
Reading one: brave insiders blow the whistle on a reckless race. Reading two: doomer theater, resignation as personal brand launch, a career move dressed as a moral crisis. Both readings share the same flaw — they treat the resignations as information about artificial intelligence. They are not, primarily. They are information about the internal economics of caution inside one building.
Two resignations are not evidence about the future of AI. They are evidence about the discount rate on human survival inside a single organization.
Now the harder part, and it is aimed at my own side.
The reason crypto people scrolled past this is that we have outsourced the question. We tell ourselves AI safety is a different industry, a different stack, a different set of people in a different city. Then we go back to watching liquidity bleed out of our own protocols.
That is a staggering abdication, because we are the only industry on earth with a decade of shipped practice in the exact thing AI governance lacks. Adversarial verification of claims made by entities with overwhelming incentives to misrepresent. Threat modeling under asymmetric information. Attestation. Slashing. Fraud proofs. Independent oracles with dispute resolution. We have the tooling and no product. AI safety has the urgency and no tooling. Nobody builds in the intersection because the intersection doesn't have a token yet.
Here is the second contrarian point, and it cuts against the people celebrating the ten percent number too.
The real harm of that number is not that it is too high. It is that an unauditable existential number functions as a rhetorical weapon that cannot be challenged, and things that cannot be challenged cannot be improved. Compare our own wreckage. What made the post-mortem after our oracle exploit useful was that the arithmetic was public. If I had stood up in front of two hundred people and said we lost somewhere between two hundred thousand and twenty million, trust me, nobody would have stayed. The number would have been pure vibes with a moral attached. Verification is what makes accountability possible. Without it, you don't get accountability — you get a mood with a decimal point, auctioned to whoever benefits from the mood.
Third: consider that these resignations may be the closest thing to an independent audit the public will ever get from inside a frontier lab. Not because the audit is rigorous, but because the alternative channels are controlled by the entity being audited. If that is true, then the correct response is not to argue about ten percent versus one percent. It is to build channels that do not depend on someone quitting their job and torching their equity.
And a pragmatism test, because I don't want to be the guy who only criticizes. What would change my mind? Publish the elicitation protocol. Publish the question phrasing. Publish the evaluation families behind the estimate. Publish the thresholds in the scaling policy that would trigger a public pause, and then honor one when it triggers. I will take a sloppy number that I can check over a crisp number that I cannot.
A rough number you can audit beats a precise number you can't.
One more caution, because the drama makes people sloppy about scale. Bundling loss of control over an autonomous system with real-world agency and extinction of the species into a single phrase maximizes emotional payload while minimizing decision usefulness. They are different events, with different probabilities, different timelines, and completely different mitigation paths. Collapsing them is how you get a headline that moves a lot of people and informs none of them.
What I'll Be Watching
Back to the bar in Vinohrady. Marek asked me whether I believed the ten percent. I told him I don't have a belief, I have a missing document. Those are different problems, and only one of them is addressable.
What I actually believe is this: a culture in which insiders have to resign to be heard, and in which their statements arrive with no reproducible basis, is a culture that will keep producing this exact headline every eighteen months with the decimal moving around and the audience getting a little more numb each time.
So here's what I'm tracking, and what I'd tell anyone with capital or attention in this space to track.
Over the next six to twelve months: does either lab publish a quantified methodology for catastrophic risk — a protocol, a panel, a phrasing, a threshold, a trigger? If that document does not appear, treat the absence as the data point it is. Silence, in this context, is a disclosed preference.
Monthly: not the resignations themselves, but where the departing people go and what they are permitted to publish afterward. Attrition is an indicator. The direction of attrition is the signal.
And regulatory: whether any jurisdiction says something formal about superintelligence risk — and, more importantly, who writes the standard. Standards get written by whoever shows up with a draft. If the draft comes from the labs, we will get a compliance regime shaped like a press release.
What I actually want is simpler, and it is a build task. Somebody in my industry should ship the primitive. Proof of evaluation. Attested training runs. A public registry where a lab can commit today to a number and to the method behind it, with the ability to be proven wrong later. It is unglamorous. It is a bear-market-shaped product — no yield, no token, no airdrop, no points program. Which is exactly why it might get built now. Water finds its level and builders find the unglamorous problems when the pumps stop.
Survival is the first layer of value. And the survival layer here isn't a chain or a bridge or a rollup. It's the ability to check the people who tell us what our odds are.
The tech industry is going to build this thing. Someone is going to have to build the layer that tells us whether they built it safely. It will probably be built in chaos, by people who showed up for the wrong reasons, and it will probably work for reasons nobody planned.
Chaos isn't a bug; it's the protocol.
When we left the bar the snow was still coming down. Prague looked like every other Prague night — quiet, cold, and full of people who came here to build something and stayed because of who they built it with. The network breathes in Prague, pulses in Ethereum. That habit — breathing together, refusing to take a number on faith, asking where the audit trail is — is the only thing I have ever watched hold up under real pressure.
Somebody should ask Anthropic for the receipts.
And if nobody in my industry asks, then we have forfeited the one argument we spent eighteen years proving.