At the time of writing, the verified public record on Jacob Coxon's exit from Anthropic consists of four items: a name, an employer, an action, and a demand. Coxon resigned from Anthropic. In doing so, he called for China's participation — "buy-in," in the framing that circulated — in AI safety. There is no timestamp on the decision. There is no confirmed title. There is no extended quotation. There is no statement from Anthropic confirming, denying, or characterizing the departure.
Four data points, none of them cross-checked against a second source. I spent 2017 building due-diligence checklists for a Paris venture firm, and I have never once seen a four-point record justify a position change. Not a token sale, not a governance vote, not a policy stance. What this record does justify is a narrower and more useful question — and it happens to be the question a crypto readership should be asking, because the answer runs straight through infrastructure this industry claims to have built: if the United States and China agreed tomorrow on an AI safety framework, how would anyone verify compliance?
That question is not rhetorical. It has a technical answer. The industry has spent three years selling a partial version of it.
Anthropic occupies a specific position in the frontier lab landscape. Founded in 2021 by former OpenAI researchers, the company built its brand on safety-first commitments — Constitutional AI as a training methodology, a Responsible Scaling Policy that ties deployment to evaluated capability thresholds, and Claude as the commercial vehicle funding the whole structure. Its policy team is not decorative. It is the interface between published safety commitments and the regulatory bodies that increasingly want to audit them.
Which is why a departure from that team carries more weight than a departure from a growth team. Safety staff at Anthropic sit on top of the company's central marketing claim. When one leaves and immediately calls for a geographic expansion of the safety perimeter, the signal is not that Anthropic is unsafe. The signal is that someone inside the safety apparatus believes the perimeter is drawn in the wrong place.
As a technical matter, it is. Frontier model risk is non-excludable. A capability that emerges in one jurisdiction is available for misuse in every jurisdiction, and the cost of misuse does not scale with the cost of development. A safety regime covering only labs subject to United States jurisdiction is a firewall with a gap roughly the size of half the world's compute supply. That is arithmetic, not opinion. The Bletchley Declaration in November 2023 and the Seoul commitments in May 2024 both acknowledged this in language. Neither produced a mechanism.
Meanwhile, the cryptographic industry spent the same period insisting it is the mechanism. Attested compute, zero-knowledge machine learning, decentralized training networks, provenance registries, agent payment rails. Readers of this publication have been pitched all of it. So the honest framing is uncomfortable: the AI safety conversation is being conducted in rooms the crypto industry is not in, about instruments the crypto industry says it has already built.
Start with what is actually measurable about a frontier model today. Benchmark scores are self-reported. Model cards are voluntary, non-standardized, and rarely include the evaluation harness. Pre-training data composition is undisclosed. Checkpoint weights are unpublished. A frontier lab can, at any moment, describe its own capabilities in any terms it likes, and the description is unverifiable by construction.
Compare that to a public ledger. Every state transition carries a hash, a timestamp, and a signature. Anyone can reconstruct the full history from genesis. That legibility is not an aesthetic preference; it is what makes certain kinds of analysis possible at all. Here is the split I use, drawn from the last audit I ran against a claim structure like this one:
- Checkable: whether a contract was deployed at a stated address; whether a transaction occurred; whether an address moved funds; whether an incentive program's emission schedule matched its documentation.
- Not checkable: whether a team would ship a roadmap; whether a benchmark number reflected a real evaluation; whether a capability claim was reproducible.
I applied exactly that split in 2020. While most of my colleagues were chasing yield through DeFi Summer, I spent weeks reading Solidity line by line — Uniswap and Compound-adjacent contracts, reentrancy surfaces, accrual math. I found an integer-rounding error in a lending protocol's interest-rate calculation. Minor in isolation, material in aggregate. I reported it privately to the core team before it went public. That was possible for one reason: the code was legible. I could read the state, replay the arithmetic, and produce a reproduction.
No equivalent exists for a closed frontier model. You cannot diff a forward pass you cannot see. You cannot reproduce an evaluation whose harness you do not hold. An AI safety commitment without a measurement surface is a press release with a longer shelf life. That is the entire gap — and it is why "calling for China's buy-in" is easier to say than it sounds and less meaningful than it reads.
Now take the stack that claims to close the gap and test each component against that standard.
Hardware attestation, the trusted execution environment model, proves that a specific enclave with a specific measurement executed. It does not prove that the weights loaded into that enclave are the weights published on a model card. It also inherits a decade of microarchitectural vulnerability history and depends on a vendor-controlled root of trust. Attestation is a real primitive. It answers a question one layer below the one regulators are asking.
Zero-knowledge proofs of inference are mathematically the strongest candidate and practically the weakest. Proving a small model's forward pass is already expensive, and the overhead does not shrink as parameter count grows. The proofs are also only as sound as the circuit's completeness — a proof that you ran a model is not a proof that the model you ran is safe.
Cryptographic provenance of weights is the cheapest intervention on the list and the most decisive. Published hashes of every checkpoint, alongside the evaluation harness and raw evaluation outputs, would let any third party reproduce a claim. It would also make a meaningful fraction of the "verifiable AI" token sector redundant overnight. No frontier lab publishes this. That absence is not an oversight. It is a disclosure decision, taken repeatedly.
Decentralized compute networks aggregate GPU supply and subsidize it with tokens. The aggregation is real. The economics are not. When emissions function as the procurement budget, the utilization curve and the token curve become the same curve. I have watched that pattern since the liquidity mining era. Remove the subsidy and the capacity leaves.
I made a version of this argument in 2021, when I built a script to track whale wallets and minting patterns through the Bored Ape launch window. Transaction hashes reconstructed across multiple blocks showed a majority of initial volume was self-directed. The organic-growth claim did not survive block-level reconstruction. Self-reported AI benchmark numbers have never been subjected to that reconstruction, because there is no block explorer for a training run.
So what would a China-inclusive safety regime actually require, mechanically? Three things travel across borders better than diplomatic language. Reciprocal evaluation: a shared, published suite with mutual access to raw outputs. Structured incident disclosure: a mandatory reporting channel for capability escapes, misuse events, and evaluation failures, specific enough to be audited. Compute attestation: hardware-rooted verification that a stated training run consumed the compute it claims, on the hardware it claims. All three are infrastructure problems. None are solved by a communiqué.
This is where the crypto parallel turns unflattering rather than promotional. The industry already ran this experiment at the infrastructure layer, and the result was fragmentation. Dozens of Layer 2 networks are live or announced, competing over a user base that is a fraction of the one they were meant to expand. Liquidity did not multiply; it was sliced. Each bridge added a trust assumption. Each rollup added a sequencer set. The aggregate system grew more complex without growing more capacious.
That is the current trajectory of AI trust layers. Dozens of attesting networks, provers, provenance registries, and evaluation DAOs, chasing a small set of institutional buyers, none with enough coverage to be cited by a regulator. A standard implemented forty different ways is not a standard. It is forty compliance products with forty tokens attached. Regulators will point at the pile and call it industry self-governance, because that is cheaper than building a measurement regime.
There is a second precedent worth citing, and it is less comfortable than the Layer 2 comparison. When the dominant NFT marketplace made creator royalties optional, the creator economy built on top of it did not adapt — it disintegrated. The royalty was enforced by platform policy, not by protocol. Policy is a discretionary input, and discretionary inputs get optimized away under competitive pressure. Voluntary safety commitments share that property exactly. Nothing in the current architecture makes a commitment binding once a competitor ships first.
The near-term collision between AI safety and on-chain infrastructure is not treaty-shaped. It is agent-shaped, and it is already here.
Autonomous agents now hold keys. They sign transactions, route orders, rebalance collateral, and vote in protocol governance. The compliance stack this industry built — transaction heuristics, sanctions screening, travel-rule data exchange — assumes an accountable counterparty on the other side of a transfer: a natural person, or a registered legal entity. An agent is neither. It has no jurisdiction, no identity document, and no liability surface.
The failure modes are not exotic. Prompt injection into an agent's context window converts a trading mandate into a drain. An agent with machine-speed execution and a hallucinated risk parameter does not merely lose its own capital; it moves the book. And with no attribution layer, post-incident forensics stall at the wallet.
I have watched this sequence before. In 2022, through the liquidity drain that followed Terra and FTX, I tracked stablecoin outflows from centralized exchanges on-chain — transaction volumes, reserve discrepancies, the exit velocity of the marginal depositor. The reporting that mattered cited specific hashes and specific reserve changes. Everything else was noise dressed as analysis. The first AI safety incident crypto traders actually feel will be an agent with a private key and a broken assumption. What follows is a regulatory response, then a mandate for attestation, then a market for that attestation. That sequence is the tradeable part.
Regulatory impact deserves its own section, per the format I have used since the spot Bitcoin ETF filings landed. Note what financial regulators already have, because it is the closest enforceable analogue to AI safety on the books. Algorithmic trading rules in Europe require pre-trade risk controls, kill switches, annual self-assessment, and detailed recordkeeping. United States market-access rules require pre-trade credit and capital thresholds with hard blocks. Neither framework asks whether a model is aligned. Both ask whether a system can be stopped, tested, and reconstructed after the fact. That is a measurement regime, and it exists.
The lesson for anyone watching the AI governance debate is that the enforceable precedent is not a treaty. It is a kill switch plus a record. Every frontier lab already has the first. Almost none publish the second.
Against that backdrop, the Coxon departure reads differently. The consensus interpretation is geopolitical: a safety researcher breaking ranks to say the United States cannot secure frontier models alone. That reading is not wrong, but it misidentifies the bottleneck. Political will is not what is missing. Measurement is. Two governments can agree on a principle in an afternoon. Neither can verify compliance in an afternoon, because neither side holds a shared object to measure — no published weights, no standardized harness, no attestation standard, no common incident taxonomy.
The second counterpoint concerns the signal itself. Personnel departures are lagging indicators. Hiring is leading. What would actually move my assessment is not another resignation statement; it is a change in what these labs publish and recruit for. Postings for evaluation engineering, interpretability, and trust-and-safety infrastructure tell you what a lab is building. Departure announcements tell you what a lab is willing to have said about it.
The third point is aimed at readers who hold this sector, and it is the one that costs money. Attestation is telemetry, not safety. Proving that some model ran inside some enclave on some hardware tells you nothing about whether the outputs are aligned, robust, or non-catastrophic. The verifiable-AI sector is selling measurement infrastructure and letting the market hear safety infrastructure. That is the same category error as selling auditability as solvency — a mistake this industry made expensively and appears ready to repeat. Code is law only if the audit trail is unbroken, and an unbroken trail that records the wrong variable is still worthless.
What to watch, in sequence. Within days: whether Anthropic confirms the departure, the title held, and whether the China remarks represent the individual or the institution. If neither is clarified, treat the entire item as unverified. Within weeks: whether any Chinese lab, standards body, or ministry responds in kind, and whether the response is procedural or rhetorical. Within a quarter: whether any frontier lab publishes checkpoint hashes, grants third-party evaluation access, or ships a standard incident taxonomy — the three disclosures that would convert safety language into an auditable object. Within a year: whether agent wallet standards ship with attribution, rate limits, and revocation before the first nine-figure agent-driven incident forces them.
The deeper question is not whether China buys in. It is whether anyone is building the instrument that would let us know if they did. Code is law only if the audit trail is unbroken — and right now, on the most consequential systems in the economy, there is no trail at all. Ask which side of that sentence the people selling you safety infrastructure are actually paid for.