Hook
The item crossed my desk on a Tuesday, filed between a token unlock schedule and a spot ETF flow table. Crypto Briefing — a venue that normally tracks exchange outflows and governance votes — was carrying a story about OpenAI and Anthropic investigating tens of thousands of AI security incidents. I read it three times, and not for the reason the headline wanted. The number was the least interesting thing in it. What held me was the venue. Value flows where attention decides to rest, and attention had just moved. A crypto outlet carrying an AI safety item is not an editorial coincidence; it is a tell. Two industries have arrived at the same structural problem from opposite directions, and neither has admitted it: both now generate more failure events than any human institution can read, and only one of them has built the apparatus to prove it.
Context
For three years, frontier AI labs have governed themselves through published frameworks — Anthropic's Responsible Scaling Policy, OpenAI's Preparedness Framework. Those documents are written in the conditional tense. They describe what a lab would do if a model crossed a capability threshold. What they do not describe is what a lab does with the residue: the adversarial prompts, jailbreak attempts, policy violations and anomalous outputs that accumulate every day.
Software has an answer for residue. In 1999 the CVE system gave the industry a shared identifier, a severity score, and a public database, and an entire security tooling market grew on top of it. Crypto has a different answer to the same problem: every transaction is a signed, timestamped, replayable artifact, and every protocol failure — from The DAO to Terra — leaves an on-chain corpse anyone can exhume years later. The AI industry has neither. It has press coverage.
That is the actual news. Not that incidents number in the tens of thousands, but that the only place that number exists is a sentence in a wire story.
Regulators are circling the same gap. The EU AI Act's high-risk provisions contemplate reporting duties; several US state bills propose mandatory incident disclosure. Every one of those texts is waiting for a definition of what an incident is. The lab that defines the schema first will effectively write the reporting standard everyone else is measured against — a quiet form of standard-setting that outlasts any single model release.
Core
I want to be precise about what is and is not established. The figure "tens of thousands" arrived without a definition of the counting unit. Depending on the schema, it could mean automated moderation classifier triggers — mostly noise, the equivalent of a firewall dropping port scans. Or it could mean successful attempts to extract harmful capability, exfiltrate training data, or route a model into agentic misuse. The distance between those readings is several orders of magnitude, and when I went looking for the definition, there was none. The number is not a measurement. It is an unfalsifiable claim wearing the costume of one, and unfalsifiable claims anchor a conversation to a magnitude nobody can verify.
A second ambiguity has gone unremarked. The English word "security" is doing double duty. Adversarially, security means someone is attacking the system — prompt injection, jailbreaks, data extraction, model theft. In the alignment sense, safety means the model harms on its own, with no attacker in the loop. Different disciplines, different teams, different remediation paths. Collapsing them into one phrase inside one wire story means a reader cannot tell whether the labs are fighting an adversary or auditing their own model. That distinction is not pedantry. It decides whether the correct response is better firewalls or better training, and the cost of choosing wrong is measured in years.
What I can read from the wire is the verb. The story says the labs are investigating these incidents, not blocking them. Investigate is retrospective. It implies a queue, a triage backlog, an analyst opening a case file weeks after the fact. I have seen this pattern. In 2017 I spent three months inside the crowdsale contracts of a then-obscure project, Iconic Protocol. What saved them was not a live monitor — it was a late-night line-by-line read of withdrawal logic, where a reentrancy path sat quietly in the code. Every bug is a story the system tried to hide. Detection came from reading, not from running, and reading is the difference between an audit and a guardrail. The wire describes the first; the market will hear the second.
If events require triage rather than individual human review, the labs have quietly built automation: input classifiers, output guardrails, red-team loops, severity-ranking systems. That architecture resembles a blockchain's mempool policy engine, and it fails the same way. The policy is only as good as the classifier, and the classifier is only as good as the adversarial distribution it was trained on.
A usable ledger needs four columns, and none of them are currently published. Classification: what type of event occurred. Severity: a distribution, not a total, because one CBRN-adjacent success outweighs ten thousand dropped jailbreaks. Attribution: was the cause a user, the model, or the guardrail itself. Closure: how many events were remediated, how many recurred, how many caused external harm. Without those four columns the total is a vanity metric. With them it becomes an instrument — the thing that lets a security team price risk instead of gesturing at it.
Here the crypto parallel stops being decorative. I have spent a decade arguing that oracle feed latency is DeFi's structural heel, and that a network marketing decentralization while running a handful of curated nodes is telling a story rather than describing an architecture. Security is a silent promise kept between nodes. AI incident governance is the same promise with fewer nodes and no signature. Every claim is self-reported by the party under examination, in a format that party defines, on a cadence that party chooses. There is no independent attestation, no shared severity score, no public database a stranger could audit. In crypto we would call that a trusted setup with a centralized admin key. In AI it is called a transparency report.
Risk behaves the same way. If a guardrail becomes a mandatory pre-component in every inference call, its cost does not disappear — it becomes a line item that travels down to every downstream builder. Last year I helped a Boston AI team design tokenomics for a decentralized data verification network. The design that survived was the boring one: no reward flowed without a human auditor's signature, with 30% of emissions reserved for that role. The lesson was not that humans outperform models. It was that attestation has to live somewhere, and if you do not fund it explicitly, it gets funded implicitly by silent failure.
Contrarian
The consensus reading is that tens of thousands of incidents is a warning: frontier AI is leaking. I think that reading is backwards, and the reflex to accept it is the real risk.
A system that can produce a structured ledger of its own failures is more mature than one that cannot, even when the ledger is enormous. In 2021, working through the Art Blocks ecosystem and interviewing fifty early collectors, the finding that mattered was not which pieces were rare. It was that provenance stories, not rarity traits, drove secondary liquidity. The image is not the asset; the belief is. Apply that to incident counts and the danger becomes plain. In a bull market, disclosure volume becomes a trust asset, which incentivizes labs to publish incident counts rather than incident severity. Goodhart's law has arrived in AI safety wearing a compliance badge. A lab reporting more incidents looks transparent. A lab reporting fewer looks either sloppy or hidden. Neither reading tells you which system is safer — only whose communications team is stronger.
Attribution compounds this. We do not know whether these events originate from malicious users, from model behaviour, or from faults inside the safety systems themselves. Anyone who has run a detector at scale knows false positives often outnumber true positives, and an over-aggressive filter generates its own statistics. A meaningful share of "tens of thousands" may be the sound of an alarm being tested, not a wall being breached.
Takeaway
Within eighteen months, autonomous agents will hold keys, sign transactions, and settle value on-chain. When that happens, the question stops being how many incidents a lab counted. It becomes: who signs the log, and can a stranger verify it? Trace the static in the protocol's genesis block, and ask which party is permitted to write the first entry. The labs have handed us the ledger. They have not yet handed us the auditor.