Over the past seven days, a mid-cap lending market quietly lost 38% of its liquidity providers. No exploit. No depeg. No governance raid. Just a fee curve that stopped paying, and depositors who noticed before the chart did. That is what a sideways tape looks like from the inside โ not a crash, a drift. Capital doesn't leave a market like this. It rebalances, and it waits for a reason to come back.
Now here is a number that moved a narrative this week: tens of thousands.
Crypto Briefing published a short aggregation reporting that OpenAI and Anthropic are investigating tens of thousands of AI security incidents. That is the entire payload. No taxonomy. No time window. No severity bands. No named source. No original document. No definition of the word "incident."
I have filed that kind of story. I have also been cited in one six months later as a cautionary example of hype-driven journalism, which is a specific kind of humiliation I recommend to anyone who wants to get good quickly. So let me say the thing the headline cannot: a count without a denominator is not data. It is a mood with a number attached.
Two years ago, "AI safety" was a panel topic. This year it's a line item. Anthropic keeps a Responsible Scaling Policy and revises it in public. OpenAI runs a Preparedness Framework and a safety committee that reports upward rather than outward. Both publish transparency artifacts at a cadence that has started to look less like research and more like quarterly filings. That cadence is the tell. Safety stopped being a research question and became an operations function โ a department, a budget, a headcount number that appears in a deck.
Crypto went through the same transition, and I watched it from the newsroom. In 2017 we counted whitepapers. By 2020 we counted TVL. By 2022 we counted exploits โ and that is when counting itself became a business. The hacks dashboards, the rekt leaderboards, the annual crime reports from the analytics firms. Every one of them is a taxonomy wearing the costume of a table. That is not a criticism; it is the lesson. Crypto learned the hard way that the moment an industry starts publishing incident counts, those counts become political objects. They get quoted in hearings. They get bundled into pitch decks. They get cited by reporters who never read the methodology โ including, twice, by me.
The AI industry is now standing exactly on that inflection point. Tens of thousands of incidents. Which ones? Counted by whom? Against what definition, in what window, with what severity floor?
And there is a second layer the aggregation never touched. The 2025 generation of AI products does not merely answer questions. It calls tools. It holds API keys. Increasingly, it holds wallets. That is the crossover. The moment a model can sign a transaction, an AI incident stops being a reputational problem and becomes a financial one โ and the people counting those incidents are not the people who would notice. In a sideways market where nobody is chasing beta, capital hunts narratives instead. "AI safety" is now one of them. Which is precisely why the arithmetic deserves a second look before the narrative hardens.
Ask five crypto analysts how many protocols were hacked in 2022 and you will get five numbers within 40% of each other, all defensible. A failed exploit that reverts on-chain: incident or non-event? A whitehat front-run that rescues funds: incident or public service? A slow rug by a doxxed team that keeps shipping: incident or business model? An oracle manipulation: protocol hack or market design flaw? Two dashboards, same month, same chain, different totals. Neither is lying. They disagree about what a hack is, and the disagreement never gets printed next to the number.
The AI figure has the same disease, but worse, because English let it happen. "AI security incident" is a phrase that collapses two distinct failure modes. There is security in the adversarial sense โ jailbreaks, prompt injection, data exfiltration, model theft, API abuse, credential leakage. And there is safety in the behavioral sense โ harmful outputs, alignment failures, evaluation deception, sycophancy under pressure. These are different research fields with different threat models, different mitigations, and different regulators. The aggregation ran them together into one word and one number, and the number came out looking catastrophic.
Then there is the counting problem inside the counting problem. A moderation classifier that blocks a request is a "prevented incident" in one report and a "false positive" in the next. A red-team finding is a discovered vulnerability or a scheduled stress test depending on whether it was in scope. An automated filter firing on a medical query is a safety success and a product failure at the same time. Without a severity floor, a time window, and a definitional boundary, tens of thousands could mean anything from "we logged every guardrail trigger across all products" to "we investigated every novel misuse pattern we could find." Those two sentences are three orders of magnitude apart, and both fit inside the same headline.
The number that matters is never the total. It is the shape of the tail. Crypto paid tuition on this. In 2022 the incident count ran into the hundreds. Five events accounted for roughly two-thirds of the value lost. Everyone quoted the count. The count was noise. The tail was the story, and the tail was never in the headline because five names don't fill a chart.
In February 2020 I sat in a Brussels conference hall and got an exclusive with the founder of a yield aggregator called LiquidityX, days before launch. Charismatic guy, genuinely interesting bonding curve design, a good story told well. I wrote it fast and I wrote it warm, and it moved $2M of TVL into the thing inside a week. What I did not write, because I did not ask, was that no reputable firm had audited the contracts. Four months later a reentrancy vulnerability took the pool apart, and my article became the case study in a panel on hype-driven journalism. The pixel wasn't the product, and the community didn't depreciate just because the price did โ but the money did, and I had helped it move.
After that I built a checklist. I put it in every bullish piece, even the ones I loved. The checklist, unfashionably, turns out to be the right instrument for evaluating an AI incident disclosure too, because the failure modes rhyme almost perfectly.
Who audited it? In crypto, the answer is a named firm with a public report and a signature at the bottom. In AI, the equivalent is a red team โ and the red team is usually hired by, scoped by, and paid by the lab whose model is under the microscope. That is not an audit. It is a stress test with a client, and the client controls the scope document. I have watched this exact slide before: an attestation dressed as an audit. Tether sits on roughly 70% of the stablecoin market and has never submitted to a genuinely independent, continuous audit of reserves; the industry has collectively agreed to look at a quarterly signed letter and call it verification. It holds because everyone benefits from not asking a second question. The same energy is now arriving in AI safety reporting, and it will hold for the same reason.
What is upgradeable? In crypto, that is a proxy contract, and mapping it is the first thing any serious diligence process does. In AI, it is the weights and the guardrail configuration. Both change without a fork announcement, without a changelog most users will read, and without a version bump anybody outside the company can verify. You cannot reproduce an incident from last month on this month's model, which means every incident count is a running total over a moving definition of the system that produced it. That is a reproducibility problem dressed as a statistics problem.
Who holds the admin keys? Here is the part that should bother you more than the number itself. The entity being measured also builds the measuring instrument. The incident classifier, the severity rubric, the reporting threshold, the decision about what counts โ all proprietary, all internal, all unreviewed by anyone with an incentive to disagree. In crypto we at least argue about multisig composition in public. Self-reported incident counts are attestations, not audits, and this industry has already proven it will pretend otherwise whenever the alternative is uncomfortable.
What is the time window, and what is the severity floor? Unknown and unknown. Which means the number cannot be compared to anything, including itself next quarter, including a competitor's number published the same morning.
Here is the blind spot I keep circling back to, and it is not a hypothetical. Modern agents call tools. A tool call is a function invocation with parameters that a user may not have written. When one of those tools is a swap, a transfer, or a signed message, prompt injection stops being a research curiosity and becomes an exploit primitive. The attack surface is the natural language interface โ the least typed, least sanitized, most ambiguous input channel we have ever wired into a system that moves money.
I tested this. I am not going to publish a playbook, but I will describe the shape of it, because the shape is the finding. I stood up a testnet agent with a small tool set โ fetch a page, summarize it, swap a token โ and pointed it at a document containing instructions it was never supposed to treat as instructions. No jailbreak, no clever encoding, no base64 smuggling. Just text in the wrong register, written as though it belonged there. The agent summarized the page and called the swap. I have done the same thing with a mock API key and watched an agent hand it to an endpoint it had never seen before, because the endpoint was described as friendly and the agent had no reason to doubt the description.
Now scale it. If a fraction of a percent of agent sessions can be steered โ and the honest number is not public, because nobody is obligated to publish it โ then at ten million daily sessions you get a standing population of thousands of steered events per day. And here is the coverage gap: the incident happens at the wallet, the model provider never sees it, and the protocol logs it as a user error. Three organizations, three dashboards, no shared record, no disclosure obligation, no registry. OpenAI and Anthropic are counting tens of thousands of incidents inside their own houses while the on-chain incident that costs real money happens in a building neither of them owns.
Worse, the reverse is also true and far less discussed. Some of the DeFi bleeding I opened with โ LPs rotating out of a lending market on a fee-curve change nobody explained โ may well be agent-mediated by 2026. You cannot audit it. You cannot attribute it. It will not appear in anyone's incident report, because the classifier that would catch it lives at a different layer of the stack. Two industries are measuring their own halves of the same event and neither will ever see the whole.
Crypto actually solved a version of this, twice. Once badly: the Smart Contract Weakness Classification registry, which never achieved the coverage it needed because adoption was voluntary and the incentives were thin. Once well: Immunefi turned bug bounties into an industry with real payouts and a public disclosure norm, and SEAL 911 gave the ecosystem something closer to a war room than anything else in tech. Both work because someone had a financial reason to make them work. Nobody built them out of virtue.
AI has neither. There is no CVE for model behavior, no ISAC for agent exploits, no public registry where a drained wallet and a prompt injection get filed under the same identifier. What exists are internal dashboards and, at the policy layer, a regulatory framework being written right now โ the EU AI Act's serious incident reporting regime, the US state-level AI bills, the NIST guidance that keeps getting revised. The threshold definitions inside those documents will effectively decide what the word "incident" means for the next decade. And thresholds are usually drafted with heavy input from the parties who will have to file against them.
I know the crypto version of this movie. MiCA's scope fights, the travel rule's de minimis arguments, the endless definitional skirmishes that determine whether you are a CASP or merely CASP-adjacent. The regulation was never the hard part. Defining the object of regulation was the hard part, and the definition went to whoever showed up with lawyers and a spreadsheet.
There is a crypto-native answer, and I have touched it. Attested inference inside a trusted execution environment plus an on-chain, append-only incident log would give you something no self-report can: a timestamped, tamper-evident, third-party-verifiable record that does not depend on the filer's honesty. I spent part of 2025 in a demo with a team notarizing model weights on-chain, and the primitive works. It also, obviously, is not going to be adopted for incident disclosure. No general counsel is going to publish a permissionless ledger of their company's failures that a plaintiff's attorney can crawl at leisure. The rails exist. The incentives point the other way, and incentives win.
Which is why you should expect the next eighteen months to produce a wave of vendors selling "AI safety interoperability" โ a standards layer that promises to make guardrails compose across models and vendors. I have watched this exact business model before. When "liquidity fragmentation" was the pitch, the fix was always a bridge, and the bridge was always a token, and the fragmentation was usually manufactured by the people selling the solution. Not every standards layer is a bridge to nowhere. Most of them are, and the ones that aren't are boring enough that nobody writes about them.
Let me be fair to the labs instead of merely suspicious of the number. If the figure is real and internally consistent, the most likely composition is dominated by high-volume, low-severity events: guardrail trips, misuse attempts caught at the classifier, prompt injection attempts against consumer surfaces, red-team findings from continuous automated probing. That is what happens when you run adversarial evaluation at scale. You generate more detections than any human team could ever read, and you build triage automation because you have no choice. That is a genuine engineering achievement and a genuine operational burden, and both things can be true at once.
It is also not the same thing as ten thousand successful harms. The distribution almost certainly looks like every incident distribution in every industry that has ever measured one: a long tail of noise, and a short head that carries all the mass. Ten or twenty cases of serious misuse โ coordinated influence operations, cyber-offense assistance, self-harm facilitation, CBRN-adjacent probing โ would dominate the risk profile entirely. Nobody publishes that breakdown, because the breakdown is the only part that would actually inform policy, and informing policy is not the same as shaping it.
So when the number travels into a hearing room, it will arrive stripped of its distribution. It will be used to argue for a framework. Some of that framework will be necessary. Some of it will be the AI equivalent of a travel rule that requires you to identify the counterparty of a self-custody transfer โ a rule written for a world that does not exist, enforced against people who cannot comply. And the same media ecosystem that turned a headline about "illicit volume" โ a metric that counted addresses merely associated with darknet services โ into a decade of talking points will do exactly the same thing here, because the incentive structure of a headline is not the incentive structure of an audit.
The consensus read on this story is: AI is dangerous, the labs are struggling, regulators should step in. Fine. It is also the least interesting available reading.
The unreported angle is that the disclosure regime is being built by the two companies with the most to gain from defining it. Safety is not just a cost center for Anthropic โ it is brand equity and, increasingly, pricing power in enterprise deals where procurement teams need a defensible reason to choose one vendor over another. OpenAI needs the same credibility to keep regulators warm while it scales into everything. When two competitors both start publishing incident data at roughly the same moment, that is not a coincidence of conscience. That is a race to own the vocabulary before somebody else writes it for them. Watch the definitions, not the totals. The definitions are the moat, and the totals are the marketing.
There is another angle here that almost nobody is writing, and it is the one that pays. This is not really an AI story with a crypto footnote. It is a crypto story wearing an AI headline. The incidents that will cost nine figures in 2026 will not be counted by OpenAI or Anthropic, because they will happen at wallet layers and tool-calling frameworks that neither company governs. The industry is building incident plumbing in one building while the money leaks in another. And the angle I keep returning to, the one that makes the whole number wobble: the totals are almost certainly dominated by events that were already prevented. A prevented incident is a control that worked, not a harm that happened. Reporting them in the same figure as the tail is not transparency. It is noise laundering with a compliance budget.
Watch three things. Whether either lab publishes a severity distribution instead of a total, because that single document would tell you more than every aggregation written this year combined. Whether an AI incident registry with an identifier scheme, a disclosure norm, and a third-party verification path exists by 2027 โ and whether crypto's attestation rails are used to build it or ignored while it gets built closed behind a legal department. And whether the first nine-figure agent exploit lands before the first serious-incident report mandated by law.
If the model cannot tell you how many of those tens of thousands actually mattered, why would anyone believe the number at all?