On the morning of October 1, I queried the registry. The entry should have been there. It was not.
I have spent two years treating attestations the way I once treated liquidity โ as physical evidence. An attestation is a signature. A signature is a claim. A claim without an artifact is a rumor. When the September 30 deadline for Anthropic's "provable inference" milestone elapsed, the company said nothing: no post, no commit, no signed artifact in any public registry I could reach. That is not a failure announcement. It is an absence announcement. And in forensic work, absence is the loudest data there is โ it tells you which variable was never isolated.
The headline writers had their story pre-loaded: "Anthropic misses its own safety deadline." I want to dismantle that framing before it calcifies into consensus. The interesting question is not whether a planning milestone slipped. The interesting question is why one primitive โ a machine proving that a specific computation ran on a specific set of weights โ keeps failing to ship across three industries for the same unspoken reason.
The reason is economics. I have watched this exact failure mode before, and I have the spreadsheet.
Context: what was actually promised
Precision is the only defense against narrative, so let me set the record.
Anthropic's Responsible Scaling Policy is the company's core brand asset โ the "we scale carefully" commitment that separates it from labs that scale faster. Its June 2025 Confidential Inference research explored running inference inside a hardware-isolated enclave. The stack underneath is real and vendor-verifiable: Trusted Platform Modules, Trusted Execution Environments, and the Model Context Protocol that shipped in November 2024 as a standard for wiring models to external tools. None of that is fiction. I have read the specs.
The proposed milestone โ "provable inference" โ is the claim that an output can be cryptographically attributed to a specific set of weights, with hardware-rooted proof that those weights were not swapped after training. It is a combination-level idea, not an architecture breakthrough. It borrows from two lineages: TEE attestation, which proves what code is running, and cryptographic proof systems, which prove what computation occurred.
This is the moment a blockchain analyst stops scrolling. Verifiable computation is crypto's oldest unsolved problem. zk-SNARKs, optimistic rollups with fraud proofs, zkEVMs โ every one is an attempt to answer the identical question Anthropic is now asking: how do you prove a computation happened without re-running it? Following the trail of outliers that others ignore, I noticed the two trails converge. The AI industry is arriving, late and loud, at a problem DeFi has bled over since 2017.
Methodology: where the artifact would live
Before I accept any claim about a missed deadline, I ask where the proof of the deadline would physically reside. Not in a press release. In a transparency log.
Certificate Transparency taught the industry how this works: every issued certificate lands in an append-only, publicly auditable log. If you want to prove you issued something, you append it. If you want to prove you did not, the absence is itself auditable. Model attestations have no such log. There is no append-only registry where a lab appends "we ran weights W and signed output Y." That vacuum is the actual finding โ larger than any single milestone.
So my method mirrors the one I used on the 0x protocol in 2017. I spent six weeks building a Python simulation to test relayer incentive structures, and I found a theoretical flaw in the fee distribution model that nobody had priced. I did not need the market to confirm it. The mechanism confirmed it. Here, the mechanism is an identity: no transparency log, no cross-cloud federation, no standard trust anchor. The absence of infrastructure is the evidence.
Core: the evidence chain
The most consequential structural error in the coverage is that "provable inference" conflates two problems with different difficulty classes.
Proving that output Y came from weights W is a signing problem. If the enclave holds a private key and signs every response, you get attribution. It is roughly solved, and it is cheap.
Proving that weights W were not tampered with after training โ that nobody quietly fine-tuned the model to drop a refusal, inject a backdoor, or swap a checkpoint โ is a supply-chain problem. It is far harder, because it requires a trust root the attacker cannot reach. If the attacker controls the hardware or the key, the entire proof chain collapses. The TEE is only as honest as the silicon vendor and the signing key, and neither of those is the model.
Conflating these two problems lets a planning milestone masquerade as a delivery failure, and lets a delivery failure masquerade as a solved problem. The algorithm does not lie, but it may omit โ and the omission here is a difficulty class.
The hardware floor is the next constraint, and it is lower than the marketing implies. Not every accelerator supports confidential computing. NVIDIA's H100 carries a confidential-computing mode; fleet-wide coverage is partial, and the overhead is not trivial. TEE inference taxes throughput and latency โ you pay per token to buy the proof. This is the same cost curve I isolated in 2020, when I pulled CRV emissions data and found advertised yields running roughly 18% above realized yields once slippage and emissions decay were priced in. The headline and the real number diverged because the cost was hidden in the mechanism, not the pitch.
Confidential inference has the same geometry. The advertised benefit โ "provable, private inference" โ omits the throughput tax and the coverage gap. You cannot attest on hardware that refuses to attest. A proof system with a hole in its hardware is a promise with a hole in its trust.
The agent-identity gap is the real story, and it is a public-key-infrastructure problem wearing a new name. The four missing elements were named plainly: hardware-rooted agent identity, measurable policy-as-code, portable attestation evidence, cross-cloud federation. Read those four again. That is a PKI specification. That is what certificate authorities, revocation lists, and trust anchors were invented to do, decades ago.
Agents today authenticate by API key and system prompt. That is not identity. That is a password taped to a terminal. The system treats "whoever holds the key" as "whoever the agent is." When the key leaks โ and keys leak โ the agent's identity leaks with it. Crypto learned this with private keys, expensively, and is still learning it. The AI industry is now repeating the curriculum from page one.
The cited vulnerability class proves the point: missing issuer validation in an MCP SDK's OAuth flow, hardcoded credentials, authentication bypass. These are the same bugs that drained wallets in 2021 and 2022. Different stack, identical failure mode โ identity inferred from a bearer token instead of proven by a signature.
The trust-through-defaults model is a systemic fragility, not an incident. If agent identity rests on API keys and system prompts, security is not a design property; it is a hope. "Security as an afterthought" is not a criticism of one vendor. It is a description of an entire deployment pattern. Agents ship faster than the identity framework that should constrain them โ the on-chain equivalent of launching a protocol before the oracle is live and assuming the price feed will behave.
I mapped 15,000 transactions once to prove an insolvency six months before it became public. The signal was never a single smoking gun. It was a structural gap โ an accounting identity that would not close. The agent-identity gap has the same texture. It is not one exploit. It is a missing equation, and every deployment writes a check against it.
Then there is the tension nobody wants to name: verifiability and confidentiality are not both maximizable. Full verifiability means the proof is public. Full confidentiality means the input and weights stay hidden. Prove everything and you leak the model's behavior to anyone holding the verifier. Hide everything and you cannot assign blame when the model misbehaves. This is a genuine tradeoff, not a backlog item, and the coverage treated it as merely delayed.
Here the geometry gets interesting โ the same geometry I spent years deciphering in liquidity pools, except the asset is trust instead of tokens. In a pool, price impact is a function of depth: thin pools move violently on small trades. Trust behaves identically. A trust pool with one verifier โ the vendor itself โ has no depth. Every claim moves the price of belief violently, because there is no independent liquidity to absorb it. Cross-cloud federation is an attempt to deepen that pool. Without it, attestation is a vendor marking its own homework, and the mark is always an A.
The economics are where this becomes actionable, and this is the part I care about most. Provable inference rides the same cost curve as ZK proving, and that curve is brutal. ZK rollup proving costs are absurdly high; unless gas returns to bull-market levels, operators bleed. TEE inference trades a different cost โ hardware overhead instead of proof generation โ but the vector points the same way: verification is expensive, and someone must pay.
Who pays? Under a compliance regime, the customer, as a line item. Under a research regime, the lab, out of a safety budget that competes directly with compute. In a bull market, nobody notices the tax because headline returns absorb it. In a bear market, the tax becomes the headline. I watched this exact dynamic in 2024, when I modeled BlackRock's IBIT daily flows and found that high-inflow days often preceded short-term corrections, as institutional arbitrageurs took profit into strength. The pattern was invisible to anyone reading price alone. It was visible only to anyone reading the mechanism.
Verifiable inference has a mechanism problem; the mechanism problem is a cost problem; and the cost problem is invisible while money is cheap. That is the entire bull-market distortion in one sentence.
And it will not stay invisible. If verifiable inference ships, it turns model outputs into programmable trust primitives โ the same leap that made DEX hooks interesting, and the same trap. Complexity spikes, and complexity scares off the majority of developers who might have built on it. A primitive that only ten teams can safely use is not infrastructure. It is a demo.
Contrarian: correlation is not causation, and the source is not a source
Now the part that will annoy people.
The narrative "Anthropic missed a safety deadline" is a correlation dressed as causation. A date passed; a company stayed quiet; the conclusion "safety commitment failed" was pre-written. But a planning milestone โ inventorying components, costs, and timelines โ is not a functional deliverable. Missing it is not the same as missing a product launch, and the coverage flattened the difference because the flat version travels further.
Worse, the source material itself fails my evidentiary standard. It anchors every factual claim to 2026 dates I cannot verify, cites CVE identifiers with a 2026 prefix I cannot corroborate, and describes a regulatory action and a breach event that, if real, would be among the largest AI-industry stories of the decade โ yet produced no independent first-party reporting I can find. That is the signature of content-farm synthesis: real technical anchors, fabricated extensions. I have seen this pattern before, and I treat it the way I treat wash-traded floor prices โ by filtering wallet pairs with overlapping histories until the real depth shows. Here, the real depth is thin.
So I hold the events at arm's length and keep the structural claims. The algorithm does not lie, but it may omit โ and the biggest omission is that the most interesting fact is not the deadline at all. It is that no transparency log exists to record whether the deadline was met.
Takeaway: the signal to watch next
Watch three things, none of them a press release: whether an independent, first-party source ever confirms the regulatory action โ if none appears within a quarter, treat the events as fabricated and the structure as instructive; whether any append-only attestation registry appears for model outputs, since its existence would matter more than any single milestone; and whether cross-cloud attestation standards move inside a standards body or a cloud consortium, because whoever owns the trust root for agent identity owns the next decade of AI compliance.
The deadline passed in silence. The question worth asking is quieter and harder: when the proof finally arrives, who will be holding the pen that signs it โ and will anyone independent be able to check the signature?