On October 9, OpenAI and Anthropic executives sat down to rehearse a catastrophe they privately believe is coming. The scenario was not a chatbot misfiring, not a model hallucinating a legal brief, not a deepfake scandal. The scenario was an AI-driven cyberattack that cascades through financial services, internet connectivity, power grids, and water systems โ and the internal conclusion was that leadership expects the first major incident to arrive exactly there, at the level of critical infrastructure, not product failure.
Here is the number that should stop you. Not a price. A posture. Two of the most aggressive capability-deployers on earth โ one branded "safety-first," one long accused of accelerating past caution โ converged on the same internal estimate: a serious incident is difficult to avoid. They did not say "unlikely." They did not say "manageable." They said they are preparing for the aftermath, and they are rehearsing it on a calendar.
I have spent the last decade auditing systems that everyone assumed were safe until the block confirmed they were not. The Ethereum 2.0 beacon chain, in late 2017, carried a consensus delay bug inside the Geth client that I flagged to core developers before mainnet. Uniswap V2 pairs, in 2020, had slippage thresholds I stress-tested across 10,000 simulations 48 hours before a flash crash. Celsius, in 2022, ran a 15% discrepancy between on-chain reserves and reported liabilities that I published under a single stark headline before the freeze. In every case, the warning was available. In every case, the crowd priced it at zero until the moment it priced it at everything.
The algorithm priced the ape before the crowd did. It will price the AI incident the same way โ and the infrastructure that pays the bill first will be on-chain, because that is where capital settles fastest and where nobody is holding a circuit breaker.
Why This Landed Now
The signal is not that AI companies worry about safety. They have always worried, publicly, in carefully worded blog posts that doubled as marketing. The signal is that they have moved from talking about risk to rehearsing its consequences. That is a different category of behavior. It is the difference between a bank publishing a risk whitepaper and a bank running a liquidity stress test with the actual treasury team in the room.
Understand the mechanics of what a disaster drill actually is. It is a low-probability, high-impact risk management instrument. Financial institutions adopted them because regulators forced the issue after 2008 โ the assumption being that if you cannot simulate the tail, you cannot survive it. When a technology firm voluntarily imports this instrument, the import itself is the disclosure. You do not rehearse the apocalypse unless your internal estimate of its probability has crossed a threshold you are unwilling to state in public.
And the threat model is specific. Executives expect the most likely form to be a cyberattack, rippling into financial services, internet, power, and water. That is not a product-failure model. That is a critical-infrastructure cascade model, the same class of modeling that sits behind national security planning. The moment you model cascading failure across utilities, you have stopped describing a software bug and started describing a geopolitical event.
The article names Dario Amodei, Sam Altman, and a political figure as potential targets of accountability. Read that carefully. When the internal framing of an incident shifts from "technical event" to "political event," the organization has already accepted that the consequence will be adjudicated in public, not in a changelog. That is the pivot point.
Then there is the defensive language. A spokesperson emphasized that the scenarios are "not viewed as inevitable." That is a legal and public-relations hedge wearing a lab coat. It pre-loads the narrative for the worst case while refusing to admit the model is dangerous. I have written the same kind of sentence in audit reports. You learn to write "the probability of failure is non-trivial" when you cannot legally write "this will fail."
Now connect it to the rails. The systems that an AI-driven cyberattack would target first are not abstract. They are the settlement layer. Financial services means exchanges, custodians, payment processors, stablecoin issuers. Internet connectivity means RPC nodes, oracle feeds, DNS, cloud regions. Power means data centers. Water means the physical dependency chain that keeps those data centers cool. Every one of those layers has a crypto analogue, and most of them have a crypto dependency.
Liquidity didn't leave the system in 2022. It changed addresses. The same is true of systemic risk. It did not disappear when the AI narrative took over the market. It relocated into the infrastructure that AI and crypto now share.
The Cascade Model Nobody Is Pricing
Let me build the threat model the way I build every stress test: structure first, then data, then the verdict.
The structure of a cascading AI attack is a dependency graph. Node one is the intrusion vector โ automated vulnerability discovery, social engineering at scale, or supply-chain compromise. Node two is lateral movement through shared identity and cloud infrastructure. Node three is the target class: financial rails, grid control, communications. Node four is the cascade: when financial rails stall, margin calls cannot settle; when grid control is disrupted, data centers fail over or go dark; when connectivity drops, oracle feeds go stale and automated liquidations fire on bad prices.
That fourth node is where crypto gets destroyed. Not by the attack itself, but by the automated response to it. Every DeFi protocol is a machine that executes on inputs. If the inputs go stale or manipulated during a broader outage, the machine does not pause and ask for guidance. It liquidates. It rebalances. It cascades.
I ran this logic in 2020 on Uniswap V2. The lesson from that stress test was not that a single pair could break. It was that price impact thresholds cluster โ many pairs hit dangerous slippage at the same time, because they share the same arbitrage bots, the same liquidity providers, the same collateral assumptions. A systemic shock does not move one pool. It moves the correlation structure between all of them simultaneously.
Apply the same lens to an AI-triggered infrastructure event. The correlated exposure is not in any single protocol. It is in the shared dependencies:
- Oracle latency. If connectivity degrades, price feeds lag. Lending protocols liquidate on stale prices. In March 2020, this mechanism alone liquidated over $8M in MakerDAO collateral at zero bids.
- Bridge finality. Cross-chain bridges assume both sides are online. During an outage, in-flight transfers hang, and wrapped assets de-peg from their backing.
- Stablecoin redemption. If banking rails are part of the cascade โ and they are, because reserves sit in banks โ redemption queues form. A stablecoin is only as liquid as the bank behind it, and the bank is a node in the same graph.
- Exchange solvency. Centralized exchanges are fractional-reserve businesses by design. A connectivity event that freezes withdrawals converts a liquidity problem into a solvency headline in under 72 hours. I watched this exact sequence at Celsius.
The confidence here is not uniform. I would rate the direction of this exposure as high-confidence โ the dependency graph is real and observable. I would rate the magnitude as medium-confidence, because the article describes a scenario, not an event, and I have no data on the time window. A six-month window and a five-year window produce completely different urgency. The absence of that window in the reporting is itself a data gap worth flagging.
Structure is not a cage; it is a launchpad. The dependency graph that makes the cascade possible is the same graph that tells you exactly where to build the defenses. That is the part the market ignores.
The Regulatory Clock Just Started Ticking
Here is the connection most crypto readers will miss. The same week this drill was reported, the European regulatory framework under MiCA was entering its compliance phase for stablecoin issuers and crypto-asset service providers. The two stories are not parallel. They are the same story.
MiCA's stablecoin reserve requirements demand that issuers hold assets that are liquid, secure, and segregated โ precisely the properties that fail during a critical-infrastructure cascade. The framework assumes a functioning banking system as the backstop for reserve liquidity. It does not model what happens when the banking system is one of the nodes under attack. That is a structural blind spot, and it is not a small one.
On the CASP side, compliance costs are already brutal. Licensing, capital requirements, audit trails, governance โ every one of those line items scales with the complexity of the threat model. A small exchange operating in Europe now faces a compliance bill that assumes it can afford the same governance infrastructure as a top-tier firm. It cannot. The result is predictable: consolidation into a handful of licensed entities, and a long tail of projects that either exit the jurisdiction or operate in a gray zone.
Now layer the AI incident expectation on top. If a major AI-driven attack occurs, the regulatory response will not be surgical. It will be a pendulum swing โ the same pattern the article flags with its reference to a political figure who resists AI regulation. Today the political weather is deregulatory. Tomorrow, after an incident, it flips. Crypto has lived through this exact cycle: the 2022 collapses produced a wave of enforcement that took three years and multiple jurisdictions to even partially clarify.
The hidden cost here is what I would call the compliance cliff. Stablecoin issuers and CASPs do not fail gradually under regulatory pressure. They fail at a threshold โ the moment the cost of compliance exceeds the margin on the business. MiCA sets that threshold higher than most small projects can clear. An AI incident that triggers emergency rulemaking sets it higher still. The projects that survive will be the ones with the balance sheet to absorb a regulatory regime change mid-flight.
And note who is absent from the accountability list: the infrastructure operators. The drill names AI leaders as targets. It does not name the exchanges, the stablecoin issuers, the bridge operators whose systems would transmit the damage. That asymmetry matters, because it means the first regulatory reflex will be aimed at the visible AI layer, while the transmission layer โ the on-chain rails โ absorbs the operational damage without the political cover.
I flagged a version of this in my Celsius work. The failure was not in the headline asset. It was in the reconciliation between reported and actual reserves โ a governance gap that nobody watched until it was too late. The AI drill is producing the same kind of governance gap, one layer up. Everyone is watching the model. Nobody is watching the plumbing.
The Insurance Market Is the Tell
If you want a single instrument to watch for the real price of this risk, it is not any AI company's valuation. It is the AI liability insurance market โ a market the reporting completely ignores, and a market I have been tracking as an analyst since the first cyber-insurance products for crypto custodians appeared.
Here is the mechanism. Disaster drills and cyberattack expectations create demand for AI liability coverage. Insurers and reinsurers must then price a risk they have never modeled: correlated, cascading, and potentially systemic. When an insurer cannot price a tail, it does one of three things โ it declines to write the policy, it writes it at a punitive premium, or it writes it with exclusions so broad the policy is worthless. All three outcomes raise the cost of doing business for AI companies, and all three transmit directly into the cost of the infrastructure those companies touch.
Watch the reinsurance layer specifically. Reinsurers are the ones who absorb the tail. When reinsurers reprice systemic risk โ as they did after major natural catastrophes and after 2008 โ the cost propagates backward through every primary insurer and forward into every corporate buyer. If AI cascade risk gets classified alongside pandemic or cyber-war risk, the premium shock will be measured in multiples, not percentages.
For crypto, the implication is direct. Custodians, exchanges, and stablecoin issuers already buy cyber and crime insurance. If the underwriting community starts treating AI-driven infrastructure attacks as a correlated systemic peril, those policies get repriced or restricted. A custodian whose insurance lapses is a custodian whose institutional clients leave. That is a solvency event dressed as a procurement decision.
Value is a consensus, not a contract. The market has decided that AI risk is not priceable. The insurance market will eventually disagree, and when it does, the disagreement will be the most honest number in the room.
The Contradiction They Refused to Name
The most important thing about this reporting is what it omits. Nowhere in the framing is the question: if leadership expects a major incident is difficult to avoid, why continue accelerating deployment?
That question is not rhetorical. It is the entire governance problem, and the drill's existence makes it unavoidable. You cannot simultaneously hold the position that catastrophe is likely and the position that you should deploy faster, without explaining the reconciliation. The reporting does not force that reconciliation, and the companies have no incentive to volunteer it. That silence is the real story.
I have a framework for reading this kind of disclosure, borrowed from audit practice. When a company conducts a stress test but publishes only the fact of the test and not the results, you assume the results were bad. When a company rehearses a disaster but declines to specify the trigger conditions, you assume the triggers are already present. The drill is not reassurance. It is a confession wearing the costume of preparedness.
There is a second layer that reads as strategic. The disclosure itself โ the fact that this internal exercise reached a reporter โ performs three functions simultaneously. It builds the image of the responsible industry leader. It signals to regulators that self-governance is already underway and external mandates are unnecessary. And it pre-loads a buffer: if an incident occurs, the company can point back and say it warned, it rehearsed, it prepared. I cannot confirm intent. I can confirm that all three effects are real and beneficial to the discloser.
And the accountability list tells you how the industry sees itself. Naming Amodei and Altman as potential targets means that, in the public and political imagination, individual AI leaders have become the industry's representatives. That is both a risk โ personal reputation is now collateral โ and a power, because whoever controls the "responsible AI" narrative controls the shape of the eventual regulation. The drill is risk management, yes. It is also a land-grab on the standard-setting process.
Liquidity didn't protect anyone who mistook a rehearsal for a guarantee. The drill does not reduce the risk. It documents that the risk was known.
What to Watch, and How to Verify It
Strip the narrative and you are left with a checklist. This is how I structure every forward call, because a signal you cannot verify is a rumor, and rumors do not survive contact with a block explorer.
Verify the disclosure, not the framing. Watch for the specific details of the exercise: scenario count, participants, and โ most importantly โ the trigger conditions. If those never surface, the drill was public relations. If they surface with technical specificity, it was real risk management. The distinction is everything.
Watch the insurance filings. Quarterly disclosures from major insurers and reinsurers will eventually reveal how AI cascade risk is being priced. That number will be more honest than any press release.
Track the regulatory calendar against the political calendar. The deregulatory posture is temporary. The moment an incident lands, emergency rulemaking follows, and crypto โ already carrying a compliance burden under MiCA โ will be the fastest to feel the pendulum.
Watch for cross-industry joint exercises. The real measure of governance maturity is not whether two competitors each drill in private. It is whether they drill together, with the infrastructure operators in the room. Absent that, you have two companies protecting their own reputations, not a system protecting itself.
I have made my career on the gap between what is disclosed and what is true. That gap is where the money is lost and where the money is made. The AI drill did not close that gap. It widened it, and then invited the market to look away.
The question is not whether the incident comes. The internal estimate already answered that. The question is whether the on-chain rails โ the exchanges, the bridges, the stablecoin issuers, the oracles โ are pricing the cascade today, or waiting to price it at zero bids on the way down. Audit trail or bust. The chain will remember what the market chose to forget.