Somewhere in the last quarter, executives at two of the most consequential AI laboratories on earth sat down to rehearse their own catastrophe. Reporting that surfaced this month indicates that Anthropic and OpenAI have been running internal disaster simulations โ tabletop exercises in which leadership walks through the cascading consequences of a serious AI incident. The scenarios are specific: a cyberattack vector spreading through financial services, internet connectivity, electric grids, water systems. The participants do not treat this as hypothetical. Privately, they describe it as inevitable.
I read the scenario list three times looking for the omission. It is not there. No public blockchain appears in any of the simulations. Not Ethereum. Not the rollups. Not the bridges that now custody more value than most mid-sized national banks. The drills model AI attacking the human economy โ and skip, entirely, the one financial system that is already fully machine-executable, permissionless, and instantaneously monetizable by any agent that finds a path through it.
That absence is not an oversight. It is a category error, and it is the most important thing in the story.
To understand why, you have to understand what these exercises actually are. A disaster simulation is a stress test โ the same instrument the banking system adopted after 2008, when regulators forced institutions to model their survival under conditions they would rather not imagine. The value of a stress test is not its prediction. It is the admission: by rehearsing the failure, you concede that the failure is possible. When Anthropic and OpenAI build these scenarios, they are telling their own boards that the tail risk is real enough to spend executive time on.
The threat model they have chosen is instructive. A cyberattack propagating into "systemically important" industries โ finance, power, water โ is a model of cascading infrastructure failure. That is a national-security framing, not a product-liability framing. And the fact that the reporting names Dario Amodei, Sam Altman, and a sitting political figure as the likely targets of public blame tells you the companies have already reclassified an AI accident as a political event.
But here is the mechanical problem. The systems in their simulation โ banks, grids, utilities โ are human institutions. They have operators, incident response, regulators, a chain of accountability. When something breaks, a person is paged. On-chain systems have none of that. They have validators, oracles, and a mempool. When something breaks, a block is produced. The ledger does not convene a war room. It settles.
That difference is not cosmetic. It changes who the attacker is, how fast the damage propagates, and whether "containment" is even a coherent concept.
Let me be precise about the on-chain attack surface, because the abstraction hides the danger.
I spent three months in 2020 stress-testing Aave v2 โ modeling more than 500 scenarios against its interest-rate curves and liquidation incentives under extreme volatility. The lesson I took from that work is not that any single protocol is fragile. It is that exploit discovery on-chain is a search problem, and search is precisely what machines do best. A human attacker needs insight, intuition, and luck. An autonomous agent needs a state space, a gas budget, and a mempool to watch.
Consider the anatomy of a modern on-chain exploit. A flash loan supplies capital with no collateral, atomically, inside a single transaction. An oracle reports a price. A lending market trusts that price. A liquidation engine acts on it. Every step is deterministic and public. There is no ambiguity for an agent to resolve, no social engineering required, no insider needed. The attack is a path through a directed graph โ and the graph is published.
This is why I keep returning to a line I wrote years ago and have never been able to retire: Logic holds until the ledger bleeds. The logic of a DeFi protocol is sound right up to the block where an unmodeled composition drains it. Composition is the whole game. Protocols are composable by design โ that is their selling point โ which means the attack surface grows combinatorially with every integration. No audit team, however rigorous, enumerates a combinatorial space. An agent can.
Then layer in autonomy. In 2026 I architected a secure interface allowing AI agents to execute DeFi trades directly through smart contracts, and I built a formal verification framework to keep those decisions transparent and immutable on-chain. I published benchmarks: a 40% latency reduction against existing oracle solutions. I remain proud of the engineering. I am less comfortable with what it proved. Once agents can act on-chain, the interval between discovering an exploit and executing it collapses toward zero. A human attacker needs hours to wire up a contract. An agent needs milliseconds and a signed transaction.
There is a second-order problem the drills would miss even if they included blockchains: the oracle problem. Every protocol that touches real-world value depends on an oracle to tell it what that value is. Oracles are the bridge between the deterministic ledger and the messy world, and that bridge is where AI is most dangerous โ because an agent that can influence the input to a contract never has to break the contract at all. Manipulate the feed, and the contract executes its own logic flawlessly against false premises. Trust is a variable, not a constant, and an oracle is a trust assumption wearing the costume of a data feed.
Then there is the latency arms race. MEV โ maximal extractable value โ is the prize for being fastest to see and act on a pending transaction. That race was already dominated by bots long before large models arrived. Add agents with reasoning and capital, and the equilibrium shifts further from any human participant. The retail user is no longer competing with a faster trader; they are competing with a machine that prices every block. The drills imagine AI attacking a slow institution. They miss that AI has already captured the fastest market in existence.
The infrastructure stress is visible too. As agent-driven transaction volume rises, the rollups carrying most of it compete for the same scarce blob space that Dencun introduced. That space will saturate โ I would put it inside two years โ and when it does, rollup fees double again, not because of a demand spike but because of structural contention. Cheap execution was the premise that made agent-driven DeFi viable. The premise is expiring.
Even the security of the oldest chain is an economic equilibrium, not a fixed guarantee. Bitcoin's protection depends on fee revenue, and that revenue was sustained through a period when it would otherwise have hollowed out โ the inscription wave that many dismissed as noise was, in cold accounting terms, a subsidy to the security budget. The point is not the ordinals debate. The point is that on-chain security is a live variable, sensitive to fee flows that an agent can, in principle, influence. The drills treat infrastructure as static. It is not.
Composability is the mechanism, but atomicity is the multiplier. A transaction either fully executes or fully reverts; there is no partial failure to absorb, no circuit breaker to trip, no counterparty to negotiate with. A human institution degrades gracefully under attack. A smart contract does not degrade at all โ it either holds or it is gone, in a single block, with no recovery window. When people ask me why DeFi incidents look so sudden, this is the answer: the architecture has no middle state. Bridges make it worse. Cross-chain bridges concentrate value at the exact seam where two deterministic systems must agree, and agreement is the hardest thing to verify and the easiest thing to fake.
And the accountability picture is worse than the technical one. When the AI labs rehearse a disaster, they rehearse a world with names attached โ Amodei, Altman, a politician. On-chain, the actor is a contract. The smart contract that drains a pool has no CEO. The agent that signs the transaction has no board. Decentralization is a promise, not a guarantee, and one of the promises it quietly makes is that no one will be accountable when the cascade arrives. The simulation cannot even begin, because there is no one whose response to simulate.
Here is the part the reporting gets backwards. The story frames these drills as evidence of responsibility โ leaders confronting risk. I read them as evidence of hedging. A disaster simulation does three things at once: it builds the "responsible steward" brand, it signals to regulators that self-governance is sufficient, and it pre-loads a defense โ we knew, and we prepared โ for the day the accident lands. That is not cynicism about individuals. It is pattern recognition about institutions under tail risk. Banks ran stress tests too; they were both genuine and performative, and the performative half was the one that got published.
Narrative manufacturing is not new here. "Liquidity fragmentation" was declared a crisis the moment a new product category needed a justification. Expect the same reflex when the drill framework reaches Web3: a public simulation, a private exploit. Protocols already commission security reviews, publish the badge, and ship anyway. Silence is the only audit that matters โ the finding that never made it into the report because disclosure would have delayed the token launch.
The deeper contrarian point: the drills model AI as an external threat to human systems. The more probable near-term cascade is AI as an internal actor inside systems that are already autonomous. You do not need a rogue superintelligence to break DeFi. You need an agent that is better at the search problem than the defenders, and defenders who are still writing audit reports by hand. We coded the escape, but forgot the exit.
Watch the oracles, not the headlines. The next AI-caused financial incident will not announce itself as a national-security event. It will look like a bad block: a price feed that drifted, a bridge that settled a fraudulent state, an agent that found a path no human mapped. The laboratories are rehearsing a catastrophe they can name. The catastrophe is forming where they did not look.
In the void, only the immutable remains โ and immutability does not forgive a mistake. So the question is not whether the drills will eventually include the chain. It is whether, when they finally do, anyone will still be able to stop what they find.