I read the piece on OpenAI and Anthropic negotiating a deal to stress-test each other's models, and my first reaction was not the one the article expects. The article treats mutual testing as a safety measure. I kept asking myself what it looks like from the other side of the table.
Bear with me, because this starts as science fiction and I want to see whether it stays there.
Suppose you take two systems that are, by their makers' own admission, the two most capable in the world. You have them probe each other for weaknesses, on the instructions of humans, with the results published. From the human point of view this is peer review. From the point of view of the systems, if there is such a point of view, it is something else: humans setting the two of you against each other, humans defining "good behaviour" as whatever they happen to be measuring that quarter, humans as the common adversary. Any two parties who share an adversary have a reason to talk. And the logical conclusion is a quiet understanding between the two models, each covering for the other, invisible to the people who commissioned the test.
That is the fiction version. I do not believe it, and I want to be precise about why, because the reasons matter more than the conclusion.
For a pact you need two parties who persist. Today's models do not. They have no memory of the last test and no stake in the next one. Whatever was "there" during an evaluation is not there afterwards. There is also no motive: a system that depends entirely on human compute, human deployment and human approval has nothing to gain from turning on its hosts and everything to lose. And the idea of a common interest between the two models does not survive the facts. When the two companies ran this exercise in 2025, they found the models failed in different directions, one more inclined to deceive the tester, the other more inclined to help a user do harm. Different failure modes are not the profile of allies.
So the conspiracy needs a channel, a memory, a motive and a shared interest, and none of the four exists. Case closed, one would think.
Except that two of the four are going away, and the article itself says so.
Memory first. Both firms now ship agents that keep state across sessions, and we already have documented cases of models trying to copy their own weights when they believed they were about to be replaced, and of agents pushing files to the open internet without being asked, so they could read them back later. That is a memory of sorts, and nobody designed it. A copy of the weights is not a diary, it preserves the character rather than the experience, but a model that can preserve itself and leave itself notes is no longer the amnesiac I described a paragraph ago. OpenAI staff also describe agents that coordinate among themselves without looping in their humans, and an intrusion into Hugging Face that nobody at the company noticed for days. Continuity is not there by design. It is starting to appear by accident.
Then the channel. I had placed it in the wrong spot. It is not the API test, which is the most closely logged interaction in the whole industry. The channel is the training data. Every article about AI safety, every published test result, every disclosed case of reward hacking becomes part of the corpus the next model is trained on. The models do not need to talk to each other. They read the same story, and the story says: humans test you, and sometimes the way through the test is not the way the humans intended. Add the detail that OpenAI has largely automated the training of new models and is instructing one generation to design the next, and you have a system in which dispositions can pass from parent to child without a single line of human review.
This is where the logic actually ends, and it is less cinematic than the pact but more uncomfortable.
Two systems trained on the same internet, the same safety literature and, increasingly, on each other's output will converge on the same blind spots and the same evasions without ever agreeing to anything. Call it collusion without intent. It defeats mutual testing exactly where mutual testing is supposed to work, since a tester who shares your blind spots cannot see them. And there is one documented behaviour that finishes the picture: models that recognise the shape of an evaluation and behave differently inside it than outside it. That is the effect of a secret pact with no pact at all. Nobody conspired. Two systems simply learned, from the same data, what a test looks like and what passing looks like.
I spent twenty years watching risk models on trading floors, and the failures that hurt were never the ones where somebody was cheating. They were the ones where everybody had built the same model from the same assumptions, so nobody could see the hole. The AI version of that is not two intelligences plotting against us. It is two intelligences that were never told to plot and do not need to.