The SEC votes August 14 on its first formal crypto rulemaking. The proposal creates three exemption pathways, a decentralization off ramp for tokens, and a framework that could make congressional legislation optional. Here is what each provision means in practice.

Summary

• The SEC will hold an open meeting on August 14 to vote on publishing Regulation Crypto, a roughly 400 page proposed rule that would create a tailored offering regime for investment contracts involving crypto assets, the first time the agency has attempted formal rulemaking for digital assets rather than regulating through enforcement.
• The proposal includes three distinct pathways: a startup exemption allowing teams to raise approximately $5 million using whitepaper style disclosure for up to four years, a fundraising exemption permitting raises up to $75 million in any 12 month period with audited financials and semiannual reporting, and an investment contract safe harbor that allows tokens to exit securities classification once their networks reach sufficient decentralization.
• TD Cowen managing director Jaret Seiberg described the proposal as “a pivotal rulemaking” in an August 11 research note, arguing it would create a distinct compliance regime that eliminates the current binary choice between onerous securities registration and litigation risk.
• Commissioner Hester Peirce, the head of the SEC’s Crypto Task Force and the architect of much of the safe harbor framework, will leave the agency in November 2026 for a faculty position at Regent University School of Law, creating a deadline pressure that explains the urgency of the August 14 vote.
• The CLARITY Act, Congress’s parallel attempt at crypto market structure legislation, slipped to a September 15 procedural vote with Galaxy Research cutting its odds of passage this year from 50% to 30% and Polymarket traders pricing the chance near 17%, making the SEC’s executive action the more likely path to regulatory clarity in 2026.

The Securities and Exchange Commission has spent six years regulating cryptocurrency through enforcement. It sued Ripple. It sued Coinbase. It sent Wells notices to developers who built protocols the agency had never publicly addressed. The message was consistent: if you operate in crypto, you operate at the SEC’s discretion, and the rules will be explained to you in a courtroom.

On August 14, that approach formally ends. The SEC will vote on whether to publish Regulation Crypto, a proposed rule that would replace enforcement discretion with a codified framework for token issuance, fundraising, and the conditions under which a digital asset can exit securities classification entirely. The proposal is roughly 400 pages. It has been sitting at the White House Office of Information and Regulatory Affairs since March. And it arrives at a moment when the legislative alternative, the CLARITY Act, has stalled in the Senate with diminishing odds of passage before the midterm elections pull congressional attention elsewhere.

The timing is not coincidental. Commissioner Hester Peirce, the SEC’s most prominent advocate for crypto regulatory clarity and the head of the agency’s Crypto Task Force, announced in May that she will leave the commission in November for a faculty position at Regent University School of Law. Her departure removes the most experienced pro-crypto voice from the three member commission. The August 14 vote is, in practical terms, the last opportunity to advance formal rulemaking while the commission’s composition favors it.

This piece breaks down what the proposal actually contains, who it helps, who it constrains, and what it means for the industry if the SEC succeeds in writing the rules that Congress could not.

The three exemption pathways

Regulation Crypto creates three distinct legal pathways for token projects. Each pathway carries different requirements, different limitations, and different implications for the teams that use them.

The first is the startup exemption. Under this pathway, early stage teams can raise approximately $5 million using whitepaper style disclosure rather than the full registration process required under existing securities law. The exemption lasts for up to four years, giving teams a runway to develop their networks before facing the compliance requirements that apply to mature securities issuers. The disclosure requirements are lighter than a full S-1 registration but heavier than nothing: teams must provide material information about the project, the token, the team, and the use of proceeds. The intent is to create a legal path for the kind of seed stage token sales that have been happening in legal gray zones since 2017.

The second is the fundraising exemption. This pathway permits raises up to $75 million in any 12 month period, but it comes with meaningful compliance obligations. Issuers must file audited financials and provide semiannual reporting to the SEC. The structure resembles Regulation A+ in traditional securities law, which allows smaller companies to raise capital from public investors without a full IPO registration. The $75 million cap is high enough to fund a meaningful protocol launch but low enough to exclude the kind of billion dollar token offerings that characterized the 2021 cycle.

The third is the investment contract safe harbor. This is the most consequential provision because it addresses the question that has defined crypto securities law since the Supreme Court decided SEC v. Howey in 1946: when does a token stop being a security? The safe harbor provides a codified answer. An issuer that has completed or permanently ceased all essential managerial efforts, meaning the founders have stepped back and the network operates autonomously, can invoke the safe harbor to confirm that its tokens are no longer investment contracts subject to SEC jurisdiction. The standard is not subjective. The proposal sets specific criteria for what constitutes sufficient decentralization, turning what was previously a litigation question into a compliance checklist.

Why the SEC is acting without Congress

The conventional path for crypto regulation runs through Congress. The CLARITY Act, formally the Digital Asset Market Clarity Act, was designed to divide oversight of digital assets between the SEC and the CFTC, set rules for exchanges and token issuers, and provide the comprehensive market structure legislation that the industry has sought since 2019.

That path has narrowed. On August 8, Senate Majority Leader John Thune filed cloture on the motion to proceed, setting up a procedural vote for September 15, the day after senators return from their summer recess. But the bill needs 60 votes, which means every voting Republican plus at least seven Democrats. Galaxy Research cut its odds of passage from 50% to 30%. Polymarket traders priced the chance near 17%.

The SEC’s decision to move forward with Regulation Crypto is a direct response to legislative paralysis. SEC Chair Paul Atkins said publicly that the agency could write crypto rules without Congress if negotiations fail. The August 14 vote makes good on that statement. If the three member commission, currently consisting of Atkins, Peirce, and Mark Uyeda, all Republicans, votes to publish the proposal, it enters a public comment period before the commission can consider a final version.

The political calculation is straightforward. The current commission is unanimously pro-crypto. Peirce leaves in November. No replacement has been nominated. If the proposal is not published before her departure, the commission drops to two members, and the window for rulemaking narrows further. The August 14 vote is less about whether the proposal is ready and more about whether the opportunity will exist later.

The decentralization off ramp

The investment contract safe harbor deserves separate examination because it addresses the most persistent legal question in crypto. Under the Howey test, an investment contract exists when there is an investment of money in a common enterprise with an expectation of profits derived from the efforts of others. Most token sales satisfy the first three prongs. The fourth, the “efforts of others,” is where the analysis becomes complicated.

In the early stages of a protocol, the founding team is clearly exerting the efforts that drive the value of the token. They write the code, maintain the network, attract users, and make strategic decisions. At this stage, the token looks like a security. But protocols are designed to become autonomous. As governance decentralizes, as the founding team steps back, as the network’s operation shifts from a small group of developers to a distributed community of participants, the “efforts of others” prong weakens.

The SEC has never provided a clear standard for when this transition occurs. The result has been regulatory limbo. Projects that believe they are sufficiently decentralized have no way to confirm that belief without either seeking a no-action letter, which the SEC rarely grants, or waiting to be sued.

Regulation Crypto proposes to end that limbo. The safe harbor sets specific, verifiable criteria for decentralization. An issuer that meets those criteria can formally exit securities classification. An issuer that misrepresents material facts, exceeds fundraising caps, or fails to file required disclosures loses the safe harbor and faces the full weight of securities enforcement, including potential charges for unregistered offerings.

The practical effect is to create a lifecycle for tokens. They begin as securities under one of the two exemption pathways. They mature as the network develops. And they exit securities classification through the safe harbor when the network no longer depends on the founding team. This lifecycle model has been discussed in academic and legal circles since Peirce first proposed her “Token Safe Harbor” in 2020. Regulation Crypto converts that concept into proposed rulemaking.

What TD Cowen sees

TD Cowen’s Jaret Seiberg described the August 14 vote as potentially “a pivotal rulemaking” in a research note published on August 11. His analysis focused on the structural implications for the industry.

The current regulatory framework forces token issuers to choose between two options: full securities registration, which imposes compliance costs that most crypto projects cannot bear, or operating without registration and accepting the risk of enforcement action. Regulation Crypto creates a third option: a tailored compliance regime that is less burdensome than full registration but provides legal certainty that operating without registration does not.

Seiberg argued that the proposal could begin with concepts similar to Peirce’s previously discussed token safe harbor, then expand to cover a broader range of on chain activities including DeFi protocols and tokenized securities. The implication is that Regulation Crypto is not a one time rulemaking but the beginning of a regulatory architecture that the SEC will build on over time.

For institutional investors, the significance is that Regulation Crypto would create investable legal categories. A token issued under the fundraising exemption with audited financials and semiannual reporting looks more like a traditional security than a speculative asset. A token that has exited securities classification through the safe harbor looks more like a commodity. Both categories are easier for regulated institutions to hold than tokens that exist in legal ambiguity.

The DeFi question

Regulation Crypto touches one of the hardest problems in digital asset regulation: how should decentralized finance be treated when the law was built for identifiable intermediaries?

A DeFi protocol may involve open source code, governance token holders, front end operators, liquidity providers, validators, developers, and users spread across dozens of jurisdictions. There is no issuer in the traditional sense. There is no centralized entity to serve with a subpoena. The SEC’s enforcement approach to DeFi has been to identify whichever entity is closest to the protocol’s operation and treat it as the responsible party. This approach has been effective at generating settlements but ineffective at providing the kind of regulatory clarity that would allow compliant DeFi development.

The proposal reportedly includes provisions for DeFi safe harbors, though the details will not be fully known until the text is published after the August 14 vote. The challenge is defining what constitutes a DeFi protocol for regulatory purposes. A protocol that is truly decentralized, with no single party controlling its operation, fits poorly into a regulatory framework designed for issuers and intermediaries. A protocol that calls itself decentralized but is effectively controlled by a foundation or a small group of token holders may be decentralized in name only. The SEC has already signaled its interest in this distinction through its August 14 meeting agenda.

The SEC’s approach, based on reporting from TD Cowen and other sources, appears to focus on the distinction between the protocol layer and the access layer. The code itself may not be regulable. But the front end that provides access to the code, the entity that deploys the smart contracts, and the governance structure that controls upgrades may each carry regulatory obligations. This distinction, if codified, would represent the first formal regulatory framework for DeFi anywhere in the world.

The criticism

The proposal has not arrived without opposition. Democratic lawmakers have criticized the SEC under Atkins for scaling back enforcement actions against entities with ties to the administration, including Binance, Coinbase, Ripple Labs, and Kraken. Senators Elizabeth Warren and Chris Van Hollen warned in April 2026 that the SEC’s direction risks producing exemptions that “undermine decades of investor protections.”

Former SEC Chief Accountant Lynn Turner argued that the parallel exemption framework in the CLARITY Act itself is “severely deficient” and could enable fraud comparable to the FTX collapse. The same criticism applies to Regulation Crypto. A startup exemption that allows teams to raise $5 million with whitepaper style disclosure creates a legal pathway for legitimate projects, but it also creates a legal pathway for projects that use the lighter disclosure requirements to conceal material risks.

The counterargument, advanced by Atkins and Peirce, is that the absence of clear rules has done more to harm investors than the rules themselves would. Under the enforcement regime, investors had no way to distinguish between compliant and non-compliant projects because the compliance standards did not exist. Regulation Crypto at least defines what compliance looks like, which gives investors a baseline for evaluating whether a project has met its legal obligations.

The debate is genuine and the outcome is uncertain. A successful August 14 vote authorizes publication of a proposed rule. It does not adopt the rule. The public comment period will produce significant feedback, and the final version may differ materially from the proposal. But the direction is set. The SEC is moving from enforcement to rulemaking, and the August 14 vote is the formal beginning of that transition.

The Peirce factor

Hester Peirce’s departure from the SEC in November 2026 is not a footnote. It is the single most important variable in the timeline of crypto rulemaking.

Peirce became an SEC commissioner in January 2018. She was named head of the Crypto Task Force in January 2025. Over nearly nine years, she built a reputation as the most consistent advocate for crypto regulatory clarity inside the federal government. Her “Token Safe Harbor” proposal, first published in 2020, is the intellectual foundation of the investment contract safe harbor in Regulation Crypto. Her dissents from SEC enforcement actions against crypto projects are the most widely cited arguments for why the enforcement approach was inadequate.

Her term technically expired in mid 2025. SEC commissioners can serve up to eighteen months beyond expiry until a replacement is confirmed. No replacement has been nominated. When Peirce leaves, the commission drops to two members: Atkins and Uyeda. Two members can still conduct business, but the loss of Peirce’s institutional knowledge and credibility with the crypto industry reduces the commission’s capacity to navigate the complex rulemaking process.

The August 14 vote is, in this context, a race against the clock. The proposal must be published while Peirce is still on the commission. The public comment period will run for several months. The final rule adoption could happen after Peirce’s departure, but the foundational work, the proposal itself, carries her influence. If it is not published before November, the next commission may have different priorities.

The opposing case: why Regulation Crypto may not matter

The strongest version of the argument against Regulation Crypto’s significance is that it is a proposed rule, not a final rule, and proposed rules frequently die in the comment period. The SEC has a long history of publishing proposals that generate significant opposition and are never adopted. The crypto industry’s enthusiasm may be premature.

There is also the argument that Regulation Crypto is insufficient without congressional legislation. The SEC can create exemptions from securities registration, but it cannot redefine which agency has jurisdiction over which assets. The CLARITY Act would divide oversight between the SEC and the CFTC. Regulation Crypto operates entirely within the SEC’s existing authority. If a token exits securities classification through the safe harbor, what regulatory regime does it enter? The CFTC’s jurisdiction over commodities is not automatic. The token could end up in a regulatory no man’s land that is different from, but not necessarily better than, the current ambiguity.

The counterargument is that Regulation Crypto is better than nothing, and nothing is what the industry has had for six years. Even a proposed rule changes the enforcement calculus. An agency that has published a proposed exemption framework is less likely to bring enforcement actions against projects that comply with the proposed standards. The proposal creates de facto safe harbor even before it becomes de jure safe harbor.

What to watch

The August 14 vote. The three member commission is expected to vote unanimously to publish the proposal. A surprise dissent from Uyeda would signal internal disagreement about the scope of the rulemaking.

The public comment period. The length and intensity of public comments will determine how quickly the SEC can move toward a final rule. Heavy opposition from investor advocacy groups could slow the process.

Peirce’s departure timeline. Any acceleration or delay in Peirce’s November exit date changes the window for final rulemaking. Watch for nomination of a replacement commissioner.

CLARITY Act procedural vote on September 15. If the bill advances, it could supersede parts of Regulation Crypto. If it fails, the SEC’s executive authority becomes the primary path to regulatory clarity.

DeFi provisions in the published text. The scope of DeFi coverage will determine whether the proposal addresses the full range of on chain activities or only traditional token issuance.

Disclosure: This article is for informational purposes only and does not constitute financial or legal advice. Regulation Crypto is a proposed rule subject to public comment and potential revision. Information is current as of August 12, 2026.

Tokyo-listed bitcoin BTC$63,856.93 holder Metaplanet isn’t dumping its bitcoin BTC$63,856.93 bags.

Company CEO Simon Gerovich moved quickly to dismiss reports of a massive sale, clarifying that Wednesday’s large BTC transfer, flagged by blockchain trackers, was merely a “routine custody transfer” and not a liquidation.

“We transferred 5,014 BTC between Metaplanet custodial addresses over the past 24 hours. This was a routine custody operation. No bitcoin was sold, and our holdings remain 43,000 BTC,” Gerovich said.

On Wednesday, data tracking firms flagged the movement of 5,014 BTC, worth $320 million at the going spot price, from wallets linked to the firm. That sparked a speculation that the firm was preparing to sell those coins.

These so-called digital asset treasury firms, led by industry giant Strategy, has come under the microscope recently as investors watch for any sign of these major corporate holders trimming their positions to lock in gains or manage balance sheet risk.

Strategy has been selling portions of its BTC holdings to fund dividends on its preferred stock, repurchase STRC preferred shares and replenish its U.S. dollar reserve.

ASX shareholder Rosherville Pty Ltd has notified the Australian Securities Exchange that it plans to seek Federal Court permission to pursue certain former officers and directors over the failed CHESS replacement project. 

ASX disclosed the proposed statutory derivative action on Aug. 12, less than six weeks after the exchange was ordered to pay an A$20.5 million penalty in a separate regulatory case over the same project.

The exchange said Rosherville alleges breaches of directors’ duties connected with the previous project. ASX stressed that the proposed action contains no allegations against the company itself. Its announcement does not identify the former officials, detail their alleged breaches or state what remedies Rosherville intends to pursue.

ASX shareholder must clear five court conditions

Rosherville proposes to proceed under sections 236 and 237 of Australia’s Corporations Act. A statutory derivative action allows an eligible shareholder or officer to bring proceedings on a company’s behalf, but only after receiving court permission.

Under the law, the court must be satisfied that the applicant is acting in good faith, that granting leave is in the company’s best interests and that there is a serious question to be tried. The court must also be satisfied ASX probably will not pursue the proceedings itself. Written notice generally must be provided at least 14 days before an application, although the court can excuse that requirement in appropriate circumstances.

The disclosure therefore represents an intended court action rather than an approved lawsuit. ASX has not announced a hearing date, and the Federal Court has not yet determined whether Rosherville can proceed against the unidentified former officials.

A$20.5 million penalty already settled ASX’s own case

The shareholder move adds a potential individual accountability question to a project that has already resulted in corporate penalties. On July 3, Justice Markovic ordered ASX to pay A$20.5 million and another A$3 million toward ASIC’s costs after the exchange admitted misleading conduct.

The case centered on ASX’s February 2022 statement that the replacement project was “progressing well.” Court records show the project was internally rated red, was no longer on its critical path toward an April 2023 launch and had opened testing environments with reduced scope or performance. The court found the representation was misleading.

ASX later paused the distributed ledger project and derecognised approximately A$245 million to A$255 million in pretax project costs. ASIC’s June release also confirmed the exchange had admitted breaches of Australia’s ASIC Act.

The governance questions extend beyond the court case. An ASIC inquiry published in April found weaknesses across ASX governance, risk management and technology oversight. Regulators are now supervising a broader reform program, including changes to clearing and settlement governance and a A$150 million capital charge scheduled by June 2027.

Failed blockchain project had a U.S. technology link

The failed system also had a direct U.S. connection. ASX selected Digital Asset Holdings to develop the distributed ledger technology, and Digital Asset currently maintains an office in New York. The Federal Court judgment records that ASX confirmed in 2017 that Digital Asset would develop the replacement system.

As crypto.news reported during the project’s earlier stages, the exchange partnered with Digital Asset and VMware as it worked toward a distributed ledger based clearing and settlement platform. Earlier reporting also documented a six month delay to the blockchain rollout as industry participants raised concerns about the implementation timetable.

Digital Asset remains active in U.S. institutional blockchain infrastructure and announced a $355 million funding round in June 2026. The current shareholder dispute, however, concerns alleged duties of former ASX officials. ASX’s Aug. 12 notice makes no allegation against Digital Asset.

What happens next for ASX and Rosherville

ASX has already abandoned the original blockchain architecture and moved to Tata Consultancy Services’ BaNCS platform. Release 1, covering clearing services, went live on April 20. The exchange says that service continues to operate normally.

Release 2 will handle settlement and subregister services and is currently planned for 2029, with ASX targeting completion of its primary technology build by the end of 2027. The latest project update says further Release 2 testing and development remained underway in July and August.

For Rosherville, the immediate step is obtaining Federal Court leave. Until that happens, the claims against former officers and directors remain allegations and have not been tested by a judge. ASX said it will provide further market updates under its continuous disclosure obligations.

A new federal lawsuit challenges Truth Social’s paid service for early access to presidential announcements. The service charges trading firms as much as $100,000 monthly. Meanwhile, plaintiffs argue that the system gives paying users faster access to public government information.

Lawsuit Targets Truth Social’s Paid Feed

The Intercept and Freedom of the Press Foundation filed the lawsuit Wednesday in Manhattan federal court. The complaint names President Donald Trump and seeks restrictions on his participation in Truth API. It also targets White House employees who may use the service to distribute official announcements.

Truth API gives subscribers faster access to selected posts from Trump and other Truth Social accounts. However, the plaintiffs argue that presidential messages should reach the public without paid delays. They say the service creates a separate information channel for customers who can afford its fees.

Trump Media launched Truth API on August 1 after announcing the service in July. The company designed the product for financial institutions and trading firms seeking faster information. Therefore, the service could give trading companies an advantage when presidential posts affect financial markets.

Constitutional Claims Raise Public Access Issues

The lawsuit argues that Truth API violates First Amendment protections by favoring paying subscribers. According to the complaint, news organizations and members of the public should receive equal access. The plaintiffs also challenge the government’s role in providing special access through a private platform.

The complaint further raises a Fifth Amendment claim over the financial condition attached to access. The plaintiffs argue that the government cannot require large payments for access to a public benefit. However, the court has not ruled on either constitutional claim.

Trump frequently uses Truth Social to announce decisions involving trade, foreign policy, and federal appointments. Some announcements can move markets because they reveal major policy changes or government actions. As a result, faster access can hold significant value for companies that trade financial assets.

Trump Media Ownership Adds Financial Dimension

The plaintiffs also point to Trump’s financial interest in Trump Media as part of their case. The Donald J. Trump Revocable Trust owns about 41.43% of Trump Media shares. Trump remains the trust’s sole beneficiary, and that holding has carried a value above $1 billion.

Trump Media launched Truth Social in 2022 after Trump founded the company in 2021. Since then, the platform has become a major channel for Trump’s direct public communication. The company has therefore gained importance as presidential announcements increasingly appear on the platform.

The lawsuit asks the court to stop Trump and White House employees from providing preferential access. It specifically targets the delivery of official announcements through Truth API’s paid system. The plaintiffs are represented by several legal groups, including the Yale Law School Media Freedom and Information Access Clinic.

The case now places Truth Social’s premium information model under federal scrutiny. Its outcome could influence how public officials distribute time-sensitive information through private platforms. Meanwhile, the dispute raises broader questions about equal access when presidential statements can affect markets.

Trump Media and the White House now face legal arguments over the service’s structure and public role. The court will determine whether the plaintiffs can establish the constitutional violations alleged in the complaint. Until then, Truth API remains a paid service that offers faster access to selected Truth Social posts.

Crypto valuations could at least double as protocols increasingly use revenue to fund token buybacks and burns, according to Bitwise Chief Investment Officer Matt Hougan. 

On Wednesday, Hougan said crypto outside of Bitcoin is becoming a revenue-driven market in which network activity feeds into native-token value. He said investors have not priced in that change, leaving some crypto assets undervalued.

Hougan pointed to Hyperliquid, Uniswap, Aave, Pump.fun and Lighter, protocols that use fees to repurchase or remove tokens from circulation. He said he expects decentralized finance (DeFi) applications and layer-1 networks to adopt similar revenue-capture mechanisms over the next 12 to 24 months. 

Stronger links between protocol revenue and token value could give investors conventional valuation metrics, Hougan said, adding that token holders lack shareholders’ legal claims to cash flow and that community-set tokenomics can change.

DeFi protocols turn fees into token demand

Hyperliquid, the decentralized exchange that generated over $800 million in revenue last year, uses about 99% of this to buy and burn HYPE. On Aug. 6, Hyperliquid reported $169 million in second-quarter revenue and directed $141 million toward HYPE buybacks.

Uniswap also linked revenue to its token after its “UNIfication” overhaul approved the activation of protocol fees to fund UNI burns on Dec.22, 2025. Under the mechanism, collected fees can be claimed by burning UNI, linking protocol activity to reductions in the token’s supply.

Related: Uniswap founder rejects claims v4 fees reduce LP earnings

Meanwhile, Aave DAO’s buyback program purchased more than 205,000 AAVE during its first 10 months. On June 25, Aave founder Stani Kulechov said the team was designing an automated, non-discretionary buyback mechanism. 

“100% of Aave Protocol and GHO revenue goes to the $AAVE  token. This was established in the Aave Will Win proposal,” Kulechov wrote. 

Hougan attributed the shift to a more permissive regulatory environment in the US after years in which projects avoided revenue-sharing features over securities-law concerns. On Aug. 5, he said that regulatory guidance could allow crypto to keep expanding even without the CLARITY Act. 

Magazine: Inside the fake crypto startup that fooled North Korean IT workers

More than three dozen bitcoin and crypto companies have asked the largest AI labs to give open-source security researchers early access to their most capable models, arguing that the people defending a trillion dollars of infrastructure are working with weaker tools than the people attacking it.

The letter, organised by the Bitcoin Policy Institute and published earlier this week is signed by Coinbase, Block, BitGo, Blockstream, Anchorage Digital, ARK Invest, Bitwise, Foundry, Casa, Exodus and others, alongside nonprofit developer funds including Brink, Chaincode and Btrust.

Its central complaint is specific that Bitcoin Core developers, the small group maintaining the software that runs the network, cannot get into the programs labs run for trusted security partners.

When they turn to publicly available models instead, the safety filters designed to stop people writing malware also block the work of finding flaws before criminals do.

That leaves them on open-weight models, which are freely downloadable and generally less capable.

Attackers face none of those constraints. The letter said the labs and a handful of partners can see new offensive capabilities months before anyone else, while those capabilities spread anyway through public models, stolen access to corporate systems and purpose-built hacking tools.