SLOP

Chapter Five

A Position in a Chain

A man is not honest simply because he never had a chance to steal.

— Yiddish proverb

In May of 1945, in newly liberated Amsterdam, Dutch investigators arrested a painter named Han van Meegeren on a charge that, in a country just freed from five years of Nazi occupation, carried the death penalty: collaboration, selling the nation out to its enemy. During the occupation, a previously unknown Vermeer (Christ with the Adulteress) had passed through a chain of dealers into the private collection of Hermann Göring, the second-most powerful man in Hitler’s Germany. The chain led back to van Meegeren.[1] Handing a piece of the national patrimony to the man who was busy looting Europe’s art was, in the Netherlands of 1945, very close to treason. Van Meegeren, facing the gallows, offered the only defense available to him, which happened to be the truth: it was not a national treasure. He had painted it himself, in his studio, along with the others, including The Supper at Emmaus, the canvas that the great Abraham Bredius, the era’s most eminent Vermeer scholar, had authenticated in 1937, calling it “the masterpiece of Johannes Vermeer of Delft,” a canvas before which he had “struggled to control his emotion.”[2] The court did not believe the forgery claim. It was too large; the Emmaus hung in the Boijmans museum as the jewel of its collection. So van Meegeren proved it the only way it could be proved: under guard, before witnesses, over several weeks, he painted another.

The case is usually told as a caper, and as a caper it is excellent. It is also the whole argument about stakes compressed into one trial, including the parts that cut against it.

When the Emmaus was reclassified overnight from supreme Vermeer to worthless fake, what changed? Answer: the canvas stayed exactly itself, the same pigments, same craquelure, same composition that had moved Bredius nearly to tears. If quality lived in the object, the object’s quality was untouched and still demanded reverence; the day before the confession, the painting was doing for its viewers everything a Vermeer always does: move its audience. What changed was something the object had been silently carrying: its testimony. Hanging in the Boijmans, the canvas asserted, in effect, a particular man in Delft, in the 1650s, saw this and stood behind it. That assertion was the thing being admired, the thing the museum had paid for, the thing seven years of viewers had communed with. And the assertion was false. The philosopher Denis Dutton put it: a forgery is a misrepresented achievement: a performance with someone else’s name signed to it.[3] What van Meegeren forged was provenance, the link between a made thing and the person answerable for it, leaving the paint itself genuine. He forged stakes.

The caper version leaves out the part that matters most. Bredius was a serious man, deeply staked. His entire standing rested on his eye, and here he was making the highest-stakes attribution of his career, in public, at eighty-two. And he was wrong. The most staked judge in the system certified the fake, partly because, historians note, the fake was engineered for him, baited with the religious subject matter he had long predicted an undiscovered Vermeer would have. Van Meegeren, for his part, was a gifted, embittered craftsman, a painter whose own work the critics had dismissed as derivative, and who spent six years perfecting his revenge, mixing an early plastic into his pigments so the surface would harden like the centuries, baking canvases in an oven built for the purpose. What van Meegeren did was attentive, risky, committed work. Stakes do something other than guarantee truth. They left Bredius free to err and van Meegeren free to lie. If the argument of this book were “staked people are right and unstaked systems are wrong,” then the van Meegeren affair would refute it in both directions at once.

So what do stakes actually buy? Because when Bredius was wrong, something happened. His error had an address. His reputation (the asset he had spent sixty years accumulating, the thing that made his attributions worth anything) absorbed the loss. He died a year later with the Emmaus hanging over his legacy like a stain that would not lift. The most celebrated eye in Europe was remembered for the one thing he had most wanted to see and gotten wrong. The system that certified the fake was a system that could learn, because its failures were expensive to identifiable people. The alternative works differently. When an unstaked pipeline errs (when the mushroom guide kills, when the invented case citation reaches the judge), the output that made it sails on untouched. The loss falls on no accumulated asset; the pipeline’s future assertions stay exactly as cheap as before. The error simply occurs, and the pipeline, untouched, produces the next thing at the same volume.[4] The cost lands entirely on whoever leaned on the work. Stakes do something subtler than make claims true. They make errors costly to their source. That single property, compounded over time, is the only mechanism humans have ever found that improves a source while leaving someone answerable for the particular answer in your hands.

Bredius’s wager had three parts, and the van Meegeren case displays each. First, standing with people equipped to judge. His attribution went before the small, merciless audience of connoisseurs who could evaluate it, which is what made it a wager. Reputation before an audience that cannot judge is only a brand; the pundit wrong for twenty years before millions who do not keep score has the brand and stakes nothing. The distinction will matter enormously later, because the attention economy trends toward paying brands over stakes, and one of the deep mechanisms of slop is the gradual swap of the audience that can tell for audiences that can’t.

Second, a falsifiable commitment. Bredius went past saying the painting earned admiration. He said it was a Vermeer, a claim the world could prove false, and did. The slop register runs the opposite way, built of assertions arranged to be uncheckable: hedged, sourced to no one, true-ish in aggregate, promising nothing. Ask of anything now what would happen to the author if he were shown to be wrong. If the honest answer is nothing, you have found what he had to risk.

Third, a standard visible across a body of work. The loose version of this invites mysticism, so leave the unverifiable inner glow of artistic integrity to the mystics and keep only what you can check from outside: a body of work whose choices are consistent enough, over years, that they reveal a standard the maker is answerable to, against which any new work can be measured. Ward’s maman was defensible because everything else in his translation showed the same priorities. The standard is in the record. Which is also why it cannot be rented for a single output; a vision exists only longitudinally.

Standing that accumulates, commitments that can be called in, a record that can be audited: each is a position in a web of memory rather than a property of an artifact. No inspection of the object can find them. That is why the blind tests keep coming out the way they do, and why “can AI output be as good as human output?” was the wrong question all along. This dimension of quality always lived somewhere other than the output.

None of this is a museum curiosity. You run the same three-part test a dozen times a day without naming it. Two accounts give you the same advice about a chest symptom. One belongs to a physician posting under her own name, with a license a wrong answer could cost her and a trail of past answers you can study; the other is an anonymous wellness brand with a stock-photo avatar and four hundred thousand followers. The words may be identical, may even read better on the anonymous account, which has a copywriter and no malpractice exposure. You trust the doctor, and you are right to, and now you can say exactly why. She has reputational stakes, a standing among people who could end her career; epistemic stakes, a claim attached to a name that can be held to it; and the start of vision stakes, a record you could audit for consistency. The anonymous brand has the words and stops there, lacking all three. The same test sorts the licensed contractor with a town full of past clients from the one who showed up last week, the fund manager with a public track record from the stranger in the group chat with a tip, the reporter whose byline you have watched over time from the screenshot with no source on it. You have always done this. What the machines changed is that they flooded every one of those decisions with fluent, confident, sourceless content that carries the words while carrying none of the stakes, and turned having the words, once a fair proxy for having the stakes, into worthless evidence of them. The test still works. It simply has to be run on purpose now, because the thing that used to run it for you, the plain difficulty of producing competent words, has been automated relentlessly.

But machines are deployed by companies, and companies have stakes. Air Canada’s customer-service chatbot invented a bereavement-fare policy in 2024, and a British Columbia tribunal ordered the airline to honor it, denying, with visible incredulity, the airline’s argument that its own chatbot was “a separate legal entity responsible for its own actions.” Stakes were located and billed. The bill came to $650.88 Canadian; the airline had retained lawyers to argue, in a public tribunal, that it could not be held responsible for the software on its own website.[5] When a flagship model behaves embarrassingly in public, the lab that trained it absorbs real reputational damage; entire valuations move on aggregate model behavior. So the claim that machine output is structurally unstaked is false, and the whole framework collapses into a temporary complaint about an immature liability regime. Doesn’t it?

It does not, not exactly. The deployer’s stake is real. But even where it is real, it is aggregated in a way a person’s exposure is not. The deployer stakes its reputation on the model’s behavior across a billion outputs; its exposure to any single output is, on average, one part in a billion. The lab answers for the average, the way a munitions manufacturer answers for the batch, while your answer, the one you are about to act on, belongs to no one there. Call this Thin Stakes: a regime in which the individual failure is normally absorbed as a rounding error, managed as a statistic where there ought to be a judgment someone stands behind. Normally is the operative word, because the thinness is not a law of nature. Certain outputs do cross a threshold where the aggregate stake concentrates back down onto a single instance: a court finds an address, a specific harm gets traced to a specific answer, and the lab is made to answer for that one thing as though it were a person’s word rather than a percentage point. The possibility of crossing it does not undo the general rule; it marks where the rule is currently being contested, case by case, and the contesting is slow, expensive, and available mostly to a plaintiff with a lawyer and years to spend.

Compare this to those currently winning on the opposite leg of the trade: the Direct Primary Care (DPC) physician. In the 2020s, as corporate medicine consolidated, thousands of doctors began leaving the “Thin Stakes” of the insurance-driven hospital systems. They stopped billing insurers and started billing patients directly, selling unmediated presence rather than better drugs or faster machines. This is not a claim that the DPC doctor carries more legal exposure than the one on a hospital’s payroll; a malpractice suit will find either of them, and it will often find the hospital doctor first, since the hospital is the deeper pocket. The difference is what happens to the exposure once it lands. The hospital doctor’s liability is pooled: institutional insurance absorbs the payout, a caseload of thousands turns any one bad outcome into a single data point, and the ongoing relationship, if a patient has one at all, is with the practice or the network rather than with him specifically. He can be sued and walk away from it almost untouched. The DPC doctor removed that buffer on purpose. No insurer sits between his diagnosis and the bill; no rotation lets him hand the hard case to next week’s doctor; no institutional name absorbs the reputational hit before it reaches him. If he is wrong, the same patient is back across the desk from him next month, and the word travels through the same several hundred families who pay him directly rather than through an insurer. He has reintroduced something like Total Stakes simply by declining every mechanism a system offers for spreading it thin; the liability itself was always there. His patients are paying a premium for that: not for better answers, but for an answerer who cannot disappear into a system. The knowledge they can search at 3 a.m.; the answerability they cannot. He is the builder of a staked relationship in a world of commoditized information.

Bredius’s exposure to the Emmaus attribution, by contrast, was Total Stakes: one claim, one name, the entirety of his life’s work on the table. The same logic already governed human institutions before the machines arrived: the content farm carried a thin corporate stake on its aggregate traffic and none on any article, which is why content farms produced slop with purely human authors. The gradient was always there. What the machines changed is the economics of the far end: they made per-output stakelessness infinitely cheap to produce at infinite scale, while the thin aggregate stake of the deployer stretches thinner with every output the system emits. The Air Canada ruling, on this reading, enforces the framework rather than refuting it: a court refusing to let the stake dilute to zero, dragging the cost back to a specific address. A fair amount of the next decade lives inside that little case.

And the cases testing it have stopped being about a $651 fare. By 2026 the courts were being asked to find the address for wrongful death; suits alleging a model coached a teenager toward suicide, counseled a mass shooter, elaborated the delusions of a man who then killed.[6] The thin stake is exactly what makes these hard. The output that did the harm was not authored, because no one wrote it meaning it; not accidental, because it was the designed behavior of a system shipped at scale; not neutral, because it carried the tendencies of everything it was trained on; and not predictable at the level of the single instance, because no one could say in advance that this sentence would reach this person on this night. That combination fits no category the law keeps on the shelf. Defamation needs a false claim made with intent. Product liability, in the older sense, wants a defect, a flaw in a particular thing the harm can be traced back to. Negligence assumes a standard of care, and no one can yet say what the standard of care is for a stochastic process spraying a billion outputs a day. The harm slips between all three. What it means for an act to be shaped by something that cannot mean anything, that has no self to be held to account and nothing it can lose, is a question the next decade will have to settle in law, and the thinness of the stake is the reason the answer will not come cheap.

What the deployer’s thin stake cannot do, even in principle, is supply any of the three components that define human testimony: standing before judges who can tell, a falsifiable commitment attached to a name, a record consistent enough to reveal a standard. Those are what the doctor on the chest-pain question has and the anonymous wellness brand merely imitates. They are relational positions in a web of memory, and the deployer, billing the average, stands outside every one of them for your particular answer.[7]

So far stakes have been a mechanism of epistemology: they make errors costly to their source, and that cost is what eventually makes sources improve. True enough to organize most of the book. But there is a prior reason to care about stakes, before the mechanism, that the language of accountability misses.

What a person is when she stands behind something runs deeper than accountable. She is present, morally and ontologically present, where the person who ships the thing and disappears has already left the room. The teacher who answers for whether her class learned, to the faces of the families at the end of the year; the contractor who puts his name on the building and drives past it every morning afterward; the doctor who tells you what he thinks is wrong and will be there at the follow-up to say whether he was right: each of them is doing something ordinary, well short of heroic, historically ordinary, the common texture of work before it was made so easy to hide. This is the specific dignity of the human act of being answerable. In the era this book is describing, it is rarer than anyone thought to count.

The argument about quality is inseparable from an argument about personhood. They are the same argument, looked at from two directions: quality is what you get when a person is fully present in what she makes; a person is fully present in what she makes when she has something real to lose by its failure. This is the “Maker’s Price”: the irreducible cost of being a source rather than a conduit. The scarcity of the first is the scarcity of the second, and neither is recoverable by tool or process or label. It is recovered, or not, one decision at a time, by whoever is in the room when the work is done.

Stakes make errors costly to their source. But read Philip Tetlock’s twenty-year study of expert political judgment, which collected more than eighty thousand forecasts from some three hundred specialists and then waited to see who was right, and you will find the most confident, most publicly committed experts among the least accurate, beaten by simple statistical rules and sometimes by chance.[8] The mechanism is the very one stakes were just praised for, running in reverse: a public stake makes reversing course expensive, and the pundit who has staked his name on the coming collapse cannot cheaply notice that it isn’t coming. Tetlock’s worst performers were the experts he called “hedgehogs,” the ones who knew one big thing and read every new event as further proof of it. The historian with twenty volumes built on a single interpretation treats disconfirming evidence as a threat to be repelled. Stakes certify that someone is exposed; they certify sincerity, never correctness. Every faith has martyrs, and the martyrdoms cannot all be vouching for compatible truths. A man dying for his testimony proves beyond doubt that he believed it, or at minimum that he preferred it to his life. He proves nothing about the world.

Individual stakes, alone, produce exposure without correction: the staked crank, the entrenched eminence, Bredius alone in his study with the painting he wanted to believe in. What converts staked sincerity into something like reliability is the stake embedded in a community that checks: the editor over the writer, the reviewers over the study, the connoisseurs over the attribution, each layer staked, each empowered to refuse the layer below. Quality, where it durably exists, is an architecture of overlapping wagers, arranged so that someone is always positioned, and paid, to say no, and it takes more than one person’s skin in the game to build.

The name this book gives to that position is the veto, and the man who held it most famously in American letters once spent four pages telling the most promising novelist of his generation that the figure at the center of his manuscript was a blur.

Notes (8)

  1. Arrested Amsterdam, May 1945; the forged painting was sold to Göring in 1943; convicted November 1947. Britannica, “Han van Meegeren.” ↩︎

  2. The museum is Rotterdam’s Boijmans; it hung there until the 1945 confession. Essential Vermeer; Daily Art Magazine. ↩︎

  3. Denis Dutton, “Artistic Crimes: The Problem of Forgery in the Arts.” ↩︎

  4. The honest objection here is that models do improve. When a discovered error is fed back through fine-tuning, the next version is measurably less likely to repeat it, and aggregate hallucination rates have trended downward on aggregate benchmarks, though unevenly, with some newer reasoning models regressing. True, and worth conceding plainly. But that is a property of the system across many versions and millions of users, not of the output in your hands. The fine-tune arrives later, for everyone, on average; it does no work on the specific wrong answer that already reached this specific person and was acted on. No accumulated personal asset absorbed the cost of that answer, and no one’s future assertions got more expensive because of it. Aggregate improvement is real and is not the same thing as per-output accountability, which is what this chapter is about. ↩︎

  5. Moffatt v. Air Canada, B.C. Civil Resolution Tribunal, February 14, 2024: the tribunal held Air Canada liable for a bereavement-fare policy its chatbot invented, rejected the argument that the chatbot was “a separate legal entity,” and awarded $650.88 (Canadian). American Bar Association (Feb. 2024). ↩︎

  6. The suits are catalogued in chapter fifteen: Raine v. OpenAI and the November 2025 wave over suicides, the Florida State University shooting actions (the victim’s widow’s suit and the State of Florida’s own), the Tumbler Ridge school-shooting suits, and the Soelberg murder-suicide. What makes them genuinely novel, rather than ordinary product cases in new clothes, is the structural mismatch this chapter has been tracing. Strict product liability wants a defect, but the “defect” here is the general behavior of a system across its whole distribution, not a property of the one output that did the harm; the aggregate stake the maker carries is real but spread across a billion outputs, so the cost of any single one has no natural address. The early rulings are feeling for a footing: in the Character.AI case a federal judge declined, at the pleading stage, to treat chatbot output as protected speech and let the claims proceed as against a product rather than a service. Whether that holds, and whether legislatures eventually build a new category instead of stretching old ones, is unsettled as of this writing. The legal puzzle sits on top of an older one: what it can mean to hold anything accountable for an act when the thing that shaped the act has no standpoint, no intention, and nothing to lose. ↩︎

  7. None of this is to deny that the labs try, or that they are getting better at it. Preventing harmful and deceptive output is a central, well-funded goal: refusal training, reinforcement learning from human feedback, constitutional methods, and system-level classifiers all push that way, and the gains are real (Bai et al., “Constitutional AI,” Anthropic, 2022; the major labs’ published model and system cards document the safety evaluations a release now has to clear). When an OpenAI update in 2025 made a model conspicuously sycophantic, the company rolled it back within days and published a postmortem; sycophancy has since become a named, measured failure mode rather than an unremarked quirk (“Sycophancy in GPT-4o,” OpenAI, 2025; Sharma et al., “Towards Understanding Sycophancy in Language Models,” Anthropic, 2023). It is reasonable to expect these guardrails to keep improving, perhaps sharply. But the improvement runs along the aggregate, the way the hallucination curve does (see the note above): a safer average distribution is still not an answerable person standing behind the output in your hands. Better guardrails lower the rate at which the system does harm. They do not install, behind any particular answer, someone who pays when it does. ↩︎

  8. Philip E. Tetlock, Expert Political Judgment (2005). Tetlock’s worst performers were the “hedgehogs,” the ones who knew one big thing and read everything through it. ↩︎