Chengdu's AI+ Action Plan: The Audit Trail of a Policy That Forgets the Ledger

2600 billion yuan. 70% penetration of next-generation intelligent terminals by 2027. 100 innovation products. 100 demonstration scenarios. These are the headline numbers from Chengdu's recently published AI+ Action Plan. On paper, it reads like a blueprint for a regional AI supercluster. But as a DeFi security auditor who has spent years dissecting Ethereum's slasher protocol and tracing liquidation cascades through Anchor Protocol, I see something else: a policy that builds a skyscraper on a foundation of sand. The ledger remembers what the interface forgets. This plan's silence on decentralized verification, cryptographic auditability, and smart contract security is not an oversight—it is a vulnerability waiting to be exploited. Context: The Chengdu AI+ Action Plan is a municipal-level strategy aiming to make Chengdu a leading AI application hub in western China. It targets an AI core industry scale of 2600 billion yuan by 2030, with a compound annual growth rate exceeding 30%. The plan emphasizes "empowering thousands of industries" through AI, with a focus on intelligent terminals and agents. It proposes annual selection of 20 benchmark scenarios and a "double hundred" program. But the document is conspicuously silent on infrastructure security, decentralized compute, and on-chain verification. For a city that hosts the National Supercomputing Center and the Tianfu Intelligent Computing Center, the absence of any reference to blockchain-based AI attestation or zero-knowledge proofs is a red flag I have seen before—in the early drafts of Ethereum 2.0's slasher protocol, where a missing consensus check could have caused a permanent chain split. Core: I examined the plan through five technical dimensions that matter to any security professional evaluating a system with 2600 billion yuan at stake. First, the technical route. The plan defines "next-generation intelligent terminals and agents" but never specifies how these agents will be authenticated, how their actions will be recorded, or what cryptographic primitives will underpin trust. In my work auditing the OpenSea Seaport migration, I learned that race conditions in fulfillment logic can lead to asset loss. Here, the policy creates a race condition between AI agents and the lack of a verifiable on-chain ledger. Without a consensus mechanism or a decentralized oracle network, any AI agent operating under this plan could be subject to front-running, data poisoning, or state manipulation. The plan assumes centralized infrastructure—cloud APIs, closed-source models, and proprietary data feeds. In 2026, that is not an assumption; it is a liability. Second, commercialization. The plan relies on government subsidies, procurement, and the so-called "double hundred" projects to catalyze adoption. But there is no mention of token-based incentives, staking mechanisms, or decentralized governance. In DeFi, we know that any system that depends solely on centralized subsidies is vulnerable to rent-seeking and misallocation. The Three Arrows Capital collapse taught me that leverage without transparent risk management is a ticking bomb. The plan sets a 70% penetration target but does not define how that penetration will be measured on-chain. If the metric is based on device sales rather than usage or value transfer, it is as misleading as a protocol that reports TVL without auditing the underlying collateral. Third, security. The plan is completely silent on AI safety, ethical review, algorithm filing, and data privacy. In the current regulatory environment—EU AI Act, China's Interim Measures for Generative AI—any AI application deployed at scale must pass security assessments. But the plan provides no guidance on how local enterprises will meet these compliance requirements. During the MakerDAO CDP liquidation of 2020, I manually traced threshold calculations and found that conservative collateralization ratios saved the system. Here, there are no thresholds. The plan mentions "empowering" healthcare and finance but does not define what happens when an AI agent makes a faulty diagnosis or a flash loan-style attack exploits a misconfigured agent. Code does not lie; auditors just listen. This policy has no audit trail. Fourth, infrastructure. The Tianfu Intelligent Computing Center is expected to reach 1000 PetaFLOPs by 2025. But the plan does not address how this compute will be allocated, verified, or audited. In my work on the AI Agent Payment Layer Specification, I insisted on zero-knowledge proof-based payment channels to ensure agent privacy without sacrificing auditability. Chengdu's plan, by contrast, treats compute as a commodity. It ignores the risk that centralized compute providers could censor or manipulate inference results. The slasher doesn't forgive. Neither do we. If a single compute node fails or is coerced, the entire AI ecosystem built on top could cascade. Fifth, competition. Chengdu positions itself as the "first city of AI applications", differentiating from Beijing (research), Shenzhen (hardware), and Hangzhou (cloud). But this differentiation is fragile. Xi'an has a national AI innovation zone; Chongqing is leapfrogging with smart vehicles. Chengdu's advantage—lower labor costs and strong software parks—is temporary. To sustain a 30% growth rate, the city needs a moat. In crypto, moats are built with composable protocols, open standards, and verifiable execution. The plan offers none of these. It assumes that applications will naturally adhere to best practices. Based on my experience auditing the Ethereum 2.0 slasher, I know that security cannot be assumed—it must be encoded. Contrarian: The mainstream narrative will praise the plan's ambition and its potential to catalyze the western China AI market. But the blind spot is far more dangerous than the hype suggests. The plan's emphasis on "intelligent terminals" and "agents" inadvertently incentivizes closed, centralized architectures. Hardware vendors like Foxconn Chengdu will push proprietary AI chips. Software vendors will lock users into their ecosystems. This creates a fragmented landscape where no single protocol can guarantee interoperability or security. In DeFi, we have seen the consequences of siloed liquidity and incompatible standards—hacks, exploits, and user losses. One missing check is all it takes. The plan's silence on open standards, decentralized identity, and on-chain governance means that every AI agent will be a potential attack vector. The 70% penetration target could become a 70% vulnerability surface. Furthermore, the plan ignores the fundamental tension between AI model opacity and blockchain transparency. AI models, especially large language models, are black boxes. Blockchain requires auditable state transitions. Combining them without a verification layer—such as zero-knowledge machine learning (zkML) or optimistic machine learning (opML)—is reckless. In 2022, I tracked Three Arrows Capital's liquidation cascades and proved that internal leverage mismanagement, not protocol flaws, caused the collapse. Here, the collapse will come from external exploit, not internal leverage. The first AI agent to be manipulated via a prompt injection or oracle manipulation will bring down the entire confidence in the plan. Takeaway: The ledger remembers what the interface forgets. Chengdu has set a bold vision, but it has forgotten to build the verification layer. The policy is a set of incentives without a security model. For every 100 innovation products funded without a mandatory code audit, there is at least one critical vulnerability hiding in the integration layer. I predict that within 24 months of the plan's full implementation, we will see a major security incident involving an AI agent deployed in a Chengdu benchmark scenario—likely in financial services or healthcare. The exploit will not be due to model failure but due to the absence of cryptographic attestation. The slasher doesn't forget. Neither should the policymakers. Read the plan. Believe nothing. Verify everything on-chain.