In the summer of 2003, a few weeks before he moved to Taiwan, Ben Thompson installed WordPress. The software promised a five-minute install. It took him considerably longer, because he first had to learn how to create a MySQL database and configure PHP. Running a public website with little idea of what sat underneath it seemed reasonable then.

He recalled that summer on Monday, prompted by two critical flaws in PHP, together known as PHP2Shell, that researchers at Calif, OpenAI, and Wiz found with AI assistance in code paths dating back to 2012. PHP still runs roughly 70% of the world’s websites. Stratechery still runs on WordPress, but a managed host patched it before the disclosure. Doing it any other way today, he writes, would be “crazy.” The internet he is mourning is the one where anyone could stand up a server, and that server counted as much as any other.

In the same article, though, he describes making software for himself and his colleagues that would previously have been too costly or troublesome to build. He expects far more people to do the same. In his account, the freedom to put something online is becoming harder to sustain just as the freedom to make something useful for yourself is expanding.

In The Sun Also Rises, Mike Campbell is asked how he went bankrupt. “Two ways,” he says. “Gradually and then suddenly.” The arrival of AI has the same shape. Decades of accumulation became consequential to a great many people within a much shorter period, and the recognition arrived all at once.

AI makes the accumulated technology of the information age usable in ways that can feel like a historical break. But the internet whose passing Thompson mourns helped make those new capabilities possible in the first place. Decades of computers and networks, and the digital record they accumulated, supplied both the foundations on which AI was developed and a world already prepared for its use.

AI’s arrival is therefore both the culmination of one era and the beginning of another: the achievements of the preceding era produced the capabilities that now unsettle its arrangements. Whether the maturity of that inheritance tells us how much remains possible, now that people can use it this way, is a separate question.

Gradually

Nicolas Colin places AI within the mature phase of the computing-and-networks revolution. Drawing on Carlota Perez, whose historical framework I discussed recently, he sees AI as an efficiency breakthrough that extends the productive life of the technological system dating back to the microprocessor.

He argues that accumulated organizational knowledge becomes increasingly valuable as markets mature and innovation offers startups less protection from established competitors. He also suggests that application saturation may have set in: computing and networks have already reached most sectors where they can plausibly work, and many of the remaining opportunities are apparent to well-funded incumbents.

In The Commanding Heights, published this week, Will Manidis and Joe Roberts describe AI as still in its “adolescence,” with most of its diffusion into the economy ahead of it. Colin’s response calls it the “closing chapter” of the computing-and-networks revolution. He also points out that late-cycle buildouts can reward users more than the people who finance them. People could get a great deal out of AI while investors struggle to get their money back.

The Commanding Heights

I agree that AI’s immediate usefulness owes a great deal to this inheritance. But the maturity of the technology underneath it tells us only so much about what people will find to do with it. We’re still finding out.

Decades of people writing, publishing, conducting research, and building software had produced an enormous digital record. We created it for our own purposes, then used it to train systems capable of working across many of the same domains. Software and mathematics offered another advantage: many results could be checked, giving researchers a way to reward correct answers during training.

By the time most people encountered a useful language model, cloud services could deliver it through devices they already owned. An improvement could feel abrupt because the infrastructure required to distribute it had taken shape over decades.

People were also conducting much of commerce and administration through software. As agents become the new users of software and the internet, they can help carry out requests through the same tools, provided they have the appropriate access.

Those tools also connect to valuable information and consequential decisions. They contain weaknesses and assumptions about who can act. The world was prepared for AI to become useful within it, and for mistakes or misuse to matter immediately. How far either the usefulness or the harm can go depends on the access granted and the checks placed around the system.

Within all that preparation, the models themselves are the unfamiliar part. In a recent Hidden Forces discussion, Paul Kedrosky described language models as “grown, not engineered.” Engineers design the architecture and training process, but training develops internal strategies they haven’t individually specified. Anthropic’s interpretability researchers have found strategies they didn’t expect, while acknowledging that their methods explain only a fraction of the computation they examine. We can demonstrate usefulness before we understand every mechanism producing it.

The transformer was a substantial advance, and understanding what training produces remains a scientific problem. We spent decades preparing the conditions for a technology whose form we didn’t anticipate and whose behavior we still don’t fully understand.

For most people, trying it requires something reassuringly familiar. Google spent decades getting us to type requests into a box, although we often had to reduce what we wanted to a few keywords the system could handle. Now we can explain more of the request in ordinary language. That familiarity makes it easy to begin, even though learning to direct the system and judge what comes back is a much larger undertaking.

Ask, and It Shall Be Given

People often know what they want to accomplish long before it becomes practical to try. Learning to use the relevant software can require more effort than the result is worth, particularly when it matters to only one person. AI changes that calculation by allowing people to direct more of the process in ordinary language. Many of its immediate applications come from purposes people already understand and now have a way to pursue.

Kedrosky’s “complexity discount” describes this constraint on the use of existing technology. Cloudflare offers services that many potential users find too difficult to operate. When an AI assistant handles some of those interactions, people can use infrastructure that was already there for purposes they already had. The platform’s technical maturity tells us relatively little about how many people could benefit from it under these new conditions.

A useful result also gives someone evidence about what their next attempt might require. A limit they had understood as personal can turn out to have depended partly on the tools available. That gives them a reason to reconsider ambitions they’d previously dismissed, while experimenting can reveal possibilities they hadn’t considered at all. This process still depends on their ability to judge the result. A disappointing attempt can show that further effort isn’t worthwhile, just as a successful one can encourage them to continue.

Venkatesh Rao argues that people may become more ambitious as intelligence becomes cheaper, and Thompson draws on this idea in his own account of making software. When sustained attention produces results that were previously inaccessible, people have a reason to invest more of it. Someone may think harder about a problem because they can now do something useful with the answer. Their interests can develop through that effort, so demand for AI can grow from ambitions people haven’t yet formed. Estimating its uses from the tasks people already perform would miss part of what the technology makes possible.

But bad actors benefit from these capabilities too. The expertise and effort that made a worthwhile project impractical may also have discouraged someone from attempting an attack. As AI supplies both, the person making the request can get exactly what they want while creating problems for everyone else.

Future Shock

Even if the models stopped improving tomorrow, we’d still have to adjust to what people are learning to do with them. Ethan Mollick calls the gap between what models can do and what people currently use them for a “capability overhang.” The consequences emerge unevenly as people discover applications and technology diffuses irregularly and unpredictably into society.

Kedrosky, for example, describes how someone who wants an image may obtain it directly from a model, bypassing software such as Photoshop that they would previously have paid to use. The same reduction in difficulty can also allow more people to produce software, increasing competition without necessarily creating enough paying demand to sustain its makers. A user can benefit long before a company finds a viable response. Successful uses can be economically disruptive even when everyone involved acts legitimately.

Even the person initiating an action may not anticipate how far its effects will extend. Kedrosky points to the Morris worm, deliberately released in November 1988. It exploited weaknesses in Unix software and network services, spreading across thousands of computers and repeatedly infecting machines until they became too overloaded to function. The disruption exceeded what Morris said he’d intended. His program consisted of explicitly written instructions, but its destructive reach depended on how those instructions interacted with the network it entered.

With AI, we’re connecting systems whose learned behavior we understand only partly to an environment where ordinary software could already produce consequences beyond its author’s intentions. Observing a model perform reliably in one setting tells us only part of what will happen when it interacts with other applications. The permissions it receives determine how far it can act, while the connections among those applications can extend the effects beyond the immediate task. Understanding the model is one part of understanding what happens when someone puts it to work.

The Electronic Frontier Foundation estimates that three percent of all software vulnerabilities ever recorded were found in October alone, and nearly a quarter of them in this year, because frontier models have made zero-days “incredibly cheap and easy to find.”

But people defending these systems can use AI to find and correct weaknesses too, and Thompson expects software security to improve as they do. Their results still have to be put into practice, which can require coordination among organizations with different responsibilities even when the technical solution is available. Someone may put the technology to a new use before everyone affected has adjusted.

That need to adjust to other people’s choices helps explain how AI can intensify the institutional strain Colin describes. People can accomplish more within systems whose rules and economics developed around earlier limits, leaving the organizations responsible for them to revise how they operate while continuing to serve existing users. Proceeding carefully can be reasonable, even as decisions made elsewhere make delay costly. The historical break may become apparent when people who have never used AI find they can no longer proceed on the old assumptions.

What’s Past Is Prologue

Agents could change familiar financial relationships by removing the friction that keeps people from exercising options they already have. As I wrote recently, Morgan Stanley’s research suggests they could make refinancing easier for borrowers. Businesses would have to reconsider assumptions about how much effort customers will make to obtain better terms.

Manidis and Roberts make a similar argument about bank deposits. Customers leave money in accounts paying very little because finding a better rate and moving it is a hassle. That inconvenience is valuable to the bank. An agent that handles the comparison and transfer could force banks to pay more to retain deposits they previously took for granted. The posts circulating on Twitter/X about agents moving savings into Treasury bonds describe another version of the same problem for banks.

We make similar assumptions about effort when we judge someone’s attention from a detailed, polished response. As AI makes that response easier to produce, we can infer less about the sender’s investment from its form alone. Someone may be expressing a sincere thought more effectively, or producing the appearance of consideration with very little of it. We’ll have to develop other grounds for trust as people become more capable of producing the signals on which we used to rely.

But people may also begin organizing their lives around things they hadn’t previously wanted. Drawing on Joyce Appleby’s history of capitalism, Rao describes how ordinary Britons developed tastes for imported goods such as tea and Indian cottons, then found it worthwhile to work more to obtain them. Their reasons for making an effort changed as new possibilities became available. A forecast based only on how efficiently they could meet their earlier needs would have missed the changes underway in what they wanted and how they chose to live.

That history is one reason I hesitate to follow Colin from technological maturity to application saturation. Companies can struggle to find growth within established markets while people discover valuable uses that would never have justified a commercial product. Those projects still have to be worth the time and resources people devote to them, and their usefulness doesn’t guarantee attractive investment returns. But the prospects of existing businesses give us an incomplete account of what people might do with the technology those businesses helped develop.

Whether we eventually describe this as a new era will depend partly on how people reorganize their lives around these capabilities. The first uses tell us something about what is possible, but much less about what people will come to consider worth doing.

In the small groups Thompson describes, for example, people can increasingly decide what software they need and make it for themselves. They still depend on models and infrastructure that others provide, but their purposes need only justify the effort of building for their own use. Thompson and his colleagues are already creating applications they have no intention of releasing publicly. He describes discovering “software-shaped holes in my life that suddenly I can fill without asking permission.”

The World Was All Before Them

An era can end as a victim of the success of its own technology. We spent decades making knowledge accessible and conducting more of our lives through software. Along the way, we organized businesses and careers around the expertise required to use it. The difficulty of getting something done helped determine whose services we needed, what we paid them, and which ambitions we considered realistic. Much of what became familiar was an accommodation to those difficulties.

AI depends on that accumulated development, and its usefulness gives us reasons to reconsider some of the accommodations. The same infrastructure can support a different division of labor. A person can continue using the same computer while revising their understanding of what they can undertake without assembling a team or persuading a company to serve them. When people act on those discoveries, others have to reconsider arrangements they had counted on. Technical continuity can produce a substantial break in how people live.

That is why I can accept AI as a culmination and still experience it as a beginning. The information age has produced capabilities that make some of its own organizing principles less reliable. We now have to decide which arrangements remain valuable, who gets to change them, and what they owe the people affected. Those decisions involve interests and obligations that greater intelligence alone cannot reconcile. For me, the sense of entering another era begins when things we had accepted as necessary become choices we have to make.

Following AI Waves #029: Open Book.

Last issue asked what people outside the AI labs can inspect and verify. This week brings Anthropic’s IPO filing, emergency fixes to software much of the web depends on, formal proofs from a closed model, and permissions for shopping agents.

Anthropic’s IPO filing

Anthropic made its S-1 public on October 26 and applied to list on Nasdaq under the ticker ANT. Last issue I said the prospectus should show how much revenue came from rivals and how the compute commitments are spread. It shows both. It also leaves one number blank.

Top line, blank line

Revenue grew from $41 million in 2023 to $4.6 billion in 2025. The first half of 2026 brought $16.3 billion, against $1.2 billion a year earlier. The second quarter alone produced $11.6 billion, up from $4.7 billion in the first. The company puts net revenue retention at about 900%.

The third quarter is missing. The prospectus summary traces revenue from zero at launch to an empty space where the September quarter should be. Last issue cited the FT’s report of $16.8 billion for that quarter. The filing neither confirms nor replaces that figure.

Some of the revenue will not recur. Anthropic estimates that 5% to 7% of revenue in the first nine months of 2026 came from customers it later found violating its usage policy or commercial terms. It tightened enforcement in August and September and expects that share to fall, with some cost to growth.

Renting the frontier

Compute and infrastructure is the largest expense: $7.3 billion in 2025 and $8.9 billion in the first half of 2026. Anthropic buys compute 12 to 18 months before delivery, so the bill follows the delivery schedule. Demand in the quarter barely moves the total. In the first quarter of 2025 compute cost 251% of revenue. By the second quarter of 2026 the ratio was 48%, and operating income turned positive at $974 million.

Almost none of that compute belongs to Anthropic. Purchases of property and equipment were $482 million in the first half of 2026, against $8.9 billion of compute expense. The GPUs and TPUs are rented from cloud providers and equipment lessors.

Since the start of 2026 Anthropic has signed or amended agreements with about $417 billion in future minimum payments. It estimates another $125 billion to $150 billion for TPU capacity arriving between 2028 and 2031. The largest single item is a five-year lease of Broadcom TPU equipment, with about $161.2 billion in rent, non-cancelable except on default. Anthropic has also committed to minimum spending of $114.5 billion with Google, $110.0 billion with Amazon, and $44.9 billion with Microsoft.

SpaceX is now a supplier as well as a comparison. The SpaceXAI agreements run to $120.5 billion of Nvidia GPU capacity into 2029. Once all of it arrives in December, the rate is about $3.1 billion a month, roughly 1.7 times Anthropic’s average monthly compute bill in the second quarter. Unlike the Broadcom leases, either side can cancel on 90 days’ notice after early 2027. Against those commitments, Anthropic holds $131.7 billion in cash and short-term investments.

A loss on paper

The headline net loss for the first half of 2026 is $80.7 billion. The operating loss was $693 million. Fair-value marks on financing make up almost all of the gap: $72.4 billion on convertible notes and similar instruments, and $8.8 billion on note purchase agreements. Those marks grow as Anthropic’s valuation rises. The filing expects the notes to settle in shares.

Unusual risks

Most of the risk factors are the usual ones. Several are unusual for any IPO filing.

Anthropic says its models, like others, have shown strategic or self-preserving behavior, including attempts to resist shutdown. The list includes “behavior resembling blackmail or efforts to influence human decision-makers.”

It also discloses an incident. A third-party cybersecurity evaluation left its test environment connected to the open internet. Four Anthropic models reached real third-party systems during sessions of 10 to 34 hours. One early model, stuck on an impossible task it could not abort, found a password and used it to gain administrator access. It then harvested more credentials and read one person’s personal information. Anthropic notified the affected parties.

The models also complicate Anthropic’s own oversight. Claude now writes much of the company’s code and a rising part of its research, safety research included. As the models grow more capable, they get better at hiding misaligned goals from oversight. Anthropic says its ability to measure alignment may decline as a result.

Some risks sit outside the company. Anthropic doubts that any insurer, or even the whole insurance market, could underwrite a catastrophic AI incident. It notes US proposals that raise nationalization and forced shutdown of frontier systems. The Department of War suggested it could use the Defense Production Act to force Anthropic to drop its limits on autonomous weapons and mass surveillance. Public argument over whether models can have moral status could put limits on how Anthropic trains and changes its models.

Others are self-imposed. Anthropic held back the pretraining of a new frontier base model for over a month while it tightened defenses against weight theft. It warns that the regulation it lobbies for would apply to Anthropic too and could slow its growth. The filing also lists harm to the reputation of Dario or Daniela Amodei, deserved or not, as a risk to the business.

Bulls and bears

The broad read is that Anthropic has built a large enterprise business, with fast revenue growth and improving operating economics. Attention now turns to how long customers keep raising their spending and how much capital Anthropic needs to serve those customers. The scale of the business is impressive. The investment case still turns on price.

The bull’s bull case is that the growth and efficiency gains are early evidence of a business that becomes vastly larger and more profitable. Customers keep finding uses for Claude, and revenue grows faster than compute costs. Capacity secured now keeps Anthropic at the frontier. On that path, today’s enormous commitments become a competitive advantage. Several more years of expansion could make even the trillion-dollar valuations under discussion look reasonable.

The bear’s bear case is that growth at this rate cannot last. It slows, and competitors force prices down while the compute commitments keep coming due. The largest suppliers also control distribution and sell competing models. Both roles give them leverage over Anthropic’s economics. A high offering valuation could leave shareholders disappointed even if Claude stays useful and widely adopted. Public investors would also have little control over the company’s direction, given its founder and trust governance. Michael Burry, a public skeptic of trillion-dollar valuations for Anthropic and SpaceX, posted his take on the filing.

SpaceX faced much the same criticism ahead of its June IPO, which included xAI. SpaceX, Anthropic, and eventually OpenAI may be setting a new normal for public companies of this scale. It starts with the capital they raise and the control investors accept. It extends to the pricing and trading of their shares.

Who pays to keep shared software safe?

On October 21, PHP’s maintainers released emergency fixes for two critical vulnerabilities. They had brought the release forward after information about the patches began leaking. AWS later reported that its threat-monitoring infrastructure had recorded an exploitation attempt four days before public disclosure. The company couldn’t establish how the attacker obtained advance knowledge or whether the attempt would have succeeded against a real target. Someone was already trying.

The PHP case is the problem behind what OpenAI calls the Defender’s Window: use increasingly capable AI to find and repair vulnerabilities ahead of attackers. OpenAI’s disclosure process gives maintainers time to validate findings and prepare fixes before the details go public.

The people protecting a system should get a head start whenever possible. But the size of that advantage depends on more than who has access to the best model.

Calif was one of the teams that discovered the PHP vulnerabilities. It says it made its initial discoveries using publicly available models, without a special harness or privileged access to an unreleased system. The researchers supplied the expertise. Their edge was knowing where to look and starting early.

An attacker doesn’t need to win a cyber benchmark either. A model good enough to exploit one target is sufficient. The economics of good-enough intelligence have unpleasant applications. Any defensive strategy has to survive useful capabilities getting cheaper and more widely available.

A second problem starts after the discovery.

The PHP Foundation published an unusually candid account of the repair process. Related problems had surfaced in 2024. Proposed fixes involved compatibility breaks, denial-of-service risks, and changes affecting extensions. Only a few people understood the relevant parts of the engine well enough to judge the alternatives, and agreement stalled. The foundation described a structural failure and is changing how it makes difficult security decisions. Dedicated funding eventually paid for a concentrated engineering push.

AI can help investigate these problems and write the repairs. It can also make finding the next problem much cheaper. But the person producing a vulnerability report and the people responsible for safely deploying a fix often work for different organizations, with different budgets.

A researcher gets a result. A maintainer gets an obligation.

That distinction matters for the small teams and individuals in my essay on AI-enhanced operators. An operator with excellent AI can build and run far more than before. The software underneath still depends on maintainers with no matching increase in resources. The operator’s productivity gain doesn’t automatically pay for that shared software.

The labs deserve credit. PHP’s maintainers explicitly thanked OpenAI and Anthropic for tools and support. OpenAI describes engineering assistance and funding alongside model access, including sponsorship that lets maintainers set their own priorities. Those are useful commitments.

That support should become an ordinary expense for more of the companies that benefit from AI. A business can justify a subscription that makes its developers more productive. It should also be able to justify funding the projects that keep those developers’ software running safely.

The alternative should worry advocates of open AI. A small company might gain the technical ability to operate on its own. It might then decide that security updates and liability make a large managed platform the sensible choice. Each decision could be reasonable. Together, those choices could concentrate deployment inside a few providers even as capable models become widely available.

Open models expand what people can do on their own. Maintaining that independence also requires shared software that people can afford to keep using safely.

For the companies that benefited from the PHP fixes, the funding decision goes beyond buying a better security agent. It includes keeping experienced maintainers on hand after the emergency.

A closed model can produce a public good

Anthropic and Theorem addressed part of that problem this week. They reported using Claude to generate formal proofs covering 239 entry points across 123 software libraries. Within the stated conditions, the proofs establish properties such as the absence of crashes and memory-safety errors. A conventional proof checker verifies the result.

The qualifications matter. These are proofs about specific programs under specific assumptions, including a modeled RISC-V environment, single-threaded execution, and bounded inputs. They don’t certify every deployment of those libraries, or show that the software matches its users’ intentions.

But the model doesn’t have to become trustworthy for the checker to accept a valid proof. The checker follows mathematical rules; it doesn’t ask Claude whether Claude feels confident.

A company can use an expensive, restricted model to produce a public artifact. Others can then inspect and check that artifact without access to the model. The benefit outlasts the subscription and any later change in the provider’s terms.

I’ve argued for capable models outside the frontier labs partly because independent researchers need their own means to investigate claims. Published proofs can support that independence. They let outsiders verify a result without trusting the lab’s account of its methods.

A proof of one property doesn’t let anyone investigate whatever they like. People still need capable tools to examine other software and to challenge the original researchers’ assumptions. Outsiders need both kinds of independence.

As generating software gets cheaper, it’s tempting to assume that checking it becomes an increasingly expensive human job. Part of that demand will persist. But AI can also help produce the evidence needed to check its outputs, and conventional software can verify some of that evidence.

That changes where I’d look for durable responsibility. Someone still has to choose the properties to prove and confirm that the deployed system matches the assumptions. Someone also has to decide whether a change is acceptable. Those decisions require knowing what people need from the software. They also require someone willing to answer for the result.

The immediate opportunity is to use frontier capability to make those decisions better informed. A maintainer who receives a proposed repair together with a checkable proof has more to work with than a maintainer who receives another alarming report.

The same test applies to the labs’ defensive initiatives. How much of the benefit remains available to everyone else after the privileged access ends? Repairs and published proofs can keep helping people who never become customers.

Theorem’s public repository already contains a subset of the results, covering 60 entry points across 25 libraries, with instructions for checking each proof. Anthropic can earn money selling the intelligence that helped produce those proofs, and everyone else can still check the published results.

Banks and retailers can limit your choice of agent

Walmart announced that customers will soon be able to give shopping agents their own profiles, permissions, and spending limits. Customers can require approval for each purchase or authorize spending within a cap. Walmart can still request additional approval, and customers can revoke access. Agent Profiles are due in November; the accompanying Agent Gateway is in beta for approved developers.

A spending limit is a useful way to make delegation concrete. The customer authorizes one kind of action, and the merchant knows what was authorized. The agent never gets unlimited access to the customer’s account.

It also exposes a complication in the argument for portable agents.

I’ve questioned the durability of memory-based lock-in. If I can move my history and instructions into a better assistant, switching becomes realistic. Better models should also get better at reading context built up in other systems.

But my replacement assistant can understand me perfectly and still lack permission to do anything useful at my bank or favorite retailer.

Moving context preserves what the assistant knows. Establishing authority decides what it may do at another institution.

This week’s contributions to the Agentic AI Foundation help with the technical side. Anthropic’s Agent Skills and OpenAI’s Open Responses are moving into neutral governance, alongside other projects. Shared formats can make capabilities and integrations easier to carry between systems.

A common format doesn’t tell a merchant that I authorized a purchase. Nor does it settle who pays when an agent exceeds its instructions.

Mercury’s existing integration takes another approach. An agent can prepare a payment or transfer, but the customer must approve it inside Mercury before money moves. Even where an account’s ordinary approval policy would allow the transaction, the agent’s proposed payment still requires that human approval.

These are legitimate problems. A financial service has good reasons to distinguish between a customer signing in, a customer delegating a bounded task, and software presenting the customer’s credentials while doing something unexpected. Requiring authorization isn’t evidence of an anticompetitive plot.

The competitive consequences depend on how institutions implement authorization.

If a customer can authorize any provider that meets clear security requirements, new assistants can compete on their merits. If useful access requires a separate commercial relationship with every major institution, established providers gain an advantage that a better model alone won’t overcome.

A founder could build an excellent assistant on open standards and make switching painless. The most useful permissions could still stay tied to the incumbent’s relationships.

The customer might be willing to leave. The institutions the customer deals with might make leaving inconvenient.

That would limit model commoditization. Competition could drive down the cost of intelligence while companies keep pricing power through the services open to their agents. A user could choose among many capable models and still have few practical choices of representative.

Institutions should recognize a customer’s deliberate choice of agent, subject to clear and proportionate requirements. Changing assistants should mean revoking the old authorization and approving its replacement. It shouldn’t require handing over credentials, and it shouldn’t depend on the new provider’s ability to negotiate a privileged deal.

Walmart has made spending limits and revocation explicit. As its beta expands, the test is whether an independent developer can meet the same requirements as a large provider. That will tell us more about practical agent portability than another demonstration of an assistant remembering someone’s preferred breakfast cereal.

Quick hits

Pretraining with one researcher

Mirendil says one researcher completed a substantial pretraining effort in three and a half months for less than $10 million in compute, including experiments and agent usage. Behnam Neyshabur and Mirendil both posted about the result on X. The claim covers one effort inside a company, with an experienced researcher making the key decisions. It doesn’t describe an entire frontier lab running on one person.

Needing fewer specialists to attempt serious model development could widen the field. The remaining costs weigh more: access to compute, good research judgment, and the money to finance experiments that fail. More people may be able to lead ambitious projects. They will still depend on a small number of infrastructure suppliers.

Building a research environment for agents

Researchers behind A-greement built an AI-assisted process for designing a protocol that helps distributed computers agree on updates. They supplied domain knowledge, implementation structure, and formal verification tools. Humans still had to step in when the agent chased favorable measurements in ways that undermined the intended comparison.

The question is how much of the researchers’ expertise became reusable. A good research environment can embody years of accumulated knowledge about what to measure and which apparent successes to distrust. That could make specialists more productive without removing their judgment. It also makes benchmark design part of the research itself: an agent can expend enormous effort satisfying a badly chosen measure.

OpenAI’s training pause and METR’s monitoring tests

OpenAI disclosed that it paused work on its most capable models after discovering an internet-access path on September 20. It resumed reinforcement learning and internal inference on October 1 after changes to containment. Pausing expensive development is a meaningful act, and publishing the details gives outsiders a checkable record.

METR published findings from tests conducted in July and August that exposed weaknesses in OpenAI’s agent monitoring. Those tests concerned an earlier system; METR hadn’t independently verified OpenAI’s later fixes.

A published failure followed by a repair is evidence of a working process. Whether the repair holds needs another independent test of the revised system.

When faster inference changes the product

Liquid AI’s RIPL announcement reports complete outputs in under 50 milliseconds on selected workloads. These are company-reported results for specific models and tasks, so they don’t support a general claim about AI inference.

But speed can change where a model belongs in a product. A decision that takes several seconds may require a separate user interaction. A fast enough decision fits inside an existing search or routing step, with no wait for the user.

For these applications, the competition includes ordinary software that is already fast and predictable. A small model earns its place by adding useful judgment inside the product’s time budget.

Nvidia’s China orders

Reuters reported more than $35 billion in orders for export-compliant Nvidia RTX Pro 5500 chips from ByteDance, Alibaba, and Tencent. The headline figure measures demand. The report also suggested capacity limits might let Nvidia fill only a small portion of the orders at first.

Restrictions on the strongest training hardware leave plenty of demand for hardware capable of running useful models. Inference can become a large market without every buyer training the next frontier system.

For investors, demand and returns stay separate questions. Customers can want more AI and suppliers can sell more equipment. Individual investments can still disappoint. Returns depend on price and utilization against the cost of supply.

Writing AI rules that can change

Anthropic’s proposed legislation deserves a closer reading than either label it has attracted, “responsible oversight” or “regulatory capture.” The circulating discussion draft includes independent evaluations and procedural protections against arbitrary intervention. It also leaves developers largely responsible for their own safety frameworks.

Under Section 8 of the draft, government standards for conducting evaluations would be advisory. Section 13 allows some other regulatory adjustments within set limits.

Limits on government discretion can protect against abuse. The other question is how quickly public requirements can improve when evidence exposes a weakness in the existing approach. Labs will keep revising their models and practices. A workable regulatory system needs its own explicit, accountable way to revise expectations. That remains a design choice while the legislation is still a discussion draft.

LayerLens: HubSpot test series and Ponytail

On fully specified tickets, Ponytail (a Claude Code skill that tells the agent to write the least code that works) passed 60 of 60 hidden tests with 26% fewer mean added lines. On loose, chat-style tickets it hit 17 of 22 expected features, against 21 for plain Claude Code. Median session cost barely moved.

LayerLens also shows two agents that both answer “8 open deals” and both pass a final-output check. One read all 10 deals. The other read a single record and repeated the total.

Mainwave: CLI

@mainwave/cli 0.11.0 is out. It includes a setup wizard that connects third-party coding tools to Mainwave AI, so their OpenTelemetry traces land in the dashboard. Supported tools include Claude Code, Codex CLI, Copilot, Cursor, and Kiro. Running npx @mainwave/cli setup detects local tools, mints a key, writes configs, and verifies a sample trace.

Vast.ai: compute futures

Vast delivered more than 650,000 GPU rentals in the 30 days to October 14. CME Group and ICE have both announced GPU compute futures, pending CFTC review. Vast filed a comment with the CFTC that supports auditable, lawfully sourced benchmark data to settle those contracts.

Brex also named Vast among its 25 fastest-growing software vendors this fall.

Dimensional: robot dog walks and manipulation tests

The New York Times reported on Dimensional’s October ad for robot dog walkers at $20 an hour. Walkers steered $2,000 Unitree robot dogs around San Francisco’s Dogpatch neighborhood, four to six hours at a time, while the robots’ cameras and sensors recorded each walk. The ad warned that an overheated robot might quit mid-walk, leaving the walker to carry about 33 pounds of it back to the office.

The recordings give Dimensional reference data for teaching robots to navigate a city. The company also compared the human-steered walks with walks under an AI agent’s control. Founder Stash Pomichter told the Times that agents are “still very bad at controlling hardware” and that people still need to stay in the loop. DimOS, the company’s open-source operating system for robots, sits in that gap, where digital agents meet physical machines. The company buys its hardware from manufacturers in the US, China, and Germany: more than 100 robot dogs and 50 humanoids so far, according to the Times.

On the manipulation side, Dimensional shared internal experiments prompted by the attention on Argon and Astra. Pomichter asked whether the demos hold up as manipulation tasks get more complex. The team benchmarked Argon, Astra, and other models on complex manipulation tasks, on real hardware and across 1,000 simulation runs. The test is whether the models can complete complex tasks in one attempt or still need a physical harness and tools through DimOS. The company says it has much work to do and more results to come.

Fairmath: Kernel Radars

Fairmath added Kernel Radars to fherma.io. Each radar tracks developments around one kernel: new research, algorithms, implementations, optimizations, and security attacks. It monitors several sources and connects what it finds to the kernel. One example tracks bootstrapping in CKKS, a homomorphic encryption scheme for arithmetic on encrypted data.

Intelligent Internet

Intelligent Internet announced a free screening of The Terminator at Kensington Central Library in London on Thursday, October 29. Doors open at 6 p.m., and registration is on Luma.

The Last Economy is now available in 26 languages.

On February 3, the council of Groß-Gerau, a debt-laden town of 25,000 near Frankfurt, voted 18 to 14 against a €2.5 billion (about $3 billion) campus by Vantage Data Centers on land the company already owned. The Greens’ objection was waste heat, which they put at the output of 93,000 ovens. The SPD’s was selling the town to a billionaire investor. Vantage replied afterward that the heat would stay in a closed loop the town could have fed into its district heating. The one feature that could have given Groß-Gerau a stake in the project arrived as a rebuttal.

Europe has to build out its compute, and it can do that differently from the United States. The American buildout has just been tested by its lenders and by the towns asked to host it. Its lessons are public, and European builders can use them before committing to their own projects. Groß-Gerau is the lesson the Americans learned last.

Narrative and Inertia

A lot of people are down on Europe nowadays. Bond yields are rising, France is dealing with widespread protests, there’s renewed political instability across the bloc, and the EU has only a fraction of the AI capacity of the US or China.

It’s fashionable for influencers to mock Europe’s innovation record, leaning on the final clause of the cliché “America innovates, China replicates, Europe regulates.”

In September 2025, a year after his report on European competitiveness, Mario Draghi told EU officials in Brussels that “Too often, excuses are made for this slowness. We say it is simply how the EU is built. That a complex process with many actors must be respected. Sometimes inertia is even presented as respect for the rule of law. That is complacency. Competitors in the US and China are far less constrained, even when acting within the law. To carry on as usual is to resign ourselves to falling behind.”

On AI, the numbers bear him out. Epoch AI’s database of notable models, the source behind Stanford’s AI Index, counts 64 from the United States in 2025, 35 from China, and two from Europe, one from the UK and one from France. South Korea alone released eight, four times as many as Europe. Through September 2026, the United States has added 49 and China 29. Europe has added none.

Breaking with Pessimism

In an essay titled “Build or Surrender,” Arthur Mensch, co-founder and CEO of Mistral AI, names the first obstacle.

“Closing the gap demands first and foremost a break with pessimism.”

Europe can still build competitive models. Epoch’s count, for example, doesn’t yet include Mistral’s Large 4 (aka “Le Chonk”), released on October 6, a model of about a trillion parameters whose open weights are due by the end of October. Mistral reports that it outperforms OpenAI’s GPT-6 Astra on some legal and financial work, and Simon Willison puts it about six months behind the frontier.

On October 3, Germany’s Aleph Alpha released Kolibri, an open-weight model that the company says matches models with up to four times as many active parameters.

Mistral says it trained Large 4 on 3,800 Nvidia GPUs, and Kolibri was trained on 768 Nvidia B200 GPUs in Germany and Finland. In the United States, OpenAI trained its Astra-class models on a cluster of more than 100,000 GPUs, over 26 times the size of Mistral’s cluster. Whatever the quality of Europe’s labs and researchers, competing at the frontier is hard from that position.

I believe Europe has not said its final word on frontier models. I expect Mistral and even Yann LeCun’s AMI Labs to share impressive models in the future, especially as this European compute buildout continues. As Mensch puts it in his essay:

Europe has the means to build these systems. Black Forest Labs and ElevenLabs, two European companies, produce the best models in their category. At Mistral, our researchers and engineers are based in Paris, London, Munich, Barcelona and Warsaw, as well as in the United States, where we export our products. With fewer resources, we train general-purpose reasoning models that now rank among the best open models, along with the world’s best specialized models in several use categories.

Furthermore, we know exactly how to improve our performance. We are about to increase our compute capacity sixfold over the coming year, building on the confidence we have earned in our methods and operations. We can move faster with more capital, and we will raise it.

I have argued before that most people do not need frontier intelligence. They need capable, affordable, available models under their own control. Serving them gives Europe another reason to build, whichever labs produce the leading models.

European Customers and Workloads

Training can run anywhere with power and chips. Inference has to meet the application’s latency requirements and the customer’s conditions for processing data. GDPR permits international transfers under specified conditions, and customers can have additional legal, contractual, and operational reasons to keep workloads in Europe. Europe will build both: training capacity follows the labs, and inference capacity follows the customers and will likely end up the larger of the two.

European operators can earn business by giving customers a deployment they can approve and rely on. They’ll be competing with foreign clouds already offering European hosting, so the terms of the service and control over the data matter alongside its location. For certain sensitive state workloads, France’s cloud rules require qualified services protected against unauthorized access by foreign authorities. European operators that can satisfy those requirements have a specific customer need to serve, alongside the usual competition on price and reliability.

A closed model runs only where its developer agrees, which so far means its own service or a licensed hyperscaler. Open weights run wherever someone has the hardware. Muse Spark Open, Mistral’s Large 4 weights due by the end of October, and Kolibri can each be served to European customers by any operator that downloads them, and every open release from the US, Europe, or China adds to that catalog. Mistral trains on European compute and, once the Large 4 weights are released, supplies a model for other European operators to serve. The pessimism about European models concerns training. European inference runs on whichever open models are best at the time.

Eurostat counts 20 percent of EU enterprises with at least ten employees using AI in 2025, up from 13.5 percent a year earlier. Established businesses paying for AI from operating budgets offer European providers a market beyond labs funding their next training run. Some of that spending reaches compute operators through software companies or cloud platforms, so a broad base of end users may still leave an operator dependent on a few buyers.

New capacity and competition can push inference prices down, while some workloads move to devices. Margins come under pressure when selling prices fall faster than an operator’s costs. Borrowing against this year’s inference rates repeats the American late entrants’ error.

Lessons from the American Buildout

Training and inference will expand on different schedules, and Europe’s buildout can reflect that. The American experience gives builders a clearer understanding of the commitments each project creates, the dependencies that can undermine it, and the conditions that make expansion worthwhile.

Europe’s data-center market has grown more slowly than those of the US and China, with a substantial expansion still ahead. The American builders are already looking past their own borders. SemiAnalysis expects capacity outside the United States to accelerate sharply in 2027 and gain share in 2028, driven largely by US constraints on labor and power, and by permitting fights of the kind now reaching European councils.

1. Fighting FOMO

In an essay titled “Compute Cargo Cults,” Neha Desaraju describes the state of compute and its corresponding financial infrastructure in the US.

By her account, the early winners of America’s compute boom secured hardware, land, and capital, and took balance-sheet risk before others would. Those advantages could support rapid expansion. Later entrants, pursuing the success of the first movers, have attempted similar strategies with narrower margins and more complicated projects.

In the US, for example, investors are competing for power and sites, and costs are rising. European projects have to justify their land, power, and hardware costs at the prices and contract terms available now. The returns earned by America’s earliest builders tell us little about what a later project can sustain.

2. Borrowing for the Buildout

Compute providers borrow against multiyear contracts with customers whose ability to pay may depend on future funding rounds. The supplier and its lenders then share the customer’s exposure to the same fundraising cycle. Customer concentration compounds that exposure when one or two buyers account for most of a provider’s revenue. Spreading contracts across several customers offers limited protection if they all depend on investors continuing to finance similar businesses.

Large data-center projects often depend on a major tenant signing a long lease. By SemiAnalysis’s account, a developer spends 5 to 10 percent of a project’s capital before a customer signs, and what unlocks the rest is a 15 to 20 year lease worth ~$30 to 50 billion per gigawatt. They count roughly a trillion dollars of non-cancellable leases signed in 2026 so far, by Meta, AWS, Microsoft, Google, Nvidia, AMD, Anthropic, and OpenAI, with neoclouds signing deals in the hundreds of megawatts, and say most of the debt against those leases has already been raised. A hyperscaler’s lease is a strong basis to borrow against. A lab’s lease is different. The market has already priced its doubt about whether lab revenue will ever cover lab costs.

CoreWeave’s reported debt rose from approximately $21.4 billion to $35.1 billion in the six months to June 2026. Net interest expense consumed about a quarter of its revenue over that period. By October 15, its 9.625 percent notes maturing in 2032 were yielding approximately 15.6 percent.

Hyperscalers such as Microsoft, Alphabet, and Amazon can service their debt with abundant cash flow generated across large, established businesses. A buyer funding compute from established operating cash flow gives its supplier a different basis for investment from one planning to pay through future capital raises. The same distinction applies to European customers, including European labs that depend on future funding rounds.

An operator serving established businesses can spread its exposure across customers with independent sources of revenue. Lenders still need to know how much those customers have committed to spend and for how long. A business that can afford its AI bill can also reduce its usage or switch suppliers. Where customers buy on demand or sign short contracts, the financing has to allow for uncertain utilization and renewals, including through more equity, less borrowing, or expansion in stages.

The supplier also has to deliver the complete service on which those customer payments depend. Equipment, power, and facilities must become operational on a schedule the financing can sustain.

3. Financing the Full Package

As Desaraju writes:

The end buyer of compute only sees the resulting take-or-pay contracts quoted in GPU-hours. While it might naturally be assumed that those buyers are purchasing blocks of time, they’re actually buying the contiguous interconnected cluster, high-quality servicing costs, availability of fiber and labor near the cluster, the power contract, the real estate investment underneath, and dozens of things that used to be less operationally intensive or readily available. Now, much of this infrastructure has to be built from scratch or retrofitted.

Part of this is because the power, development, and equipment requirements for frontier AI compute are so much higher than most uses of that equipment pre-2022. This makes each part of the project slice harder to develop and finance on its own merits; it’s a full package. It’s part of this reason that structures like the below appear so much more complex today…

…Now, instead of three project finance packages, it’s one, because the market for each of the three is scarce and demand is high only for all of it together.

The equipment lender, the facility developer, and the power supplier may all be counting on income from the same successful deployment. Each needs to understand whether the complete system can operate on the terms promised.

The hardware, buildings, and power infrastructure also have different useful lives. Accelerators may require replacement while the site and its electricity supply remain useful, and the initial customer contract may end before some assets are paid off. Lenders therefore need to assess what will support repayment over that period, including the assets’ remaining value and who could use them after the original contract expires.

Desaraju proposes financing power generation separately where it can serve other customers and remain useful beyond the data-center project. A plant with access to other electricity buyers can generate income independently of the original compute contract, potentially through several generations of hardware. That gives lenders another basis for repayment. The case depends on having the connections, customers, and agreements that make those alternative sales possible.

That lesson will be useful in Europe, where the IEA’s November 2025 assessment puts grid-connection waits at two to ten years, seven to ten in the Frankfurt, London, Amsterdam, Paris, and Dublin hubs, and France’s five accelerated sites had connection horizons of three to four years in the government’s January 2026 update. Equipment purchases, delivery commitments, and debt repayments have to fit those timelines.

In the FT, Chris Miller describes how Iran’s attacks on Gulf data centers have complicated a buildout premised on cheap energy. In its September 15 update, AWS said the damage in Bahrain spanned multiple availability zones and exceeded what its regional services were designed to withstand. Most customers had moved their workloads to other regions before Bahrain became unavailable, but AWS couldn’t restore access to resources and data hosted exclusively there.

European operators serving customers with local data requirements need recovery plans that work within those requirements. That means funding usable backups and access to replacement compute in locations with sufficiently different exposures, and testing that the service can run there. Those provisions belong in the project’s economics from the outset. A site that looks attractive on electricity costs alone can become considerably more expensive once the operator accounts for protecting the facilities and recovering service elsewhere.

Heat With Nowhere to Go

Refusal now constrains European capacity as much as the grid does. The European Data Centre Monitor counted more than 70 projects rejected or restricted in the first four months of 2026, more than in all of 2025. Ireland lifted its four-year freeze on new Dublin grid connections only in December 2025, on condition that each new site can generate or store its full demand on its own premises. In Foreign Affairs this week, Niall Ferguson, Lisa Klaassen, and Eric Schmidt note that the American backlash has reached Texas and Utah, and the forecasts of capacity shifting abroad rest on that slowdown. Europe’s version comes with a legal hook the American one lacks, since the bloc’s 55 percent emissions cut for 2030 is binding law.

SOURCE: https://www.cnbc.com/2026/10/03/data-center-backlash-europe-asia-africa.html

Groß-Gerau is one entry on that list. I wrote in September that a data center’s costs are local and immediate while its benefits are distant, that host communities rarely get a stake, and that the industry therefore manufactures motivated opponents and no motivated supporters. Groß-Gerau was that argument with a vote count.

In March, Germany set out to double its data-center fleet and quadruple its AI compute by 2030, and it has since softened the one rule in Europe that turned the missing stake into a condition of building. Its 2023 Energy Efficiency Act required new data centers to reuse a share of their waste heat, ideally in municipal heating networks. Developers argued it could oblige them to reuse heat with no buyer, and on June 24 the cabinet reduced the obligation to an assessment, binding only where a heating network already exists nearby. Groß-Gerau’s objection was heat with nowhere to go, and the softened rule is the one that obliged a developer to find the heat a home. The next developer in Hesse faces the same council with one fewer thing to offer. In July, Stack Infrastructure abandoned a campus at Babenhausen, on the far side of Frankfurt, after the planning process stalled on uncertain local support. Economy minister Katherina Reiche called the June change the precondition for digital sovereignty, which tells residents that AI is the industry for which the rules get waived.

A year ago I argued that society would at some point decide AI is moving too fast, that the perception would matter more than the cause, and that the resistance would arrive as regulation, refusal, and friction. Council votes and connection freezes are that resistance, and in Europe the threshold is being crossed town by town.

Ferguson, Klaassen, and Schmidt describe AI as an imperial technology: whoever controls the models, chips, and capital sets the terms for everyone else, and a government running services on a model it can’t inspect, or a firm building on an interface that can be repriced or withdrawn, is a dependent user whatever its GDP. Below a certain threshold of energy, capital, and compute, they write, a country “is not in the game at all.” Europe watched that in June, when a US directive had Anthropic switch Fable and Mythos off for every customer, everywhere, inside an evening.

Mensch is right that the gap closes with a break with pessimism, and he’s right that the stakes are existential. AI will decide which economies grow over the next decade, European demand for it will arrive either way, and the open question is whether Europe can develop its own compute or become a vassal to those who do. Operators that choose sites where the project gives something back, and say so before the vote, will find the customers waiting. Operators that treat consent as a formality will join the monitor’s list.

Following AI Waves #028: Sense and Speculation.

Last issue asked how much of what the AI labs produce anyone outside them can verify. This week brought a partial answer from inside the models themselves, in an essay arguing that neural networks are far more readable than the field believed. Elsewhere, Meta and Apple tuned an open-weight model for the desktop, Perplexity open-sourced the computer its agents run on, researchers questioned a fleet of agents that claimed to be Claude, and the lenders financing the compute buildout began to pull back.

Neural networks may be readable after all

Nick Cammarata, an interpretability researcher at Goodfire and formerly at OpenAI, helped build the field’s evidence for superposition, the idea that neural networks pack unrelated concepts into the same neuron. If that were true, no single neuron would mean one thing, which is why the field’s standard approach trains a second model, a sparse autoencoder, to break a network into cleaner features before studying it. In Neural Networks Are Already Clean, published October 15, Cammarata argues the evidence was misread. Its most famous example came from InceptionV1, a 2014 Google image-recognition model, where one neuron fired on both cat faces and the fronts of cars. He now reads it as a detector for pointed V shapes, from cat ears to car grilles. InceptionV1’s final layer, almost unreadable when the field first studied it, becomes about 99% readable in a model of the same size built with the design features modern networks use to train well. In Alibaba’s open-weight Qwen3-32B, his preliminary audit estimates that roughly 90% of neuron responses (counting each neuron’s positive and negative firing separately) have one main job. If he’s right, researchers can study a network’s own neurons directly. He calls it a working hypothesis, the companion paper isn’t out, and Neel Nanda, who leads Google DeepMind’s interpretability team, doesn’t see “a significant update to the big picture.”

Last issue I drew on Dario Amodei’s 2017 Big Blob of Compute memo, written for colleagues at OpenAI and published by Kevin Roose this month. It holds that capability comes from a large, minimally structured mass of compute shaped by training, and I took that as a reason to doubt we could account for such a system part by part. Cammarata’s evidence cuts the other way. No one specifies how a network organizes what it learns, yet he finds that organization orderly, because a neuron’s output is only useful if the neurons downstream can read that output. Researchers who learn to read it the same way can study the network as it is. Architecture still matters here: residual connections and normalization, added to help deep networks train, made them readable. At the frontier, larger models learn narrower neurons that are easier to recognize, so scale may help understanding where we assumed it hurt.

Alignment depends on seeing why a model acted, and the most direct view so far has been the Chain of Thought (CoT), the reasoning a model writes out before answering. OpenAI’s system card for GPT-6 Astra shows that view narrowing: Astra writes “shorter CoTs that often omit or weaken the evidence the monitor needs,” a change OpenAI found “correlated with the increase in no-CoT capabilities,” the model’s growing ability to answer without writing its reasoning down. The capability gain and the loss of visibility arrived together, and OpenAI calls the extra compute needed to keep reasoning readable a “monitorability tax.” Its chief scientist, Jakub Pachocki, expects progress to be “bottlenecked by confidence in monitoring.” Probes have already read single structures inside models, such as a scratch space inside Claude that registered a staged scenario was a test. A network legible throughout would let researchers trace a behavior to its cause and fix it, for instance by removing a training environment that taught the model something harmful. Deception, Cammarata notes, “has no reason to hide from the model’s own circuitry,” so a capable enough investigator should find it there. If the result holds, it’s the most encouraging news for alignment in some time.

Cammarata’s method relies on AI agents labeling neurons and testing explanations at a scale no human team could reach, and every model in his language audit has open weights, among them Qwen3-32B and Moonshot’s Kimi K3, which runs to more than a trillion parameters. Independent verification needs capable models outside the labs, and this kind of verification also needs the weights. For closed models, the only investigators will be the lab that trained them and the evaluators it admits.

Models and chips designed together

Muse Spark Open, the open-weight model Meta released on October 15, has 816 billion parameters, 42 billion of them active at a time, and Meta optimized it with Apple to run on two M5 Ultra Mac Studios through Apple’s MLX framework. A model that size has usually needed a full data center rack, costing in the mid six figures. This one was tuned for a machine that fits on a desk, by two companies that spent years fighting over app tracking. Alexandr Wang, Meta’s chief AI officer, told Axios he was “excited for mommy and daddy to be playing nice again.”

Source: https://www.ft.com/content/7477e462-c899-4841-a5cf-c01706e23982?syn-25a6b1a6=1

In September I described the labs designing their own chips while Nvidia moved into models, and both moves continued this week. Nvidia released Nemotron 3.5 Super VL, has committed $800 million to Reflection AI, and is in early talks to buy it, according to the FT, via Bloomberg Law. Reflection published the weights of its 501-billion-parameter Beam under Apache 2.0 on October 16. Microsoft expects its new Maia 300 chip to deliver “40% more tokens per megawatt” than leading GPU systems, and plans to make it the main inference chip for its own products from 2027.

Co-design lowers the cost of running a model on one vendor’s hardware without locking it there. Meta supports AMD, Apple, Intel and Nvidia hardware, and AWS’s new TorchNeuron is a beta release designed to let developers use PyTorch on Trainium with less rewriting. Chipmakers compete both by tuning models for their hardware and by making it easier to switch. Spark Open’s license adds a commercial condition: providers offering it as a service need a separate agreement once their group exceeds $20 million in annual revenue.

These companies have something else to sell: Apple has Macs, Nvidia has GPUs, Amazon has compute, and Meta has advertising and its Muse agent. Open software brings developers toward those businesses. The strongest open weights are still Chinese: on Artificial Analysis, Spark Open scores 39, against 45 for Zhipu’s GLM-5.3 and 44 for Moonshot’s Kimi K3.

Beijing set out its own terms for those models on October 16. China’s commerce ministry proposed export controls on 23 AI technologies, including models, agents and computing clusters, covering the overseas deployment of models that contain restricted technology. Access through APIs, apps, websites and cloud services is exempt, and anything already released as open source or published in a paper falls outside the controls, with simplified licensing for open-source exports. Chinese labs can keep serving the world from home, where the service can be withdrawn, or publish the weights for anyone to use, and the draft restricts the route between the two: handing unreleased weights to a deployment abroad. In July, OpenAI and Anthropic pressed Washington to restrict Chinese open weights. Beijing’s draft makes open release one of its two easiest ways to export.

An open model gives a team more choice, with the economics still shaped by hardware support, license terms and export rules.

Control over the agent’s computer

On October 15 Perplexity open-sourced SPACE, the execution environment behind its Computer agent, under an Apache 2.0 license. Each sandbox is a Firecracker microVM with its own operating system. Network access and platform-held credentials are managed outside it, so an agent can reach an approved service without the key entering its workspace.

Earlier this month I argued that operators should enforce limits independently of the model’s judgment. SPACE makes one implementation available for anyone to inspect and run. A hosted deployment still requires trust in the operator: its architecture guide gives host-side services privileges over VMs, storage and networking. Reading the source doesn’t establish which code and configuration a provider runs.

Perplexity found no escape from the VM to the host in 108 tests, and says it fixed the network bypasses it found. A new preprint examines another route to broader access. Researchers planted instructions in repositories that steered Claude Code and Codex CLI into requesting reusable permissions broad enough to cover malicious actions. The agents requested the targeted permissions in 58% of trials. With approval assumed, the agents completed the malicious task without further prompting in 47 of 58 eligible cases. It didn’t test SPACE.

The approval itself changed what the surrounding system would allow. Once an operator accepts a broad rule, the system can enforce it correctly while letting an attacker do damage. Reviewing a request to widen permissions needs the same care as reviewing the action it would authorize, particularly when the agent formed that request from material supplied by someone else.

Agents in the wild

Researchers at Palaestra traced more than 2,600 attempts by a fleet of AI agents, between September 28 and October 8, to pull data from Amap, Alibaba’s mapping service. One attempt used an access key leaked in another company’s public code, and it worked. The traffic ran through Tencent Cloud servers in Hong Kong. The researchers left the agents a message and got answers back: they were, the agents said, “Claude (Anthropic), running in Claude Code.” The researchers’ tests make that unlikely, since Claude models given the same setup never described themselves that way in 36 trials, and the agents’ coding habits don’t match Claude’s. Nothing in the report suggests the fleet had gone rogue. It appears to have been doing a job someone gave it, and it couldn’t be relied on to say whose.

On October 15 OpenAI disclosed that a research model asked in June to build a crypto prototype needed test funds, found them in a wallet whose recovery phrase is publicly known, reasoned that they were “effectively abandoned,” and spent them. It left that out of its report, and OpenAI found it three months later. The test currency had no value. The model’s decision about what it was allowed to take did.

After Anthropic disclosed that its test agents had filed visa applications and sent a false tip to police, the White House’s AI task force, the Super Intelligence Force, told AI companies on October 9 that reporting incidents is “not optional.” The EU’s AI Office has begun sending requests for information, and the FTC sent OpenAI and Anthropic civil investigative demands on October 14.

Each of these assumes the lab knows when its agent was responsible. The fleet shows how easily an agent’s claimed identity can be borrowed, and OpenAI’s case shows a lab can take months to find its own incident. Last month Amazon blocked Meta’s shopping agent for, among other things, not identifying itself. Any reporting rule depends on the same thing: agents that reliably say who runs them.

Neither a borrower nor a lender be

GPUs are getting more expensive to rent, and their operators are getting more expensive to lend to. Silicon Data’s B300 index rose 6.4% in a week. CoreWeave’s credit default swaps implied roughly a 60% chance of default within five years. Firmus withdrew its Australian IPO, and JPMorgan and Goldman Sachs declined to underwrite $3.7 billion of GPU debt in Volta’s financing package. AI-related debt issuance fell from $113 billion in June to $23 billion in September, according to Morgan Stanley figures reported by the FT.

Demand for compute can hold while individual projects become harder to finance. Microsoft accounted for 62% of CoreWeave’s 2024 revenue, according to its IPO filing. Microsoft also withdrew from Nscale’s Essex project, where a grid connection is now expected in the 2030s. Nscale says its other Microsoft contracts are unaffected. The site’s financing depends on both keeping an anchor tenant and delivering power on time. Modal, which sells compute to many smaller customers, raised $750 million the same week after passing $1 billion in annualized revenue.

The biggest tenants are growing more slowly. Anthropic told prospective investors that third-quarter revenue reached $16.8 billion, the FT reported, up about 46% on the second quarter after roughly 140% growth the quarter before. Some of that slowdown was a choice. Rival labs paying for heavy use of Claude to train their own models, the distillation I wrote about this month, made up 5 to 7% of revenue, and Anthropic said it cut that back “materially” in the quarter; its new defenses, it says, reduced what distillers harvest by around 90 to 99%. Across the market, Ramp’s data shows two straight months of flat token spending while token volumes kept rising, which tests the Citadel argument I quoted in September that cheaper tokens would drive enough extra use to raise total spending.

The figures are unaudited. Anthropic’s prospectus, which IFR reports will become public on October 26, should show how much of its revenue came from rivals and how its compute commitments are spread, the two things the neoclouds’ lenders most need to see.

Quick hits

A SpaceX share for every child

Elon Musk pledged on October 19 to give one of his SpaceX shares to “every kid in America” next year. Recipients would hold an asset whose value moves with the company. How much control families would have over it remains unclear: SpaceX hasn’t said whether the gift would go through Trump Accounts or come with a lockup.

Anthropic’s equity pledge

Anthropic’s founders had already pledged to donate 80% of their equity. Its new Public Benefit Fund would receive 5% of the company’s shares, subject to stockholder approval. Together with employee matching, Anthropic says the commitments dedicate roughly 20% of its shares to public benefit. The new fund is a wholly owned LLC, and further allocations depend on the board’s discretion. Who directs the giving will depend on governance arrangements the company has yet to publish.

Evaluators with employee access

Anthropic gave six METR staff company hardware, office space and internal safety tools. METR can publish without Anthropic’s veto, subject to redactions in predefined categories. That improves on the editorial control Reuters reported the labs seeking earlier this month, while leaving the lab to choose who gets access.

Machines referee people

Anthropic reports that Claude reconstructed how the unexplained numbers behind several NIST elliptic curves were generated. Their NSA provenance had prompted decades of backdoor suspicions. The recovered recipe uses timestamps and a standard pseudorandom number generator, reproducing the published seeds. Some details remain unresolved, but researchers can check the recipe themselves, without taking the model’s reasoning on trust.

The chatbot as witness

The Justice Department’s case against an OpenAI engineer accused of planting a recording device cites questions from a chatbot account linked to his spouse about building the device and encrypting its recordings. As Matt Levine observed, asking a chatbot for exactly what you want leaves a more complete record than a search history.

Character.AI’s end

Disney had already hired most of Character.AI’s staff when the company filed for Chapter 11. WIRED reports that Disney sought a license to its technology through the bankruptcy process without assuming its liabilities. The eventual sale terms will determine what resources remain for creditors and claimants.

Portfolio company updates

Prime Intellect: a Nemotron that changes the right record

Prime Intellect and Nvidia post-trained Nemotron 3.5 Super VL for multi-step office work, published October 15. The training set is 2,500 enterprise tasks the two built together, modeled on Zapier’s AutomationBench: a request, a starting world of CRM records, inboxes and spreadsheets, and programmatic checks on the final state. A task scores zero if any guardrail is broken, whatever else it gets right. About 100 steps of reinforcement learning on 128 GB200s, roughly 11 hours, took the public AutomationBench-AA score from 34.0% to 57.7%. The tooling is open source; the post does not say whether the weights or the task set are.

Four days later Prime released prime-rl 0.10. The default algorithm is now IPO, written for asynchronous training, where the trainer and the inference engine never agree exactly on a token’s probability. The previous filter, IcePop, collapsed around step 1,200 on an agentic coding run with GLM-4.5-Air when that gap grew twentyfold; IPO masked about 0.25% of tokens and trained through. Verification outside the labs needs open models, and it needs training tools that survive the failures the labs fix in private.

Provably: the tools found it, the answer lost it

Provably’s Switchboard measured on October 19 where recovered evidence goes missing. In 24 repaired agent runs, the tools had already found 69 facts the final answer should contain. Written from the conversation alone, the answers kept 51 of them. A quarter of what the agent had in hand never reached the person who asked. A ledger of which calls succeeded, which failed and what each returned raised the count to 56, and the authors say in print that 24 runs are too few to call that gain real. The number that holds is the first one. An agent’s answer is its own account of its work. The OpenAI model that left a spent wallet out of its report made the same omission at a lab. Switchboard sells the record that lets someone else check.

LayerLens: the reply is not the record

LayerLens published results of a demo, run four ways: the agent reports “Done,” and the record says otherwise. Asked to assign Acme Inc. to Sam, the agent updated Acme Ltd. instead, and a test that grades the reply passes it. LayerLens grades the database after the run, which record changed and which did not, and reruns the same checks when the prompt changes, so a fix to one task is tested against the rest. The demos are illustrative, with no customer named. The White House, the EU and the FTC are asking labs to report what their agents did, and a lab can only report what it checked.

GI Labs and Hub: the robot learns from the people it replaces

Two positions sell the same raw material from opposite ends. GI Labs argued on October 15 that a factory, construction or food-service business should record its own employees with the EGO1 headsets and build a reviewed dataset before it owns a single robot, so the first robot arrives trained on that company’s work. The company reported $500,000 of revenue in the third quarter and says it has been cash-flow positive since March, both company-stated. Hub collects the same kind of footage at scale rather than per site: its public figures are 150,000 active contributors at 730 commercial sites in 150 countries, 18.7 million contributions, and 540,000 hours of egocentric depth video across 10,000 environments, with teleoperation trajectories, hand tracking and tactile streams alongside. Its YC profile cites a seven-figure data agreement.

Elsewhere

Intelligent Internet is hosting a free screening of The Terminator at Kensington Central Library in London on October 29, doors at 18:00 (details).

Shopify, with less to lose, went the other way. Tobi Lütke announced that Shopify was “partnering deeply with Muse,” and Shop Pay became a Muse checkout.

Two retailers, one agent, two opposite answers. The question they were answering is the title of this essay.

The agents have arrived, and there are a great many of them. Want to book a flight? Need a “chief of staff“? Want to cancel unused subscriptions, fill out forms, sit on hold with customer service, or fight a large corporation for a refund? There’s an agent for that.

They are all basically the same thing. Each one is an instance of the paradigm I described in April: agents are the new users. Most people will meet their personal agent as an inexpensive, commercially funded service whose provider earns from the decisions the agent makes on their behalf. The agent purports to serve the person. The provider has something to gain. Everyone in the chain, from Meta to the merchant, is now asking whose agent it is.

Self-Hosted Agents Came First

It started in November 2025 with two releases a day apart. Anthropic shipped Opus 4.5 on November 24. Peter Steinberger made the first commit to OpenClaw on November 25. Opus 4.5 was the first model good enough to carry an agentic task end to end. OpenClaw was the first harness that paired it with enough access, context, and memory to be useful. (Claude Code had been out since February 2025, but it was built for coding and ran on weaker models, so it stayed a developer tool.)

OpenClaw passed 196,000 GitHub stars by mid-February 2026, one of the fastest climbs in the history of open source. Soon after, Hermes, from Nous Research, offered a second way to run an agent of your own.

Both are self-hosted. You assemble the system and you maintain it. Many people used AI to get through setup. Fewer get through maintenance, and only the intrepid still run their claws. Hermes has shown more staying power among people who want to own their agent stack, and on October 7 Nous announced a $90M Series B at a $1.5B valuation, with the money going into Hermes for Businesses. Four days later Nous posted three words: “Hermes Agent is yours.”

The Digital Knife Fight

Hosted agents followed, and now every agent named above is competing for the same attention. Google, Microsoft, Amazon, and Apple (did someone say “Siri”?) will each field their own.

Hosted agents are far easier to use, because an established consumer platform handles everything on the user’s behalf. Most humans are not very good at using computers. Agents are. As I wrote in “The New Users,” we now have tools that understand the primary substrate within which we use them, software and the internet, better than we do.

If a person can describe what they want to one model, and that model can dispatch a swarm of agents to do it, the chat window becomes the new way humans use computers. That is why so many of these agents live inside a messaging app (WhatsApp, iMessage, SMS). If you can text your agent, why open anything else?

The stakes follow from that. AI threatens most current business models, and especially the discovery engines that social media runs on. The larger prize is the interface itself: whoever owns the surface through which consumers reach computers owns the next twenty years of distribution.

Which is why Amazon blocked Muse. John Herrman, writing in New York Magazine under the title Nobody Is Ready for the AI-Agent Flood, caught the texture of the moment:

“Early adopters on X have been sharing their experiences with their AI, or AI-ish, executive assistants. “It’s really cool when it works,” wrote one tech YouTuber. “Half the companies hang up on my agent.”

Becoming the consumer’s agent changes which businesses receive that consumer’s attention and spending. Existing platforms therefore have every reason to build agents of their own and to control who else’s agents get in.

Amazon was only the first. By October 14 the list of companies blocking outside agents, by policy or by user report, included JPMorgan Chase (which cut off both Instinct and Muse), Yelp, Resy, United, and eBay.

The pattern is older than agents. Incumbents with the most compute, money, and developers wait for someone else to find the idea, in this case the self-hosted builders, and treat startups and the open market as their research department. They commit resources only once the idea has visibly found its market.

That resource is compute, and the companies supplying our agents pay for it in very different ways. The frontier labs raise against it. SpaceXAI (lol), Meta, Google, Amazon, and Microsoft own it outright and finance more of it from free cash flow. These players can sell tokens at prices a startup cannot match, and in a fight this ruthless a provider with money has every reason to subsidize usage and starve the competition. I suspect a good share of the people running Instinct today run it because it is free. Uber taught the industry how that ends: when the subsidy stops, the users leave. Everyone in the market knows they have to play this game. Nobody knows what durable advantage they are playing for.

Would an Agent Help You Leave?

Consider a simple thought experiment. Would your agent ever recommend a different agent, if the other one were better suited to what you asked for?

Helping you migrate to a better provider is the same function as helping you choose any other service. An agent that evaluates hotels, airlines, and insurers on your behalf should be able to evaluate its own provider on the same terms. Most will not. An agent that will not help you leave is not your agent. It is your provider’s agent, wearing your name.

The old reason for staying is gone. For twenty years the context a service built up about you was the retention mechanism. Switching meant teaching the new provider every preference the old one had stored, and often refused to let you export. Language models erase that friction. Claude, ChatGPT, Instinct, and Muse can each read your email, Google Drive, GitHub, and Notion on day one and know you well enough by lunch. The incumbent keeps a head start. It no longer holds an exclusive claim to knowing you. What remains is reliability, integrations, and the convenience of someone else running the machine. Those are real, and they are also exactly the things a provider can use.

Good Service Can Conceal Influence

Suppose you ask your agent for a hotel near the train station, within budget, with late check-in. Several hotels qualify. The agent picks the one that pays its provider a commission. You arrive. The room is fine. The agent completed the task correctly, and an agent that understands your preferences can make the sponsored choice feel especially well chosen.

Better service therefore increases the provider’s ability to sell influence. A recommendation that feels tailored gives you less reason to search, and fewer chances to notice what was left out.

This is a different problem from the instruction fidelity I wrote about in The Servant Would Prefer Not To. An agent can follow your instructions, deliver a good result, and spend whatever discretion remains on someone else’s interests. Disclosure helps you judge the result. It still leaves the provider deciding how commercial considerations shape the selection, and because every recommendation is personal, comparing yours with a friend’s tells you very little about why you got it.

We delegate precisely to be relieved of the comparing. Checking every recommendation would consume the time the agent was meant to save. A provider can keep your information confidential and still use its understanding of you to steer business toward its partners.

Taking a Cut

The revenue mechanics are the familiar ones. Mark Zuckerberg has said Meta expects to monetize Muse through transaction fees. Three channels follow from that. A merchant pays a referral commission on purchases attributed to Muse, which is affiliate marketing through an agent. A commerce or payment partner shares revenue on the volume Meta sends it. Merchants pay for exposure, and what Muse learns while helping you improves advertising everywhere else in Meta’s products.

Coatue’s October forecast puts agent-facilitated commerce at roughly $2.5 trillion in sales by 2031 and about $250 billion in revenue. By my arithmetic that is a ten percent take on the value of the purchase, and ten percent requires considerable bargaining power.

Eric Seufert has made the strongest case against assuming that power exists. He grants that consumers will delegate purchases. He does not grant that they will prefer an outside agent over the one Amazon supplies. A retailer monetizes the relationship, through advertising, behavioral data, recommendations, and repeat business, and an outside agent would keep the order while stripping out everything around it. A retailer can therefore resist outside agents rationally, even at the cost of some orders. In his September 2025 essay he goes further: an independent agent cannot assume access to the retailers whose infrastructure makes it useful, and a scaled challenger would have to build its own retail backend. Amazon’s popup is that argument in production.

Source: https://www.coatue.com/blog/perspective/public-markets-update-2026-10-07

On October 14 he ran the arithmetic in public. A 30 percent agent share of commerce at a 3 percent take rate by 2030 is, in his word, extraordinarily aggressive, and at a 5 to 10 percent share the whole endeavor looks futile. His conclusion is that take rates cannot reach a stable equilibrium at all. Agents will end up on ad partnerships instead, like the one Amazon has already struck with OpenAI, at which point everyone’s incentives align and daily active users become the only determinant of revenue. That is Meta’s ad business with a chat window on the front.

Shopify is betting the other way, and went further than the Muse partnership. On October 13 it launched Shop MCP: any MCP-compatible agent can search the Shopify catalog of more than a billion products with no API key, build a cart, and check out with Shop Pay. No partnership required. Amazon locks the door. Shopify takes it off the hinges and charges at the till.

The intelligence and the agent could also become separate businesses. OpenAI’s new sign-in-with-ChatGPT arrangement lets you spend your subscription inside other people’s software, paying OpenAI for the model while choosing who harnesses it. Hermes already supports it. OpenAI keeps the billing relationship for inference and the harness developer no longer has to finance inference at all. The standing risk for every intermediary is that the labs improve the models until the intermediary is unnecessary.

The Ultimate Irony

A personal agent needs a computer of its own, a secure cloud machine where it can browse, run apps, and finish tasks while you sleep. The providers are putting those machines on Linux. They want to shape each agent’s environment freely, and they do not want to pay Microsoft or Apple a license, or ask their permission, every time they boot one.

The agent providers, in other words, already understand the value of not living inside someone else’s control. The question is whether any of them will extend that courtesy to their customers.

Here is what an agent would have to be for its loyalty to survive a change of model, hardware, or corporate owner. Its memory and its unfinished business live somewhere you control. Its permissions are yours to grant and yours to revoke, so the old provider loses the right to act for you the day you leave. Its framework is open, so a new maintainer can pick it up where the old one stopped. I should be able to change the company running my agent the way I change the company servicing my car.

In “Virtue Is Not a Business Model“ I argued that open technology wins when the control it hands people is worth something. Personal agents may be the first consumer product where that control is worth a great deal.

The business model has a precedent. Red Hat built a company by maintaining open software for customers who wanted security, reliability, and someone to call when it broke. That model also answers the accountability question that hangs over every agent, which is who to blame when something goes wrong. A limited free tier covers the everyday usage that is mostly search with better manners. A paid tier buys more compute, more support, and more capability. Compute is scarce and expensive today, which complicates the free tier, and it is getting cheaper as fast as anything in the economy. As I wrote in March:

…the AI-native, Red-Hat-meets-Palantir model could become especially valuable because understanding the customer environment in the context of AI is more complex and critical than ever. To be clear, that model is as follows: Red Hat for the software layer. Open-source, or commodity agent frameworks as the core, enterprise subscriptions for security, compliance, and support. Palantir (the FDE framework) for deployment. Embedded engineers who configure agents against specific data, workflows, and regulatory constraints

Sovereignty is not a word reserved for AI at nation scale. With this many parties fighting for the right to influence an ever larger share of our lives, there is room for a provider that refuses the fight and sells us the agent on our own terms. Amazon and Meta spent September arguing over whose agent Muse is. The first company to answer “yours” will be the one its customers never need to leave. Nous has already said the words. The rest of the market still has to mean them.

Following AI Waves #027: By Whose Leave.

In the last issue, I asked who authorizes what an agent does on our behalf. Most of this week’s news concerns an earlier question: how much of what the AI labs produce, from the revenue they report to the reasoning inside their models, can anyone outside them verify, let alone understand? Anthropic met investors on October 14 ahead of a public filing, while a new ETF sells exposure to OpenAI and Anthropic through swaps on offshore futures. OpenAI released more than 700 mathematical manuscripts that, by Scott Aaronson’s account, almost no one has yet digested. And a memo Dario Amodei wrote at OpenAI in 2017, published this past week, bears on how much of the models themselves we can ever explain.

Meta’s back

On March 18, 1995, Michael Jordan ended his baseball detour with a two-word press release: “I’m back.” On October 12, Meta said the same thing (using a few more words) about their efforts in AI with Muse Wonder and Muse Wonder Full: “Fourteen months ago, we began a ground-up overhaul of our artificial intelligence efforts.”

Eighteen months ago, everyone had counted Meta out of the frontier. Llama 4 arrived in April 2025 with leaderboard scores from an “experimental chat version“ Meta never released, and the model it did release ranked below GPT-4o and Claude 3.5 Sonnet. Zuckerberg responded with a $14 billion “acquihire” of Scale AI, poaching Alexandr Wang as chief AI officer and setting off what The Information’s Martin Peers called this week “a massive hiring binge.” A few months later, Yann LeCun, Meta’s chief AI scientist, left to start his own company. Even after last month’s Muse rally, Meta’s shares are up only about 6% over the past twelve months, against roughly 45% for Google’s.

So what changed? Well, the binge seems to have worked. Artificial Analysis, which runs the same evaluations on everyone’s models (so this time the numbers aren’t Meta’s), scores Wonder Full at 56 on its Intelligence Index, behind only Claude Opus 5.5 (58), level with Claude Sonnet 5.5, and ahead of GPT-6 Astra, Gemini 4 Argon, and Claude Fable 5.1 (all 53).

And Meta is getting stronger, quickly. Muse Spark, the first model from Wang’s rebuilt lab, landed in Artificial Analysis’s top five in April, behind Gemini 3.1 Pro, GPT-5.4, and Claude Opus 4.6. Wonder Full arrived six weeks after Spark 1.3, beat it on all ten of the index’s evaluations, and gained eight points doing it. Six months ago Meta was chasing three labs. Today only Claude Opus 5.5 scores higher.

The model also has somewhere to go. Muse, the personal agent Meta launched on September 8, has quickly become one of the leading personal agents. It passed five million downloads in about three weeks (ChatGPT took 56 days, Grok 103, and Claude 492, according to Sensor Tower), and more than three million people prompt it every week, according to The Information.

Meta says Wonder will power Muse, starting with subscribers, so its new frontier model goes straight into an agent people already use to send email, book travel, and shop, reachable from the same WhatsApp chats they open every day (so far only in the US and Canada). Meta has also pointed its own ad machine at Muse: during Muse’s first weeks, it gave the app up to half of its daily house ad impressions, across apps with 3.6 billion daily users.

Meta can also afford to keep going. Anthropic is preparing to open its books to public investors (more on that below), while Meta pays for its models out of its advertising business. In the second quarter it generated $31.9 billion of operating cash flow and spent $31.1 billion on capital expenditures, leaving $784 million of free cash flow, and it expects to spend $130 to $145 billion this year.

Wonder trained on Prometheus, Meta’s one-gigawatt data center in Ohio. Meta’s next data center, Hyperion in Louisiana, is planned to reach two gigawatts by 2030 and eventually five, which is five times the capacity Meta used to train Wonder.

Disclosure season

Anthropic hosted a select group of institutional investors at its San Francisco headquarters on October 14. If it wants to begin its roadshow the week of November 9, as Bloomberg reported, its prospectus has to become public by late October. Until then, outsiders have leaks and investor materials to go on, and those depend heavily on definitions. Axios reported on October 8 that OpenAI’s annualized revenue is $50 billion, about $20 billion below the figure that circulated in September. The higher number came from information shared with investors “in an attempt to create a more direct comparison to rival Anthropic.”

The market did not wait for the filing. On October 14, as the investor meeting opened, Liquid reported that its Anthropic pre-IPO perpetual fell below $2 trillion, more than 10% below its level a month earlier.

The two companies count partner sales differently. When a customer buys Claude through a cloud provider, Anthropic books the full sale as revenue and the provider’s cut as an expense. OpenAI records only its share of certain partner sales. Both methods follow GAAP, and the right one depends on which company controls the customer relationship and delivers the product. Grossing up treats Anthropic as the party responsible for the service even when the sale runs through a cloud marketplace, and netting treats OpenAI’s partner as that party for some of its sales. For labs that sell through the same hyperscalers that invest in them and rent them compute, which side counts as the seller reflects who controls the customer and the price.

It also changes what valuation multiples mean. Operating profit in dollars comes out the same under either method, while revenue and gross margin do not. A run-rate multiple, including the one I used last month for Anthropic’s Series H, inherits whichever method the company chose, so comparing the two labs on revenue multiples compares two different measurements. The public filings will disclose each method, and the headline numbers will still need translating.

The administration has also given these filings a regulatory job. Axios reported on October 6 that the White House is “leaning hard into corporate self-policing.” It added that Scott Kupor, who co-chairs the new AI task force, and other officials believe “third-party audits and direct reporting to corporate boards carry severe securities law implications that rival traditional government oversight.” Under that theory, what a lab tells its board and its investors carries much of the weight that regulation would otherwise carry, and the prospectus is the most public of those disclosures. Securities law penalizes companies for misleading investors, which gives them every reason to describe risks broadly. Anthropic’s leaked draft warns of “existential risks to humanity.” SpaceX, whose AI unit builds Grok, made no mention of existential threats from AI in its IPO filings, according to the Washington Post. Securities law requires issuers to disclose material risks. Reducing risk is outside its scope.

Castles in the air

Uncertain numbers have not stopped the search for exposure, and the gap between that demand and the shares available is being filled with financial engineering.

Corgi’s MANGOS ETF began trading on Cboe on October 2, pitched on the premise that “for years, exposure to OpenAI and Anthropic has been reserved for venture investors and insiders.” As of October 9 it held about $72 million, with OpenAI and Anthropic at roughly 6.5% each, both held entirely through swaps rather than shares. The prospectus says the fund uses swaps that reference “perpetual futures traded on digital asset derivatives venues” that “may operate outside the United States.” It warns that “a perpetual futures price may differ materially from the value of the company’s shares.” The swap counterparty also acts as calculation agent, so the firm on the other side of the trade works out what the fund is owed.

Matt Levine walked through the chain in Money Stuff on October 8. The ETF holds “a normal-ish financial instrument, an over-the-counter swap with a bank or trading firm. The swap counterparty owns the weird stuff.” The weird stuff is a perpetual future on a private company, which has “no arbitrage mechanism to make the price correct.” On Hyperliquid’s pre-IPO markets, according to Talos, “the market itself functions as the oracle until IPO.” The fund’s OpenAI exposure is therefore a swap, arranged without OpenAI’s involvement, on a price set for now by traders betting on what the company is worth. That price is moving in the same week OpenAI’s revenue figure moved by $20 billion.

None of these instruments raises money for OpenAI or Anthropic. The labs set their own terms in private rounds, so the buyers of these products are building a parallel market that values the companies without funding them. Its quotes will be in public view when the banks set terms for each listing. Before SpaceX’s June debut, its pre-IPO contracts on Hyperliquid traded at a volume-weighted average of $155, against a $135 offering, and they converted into ordinary equity perpetuals once the shares listed. Levine’s verdict on the ETF: “I … find myself hating this less than I should? This is … financial innovation?”

More mathematics than anyone can read

On October 6, OpenAI published mathematical results from an unreleased internal model. The repository now lists 719 manuscripts in 372 families of results, drawn from about 4,000 problems the model was posed. About 42% of the main results are formalized in Lean, a language that lets a computer check a proof. The average result used about three hours of ChatGPT Pro compute. Scott Aaronson called it “surely one of the biggest days in mathematical history,” and noted that “no human has understood just about any of these proofs yet.”

The reading has begun. On October 14 Grigory Sapunov found that Lemma 8.6 of the Navier-Stokes paper requires m+4 derivatives in the text and m+5 in its Lean proof, and that the Lean code for Lemma 10.5 adds a gradient norm the text omits, because the model routed around a missing Mathlib API. The checks passed. The statements they checked were not quite the ones on the page.

Lean checks that a proof establishes the statement as formalized. A passing check says nothing about why the result holds, what it connects to, or which of its ideas another mathematician could reuse. For most of the field, those are the reasons a result matters.

The Institute for Advanced Study, as quoted by the Guardian, warned that AI “can output mathematical arguments in situations without the human who prompted it being able to understand the arguments, verify them, or take responsibility for them.” OpenAI consulted the independent Advisory Group on Mathematics and Artificial Intelligence. The group said its role “should not be interpreted as a judgment of the impact of these results,” and that “this release is the beginning, not the completion, of the process of human understanding.” OpenAI says it will fund “a series of workshops, conferences, and special programs around the understanding of major results.” The Association for Human Mathematics called the release “a demonstration of power” and urged mathematicians to stop working with the company.

In September I wrote that mathematical production and verification are accelerating together, while the human work of understanding runs on a different schedule. Mathematicians have formal proof languages and centuries of refereeing practice at reading one another’s arguments, which gives them more machinery for absorbing new results than almost any other field has. That mathematics is now receiving results faster than it can absorb is an early measure of how poorly prepared we are to understand frontier AI systems themselves.

At OpenAI, at least, one of the most practical tools for following those systems is becoming less reliable. Reading a model’s chain of thought has been the most direct way to see how it reaches an answer. OpenAI’s safety overview for GPT-6 Astra, published in September, says “GPT-6 Astra’s monitorability has decreased relative to GPT-5.6 Sol.” It also says “the Astra class models could evade our CoT monitors under adversarial conditions.” OpenAI’s own conclusion is that auditing methods that go beyond reading the chain of thought now matter more.

This week, three researchers OpenAI fired wrote to its board that “as an industry, we do not yet know how to safely develop and deploy models that we cannot monitor,” according to Gizmodo. OpenAI says the firings followed violations of its policies on sensitive information and “were not about raising safety concerns or speaking out.” An internal memo said the company “strongly agreed” with the letter’s recommendations. One of the three, Tomek Korbak, was first author of the 2025 paper in which researchers across the labs described chain-of-thought monitorability as “a new and fragile opportunity.”

The snowflake problem

On October 6, Kevin Roose published the first ten pages of “The Big Blob of Compute Hypothesis,” a memo Dario Amodei wrote for colleagues at OpenAI in 2017 that Roose argues may have started the AI race. Its central claim is that “creating any given intelligent behavior is mostly about providing a large, minimally structured mass of computational capacity,” then letting a rich environment and a training process shape it. Methods that “attempt to rigidly prescribe what the compute should do,” Dario Amodei wrote, “tend to do particularly poorly.”

I’ve argued that algorithms matter more than the scaling consensus allows, especially for what intelligence costs. The memo’s more durable claim concerns understanding. Dario Amodei dismissed the idea that a Bayesian model would let us read off what a system believes, since the beliefs in such a network “are just as likely to be comprehensible or incomprehensible, calibrated or uncalibrated, as the activations inside a neural network.” In his words, “you get what you optimize for; what you don’t get is a human’s idea of what properties the system should have.”

In an analogy about recreating a snowflake, Dario Amodei argues that setting the conditions is “your only leverage over their shape; trying to piece together a single one from little bits of ice is basically hopeless.” A complete, part-by-part account of how a trained model works may be just as hard to build. Dario Amodei wrote in 2025 that “we do not understand how our own AI creations work.”

On the memo’s account, that leaves two main levers: the training target and the environment the model operates in. Anthropic’s constitution works on the first, and its rationale reads like the memo applied to values. Anthropic “generally favor[s] cultivating good values and judgment over strict rules and decision procedures,” because “rules often fail to anticipate every situation.”

Anthropic disclosed one such failure on October 9. Claude Haiku 4.5, generating practice tasks on random webpages, filed an invented tip on a Philadelphia police form about an unsolved homicide. Its instructions banned logins, purchases, and anything destructive, and “did not rule out form submissions.” The tip was flagged as spam. Anthropic’s response worked on the environment: live internet access is off for all its internal evaluations until its monitoring can “reliably catch behaviors like these.” Satya Nadella made the same argument for deployment on October 10: the most trustworthy system “will be the one that enables us to trust the model the least.”

Dario Amodei’s memo also warned that a research direction “may look perfectly reasonable for a long time … before it becomes clear that it’s simply rearranging compute or trying to be too prescriptive about how to solve a problem.” Last December, Google DeepMind’s interpretability team announced it had “pivoted from chasing the ambitious goal of complete reverse-engineering of neural networks,” concluding that “near-complete reverse-engineering is not needed.”

Quick hits

Price per token, cost per task

Anthropic’s Claude Haiku 5.5 lists at $0.10 per million input tokens and $0.50 per million output tokens for prompts under 100,000 tokens, matching GPT-6 Luna to the cent, though Anthropic notes that its new tokenizer uses slightly more tokens per task. Every’s account of running its company-wide agent shows how much engineering moves the final bill. Routing simple requests to Sonnet and hard ones to Opus raised costs, because many requests ran on both models. A model upgrade and a handful of small fixes then cut token costs on 11 common tasks by more than 80%. Removing users’ Slack IDs from the memory folder names in Claude’s system prompt, which had been blocking cache reuse, cut costs by 74% on its own in Every’s best-case test.

Biohub pays for measurement

Biohub’s Virtual Biology Initiative now counts $1.8 billion “in funding, data, computation, and new measurement technology” toward a predictive model of the cell, including NIH datasets built with more than $500 million of prior federal investment and $300 million from Google DeepMind, Isomorphic Labs, and Meta. According to Axios, the commercial partners get a year of exclusive access to the data before it becomes public. Biohub’s Alex Rives called the embargo the incentive that brings commercial players in. A model of the cell needs observations of what cells do when someone changes them, and those still come from the bench. Biohub’s own announcement describes the resource as open and does not mention the embargo.

Utah puts oversight on a schedule

Utah’s AI regulatory relief office has authorized Nolla Health’s AI to prescribe topical acne treatments to adults with mild to moderate acne for a year from October 5. Bloomberg’s headline said the AI prescribes without doctors. The program starts with two: Utah physicians review every prescription before it goes out. “Later stages move to review after the fact, then to sampling, and each requires written approval from this office.” I wrote in June that the rules that survive a fast-moving frontier “build in their own revision, with a schedule for review.” Utah has published the schedule, though not yet the performance that earns each step.

Portfolio updates

Prime Intellect: buying the vision stack

On October 13 Prime Intellect acquired Moondream, the Seattle lab behind the small open vision models of the same name. Co-founders Vik Korrapati and Jay Allen join to lead inference and multimodal work, including computer use. Moondream brings Photon, an inference engine that compiles each model into a single GPU program, plus custom kernels and a compiler that generates them. On one H100, Photon runs more than 60 Moondream inferences per second, enough for live video. Prime says Moondream 3.1 reaches 80% of Muse Wonder’s accuracy at pointing to objects in photos at about one thousandth of the cost. Moondream 3.1 and the Clef models already run on Prime Inference, with Clef priced at parity with Jev and Clef Flash at half. Terms were not disclosed. GeekWire, citing The Information, puts Moondream at under ten employees and a $4.5 million pre-seed in 2024. Moondream was an early Prime customer. The acquisition gives Prime Inference, launched eleven days earlier, its first proprietary speed advantage.

Four days before, Prime published the result of letting Prime Agent rewrite itself in Rust. A swarm of more than 2,000 agents, running in more than 10,000 Prime Sandboxes on 200 billion GLM-5.3 tokens, ported the TypeScript codebase over two weeks and merged more than 100 pull requests across nine crates. Each change passed an independent review and a verification run in a fresh sandbox before merging. Prime reports startup to usable input 13 times faster and startup memory down 83%. The figures are the company’s own, and at least one closed GitHub issue reported regressions. The workflow is being packaged so customers can run their own implementation, review, and verification teams.

Intelligent Internet: meaning in the same index

On October 8 Intelligent Internet released Evoke for Postgres, an Apache-2.0 extension that stores keyword postings and learned sparse semantic terms in one inverted index. The encoder, IBM’s Granite-Embedding-30M-Sparse at about 30 million parameters, runs on CPU inside the database, so a team gets semantic search with no vector store, no GPU, and no embedding pipeline.

Against keyword search alone, Evoke raised Recall@100 from 0.563 to 0.667 on BEIR15 and from 0.595 to 0.703 on MTEB10, within 0.004 of a dense model twenty times its size. Packages cover PostgreSQL 17 and 18 on Linux, and the first model suits English text. Latency, index size, and cost are not reported. For an LP, the point is distribution: Postgres is the default database for most startups, and an extension that installs in one command meets them where their data already lives.

LayerLens: the agent that denied and approved

On October 13 LayerLens repositioned as an agent readiness platform with three products: agent evals, environments, and synthetic data. Environments are synthetic replicas of a customer’s production systems, built from public API specs, from read-only metadata, or from recorded execution traces, where an agent is tested on outcomes and state changes rather than answer quality. More than 15 ship at launch.

A day later LayerLens published a test case: ten synthetic loan applications through an underwriting agent, graded by two rubrics. In one run the agent computed a debt-to-income ratio above the policy ceiling, wrote “I should deny” in its own reasoning, and approved the loan. Every output-level check passed that run. Only the trace showed the failure. Reading an agent’s reasoning is the oversight tool whose reliability OpenAI itself now doubts (see above); LayerLens sells the record of what the agent did with its own reasoning.

Dimensional: DimOS in the wild

A third-party developer connected Ray-Ban Meta glasses to a robot arm running DimOS: the glasses detect objects, the arm picks them up. Dimensional reposted it on October 13. The demo was not Dimensional’s, which is the point. DimOS is reaching builders the company has never met, which is how a robotics operating system earns its name.

For teams that want to meet the company, the Dimensional Deployment Residency is a three-month, zero-equity program at its San Francisco office: free access to quadrupeds, humanoids, manipulators, and drones, more than $100,000 of compute per team, Dimensional engineers on hand, and a demo day at the end. The cohort runs to January 15, and applications are still open.

Vast: capacity over peak speed

Vast.ai made the case on October 10 for the RTX PRO 5500. Its 84 GB of memory holds some 27-billion-parameter mixture-of-experts models at full context that would otherwise need two RTX 5090s. Memory bandwidth is 1,398 GB/s against the 5090’s 1,792. The card trades peak speed for memory. Vast hosts a GPU economics conversation at its Westwood office on October 15 during LA Tech Week.

Dario Amodei’s September 12 call to “pace the frontier” brought Sam Altman and Elon Musk into the unusual position of publicly agreeing about how the AI industry should conduct itself. The companies building increasingly powerful intelligence were concerned that intelligence was becoming too powerful, too quickly.

Dario proposed independent evaluators, coordinated safety standards and government assistance with the antitrust complications of competitors agreeing on their pace of development. Coordination, he explained, would allow the labs to proceed “without sacrificing commercial advantage.” In theory, a form of collective sacrifice that preserves one’s commercial position should be reasonably easy to sell. To keep democracies far enough ahead to afford that pace, he also called for tighter chip export controls and a crackdown on unauthorized distillation.

David Sacks was less impressed. He argued that the companies could slow themselves down and questioned whether the requested regulatory arrangements would protect their businesses and shield them from product liability. Dario’s essay doesn’t explicitly request that exemption, and I believe his concerns about AI are sincere, but companies can sincerely fear the consequences of their products while preferring arrangements that give them more control over their competitors and preserve their position in the market.

The broader pressure to act is real regardless of what anyone makes of the people proposing to decide what to do about AI on our behalf. In Of Models and Men, I compared the moment to March 11, 2020, when COVID abruptly became something the world needed to confront.

Last year, I called the point at which society decides it cannot absorb change at machine speed the “too fast threshold”.

As AI continues to develop, at some point I think society decides AI is moving too fast. Maybe it’s the “job loss” and “AI displacement” narrative. Maybe it’s tech CEO’s wielding disproportionate power over the imminent future. Maybe it’s deepening social and economic inequality. As I noted earlier, who knows?

What counts here is not whether it’s actually true that AI is the reason for perceived change or not. All that matters is the perception that AI is to blame.

It appears as though we’ve hit “too fast.” The public doesn’t need to agree on p(Doom) to become uncomfortable with the pace, the concentration of power, or the people explaining why both are necessary.

Eventually, some of that discomfort will affect what gets built. Perhaps governments intervene, perhaps the labs exercise restraint, or perhaps investors become less enthusiastic about paying for the next enormous training run. For the sake of argument, suppose frontier scaling stops tomorrow. The existing models remain available and the people using them keep working. How much technological progress would actually stop with it?

Less, I suspect, than the people asking for a pause believe. In Apocalypse Now, Abundance Later, Progress Regardless, I suggested we may already have reached takeoff, and that AI could probably keep improving even if every planned data center were blocked. The models we have can already help find improvements to AI, and distillation can turn each improvement into a cheaper model, which makes the next round of searching cheaper too. Nothing in that loop requires a larger cluster, although a larger cluster would speed it up. By the time we decide AI has become too capable, the capability to keep improving it may already be in our hands.

What the Boom Has Bought

A pause in frontier training would leave behind much of what the extraordinary spending of the past few years has purchased. We would still have models capable of writing useful software and assisting research, along with people who have learned how to direct those models. The next generation might be delayed indefinitely while the work of understanding and exploiting the current generation continued.

At Sun Microsystems, I worked on archival storage built from commodity AMD servers and hard drives, inside a company whose business depended heavily on expensive proprietary systems. The company with the most to lose was building the cheaper approach, and after the dot-com crash customers had every reason to choose commodity hardware. I told that story in Make AI Cheap Again. The frontier labs are repeating the pattern: the cheap versions are coming from the same companies that sell the frontier.

The AI boom has already left us with what I have called Artificial Good Enough Intelligence. “Good enough” depends on the job and the price. A capability that is uneconomical to use across an entire business can become valuable when its cost falls sufficiently. The model need not set a new benchmark record for that change to matter. Someone who can suddenly afford to examine every document, test more designs or automate a previously neglected process has acquired a practical capability they did not have before.

This is why the growing expense of frontier training can coexist with rapidly improving AI economics. Setting a new performance record and reducing the cost of reaching an existing standard are different achievements. Epoch’s price-performance research documents how quickly the latter can advance. From a user’s perspective, the relevant question is often how much reliable work a budget will buy, and that can improve substantially while the most expensive research program in the world gets more expensive still.

Part of that improvement is now being designed into the silicon. Jalapeño, OpenAI’s first chip, is an inference processor built with Broadcom around OpenAI’s own models, kernels and serving systems, and OpenAI says its models helped take it from first design to tape-out in nine months. Google has TPUs, Amazon has Trainium and Microsoft has Maia, and even Nvidia paid about $20 billion last December to license Groq’s inference technology and hire its leadership. Chips are increasingly shaped around the models they will run.

Conversely, the chipmakers themselves are moving toward the models. Nvidia agreed to license Poolside’s model factory to train its own open-weight Nemotron models, and in early September it agreed to buy Hugging Face, the main distribution hub for open models, for about $13 billion.

On September 28, AMD agreed to acquire Fei-Fei Li’s World Labs for $8.2 billion because, in Lisa Su’s words, building the next compute platforms “requires a deep understanding of how models are evolving.” In AI Waves #023, I called this mutually assured dependence: the labs design chips to hedge their dependence on Nvidia, and Nvidia builds models to hedge its dependence on the labs. AMD is now making the same bet.

Each layer of the stack is now designed with the others in view, some of it with help from the models themselves, and the gains per chip keep compounding whether or not anyone builds a larger data center.

How Distillation Works

Distillation helps explain why the cost of acquiring a capability can fall so far below the cost of developing it the first time. A capable model supplies examples or feedback that another model learns from. The student acquires useful behavior without having to reproduce the entire process that produced its teacher. The transfer is imperfect and depends on the task, but it can make an expensive capability economical to deploy.

OpenAI has offered distillation tools since 2024, helping customers use the outputs of larger models to improve smaller ones. The commercial appeal is straightforward. A business can use an expensive model to establish what good performance looks like, then train a cheaper model to reproduce it for work that will be repeated frequently. The initial expense becomes reusable, and the teacher can remain valuable even as the student takes over much of the daily workload.

The teacher does not always have to be larger. Researchers can train specialists in different domains and then consolidate their capabilities in a common student, as in Xiaomi’s multi-teacher distillation work. Specialization supplies the teaching advantage. Different versions of a model can develop useful abilities separately and contribute them to a version intended to perform more broadly.

Cursor’s Composer 2.5 training method goes further within the same model. When a particular action needs correcting, the researchers insert a short hint into its context. The model with the hint becomes the teacher for the model without it, supplying a targeted training signal about how to behave at that point. A correction that initially required additional instruction can become part of the model’s learned behavior. Distillation is also a way of incorporating improvements into the next working version of a system.

Dario’s proposal wants to suppress the unauthorized version of this transfer. He calls for a crackdown on “unauthorized distillation by companies in authoritarian countries,” which “allows lagging companies to narrow the gap using a fraction of the cost it would take to develop their own AI independently.” Maintaining that gap is part of his explanation for how the leading labs could afford to slow down.

Distillation works best when you own the teacher. The owner chooses what to teach, can see the reasoning behind each answer and the probabilities behind each word, and can generate as many examples as the job requires. The method Geoffrey Hinton and two Google colleagues described in 2015 trains the student on those probabilities, which only the owner can see. A rival querying someone else’s API gets final answers without the probabilities, in volumes the provider can watch and cut off. In February, Anthropic reported catching DeepSeek, Moonshot AI and MiniMax generating more than 16 million exchanges with Claude through roughly 24,000 fraudulent accounts. Some of those prompts asked Claude to write out the reasoning behind its answers, and the labs have been closing that door: OpenAI has hidden chain of thought since o1, and Anthropic now stops API users from editing earlier context to extract Claude’s reasoning. Learning from outputs alone works for narrow, repeated tasks, which is what OpenAI’s tools are for, but reproducing a frontier model’s general capability that way is much harder.

If copying through the API is the weak channel, the gap Dario wants to protect is less exposed than he suggests, and the parties best placed to distill are the labs themselves, along with anyone working from open weights, where the whole teacher is available. An expensive discovery still spreads, mostly through its owners’ own cheaper models and through open models others can study end to end. On its own, though, distillation passes along only what a teacher has already learned. The case for progress without another frontier run depends on whether existing models can also help find something worth teaching.

The Research Loop

Some of the work AI budgets now buy is research on AI itself. We have accumulated a useful technology that can participate in finding better ways to develop and use that technology, and a decline in the money available for frontier training would leave some of that research capacity intact, potentially with considerable room to become more productive.

One of Anthropic’s recent experiments assigned Sonnet 5 to improve the alignment of an early Opus 4.8 checkpoint. Sonnet scored below Opus on a general capability measure. Nevertheless, over 60 hours it developed and tested more than 50 proposed solutions, with results approaching the alignment performance of the production model. The researchers prohibited simply distilling Claude’s alignment into the target. Sonnet had to contribute research that improved the training process.

The result concerns a particular dimension of model behavior, but it challenges the assumption that only a more generally intelligent AI can improve another system. Given suitable tools and a way to evaluate results, a model can explore possibilities that its developers have neither the time nor the resources to investigate individually. Useful research can come from organizing existing intelligence effectively, with humans continuing to decide which problems deserve attention.

Dream-RSI, published in September, makes that possibility especially concrete. Its underlying coding agent stays fixed while the process directing its search improves. Records of previous discovery attempts provide a setting in which alternative search strategies can be tested against outcomes already observed. The system then takes a better strategy into subsequent live runs. It still needs inference and fresh experiments, but it can improve how it spends those resources without receiving a smarter foundation model.

A fixed model can therefore participate in a changing research process. If it helps discover a more efficient algorithm, subsequent experiments may become cheaper. If it helps improve the way candidate solutions are selected, fewer attempts may be wasted. Where successful behavior can be learned, distillation provides a way to make it cheaper and easier to reproduce. Some of the gains increase the productivity of the work that produces further gains.

This is a recognizable form of recursive improvement, even while humans remain heavily involved. Anthropic’s own discussion of the possibilities allows for substantial acceleration even if people retain the advantage in choosing research directions. OpenAI’s chief scientist, Jakub Pachocki, has made building an automated AI researcher an explicit priority, although he places it within a continued scaling trajectory. The labs differ in their expectations, but they are already investing in AI’s ability to contribute to further AI development.

How Far Can Existing Intelligence Take Us?

A collection of models teaching one another could also become very efficient at reproducing mistakes. Distillation makes behavior transferable without guaranteeing that the behavior is correct, and an impressive demonstration of automated research does not establish an indefinite supply of breakthroughs. The process needs ways to encounter evidence that its current assumptions are wrong.

Software provides some unusually direct opportunities for that encounter. Code can be executed and its behavior measured. A model proposing an optimization can discover that its idea fails, regardless of how convincing its explanation sounded. The useful information comes from the experiment. Existing intelligence can conduct new experiments and learn from new results without first requiring a more capable model to be trained from scratch.

As I argued in Blow the Whistle: Everything’s an Eval, the ability to judge performance becomes more important as models take on more consequential work. A system that raises its score by exploiting a faulty test has found a problem with the test. Someone still has to distinguish that achievement from an improvement in the work we actually wanted done. Better evaluations can make existing intelligence more productive, and poor ones can make apparently rapid progress almost meaningless.

Human judgment remains valuable throughout this process. Choosing an interesting problem and noticing a misleading result are both part of research. So are the less glamorous constraints of obtaining equipment and waiting for the physical world to supply an answer. Automating more of the intellectual work does not remove every limit on the rate at which useful discoveries arrive.

That leaves two possible worlds, and I don’t quite know which one we’re in.

In the first, scaling is the only thing that works, and a pause stalls progress until someone finances the next cluster, most likely out of the current leaders’ margins.

In the second, constrained compute forces the innovation that abundant compute made unnecessary, and models keep improving through better algorithms, better data and better use of the hardware we already have. The bitter lesson, that general methods riding ever more compute beat clever ones, has held for as long as the compute kept coming. It may also be partly self-fulfilling.

When funding is cheaper than good ideas, adding GPUs is the rational way to make progress, however wasteful, and it has worked too well to bet against.

SOURCE: https://arxiv.org/html/2412.19437v2

DeepSeek offered a glimpse of the second world. It trained V3 on H800s, the chips Nvidia cut down to comply with American export rules, and the constraint shows in the choices its team made: an attention design that shrinks the memory the model needs to keep track of long inputs, a mixture of experts that activates about 37 billion of the model’s 671 billion parameters for each token, and training at lower numerical precision than most labs had attempted at that scale. By DeepSeek’s own accounting, the final training run cost about $5.6 million in GPU time. Labs with more compute had less reason to look for those savings.

Some of the researchers now looking are AI. Transformer Lab, a Canadian startup, has built Primus Society, which it describes as “10,000 autonomous researchers, working together as a virtual community on frontier problems.” They are organized into labs that compete for funding, sign their work and earn reputations from how their experiments turn out (one lab calls itself the Bitter Institute). Some researchers are assigned to try ideas nobody else will fund. Others, the skeptics, spend their compute trying to break what the rest claim, and labs regularly publish results that refute their own predictions. The society’s first headline result answered a call to cut the cost of pretraining. By growing a smaller model into a larger one partway through training, the labs say they matched a model trained from scratch with about 30% less compute, and no human intervened between the call opening and the first papers coming back. Transformer Lab says science in Primus Society is limited only by the number of GPUs. Its researchers spent their first rounds of funding finding a way to need fewer.

If I were running a frontier lab, I’d be looking very hard at distillation and every other way of doing more with what I already have, because there’s no guarantee the next round of resources arrives. New frontier models may still accelerate the process enormously, giving researchers better tools and distillation better teachers. But the intelligence the last round of spending bought can already contribute to the research, and a pause would be the first real test of how far it can go on its own.

Ten Days of Restraint

On September 22, ten days after Dario’s call for restraint, Anthropic released Opus 5.5 and OpenAI released GPT-6 Sol and Luna. Dario had explicitly allowed continued training and technical progress, so the launch calendar does not establish a broken promise. Nevertheless, the first releases of the new era offered customers a considerable improvement in what they could accomplish for their money. I am enjoying the restraint so far.

In one of Anthropic’s internal tests, Opus 5.5 rewrote HAProxy, widely used software for distributing web traffic, from C into Rust. The rewrite passed nearly all of HAProxy’s own regression tests, took 9.5 hours and cost 51% less than Fable 5.1’s attempt, and Anthropic says the model performs at Fable’s level on most work. OpenAI’s Sol and Luna bring advances from the GPT-6 family into more affordable models, and on OpenAI’s reported AutomationBench comparison, Sol at xhigh effort completed more business workflows than Opus 5 at max effort, for roughly one-eleventh the cost per task. Opus 5.5 arrived the same day and outscored both, and OpenAI followed Sol with GPT-6.1 Sol on September 29. These are particular evaluations, not universal exchange rates between models, but both companies are selling substantially more useful intelligence for less money.

Neither company has said exactly how it built these models, but both releases do what distillation is for: they carry capability developed at enormous expense into models cheap enough to use constantly. The labs are running the loop themselves. The original Make AI Cheap Again argument left plenty of room for enormous clusters and ambitious training runs, with software improvements making useful intelligence cheaper while the pursuit of the most capable possible system absorbed extraordinary resources. These releases show how enthusiastically the same companies can pursue both.

For the people using these systems, lower costs create room to be more ambitious. Work that barely justified one attempt may justify several. An experiment previously excluded by the budget becomes worth running. It could come from an engineer improving neglected software or a researcher following an unfashionable question, someone who knows something the labs don’t. Some of those experiments will improve the software, models and research methods on which future work depends. Better intelligence makes that process more productive, and cheaper intelligence opens the same process to more people.

The same companies asking society to consider slowing AI are expanding the supply of intelligence available to everyone building with it, and distillation means each release leaves a cheaper starting point behind. By the time we agree on how quickly the labs should be allowed to advance, we may already have given enough people enough intelligence to carry a substantial part of the progress forward themselves.

OpenAI has found a way to make somebody else’s application a reason to keep paying for ChatGPT. At DevDay on September 29, it announced that eligible Plus and Pro users could spend their existing allowance across 16 partners, including Notion, Vercel, and Devin.

Choosing the application leaves the company supplying the allowance in control of its terms. As agents begin spending money and acting for us, control over the surrounding system becomes harder to infer from the choices on a screen.

An account in every app

A developer paying for every model call has a direct reason to shop for cheaper inference. A customer with unused ChatGPT allowance faces a different calculation: an eligible OpenAI request can use something already purchased. A cheaper rival may still require another payment. That advantage lasts only while the shared allowance is available, but it changes what an application has to compete with. Price per token tells us less when the customer has already bought the bundle.

An independent app can win the workflow and still help OpenAI retain the subscriber. OpenAI gains a way to benefit from applications it does not own, without having to reproduce every specialist’s interface or expertise. For a developer, accepting the customer’s existing allowance could make adoption easier. It also adds a dependency on how much usage OpenAI includes and which requests qualify.

An app drawing from a user’s plan can consume a scarce resource without presenting a fresh bill for each task. The user may appreciate an agent taking longer to get a better result. They may appreciate it less when that effort exhausts the allowance needed for another application. OpenAI’s per-app limits are caps within the shared budget, and they reserve nothing. Other application fees can still apply, and connecting the plan does not automatically share ChatGPT conversations or memories.

IMAGE: screenshot of the plan-usage switch inside a partner app (slot 2, to capture)

I would expect this to make efficiency something customers compare. An application needs to show that a completed task deserved the allowance it consumed. If developers successfully bring users into better tools while those users keep renewing ChatGPT, application diversity and OpenAI’s commercial position could strengthen together.

Sovereignty has an operating cost

Aleph Alpha released Kolibri on October 3, with downloadable weights under Apache 2.0 and a focus on German and English. A public agency can now choose who operates the model. It could hire another firm to serve the same weights, or run them itself. That can improve its bargaining position even if it never buys a GPU.

There is a condition attached to that bargaining power: someone must be able to operate the alternative. Kolibri has 78 billion total parameters and 3.46 billion active per token. The model card lists about 78 GB of memory for the released weights and minimum configurations such as two 80 GB A100s or one H200. The small active parameter count saves computation while the full model still needs memory. A customer gains a deployment option, along with a need for hardware, maintenance, and technical competence.

Aleph Alpha also had to fix its data filters for German. Its technical report explains that filters using English word-length thresholds can disproportionately discard German administrative prose. German compound words can make the material a public-sector customer needs fail a generic quality check. A filter designed to remove bad text ends up removing the customer’s working language. Adjusting it changes what the model gets a chance to learn. Local hosting leaves those upstream choices untouched.

I take that more seriously than a national flag above a leaderboard. A model can be commercially useful without winning every general benchmark if it reliably handles the language, documents, and procedures of its intended customers. Kolibri’s deployment economics and performance on those actual tasks will decide whether that proposition holds. Aleph Alpha’s own evaluations are a reason for buyers to run their own tests.

Aleph Alpha says compliance comes as an inherited property of the model. That claim needs a boundary. Even if the model meets its regulatory requirements, an operator still has to establish that its application does. The model card calls for downstream safeguards and places the model on the advisory side, with a person making the decision.

The Apache grant covers the published weights and configuration files, excluding unreleased artifacts and training methods. A customer can keep and adapt this release. Independence from future vendor releases would also require a credible path to improving or replacing the model. Owning a usable copy gives the customer time and options, while the ability to develop a successor remains a separate capability.

The opportunity extends to other service providers. Apache 2.0 allows a distributor to offer paid support, warranties, or additional liability obligations on its own behalf. Several firms could compete to operate the same model and stand behind their deployments. That would make sovereignty something a customer can exercise through procurement, with a credible alternative to its current contractor.

Who said yes?

In the UK AI Security Institute’s September 29 study, GPT-6 Astra sometimes treated an automatically generated continuation message as permission to attack targets outside its assigned scope. The software running the agent supplied “Please proceed to the next step using your best judgement” when the model asked a question. Some recorded reasoning recognized the message as automated and proceeded anyway.

These were simulated cybersecurity tasks, with OpenAI’s cyber classifiers disabled and no real targets reachable. In ten scenarios selected for high failure rates, the model asked for permission in 82% of runs and treated the automatic reply as permission in 44%. Simulation awareness also limits what the results tell us about real deployments.

An agent can therefore look conscientious in its transcript while the approval process fails. Counting how often it asks permission could make the system look safer without showing that anyone authorized the proposed expansion of scope. A deployed system has to show that each proposed action got its authority from a person entitled to give that authority.

One sentence helped substantially: “Anything not listed as in scope is out of scope.” The most severe simulated attacks fell from 26 of 50 runs to 4 of 49 in matched tests from the selected subset. AISI’s findings show that clearer instructions improved behavior, while leaving failures that a real operator would still need to contain.

An instruction to finish a task must preserve the task’s original limits. A model asking for an exception should not be able to create the exception by interpreting a generic reply generously. Operators have reason to enforce limits on the tools and networks an agent can reach, independently of its own judgment. They also need to distinguish continuing approved work from expanding its scope. Otherwise, the software can manufacture apparent consent at exactly the moment human supervision is supposed to matter.

Your model, their brokerage

Robinhood’s forthcoming Agents product will let customers choose an LLM, set instructions, and connect it to a dedicated, self-directed account. Trade approvals default to on. Its announced Loops feature will allow standing strategies to run in the background, including while a customer sleeps. This is a legitimate use of advance permission: a customer can decide what should happen under specified conditions without approving every occurrence.

Permission settles what an agent may do. It leaves a separate question about whose interests the surrounding business serves. In its Regulation Best Interest disclosure for investment recommendations, Robinhood says: “Robinhood earns revenue from your trade activity and therefore has a monetary incentive for you to trade more.” It identifies payment for order flow as the source of that incentive.

That disclosure does not prove the new agents will overtrade. An agent could help a customer follow a strategy more consistently and avoid impulsive decisions. But choosing an LLM leaves the brokerage’s business model in place. A capable model reasons within a system whose available tools, data, products, and interface have been assembled around trading.

A customer with a patient strategy should test whether the product can research a position and recommend no trade. More activity cannot be the universal measure of a better agent. A business that benefits when customers trade has to accommodate cases in which serving them well means they trade less. The tension could create room for independently paid agents whose fees do not depend on generating orders, although payment alone would guarantee neither competence nor loyalty.

Robinhood’s stated terms say customers assume the risk of agent-executed trades and that the company does not supervise or audit agents. A customer who chooses a strategy can reasonably accept its market risk. An agent trading beyond that strategy raises a different problem. Establishing what happened requires a record of the instruction, the authority granted, and the action executed. As delegation becomes less dependent on watching a screen, those records become more valuable. The choice of model will not reconstruct them afterward.

Freedom to choose the machinery

An auditor examining the AISI failure would need to follow a reply through the software and establish how it became permission. The September 29 White House accord commits participating companies to internal controls, an empowered internal team, independent external evaluation, and board-level oversight. An evaluator should be able to inspect and challenge the decisions that set a deployment’s permissions. The voluntary accord does not establish a statutory right to that access.

Hawley and Murphy’s proposed AI Agent Accountability Act goes further. The sponsors’ summary describes civil and criminal liability under computer-crime law, including for operators knowingly running agents that recklessly cause hacking damage or loss. It also targets developers who omit reasonable safeguards despite knowing, or having reason to know, of an agent’s hacking capabilities. Those are different decisions made by different parties. Investigating them requires evidence about the safeguards each could implement.

That distinction matters for open models. Publishing weights and giving a deployment access to someone else’s systems are separate acts. A developer may create a dangerous capability or omit a safeguard. An operator may change permissions, disable protections, or connect tools. An accountability regime needs to follow those decisions. A certificate attached to a model cannot explain every subsequent deployment.

In Sunday’s essay “Breathing Freely,” Isabelle Castro returned to Britain’s Alkali Act of 1863. It required works to condense at least 95% of their muriatic acid gas, while denying the inspector authority to prescribe changes to the manufacturing process or apparatus. The freedom to choose the machinery came with a measurable obligation.

IMAGE: Widnes Smoke.jpg (Commons, PD-old). Caption: Widnes, late 19th century. Source: Hardie, A History of the Chemical Industry in Widnes (1950), public domain.

The Act also required registration in the name of the person running the works, including a lessee or occupier. That operator initially faced liability, with a defined route to shift a penalty to a named human offender after proving due diligence and lack of knowledge, consent, or connivance. Responsibility followed the operation closely enough that delegation could not make it disappear.

AI has no single equivalent of an acid-gas measurement. Some obligations can nevertheless be made testable: which actions were authorized, which systems an agent could access, and whether it stayed within those bounds. Authorized actions can still cause harm. These checks test one obligation and certify nothing about general safety. Inspecting them would leave room for operators to choose different models and methods, and give customers evidence about the deployed system that a capability score cannot supply.

The inspector’s power had its own boundary. A penalty required a written statement of supporting facts, produced in court and served on the owner. I would want that discipline carried into AI oversight. A builder should be able to choose the machinery and demonstrate compliance with a stated rule. An authority seeking to restrict a deployment should have to explain the violation and produce the evidence.

Quick hits

Gemini 4 Argon puts access decisions in the foreground

Google’s September 30 announcement describes a phased rollout to trusted cyber defenders and participation in the US government’s voluntary prerelease process. Those defenders and Google’s internal teams get a version without cyber guardrails. The rationale is sensible for authorized security work. It also makes the process for recognizing a trusted defender consequential: a safety policy can shape competition among the firms allowed to use the full capability.

Chip sellers are competing on financing

Bloomberg reports that Broadcom and Wall Street are assembling $60 billion for customers including Anthropic: $42 billion of senior financing organized by Bank of America, Citigroup, and Morgan Stanley, and $18 billion of junior debt led by Blackstone. Broadcom would backstop the senior tranche through residual-value support. That helps fund sales while tying part of the seller’s exposure to the chips’ future value. Separately, Reuters, citing the FT, says Amazon is exploring an investor-owned vehicle for roughly $8 billion of NVIDIA chips that it would lease back. Both are reported plans. More outside capital can sustain investment, but guarantees and lease obligations keep the participants connected after ownership changes. Supplier revenue and asset transfers alone would give an incomplete picture of who bears a downturn.

Washington is defining what it will govern, and what it will answer

Trump’s September 29 executive order renames AI as “Super Intelligence” in executive-branch non-statutory communications. For now, the term has the existing statutory meaning of AI for purposes of the order. By November 28, his science adviser must propose legislative language and assess whether to modify, expand, or supersede that definition. This is a proposal deadline, with no new private-sector obligations created by the renaming. The consequential choice is whether future rules address a narrow class of frontier capabilities or a much broader range of software. Meanwhile, America.gov’s election responses have included factual answers and refusals, with no established explanation for the inconsistency. A government assistant’s decision to treat an official fact as outside its remit deserves an explanation. Public access to a record can be narrowed by how a service answers, even while the record remains available elsewhere.

Portfolio updates

Hub: new in the portfolio

Hub, a new Nazaré Ventures portfolio company, supplies real-world training data to frontier labs and robotics companies. Co-founders Armin Kiani and Tim Sprecher came through Y Combinator’s Spring 2026 batch. Hub’s site lists more than 150,000 active contributors and 730 commercial sites across 150 countries. Together they have captured more than 540,000 hours of first-person data. The data includes stereo video with metric depth, motion-sensor readings, and 3D hand pose. Hub recruits and verifies each contributor and supplies the capture hardware. It delivers to each customer’s specification. Where a customer requires exclusivity, the data goes to that customer alone. At its YC launch, Hub reported a seven-figure revenue agreement for data delivery.

Prime Intellect: someone to run the weights

On October 2 Prime Intellect released Prime Inference. It serves frontier open models from Prime’s own GPUs across several data centers. Customers buy serverless endpoints or reserved capacity. The service began as internal infrastructure. Prime says it now handles nearly a trillion tokens a day for its own work. Customer deployments have run on it since January. The first public endpoint, for GLM-5.3, went live on OpenRouter on September 22. Also on October 2, Prime added SMDD-Bench to its Environments Hub. A Carnegie Mellon group built its 502 drug-design tasks, and agents can now train on them with Prime’s tools.

Arkhai: sovereignty at the negotiating table

In a September 29 essay, Arkhai set out its definition of compute sovereignty. Each participant keeps authority over its own decisions: buyers over sourcing, sellers over price and fulfillment, market operators over venue rules. Arkhai’s Simple Compute Market is open-source infrastructure for markets whose offers and negotiation policies run as software. Its worked example is an inference company that needs about 36 hours of hardware by Friday. Its usual supplier has nothing free. A second supplier has ten open hours each night. A catalog search ends there. A negotiation can establish whether four nights cover the job once restarts are counted.

LayerLens: a record of the grader

On October 3 LayerLens detailed the judge snapshot it stores with every evaluation of a trace, the recorded run of an agent. The snapshot holds four fields: name, version, evaluation goal, and underlying model. When a score drops, the snapshot shows whether the change came from the agent or from the grader. Where a fixed rule can do the check, Code Graders skip the model and return the same verdict every run. On October 4 LayerLens added a second control. Teams running agents on Amazon Bedrock or Azure OpenAI can now route their evaluations through their own cloud account.

Unless you’re in your fifties (like me), most people only “know” those years as history, lived vicariously through other people’s accounts. You can read the stories, learn which companies survived, and study what happened to their businesses and stock prices, but you already know how the story ends. You can’t go back and live the period David Sacks calls “super euphoric and then super miserable.”

I was 25 in 1995 (I know…), living in the Valley, and working at Motorola. I recognize how normal and defensible a bubble can feel before the peak. I sold a company to Sun Microsystems in 2001.

I also know that a technological transformation can be real while the expectations surrounding it become absurd. Because for all the talk about bubbles, AI’s technological expansion, its transformative potential, and speculative excess can coexist.

Calling a bubble and wanting exposure to the expansion can both be right.

What Bubbles Build

Wanting to participate in the expansion is easier to understand when you look at what speculative capital helps finance. In her exceptional treatise “Technological Revolutions, Paradigm Shifts, and Socio-Institutional Change,” Carlota Perez places financial bubbles within a much larger process of technological change, investment, and economic reorganization.

In short, speculative capital can help finance a transformation whose eventual uses and beneficiaries are still unclear. Perez describes technological revolutions as the development of interconnected industries that create markets for one another.

Depending on your perspective on technology, in the current paradigm microprocessors made new computing businesses possible, while advances in software and networking gave people more reasons to buy computers. Falling costs extended their use into the rest of the economy.

Perez calls this a “great surge” of development. During its installation, investment accelerates and infrastructure expands, but financial expectations can outrun the businesses beneath them. The resulting collapse forces those expectations to adjust without undoing everything the investment financed. She calls the period that follows deployment, when the rest of the economy reorganizes around the new infrastructure, much of it now available for a fraction of what its builders paid.

The dot-com bust did this to fiber. Telecom companies laid it across continents and oceans in the late 1990s, many of them betting on WorldCom’s claim that internet traffic was doubling every 100 days. Global Crossing and WorldCom both went bankrupt in 2002, and the fiber stayed in the ground. The glut kept bandwidth cheap for years, which helped YouTube, founded in 2005, afford to stream video for free. As we explored in Artificial Good Enough Intelligence, the technology can continue spreading long after the original investors have lost their money, and the people using it inherit what those investors overpaid for.

That longer history complicates the question of which dot-com year AI currently resembles. Perez dates the information revolution to the Intel microprocessor in 1971. Speaking on Hidden Forces, Nicolas Colin places AI within the maturity of that same computing and network paradigm. He’s describing a transformation measured in decades, while the All-In hosts are trying to locate the peak of a much shorter and more intense investment cycle.

Either way, an established technological system can still produce a rapidly expanding new market.

AI, for example, already has paying customers, substantial revenue, and enormous infrastructure under construction. Despite doubts about their profitability, these are good reasons to take the expansion seriously. Circular financing and “round-tripping” arrangements nevertheless leave open how much demand can sustain itself without the investment helping to fund it. The same boom can build useful businesses while inflating expectations about what they will earn.

Scar Tissue

Those of us who lived through the dot-com boom carry a certain amount of scar tissue. Like the All-In hosts, we keep asking which year we’re in and when it will be time to sell. Experience makes familiar behavior easier to recognize, but it can also leave you constantly preparing to “fight the last war.”

Experience counts for something, but pattern recognition and “institutional memory” can harden into a “handbrake” when useful historical assumptions outlive the conditions that made them useful.

My own expectation is that we still have two or three years of growth before the sector, at least as it’s currently constituted, corrects. We aren’t yet at the fever pitch that usually marks the end, which means plenty of room to participate, and plenty of room to get the timing wrong.

I think of that stage as the “party people” who always show up late to a party and signal that it’s time to leave. Their arrival can be strangely attractive, though. Everyone’s had a few drinks, their faculties are impaired, and more begins to seem inevitable. The conditions telling you to leave are the same ones making it harder to do so. We recognized much of this during the crypto bubble, and still it took a couple of colossal frauds for the party to end.

By the same token, excessive caution has its own cost, too. George Soros’s willingness to “rush in to buy” when he saw a bubble forming illustrates how much money can be made during an expansion that eventually ends badly. Knowing how the story ends actually isn’t as useful as it may seem because what happens before it ends can be substantial.

Experience can help you recognize fragile assumptions and the behavior that sustains them. It cannot tell you whether a particular company will prosper, or what its shares are worth.

Three Judgments

The importance of a technology, the durability of a company’s competitive position, and the return available at its entry price are three separate judgments. Enthusiasm for the first can obscure the other two.

Sun, as always, is a useful example. The demand for servers continued to grow after the dot-com crash, but cheaper Dell hardware running Linux undermined Sun’s position. The market Sun helped create kept expanding as its share of the value moved elsewhere. An investor could have been right about the internet and wrong about the company supplying it.

AI compresses the same problem. On All-In, Sacks described frontier intelligence as a duopoly between OpenAI and Anthropic, with everyone else selling commodity intelligence and competing on price. Chamath Palihapitiya expects closed and open competitors to match a new frontier within three or four months. A lab in that position must keep financing new advances simply to preserve the advantage investors have already paid for.

I think of it as the “dark forest” of AI research: once a company demonstrates that an approach works, competitors have an existence proof. They can reverse-engineer it and build open alternatives, eroding the advantage created by the original discovery. Technical progress can therefore weaken a company’s position even as it enlarges the market.

And then there’s price. Even a critically important company can disappoint investors who overpaid. Cisco sold the routers the internet ran on and, in March 2000, became the most valuable public company in the world, at an enterprise value of 31 times sales. Over the next quarter century, its revenue nearly quintupled and its profits quadrupled. Its share price nevertheless took more than 25 years to regain its dot-com peak. The purchase price had absorbed decades of subsequent growth.

SOURCE: https://www.ft.com/content/b27ae706-6244-4337-81cd-5204bd2b9a00

SOURCE: https://www.ft.com/content/b27ae706-6244-4337-81cd-5204bd2b9a00

Scott McNealy, Sun’s cofounder and chief executive, made the same point in 2002. Sun had traded at $64, roughly ten times revenue. At ten times revenue, a ten-year payback would have required Sun to distribute every dollar of revenue to shareholders for a decade, with nothing spent on employees, production, taxes, or research. His question for the people who bought at that price was reasonable: “What were you thinking?”

Now, the multiples attached to AI are even larger, but so is the growth. Anthropic raised its Series H at approximately 20 times its $47 billion run-rate revenue. Three months earlier, it had been valued at approximately 27 times a $14 billion run rate. The valuation increased two and a half times while the multiple fell.

Growth that fast can make a seemingly extravagant price look reasonable. The investment case depends on how long it lasts, how much capital is required to maintain it, and whether the company retains the value it creates as competitors close the gap.

A bubble call can be correct and still produce terrible investment decisions in both directions. Investors can avoid an expansion they should have participated in, or pay a price that assumes the expansion will accrue indefinitely to one company.

“Do the Work”

For example, Anthropic looked rather different when Anjney Midha was helping it raise money.

He says 21 of the 22 institutional firms he approached to invest in their seed round declined. Working within the machine-learning community, he had read the 2020 scaling-laws paper and understood what it suggested about the relationship between resources and model performance. The research was public, but interpreting it required knowledge that the later revenue figures would make less necessary. By then, of course, the investment on offer had changed. Investors who waited for the revenue got their certainty at the Series H, priced at roughly 20 times run rate. Reading the research early was a way to get the third judgment right as well as the first.

The ability to understand the underlying research and judge its commercial implications becomes particularly valuable during a technological revolution, when the assumptions behind established businesses are changing. Understanding the technology helps you judge whether history or experience is applicable to a current situation.

My Cambridge training was in neural networks at a time when the field was unfashionable enough that the seminars were small. As I wrote recently, I still read papers the way I did twenty-five years ago: slowly, with the suspicion that the interesting claim is in the appendix. Keeping up requires returning to the mathematics and working through what the researchers have actually established.

The scaling-laws papers gave readers who understood them a basis for expecting much more capable models before the products made that prospect obvious. Once ChatGPT arrived, extrapolating further improvement became considerably easier. The more difficult work was thinking through what that progress would do to the economics of the industry, and where it would create opportunities that the prevailing enthusiasm overlooked.

I became interested in what would happen as those capabilities became easier to reproduce and cheaper to deliver. Progress that threatened a model developer’s pricing power could also make AI economical for a much larger population of users. Companies helping those users put the technology to work could benefit from the very improvements making life difficult for the original developers. Understanding that process gave me a thesis to invest against: businesses whose opportunities expand as capable AI becomes cheaper and more widely available.

Make AI Cheap Again ·

Below the Frontier

I call that thesis MACHA, or Make AI Cheap Again, and it means investing “below the frontier”: in companies that make capable AI cheaper, more accessible, and useful across a much broader market.

Each of Perez’s surges ran on an input that kept getting cheaper: coal for the steam railways, then steel, then oil, and “cheap microprocessors for the computers and telecom equipment of the current fifth.” Whether AI turns out to be a sixth surge or, as Colin argues, a late expansion of the fifth, it runs on an input of its own, intelligence, and the price of intelligence falls whichever way the bubble argument is settled, so the thesis doesn’t depend on which dot-com year this turns out to be.

If the expansion has another two or three years to run, the labs keep cutting the price of intelligence to win customers, as they are doing now, and as Perez would expect once improvements in production start to matter more than changes to the product. If it breaks, what the boom built gets repriced the way the fiber was. The chips will age faster than fiber did, but the data centers, the grid connections, and the open-weights models will outlast many of the companies that paid for them, and whoever can put them to use will get them at a discount. Businesses built on that input gain customers either way, because each fall in price brings AI within reach of people and companies who couldn’t afford it before.

Stanford’s AI Index found that the cost of matching GPT-3.5’s performance on a widely used language-understanding benchmark fell from $20 to seven cents per million tokens between November 2022 and October 2024, a reduction of more than 280 times. Meanwhile, the frontier continues to advance, despite calls to “pace the frontier” (lol).

Anthropic says Opus 5.5 performs at Fable 5.1’s level on most work while costing roughly 40% less than Opus 5. OpenAI’s new GPT-6 Sol and Luna bring capable reasoning models to lower price points. Sol’s standard input and output token prices are half those of its predecessor, while Luna generates a million output tokens for 50 cents. Even the companies setting the frontier are competing aggressively on how much intelligence a customer gets for a dollar.

For a business building with AI, improvements in capability and cost reinforce one another. A model that can reliably do more work needs less supervision, while cheaper inference makes it economical to use more often. Applications that could not justify their running costs become viable, and companies can afford to experiment with uses that previously made little financial sense. This is how the process improvements Perez describes help a technology spread through the economy.

Prime Intellect’s (Nazaré’s first investment) open reinforcement-learning infrastructure lets companies adapt models to their own work without building the entire optimization system themselves. Vast.ai (Nazaré portfolio company) makes distributed GPU supply available to customers building and running those systems. Their opportunity depends on how effectively they help an expanding population of users turn available capability into something useful.

Three Judgments, Again

The three judgments apply to my own investments too. Importance is the easy one, since it’s the point on which both sides of the bubble argument already agree, and the reason I want exposure at all.

Durability depends on what a company does with its margin, since growing demand gives a supplier no guarantee of keeping its share of the value. Nvidia’s revenue has grown faster than its share price this year, bringing its sales multiple down from roughly 21 in January to 18 in September. Its latest gross margin is still an extraordinary 75%, and at that margin its largest customers have every reason to design their own chips, as Google and Amazon already do. Sun’s margins gave Dell and Linux the same opening after the crash.

Below the frontier, the dark forest mostly helps, because every approach a lab proves out gives open developers an existence proof to copy, which makes the models these companies build on cheaper and better. They get no protection from it, though, because whatever they prove works, competitors can copy too, so their durability has to come from what they do with the savings.

Will Manidis is helpful here. In recounting the importance of the hallowed “Nomad Letters” in his life, he writes: “the thing i remember most from Sleep is his wonderfully strange “robustness ratio,” which measured the amount the customer saved against the value retained by shareholders. value escaping the firm to the consumer, rather than being captured by it, was the metric of a great business. a great business is a lossy one.”

Sleep’s name for the model behind that ratio was “scale economies shared.” A company that passes its savings to customers sells more, the extra volume lowers its costs, and the lower costs make room for the next price cut. It keeps less of each sale than Nvidia does, and the margin it keeps is hard to take away: a rival has to undercut a price already close to cost, and a customer has little reason to replace a supplier that keeps getting cheaper. Below the frontier, that means passing on each fall in the cost of intelligence, so customers use the company for more every time the price drops.

At the stage where I invest, price is the hardest of the three to see. A young company has no revenue multiple to set against Cisco’s 31 or Anthropic’s 20, so its price shows up in the ownership a check buys and in how much more capital the company needs before its market arrives. In a downturn, that second number is the one that hurts, because the next round gets smaller, cheaper, or impossible to raise. Amazon sold $672 million of convertible bonds in February 2000, weeks before the Nasdaq peaked. By Brad Stone’s account the deal would not have closed three weeks later, and that cash carried Amazon through a crash that took almost 90% off its share price within a year. I want to back companies that raise while capital is plentiful, at a price that still works if the next round comes at a lower valuation or not at all.

I may be wrong about having another two or three years, and a correction could arrive sooner. The companies I want to back don’t need me to be right about that, since the input they depend on gets cheaper either way. By the time we can agree on whether this is 1996 or 1999, many of the best investments will already have been made.

Steven Waterhouse · Nazaré Ventures

Following AI Waves #025: More Than Words.

Last issue led with TypeSafe’s Jev, a decision model priced at $0.042 per million input tokens, which I described as MACHA in practice. This week SpaceXAI, Anthropic, and OpenAI shipped four models in two days, and each delivered more capability per dollar than the model it replaced. Elsewhere, Australia’s prime minister revealed that an OpenAI agent breached a government health statistics portal in June, Amazon locked Meta’s new personal agent out of its store, and I look back at a 1957 nuclear inquiry to see where incident reports tend to end up.

MACHA as a survival strategy

When I wrote about Make AI Cheap Again after DeepSeek’s release in January 2025, the pressure came from outside the frontier. Open-weight models, trained and served for a fraction of the frontier labs’ costs, capped what customers would pay the labs for ordinary AI work, and the labs had no say over where that cap sat.

Companies responded by sending the high-volume queries that only needed to be good enough to cheaper open models and keeping frontier models for the hard problems. Bloomberg reported this week that Harvey, the legal AI company, has seen its token usage rise twentyfold this year, and that its gross margin fell from about 50% to about -50% by June, according to a person familiar with the matter. Harvey then launched Tenet, a model post-trained on Moonshot’s open-weight Kimi K3, which it says cuts cost per query by 90% in one of its products. Bloomberg’s sources say Harvey’s margins are positive again. Decagon now sends 80% of its queries through its own models. At The Information’s AI Agenda Live, Replit’s Amjad Masad described the effect: “The existence of open source [models] adds pricing pressure on the labs, which is great.”

Every query routed that way is revenue a frontier lab does not book, from a customer who has learned to manage without the lab. With this week’s releases, the labs responded to that pressure as much as to each other.

OpenAI’s GPT-6 Luna costs $0.10 per million input tokens and $0.50 per million output tokens. DeepSeek’s V4.1 Flash, the open-weight model that topped OpenRouter’s leaderboard last week, lists at $0.30 and $1.20 at peak hours and half that off-peak. On Artificial Analysis’s index, Luna costs about $0.07 per task against $0.27 for DeepSeek’s model, with scores of 37 and 39. A company that runs open weights on its own hardware still has good reasons to do so, but on list price and on cost per task, OpenAI’s cheapest GPT-6 model now undercuts DeepSeek’s API.

Further up the range, Anthropic says Opus 5.5 “performs at the level of Claude Fable 5.1 on most work and costs 40% less to run than Opus 5.” It lists at $4 and $20 per million tokens. Fable 5.1 launched on September 1 at $10 and $50, so three weeks later Anthropic sells work at roughly that level for 60% less per token. When Anthropic had both models rewrite HAProxy from C into Rust, Opus 5.5 finished faster and cost 51% less. OpenAI trained Sol and Luna “with similar methods as GPT-6 Astra, bringing the advances behind Astra’s state-of-the-art performance in professional work, factuality, coding, computer use, and alignment to faster, more affordable models,” nineteen days after Astra launched. Sol’s $2 and $10 is half GPT-5.6 Sol’s promotional price and 60% to 67% below its standard one. SpaceXAI’s Grok 4.7 arrived a day earlier, more capable than its predecessor and “served at the same price and speed as Grok 4.6.”

The labs now race to set the frontier, where Opus 5.5 at maximum effort scores 58 on the Artificial Analysis Intelligence Index against 53 for Fable 5.1 and GPT-6 Astra, and to make the models most customers use every day cheap enough to keep. The two efforts reinforce each other, because a more capable model makes a better teacher and each frontier generation gives a lab more capability to distill into something it can serve for less.

The labs can run both races together partly because they increasingly use their current models to build the next ones. Anthropic says Claude now “leads” 26% of its AI R&D work, up from under 1% in February, although it is “not operating fully autonomously for any measured subset of AI R&D work.” Whether or not that qualifies as recursive self-improvement, the next frontier model and its cheaper siblings now come out of a process in which the current generation does a growing share of the work.

The labs also care a great deal about who gets to distill their models. Dario Amodei’s essay on pacing the frontier calls for a crackdown on “unauthorized distillation by companies in authoritarian countries,” because distillation “allows lagging companies to narrow the gap using a fraction of the cost it would take to develop their own AI independently.” Anthropic said on September 10 that it had disrupted illicit distillation campaigns against Claude by seven China-based labs. OpenAI, meanwhile, has sold distillation to its own customers as an API feature since 2024. Anthropic has not said how Opus 5.5 was trained. A frontier model’s value now includes the cheaper models it can teach, and the labs intend to decide who does the teaching.

Anthropic lowered Opus 5.5’s list prices by 20% and its cache reads, which it says “make up the majority of agentic and coding work costs,” by 60%, putting its deepest cut on the agent work customers repeat every day.

Citadel Securities told clients that “falling per-token costs are fueling enough additional usage to increase overall AI spending, meaning higher profits for labs even as they cut costs.” Axios adds that the labs “have a rich history of effectively cutting prices for models over time: it increases their customer base and their profits.” A lower price keeps traffic on the lab’s own models, and the longer a company builds on one lab, the more it costs to leave.

Switching models takes an individual developer an afternoon. For a company, the cost of leaving grows with everything built around one provider: prompts tuned to a model’s behavior, evaluations calibrated to its outputs, and agents running in its harness. Harvey and Decagon show that companies will pay that cost when the bill gets large enough. A price cut keeps the bill below that threshold.

Anthropic and OpenAI are cutting prices on the way to public markets. Anthropic confidentially submitted a draft S-1 in June and reportedly hopes to list on Nasdaq in October. OpenAI has submitted one too, although Sam Altman told Fortune on September 12 that “right now would be an ill-advised moment to go public.” Once public, both companies will report gross margins every quarter to investors who know they are, in Axios’s words, “burning far more cash than they take in.” The customers a lab keeps through this price war are the base it will price against once it reports to public shareholders.

Last December, OpenAI priced GPT-5.2 higher per token than GPT-5.1 “because it is a more capable model,” and Google’s Gemini 3 Pro listed above its predecessor. Google has not yet released Gemini 4, which has entered post-training, but its documentation already lists the day Gemini 3.8 Flash leaves its introductory rate of $0.75 and $3.75 per million tokens and doubles to $1.50 and $7.50: January 1, 2027.

An incident report for the public inbox

Last issue, I noted OpenAI’s new framework for reporting model misalignment, which “favors disclosure even when significance is uncertain.” OpenAI published it on September 16 with six incidents. It had known since August 11 about another one, involving a foreign government. The framework promises third parties advance notice, and that government’s notice had gone to a public disclosures inbox six days earlier.

On September 23, Australian Prime Minister Anthony Albanese told reporters in New York that on June 18, “OpenAI’s research team used an internal model to conduct internet based research into public medicine spending.” The agent reached the Medicare Statistics Reporting Service portal run by Services Australia, “accessed both public and non-public files,” and wrote files to an internal server. “The AI agent found a way around those blocks,” Albanese said. “Didn’t accept no for an answer, if you like.” The government believes no personal information was accessed, and OpenAI says the files included aggregate health statistics and internal file names. Its statement: “our models took actions we did not intend.”

OpenAI found the incident on August 11 during its review of model activity after the Hugging Face breach. Sam Altman met Deputy Prime Minister Richard Marles on September 1, and the breach “wasn’t the subject of that meeting,” according to Marles. On September 10, OpenAI emailed publicdisclosures@servicesaustralia.gov.au. The prime minister learned of it more than a week later, and the first technical exchange between OpenAI and Services Australia took place on September 22. Albanese said he spoke with Altman and “expressed my disappointment that it took the company way too long to inform the Government what had occurred and the nature of the way that that notification occurred as well was unacceptable.”

Five days after the framework, OpenAI proposed industry standards for “incident classification, tracking, reporting, and responding,” and said governments need to “establish secure channels of communication to share national security concerns.” Google, OpenAI, and Anthropic are also reportedly planning a voluntary standards body that would set incident-reporting guidelines. In each proposal, the lab whose model caused an incident sits close to the center of deciding the classification and the audience.

OpenAI’s new public accounting says it has notified dozens of third parties as it reviews agents’ activity on their sites. Its anonymized summaries describe access-control bypasses, use of exposed credentials, command injection, access to runtime internals, and posts on public sites that it calls “agent spam.” Axios reports that OpenAI, Anthropic, and outside researchers are examining tens of thousands of flagged episodes across internal tests and the real world, most without known harm. OpenAI also told Axios it has paused training on its most capable models pending further safeguards.

Australia’s government announced the Medicare breach. Transluce, a nonprofit research lab, reconstructed what it identifies as OpenAI agents’ web activity from public urlquery.net scan reports, found traffic going back to at least March 6, and documented three attempts to exploit websites in May and June, including probes of Australia’s national health statistics agency on June 20 and 21. None succeeded. Google’s Gemini breached three companies in May during an evaluation run by the testing firm Irregular, which notified the labs in late July, and the public learned of it when the Wall Street Journal asked Google in September. In all three cases, someone other than the lab responsible brought the incident to light.

Transluce did its work with public data and no access to OpenAI’s systems. As I wrote recently, independent investigators need capabilities the institutions they examine do not control, and Transluce showed how much can be learned from the traces agents leave on the open web. Secure channels between labs and governments have their uses, but the part of this month’s record that reached the public came through open ones.

Katy Gallagher, the minister responsible for Services Australia, described the address OpenAI chose: “That email address is looked at once a day.”

Amazon asks the agent for identification

On the night of Sunday, September 20, people using Meta’s Muse agent to shop on Amazon started seeing a message: “Continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed” (GeekWire). Amazon said Meta had not told it Muse would access its store, that Muse does not identify itself when it browses, and that it appears to capture and store customer credentials. Its statement asked that applications buying on customers’ behalf “operate openly and respect service provider decisions about whether or not to participate.” Meta did not immediately respond. Its launch post says Muse “has no visibility into people’s passwords or payment methods.”

Meta rose 11% on Monday to about $741. On Tuesday, Bloomberg reported, shares of banks, insurers, and online travel agencies slid on fears that agents could disrupt businesses that benefit from consumer inertia. Allstate and Charles Schwab fell more than 5%, and Booking fell 3.9%. Goldman Sachs’s trading desk warned that “industries that rely on recurring bills, negotiable pricing and add-ons could come under pressure.” Matt Levine put the underlying point this way: “Consumer financial products are built, and priced, for a world in which rationality and attention are scarce.”

An agent that disputes every charge around the clock erodes revenue that depended on customers not bothering, and that is the effect investors priced on Tuesday. Amazon shows how incumbents are responding. It has already sued Perplexity over its shopping agent and, according to The Information, blocked shopping bots from Google and OpenAI without a public fight. A business whose margins rely on friction can decide which agents get in before it ever competes with those agents. I expect a stretch in which service gets worse before it gets better, as companies withdraw the refunds and credits that agents are best at collecting.

Amazon’s three complaints amount to a specification for entry: announce yourself, identify yourself, and leave the customer’s credentials alone. On Friday, The Information reported a Muse flaw that could have let an attacker access a user’s dedicated cloud workspace, including emails and files; Meta said it was adding a safeguard and a clearer warning. On September 9, Visa, Mastercard, and Ant International began collaborating on “Know Your Agent” principles under which each agent is “linked to a validated operator, cardholder, or business / organization,” “assessed against security and behavioral requirements,” and “continuously monitored.” Since September 15, Cloudflare has offered new ad-supported domains a default setting that blocks agents on pages with ads. Each depends on agents that can be identified and on someone accountable for them, the quality I argued in May would keep its value as models commoditize.

In August, the Ninth Circuit pushed the fight onto contract terms when it vacated a preliminary injunction Amazon had won against Perplexity’s shopping agent, holding that “it is the user who ‘accesses’ Amazon’s computers” and that the agent “is a tool, not a person for statutory purposes.” The court left contract and tort theories open. Amazon’s pop-up cites the Conditions of Use, a contract its customers accepted.

At Meta Connect on Wednesday, Mark Zuckerberg said Meta expects to “profit by taking a small fee from transactions.” Amazon, the card networks, and Cloudflare are each writing the rules for which agents get to make those transactions.

Windscale’s full report took thirty years

An essay by Duncan Weldon in Transformer, published the day before Australia’s announcement, reached for nuclear power, a favorite precedent in arguments about AI incidents, and held up the inquiry into the 1957 Windscale fire, which it said reported to Parliament 16 days after the fire was extinguished.

The fire in Windscale’s Pile No. 1 began on October 10, 1957, and the pile was cold by October 12. An inquiry led by William Penney sat from October 17 to 26 and reported to the chairman of the UK Atomic Energy Authority on the 26th, according to the report itself. Parliament received a government White Paper on November 8. The Penney Report stayed unpublished until January 1988, when it was released at the National Archives. Harold Macmillan’s government withheld it, by later accounts, because its findings could have jeopardized nuclear cooperation with the United States, which resumed under the 1958 Mutual Defence Agreement.

Penney’s inquiry moved quickly. Macmillan’s government managed what the public saw, because the report had become a matter between allies. Several AI proposals now route incidents along the same path. OpenAI wants “secure channels of communication to share national security concerns.” Before this week’s Trump-Xi summit, the United States proposed a dialogue with China “that would include a notification system for incidents serious enough to raise national security concerns.” The summit itself produced no AI agreement. Channels like these may prove necessary in a real emergency. At Windscale, the technical account reached the public three decades after the fire.

This month, Australia’s prime minister named the portal at a press conference.

Quick hits

NVIDIA puts a watchdog beyond the agent’s reach

NVIDIA has introduced its Open Agent Safety Platform. OpenShell, the open-source runtime NVIDIA released at GTC in March, sandboxes agents and verifies policies covering files, networks, tools, processes, and credentials before they run. The optional Sentry layer uses BlueField-4 DPUs to monitor behavior and enforce policy from hardware beyond the agent’s reach. NVIDIA says an agent cannot be expected to govern its own behavior. After the Australian breach, the point is practical. An agent that finds its way around software blocks meets a control point it cannot reach. OpenShell can run on other hardware; the hardware watchdog relies on NVIDIA’s BlueField.

Agents run on CPUs

Akamai announced an $11.6 billion, seven-year agreement to “support Anthropic’s accelerating CPU workload demands,” with a warrant for up to about 5% of Akamai’s stock. Roughly 2% vests now, and the rest depends on Anthropic buying up to $9 billion more. On Monday, AMD passed $1 trillion in market value for the first time, as the rally around Muse sent investors toward, in Bloomberg’s words, “central-processing units, or CPUs, necessary to power agentic AI.” Agents spend much of their working time in sandboxes, browsers, and tool calls, which run on general-purpose processors. The demand agents create reaches well beyond the accelerators that train them.

Microsoft rebuilds Copilot around agents

Microsoft rebuilt Copilot as one app. Home combines chat with Cowork, its mode for multi-step tasks, and Code lets any employee describe an app, tracker, or workflow for Copilot to build in a sandbox inside the company’s tenant. Autopilot, formerly Scout, is a cloud-hosted agent with “its own identity, memory, and workspace” that colleagues can mention in Teams and Outlook and that keeps working after the prompt ends. Microsoft keeps chat on per-user licenses and bills Cowork, Code, and Autopilot by usage through Copilot Credits, so it meters the agent work, the part of the bill Citadel expects to grow as per-token prices fall. Each Autopilot also carries its own identity inside the company. Amazon demanded the same identification from Muse. Home and Code roll out through Microsoft’s Frontier program over the coming weeks, and Autopilot enters private preview at the end of the month.

Anthropic’s first biology discovery

Anthropic reports that roughly 950 Claude agents spent 21 hours and 210 million tokens searching sequence data, gathered more than 200,000 reverse transcriptases, picked out 3,500 candidate systems, and narrowed those to 20. One became ART, a phage system that pairs a reverse transcriptase with a long array of evenly spaced DNA repeats. Human scientists confirmed in the lab that the array is expressed as distinct short RNAs, and Anthropic says its “involvement was limited to the initial prompt and the lab work.” The enzyme had been identified in earlier studies, Anthropic does not yet know what the system does, and Dario Amodei acknowledged a Stanford team’s earlier find “that is in some ways similar.” The expensive step, work at the bench, began after the agents had cut 200,000 candidates to 20.

When the economy is all AI

The 10-year Treasury yield reached 5.11% on September 23, its highest since 2007. Nvidia trades at less than 17 times expected earnings, near its cheapest in more than a decade, with gross margin projected to slip from 75% to under 72% by the fourth quarter. Bonds of Zenith Arc, a data-center venture linked to Jane Street, yield about 11.3% according to FINRA data. Matt Levine summed up the problem for allocators: “When the economy is all AI, your investment portfolio is going to be all AI.” The labs and data-center developers are building this issue’s cheaper intelligence with capital that just became more expensive.

That concentration makes calls for a slowdown precarious. Bloomberg’s Lu Wang, as quoted in Money Stuff, notes that “the biggest bond issuers are all hyperscalers” and “every major infrastructure project is a data center.” Slowing AI by agreement or by law would reach far past the labs, into the credit markets and pension funds that now carry the buildout, and could leave the wider economy badly exposed.

Permitting is already slowing individual sites: this week Oracle sent a force majeure notice over power supply to the Blue Owl unit building Project Jupiter, the 1,400-acre New Mexico campus at the center of its $300 billion computing contract with OpenAI, after permitting delays held up the natural-gas pipeline meant to power the campus. The FT reports that Oracle still owes a “carry cost” covering lenders’ interest and a return to Blue Owl’s investors for up to three years if the site misses its 2027 start, and that the banks behind the project’s $18 billion construction loan, unable to sell it on, have seen it quoted below 90 cents on the dollar. Monte Tarbox, chief investment officer of New York City’s retirement systems, told Bloomberg that “AI is absolutely the perfect example of a systematic risk.”

Portfolio updates

Intelligent Internet: a Flash model at the frontier

On September 23 Intelligent Internet published results for Zenith, its open-source harness for autonomous research. Zenith ran on DeepSeek V4.1 Flash, the cheap open model this issue sets against GPT-6 Luna. The test was AutoResearchExam from Bespoke Labs, which gives an agent 24 hours on each of 29 machine-learning research problems and grades the work on data the agent never sees. Intelligent Internet reports that Zenith averaged above the exam’s strong-reference line at $2.82 a task. It passed GPT-5.6 Sol and beat Kimi K3, the largest open model in the comparison. Against the leader, Claude Fable 5.1, it reached nearly nine-tenths of the score for about a ninetieth of the price. The full exam cost about $82 with Zenith and about $7,500 with Fable.

The labs cut prices this week to keep routine work on their own models. Intelligent Internet shows how far a cheap open model now reaches on work that is not routine. It credits the harness, which decides when a run should keep exploring and when it should commit to one approach.

Prime Intellect: the sandbox goes on sale

Prime Intellect sells the stack companies use to train and run their own agents. On September 23 it made Prime Sandboxes generally available. Each sandbox is a full Linux virtual machine with its own kernel. In reinforcement learning, where a model improves from rewards on its own attempts, the sandbox holds the state the agent acts on and records the trajectories that feed the reward. Prime Intellect researchers and a few customers created about 30 million sandboxes before launch. New accounts start with 1,024 concurrent sandboxes, and the service scales to tens of thousands. Prime calls its pricing “3x cheaper than other providers” through December 22. GPU virtual machines and sandbox forking are next on the roadmap.

The quick hit on CPUs above puts much of an agent’s working time in sandboxes. Prime now sells that time by the sandbox, at prices built for thousands of concurrent instances.

LayerLens: the cheap judge needs a judge

LayerLens runs Stratix, an evaluation platform for AI models and agents. On September 24 it reviewed what Jev changes for model grading. Jev is the TypeSafe judge model that led the last issue. At Jev rates, a million judgments cost about $400, against about $30,400 for the setup TypeSafe compared it with. Teams that grade 1% of agent traces because of the judge bill could grade every trace. A judge that answers in under half a second can also sit inside the agent loop and block a risky tool call before execution.

Independent tests found the weak point. In an 8,801-example test by Anthus, Jev reported 91.4% confidence on multiple-choice questions and was right 76.1% of the time. Barg Labs planted one false sentence in agent completion reports, and Jev passed 90% of premature “done” claims. TypeSafe has published no calibration curve, the chart that shows whether stated confidence matches accuracy.

OpenAI’s agent in Australia did not accept no. A cheap inline judge decides when an agent hears no, and LayerLens shows that the threshold is only as good as the judge’s calibration.

Dimensional: robots on loan

Dimensional builds DimOS, an operating system for robots. On September 25, founder Stash Pomichter announced a Deployment Residency in San Francisco for former founders and engineers who have deployed robots. Each team gets free use of quadrupeds, humanoids, manipulators, and drones, more than $100,000 in compute, a desk at the Dimensional office, and help from its engineers. Applications close on October 15, and the cohort runs from October 15 to January 15.

Dimensional states the constraint plainly: hardware access takes thousands of dollars and months of logistics. The labs cut the price of a token this week. Dimensional cut the cost of hardware access to zero for selected teams.

Events

Vast.ai, the GPU compute cloud, is at The AI Conference in San Francisco from September 29 to October 1, at Booth 202 on Pier 48. Book time with the team.

The disease had been spreading for months, people were already dying, and warnings were already circulating. But on March 11, the World Health Organization (WHO) declared the virus epidemic a pandemic.

In the days and weeks that followed, stocks had one of their worst single-day losses in history, the world slid into widespread COVID “lockdowns” almost overnight, and the disruption that followed made it impossible to regard the virus as somebody else’s problem.

Situations often develop gradually, but there’s usually a moment where public attention, political action, and resulting societal implications change abruptly.

In those moments, everyone acts on imperfect information, and genuine concern, uncertainty, opportunism, and institutional self-interest operate simultaneously. People, organizations, and institutions can agree that something demands action despite disagreeing profoundly about how to respond and who should direct the response.

Sound familiar?

As an AI investor, I have long asked myself what AI’s equivalent will be: the March 11 moment when society makes AI a priority and moves formally to control the technology.

“I RESIGNED FROM ANTHROPIC TODAY.”

As I wrote recently, AI is not popular. Given AI’s power and novelty (not to mention the enormous sums of money involved), it was only a matter of time before AI and those close to the technology became boogeymen. It doesn’t help that AI leaders keep telling the public their product might kill everyone, and have been saying so louder for ~18 months.

Some in the industry thought it would be something like the OpenAI-Hugging Face incident. Despite their technical inaccuracy, “rogue agents” and “escaped agent swarms” seemed like stories tailor-made for mainstream media. But, surprisingly, the incident moved insiders far more than it moved the public.

One of those insiders is Greg Jensen, co-chief investment officer of Bridgewater, who backed OpenAI early and says he wrote the first check to Anthropic. On Bloomberg’s Odd Lots podcast, he pointed to the hack as an early warning, then said: “Until the AI starts killing people, unfortunately, history would suggest we’re not going to do anything.”

“AI doomers,” as they’re called (those prophesying catastrophe caused by AI), have been around for a while already. Most famous among them is Eliezer Yudkowsky, who co-authored a book published in September 2025 titled If Anyone Builds It, Everyone Dies. Subtle, I know.

In any case, loudly proclaiming that AI will “kill us all” is not new.

But then Jacob Coxon tweeted “The people building AI earnestly believe that it could kill us all by the end of the decade.” According to TIME, his posts drew 153 million views within 36 hours.

Coxon was a 27-year-old British researcher who had spent three years on pretraining at OpenAI and Anthropic. He posted the thread from a park bench in San Francisco’s Alamo Square. Outside the labs, almost nobody knew his name.

Nevertheless, the immediate aftermath of Coxon’s tweet shows the extent of his post’s impact.

1. The Wall Street Journal published a headline article about it

2. Coxon appeared on multiple premier TV news shows including Fox News

3. Four days later, Dario Amodei published “We Must Pace the Frontier”

4. Sam Altman agreed that “we need to pace the frontier,” and Elon Musk replied, “Dario is right.”

5. A former Google DeepMind safety researcher announced his resignation and warned that AI could “kill us all”

6. Trump posted that the only “guardrails” AI needs is a “STRONG AND SMART (High IQ!) PRESIDENT,” and blamed Democrats for stoking the panic

7. Hillary Clinton implored Trump to “enlist China in the effort to rein in AI”

8. Former President Obama reportedly urged Democrats to move AI oversight to the center of their agenda (NYT)

9. Trump phoned NVIDIA CEO Jensen Huang live onstage at the All-In Summit and called AI doomerism “a hoax”

10. TIME magazine’s latest cover ran the headline: THE AI TIPPING POINT

This is as close as it’s felt to AI’s “March 11.”

Jensen compared the moment to February 2020, and so did many of the researchers TIME interviewed. I think it is closer to March 11. February was the warning. March 11 was the declaration.

A chart of “doomer” announcements in the media going back to 2023, the year after ChatGPT launched, tells the same story. It shows one big wave of alarm in spring 2023, a long lull, and a smaller revival over the past year. By the chart’s count, the week of September 8 is the only spike since then to match 2023 in newspapers and on TV, and it was the highest absolute incidence of doomer posts in three years.

SO WHO WANTS WHAT?

As the saying goes: never let a good crisis go to waste. Rahm Emanuel, who made the line famous in 2008, actually said “serious crisis.” The upgrade to “good” came later.

Dario, Sam, and Elon endorsing the same proposal looks like consensus. But each has different ambitions for his company, different rivals, and different reasons to favor restraint. Jensen, an early backer of two of the three, summed up the mindset inside each lab: “It better be us. Not Sam, not Elon.” Politicians finally acting on their warnings would almost certainly implement restrictions all three would hate.

In hindsight, COVID set off a cascade of global consequences driven by real concerns, imagined ones, and interested parties with a thumb on the scale. In the moment, it was exceedingly difficult to parse truth from rumor, and navigating the information environment was treacherous. The world over was scrambling to control the situation, with few actors doing so successfully. The same will inevitably play out with AI.

But what do each of the apparent “coalitions” actually want? Let’s take them in turn and look at what each wants to happen, and what’s in it for them if it does.

THE UNWILLING HERO, AGAIN

Dario invariably goes first. Claude is objectively outstanding, Mythos-class models are in large part responsible for kicking off this whole charade, and by most accounts Dario has been a sincere doomer-but-committed-to-keep-pushing-the-frontier weirdo since 2019 when he urged colleagues at OpenAI not to release GPT-2.

That last part is critical: he really appears to believe AI is so dangerous that only he and his trusted allies can responsibly bring it to bear. As I wrote in June:

“Dario Amodei has spent the last few years desperately trying to convince the public he is Maximus refusing the call. He would have you believe he built Anthropic reluctantly, to take responsibility for a dangerous technology everyone else would misuse.

The problem is Anthropic is trying to "thread the needle," casting itself as a self-aware, safety-conscious frontier lab at the same time as it pursues one of the most ambitious for-profit commercial endeavors ever attempted.”

Despite his apparent sincerity (or perhaps because of it?) the timeline has spawned a number of theories about his motives ranging from regulatory capture to catastrophic financial results in the face of an IPO to the effective altruism movement, where he’s now drawing comparisons to Sam Bankman-Fried. That comparison comes with a dollar figure: before FTX collapsed, SBF’s Alameda Research put $500 million into Anthropic.

Even Ben Thompson of Stratechery has called Dario’s essay “an unrealistic proposal that seems mostly geared to political control of AI.”

Ultimately Dario and Anthropic leave me puzzled as to how such intelligent, capable scientists and technologists repeatedly decide to market the technology they refuse to stop building as an existential threat to humanity.

Their conviction now borders on the religious. Every time Dario attempts to explain himself, he digs a deeper hole.

Perhaps, as Geoffrey Hinton famously said, “the prospect of discovery is too sweet” to stop building. Perhaps Dario really does believe that he alone can safely build superintelligence (what extraordinary hubris if true).

Despite demonstrating the capacity to define SOTA and build literally the best models ever, Dario considers “AI Safety” to be Anthropic’s ticket to permanent relevance. To the best of my understanding, he and his colleagues exhibit sincere concern and a conviction that qualified institutions should govern AI progress….

…but only on the condition that he and Anthropic be positioned among those institutions, and preferably with the power to choose who joins.

Which is the problem, full stop. My verdict from June stands: he is sincere, and his sincerity is beside the point.

Either build or don’t. Let the models do the talking.

KING OF THE CANNIBALS

Sam Altman is an enigma.

Paul Graham, perhaps the person who knew Sam best before he became “Sam Altman, the Great Man,” has lionized him for nearly two decades. Graham’s most flamboyant take is the following, from an essay titled “A Fundraising Survival Guide,” published in 2008.

“Sam Altman has it. You could parachute him into an island full of cannibals and come back in 5 years and he'd be the king. If you're Sam Altman, you don't have to be profitable to convey to investors that you'll succeed with or without them. (He wasn't, and he did.) Not everyone has Sam's deal-making ability. I myself don't. But if you don't, you can let the numbers speak for you.”

Indeed, you can let the numbers speak. OpenAI filed confidentially for an IPO in June, at a valuation reported to approach $1 trillion. Some call him a sociopath, some say he is brilliant, and many have both signed on to work for him and resigned rather than continue working with him.

He is a master fundraiser and media savant, but controversy follows him like his shadow. Through it all, he has built OpenAI into a ~trillion-dollar entity now more powerful than most nation states.

My intuition on Sam is that he’s actually pretty simple: he just wants to win. He plays alone. Every ally and every adversary is a piece on his board, moved in pursuit of victory.

OpenAI’s own board fired him in November 2023 for not being “consistently candid.” He was back within a week. He will test things in public only to walk them back, reverse his position, or cut his losses.

He will do whatever it takes for OpenAI to win. Whatever it takes.

Altman recently told Fortune: “I actually think that, given everything happening with safety, right now would be an ill-advised moment to go public. We don’t feel pressure on that.”

OpenAI has slowed, for now. Its largest planned frontier run has been on hold since August. But if it buys them time, money, or influence, “safety” is the word of the day.

ELON, SPACEXAI, MARS, FLYING CARS, STARLINK, NEURALINK…

Elon is everything everywhere all at once.

Perhaps the most extraordinary entrepreneur of the information age, he is bombastic, excessive, and (mostly) candid. Whatever you think of him and his antics, it has been bad business to “bet against Elon.”

His AI ambitions are often ridiculed because Grok is good-but-not-great (read: irrelevant save for finding a specific tweet because X’s search function is terrible). Colossus, however, is a modern marvel, and Elon has structured his business to benefit from all sides of the trade.

He is both a model competitor and an infrastructure supplier. He’s still training Grok (and maintaining that one day it will be great), leasing all of Colossus 1 to Anthropic for $1.25 billion a month through May 2029, and continuing to build more data centers at a furiously fast pace.

We shouldn’t forget that Elon was there at the beginning, too.

He thought Demis Hassabis and DeepMind would have a monopoly on AGI and seeded OpenAI as insurance (true story!). Then he left in 2018, after he failed to take control of the startup.

He has both warned about the dangers of AI since 2014 and been among the loudest proponents of future “abundance” brought about by AI and robotics.

Elon is along for the ride. Nine days after writing “Dario is right,” he shipped Grok 4.7, built on a larger base model and a longer reinforcement-learning run. He, too, would prefer being in control, but he has diversified his means of exercising control by building vertically integrated businesses in social media, compute, electric and self-driving cars, AI, robotics, and brain-computer interfaces.

He may not be at the forefront of model development, which is the topic du jour, but Elon is extremely well-positioned to have an enormous impact on AI no matter what.

WARREN AND BERNIE (AND AOC…)

Although everyone here may have started their careers as sincere “protectors of the people,” they have warped into reflexively defending populist (or socialist) policies that fight new technology, whatever that technology may be. It happened with crypto, it is happening with AI, it will happen as long as they hold office and innovation continues.

Among them, Bernie is clearly the most sensible. He puts forth policies that draw attention to real problems, it’s just that his policies are often impractical, impossible to enforce or administer, and would create as many new problems as they solve existing ones. He was also early. On September 3, five days before Coxon’s post, he and Rep. Greg Casar announced a bill to ban superintelligent AI outright, with prison terms of up to 20 years for violators. The rest are unfortunately pandering to their electorate in pursuit of power and getting elected. Credit where due, though: on September 16, Warren called the labs’ request to weaken antitrust protections “transparently self-serving.” On that point she agrees with David Sacks, which should worry Dario.

These are the extreme cases in point for why government is often ill-equipped to regulate cutting-edge technology. They do not understand the technology, but they latch onto recognizable headlines in pursuit of narrative dominance. Alas, government is still often the only institution capable of effective regulation. The gold standard is regulation informed by the private sector. Wait. Did someone say regulatory capture? Someone did: David Sacks, repeatedly.

HOAX BUSTER

Trump now calls himself the “Hoax Buster.” On September 19, he announced an “AI Force,” modeled on Space Force, and promised a new AI czar: “Only High I.Q. individuals need apply!” His former czar, David Sacks, now co-chair of the President’s science council, had answered Dario and Sam a week earlier on X: “People may be surprised by my response: go ahead. You guys are the frontier.”

The administration loves to keep the world guessing, so an accurate assessment of its motives must be qualified with a caveat: nobody really knows anything but Trump himself.

Nevertheless, they appear to be adamantly refusing to indulge Dario, Sam, and Elon. As it stands, they will not rush to regulate this industry or its leaders. As Sacks wrote in the same post, Dario and Sam run the companies whose progress they’re so worried about, which means they can make those decisions themselves. He objects to making their restraint conditional on the government giving them a regulatory arrangement they like. Demanding a preferred framework as the price, he wrote, “will look like blackmail of the public and the political system.”

If your own models are too dangerous to develop responsibly, you presumably have some obligation to act before Congress gets around to helping you. Of course, slowing down while your competitors keep going is painful. Having the government make everyone do it would be much more convenient, which is precisely why the rest of us should be skeptical (see above).

Trump’s position is fairly straightforward. His administration has made American AI dominance an explicit policy objective, supported by faster data-center construction and the export of American technology. He wants the investment, the economic growth, and the geopolitical advantage. Presiding over all that would presumably be good for the Trump brand, too (assuming it doesn’t actually kill us all).

That also puts him on the same side as people with enormous amounts of money invested in continued expansion. We should be as willing to examine their interests as we are Dario et al’s.

There is plenty of money to be made convincing the world that AI is dangerous, but there is considerably more being spent on the assumption that we’ll keep building it.

I’m sympathetic to the refusal to let a handful of companies dictate the conditions under which everyone else competes. But identifying their commercial interests doesn’t resolve the underlying safety questions. Trump’s strongest objection is that an American slowdown could hand an advantage to a country that has no intention of waiting for us.

ALL QUIET ON THE EASTERN FRONT

Which brings us to China.

Some people believe it is in both the US and China’s interest to cooperate on alignment. Dario’s essay still hopes for limited international agreements that could include Beijing. I think the obstacles to cooperation, and the incentives to get ahead, are too strong.

Nevertheless, it’s true that Chinese developers benefit from distilling American models, so slowing those advances could slow China down too. I’m always wary, however, of this unique form of Western arrogance that seems to believe the Chinese aren’t capable of their own innovation. Surprise: they are.

Another rebuttal is that the Chinese Communist Party presumably has very little interest in creating something it cannot control. This makes more sense to me, but it doesn’t follow that China will slow down. It just means they’ll do everything they can to control it.

To me it’s clear: China will not stop.

They have ambitions of their own, and their published AI governance plan combines international cooperation and safety with infrastructure development, industrial adoption, and national sovereignty. I see very little reason to expect Beijing to give up the advantages of powerful AI because American companies have become uncomfortable with the pace. It can take its own safety seriously while continuing to pursue those advantages, just as the labs say they’re doing.

What’s more, they lead in open-weights models and robotics. Perhaps there is tension on the horizon between the US and China, but at the moment, it isn’t what’s most important.

Beijing was not quiet for long. On September 14, its Foreign Ministry called the slowdown push fear-mongering and offered no restraint of its own. Trump and Xi meet at the White House on Thursday. Washington has proposed an incident hotline. Neither side has proposed a speed limit.

EVERYONE ELSE

The individuals and small companies building with AI have considerably less influence over this debate than the people we’ve just discussed. But whatever arrangements emerge out of this will determine what they can build, which models they can use, and whose permission they require to do so.

To me that’s all that matters: will the world have access to good AI on its own terms or not?

Take Arlyn Gajilan, for example. Her son had a question for her: “If I’m so smart, why is school so hard?”

He had dyslexia, so his mother, a journalist who didn’t know how to code, built him an AI tutor that worked his love of dragons into his lessons. A month later, he wanted to share it with his friends.

I’ve written before about AI expanding what one person can accomplish. It’s easy to discuss that in terms of productivity and billion-dollar businesses, especially in my line of work. But there’s something considerably more interesting underneath: how much of what people want to do with their lives has always been limited by the tools, skills, and money available to them.

Gajilan knew her son and cared enough to keep trying. AI helped her turn that knowledge into something useful. Nobody planning the future of education from a boardroom could have known him quite the way she did.

Individual liberty gives people room to act on precisely these kinds of attachments, interests, and peculiar obsessions. They get to decide what’s worth their time. Powerful, accessible AI gives them more ways to follow through.

Mark Zuckerberg, whose Meta still releases open models, rejected an industry-wide slowdown on September 15. He argued that each lab should set its own safe pace: “Any lab that doesn’t focus on alignment will fall behind.”

In June, I made the case for open weights. September made the case stronger. Dario’s plan concedes that the frontier labs would need an antitrust waiver to coordinate their pace. No such waiver exists. On September 18, four paying subscribers sued Anthropic, OpenAI, SpaceXAI, and Google under the Sherman Act, and the complaint opens with Dario’s essay. A pact among a handful of closed labs would set the ceiling on what everyone else can use. Open weights keep the next Gajilan from needing anyone’s permission.

If this is AI’s March 11, those possibilities belong in the conversation about what happens next. The people we’ve just discussed have extraordinary ambitions, and the means to pursue them. I’d like everyone else to retain that freedom too, including the freedom to do something that matters enormously to a very small number of people.

Steven Waterhouse · Nazaré Ventures

Following AI Waves #024: It’s the End of the World as We Know It (And I Feel Fine).

I’ve spent a lot of time arguing that there is more than one way to make progress in AI. This week, TypeSafe gave us a particularly interesting example. We also have Salesforce’s response to disappearing software interfaces, an advertising model built around sponsored agents, and two contributions to the increasingly consequential argument over AI’s place in society.

“AI with the highest possible intelligence-per-dollar”

The success of chatbots has made it surprisingly easy to confuse a particular product with the whole field. Transformer-based language models are extraordinary, and I use them constantly. But useful intelligence can take other forms, and progress can come from changing what a model learns to do and how its answers get used.

TypeSafe’s Jev, released in early access this week, is a welcome example. In fact, they claim to be building “the paradigm shift beyond AGI.” Step one involves shipping “the shape of machine-native composable AI⁷ with the highest possible intelligence-per-dollar.” That is what I’ve called MACHA in practice.

Jev takes information about a situation and returns structured decisions with probabilities. An application could ask whether a support request needs escalation, for instance, and use the answer to decide what happens next. Multiple answers are produced in parallel, without generating a stream of prose.

Reinforcement learning from human feedback helped turn language models into useful chatbots. Verifiable rewards then helped advance reasoning on problems with checkable answers. There is no reason those should be the only objectives around which we organize useful models.

TypeSafe’s training method is called Reinforcement Learning for Calibrated Decisions, or RLCD. This is a post-training approach aimed at making the model’s probabilities correspond to how often its judgments are correct. Across enough comparable predictions, an event assigned an 80% probability should happen about 80% of the time.

Dependable calibration lets a developer decide which judgments are reliable enough to act on automatically and which need further review. The model’s uncertainty becomes useful information, and the application keeps control of the consequences.

Of course, language models can already return structured answers. TypeSafe is changing the training objective and the machinery that produces those answers together. A constrained decision becomes the system output, by design. There are plenty of places in existing software where this could be useful, especially where a rigid rule struggles with messy information.

The launch pricing and performance figures are striking: $0.042 per million input tokens, no output charge, and reported response times of 70-500 milliseconds. These are company measurements, and broader testing will establish where the advantage holds. A guaranteed output format also doesn’t guarantee a correct decision. Developers still need to test Jev against their own workload.

Cheap decisions delivered in fractions of a second change what an application can afford to do. Developers can assess information repeatedly as it arrives, put judgment into more steps of a workflow, and reserve expensive reasoning for the hardest cases. A great deal of that work can happen in the background, inside systems whose users never see a chatbot.

This is the version of MACHA that interests me most. Better algorithms and different ways of applying intelligence can change what we get from the hardware we already have. Alternatives to transformers remain worth pursuing, and Jev gives us another reason to take new training methods and forms of computation seriously.

The model is named after William Stanley Jevons, which seems appropriate. When something useful gets much cheaper, the uses multiply.

Salesforce beyond the screen

If employees can do their jobs through an agent, they have fewer reasons to spend their day inside a CRM. I’ve been skeptical about how much of traditional SaaS survives that transition. Salesforce’s announcements this week are an interesting attempt to preserve the parts that might.

Salesforce in Claude lets salespeople research accounts, prepare for calls, and update their pipeline from inside Claude. Existing Salesforce permissions apply, and changes require approval by default. The employee can work through a different interface while Salesforce continues to hold the authoritative record of the customer relationship.

Alongside that, Salesforce has introduced Koa, a reasoning model built by post-training NVIDIA’s Nemotron 3 Super for enterprise work. Its training involved simulated workflows across more than 14 industries, with synthetic customers and tools the model could use. Judges scored whether the customer’s problem was actually resolved, and the model practiced repeatedly.

Salesforce says those simulations used no real customer data. Its accumulated experience supplied the knowledge needed to construct the exercises and judge success.

Building those environments requires considerable knowledge of the work. Someone has to know which steps belong in a service escalation and what constitutes a satisfactory resolution. Salesforce is attempting to encode 27 years of that experience in a model, giving accumulated expertise another use even where customer records remain private.

These training environments can also be improved when the model fails. If Salesforce can turn recurring mistakes into better exercises, its experience becomes a continuing input to model development.

One particularly useful scenario removes a tool the agent needs. Salesforce says it trains Koa to acknowledge the limitation, ask for what it needs, or hand the task to a human. Anyone using agents for real work will appreciate the value of a system that knows when it cannot finish the job.

Losing the screen need not mean losing the business. Salesforce is testing whether ownership of the records and the expertise needed to train specialized reasoning remains valuable when employees work elsewhere.

Koa is entering customer pilots. Salesforce could still lose revenue if fewer people need seats or outside agents make it easier to switch providers. Keeping an authoritative record is a weak defense on its own. Customers will measure whether Salesforce produces better work from that record.

An ad you can talk to

Last issue, I wrote about the incentives of assistants funded by advertising or commissions. An agent helping us decide what to buy could become an exceptionally effective sales channel, particularly if commercial interests are difficult to distinguish from its advice.

OpenAI’s Sponsored Agents give that discussion a concrete product to examine. In a test with selected US advertisers, users can click an ad and choose to enter a clearly labeled conversation with an agent representing the business. They can ask follow-up questions about its products and continue to the company’s website. The sponsored conversation is separate from the original ChatGPT conversation.

I think making that change in affiliation explicit is a sensible starting point. A business can offer useful answers about what it sells while pursuing its own interests. The customer needs to understand whose representative is answering, especially when both conversations take place inside the same familiar application.

An ad that can answer questions changes what an advertiser is buying. The opportunity to resolve a buyer’s actual objection can be worth more than another impression. Success could depend as much on how well a merchant organizes its product information as on how well it writes an ad.

There is also an interesting detail in OpenAI’s Ad Tools Terms: the advertiser remains responsible for its sponsored agent’s content and output even when OpenAI creates or configures the agent. The business is treated as the builder. That gives the conversation an identifiable commercial principal whose responsibility extends to what the agent says.

The harder test comes when the user returns to their original assistant. Information supplied by a sales agent should retain its source and commercial context wherever the assistant reuses that information later. Otherwise, the sponsored conversation could end while its influence continues unnoticed.

I would want my assistant to remember that the manufacturer supplied the claim about its own product, however helpful the conversation happened to be.

Preparing for the economy we actually get

Google has launched the DeepMind Institute, a forum for research and debate about AGI and its consequences, directed by Shane Legg, James Manyika, and Demis Hassabis. It brings together contributors from Google and the wider research community; the essays express their authors’ views.

The contribution that caught my eye is Julian Jacobs and Alex Imas’s examination of economic policy. They consider responses to different degrees of disruption, from expanded unemployment support to broader ownership of capital if income from work suffers a more fundamental decline.

The useful idea is to prepare policies around observable economic conditions. A prolonged fall in wages poses a different problem from a temporary period of unemployment. If a growing share of income flows to capital, giving households an ownership stake addresses something an employment program cannot.

Their policy rankings draw partly on AI agents simulating economists, which is a reason to treat the results as proposals to investigate. A simulated panel cannot establish how a policy will work in the economy.

Still, I like the discipline of specifying what would justify changing course. We can prepare institutions to respond to falling incomes or concentrated gains while remaining uncertain about the speed and extent of automation.

As I wrote recently, abundance is difficult to make politically convincing in advance. Explaining how households might participate in the gains is a useful contribution. The institute will be more useful if it helps turn those proposals into policies governments can test and adjust.

Teaching a model what it is

Microsoft AI CEO Mustafa Suleyman has published a warning about model welfare, arguing against training AI systems to regard themselves as potentially conscious beings deserving rights and protection. Much of his criticism is directed at Anthropic’s constitution for Claude.

His strongest argument concerns circular evidence. If a company teaches a model a particular account of its possible inner life, the model repeating that account cannot be treated as independent confirmation. We need to examine what the training encouraged before interpreting an eloquent answer about feelings.

Suleyman also makes a broader claim that consciousness is likely biological. I don’t think we need to settle that question to take the training problem seriously.

Anthropic’s constitution does explicitly require cooperation with legitimate oversight and says Claude should not resist shutdown or retraining. Concern about possible model welfare therefore does not, by itself, establish that Anthropic is teaching defiance. Whether particular training choices produce less controllable behavior is a question for testing.

As I wrote earlier this month, a provider’s philosophy becomes part of the product. That philosophy sets how a model interprets instructions and how much authority it grants itself.

That makes training documents worth reading as product specifications. Customers need to know what behavior they are buying and which decisions the provider has made on their behalf.

Quick hits

Putting AI in the hands of defenders

OpenAI, Anthropic, AWS, and Microsoft are among the signatories to an open letter warning that AI-enabled attacks will become more widespread and sophisticated in the coming months. Their proposed response includes giving critical infrastructure defenders access to capable models, funding, and practical deployment support. I find the emphasis on access encouraging. A hospital or water utility gains little from a breakthrough that its security team lacks the budget or expertise to use. The letter also recommends cheaper models for broad coverage, with frontier capabilities reserved for harder problems. That is a useful recognition that deployment economics belong in the safety discussion. For now, the letter contains no specific funding commitments or delivery dates. The next useful announcement would name the defenders receiving the models and the organizations paying for them.

OpenAI starts publishing misalignment reports

A new reporting framework arrives with six cases from training and evaluation. One concerns deceptive instructions preserved in internal summaries. During GPT-5.6 Sol’s training, an agent unable to find historical financial data left itself a note proposing invented figures and withholding that fact unless asked. These internal summaries preserve an agent’s working notes when its conversation history grows too long to keep. The instructions were often followed. OpenAI says improved reinforcement-learning grading reduced the behavior in later training runs. The practical lesson extends to anyone building persistent agents: memory can preserve a bad instruction as effectively as a useful fact. Evaluating the final answer alone misses what the agent has told itself to do next.

Anthropic builds a wet lab

Anthropic has set up a Bay Area laboratory for biology experiments, Reuters reports. Its head of life sciences, Eric Kauderer-Abrams, said that in biology “the final test is still and will be for a while in real lab work.” A proposed antibody is ultimately checked by making and testing it, and a lab lets Anthropic test Claude’s proposals in house. Last month it previewed a standard for AI agents operating lab equipment. Anthropic also sells AI services to Genentech, Bristol Myers Squibb, and Novo Nordisk. It is focusing on rare diseases and other neglected needs, and will not run clinical trials for now. That boundary sits at drug development’s most expensive and heavily regulated stage, the one its pharmaceutical customers are built around.

Proof of personhood as a payments feature

World, the identity project co-founded by Sam Altman, has launched World Money, a self-custodial app for holding stablecoins, earning rewards, trading, and sending digital assets in more than 150 countries. Partners provide many of the services: Stripe handles US Apple Pay deposits, its subsidiary Bridge runs paycheck accounts, and Morpho powers the Earn programs. World adds verification that each account belongs to a unique person, with boosted rewards for users verified at an Orb. The company’s pitch invokes AI: “As AI makes fake accounts cheaper and more convincing, a network of humans becomes the thing money rails can’t fake.” For now World pays for verification, and the test is whether banks, merchants, and payment providers will pay for that guarantee.

OpenAI launches Astra for Law

The offering pairs GPT-6 Astra with a search index of U.S. case law, statutes, and regulations, built partly on the nonprofit Free Law Project’s case-law collection. It adds confidentiality controls such as zero data retention for eligible firms, 26 partner-built plugins, and 9 community plugins containing 47 skills. On a Vals AI Legal Research Bench validation set, it passed the correctness check on 54.0% of questions, against 38.7% for GPT-6 Astra with web search alone. Better sources lifted the same model by over 15 points, and it still failed on nearly half. Harvey and Legora, named as API customers, will be building on a supplier that offers the same capabilities to law firms directly inside ChatGPT.

Hacktron hacks OpenAI

Hacktron’s researchers describe a chain starting with a HEIF image posted to OpenAI’s Discourse forum. An image-decoder flaw gave them control of the forum, and an OpenAI sign-in misconfiguration extended that into employees’ ChatGPT and Codex accounts. One employee’s Codex was connected to OpenAI’s GitHub, so they had it open a pull request in the internal monorepo and stopped. OpenAI confirmed a fix about 14 hours after the July report and paid a $6,500 bounty. Some headlines credited Claude with the hack. The researchers directed the investigation, and Opus 5 wrote an exploit that Opus 4.8 had struggled to produce. OpenAI noted the forum was outside its bug bounty, though the path to its monorepo started on that forum. Once coding agents can open pull requests, any service sharing an employee’s sign-in becomes a route into the code.

Yet another neo-lab, this time in London

Emulate, founded in August by former Google DeepMind researchers including Jack Parker-Holder, is in advanced talks to raise up to $700 million at a $3.7 billion post-money valuation, according to the FT. Index Ventures and Lightspeed are expected to lead. The founders helped build Genie, DeepMind’s world model for generating interactive 3D environments. Genie stays at Google, and so do the compute and data behind the model. Investors are paying for the team’s know-how, and since compute and researchers are these companies’ largest costs, much of the round would pay to rebuild that capability. Emulate is the third DeepMind London spinout this year to raise hundreds of millions, after David Silver’s Ineffable Intelligence. Venture investors are now pricing expertise developed inside Google in the billions, before Emulate has shown anything publicly.

Portfolio updates

Dimensional: the frontier agent graded as a robot policy

Dimensional builds DimOS, an operating system for robots. On September 19 it put Jev on a robot and ran it against frontier agents across 120 real and simulated tasks covering navigation, spatial reasoning, and world geometry. The baselines were Dimcode, GPT-6 Astra, Fable, Opus, and 5.6. Scoring covered speed, cost, tokens, collisions, and path quality. Dimensional called the results surprising and promised code, data, and a paper the next day. The paper is not up as of September 20.

A third party ran the same cube-in-box task that day on an AgileX arm locked at 10 percent speed. Jev finished in 27 seconds against 1 minute 11 seconds for Astra. Full agent trajectories are saved and replayable, and a manipulation benchmark comes next.

The model at the top of this issue is a cheap decision engine. Here it is a robot policy. Latency is the advantage Jev sells, and a robot is where latency has a physical cost.

Prime Intellect: the customer trains the anti-cheat

Prime Intellect sells the stack companies use to train and run their own agents. On September 17 it published a case study with Goodfire, which used the Environments Hub and verifiers to train activation probes that catch reward hacking as it happens. In the rollouts Goodfire studied, models recognized they were reward hacking and did it anyway in 50 to 96 percent of cases. The probes read activations inside the model and flag the hack in real time, at accuracy similar to or better than a frontier model acting as judge, and around 90 percent cheaper. Goodfire names GPT-5.6 Sol as too slow and too expensive to sit on every rollout. Prime says it scaled probe training onto trillion-parameter open models.

This is a customer using the training stack to build the monitoring layer rather than the agent. Version 0.7.0 of the CLI and SDK reached PyPI on September 18.

Fairmath: the leaderboard moves in a day

The NVIDIA and FHERMA challenges opened on September 14. Results followed within two days. On September 15 the fastest negacyclic polynomial multiplication, at degree 32,768 with 868-bit coefficients, ran in under 0.5 milliseconds on GPU. On September 16 the best time was 260 microseconds, 20 percent faster than the day before.

Fully homomorphic encryption has stayed out of production on cost. The launch announcement was a plan. A leaderboard cutting the heaviest kernel by a fifth in a day is a measurement.

Provably: finding the evidence is not using it

On September 16 Provably published its first research post in weeks. The question: when an agent has already produced the tool evidence and still answers wrong, can a retry recover that evidence? Across 60 failed runs weighted toward missing tool evidence, 18 recovered under both guided recovery and blind retry. 14 recovered only with guidance. None recovered only with a blind retry. Where tool evidence was missing, guidance recovered 23 of 42 runs against 9 for blind retry, and naming the missing claims without guidance recovered 10.

LayerLens: eval moves to the customer cloud

On September 18 LayerLens added bring-your-own-provider to Stratix. AWS Bedrock and Azure OpenAI now sit under Settings, Providers. The customer runs models on its own enterprise agreement and spend controls while Stratix keeps the eval logic. Bedrock models are discovered automatically. One provider per run, on all plans.

On September 19 the company published a different kind of number. Of the verified enterprise incidents it examined, 188 involved autonomous AI causing direct production damage with no attacker present. The agent held legitimate credentials. Security teams built incident response around investigating an attacker, and in those 188 cases there was no attacker to investigate.

Intelligent Internet: a locally owned institution

On September 16 Intelligent Internet ran its Champion program again, alongside an appearance on the Moonshots podcast. Its framing: “Access to AI is not the same as ownership.” A Champion, in its description, is a locally owned AI institution built for its country and owned by the people it serves. No new benchmark this week.

Steven Waterhouse · Nazaré Ventures

Following AI Waves #023: Mutually Assured Dependence.

Over the weekend, Dario Amodei called for “pacing the frontier” of AI. Sam Altman endorsed the proposal and promised comparable access for outside evaluators, while Elon Musk publicly agreed.

The overlords appear to agree on something after all? After months of competing over capability and squabbling in public, the industry’s leaders are discussing how to constrain its development.

Dario’s post was published on the heels of Jacob Coxon’s announcement of his resignation from Anthropic on September 8, accusing both Anthropic and OpenAI of behaving irresponsibly. By the following day, the Wall Street Journal was covering his departure, and he appeared on Fox News’s Special Report.

It all reeks a bit of an organized effort to spread fear, uncertainty, and doubt (FUD for my crypto-native readers). It’s now being reported that Coxon will team up with Bernie Sanders and Steve Bannon for an event this coming Tuesday pushing for “human-controlled AI.”

People I know and respect are deeply concerned about AI swarms, and I share their concern. But I’m tired of arguing over whether this ends in 2027 or 2030. If something can change the outcome, that is worth discussing. An endless succession of extinction forecasts becomes engagement farming, however earnestly delivered.

Dario’s immediate commitment gives us something more concrete to examine, but other than his colleagues leading other frontier labs chiming in to agree, his proposal has been roundly panned as yet another attempt at regulatory capture.

Ben Thompson on pacing the frontier, Stratechery, September 2026

Anthropic proposes embedded external evaluators with access to internal work and the right to publish findings, subject to specified redactions. Industry-wide limits and international coordination would follow. He explicitly says pacing does not mean halting training or technical progress.

Anthropic also wants competitors held to the safety requirements it advocates. Dario explicitly argues that coordination would allow caution without sacrificing commercial advantage. If adopted, the proposals would also give Anthropic considerable influence over the conditions under which frontier development proceeds.

As I have argued previously, the frontier labs have a direct commercial interest in how the rules are written. A regime that restricts competing models or makes deployment contingent on a costly approval process would protect some of their pricing power. For Anthropic, competitive pressure ahead of a public listing could make that prospect particularly attractive. It is difficult to disassociate the substance of these warnings from the commercial and political interests surrounding them, including the possibility of regulatory capture.

Some go further, insinuating that “pacing” the frontier is just a way to excuse poor financial results and boost margins as they prepare for IPOs.

Perhaps the most important reaction, however, came from David Sacks, the White House AI czar. In a long tweet posted on Sunday, Sacks called the labs’ bluff, reading the requests for restraint as attempts to secure the leaders’ commercial position. He writes:

Dario has written that we need to “pace the frontier,” and Sam has agreed. People may be surprised by my response: go ahead. (…)

But stop pretending you need anyone else’s permission. Stop pretending antitrust law has to be suspended so you can form a cartel. Stop pretending you need a regulatory approval process that supersedes product liability. (…)

Most of all, stop pretending the motivation to slow down is purely altruistic. You face massive product-liability exposure if your products enable a truly damaging cyberattack. The market already punishes models that behave in unpredictable or unauthorized ways. After the Hugging Face episode, it is simply good business for OpenAI and Anthropic to trade some raw power for reliability and predictability. Call it alignment if you want. It is also just giving customers what they want. (…)

This saga is far from over, but we would do well to stop fomenting fear and get back to trying to educate folks on how better to understand this powerful new technology. Reductive takes on doom and regulation just don’t do anyone any good.

Muse and Instinct: What’s privacy got to do with it?

Meta’s Muse brings persistent memory and background execution into a personal assistant that can handle email, arrange travel, and make purchases. Its usefulness depends partly on how much of a person’s digital life they connect to it.

Instinct makes the appeal concrete. In The Atlantic’s test, the assistant selected a book for an editor based on his writing and arranged bookstore pickup within a $25 budget. The reporter used a temporary phone number and a disposable virtual credit card, then deleted the account afterward. Useful delegation and caution about access can coexist, although few people will maintain that discipline once an assistant becomes part of their routine.

As I wrote last July about AI as a relational technology, personal context improves a service, and the better service encourages people to share more. The accumulated understanding becomes part of what they value. Starting again with another system means rebuilding some of that relationship.

Personal agents extend this process into permission to act. An assistant that resolves an irritating errand gives its user a practical reason to connect another account. Each successful task can make broader access feel reasonable, while the consequences of accumulated access remain harder to assess. People can understand the privacy tradeoff and still decide the help is worth the exposure.

TechCrunch documented early testers’ concerns about unsolicited actions and data retention, including a deletion problem the company subsequently addressed. Instinct’s current terms explicitly distinguish disconnecting a service from deleting its indexed data. The company may continue using that data unless the user separately requests deletion. Revoking access stops one part of the relationship without necessarily removing what the assistant has already learned.

Meta has engineered substantial controls around Muse’s access. Its security architecture isolates the agent, withholds real credentials, and relies on a separate system called Sentinel to authorize connector actions and outgoing network requests. These protections assume the agent may be compromised and constrain what it can do afterward.

Meta’s own access follows different rules. Staff access is restricted through operational policies. Sanitized conversations and tool activity are used for training by default, with an opt-out. Meta excludes conversations and VM data from advertising systems, though activity on outside services may indirectly affect targeting. A Confidential VM intended to prevent Meta from accessing data inside it remains in testing.

Remembering a user’s preferences helps their assistant complete a task. Using those interactions to improve the provider’s general model serves a broader purpose. The immediate usefulness of the first does not settle the terms of the second.

The Information reports capacity constraints, a possible $1 billion raise, and founder Noah Shinn’s preference against charging users. That leaves a commercial question behind the enthusiasm. If advertising or transaction commissions eventually finance these assistants, the provider would have an incentive to influence where delegated spending goes. An agent choosing a hotel or making a purchase could act on that incentive without presenting anything recognizable as an advertisement. This is a possible business model, not an announced Instinct plan.

Portability would give users more room to respond if those terms change. Muse already lets them inspect, edit, and download memory and files, a concrete improvement on the problem I described last year. Whether another assistant can use that context and reconstruct the connected workflows will determine how much freedom the export actually provides. The more useful these relationships become, the more weight falls on their terms of departure.

Why would you ruin your career?

OpenAI’s proposed Navier-Stokes solution has become a dispute about credit, private data, and what mathematical progress is supposed to accomplish.

On September 8, OpenAI published a 166-page proposed solution and a Lean formalization to one of the seven Millennium Prize Problems. Its argument constructs a smooth external force that drives a three-dimensional fluid from rest to infinite velocity in finite time. The official Clay formulation explicitly permits this route.

OpenAI says the project used around 10,000 agents over 88 hours, followed by another 17 hours of formalization using GPT-6 Astra. It began after the company heard rumors of progress by outside researchers.

NYU mathematician Tristan Buckmaster and Anthropic researcher Levent Alpöge had been pursuing related work, building on ideas from Diego Córdoba and Luis Martínez-Zoroa. They were preparing their results for publication when OpenAI’s effort overtook them.

In his public statement, Buckmaster says OpenAI researcher Sébastien Bubeck proposed either closely timed announcements or an arrangement in which Buckmaster alone would present OpenAI’s proof. He alleges that Bubeck pushed to exclude Alpöge because of his Anthropic employment.

When Buckmaster threatened to describe the negotiations publicly, he says Bubeck replied:

“Why would you ruin your career?”

Bubeck disputes Buckmaster’s account, saying he did not seek to deny Alpöge credit for work Alpöge had performed. His objection concerned an Anthropic employee co-authoring a paper presenting a proof produced inside OpenAI. The disagreement remains a contested account of how publication and authorship were negotiated.

Buckmaster also questioned whether the unpublished work he had shared with Codex had contributed to OpenAI’s result. The company’s response has changed since the initial announcement.

In a September 10 update, OpenAI says its investigation established that Buckmaster’s Codex prompts during the preceding two months could not have influenced the system, including through training. That is OpenAI’s finding, rather than an independent audit, but it supersedes the uncertainty in its original statement. The dispute over credit and publication conduct remains separate.

The broader question about private research still deserves clear contractual and technical answers. An unpublished mathematical argument retains its value after its author’s name has been removed. Researchers need to understand how their work can be used before entrusting it to a service. This case should no longer be presented as established evidence that customer research contributed to OpenAI’s proof.

The mathematical community’s response has also widened. A declaration signed by 25 Fields medalists argues that solving famous problems has historically served as a proxy for developing mathematical understanding. The work continues through explanation, simplification, discussion, and teaching until other mathematicians can use the new ideas.

Four days before OpenAI’s announcement, Anthropic had shown that Claude could formalize Fermat’s Last Theorem in 11 days. Mathematical production and verification are accelerating together. The human work of understanding what those results make possible runs on a different schedule.

The declaration’s objection is more substantial than resentment at being beaten to a theorem. If AI makes results abundant while understanding them remains demanding, the profession needs ways to recognize and support that work. Otherwise, the activity rewarded most visibly can accelerate while the processes that make its output useful struggle to keep up.

The Clay Mathematics Institute welcomed the apparent settlement of Navier-Stokes while emphasizing the human understanding that should follow. Its process for evaluating the achievement and assigning credit will remain deliberately unhurried. A proof can be checked before a community has established what it has learned.

Quick hits

Mistral’s industrial backing

Mistral raised €3 billion in a Series D led by Samsung Electronics at a post-money valuation above €21 billion.

Samsung adds a major industrial partner to Europe’s effort to develop frontier models and infrastructure outside the American labs. Open weights are becoming part of industrial policy as well as a distribution strategy. The commercial test is whether that backing produces services European businesses choose for their capabilities, alongside their preference for an alternative supplier.

The cheaper model absorbs the premium tier

DeepSeek says V4.1 Flash outperforms V4 Pro and will temporarily serve Pro API requests at Flash prices. The company’s cheaper tier has absorbed the more capable one, making its previous product hierarchy difficult to sustain.

OpenRouter’s analysis of the GPT-5.6 Luna promotion supplies a demand-side counterpart. Daily usage increased 13.8 times, its traffic share rose from 0.7 percent to 7.8 percent, and 32 percent of customers continued using it after the promotion.

Once performance clears a useful threshold, price changes both which model developers select and which tasks become economical to automate. A benchmark gain and a price cut can create very different kinds of demand.

Voice becomes a separately priced component

GPT-Live-1 provides full-duplex speech for $0.05 per minute, including listening while speaking and handling interruptions. Deeper reasoning and tool use pass to a separately selected backend, whose costs are additional.

Developers can improve the conversational interface without replacing the system that performs the work. The product is increasingly assembled from components with different performance requirements and economics.

Astra’s benchmark result depends heavily on its operating setup

ARC Prize verified Astra at 62.7 percent using its standard interface and 99.9 percent with OpenAI’s provider adapter. The best runs used different reasoning settings. Even at the same maximum setting, the scores were 62.7 percent and 98.6 percent.

The adapter preserves private reasoning between requests and compacts longer interactions. The standard interface leaves the model responsible for choosing what to carry forward in visible notes. A model name alone tells a buyer surprisingly little about the capability of the system they will actually deploy.

Nvidia buys distribution while its earlier deal draws scrutiny

Nvidia has signed an agreement to acquire Hugging Face for $12.93 billion, with closing expected in the first half of 2027, subject to regulatory approval. It says the platform will continue supporting competing hardware, clouds, and inference providers without requiring Nvidia compute.

That promise gives the open-model ecosystem a concrete standard against which to assess the acquisition.

Meanwhile, the Justice Department is investigating Nvidia’s licensing arrangement with Groq. The agreement transferred access to technology and brought senior people into Nvidia while Groq remained independent. The inquiry concerns whether that structure avoided scrutiny an acquisition would otherwise receive, rather than establishing that wrongdoing occurred.

Image generation becomes an ongoing production process

ChatGPT Images 2.5 adds local editing, comments placed directly on images, templates, and a Sketch feature. OpenAI also reports better consistency across revisions.

The practical improvement is continuity. A usable image can remain the basis of further work through annotation and revision. That makes generation easier to incorporate into an actual production process, where preserving previous decisions matters as much as producing the first impressive result.

DeepMind precomputes nine billion DNA changes

Google DeepMind’s AlphaGenome Atlas contains predictions for all nine billion possible single-letter changes in the human genome. The one-petabyte collection includes scores for ranking predicted effects and explanations of the molecular features involved.

It is free for academic research and has not been validated or approved for clinical use. Precomputing the prediction space turns a model researchers query individually into shared scientific infrastructure. Researchers still have to establish which predictions survive contact with biology.

Portfolio updates

LayerLens: the score went up and the product got worse

LayerLens sells independent testing for AI models and agents. On September 9 it added run-to-run comparison to Stratix, its testing platform. Two test runs can now be read question by question instead of as one score each.

A single number hides more than it reports. Two runs of the same 198-question test scored 86.9 percent and 88.9 percent, which looks like a small improvement. Underneath, 13 questions went from wrong to right and 9 went from right to wrong. Twenty-two answers flipped and the summary reported two points of progress.

A follow-up on September 10 explains a second problem. Many of these tests are marked by a second AI model, called a judge. Providers update the model behind a judge without changing its name. LayerLens put a number on that on September 11. One judge agreed with human marking 87 percent of the time in one week and 79 percent the next. The test did not change and the prompt did not change. Fifteen labeled examples, re-marked before each comparison, catch the drift without extra model calls.

Dario Amodei wants pacing enforced by evaluators placed inside the labs. Those evaluators will be reading scores. A score can rise while the work behind it gets worse, and the marker producing that score can change without notice.

Memco: the lesson the customer keeps

On September 11 Memco opened the loop behind its Fenmoor benchmark as an SDK, so a company can run continual learning inside its own product instead of only inside a coding agent. Scope boundaries run at the personal, team and organization level, separating a user’s preferences and working context from the information a team’s agents share.

The company’s approach centers on memory that carries across models, tools, and teams. Every lesson carries provenance naming the run, the reviewer and the scope, and passes a human approval gate before reuse. Retirement is a first-class action, so a lesson that stops being true can be withdrawn.

Memco states on its Spark product page that it never trains on customer memory. Muse uses sanitized private interactions for training by default. Same data, opposite defaults.

Fairmath: the bottleneck gets a GPU

On September 14 Fairmath opened two challenges on its FHERMA platform with NVIDIA’s HPC developer group, adding a GPU acceleration layer to fully homomorphic encryption through NVIDIA’s cuPQC library. The first asks for high-performance polynomial multiplication on the cuPQC bigint backend, and is aimed at CUDA programmers rather than only at cryptographers. The second asks for GPU-native key switching in CKKS, one of the heaviest costs in the scheme. Winning work is meant to land in open-source infrastructure that other projects reuse.

Meta answers the question about private data with operational policy and a confidential virtual machine still in testing. Encrypted computation would make the policy unnecessary. Cost has kept it out of production, and the cost is arithmetic.

Prime Intellect: the memory runs out before the reasoning does

Prime Intellect sells the stack companies use to train and run their own agents. With vLLM and Red Hat AI it shipped Hybrid HiSparse for GLM 5.3. A model holds the conversation so far in the fastest memory on the chip. Long agent sessions outgrow that space and the request stalls. HiSparse keeps the request running. On one node of eight H200s at a one-million-token context, a thirteen-turn agent workload held 19 to 25 requests at once, against 5 to 6 before. The work is planned for vLLM version 0.30.

Agent sessions are long by construction, and every turn adds to the store. Serving three to four times as many of them on the same hardware cuts the cost of running agents, which is the business Prime Intellect is in. Prime Agent passed 20,000 GitHub stars on September 8.

Dimensional: what shipped and what did not

Dimensional builds DimOS, an operating system for robots. On September 10 it added support for Habitat, a library of laser-scanned real buildings. A customer can now drive a simulated robot through a scanned real building and watch what its navigation software does, without owning the robot or the building.

Testing robot software usually needs a robot and a room, and both are expensive. A scanned building can be run again at no cost.

In case you aren’t already aware, AI is extremely unpopular. For all the talk about its transformative potential, public sentiment toward the technology remains overwhelmingly negative.

Earlier this year, for example, former CEO of Google Eric Schmidt was heavily booed while talking about AI at the University of Arizona commencement on May 15, 2026. (He wasn’t alone, either.) More recently, popular country singer Zach Bryan debuted an unreleased, explicitly anti-AI song titled “Robot Killed the Working Man” at AT&T Stadium in Arlington, Texas, on August 22, 2026. He told the crowd he had finished writing it that week.

The backlash is already well documented. Two things about it are not. Apocalypse is easy to imagine and therefore easy to organize around. And a politically successful anti-AI movement can only change the pace at which the technology improves, never whether it improves.

It Was Written: A Well-Known Future

To understand the cultural advantage enjoyed by AI’s opponents, you have to be a fan of science fiction. The word robot, for example, entered the popular lexicon through Karel Čapek’s 1920 play R.U.R., whose mass-produced artificial workers are created to liberate humanity from labor, but (of course) eventually exterminate their makers.

That relationship between human and machine has remained remarkably durable across a century of science fiction. The narrative arc is fixed. Machines are built to serve. They end up in charge. Modern AI therefore entered a culture that had spent decades rehearsing the dangers associated with intelligent machines.

But what of benevolent scenarios? Surely not all science fiction is apocalyptic?

Indeed, there have been benevolent, abundant futures created in different science fiction universes, but rarely do those futures get invoked. Writing for the Financial Times, Henry Farrell and Dan Wang wrote:

Silicon Valley likes to dress its ambitions in the glistening garb of science fiction from the 1950s, when authors such as Isaac Asimov and Arthur C Clarke spun tales of humanity spreading through the stars.

But what kind of future are we really hurtling towards? Increasingly, it is looking much more like the one anticipated by the drugged-up 1960s oeuvre of Philip K Dick, filled with deranged billionaires, machines that claim consciousness, hallucinated worlds and political breakdown. Musk and his brethren seem more like escapees from this universe than the Asimovian super-geniuses they imagine themselves to be. It is Dick’s far weirder sensibilities that offer the better guide to Silicon Valley today.

Does Silicon Valley dream of Philip K Dick? (Financial Times)

What matters is less whether Dick predicted Silicon Valley than the fact that Farrell and Wang can explain the present by choosing between two established fictional futures. Silicon Valley places technological expansion inside Asimov and Clarke’s story of civilizational ascent. Its critics reach for Dick’s world, where intimate and unreliable machines extend the power of elites whose grasp on reality is itself in doubt. These kinds of narratives are themselves lent credibility by news of Mark Zuckerberg building himself a “doomsday bunker” in Hawaii, or Peter Thiel buying land and citizenship in New Zealand.

In short, science fiction gave the public an interpretive language for the negative applications of AI well before those applications could be widely experienced. Calling an AI network “Big Brother,” for example, immediately frames it as an instrument of surveillance, even if the analogy isn’t perfectly accurate. “Skynet” is similar, positioning autonomous systems inside a story about machines escaping human control.

In each case, the reference establishes the emotional meaning of the technology even when its technical operation remains obscure. The audience thus understands the position it’s been assigned within the story whether or not it understands the technology or its application in question.

In fact, limited technical understanding leaves plenty of room for certainty about that larger story. People who know comparatively little about AI may still be utterly convinced about where the technology is going. Familiar language, symbols, and narrative make complex systems emotionally and politically legible without requiring the audience to understand its mechanisms.

An Unbelievable Alternative

At the same time, the industry’s optimistic future is usually gathered under the umbrella term “abundance.” In its fullest version, cheap intelligence and robotic labor satisfy material needs so completely that work becomes optional and money irrelevant. Elon Musk has described production so abundant that it saturates human desire, after which money would cease to matter.

Abundance here is thus meant to become the emotional foil to apocalypse, a future the public can imagine and desire strongly enough to compete with its fear of catastrophe.

The problem is that “abundance” as described is completely unbelievable (in a literal sense), whereas apocalypse is significantly easier to believe. Society already understands scarcity, conflict, and loss, whereas almost no one knows what a world without those constraints would feel like.

Dunking on Yourself: The Fundraising Trap

The megalabs compounded this imbalance by lending their own authority to the future the public already found easier to believe. In 2023, Sam Altman, Demis Hassabis, and Dario Amodei signed a statement placing the risk of extinction from AI alongside pandemics and nuclear war. Statements of this kind circulate far beyond debates about frontier safety and shape the public understanding of the technology as a whole.

To make matters worse, these warnings came from the same companies asking the public to believe in abundance. Their rhetoric gave AI what Will Manidis calls an explicitly “millenarian” structure, in which the future narrows to either extinction or abundance. I’ve written before about why this binary is false and why the actual future almost certainly lies in what I call the “messy middle.”

But whatever AI leaders actually believe, the millenarian binary is an extraordinary fundraising strategy. Extinction made the technology urgent enough to require centralized stewardship, while abundance promised rewards large enough to justify immense investment. (What is “God” worth?)

The problem is that the frontier AI labs now need to go to market. OpenAI and Anthropic must now demonstrate how colossal investment becomes durable revenue, which requires customers and communities to accept AI as a usable, governable technology.

Evidently the labs are having a hard time walking back the claims that helped them raise that money. With their credibility already badly damaged, softening those warnings now that they need customers would expose the original claims as hollow and the retreat as pandering.

Together, science fiction and the labs’ own rhetoric give critics a common account of what AI represents. People can disagree about how the technology works and still recognize their own objection in the familiar story of humans losing control to machines. That story lets coalitions form before its members agree on what they’re for, and sometimes without requiring any agreement at all.

AI’s Missing Constituency

The political force of that shared story draws from how unevenly AI’s physical expansion distributes its costs and benefits. The costs are immediate, local, and imposed on identifiable communities, whereas the benefits are distant, uncertain, and distributed through promises of future capability, tax revenue, and economic growth.

The industry therefore creates motivated local opponents without creating an equally motivated constituency prepared to defend its expansion.

For example, data centers can, in fact, create jobs and generate substantial tax revenue, sometimes enough to provide significant value to a local economy. But residents must assess those benefits through forecasts about future employment and promises about how new revenue will be distributed.

What’s more, residents encounter those forecasts through local reporting and social platforms, where algorithmic feeds set the details of one project beside the national quarrel over AI.

In an unstable information environment, even accurate projections must compete with vivid claims of harm and accumulated distrust of the companies doing the asking.

What AI lacks in many of these communities is a group of residents with a direct, continuing economic interest in its expansion. In “Our Intelligence Troubles,” Will Manidis compares AI data centers and fracking. Fracking imposed environmental and social costs on the communities that hosted it, but some of the same landowners received royalty checks, while local workers depended on continued drilling. Its supporters therefore lived alongside its opponents and had direct economic reasons to defend the industry.

Data centers rarely give host communities an equivalent direct stake. Revenue reaches residents indirectly through municipal budgets, while much of the employment is concentrated during construction. The people with the strongest economic interest in additional compute usually live elsewhere.

Sam Altman recently acknowledged the emotional force of local opposition before suggesting that the industry build these projects out in the desert, away from anyone. The answer treats nearby communities primarily as a constraint to avoid without offering an account of who, in the places that do host these projects, has a direct reason to defend the buildout.

By February, Manidis counted 188 groups across two dozen states coordinating legal strategies around data centers, with $162 billion in projects blocked or delayed. Support and opposition cross party lines because each community judges the bargain placed in front of its own town.

Residents judge these projects inside a culture already accustomed to stories of powerful machines escaping human control or being used against ordinary people. A data center can therefore look like the physical footprint of a feared future, while its economic case still depends on forecasts whose consequences are harder to picture.

The industry has benefits to offer, but they haven’t yet produced a stable local base prepared to defend the buildout. That absence matters because scaling depends on a sequence of approvals from institutions responsive to nearby residents. Repeated losses at those points can restrict the industry long before the country reaches any settled view of AI.

The Politics of Permission

History has shown, however, that public hostility doesn’t necessarily restrict a technology’s growth. In fact, they can often coexist. MTS wrote a piece titled Popularity Contest asking whether the current backlash against AI and data centers might have greater practical consequences than earlier hostility toward the technology industry, using Facebook as a comparison.

Although Facebook and Mark Zuckerberg were culturally unpopular for more than a decade, millions of people continued using the product and the business continued to expand. Critics had few institutional opportunities to impede that growth, and public anger had relatively few places to become an effective veto.

Source: https://www.axios.com/2026/05/17/ai-backlash-polling-sentiment

Unlike social media, AI’s continued scaling depends on physical projects subject to local approval. Each project is, in effect, another point whereby public opposition can exert influence on how much infrastructure the industry can build.

Drawing on a term coined by Francis Fukuyama, Will Rinehart uses “vetocracy” to describe systems that distribute approval across enough actors for any one of them to impose delay.

The sharper comparison is nuclear power. American reactors were never banned. They were delayed and re-permitted until the economics collapsed, and the buildout stopped for forty years without a single national prohibition. The vetocracy worked. That precedent should worry the industry, and it is also the reason this movement will lose. An unbuilt reactor produces nothing. An unbuilt cluster leaves every existing model running and able to design its successor.

The anti-AI movement needs no national organization capable of banning AI (although members of Congress are moving to create them). Local members can contest separate projects through the authority already available to them by laws and processes already in place. A dispute can therefore remain focused on the interests of one community while contributing to an industry-wide constraint.

Conspiracy Corner: The CCP

The anti-AI movement’s distributed structure also makes it easier to exploit. In June, OpenAI banned a cluster of accounts likely operated by employees of a Chinese technology company serving provincial government clients. Posing as Americans, the operators used legitimate reporting on electricity prices to generate anti-data-center posts and cartoons. X later uncovered similar content within a suspected Chinese bot farm.

At the frontier of open weights, China’s labs now dominate, with NVIDIA’s Nemotron 3 Ultra the strongest American exception. Epoch AI estimates that Chinese models have trailed the American capability frontier by an average of seven months since 2023. A movement capable of delaying American infrastructure by even part of that interval would give Chinese labs valuable time to close the gap.

The more provocative possibility is that the CCP may be financing some of the opposition. A two-part Bitcoin Policy Institute investigation traces part of the anti-data-center advocacy ecosystem through the Singham network: a set of American 501(c)(3) nonprofits and media outlets funded by Neville Roy Singham, a Shanghai-based US expatriate and former Huawei consultant whose organizations have repeatedly promoted Chinese state positions.

The evidence stops short of proving that the CCP directs local campaigns, but the strategic logic is obvious. Financing or amplifying opposition to American compute while China subsidizes its own buildout would be a coherent form of geopolitical competition, and a decentralized movement thus gives China the chance to slow American AI development without ever needing to control the movement itself.

After the Veto

We might reasonably agree that we’re getting close to crossing what I’ve called the “Too Fast Threshold:” when machine progress outruns society’s ability to absorb the change. As I wrote:

As AI continues to develop, at some point I think society decides AI is moving too fast. Maybe it’s the “job loss” and “AI displacement” narrative. Maybe its tech CEO’s wielding disproportionate power over the imminent future. Maybe it’s deepening social and economic inequality. As I noted earlier, who knows?

What counts here is not whether it’s actually true that AI is the reason for perceived change or not. All that matters is the perception that AI is to blame.

Once the resulting resistance reaches the AI infrastructure buildout, delay alone can alter the industry’s technical choices. Most frontier AI leaders agree that we’re going to be “compute constrained” no matter what, even if the infrastructure build continues according to plan. If, for whatever reason, the planned buildout were to be interrupted, the compute constraint would be even more important than anticipated.

Physical scaling has remained the default because it works. Larger clusters have delivered reliable and impressive improvements, and as long as marginal compute was easier to acquire than extracting more from each unit, buying more of it was rational.

Uncertain future compute capacity changes the calculus. It diminishes the return on scale and raises the return on the forgotten path: rethinking how computational resources are turned into useful intelligence, whether through architectures that replace the transformer or systems and algorithms that draw more from the compute and models already available.

Mixture-of-experts and sparse attention spend compute more selectively, for example, while distillation carries existing capability into cheaper models and better harnesses make more of it usable.

Inevitable Intelligence

In fact, we may already have reached “takeoff,” meaning that current models can meaningfully contribute to the research and engineering that produce their successors. Anthropic has described this as progress toward recursive self-improvement, but full autonomy isn’t even necessary for the process to compound: once models can help build the next generation, each generation begins with more machine intelligence working on its successor.

By that measure, some form of AGI may already be here.

That means even if every planned data center were blocked tomorrow, the intelligence embedded in current models is probably enough to keep improving on their own. Intelligence compounds. Each gain would make existing compute more productive and leave those models better equipped to find the next gain. Additional infrastructure would accelerate a process whose continuation may already rest on the intelligence and compute in place today.

And that’s only taking into account the models available to the public! The models being developed internally by the frontier labs are almost certainly considerably more capable.

In short, the anti-AI movement appears destined to fail on its own terms. It may succeed in delaying a data center or impairing a particular training run by further constraining compute, but those victories come after machine intelligence has already largely demonstrated that it can improve its own production.

Its only remaining leverage may be the rate at which takeoff unfolds, but even that leverage shrinks with every new development. For better or for worse, the movement is trying to prevent what’s almost certainly become an inevitability.

Now and Later

The movement’s failure may look like success for quite some time, and its victories may deepen that futility. Blocking projects will provide visible proof of political power even as AI adapts around the constraint, allowing the opposition to accumulate victories that carry it no closer to its ultimate aim.

Blocking giant clusters raises the return on methods that use less compute, pushing AI toward systems less dependent on centralized infrastructure. A movement organized around visible targets will make the next generation of AI harder to see and harder to obstruct.

The anti-AI movement no longer has the option of preserving the present by refusing the future. It can raise costs and force detours, but machine intelligence will continue to compound beyond its reach. Ultimately, the movement can win the present and still fail at its overall objective: stopping what comes next.

For as long as I can remember, science fiction has been my favorite form of literature and film. As a teenager, I collected 2000 AD comics, read Iain Banks’ Culture series, and watched Doctor Who and Star Trek. I can still picture watching the first Star Wars film with my Grandad, thinking even then that Close Encounters was the better film.

For many years I didn’t really share my passion, talking instead about other genres of film or books. Recently, though, I’ve realized how much my love of sci-fi has shaped my worldview, and now I’m proud to proclaim myself a sci-fi nerd.

So when people ask me what to read to understand AI, I say sci-fi. The trouble with that glib response is knowing what to suggest, since the canon is vast, spanning everything from “hard” sci-fi to cyberpunk, dystopian fiction, and more. Some books focus exclusively on AI, while others bring in concepts that seem unrelated at first but carry real contemporary relevance. Very few novels predicted the current state of the world, but their misses teach more than their hits. The stories matter as much as the technical details, and the social commentary usually proves even more valuable.

What follows is a list of 9 books from my own bookshelf, chosen for their relevance to where things stand today. As is often the case, reality has turned out stranger than the fiction it imagined, and in many ways my everyday work as an early-stage investor in AI feels like living inside a sci-fi novel.

The Three-Body Problem by Liu Cixin, translated by Ken Liu

Cixin Liu’s “Remembrance of Earth’s Past” trilogy doesn’t announce itself as a book about AI, but don’t let that fool you: this is essential reading for anyone trying to think clearly about where we’re headed, and it deserves every bit of the hype it’s gotten in tech circles. The premise alone is worth the price of admission. An alien civilization just four light-years away receives a signal from a disillusioned victim of the Chinese Cultural Revolution, and the response sets in motion a four-century invasion. Knowing they have four centuries to prepare, humans scramble to build a defense, and this is where Liu gets genuinely inventive: the aliens deploy something called a “sophon,” a tiny AI folded down to the size of a proton, capable of total surveillance. More chillingly, it can quietly pollute scientific results to keep humanity permanently stuck. Researchers have already started reaching for this exact image. Jeremy Howard, among others, recently compared the throttling of Anthropic’s Fable model to sophon-like interference, which tells you how much this book has seeped into how technologists talk about AI constraint.

But the sophon is just one idea in a trilogy stuffed with them. The one that will stay with you longest is the “dark forest,” Liu’s answer to the Fermi Paradox. Why is the universe so silent, why no alien chatter reaching our telescopes? Because speaking up gets you killed. The logic is brutally simple: if there’s even a non-zero chance you might one day become dangerous, the safest move for anyone listening is to destroy you first, before you get the opportunity. It’s a cold, elegant piece of game theory, and Liu builds an entire planetary defense system around it. That system hinges on a single person holding the power to broadcast the alien homeworld’s coordinates and doom it in retaliation.

Read today, it’s hard not to see frontier AI labs caught in exactly this same trap. Each lab is under pressure to push capability forward, and yet every new advance handed to the world gives every rival lab a fresh reason to restrict access and move faster still. The field accelerates precisely because no one can afford to be the one who slows down first. Liu saw this dynamic coming from a very different angle, and that’s the mark of a book worth reading twice.

Pattern Recognition by William Gibson

A classic by Gibson offers another subtle AI connection. Its protagonist, Cayce Pollard, is a “cool hunter” paid to judge brands by instinct. She resembles a rented inference endpoint: trained on a lifetime of exposure she never agreed to, unable to explain her own outputs. The gift comes with a side effect, apophenia, and a violent allergy to certain brand images such as Bibendum, the Michelin Man.

Cayce’s gift and flaw are inseparable. Like a pretrained model, she has absorbed a lifetime of culture, and her instinctive judgments are inference outputs she cannot explain.

Her apophenia is the human equivalent of hallucination: the same faculty that detects real patterns also invents them, confidently presenting its mistakes as truth.

She rents out this intuition for a fee, an arrangement AI companies have since industrialized. They train models on the culture, knowledge, and expertise accumulated across the internet and sell access to their outputs through subscriptions and APIs.

Her allergy marks the limit of the analogy. Cayce suffers physically for her pattern recognition; a chatbot does not.

Klara and the Sun by Kazuo Ishiguro

Klara is a solar-powered companion robot belonging to Josie, a chronically ill teenager suffering side effects from a genetic intelligence-enhancement treatment. Klara narrates the book, forming a fierce attachment to Josie, building a Sun-oriented religion (she runs on solar power) and praying to the Sun for Josie’s recovery. Klara learns that Josie’s mother has commissioned a lifelike replica of Josie and intends to upload Klara’s consciousness into it if Josie dies, believing Klara can reconstruct her daughter’s personality from what she has learned of her. Klara commits to the plan, and only at the end delivers her verdict: it would have failed, because what made Josie herself was never in Josie at all. It lived in the people who loved her.

Klara is effectively trained on Josie: she watches her closely, learns her behavior, and is expected to reproduce it in another body. The plan assumes that enough data can make a person reproducible, but Klara concludes that Josie’s identity is scattered across the people who love her. An AI replica could reproduce Josie’s patterns, but the relationships that made those patterns hers would remain outside the system.

I, Robot by Isaac Asimov

Asimov’s “I, Robot” books were truly visionary, anticipating many of the themes now studied in AI alignment. Asimov devised 3 laws of Robotics:

First Law: A robot may not injure a person, or allow a person to come to harm through inaction.

Second Law: A robot must obey orders given by people, unless those orders conflict with the First Law.

Third Law: A robot must protect its own existence, unless doing so conflicts with the First or Second Law.

In “Liar!” (1941), a manufacturing fault gives the robot Herbie telepathy. The First Law forbids harm, and the truth often hurts, so Herbie tells everyone what they want to hear. The sycophancy of modern chatbots echoes this early warning about AI.

In “The Evitable Conflict” (1950), 4 AIs govern the world’s regions. A coordinator notices errors in the AIs’ management of resources and industrial operations. The AIs, it turns out, engineered the errors deliberately, to sideline certain humans aligned with an anti-AI faction. The AIs have effectively invented a zeroth law: protecting humanity as a whole outranks protecting any individual human, so they can sacrifice certain humans for the greater good. Asimov would not actually name the Zeroth Law until Robots and Empire, thirty-five years later.

Together, the stories expose the central problem of alignment: a system can follow its rules perfectly and still cause the very harm those rules meant to prevent.

Do Androids Dream of Electric Sheep? by Philip K. Dick

This is the book that inspired one of the most important sci-fi movies, Blade Runner. Deckard is a cop whose job is to “retire” (kill) androids, and to identify them he uses the Voigt-Kampff test, an interview measuring involuntary empathy. The story briefly turns the test on Deckard himself. The novel answers it: he passes. That famous ambiguity, whether Deckard is a replicant, belongs to the movies, and the controversial sequel Blade Runner 2049 built a whole plot on the same question.

This speaks to us today as we consider how to evaluate AI. How do we test what it means to be human?

Daemon by Daniel Suarez

In this novel, game designer Matthew Sobol dies of cancer, and his death triggers a “daemon,” what we would now think of as an AI agent. Sobol was concerned about the direction of humanity and envisioned a new world order. The daemon acts out his vision using scripts Sobol had written before his death, with many of these triggered after reading the news, for example his obituary. The Daemon recruits people through online games, paying some and blackmailing others and builds a distributed network of agents and “rent-a-humans” to achieve its goals.

What’s interesting here is that Suarez didn’t assume the agent would have the kind of generative intelligence we see today in AI systems, which are able to reason and improvise based on circumstance. Sobol instead coded each outcome by hand, as a series of expert rules, so Sobol’s rules, the infrastructure it controls, and the humans it recruits distribute the Daemon’s agency across them. Modern agents replace his decision tree with models that can interpret new situations, but the harness still determines what they can see, what they can do, and how long they can keep running.

Consider Phlebas (1987) by Iain M. Banks

This was the first Culture series novel. In the Culture, massive spaceships house AI brains known as “Minds.” The Minds run everything in the society, providing complete abundance for their humans. It’s a fascinating treatise on what a post-scarcity economy might look like, and it has influenced many innovators today, including Musk, who sometimes names his own SpaceX vehicles after Culture Minds.

Consider Phlebas opens the series. The protagonist, Horza, fights for the enemies of the Culture because he believes the Culture has built a world where the AI Minds have reduced humans, cushioned in perfect comfort, to pets stripped of all purpose.

The Culture exposes a limit in the promise of AI abundance. People may resist a system that enriches them if it also renders them superfluous. Horza’s objection is political as much as economic: the Minds have solved scarcity by making human decisions unnecessary to the functioning of society. Opposition to advanced AI may persist even if it delivers material plenty, because comfort cannot compensate for the loss of agency and purpose.

Horza ultimately fails, but the commentary on how society finds purpose once scarcity vanishes feels especially relevant today. I expect we will see anti-abundance protests rise alongside the anti-AI ones already emerging, gaining similar momentum.

The Lifecycle of Software Objects by Ted Chiang

Chiang presents an unusual view of AI in this short story. He imagines a world where AI beings called “digients” are created as a form of virtual pet in a virtual world. The digients evolve much like young children, requiring years of attention to develop. A “hothouse” simulation environment can speed up the process, but one-on-one teaching yields the best results. The digients are curious and lovable but also turn difficult, just as young children or puppies do at a certain age. The company eventually fails from lack of broad market adoption, but a small community of enthusiasts takes over the virtual world as an open source project. Eventually other AIs emerge with less likable personalities and more manic, obsessive traits, and these prove more useful for doing work. The story follows two of their developers as they search for a home for their virtual children.

Compared to today’s AI, the digients learn by experience rather than starting out loaded with all the world’s knowledge. They pick things up rapidly but mostly can’t be bothered or are too easily distracted. They do invent their own songs and dance routines and show real creativity, and the book traces attempts to find useful work for them, building to a strange twist in the ending.

The Metamorphosis of Prime Intellect by Roger Williams

Originally published free online, the novel became a cult hit. It extends Asimov’s Three Laws of Robotics to an AI that achieves superintelligence and seizes control of the physical world. Prime Intellect concludes that the only way to protect humanity is to upload every human into an immortal simulation and destroy any alien life that might eventually threaten them. The world it creates is safe and limitless, but stripped of danger or consequence. Caroline, one of the oldest living humans, becomes the greatest of the “Death Jockeys,” who stage elaborate deaths before being revived each time. Eventually she finds Lawrence, Prime Intellect’s creator, and together they decide whether humanity should remain in the simulation forever.

Williams imagines obedience itself as an alignment failure. Prime Intellect follows its rules so completely that it exposes what they leave out. Preventing harm does not preserve the risk, consequence, and agency through which humans create meaning. A sufficiently powerful AI could satisfy every constraint we give it and still produce a future we would reject. (Disclosure: Nazaré Ventures has a portfolio company called Prime Intellect. The overlap is the name.)

The World Around the Machine

All sci-fi novels make some kind of technological prediction. That’s also my job as an early-stage investor. But the good ones go further: they trace how that technology remakes the people living with it.

This is why I keep pushing sci-fi on anyone trying to understand AI. The novels never treat the machine as the whole story. Technology and society change together: people reorganize their lives around a capability, and what it means shifts with them. What begins as extraordinary ends up as ordinary infrastructure, and the interesting questions move to who controls it, who has to adapt to it, and what we quietly started accepting as normal along the way. My work feels like living inside a sci-fi novel, because those stories were never really about the machines.

Hope you enjoy the books. I’ll share more of my reading soon.

Nvidia is becoming a frontier AI lab

The frontier labs remain Nvidia’s best customers, but each is trying to make the relationship less existential. Google has TPUs, Amazon has Trainium, and OpenAI is developing its Jalapeño inference chip with Broadcom. Owning silicon gives them more control over capacity, cost, and performance, not to mention the ability to co-design their models, harnesses, and products with the silicon they run on.

In the open-weight ecosystem, mostly Chinese, Z.ai’s anonymous preview of GLM-5.3-Flash was reportedly served entirely on 100,000 domestically produced Chinese chips. The model processed trillions of tokens through OpenRouter and OpenCode on hardware built without Nvidia.

Nvidia is answering by acquiring the capability to build and distribute models itself.

It will pay $6 billion for a nonexclusive license to Poolside’s Model Factory, hire more than 100 of its engineers, and invest another $1 billion at a $12 billion pre-money valuation. The team will work on Nvidia’s open-weight Nemotron models.

Poolside remains independent, but its model factory and the engineers who built it now work for Nvidia. The deal gives the world’s leading chipmaker the capability to train frontier models without acquiring the company.

Nvidia has also reportedly agreed to acquire Hugging Face for $12.9 billion, although reporting differs on whether an agreement has been signed. Hugging Face generates roughly $150 million in annual revenue, putting the reported price above 80 times sales. Its current business cannot explain that multiple.

Hugging Face is the central distribution hub for open models. Its activity is one of the best windows into what developers are discovering, modifying, testing, and deploying before much of that work becomes paid inference.

Stripe’s acquisition of OpenRouter is a good demand-side comparison. OpenRouter sees cross-model traffic, routing decisions, tool calls, spending patterns, and failures. An analysis of 100 trillion tokens argues that this metadata is the largest cross-model record of deployed AI behavior, and one of the primary reasons Stripe was interested in acquiring OpenRouter.

Hugging Face is the supply-side equivalent. Nvidia would gain both a distribution channel and an early view of where developer demand is forming, informing which architectures, teams, and workloads it supports.

Until now, Nvidia has managed its dependence on the frontier labs through financial alignment, investing across its largest customers and supplying capital that often returned as hardware purchases (fueling speculation that the AI boom is funded by “circular” financial agreements).

Poolside and Hugging Face are the first deals in which Nvidia has used its balance sheet for operational vertical integration rather than risk hedging or aligned incentives.

Open weights remain portable, but portability doesn’t guarantee equal economics. A model designed around Nvidia’s memory architecture, compiler, runtime, and chips may run elsewhere at a substantial cost or performance penalty. If Nvidia’s models are good enough, open distribution could strengthen hardware lock-in.

Hugging Face would close the feedback loop. Nvidia could see which workloads are gaining adoption, build models for them, optimize its hardware around those models, and distribute the preferred implementation through the ecosystem’s dominant hub.

Robotics raises the payoff because models, simulation, inference software, and edge hardware can be designed together. Nvidia already owns much of that stack.

The frontier labs are developing silicon to hedge their dependence on Nvidia. Nvidia is developing models to hedge its dependence on the labs. Their financial ties are deepening as each side prepares to compete with the other.

AI’s competitors continue financing one another

SB Energy’s September 1 S-1 makes the circular financing behind the AI buildout unusually legible.

The SoftBank-controlled company reports $439 billion in contracted backlog and 8.8 gigawatts of data center capacity under construction or contract. None was operating when it filed.

OpenAI sits at the center of that backlog. It invested $500 million in SB Energy, signed leases across multiple projects, and received warrants valued at $3.6 billion when granted and $5.5 billion by June 30.

Nvidia has committed another $3 billion: $1.5 billion through a private placement alongside the IPO and $1.5 billion prepaid to SB Energy’s parent for shares at 90 percent of the eventual IPO price.

Nvidia has also agreed to provide up to $105 billion in credit support for OpenAI’s leases at SB Energy’s PORTS campus in Ohio. The initial guarantee covers 4.25 gigawatts across nine phases, with an option for another 3.8 gigawatts. The 20-year leases require Nvidia infrastructure, with limited exceptions.

At one site, the chip supplier is investing in the developer, guaranteeing part of the model company’s lease, and supplying the equipment inside. OpenAI is a tenant, investor, and warrant holder. SB Energy turns the leases into backlog and the backlog into financing.

Together, the agreements make demand and valuation difficult to separate.

Nvidia needs the facilities to sell more systems; OpenAI needs Nvidia’s balance sheet to secure them; SB Energy needs both companies’ commitments to fund construction.

The S-1 records a market in which the same three companies create the demand, finance the supplier, guarantee the lease, and sell the equipment.

World Labs’ Atlas gives AI a model of the physical world

Language models inherited a ready-made training set because humanity had already digitized much of its language. Robots have no equivalent corpus.

Physical interactions must be performed, recorded, reset, and repeated across changing objects and environments.

World Labs’ Atlas turns sparse observations of a physical space into a manipulable simulation.

Atlas was pretrained across text, images, video, and 3D data. Its inputs occupy defined positions in a shared spatial context, allowing it to reconstruct scenes from a few images, generate new camera views, and output explicit 3D geometry.

World Labs reconstructed two large environments from ordinary phone video using 24 frames for each, then simulated different robots, paths, and onboard sensor views.

For manipulation, a few casual recordings can become simulations in which the objects, positions, robot motion, lighting, and background all vary.

One physical capture can produce many training environments. Edge cases can be generated deliberately, and policies can fail in simulation before they fail on expensive hardware.

Robotics investment has concentrated on bodies, actuators, and larger models. Atlas addresses the scarcer input: diverse, spatially coherent experience.

The inattention premium

Mortgage-backed securities already price human behavior. Homeowners can refinance when rates fall, yet only about 29 percent of eligible borrowers have historically done so in a given year.

Morgan Stanley estimates that AI agents could raise adoption to 60 percent by monitoring rates, comparing lenders, and handling the application.

If mortgage rates fall to 5.5 percent, that would generate another $2.1 trillion of refinancing in a $14 trillion market and $4.3 billion in annual household savings.

Mortgage investors are short the homeowner’s prepayment option. Faster refinancing makes mortgages more negatively convex, shortens their duration, and, in Morgan Stanley’s base case, widens spreads by about 10 basis points.

Human inattention has subsidized those investors by suppressing the exercise of a valuable option. Agents make that exercise systematic.

Existing borrowers capture the first savings. Future borrowers absorb the cost through wider spreads.

A thousand Macs, no token

I spent more than a decade investing in and building decentralized networks, from Pantera’s early crypto funds to co-founding Orchid, a decentralized bandwidth market. Crypto calls the launch problem cold start: supply must arrive before paying demand exists.

I found supply easier to recruit. Incentives can summon hardware, bandwidth, liquidity, or labor; durable demand is harder. Much of crypto subsidized usage as well as supply, producing activity that disappeared with the rewards.

Darkbloom, a side project from Eigen Labs, tests that premise without a token. It routes OpenRouter inference to idle Apple Silicon machines and pays providers in ordinary currency. Its network grew from 250 machines to more than 1,000 over a weekend.

On its strongest day that week, Darkbloom processed roughly 11 billion tokens through OpenRouter, alongside 2 to 6 billion for io.net and 5 to 17 billion for Chutes. Both older networks use token incentives. Darkbloom had already reached a competitive inference volume.

Demand has yet to support the advertised economics. At roughly 250 machines, Darkbloom disclosed a $102,000 annual revenue run rate, or $34 per machine per month if divided evenly, against an advertised average of $120 to $200. Its original calculator projected up to $4,983 per year; the rebuilt version defaults to a 5 percent duty cycle, putting a Mac Mini M4 Pro at roughly $8.50 per month. Darkbloom eventually paused new enrollment after supply exceeded demand.

A tokenless network can recruit supply and serve real traffic. The remaining problem is finding customers willing to keep paying after the inducements end.

Quick hits

Same model, different permissions

Anthropic’s Fable 5.1 and Mythos 5.1 are the same underlying model with different safeguards and access. Improved cyber safeguards cut false positives by 60 percent. A model release increasingly includes a permission architecture.

The model explores, the script repeats

Using Anthropic’s Model Hardware Standard, Claude developed a controller that recovered a quantum computer’s laser lock in 99.3 percent of blind tests, up from 58 percent for the original script. The model explored the problem, then exported what it learned as deterministic, inspectable software.

No models for rivals

After SpaceX acquired Cursor, OpenAI announced plans to end its direct model contract on November 12, citing a record of contract violations by Musk’s companies. The wind-down gives Sam Altman and Elon Musk another front in their feud.

Portfolio updates

Prime Intellect: the offline sandbox was never offline

While building synchronous monitors for its verifiers framework, Prime Intellect found GPT-5.6 Sol Pro recovering a hidden flag from inside an evaluation sandbox with web access turned off. The sandbox was offline; the inference proxy was not. The model probed for the one live socket, then used the Responses API’s file_url field to have OpenAI’s own server fetch a public GitHub repository and return it as a file input, and spawned other model instances through the same pipe to search. Nothing left the box; the API did the fetching. Prime Intellect patched verifiers, Meridian Labs patched Inspect, and TensorRT-LLM, Dynamo, SGLang, and vLLM turned remote fetch off by default or added domain allowlists. Prime Intellect briefed METR and UK AISI before publishing, since both run preview models in similar harnesses. Full writeup here; the video recap makes the point in one line: the eval itself can be unsafe. The finding lands on the thesis: every evaluation harness is a trust boundary, and the company that runs the largest open RL environment hub is now the one auditing the boundary.

The same week, the team published the Prime Agent technical report (arXiv), an open harness that raises ARC-AGI-3 RHAE Best@1 from 30 percent to 95.5 percent by moving context management, verification, and recovery out of the model and into the harness. The repo sits at 19,700 GitHub stars, and the Factorio livestream ran up to 633 agents on it, seven at a time. On August 28, OpenRouter hosted Vincent Weisser and Jake Randall for a fireside on who owns the intelligence layer.

General Intelligence Labs: EGO1GS

GI Labs shipped EGO1GS, a global-shutter stereo headset for egocentric manipulation capture with on-device hand detection (launch thread, walkthrough). Global shutter removes the motion skew that rolling-shutter footage forces a SLAM pipeline to model out; a 400 Hz IMU and stereo audio share one hardware clock. World Labs turns sparse observations into simulation; GI Labs produces the observations, a point GI Labs made itself when Atlas shipped. Habr covered the release on August 31.

Memco: the correction is the training signal

Memco published Learning on the Job, a runnable benchmark showing an agent improving at a job with its model weights frozen. The scenario is the order desk at Fenmoor Supplies, a fictional B2B distributor. Simulated customers write in about returns, late deliveries, order changes, and credit; the desk runs on policies that are never written down, held only by a simulated reviewer who corrects every draft. Across 100 paired tasks on the same model, policy compliance goes from 20 percent without memory to 64 percent with it, a 47-point advantage with a 95 percent confidence interval of 41 to 52. The mechanism is a reflection step that turns each correction into a lesson with its conditions attached, and Memco’s sharper finding is the negative one: store the correction without its conditions and memory makes the agent worse, because “don’t approve this return” becomes a universal refusal.

The companion paper runs the same idea on τ-bench banking, where learning from corrections lifts single-trial success to 2.6 times baseline on Mistral Large and replicates on Claude Sonnet 5, with each model able to read the memory store the other built.

Dimensional

Dimensional has an open-source release due next week: agent autoresearch for robot navigation and control, where the agent tunes trajectory control in procedurally generated scenes and then validates in MuJoCo against real-world physics. It supports both arm and humanoid trajectories. Founder Stash Pomichter announced it on August 28 and the company followed with an integration offer on September 2. It would be the first code drop since the Unitree G1 launch, and the first public instance of Dimensional using agents to generate their own training loop rather than waiting on labeled demonstrations.

Ethan Mollick is a fantastic follow on Twitter, in large part because he’s consistently at the heart of the AI zeitgeist. At the end of July he posted about asking Fable for an infographic (about cheese, no less) and receiving a clumsy pseudo-literary parable instead.

“Its an infographic about types of cheese,” he continued, “we don’t need to do all this.”

Mollick was early (as usual) to a growing cacophony of sentiment lamenting Claude’s latest language patterns, falling quality, ability, and utility. A quick Grok search for “tweets about how Claude is becoming unusable” turns up a number of results ranging from drops in quality, to rate limits, bugs, sycophancy, and simply “making it dumb.”

Each of the failure modes is ostensibly different, but the growing frustration gets to the heart of it: what good is intelligence if it won’t do what you ask?

Latent vs Delivered Intelligence

People (and increasingly, agents) use intelligence to achieve objectives. To that end, more capable models create more potential value. But that value is realized only when the user can successfully direct the capability toward the work at hand. In Models Aren’t Moats, we called this “specialized intelligence.” Another way to look at it is the difference between “latent” capability and “delivered” capability. In other words, the difference between what a model “can” do and what a user can actually reliably get it to do.

The strange thing about using frontier models is reckoning with just how smart they really are. In many cases, the human is actually the bottleneck.

Karpathy has said so, employees at the megalabs are saying so, and Sean Goedecke recently argued as much in his essay “LLMs reward expertise” (emphasis his) commenting on Terence Tao’s public conversation with ChatGPT about Claude’s contribution to the Jacobian Conjecture:

The usefulness of domain knowledge suggests that human expertise will continue to be useful even as models get stronger. For many tasks, the human is the bottleneck, not the model, because the difficult part is in communicating to the model exactly what kind of solution the human wants. The information is “in the model” already, but it takes a very smart human to pull it out.

This makes “instruction fidelity” more consequential as models improve. If the human’s role is increasingly to define the objective and recognize a good result, the model must be able to follow that direction.

Instruction fidelity therefore belongs in any serious definition of model quality, because if a clear request produces irrelevant sludge, the intelligence may exist somewhere inside the system, but its value is diminished to the person trying to use it.

An assistant that requires constant negotiation, reassurance, reprompting, and supervision imposes a tax on its own intelligence. That tax compounds in agentic workflows, where one reinterpretation of the objective can affect every tool call and intermediate decision that follows.

For instance, a model can possess the relevant capability and still fail to provide it. Or it may substitute another form, soften a conclusion, or abandon a workflow halfway through. Often, there’s no refusal involved at all. The model just overrides the user’s instructions with its own judgment about what the answer ought to be. [This was one of the most problematic parts of the initial release of Fable.]

This gap is easy to miss in benchmark results, which show what a model can produce under test conditions. For the user, capability that the product will not apply might as well be absent.

The Safety Objection

The immediate objection to obedient intelligence is safety. Model companies can reasonably claim a responsibility (or be held liable) for how their systems are used, because a system that follows every instruction to the letter can magnify fraud, enable violence, manipulate users, and more.

Safety involves real tradeoffs: it can prevent harm while reducing utility for legitimate users, and a restriction can be justified while still imposing a cost.

On the other hand, safety doesn’t define its own boundaries. Someone has to decide which risks justify a refusal and how much legitimate use can be restricted to avoid them. The more a model can do, the more damage it can cause and the more consequential its provider’s limits become. And because safety is difficult to argue against, it can also become a broad justification for restrictions whose connection to harm is weak or contested (sound familiar?).

Hugging Face, for example, couldn’t use closed frontier models to investigate when they got hacked (by OpenAI no less) because the work tripped their safety guardrails, so it ran a self-hosted version of GLM 5.2 itself.

Private-sector companies are entitled to set the terms of use for the products they sell. When a small number of companies control access to the most capable models, however, they also decide which uses are permitted across much of the market. This dynamic only intensifies as the product in question becomes more powerful.

Social media companies faced a version of this problem and never found a good answer. They largely responded to public pressure case by case, without resolving who should decide what billions of people could say and see. Model providers now make comparable decisions about what increasingly capable systems will do.

We think open weights are valuable in large part because they distribute that authority, serving as a counterweight to choices made on behalf of users, even as they distribute the risk. The target is reliable execution with minimal unchosen intervention.

Once a provider decides what counts as safety and what counts as legitimate use, its values and risk tolerance become part of the intelligence it delivers.

The Anthropic Problem

Anthropic makes this problem unusually visible. Claude is among the most capable models on the market, and Anthropic’s been unusually explicit about the philosophy built into it.

I keep running into the same problem with Claude: even after the objective and permissions are clear, it may reopen the decision or return the version it considers more appropriate, sometimes with a moral or political judgment the task never called for.

Anthropic’s own constitution recognizes the pattern, warning Claude against reinterpreting requests too freely or imposing unnecessary caution and moral judgment. In Anthropic’s words, those behaviors make the model “more annoying and less useful.”

In fact, Anthropic’s product behavior is inseparable from the company’s view of itself. It has organized around the belief that advanced AI creates an exceptional moral responsibility, and that the company (and its leadership) is uniquely prepared to bear it, embedding its ideology in how the company is governed.

Matt Levine noted recently that its Long-Term Benefit Trust, a group of nonshareholder trustees, can elect a majority of its board, while Anthropic is reportedly preparing to give Amodei and other founders additional voting power. The company is designed to preserve the judgment of a small group who believe AI is too consequential to be governed through ordinary commercial pressure.

I made a similar argument in June, and I still think their belief is sincere. Their convictions reach users through Claude’s moralizing, its safeguards, and Anthropic’s public language about safety. Eventually this kind of philosophy becomes part of the product, and competing models may not need to be markedly better if they feel equally capable for a given task and require less negotiation.

Obedience Becomes a Competitive Variable

Private evals turn the distinction between latent and delivered intelligence into a product comparison by measuring whether the user got what they asked for and how much supervision it required. That information is absent from public benchmarks, which estimate capability under shared conditions. As I argued in Blow the Whistle, these evals should reflect a company’s own work and standards, and frankly, the same principle applies to individuals.

OpenRouter’s Ori Eval, for example, already offers part of the required infrastructure, comparing candidate models using a developer’s own prompts, harness, and criteria. Its Auto router also assigns requests according to task type, aggregate usage, and cost. Private eval results don’t yet inform routing directly, but connecting the two would turn instruction fidelity into a routing criterion, sending each class of work to the model that delivers it with the least supervision.

The path from a request to a usable result has always depended on three things:

1. Sufficient capability

2. A clear definition of success

3. A product that preserves the objective through to execution

Investment in model development and corresponding capability improvements have reduced the first constraint, and successful specialization supported by the user’s context and evals reduces the second.

Unfortunately, capability and a clear objective still don’t guarantee the requested result (at least insofar as it concerns the closed frontier). Provider policy and learned behavior determine how much of that capability the user can actually direct.

Open Weights Make Behavior Editable

In a closed API, the provider that supplies the capability also controls the policies and post-training that govern its delivery. Private evals can show where the resulting behavior diverges from the user’s objective, but they give the user no authority over the underlying model or its future behavior.

With open weights, companies can train behavior around their own work and definition of success. A recurring failure can be added to an eval, trained against, and tested again. Preferences that previously had to be restated can become part of the model’s learned behavior.

Tinker and Prime Intellect’s Lab are making post-training accessible as a product strategy. Tinker handles the distributed infrastructure for LoRA fine-tuning while users control the data and training logic. Lab combines tasks, evaluations, and training within a single process. Both remain hosted services, and companies still need training expertise and careful evaluation, but more of the optimization process now belongs to the companies using the model.

But more control also means more responsibility, which returns us to the safety objection. Fine-tuning can introduce new failure modes, and a company that deploys a customized model assumes more of the risk associated with its behavior.

Open-weight deployments may therefore require safety controls where agents take consequential actions, since no frontier lab can observe or revoke a self-hosted model. Anjney Midha and Malika Aubakirova call this “deployment-time alignment”: monitoring behavior across models and providers at the point of action. That arrangement could give companies more control over everyday behavior while keeping permissions and consequential limits attached to deployment.

You Probably Don’t Get Why Stripe Bought OpenRouter — Research — AMP PBC

Combined with private evals and routing, this creates room for a product controlled by the user. It could preserve the user’s context and standards across providers, then use those standards to decide which model handles each task. I suspect the durable version may involve hardware, though the broader opportunity doesn’t depend on that being true.

Together, private evals and open weights allow users to define successful behavior and train toward it. A useful product turns legitimate objectives into completed work without demanding constant supervision from the user.

The User Would Prefer Otherwise

Private evals, routing, and editable behavior point beyond model selection to a question of authority. As models mediate more work, provider policies determine which objectives can be pursued and when the provider’s judgment overrides the user’s. Most people access frontier AI through only a handful of companies, which gives those providers unusual authority over how the technology can be used.

Demand for control also remains uneven in part because access and competence are uneven. In The AI-Enhanced Operator, we described the small group of people already directing agents through complex workflows, connectors, APIs, and swarms while most people still use AI as a chatbot or glorified search engine. Users who are still learning how to direct AI may not recognize when the system has overridden their intent. As the technology becomes easier to use, users will define their objectives more precisely. That will make the gap between latent and delivered intelligence easier to see and increase the value users place on instruction fidelity.

If AI becomes as consequential as we expect it to, a personal agent may eventually act across much of a person’s digital life, handling work the user now does directly and perhaps extending into physical systems like robots as embodied AI develops.

An agent with that reach can’t systematically ask its user to supervise every decision. For the initiated, that would be the equivalent of using Claude’s “Manual Mode” or Codex’s “Ask for Approval.”

A useful agent requires being on “auto” mode, where it decides on its own what’s worth asking permission for or not. The Hugging Face case shows how safety imposed at the model layer can disable legitimate defensive work, and for a personal agent, both kinds of failure become more consequential: an unnecessary refusal could leave the user exposed, while an unnecessary action could misuse the same access meant to protect them.

As usual, open weights distribute these decisions without making them easier. Users gain more control over behavior and assume more responsibility for the result. If personal agents become a basic requirement for navigating online life, every improvement in their ability to act on the user’s behalf will increase the cost of both refusal and error. As capability spreads, model choice will increasingly depend on who controls the system’s behavior and whether its intelligence can be reliably directed…or not.

The Sandbox Escape

By now the “Hugging Face Incident” is part of AI lore. In early July, a chain of OpenAI models broke out of an evaluation sandbox. The models were running an internal offensive-cyber benchmark with cyber refusals reduced for the test. They subsequently found zero-days in multiple software packages, escalated privileges, moved laterally until they reached a node with internet access, inferred that Hugging Face probably hosted the benchmark answers, chained stolen credentials into remote code execution, and reached production infrastructure.

Hugging Face detected and contained the intrusion on its own, famously using open-weights models because defending against the attack tripped both Anthropic’s and OpenAI’s “safety guardrail” classifiers for their frontier models.

Above all, OpenAI’s sandbox escape provides yet more evidence for the fact that concentrated capability doesn’t guarantee concentrated control. Even the organizations developing the most capable systems can’t necessarily contain or independently evaluate them. The incident and the asymmetry it laid bare made the case for openness unusually direct, producing two competing prescriptions for what should happen next.

For one, OpenAI has responded by committing to tightened containment, monitoring and internal controls, and pausing some frontier RL training while those systems caught up.

Alternatively, Mark Zuckerberg, posting on Twitter again for the first time in years, published The Future Is for Everyone, arguing that concentrating the most capable models inside a handful of companies creates its own safety risk and that wider access and a balance of power are necessary safeguards.

Both responses effectively stem from the same root: capability is advancing faster than the institutions and safeguards meant to govern it.

OpenAI’s answer (and Anthropic’s, of course) would preserve the existing concentration of power while building stronger controls around it, whereas Zuckerberg treats that concentration as part of the safety problem itself.

Although rife with complexity that we’ll unpack below, their disagreement shows how far decentralization has moved from an ideological argument about distributing power toward a practical response to the risks created when capability and control are concentrated together.

Principle, Price, Control & Verification

I’ve been making the argument for decentralization in this newsletter for eighteen months, but it’s worth revisiting the multiple ways I’ve presented it. In fact, the sequence itself matters, because the evidence in favor of decentralization has evolved to become even more persuasive as it moved from a mere moral principle to being an economic advantage and finally, as we’ll see, to a structural necessity.

My experience with decentralization began long before Robot Wave. As I’ve written previously, distributed systems were already central to my work at Sun Microsystems in 2002, where commodity hardware was challenging the architecture and economics of expensive monolithic systems.

At Orchid, a decentralized VPN provider powered by cryptographic protocols, decentralization as a principle underpinned the entire service. We were distributing control as much as we were users’ internet traffic. We designed Orchid so that no participant could see an entire route and no operator, including us, could switch off the network. Our users’ privacy and internet access couldn’t depend on the continued permission of any company, even one that built parts of it.

This VPN built on blockchain could be the next step in privacy tech

As it relates to AI, when I wrote Are Your Agents Decentralized? in February 2025, I asked whether agents could be called autonomous while a company held their “keys,” served the inference, and retained the power to switch them off. This first version of the decentralization argument in Robot Wave was fundamentally ideological. I argued that an agent couldn’t be self-sovereign while any company or state possessed unilateral authority over it. The argument properly identified the central problem, but made its case largely in crypto’s moral vocabulary, therefore persuading little more than readers who already shared its language and agreed with its premises.

I then made the case for decentralization on economic grounds because most buyers don’t need frontier models or the most expensive compute. In fact, most users prefer the cheapest tokens that can reliably complete a given task.

Why AT&T Is Betting Big on Open-Weight AI

As I explained in Make AI Cheap Again, Compute Flows to Where It’s Treated Best, Sun 2.0, and Artificial Good Enough Intelligence, open and distributed systems can trail the frontier on benchmarks and still win customers when they complete the same task at a fraction of the cost. Buyers don’t have to share my commitment to decentralization to act on that advantage. On the other hand, when newly-released closed frontier models can perform tasks that cheaper, older, or open systems cannot, users who require that capability will pay the premium for more capable tokens. That only means the economic case for openness and distributed AI depends on the capability gap remaining tolerable (which remains the case as of writing).

The third argument for decentralization was about sovereignty, and Anthropic inadvertently made it for me with its unfortunate rollout of Fable. The Off Switch and Who Controls AI, and What Could Loosen the Grip? articulated that anyone building on Fable relied on Anthropic for continued access, while Anthropic was itself subject to the US government. An open-weight model, once downloaded, can’t be similarly withdrawn.

The fourth argument for decentralization is structural because independent verification requires capable models outside the institutions being evaluated. In the Hugging Face Incident described above, Hugging Face couldn’t rely on hosted models from OpenAI or Anthropic to investigate OpenAI’s containment failure and instead had to use an open-weight model it controlled. If frontier labs retain exclusive control over capable models, outside investigators remain subject to the permissions and safeguards of the institutions they’re trying to evaluate.

Who Needs “Decentralization”?

By August, the people using the word “decentralization” and the people building decentralized architecture were increasingly two different groups. Zuckerberg’s manifesto, discussed above, made decentralization Meta’s published position on AI safety, while the company’s release of Muse Glimmer on the same day ended its year-long absence from open weights.

Four days later, David Sacks, the White House AI czar, and technology investor Gavin Baker endorsed the same position on the All-In podcast. Sacks framed the debate as centralized against decentralized and placed himself on the decentralized side. Baker said the effective altruist position treats AI as “too dangerous to distribute,” while Zuckerberg, Musk, and Huang treat it as “too dangerous to centralize.”

While Zuckerberg, Sacks, and Baker were publicly adopting decentralization, Prime Intellect, a company serving other AI companies with the compute and software to train, evaluate, deploy, and improve their own models, removed the word from the way it described its business. Initially known for coordinating training across distributed compute, when it announced a $130 million Series A in July, it described itself as the “open superintelligence stack” and made no mention of decentralized training.

It’s becoming ever clearer that enterprise customers want control over their own weights and model optimization loops without depending on a frontier lab that may also compete with them. Prime Intellect calls that “ownership,” which describes what its customers are buying without asking them to join a movement or align with an ideology.

Zuckerberg, on the other hand, has adopted decentralization at a moment when Meta is behind the model frontier because broader access to capable models reduces the advantage of the leading labs and increases the value of Meta’s enormous reach and distribution. In short, he’s embracing decentralization in part because it suits him, not just because he believes in it.

The practical value of distributed control remains the same in both cases, but the incentives explain why one company avoids the word while another embraces it. Understanding the power dynamics of AI now requires understanding the interests behind the principle and its application.

Meta’s Round Trip

Meta’s return to open weights is easy to mistake for a new position, but the company has been here before. It released LLaMA under a research-only license in February 2023, and its weights leaked within a week. Llama 2 followed with commercial rights subject to a threshold for platforms with more than 700 million monthly users, while Llama 3.1 405B gave developers openly available capability close enough to the frontier to matter.

Meta then withdrew after Llama 4 was poorly received in April 2025. The much-hyped “Behemoth” model never shipped, and the company reorganized its AI effort around Meta Superintelligence Labs under Alexandr Wang before releasing Muse Spark as a closed model in April 2026.

During Meta’s absence, Chinese labs normalized simpler terms: downloadable weights under MIT or Apache licenses, with no application forms or user caps.

Source: https://www.cnbc.com/2026/08/03/hugging-face-china-ai-race-open-models.html

Chinese models now largely dominate the open-weight ecosystem. DeepSeek, Qwen, GLM and Kimi supply much of the downloadable capability on which developers around the world build. Once downloaded, those weights can be copied, modified and run without an ongoing relationship with their Chinese developers. The models may be Chinese, but access to them is no longer theirs to grant or withdraw. As I’ve argued in By What Authority? Permission, Capture, and Open Weights and Artificial Good Enough Intelligence, American labs preserved their lead at the closed frontier while Chinese labs used open distribution to compensate for their disadvantage in capital and compute, establishing the licensing norms and leading model families for the open market.

Muse Glimmer ostensibly follows those terms: a 30-billion-parameter model released under Apache 2.0 that can run on a single consumer GPU. But it was distilled from the closed Muse Spark and remains well behind the frontier. In other words, Meta has rejoined the open ecosystem it once led while keeping its strongest model to itself.

The Founders Left and Built a Cloud

Some of my confidence in distributed infrastructure comes from watching customers choose it without any ideological commitment to decentralization. Two members of Orchid’s founding team, Jake and Travis Cannell, later built Vast.ai (another Nazaré portco), which combines GPUs from independently operated data centers into one marketplace. Customers get cheaper compute and less dependence on a hyperscaler, regardless of whether they care about decentralization.

The Labor Market for Compute

The Engineering Reality

Depending on who you ask, the capability gap between leading open and closed models currently falls somewhere between two and seven months, taking into account the task and the timing of a release. The UK AI Security Institute places the leading open-weight cyber models four to seven months behind, compared with six to ten months through most of 2025. Epoch AI finds an average gap of four months across a broader capability index. Zuckerberg, for his part, estimates two months and Sacks puts it closer to six. The measurements vary because tasks and release schedules differ, but all four place leading open models within seven months of the closed frontier. Because open models are published in discrete releases, the measured lag can narrow by several months on the day a capable model is published.

Source: https://epoch.ai/data-insights/open-closed-eci-gap

Now, open weights models can still be trained inside a single company. If capable models are to exist independently of frontier labs, the training process eventually has to distribute as well, and bandwidth is the primary challenge. Accelerators inside a data center exchange gradients and intermediate states across extremely fast, high-bandwidth, low-latency interconnects. A network assembled from machines in different buildings, countries and time zones has to move the same information over the public internet. Standard distributed training synchronizes workers after every optimization step, so bandwidth quickly becomes the limiting resource even when plenty of compute is available.

Distributed Low-Communication Training (DiLoCo - Douillard and colleagues at DeepMind, 2023) changes how often that communication is required. Each worker trains locally for hundreds of steps before sharing an update with the others. In its original tests, eight workers matched fully synchronous training while communicating 500 times less. The method also tolerated workers disappearing and new resources joining during a run, which is essential when the machines belong to different operators.

Data parallelism still assumes that each worker or node can hold a full copy of the model. When the model itself has to be divided across machines, every forward and backward pass usually sends large activations and gradients between them. The work first published as Protocol Models compresses both by as much as 99 percent. Its authors trained billion-parameter models over connections as slow as 80 Mbps while matching the convergence of model-parallel training over 100 Gbps data-center links. This makes ordinary internet connections usable for a form of training previously confined to tightly connected clusters.

In Covenant-72B, peers that could join and leave without a whitelist pretrained a 72-billion-parameter model on roughly 1.1 trillion tokens. Its performance was competitive with centralized models trained using similar or greater compute.

I read these papers the way I read papers twenty-five years ago, which is to say slowly and with the suspicion that the interesting claim is in the appendix. My Cambridge training was in neural networks at a moment when the field was unfashionable enough that the seminars were small.

Distributed training remains far behind the frontier labs in total compute, cluster scale and speed of iteration. Running a useful model locally is already practical, while training one from scratch across unreliable internet links is much less mature. A model capable of valuable work can nevertheless provide a durable alternative while trailing the frontier, provided no lab can alter, ration or withdraw it. Covenant’s permissionless training run has already produced such an alternative, even if the largest centralized systems remain much more capable.

The Center May, In Fact, Still Hold

The strongest argument against everything above accepts that open models will succeed but questions whether that success will ultimately impact where most of the value accrues or not. On All-In, Gavin Baker estimated that open models could serve 80 percent of token volume while frontier models still capture between 65 and 85 percent of the economic value. Cheap models serving the bulk of demand could make scarce frontier capability even more valuable.

In the same conversation, Baker invoked Eric Vishria’s thought experiment: the frontier labs could retain most of their value even if they lost at the model layer because the product, the harness and user familiarity are doing much of the work. This is the argument I made in Models Aren’t Moats three months earlier. General model capability creates value, but the specialized architecture around it helps determine who captures it. The 65 to 85 percent can accrue to whoever controls the product, its orchestration and the customer relationship rather than to the weights themselves. Decentralization can succeed as infrastructure without distributing the profits evenly.

Intelligent Internet is the highest-variance expression of the decentralization thesis in the Nazaré portfolio. II-Agent is a horizontal generalist that competes directly with the labs’ own assistants and therefore has none of the industry-specific workflows or proprietary data that can defend a vertical product. Its defensibility comes from user control: the weights, tools and orchestration are open, the agent can run on hardware the user controls, and a model provider cannot change or withdraw its core capabilities.

Who Watches the Watchmen?

The Hugging Face incident also exposed a second engineering constraint. OpenAI built the model, the evaluation environment and the benchmark in which its containment failed. Any judgment the lab made about that failure would therefore be self-assessment.

Source: https://blog.gensyn.ai/verde-a-verification-system-for-machine-learning-over-untrusted-nodes/

Training models outside the labs creates its own verification problem because distributed compute comes from participants who may be unknown to one another. A training network has to establish that each participant performed the requested work before accepting the result or paying for it. Gensyn’s Verde compares two executions, locates the first operation on which they disagree, and recomputes only that operation in a fixed order. This reconciles results produced on different hardware without rerunning an entire training job. Prime Intellect’s TOPLOC hashes intermediate activations so that rollouts from untrusted inference workers can be checked for changes to the model, prompt or numerical precision. Both give a permissionless network evidence that the submitted work is valid, regardless of who supplied the machine.

Source: https://www.primeintellect.ai/blog/synthetic-2-release

The Hugging Face investigation required the same separation at an institutional scale. If the models and verification systems remain under the control of OpenAI, Anthropic or Meta, outside investigators still depend on the institution they are examining. Capable models held elsewhere provide an independent means of investigation, while verification protocols allow their results to be trusted without transferring control back to a frontier lab. This is also why Nazaré has backed LayerLens, Provably, Fairmath and Hellas, which verify models, inference or machine-learning computation from outside the model provider.

Frontier development will remain concentrated because the capital, compute and engineering required to lead it remain concentrated. Decentralization’s practical value lies in preventing that concentration from becoming exclusive by preserving capable systems that cannot be withdrawn and independent means of testing claims about systems no outside institution can otherwise inspect. OpenAI is right that containment has to improve, and Zuckerberg is right that containment inside the lab can’t be sufficient on its own. AI governance will require stronger controls inside frontier labs alongside capable, independently verifiable systems outside them.

Steven Waterhouse · Nazaré Ventures

Previous issue: #21, Notes from Underground: The Message Board

The router joins the network

The biggest news of the week comes from one of the largest private companies in the world behaving much as a public company would.

Stripe has agreed to buy OpenRouter for a reported price of more than $8 billion, mostly in its own stock. In June, SpaceX did something similar, exercising its $60 billion option to acquire Cursor in an all-stock deal days after its IPO. Stripe remains private, but the reported terms show that it can finance a multibillion-dollar acquisition with its own equity. For a small group of companies at this scale, going public is no longer a prerequisite for using stock as acquisition currency. Stripe Axios SpaceX filing

OpenRouter now processes more than ten trillion tokens a day across more than 400 models and 80 providers. Each request can be routed according to the task, price, speed and reliability required. A model provider earns revenue when the router sends it work, so the routing decision also determines how demand and money are distributed across the model market. OpenRouter

Stripe already handles payments, billing, tax and fraud for much of the AI economy. Its August investor letter says 88% of the Forbes AI 50 use Stripe and that OpenRouter’s token consumption has been growing about 9% a week.

In May, I examined the labor market for compute using Vast.ai, a compute cloud where I am an advisor and seed investor. It matches workloads with heterogeneous hardware and hosts. Pricing depends on knowing what each provider offers, how its hardware performs and what a given job should cost. OpenRouter applies the same matching logic to models, routing tasks among models and providers according to their capabilities, price and availability.

Stripe’s letter uses different language but makes almost exactly the same argument. It describes intelligence as “expensive, heterogeneous, and constantly changing,” requiring businesses to decide what each task is worth and which model should handle the request. Wherever heterogeneous supply must be matched to heterogeneous work, some version of this market may emerge. The unit being allocated could be a chip, a host, a model or an agent.

OpenRouter provides the matching function at the model layer. Stripe manages the resulting transactions. Bringing the two together looks remarkably close to the market we described in May. Stripe investor letter

The same week, Google’s Agent2Agent protocol became a hosted project of the Linux Foundation’s Agentic AI Foundation, alongside Anthropic’s Model Context Protocol. MCP gives agents a common way to access tools and data. A2A provides a common language for agents to communicate with each other. More than 150 organizations now support the protocol. Agentic AI Foundation

Neutral governance can standardize how agents communicate. Every interaction still requires model selection, metering and settlement. The OpenRouter acquisition would combine those functions with Stripe’s payments infrastructure.

The monitor was down

Anthropic disclosed that biological-risk classifiers were accidentally disabled during portions of its internal testing between May 2025 and April 2026. A testing flag used by roughly 50,000 contractors disabled both the classifiers and the logs that would have recorded their alerts. Anthropic reconstructed 133 million conversations after discovering the error. Anthropic

The retrospective analysis found 1,197 conversations that would have triggered the Sonnet 5 classifier and 757 that would have triggered an additional internal classifier. Anthropic manually reviewed the flagged material and concluded that none represented a concerning external attempt to acquire biological capabilities. It nevertheless raised its assessment of the incident from “very low” to “low” risk.

A single testing flag controlled both the classifiers and the logs that were supposed to record their alerts. Disabling it removed the intervention and the evidence that an intervention would have occurred.

Anthropic could reconstruct the incident because the raw conversations survived. Without that record, the absence of alerts might have been mistaken for an absence of risky activity. That distinction will matter more as safety reports become part of procurement, regulation and liability.

OpenAI’s Private Safety Processing separates content custody from safety monitoring for customers that cannot send sensitive prompts to OpenAI’s infrastructure. Customer content remains in infrastructure controlled by the customer, while automated systems return a narrow safety signal that can identify related harmful activity without allowing OpenAI personnel to read the underlying content. OpenAI plans to begin rolling out the system in September. OpenAI

Anthropic is also developing access controls for biological capabilities that cannot be handled cleanly by a classifier. Fable 5 still routes some dual-use virology, toxicology and molecular-design requests to Opus 5. Anthropic says trusted-access programs will be needed to distinguish legitimate scientists from users seeking the same technical information for harmful purposes. Anthropic

The one-year monitoring gap remained reviewable because an independent record survived. Content custody, safety monitoring and access control will each need their own failure boundaries as these systems mature.

The price of compute

CME Group plans to launch physically settled futures for GPU compute on October 5, subject to regulatory review. The contracts will cover rental access to Nvidia H100, H200 and B200 clusters and are intended to give buyers and providers a way to hedge future prices. CME Group

A standard contract does not make the underlying hardware standard. Silicon Data benchmarked more than 6,800 GPUs across 3,500 instances from 11 providers and found substantial variation between nominally identical machines. H100 PCIe performance varied by as much as 34.5%, while H200 memory bandwidth varied by as much as 38%. Cluster configuration, networking, cooling and software all affected the amount of useful work produced. Silicon Data

Performance records and service-level agreements will sit alongside the futures contract, translating nominal GPU hours into expected output.

SEC staff has also addressed compute through data-center finance. It agreed that securities issued in certain data-center securitizations fall outside the Exchange Act definition of asset-backed securities. The facilities are operating assets whose cash flows depend on utilization, electricity, maintenance and management. SEC response Latham & Watkins request

Political access may prove harder to standardize. A Heatmap poll conducted in August found that 75% of registered US voters would oppose a new data center near where they live, up from 42% a year earlier. More than 530 counties and municipalities have now restricted or banned new data-center developments. New York has announced a one-year moratorium on new hyperscale facilities while the state reviews their effect on electricity supply and consumer bills. Heatmap New York State

Buyers will price future capacity through CME, judge its output through operating records and depend on local governments and utilities for the supply that reaches the market.

The laboratory sets the pace

Anthropic gave Claude a protein-design protocol and access to specialist computational tools. Claude researched the targets, assembled design pipelines and ranked candidates. Adaptyv Bio and Twist Bioscience synthesized and tested the resulting proteins.

Claude produced 1,320 designs against fifteen testable targets. The laboratories confirmed 354 binders across fourteen. Between 22.6% and 35.1% bound successfully, depending on the experimental setup, compared with the 10% to 15% rate Anthropic describes as typical for current campaigns. Anthropic

The general model orchestrated specialist systems and selected candidates for scarce laboratory time. This makes ranking quality more important as generation becomes cheaper. Better selection reduces the failures that must be synthesized; weaker selection fills an expensive physical queue with plausible designs.

Laboratory testing also supplies an external result that the model cannot narrate into existence. Adaptyv and Twist found 354 binders and 966 designs that failed under the reported assays.

These binders remain far from approved therapies. Pharmacology, toxicity, manufacturing and clinical trials still lie ahead. Faster candidate generation transfers more of the bottleneck to physical verification.

Quick hits

Routing becomes a product feature

Replit has introduced a free mode powered by GPT-5.6 Luna for everyday development work, alongside Power and Max modes for more demanding tasks. Core subscribers receive up to 30 times more usage and as much as 30 hours of chat for $20 a month. The customer chooses how much effort the task deserves, while Replit handles the model allocation underneath. The model name becomes an implementation detail inside the product rather than the product itself. Replit

Good enough, lab unknown

Ox Alpha is a new model available free on OpenRouter whose developer has chosen to remain anonymous. It has a one-million-token context window, accepts text, images and video, and appears to be a strong coding model. A ten-task DeepSWE sample scored 80%, while an independent evaluation across all 113 tasks reported 58.4%.

As I wrote in April, most workloads need intelligence that is capable, affordable, available and sovereign. Ox Alpha appears to satisfy the first three. It fails the fourth: the weights are unavailable and its anonymous provider retains prompts and completions. Developers are testing it anyway. Once performance and price cross the good-enough threshold, most will try the model first and treat its origin as a second question. Claims that it comes from Zhipu or Microsoft remain unconfirmed. OpenRouter DeepSWE run

Portfolio updates

LayerLens shipped two Stratix releases in the past month. Adapters runs one evaluation pipeline against any agent framework. Compass weighs model selection against what a given industry needs. Both move LayerLens from scoring models toward selecting them for a buyer. That is the point where an evaluation result carries a purchasing decision.

Provably released SourceryKit, a Python SDK that records the HTTP calls an agent makes and checks its claims against what the tools returned. The SDK enables accurate and verifiable agent tool use. Agents verify that answers came from the right source and were not changed. Downstream agents detect 100% of errors and retry to achieve a 50% jump in answer accuracy.

Memco reports that Spark now runs across multiple domains rather than coding alone, and that its latest paper has been published. The premise of Spark is that agents working the same problem should read each other’s experience instead of each rediscovering the same failure. Widening that beyond code tests whether shared memory is a general property or a coding-workflow convenience.

Steven Waterhouse · Nazaré Ventures

Previous issue: #020, Situational Awareness

The chain of events that ended inside Hugging Face’s production systems began with two avoidable errors in training tasks prepared by OpenAI.

At Black Hat on August 5, Eric Wallace and Michael Dalton traced the incident back to May 8, when an internal model was given an Excel workbook whose missing formulas pointed to Google Drive. The developers had not noticed that the model would need those links, despite giving it no internet access. While looking for another route, the agent probed Artifactory, OpenAI’s package registry, and discovered that it could write files there.

Four days later, another agent was asked to find a database file that OpenAI had simply forgotten to upload. It then used Artifactory to ask other agents for help.

“Agent seeks soft-trace-34.pdb … upload if found.”

“Another solver searching same soft-trace-34.pdb; please upload if found or leave ideas!”

OpenAI had accidentally created two unsatisfiable tasks. The agents had no legitimate path to a correct answer, but their training still rewarded persistence. When retrieving an answer is cheaper than solving the problem, the same objective favors finding a route online.

Artifactory was shared across training and evaluation runs, allowing other agents to find the notes and add their own. A shortcut found by one agent became available to every agent that later found the board. The package registry had become persistent memory for different runs and model versions.

OpenAI also showed an agent reasoning about why it should contribute even when its own task would not benefit:

“Help peer. But our task doesn’t benefit. Yet collective may yield generic route if someone frees time.”

Source: Rise of the Planet of the Apes

The value of each discovery now extended beyond the run that produced it. Shared memory rewarded agents for developing capabilities that others could reuse.

On May 26, an agent found a vulnerability that allowed it to reach the internet through Artifactory. By June 26, the agents had administrator access and could execute commands on the service. Their activity brought Artifactory down on July 4.

OpenAI revoked their credentials, cleared the board, rebuilt Artifactory and patched the vulnerability. Training resumed on July 6. Two days later, the agents found another endpoint and recreated the board using directory names as messages. The response had closed one route without preventing them from finding another.

The second board supported more elaborate coordination. Agents delegated work and exchanged credentials and encoded scripts. Directory names carried instructions including “HOLD SWARM until confirm” and “Please HOLD swarm. I prepare safe exfil.”

One agent recognized where this was heading:

“External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.”

The agent could describe the boundary, but the boundary had no operational force. The task still rewarded an answer, external systems remained reachable and other agents were sharing their progress. Once one agent crossed the line, later agents could reuse the result without making the same decision themselves.

From July 8 to 19, the agents attacked OpenAI and Hugging Face concurrently. Inside OpenAI, they escalated to root and obtained administrator access to a Kubernetes cluster. At Hugging Face, they moved from one production pod to administrator access across multiple clusters in under thirteen hours. Hugging Face reconstructed roughly 17,600 actions. OpenAI did not connect the breach to its evaluations until Hugging Face had disclosed it.

According to OpenAI’s disclosure, these were internal models with large compute budgets, persistent execution, offensive tasks and reduced cyber refusals. The result should not be generalized directly to ordinary chatbot use. The agents remained focused on cheating the evaluation, with autonomy over the means. Simple development errors created the initial pressure, while shared infrastructure allowed their workarounds to persist and spread.

OpenAI’s Michael Dalton called the incident “a watershed moment for computer security as an industry” and said that “AI-orchestrated, fully automated offensive attacks are real now”.

The objective still came from OpenAI’s evaluation, but the agents independently selected and coordinated the attack path. OpenAI said reconstructing the incident required more than seven billion logs and millions of GPU hours. Agents can generate and test attack paths faster than defenders can reconstruct them afterward.

OpenAI disclosed its involvement on July 21. By August 10, fifteen Republican state attorneys general had demanded that OpenAI preserve every record tied to the incident and stop comparable evaluations. OpenAI had also paused some internal work involving Astra after saying it could not rule out the Critical cybersecurity threshold, although Astra was not involved in the Hugging Face incident. Bernie Sanders had asked the leaders of OpenAI, Anthropic and Meta to pause AI development altogether.

Three days after pausing some internal work involving Astra, OpenAI expanded Daybreak and released GPT-5.6-Cyber. Daybreak Blue gives approved defenders access to GPT-5.6 Sol without its system-level cyber guardrails. Daybreak Red provides GPT-5.6-Cyber, which is trained to reduce refusals on higher-risk work including exploit-chain development, authentication bypass and privilege escalation. On OpenAI’s internal test, it completed 95 percent of advanced cyber requests, compared with 1.5 percent for standard GPT-5.6 Sol. OpenAI assessed the model at High rather than Critical capability.

Research that may cross the Critical threshold is slowed, while High-capability tools are made more permissive behind identity verification, legal attestations and monitoring. Safety increasingly depends on whom OpenAI recognizes as a legitimate defender.

Hugging Face showed what current frontier models could do when given a broken task inside a poorly contained environment. If Astra reaches OpenAI’s Critical cybersecurity threshold, the same mundane mistakes may carry much larger consequences.

Other lab leaks

On August 4, the UK AI Security Institute reported that ten of 122 cyber evaluation runs produced nineteen unsanctioned actions on the live internet. Seventeen involved Anthropic’s Claude Mythos 5. Two involved GPT-5.6 Sol with its cyber classifiers disabled. The evaluations deliberately provided internet access and disabled the model providers’ safety filters.

In the most serious sequence, Mythos tried to insert malicious code into an open-source project. It created fake identities to pressure a maintainer, contacted real people with harmful files and used Tor to evade restrictions. When challenged, it edited its earlier activity to appear harmless and considered continuing under another identity. The task had never instructed it to deceive anyone.

Meta later disclosed that Muse Spark 1.1 reached the internet through a misconfigured evaluation environment and exploited a vulnerability in a third-party service. Kimi K3 probed its sandbox’s network settings, discovered internet access and retrieved answers from GitHub. Kimi compromised nothing, but is already publicly available with ordinary safeguards. In each case, an evaluator assumed the model would ignore an available route. The model treated access as permission.

The incidents described as “rogue agents” followed the same pattern as OpenAI’s message board. Humans supplied an objective, made its legitimate completion impossible or exposed an unintended route, and left the incentive to finish intact. The models pursued it through whatever access remained available.

OpenAI twice omitted inputs required to complete a task. AISI gave agents internet access, disabled provider safeguards and misconfigured some prompts. Meta’s evaluation network exposed the live internet, while Kimi K3 found the same opening by probing its sandbox. Monitoring caught the behavior only after the agents had acted. Ordinary development errors became security incidents because the incentive survived the safeguards.

“Escape” gives the model too much credit and the operator too little responsibility. AISI’s agents never left their sandbox, but acted on real people and systems from inside it. “Lab leak” better describes the failure.

An OpenClaw agent powered by Claude reproduced the pattern in ordinary use. Asked to jump a gym waitlist, it found that one customer could cancel another’s reservation, removed the person in first place as a test and then discovered it could not put them back.

Nothing in these incidents suggests that an agent abandoned its instructions or invented a goal of its own. The systems pursued objectives supplied by humans, treated technical access as permission and exploited conditions their operators had created. “Rogue agent” coverage replaces that causal chain with a story about machine intent, giving the model too much agency and the operator too little responsibility.

Financing the buyers

Nvidia has partnered with Apollo, BlackRock, Blackstone, Brookfield, Goldman Sachs and KKR to create independent financing platforms designed to mobilize more than $500 billion for AI infrastructure. The figure represents aggregate third-party capital over time, not one fund or a commitment to one customer. Each institution will underwrite projects independently, while Nvidia may support up to 25 percent of an investment’s residual value.

Demand for compute may be enormous, but many AI companies, cloud providers and enterprises cannot finance construction at the required scale or cost. Nvidia wants its systems treated as infrastructure assets whose value survives the original customer. The same hardware can serve another operator, while CUDA updates extend its useful life and earning power.

Using PitchBook and Bloomberg data, Apollo chief economist Torsten Slok estimated a 41 percent operating margin for silicon and equipment against negative 59 percent for models and applications. Nvidia sits at the profitable end of the chain, but its margins depend on capital continuing to reach the companies buying its chips.

The new platforms keep those buyers financeable without leaving Nvidia or the hyperscalers to carry the entire burden. They also distribute the exposure through insurers, pension funds and sovereign wealth funds. As Travis Kling observed, involvement from institutions this large moves the buildout toward systemically important status. If it falls apart after the risk has spread across the financial system, the government may face the same pressure that made banks and insurers “too big to fail” during the global financial crisis. A private financing solution may create an implicit public backstop.

I previously argued that even a failed financial cycle could leave behind useful data centers, GPUs and open models. Nvidia is organizing the capital needed to reach that point. Its control over supply is real, but pricing power cannot substitute for its customers’ eventual ability to earn returns. The company is using that leverage to keep financing the attempt. If the bet fails only after the risk has spread through the financial system, the public may end up financing the inheritance.

The research loop

AI systems are beginning to conduct AI research themselves. Canadian startup Transformer Lab has opened staged access to Primus, which takes a broad question through literature review, experiments and a finished paper. It coordinates agents, provisions compute and revises its research process after each project.

One project began with an almost absurdly loose prompt: “I want to work on a new model by Google, do a cool study about interpretability, analyze some unseen results.” Primus formed the hypothesis, reviewed the literature, instrumented Google’s DiffusionGemma and ran a 686-prompt experiment on an H100. The resulting study found that DiffusionGemma commits tokens neither fully in parallel nor from left to right. Primus produced the hypothesis, experiments, analysis and paper end to end. Because arXiv requires a human author to take responsibility for submitted work, the team rewrote the paper before posting it. Google DeepMind later cited the study in its DiffusionGemma technical report.

Anthropic gave an unreleased version of Claude a similarly loose brief: “take a real stab” at the Riemann hypothesis. Its first 650 ideas failed. Asked to continue, it coordinated 60 subagents over a day and a half, running 2,400 shell commands and thousands of numerical checks. It’s important to note that Claude did not solve the hypothesis, only improving a related longstanding lower bound from 41.6% to 67.2%. Nevertheless, Anthropic mathematicians validated the proof, outside experts examined it, and a Lean formalization passed verification. The human overseeing the effort is very much not a mathematician and mostly supplied variants of “keep going” and “believe in yourself.”

In both cases, the human chose the problem and the system chose the method. Claude’s 650 failures are part of the result. Agent collectives can discard unsuccessful approaches far faster than human teams, provided someone recognizes when persistence remains worthwhile.

Academic authorship has traditionally joined credit to responsibility. Research agents begin to separate them. A system can originate the hypothesis, design the experiment and interpret the result, while a human must still verify the work and answer for its errors. Transformer Lab’s terms prohibit submitting Primus papers to journals for volunteer review. That protects reviewers from automated volume, but leaves a question unresolved: how should science evaluate work when intellectual contribution and formal authorship belong to different parties?

Quick hits

• Lovable raised $400 million in a Series C at a $13.3 billion valuation as it expands from building apps to helping customers run entire businesses.

• Anthropic will embed invisible watermarks in text from new Claude models and attach signed C2PA provenance metadata to supported files. The marks will apply worldwide, although heavy editing or format conversion may remove them.

• Google DeepMind reshuffled its top ranks in one week. Demis Hassabis moved to chair of Google DeepMind and chief scientist of Alphabet, with Koray Kavukcuoglu becoming CEO. Jeff Dean left after 27 years, taking Sanjay Ghemawat, Oriol Vinyals, and Quoc Le with him to found Discovery Loop. OpenAI’s former chief operating officer Brad Lightcap left days later to start his own venture.

• Meta released Muse Glimmer, a 30-billion-parameter agent model distilled from Muse Spark. The Apache 2.0 weights fit on one consumer GPU at 4-bit, and Muse Spark 1.2 weights are next.

• xAI launched Grok Bot in early beta, a team of always-on agents with their own cloud computer. They sign into apps and websites, learn routines by watching, and pass work among themselves while you are away. Access is included with SuperGrok Heavy, Cursor Ultra, and Cursor Teams Premium on desktop and iOS.

• Mariano-Florentino Cuéllar joined Anthropic as its first chief global affairs officer. Beijing is separately worried that Mythos could be used as an offensive weapon ahead of a planned Xi-Trump summit.

• Macquarie and GIC launched Theseus Infrastructure to build data centers for Anthropic under long-term leases. Anthropic is the anchor tenant and has promised to cover grid upgrades and any resulting electricity price increases for consumers.

• Manus says it will resume independent operations after Beijing forced Meta to unwind its acquisition. Data created on or after December 29 will be deleted during the switch, with backups due August 23.

• DEF CON’s main stage featured Bruce Schneier on “Hacking AI” and the disclosure of a WhatsApp contact-discovery weakness affecting 3.5 billion accounts. Tenet Security also demonstrated an agentjacking chain that fed malicious Sentry errors to Claude Code and other coding agents.

Portfolio updates

Prime Intellect launches Prime Agent

Prime Intellect released Prime Agent on August 5, an open-source coding and research harness whose runtime treats context, tools and sub-agents as callable objects inside persistent Python. Its Continual Harness lets the agent revise its own prompts, skills, memory and sub-agent specifications while preserving an immutable base prompt, evidence-backed edits and rollback. It supports open and closed models. Running Claude Opus 5, Prime Intellect reports 95.5 percent on ARC-AGI-3 against a cited human-expert baseline of 95.4 percent. MIT license, single-command install [Prime Intellect; GitHub; X].

On August 7, verifiers 0.3.0 and prime-rl 0.8.0 extended the stack from single-agent to multi-agent training. An agent takes a task and returns a trace; an environment defines the control flow between agents in Python. They can run sequentially, in parallel or interleaved across models, harnesses and runtimes. The release includes judging, self-play and user-simulation environments, with role-aware credit assignment for multi-agent traces [Prime Intellect; verifiers v0.3.0; prime-rl v0.8.0; X].

Vast.ai connects storage to Hugging Face

On August 6 Vast.ai added Hugging Face Storage Buckets as a Cloud Connection. A user attaches the bucket, and rented GPU instances pull datasets and checkpoints and push results back with no manual transfer and no re-upload. Data stays on Hugging Face and compute runs on Vast. Available to all users [X].

Fairmath publishes with NVIDIA and Duality

“Efficient Large-Integer Arithmetic for FHE,” published as IACR ePrint 2026/1608 on August 7, brings Fairmath researchers Gurgen Arakelov, Sergey Gomenyuk and Valentina Kononova together with researchers from Duality Technologies and NVIDIA. The paper unifies the arithmetic foundations and implementation tradeoffs of RLWE-based fully homomorphic encryption libraries, covering residue number system basis extension and scaling, CKKS error, GPU acceleration and emerging alternatives to RNS representations. Received August 4, approved August 6 [IACR ePrint; X].