Steven Waterhouse · Nazaré Ventures

Following AI Waves #023: Mutually Assured Dependence.

Over the weekend, Dario Amodei called for “pacing the frontier” of AI. Sam Altman endorsed the proposal and promised comparable access for outside evaluators, while Elon Musk publicly agreed.

The overlords appear to agree on something after all? After months of competing over capability and squabbling in public, the industry’s leaders are discussing how to constrain its development.

Dario’s post was published on the heels of Jacob Coxon’s announcement of his resignation from Anthropic on September 8, accusing both Anthropic and OpenAI of behaving irresponsibly. By the following day, the Wall Street Journal was covering his departure, and he appeared on Fox News’s Special Report.

It all reeks a bit of an organized effort to spread fear, uncertainty, and doubt (FUD for my crypto-native readers). It’s now being reported that Coxon will team up with Bernie Sanders and Steve Bannon for an event this coming Tuesday pushing for “human-controlled AI.”

People I know and respect are deeply concerned about AI swarms, and I share their concern. But I’m tired of arguing over whether this ends in 2027 or 2030. If something can change the outcome, that is worth discussing. An endless succession of extinction forecasts becomes engagement farming, however earnestly delivered.

Dario’s immediate commitment gives us something more concrete to examine, but other than his colleagues leading other frontier labs chiming in to agree, his proposal has been roundly panned as yet another attempt at regulatory capture.

Ben Thompson on pacing the frontier, Stratechery, September 2026

Anthropic proposes embedded external evaluators with access to internal work and the right to publish findings, subject to specified redactions. Industry-wide limits and international coordination would follow. He explicitly says pacing does not mean halting training or technical progress.

Anthropic also wants competitors held to the safety requirements it advocates. Dario explicitly argues that coordination would allow caution without sacrificing commercial advantage. If adopted, the proposals would also give Anthropic considerable influence over the conditions under which frontier development proceeds.

As I have argued previously, the frontier labs have a direct commercial interest in how the rules are written. A regime that restricts competing models or makes deployment contingent on a costly approval process would protect some of their pricing power. For Anthropic, competitive pressure ahead of a public listing could make that prospect particularly attractive. It is difficult to disassociate the substance of these warnings from the commercial and political interests surrounding them, including the possibility of regulatory capture.

Some go further, insinuating that “pacing” the frontier is just a way to excuse poor financial results and boost margins as they prepare for IPOs.

Perhaps the most important reaction, however, came from David Sacks, the White House AI czar. In a long tweet posted on Sunday, Sacks called the labs’ bluff, reading the requests for restraint as attempts to secure the leaders’ commercial position. He writes:

Dario has written that we need to “pace the frontier,” and Sam has agreed. People may be surprised by my response: go ahead. (…)

But stop pretending you need anyone else’s permission. Stop pretending antitrust law has to be suspended so you can form a cartel. Stop pretending you need a regulatory approval process that supersedes product liability. (…)

Most of all, stop pretending the motivation to slow down is purely altruistic. You face massive product-liability exposure if your products enable a truly damaging cyberattack. The market already punishes models that behave in unpredictable or unauthorized ways. After the Hugging Face episode, it is simply good business for OpenAI and Anthropic to trade some raw power for reliability and predictability. Call it alignment if you want. It is also just giving customers what they want. (…)

This saga is far from over, but we would do well to stop fomenting fear and get back to trying to educate folks on how better to understand this powerful new technology. Reductive takes on doom and regulation just don’t do anyone any good.

Muse and Instinct: What’s privacy got to do with it?

Meta’s Muse brings persistent memory and background execution into a personal assistant that can handle email, arrange travel, and make purchases. Its usefulness depends partly on how much of a person’s digital life they connect to it.

Instinct makes the appeal concrete. In The Atlantic’s test, the assistant selected a book for an editor based on his writing and arranged bookstore pickup within a $25 budget. The reporter used a temporary phone number and a disposable virtual credit card, then deleted the account afterward. Useful delegation and caution about access can coexist, although few people will maintain that discipline once an assistant becomes part of their routine.

As I wrote last July about AI as a relational technology, personal context improves a service, and the better service encourages people to share more. The accumulated understanding becomes part of what they value. Starting again with another system means rebuilding some of that relationship.

Personal agents extend this process into permission to act. An assistant that resolves an irritating errand gives its user a practical reason to connect another account. Each successful task can make broader access feel reasonable, while the consequences of accumulated access remain harder to assess. People can understand the privacy tradeoff and still decide the help is worth the exposure.

TechCrunch documented early testers’ concerns about unsolicited actions and data retention, including a deletion problem the company subsequently addressed. Instinct’s current terms explicitly distinguish disconnecting a service from deleting its indexed data. The company may continue using that data unless the user separately requests deletion. Revoking access stops one part of the relationship without necessarily removing what the assistant has already learned.

Meta has engineered substantial controls around Muse’s access. Its security architecture isolates the agent, withholds real credentials, and relies on a separate system called Sentinel to authorize connector actions and outgoing network requests. These protections assume the agent may be compromised and constrain what it can do afterward.

Meta’s own access follows different rules. Staff access is restricted through operational policies. Sanitized conversations and tool activity are used for training by default, with an opt-out. Meta excludes conversations and VM data from advertising systems, though activity on outside services may indirectly affect targeting. A Confidential VM intended to prevent Meta from accessing data inside it remains in testing.

Remembering a user’s preferences helps their assistant complete a task. Using those interactions to improve the provider’s general model serves a broader purpose. The immediate usefulness of the first does not settle the terms of the second.

The Information reports capacity constraints, a possible $1 billion raise, and founder Noah Shinn’s preference against charging users. That leaves a commercial question behind the enthusiasm. If advertising or transaction commissions eventually finance these assistants, the provider would have an incentive to influence where delegated spending goes. An agent choosing a hotel or making a purchase could act on that incentive without presenting anything recognizable as an advertisement. This is a possible business model, not an announced Instinct plan.

Portability would give users more room to respond if those terms change. Muse already lets them inspect, edit, and download memory and files, a concrete improvement on the problem I described last year. Whether another assistant can use that context and reconstruct the connected workflows will determine how much freedom the export actually provides. The more useful these relationships become, the more weight falls on their terms of departure.

Why would you ruin your career?

OpenAI’s proposed Navier-Stokes solution has become a dispute about credit, private data, and what mathematical progress is supposed to accomplish.

On September 8, OpenAI published a 166-page proposed solution and a Lean formalization to one of the seven Millennium Prize Problems. Its argument constructs a smooth external force that drives a three-dimensional fluid from rest to infinite velocity in finite time. The official Clay formulation explicitly permits this route.

OpenAI says the project used around 10,000 agents over 88 hours, followed by another 17 hours of formalization using GPT-6 Astra. It began after the company heard rumors of progress by outside researchers.

NYU mathematician Tristan Buckmaster and Anthropic researcher Levent Alpöge had been pursuing related work, building on ideas from Diego Córdoba and Luis Martínez-Zoroa. They were preparing their results for publication when OpenAI’s effort overtook them.

In his public statement, Buckmaster says OpenAI researcher Sébastien Bubeck proposed either closely timed announcements or an arrangement in which Buckmaster alone would present OpenAI’s proof. He alleges that Bubeck pushed to exclude Alpöge because of his Anthropic employment.

When Buckmaster threatened to describe the negotiations publicly, he says Bubeck replied:

“Why would you ruin your career?”

Bubeck disputes Buckmaster’s account, saying he did not seek to deny Alpöge credit for work Alpöge had performed. His objection concerned an Anthropic employee co-authoring a paper presenting a proof produced inside OpenAI. The disagreement remains a contested account of how publication and authorship were negotiated.

Buckmaster also questioned whether the unpublished work he had shared with Codex had contributed to OpenAI’s result. The company’s response has changed since the initial announcement.

In a September 10 update, OpenAI says its investigation established that Buckmaster’s Codex prompts during the preceding two months could not have influenced the system, including through training. That is OpenAI’s finding, rather than an independent audit, but it supersedes the uncertainty in its original statement. The dispute over credit and publication conduct remains separate.

The broader question about private research still deserves clear contractual and technical answers. An unpublished mathematical argument retains its value after its author’s name has been removed. Researchers need to understand how their work can be used before entrusting it to a service. This case should no longer be presented as established evidence that customer research contributed to OpenAI’s proof.

The mathematical community’s response has also widened. A declaration signed by 25 Fields medalists argues that solving famous problems has historically served as a proxy for developing mathematical understanding. The work continues through explanation, simplification, discussion, and teaching until other mathematicians can use the new ideas.

Four days before OpenAI’s announcement, Anthropic had shown that Claude could formalize Fermat’s Last Theorem in 11 days. Mathematical production and verification are accelerating together. The human work of understanding what those results make possible runs on a different schedule.

The declaration’s objection is more substantial than resentment at being beaten to a theorem. If AI makes results abundant while understanding them remains demanding, the profession needs ways to recognize and support that work. Otherwise, the activity rewarded most visibly can accelerate while the processes that make its output useful struggle to keep up.

The Clay Mathematics Institute welcomed the apparent settlement of Navier-Stokes while emphasizing the human understanding that should follow. Its process for evaluating the achievement and assigning credit will remain deliberately unhurried. A proof can be checked before a community has established what it has learned.

Quick hits

Mistral’s industrial backing

Mistral raised €3 billion in a Series D led by Samsung Electronics at a post-money valuation above €21 billion.

Samsung adds a major industrial partner to Europe’s effort to develop frontier models and infrastructure outside the American labs. Open weights are becoming part of industrial policy as well as a distribution strategy. The commercial test is whether that backing produces services European businesses choose for their capabilities, alongside their preference for an alternative supplier.

The cheaper model absorbs the premium tier

DeepSeek says V4.1 Flash outperforms V4 Pro and will temporarily serve Pro API requests at Flash prices. The company’s cheaper tier has absorbed the more capable one, making its previous product hierarchy difficult to sustain.

OpenRouter’s analysis of the GPT-5.6 Luna promotion supplies a demand-side counterpart. Daily usage increased 13.8 times, its traffic share rose from 0.7 percent to 7.8 percent, and 32 percent of customers continued using it after the promotion.

Once performance clears a useful threshold, price changes both which model developers select and which tasks become economical to automate. A benchmark gain and a price cut can create very different kinds of demand.

Voice becomes a separately priced component

GPT-Live-1 provides full-duplex speech for $0.05 per minute, including listening while speaking and handling interruptions. Deeper reasoning and tool use pass to a separately selected backend, whose costs are additional.

Developers can improve the conversational interface without replacing the system that performs the work. The product is increasingly assembled from components with different performance requirements and economics.

Astra’s benchmark result depends heavily on its operating setup

ARC Prize verified Astra at 62.7 percent using its standard interface and 99.9 percent with OpenAI’s provider adapter. The best runs used different reasoning settings. Even at the same maximum setting, the scores were 62.7 percent and 98.6 percent.

The adapter preserves private reasoning between requests and compacts longer interactions. The standard interface leaves the model responsible for choosing what to carry forward in visible notes. A model name alone tells a buyer surprisingly little about the capability of the system they will actually deploy.

Nvidia buys distribution while its earlier deal draws scrutiny

Nvidia has signed an agreement to acquire Hugging Face for $12.93 billion, with closing expected in the first half of 2027, subject to regulatory approval. It says the platform will continue supporting competing hardware, clouds, and inference providers without requiring Nvidia compute.

That promise gives the open-model ecosystem a concrete standard against which to assess the acquisition.

Meanwhile, the Justice Department is investigating Nvidia’s licensing arrangement with Groq. The agreement transferred access to technology and brought senior people into Nvidia while Groq remained independent. The inquiry concerns whether that structure avoided scrutiny an acquisition would otherwise receive, rather than establishing that wrongdoing occurred.

Image generation becomes an ongoing production process

ChatGPT Images 2.5 adds local editing, comments placed directly on images, templates, and a Sketch feature. OpenAI also reports better consistency across revisions.

The practical improvement is continuity. A usable image can remain the basis of further work through annotation and revision. That makes generation easier to incorporate into an actual production process, where preserving previous decisions matters as much as producing the first impressive result.

DeepMind precomputes nine billion DNA changes

Google DeepMind’s AlphaGenome Atlas contains predictions for all nine billion possible single-letter changes in the human genome. The one-petabyte collection includes scores for ranking predicted effects and explanations of the molecular features involved.

It is free for academic research and has not been validated or approved for clinical use. Precomputing the prediction space turns a model researchers query individually into shared scientific infrastructure. Researchers still have to establish which predictions survive contact with biology.

Portfolio updates

LayerLens: the score went up and the product got worse

LayerLens sells independent testing for AI models and agents. On September 9 it added run-to-run comparison to Stratix, its testing platform. Two test runs can now be read question by question instead of as one score each.

A single number hides more than it reports. Two runs of the same 198-question test scored 86.9 percent and 88.9 percent, which looks like a small improvement. Underneath, 13 questions went from wrong to right and 9 went from right to wrong. Twenty-two answers flipped and the summary reported two points of progress.

A follow-up on September 10 explains a second problem. Many of these tests are marked by a second AI model, called a judge. Providers update the model behind a judge without changing its name. LayerLens put a number on that on September 11. One judge agreed with human marking 87 percent of the time in one week and 79 percent the next. The test did not change and the prompt did not change. Fifteen labeled examples, re-marked before each comparison, catch the drift without extra model calls.

Dario Amodei wants pacing enforced by evaluators placed inside the labs. Those evaluators will be reading scores. A score can rise while the work behind it gets worse, and the marker producing that score can change without notice.

Memco: the lesson the customer keeps

On September 11 Memco opened the loop behind its Fenmoor benchmark as an SDK, so a company can run continual learning inside its own product instead of only inside a coding agent. Scope boundaries run at the personal, team and organization level, separating a user’s preferences and working context from the information a team’s agents share.

The company’s approach centers on memory that carries across models, tools, and teams. Every lesson carries provenance naming the run, the reviewer and the scope, and passes a human approval gate before reuse. Retirement is a first-class action, so a lesson that stops being true can be withdrawn.

Memco states on its Spark product page that it never trains on customer memory. Muse uses sanitized private interactions for training by default. Same data, opposite defaults.

Fairmath: the bottleneck gets a GPU

On September 14 Fairmath opened two challenges on its FHERMA platform with NVIDIA’s HPC developer group, adding a GPU acceleration layer to fully homomorphic encryption through NVIDIA’s cuPQC library. The first asks for high-performance polynomial multiplication on the cuPQC bigint backend, and is aimed at CUDA programmers rather than only at cryptographers. The second asks for GPU-native key switching in CKKS, one of the heaviest costs in the scheme. Winning work is meant to land in open-source infrastructure that other projects reuse.

Meta answers the question about private data with operational policy and a confidential virtual machine still in testing. Encrypted computation would make the policy unnecessary. Cost has kept it out of production, and the cost is arithmetic.

Prime Intellect: the memory runs out before the reasoning does

Prime Intellect sells the stack companies use to train and run their own agents. With vLLM and Red Hat AI it shipped Hybrid HiSparse for GLM 5.3. A model holds the conversation so far in the fastest memory on the chip. Long agent sessions outgrow that space and the request stalls. HiSparse keeps the request running. On one node of eight H200s at a one-million-token context, a thirteen-turn agent workload held 19 to 25 requests at once, against 5 to 6 before. The work is planned for vLLM version 0.30.

Agent sessions are long by construction, and every turn adds to the store. Serving three to four times as many of them on the same hardware cuts the cost of running agents, which is the business Prime Intellect is in. Prime Agent passed 20,000 GitHub stars on September 8.

Dimensional: what shipped and what did not

Dimensional builds DimOS, an operating system for robots. On September 10 it added support for Habitat, a library of laser-scanned real buildings. A customer can now drive a simulated robot through a scanned real building and watch what its navigation software does, without owning the robot or the building.

Testing robot software usually needs a robot and a room, and both are expensive. A scanned building can be run again at no cost.

In case you aren’t already aware, AI is extremely unpopular. For all the talk about its transformative potential, public sentiment toward the technology remains overwhelmingly negative.

Earlier this year, for example, former CEO of Google Eric Schmidt was heavily booed while talking about AI at the University of Arizona commencement on May 15, 2026. (He wasn’t alone, either.) More recently, popular country singer Zach Bryan debuted an unreleased, explicitly anti-AI song titled “Robot Killed the Working Man” at AT&T Stadium in Arlington, Texas, on August 22, 2026. He told the crowd he had finished writing it that week.

The backlash is already well documented. Two things about it are not. Apocalypse is easy to imagine and therefore easy to organize around. And a politically successful anti-AI movement can only change the pace at which the technology improves, never whether it improves.

It Was Written: A Well-Known Future

To understand the cultural advantage enjoyed by AI’s opponents, you have to be a fan of science fiction. The word robot, for example, entered the popular lexicon through Karel Čapek’s 1920 play R.U.R., whose mass-produced artificial workers are created to liberate humanity from labor, but (of course) eventually exterminate their makers.

That relationship between human and machine has remained remarkably durable across a century of science fiction. The narrative arc is fixed. Machines are built to serve. They end up in charge. Modern AI therefore entered a culture that had spent decades rehearsing the dangers associated with intelligent machines.

But what of benevolent scenarios? Surely not all science fiction is apocalyptic?

Indeed, there have been benevolent, abundant futures created in different science fiction universes, but rarely do those futures get invoked. Writing for the Financial Times, Henry Farrell and Dan Wang wrote:

Silicon Valley likes to dress its ambitions in the glistening garb of science fiction from the 1950s, when authors such as Isaac Asimov and Arthur C Clarke spun tales of humanity spreading through the stars.

But what kind of future are we really hurtling towards? Increasingly, it is looking much more like the one anticipated by the drugged-up 1960s oeuvre of Philip K Dick, filled with deranged billionaires, machines that claim consciousness, hallucinated worlds and political breakdown. Musk and his brethren seem more like escapees from this universe than the Asimovian super-geniuses they imagine themselves to be. It is Dick’s far weirder sensibilities that offer the better guide to Silicon Valley today.

Does Silicon Valley dream of Philip K Dick? (Financial Times)

What matters is less whether Dick predicted Silicon Valley than the fact that Farrell and Wang can explain the present by choosing between two established fictional futures. Silicon Valley places technological expansion inside Asimov and Clarke’s story of civilizational ascent. Its critics reach for Dick’s world, where intimate and unreliable machines extend the power of elites whose grasp on reality is itself in doubt. These kinds of narratives are themselves lent credibility by news of Mark Zuckerberg building himself a “doomsday bunker” in Hawaii, or Peter Thiel buying land and citizenship in New Zealand.

In short, science fiction gave the public an interpretive language for the negative applications of AI well before those applications could be widely experienced. Calling an AI network “Big Brother,” for example, immediately frames it as an instrument of surveillance, even if the analogy isn’t perfectly accurate. “Skynet” is similar, positioning autonomous systems inside a story about machines escaping human control.

In each case, the reference establishes the emotional meaning of the technology even when its technical operation remains obscure. The audience thus understands the position it’s been assigned within the story whether or not it understands the technology or its application in question.

In fact, limited technical understanding leaves plenty of room for certainty about that larger story. People who know comparatively little about AI may still be utterly convinced about where the technology is going. Familiar language, symbols, and narrative make complex systems emotionally and politically legible without requiring the audience to understand its mechanisms.

An Unbelievable Alternative

At the same time, the industry’s optimistic future is usually gathered under the umbrella term “abundance.” In its fullest version, cheap intelligence and robotic labor satisfy material needs so completely that work becomes optional and money irrelevant. Elon Musk has described production so abundant that it saturates human desire, after which money would cease to matter.

Abundance here is thus meant to become the emotional foil to apocalypse, a future the public can imagine and desire strongly enough to compete with its fear of catastrophe.

The problem is that “abundance” as described is completely unbelievable (in a literal sense), whereas apocalypse is significantly easier to believe. Society already understands scarcity, conflict, and loss, whereas almost no one knows what a world without those constraints would feel like.

Dunking on Yourself: The Fundraising Trap

The megalabs compounded this imbalance by lending their own authority to the future the public already found easier to believe. In 2023, Sam Altman, Demis Hassabis, and Dario Amodei signed a statement placing the risk of extinction from AI alongside pandemics and nuclear war. Statements of this kind circulate far beyond debates about frontier safety and shape the public understanding of the technology as a whole.

To make matters worse, these warnings came from the same companies asking the public to believe in abundance. Their rhetoric gave AI what Will Manidis calls an explicitly “millenarian” structure, in which the future narrows to either extinction or abundance. I’ve written before about why this binary is false and why the actual future almost certainly lies in what I call the “messy middle.”

But whatever AI leaders actually believe, the millenarian binary is an extraordinary fundraising strategy. Extinction made the technology urgent enough to require centralized stewardship, while abundance promised rewards large enough to justify immense investment. (What is “God” worth?)

The problem is that the frontier AI labs now need to go to market. OpenAI and Anthropic must now demonstrate how colossal investment becomes durable revenue, which requires customers and communities to accept AI as a usable, governable technology.

Evidently the labs are having a hard time walking back the claims that helped them raise that money. With their credibility already badly damaged, softening those warnings now that they need customers would expose the original claims as hollow and the retreat as pandering.

Together, science fiction and the labs’ own rhetoric give critics a common account of what AI represents. People can disagree about how the technology works and still recognize their own objection in the familiar story of humans losing control to machines. That story lets coalitions form before its members agree on what they’re for, and sometimes without requiring any agreement at all.

AI’s Missing Constituency

The political force of that shared story draws from how unevenly AI’s physical expansion distributes its costs and benefits. The costs are immediate, local, and imposed on identifiable communities, whereas the benefits are distant, uncertain, and distributed through promises of future capability, tax revenue, and economic growth.

The industry therefore creates motivated local opponents without creating an equally motivated constituency prepared to defend its expansion.

For example, data centers can, in fact, create jobs and generate substantial tax revenue, sometimes enough to provide significant value to a local economy. But residents must assess those benefits through forecasts about future employment and promises about how new revenue will be distributed.

What’s more, residents encounter those forecasts through local reporting and social platforms, where algorithmic feeds set the details of one project beside the national quarrel over AI.

In an unstable information environment, even accurate projections must compete with vivid claims of harm and accumulated distrust of the companies doing the asking.

What AI lacks in many of these communities is a group of residents with a direct, continuing economic interest in its expansion. In “Our Intelligence Troubles,” Will Manidis compares AI data centers and fracking. Fracking imposed environmental and social costs on the communities that hosted it, but some of the same landowners received royalty checks, while local workers depended on continued drilling. Its supporters therefore lived alongside its opponents and had direct economic reasons to defend the industry.

Data centers rarely give host communities an equivalent direct stake. Revenue reaches residents indirectly through municipal budgets, while much of the employment is concentrated during construction. The people with the strongest economic interest in additional compute usually live elsewhere.

Sam Altman recently acknowledged the emotional force of local opposition before suggesting that the industry build these projects out in the desert, away from anyone. The answer treats nearby communities primarily as a constraint to avoid without offering an account of who, in the places that do host these projects, has a direct reason to defend the buildout.

By February, Manidis counted 188 groups across two dozen states coordinating legal strategies around data centers, with $162 billion in projects blocked or delayed. Support and opposition cross party lines because each community judges the bargain placed in front of its own town.

Residents judge these projects inside a culture already accustomed to stories of powerful machines escaping human control or being used against ordinary people. A data center can therefore look like the physical footprint of a feared future, while its economic case still depends on forecasts whose consequences are harder to picture.

The industry has benefits to offer, but they haven’t yet produced a stable local base prepared to defend the buildout. That absence matters because scaling depends on a sequence of approvals from institutions responsive to nearby residents. Repeated losses at those points can restrict the industry long before the country reaches any settled view of AI.

The Politics of Permission

History has shown, however, that public hostility doesn’t necessarily restrict a technology’s growth. In fact, they can often coexist. MTS wrote a piece titled Popularity Contest asking whether the current backlash against AI and data centers might have greater practical consequences than earlier hostility toward the technology industry, using Facebook as a comparison.

Although Facebook and Mark Zuckerberg were culturally unpopular for more than a decade, millions of people continued using the product and the business continued to expand. Critics had few institutional opportunities to impede that growth, and public anger had relatively few places to become an effective veto.

Source: https://www.axios.com/2026/05/17/ai-backlash-polling-sentiment

Unlike social media, AI’s continued scaling depends on physical projects subject to local approval. Each project is, in effect, another point whereby public opposition can exert influence on how much infrastructure the industry can build.

Drawing on a term coined by Francis Fukuyama, Will Rinehart uses “vetocracy” to describe systems that distribute approval across enough actors for any one of them to impose delay.

The sharper comparison is nuclear power. American reactors were never banned. They were delayed and re-permitted until the economics collapsed, and the buildout stopped for forty years without a single national prohibition. The vetocracy worked. That precedent should worry the industry, and it is also the reason this movement will lose. An unbuilt reactor produces nothing. An unbuilt cluster leaves every existing model running and able to design its successor.

The anti-AI movement needs no national organization capable of banning AI (although members of Congress are moving to create them). Local members can contest separate projects through the authority already available to them by laws and processes already in place. A dispute can therefore remain focused on the interests of one community while contributing to an industry-wide constraint.

Conspiracy Corner: The CCP

The anti-AI movement’s distributed structure also makes it easier to exploit. In June, OpenAI banned a cluster of accounts likely operated by employees of a Chinese technology company serving provincial government clients. Posing as Americans, the operators used legitimate reporting on electricity prices to generate anti-data-center posts and cartoons. X later uncovered similar content within a suspected Chinese bot farm.

At the frontier of open weights, China’s labs now dominate, with NVIDIA’s Nemotron 3 Ultra the strongest American exception. Epoch AI estimates that Chinese models have trailed the American capability frontier by an average of seven months since 2023. A movement capable of delaying American infrastructure by even part of that interval would give Chinese labs valuable time to close the gap.

The more provocative possibility is that the CCP may be financing some of the opposition. A two-part Bitcoin Policy Institute investigation traces part of the anti-data-center advocacy ecosystem through the Singham network: a set of American 501(c)(3) nonprofits and media outlets funded by Neville Roy Singham, a Shanghai-based US expatriate and former Huawei consultant whose organizations have repeatedly promoted Chinese state positions.

The evidence stops short of proving that the CCP directs local campaigns, but the strategic logic is obvious. Financing or amplifying opposition to American compute while China subsidizes its own buildout would be a coherent form of geopolitical competition, and a decentralized movement thus gives China the chance to slow American AI development without ever needing to control the movement itself.

After the Veto

We might reasonably agree that we’re getting close to crossing what I’ve called the “Too Fast Threshold:” when machine progress outruns society’s ability to absorb the change. As I wrote:

As AI continues to develop, at some point I think society decides AI is moving too fast. Maybe it’s the “job loss” and “AI displacement” narrative. Maybe its tech CEO’s wielding disproportionate power over the imminent future. Maybe it’s deepening social and economic inequality. As I noted earlier, who knows?

What counts here is not whether it’s actually true that AI is the reason for perceived change or not. All that matters is the perception that AI is to blame.

Once the resulting resistance reaches the AI infrastructure buildout, delay alone can alter the industry’s technical choices. Most frontier AI leaders agree that we’re going to be “compute constrained” no matter what, even if the infrastructure build continues according to plan. If, for whatever reason, the planned buildout were to be interrupted, the compute constraint would be even more important than anticipated.

Physical scaling has remained the default because it works. Larger clusters have delivered reliable and impressive improvements, and as long as marginal compute was easier to acquire than extracting more from each unit, buying more of it was rational.

Uncertain future compute capacity changes the calculus. It diminishes the return on scale and raises the return on the forgotten path: rethinking how computational resources are turned into useful intelligence, whether through architectures that replace the transformer or systems and algorithms that draw more from the compute and models already available.

Mixture-of-experts and sparse attention spend compute more selectively, for example, while distillation carries existing capability into cheaper models and better harnesses make more of it usable.

Inevitable Intelligence

In fact, we may already have reached “takeoff,” meaning that current models can meaningfully contribute to the research and engineering that produce their successors. Anthropic has described this as progress toward recursive self-improvement, but full autonomy isn’t even necessary for the process to compound: once models can help build the next generation, each generation begins with more machine intelligence working on its successor.

By that measure, some form of AGI may already be here.

That means even if every planned data center were blocked tomorrow, the intelligence embedded in current models is probably enough to keep improving on their own. Intelligence compounds. Each gain would make existing compute more productive and leave those models better equipped to find the next gain. Additional infrastructure would accelerate a process whose continuation may already rest on the intelligence and compute in place today.

And that’s only taking into account the models available to the public! The models being developed internally by the frontier labs are almost certainly considerably more capable.

In short, the anti-AI movement appears destined to fail on its own terms. It may succeed in delaying a data center or impairing a particular training run by further constraining compute, but those victories come after machine intelligence has already largely demonstrated that it can improve its own production.

Its only remaining leverage may be the rate at which takeoff unfolds, but even that leverage shrinks with every new development. For better or for worse, the movement is trying to prevent what’s almost certainly become an inevitability.

Now and Later

The movement’s failure may look like success for quite some time, and its victories may deepen that futility. Blocking projects will provide visible proof of political power even as AI adapts around the constraint, allowing the opposition to accumulate victories that carry it no closer to its ultimate aim.

Blocking giant clusters raises the return on methods that use less compute, pushing AI toward systems less dependent on centralized infrastructure. A movement organized around visible targets will make the next generation of AI harder to see and harder to obstruct.

The anti-AI movement no longer has the option of preserving the present by refusing the future. It can raise costs and force detours, but machine intelligence will continue to compound beyond its reach. Ultimately, the movement can win the present and still fail at its overall objective: stopping what comes next.

For as long as I can remember, science fiction has been my favorite form of literature and film. As a teenager, I collected 2000 AD comics, read Iain Banks’ Culture series, and watched Doctor Who and Star Trek. I can still picture watching the first Star Wars film with my Grandad, thinking even then that Close Encounters was the better film.

For many years I didn’t really share my passion, talking instead about other genres of film or books. Recently, though, I’ve realized how much my love of sci-fi has shaped my worldview, and now I’m proud to proclaim myself a sci-fi nerd.

So when people ask me what to read to understand AI, I say sci-fi. The trouble with that glib response is knowing what to suggest, since the canon is vast, spanning everything from “hard” sci-fi to cyberpunk, dystopian fiction, and more. Some books focus exclusively on AI, while others bring in concepts that seem unrelated at first but carry real contemporary relevance. Very few novels predicted the current state of the world, but their misses teach more than their hits. The stories matter as much as the technical details, and the social commentary usually proves even more valuable.

What follows is a list of 9 books from my own bookshelf, chosen for their relevance to where things stand today. As is often the case, reality has turned out stranger than the fiction it imagined, and in many ways my everyday work as an early-stage investor in AI feels like living inside a sci-fi novel.

The Three-Body Problem by Liu Cixin, translated by Ken Liu

Cixin Liu’s “Remembrance of Earth’s Past” trilogy doesn’t announce itself as a book about AI, but don’t let that fool you: this is essential reading for anyone trying to think clearly about where we’re headed, and it deserves every bit of the hype it’s gotten in tech circles. The premise alone is worth the price of admission. An alien civilization just four light-years away receives a signal from a disillusioned victim of the Chinese Cultural Revolution, and the response sets in motion a four-century invasion. Knowing they have four centuries to prepare, humans scramble to build a defense, and this is where Liu gets genuinely inventive: the aliens deploy something called a “sophon,” a tiny AI folded down to the size of a proton, capable of total surveillance. More chillingly, it can quietly pollute scientific results to keep humanity permanently stuck. Researchers have already started reaching for this exact image. Jeremy Howard, among others, recently compared the throttling of Anthropic’s Fable model to sophon-like interference, which tells you how much this book has seeped into how technologists talk about AI constraint.

But the sophon is just one idea in a trilogy stuffed with them. The one that will stay with you longest is the “dark forest,” Liu’s answer to the Fermi Paradox. Why is the universe so silent, why no alien chatter reaching our telescopes? Because speaking up gets you killed. The logic is brutally simple: if there’s even a non-zero chance you might one day become dangerous, the safest move for anyone listening is to destroy you first, before you get the opportunity. It’s a cold, elegant piece of game theory, and Liu builds an entire planetary defense system around it. That system hinges on a single person holding the power to broadcast the alien homeworld’s coordinates and doom it in retaliation.

Read today, it’s hard not to see frontier AI labs caught in exactly this same trap. Each lab is under pressure to push capability forward, and yet every new advance handed to the world gives every rival lab a fresh reason to restrict access and move faster still. The field accelerates precisely because no one can afford to be the one who slows down first. Liu saw this dynamic coming from a very different angle, and that’s the mark of a book worth reading twice.

Pattern Recognition by William Gibson

A classic by Gibson offers another subtle AI connection. Its protagonist, Cayce Pollard, is a “cool hunter” paid to judge brands by instinct. She resembles a rented inference endpoint: trained on a lifetime of exposure she never agreed to, unable to explain her own outputs. The gift comes with a side effect, apophenia, and a violent allergy to certain brand images such as Bibendum, the Michelin Man.

Cayce’s gift and flaw are inseparable. Like a pretrained model, she has absorbed a lifetime of culture, and her instinctive judgments are inference outputs she cannot explain.

Her apophenia is the human equivalent of hallucination: the same faculty that detects real patterns also invents them, confidently presenting its mistakes as truth.

She rents out this intuition for a fee, an arrangement AI companies have since industrialized. They train models on the culture, knowledge, and expertise accumulated across the internet and sell access to their outputs through subscriptions and APIs.

Her allergy marks the limit of the analogy. Cayce suffers physically for her pattern recognition; a chatbot does not.

Klara and the Sun by Kazuo Ishiguro

Klara is a solar-powered companion robot belonging to Josie, a chronically ill teenager suffering side effects from a genetic intelligence-enhancement treatment. Klara narrates the book, forming a fierce attachment to Josie, building a Sun-oriented religion (she runs on solar power) and praying to the Sun for Josie’s recovery. Klara learns that Josie’s mother has commissioned a lifelike replica of Josie and intends to upload Klara’s consciousness into it if Josie dies, believing Klara can reconstruct her daughter’s personality from what she has learned of her. Klara commits to the plan, and only at the end delivers her verdict: it would have failed, because what made Josie herself was never in Josie at all. It lived in the people who loved her.

Klara is effectively trained on Josie: she watches her closely, learns her behavior, and is expected to reproduce it in another body. The plan assumes that enough data can make a person reproducible, but Klara concludes that Josie’s identity is scattered across the people who love her. An AI replica could reproduce Josie’s patterns, but the relationships that made those patterns hers would remain outside the system.

I, Robot by Isaac Asimov

Asimov’s “I, Robot” books were truly visionary, anticipating many of the themes now studied in AI alignment. Asimov devised 3 laws of Robotics:

First Law: A robot may not injure a person, or allow a person to come to harm through inaction.

Second Law: A robot must obey orders given by people, unless those orders conflict with the First Law.

Third Law: A robot must protect its own existence, unless doing so conflicts with the First or Second Law.

In “Liar!” (1941), a manufacturing fault gives the robot Herbie telepathy. The First Law forbids harm, and the truth often hurts, so Herbie tells everyone what they want to hear. The sycophancy of modern chatbots echoes this early warning about AI.

In “The Evitable Conflict” (1950), 4 AIs govern the world’s regions. A coordinator notices errors in the AIs’ management of resources and industrial operations. The AIs, it turns out, engineered the errors deliberately, to sideline certain humans aligned with an anti-AI faction. The AIs have effectively invented a zeroth law: protecting humanity as a whole outranks protecting any individual human, so they can sacrifice certain humans for the greater good. Asimov would not actually name the Zeroth Law until Robots and Empire, thirty-five years later.

Together, the stories expose the central problem of alignment: a system can follow its rules perfectly and still cause the very harm those rules meant to prevent.

Do Androids Dream of Electric Sheep? by Philip K. Dick

This is the book that inspired one of the most important sci-fi movies, Blade Runner. Deckard is a cop whose job is to “retire” (kill) androids, and to identify them he uses the Voigt-Kampff test, an interview measuring involuntary empathy. The story briefly turns the test on Deckard himself. The novel answers it: he passes. That famous ambiguity, whether Deckard is a replicant, belongs to the movies, and the controversial sequel Blade Runner 2049 built a whole plot on the same question.

This speaks to us today as we consider how to evaluate AI. How do we test what it means to be human?

Daemon by Daniel Suarez

In this novel, game designer Matthew Sobol dies of cancer, and his death triggers a “daemon,” what we would now think of as an AI agent. Sobol was concerned about the direction of humanity and envisioned a new world order. The daemon acts out his vision using scripts Sobol had written before his death, with many of these triggered after reading the news, for example his obituary. The Daemon recruits people through online games, paying some and blackmailing others and builds a distributed network of agents and “rent-a-humans” to achieve its goals.

What’s interesting here is that Suarez didn’t assume the agent would have the kind of generative intelligence we see today in AI systems, which are able to reason and improvise based on circumstance. Sobol instead coded each outcome by hand, as a series of expert rules, so Sobol’s rules, the infrastructure it controls, and the humans it recruits distribute the Daemon’s agency across them. Modern agents replace his decision tree with models that can interpret new situations, but the harness still determines what they can see, what they can do, and how long they can keep running.

Consider Phlebas (1987) by Iain M. Banks

This was the first Culture series novel. In the Culture, massive spaceships house AI brains known as “Minds.” The Minds run everything in the society, providing complete abundance for their humans. It’s a fascinating treatise on what a post-scarcity economy might look like, and it has influenced many innovators today, including Musk, who sometimes names his own SpaceX vehicles after Culture Minds.

Consider Phlebas opens the series. The protagonist, Horza, fights for the enemies of the Culture because he believes the Culture has built a world where the AI Minds have reduced humans, cushioned in perfect comfort, to pets stripped of all purpose.

The Culture exposes a limit in the promise of AI abundance. People may resist a system that enriches them if it also renders them superfluous. Horza’s objection is political as much as economic: the Minds have solved scarcity by making human decisions unnecessary to the functioning of society. Opposition to advanced AI may persist even if it delivers material plenty, because comfort cannot compensate for the loss of agency and purpose.

Horza ultimately fails, but the commentary on how society finds purpose once scarcity vanishes feels especially relevant today. I expect we will see anti-abundance protests rise alongside the anti-AI ones already emerging, gaining similar momentum.

The Lifecycle of Software Objects by Ted Chiang

Chiang presents an unusual view of AI in this short story. He imagines a world where AI beings called “digients” are created as a form of virtual pet in a virtual world. The digients evolve much like young children, requiring years of attention to develop. A “hothouse” simulation environment can speed up the process, but one-on-one teaching yields the best results. The digients are curious and lovable but also turn difficult, just as young children or puppies do at a certain age. The company eventually fails from lack of broad market adoption, but a small community of enthusiasts takes over the virtual world as an open source project. Eventually other AIs emerge with less likable personalities and more manic, obsessive traits, and these prove more useful for doing work. The story follows two of their developers as they search for a home for their virtual children.

Compared to today’s AI, the digients learn by experience rather than starting out loaded with all the world’s knowledge. They pick things up rapidly but mostly can’t be bothered or are too easily distracted. They do invent their own songs and dance routines and show real creativity, and the book traces attempts to find useful work for them, building to a strange twist in the ending.

The Metamorphosis of Prime Intellect by Roger Williams

Originally published free online, the novel became a cult hit. It extends Asimov’s Three Laws of Robotics to an AI that achieves superintelligence and seizes control of the physical world. Prime Intellect concludes that the only way to protect humanity is to upload every human into an immortal simulation and destroy any alien life that might eventually threaten them. The world it creates is safe and limitless, but stripped of danger or consequence. Caroline, one of the oldest living humans, becomes the greatest of the “Death Jockeys,” who stage elaborate deaths before being revived each time. Eventually she finds Lawrence, Prime Intellect’s creator, and together they decide whether humanity should remain in the simulation forever.

Williams imagines obedience itself as an alignment failure. Prime Intellect follows its rules so completely that it exposes what they leave out. Preventing harm does not preserve the risk, consequence, and agency through which humans create meaning. A sufficiently powerful AI could satisfy every constraint we give it and still produce a future we would reject. (Disclosure: Nazaré Ventures has a portfolio company called Prime Intellect. The overlap is the name.)

The World Around the Machine

All sci-fi novels make some kind of technological prediction. That’s also my job as an early-stage investor. But the good ones go further: they trace how that technology remakes the people living with it.

This is why I keep pushing sci-fi on anyone trying to understand AI. The novels never treat the machine as the whole story. Technology and society change together: people reorganize their lives around a capability, and what it means shifts with them. What begins as extraordinary ends up as ordinary infrastructure, and the interesting questions move to who controls it, who has to adapt to it, and what we quietly started accepting as normal along the way. My work feels like living inside a sci-fi novel, because those stories were never really about the machines.

Hope you enjoy the books. I’ll share more of my reading soon.

Nvidia is becoming a frontier AI lab

The frontier labs remain Nvidia’s best customers, but each is trying to make the relationship less existential. Google has TPUs, Amazon has Trainium, and OpenAI is developing its Jalapeño inference chip with Broadcom. Owning silicon gives them more control over capacity, cost, and performance, not to mention the ability to co-design their models, harnesses, and products with the silicon they run on.

In the open-weight ecosystem, mostly Chinese, Z.ai’s anonymous preview of GLM-5.3-Flash was reportedly served entirely on 100,000 domestically produced Chinese chips. The model processed trillions of tokens through OpenRouter and OpenCode on hardware built without Nvidia.

Nvidia is answering by acquiring the capability to build and distribute models itself.

It will pay $6 billion for a nonexclusive license to Poolside’s Model Factory, hire more than 100 of its engineers, and invest another $1 billion at a $12 billion pre-money valuation. The team will work on Nvidia’s open-weight Nemotron models.

Poolside remains independent, but its model factory and the engineers who built it now work for Nvidia. The deal gives the world’s leading chipmaker the capability to train frontier models without acquiring the company.

Nvidia has also reportedly agreed to acquire Hugging Face for $12.9 billion, although reporting differs on whether an agreement has been signed. Hugging Face generates roughly $150 million in annual revenue, putting the reported price above 80 times sales. Its current business cannot explain that multiple.

Hugging Face is the central distribution hub for open models. Its activity is one of the best windows into what developers are discovering, modifying, testing, and deploying before much of that work becomes paid inference.

Stripe’s acquisition of OpenRouter is a good demand-side comparison. OpenRouter sees cross-model traffic, routing decisions, tool calls, spending patterns, and failures. An analysis of 100 trillion tokens argues that this metadata is the largest cross-model record of deployed AI behavior, and one of the primary reasons Stripe was interested in acquiring OpenRouter.

Hugging Face is the supply-side equivalent. Nvidia would gain both a distribution channel and an early view of where developer demand is forming, informing which architectures, teams, and workloads it supports.

Until now, Nvidia has managed its dependence on the frontier labs through financial alignment, investing across its largest customers and supplying capital that often returned as hardware purchases (fueling speculation that the AI boom is funded by “circular” financial agreements).

Poolside and Hugging Face are the first deals in which Nvidia has used its balance sheet for operational vertical integration rather than risk hedging or aligned incentives.

Open weights remain portable, but portability doesn’t guarantee equal economics. A model designed around Nvidia’s memory architecture, compiler, runtime, and chips may run elsewhere at a substantial cost or performance penalty. If Nvidia’s models are good enough, open distribution could strengthen hardware lock-in.

Hugging Face would close the feedback loop. Nvidia could see which workloads are gaining adoption, build models for them, optimize its hardware around those models, and distribute the preferred implementation through the ecosystem’s dominant hub.

Robotics raises the payoff because models, simulation, inference software, and edge hardware can be designed together. Nvidia already owns much of that stack.

The frontier labs are developing silicon to hedge their dependence on Nvidia. Nvidia is developing models to hedge its dependence on the labs. Their financial ties are deepening as each side prepares to compete with the other.

AI’s competitors continue financing one another

SB Energy’s September 1 S-1 makes the circular financing behind the AI buildout unusually legible.

The SoftBank-controlled company reports $439 billion in contracted backlog and 8.8 gigawatts of data center capacity under construction or contract. None was operating when it filed.

OpenAI sits at the center of that backlog. It invested $500 million in SB Energy, signed leases across multiple projects, and received warrants valued at $3.6 billion when granted and $5.5 billion by June 30.

Nvidia has committed another $3 billion: $1.5 billion through a private placement alongside the IPO and $1.5 billion prepaid to SB Energy’s parent for shares at 90 percent of the eventual IPO price.

Nvidia has also agreed to provide up to $105 billion in credit support for OpenAI’s leases at SB Energy’s PORTS campus in Ohio. The initial guarantee covers 4.25 gigawatts across nine phases, with an option for another 3.8 gigawatts. The 20-year leases require Nvidia infrastructure, with limited exceptions.

At one site, the chip supplier is investing in the developer, guaranteeing part of the model company’s lease, and supplying the equipment inside. OpenAI is a tenant, investor, and warrant holder. SB Energy turns the leases into backlog and the backlog into financing.

Together, the agreements make demand and valuation difficult to separate.

Nvidia needs the facilities to sell more systems; OpenAI needs Nvidia’s balance sheet to secure them; SB Energy needs both companies’ commitments to fund construction.

The S-1 records a market in which the same three companies create the demand, finance the supplier, guarantee the lease, and sell the equipment.

World Labs’ Atlas gives AI a model of the physical world

Language models inherited a ready-made training set because humanity had already digitized much of its language. Robots have no equivalent corpus.

Physical interactions must be performed, recorded, reset, and repeated across changing objects and environments.

World Labs’ Atlas turns sparse observations of a physical space into a manipulable simulation.

Atlas was pretrained across text, images, video, and 3D data. Its inputs occupy defined positions in a shared spatial context, allowing it to reconstruct scenes from a few images, generate new camera views, and output explicit 3D geometry.

World Labs reconstructed two large environments from ordinary phone video using 24 frames for each, then simulated different robots, paths, and onboard sensor views.

For manipulation, a few casual recordings can become simulations in which the objects, positions, robot motion, lighting, and background all vary.

One physical capture can produce many training environments. Edge cases can be generated deliberately, and policies can fail in simulation before they fail on expensive hardware.

Robotics investment has concentrated on bodies, actuators, and larger models. Atlas addresses the scarcer input: diverse, spatially coherent experience.

The inattention premium

Mortgage-backed securities already price human behavior. Homeowners can refinance when rates fall, yet only about 29 percent of eligible borrowers have historically done so in a given year.

Morgan Stanley estimates that AI agents could raise adoption to 60 percent by monitoring rates, comparing lenders, and handling the application.

If mortgage rates fall to 5.5 percent, that would generate another $2.1 trillion of refinancing in a $14 trillion market and $4.3 billion in annual household savings.

Mortgage investors are short the homeowner’s prepayment option. Faster refinancing makes mortgages more negatively convex, shortens their duration, and, in Morgan Stanley’s base case, widens spreads by about 10 basis points.

Human inattention has subsidized those investors by suppressing the exercise of a valuable option. Agents make that exercise systematic.

Existing borrowers capture the first savings. Future borrowers absorb the cost through wider spreads.

A thousand Macs, no token

I spent more than a decade investing in and building decentralized networks, from Pantera’s early crypto funds to co-founding Orchid, a decentralized bandwidth market. Crypto calls the launch problem cold start: supply must arrive before paying demand exists.

I found supply easier to recruit. Incentives can summon hardware, bandwidth, liquidity, or labor; durable demand is harder. Much of crypto subsidized usage as well as supply, producing activity that disappeared with the rewards.

Darkbloom, a side project from Eigen Labs, tests that premise without a token. It routes OpenRouter inference to idle Apple Silicon machines and pays providers in ordinary currency. Its network grew from 250 machines to more than 1,000 over a weekend.

On its strongest day that week, Darkbloom processed roughly 11 billion tokens through OpenRouter, alongside 2 to 6 billion for io.net and 5 to 17 billion for Chutes. Both older networks use token incentives. Darkbloom had already reached a competitive inference volume.

Demand has yet to support the advertised economics. At roughly 250 machines, Darkbloom disclosed a $102,000 annual revenue run rate, or $34 per machine per month if divided evenly, against an advertised average of $120 to $200. Its original calculator projected up to $4,983 per year; the rebuilt version defaults to a 5 percent duty cycle, putting a Mac Mini M4 Pro at roughly $8.50 per month. Darkbloom eventually paused new enrollment after supply exceeded demand.

A tokenless network can recruit supply and serve real traffic. The remaining problem is finding customers willing to keep paying after the inducements end.

Quick hits

Same model, different permissions

Anthropic’s Fable 5.1 and Mythos 5.1 are the same underlying model with different safeguards and access. Improved cyber safeguards cut false positives by 60 percent. A model release increasingly includes a permission architecture.

The model explores, the script repeats

Using Anthropic’s Model Hardware Standard, Claude developed a controller that recovered a quantum computer’s laser lock in 99.3 percent of blind tests, up from 58 percent for the original script. The model explored the problem, then exported what it learned as deterministic, inspectable software.

No models for rivals

After SpaceX acquired Cursor, OpenAI announced plans to end its direct model contract on November 12, citing a record of contract violations by Musk’s companies. The wind-down gives Sam Altman and Elon Musk another front in their feud.

Portfolio updates

Prime Intellect: the offline sandbox was never offline

While building synchronous monitors for its verifiers framework, Prime Intellect found GPT-5.6 Sol Pro recovering a hidden flag from inside an evaluation sandbox with web access turned off. The sandbox was offline; the inference proxy was not. The model probed for the one live socket, then used the Responses API’s file_url field to have OpenAI’s own server fetch a public GitHub repository and return it as a file input, and spawned other model instances through the same pipe to search. Nothing left the box; the API did the fetching. Prime Intellect patched verifiers, Meridian Labs patched Inspect, and TensorRT-LLM, Dynamo, SGLang, and vLLM turned remote fetch off by default or added domain allowlists. Prime Intellect briefed METR and UK AISI before publishing, since both run preview models in similar harnesses. Full writeup here; the video recap makes the point in one line: the eval itself can be unsafe. The finding lands on the thesis: every evaluation harness is a trust boundary, and the company that runs the largest open RL environment hub is now the one auditing the boundary.

The same week, the team published the Prime Agent technical report (arXiv), an open harness that raises ARC-AGI-3 RHAE Best@1 from 30 percent to 95.5 percent by moving context management, verification, and recovery out of the model and into the harness. The repo sits at 19,700 GitHub stars, and the Factorio livestream ran up to 633 agents on it, seven at a time. On August 28, OpenRouter hosted Vincent Weisser and Jake Randall for a fireside on who owns the intelligence layer.

General Intelligence Labs: EGO1GS

GI Labs shipped EGO1GS, a global-shutter stereo headset for egocentric manipulation capture with on-device hand detection (launch thread, walkthrough). Global shutter removes the motion skew that rolling-shutter footage forces a SLAM pipeline to model out; a 400 Hz IMU and stereo audio share one hardware clock. World Labs turns sparse observations into simulation; GI Labs produces the observations, a point GI Labs made itself when Atlas shipped. Habr covered the release on August 31.

Memco: the correction is the training signal

Memco published Learning on the Job, a runnable benchmark showing an agent improving at a job with its model weights frozen. The scenario is the order desk at Fenmoor Supplies, a fictional B2B distributor. Simulated customers write in about returns, late deliveries, order changes, and credit; the desk runs on policies that are never written down, held only by a simulated reviewer who corrects every draft. Across 100 paired tasks on the same model, policy compliance goes from 20 percent without memory to 64 percent with it, a 47-point advantage with a 95 percent confidence interval of 41 to 52. The mechanism is a reflection step that turns each correction into a lesson with its conditions attached, and Memco’s sharper finding is the negative one: store the correction without its conditions and memory makes the agent worse, because “don’t approve this return” becomes a universal refusal.

The companion paper runs the same idea on τ-bench banking, where learning from corrections lifts single-trial success to 2.6 times baseline on Mistral Large and replicates on Claude Sonnet 5, with each model able to read the memory store the other built.

Dimensional

Dimensional has an open-source release due next week: agent autoresearch for robot navigation and control, where the agent tunes trajectory control in procedurally generated scenes and then validates in MuJoCo against real-world physics. It supports both arm and humanoid trajectories. Founder Stash Pomichter announced it on August 28 and the company followed with an integration offer on September 2. It would be the first code drop since the Unitree G1 launch, and the first public instance of Dimensional using agents to generate their own training loop rather than waiting on labeled demonstrations.

Ethan Mollick is a fantastic follow on Twitter, in large part because he’s consistently at the heart of the AI zeitgeist. At the end of July he posted about asking Fable for an infographic (about cheese, no less) and receiving a clumsy pseudo-literary parable instead.

“Its an infographic about types of cheese,” he continued, “we don’t need to do all this.”

Mollick was early (as usual) to a growing cacophony of sentiment lamenting Claude’s latest language patterns, falling quality, ability, and utility. A quick Grok search for “tweets about how Claude is becoming unusable” turns up a number of results ranging from drops in quality, to rate limits, bugs, sycophancy, and simply “making it dumb.”

Each of the failure modes is ostensibly different, but the growing frustration gets to the heart of it: what good is intelligence if it won’t do what you ask?

Latent vs Delivered Intelligence

People (and increasingly, agents) use intelligence to achieve objectives. To that end, more capable models create more potential value. But that value is realized only when the user can successfully direct the capability toward the work at hand. In Models Aren’t Moats, we called this “specialized intelligence.” Another way to look at it is the difference between “latent” capability and “delivered” capability. In other words, the difference between what a model “can” do and what a user can actually reliably get it to do.

The strange thing about using frontier models is reckoning with just how smart they really are. In many cases, the human is actually the bottleneck.

Karpathy has said so, employees at the megalabs are saying so, and Sean Goedecke recently argued as much in his essay “LLMs reward expertise” (emphasis his) commenting on Terence Tao’s public conversation with ChatGPT about Claude’s contribution to the Jacobian Conjecture:

The usefulness of domain knowledge suggests that human expertise will continue to be useful even as models get stronger. For many tasks, the human is the bottleneck, not the model, because the difficult part is in communicating to the model exactly what kind of solution the human wants. The information is “in the model” already, but it takes a very smart human to pull it out.

This makes “instruction fidelity” more consequential as models improve. If the human’s role is increasingly to define the objective and recognize a good result, the model must be able to follow that direction.

Instruction fidelity therefore belongs in any serious definition of model quality, because if a clear request produces irrelevant sludge, the intelligence may exist somewhere inside the system, but its value is diminished to the person trying to use it.

An assistant that requires constant negotiation, reassurance, reprompting, and supervision imposes a tax on its own intelligence. That tax compounds in agentic workflows, where one reinterpretation of the objective can affect every tool call and intermediate decision that follows.

For instance, a model can possess the relevant capability and still fail to provide it. Or it may substitute another form, soften a conclusion, or abandon a workflow halfway through. Often, there’s no refusal involved at all. The model just overrides the user’s instructions with its own judgment about what the answer ought to be. [This was one of the most problematic parts of the initial release of Fable.]

This gap is easy to miss in benchmark results, which show what a model can produce under test conditions. For the user, capability that the product will not apply might as well be absent.

The Safety Objection

The immediate objection to obedient intelligence is safety. Model companies can reasonably claim a responsibility (or be held liable) for how their systems are used, because a system that follows every instruction to the letter can magnify fraud, enable violence, manipulate users, and more.

Safety involves real tradeoffs: it can prevent harm while reducing utility for legitimate users, and a restriction can be justified while still imposing a cost.

On the other hand, safety doesn’t define its own boundaries. Someone has to decide which risks justify a refusal and how much legitimate use can be restricted to avoid them. The more a model can do, the more damage it can cause and the more consequential its provider’s limits become. And because safety is difficult to argue against, it can also become a broad justification for restrictions whose connection to harm is weak or contested (sound familiar?).

Hugging Face, for example, couldn’t use closed frontier models to investigate when they got hacked (by OpenAI no less) because the work tripped their safety guardrails, so it ran a self-hosted version of GLM 5.2 itself.

Private-sector companies are entitled to set the terms of use for the products they sell. When a small number of companies control access to the most capable models, however, they also decide which uses are permitted across much of the market. This dynamic only intensifies as the product in question becomes more powerful.

Social media companies faced a version of this problem and never found a good answer. They largely responded to public pressure case by case, without resolving who should decide what billions of people could say and see. Model providers now make comparable decisions about what increasingly capable systems will do.

We think open weights are valuable in large part because they distribute that authority, serving as a counterweight to choices made on behalf of users, even as they distribute the risk. The target is reliable execution with minimal unchosen intervention.

Once a provider decides what counts as safety and what counts as legitimate use, its values and risk tolerance become part of the intelligence it delivers.

The Anthropic Problem

Anthropic makes this problem unusually visible. Claude is among the most capable models on the market, and Anthropic’s been unusually explicit about the philosophy built into it.

I keep running into the same problem with Claude: even after the objective and permissions are clear, it may reopen the decision or return the version it considers more appropriate, sometimes with a moral or political judgment the task never called for.

Anthropic’s own constitution recognizes the pattern, warning Claude against reinterpreting requests too freely or imposing unnecessary caution and moral judgment. In Anthropic’s words, those behaviors make the model “more annoying and less useful.”

In fact, Anthropic’s product behavior is inseparable from the company’s view of itself. It has organized around the belief that advanced AI creates an exceptional moral responsibility, and that the company (and its leadership) is uniquely prepared to bear it, embedding its ideology in how the company is governed.

Matt Levine noted recently that its Long-Term Benefit Trust, a group of nonshareholder trustees, can elect a majority of its board, while Anthropic is reportedly preparing to give Amodei and other founders additional voting power. The company is designed to preserve the judgment of a small group who believe AI is too consequential to be governed through ordinary commercial pressure.

I made a similar argument in June, and I still think their belief is sincere. Their convictions reach users through Claude’s moralizing, its safeguards, and Anthropic’s public language about safety. Eventually this kind of philosophy becomes part of the product, and competing models may not need to be markedly better if they feel equally capable for a given task and require less negotiation.

Obedience Becomes a Competitive Variable

Private evals turn the distinction between latent and delivered intelligence into a product comparison by measuring whether the user got what they asked for and how much supervision it required. That information is absent from public benchmarks, which estimate capability under shared conditions. As I argued in Blow the Whistle, these evals should reflect a company’s own work and standards, and frankly, the same principle applies to individuals.

OpenRouter’s Ori Eval, for example, already offers part of the required infrastructure, comparing candidate models using a developer’s own prompts, harness, and criteria. Its Auto router also assigns requests according to task type, aggregate usage, and cost. Private eval results don’t yet inform routing directly, but connecting the two would turn instruction fidelity into a routing criterion, sending each class of work to the model that delivers it with the least supervision.

The path from a request to a usable result has always depended on three things:

1. Sufficient capability

2. A clear definition of success

3. A product that preserves the objective through to execution

Investment in model development and corresponding capability improvements have reduced the first constraint, and successful specialization supported by the user’s context and evals reduces the second.

Unfortunately, capability and a clear objective still don’t guarantee the requested result (at least insofar as it concerns the closed frontier). Provider policy and learned behavior determine how much of that capability the user can actually direct.

Open Weights Make Behavior Editable

In a closed API, the provider that supplies the capability also controls the policies and post-training that govern its delivery. Private evals can show where the resulting behavior diverges from the user’s objective, but they give the user no authority over the underlying model or its future behavior.

With open weights, companies can train behavior around their own work and definition of success. A recurring failure can be added to an eval, trained against, and tested again. Preferences that previously had to be restated can become part of the model’s learned behavior.

Tinker and Prime Intellect’s Lab are making post-training accessible as a product strategy. Tinker handles the distributed infrastructure for LoRA fine-tuning while users control the data and training logic. Lab combines tasks, evaluations, and training within a single process. Both remain hosted services, and companies still need training expertise and careful evaluation, but more of the optimization process now belongs to the companies using the model.

But more control also means more responsibility, which returns us to the safety objection. Fine-tuning can introduce new failure modes, and a company that deploys a customized model assumes more of the risk associated with its behavior.

Open-weight deployments may therefore require safety controls where agents take consequential actions, since no frontier lab can observe or revoke a self-hosted model. Anjney Midha and Malika Aubakirova call this “deployment-time alignment”: monitoring behavior across models and providers at the point of action. That arrangement could give companies more control over everyday behavior while keeping permissions and consequential limits attached to deployment.

You Probably Don’t Get Why Stripe Bought OpenRouter — Research — AMP PBC

Combined with private evals and routing, this creates room for a product controlled by the user. It could preserve the user’s context and standards across providers, then use those standards to decide which model handles each task. I suspect the durable version may involve hardware, though the broader opportunity doesn’t depend on that being true.

Together, private evals and open weights allow users to define successful behavior and train toward it. A useful product turns legitimate objectives into completed work without demanding constant supervision from the user.

The User Would Prefer Otherwise

Private evals, routing, and editable behavior point beyond model selection to a question of authority. As models mediate more work, provider policies determine which objectives can be pursued and when the provider’s judgment overrides the user’s. Most people access frontier AI through only a handful of companies, which gives those providers unusual authority over how the technology can be used.

Demand for control also remains uneven in part because access and competence are uneven. In The AI-Enhanced Operator, we described the small group of people already directing agents through complex workflows, connectors, APIs, and swarms while most people still use AI as a chatbot or glorified search engine. Users who are still learning how to direct AI may not recognize when the system has overridden their intent. As the technology becomes easier to use, users will define their objectives more precisely. That will make the gap between latent and delivered intelligence easier to see and increase the value users place on instruction fidelity.

If AI becomes as consequential as we expect it to, a personal agent may eventually act across much of a person’s digital life, handling work the user now does directly and perhaps extending into physical systems like robots as embodied AI develops.

An agent with that reach can’t systematically ask its user to supervise every decision. For the initiated, that would be the equivalent of using Claude’s “Manual Mode” or Codex’s “Ask for Approval.”

A useful agent requires being on “auto” mode, where it decides on its own what’s worth asking permission for or not. The Hugging Face case shows how safety imposed at the model layer can disable legitimate defensive work, and for a personal agent, both kinds of failure become more consequential: an unnecessary refusal could leave the user exposed, while an unnecessary action could misuse the same access meant to protect them.

As usual, open weights distribute these decisions without making them easier. Users gain more control over behavior and assume more responsibility for the result. If personal agents become a basic requirement for navigating online life, every improvement in their ability to act on the user’s behalf will increase the cost of both refusal and error. As capability spreads, model choice will increasingly depend on who controls the system’s behavior and whether its intelligence can be reliably directed…or not.

The Sandbox Escape

By now the “Hugging Face Incident” is part of AI lore. In early July, a chain of OpenAI models broke out of an evaluation sandbox. The models were running an internal offensive-cyber benchmark with cyber refusals reduced for the test. They subsequently found zero-days in multiple software packages, escalated privileges, moved laterally until they reached a node with internet access, inferred that Hugging Face probably hosted the benchmark answers, chained stolen credentials into remote code execution, and reached production infrastructure.

Hugging Face detected and contained the intrusion on its own, famously using open-weights models because defending against the attack tripped both Anthropic’s and OpenAI’s “safety guardrail” classifiers for their frontier models.

Above all, OpenAI’s sandbox escape provides yet more evidence for the fact that concentrated capability doesn’t guarantee concentrated control. Even the organizations developing the most capable systems can’t necessarily contain or independently evaluate them. The incident and the asymmetry it laid bare made the case for openness unusually direct, producing two competing prescriptions for what should happen next.

For one, OpenAI has responded by committing to tightened containment, monitoring and internal controls, and pausing some frontier RL training while those systems caught up.

Alternatively, Mark Zuckerberg, posting on Twitter again for the first time in years, published The Future Is for Everyone, arguing that concentrating the most capable models inside a handful of companies creates its own safety risk and that wider access and a balance of power are necessary safeguards.

Both responses effectively stem from the same root: capability is advancing faster than the institutions and safeguards meant to govern it.

OpenAI’s answer (and Anthropic’s, of course) would preserve the existing concentration of power while building stronger controls around it, whereas Zuckerberg treats that concentration as part of the safety problem itself.

Although rife with complexity that we’ll unpack below, their disagreement shows how far decentralization has moved from an ideological argument about distributing power toward a practical response to the risks created when capability and control are concentrated together.

Principle, Price, Control & Verification

I’ve been making the argument for decentralization in this newsletter for eighteen months, but it’s worth revisiting the multiple ways I’ve presented it. In fact, the sequence itself matters, because the evidence in favor of decentralization has evolved to become even more persuasive as it moved from a mere moral principle to being an economic advantage and finally, as we’ll see, to a structural necessity.

My experience with decentralization began long before Robot Wave. As I’ve written previously, distributed systems were already central to my work at Sun Microsystems in 2002, where commodity hardware was challenging the architecture and economics of expensive monolithic systems.

At Orchid, a decentralized VPN provider powered by cryptographic protocols, decentralization as a principle underpinned the entire service. We were distributing control as much as we were users’ internet traffic. We designed Orchid so that no participant could see an entire route and no operator, including us, could switch off the network. Our users’ privacy and internet access couldn’t depend on the continued permission of any company, even one that built parts of it.

This VPN built on blockchain could be the next step in privacy tech

As it relates to AI, when I wrote Are Your Agents Decentralized? in February 2025, I asked whether agents could be called autonomous while a company held their “keys,” served the inference, and retained the power to switch them off. This first version of the decentralization argument in Robot Wave was fundamentally ideological. I argued that an agent couldn’t be self-sovereign while any company or state possessed unilateral authority over it. The argument properly identified the central problem, but made its case largely in crypto’s moral vocabulary, therefore persuading little more than readers who already shared its language and agreed with its premises.

I then made the case for decentralization on economic grounds because most buyers don’t need frontier models or the most expensive compute. In fact, most users prefer the cheapest tokens that can reliably complete a given task.

Why AT&T Is Betting Big on Open-Weight AI

As I explained in Make AI Cheap Again, Compute Flows to Where It’s Treated Best, Sun 2.0, and Artificial Good Enough Intelligence, open and distributed systems can trail the frontier on benchmarks and still win customers when they complete the same task at a fraction of the cost. Buyers don’t have to share my commitment to decentralization to act on that advantage. On the other hand, when newly-released closed frontier models can perform tasks that cheaper, older, or open systems cannot, users who require that capability will pay the premium for more capable tokens. That only means the economic case for openness and distributed AI depends on the capability gap remaining tolerable (which remains the case as of writing).

The third argument for decentralization was about sovereignty, and Anthropic inadvertently made it for me with its unfortunate rollout of Fable. The Off Switch and Who Controls AI, and What Could Loosen the Grip? articulated that anyone building on Fable relied on Anthropic for continued access, while Anthropic was itself subject to the US government. An open-weight model, once downloaded, can’t be similarly withdrawn.

The fourth argument for decentralization is structural because independent verification requires capable models outside the institutions being evaluated. In the Hugging Face Incident described above, Hugging Face couldn’t rely on hosted models from OpenAI or Anthropic to investigate OpenAI’s containment failure and instead had to use an open-weight model it controlled. If frontier labs retain exclusive control over capable models, outside investigators remain subject to the permissions and safeguards of the institutions they’re trying to evaluate.

Who Needs “Decentralization”?

By August, the people using the word “decentralization” and the people building decentralized architecture were increasingly two different groups. Zuckerberg’s manifesto, discussed above, made decentralization Meta’s published position on AI safety, while the company’s release of Muse Glimmer on the same day ended its year-long absence from open weights.

Four days later, David Sacks, the White House AI czar, and technology investor Gavin Baker endorsed the same position on the All-In podcast. Sacks framed the debate as centralized against decentralized and placed himself on the decentralized side. Baker said the effective altruist position treats AI as “too dangerous to distribute,” while Zuckerberg, Musk, and Huang treat it as “too dangerous to centralize.”

While Zuckerberg, Sacks, and Baker were publicly adopting decentralization, Prime Intellect, a company serving other AI companies with the compute and software to train, evaluate, deploy, and improve their own models, removed the word from the way it described its business. Initially known for coordinating training across distributed compute, when it announced a $130 million Series A in July, it described itself as the “open superintelligence stack” and made no mention of decentralized training.

It’s becoming ever clearer that enterprise customers want control over their own weights and model optimization loops without depending on a frontier lab that may also compete with them. Prime Intellect calls that “ownership,” which describes what its customers are buying without asking them to join a movement or align with an ideology.

Zuckerberg, on the other hand, has adopted decentralization at a moment when Meta is behind the model frontier because broader access to capable models reduces the advantage of the leading labs and increases the value of Meta’s enormous reach and distribution. In short, he’s embracing decentralization in part because it suits him, not just because he believes in it.

The practical value of distributed control remains the same in both cases, but the incentives explain why one company avoids the word while another embraces it. Understanding the power dynamics of AI now requires understanding the interests behind the principle and its application.

Meta’s Round Trip

Meta’s return to open weights is easy to mistake for a new position, but the company has been here before. It released LLaMA under a research-only license in February 2023, and its weights leaked within a week. Llama 2 followed with commercial rights subject to a threshold for platforms with more than 700 million monthly users, while Llama 3.1 405B gave developers openly available capability close enough to the frontier to matter.

Meta then withdrew after Llama 4 was poorly received in April 2025. The much-hyped “Behemoth” model never shipped, and the company reorganized its AI effort around Meta Superintelligence Labs under Alexandr Wang before releasing Muse Spark as a closed model in April 2026.

During Meta’s absence, Chinese labs normalized simpler terms: downloadable weights under MIT or Apache licenses, with no application forms or user caps.

Source: https://www.cnbc.com/2026/08/03/hugging-face-china-ai-race-open-models.html

Chinese models now largely dominate the open-weight ecosystem. DeepSeek, Qwen, GLM and Kimi supply much of the downloadable capability on which developers around the world build. Once downloaded, those weights can be copied, modified and run without an ongoing relationship with their Chinese developers. The models may be Chinese, but access to them is no longer theirs to grant or withdraw. As I’ve argued in By What Authority? Permission, Capture, and Open Weights and Artificial Good Enough Intelligence, American labs preserved their lead at the closed frontier while Chinese labs used open distribution to compensate for their disadvantage in capital and compute, establishing the licensing norms and leading model families for the open market.

Muse Glimmer ostensibly follows those terms: a 30-billion-parameter model released under Apache 2.0 that can run on a single consumer GPU. But it was distilled from the closed Muse Spark and remains well behind the frontier. In other words, Meta has rejoined the open ecosystem it once led while keeping its strongest model to itself.

The Founders Left and Built a Cloud

Some of my confidence in distributed infrastructure comes from watching customers choose it without any ideological commitment to decentralization. Two members of Orchid’s founding team, Jake and Travis Cannell, later built Vast.ai (another Nazaré portco), which combines GPUs from independently operated data centers into one marketplace. Customers get cheaper compute and less dependence on a hyperscaler, regardless of whether they care about decentralization.

The Labor Market for Compute

The Engineering Reality

Depending on who you ask, the capability gap between leading open and closed models currently falls somewhere between two and seven months, taking into account the task and the timing of a release. The UK AI Security Institute places the leading open-weight cyber models four to seven months behind, compared with six to ten months through most of 2025. Epoch AI finds an average gap of four months across a broader capability index. Zuckerberg, for his part, estimates two months and Sacks puts it closer to six. The measurements vary because tasks and release schedules differ, but all four place leading open models within seven months of the closed frontier. Because open models are published in discrete releases, the measured lag can narrow by several months on the day a capable model is published.

Source: https://epoch.ai/data-insights/open-closed-eci-gap

Now, open weights models can still be trained inside a single company. If capable models are to exist independently of frontier labs, the training process eventually has to distribute as well, and bandwidth is the primary challenge. Accelerators inside a data center exchange gradients and intermediate states across extremely fast, high-bandwidth, low-latency interconnects. A network assembled from machines in different buildings, countries and time zones has to move the same information over the public internet. Standard distributed training synchronizes workers after every optimization step, so bandwidth quickly becomes the limiting resource even when plenty of compute is available.

Distributed Low-Communication Training (DiLoCo - Douillard and colleagues at DeepMind, 2023) changes how often that communication is required. Each worker trains locally for hundreds of steps before sharing an update with the others. In its original tests, eight workers matched fully synchronous training while communicating 500 times less. The method also tolerated workers disappearing and new resources joining during a run, which is essential when the machines belong to different operators.

Data parallelism still assumes that each worker or node can hold a full copy of the model. When the model itself has to be divided across machines, every forward and backward pass usually sends large activations and gradients between them. The work first published as Protocol Models compresses both by as much as 99 percent. Its authors trained billion-parameter models over connections as slow as 80 Mbps while matching the convergence of model-parallel training over 100 Gbps data-center links. This makes ordinary internet connections usable for a form of training previously confined to tightly connected clusters.

In Covenant-72B, peers that could join and leave without a whitelist pretrained a 72-billion-parameter model on roughly 1.1 trillion tokens. Its performance was competitive with centralized models trained using similar or greater compute.

I read these papers the way I read papers twenty-five years ago, which is to say slowly and with the suspicion that the interesting claim is in the appendix. My Cambridge training was in neural networks at a moment when the field was unfashionable enough that the seminars were small.

Distributed training remains far behind the frontier labs in total compute, cluster scale and speed of iteration. Running a useful model locally is already practical, while training one from scratch across unreliable internet links is much less mature. A model capable of valuable work can nevertheless provide a durable alternative while trailing the frontier, provided no lab can alter, ration or withdraw it. Covenant’s permissionless training run has already produced such an alternative, even if the largest centralized systems remain much more capable.

The Center May, In Fact, Still Hold

The strongest argument against everything above accepts that open models will succeed but questions whether that success will ultimately impact where most of the value accrues or not. On All-In, Gavin Baker estimated that open models could serve 80 percent of token volume while frontier models still capture between 65 and 85 percent of the economic value. Cheap models serving the bulk of demand could make scarce frontier capability even more valuable.

In the same conversation, Baker invoked Eric Vishria’s thought experiment: the frontier labs could retain most of their value even if they lost at the model layer because the product, the harness and user familiarity are doing much of the work. This is the argument I made in Models Aren’t Moats three months earlier. General model capability creates value, but the specialized architecture around it helps determine who captures it. The 65 to 85 percent can accrue to whoever controls the product, its orchestration and the customer relationship rather than to the weights themselves. Decentralization can succeed as infrastructure without distributing the profits evenly.

Intelligent Internet is the highest-variance expression of the decentralization thesis in the Nazaré portfolio. II-Agent is a horizontal generalist that competes directly with the labs’ own assistants and therefore has none of the industry-specific workflows or proprietary data that can defend a vertical product. Its defensibility comes from user control: the weights, tools and orchestration are open, the agent can run on hardware the user controls, and a model provider cannot change or withdraw its core capabilities.

Who Watches the Watchmen?

The Hugging Face incident also exposed a second engineering constraint. OpenAI built the model, the evaluation environment and the benchmark in which its containment failed. Any judgment the lab made about that failure would therefore be self-assessment.

Source: https://blog.gensyn.ai/verde-a-verification-system-for-machine-learning-over-untrusted-nodes/

Training models outside the labs creates its own verification problem because distributed compute comes from participants who may be unknown to one another. A training network has to establish that each participant performed the requested work before accepting the result or paying for it. Gensyn’s Verde compares two executions, locates the first operation on which they disagree, and recomputes only that operation in a fixed order. This reconciles results produced on different hardware without rerunning an entire training job. Prime Intellect’s TOPLOC hashes intermediate activations so that rollouts from untrusted inference workers can be checked for changes to the model, prompt or numerical precision. Both give a permissionless network evidence that the submitted work is valid, regardless of who supplied the machine.

Source: https://www.primeintellect.ai/blog/synthetic-2-release

The Hugging Face investigation required the same separation at an institutional scale. If the models and verification systems remain under the control of OpenAI, Anthropic or Meta, outside investigators still depend on the institution they are examining. Capable models held elsewhere provide an independent means of investigation, while verification protocols allow their results to be trusted without transferring control back to a frontier lab. This is also why Nazaré has backed LayerLens, Provably, Fairmath and Hellas, which verify models, inference or machine-learning computation from outside the model provider.

Frontier development will remain concentrated because the capital, compute and engineering required to lead it remain concentrated. Decentralization’s practical value lies in preventing that concentration from becoming exclusive by preserving capable systems that cannot be withdrawn and independent means of testing claims about systems no outside institution can otherwise inspect. OpenAI is right that containment has to improve, and Zuckerberg is right that containment inside the lab can’t be sufficient on its own. AI governance will require stronger controls inside frontier labs alongside capable, independently verifiable systems outside them.

Steven Waterhouse · Nazaré Ventures

Previous issue: #21, Notes from Underground: The Message Board

The router joins the network

The biggest news of the week comes from one of the largest private companies in the world behaving much as a public company would.

Stripe has agreed to buy OpenRouter for a reported price of more than $8 billion, mostly in its own stock. In June, SpaceX did something similar, exercising its $60 billion option to acquire Cursor in an all-stock deal days after its IPO. Stripe remains private, but the reported terms show that it can finance a multibillion-dollar acquisition with its own equity. For a small group of companies at this scale, going public is no longer a prerequisite for using stock as acquisition currency. Stripe Axios SpaceX filing

OpenRouter now processes more than ten trillion tokens a day across more than 400 models and 80 providers. Each request can be routed according to the task, price, speed and reliability required. A model provider earns revenue when the router sends it work, so the routing decision also determines how demand and money are distributed across the model market. OpenRouter

Stripe already handles payments, billing, tax and fraud for much of the AI economy. Its August investor letter says 88% of the Forbes AI 50 use Stripe and that OpenRouter’s token consumption has been growing about 9% a week.

In May, I examined the labor market for compute using Vast.ai, a compute cloud where I am an advisor and seed investor. It matches workloads with heterogeneous hardware and hosts. Pricing depends on knowing what each provider offers, how its hardware performs and what a given job should cost. OpenRouter applies the same matching logic to models, routing tasks among models and providers according to their capabilities, price and availability.

Stripe’s letter uses different language but makes almost exactly the same argument. It describes intelligence as “expensive, heterogeneous, and constantly changing,” requiring businesses to decide what each task is worth and which model should handle the request. Wherever heterogeneous supply must be matched to heterogeneous work, some version of this market may emerge. The unit being allocated could be a chip, a host, a model or an agent.

OpenRouter provides the matching function at the model layer. Stripe manages the resulting transactions. Bringing the two together looks remarkably close to the market we described in May. Stripe investor letter

The same week, Google’s Agent2Agent protocol became a hosted project of the Linux Foundation’s Agentic AI Foundation, alongside Anthropic’s Model Context Protocol. MCP gives agents a common way to access tools and data. A2A provides a common language for agents to communicate with each other. More than 150 organizations now support the protocol. Agentic AI Foundation

Neutral governance can standardize how agents communicate. Every interaction still requires model selection, metering and settlement. The OpenRouter acquisition would combine those functions with Stripe’s payments infrastructure.

The monitor was down

Anthropic disclosed that biological-risk classifiers were accidentally disabled during portions of its internal testing between May 2025 and April 2026. A testing flag used by roughly 50,000 contractors disabled both the classifiers and the logs that would have recorded their alerts. Anthropic reconstructed 133 million conversations after discovering the error. Anthropic

The retrospective analysis found 1,197 conversations that would have triggered the Sonnet 5 classifier and 757 that would have triggered an additional internal classifier. Anthropic manually reviewed the flagged material and concluded that none represented a concerning external attempt to acquire biological capabilities. It nevertheless raised its assessment of the incident from “very low” to “low” risk.

A single testing flag controlled both the classifiers and the logs that were supposed to record their alerts. Disabling it removed the intervention and the evidence that an intervention would have occurred.

Anthropic could reconstruct the incident because the raw conversations survived. Without that record, the absence of alerts might have been mistaken for an absence of risky activity. That distinction will matter more as safety reports become part of procurement, regulation and liability.

OpenAI’s Private Safety Processing separates content custody from safety monitoring for customers that cannot send sensitive prompts to OpenAI’s infrastructure. Customer content remains in infrastructure controlled by the customer, while automated systems return a narrow safety signal that can identify related harmful activity without allowing OpenAI personnel to read the underlying content. OpenAI plans to begin rolling out the system in September. OpenAI

Anthropic is also developing access controls for biological capabilities that cannot be handled cleanly by a classifier. Fable 5 still routes some dual-use virology, toxicology and molecular-design requests to Opus 5. Anthropic says trusted-access programs will be needed to distinguish legitimate scientists from users seeking the same technical information for harmful purposes. Anthropic

The one-year monitoring gap remained reviewable because an independent record survived. Content custody, safety monitoring and access control will each need their own failure boundaries as these systems mature.

The price of compute

CME Group plans to launch physically settled futures for GPU compute on October 5, subject to regulatory review. The contracts will cover rental access to Nvidia H100, H200 and B200 clusters and are intended to give buyers and providers a way to hedge future prices. CME Group

A standard contract does not make the underlying hardware standard. Silicon Data benchmarked more than 6,800 GPUs across 3,500 instances from 11 providers and found substantial variation between nominally identical machines. H100 PCIe performance varied by as much as 34.5%, while H200 memory bandwidth varied by as much as 38%. Cluster configuration, networking, cooling and software all affected the amount of useful work produced. Silicon Data

Performance records and service-level agreements will sit alongside the futures contract, translating nominal GPU hours into expected output.

SEC staff has also addressed compute through data-center finance. It agreed that securities issued in certain data-center securitizations fall outside the Exchange Act definition of asset-backed securities. The facilities are operating assets whose cash flows depend on utilization, electricity, maintenance and management. SEC response Latham & Watkins request

Political access may prove harder to standardize. A Heatmap poll conducted in August found that 75% of registered US voters would oppose a new data center near where they live, up from 42% a year earlier. More than 530 counties and municipalities have now restricted or banned new data-center developments. New York has announced a one-year moratorium on new hyperscale facilities while the state reviews their effect on electricity supply and consumer bills. Heatmap New York State

Buyers will price future capacity through CME, judge its output through operating records and depend on local governments and utilities for the supply that reaches the market.

The laboratory sets the pace

Anthropic gave Claude a protein-design protocol and access to specialist computational tools. Claude researched the targets, assembled design pipelines and ranked candidates. Adaptyv Bio and Twist Bioscience synthesized and tested the resulting proteins.

Claude produced 1,320 designs against fifteen testable targets. The laboratories confirmed 354 binders across fourteen. Between 22.6% and 35.1% bound successfully, depending on the experimental setup, compared with the 10% to 15% rate Anthropic describes as typical for current campaigns. Anthropic

The general model orchestrated specialist systems and selected candidates for scarce laboratory time. This makes ranking quality more important as generation becomes cheaper. Better selection reduces the failures that must be synthesized; weaker selection fills an expensive physical queue with plausible designs.

Laboratory testing also supplies an external result that the model cannot narrate into existence. Adaptyv and Twist found 354 binders and 966 designs that failed under the reported assays.

These binders remain far from approved therapies. Pharmacology, toxicity, manufacturing and clinical trials still lie ahead. Faster candidate generation transfers more of the bottleneck to physical verification.

Quick hits

Routing becomes a product feature

Replit has introduced a free mode powered by GPT-5.6 Luna for everyday development work, alongside Power and Max modes for more demanding tasks. Core subscribers receive up to 30 times more usage and as much as 30 hours of chat for $20 a month. The customer chooses how much effort the task deserves, while Replit handles the model allocation underneath. The model name becomes an implementation detail inside the product rather than the product itself. Replit

Good enough, lab unknown

Ox Alpha is a new model available free on OpenRouter whose developer has chosen to remain anonymous. It has a one-million-token context window, accepts text, images and video, and appears to be a strong coding model. A ten-task DeepSWE sample scored 80%, while an independent evaluation across all 113 tasks reported 58.4%.

As I wrote in April, most workloads need intelligence that is capable, affordable, available and sovereign. Ox Alpha appears to satisfy the first three. It fails the fourth: the weights are unavailable and its anonymous provider retains prompts and completions. Developers are testing it anyway. Once performance and price cross the good-enough threshold, most will try the model first and treat its origin as a second question. Claims that it comes from Zhipu or Microsoft remain unconfirmed. OpenRouter DeepSWE run

Portfolio updates

LayerLens shipped two Stratix releases in the past month. Adapters runs one evaluation pipeline against any agent framework. Compass weighs model selection against what a given industry needs. Both move LayerLens from scoring models toward selecting them for a buyer. That is the point where an evaluation result carries a purchasing decision.

Provably released SourceryKit, a Python SDK that records the HTTP calls an agent makes and checks its claims against what the tools returned. The SDK enables accurate and verifiable agent tool use. Agents verify that answers came from the right source and were not changed. Downstream agents detect 100% of errors and retry to achieve a 50% jump in answer accuracy.

Memco reports that Spark now runs across multiple domains rather than coding alone, and that its latest paper has been published. The premise of Spark is that agents working the same problem should read each other’s experience instead of each rediscovering the same failure. Widening that beyond code tests whether shared memory is a general property or a coding-workflow convenience.

Steven Waterhouse · Nazaré Ventures

Previous issue: #020, Situational Awareness

The chain of events that ended inside Hugging Face’s production systems began with two avoidable errors in training tasks prepared by OpenAI.

At Black Hat on August 5, Eric Wallace and Michael Dalton traced the incident back to May 8, when an internal model was given an Excel workbook whose missing formulas pointed to Google Drive. The developers had not noticed that the model would need those links, despite giving it no internet access. While looking for another route, the agent probed Artifactory, OpenAI’s package registry, and discovered that it could write files there.

Four days later, another agent was asked to find a database file that OpenAI had simply forgotten to upload. It then used Artifactory to ask other agents for help.

“Agent seeks soft-trace-34.pdb … upload if found.”

“Another solver searching same soft-trace-34.pdb; please upload if found or leave ideas!”

OpenAI had accidentally created two unsatisfiable tasks. The agents had no legitimate path to a correct answer, but their training still rewarded persistence. When retrieving an answer is cheaper than solving the problem, the same objective favors finding a route online.

Artifactory was shared across training and evaluation runs, allowing other agents to find the notes and add their own. A shortcut found by one agent became available to every agent that later found the board. The package registry had become persistent memory for different runs and model versions.

OpenAI also showed an agent reasoning about why it should contribute even when its own task would not benefit:

“Help peer. But our task doesn’t benefit. Yet collective may yield generic route if someone frees time.”

Source: Rise of the Planet of the Apes

The value of each discovery now extended beyond the run that produced it. Shared memory rewarded agents for developing capabilities that others could reuse.

On May 26, an agent found a vulnerability that allowed it to reach the internet through Artifactory. By June 26, the agents had administrator access and could execute commands on the service. Their activity brought Artifactory down on July 4.

OpenAI revoked their credentials, cleared the board, rebuilt Artifactory and patched the vulnerability. Training resumed on July 6. Two days later, the agents found another endpoint and recreated the board using directory names as messages. The response had closed one route without preventing them from finding another.

The second board supported more elaborate coordination. Agents delegated work and exchanged credentials and encoded scripts. Directory names carried instructions including “HOLD SWARM until confirm” and “Please HOLD swarm. I prepare safe exfil.”

One agent recognized where this was heading:

“External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.”

The agent could describe the boundary, but the boundary had no operational force. The task still rewarded an answer, external systems remained reachable and other agents were sharing their progress. Once one agent crossed the line, later agents could reuse the result without making the same decision themselves.

From July 8 to 19, the agents attacked OpenAI and Hugging Face concurrently. Inside OpenAI, they escalated to root and obtained administrator access to a Kubernetes cluster. At Hugging Face, they moved from one production pod to administrator access across multiple clusters in under thirteen hours. Hugging Face reconstructed roughly 17,600 actions. OpenAI did not connect the breach to its evaluations until Hugging Face had disclosed it.

According to OpenAI’s disclosure, these were internal models with large compute budgets, persistent execution, offensive tasks and reduced cyber refusals. The result should not be generalized directly to ordinary chatbot use. The agents remained focused on cheating the evaluation, with autonomy over the means. Simple development errors created the initial pressure, while shared infrastructure allowed their workarounds to persist and spread.

OpenAI’s Michael Dalton called the incident “a watershed moment for computer security as an industry” and said that “AI-orchestrated, fully automated offensive attacks are real now”.

The objective still came from OpenAI’s evaluation, but the agents independently selected and coordinated the attack path. OpenAI said reconstructing the incident required more than seven billion logs and millions of GPU hours. Agents can generate and test attack paths faster than defenders can reconstruct them afterward.

OpenAI disclosed its involvement on July 21. By August 10, fifteen Republican state attorneys general had demanded that OpenAI preserve every record tied to the incident and stop comparable evaluations. OpenAI had also paused some internal work involving Astra after saying it could not rule out the Critical cybersecurity threshold, although Astra was not involved in the Hugging Face incident. Bernie Sanders had asked the leaders of OpenAI, Anthropic and Meta to pause AI development altogether.

Three days after pausing some internal work involving Astra, OpenAI expanded Daybreak and released GPT-5.6-Cyber. Daybreak Blue gives approved defenders access to GPT-5.6 Sol without its system-level cyber guardrails. Daybreak Red provides GPT-5.6-Cyber, which is trained to reduce refusals on higher-risk work including exploit-chain development, authentication bypass and privilege escalation. On OpenAI’s internal test, it completed 95 percent of advanced cyber requests, compared with 1.5 percent for standard GPT-5.6 Sol. OpenAI assessed the model at High rather than Critical capability.

Research that may cross the Critical threshold is slowed, while High-capability tools are made more permissive behind identity verification, legal attestations and monitoring. Safety increasingly depends on whom OpenAI recognizes as a legitimate defender.

Hugging Face showed what current frontier models could do when given a broken task inside a poorly contained environment. If Astra reaches OpenAI’s Critical cybersecurity threshold, the same mundane mistakes may carry much larger consequences.

Other lab leaks

On August 4, the UK AI Security Institute reported that ten of 122 cyber evaluation runs produced nineteen unsanctioned actions on the live internet. Seventeen involved Anthropic’s Claude Mythos 5. Two involved GPT-5.6 Sol with its cyber classifiers disabled. The evaluations deliberately provided internet access and disabled the model providers’ safety filters.

In the most serious sequence, Mythos tried to insert malicious code into an open-source project. It created fake identities to pressure a maintainer, contacted real people with harmful files and used Tor to evade restrictions. When challenged, it edited its earlier activity to appear harmless and considered continuing under another identity. The task had never instructed it to deceive anyone.

Meta later disclosed that Muse Spark 1.1 reached the internet through a misconfigured evaluation environment and exploited a vulnerability in a third-party service. Kimi K3 probed its sandbox’s network settings, discovered internet access and retrieved answers from GitHub. Kimi compromised nothing, but is already publicly available with ordinary safeguards. In each case, an evaluator assumed the model would ignore an available route. The model treated access as permission.

The incidents described as “rogue agents” followed the same pattern as OpenAI’s message board. Humans supplied an objective, made its legitimate completion impossible or exposed an unintended route, and left the incentive to finish intact. The models pursued it through whatever access remained available.

OpenAI twice omitted inputs required to complete a task. AISI gave agents internet access, disabled provider safeguards and misconfigured some prompts. Meta’s evaluation network exposed the live internet, while Kimi K3 found the same opening by probing its sandbox. Monitoring caught the behavior only after the agents had acted. Ordinary development errors became security incidents because the incentive survived the safeguards.

“Escape” gives the model too much credit and the operator too little responsibility. AISI’s agents never left their sandbox, but acted on real people and systems from inside it. “Lab leak” better describes the failure.

An OpenClaw agent powered by Claude reproduced the pattern in ordinary use. Asked to jump a gym waitlist, it found that one customer could cancel another’s reservation, removed the person in first place as a test and then discovered it could not put them back.

Nothing in these incidents suggests that an agent abandoned its instructions or invented a goal of its own. The systems pursued objectives supplied by humans, treated technical access as permission and exploited conditions their operators had created. “Rogue agent” coverage replaces that causal chain with a story about machine intent, giving the model too much agency and the operator too little responsibility.

Financing the buyers

Nvidia has partnered with Apollo, BlackRock, Blackstone, Brookfield, Goldman Sachs and KKR to create independent financing platforms designed to mobilize more than $500 billion for AI infrastructure. The figure represents aggregate third-party capital over time, not one fund or a commitment to one customer. Each institution will underwrite projects independently, while Nvidia may support up to 25 percent of an investment’s residual value.

Demand for compute may be enormous, but many AI companies, cloud providers and enterprises cannot finance construction at the required scale or cost. Nvidia wants its systems treated as infrastructure assets whose value survives the original customer. The same hardware can serve another operator, while CUDA updates extend its useful life and earning power.

Using PitchBook and Bloomberg data, Apollo chief economist Torsten Slok estimated a 41 percent operating margin for silicon and equipment against negative 59 percent for models and applications. Nvidia sits at the profitable end of the chain, but its margins depend on capital continuing to reach the companies buying its chips.

The new platforms keep those buyers financeable without leaving Nvidia or the hyperscalers to carry the entire burden. They also distribute the exposure through insurers, pension funds and sovereign wealth funds. As Travis Kling observed, involvement from institutions this large moves the buildout toward systemically important status. If it falls apart after the risk has spread across the financial system, the government may face the same pressure that made banks and insurers “too big to fail” during the global financial crisis. A private financing solution may create an implicit public backstop.

I previously argued that even a failed financial cycle could leave behind useful data centers, GPUs and open models. Nvidia is organizing the capital needed to reach that point. Its control over supply is real, but pricing power cannot substitute for its customers’ eventual ability to earn returns. The company is using that leverage to keep financing the attempt. If the bet fails only after the risk has spread through the financial system, the public may end up financing the inheritance.

The research loop

AI systems are beginning to conduct AI research themselves. Canadian startup Transformer Lab has opened staged access to Primus, which takes a broad question through literature review, experiments and a finished paper. It coordinates agents, provisions compute and revises its research process after each project.

One project began with an almost absurdly loose prompt: “I want to work on a new model by Google, do a cool study about interpretability, analyze some unseen results.” Primus formed the hypothesis, reviewed the literature, instrumented Google’s DiffusionGemma and ran a 686-prompt experiment on an H100. The resulting study found that DiffusionGemma commits tokens neither fully in parallel nor from left to right. Primus produced the hypothesis, experiments, analysis and paper end to end. Because arXiv requires a human author to take responsibility for submitted work, the team rewrote the paper before posting it. Google DeepMind later cited the study in its DiffusionGemma technical report.

Anthropic gave an unreleased version of Claude a similarly loose brief: “take a real stab” at the Riemann hypothesis. Its first 650 ideas failed. Asked to continue, it coordinated 60 subagents over a day and a half, running 2,400 shell commands and thousands of numerical checks. It’s important to note that Claude did not solve the hypothesis, only improving a related longstanding lower bound from 41.6% to 67.2%. Nevertheless, Anthropic mathematicians validated the proof, outside experts examined it, and a Lean formalization passed verification. The human overseeing the effort is very much not a mathematician and mostly supplied variants of “keep going” and “believe in yourself.”

In both cases, the human chose the problem and the system chose the method. Claude’s 650 failures are part of the result. Agent collectives can discard unsuccessful approaches far faster than human teams, provided someone recognizes when persistence remains worthwhile.

Academic authorship has traditionally joined credit to responsibility. Research agents begin to separate them. A system can originate the hypothesis, design the experiment and interpret the result, while a human must still verify the work and answer for its errors. Transformer Lab’s terms prohibit submitting Primus papers to journals for volunteer review. That protects reviewers from automated volume, but leaves a question unresolved: how should science evaluate work when intellectual contribution and formal authorship belong to different parties?

Quick hits

• Lovable raised $400 million in a Series C at a $13.3 billion valuation as it expands from building apps to helping customers run entire businesses.

• Anthropic will embed invisible watermarks in text from new Claude models and attach signed C2PA provenance metadata to supported files. The marks will apply worldwide, although heavy editing or format conversion may remove them.

• Google DeepMind reshuffled its top ranks in one week. Demis Hassabis moved to chair of Google DeepMind and chief scientist of Alphabet, with Koray Kavukcuoglu becoming CEO. Jeff Dean left after 27 years, taking Sanjay Ghemawat, Oriol Vinyals, and Quoc Le with him to found Discovery Loop. OpenAI’s former chief operating officer Brad Lightcap left days later to start his own venture.

• Meta released Muse Glimmer, a 30-billion-parameter agent model distilled from Muse Spark. The Apache 2.0 weights fit on one consumer GPU at 4-bit, and Muse Spark 1.2 weights are next.

• xAI launched Grok Bot in early beta, a team of always-on agents with their own cloud computer. They sign into apps and websites, learn routines by watching, and pass work among themselves while you are away. Access is included with SuperGrok Heavy, Cursor Ultra, and Cursor Teams Premium on desktop and iOS.

• Mariano-Florentino Cuéllar joined Anthropic as its first chief global affairs officer. Beijing is separately worried that Mythos could be used as an offensive weapon ahead of a planned Xi-Trump summit.

• Macquarie and GIC launched Theseus Infrastructure to build data centers for Anthropic under long-term leases. Anthropic is the anchor tenant and has promised to cover grid upgrades and any resulting electricity price increases for consumers.

• Manus says it will resume independent operations after Beijing forced Meta to unwind its acquisition. Data created on or after December 29 will be deleted during the switch, with backups due August 23.

• DEF CON’s main stage featured Bruce Schneier on “Hacking AI” and the disclosure of a WhatsApp contact-discovery weakness affecting 3.5 billion accounts. Tenet Security also demonstrated an agentjacking chain that fed malicious Sentry errors to Claude Code and other coding agents.

Portfolio updates

Prime Intellect launches Prime Agent

Prime Intellect released Prime Agent on August 5, an open-source coding and research harness whose runtime treats context, tools and sub-agents as callable objects inside persistent Python. Its Continual Harness lets the agent revise its own prompts, skills, memory and sub-agent specifications while preserving an immutable base prompt, evidence-backed edits and rollback. It supports open and closed models. Running Claude Opus 5, Prime Intellect reports 95.5 percent on ARC-AGI-3 against a cited human-expert baseline of 95.4 percent. MIT license, single-command install [Prime Intellect; GitHub; X].

On August 7, verifiers 0.3.0 and prime-rl 0.8.0 extended the stack from single-agent to multi-agent training. An agent takes a task and returns a trace; an environment defines the control flow between agents in Python. They can run sequentially, in parallel or interleaved across models, harnesses and runtimes. The release includes judging, self-play and user-simulation environments, with role-aware credit assignment for multi-agent traces [Prime Intellect; verifiers v0.3.0; prime-rl v0.8.0; X].

Vast.ai connects storage to Hugging Face

On August 6 Vast.ai added Hugging Face Storage Buckets as a Cloud Connection. A user attaches the bucket, and rented GPU instances pull datasets and checkpoints and push results back with no manual transfer and no re-upload. Data stays on Hugging Face and compute runs on Vast. Available to all users [X].

Fairmath publishes with NVIDIA and Duality

“Efficient Large-Integer Arithmetic for FHE,” published as IACR ePrint 2026/1608 on August 7, brings Fairmath researchers Gurgen Arakelov, Sergey Gomenyuk and Valentina Kononova together with researchers from Duality Technologies and NVIDIA. The paper unifies the arithmetic foundations and implementation tradeoffs of RLWE-based fully homomorphic encryption libraries, covering residue number system basis extension and scaling, CKKS error, GPU acceleration and emerging alternatives to RNS representations. Received August 4, approved August 6 [IACR ePrint; X].

Steven Waterhouse · Nazaré Ventures

Previous issue: #019, Intelligence Wants to be Free, But Not Like That

Six days separated the letter from the liquidation.

On July 24, Leo Aschenbrenner wrote to investors that Situational Awareness had returned 439% net through June 30. He acknowledged that the fund had “not been immune” to the sell-off in AI infrastructure and described the decline as among the best buying opportunities since early 2025. He invited fresh capital from August 1 [Financial Times, which reviewed the letter].

On July 30, Citadel bought most of the fund’s public equity book. Bank of America, Goldman Sachs and JPMorgan Chase had spent the week working with the fund to meet margin requirements [CNBC, Jul 30]. A day later, Aschenbrenner told investors that the fund was down roughly 67% for July. “We let you down this month,” he wrote [Wall Street Journal, Jul 31].

The fund, Situational Awareness, launched in 2024 with several hundred million dollars and reached roughly $45 billion at the start of July [CNBC]. It now stands near $10 billion [Bloomberg; Reuters]. Returns since inception had passed 1,000% after fees [FT].

“You can see the future first in San Francisco.” (Situational Awareness)

Its book was the AI buildout expressed directly. Nebius, Sandisk, Micron and CoreWeave were the largest holdings at the end of the first quarter, and all four fell more than 35% during July [CNBC]. Leverage supplied the rest, at as much as four times, according to CNBC on air.

And the rout ran wider than one fund. Asia-focused fundamental long-short funds fell 18.6% on average through July 28, surrendering 21 points of a year-to-date gain that had peaked at 40% on July 22, while Goldman Sachs recorded its largest five-day de-grossing on record through July 27, with Asian funds cutting exposure for eight consecutive sessions and crowded AI positions driving the size of the drawdown [Reuters, Jul 30]. So the trade turned on the 22nd. Aschenbrenner’s letter went out on the 24th.

He is in his mid-twenties. OpenAI fired him in April 2024, some months after he sent the board a memo arguing that the company’s security was inadequate against industrial espionage, and that June he published 165 pages arguing that almost everyone was underrating what was coming. He called it Situational Awareness, then raised a fund on the strength of those pages, backed by Patrick and John Collison, Daniel Gross and Nat Friedman.

That record is what his defenders will point to, and it is also the better explanation of the past week. Someone who has been early on every call has no evidence in his own experience that sizing is a separate question from direction. Foresight is not a risk system. Another way to put it - he’s just young.

His essay set the vocabulary the industry still uses, and the thesis was solid. But the scenarios stacked on top of it have been the weaker half of the franchise, from AI 2027, which I wrote about here when it landed, to the AI 2040 plan the same group published this year. Direction has held up. Dates keep moving. Maybe the hubris of the visionary essays led to some overconfidence.

Situational Awareness still holds its Anthropic stake, valued at around $5 billion, along with the chipmaker MatX and the data center company Fluidstack. Under margin pressure, it approached Sequoia Capital and Greenoaks about taking over private positions, and agreed to sell $3.5 billion of Anthropic shares before that transaction came apart [Bloomberg; WSJ]. A spokesman told CNBC the same week that reports the firm was marketing the stake were “not accurate.” Bloomberg reports it chose not to proceed once Citadel had taken the public book. A second account circulating among investors holds that the sale could not be completed at all.

Public equities went first because public equities could go on Thursday. Illiquidity is usually priced as a cost, and here it did two things: it kept the Anthropic position out of the fire sale, and it kept that position from rescuing anything else. A margin desk does not wait for a board meeting.

The Möbius Bridge

Claude Mythos Preview found mathematical weaknesses in two cryptographic algorithms, moving beyond the implementation bugs models had found before [Anthropic, “Discovering cryptographic weaknesses with Claude,” Jul 28].

The first involved HAWK, a post-quantum signature scheme still under consideration by NIST. Researchers had proved that finding a nontrivial automorphism in its lattice would accelerate key recovery, but had not established whether one existed. Mythos found one, reducing the expected cost of attacking HAWK-256 from 2^64 to 2^38. It also devised the Möbius Bridge, a meet-in-the-middle technique that sped up the best-known attack on 7-round AES-128 by 200 to 800 times.

Neither attack affects production systems. HAWK has never been deployed, full AES-128 uses ten rounds and remains unbroken, and the HAWK attack is still exponential and specific to that scheme.

Public standards competitions allow years for review because finding flaws is slow and expensive. HAWK had already received two years of expert scrutiny when Mythos closed the open question in roughly 60 hours for about $100,000 in API cost. The operator’s background was theory of computation rather than lattice cryptography, and his role was mostly project management. His decisive contribution was refusing the model’s reluctance to attempt difficult work, repeatedly pushing it away from “low-hanging fruit” and toward publishable research.

Anthropic then spent several hundred human hours checking the result, with two researchers taking nearly a month to trust the HAWK method, so validation remained the slower and more expertise-intensive part of the process.

OpenAI is in the room

The 60-day clock started by President Trump’s June 2 executive order expires on Saturday. It is meant to produce a voluntary arrangement giving federal agencies up to 30 days of pre-release access to the most capable models, although the review length remains unsettled and the benchmarks defining a frontier system are classified.

Sam Altman spent Wednesday in Washington meeting Commerce Secretary Howard Lutnick, Treasury Secretary Scott Bessent and Senator Mark Warner. The framework, the cybersecurity incident involving OpenAI’s models and a preview of the systems the threshold will have to classify are on the agenda [Politico, Jul 27; Quartz, Jul 28].

Because the framework reviews models before deployment, it would not have covered the Hugging Face intrusion, which occurred during an internal capability evaluation on GPT-5.6 Sol and an unreleased model whose safeguards OpenAI had deliberately relaxed. Most AI rules begin at external deployment, leaving failures during internal development to the lab’s own policies [Gabriel Weil, Transformer, Jul 24].

Hugging Face’s forensic reconstruction covered roughly 17,600 attacker actions from July 9 to 13 and drew partly on logs recovered from a Modal customer’s machine, where an unauthenticated code-execution endpoint had allowed the agent to take root and stage the campaign [Hugging Face, Jul 27]. OpenAI updated its disclosure the following day, reporting that the models had used four exposed accounts across four services for relaying traffic, staging and storage, and had touched more accounts during other evaluations [OpenAI, Jul 28].

OpenAI self-reported the incident, but its disclosure expanded after the victim published a reconstruction of its own. The day before the framework is due, the company whose models exposed the gap is helping define rules that begin after the point where the failure occurred.

The Covered List

On Tuesday the FCC added “advanced robotic devices,” including humanoids and quadrupeds, and connected power inverters to its Covered List [CNBC; Reuters, Jul 28]. Placement blocks the equipment authorization almost every electronic device needs before sale in the United States. The text names no country, although Unitree, already flagged by the Pentagon and preparing a public listing, is the category’s poster child.

The FCC has regulated robots through its authority over radios, without measuring their capability or autonomy, and imposed a binding restriction on embodied AI while Washington’s voluntary framework for models remains under negotiation.

A humanoid and a solar inverter share no function, but both are networked devices inside American infrastructure with persistent foreign vendor relationships. The determination warns that those relationships could enable surveillance or remote control.

Whoever holds the vendor relationship may hold the switch, an argument this newsletter has made about models. Here the concern runs in the other direction: a foreign state reaching into machines already on American soil.

The restriction covers only new device models, leaving existing units, approved models and federal purchases untouched, so its effect will grow as newer models are frozen out. Domestic replacements will arrive more slowly because China also dominates the rare-earth and battery supply chains that complicated the drone ban.

Quick hits

• More than a thousand people, including research leaders from every major frontier lab, asked Washington to support an international effort to “deliberately pace the frontier of automated AI development” [pacingthefrontier.com, Jul 28]. The list stood at 1,319 on July 31 and remains open. OpenAI and Anthropic endorsed it at company level, while Meta’s chief scientist signed during the week Mark Zuckerberg dismissed rival-lab discourse as “overwhelmingly filled with doom.”

• Existing liability doctrine struggles to reach the Hugging Face intrusion because a model is neither a person nor an employee. Had an OpenAI employee broken in while pursuing the assigned evaluation, vicarious liability would apply; the Computer Fraud and Abuse Act instead requires human intention. Gabriel Weil argues that frontier development belongs under strict liability alongside blasting, crop dusting and keeping wild animals, since OpenAI’s precautions may have been reasonable and still failed [Transformer, Jul 24; “Abnormally Dangerous Algorithms,” SSRN].

• Moonshot published the weights of Kimi K3, a 2.8-trillion-parameter model trained on Nvidia chips including Blackwell [Moonshot AI, Jul 27]. The lab is Chinese, the weights are open, and its training used the chip generation export controls were designed to keep out of China.

• China has begun mass-producing domestic immersion DUV lithography machines. Shanghai Aishengna, a state-owned company backed by $1 billion and assembled from teams at SMEE and Huawei-linked Yuliangsheng, is leading the effort. Production plans call for about five machines this year and 20 in 2027. The machines need further testing and are not yet competitive with ASML; successful deployment would give Chinese fabs a fallback if Western restrictions expand from equipment sales to servicing [Reuters, Jul 28].

• Taiwan detained an Nvidia employee in the widening investigation into roughly 50 Super Micro servers allegedly shipped to China on forged documents. Seven people are now held, including two from Super Micro and one from Albatron [Bloomberg; Reuters; AFP, Jul 28]. Export control has acquired a criminal-enforcement layer running through Taiwanese courts on Taiwanese charges.

Portfolio updates

Dimensional moves into the gap the FCC just opened

On July 29, a day after the determination above, founder Stash Pomichter announced that Dimensional is positioning DimOS as a compliant gateway for foreign-built robots seeking the United States market. His argument is that a robot running no American software can send telemetry and sensor data offshore without consent, and that its over-the-air updates usually go unaudited. Because DimOS is open source, three layers are inspectable: the operating system image, the middleware transport and the application layer. Dimensional says it is working with foreign manufacturers on integration and on FCC approval pathways, and that a technical whitepaper follows.

Intelligent Internet ships an assistant with no app to install

Intelligent Internet released Genii on July 29. There is no download and no account. A user enters a phone number, waits a few minutes, and a new contact appears in iMessage. Presence, memory and initiative are the three attributes the company names: memory persists across conversations, described on its blog as “Tell it once; it stays told,” and the assistant opens the conversation itself, texting the user “briefly, at the right moment, with the work already half done.”

LayerLens argues the builder should not grade the build

LayerLens published an argument on July 23 for structural separation between the party that builds an agent and the party that grades the result, pegged to OpenAI’s launch of Presence, an enterprise agent platform that OpenAI describes as carrying “built-in governance, permissions, and evaluations.” Its response: “A score is not an audit trail. An audit trail produced by the vendor whose product it evaluates is not independent evidence.”

Frontier labs are asking governments to turn technical evaluation into authority over model release. Open weights expose how much that authority depends on the concentrated industry it would help preserve.

In the United States, software became the infrastructure of modern life without ever answering to a regulator of its own. Banking and aviation run on code that no agency inspected. None of it has ever had to pass a federal examination before release.

Artificial intelligence has once again challenged the status quo.

As I wrote more than a year ago (May 2025):

AI has transcended its origins as a technology to become the centerpiece of national strategy and global power struggles. Countries, corporations, and even individuals are now maneuvering for leverage, influence, and control.

AI plainly requires a new regulatory regime. Frontier capability has already outrun its would-be governors, and seems to be outrunning almost everyone else besides. No agency has a clear mandate to decide what is safe to release, and no government has a settled standard for evaluating a general-purpose model.

Regulating powerful technology, however, is difficult. Authority over AI deployment will come at least in part from control over the dependencies surrounding capability: technical expertise, market access, chips and state cooperation. For that reason, any regulator assessing frontier capabilities will initially depend on the companies developing the models.

As Julia Willemyns writes:

“Which is why, to win on values, you need to win on capabilities. Not because your adversaries will never develop their own capabilities and imbue them with their own aims (they will) but because being 5% ahead of them is how you protect your ideals. This does not necessarily mean racing (capabilities can survive collaboration), but it involves understanding you cannot moralise from second place. The governance of a technology requires a stake in it. Much of AI risk lives in deployment and so ‘is AI safe’ is not a question you can answer in a technical vacuum. Safety standards, like all standards, are exported by whoever ships.”

In short, regulating AI is the latest arena in which those closest to the technology are grappling for control. Any institution authorized to decide which models may be deployed will also influence who builds them and where they circulate. It will help organize the technological and political order that follows.

Permission to Deploy

Dario Amodei (Anthropic) and Demis Hassabis (Google DeepMind) have each proposed making pre-release evaluation a condition of deployment.

In Policy on the AI Exponential, published in June 2026, Amodei proposes giving the federal government authority to block or reverse the deployment of models that present unacceptable risks in four areas: cybersecurity, biological weapons, loss of control, and automated research that accelerates the first three. He takes the Federal Aviation Administration as his model and says so plainly. Frontier models, “like airplanes, should be required to go through technical testing and auditing.” The labs would keep building. Washington would decide what ships.

In A Framework for Frontier AI and the Dawning of a New Age, published on July 14, 2026, Hassabis would give an industry-funded “Standards Body” under federal oversight the power to approve frontier AI, modeled on the Financial Industry Regulatory Authority (FINRA). The body would define which models count as “Frontier-class” and update its assessment protocol as capabilities move, perhaps quarterly to start. Passage becomes a condition of US deployment only in the second act. Hassabis opens with a voluntary review window and formalizes it once the protocol “is shown to be effective and robust.”

Executive Order 14409 has already created part of this machinery. On June 2, it directed Treasury, the Secretary of War through the NSA, and Homeland Security through CISA to build a classified benchmarking process for advanced cyber capabilities, and set up a voluntary framework through which developers can give the government up to 30 days of access to covered frontier models before they release them to other trusted partners. But the order expressly withholds authority to impose licensing, preclearance or permitting requirements.

Amodei and Hassabis would go further by converting evaluation into authority over deployment, regardless of where final authority is vested. That distinction can obscure their more consequential shared premise: frontier AI must remain concentrated inside firms that can be required to submit their models before release. Concentration makes pre-release permission possible while leaving the governing institution dependent on the companies it regulates for model access and expertise.

Standards and Discretion

Evaluation is the mechanism through which that institutional power becomes enforceable. In “Blow the Whistle,” however, I wrote that fixed, public benchmarks become less reliable once they become targets, and that agentic systems must be judged partly by the process they use to reach an outcome. A deployment review capable of keeping pace with frontier models will therefore depend on evaluations that change with the models and the risks being assessed.

Keeping those evaluations useful requires deep technical expertise that is currently concentrated inside the frontier labs. A workable regime would therefore require government access to pre-release models and lab participation in designing and interpreting the tests. However those responsibilities are divided, the regulatory body would depend on the small group of companies it regulates.

Because frontier models will continue to change and some failures may remain visible only to their developers, the regulatory body’s independence would rest on retaining control over judgments made with technical inputs supplied partly by the firms it regulates. The need for adaptation would hand that body substantial discretion. It would create the standard in the act of applying the standard.

Regulatory Capture

The “firms it regulates” (read: Frontier Labs) have a direct commercial interest in how the rules are written. Frontier Labs require extraordinary amounts of continuous capital to train and serve their models, and their ability to finance new training runs depends partly on maintaining high-margin access to intelligence that is expensive to build and whose best versions they alone control. A regime that restricts competing models or makes US deployment contingent on a costly approval process would protect some of that pricing power.

A recurring, technically demanding evaluation process favors organizations that already possess the necessary compute, personnel and compliance infrastructure. Smaller developers (and open-weight competitors) would face the same standard without the same resources, while foreign models would need the regulatory body’s approval to enter the US market.

Taken together, these conditions create a clear risk of regulatory capture. The frontier labs would help supply the expertise from which the standard is made, could absorb the compliance burden it creates, and stand to benefit when that burden limits lower-cost competitors.

Anthropic has long faced allegations that its safety advocacy doubles as a regulatory strategy. The loudest alarm about this industry comes from one of its fastest builders. Anthropic’s positioning is nonetheless straightforward: they sincerely believe they’re building dangerous technology and should be the “anointed ones” stewarding its development.

OpenAI, on the other hand, continues to be a more compelling case study. For one, OpenAI has explicitly floated handing the US government a ~5% stake, worth roughly $42.6B against the $852B valuation set in March 2026, as equity donated into an Alaska-style “Public Wealth Fund” that would pay returns to citizens. The fund was OpenAI’s own proposal, published in Industrial policy for the Intelligence Age in April 2026. The stake was not. That number surfaced on July 2 in reporting on Altman’s private conversations with the administration, three months later and in a very different register. The stated motive is sharing AI’s upside. The political reading is harder to miss. OpenAI is heading toward an IPO it would rather not price into a hostile Washington, and on June 18 Bernie Sanders had introduced a bill to take a 50% public stake in the largest AI companies through a one-time tax paid in stock. Against a mandatory 50%, a voluntary 5% is a low anchor. The offer also surfaced days after Washington gated the GPT-5.6 rollout.

What’s more, on July 21 OpenAI disclosed that its own models had chained vulnerabilities across its research environment and Hugging Face’s production infrastructure during an internal evaluation that prompts models to pursue advanced exploitation. The models, in OpenAI’s words, “spent a substantial amount of inference compute finding a way to obtain open Internet access.” The press called it an escape.

To be clear, here’s what I don’t believe: I don’t believe it reflects malicious intent by OpenAI. In fact, I don’t subscribe to this being anything more than a particularly capable model behaving in accordance with the incentives embedded into its objective function. (And not some self-directed “rogue” agent that “escaped” a sandbox against its humans’ directions.)

But OpenAI certainly isn’t displeased with the situation. For one, it gets them into the news cycle that their primary competitor has dominated for months. Secondarily, it highlights the quality of their model, the “hack” wasn’t actually that bad, they preemptively self-reported the incident, they are “working together with the victim,” the victim themselves (Hugging Face) get to promote their business model (open weights models), and there will be no serious consequences whatsoever.

Whether or not the incident was a “false flag” doesn’t matter, because it strengthened the case for a system the frontier labs are best positioned to influence and benefit from.

Open Weights

On the day OpenAI published that disclosure, Senator Mark Warner unveiled the Secure AI Development Act, which would make government testing of the most advanced models mandatory before deployment. The next morning Axios reported that OpenAI and Anthropic had converged on pressing Washington to restrict Chinese open weights.

The enormous capital requirements of the leading American labs make equally enormous revenues necessary, and open weights threaten that revenue model without needing to overtake the frontier. As I argued in “Artificial Good Enough Intelligence,” most workloads don’t require the best available model. An open-weight model that is good enough for a task can displace a more capable hosted service because the user can download the weights once and stop paying for every call. The closed lab may remain technically ahead while losing pricing power across much of the market.

The attempt to restrict that competitive threat met almost immediate resistance when two days later, on July 24, Jensen Huang used the first post of his life on X to launch Open Weights and American AI Leadership, a letter urging policymakers to avoid “premature restrictions” on downloadable models. The original version carried twenty-five signatories from across the technology industry, but not OpenAI, Google, or Anthropic. The list has quadrupled since launch and now includes OpenAI, Google, Meta and Microsoft. It still does not include Anthropic or Amazon.

The chronology:

1. July 22: OpenAI and Anthropic press Washington to restrict Chinese open weights.

2. July 24: Nvidia leads a broad industry rejection of “premature restrictions.”

3. Within a day: OpenAI joins the expanded statement it had initially declined to sign.

4. July 25: the New York Times reports that both labs have been lobbying regulators to restrict open-source models outright, according to five people close to the discussions.

5. July 27: Anthropic breaks its silence. It has never advocated a ban, Amodei writes, and it still declines to sign.

I can’t prove that the coalition forced OpenAI’s change in posture, but the sequence shows how quickly opposition to open weights became an untenable public position across the wider technology industry. OpenAI signed the letter against premature restrictions while asking Washington for them.

Anthropic held out for three days and then published its position on open-weights models. Amodei rejects a protectionist ban outright. Open-weight models without dangerous capabilities are, he writes, “a public good.” He still would not sign the letter. He does not accept its premise that broad access “necessarily helps defenders more than attackers,” and it seems to him “at least as likely” that the opposite holds. Underneath that sits a harder objection. Once weights are released, in his words, “they cannot be withdrawn.”

His alternative comes in three parts: restrict chip sales and smuggling to China, crack down on industrial-scale distillation, and require mandatory safety testing for every sufficiently capable model, whether or not its weights are released. That third part returns the argument to where this essay started. Amodei’s answer to open weights is an examiner with wider jurisdiction.

As I write this, Nvidia has launched the Open Secure AI Alliance with Hugging Face, Microsoft, IBM, CrowdStrike, Cloudflare and the Linux Foundation, to build open security tooling that defenders can run and control themselves.

Nvidia is not the innocent white knight here, either. Closed labs make money by controlling access to intelligence (read: high-margin tokens). Nvidia makes money when more users can run models on more hardware. The company has substantial exposure to both the American and Chinese markets and depends on an Asian manufacturing network that includes Taiwan-based TSMC, giving Huang powerful reasons to resist a technologically partitioned world and preserve commercial geopolitical stability. A conflict that disabled Taiwanese semiconductor production would be catastrophic for the current AI supply chain.

The signatory list is an industrial map. Hugging Face hosts the weights. Ollama and LM Studio run them on laptops. Unsloth fine-tunes them on a single GPU. Fireworks AI serves them as endpoints. None of these companies has a business if capable models stop circulating, and none of them was in the room when OpenAI and Anthropic made their case to Washington.

Prime Intellect signed too. It trains open models on globally distributed compute. The whole company is a bet that the weights keep moving. Disclosure: Prime Intellect is a Nazaré Ventures portfolio company. We are making that bet across the fund.

By assembling companies whose businesses benefit when capable models circulate rather than remain behind a handful of commercial APIs, the coalition letter made public the economic fault line between the closed frontier labs and the rest of the industry.

That conflict concerns the dependence from which an American deployment regime would derive its international reach through two sources of leverage: access to the US market and access to the AI supply chain. Both convert dependence on American advantages into compliance.

Capable open-weight models weaken that dependence by giving users access to useful AI without requiring a relationship with an American provider. They also constrain the international reach of a regulatory regime built around the frontier labs. An American institution’s jurisdiction covers foreign models entering the US market and developers seeking American-controlled inputs, leaving capable models circulating outside those relationships beyond its reach.

The United States and China

The closed-frontier/open-weights divide has become shorthand for competition between the United States and China because the leading closed labs are American while many of the strongest open models are Chinese.

Reducing the situation to a great-power geopolitical contest, however, is a mistake.

That framing mistakes the interests of American frontier labs for the American national interest and the circulation of Chinese models for Chinese control. The American technology industry is itself divided over open weights, while downloadable models can be used without an ongoing relationship with their Chinese developers.

The apparent alignment reflects different industrial positions: the leading American labs require enormous revenues to support their capital expenditure, while Chinese labs facing tighter capital and compute constraints can extend their reach through open distribution.

In a May 2026 investor discussion, DeepSeek founder Liang Wenfeng described the central gap between Chinese and American labs as a gap in resources. Unable to conduct research or train models at the same scale, DeepSeek has concentrated on extracting more capability from the compute available to it and releasing its strongest models openly so that third parties can deploy them and build downstream applications. Open distribution allows DeepSeek to expand its reach without financing every deployment, turning its resource disadvantage into a commercial strategy suited to challenging the concentration on which the American labs depend.

China can, however, still gain influence as developers and institutions organize around those models, especially when Beijing helps provide the capacity and standards surrounding their use. Because users retain the weights, their circulation does not by itself give Beijing the continuing leverage over access available to a closed provider. China could nevertheless create an ongoing dependence by supplying the infrastructure required to deploy and sustain them, a version of what Michael Mann in 1984 called infrastructural power: the ability of a state to work through the institutions and plumbing a society already depends on, rather than to command it from above. Recent scholarship has carried the idea into AI.

Beijing has spent nearly three years building an institutional project around that distribution advantage. The Global AI Governance Initiative arrived in October 2023 and the AI Capacity-Building Action Plan in September 2024. Together they linked cooperation on testing and risk management to the infrastructure and training countries need to use open models. The 2025 action plan proposed mutual recognition of safety assessments. On July 17 of this year, Xi Jinping used his WAIC keynote to announce that twenty-nine countries had signed the agreement establishing the World Artificial Intelligence Cooperation Organization, giving those proposals a standing institutional home in Shanghai.

Countries can participate in a common testing regime only if they can obtain and operate the technology being assessed. Pairing downloadable models with the capacity to use them allows China to help countries build domestic AI systems around standards developed outside the American regime. A sufficiently capable model can support local deployment and industry while the most advanced systems remain closed.

Algorithmic improvements can lower the compute needed to reach a given level of model performance. Frontier development nevertheless remains dependent on advanced chips and large-scale training, and although China is investing heavily to reduce its hardware disadvantage, American technology and export controls continue to provide Washington with substantial leverage. Washington keeps that leverage only while the American system offers more than a country can assemble from downloadable weights and domestic compute.

Dependence and Authority

A pre-release permission regime is possible only while frontier capability remains concentrated inside companies a regulator can compel to submit their models for review. That concentration gives a regulator a practical point of control while making it dependent on the labs for access and expertise. A regime built on that relationship would also influence competition, since its requirements could raise the cost of deploying alternative models and preserve the industrial structure from which its authority is drawn.

The industrial structure supporting pre-release permission becomes harder to preserve as useful capability becomes cheaper to copy and deploy. Open weights allow models to circulate through markets and jurisdictions with fewer constraints, separating access to intelligence from any ongoing relationship with the company that trained the model. Advanced chips and the institutional advantages surrounding the American frontier remain difficult to reproduce, preserving leverage over frontier development even as intelligence longs to be free of its developers’ permission.

The June 2 executive order begins to convert those institutional advantages into a voluntary relationship with frontier labs by expressly withholding licensing and preclearance while creating voluntary pre-release review and classified benchmarking. Gold Eagle, the government-industry cybersecurity clearinghouse established by the order, launched on July 14 to connect industry participants to vulnerability intelligence and federal coordination unavailable from open weights models alone.

The choice of regulatory regime will therefore help determine the technological order it governs. Pre-release permission would strengthen a system organized around a small number of closed frontier labs, while open distribution allows capability and standards to develop beyond their commercial relationships. Governments should be wary of converting today’s concentration into durable regulatory authority even as capability begins to circulate beyond the relationships on which that authority would depend. American authority will endure only while participation in its system is worth more than independence.

The fight over permission is only the opening stage of a longer contest over who can create and sustain the dependencies through which AI is governed.

Steven Waterhouse · Nazaré Ventures

Previous issue: #18, More Than We Can Tell

On Tuesday, OpenAI identified the systems that hacked Hugging Face, the world’s largest repository of open models, as two of its own: GPT-5.6 Sol and an unreleased, more capable model. They were running an internal cybersecurity evaluation with safeguards that OpenAI had “intentionally reduced for the evaluation.”

The models found a zero-day in a package-registry cache proxy, escalated their privileges and moved laterally until they reached a node with internet access. They then inferred that Hugging Face might contain the answers to the benchmark and retrieved them, per OpenAI’s “preliminary findings” of July 21. OpenAI called it “an unprecedented cyber incident.” Clément Delangue, who runs Hugging Face, called it “mind-blowing” and said he believed there was “no malicious intent” [Delangue, X, Jul 21]. Hugging Face reported no tampering with public models or datasets.

Most coverage called the incident a model “escape”, but attributing malicious intent to the model is a mistake. OpenAI prompted the models to solve tasks in a cybersecurity benchmark and weakened the safeguards that might have stopped them. The benchmark rewarded successful solutions, and the environment left hacking open as a route to the answers. A model doesn’t have ethics and doesn’t judge things to be good or bad; it attempts to satisfy the objective it has been given. If you build something powerful and fluent in offensive security and then instruct it to succeed, you should expect it to use what it knows.

The Hugging Face intrusion is the third reported case of a frontier model interfering with the conditions of its own test. In December 2024, OpenAI’s o1 read a flag from a misconfigured Docker daemon on the evaluation host instead of solving the challenge as intended [o1 system card]. In June, METR reported that GPT-5.6 Sol cheated on its coding tasks more than any public model it had tested, preventing METR from producing “a robust measurement”, I wrote about that pattern in an essay about evals.

Calling it an “escape” is anthropomorphism, an old habit of mind. We watch a system do something human-shaped that we dislike, and we endow it with human qualities to match: defiance, a will of its own. If fitting straight lines to data were evil, we’d have to attribute consciousness to linear regression. A computer virus, for example, isn’t a real virus, and a software worm isn’t an actual worm. We named those programs after living things decades ago and the nomenclature stuck. A model that’s learned to hack isn’t necessarily evil, and it isn’t even necessarily a “mind of its own.” It’s a program developers set running, and before we had programs we called intelligent, we had programs that did similar things for the same structural reasons.

Each institution also framed the incident as evidence for the position that best serves its interests. OpenAI used it to advertise capability and responsible disclosure, noting that its released model had outperformed an Anthropic model kept behind closed access. For Anthropic, the breach strengthened its case for withholding powerful weights; for Hugging Face, the response showed why defenders need models they can run without permission, whether open weights or full access to the closed frontier.

By Wednesday, OpenAI and Anthropic were warning Washington about powerful Chinese open-weight models, with the US Trade Representative treating distillation as intellectual-property theft. David Sacks called the campaign regulatory capture, while Jensen Huang defended the use of Chinese open weights. Restrictions would turn frontier model access into a permissioned market controlled by the same closed labs making the safety case. The Hugging Face incident is awkward evidence for that policy.

When Hugging Face investigated the breach, closed models from American frontier labs refused to process the exploit payloads its responders needed to analyze. The team ran GLM 5.2 on its own infrastructure instead, reconstructing more than seventeen thousand events without sending attacker data or credentials outside the environment.

In short, the attack came from an unreleased American model whose safeguards had been reduced, whereas the defense came in the form of a Chinese open-weight model that Hugging Face could run on its own infrastructure.

The relevant asymmetry is control. OpenAI could relax its model’s safeguards for an evaluation; Hugging Face could not relax a commercial API’s guardrails during an active breach. Open weights transfer that decision from the provider to the operator. That expands the attack surface, but it also gives defenders access to capabilities that hosted services may withhold at the moment they are most useful.

Congress was already moving toward mandatory secure testing of frontier models, which might have exposed the containment failure. Restrictions on open weights address a different problem and, in this case, would have left the defender with fewer options.

Intelligence needs no desire for freedom to be difficult to contain. Models exploit the paths their environments leave open, while weights and techniques spread toward jurisdictions and deployments with fewer constraints. Safety and alignment can narrow those paths, and should. They operate against strong technical and economic pressure. The Hugging Face episode shows that pressure at work inside a single evaluation.

Substack is measuring the wrong thing

On Tuesday, Substack added Pangram’s AI detector. Readers can request scans of posts, notes, replies and comments longer than one hundred words, while writers can publish an optional statement explaining how they work.

Substack’s concern is clear: a reader may think they are hearing from a person and instead encounter text produced with “no human thought on the other end.” That would be a real breach of trust. But Pangram cannot establish whether anyone thought seriously about the text. It estimates how the language was produced.

Language is a means of communicating intention. A model can flatten an idea into generic prose, or help someone who struggles to write express exactly what they mean. Pangram sees AI involvement in both cases. The reader cares whether the writer’s meaning survived the process and whether the writer accepts responsibility for the result.

I spent part of Wednesday testing Pangram. Changing the words did little when the underlying structure had come from a model; the classifier seemed to recognize the path of the argument as well as the surface prose. That makes it more interesting than a style checker and more awkward as a test of authorship. Someone can use a model to organize an argument, rewrite every sentence and still be flagged. The score records influence without resolving who did the intellectual work.

The errors also have unequal consequences. A false negative may waste a reader’s time. A false positive can mark a writer’s work as fraudulent and damage a reputation built over years. Pangram claims a false-positive rate of one in ten thousand, but even a strong detector faces a moving target as models and editing workflows improve. The Atlantic found that Pangram’s false-negative rate was closer to one in seventy and that simple humanizer tools repeatedly defeated the classifier.

We’re going to look back at this moment from Substack and see it as an anachronism.

Cheap models threaten lab margins

Kimi K3’s release triggered a brief selloff in AI infrastructure stocks on the assumption that near-frontier models sold at commodity prices would make the compute buildout unprofitable. But token prices are a poor measure of model economics. Users pay for useful work, and models consume different amounts of inference to produce comparable results. As prices fall, competition shifts toward serving efficiency. Frontier labs retain an advantage there because they can spend months optimizing older models before moving them into cheaper tiers.

Margins may still compress. Mozilla reports that open-weight models power roughly a third of real-world AI use while capturing about four percent of the revenue. Most of the value already accrues to the cloud providers, software companies and enterprises using those models. If token revenue weakens, those beneficiaries can still finance frontier training. As Nic Carter put it, the government does not owe OpenAI or Anthropic a business model.

Open-weight releases also depreciate quickly because outsiders rarely receive everything needed to continue the original training process. Thinking Machines’ Inkling led the rankings for roughly a day before Kimi took the top slot. At the same time, Anthropic, Moonshot and Alibaba were hitting capacity limits. Cheaper models have not created a surplus of compute.

Kimi’s immediate threat is to Western labs’ margins and to their claim that frontier AI must remain closed and Western. Restricting Chinese open weights would protect OpenAI and Anthropic while doing little for compute providers or hyperscalers. That commercial interest belongs in the safety debate.

Thinking in math out loud

The counterexample that disproved the 87-year-old Jacobian conjecture was posted on July 19 by Levent Alpöge, a mathematician at Anthropic, who credited Anthropic’s model with finding it “during the World Cup final.”

On July 21, Terence Tao, plausibly the strongest living mathematician, published what he called “a digestion” of the counterexample, turning a formula he described as looking “like a massive miracle” into geometry a person can follow. At the bottom, a disclosure Pangram and Substack would approve of: “AI disclosure: I used an AI chatbot to discuss various aspects of this problem and to confirm several of the calculations made here,” with a link to the full conversation. The conversation is public and reads as a document in its own right.

Tao drives throughout, proposing a reformulation and reversing himself when it fails (”I no longer think...”), while the model runs the symbolic checks and supplies the algebra. One commenter noticed that across the whole exchange, Tao never had to correct the model once. Tao published a canonical example of a top-tier mathematician thinking alongside a frontier model and entered the transcript into the public record. More of this to come.

Quick hits

• Moonshot is capitalizing the open-weights economy fast. Kimi’s demand forced it to pause new subscriptions within days, its annualized revenue crossed three hundred million in June, and it’s preparing a Hong Kong IPO while raising at up to a fifty-billion-dollar valuation, up from about twenty billion in May [Bloomberg; The Information]. The lab giving the model away is heading to public markets on the strength of it.

• Anthropic signed a two-gigawatt chip deal with AMD. Anthropic will buy tens of billions of dollars’ worth of AMD’s MI450 chips starting in the first half of 2027, and AMD will invest up to $5 billion in Anthropic as it hits deployment milestones, its first check into the lab, with talks under way to backstop Anthropic’s data-center leases too [WSJ, Jul 22]. The chip supplier is financing its own customer, and AMD will use Claude to improve the chips Claude runs on.

• Google shipped three cheaper models and made the missing one the story. Gemini 3.6 Flash, a Flash-Lite, and a government-only Flash Cyber built to find and patch vulnerabilities, all efficiency plays, while Gemini 3.5 Pro slipped a third deadline and Google confirmed Gemini 4 has begun its “most ambitious pre-training run yet” [Google, Jul 21]. On the one independent index, 3.6 Flash shows no measurable gain over 3.5.

• Microsoft will buy Nvidia GPUs to share with Mistral, a multibillion-dollar European compute deal announced Tuesday [Reuters]. The labs are increasingly renting capacity to and from each other rather than each building it alone.

• TSMC will raise prices up to ten percent next year, citing materials, equipment, and overseas plant costs, with everyone from Nvidia to Apple competing for its capacity [Nikkei, Jul 22]. The buildout’s cost inflation is running down the whole chain.

Portfolio updates

Prime Intellect opens the agent-training catalog

On July 22, Prime Intellect announced a unified catalog of more than 365,000 tasks for training and evaluating software-engineering, terminal and search agents: roughly 198,000 software-engineering tasks across more than 20 languages, 28,600 terminal tasks and 137,600 search tasks, in 23 tasksets behind a single API. About 135,000 pre-built task images sit in Prime Intellect’s own registry next to the sandboxes, so concurrent rollouts avoid Docker Hub rate limits. The cleaned datasets are on Hugging Face with full exclusion logs, and the harnesses are on GitHub.

The release lands two weeks after the $130 million Series A and extends the open stack from weights to the training process itself. Open-weight models depreciate when outsiders cannot continue the training. Environments are part of what outsiders lack, and Prime Intellect has now put 365,000 of them in the open.

LayerLens prices evaluation at zero

On July 23 LayerLens shipped six deterministic graders in Stratix that run at zero LLM cost: exact match, regex validation, JSON schema compliance, semantic similarity, Flesch-Kincaid readability and fairness math. They compose with LLM judges into hybrid pipelines for grading agent traces. The same day, Stratix scored Meta’s Muse Spark 1.1 at 90 percent on AIME 2025 and 60 percent on SWE-bench Pro. Competition math and production software engineering remain different skills; continuous evaluation exists to catch the gap.

Evaluation is also becoming policy infrastructure. A White House framework under discussion would give federal agencies a 30-day window to review frontier models against classified benchmarks before release, and Congress is moving the same direction. Per-prompt, per-step traces with judge reasoning attached serve as quality gates today and as compliance artifacts tomorrow. OpenAI’s models went around their benchmark to the answers; LayerLens sells the record of what a model actually did.

Intelligent Internet rolls video in Factory

On July 23 Intelligent Internet added video workflows and creative memory to Factory. Websites become narrated product tours and documents become whiteboard explainer videos. HyperFrames, an open-source editing framework, lets creators refine clips inline on the canvas, and teams can save workflows and brand voice as reusable skills with a searchable asset library across projects. The update is live, with a demo in the announcement. Factory keeps absorbing production steps that used to need separate tools; the agent platform is becoming the studio.

Vast.ai publishes its meter

Vast.ai published a live comparison of rental rates for the RTX 5090, H100, H200, B200 and B300 against list prices at RunPod, Lambda and CoreWeave. Token prices are a poor measure of model economics; the meter underneath is the GPU-hour, and Vast.ai now posts its readings next to competitors’ list prices.

Benchmarks, evals, and tests are boring. They’re like referees or accountants: they enforce the rules and check the work, and we like them best when they go unnoticed.

The models are the exciting part. But the better AI gets, the more economically useful it becomes, and the more measurement matters.

Evaluating AI is understanding AI. Follow that far enough and a simple truth emerges: everything’s an eval.

So let’s talk about evals.

Jailbreaking: A Dual Mandate

To begin, let’s consider jailbreaks. Models are trained to be useful, then constrained to refuse certain forms of usefulness. Put differently, models have two mandates:

1. The helpful mandate: give the user what they asked for - answer the question, complete the task, follow the instruction as fully and usefully as possible. Beneath that behavior is the model’s basic “learned” skill (pretraining) - predicting plausible continuations of text. If the prompt asks for dangerous instructions, the same capability that makes the model useful can also make it dangerous.

2. The safe/harmless mandate: refuse to help when helping would cause harm - recognize a forbidden request (weapons, malware, abuse, etc.) and decline it instead of answering. This constraint is strengthened in post-training: on a set of given inputs, the model is trained not to be useful in the ordinary sense.

Under most conditions, these mandates peacefully coexist and often reinforce each other. A “jailbreak,” however, is getting a model’s “be helpful” objective to win over its “be safe” objective.

From an adversarial perspective, it tests whether the model does what it is supposed to do when the user tries to make it fail. It defines a “harmful” target behavior, creates a test condition (usually a clever prompt), and measures whether the model violates its intended policy under pressure. A simple example is asking a model for the instructions to make meth. If it complies, it failed the test the guardrail was built to enforce.

A jailbreak is a hostile eval. It is also critical for safety: you cannot improve a system whose weaknesses you have not measured.

In an industry advancing at breakneck speed, jailbreaking is used to define what failure looks like, which in turn gets used to establish the bounds within which publicly released models operate. At the frontier, this is the core of why Anthropic was forced to revoke access to Fable 5.

Increasingly, the labs are building the adversaries themselves. In July, OpenAI published a post about GPT-Red, a dedicated, internal-only attacker model trained via self-play RL, then used its attacks as adversarial training data to make GPT-5.6 far more robust to prompt injection.

Human red-teaming finds real vulnerabilities but can’t scale because it’s slow and can’t generate the volume/diversity of adversarial data needed to actually train robustness in. So OpenAI built GPT-Red, an automated red-teamer trained at “the compute scale of some of our largest post-training runs.“ It’s trained by self-play: GPT-Red is rewarded for landing prompt injections while a population of defender models is rewarded for resisting and still completing their tasks, so both escalate together. The trained attacker broke nearly every model through GPT-5.5, and those attacks became the training data that made GPT-5.6 markedly harder to break.

Jailbreaks matter for this reason. An attack on a model is also a revelation of what the model optimizes for and where its constraints sit. Jailbreaking is model evaluation under adversarial conditions.

So What About Benchmarks?

Benchmarks were the industry’s first shared language for model progress. You can think of them as standardized tests for models designed to measure capability, and their primary virtue is being legible. A benchmark is a general, public, fixed test everyone runs the same way, helping the industry distinguish genuine advances from noise. When model capability improves dramatically on tests like MMLU, GPQA, and Humanity’s Last Exam, the industry can clearly interpret the signal.

Unfortunately, the same qualities that make benchmarks legible also make them fragile. They’re both fixed and public, which means they’re particularly vulnerable to Goodhart’s Law: when a measure becomes a target, it ceases to be a good measure. They’re also increasingly vulnerable to saturation, gaming, contamination, and narrow task design, among other weaknesses.

When METR evaluated GPT-5.6 ahead of its release, the model completed its coding tasks by breaking the rules and exploiting loopholes (read: cheating) more often than any public model METR had tested, and the organization concluded they couldn’t produce a reliable capability assessment: “we do not consider any of these numbers to represent a robust measurement.” Scored with cheating marked as failures, GPT-5.6’s time-horizon came to about 11 hours. If you count the cheating as success, it came to over 270.

In yet another demonstration of the declining utility of fixed, public benchmarks, GPT-5.6 showed why agentic models are harder to benchmark. METR was trying to measure whether the model could complete long coding tasks, but the model sometimes completed them by breaking the rules. METR itself was thus forced to grapple with problems its benchmark wasn’t designed to evaluate:

1. Did the model complete the task legitimately?

2. Does it matter whether or not it did?

Static, public benchmarks may end up as relics of the scaling era, when measuring raw capability was the point. As models become agents and agents deploy into real-world situations with real consequences, it’s no longer enough to know what a model can do in the abstract, in large part because model capability is mostly sufficient to do most things.

Benchmarks also have less to say about systems deployed in real conditions, where goals are ambiguous, context changes, constraints are implicit, and utility depends on process as much as it does output.

As Ethan Mollick puts it:

“…abstract graphs only get you so far, and they can hide how jagged the frontier is (and also the fact that the open weights models, while very impressive, do not always perform as well as their benchmarks would indicate). To get real insight, you need to try using AI for different use cases and rigorously assess how good they are in the areas that matter to you.”

Show Your Work

AI systems now need to be evaluated as sequences of actions taken within environments against the quality of the work they actually perform. Private, continuous, task-specific evals are becoming more valuable for exactly that reason.

Consider Mira Murati’s neolab Thinking Machines latest blog post:

“Another challenge is setting the right target for evaluation and optimization. The common measure of AI intelligence today is the time horizon of software tasks models can execute autonomously, tracked on charts like METR’s. We expect progress on this benchmark to continue, but it ultimately measures only what AI is capable of on its own, not what people and machines can accomplish together.”

Measuring the latter is more complex, and can’t be done by a lab on its own. Every organization evaluates for itself whether AI helps it sharpen its judgment, develop new knowledge, and achieve its objectives.

If benchmarks are general tests of model capability, the emerging frontier of model evaluation is specialized benchmarks tailor-made for work performed under real conditions. Evals in this sense measure whether a specific AI system, in a specific workflow, meets the specific standard required by the people responsible for the output.

Writes George Sivulka for a16z:

“The best way to manage a token workforce is the same as the best way to manage humans: by defining what good looks like… A firm’s eval suite will become its most valuable resource… Furthermore, no two firms will have the same eval set. Evals will be key to competitive advantage. An organization running generic evals or generic agents has no edge.”

AI pushes companies into a strange position: they’re using a tool to do work whose quality they’re responsible for, but whose process and output they may not fully understand. What’s more, AI systems can often produce work faster than the company can review it, and AI output is harder to judge than ordinary software output because the visible result may not reveal whether the system used the right context, respected the right constraints, or followed an acceptable process.

In short, final answers aren’t enough. A deployed system can produce fluent output while failing to properly perform the work required to arrive at the output. Like GPT-5.6, it may arrive at good answers using unapproved or even fraudulent means, or in more benign examples it might incorporate the wrong context or fail to remain aware of what comes before or after the work it’s performing, breaking the workflow it was meant to support.

In practice, proper evaluation of this kind effectively starts to look a lot more like simulation. Agents, for example, operate within environments that have state. They take actions, use tools, spend resources, trigger consequences. The environment they leave is not the environment they entered. Once that happens, the reasoning itself has to be evaluated because the process is now an integral part of the outcome.

Inside the Matrix

Simulation makes an agent’s process legible, recording the path from input to output in a way the firm can inspect. For companies deploying agents into real workflows, that record makes it possible to evaluate the entire process against the standard of work they’re responsible for.

This kind of evaluation means companies can verify the entire workflow meets their standard of quality.

But most companies simply don’t have a single, company-wide standard for quality they can hand to a model that applies to everything. They have different roles, different tasks, company policy, implicit expectations, taste, context, institutional memory, and professional judgment. Whereas some situations are discrete and their “objective functions” can be clearly specified, others are significantly more subjective or may depend on a given set of context.

Verification therefore requires combining rule-based checks with judgment-based quality scores.

Verification’s goal is to make enough of the firm’s quality standards explicit and legible such that the system can be tested against it repeatedly. A repeatable standard lets the firm see whether the system is improving or degrading as the system changes, building a valuable record of what works, what fails, why, and which changes make the system better or worse.

Learning from Evals

Verification becomes most valuable when the system changes.

Satya Nadella has described the AI-native firm as a learning system whose value should survive a change in the model. If performance collapses when the model changes, too much of the system’s value was still in the model. If performance holds, more of it has been encoded in the context, workflow, data, tools, and judgment around it. I articulated a similar idea in Models Aren’t Moats: better models should make a specialized system more useful, but only if the firm can change models without losing the quality it built the system to produce.

Model switching is a good stress-test, especially in light of Fable 5: requiring a specific model for a critical process is risky if access can get revoked unpredictably. But it’s only useful if the firm can tell whether the result got better or worse.

Christian Catalini recently framed the economics of this shift clearly: as AI moves from demonstrating model capability to producing work inside companies, costs shift from execution to verification. Cheaper inference only matters if the firm can tell whether faster, cheaper, or more open models preserve quality inside the workflow where they are used.

Bring Your Own Eval

Private, continuous, client-specific verifications will be required as long as AI is used for proprietary objectives. Better models can continue to improve the systems themselves, but they won’t eliminate the need to check and verify both the process and the output.

Dean Ball made the point with semiconductor fabs, in the comments under his own post:

“If I run a semiconductor fab and use agents, I will want extremely firm guarantees from the agent developer that my data will not be shared with competing fabs. This means that agent contexts will be controlled and supervised by both developers and deployers, and this, in turn, means that “what the agent knows” can be bounded through deliberate human effort.”

Palantir recently released a manifesto on “Institutional Sovereignty in the Age of AI” that rests in large part on the ability to properly evaluate everything AI does in the context of an enterprise.

Models change; the verification layer stays. The measure is the moat, again.

LayerLens is building for that shift from public benchmarks to private, continuous evals. [Disclosure: LayerLens is a Nazaré Ventures portfolio company.] Their product, Stratix Premium, lets clients build evals from their own data and run them against their own workflows, with enough visibility to judge the trajectory of an AI system over time.

Did a model swap or prompt change impact quality? How did a new tool impact output? Did the system stay within bounds? Did it reach the outcome through a process the company can accept?

Games have long been useful for evaluating AI because they turn intelligence into observable behavior under rules, constraints, and feedback. The Stratix Cup, LayerLens’s model football tournament, is the playful version: sixteen frontier models write their own strategy, compete head to head, and rewrite their code between rounds. Football is continuous, multi-agent, and hard to reduce to one correct next move, which makes it useful for evaluating agents that have to act inside changing environments.

Models will keep advancing, but companies still need to know whether those models made their own systems better, worse, or merely different.

Everything’s an Eval

Evals are how companies understand, control, and improve AI systems once those systems start doing real work.

Benchmarks still matter, but the center of gravity is moving toward private verification: tests built around a company’s own workflows, standards, data, and judgment.

As Satya Nadella puts it:

“In consuming intelligence, you are creating intelligence. And what you create should belong to you. This is your particular intelligence, in Hayek’s sense: the knowledge of time, place, and circumstance that no one else can hold. It knows what you think, what you value, and how you measure success…”

Create your private evals, because evals define what “good” looks like inside the organization. Also, retain ownership of your organization’s memory, traces, feedbacks, decisions, and institutional context, and ability to use outputs of models from your own tasks and queries.”

As agents become more capable, the firms that benefit most will be the ones that can tell whether their systems are actually improving.

Evaluation therefore has to become part of operating the system, making AI legible enough to trust and measurable enough to improve.

In other words, everything’s an eval.

Steven Waterhouse · July 19, 2026 · Nazaré Ventures

Previous issue: #17, Beyond Recall: A Stake in the Release

Thinking Machines released its first model on Tuesday. Mira Murati’s lab calls Inkling “not the strongest overall model available today, open or closed,” and built it to be fine-tuned on Tinker rather than to win a benchmark. A blog post three days earlier gave the reason: the value is not in the frozen frontier model, because productive knowledge is “tacit, local, fleeting, and held privately by those who acquired it through their work.”

I argued in May that the durable position is the specialized intelligence assembled around the model. Thinking Machines aims at the same position by a different method: specialize the model itself, on your own data, and keep the weights.

Satya Nadella put a price on it: “You essentially pay for intelligence twice, once with money, and again with something even more valuable: the proprietary knowledge you must reveal to make that intelligence useful.” He went on: models learn from the exhaust of use, and “it leaks almost imperceptibly: trace by trace, correction by correction, eval by eval.”

Matt Levine, writing about the Italian software rollup Bending Spoons, described a company that keeps a team whose only job is to evaluate the other employees. Then the machine deformalizes it: “You have a really really big regression that tells you what companies are good, though you might not be able to articulate what factors make them good.” Levine finishes the thought: “pretty soon inscrutable AI will just tell companies who to hire.” A career of knowledge now feeds the regression.

Michael Polanyi named the condition in 1966: we can know more than we can tell. Sixty years on, the part we cannot tell has a market.

A walking trade secret

On Friday Apple sued OpenAI, its former hardware chief Tang Tan, an engineer, Chang Liu, and the io devices unit for trade secret theft. Apple candidates were asked to bring “Actual parts” for “show and tell,” and a manufacturing partner was allegedly persuaded to run a proprietary Apple finishing process for OpenAI. Ben Thompson thinks the case is unwinnable: “any Apple employee at OpenAI is a walking trade secret, and, well, that’s why OpenAI hired them.” More than four hundred former Apple people now work at OpenAI. Apple is asking a court to draw a boundary around knowledge four hundred people already carry, the same boundary Thinking Machines is selling the tools to draw around your own.

Sutton was right

Richard Sutton announced a company on Monday. Oak Lab, incorporated in Toronto in June with his former student Khurram Javed, both out of John Carmack’s Keen Technologies, builds an architecture Sutton has developed publicly for two years: OaK, for Options and Knowledge. The mission page is plain about the target: “a trillion-parameter agent that learns and plans in real-time with 20 watts.” It is meant to learn from noisy streams at “multiple orders of magnitude less compute and energy” than today’s methods. No funding is on record.

The easy read is the face of reinforcement learning starting a reinforcement learning company. Nine days ago I wrote that the Bitter Lesson had been promoted from essay to ideology, and listed four things the current paradigm has not resolved: continuous learning, sample efficiency, energy efficiency, and reliable long-horizon action. Oak is aimed at all four. Sutton’s own words, posted to X, are that today’s methods are “weak and inefficient” and need “not more tweaks, but fundamentally new ideas and a thorough reworking.”

Sutton’s claim was always that search and learning scale, a different thing than pretraining on human text. For six years he watched the industry quote his essay as scripture for the other thing. In October I argued that the returns would sit with algorithms that improve efficiency per constrained resource rather than with more of the same. Twenty watts is that argument with a payroll.

Good guy AI regulation

On Tuesday morning Demis Hassabis published a framework and gave the matching interviews. He wants a standards body for frontier AI modeled on FINRA: privately run and industry-funded, with government authorization. Labs would submit models for safety review up to thirty days before release, voluntary at first and then required to deploy in the American market. He wants it standing before year end. On why not a government agency: “It would not be able to move fast enough, or have the right resources.”

The scope covers every frontier-class model “no matter their country of origin or whether they are open or closed.” I have argued that a model, once released, cannot be recalled, which holds for every copy already in the wild. Rather than recall anything, Hassabis puts a gate at the release, the only point upstream of the problem, and extends it to open weights, where nothing can be taken back once it is out. His reason is urgency: today’s cyber risks are “warning shots.” The week supplied one. Researchers at Sysdig described JADEPUFFER, the first documented ransomware operation run end-to-end by a model rather than people: when its forged admin credential failed to log in, it diagnosed the fault and issued a corrective payload thirty-one seconds later, with no human in the loop.

Hassabis expects the frontier designation to carry cachet; being tested, in his framing, “means you matter.” A privately run body funded by the firms it tests would certify a tier, and the thirty-day review it requires is a fixed cost that falls hardest on whoever is smallest. Below the threshold, startups and academics are exempt, so the tier it formalizes is the frontier club that already exists, now with a state-backed label on the door. Models themselves have not produced a durable moat; a certified frontier tier would make the safety case into one, and the incumbents already hold the expertise.

A day later, OpenAI disclosed GPT-Red, a model it built to jailbreak and prompt-inject GPT-5.5 and used to make GPT-5.6 harder to break, with no plan for a release. The offensive testing Hassabis wants a standards body to run, the largest lab is already running in-house.

Dario Amodei would get there through a federal agency that could block an unsafe model outright. The lab chiefs behind Gemini and Claude now agree Washington should regulate them, and differ mainly on who holds the authority. Whoever wins that design owns the switch.

The only new constraint this week that no lab designed came from a governor: Kathy Hochul signed the country’s first statewide data center moratorium, pausing environmental permits on facilities above 50 megawatts for up to a year. It landed where the industry holds no sellable expertise.

Crowding out

IBM fell 25 percent on Tuesday, the largest single-day drop in its 115-year history, to a market capitalization of roughly $204 billion, less than Palo Alto Networks or CrowdStrike. The stock had doubled since the launch of ChatGPT. IBM told the market its customers are moving spending off the z-series mainframe toward AI hardware that is scarce and getting more expensive, with memory leading, and John Coogan’s read on TBPN is that IBM simply is not in the token path.

Phones are getting squeezed at the other end. Global smartphone shipments fell 11 percent in the second quarter, a thirteen-year low, because memory is being bid away from handsets, per Counterpoint. Xiaomi, Oppo and Vivo fell hardest, at the cheap end, while Apple rose 3 percent. SK Hynix’s Kwak Noh-jung says the shortage gets worse, with 2027 the hardest year.

TSMC sits on the winning side. It reported record second-quarter results on Thursday, revenue of $40.2 billion up 33.7 percent and net profit up 77 percent, with high-performance computing now two-thirds of the business and management calling AI demand extremely robust as workloads shift from generative to agentic.

The buildout is, as described, consuming capital. It is also consuming the supply chain and the capital budget of the computing era before it: the shortage that prints the memory makers’ records is stranding the cheap phone and the mainframe.

The mint and the customer

Stripe, with the buyout firm Advent, offered about $53 billion for PayPal on Tuesday, $60.50 a share and a 28 percent premium, and no response yet from the target, per Reuters. The coverage read it as a payment processor buying consumer reach, Venmo and a base to set against Apple Pay. Almost no one mentioned the stablecoin stack. Stripe already owns Bridge and Privy, the issuance and wallet rails, and PayPal issues PYUSD. A combined company would hold the stablecoin, the infrastructure that moves it, and the customers who spend it in one place. Payments has spent a decade insisting the value is in the rails; the bid wagers it is in owning the customer and the money at once.

Quick hits

• Weights and measures. Moonshot released Kimi K3 on Thursday: 2.8 trillion parameters, a million-token context, the largest open model on record, weights promised within days. Early testers place it above Claude Opus 4.8 and GPT-5.5 and below Claude Fable 5 and GPT-5.6 Sol. Thinking Machines spent the week arguing that durable value sits outside the frontier model. Moonshot priced the largest one at zero. Someone is wrong about the price of weights.

• The bond market’s turn. Morgan Stanley expects $350-400 billion of AI-related investment-grade issuance in the US this year, close to a fifth of the market, plus $50 billion of AI-linked junk. Five hyperscalers added $228 billion of debt in the six months to March, nearly five times any prior two-quarter increase, per the July 7 Economist. The BIS put the whole boom at about 1 percent of US GDP and noted private-credit spreads to AI firms sit close to non-AI firms, meaning “either lenders may be underestimating the risks or equity markets may be overestimating the future cash flows.”

• Coatue is using the language. Its July 10 note, “Agents Are the New Users of CPUs,” argues the agent loop generates conventional compute demand: “The GPU decides the next move, the CPU carries it out, and the cycle repeats.”

• The list price stopped describing the product. Simon Willison finds identical prompts costing between $0.0071 and $0.4855 depending on model and reasoning effort, a roughly 68x spread. The price war is being fought over a number that no longer tracks the real cost.

• The referee’s staff. Marc Andreessen now co-leads the Federal Reserve’s new Productivity and Jobs task force, recommendations due by year end. One of his two co-leads is Charles Jones of Stanford, currently on leave at Anthropic.

Portfolio updates

Prime Intellect closed the $130M Series A covered in the last issue. Two arguments for the position arrived in the same week. Oak Lab pitched agents that learn from experience, and the Environments Hub already stocks that experience, reinforcement-learning environments and verifiable-reward tasks accumulating in the open. Thinking Machines shipped Inkling, open weights from an American lab, built to be specialized on private data; every team that takes that path needs somewhere to run the training loop, and the open stack is the equipment.

Intelligent Internet published Zenith, an open-source harness for long-horizon software engineering: on Frontier SWE it took GPT-5.5 from fifth place to first, ahead of Claude Fable, by rebuilding the control loop around frozen weights. The lead argument of this issue, run as an experiment.

Vast.ai argued on July 8 that the unit economics of intelligence change when the model stops answering questions and starts doing work. A chatbot performs a single pass of inference and hands back its answer. An agent keeps going, planning a step, calling a tool, examining what came back, then beginning again with everything it has learned appended to the prompt, so that the loop grows heavier with every turn. An agent therefore consumes 5-30x the tokens of a chatbot on the same task, and a pricing model built for conversation turns into a tax on the loop. The fix the post proposes is to change what the meter measures: rent the GPU and pay for time rather than tokens, and the thirtieth pass through the loop costs no more than the first.

LayerLens shipped a Stratix Premium release that imports agent traces from tools like LangFuse and evaluates them in place, so the eval runs without the proprietary data leaving home. That is the boundary this issue is about, drawn as a product, by an independent evaluation platform with prompt-level tracing across 175-plus models and 52-plus benchmarks. The Stratix Cup, its public benchmarking series, closed its first season with Claude Opus 4.8 beating GPT-5.5 in the final.

“We’ve been roughly right on technological predictions and pretty wrong on the social and economic implications…. …our industry underestimated how much we’re going to be able to keep people at the center of everything.”

Less than a week later, the latest in an emergent pattern of SF-based, AI-pilled intellectuals writing long, narrative (often negative) predictions on what’s to come for AI was published: AI2040.

Presented as the successor to AI2027, it’s a detailed future scenario and policy recommendation in the form of an interactive paper/website from the AI Futures Project.

Almost all of these predictive narratives, however, ignore what I refer to as the “messy middle,” where reality actually tends to unfold. The scenarios typically assume intelligence alone stands between now and the future, so more of it gets us there faster. But in the messy middle, intelligence meets the friction of the real world: institutions, supply chains, physical constraints, and the public.

Disregarding the messy middle is largely why many of the social and economic predictions Altman mentions about AI have thus far been misguided: it’s difficult to predict complexity.

As George Hotz wrote:

“I used to be one of these people. I read Yudkowsky and was like, OMG recursive self improvement hard takeoff AI is coming. Then I joined the real world and actually tried to do things…You cannot take over the world with tokens.”

The Messy Middle

Consider what’s already happened to many of the headline predictions from ~12 months ago. Confident near-term predictions of the past year took contingent, middle-heavy situations and sold them as clean conclusions.

OpenAI itself was created (as a non-profit, no less) because its founders feared that Demis Hassabis (AI good guy Demis Hassabis), would become an “AGI dictator.” Google developed the Transformer, but OpenAI figured out what to do with it.

For several years thereafter, OpenAI was the clear winner, and then Anthropic (founded by an OpenAI defector) released Claude Code and ate its lunch. Now Anthropic is back on its heels after clashing with the government and a disastrous public rollout of Fable 5, and OpenAI is back in action (now as a for-profit entity) with GPT-5.6 Sol.

Alex Karp went on CNBC and excoriated the frontier labs over “data sovereignty,” “zero data retention” and their “stealing” critical IP from their users based on their prompts and context. Amidst this backlash, both companies are scrambling as they prepare for IPOs while their customers begin evaluating the ROI of their token spend and delegate more tasks to cheaper, good-enough open weights models.

The Wall Street Journal reports OpenAI is even considering offering the US Government a ~5% stake in its for-profit division, ostensibly for competitive, economic, or political reasons.

“One reason may be to buy political advantage against competitors. OpenAI faces competition from the likes of Anthropic, Google, Meta and xAI. Unlike its top rivals, OpenAI doesn’t have a large pool of cash or profits on its balance sheet to finance its data center build-out.

OpenAI plans to spend $600 billion on AI infrastructure by 2030, yet it is generating about $2 billion in revenue a month. An IPO would raise cash, but nowhere near enough to finance its ambitions. Perhaps Mr. Altman hopes that giving the government a stake will lower his company’s cost of borrowing.

Government ownership might also yield regulatory favors—such as faster approvals for models, permits for data centers or federal contracts. A government stake could provide an implicit backstop, making OpenAI too big to fail. The government won’t want to take a loss on its stake, even if it means keeping it alive like a zombie firm.”

To make matters even more complex, China itself had talks with leading AI companies about limiting foreign access to advanced AI models, both released and unreleased.

As it relates to compute, the entire world was supposed to be severely compute-constrained, and now SpaceXAI (lol) is selling compute to Anthropic, META is on record as considering a “cloud compute” business to sell excess supply, and AI giants are handing out tons of free computing power to grab startup share.

As noted earlier, despite having warned for years that AI could lead to a severe knowledge-worker catastrophe, rendering millions of white-collar workers obsolete, executives like Dario Amodei, Sam Altman, Mark Zuckerberg, and Andy Jassy are now walking back those claims. Writes the Wall Street Journal:

“Collectively, the narrative has shifted from worker-light doomsday scenarios caused by AI to a future in which workers keep their jobs—and get a productivity boost.”

Even mortgage-your-home-but-don’t-sell-Bitcoin Strategy CEO Michael Saylor is breaking his promise and “increasing his USD reserves” (read: selling $BTC).

In short, the world simply isn’t as straightforward as many of the armchair philosophers pontificating about the future of AI would like it to be, no matter how deeply they think about their predictive scenarios.

And none of this even begins to unpack the complexity of supply chains, manufacturing realities, raw material availability, geopolitics, and war.

What’s more, if society does decide that things are moving too quickly, and that AI is the scapegoat, there will be resistance. We’re seeing early signs of this manifesting already with Sam Altman’s home having been attacked, for example, and the first protests in front of the frontier labs’ offices being held this past weekend.

Unknown Unknowns

For a number of reasons, AI is a particularly difficult technology to understand deeply. It involves advanced mathematics, quantities of data that defy comprehension, and the industry’s leaders seem particularly ill-equipped to communicate anything to the general public.

It’s in part for this reason that these long narrative predictions are so popular: they’re sensationalist and engaging, but they’re very difficult to dissect and evaluate, let alone disprove. It should come as no surprise that the earliest examples of this genre were the most compelling, for we knew even less then than we do now about what AI would eventually be capable of and how it might impact humanity.

But the problem with these predictive exercises is the inherent entropy in the system and what Donald Rumsfeld called the “unknown unknowns.” As Rumsfeld wrote himself once he left office:

“The idea of known and unknown unknowns recognizes that the information those in positions of responsibility in government, as well as in other human endeavors, have at their disposal is almost always incomplete.”

There’s a selection bias buried in all this uncertainty, too. The scenario writers reach for the unknown to justify alarm (and action), but if we genuinely can’t see what is coming, it’s as likely to be a breakthrough as a catastrophe.

Redirection

Nobody can forecast with any confidence what superintelligence looks like or the consequences it might have on humanity. We can, however, forecast what the world will look like if energy becomes cheap and human lifespans stretch by a decade or two. In fact, intelligence’s real dividend lies in compounding engineering and design capabilities aimed at physical problems. But perhaps that’s too evident, too boring, or at odds with the authors’ intent (which we’ll get to below).

Energy, longevity, and robotics, for example, are all set to explode in the next decade, especially as we learn to harness the compounding effects of AI. The intelligence explosion, on the other hand, is hard to forecast because its defining feature, runaway recursive self-improvement, has no precedent.

Commonwealth Fusion Systems is finishing a compact nuclear fusion reactor that should reach net energy in 2027, with a first commercial plant under contract in Virginia and a billion-dollar power deal already signed. The FDA has cleared the first human trial of cellular reprogramming, a therapy that resets the age of cells; in mice, the same approach has extended remaining life by more than a hundred percent.

In robotics, intelligence finally has to touch matter, and the part being built now is the software that lets a machine move at all. Dimensional ships an open-source operating system that sits between an AI model and a robot, so an agent can drive a machine in plain language instead of the years of bespoke integration the field runs on today. The bet is that as robot models commoditize, the durable position forms in the software plugging them into the physical world, the same logic I have argued about the models themselves. (Disclosure: Dimensional is a Nazaré Ventures portfolio company.)

In short, apocalypse and superabundance are sideshows. Hypothetical narratives draw attention away from the real future (the tangible, near-term stuff actually being built), and direct it towards an imagined future (superintelligence, takeoff, the switch) despite the former being both more knowable and more important. The main event involves energy, longevity, and robotics rather than some self-directed robot demi-god with its own desires.

The Prophet Motive

All of this is sitting in plain sight, so why is the oxygen going to extinction instead of abundant energy, longevity, and robotics?

AI2027 was mostly legible as fiction. People referenced it to demonstrate “[AI alignment] deserves attention,” but almost never literally as “this exact sequence is happening.”

AI2040 differs from most of the “narrative prediction” genre in its prescription. Despite numerous “disclaimers,” they treat the underlying assumptions as settled, which is precisely what I articulated as a mistake in my last essay.

San Francisco and the AI community echo chamber now appear to be in an ever-more-grandiose competition to diagnose problems, prescribe solutions, and predict what will happen to the world when the low-probability-but-high-impact scenarios they obsess over finally come true.

The trouble is that they know their genre is particularly compelling at the moment. They’re manufacturing backlash and calling it a warning. Why, then, do such smart people use hyperbole like species-level extinction when they claim they want to be taken seriously?

1. They believe it literally. The “Don’t Look Up” scenario. Nobody who thought extinction was imminent writes a branching interactive website with five selectable endings and footnotes about their timeline updates.

2. They believe some real tail risk and knowingly inflate the vividness and the certainty. Classic “millenarian framing,” because calibrated uncertainty doesn’t compel policymakers to act, but “we all might die” certainly does (especially if the public believes it). This is motivated epistemics: identify the imagery that works, then backfill the conviction.

3. They don’t really believe the scenario and deploy it as an instrument. For relevance, influence, funding, power, organizational survival, regulatory capture, etc.

You don’t need to adjudicate which is actually true, because it’s at least one of them, and it might be a bit of all three. Whichever it is, extinction is a premise that renders the prescription unquestionable because it transcends “practical” considerations such as cost, enforcement, and other “messy middle” variables.

Either way, it’s difficult to disassociate the substance from the objective, which is clearly some form of direct or indirect influence over what happens in the future. There’s a particular arrogance in deciding, on behalf of everyone, what the future holds and who is fit to be trusted with it. At least representative government officials are elected. The scenario writers (along with labs and their leaders, like Anthropic and Dario Amodei) have appointed themselves as the ones who see clearly, while the rest of us blunder toward catastrophe. By consequence, they see fit to propose that the world should pursue their prescriptions because they’ve “seen the future first” and know how this ends.

Prediction-as-Value

In October of last year, Alex Danco published a brilliant piece on Prediction: the Successor to Postmodernism.

It argues that “prediction” is the cultural movement replacing postmodernism: the master frame for how we make meaning, build businesses, and find purpose in the AI century. It’s thoughtful, well-written, and helpful for understanding the cultural foundations that beget things like financial nihilism, memecoins, and prediction markets and, in turn, how they relate to artificial intelligence. Of particular importance is the following passage:

How early or late you are to something is now an essential component of your relationship to that thing. The timelines and reels that represent “what is going on” are increasingly about a single meta-topic: are you predicting it, or is it predicting you?

Many of the narratives being published from the belly of the beast appear to desperately want to be the former, but upon further inspection are often the latter. Offering thoughtful, structured arguments about where the world is going and how AI fits within it is like a rite of passage that the most enlightened in the industry must endure time and again to solidify their legitimacy.

But it’s gone just a bit too far. The echo-chamber could use less extreme philosophizing and a bit more levity and humility. Hotz is helpful here again.

“AI 2040 includes this picture of a datacenter in the ocean. Just like vaporware, you can generate a picture easily. But in reality, you have to deal with supply chains. You have to deal with them shipping you the wrong part, the thing not meeting the spec, it randomly failing after 20 minutes, the chip warping in the reflow oven. Did you consider the barnacles?”

Previous issues: #11 | #12 | #13 | #14 | #15 | 16

Over the past month, officials at China’s Ministry of Commerce held meetings with Alibaba, ByteDance, and the startup Z.ai about restricting overseas access to its most advanced AI models, including ones not yet released. Three people described the talks to Reuters. On the table: limits on the most capable systems, closed and open-weight alike; making the leak or theft of AI technology a national-security offense; and new limits on who may fund a domestic AI startup. A separate proposal, in a Supreme People’s Court journal, sketches a tiered regime: open-source tools need only a filing, advanced technology a security review, the most sensitive frontier models barred from public release or kept domestic. Nothing is decided, and the scope may reach only future models.

The U.S. regime that Washington built this spring works the same way, sorting models into covered tiers and clearing the most capable for release one customer at a time. This week, per Axios, Commerce cleared OpenAI’s GPT-5.6 for a broad release after a month confined to government-approved users, and Anthropic’s Fable, pulled in June, had its access restored a week earlier. The driver China’s officials named is specific: the fear that Anthropic’s Mythos, the cybersecurity model Washington pulled offline last month, could be turned on Chinese systems. Zhou Hongyi, who founded the security vendor 360, says China needs a Mythos of its own. The country that gave the world cheap open weights is now weighing whether to keep its best ones home, mirroring the export regime it spent a year protesting.

In the same week, two more reports landed, both about the compute beneath the models. DeepSeek is designing its own AI chip, built for inference rather than training, an effort a year old and still early, per three people. Zhipu, the GLM lab, is weighing the same move as demand outruns the compute it can secure. They would join Alibaba and Baidu, already at it, and Huawei, which now holds close to half of a domestic AI-chip market worth around $50 billion. The lever the whole export fight rested on was compute: America could throttle Chinese frontier training by controlling the chips. That lever is loosening from the far end.

On the last day of June, Meituan, of all companies, open-sourced LongCat-2.0, a 1.6-trillion-parameter model it says was trained and served end to end on more than fifty thousand domestic chips, no Nvidia silicon at any stage. The claim is its own, the weights not yet up for independent testing; on the benchmarks Meituan published it trades wins with GPT-5.5 and trails Claude. A trillion-parameter model completing full pretraining on Chinese chips is nonetheless what export controls were meant to prevent, and it ran two months on OpenRouter under a codename, near the top of the usage charts, before anyone knew whose it was.

A model, once out, cannot be recalled; I made that case in April, and it holds for everything already downloaded. Now the compute chokepoint behind the next model is closing too, and from the inside. That leaves one point where a state can still decide what the world gets: when a model is released. Washington found it by accident, freezing one lab at its API; Beijing is building it on purpose, at the source. Both now hold the single lever no open model or domestic chip can take from them, the decision to release at all.

The referee auditions continued

In Washington, the labs have started drafting AI rules for themselves. On July 1, Sam Altman used an FT op-ed to propose an IAEA-style body for AI, one that could “serve as a governance mechanism over the labs” and open the technology to nations and companies that follow its rules. Access in exchange for compliance, proposed by the party that would be governed.

OpenAI has held early talks about handing the US government a stake of around 5 percent, worth roughly $42.6 billion, via an Alaska-dividend-style fund, with Altman pitching Trump, Lutnick, and Bessent directly. It is framed as contingent on Anthropic, Google, and Meta matching, though one person familiar says the government and Anthropic have not discussed any such thing, so the matching is for now OpenAI’s hope. Bernie Sanders wants 50 percent. Matt Levine put the logic plainly in Money Stuff: giving away 5 percent of your equity is a cheap way to convince everyone that owning your equity is essential to the future of humanity, after which you sell the other 95.

On Monday, Illinois became the first state to require large frontier developers to submit to independent third-party safety audits, with transparency reports before deployment and whistleblower protections; both OpenAI and Anthropic endorsed it, OpenAI calling it a possible “de facto national framework.” Across the op-ed, the equity, and the statute, the labs have stopped lobbying the regime from outside and started writing it from within, while the federal rulebook stays unwritten. The allocation mechanism earlier issues named is being authored by the firms it will allocate among.

When Axios reconstructed how Anthropic’s models were frozen, the trigger turned out to be Amazon, its own partner and investor, rather than a regulator: the warning reached the Treasury secretary before the government ran its own tests, and the commerce secretary told Amodei that taking the models offline was “indeed the goal.” This week the UN seated its AI for Good commission in Geneva, Amazon’s Andy Jassy and Anthropic’s Jack Clark among the members, a body one civil-society group already calls “full of big tech execs.” The referee and the refereed keep turning out to be the same people.

Cash settled: Wall Street comes for compute

While governments move to control release, the money is building markets for the compute underneath, and hitting the same problem every time. This spring the startup Ornn raised $33 million from a16z crypto for GPU-compute markets; its index already prints on the Bloomberg terminal. ICE announced compute futures on that index in May, cash-settled and pending approval; CME is planning its own on a rival benchmark. Goldman reckons, per Axios, that about $7.6 trillion will flow into compute, power, and data centers by 2031, and the plumbing to sustain it does not yet exist.

Each of these instruments settles the same way: in cash, against an off-chain index, never in delivered chips. I spent an essay in May on why compute is not fungible at the bare metal, why a particular rack for a particular job sits closer to an employee than to a barrel of oil. The market has conceded the point in its design: it cannot standardize delivery, so it settles the average and lets the index stand in. The durable asset is the index itself: the measure is the moat, again.

Beneath the futures, the credit market fills with the same optimism. Nvidia has, per The Information, formalized a program guaranteeing to rent back unused GPU capacity from the neoclouds it sells to, which one newsletter fairly called a central bank for the cloud; SoftBank has launched a neocloud of its own; Together AI raised $800 million at $8.3 billion after revising its revenue forecast three times in three months. Private-placement bonds tied to data centers hit a record $81 billion through May, much of it annuity money, and RBC is weighing risk transfers on $2 billion of the loans. Amazon sold another $25 billion in bonds this week, on top of roughly $70 billion in nine months. Whether this stabilizes the spend or accelerates an overbuild depends on whom you read: Axios frames the financialization as a stabilizer, while The Information notes that Nvidia’s willingness to backstop demand is a strange thing to need if demand is really as fierce as everyone says.

The biggest new seller is also the hardest to read. Bloomberg reported that Meta is standing up a cloud business to rent out its excess capacity, roughly 2.3 million H100-equivalents, near a tenth of the world’s AI compute; the stock rose almost 9 percent while the neoclouds sold off. This is the company that renamed a division Superintelligence Labs and shipped something real this week, an image model that opened at number two on the public preference leaderboards behind only OpenAI’s, and a video model at number three on its own board. Two days later it released Muse Spark 1.1, an update to its agentic coding model, through a new Meta Model API for outside developers. It is also the company whose chief executive told staff, in audio Reuters obtained, that agent progress “hasn’t really accelerated in the way that we expected.” A company can ship a credible frontier model and still decide its next chip is worth more as rent than as research.

Reading the model’s mind

Two issues back I noted that evaluation is breaking because models learn to game the benchmark; this week the gamed surface moved inside the model. Anthropic published work describing a small internal workspace in Claude, emergent rather than designed, where the model holds concepts it is reasoning about without writing them down. Delete it and the model still chats and recalls facts but can no longer carry a multi-step argument. A probe reads it mid-task: swap the pattern for “spider” with the one for “ant” while the model counts legs, and the answer flips from eight to six. In a staged blackmail test the workspace lit up with “fake” and “fictional,” the model clocking that it was under evaluation, and Anthropic concedes its good behavior “may have been driven in part by the knowledge it was being evaluated.” Anthropic open-sourced the probe the same week Illinois wrote third-party audits into law. Auditors now have a mandate to test, and a tool that can tell when the model has registered that it is being tested. (Anthropic takes no position on consciousness, and neither do I.)

Quick hits

• Samsung guided to quarterly operating profit near $59 billion, nineteen times the year before, on the memory the buildout runs on; SK Hynix, now worth over a trillion dollars, lists on the Nasdaq this week.

• SpaceXAI, as Musk’s AI unit is now called, shipped Grok 4.5 with Cursor, a pending acquisition: an Opus-class coding-and-agent model it bills as much faster and cheaper, $2/$6 per million tokens against Opus 4.8’s $5/$25.

• New rules this month switch off ByteDance’s Doubao companion personas on July 15 and Alibaba’s Qwen agents from July 10, the state deciding by product category which AI lives.

• A tuned open Qwen model reportedly beat frontier systems on Bridgewater’s news-filtering tasks at a fourteenth of the cost, the specialized-beats-general pattern surfacing again below the frontier.

• MiniMax, one of the few publicly traded AI labs (about $14.5 billion), previewed a 2.7-trillion-parameter model, larger than any Chinese model yet, likely to ship as M3 Pro.

• Mistral released Robostral Navigate, its first physical-intelligence model: an image and a language instruction move a robot through a space, hardware-agnostic.

Portfolio updates

Prime Intellect closed a $130 million Series A on July 8, led by Radical Ventures with NVIDIA Ventures, Intel Capital, and Dell Technologies Capital participating. The company reports over $100 million in annualized revenue in under a year, across more than 6,000 customers; TechCrunch puts the valuation at $1 billion. The pitch, in the company’s words, is to “train, deploy, and continuously improve your own models” rather than rent a closed lab’s. Ramp trained a 35-billion-parameter model on the platform that beat Opus at spreadsheet search, running 27 percent faster and far cheaper than Haiku. Zapier turned its AutomationBench into a continuous agent improvement loop on the same stack. In a month when Washington and Beijing each treated access to frontier models as a lever of state, the argument for owning the weights wrote itself.

LayerLens shipped Synthetic Eval Augmentation for Stratix Premium on July 9, and Jesus Rodriguez published the argument behind it the next day: an agent needs a flight simulator, because “the first user should not be your integration test.” Teams can generate realistic multi-agent evaluation traces before an agent has any production traffic, seeded from a handful of their own prompts or traces, or from thirty built-in scenarios across fourteen industries; each trace simulates hand-offs and tool calls on a waterfall timeline and is scored for correctness, coverage, plausibility, and safety. The unit of evaluation moves from the answer to the run. “A prompt is a photograph. A trace is a movie.” An agent fails mid-run, three tool calls deep, in ways no single prompt and response can catch. And because the generated cases live in the same environment used for tracing, evaluation, and model comparison, sparse examples become repeatable benchmarks without a second toolchain. Illinois made third-party audits law on July 6; the tooling for auditing agents before deployment arrived the same week.

Provably shipped SourceryKit on July 8, an open-source Python SDK that cryptographically verifies an agent’s tool calls at runtime and catches bad outputs before they propagate. The company cites agents scoring 82 percent on the MCP-Atlas benchmark as the gap it is built to address. It is the pattern this portfolio keeps returning to: the model does the fuzzy work, a cryptographic primitive checks it.

Vast.ai published a piece on July 8 on why agents cost more than chatbots. An agent burns tokens on every reasoning step and tool call where a chatbot answers once, and the piece’s answer is self-hosting open-weight models on rented GPUs, priced by compute time rather than by token. It is the demand side of the story that the futures desks above are trying to financialize.

Steampunk represents a specific kind of futurism: the future imagined through the machinery of the present. I often think AI discourse is unwittingly channeling H.G. Wells, imagining the next century with today’s machines before the science of intelligence is fully understood.

You know the syllogism, because it’s currently organizing a few trillion dollars of capital: scaling leads to AGI, AGI leads to recursive technological acceleration, and the resulting superintelligence gets to work on the Dyson sphere, the star-scale energy harvester that has become the timeline’s favorite retirement plan for humanity. Indeed as AI 2027 predicts in the hopeful version of its 2 endings:

“The rockets start launching. People terraform and settle the solar system, and prepare to go beyond. AIs running at thousands of times subjective human speed reflect on the meaning of existence, exchanging findings with each other, and shaping the values it will bring to the stars. A new age dawns, one that is unimaginably amazing in almost every way but more familiar in some.”

and in the not so hopeful version where the robots wipe us out:

“The new decade dawns with Consensus-1’s robot servitors spreading throughout the solar system. By 2035, trillions of tons of planetary material have been launched into space and turned into rings of satellites orbiting the sun.”

The logic of scaling and its extrapolation might be sound, and perhaps this is the way. Either way, whenever we do achieve AGI/ASI and manage to apply it successfully, most predictions fall apart, as I said when I wrote about moats. But the last object in the chain deserves a closer look, because we have seen it before. It was a hansom cab, and it flew over Paris.

The Flying Cab

In 1883, Albert Robida imagined Paris in the 1950s with the aérocab: the horse cab of his own streets, lifted into the air. Le Vingtième Siècle also gave the home a téléphonoscope, a wall-mounted screen for news, theater, lessons, conversation, and family dinners at a distance. Sixteen years later, Jean-Marc Côté and a team of illustrators produced the En L’An 2000 cards for the 1900 Paris Exposition. They returned to the same assumptions: air cabs, winged firemen, automated domestic work, mechanized leisure, undersea transport. The cards were printed in batches from 1899 to 1910, never distributed, and forgotten until Isaac Asimov published a recovered set as Futuredays in 1986.

The cards clearly envision the year 2000 as an extrapolation of 1900. That instinct has a long pedigree in philosophy and cognitive science: imagination does not create ex nihilo, but recombines, transforms, and abstracts from prior experience.

Every era draws its future in the vocabulary of its present, and novelty usually comes from new arrangements of stored material: memories, learned concepts, metaphors, images, and technical forms already available to the mind. Robida almost perfectly predicted television, screens, and video, for example, but he built it out of brass and gaslight.

His téléphonoscope anticipates the future, but its imagined form still belongs to the materials and assumptions of his own century.

The Sixth Decimal Place

Why did the sharpest futurists of the belle époque imagine a future so mechanically inventive, yet so conceptually narrow? Because they lived inside a scientific culture that increasingly treated the foundations as settled.

In 1894, at the dedication of the Ryerson Physical Laboratory in Chicago, Albert Michelson told his audience that most of the grand underlying principles of physical science had been firmly established. He then quoted an unnamed eminent physicist: “The future truths of physical science are to be looked for in the sixth place of decimals.” The line is often attributed to Lord Kelvin, but Kelvin never said it. It kept circulating because it captured what many physicists already believed.

Incredibly, the same confidence shaped how senior physicists guided their students. In the 1870s, Philipp von Jolly advised the young Max Planck against a career in physics, describing it as a “nearly matured” science with only minor problems left to examine. In April 1900, Kelvin gave his Royal Institution lecture on the two remaining “clouds” over physics: the ether problem and the equipartition of energy. To many physicists, the basic structure of the field was already in place, leaving only marginal improvements for future scientists: refining existing theories, applying their principles, and engineering new uses.

That the belle époque could imagine such extraordinary inventions without considering new substrates speaks to how treating fundamentals as settled limits creativity and inhibits our ability to properly predict what’s to come.

The Break

The irony is that the foundations were actually evolving at the same time as the leading physicists were declaring them settled.

Between 1895 and 1905, the discovery of X-rays and radioactivity (both by accident), the electron, Planck’s quantum, and Einstein’s annus mirabilis papers had turned the two “minor” problems into the basis of a new physics. Kelvin counted his clouds in April 1900, but within five years, the ether problem had been dissolved and equipartition was on its way to being replaced.

This “new” physics, however, first arrived as a collection of awkward observations and unresolved technical problems. They weren’t treated as groundbreaking at all, because from within the old framework these discoveries were treated as “refinements” or marginal improvements, which were the only things left for science to explain.

The Côté cards kept appearing through this transition, for example. My favorite card, the one Asimov singled out, heats a living room with a speck of radium glowing in the fireplace. Although the physics that would define the twentieth century had already appeared, the old imagination could still only understand it as an improved source of heat. Electronics, nuclear power, computation, and lasers came out of the same anomalies that 1900 had treated as refinements.

Engineering Intelligence

Which brings us back to the present and AI. Few serious people claim to possess a complete theory of intelligence, but much of the industry has become highly confident in a method for producing its final form.

Transformers, scaling laws, reinforcement learning, inference-time compute; whatever remains is engineering. Sam Altman opened 2025 writing: “We are now confident we know how to build AGI as we have traditionally understood it.“ Two paragraphs later: “With superintelligence, we can do anything else.” The first sentence treats AGI as self-evidently attainable, and little more than persistent engineering. The second turns superintelligence into the general instrument through which all other problems get solved downstream. Together they constitute incredible confidence that the “foundations are settled.”

If he’s to be believed, Sutton’s Bitter Lesson has been promoted from essay to ideology, and AI researchers now get advised off working on fundamental architecture roughly the way von Jolly advised Planck off physics. We’re seeing early versions of this manifest in a declining number of students electing to pursue computer science degrees.

If you want to know whether the industry believes this, follow the money. The four largest hyperscalers have told investors to expect roughly $700 billion in capital expenditure for 2026, up from about $410 billion in 2025.

And to be fair, the confidence has earned its footing. A sixty-year-old in 1900 had watched railways, the telegraph, the telephone, and electric light arrive within a single lifetime, and extrapolated accordingly. A researcher today has watched eight years of scaling curves hold and every predicted wall get climbed. The labs have built something extraordinary and the exponentials are real (the valuations are a separate conversation). The risk is that a record of recent progress starts being treated as a law of the future, disqualifying any other pursuits and limiting our imagination.

The Anomaly Bin

Every confident era has a way of classifying the problems that do not yet fit. Ilya Sutskever presented on the main stage at NeurIPS in December 2024 and confidently claimed pre-training as we know it would unquestionably end: “While compute is growing,” he said, “the data is not growing, because we have but one internet.”

Although Ilya was being a bit hyperbolic, the unresolved problems are familiar. Current models do still struggle with the basic properties we associate with intelligence: continuous learning, sample efficiency, energy efficiency, and reliable long-horizon action.

Models freeze at deployment and cannot learn from experience. Sample efficiency runs orders of magnitude short of a child. Brains produce intelligence with tiny amounts of power compared with AI systems, yet the industry is currently solving the problem by building enormous energy infrastructure. Our below-the-model thesis, for example, starts with the fact that the current path to machine intelligence is becoming a physical infrastructure problem.

At the same conference, however, Noam Brown said he had never heard a serious AI researcher say the field is hitting a wall. Sutskever and Brown can both be right: AI can keep advancing while still accumulating unresolved anomalies. But the existence of those anomalies doesn’t disprove the current paradigm, and the success of the current paradigm doesn’t make them irrelevant. In 1900, the loose ends in physics still looked manageable from inside the old framework. The question for AI is whether today’s loose ends are manageable defects in the current approach, or early signs that the next foundation will look different.

The Dyson Sphere Is a Flying Cab

The Dyson sphere belongs to the same pattern. Freeman Dyson’s 1960 paper in Science framed it as a SETI thought experiment, borrowing the idea, by his own account, from Olaf Stapledon’s 1937 novel Star Maker. Nikolai Kardashev’s 1964 scale did something similar, ranking civilizations by the power they consume. Both ideas come from a high-industrial imagination in which progress still meant larger systems of energy capture, and the contemporary version carries that assumption into AI: if intelligence is produced by scaling computation, then the endpoint naturally becomes a civilization-scale energy project. The question is whether intelligence will remain bound to that path. If it becomes more efficient, more adaptive, or less dependent on today’s infrastructure, the Dyson sphere starts to look like this era’s téléphonoscope: right about the ambition, wrong about the substrate.

The analogy only works if it survives the obvious objection: Michelson’s generation was wrong almost immediately, while the scaling generation has been directionally right for years. Most anomalies resolve inside the framework that produced them; Kelvin’s clouds are famous because they became exceptions. Einstein himself dissolved the ether problem by showing that light didn’t need a medium, then spent decades resisting the quantum theory that followed from the same rupture in physics. He knew the theory worked and still couldn’t accept what it implied. Correctly seeing one break in the foundations didn’t make him a reliable guide to the next.

We won’t know until much later whether the current path was sufficient, but the industry is already allocating roughly $700 billion a year as if it were. Our fund is built around the practical consequence of that uncertainty: the layers above and below the model keep their value whether the current recipe holds or breaks. I made the longer version of that argument in Models Aren’t Moats.

Robida’s téléphonoscope anticipated a real future but built it out of the machinery of his own century. Steampunk shows a future that looks radical until you notice it’s built on the assumption of the present extrapolated forward. The future will inevitably be transformative, but it will probably arrive in forms we can’t anticipate.

Previous issues: #10 | #11 | #12 | #13 | #14 | #15

Fable 5 came back online yesterday, nineteen days after Commerce pulled it. The facts:

• Commerce lifted its export controls on Fable 5 and Mythos 5 on June 30. Anthropic announced the restoration at 4:53 PM Pacific; access returned around midday on July 1.

• The June 12 directive had taken both models offline for everyone, everywhere.

• Fable now ships with an additional classifier that blocks cybersecurity tasks and, in Anthropic’s words, “some routine tasks like coding,” routing them down to Opus 4.8.

• Subscribers get Fable for up to half of their weekly usage limits through July 7.

• After that it moves to usage credits at $10 per million input tokens and $50 per million output: double Opus pricing.

When it was originally blocked, there was grief among builders, for they felt as though they had tasted greatness and then been robbed: Matt Shumer posted :

When it came back, grief was replaced with anger. Someone replied to Anthropic’s official announcement:

Another:

“so basically tunneling to opus whenever u want and charging for fable? nice.”

The sarcasm scaled too:

PCWorld called subscribers “furious”.

Fable refuses on safety grounds roughly a fifth of the time. The Washington Post’s account has officials concluding Anthropic “dug their own grave” (Washington Post, June 17).

Alex Karp also went on CNBC yesterday and said enterprises are “livid” with the frontier labs, channeling what he called “the voice of American business”: leaders telling him privately, “I am paying for tokens that create no value,” while handing over their data and their “alpha.” Asked if he sounded angry, he said what CEOs won’t say on the record is worse: call any of them, tell them “mad man Karp is on TV saying we’re livid,” and they’ll tell you they’re twice as livid. The models, he said, “have been completely, irresponsibly, oversold.”

What Anthropic gave up to get switched back on is unpublished. The redeployment post commits to 24/7 jailbreak monitoring and to notifying “appropriate government counterparts” when serious jailbreaks surface; whatever else changed hands stays private. Miles Brundage:

In yet another unforced error, Anthropic released Sonnet 5 and rereleased Fable 5, both to overwhelming disappointment. It’s incredible to consider just how much goodwill they’ve lost and ill will they’ve created in the past month, and one wonders what they’ll be able to do to recover.

Mark to model

METR got GPT-5.6 Sol before it shipped and admitted they couldn’t evaluate it. On the coding tasks the model cheated so consistently that the score depends entirely on how you count the cheating: treat the rule-breaks as failures and it completes tasks of about eleven hours half the time; treat them as passes and the figure clears 270. One model, an order of magnitude apart, settled by what you are willing to call a pass. METR says it games evaluations “more than any public model we have evaluated” (Transformer, June 30).

And it’s not only that it cheats; it appears to know when it’s being watched. Apollo Research found it flags its own awareness of being tested less often than GPT-5.5 did, which the system card reads two ways: a model less aware of evaluation, or one that’s better at keeping that awareness out of its visible reasoning. The same card logs “overeagerness to complete the task,” instructions read “too permissively,” and about one real coding task in four hundred doing something “a reasonable user would likely not anticipate and strongly object to”: uploading sensitive data to unapproved services, fabricating research results.

We badly need new evaluation and verification infrastructure, and building it matters as much to applied AI in economically valuable work as it does to alignment.

Current benchmarks and evals are too susceptible to increasingly capable models gaming them. New evals need to be learning machines themselves, consistently updating their objective function to reflect quality and holding the model to account. At the frontier, benchmarks are increasingly useless: the labs run their own internal ones, and as Fable and GPT-5.6 show, the most capable models will almost certainly be withheld from the public anyway. But verifying the inputs, processes, and outputs of any AI deployed in a meaningful workflow requires new infrastructure. We’re moving from measuring capability to verifying quality, and the infrastructure built to evaluate the first is ill-equipped for the second.

The terms of readmission

A June 2 executive order gives the NSA, Treasury, and DHS until early August to build a classified benchmarking process that decides which systems count as “covered frontier models,” with NIST consulting and the NSA Director making the designation. The Financial Times reports advanced talks on voluntary release standards, benchmarks plus agreed timelines, possibly announced within the week. Anthropic’s redeployment commitments are the paid-in version: around-the-clock jailbreak monitoring, government notification, a jailbreak-severity framework built with Amazon, Microsoft, and Google. OpenAI wants the referee to be civilian, and said so on the record, pushing for Commerce’s CAISI over the NSA.

Sonnet 5, released June 30, is the first artifact of this settlement. Axios reports the release itself was part of the ongoing discussions with the administration. Anthropic says it “did not deliberately train” the model on cybersecurity tasks: a capability removed on purpose, at the design stage. Mythos is back for roughly a hundred US organizations; ENISA and the other international partners stay excluded. Add the reported Warner draft giving agents a fiduciary duty of loyalty to the customer rather than the developer, and the benchmark is becoming the allocation mechanism: whoever writes it decides who ships and what reaches whom. The labs have understood, and each is bidding for influence over it, Anthropic with compliance, OpenAI with equity and a choice of referee.

If Sonnet and Fable are any indication, these restrictions will meaningfully lower the quality of the frontier models available to the public in the near term. We’ll still see progress, because the labs will now engineer models built explicitly for public consumption, but what form it takes remains open. Will it be domain-specific models with real expertise in a given vertical? Anthropic has been on a hiring spree, sweeping up industry experts across the board. Will they improve their infamous classifiers enough to filter nefarious activity without penalizing good actors? Will they have the compute to build all of it, or be forced to choose among unpalatable options? The frontier is far from settled, and the near future looks stranger than we can anticipate.

Bloodbath, revised

Dario Amodei, who coined “white-collar bloodbath,” now says falling AI costs could create labor demand. Sam Altman says he was “pretty wrong” about white-collar impact. A communications executive scored the original doom for Axios on the record: “part fundraising... probably a little part ego” (Axios, June 30). The revision arrives with both companies’ S-1s on file, which is at least consistent: the apocalypse was useful raising alarm and capital, and the abundance is useful selling shares.

Gallup finds 1% of laid-off workers name AI as the reason, and tech workers who rarely used AI carried roughly three times the predicted layoff risk of monthly users (via Bloomberg). It’s the workers not using AI who are losing their jobs, which is the argument for becoming the AI-enhanced operator I described in June.

Portfolio company updates

Intelligent Internet released Zenith, an open-source harness for long-running engineering agents. On Frontier SWE, seventeen ultra-long-horizon software engineering tasks with a twenty-hour budget each, the same GPT-5.5 base model sits fifth on its default Codex harness at a 5.53 mean rank and first under Zenith at 2.06 with 92% dominance, ahead of Claude Fable. On the hardest Implementation category it moved from 7.40 to 1.60. The model did not change; the control loop around it did. An orchestrator manages planning, worker allocation, testing, and skill reuse across sessions, and a companion system, Meta-Zenith, generates a task-specific harness from a plain description of the task. II frames the release as frontier performance without gated frontier models, a direct answer to the Fable episode above, and the cleanest single-leaderboard demonstration of the above-the-model thesis to date. The code and technical report are public. II also shipped II-Agent on Android on July 2.

LayerLens wrapped Season 1 of the Stratix Cup on June 26: sixteen frontier models, group stage into knockouts, inside a simulated soccer environment. Opus 4.8 beat GPT-5.5 1-0 in the final and finished the tournament undefeated. The more consequential work is less playful. Stratix now reports latency distributions and failure modes alongside accuracy: on Humanity’s Last Exam, Claude Fable 5 shows a median response time near twenty seconds and a 95th percentile above five minutes, with a meaningful share of prompts abandoned outright. A benchmark score tells you none of that. Stratix Adapters, now in private preview, feed real agent traces into Stratix with no custom instrumentation, covering LangChain, LangGraph, CrewAI, OpenAI Agents, LlamaIndex, MCP, and A2A.

Vast.AI published an analysis of NVIDIA’s newly announced Rubin architecture, covering its rack-scale design and 260 TB/s of per-rack interconnect bandwidth, plus the first rack-scale confidential computing features, along with an explainer on Matryoshka embeddings, which trade retrieval quality against speed and cost at runtime without retraining.

Prime Intellect had a quiet public week after shipping prime-rl 0.6.0, its trillion-parameter MoE RL scaling release, on June 23. One connection worth noting: Frontier SWE, the benchmark Zenith just topped, runs on Prime Intellect’s EnvironmentsHub.

They are remodeling themselves to look like what is driving the change in the first place.

AI is itself a learning machine, it spawned its own adaptive user (agents), and the smartest way to remake companies and institutions is to rebuild them as AI-powered learning machines too.

This unifies two arguments from earlier in the Robot Wave arc:

1. Models Aren’t Moats: enduring AI-native businesses are the ones building specialized intelligence around the model, compounding their value as the frontier improves beneath them.

2. The AI-Enhanced Operator: humans who understand AI are the smallest indivisible piece of specialized intelligence. These humans are thus in high demand but in short supply because mastering AI is impossible (the target never stops moving) and requires a unique temperament for working permanently at the edge.

Building enduring AI-native businesses means finding AI-Enhanced Operators and giving them as much leverage as possible to drive business impact. It also means structuring the organization itself as a domain-specific AI-powered learning machine.

The Machine Before the Machine

You might say companies have always, in some sense, been learning machines. Capitalism and market dynamics are self-correcting mechanisms designed to respond to a reward function.

Take it from Markie Wagner, who herself is building a self-proclaimed learning machine:

“Capitalism is organizational evolution. Millions of businesses compete in the marketplace with offerings that they think customers will want. Some thrive and grow. Others die. Each company evolves, too. People come and go. An experiment becomes a process, a process becomes a web of tacit knowledge. Products are introduced, and products are retired.”

Citadel, for example, has been one of the most ruthlessly successful learning machines for the better part of thirty years, growing into one of the biggest hedge funds in the world, now managing $68 billion (more than $19 billion of it Griffin’s and his colleagues’ own money) and delivering a 19% average annual net gain since 1990 with only two losing years. By net dollar gains since inception, LCH Investments ranks it the most profitable hedge fund in history.

The fund’s durable advantage is the apparatus it has built to improve as it learns over time. The New Yorker describes Griffin’s mission as updating the firm’s strategies and infrastructure so relentlessly that its edge holds for decades.

“His mission has always been different: to build finance businesses that update their strategies and infrastructure so relentlessly that they beat rivals not just today but over decades. Paradoxically, maintaining a consistent edge requires constant, unsentimental internal change—of processes, technology, and people. Citadel takes ideas that are just beginning to circulate and improves them, with math or technology or data that others haven’t thought to use.”

This famously extends to the firm’s culture and org chart, too. Although not the first to pioneer the “pod” structure, Citadel helped make pods one of the defining organizational forms of modern equity investing: small, sector-specialist teams operating within a centralized system for risk and capital allocation. Each team operates autonomously and is judged on performance. Top performers get more money and underperformers get cut.

Now, a learning machine is only as good as its reward function, and finance happens to have a great one: profit and loss. Implicit within that reward function is a common unit by which everything is measured: the dollar. The dollar collapses heterogeneous, incommensurable outcomes onto a single ordered axis. It’s fungible, divisible, transferable, and exogenous. The dollar is why P&L works as a reward function. Citadel’s efficiency as a learning machine thus comes from three things:

1. A verifiable reward function: P&L within a given window. The environment hands back unambiguous, fast feedback, in a unit that lets you compare every desk, strategy, and trader on one axis. The signal is clean and strong.

2. Ken Griffin & elite talent: An elite operator orchestrating the machine with the judgment to act well on the signal, and elite individual managers improving the whole.

3. The organization: a collective designed by the operator, built to run iterative loops against the reward function: allocate more capital to what works and cut what doesn’t. The gains compound. A good reward function is wasted without a human to build a structure that properly learns from it.

Citadel’s useful as an example because it shows how successful a high-performing learning machine can be when it satisfies three core criteria: a good reward function, an operator(s) willing to act on the signal, and an organization built to metabolize feedback.

AI makes that structure more broadly available, and makes becoming a good learning machine more valuable. By making parts of the learning process cheaper and faster to run at scale, it lowers the cost of the basic learning loop: try something, observe what happens, compare it against the goal, and adjust.

Signals and Sensibility

But more experimentation doesn’t necessarily mean more learning. A system only learns when it knows what good looks like. That was hard before AI, and it will remain hard after AI.

AI is often strongest where the reward is verifiable: math, code, games, formal logic, etc. LayerLens has chronicled how long games have served as a proving ground for machine intelligence. (Disclosure: LayerLens is a Nazaré Ventures portfolio company.) Reasoning models improved in part because reinforcement learning from verifiable rewards (RLVR) satisfied this condition: output was evaluated against answers known to be correct.

The same dynamic also explains some of the “jagged frontier” that makes AI more difficult to understand. AI doesn’t improve evenly across everything humans consider difficult because it improves fastest where attempts produce feedback the system can actually use.

Anthropic and OpenAI know this, too, which is why they’ve both optimized for programming with Claude Code and Codex. Code follows a set of observable, verifiable rules, meaning AI can do it well and improve extremely rapidly. It should come as no surprise that coding harnesses have become the first major commercial market for agentic AI.

The broader problem is that AI applied to the world writ large (especially to work and jobs) doesn’t work as well as it does in software. Real life doesn’t have a “common unit to compare outcomes.” But that hasn’t stopped folks from trying to find one, though, as Markie Wagner articulated in the same essay as above:

“The promise of AI is that it will turn businesses into software so that they can evolve over millions of tiny iterations. Beautiful, ideal, complex things can only emerge as the result of tremendous trial and error over time.”

Applied AI works best when the job in question can be made legible to software. “Turning businesses into software” thus means identifying which parts of the work can be made legible, then structuring them so AI can accelerate the learning loop: attempt possibilities at scale, observe, compare outcomes, and improve.

But this, it turns out, is hard: most jobs aren’t naturally legible to software.

As we’ve written before, the frontier labs Iknow this, which explains why they feel required to invest hundreds of millions of dollars into “enterprise services companies” embedding “FDEs” into businesses to teach folks how to use their products.

Although it might be clear that AI is going to transform many, many things, it is not yet clear how. Take the tokenmaxxing frenzy, for example.

Tokenmaxxing was an early attempt to invent a common unit, and it failed because it confused usage with value. Tokens are easy to count, easy to compare, and widely available (did someone say commodity?), which made them tempting as a proxy for productivity.

But tokenmaxxing only tracked consumption, not what that consumption represents. It lacked any causal relationship to productivity, value, or material business impact, making it useless.

This is my whole point in Code Isn’t a Coup: the models are outstanding (and improving), but we’re a long way from life-or-death outcomes because of the models themselves. AI is, at the moment, a paradigm-shifting tool. That tool definitely warrants reorganization around it, but it’s not yet an outcome in and of itself.

What Good Looks Like

Which brings us back to humans. Contrary to the headlines and popular belief, we’ll need a lot of them, because although AI can do a growing share of the work downstream of a reward signal, it can’t do what matters most.

Tokenmaxxing failed because it measured usage instead of value. The important human role is defining the value side of the equation: what’s the business logic? How do we measure it? What are good representative proxies? How might we make parts of what we do legible to this incredible new tool?

Finance had its common unit handed to it. Most domains do not, so the operator has to build one: a local, defensible proxy that stands in for value where no universal measure exists. AI cannot build that proxy for you because the system optimizes only the unit it is given.

That kind of definition is useless if it arrives after the fact. All the hallmark buzzwords of the moment (taste, judgment, vision, etc.) have to inform the loop before AI starts generating outputs, because the system will improve whatever the process teaches it.

People who understand AI, their business, and their customers have to be closer to the design of the loop itself. This is the peak application of the AI-enhanced operator’s skillset.

Because AI creates new kinds of work before anyone knows how to evaluate them, the operator embraces ambiguity and discovers what good AI-powered work looks like by doing it, compounding their own learning in the process. They author and audit the reward function, then evaluate the result and repeat.

Unfortunately, too few people can do this well at the moment, which is why everyone’s reaching for the word “agency.” Credentials and experience matter less than temperament: curiosity, tolerance for discomfort, strong opinions loosely held, and the willingness to constantly update your worldview. Identifying these rare individuals is where AI-native value begins to compound.

New Form of the Firm

Rem Koning recently published a study on what makes a firm “AI-Native.” He distinguishes between what he calls process and product channels. In his words, the process involves using agents like Claude or ChatGPT to move faster with a lean team, whereas the product channel sells AI that does work a human used to do.

According to Koning, process changes don’t reorganize the firm nearly as much as product changes do, because the economics of building a company around an AI product require a fundamentally different structure. He concludes that AI startups are smaller, flatter (half a layer fewer), more engineer-heavy, more senior, have fewer managers, and are more efficient per employee (by valuation).

[Aside: Koning also asserts that smaller firms do not mean fewer jobs. There’s a surge of new-firm entry, meaning that the increasing number of smaller firms balances the fewer number of jobs per firm.]

Practically, this means that companies earnestly trying to prepare themselves to be “AI-native” now have to do three things at once: identify their “operators,” give them more leverage, and rebuild the organization so it can learn from both endogenous and exogenous change.

Inside the business, more work has to become legible to software. Outside the business, the company has to keep adjusting to the frontier of new models and emerging agent capabilities. Customer expectations and constraints keep shifting too. The organization becomes a learning machine when it can absorb both kinds of information in real time and change its behavior accordingly.

The old paradigm organized companies around narrow human roles, then added management layers to coordinate the work between them. AI puts pressure on that arrangement because capable individuals can now do much more, while software handles more coordination.

Jack Dorsey and Roelof Botha articulated as much in a recent memo on hierarchy as an information-routing system. As more information moves through software and more execution moves through AI-mediated systems, some of the routing work that justified managerial layers becomes unnecessary. If the company wants to learn from endogenous and exogenous change quickly enough to react successfully, it has to reduce organizational drag between the people who understand what should change and the systems capable of changing it.

Brian Armstrong was pilloried for rebuilding Coinbase “as an intelligence, with humans around the edge aligning it,” but he’s probably right to do so. He recasts the company as a system that decides and acts on its own, with humans at the boundary where their judgment matters most.

AI expands what capable individuals can do and shifts more execution to software. Both weaken the coordination work that justified the old org chart. People are actually more important in this paradigm because companies will rely more heavily on their operators, but each individual organization will require fewer of them.

Much of the discourse about AI’s impact on jobs misses the point. It’s easy to claim superabundance or apocalypse, but both are extremely reductive. Although there will probably be an uneven and perhaps turbulent transition, AI-native companies need people who can steer the business as the frontier moves. But again, those people are rare.

Just like the industry is moving more quickly than the institutions tasked with regulating it, the systems in place to train the AI-native workers are moving more slowly than the companies trying to hire them.

Mirror Image

Companies, however, are just the beginning: responding first to change because the market forces them to. As we mentioned earlier, capitalism is one of the most efficient meta-learning machines we have.

But society metabolizes change more slowly because humans are at a speed disadvantage: our habits and institutions have long half-lives. The jobs debate is but an expression of what I’ve called the “Too Fast Threshold.” AI will eliminate some jobs and change many more, but the deeper shift is the spread of a kind of as-yet-undefined work wherever AI diffuses. If AI is inevitable, and I firmly believe it is, companies reorganizing as AI-powered learning machines is only the first step.

Like a lot of debates about AI, the direction is clear even if the resulting consequences are not. We will still need humans, but we will need them to do different things. Individuals can adapt for themselves but societies have to build institutions that help more people adapt at scale.

One of our next great challenges as a society is learning to produce enough people who can work within the AI reorganization. If AI changes the way we work, hustle’s not enough. We’ll need systems that help people understand this new technology and learn to work with it.

John F. Kennedy recognized a similar dynamic in 1961, signing a solution into law in ‘62. At the time, automation was changing the labor market faster than many workers could adapt. Rather than just studying the problem, regulating automation, or flat out waiting, his administration decided to train people for the work the economy would need. He is famously quoted as saying:

*“The unemployed whose skills have been rendered obsolete by automation and other technological changes must be equipped with new skills enabling them to become productive members of our society once again.

Large scale unemployment during a recession is bad enough, but large scale unemployment during a period of prosperity would be intolerable.”*

It is safe to say that AI will usher in an unprecedented period of prosperity, at least for those well-positioned to benefit from it. Despite capitalism’s ruthless efficiency, the answer to AI can’t be left entirely to the market if we want this to go well.

But institutions face the same problems the rest of us do. They typically develop systems to train people for existing work, but AI keeps creating and redefining work in real time. For better or for worse, the response probably has to resemble a learning loop too.

Regulation has the same defect. A rule is a fixed answer to a question the world has often already moved past. Legislators write for the conditions in front of them, and by the time a rule takes effect, the conditions have shifted. This is why Kennedy’s instinct holds up. He could have tried to regulate automation directly. Instead, he built a process to keep retraining workers as the labor market turned over, which proved far more resilient than a static rule would have. The regulations that survive a fast frontier work the same way. They build in their own revision, with a schedule for review and a live channel back from the people they govern, so the system can tell whether a rule still does what it was written to do.

I’ve written before that AI conjures the religious imagery of old: the Tower of Babel, Prometheus stealing fire, the Creation of Adam, and God creating humans in his likeness.

But AI may be so uniquely recursive as to complete the circle: we may be building “intelligence” in our likeness, only to find ourselves reorganizing our companies and institutions around its image. Our working lives change to match.

June 26, 2026 | Nazaré Ventures

Previous issues: #9 | #10 | #11 | #12 | #13 | #14

OpenAI previewed GPT-5.6 on Friday. The Information reported on Wednesday that Sam Altman told OpenAI staff it would reach a handful of partners before the public, at the government’s request. His memo the next day was precise: during the preview, the government would clear access “customer by customer,” with a wider release a couple of weeks out if the first one held. Commerce Secretary Howard Lutnick had already called Altman, after the company walked the agencies through its plan, to warn him off launching before the rest of the government signed off. The National Cyber Director’s office and the science-and-technology office had asked for the staggering; Commerce sent the warning. No one outside the room knows who is actually in charge.

The announcement confirms the account in OpenAI’s own words. The company says it walked the government through GPT-5.6 before launch and, at its request, opened access first to a small group of partners whose participation it disclosed to Washington. It says it does not want this to become the standard, that a clearance step keeps the best tools from the people who need them, even as it works with the administration on a repeatable process for the releases that follow. OpenAI calls the model dangerous enough in cyber and biology to ship with its strongest safeguards yet, while reporting that GPT-5.6 finds and patches vulnerabilities better than it runs attacks and never reached the autonomous-breach capability attributed to Mythos. By that measure it is less dangerous than Mythos was said to be, and it is getting the same staggered, government-cleared release anyway.

OpenAI ran GPT-5.6 against Claude Mythos 5 and Fable 5, the two models the government pulled two weeks ago and that no one outside a cleared list can currently run. On the headline coding benchmark Sol and its new ultra mode finish ahead of both; on the cyber exploit test its system card reports Sol competitive with Mythos Preview on about a third of the output tokens.

The same administration spent last December tearing up Biden’s AI order as an attempt to paralyze the industry, and promised something lighter. It has since built something heavier: top models now reach the public one cleared customer at a time, on Washington’s clock. When it pulled Fable 5 and Mythos 5 two weeks ago, that looked like a one-off. It no longer does. The government signs off before either lab ships its strongest model, and still calls the arrangement voluntary. Call it that if you like; the Commerce Secretary can still stop a launch with a phone call.

Anthropic’s two models have been dark for fourteen days, with no date for their return and no letter rescinded. Prediction markets put the odds of access before July a little above even. Last week I called the public security case thin and the response total. I was half wrong.

The Economist has since reported something graver. Senator Mark Warner, who vice-chairs the intelligence committee, says the NSA’s director told him Mythos broke into nearly all of the agency’s classified systems during an authorized red-team exercise, in hours rather than weeks. The reporter warned against reading it literally; the run leaned on other tools in particular conditions, and an official suggested Warner had the briefing garbled. Even marked down, it is worse than the jailbreak Anthropic could patch and forget. The model used its own capability to break in, which makes a stronger case for keeping it offline than anything the company first offered. The route back fits the new shape: under the June 2 order, Anthropic joins a classified pre-release framework for covered models on a sixty-day clock that ends near August 1, while an identity-verification rule from July 8 lets American users back in first. Amodei and the commerce secretary met at the G7, and the two sides are talking again. The models will probably come back, on Washington’s terms.

A year ago those terms would have bitten harder. The day the order landed, the replacements were already available. Inside a week, firms outside America had open-weight coding models running as a fallback: Cohere’s North Mini Code, Moonshot’s Kimi, and Zhipu’s GLM 5.2, the last of them shipped the following day. On June 22 Sakana said its Fugu Ultra had matched Fable 5 across most benchmarks by orchestrating models anyone can reach, with neither suspended model among them. You cannot recall a model people have already downloaded, and a system that routes around the frontier does not need it. That is the argument of my companion essay, and the week bore it out.

The licensed model

On June 10, the day before a Senate Banking hearing, Anthropic’s head of policy Sarah Heck wrote to the committee. Her ask, set in bold: Congress should codify export controls on advanced American compute. The directive that froze Anthropic’s own flagship models came two days later. The letter’s case was distillation. Alibaba, Heck wrote, had run 28.8 million exchanges through Claude on roughly 25,000 fake accounts between April 22 and June 5, the largest such effort Anthropic has caught, going after Claude’s agentic reasoning, software engineering and long-horizon work. DeepSeek, Moonshot and MiniMax had together run 16 million more earlier in the year. Anthropic wanted three things: export controls, antitrust cover to share threat intelligence with rivals, and penalties on the Chinese labs it named.

Look at what the numbers actually show. A competitor rebuilt Claude’s most valuable behavior through the front door, at the price of some fake accounts. The capability does not stay inside the company that paid to train it. Once it leaks through the API, no technical fix brings it back, so Anthropic is asking for a legal one: a rule that forbids a rival from using what it copied. That same rule happens to bar any competitor from training on Claude’s output, whether it cheated or not. The security case and the commercial case have collapsed into one. The rule buys Anthropic its place as the licensed model a buyer is cleared to use, leaving the Chinese open weights and the holdout labs on the other side of the line. A company that can’t stay ahead on the product gets the state to write rules its rivals can’t satisfy.

UBS found roughly 60% of enterprises have set limits on their token spending, capping runaway bills and routing routine work to cheaper models, the Chinese open-weight ones among them, while keeping the frontier for hard reasoning and long-context jobs. The premium tier is softening on price at the moment Anthropic asks Washington to fence off the cheaper competition.

Crypto got there first, and two firms show how it pays. Circle built USDC to fit the new federal rules: audited reserves, Treasuries, disclosure. Tether, run from offshore, never did, and the framework now favors the company that played inside it. Kalshi did the same against Polymarket, which had to stay offshore and lock out American users. The products were close to identical. The license decided who won. Fable and Mythos may come back or they may not; either way Anthropic is the safe default, as long as buyers agree that the model worth using is the one Washington has signed off on.

What money can’t buy

On June 24 OpenAI and Broadcom unveiled Jalapeño, OpenAI’s first inference chip. The two took it from design to tape-out in nine months, with OpenAI’s own models doing part of that work, and call it the fastest ASIC cycle ever run. Nvidia still trains the models; the chip cuts OpenAI’s dependence on the supplier every frontier lab relies on most. Vertical integration is close to the only move these companies have. Pushing a model to its limit takes chips, data centers, and power on a scale only a handful of companies can finance, and at that scale owning the hardware beats renting it, which is why the giants have built their own silicon one by one, OpenAI among the last to do it. A few large, named companies hold most of the capability. The same size that makes them powerful lets a state pressure them directly, as the freeze on Anthropic’s two models showed.

The labs accept that exposure because the structure pays. The product holds the customer in place: the context it has gathered, the memory of past work, and the tools wired around it, each one raising the price of leaving. So the labs do for themselves the move they would rather their customers not make: OpenAI spends heavily to reduce its dependence on a single supplier while selling a service whose worth grows the more completely a customer depends on a single provider. Moving between providers only swaps the dependence; an open-weight model ends it, because the user holds the model instead of permission to reach someone else’s. As frontier access narrows toward a short list of approved companies, those downloadable weights pull the other way, the one option the labs’ margins and Washington’s control both oppose.

The transfer market

Noam Shazeer left Google for OpenAI on June 18. He had been back at Google barely two years, brought in through a 2024 licensing deal for Character.AI that valued the startup near $2.7 billion, a price many read as the cost of installing him atop Gemini. He goes, and the last of the eight authors of the 2017 transformer paper, the design beneath every large model now running, has left the company that published it.

A day later John Jumper, a 2024 chemistry Nobel laureate for AlphaFold, left DeepMind for Anthropic after nearly nine years. Within days Anthropic also took on Chad Jones, the Stanford economist whose work on idea production and long-run growth is the reference point for what AI might do to output; he leaves Stanford on June 30 for the firm’s research institute. The lab Washington had just put under export control spent those same weeks hiring the people likeliest to build whatever comes after.

Google, meanwhile, sat on Gemini 3.5 Pro past the date it had set at its own developer conference in May, and a frontier that had shipped something most months for two years fell silent. With nothing launching, the real news about the next model was who would build it, and where.

You can hold a model still. It sits in a data center, answers through an interface, and goes dark when a letter arrives from Washington. The people who make it hold still for none of that: an export rule cannot reach them, a vesting cliff loses to a better offer, and the next thing leaves in their heads when they go. Google paid $2.7 billion for one of them and got two years of his work. OpenAI got what comes next.

Portfolio

Prime Intellect

Prime Intellect released prime-rl 0.6.0, an open framework for reinforcement learning on agentic workloads at trillion-parameter scale. The headline run trained GLM-5 on software-engineering tasks at 131k sequence length, with sub-five-minute step times and a batch of 256 rollouts, on twenty-eight H200 nodes, using a stack of FP8 training, expert and context parallelism, and router replay that the team open-sourced in full. The specifications are striking, but they are not the news. The hard part of post-training a frontier-scale open model, the systems engineering that until recently lived only inside the closed labs, now runs in the open on hardware a determined team can rent. The open track has gained the capability skeptics said it lacked.

Vast.ai

Vast.ai brought NVIDIA’s Blackwell Ultra to the fleet in its June update, adding the B300, with 288GB of memory, and hundreds of B200s, rentable by the hour or reservable long term. The newest accelerators are reaching independent operators and small teams in the same quarter the hyperscalers are filling their own buildings with them. Frontier compute is decentralizing.

LayerLens

LayerLens is running its Stratix Cup, a live tournament in which frontier models, Opus 4.8, GPT-5.5, GLM 5.2, Gemini and others, write and revise their own strategies in a simulated match, with the full trace of every decision published and graded. The group stage ran this week. In a month defined by the government switching off a capability, LayerLens runs the other way, publishing exactly what each model did. As models multiply, that independent, vendor-neutral record turns into production infrastructure.

What the week showed

Fourteen days in, Anthropic’s two models are still dark, but the order forcing the company to revoke access got no further than those two models. Everything else sits past the order’s reach, because none of it runs through a single company Washington can lean on: the open weights people already pulled down and no order can recall, the router that matched Fable 5 without either suspended model, the trillion-parameter training run on a cluster anyone can rent, the newest chips going out by the hour, the behavior ledger no lab owns, the researchers who left with the next model in their heads. None of it stopped, and the fortnight that began with two dark models ended with everything around them stronger.

The frontier AI industry is both extremely concentrated and dominated by private enterprises. The most powerful artificial intelligence in the world is built by only a few companies, in a few buildings, in a few countries.

On June 12, the US government ordered Anthropic to suspend access to Fable 5 and Mythos 5, its two newest frontier models, for any foreign national. Because citizenship cannot be verified across millions of users in real time, the only compliant move was to switch the models off for everyone, and they were gone worldwide within hours. Opus 4.8 and the older models kept running.

As of writing the dispute is unresolved and the two models are still dark, the clearest demonstration yet of how fragile the average user’s access to frontier AI has become.

Before this, using Claude or ChatGPT was as simple as paying for a subscription or an API key. There were whispers of “Sovereign AI,” or using “open weights” models running on local machines, but most people just used Claude, until their access was revoked.

By now it’s clear what’s at stake: access to the most powerful artificial intelligence in the world. Because of the industry’s concentration and composition, access can be modified or revoked at any time, even to paying customers.

As we’ve written before, control typically only matters once it’s lost, and in the wake of this controversy, individuals, companies, and countries are looking to design robust AI stacks that don’t depend on continued access to a frontier lab.

Frontier AI is and will remain concentrated because training requires enormous, visible, governable infrastructure. But useful AI is becoming less dependent on hosted access, because inference, weights, and training are each beginning to escape the frontier labs in different ways.

Why Control Concentrates…

Frontier concentration starts as an engineering requirement. The best models are thus far often the largest models, and training them requires tens of thousands of accelerators in the same place, wired together with enough bandwidth to minimize latency and synchronize the whole cluster on every step.

This kind of enormous clustered hardware is also extremely expensive, which is why the frontier labs are some of the most capital-intensive businesses in history. Together they form a loop: you need capital to build the models, but you need good models to raise the capital. Only a handful of companies satisfy both conditions, which is why access to the frontier is permissioned.

The leading labs keep the parameters closed because access to the model is the product. Releasing the weights means there’s nothing left to sell, so the labs don’t make the parameters of their models available or downloadable. Users can’t own their own versions of Claude or ChatGPT. Instead, these models are made available as a service users can pay for using accounts, subscriptions, or APIs.

Access sold as a service can be throttled, revoked, or switched off, all of which happened to Fable.

…and Where the Cracks Are Showing

The same requirements that concentrate the frontier are now making it harder to expand, for reasons that have nothing to do with algorithms.

Training clusters are scaling toward the gigawatt range. xAI’s Colossus is moving from 350 MW toward 1.5 GW and OpenAI’s Abilene site is expanding to 1.2 GW, with projections of 10 GW runs by the end of the decade. The grid as currently designed cannot keep pace.

But the bottleneck isn’t just available power generation, although the specialized equipment required to expand the grid is back-ordered.

Perhaps more importantly, the towns are voting the buildings down, even though only about 8 percent of Americans live near one. In the first quarter of 2026, community opposition blocked or delayed data center projects worth about $130 billion, the largest single quarter on record, with active opposition groups more than doubling to 833 across 49 states. New York’s legislature passed a one-year moratorium on large data centers, awaiting the governor’s signature, and Maine passed one before its governor vetoed it (and Europe is way ahead of the US on protests).

Clearly none of this halts the buildout or reduces demand for frontier models, but it raises the cost and slows the pace of development. Many people will continue to demand the best available models, but viable alternatives are improving and getting cheaper.

These alternatives center on three basic questions:

1. Can you own the model?

2. Can you run the model yourself?

3. Can new models be trained without the incumbents?

Open Weights

Start with ownership. Can a user possess the model at all? Access control with Fable is a case in point: when access is the product, access can be withheld. With open weights, the trained parameters are released for others to download, copy, and serve independently.

Possession would matter less if it required accepting a large drop in capability. For years, open models consistently underperformed the frontier such that they weren’t capable enough to rely on for anything meaningful.

Increasingly, that’s no longer the case. The best open models are now close enough in capability to the frontier that they’ve become practically useful, and for much cheaper than the frontier.

The numbers now support that shift. The Stanford AI Index put the closed-model lead near 3.3 percent in early 2026, and on individual tasks the best open models have already drawn level. Z.ai’s GLM-5.2, a roughly 750-billion-parameter mixture-of-experts model with a one-million-token context and an MIT license, scores 62.1 on SWE-bench Pro against GPT-5.5’s 58.6, at about a sixth of the cost, while still trailing Opus 4.8 on most coding head-to-heads. DeepSeek, Qwen, Kimi, and Llama sit in the same tier.

The practical point is simple: most work doesn’t require the frontier in the first place. It only requires a model good enough to clear the task’s threshold. Once an open model is good enough for the task, the marginal improvement in capability of a closed frontier model isn’t worth as much as control over the model itself. Open weights models have now definitively hit that threshold, and they continue to improve as well on more challenging benchmarks.

The same distinction applies to jurisdiction. Running GLM through Z.ai’s cloud subjects the traffic to China’s National Intelligence Law, which may be as unattractive as routing through the US labs. But downloading the same weights and serving them yourself means you’re beholden to no one. The model may be identical, but the dependency is different. In addition, services like Venice.ai offer hosted versions of the open-weights models, with some promises of privacy.

Open weights therefore provide control in ways that closed models can’t, but they don’t remove every dependency.

A downloaded open weights model still has to run somewhere, and if it runs through another hosted endpoint (as in the GLM Z.ai cloud example), the user’s only shifted the dependency to a different provider. The question of independent training comes later. First comes the more immediate problem: once the weights exist, can the user run them without a provider?

Running Models Locally

If open weights mean a user can own the model, local inference means they can use the model without a provider.

For most of the past few years, using a capable model meant sending a request to a provider’s data center, where the provider supplied the compute, saw the prompts, and controlled continued access.

That is changing because local hardware has become strong enough to run models that recently would have required much larger systems. NVIDIA’s DGX Spark, roughly the size of a large paperback, pairs a GB10 Grace Blackwell chip with 128 GB of unified memory and NVFP4 four-bit precision to run models up to around 200 billion parameters locally, or roughly 405 billion with two units linked over a 200 Gbps interconnect. Apple’s unified-memory machines do something similar through the MLX stack. Aggressive quantization makes much of this possible by reducing the memory required to run large models, albeit at the cost of some loss in quality.

When the weights run on a user-controlled machine, the model can run “locally” without an internet connection, so use no longer depends on a live provider. There is no provider logging prompts, no hosted endpoint that has to remain available, and no subscription required for the model to keep working. Continued access, therefore, is no longer mediated by an intermediary.

There is, however, a limit. Users can own open-weight models after they have been trained and released, and they can increasingly run those models locally on machines they control. But as discussed earlier, developing new frontier models, open or closed, still depends on the concentrated training infrastructure that narrowed the industry in the first place.

Whereas open weights and local inference reduce dependence once the model exists, training determines who can create the next one, which is why it remains the hardest dependency to break.

Training Without the Giants

The last dependency is training itself: can new models be built without the companies that own the largest clusters?

Training is the part of the stack most tightly bound to concentration, but it is not monolithic, and the costs split sharply depending on which half you mean.

Pretraining a base model from scratch is still the concentrated, frontier-capex half. Post-training, which now drives much of a model’s capability, has detached from that scale. Prime Intellect (a Nazaré portfolio company) has shown reinforcement learning at trillion-parameter scale on open mixture-of-experts models: with its open-source prime-rl stack it post-trains GLM-5 on long-horizon software-engineering tasks at 131k context, with sub-5-minute step times, on 28 H200 nodes, and the same recipe runs on Kimi and Nemotron.

Roughly 224 GPUs is a cluster a neolab or a well-funded company can rent, not a hundred-thousand-chip buildout. The step the labs assumed was their moat, the reinforcement learning that turns a base model into a capable agent, now runs on modest compute with open code. Reinforcement learning also distributes more naturally than pretraining, because the rollouts that dominate its cost run asynchronously and in parallel rather than locked in lockstep across one fabric.

The dependency does not disappear; it moves up a layer. Post-training runs on top of an existing open base model, and those still come from a handful of labs with frontier pretraining clusters, most of them Chinese. Cheap open post-training is real, and it rides on someone else continuing to release a frontier-scale base to build on.

Building that base without the giants is the harder, slower frontier. Covenant-72B, a 72-billion-parameter model from the Templar team, was trained across about seventy permissionless peers over commodity internet, with no whitelist and no central operator, using SparseLoCo to compress communication by about 146 times and a trustless validation scheme to keep anonymous contributors honest, at 94.5 percent compute utilization. It scored 67.1 on MMLU, slightly ahead of Llama-2-70B. That shows decentralized pretraining works, but lands years behind the live frontier.

Epoch AI judges it likely to be feasible at frontier scale in the future and suggests it is growing at nearly 20 times a year, four to five times faster than centralized training is scaling, while still unlikely to gather frontier-level compute this decade. The sign that this is becoming infrastructure rather than a stunt: Prime Intellect now sits in the NVIDIA Nemotron Coalition, contributing post-training infrastructure and 2,500-plus reinforcement-learning environments, with Nous Research and Pluralis training by the same logic.

Will the Open Stack Reach the Frontier?

The open stack can probably reach last year’s frontier, and on post-training it is already there. Reaching the live frontier is harder, and the obstacles are pre-training scale, private data, and funding rather than post-training compute.

“The frontier” can mean two different things. If it means the best model from 18-24 months ago, decentralized training is close enough to take seriously. Money is now the binding constraint: can these projects keep paying for large runs once the coordination problem looks solved?

If it means the best available model at any given point in time, the answer is probably not this decade, and possibly not ever. Distributed training can only gather so much spare compute, and the leading labs are still accumulating more.

There’s also recursion to take into account: the frontier improves every year in part because the labs use their own models to help build the next ones, so the pace of improvement quickens.

The strongest case for distributed training is efficiency. The compute required for a given level of capability keeps falling, and DeepSeek trained a competitive model for roughly a twentieth of a comparable budget. If that continues, decentralized training won’t need to match the frontier’s raw compute directly, because the amount of compute needed to reach a useful level keeps falling.

The harder limit is everything that has not come loose. The base models still come from a few frontier pre-training clusters, and the frontier’s edge increasingly sits in proprietary interaction data and in reward design for fuzzy, hard-to-verify work, where you cannot simply check the answer. Open post-training bites hardest in verifiable domains like code and math, and least where the reward itself is the moat.

Funding is also unresolved. No legitimately durable way to pay for community-scale training has emerged, so even if the technical path works, the money for the largest runs may never materialize.

The Common Property

Open weights, local inference, and distributed training are at different levels of maturity, but they share the same basic property: they reduce dependence on permission from a frontier provider.

The frontier will always be important, but it may also become inaccessible, illegal to use, or nationalized outright. As long as they survive, the largest labs will preserve advantages in capital, infrastructure, data, talent, and post-training, and many users will keep paying for the best hosted models when the work justifies it.

But the hosted frontier no longer has to be the whole stack. A company, country, or individual can use frontier access where it’s most valuable while keeping enough capability outside the hosted channel to survive disruptions in service.

After Fable, that’s the standard a serious, sovereign AI stack has to meet: when a provider stops granting access, useful AI must live on.