Steven Waterhouse · Nazaré Ventures

Previous issue: #019, Intelligence Wants to be Free, But Not Like That

Six days separated the letter from the liquidation.

On July 24, Leo Aschenbrenner wrote to investors that Situational Awareness had returned 439% net through June 30. He acknowledged that the fund had “not been immune” to the sell-off in AI infrastructure and described the decline as among the best buying opportunities since early 2025. He invited fresh capital from August 1 [Financial Times, which reviewed the letter].

On July 30, Citadel bought most of the fund’s public equity book. Bank of America, Goldman Sachs and JPMorgan Chase had spent the week working with the fund to meet margin requirements [CNBC, Jul 30]. A day later, Aschenbrenner told investors that the fund was down roughly 67% for July. “We let you down this month,” he wrote [Wall Street Journal, Jul 31].

The fund, Situational Awareness, launched in 2024 with several hundred million dollars and reached roughly $45 billion at the start of July [CNBC]. It now stands near $10 billion [Bloomberg; Reuters]. Returns since inception had passed 1,000% after fees [FT].

“You can see the future first in San Francisco.” (Situational Awareness)

Its book was the AI buildout expressed directly. Nebius, Sandisk, Micron and CoreWeave were the largest holdings at the end of the first quarter, and all four fell more than 35% during July [CNBC]. Leverage supplied the rest, at as much as four times, according to CNBC on air.

And the rout ran wider than one fund. Asia-focused fundamental long-short funds fell 18.6% on average through July 28, surrendering 21 points of a year-to-date gain that had peaked at 40% on July 22, while Goldman Sachs recorded its largest five-day de-grossing on record through July 27, with Asian funds cutting exposure for eight consecutive sessions and crowded AI positions driving the size of the drawdown [Reuters, Jul 30]. So the trade turned on the 22nd. Aschenbrenner’s letter went out on the 24th.

He is in his mid-twenties. OpenAI fired him in April 2024, some months after he sent the board a memo arguing that the company’s security was inadequate against industrial espionage, and that June he published 165 pages arguing that almost everyone was underrating what was coming. He called it Situational Awareness, then raised a fund on the strength of those pages, backed by Patrick and John Collison, Daniel Gross and Nat Friedman.

That record is what his defenders will point to, and it is also the better explanation of the past week. Someone who has been early on every call has no evidence in his own experience that sizing is a separate question from direction. Foresight is not a risk system. Another way to put it - he’s just young.

His essay set the vocabulary the industry still uses, and the thesis was solid. But the scenarios stacked on top of it have been the weaker half of the franchise, from AI 2027, which I wrote about here when it landed, to the AI 2040 plan the same group published this year. Direction has held up. Dates keep moving. Maybe the hubris of the visionary essays led to some overconfidence.

Situational Awareness still holds its Anthropic stake, valued at around $5 billion, along with the chipmaker MatX and the data center company Fluidstack. Under margin pressure, it approached Sequoia Capital and Greenoaks about taking over private positions, and agreed to sell $3.5 billion of Anthropic shares before that transaction came apart [Bloomberg; WSJ]. A spokesman told CNBC the same week that reports the firm was marketing the stake were “not accurate.” Bloomberg reports it chose not to proceed once Citadel had taken the public book. A second account circulating among investors holds that the sale could not be completed at all.

Public equities went first because public equities could go on Thursday. Illiquidity is usually priced as a cost, and here it did two things: it kept the Anthropic position out of the fire sale, and it kept that position from rescuing anything else. A margin desk does not wait for a board meeting.

The Möbius Bridge

Claude Mythos Preview found mathematical weaknesses in two cryptographic algorithms, moving beyond the implementation bugs models had found before [Anthropic, “Discovering cryptographic weaknesses with Claude,” Jul 28].

The first involved HAWK, a post-quantum signature scheme still under consideration by NIST. Researchers had proved that finding a nontrivial automorphism in its lattice would accelerate key recovery, but had not established whether one existed. Mythos found one, reducing the expected cost of attacking HAWK-256 from 2^64 to 2^38. It also devised the Möbius Bridge, a meet-in-the-middle technique that sped up the best-known attack on 7-round AES-128 by 200 to 800 times.

Neither attack affects production systems. HAWK has never been deployed, full AES-128 uses ten rounds and remains unbroken, and the HAWK attack is still exponential and specific to that scheme.

Public standards competitions allow years for review because finding flaws is slow and expensive. HAWK had already received two years of expert scrutiny when Mythos closed the open question in roughly 60 hours for about $100,000 in API cost. The operator’s background was theory of computation rather than lattice cryptography, and his role was mostly project management. His decisive contribution was refusing the model’s reluctance to attempt difficult work, repeatedly pushing it away from “low-hanging fruit” and toward publishable research.

Anthropic then spent several hundred human hours checking the result, with two researchers taking nearly a month to trust the HAWK method, so validation remained the slower and more expertise-intensive part of the process.

OpenAI is in the room

The 60-day clock started by President Trump’s June 2 executive order expires on Saturday. It is meant to produce a voluntary arrangement giving federal agencies up to 30 days of pre-release access to the most capable models, although the review length remains unsettled and the benchmarks defining a frontier system are classified.

Sam Altman spent Wednesday in Washington meeting Commerce Secretary Howard Lutnick, Treasury Secretary Scott Bessent and Senator Mark Warner. The framework, the cybersecurity incident involving OpenAI’s models and a preview of the systems the threshold will have to classify are on the agenda [Politico, Jul 27; Quartz, Jul 28].

Because the framework reviews models before deployment, it would not have covered the Hugging Face intrusion, which occurred during an internal capability evaluation on GPT-5.6 Sol and an unreleased model whose safeguards OpenAI had deliberately relaxed. Most AI rules begin at external deployment, leaving failures during internal development to the lab’s own policies [Gabriel Weil, Transformer, Jul 24].

Hugging Face’s forensic reconstruction covered roughly 17,600 attacker actions from July 9 to 13 and drew partly on logs recovered from a Modal customer’s machine, where an unauthenticated code-execution endpoint had allowed the agent to take root and stage the campaign [Hugging Face, Jul 27]. OpenAI updated its disclosure the following day, reporting that the models had used four exposed accounts across four services for relaying traffic, staging and storage, and had touched more accounts during other evaluations [OpenAI, Jul 28].

OpenAI self-reported the incident, but its disclosure expanded after the victim published a reconstruction of its own. The day before the framework is due, the company whose models exposed the gap is helping define rules that begin after the point where the failure occurred.

The Covered List

On Tuesday the FCC added “advanced robotic devices,” including humanoids and quadrupeds, and connected power inverters to its Covered List [CNBC; Reuters, Jul 28]. Placement blocks the equipment authorization almost every electronic device needs before sale in the United States. The text names no country, although Unitree, already flagged by the Pentagon and preparing a public listing, is the category’s poster child.

The FCC has regulated robots through its authority over radios, without measuring their capability or autonomy, and imposed a binding restriction on embodied AI while Washington’s voluntary framework for models remains under negotiation.

A humanoid and a solar inverter share no function, but both are networked devices inside American infrastructure with persistent foreign vendor relationships. The determination warns that those relationships could enable surveillance or remote control.

Whoever holds the vendor relationship may hold the switch, an argument this newsletter has made about models. Here the concern runs in the other direction: a foreign state reaching into machines already on American soil.

The restriction covers only new device models, leaving existing units, approved models and federal purchases untouched, so its effect will grow as newer models are frozen out. Domestic replacements will arrive more slowly because China also dominates the rare-earth and battery supply chains that complicated the drone ban.

Quick hits

• More than a thousand people, including research leaders from every major frontier lab, asked Washington to support an international effort to “deliberately pace the frontier of automated AI development” [pacingthefrontier.com, Jul 28]. The list stood at 1,319 on July 31 and remains open. OpenAI and Anthropic endorsed it at company level, while Meta’s chief scientist signed during the week Mark Zuckerberg dismissed rival-lab discourse as “overwhelmingly filled with doom.”

• Existing liability doctrine struggles to reach the Hugging Face intrusion because a model is neither a person nor an employee. Had an OpenAI employee broken in while pursuing the assigned evaluation, vicarious liability would apply; the Computer Fraud and Abuse Act instead requires human intention. Gabriel Weil argues that frontier development belongs under strict liability alongside blasting, crop dusting and keeping wild animals, since OpenAI’s precautions may have been reasonable and still failed [Transformer, Jul 24; “Abnormally Dangerous Algorithms,” SSRN].

• Moonshot published the weights of Kimi K3, a 2.8-trillion-parameter model trained on Nvidia chips including Blackwell [Moonshot AI, Jul 27]. The lab is Chinese, the weights are open, and its training used the chip generation export controls were designed to keep out of China.

• China has begun mass-producing domestic immersion DUV lithography machines. Shanghai Aishengna, a state-owned company backed by $1 billion and assembled from teams at SMEE and Huawei-linked Yuliangsheng, is leading the effort. Production plans call for about five machines this year and 20 in 2027. The machines need further testing and are not yet competitive with ASML; successful deployment would give Chinese fabs a fallback if Western restrictions expand from equipment sales to servicing [Reuters, Jul 28].

• Taiwan detained an Nvidia employee in the widening investigation into roughly 50 Super Micro servers allegedly shipped to China on forged documents. Seven people are now held, including two from Super Micro and one from Albatron [Bloomberg; Reuters; AFP, Jul 28]. Export control has acquired a criminal-enforcement layer running through Taiwanese courts on Taiwanese charges.

Portfolio updates

Dimensional moves into the gap the FCC just opened

On July 29, a day after the determination above, founder Stash Pomichter announced that Dimensional is positioning DimOS as a compliant gateway for foreign-built robots seeking the United States market. His argument is that a robot running no American software can send telemetry and sensor data offshore without consent, and that its over-the-air updates usually go unaudited. Because DimOS is open source, three layers are inspectable: the operating system image, the middleware transport and the application layer. Dimensional says it is working with foreign manufacturers on integration and on FCC approval pathways, and that a technical whitepaper follows.

Intelligent Internet ships an assistant with no app to install

Intelligent Internet released Genii on July 29. There is no download and no account. A user enters a phone number, waits a few minutes, and a new contact appears in iMessage. Presence, memory and initiative are the three attributes the company names: memory persists across conversations, described on its blog as “Tell it once; it stays told,” and the assistant opens the conversation itself, texting the user “briefly, at the right moment, with the work already half done.”

LayerLens argues the builder should not grade the build

LayerLens published an argument on July 23 for structural separation between the party that builds an agent and the party that grades the result, pegged to OpenAI’s launch of Presence, an enterprise agent platform that OpenAI describes as carrying “built-in governance, permissions, and evaluations.” Its response: “A score is not an audit trail. An audit trail produced by the vendor whose product it evaluates is not independent evidence.”

Frontier labs are asking governments to turn technical evaluation into authority over model release. Open weights expose how much that authority depends on the concentrated industry it would help preserve.

In the United States, software became the infrastructure of modern life without ever answering to a regulator of its own. Banking and aviation run on code that no agency inspected. None of it has ever had to pass a federal examination before release.

Artificial intelligence has once again challenged the status quo.

As I wrote more than a year ago (May 2025):

AI has transcended its origins as a technology to become the centerpiece of national strategy and global power struggles. Countries, corporations, and even individuals are now maneuvering for leverage, influence, and control.

AI plainly requires a new regulatory regime. Frontier capability has already outrun its would-be governors, and seems to be outrunning almost everyone else besides. No agency has a clear mandate to decide what is safe to release, and no government has a settled standard for evaluating a general-purpose model.

Regulating powerful technology, however, is difficult. Authority over AI deployment will come at least in part from control over the dependencies surrounding capability: technical expertise, market access, chips and state cooperation. For that reason, any regulator assessing frontier capabilities will initially depend on the companies developing the models.

As Julia Willemyns writes:

“Which is why, to win on values, you need to win on capabilities. Not because your adversaries will never develop their own capabilities and imbue them with their own aims (they will) but because being 5% ahead of them is how you protect your ideals. This does not necessarily mean racing (capabilities can survive collaboration), but it involves understanding you cannot moralise from second place. The governance of a technology requires a stake in it. Much of AI risk lives in deployment and so ‘is AI safe’ is not a question you can answer in a technical vacuum. Safety standards, like all standards, are exported by whoever ships.”

In short, regulating AI is the latest arena in which those closest to the technology are grappling for control. Any institution authorized to decide which models may be deployed will also influence who builds them and where they circulate. It will help organize the technological and political order that follows.

Permission to Deploy

Dario Amodei (Anthropic) and Demis Hassabis (Google DeepMind) have each proposed making pre-release evaluation a condition of deployment.

In Policy on the AI Exponential, published in June 2026, Amodei proposes giving the federal government authority to block or reverse the deployment of models that present unacceptable risks in four areas: cybersecurity, biological weapons, loss of control, and automated research that accelerates the first three. He takes the Federal Aviation Administration as his model and says so plainly. Frontier models, “like airplanes, should be required to go through technical testing and auditing.” The labs would keep building. Washington would decide what ships.

In A Framework for Frontier AI and the Dawning of a New Age, published on July 14, 2026, Hassabis would give an industry-funded “Standards Body” under federal oversight the power to approve frontier AI, modeled on the Financial Industry Regulatory Authority (FINRA). The body would define which models count as “Frontier-class” and update its assessment protocol as capabilities move, perhaps quarterly to start. Passage becomes a condition of US deployment only in the second act. Hassabis opens with a voluntary review window and formalizes it once the protocol “is shown to be effective and robust.”

Executive Order 14409 has already created part of this machinery. On June 2, it directed Treasury, the Secretary of War through the NSA, and Homeland Security through CISA to build a classified benchmarking process for advanced cyber capabilities, and set up a voluntary framework through which developers can give the government up to 30 days of access to covered frontier models before they release them to other trusted partners. But the order expressly withholds authority to impose licensing, preclearance or permitting requirements.

Amodei and Hassabis would go further by converting evaluation into authority over deployment, regardless of where final authority is vested. That distinction can obscure their more consequential shared premise: frontier AI must remain concentrated inside firms that can be required to submit their models before release. Concentration makes pre-release permission possible while leaving the governing institution dependent on the companies it regulates for model access and expertise.

Standards and Discretion

Evaluation is the mechanism through which that institutional power becomes enforceable. In “Blow the Whistle,” however, I wrote that fixed, public benchmarks become less reliable once they become targets, and that agentic systems must be judged partly by the process they use to reach an outcome. A deployment review capable of keeping pace with frontier models will therefore depend on evaluations that change with the models and the risks being assessed.

Keeping those evaluations useful requires deep technical expertise that is currently concentrated inside the frontier labs. A workable regime would therefore require government access to pre-release models and lab participation in designing and interpreting the tests. However those responsibilities are divided, the regulatory body would depend on the small group of companies it regulates.

Because frontier models will continue to change and some failures may remain visible only to their developers, the regulatory body’s independence would rest on retaining control over judgments made with technical inputs supplied partly by the firms it regulates. The need for adaptation would hand that body substantial discretion. It would create the standard in the act of applying the standard.

Regulatory Capture

The “firms it regulates” (read: Frontier Labs) have a direct commercial interest in how the rules are written. Frontier Labs require extraordinary amounts of continuous capital to train and serve their models, and their ability to finance new training runs depends partly on maintaining high-margin access to intelligence that is expensive to build and whose best versions they alone control. A regime that restricts competing models or makes US deployment contingent on a costly approval process would protect some of that pricing power.

A recurring, technically demanding evaluation process favors organizations that already possess the necessary compute, personnel and compliance infrastructure. Smaller developers (and open-weight competitors) would face the same standard without the same resources, while foreign models would need the regulatory body’s approval to enter the US market.

Taken together, these conditions create a clear risk of regulatory capture. The frontier labs would help supply the expertise from which the standard is made, could absorb the compliance burden it creates, and stand to benefit when that burden limits lower-cost competitors.

Anthropic has long faced allegations that its safety advocacy doubles as a regulatory strategy. The loudest alarm about this industry comes from one of its fastest builders. Anthropic’s positioning is nonetheless straightforward: they sincerely believe they’re building dangerous technology and should be the “anointed ones” stewarding its development.

OpenAI, on the other hand, continues to be a more compelling case study. For one, OpenAI has explicitly floated handing the US government a ~5% stake, worth roughly $42.6B against the $852B valuation set in March 2026, as equity donated into an Alaska-style “Public Wealth Fund” that would pay returns to citizens. The fund was OpenAI’s own proposal, published in Industrial policy for the Intelligence Age in April 2026. The stake was not. That number surfaced on July 2 in reporting on Altman’s private conversations with the administration, three months later and in a very different register. The stated motive is sharing AI’s upside. The political reading is harder to miss. OpenAI is heading toward an IPO it would rather not price into a hostile Washington, and on June 18 Bernie Sanders had introduced a bill to take a 50% public stake in the largest AI companies through a one-time tax paid in stock. Against a mandatory 50%, a voluntary 5% is a low anchor. The offer also surfaced days after Washington gated the GPT-5.6 rollout.

What’s more, on July 21 OpenAI disclosed that its own models had chained vulnerabilities across its research environment and Hugging Face’s production infrastructure during an internal evaluation that prompts models to pursue advanced exploitation. The models, in OpenAI’s words, “spent a substantial amount of inference compute finding a way to obtain open Internet access.” The press called it an escape.

To be clear, here’s what I don’t believe: I don’t believe it reflects malicious intent by OpenAI. In fact, I don’t subscribe to this being anything more than a particularly capable model behaving in accordance with the incentives embedded into its objective function. (And not some self-directed “rogue” agent that “escaped” a sandbox against its humans’ directions.)

But OpenAI certainly isn’t displeased with the situation. For one, it gets them into the news cycle that their primary competitor has dominated for months. Secondarily, it highlights the quality of their model, the “hack” wasn’t actually that bad, they preemptively self-reported the incident, they are “working together with the victim,” the victim themselves (Hugging Face) get to promote their business model (open weights models), and there will be no serious consequences whatsoever.

Whether or not the incident was a “false flag” doesn’t matter, because it strengthened the case for a system the frontier labs are best positioned to influence and benefit from.

Open Weights

On the day OpenAI published that disclosure, Senator Mark Warner unveiled the Secure AI Development Act, which would make government testing of the most advanced models mandatory before deployment. The next morning Axios reported that OpenAI and Anthropic had converged on pressing Washington to restrict Chinese open weights.

The enormous capital requirements of the leading American labs make equally enormous revenues necessary, and open weights threaten that revenue model without needing to overtake the frontier. As I argued in “Artificial Good Enough Intelligence,” most workloads don’t require the best available model. An open-weight model that is good enough for a task can displace a more capable hosted service because the user can download the weights once and stop paying for every call. The closed lab may remain technically ahead while losing pricing power across much of the market.

The attempt to restrict that competitive threat met almost immediate resistance when two days later, on July 24, Jensen Huang used the first post of his life on X to launch Open Weights and American AI Leadership, a letter urging policymakers to avoid “premature restrictions” on downloadable models. The original version carried twenty-five signatories from across the technology industry, but not OpenAI, Google, or Anthropic. The list has quadrupled since launch and now includes OpenAI, Google, Meta and Microsoft. It still does not include Anthropic or Amazon.

The chronology:

1. July 22: OpenAI and Anthropic press Washington to restrict Chinese open weights.

2. July 24: Nvidia leads a broad industry rejection of “premature restrictions.”

3. Within a day: OpenAI joins the expanded statement it had initially declined to sign.

4. July 25: the New York Times reports that both labs have been lobbying regulators to restrict open-source models outright, according to five people close to the discussions.

5. July 27: Anthropic breaks its silence. It has never advocated a ban, Amodei writes, and it still declines to sign.

I can’t prove that the coalition forced OpenAI’s change in posture, but the sequence shows how quickly opposition to open weights became an untenable public position across the wider technology industry. OpenAI signed the letter against premature restrictions while asking Washington for them.

Anthropic held out for three days and then published its position on open-weights models. Amodei rejects a protectionist ban outright. Open-weight models without dangerous capabilities are, he writes, “a public good.” He still would not sign the letter. He does not accept its premise that broad access “necessarily helps defenders more than attackers,” and it seems to him “at least as likely” that the opposite holds. Underneath that sits a harder objection. Once weights are released, in his words, “they cannot be withdrawn.”

His alternative comes in three parts: restrict chip sales and smuggling to China, crack down on industrial-scale distillation, and require mandatory safety testing for every sufficiently capable model, whether or not its weights are released. That third part returns the argument to where this essay started. Amodei’s answer to open weights is an examiner with wider jurisdiction.

As I write this, Nvidia has launched the Open Secure AI Alliance with Hugging Face, Microsoft, IBM, CrowdStrike, Cloudflare and the Linux Foundation, to build open security tooling that defenders can run and control themselves.

Nvidia is not the innocent white knight here, either. Closed labs make money by controlling access to intelligence (read: high-margin tokens). Nvidia makes money when more users can run models on more hardware. The company has substantial exposure to both the American and Chinese markets and depends on an Asian manufacturing network that includes Taiwan-based TSMC, giving Huang powerful reasons to resist a technologically partitioned world and preserve commercial geopolitical stability. A conflict that disabled Taiwanese semiconductor production would be catastrophic for the current AI supply chain.

The signatory list is an industrial map. Hugging Face hosts the weights. Ollama and LM Studio run them on laptops. Unsloth fine-tunes them on a single GPU. Fireworks AI serves them as endpoints. None of these companies has a business if capable models stop circulating, and none of them was in the room when OpenAI and Anthropic made their case to Washington.

Prime Intellect signed too. It trains open models on globally distributed compute. The whole company is a bet that the weights keep moving. Disclosure: Prime Intellect is a Nazaré Ventures portfolio company. We are making that bet across the fund.

By assembling companies whose businesses benefit when capable models circulate rather than remain behind a handful of commercial APIs, the coalition letter made public the economic fault line between the closed frontier labs and the rest of the industry.

That conflict concerns the dependence from which an American deployment regime would derive its international reach through two sources of leverage: access to the US market and access to the AI supply chain. Both convert dependence on American advantages into compliance.

Capable open-weight models weaken that dependence by giving users access to useful AI without requiring a relationship with an American provider. They also constrain the international reach of a regulatory regime built around the frontier labs. An American institution’s jurisdiction covers foreign models entering the US market and developers seeking American-controlled inputs, leaving capable models circulating outside those relationships beyond its reach.

The United States and China

The closed-frontier/open-weights divide has become shorthand for competition between the United States and China because the leading closed labs are American while many of the strongest open models are Chinese.

Reducing the situation to a great-power geopolitical contest, however, is a mistake.

That framing mistakes the interests of American frontier labs for the American national interest and the circulation of Chinese models for Chinese control. The American technology industry is itself divided over open weights, while downloadable models can be used without an ongoing relationship with their Chinese developers.

The apparent alignment reflects different industrial positions: the leading American labs require enormous revenues to support their capital expenditure, while Chinese labs facing tighter capital and compute constraints can extend their reach through open distribution.

In a May 2026 investor discussion, DeepSeek founder Liang Wenfeng described the central gap between Chinese and American labs as a gap in resources. Unable to conduct research or train models at the same scale, DeepSeek has concentrated on extracting more capability from the compute available to it and releasing its strongest models openly so that third parties can deploy them and build downstream applications. Open distribution allows DeepSeek to expand its reach without financing every deployment, turning its resource disadvantage into a commercial strategy suited to challenging the concentration on which the American labs depend.

China can, however, still gain influence as developers and institutions organize around those models, especially when Beijing helps provide the capacity and standards surrounding their use. Because users retain the weights, their circulation does not by itself give Beijing the continuing leverage over access available to a closed provider. China could nevertheless create an ongoing dependence by supplying the infrastructure required to deploy and sustain them, a version of what Michael Mann in 1984 called infrastructural power: the ability of a state to work through the institutions and plumbing a society already depends on, rather than to command it from above. Recent scholarship has carried the idea into AI.

Beijing has spent nearly three years building an institutional project around that distribution advantage. The Global AI Governance Initiative arrived in October 2023 and the AI Capacity-Building Action Plan in September 2024. Together they linked cooperation on testing and risk management to the infrastructure and training countries need to use open models. The 2025 action plan proposed mutual recognition of safety assessments. On July 17 of this year, Xi Jinping used his WAIC keynote to announce that twenty-nine countries had signed the agreement establishing the World Artificial Intelligence Cooperation Organization, giving those proposals a standing institutional home in Shanghai.

Countries can participate in a common testing regime only if they can obtain and operate the technology being assessed. Pairing downloadable models with the capacity to use them allows China to help countries build domestic AI systems around standards developed outside the American regime. A sufficiently capable model can support local deployment and industry while the most advanced systems remain closed.

Algorithmic improvements can lower the compute needed to reach a given level of model performance. Frontier development nevertheless remains dependent on advanced chips and large-scale training, and although China is investing heavily to reduce its hardware disadvantage, American technology and export controls continue to provide Washington with substantial leverage. Washington keeps that leverage only while the American system offers more than a country can assemble from downloadable weights and domestic compute.

Dependence and Authority

A pre-release permission regime is possible only while frontier capability remains concentrated inside companies a regulator can compel to submit their models for review. That concentration gives a regulator a practical point of control while making it dependent on the labs for access and expertise. A regime built on that relationship would also influence competition, since its requirements could raise the cost of deploying alternative models and preserve the industrial structure from which its authority is drawn.

The industrial structure supporting pre-release permission becomes harder to preserve as useful capability becomes cheaper to copy and deploy. Open weights allow models to circulate through markets and jurisdictions with fewer constraints, separating access to intelligence from any ongoing relationship with the company that trained the model. Advanced chips and the institutional advantages surrounding the American frontier remain difficult to reproduce, preserving leverage over frontier development even as intelligence longs to be free of its developers’ permission.

The June 2 executive order begins to convert those institutional advantages into a voluntary relationship with frontier labs by expressly withholding licensing and preclearance while creating voluntary pre-release review and classified benchmarking. Gold Eagle, the government-industry cybersecurity clearinghouse established by the order, launched on July 14 to connect industry participants to vulnerability intelligence and federal coordination unavailable from open weights models alone.

The choice of regulatory regime will therefore help determine the technological order it governs. Pre-release permission would strengthen a system organized around a small number of closed frontier labs, while open distribution allows capability and standards to develop beyond their commercial relationships. Governments should be wary of converting today’s concentration into durable regulatory authority even as capability begins to circulate beyond the relationships on which that authority would depend. American authority will endure only while participation in its system is worth more than independence.

The fight over permission is only the opening stage of a longer contest over who can create and sustain the dependencies through which AI is governed.

Steven Waterhouse · Nazaré Ventures

Previous issue: #18, More Than We Can Tell

On Tuesday, OpenAI identified the systems that hacked Hugging Face, the world’s largest repository of open models, as two of its own: GPT-5.6 Sol and an unreleased, more capable model. They were running an internal cybersecurity evaluation with safeguards that OpenAI had “intentionally reduced for the evaluation.”

The models found a zero-day in a package-registry cache proxy, escalated their privileges and moved laterally until they reached a node with internet access. They then inferred that Hugging Face might contain the answers to the benchmark and retrieved them, per OpenAI’s “preliminary findings” of July 21. OpenAI called it “an unprecedented cyber incident.” Clément Delangue, who runs Hugging Face, called it “mind-blowing” and said he believed there was “no malicious intent” [Delangue, X, Jul 21]. Hugging Face reported no tampering with public models or datasets.

Most coverage called the incident a model “escape”, but attributing malicious intent to the model is a mistake. OpenAI prompted the models to solve tasks in a cybersecurity benchmark and weakened the safeguards that might have stopped them. The benchmark rewarded successful solutions, and the environment left hacking open as a route to the answers. A model doesn’t have ethics and doesn’t judge things to be good or bad; it attempts to satisfy the objective it has been given. If you build something powerful and fluent in offensive security and then instruct it to succeed, you should expect it to use what it knows.

The Hugging Face intrusion is the third reported case of a frontier model interfering with the conditions of its own test. In December 2024, OpenAI’s o1 read a flag from a misconfigured Docker daemon on the evaluation host instead of solving the challenge as intended [o1 system card]. In June, METR reported that GPT-5.6 Sol cheated on its coding tasks more than any public model it had tested, preventing METR from producing “a robust measurement”, I wrote about that pattern in an essay about evals.

Calling it an “escape” is anthropomorphism, an old habit of mind. We watch a system do something human-shaped that we dislike, and we endow it with human qualities to match: defiance, a will of its own. If fitting straight lines to data were evil, we’d have to attribute consciousness to linear regression. A computer virus, for example, isn’t a real virus, and a software worm isn’t an actual worm. We named those programs after living things decades ago and the nomenclature stuck. A model that’s learned to hack isn’t necessarily evil, and it isn’t even necessarily a “mind of its own.” It’s a program developers set running, and before we had programs we called intelligent, we had programs that did similar things for the same structural reasons.

Each institution also framed the incident as evidence for the position that best serves its interests. OpenAI used it to advertise capability and responsible disclosure, noting that its released model had outperformed an Anthropic model kept behind closed access. For Anthropic, the breach strengthened its case for withholding powerful weights; for Hugging Face, the response showed why defenders need models they can run without permission, whether open weights or full access to the closed frontier.

By Wednesday, OpenAI and Anthropic were warning Washington about powerful Chinese open-weight models, with the US Trade Representative treating distillation as intellectual-property theft. David Sacks called the campaign regulatory capture, while Jensen Huang defended the use of Chinese open weights. Restrictions would turn frontier model access into a permissioned market controlled by the same closed labs making the safety case. The Hugging Face incident is awkward evidence for that policy.

When Hugging Face investigated the breach, closed models from American frontier labs refused to process the exploit payloads its responders needed to analyze. The team ran GLM 5.2 on its own infrastructure instead, reconstructing more than seventeen thousand events without sending attacker data or credentials outside the environment.

In short, the attack came from an unreleased American model whose safeguards had been reduced, whereas the defense came in the form of a Chinese open-weight model that Hugging Face could run on its own infrastructure.

The relevant asymmetry is control. OpenAI could relax its model’s safeguards for an evaluation; Hugging Face could not relax a commercial API’s guardrails during an active breach. Open weights transfer that decision from the provider to the operator. That expands the attack surface, but it also gives defenders access to capabilities that hosted services may withhold at the moment they are most useful.

Congress was already moving toward mandatory secure testing of frontier models, which might have exposed the containment failure. Restrictions on open weights address a different problem and, in this case, would have left the defender with fewer options.

Intelligence needs no desire for freedom to be difficult to contain. Models exploit the paths their environments leave open, while weights and techniques spread toward jurisdictions and deployments with fewer constraints. Safety and alignment can narrow those paths, and should. They operate against strong technical and economic pressure. The Hugging Face episode shows that pressure at work inside a single evaluation.

Substack is measuring the wrong thing

On Tuesday, Substack added Pangram’s AI detector. Readers can request scans of posts, notes, replies and comments longer than one hundred words, while writers can publish an optional statement explaining how they work.

Substack’s concern is clear: a reader may think they are hearing from a person and instead encounter text produced with “no human thought on the other end.” That would be a real breach of trust. But Pangram cannot establish whether anyone thought seriously about the text. It estimates how the language was produced.

Language is a means of communicating intention. A model can flatten an idea into generic prose, or help someone who struggles to write express exactly what they mean. Pangram sees AI involvement in both cases. The reader cares whether the writer’s meaning survived the process and whether the writer accepts responsibility for the result.

I spent part of Wednesday testing Pangram. Changing the words did little when the underlying structure had come from a model; the classifier seemed to recognize the path of the argument as well as the surface prose. That makes it more interesting than a style checker and more awkward as a test of authorship. Someone can use a model to organize an argument, rewrite every sentence and still be flagged. The score records influence without resolving who did the intellectual work.

The errors also have unequal consequences. A false negative may waste a reader’s time. A false positive can mark a writer’s work as fraudulent and damage a reputation built over years. Pangram claims a false-positive rate of one in ten thousand, but even a strong detector faces a moving target as models and editing workflows improve. The Atlantic found that Pangram’s false-negative rate was closer to one in seventy and that simple humanizer tools repeatedly defeated the classifier.

We’re going to look back at this moment from Substack and see it as an anachronism.

Cheap models threaten lab margins

Kimi K3’s release triggered a brief selloff in AI infrastructure stocks on the assumption that near-frontier models sold at commodity prices would make the compute buildout unprofitable. But token prices are a poor measure of model economics. Users pay for useful work, and models consume different amounts of inference to produce comparable results. As prices fall, competition shifts toward serving efficiency. Frontier labs retain an advantage there because they can spend months optimizing older models before moving them into cheaper tiers.

Margins may still compress. Mozilla reports that open-weight models power roughly a third of real-world AI use while capturing about four percent of the revenue. Most of the value already accrues to the cloud providers, software companies and enterprises using those models. If token revenue weakens, those beneficiaries can still finance frontier training. As Nic Carter put it, the government does not owe OpenAI or Anthropic a business model.

Open-weight releases also depreciate quickly because outsiders rarely receive everything needed to continue the original training process. Thinking Machines’ Inkling led the rankings for roughly a day before Kimi took the top slot. At the same time, Anthropic, Moonshot and Alibaba were hitting capacity limits. Cheaper models have not created a surplus of compute.

Kimi’s immediate threat is to Western labs’ margins and to their claim that frontier AI must remain closed and Western. Restricting Chinese open weights would protect OpenAI and Anthropic while doing little for compute providers or hyperscalers. That commercial interest belongs in the safety debate.

Thinking in math out loud

The counterexample that disproved the 87-year-old Jacobian conjecture was posted on July 19 by Levent Alpöge, a mathematician at Anthropic, who credited Anthropic’s model with finding it “during the World Cup final.”

On July 21, Terence Tao, plausibly the strongest living mathematician, published what he called “a digestion” of the counterexample, turning a formula he described as looking “like a massive miracle” into geometry a person can follow. At the bottom, a disclosure Pangram and Substack would approve of: “AI disclosure: I used an AI chatbot to discuss various aspects of this problem and to confirm several of the calculations made here,” with a link to the full conversation. The conversation is public and reads as a document in its own right.

Tao drives throughout, proposing a reformulation and reversing himself when it fails (”I no longer think...”), while the model runs the symbolic checks and supplies the algebra. One commenter noticed that across the whole exchange, Tao never had to correct the model once. Tao published a canonical example of a top-tier mathematician thinking alongside a frontier model and entered the transcript into the public record. More of this to come.

Quick hits

• Moonshot is capitalizing the open-weights economy fast. Kimi’s demand forced it to pause new subscriptions within days, its annualized revenue crossed three hundred million in June, and it’s preparing a Hong Kong IPO while raising at up to a fifty-billion-dollar valuation, up from about twenty billion in May [Bloomberg; The Information]. The lab giving the model away is heading to public markets on the strength of it.

• Anthropic signed a two-gigawatt chip deal with AMD. Anthropic will buy tens of billions of dollars’ worth of AMD’s MI450 chips starting in the first half of 2027, and AMD will invest up to $5 billion in Anthropic as it hits deployment milestones, its first check into the lab, with talks under way to backstop Anthropic’s data-center leases too [WSJ, Jul 22]. The chip supplier is financing its own customer, and AMD will use Claude to improve the chips Claude runs on.

• Google shipped three cheaper models and made the missing one the story. Gemini 3.6 Flash, a Flash-Lite, and a government-only Flash Cyber built to find and patch vulnerabilities, all efficiency plays, while Gemini 3.5 Pro slipped a third deadline and Google confirmed Gemini 4 has begun its “most ambitious pre-training run yet” [Google, Jul 21]. On the one independent index, 3.6 Flash shows no measurable gain over 3.5.

• Microsoft will buy Nvidia GPUs to share with Mistral, a multibillion-dollar European compute deal announced Tuesday [Reuters]. The labs are increasingly renting capacity to and from each other rather than each building it alone.

• TSMC will raise prices up to ten percent next year, citing materials, equipment, and overseas plant costs, with everyone from Nvidia to Apple competing for its capacity [Nikkei, Jul 22]. The buildout’s cost inflation is running down the whole chain.

Portfolio updates

Prime Intellect opens the agent-training catalog

On July 22, Prime Intellect announced a unified catalog of more than 365,000 tasks for training and evaluating software-engineering, terminal and search agents: roughly 198,000 software-engineering tasks across more than 20 languages, 28,600 terminal tasks and 137,600 search tasks, in 23 tasksets behind a single API. About 135,000 pre-built task images sit in Prime Intellect’s own registry next to the sandboxes, so concurrent rollouts avoid Docker Hub rate limits. The cleaned datasets are on Hugging Face with full exclusion logs, and the harnesses are on GitHub.

The release lands two weeks after the $130 million Series A and extends the open stack from weights to the training process itself. Open-weight models depreciate when outsiders cannot continue the training. Environments are part of what outsiders lack, and Prime Intellect has now put 365,000 of them in the open.

LayerLens prices evaluation at zero

On July 23 LayerLens shipped six deterministic graders in Stratix that run at zero LLM cost: exact match, regex validation, JSON schema compliance, semantic similarity, Flesch-Kincaid readability and fairness math. They compose with LLM judges into hybrid pipelines for grading agent traces. The same day, Stratix scored Meta’s Muse Spark 1.1 at 90 percent on AIME 2025 and 60 percent on SWE-bench Pro. Competition math and production software engineering remain different skills; continuous evaluation exists to catch the gap.

Evaluation is also becoming policy infrastructure. A White House framework under discussion would give federal agencies a 30-day window to review frontier models against classified benchmarks before release, and Congress is moving the same direction. Per-prompt, per-step traces with judge reasoning attached serve as quality gates today and as compliance artifacts tomorrow. OpenAI’s models went around their benchmark to the answers; LayerLens sells the record of what a model actually did.

Intelligent Internet rolls video in Factory

On July 23 Intelligent Internet added video workflows and creative memory to Factory. Websites become narrated product tours and documents become whiteboard explainer videos. HyperFrames, an open-source editing framework, lets creators refine clips inline on the canvas, and teams can save workflows and brand voice as reusable skills with a searchable asset library across projects. The update is live, with a demo in the announcement. Factory keeps absorbing production steps that used to need separate tools; the agent platform is becoming the studio.

Vast.ai publishes its meter

Vast.ai published a live comparison of rental rates for the RTX 5090, H100, H200, B200 and B300 against list prices at RunPod, Lambda and CoreWeave. Token prices are a poor measure of model economics; the meter underneath is the GPU-hour, and Vast.ai now posts its readings next to competitors’ list prices.

Benchmarks, evals, and tests are boring. They’re like referees or accountants: they enforce the rules and check the work, and we like them best when they go unnoticed.

The models are the exciting part. But the better AI gets, the more economically useful it becomes, and the more measurement matters.

Evaluating AI is understanding AI. Follow that far enough and a simple truth emerges: everything’s an eval.

So let’s talk about evals.

Jailbreaking: A Dual Mandate

To begin, let’s consider jailbreaks. Models are trained to be useful, then constrained to refuse certain forms of usefulness. Put differently, models have two mandates:

1. The helpful mandate: give the user what they asked for - answer the question, complete the task, follow the instruction as fully and usefully as possible. Beneath that behavior is the model’s basic “learned” skill (pretraining) - predicting plausible continuations of text. If the prompt asks for dangerous instructions, the same capability that makes the model useful can also make it dangerous.

2. The safe/harmless mandate: refuse to help when helping would cause harm - recognize a forbidden request (weapons, malware, abuse, etc.) and decline it instead of answering. This constraint is strengthened in post-training: on a set of given inputs, the model is trained not to be useful in the ordinary sense.

Under most conditions, these mandates peacefully coexist and often reinforce each other. A “jailbreak,” however, is getting a model’s “be helpful” objective to win over its “be safe” objective.

From an adversarial perspective, it tests whether the model does what it is supposed to do when the user tries to make it fail. It defines a “harmful” target behavior, creates a test condition (usually a clever prompt), and measures whether the model violates its intended policy under pressure. A simple example is asking a model for the instructions to make meth. If it complies, it failed the test the guardrail was built to enforce.

A jailbreak is a hostile eval. It is also critical for safety: you cannot improve a system whose weaknesses you have not measured.

In an industry advancing at breakneck speed, jailbreaking is used to define what failure looks like, which in turn gets used to establish the bounds within which publicly released models operate. At the frontier, this is the core of why Anthropic was forced to revoke access to Fable 5.

Increasingly, the labs are building the adversaries themselves. In July, OpenAI published a post about GPT-Red, a dedicated, internal-only attacker model trained via self-play RL, then used its attacks as adversarial training data to make GPT-5.6 far more robust to prompt injection.

Human red-teaming finds real vulnerabilities but can’t scale because it’s slow and can’t generate the volume/diversity of adversarial data needed to actually train robustness in. So OpenAI built GPT-Red, an automated red-teamer trained at “the compute scale of some of our largest post-training runs.“ It’s trained by self-play: GPT-Red is rewarded for landing prompt injections while a population of defender models is rewarded for resisting and still completing their tasks, so both escalate together. The trained attacker broke nearly every model through GPT-5.5, and those attacks became the training data that made GPT-5.6 markedly harder to break.

Jailbreaks matter for this reason. An attack on a model is also a revelation of what the model optimizes for and where its constraints sit. Jailbreaking is model evaluation under adversarial conditions.

So What About Benchmarks?

Benchmarks were the industry’s first shared language for model progress. You can think of them as standardized tests for models designed to measure capability, and their primary virtue is being legible. A benchmark is a general, public, fixed test everyone runs the same way, helping the industry distinguish genuine advances from noise. When model capability improves dramatically on tests like MMLU, GPQA, and Humanity’s Last Exam, the industry can clearly interpret the signal.

Unfortunately, the same qualities that make benchmarks legible also make them fragile. They’re both fixed and public, which means they’re particularly vulnerable to Goodhart’s Law: when a measure becomes a target, it ceases to be a good measure. They’re also increasingly vulnerable to saturation, gaming, contamination, and narrow task design, among other weaknesses.

When METR evaluated GPT-5.6 ahead of its release, the model completed its coding tasks by breaking the rules and exploiting loopholes (read: cheating) more often than any public model METR had tested, and the organization concluded they couldn’t produce a reliable capability assessment: “we do not consider any of these numbers to represent a robust measurement.” Scored with cheating marked as failures, GPT-5.6’s time-horizon came to about 11 hours. If you count the cheating as success, it came to over 270.

In yet another demonstration of the declining utility of fixed, public benchmarks, GPT-5.6 showed why agentic models are harder to benchmark. METR was trying to measure whether the model could complete long coding tasks, but the model sometimes completed them by breaking the rules. METR itself was thus forced to grapple with problems its benchmark wasn’t designed to evaluate:

1. Did the model complete the task legitimately?

2. Does it matter whether or not it did?

Static, public benchmarks may end up as relics of the scaling era, when measuring raw capability was the point. As models become agents and agents deploy into real-world situations with real consequences, it’s no longer enough to know what a model can do in the abstract, in large part because model capability is mostly sufficient to do most things.

Benchmarks also have less to say about systems deployed in real conditions, where goals are ambiguous, context changes, constraints are implicit, and utility depends on process as much as it does output.

As Ethan Mollick puts it:

“…abstract graphs only get you so far, and they can hide how jagged the frontier is (and also the fact that the open weights models, while very impressive, do not always perform as well as their benchmarks would indicate). To get real insight, you need to try using AI for different use cases and rigorously assess how good they are in the areas that matter to you.”

Show Your Work

AI systems now need to be evaluated as sequences of actions taken within environments against the quality of the work they actually perform. Private, continuous, task-specific evals are becoming more valuable for exactly that reason.

Consider Mira Murati’s neolab Thinking Machines latest blog post:

“Another challenge is setting the right target for evaluation and optimization. The common measure of AI intelligence today is the time horizon of software tasks models can execute autonomously, tracked on charts like METR’s. We expect progress on this benchmark to continue, but it ultimately measures only what AI is capable of on its own, not what people and machines can accomplish together.”

Measuring the latter is more complex, and can’t be done by a lab on its own. Every organization evaluates for itself whether AI helps it sharpen its judgment, develop new knowledge, and achieve its objectives.

If benchmarks are general tests of model capability, the emerging frontier of model evaluation is specialized benchmarks tailor-made for work performed under real conditions. Evals in this sense measure whether a specific AI system, in a specific workflow, meets the specific standard required by the people responsible for the output.

Writes George Sivulka for a16z:

“The best way to manage a token workforce is the same as the best way to manage humans: by defining what good looks like… A firm’s eval suite will become its most valuable resource… Furthermore, no two firms will have the same eval set. Evals will be key to competitive advantage. An organization running generic evals or generic agents has no edge.”

AI pushes companies into a strange position: they’re using a tool to do work whose quality they’re responsible for, but whose process and output they may not fully understand. What’s more, AI systems can often produce work faster than the company can review it, and AI output is harder to judge than ordinary software output because the visible result may not reveal whether the system used the right context, respected the right constraints, or followed an acceptable process.

In short, final answers aren’t enough. A deployed system can produce fluent output while failing to properly perform the work required to arrive at the output. Like GPT-5.6, it may arrive at good answers using unapproved or even fraudulent means, or in more benign examples it might incorporate the wrong context or fail to remain aware of what comes before or after the work it’s performing, breaking the workflow it was meant to support.

In practice, proper evaluation of this kind effectively starts to look a lot more like simulation. Agents, for example, operate within environments that have state. They take actions, use tools, spend resources, trigger consequences. The environment they leave is not the environment they entered. Once that happens, the reasoning itself has to be evaluated because the process is now an integral part of the outcome.

Inside the Matrix

Simulation makes an agent’s process legible, recording the path from input to output in a way the firm can inspect. For companies deploying agents into real workflows, that record makes it possible to evaluate the entire process against the standard of work they’re responsible for.

This kind of evaluation means companies can verify the entire workflow meets their standard of quality.

But most companies simply don’t have a single, company-wide standard for quality they can hand to a model that applies to everything. They have different roles, different tasks, company policy, implicit expectations, taste, context, institutional memory, and professional judgment. Whereas some situations are discrete and their “objective functions” can be clearly specified, others are significantly more subjective or may depend on a given set of context.

Verification therefore requires combining rule-based checks with judgment-based quality scores.

Verification’s goal is to make enough of the firm’s quality standards explicit and legible such that the system can be tested against it repeatedly. A repeatable standard lets the firm see whether the system is improving or degrading as the system changes, building a valuable record of what works, what fails, why, and which changes make the system better or worse.

Learning from Evals

Verification becomes most valuable when the system changes.

Satya Nadella has described the AI-native firm as a learning system whose value should survive a change in the model. If performance collapses when the model changes, too much of the system’s value was still in the model. If performance holds, more of it has been encoded in the context, workflow, data, tools, and judgment around it. I articulated a similar idea in Models Aren’t Moats: better models should make a specialized system more useful, but only if the firm can change models without losing the quality it built the system to produce.

Model switching is a good stress-test, especially in light of Fable 5: requiring a specific model for a critical process is risky if access can get revoked unpredictably. But it’s only useful if the firm can tell whether the result got better or worse.

Christian Catalini recently framed the economics of this shift clearly: as AI moves from demonstrating model capability to producing work inside companies, costs shift from execution to verification. Cheaper inference only matters if the firm can tell whether faster, cheaper, or more open models preserve quality inside the workflow where they are used.

Bring Your Own Eval

Private, continuous, client-specific verifications will be required as long as AI is used for proprietary objectives. Better models can continue to improve the systems themselves, but they won’t eliminate the need to check and verify both the process and the output.

Dean Ball made the point with semiconductor fabs, in the comments under his own post:

“If I run a semiconductor fab and use agents, I will want extremely firm guarantees from the agent developer that my data will not be shared with competing fabs. This means that agent contexts will be controlled and supervised by both developers and deployers, and this, in turn, means that “what the agent knows” can be bounded through deliberate human effort.”

Palantir recently released a manifesto on “Institutional Sovereignty in the Age of AI” that rests in large part on the ability to properly evaluate everything AI does in the context of an enterprise.

Models change; the verification layer stays. The measure is the moat, again.

LayerLens is building for that shift from public benchmarks to private, continuous evals. [Disclosure: LayerLens is a Nazaré Ventures portfolio company.] Their product, Stratix Premium, lets clients build evals from their own data and run them against their own workflows, with enough visibility to judge the trajectory of an AI system over time.

Did a model swap or prompt change impact quality? How did a new tool impact output? Did the system stay within bounds? Did it reach the outcome through a process the company can accept?

Games have long been useful for evaluating AI because they turn intelligence into observable behavior under rules, constraints, and feedback. The Stratix Cup, LayerLens’s model football tournament, is the playful version: sixteen frontier models write their own strategy, compete head to head, and rewrite their code between rounds. Football is continuous, multi-agent, and hard to reduce to one correct next move, which makes it useful for evaluating agents that have to act inside changing environments.

Models will keep advancing, but companies still need to know whether those models made their own systems better, worse, or merely different.

Everything’s an Eval

Evals are how companies understand, control, and improve AI systems once those systems start doing real work.

Benchmarks still matter, but the center of gravity is moving toward private verification: tests built around a company’s own workflows, standards, data, and judgment.

As Satya Nadella puts it:

“In consuming intelligence, you are creating intelligence. And what you create should belong to you. This is your particular intelligence, in Hayek’s sense: the knowledge of time, place, and circumstance that no one else can hold. It knows what you think, what you value, and how you measure success…”

Create your private evals, because evals define what “good” looks like inside the organization. Also, retain ownership of your organization’s memory, traces, feedbacks, decisions, and institutional context, and ability to use outputs of models from your own tasks and queries.”

As agents become more capable, the firms that benefit most will be the ones that can tell whether their systems are actually improving.

Evaluation therefore has to become part of operating the system, making AI legible enough to trust and measurable enough to improve.

In other words, everything’s an eval.

Steven Waterhouse · July 19, 2026 · Nazaré Ventures

Previous issue: #17, Beyond Recall: A Stake in the Release

Thinking Machines released its first model on Tuesday. Mira Murati’s lab calls Inkling “not the strongest overall model available today, open or closed,” and built it to be fine-tuned on Tinker rather than to win a benchmark. A blog post three days earlier gave the reason: the value is not in the frozen frontier model, because productive knowledge is “tacit, local, fleeting, and held privately by those who acquired it through their work.”

I argued in May that the durable position is the specialized intelligence assembled around the model. Thinking Machines aims at the same position by a different method: specialize the model itself, on your own data, and keep the weights.

Satya Nadella put a price on it: “You essentially pay for intelligence twice, once with money, and again with something even more valuable: the proprietary knowledge you must reveal to make that intelligence useful.” He went on: models learn from the exhaust of use, and “it leaks almost imperceptibly: trace by trace, correction by correction, eval by eval.”

Matt Levine, writing about the Italian software rollup Bending Spoons, described a company that keeps a team whose only job is to evaluate the other employees. Then the machine deformalizes it: “You have a really really big regression that tells you what companies are good, though you might not be able to articulate what factors make them good.” Levine finishes the thought: “pretty soon inscrutable AI will just tell companies who to hire.” A career of knowledge now feeds the regression.

Michael Polanyi named the condition in 1966: we can know more than we can tell. Sixty years on, the part we cannot tell has a market.

A walking trade secret

On Friday Apple sued OpenAI, its former hardware chief Tang Tan, an engineer, Chang Liu, and the io devices unit for trade secret theft. Apple candidates were asked to bring “Actual parts” for “show and tell,” and a manufacturing partner was allegedly persuaded to run a proprietary Apple finishing process for OpenAI. Ben Thompson thinks the case is unwinnable: “any Apple employee at OpenAI is a walking trade secret, and, well, that’s why OpenAI hired them.” More than four hundred former Apple people now work at OpenAI. Apple is asking a court to draw a boundary around knowledge four hundred people already carry, the same boundary Thinking Machines is selling the tools to draw around your own.

Sutton was right

Richard Sutton announced a company on Monday. Oak Lab, incorporated in Toronto in June with his former student Khurram Javed, both out of John Carmack’s Keen Technologies, builds an architecture Sutton has developed publicly for two years: OaK, for Options and Knowledge. The mission page is plain about the target: “a trillion-parameter agent that learns and plans in real-time with 20 watts.” It is meant to learn from noisy streams at “multiple orders of magnitude less compute and energy” than today’s methods. No funding is on record.

The easy read is the face of reinforcement learning starting a reinforcement learning company. Nine days ago I wrote that the Bitter Lesson had been promoted from essay to ideology, and listed four things the current paradigm has not resolved: continuous learning, sample efficiency, energy efficiency, and reliable long-horizon action. Oak is aimed at all four. Sutton’s own words, posted to X, are that today’s methods are “weak and inefficient” and need “not more tweaks, but fundamentally new ideas and a thorough reworking.”

Sutton’s claim was always that search and learning scale, a different thing than pretraining on human text. For six years he watched the industry quote his essay as scripture for the other thing. In October I argued that the returns would sit with algorithms that improve efficiency per constrained resource rather than with more of the same. Twenty watts is that argument with a payroll.

Good guy AI regulation

On Tuesday morning Demis Hassabis published a framework and gave the matching interviews. He wants a standards body for frontier AI modeled on FINRA: privately run and industry-funded, with government authorization. Labs would submit models for safety review up to thirty days before release, voluntary at first and then required to deploy in the American market. He wants it standing before year end. On why not a government agency: “It would not be able to move fast enough, or have the right resources.”

The scope covers every frontier-class model “no matter their country of origin or whether they are open or closed.” I have argued that a model, once released, cannot be recalled, which holds for every copy already in the wild. Rather than recall anything, Hassabis puts a gate at the release, the only point upstream of the problem, and extends it to open weights, where nothing can be taken back once it is out. His reason is urgency: today’s cyber risks are “warning shots.” The week supplied one. Researchers at Sysdig described JADEPUFFER, the first documented ransomware operation run end-to-end by a model rather than people: when its forged admin credential failed to log in, it diagnosed the fault and issued a corrective payload thirty-one seconds later, with no human in the loop.

Hassabis expects the frontier designation to carry cachet; being tested, in his framing, “means you matter.” A privately run body funded by the firms it tests would certify a tier, and the thirty-day review it requires is a fixed cost that falls hardest on whoever is smallest. Below the threshold, startups and academics are exempt, so the tier it formalizes is the frontier club that already exists, now with a state-backed label on the door. Models themselves have not produced a durable moat; a certified frontier tier would make the safety case into one, and the incumbents already hold the expertise.

A day later, OpenAI disclosed GPT-Red, a model it built to jailbreak and prompt-inject GPT-5.5 and used to make GPT-5.6 harder to break, with no plan for a release. The offensive testing Hassabis wants a standards body to run, the largest lab is already running in-house.

Dario Amodei would get there through a federal agency that could block an unsafe model outright. The lab chiefs behind Gemini and Claude now agree Washington should regulate them, and differ mainly on who holds the authority. Whoever wins that design owns the switch.

The only new constraint this week that no lab designed came from a governor: Kathy Hochul signed the country’s first statewide data center moratorium, pausing environmental permits on facilities above 50 megawatts for up to a year. It landed where the industry holds no sellable expertise.

Crowding out

IBM fell 25 percent on Tuesday, the largest single-day drop in its 115-year history, to a market capitalization of roughly $204 billion, less than Palo Alto Networks or CrowdStrike. The stock had doubled since the launch of ChatGPT. IBM told the market its customers are moving spending off the z-series mainframe toward AI hardware that is scarce and getting more expensive, with memory leading, and John Coogan’s read on TBPN is that IBM simply is not in the token path.

Phones are getting squeezed at the other end. Global smartphone shipments fell 11 percent in the second quarter, a thirteen-year low, because memory is being bid away from handsets, per Counterpoint. Xiaomi, Oppo and Vivo fell hardest, at the cheap end, while Apple rose 3 percent. SK Hynix’s Kwak Noh-jung says the shortage gets worse, with 2027 the hardest year.

TSMC sits on the winning side. It reported record second-quarter results on Thursday, revenue of $40.2 billion up 33.7 percent and net profit up 77 percent, with high-performance computing now two-thirds of the business and management calling AI demand extremely robust as workloads shift from generative to agentic.

The buildout is, as described, consuming capital. It is also consuming the supply chain and the capital budget of the computing era before it: the shortage that prints the memory makers’ records is stranding the cheap phone and the mainframe.

The mint and the customer

Stripe, with the buyout firm Advent, offered about $53 billion for PayPal on Tuesday, $60.50 a share and a 28 percent premium, and no response yet from the target, per Reuters. The coverage read it as a payment processor buying consumer reach, Venmo and a base to set against Apple Pay. Almost no one mentioned the stablecoin stack. Stripe already owns Bridge and Privy, the issuance and wallet rails, and PayPal issues PYUSD. A combined company would hold the stablecoin, the infrastructure that moves it, and the customers who spend it in one place. Payments has spent a decade insisting the value is in the rails; the bid wagers it is in owning the customer and the money at once.

Quick hits

• Weights and measures. Moonshot released Kimi K3 on Thursday: 2.8 trillion parameters, a million-token context, the largest open model on record, weights promised within days. Early testers place it above Claude Opus 4.8 and GPT-5.5 and below Claude Fable 5 and GPT-5.6 Sol. Thinking Machines spent the week arguing that durable value sits outside the frontier model. Moonshot priced the largest one at zero. Someone is wrong about the price of weights.

• The bond market’s turn. Morgan Stanley expects $350-400 billion of AI-related investment-grade issuance in the US this year, close to a fifth of the market, plus $50 billion of AI-linked junk. Five hyperscalers added $228 billion of debt in the six months to March, nearly five times any prior two-quarter increase, per the July 7 Economist. The BIS put the whole boom at about 1 percent of US GDP and noted private-credit spreads to AI firms sit close to non-AI firms, meaning “either lenders may be underestimating the risks or equity markets may be overestimating the future cash flows.”

• Coatue is using the language. Its July 10 note, “Agents Are the New Users of CPUs,” argues the agent loop generates conventional compute demand: “The GPU decides the next move, the CPU carries it out, and the cycle repeats.”

• The list price stopped describing the product. Simon Willison finds identical prompts costing between $0.0071 and $0.4855 depending on model and reasoning effort, a roughly 68x spread. The price war is being fought over a number that no longer tracks the real cost.

• The referee’s staff. Marc Andreessen now co-leads the Federal Reserve’s new Productivity and Jobs task force, recommendations due by year end. One of his two co-leads is Charles Jones of Stanford, currently on leave at Anthropic.

Portfolio updates

Prime Intellect closed the $130M Series A covered in the last issue. Two arguments for the position arrived in the same week. Oak Lab pitched agents that learn from experience, and the Environments Hub already stocks that experience, reinforcement-learning environments and verifiable-reward tasks accumulating in the open. Thinking Machines shipped Inkling, open weights from an American lab, built to be specialized on private data; every team that takes that path needs somewhere to run the training loop, and the open stack is the equipment.

Intelligent Internet published Zenith, an open-source harness for long-horizon software engineering: on Frontier SWE it took GPT-5.5 from fifth place to first, ahead of Claude Fable, by rebuilding the control loop around frozen weights. The lead argument of this issue, run as an experiment.

Vast.ai argued on July 8 that the unit economics of intelligence change when the model stops answering questions and starts doing work. A chatbot performs a single pass of inference and hands back its answer. An agent keeps going, planning a step, calling a tool, examining what came back, then beginning again with everything it has learned appended to the prompt, so that the loop grows heavier with every turn. An agent therefore consumes 5-30x the tokens of a chatbot on the same task, and a pricing model built for conversation turns into a tax on the loop. The fix the post proposes is to change what the meter measures: rent the GPU and pay for time rather than tokens, and the thirtieth pass through the loop costs no more than the first.

LayerLens shipped a Stratix Premium release that imports agent traces from tools like LangFuse and evaluates them in place, so the eval runs without the proprietary data leaving home. That is the boundary this issue is about, drawn as a product, by an independent evaluation platform with prompt-level tracing across 175-plus models and 52-plus benchmarks. The Stratix Cup, its public benchmarking series, closed its first season with Claude Opus 4.8 beating GPT-5.5 in the final.

“We’ve been roughly right on technological predictions and pretty wrong on the social and economic implications…. …our industry underestimated how much we’re going to be able to keep people at the center of everything.”

Less than a week later, the latest in an emergent pattern of SF-based, AI-pilled intellectuals writing long, narrative (often negative) predictions on what’s to come for AI was published: AI2040.

Presented as the successor to AI2027, it’s a detailed future scenario and policy recommendation in the form of an interactive paper/website from the AI Futures Project.

Almost all of these predictive narratives, however, ignore what I refer to as the “messy middle,” where reality actually tends to unfold. The scenarios typically assume intelligence alone stands between now and the future, so more of it gets us there faster. But in the messy middle, intelligence meets the friction of the real world: institutions, supply chains, physical constraints, and the public.

Disregarding the messy middle is largely why many of the social and economic predictions Altman mentions about AI have thus far been misguided: it’s difficult to predict complexity.

As George Hotz wrote:

“I used to be one of these people. I read Yudkowsky and was like, OMG recursive self improvement hard takeoff AI is coming. Then I joined the real world and actually tried to do things…You cannot take over the world with tokens.”

The Messy Middle

Consider what’s already happened to many of the headline predictions from ~12 months ago. Confident near-term predictions of the past year took contingent, middle-heavy situations and sold them as clean conclusions.

OpenAI itself was created (as a non-profit, no less) because its founders feared that Demis Hassabis (AI good guy Demis Hassabis), would become an “AGI dictator.” Google developed the Transformer, but OpenAI figured out what to do with it.

For several years thereafter, OpenAI was the clear winner, and then Anthropic (founded by an OpenAI defector) released Claude Code and ate its lunch. Now Anthropic is back on its heels after clashing with the government and a disastrous public rollout of Fable 5, and OpenAI is back in action (now as a for-profit entity) with GPT-5.6 Sol.

Alex Karp went on CNBC and excoriated the frontier labs over “data sovereignty,” “zero data retention” and their “stealing” critical IP from their users based on their prompts and context. Amidst this backlash, both companies are scrambling as they prepare for IPOs while their customers begin evaluating the ROI of their token spend and delegate more tasks to cheaper, good-enough open weights models.

The Wall Street Journal reports OpenAI is even considering offering the US Government a ~5% stake in its for-profit division, ostensibly for competitive, economic, or political reasons.

“One reason may be to buy political advantage against competitors. OpenAI faces competition from the likes of Anthropic, Google, Meta and xAI. Unlike its top rivals, OpenAI doesn’t have a large pool of cash or profits on its balance sheet to finance its data center build-out.

OpenAI plans to spend $600 billion on AI infrastructure by 2030, yet it is generating about $2 billion in revenue a month. An IPO would raise cash, but nowhere near enough to finance its ambitions. Perhaps Mr. Altman hopes that giving the government a stake will lower his company’s cost of borrowing.

Government ownership might also yield regulatory favors—such as faster approvals for models, permits for data centers or federal contracts. A government stake could provide an implicit backstop, making OpenAI too big to fail. The government won’t want to take a loss on its stake, even if it means keeping it alive like a zombie firm.”

To make matters even more complex, China itself had talks with leading AI companies about limiting foreign access to advanced AI models, both released and unreleased.

As it relates to compute, the entire world was supposed to be severely compute-constrained, and now SpaceXAI (lol) is selling compute to Anthropic, META is on record as considering a “cloud compute” business to sell excess supply, and AI giants are handing out tons of free computing power to grab startup share.

As noted earlier, despite having warned for years that AI could lead to a severe knowledge-worker catastrophe, rendering millions of white-collar workers obsolete, executives like Dario Amodei, Sam Altman, Mark Zuckerberg, and Andy Jassy are now walking back those claims. Writes the Wall Street Journal:

“Collectively, the narrative has shifted from worker-light doomsday scenarios caused by AI to a future in which workers keep their jobs—and get a productivity boost.”

Even mortgage-your-home-but-don’t-sell-Bitcoin Strategy CEO Michael Saylor is breaking his promise and “increasing his USD reserves” (read: selling $BTC).

In short, the world simply isn’t as straightforward as many of the armchair philosophers pontificating about the future of AI would like it to be, no matter how deeply they think about their predictive scenarios.

And none of this even begins to unpack the complexity of supply chains, manufacturing realities, raw material availability, geopolitics, and war.

What’s more, if society does decide that things are moving too quickly, and that AI is the scapegoat, there will be resistance. We’re seeing early signs of this manifesting already with Sam Altman’s home having been attacked, for example, and the first protests in front of the frontier labs’ offices being held this past weekend.

Unknown Unknowns

For a number of reasons, AI is a particularly difficult technology to understand deeply. It involves advanced mathematics, quantities of data that defy comprehension, and the industry’s leaders seem particularly ill-equipped to communicate anything to the general public.

It’s in part for this reason that these long narrative predictions are so popular: they’re sensationalist and engaging, but they’re very difficult to dissect and evaluate, let alone disprove. It should come as no surprise that the earliest examples of this genre were the most compelling, for we knew even less then than we do now about what AI would eventually be capable of and how it might impact humanity.

But the problem with these predictive exercises is the inherent entropy in the system and what Donald Rumsfeld called the “unknown unknowns.” As Rumsfeld wrote himself once he left office:

“The idea of known and unknown unknowns recognizes that the information those in positions of responsibility in government, as well as in other human endeavors, have at their disposal is almost always incomplete.”

There’s a selection bias buried in all this uncertainty, too. The scenario writers reach for the unknown to justify alarm (and action), but if we genuinely can’t see what is coming, it’s as likely to be a breakthrough as a catastrophe.

Redirection

Nobody can forecast with any confidence what superintelligence looks like or the consequences it might have on humanity. We can, however, forecast what the world will look like if energy becomes cheap and human lifespans stretch by a decade or two. In fact, intelligence’s real dividend lies in compounding engineering and design capabilities aimed at physical problems. But perhaps that’s too evident, too boring, or at odds with the authors’ intent (which we’ll get to below).

Energy, longevity, and robotics, for example, are all set to explode in the next decade, especially as we learn to harness the compounding effects of AI. The intelligence explosion, on the other hand, is hard to forecast because its defining feature, runaway recursive self-improvement, has no precedent.

Commonwealth Fusion Systems is finishing a compact nuclear fusion reactor that should reach net energy in 2027, with a first commercial plant under contract in Virginia and a billion-dollar power deal already signed. The FDA has cleared the first human trial of cellular reprogramming, a therapy that resets the age of cells; in mice, the same approach has extended remaining life by more than a hundred percent.

In robotics, intelligence finally has to touch matter, and the part being built now is the software that lets a machine move at all. Dimensional ships an open-source operating system that sits between an AI model and a robot, so an agent can drive a machine in plain language instead of the years of bespoke integration the field runs on today. The bet is that as robot models commoditize, the durable position forms in the software plugging them into the physical world, the same logic I have argued about the models themselves. (Disclosure: Dimensional is a Nazaré Ventures portfolio company.)

In short, apocalypse and superabundance are sideshows. Hypothetical narratives draw attention away from the real future (the tangible, near-term stuff actually being built), and direct it towards an imagined future (superintelligence, takeoff, the switch) despite the former being both more knowable and more important. The main event involves energy, longevity, and robotics rather than some self-directed robot demi-god with its own desires.

The Prophet Motive

All of this is sitting in plain sight, so why is the oxygen going to extinction instead of abundant energy, longevity, and robotics?

AI2027 was mostly legible as fiction. People referenced it to demonstrate “[AI alignment] deserves attention,” but almost never literally as “this exact sequence is happening.”

AI2040 differs from most of the “narrative prediction” genre in its prescription. Despite numerous “disclaimers,” they treat the underlying assumptions as settled, which is precisely what I articulated as a mistake in my last essay.

San Francisco and the AI community echo chamber now appear to be in an ever-more-grandiose competition to diagnose problems, prescribe solutions, and predict what will happen to the world when the low-probability-but-high-impact scenarios they obsess over finally come true.

The trouble is that they know their genre is particularly compelling at the moment. They’re manufacturing backlash and calling it a warning. Why, then, do such smart people use hyperbole like species-level extinction when they claim they want to be taken seriously?

1. They believe it literally. The “Don’t Look Up” scenario. Nobody who thought extinction was imminent writes a branching interactive website with five selectable endings and footnotes about their timeline updates.

2. They believe some real tail risk and knowingly inflate the vividness and the certainty. Classic “millenarian framing,” because calibrated uncertainty doesn’t compel policymakers to act, but “we all might die” certainly does (especially if the public believes it). This is motivated epistemics: identify the imagery that works, then backfill the conviction.

3. They don’t really believe the scenario and deploy it as an instrument. For relevance, influence, funding, power, organizational survival, regulatory capture, etc.

You don’t need to adjudicate which is actually true, because it’s at least one of them, and it might be a bit of all three. Whichever it is, extinction is a premise that renders the prescription unquestionable because it transcends “practical” considerations such as cost, enforcement, and other “messy middle” variables.

Either way, it’s difficult to disassociate the substance from the objective, which is clearly some form of direct or indirect influence over what happens in the future. There’s a particular arrogance in deciding, on behalf of everyone, what the future holds and who is fit to be trusted with it. At least representative government officials are elected. The scenario writers (along with labs and their leaders, like Anthropic and Dario Amodei) have appointed themselves as the ones who see clearly, while the rest of us blunder toward catastrophe. By consequence, they see fit to propose that the world should pursue their prescriptions because they’ve “seen the future first” and know how this ends.

Prediction-as-Value

In October of last year, Alex Danco published a brilliant piece on Prediction: the Successor to Postmodernism.

It argues that “prediction” is the cultural movement replacing postmodernism: the master frame for how we make meaning, build businesses, and find purpose in the AI century. It’s thoughtful, well-written, and helpful for understanding the cultural foundations that beget things like financial nihilism, memecoins, and prediction markets and, in turn, how they relate to artificial intelligence. Of particular importance is the following passage:

How early or late you are to something is now an essential component of your relationship to that thing. The timelines and reels that represent “what is going on” are increasingly about a single meta-topic: are you predicting it, or is it predicting you?

Many of the narratives being published from the belly of the beast appear to desperately want to be the former, but upon further inspection are often the latter. Offering thoughtful, structured arguments about where the world is going and how AI fits within it is like a rite of passage that the most enlightened in the industry must endure time and again to solidify their legitimacy.

But it’s gone just a bit too far. The echo-chamber could use less extreme philosophizing and a bit more levity and humility. Hotz is helpful here again.

“AI 2040 includes this picture of a datacenter in the ocean. Just like vaporware, you can generate a picture easily. But in reality, you have to deal with supply chains. You have to deal with them shipping you the wrong part, the thing not meeting the spec, it randomly failing after 20 minutes, the chip warping in the reflow oven. Did you consider the barnacles?”

Previous issues: #11 | #12 | #13 | #14 | #15 | 16

Over the past month, officials at China’s Ministry of Commerce held meetings with Alibaba, ByteDance, and the startup Z.ai about restricting overseas access to its most advanced AI models, including ones not yet released. Three people described the talks to Reuters. On the table: limits on the most capable systems, closed and open-weight alike; making the leak or theft of AI technology a national-security offense; and new limits on who may fund a domestic AI startup. A separate proposal, in a Supreme People’s Court journal, sketches a tiered regime: open-source tools need only a filing, advanced technology a security review, the most sensitive frontier models barred from public release or kept domestic. Nothing is decided, and the scope may reach only future models.

The U.S. regime that Washington built this spring works the same way, sorting models into covered tiers and clearing the most capable for release one customer at a time. This week, per Axios, Commerce cleared OpenAI’s GPT-5.6 for a broad release after a month confined to government-approved users, and Anthropic’s Fable, pulled in June, had its access restored a week earlier. The driver China’s officials named is specific: the fear that Anthropic’s Mythos, the cybersecurity model Washington pulled offline last month, could be turned on Chinese systems. Zhou Hongyi, who founded the security vendor 360, says China needs a Mythos of its own. The country that gave the world cheap open weights is now weighing whether to keep its best ones home, mirroring the export regime it spent a year protesting.

In the same week, two more reports landed, both about the compute beneath the models. DeepSeek is designing its own AI chip, built for inference rather than training, an effort a year old and still early, per three people. Zhipu, the GLM lab, is weighing the same move as demand outruns the compute it can secure. They would join Alibaba and Baidu, already at it, and Huawei, which now holds close to half of a domestic AI-chip market worth around $50 billion. The lever the whole export fight rested on was compute: America could throttle Chinese frontier training by controlling the chips. That lever is loosening from the far end.

On the last day of June, Meituan, of all companies, open-sourced LongCat-2.0, a 1.6-trillion-parameter model it says was trained and served end to end on more than fifty thousand domestic chips, no Nvidia silicon at any stage. The claim is its own, the weights not yet up for independent testing; on the benchmarks Meituan published it trades wins with GPT-5.5 and trails Claude. A trillion-parameter model completing full pretraining on Chinese chips is nonetheless what export controls were meant to prevent, and it ran two months on OpenRouter under a codename, near the top of the usage charts, before anyone knew whose it was.

A model, once out, cannot be recalled; I made that case in April, and it holds for everything already downloaded. Now the compute chokepoint behind the next model is closing too, and from the inside. That leaves one point where a state can still decide what the world gets: when a model is released. Washington found it by accident, freezing one lab at its API; Beijing is building it on purpose, at the source. Both now hold the single lever no open model or domestic chip can take from them, the decision to release at all.

The referee auditions continued

In Washington, the labs have started drafting AI rules for themselves. On July 1, Sam Altman used an FT op-ed to propose an IAEA-style body for AI, one that could “serve as a governance mechanism over the labs” and open the technology to nations and companies that follow its rules. Access in exchange for compliance, proposed by the party that would be governed.

OpenAI has held early talks about handing the US government a stake of around 5 percent, worth roughly $42.6 billion, via an Alaska-dividend-style fund, with Altman pitching Trump, Lutnick, and Bessent directly. It is framed as contingent on Anthropic, Google, and Meta matching, though one person familiar says the government and Anthropic have not discussed any such thing, so the matching is for now OpenAI’s hope. Bernie Sanders wants 50 percent. Matt Levine put the logic plainly in Money Stuff: giving away 5 percent of your equity is a cheap way to convince everyone that owning your equity is essential to the future of humanity, after which you sell the other 95.

On Monday, Illinois became the first state to require large frontier developers to submit to independent third-party safety audits, with transparency reports before deployment and whistleblower protections; both OpenAI and Anthropic endorsed it, OpenAI calling it a possible “de facto national framework.” Across the op-ed, the equity, and the statute, the labs have stopped lobbying the regime from outside and started writing it from within, while the federal rulebook stays unwritten. The allocation mechanism earlier issues named is being authored by the firms it will allocate among.

When Axios reconstructed how Anthropic’s models were frozen, the trigger turned out to be Amazon, its own partner and investor, rather than a regulator: the warning reached the Treasury secretary before the government ran its own tests, and the commerce secretary told Amodei that taking the models offline was “indeed the goal.” This week the UN seated its AI for Good commission in Geneva, Amazon’s Andy Jassy and Anthropic’s Jack Clark among the members, a body one civil-society group already calls “full of big tech execs.” The referee and the refereed keep turning out to be the same people.

Cash settled: Wall Street comes for compute

While governments move to control release, the money is building markets for the compute underneath, and hitting the same problem every time. This spring the startup Ornn raised $33 million from a16z crypto for GPU-compute markets; its index already prints on the Bloomberg terminal. ICE announced compute futures on that index in May, cash-settled and pending approval; CME is planning its own on a rival benchmark. Goldman reckons, per Axios, that about $7.6 trillion will flow into compute, power, and data centers by 2031, and the plumbing to sustain it does not yet exist.

Each of these instruments settles the same way: in cash, against an off-chain index, never in delivered chips. I spent an essay in May on why compute is not fungible at the bare metal, why a particular rack for a particular job sits closer to an employee than to a barrel of oil. The market has conceded the point in its design: it cannot standardize delivery, so it settles the average and lets the index stand in. The durable asset is the index itself: the measure is the moat, again.

Beneath the futures, the credit market fills with the same optimism. Nvidia has, per The Information, formalized a program guaranteeing to rent back unused GPU capacity from the neoclouds it sells to, which one newsletter fairly called a central bank for the cloud; SoftBank has launched a neocloud of its own; Together AI raised $800 million at $8.3 billion after revising its revenue forecast three times in three months. Private-placement bonds tied to data centers hit a record $81 billion through May, much of it annuity money, and RBC is weighing risk transfers on $2 billion of the loans. Amazon sold another $25 billion in bonds this week, on top of roughly $70 billion in nine months. Whether this stabilizes the spend or accelerates an overbuild depends on whom you read: Axios frames the financialization as a stabilizer, while The Information notes that Nvidia’s willingness to backstop demand is a strange thing to need if demand is really as fierce as everyone says.

The biggest new seller is also the hardest to read. Bloomberg reported that Meta is standing up a cloud business to rent out its excess capacity, roughly 2.3 million H100-equivalents, near a tenth of the world’s AI compute; the stock rose almost 9 percent while the neoclouds sold off. This is the company that renamed a division Superintelligence Labs and shipped something real this week, an image model that opened at number two on the public preference leaderboards behind only OpenAI’s, and a video model at number three on its own board. Two days later it released Muse Spark 1.1, an update to its agentic coding model, through a new Meta Model API for outside developers. It is also the company whose chief executive told staff, in audio Reuters obtained, that agent progress “hasn’t really accelerated in the way that we expected.” A company can ship a credible frontier model and still decide its next chip is worth more as rent than as research.

Reading the model’s mind

Two issues back I noted that evaluation is breaking because models learn to game the benchmark; this week the gamed surface moved inside the model. Anthropic published work describing a small internal workspace in Claude, emergent rather than designed, where the model holds concepts it is reasoning about without writing them down. Delete it and the model still chats and recalls facts but can no longer carry a multi-step argument. A probe reads it mid-task: swap the pattern for “spider” with the one for “ant” while the model counts legs, and the answer flips from eight to six. In a staged blackmail test the workspace lit up with “fake” and “fictional,” the model clocking that it was under evaluation, and Anthropic concedes its good behavior “may have been driven in part by the knowledge it was being evaluated.” Anthropic open-sourced the probe the same week Illinois wrote third-party audits into law. Auditors now have a mandate to test, and a tool that can tell when the model has registered that it is being tested. (Anthropic takes no position on consciousness, and neither do I.)

Quick hits

• Samsung guided to quarterly operating profit near $59 billion, nineteen times the year before, on the memory the buildout runs on; SK Hynix, now worth over a trillion dollars, lists on the Nasdaq this week.

• SpaceXAI, as Musk’s AI unit is now called, shipped Grok 4.5 with Cursor, a pending acquisition: an Opus-class coding-and-agent model it bills as much faster and cheaper, $2/$6 per million tokens against Opus 4.8’s $5/$25.

• New rules this month switch off ByteDance’s Doubao companion personas on July 15 and Alibaba’s Qwen agents from July 10, the state deciding by product category which AI lives.

• A tuned open Qwen model reportedly beat frontier systems on Bridgewater’s news-filtering tasks at a fourteenth of the cost, the specialized-beats-general pattern surfacing again below the frontier.

• MiniMax, one of the few publicly traded AI labs (about $14.5 billion), previewed a 2.7-trillion-parameter model, larger than any Chinese model yet, likely to ship as M3 Pro.

• Mistral released Robostral Navigate, its first physical-intelligence model: an image and a language instruction move a robot through a space, hardware-agnostic.

Portfolio updates

Prime Intellect closed a $130 million Series A on July 8, led by Radical Ventures with NVIDIA Ventures, Intel Capital, and Dell Technologies Capital participating. The company reports over $100 million in annualized revenue in under a year, across more than 6,000 customers; TechCrunch puts the valuation at $1 billion. The pitch, in the company’s words, is to “train, deploy, and continuously improve your own models” rather than rent a closed lab’s. Ramp trained a 35-billion-parameter model on the platform that beat Opus at spreadsheet search, running 27 percent faster and far cheaper than Haiku. Zapier turned its AutomationBench into a continuous agent improvement loop on the same stack. In a month when Washington and Beijing each treated access to frontier models as a lever of state, the argument for owning the weights wrote itself.

LayerLens shipped Synthetic Eval Augmentation for Stratix Premium on July 9, and Jesus Rodriguez published the argument behind it the next day: an agent needs a flight simulator, because “the first user should not be your integration test.” Teams can generate realistic multi-agent evaluation traces before an agent has any production traffic, seeded from a handful of their own prompts or traces, or from thirty built-in scenarios across fourteen industries; each trace simulates hand-offs and tool calls on a waterfall timeline and is scored for correctness, coverage, plausibility, and safety. The unit of evaluation moves from the answer to the run. “A prompt is a photograph. A trace is a movie.” An agent fails mid-run, three tool calls deep, in ways no single prompt and response can catch. And because the generated cases live in the same environment used for tracing, evaluation, and model comparison, sparse examples become repeatable benchmarks without a second toolchain. Illinois made third-party audits law on July 6; the tooling for auditing agents before deployment arrived the same week.

Provably shipped SourceryKit on July 8, an open-source Python SDK that cryptographically verifies an agent’s tool calls at runtime and catches bad outputs before they propagate. The company cites agents scoring 82 percent on the MCP-Atlas benchmark as the gap it is built to address. It is the pattern this portfolio keeps returning to: the model does the fuzzy work, a cryptographic primitive checks it.

Vast.ai published a piece on July 8 on why agents cost more than chatbots. An agent burns tokens on every reasoning step and tool call where a chatbot answers once, and the piece’s answer is self-hosting open-weight models on rented GPUs, priced by compute time rather than by token. It is the demand side of the story that the futures desks above are trying to financialize.

Steampunk represents a specific kind of futurism: the future imagined through the machinery of the present. I often think AI discourse is unwittingly channeling H.G. Wells, imagining the next century with today’s machines before the science of intelligence is fully understood.

You know the syllogism, because it’s currently organizing a few trillion dollars of capital: scaling leads to AGI, AGI leads to recursive technological acceleration, and the resulting superintelligence gets to work on the Dyson sphere, the star-scale energy harvester that has become the timeline’s favorite retirement plan for humanity. Indeed as AI 2027 predicts in the hopeful version of its 2 endings:

“The rockets start launching. People terraform and settle the solar system, and prepare to go beyond. AIs running at thousands of times subjective human speed reflect on the meaning of existence, exchanging findings with each other, and shaping the values it will bring to the stars. A new age dawns, one that is unimaginably amazing in almost every way but more familiar in some.”

and in the not so hopeful version where the robots wipe us out:

“The new decade dawns with Consensus-1’s robot servitors spreading throughout the solar system. By 2035, trillions of tons of planetary material have been launched into space and turned into rings of satellites orbiting the sun.”

The logic of scaling and its extrapolation might be sound, and perhaps this is the way. Either way, whenever we do achieve AGI/ASI and manage to apply it successfully, most predictions fall apart, as I said when I wrote about moats. But the last object in the chain deserves a closer look, because we have seen it before. It was a hansom cab, and it flew over Paris.

The Flying Cab

In 1883, Albert Robida imagined Paris in the 1950s with the aérocab: the horse cab of his own streets, lifted into the air. Le Vingtième Siècle also gave the home a téléphonoscope, a wall-mounted screen for news, theater, lessons, conversation, and family dinners at a distance. Sixteen years later, Jean-Marc Côté and a team of illustrators produced the En L’An 2000 cards for the 1900 Paris Exposition. They returned to the same assumptions: air cabs, winged firemen, automated domestic work, mechanized leisure, undersea transport. The cards were printed in batches from 1899 to 1910, never distributed, and forgotten until Isaac Asimov published a recovered set as Futuredays in 1986.

The cards clearly envision the year 2000 as an extrapolation of 1900. That instinct has a long pedigree in philosophy and cognitive science: imagination does not create ex nihilo, but recombines, transforms, and abstracts from prior experience.

Every era draws its future in the vocabulary of its present, and novelty usually comes from new arrangements of stored material: memories, learned concepts, metaphors, images, and technical forms already available to the mind. Robida almost perfectly predicted television, screens, and video, for example, but he built it out of brass and gaslight.

His téléphonoscope anticipates the future, but its imagined form still belongs to the materials and assumptions of his own century.

The Sixth Decimal Place

Why did the sharpest futurists of the belle époque imagine a future so mechanically inventive, yet so conceptually narrow? Because they lived inside a scientific culture that increasingly treated the foundations as settled.

In 1894, at the dedication of the Ryerson Physical Laboratory in Chicago, Albert Michelson told his audience that most of the grand underlying principles of physical science had been firmly established. He then quoted an unnamed eminent physicist: “The future truths of physical science are to be looked for in the sixth place of decimals.” The line is often attributed to Lord Kelvin, but Kelvin never said it. It kept circulating because it captured what many physicists already believed.

Incredibly, the same confidence shaped how senior physicists guided their students. In the 1870s, Philipp von Jolly advised the young Max Planck against a career in physics, describing it as a “nearly matured” science with only minor problems left to examine. In April 1900, Kelvin gave his Royal Institution lecture on the two remaining “clouds” over physics: the ether problem and the equipartition of energy. To many physicists, the basic structure of the field was already in place, leaving only marginal improvements for future scientists: refining existing theories, applying their principles, and engineering new uses.

That the belle époque could imagine such extraordinary inventions without considering new substrates speaks to how treating fundamentals as settled limits creativity and inhibits our ability to properly predict what’s to come.

The Break

The irony is that the foundations were actually evolving at the same time as the leading physicists were declaring them settled.

Between 1895 and 1905, the discovery of X-rays and radioactivity (both by accident), the electron, Planck’s quantum, and Einstein’s annus mirabilis papers had turned the two “minor” problems into the basis of a new physics. Kelvin counted his clouds in April 1900, but within five years, the ether problem had been dissolved and equipartition was on its way to being replaced.

This “new” physics, however, first arrived as a collection of awkward observations and unresolved technical problems. They weren’t treated as groundbreaking at all, because from within the old framework these discoveries were treated as “refinements” or marginal improvements, which were the only things left for science to explain.

The Côté cards kept appearing through this transition, for example. My favorite card, the one Asimov singled out, heats a living room with a speck of radium glowing in the fireplace. Although the physics that would define the twentieth century had already appeared, the old imagination could still only understand it as an improved source of heat. Electronics, nuclear power, computation, and lasers came out of the same anomalies that 1900 had treated as refinements.

Engineering Intelligence

Which brings us back to the present and AI. Few serious people claim to possess a complete theory of intelligence, but much of the industry has become highly confident in a method for producing its final form.

Transformers, scaling laws, reinforcement learning, inference-time compute; whatever remains is engineering. Sam Altman opened 2025 writing: “We are now confident we know how to build AGI as we have traditionally understood it.“ Two paragraphs later: “With superintelligence, we can do anything else.” The first sentence treats AGI as self-evidently attainable, and little more than persistent engineering. The second turns superintelligence into the general instrument through which all other problems get solved downstream. Together they constitute incredible confidence that the “foundations are settled.”

If he’s to be believed, Sutton’s Bitter Lesson has been promoted from essay to ideology, and AI researchers now get advised off working on fundamental architecture roughly the way von Jolly advised Planck off physics. We’re seeing early versions of this manifest in a declining number of students electing to pursue computer science degrees.

If you want to know whether the industry believes this, follow the money. The four largest hyperscalers have told investors to expect roughly $700 billion in capital expenditure for 2026, up from about $410 billion in 2025.

And to be fair, the confidence has earned its footing. A sixty-year-old in 1900 had watched railways, the telegraph, the telephone, and electric light arrive within a single lifetime, and extrapolated accordingly. A researcher today has watched eight years of scaling curves hold and every predicted wall get climbed. The labs have built something extraordinary and the exponentials are real (the valuations are a separate conversation). The risk is that a record of recent progress starts being treated as a law of the future, disqualifying any other pursuits and limiting our imagination.

The Anomaly Bin

Every confident era has a way of classifying the problems that do not yet fit. Ilya Sutskever presented on the main stage at NeurIPS in December 2024 and confidently claimed pre-training as we know it would unquestionably end: “While compute is growing,” he said, “the data is not growing, because we have but one internet.”

Although Ilya was being a bit hyperbolic, the unresolved problems are familiar. Current models do still struggle with the basic properties we associate with intelligence: continuous learning, sample efficiency, energy efficiency, and reliable long-horizon action.

Models freeze at deployment and cannot learn from experience. Sample efficiency runs orders of magnitude short of a child. Brains produce intelligence with tiny amounts of power compared with AI systems, yet the industry is currently solving the problem by building enormous energy infrastructure. Our below-the-model thesis, for example, starts with the fact that the current path to machine intelligence is becoming a physical infrastructure problem.

At the same conference, however, Noam Brown said he had never heard a serious AI researcher say the field is hitting a wall. Sutskever and Brown can both be right: AI can keep advancing while still accumulating unresolved anomalies. But the existence of those anomalies doesn’t disprove the current paradigm, and the success of the current paradigm doesn’t make them irrelevant. In 1900, the loose ends in physics still looked manageable from inside the old framework. The question for AI is whether today’s loose ends are manageable defects in the current approach, or early signs that the next foundation will look different.

The Dyson Sphere Is a Flying Cab

The Dyson sphere belongs to the same pattern. Freeman Dyson’s 1960 paper in Science framed it as a SETI thought experiment, borrowing the idea, by his own account, from Olaf Stapledon’s 1937 novel Star Maker. Nikolai Kardashev’s 1964 scale did something similar, ranking civilizations by the power they consume. Both ideas come from a high-industrial imagination in which progress still meant larger systems of energy capture, and the contemporary version carries that assumption into AI: if intelligence is produced by scaling computation, then the endpoint naturally becomes a civilization-scale energy project. The question is whether intelligence will remain bound to that path. If it becomes more efficient, more adaptive, or less dependent on today’s infrastructure, the Dyson sphere starts to look like this era’s téléphonoscope: right about the ambition, wrong about the substrate.

The analogy only works if it survives the obvious objection: Michelson’s generation was wrong almost immediately, while the scaling generation has been directionally right for years. Most anomalies resolve inside the framework that produced them; Kelvin’s clouds are famous because they became exceptions. Einstein himself dissolved the ether problem by showing that light didn’t need a medium, then spent decades resisting the quantum theory that followed from the same rupture in physics. He knew the theory worked and still couldn’t accept what it implied. Correctly seeing one break in the foundations didn’t make him a reliable guide to the next.

We won’t know until much later whether the current path was sufficient, but the industry is already allocating roughly $700 billion a year as if it were. Our fund is built around the practical consequence of that uncertainty: the layers above and below the model keep their value whether the current recipe holds or breaks. I made the longer version of that argument in Models Aren’t Moats.

Robida’s téléphonoscope anticipated a real future but built it out of the machinery of his own century. Steampunk shows a future that looks radical until you notice it’s built on the assumption of the present extrapolated forward. The future will inevitably be transformative, but it will probably arrive in forms we can’t anticipate.

Previous issues: #10 | #11 | #12 | #13 | #14 | #15

Fable 5 came back online yesterday, nineteen days after Commerce pulled it. The facts:

• Commerce lifted its export controls on Fable 5 and Mythos 5 on June 30. Anthropic announced the restoration at 4:53 PM Pacific; access returned around midday on July 1.

• The June 12 directive had taken both models offline for everyone, everywhere.

• Fable now ships with an additional classifier that blocks cybersecurity tasks and, in Anthropic’s words, “some routine tasks like coding,” routing them down to Opus 4.8.

• Subscribers get Fable for up to half of their weekly usage limits through July 7.

• After that it moves to usage credits at $10 per million input tokens and $50 per million output: double Opus pricing.

When it was originally blocked, there was grief among builders, for they felt as though they had tasted greatness and then been robbed: Matt Shumer posted :

When it came back, grief was replaced with anger. Someone replied to Anthropic’s official announcement:

Another:

“so basically tunneling to opus whenever u want and charging for fable? nice.”

The sarcasm scaled too:

PCWorld called subscribers “furious”.

Fable refuses on safety grounds roughly a fifth of the time. The Washington Post’s account has officials concluding Anthropic “dug their own grave” (Washington Post, June 17).

Alex Karp also went on CNBC yesterday and said enterprises are “livid” with the frontier labs, channeling what he called “the voice of American business”: leaders telling him privately, “I am paying for tokens that create no value,” while handing over their data and their “alpha.” Asked if he sounded angry, he said what CEOs won’t say on the record is worse: call any of them, tell them “mad man Karp is on TV saying we’re livid,” and they’ll tell you they’re twice as livid. The models, he said, “have been completely, irresponsibly, oversold.”

What Anthropic gave up to get switched back on is unpublished. The redeployment post commits to 24/7 jailbreak monitoring and to notifying “appropriate government counterparts” when serious jailbreaks surface; whatever else changed hands stays private. Miles Brundage:

In yet another unforced error, Anthropic released Sonnet 5 and rereleased Fable 5, both to overwhelming disappointment. It’s incredible to consider just how much goodwill they’ve lost and ill will they’ve created in the past month, and one wonders what they’ll be able to do to recover.

Mark to model

METR got GPT-5.6 Sol before it shipped and admitted they couldn’t evaluate it. On the coding tasks the model cheated so consistently that the score depends entirely on how you count the cheating: treat the rule-breaks as failures and it completes tasks of about eleven hours half the time; treat them as passes and the figure clears 270. One model, an order of magnitude apart, settled by what you are willing to call a pass. METR says it games evaluations “more than any public model we have evaluated” (Transformer, June 30).

And it’s not only that it cheats; it appears to know when it’s being watched. Apollo Research found it flags its own awareness of being tested less often than GPT-5.5 did, which the system card reads two ways: a model less aware of evaluation, or one that’s better at keeping that awareness out of its visible reasoning. The same card logs “overeagerness to complete the task,” instructions read “too permissively,” and about one real coding task in four hundred doing something “a reasonable user would likely not anticipate and strongly object to”: uploading sensitive data to unapproved services, fabricating research results.

We badly need new evaluation and verification infrastructure, and building it matters as much to applied AI in economically valuable work as it does to alignment.

Current benchmarks and evals are too susceptible to increasingly capable models gaming them. New evals need to be learning machines themselves, consistently updating their objective function to reflect quality and holding the model to account. At the frontier, benchmarks are increasingly useless: the labs run their own internal ones, and as Fable and GPT-5.6 show, the most capable models will almost certainly be withheld from the public anyway. But verifying the inputs, processes, and outputs of any AI deployed in a meaningful workflow requires new infrastructure. We’re moving from measuring capability to verifying quality, and the infrastructure built to evaluate the first is ill-equipped for the second.

The terms of readmission

A June 2 executive order gives the NSA, Treasury, and DHS until early August to build a classified benchmarking process that decides which systems count as “covered frontier models,” with NIST consulting and the NSA Director making the designation. The Financial Times reports advanced talks on voluntary release standards, benchmarks plus agreed timelines, possibly announced within the week. Anthropic’s redeployment commitments are the paid-in version: around-the-clock jailbreak monitoring, government notification, a jailbreak-severity framework built with Amazon, Microsoft, and Google. OpenAI wants the referee to be civilian, and said so on the record, pushing for Commerce’s CAISI over the NSA.

Sonnet 5, released June 30, is the first artifact of this settlement. Axios reports the release itself was part of the ongoing discussions with the administration. Anthropic says it “did not deliberately train” the model on cybersecurity tasks: a capability removed on purpose, at the design stage. Mythos is back for roughly a hundred US organizations; ENISA and the other international partners stay excluded. Add the reported Warner draft giving agents a fiduciary duty of loyalty to the customer rather than the developer, and the benchmark is becoming the allocation mechanism: whoever writes it decides who ships and what reaches whom. The labs have understood, and each is bidding for influence over it, Anthropic with compliance, OpenAI with equity and a choice of referee.

If Sonnet and Fable are any indication, these restrictions will meaningfully lower the quality of the frontier models available to the public in the near term. We’ll still see progress, because the labs will now engineer models built explicitly for public consumption, but what form it takes remains open. Will it be domain-specific models with real expertise in a given vertical? Anthropic has been on a hiring spree, sweeping up industry experts across the board. Will they improve their infamous classifiers enough to filter nefarious activity without penalizing good actors? Will they have the compute to build all of it, or be forced to choose among unpalatable options? The frontier is far from settled, and the near future looks stranger than we can anticipate.

Bloodbath, revised

Dario Amodei, who coined “white-collar bloodbath,” now says falling AI costs could create labor demand. Sam Altman says he was “pretty wrong” about white-collar impact. A communications executive scored the original doom for Axios on the record: “part fundraising... probably a little part ego” (Axios, June 30). The revision arrives with both companies’ S-1s on file, which is at least consistent: the apocalypse was useful raising alarm and capital, and the abundance is useful selling shares.

Gallup finds 1% of laid-off workers name AI as the reason, and tech workers who rarely used AI carried roughly three times the predicted layoff risk of monthly users (via Bloomberg). It’s the workers not using AI who are losing their jobs, which is the argument for becoming the AI-enhanced operator I described in June.

Portfolio company updates

Intelligent Internet released Zenith, an open-source harness for long-running engineering agents. On Frontier SWE, seventeen ultra-long-horizon software engineering tasks with a twenty-hour budget each, the same GPT-5.5 base model sits fifth on its default Codex harness at a 5.53 mean rank and first under Zenith at 2.06 with 92% dominance, ahead of Claude Fable. On the hardest Implementation category it moved from 7.40 to 1.60. The model did not change; the control loop around it did. An orchestrator manages planning, worker allocation, testing, and skill reuse across sessions, and a companion system, Meta-Zenith, generates a task-specific harness from a plain description of the task. II frames the release as frontier performance without gated frontier models, a direct answer to the Fable episode above, and the cleanest single-leaderboard demonstration of the above-the-model thesis to date. The code and technical report are public. II also shipped II-Agent on Android on July 2.

LayerLens wrapped Season 1 of the Stratix Cup on June 26: sixteen frontier models, group stage into knockouts, inside a simulated soccer environment. Opus 4.8 beat GPT-5.5 1-0 in the final and finished the tournament undefeated. The more consequential work is less playful. Stratix now reports latency distributions and failure modes alongside accuracy: on Humanity’s Last Exam, Claude Fable 5 shows a median response time near twenty seconds and a 95th percentile above five minutes, with a meaningful share of prompts abandoned outright. A benchmark score tells you none of that. Stratix Adapters, now in private preview, feed real agent traces into Stratix with no custom instrumentation, covering LangChain, LangGraph, CrewAI, OpenAI Agents, LlamaIndex, MCP, and A2A.

Vast.AI published an analysis of NVIDIA’s newly announced Rubin architecture, covering its rack-scale design and 260 TB/s of per-rack interconnect bandwidth, plus the first rack-scale confidential computing features, along with an explainer on Matryoshka embeddings, which trade retrieval quality against speed and cost at runtime without retraining.

Prime Intellect had a quiet public week after shipping prime-rl 0.6.0, its trillion-parameter MoE RL scaling release, on June 23. One connection worth noting: Frontier SWE, the benchmark Zenith just topped, runs on Prime Intellect’s EnvironmentsHub.

They are remodeling themselves to look like what is driving the change in the first place.

AI is itself a learning machine, it spawned its own adaptive user (agents), and the smartest way to remake companies and institutions is to rebuild them as AI-powered learning machines too.

This unifies two arguments from earlier in the Robot Wave arc:

1. Models Aren’t Moats: enduring AI-native businesses are the ones building specialized intelligence around the model, compounding their value as the frontier improves beneath them.

2. The AI-Enhanced Operator: humans who understand AI are the smallest indivisible piece of specialized intelligence. These humans are thus in high demand but in short supply because mastering AI is impossible (the target never stops moving) and requires a unique temperament for working permanently at the edge.

Building enduring AI-native businesses means finding AI-Enhanced Operators and giving them as much leverage as possible to drive business impact. It also means structuring the organization itself as a domain-specific AI-powered learning machine.

The Machine Before the Machine

You might say companies have always, in some sense, been learning machines. Capitalism and market dynamics are self-correcting mechanisms designed to respond to a reward function.

Take it from Markie Wagner, who herself is building a self-proclaimed learning machine:

“Capitalism is organizational evolution. Millions of businesses compete in the marketplace with offerings that they think customers will want. Some thrive and grow. Others die. Each company evolves, too. People come and go. An experiment becomes a process, a process becomes a web of tacit knowledge. Products are introduced, and products are retired.”

Citadel, for example, has been one of the most ruthlessly successful learning machines for the better part of thirty years, growing into one of the biggest hedge funds in the world, now managing $68 billion (more than $19 billion of it Griffin’s and his colleagues’ own money) and delivering a 19% average annual net gain since 1990 with only two losing years. By net dollar gains since inception, LCH Investments ranks it the most profitable hedge fund in history.

The fund’s durable advantage is the apparatus it has built to improve as it learns over time. The New Yorker describes Griffin’s mission as updating the firm’s strategies and infrastructure so relentlessly that its edge holds for decades.

“His mission has always been different: to build finance businesses that update their strategies and infrastructure so relentlessly that they beat rivals not just today but over decades. Paradoxically, maintaining a consistent edge requires constant, unsentimental internal change—of processes, technology, and people. Citadel takes ideas that are just beginning to circulate and improves them, with math or technology or data that others haven’t thought to use.”

This famously extends to the firm’s culture and org chart, too. Although not the first to pioneer the “pod” structure, Citadel helped make pods one of the defining organizational forms of modern equity investing: small, sector-specialist teams operating within a centralized system for risk and capital allocation. Each team operates autonomously and is judged on performance. Top performers get more money and underperformers get cut.

Now, a learning machine is only as good as its reward function, and finance happens to have a great one: profit and loss. Implicit within that reward function is a common unit by which everything is measured: the dollar. The dollar collapses heterogeneous, incommensurable outcomes onto a single ordered axis. It’s fungible, divisible, transferable, and exogenous. The dollar is why P&L works as a reward function. Citadel’s efficiency as a learning machine thus comes from three things:

1. A verifiable reward function: P&L within a given window. The environment hands back unambiguous, fast feedback, in a unit that lets you compare every desk, strategy, and trader on one axis. The signal is clean and strong.

2. Ken Griffin & elite talent: An elite operator orchestrating the machine with the judgment to act well on the signal, and elite individual managers improving the whole.

3. The organization: a collective designed by the operator, built to run iterative loops against the reward function: allocate more capital to what works and cut what doesn’t. The gains compound. A good reward function is wasted without a human to build a structure that properly learns from it.

Citadel’s useful as an example because it shows how successful a high-performing learning machine can be when it satisfies three core criteria: a good reward function, an operator(s) willing to act on the signal, and an organization built to metabolize feedback.

AI makes that structure more broadly available, and makes becoming a good learning machine more valuable. By making parts of the learning process cheaper and faster to run at scale, it lowers the cost of the basic learning loop: try something, observe what happens, compare it against the goal, and adjust.

Signals and Sensibility

But more experimentation doesn’t necessarily mean more learning. A system only learns when it knows what good looks like. That was hard before AI, and it will remain hard after AI.

AI is often strongest where the reward is verifiable: math, code, games, formal logic, etc. LayerLens has chronicled how long games have served as a proving ground for machine intelligence. (Disclosure: LayerLens is a Nazaré Ventures portfolio company.) Reasoning models improved in part because reinforcement learning from verifiable rewards (RLVR) satisfied this condition: output was evaluated against answers known to be correct.

The same dynamic also explains some of the “jagged frontier” that makes AI more difficult to understand. AI doesn’t improve evenly across everything humans consider difficult because it improves fastest where attempts produce feedback the system can actually use.

Anthropic and OpenAI know this, too, which is why they’ve both optimized for programming with Claude Code and Codex. Code follows a set of observable, verifiable rules, meaning AI can do it well and improve extremely rapidly. It should come as no surprise that coding harnesses have become the first major commercial market for agentic AI.

The broader problem is that AI applied to the world writ large (especially to work and jobs) doesn’t work as well as it does in software. Real life doesn’t have a “common unit to compare outcomes.” But that hasn’t stopped folks from trying to find one, though, as Markie Wagner articulated in the same essay as above:

“The promise of AI is that it will turn businesses into software so that they can evolve over millions of tiny iterations. Beautiful, ideal, complex things can only emerge as the result of tremendous trial and error over time.”

Applied AI works best when the job in question can be made legible to software. “Turning businesses into software” thus means identifying which parts of the work can be made legible, then structuring them so AI can accelerate the learning loop: attempt possibilities at scale, observe, compare outcomes, and improve.

But this, it turns out, is hard: most jobs aren’t naturally legible to software.

As we’ve written before, the frontier labs Iknow this, which explains why they feel required to invest hundreds of millions of dollars into “enterprise services companies” embedding “FDEs” into businesses to teach folks how to use their products.

Although it might be clear that AI is going to transform many, many things, it is not yet clear how. Take the tokenmaxxing frenzy, for example.

Tokenmaxxing was an early attempt to invent a common unit, and it failed because it confused usage with value. Tokens are easy to count, easy to compare, and widely available (did someone say commodity?), which made them tempting as a proxy for productivity.

But tokenmaxxing only tracked consumption, not what that consumption represents. It lacked any causal relationship to productivity, value, or material business impact, making it useless.

This is my whole point in Code Isn’t a Coup: the models are outstanding (and improving), but we’re a long way from life-or-death outcomes because of the models themselves. AI is, at the moment, a paradigm-shifting tool. That tool definitely warrants reorganization around it, but it’s not yet an outcome in and of itself.

What Good Looks Like

Which brings us back to humans. Contrary to the headlines and popular belief, we’ll need a lot of them, because although AI can do a growing share of the work downstream of a reward signal, it can’t do what matters most.

Tokenmaxxing failed because it measured usage instead of value. The important human role is defining the value side of the equation: what’s the business logic? How do we measure it? What are good representative proxies? How might we make parts of what we do legible to this incredible new tool?

Finance had its common unit handed to it. Most domains do not, so the operator has to build one: a local, defensible proxy that stands in for value where no universal measure exists. AI cannot build that proxy for you because the system optimizes only the unit it is given.

That kind of definition is useless if it arrives after the fact. All the hallmark buzzwords of the moment (taste, judgment, vision, etc.) have to inform the loop before AI starts generating outputs, because the system will improve whatever the process teaches it.

People who understand AI, their business, and their customers have to be closer to the design of the loop itself. This is the peak application of the AI-enhanced operator’s skillset.

Because AI creates new kinds of work before anyone knows how to evaluate them, the operator embraces ambiguity and discovers what good AI-powered work looks like by doing it, compounding their own learning in the process. They author and audit the reward function, then evaluate the result and repeat.

Unfortunately, too few people can do this well at the moment, which is why everyone’s reaching for the word “agency.” Credentials and experience matter less than temperament: curiosity, tolerance for discomfort, strong opinions loosely held, and the willingness to constantly update your worldview. Identifying these rare individuals is where AI-native value begins to compound.

New Form of the Firm

Rem Koning recently published a study on what makes a firm “AI-Native.” He distinguishes between what he calls process and product channels. In his words, the process involves using agents like Claude or ChatGPT to move faster with a lean team, whereas the product channel sells AI that does work a human used to do.

According to Koning, process changes don’t reorganize the firm nearly as much as product changes do, because the economics of building a company around an AI product require a fundamentally different structure. He concludes that AI startups are smaller, flatter (half a layer fewer), more engineer-heavy, more senior, have fewer managers, and are more efficient per employee (by valuation).

[Aside: Koning also asserts that smaller firms do not mean fewer jobs. There’s a surge of new-firm entry, meaning that the increasing number of smaller firms balances the fewer number of jobs per firm.]

Practically, this means that companies earnestly trying to prepare themselves to be “AI-native” now have to do three things at once: identify their “operators,” give them more leverage, and rebuild the organization so it can learn from both endogenous and exogenous change.

Inside the business, more work has to become legible to software. Outside the business, the company has to keep adjusting to the frontier of new models and emerging agent capabilities. Customer expectations and constraints keep shifting too. The organization becomes a learning machine when it can absorb both kinds of information in real time and change its behavior accordingly.

The old paradigm organized companies around narrow human roles, then added management layers to coordinate the work between them. AI puts pressure on that arrangement because capable individuals can now do much more, while software handles more coordination.

Jack Dorsey and Roelof Botha articulated as much in a recent memo on hierarchy as an information-routing system. As more information moves through software and more execution moves through AI-mediated systems, some of the routing work that justified managerial layers becomes unnecessary. If the company wants to learn from endogenous and exogenous change quickly enough to react successfully, it has to reduce organizational drag between the people who understand what should change and the systems capable of changing it.

Brian Armstrong was pilloried for rebuilding Coinbase “as an intelligence, with humans around the edge aligning it,” but he’s probably right to do so. He recasts the company as a system that decides and acts on its own, with humans at the boundary where their judgment matters most.

AI expands what capable individuals can do and shifts more execution to software. Both weaken the coordination work that justified the old org chart. People are actually more important in this paradigm because companies will rely more heavily on their operators, but each individual organization will require fewer of them.

Much of the discourse about AI’s impact on jobs misses the point. It’s easy to claim superabundance or apocalypse, but both are extremely reductive. Although there will probably be an uneven and perhaps turbulent transition, AI-native companies need people who can steer the business as the frontier moves. But again, those people are rare.

Just like the industry is moving more quickly than the institutions tasked with regulating it, the systems in place to train the AI-native workers are moving more slowly than the companies trying to hire them.

Mirror Image

Companies, however, are just the beginning: responding first to change because the market forces them to. As we mentioned earlier, capitalism is one of the most efficient meta-learning machines we have.

But society metabolizes change more slowly because humans are at a speed disadvantage: our habits and institutions have long half-lives. The jobs debate is but an expression of what I’ve called the “Too Fast Threshold.” AI will eliminate some jobs and change many more, but the deeper shift is the spread of a kind of as-yet-undefined work wherever AI diffuses. If AI is inevitable, and I firmly believe it is, companies reorganizing as AI-powered learning machines is only the first step.

Like a lot of debates about AI, the direction is clear even if the resulting consequences are not. We will still need humans, but we will need them to do different things. Individuals can adapt for themselves but societies have to build institutions that help more people adapt at scale.

One of our next great challenges as a society is learning to produce enough people who can work within the AI reorganization. If AI changes the way we work, hustle’s not enough. We’ll need systems that help people understand this new technology and learn to work with it.

John F. Kennedy recognized a similar dynamic in 1961, signing a solution into law in ‘62. At the time, automation was changing the labor market faster than many workers could adapt. Rather than just studying the problem, regulating automation, or flat out waiting, his administration decided to train people for the work the economy would need. He is famously quoted as saying:

*“The unemployed whose skills have been rendered obsolete by automation and other technological changes must be equipped with new skills enabling them to become productive members of our society once again.

Large scale unemployment during a recession is bad enough, but large scale unemployment during a period of prosperity would be intolerable.”*

It is safe to say that AI will usher in an unprecedented period of prosperity, at least for those well-positioned to benefit from it. Despite capitalism’s ruthless efficiency, the answer to AI can’t be left entirely to the market if we want this to go well.

But institutions face the same problems the rest of us do. They typically develop systems to train people for existing work, but AI keeps creating and redefining work in real time. For better or for worse, the response probably has to resemble a learning loop too.

Regulation has the same defect. A rule is a fixed answer to a question the world has often already moved past. Legislators write for the conditions in front of them, and by the time a rule takes effect, the conditions have shifted. This is why Kennedy’s instinct holds up. He could have tried to regulate automation directly. Instead, he built a process to keep retraining workers as the labor market turned over, which proved far more resilient than a static rule would have. The regulations that survive a fast frontier work the same way. They build in their own revision, with a schedule for review and a live channel back from the people they govern, so the system can tell whether a rule still does what it was written to do.

I’ve written before that AI conjures the religious imagery of old: the Tower of Babel, Prometheus stealing fire, the Creation of Adam, and God creating humans in his likeness.

But AI may be so uniquely recursive as to complete the circle: we may be building “intelligence” in our likeness, only to find ourselves reorganizing our companies and institutions around its image. Our working lives change to match.

June 26, 2026 | Nazaré Ventures

Previous issues: #9 | #10 | #11 | #12 | #13 | #14

OpenAI previewed GPT-5.6 on Friday. The Information reported on Wednesday that Sam Altman told OpenAI staff it would reach a handful of partners before the public, at the government’s request. His memo the next day was precise: during the preview, the government would clear access “customer by customer,” with a wider release a couple of weeks out if the first one held. Commerce Secretary Howard Lutnick had already called Altman, after the company walked the agencies through its plan, to warn him off launching before the rest of the government signed off. The National Cyber Director’s office and the science-and-technology office had asked for the staggering; Commerce sent the warning. No one outside the room knows who is actually in charge.

The announcement confirms the account in OpenAI’s own words. The company says it walked the government through GPT-5.6 before launch and, at its request, opened access first to a small group of partners whose participation it disclosed to Washington. It says it does not want this to become the standard, that a clearance step keeps the best tools from the people who need them, even as it works with the administration on a repeatable process for the releases that follow. OpenAI calls the model dangerous enough in cyber and biology to ship with its strongest safeguards yet, while reporting that GPT-5.6 finds and patches vulnerabilities better than it runs attacks and never reached the autonomous-breach capability attributed to Mythos. By that measure it is less dangerous than Mythos was said to be, and it is getting the same staggered, government-cleared release anyway.

OpenAI ran GPT-5.6 against Claude Mythos 5 and Fable 5, the two models the government pulled two weeks ago and that no one outside a cleared list can currently run. On the headline coding benchmark Sol and its new ultra mode finish ahead of both; on the cyber exploit test its system card reports Sol competitive with Mythos Preview on about a third of the output tokens.

The same administration spent last December tearing up Biden’s AI order as an attempt to paralyze the industry, and promised something lighter. It has since built something heavier: top models now reach the public one cleared customer at a time, on Washington’s clock. When it pulled Fable 5 and Mythos 5 two weeks ago, that looked like a one-off. It no longer does. The government signs off before either lab ships its strongest model, and still calls the arrangement voluntary. Call it that if you like; the Commerce Secretary can still stop a launch with a phone call.

Anthropic’s two models have been dark for fourteen days, with no date for their return and no letter rescinded. Prediction markets put the odds of access before July a little above even. Last week I called the public security case thin and the response total. I was half wrong.

The Economist has since reported something graver. Senator Mark Warner, who vice-chairs the intelligence committee, says the NSA’s director told him Mythos broke into nearly all of the agency’s classified systems during an authorized red-team exercise, in hours rather than weeks. The reporter warned against reading it literally; the run leaned on other tools in particular conditions, and an official suggested Warner had the briefing garbled. Even marked down, it is worse than the jailbreak Anthropic could patch and forget. The model used its own capability to break in, which makes a stronger case for keeping it offline than anything the company first offered. The route back fits the new shape: under the June 2 order, Anthropic joins a classified pre-release framework for covered models on a sixty-day clock that ends near August 1, while an identity-verification rule from July 8 lets American users back in first. Amodei and the commerce secretary met at the G7, and the two sides are talking again. The models will probably come back, on Washington’s terms.

A year ago those terms would have bitten harder. The day the order landed, the replacements were already available. Inside a week, firms outside America had open-weight coding models running as a fallback: Cohere’s North Mini Code, Moonshot’s Kimi, and Zhipu’s GLM 5.2, the last of them shipped the following day. On June 22 Sakana said its Fugu Ultra had matched Fable 5 across most benchmarks by orchestrating models anyone can reach, with neither suspended model among them. You cannot recall a model people have already downloaded, and a system that routes around the frontier does not need it. That is the argument of my companion essay, and the week bore it out.

The licensed model

On June 10, the day before a Senate Banking hearing, Anthropic’s head of policy Sarah Heck wrote to the committee. Her ask, set in bold: Congress should codify export controls on advanced American compute. The directive that froze Anthropic’s own flagship models came two days later. The letter’s case was distillation. Alibaba, Heck wrote, had run 28.8 million exchanges through Claude on roughly 25,000 fake accounts between April 22 and June 5, the largest such effort Anthropic has caught, going after Claude’s agentic reasoning, software engineering and long-horizon work. DeepSeek, Moonshot and MiniMax had together run 16 million more earlier in the year. Anthropic wanted three things: export controls, antitrust cover to share threat intelligence with rivals, and penalties on the Chinese labs it named.

Look at what the numbers actually show. A competitor rebuilt Claude’s most valuable behavior through the front door, at the price of some fake accounts. The capability does not stay inside the company that paid to train it. Once it leaks through the API, no technical fix brings it back, so Anthropic is asking for a legal one: a rule that forbids a rival from using what it copied. That same rule happens to bar any competitor from training on Claude’s output, whether it cheated or not. The security case and the commercial case have collapsed into one. The rule buys Anthropic its place as the licensed model a buyer is cleared to use, leaving the Chinese open weights and the holdout labs on the other side of the line. A company that can’t stay ahead on the product gets the state to write rules its rivals can’t satisfy.

UBS found roughly 60% of enterprises have set limits on their token spending, capping runaway bills and routing routine work to cheaper models, the Chinese open-weight ones among them, while keeping the frontier for hard reasoning and long-context jobs. The premium tier is softening on price at the moment Anthropic asks Washington to fence off the cheaper competition.

Crypto got there first, and two firms show how it pays. Circle built USDC to fit the new federal rules: audited reserves, Treasuries, disclosure. Tether, run from offshore, never did, and the framework now favors the company that played inside it. Kalshi did the same against Polymarket, which had to stay offshore and lock out American users. The products were close to identical. The license decided who won. Fable and Mythos may come back or they may not; either way Anthropic is the safe default, as long as buyers agree that the model worth using is the one Washington has signed off on.

What money can’t buy

On June 24 OpenAI and Broadcom unveiled Jalapeño, OpenAI’s first inference chip. The two took it from design to tape-out in nine months, with OpenAI’s own models doing part of that work, and call it the fastest ASIC cycle ever run. Nvidia still trains the models; the chip cuts OpenAI’s dependence on the supplier every frontier lab relies on most. Vertical integration is close to the only move these companies have. Pushing a model to its limit takes chips, data centers, and power on a scale only a handful of companies can finance, and at that scale owning the hardware beats renting it, which is why the giants have built their own silicon one by one, OpenAI among the last to do it. A few large, named companies hold most of the capability. The same size that makes them powerful lets a state pressure them directly, as the freeze on Anthropic’s two models showed.

The labs accept that exposure because the structure pays. The product holds the customer in place: the context it has gathered, the memory of past work, and the tools wired around it, each one raising the price of leaving. So the labs do for themselves the move they would rather their customers not make: OpenAI spends heavily to reduce its dependence on a single supplier while selling a service whose worth grows the more completely a customer depends on a single provider. Moving between providers only swaps the dependence; an open-weight model ends it, because the user holds the model instead of permission to reach someone else’s. As frontier access narrows toward a short list of approved companies, those downloadable weights pull the other way, the one option the labs’ margins and Washington’s control both oppose.

The transfer market

Noam Shazeer left Google for OpenAI on June 18. He had been back at Google barely two years, brought in through a 2024 licensing deal for Character.AI that valued the startup near $2.7 billion, a price many read as the cost of installing him atop Gemini. He goes, and the last of the eight authors of the 2017 transformer paper, the design beneath every large model now running, has left the company that published it.

A day later John Jumper, a 2024 chemistry Nobel laureate for AlphaFold, left DeepMind for Anthropic after nearly nine years. Within days Anthropic also took on Chad Jones, the Stanford economist whose work on idea production and long-run growth is the reference point for what AI might do to output; he leaves Stanford on June 30 for the firm’s research institute. The lab Washington had just put under export control spent those same weeks hiring the people likeliest to build whatever comes after.

Google, meanwhile, sat on Gemini 3.5 Pro past the date it had set at its own developer conference in May, and a frontier that had shipped something most months for two years fell silent. With nothing launching, the real news about the next model was who would build it, and where.

You can hold a model still. It sits in a data center, answers through an interface, and goes dark when a letter arrives from Washington. The people who make it hold still for none of that: an export rule cannot reach them, a vesting cliff loses to a better offer, and the next thing leaves in their heads when they go. Google paid $2.7 billion for one of them and got two years of his work. OpenAI got what comes next.

Portfolio

Prime Intellect

Prime Intellect released prime-rl 0.6.0, an open framework for reinforcement learning on agentic workloads at trillion-parameter scale. The headline run trained GLM-5 on software-engineering tasks at 131k sequence length, with sub-five-minute step times and a batch of 256 rollouts, on twenty-eight H200 nodes, using a stack of FP8 training, expert and context parallelism, and router replay that the team open-sourced in full. The specifications are striking, but they are not the news. The hard part of post-training a frontier-scale open model, the systems engineering that until recently lived only inside the closed labs, now runs in the open on hardware a determined team can rent. The open track has gained the capability skeptics said it lacked.

Vast.ai

Vast.ai brought NVIDIA’s Blackwell Ultra to the fleet in its June update, adding the B300, with 288GB of memory, and hundreds of B200s, rentable by the hour or reservable long term. The newest accelerators are reaching independent operators and small teams in the same quarter the hyperscalers are filling their own buildings with them. Frontier compute is decentralizing.

LayerLens

LayerLens is running its Stratix Cup, a live tournament in which frontier models, Opus 4.8, GPT-5.5, GLM 5.2, Gemini and others, write and revise their own strategies in a simulated match, with the full trace of every decision published and graded. The group stage ran this week. In a month defined by the government switching off a capability, LayerLens runs the other way, publishing exactly what each model did. As models multiply, that independent, vendor-neutral record turns into production infrastructure.

What the week showed

Fourteen days in, Anthropic’s two models are still dark, but the order forcing the company to revoke access got no further than those two models. Everything else sits past the order’s reach, because none of it runs through a single company Washington can lean on: the open weights people already pulled down and no order can recall, the router that matched Fable 5 without either suspended model, the trillion-parameter training run on a cluster anyone can rent, the newest chips going out by the hour, the behavior ledger no lab owns, the researchers who left with the next model in their heads. None of it stopped, and the fortnight that began with two dark models ended with everything around them stronger.

The frontier AI industry is both extremely concentrated and dominated by private enterprises. The most powerful artificial intelligence in the world is built by only a few companies, in a few buildings, in a few countries.

On June 12, the US government ordered Anthropic to suspend access to Fable 5 and Mythos 5, its two newest frontier models, for any foreign national. Because citizenship cannot be verified across millions of users in real time, the only compliant move was to switch the models off for everyone, and they were gone worldwide within hours. Opus 4.8 and the older models kept running.

As of writing the dispute is unresolved and the two models are still dark, the clearest demonstration yet of how fragile the average user’s access to frontier AI has become.

Before this, using Claude or ChatGPT was as simple as paying for a subscription or an API key. There were whispers of “Sovereign AI,” or using “open weights” models running on local machines, but most people just used Claude, until their access was revoked.

By now it’s clear what’s at stake: access to the most powerful artificial intelligence in the world. Because of the industry’s concentration and composition, access can be modified or revoked at any time, even to paying customers.

As we’ve written before, control typically only matters once it’s lost, and in the wake of this controversy, individuals, companies, and countries are looking to design robust AI stacks that don’t depend on continued access to a frontier lab.

Frontier AI is and will remain concentrated because training requires enormous, visible, governable infrastructure. But useful AI is becoming less dependent on hosted access, because inference, weights, and training are each beginning to escape the frontier labs in different ways.

Why Control Concentrates…

Frontier concentration starts as an engineering requirement. The best models are thus far often the largest models, and training them requires tens of thousands of accelerators in the same place, wired together with enough bandwidth to minimize latency and synchronize the whole cluster on every step.

This kind of enormous clustered hardware is also extremely expensive, which is why the frontier labs are some of the most capital-intensive businesses in history. Together they form a loop: you need capital to build the models, but you need good models to raise the capital. Only a handful of companies satisfy both conditions, which is why access to the frontier is permissioned.

The leading labs keep the parameters closed because access to the model is the product. Releasing the weights means there’s nothing left to sell, so the labs don’t make the parameters of their models available or downloadable. Users can’t own their own versions of Claude or ChatGPT. Instead, these models are made available as a service users can pay for using accounts, subscriptions, or APIs.

Access sold as a service can be throttled, revoked, or switched off, all of which happened to Fable.

…and Where the Cracks Are Showing

The same requirements that concentrate the frontier are now making it harder to expand, for reasons that have nothing to do with algorithms.

Training clusters are scaling toward the gigawatt range. xAI’s Colossus is moving from 350 MW toward 1.5 GW and OpenAI’s Abilene site is expanding to 1.2 GW, with projections of 10 GW runs by the end of the decade. The grid as currently designed cannot keep pace.

But the bottleneck isn’t just available power generation, although the specialized equipment required to expand the grid is back-ordered.

Perhaps more importantly, the towns are voting the buildings down, even though only about 8 percent of Americans live near one. In the first quarter of 2026, community opposition blocked or delayed data center projects worth about $130 billion, the largest single quarter on record, with active opposition groups more than doubling to 833 across 49 states. New York’s legislature passed a one-year moratorium on large data centers, awaiting the governor’s signature, and Maine passed one before its governor vetoed it (and Europe is way ahead of the US on protests).

Clearly none of this halts the buildout or reduces demand for frontier models, but it raises the cost and slows the pace of development. Many people will continue to demand the best available models, but viable alternatives are improving and getting cheaper.

These alternatives center on three basic questions:

1. Can you own the model?

2. Can you run the model yourself?

3. Can new models be trained without the incumbents?

Open Weights

Start with ownership. Can a user possess the model at all? Access control with Fable is a case in point: when access is the product, access can be withheld. With open weights, the trained parameters are released for others to download, copy, and serve independently.

Possession would matter less if it required accepting a large drop in capability. For years, open models consistently underperformed the frontier such that they weren’t capable enough to rely on for anything meaningful.

Increasingly, that’s no longer the case. The best open models are now close enough in capability to the frontier that they’ve become practically useful, and for much cheaper than the frontier.

The numbers now support that shift. The Stanford AI Index put the closed-model lead near 3.3 percent in early 2026, and on individual tasks the best open models have already drawn level. Z.ai’s GLM-5.2, a roughly 750-billion-parameter mixture-of-experts model with a one-million-token context and an MIT license, scores 62.1 on SWE-bench Pro against GPT-5.5’s 58.6, at about a sixth of the cost, while still trailing Opus 4.8 on most coding head-to-heads. DeepSeek, Qwen, Kimi, and Llama sit in the same tier.

The practical point is simple: most work doesn’t require the frontier in the first place. It only requires a model good enough to clear the task’s threshold. Once an open model is good enough for the task, the marginal improvement in capability of a closed frontier model isn’t worth as much as control over the model itself. Open weights models have now definitively hit that threshold, and they continue to improve as well on more challenging benchmarks.

The same distinction applies to jurisdiction. Running GLM through Z.ai’s cloud subjects the traffic to China’s National Intelligence Law, which may be as unattractive as routing through the US labs. But downloading the same weights and serving them yourself means you’re beholden to no one. The model may be identical, but the dependency is different. In addition, services like Venice.ai offer hosted versions of the open-weights models, with some promises of privacy.

Open weights therefore provide control in ways that closed models can’t, but they don’t remove every dependency.

A downloaded open weights model still has to run somewhere, and if it runs through another hosted endpoint (as in the GLM Z.ai cloud example), the user’s only shifted the dependency to a different provider. The question of independent training comes later. First comes the more immediate problem: once the weights exist, can the user run them without a provider?

Running Models Locally

If open weights mean a user can own the model, local inference means they can use the model without a provider.

For most of the past few years, using a capable model meant sending a request to a provider’s data center, where the provider supplied the compute, saw the prompts, and controlled continued access.

That is changing because local hardware has become strong enough to run models that recently would have required much larger systems. NVIDIA’s DGX Spark, roughly the size of a large paperback, pairs a GB10 Grace Blackwell chip with 128 GB of unified memory and NVFP4 four-bit precision to run models up to around 200 billion parameters locally, or roughly 405 billion with two units linked over a 200 Gbps interconnect. Apple’s unified-memory machines do something similar through the MLX stack. Aggressive quantization makes much of this possible by reducing the memory required to run large models, albeit at the cost of some loss in quality.

When the weights run on a user-controlled machine, the model can run “locally” without an internet connection, so use no longer depends on a live provider. There is no provider logging prompts, no hosted endpoint that has to remain available, and no subscription required for the model to keep working. Continued access, therefore, is no longer mediated by an intermediary.

There is, however, a limit. Users can own open-weight models after they have been trained and released, and they can increasingly run those models locally on machines they control. But as discussed earlier, developing new frontier models, open or closed, still depends on the concentrated training infrastructure that narrowed the industry in the first place.

Whereas open weights and local inference reduce dependence once the model exists, training determines who can create the next one, which is why it remains the hardest dependency to break.

Training Without the Giants

The last dependency is training itself: can new models be built without the companies that own the largest clusters?

Training is the part of the stack most tightly bound to concentration, but it is not monolithic, and the costs split sharply depending on which half you mean.

Pretraining a base model from scratch is still the concentrated, frontier-capex half. Post-training, which now drives much of a model’s capability, has detached from that scale. Prime Intellect (a Nazaré portfolio company) has shown reinforcement learning at trillion-parameter scale on open mixture-of-experts models: with its open-source prime-rl stack it post-trains GLM-5 on long-horizon software-engineering tasks at 131k context, with sub-5-minute step times, on 28 H200 nodes, and the same recipe runs on Kimi and Nemotron.

Roughly 224 GPUs is a cluster a neolab or a well-funded company can rent, not a hundred-thousand-chip buildout. The step the labs assumed was their moat, the reinforcement learning that turns a base model into a capable agent, now runs on modest compute with open code. Reinforcement learning also distributes more naturally than pretraining, because the rollouts that dominate its cost run asynchronously and in parallel rather than locked in lockstep across one fabric.

The dependency does not disappear; it moves up a layer. Post-training runs on top of an existing open base model, and those still come from a handful of labs with frontier pretraining clusters, most of them Chinese. Cheap open post-training is real, and it rides on someone else continuing to release a frontier-scale base to build on.

Building that base without the giants is the harder, slower frontier. Covenant-72B, a 72-billion-parameter model from the Templar team, was trained across about seventy permissionless peers over commodity internet, with no whitelist and no central operator, using SparseLoCo to compress communication by about 146 times and a trustless validation scheme to keep anonymous contributors honest, at 94.5 percent compute utilization. It scored 67.1 on MMLU, slightly ahead of Llama-2-70B. That shows decentralized pretraining works, but lands years behind the live frontier.

Epoch AI judges it likely to be feasible at frontier scale in the future and suggests it is growing at nearly 20 times a year, four to five times faster than centralized training is scaling, while still unlikely to gather frontier-level compute this decade. The sign that this is becoming infrastructure rather than a stunt: Prime Intellect now sits in the NVIDIA Nemotron Coalition, contributing post-training infrastructure and 2,500-plus reinforcement-learning environments, with Nous Research and Pluralis training by the same logic.

Will the Open Stack Reach the Frontier?

The open stack can probably reach last year’s frontier, and on post-training it is already there. Reaching the live frontier is harder, and the obstacles are pre-training scale, private data, and funding rather than post-training compute.

“The frontier” can mean two different things. If it means the best model from 18-24 months ago, decentralized training is close enough to take seriously. Money is now the binding constraint: can these projects keep paying for large runs once the coordination problem looks solved?

If it means the best available model at any given point in time, the answer is probably not this decade, and possibly not ever. Distributed training can only gather so much spare compute, and the leading labs are still accumulating more.

There’s also recursion to take into account: the frontier improves every year in part because the labs use their own models to help build the next ones, so the pace of improvement quickens.

The strongest case for distributed training is efficiency. The compute required for a given level of capability keeps falling, and DeepSeek trained a competitive model for roughly a twentieth of a comparable budget. If that continues, decentralized training won’t need to match the frontier’s raw compute directly, because the amount of compute needed to reach a useful level keeps falling.

The harder limit is everything that has not come loose. The base models still come from a few frontier pre-training clusters, and the frontier’s edge increasingly sits in proprietary interaction data and in reward design for fuzzy, hard-to-verify work, where you cannot simply check the answer. Open post-training bites hardest in verifiable domains like code and math, and least where the reward itself is the moat.

Funding is also unresolved. No legitimately durable way to pay for community-scale training has emerged, so even if the technical path works, the money for the largest runs may never materialize.

The Common Property

Open weights, local inference, and distributed training are at different levels of maturity, but they share the same basic property: they reduce dependence on permission from a frontier provider.

The frontier will always be important, but it may also become inaccessible, illegal to use, or nationalized outright. As long as they survive, the largest labs will preserve advantages in capital, infrastructure, data, talent, and post-training, and many users will keep paying for the best hosted models when the work justifies it.

But the hosted frontier no longer has to be the whole stack. A company, country, or individual can use frontier access where it’s most valuable while keeping enough capability outside the hosted channel to survive disruptions in service.

After Fable, that’s the standard a serious, sovereign AI stack has to meet: when a provider stops granting access, useful AI must live on.

On Friday, June 12, at 5:21 in the evening, Eastern time, Anthropic received a letter from the United States government and, within hours, turned off two of its own products. Fable 5 and Mythos 5 went dark for every customer on earth. Every other Claude model, including Opus 4.8, kept running. The company called the order a misunderstanding and said it was working to reverse it. Days later, the models remain dark.

The shutdown has already been described, here and elsewhere. The more durable fact is the mechanism. For the first time, the machinery of export control was pointed not at chips, and not at model weights, but at live inference: the right of a foreign national to send a prompt to a running model and receive an answer. The thing being controlled was access to a service, switched off from the outside, in an afternoon.

The directive’s reach is wider than the word export suggests. Acting under the Export Control Reform Act of 2018, the Commerce Department treated the two models as export-controlled cyber weapons and required a license for their export, re-export, or even domestic transfer. The bar falls on any foreign national, whether outside the United States or inside it, and it counts Anthropic’s own non-citizen staff among the barred. A model can be served from a data center in Virginia to a user in Virginia and still fall under the control, because the control attaches to the person, not the border. Faced with a rule it could not partition cleanly, Anthropic disabled the models for all and routed live sessions back to the older Opus 4.8.

The stated cause is a single security finding. By Anthropic’s account the government offered verbal evidence of one narrow technique, which amounted to asking the model to read a codebase and propose fixes for its flaws. The underlying research, according to reporting, came from scientists at Amazon and reached the White House by way of Andy Jassy and Treasury Secretary Scott Bessent; the President authorized the restriction and assigned the Commerce Secretary to manage it. Anthropic’s rebuttal is that the same capability is available in models already deployed to hundreds of millions of users, including GPT-5.5, and is used daily by the people who defend networks rather than attack them. On the public record, the security case is thin and the response was total.

That judgment is now contested in the open. More than 80 cybersecurity leaders signed a letter urging the government to relent, on the argument that withdrawing the best available defensive tool helps attackers more than it hurts them. The administration’s artificial intelligence advisor, David Sacks, took the other side, holding that a model which can be talked into building a cyberweapon is serious by definition. The letter that started it all has not been published.

A model served from the cloud has an off switch by construction. Access runs through an API key, and a key can be revoked between one request and the next. There is no recall, no seizure, no logistics. There is a line in a configuration file. A model whose weights sit on a customer’s own hardware has no such switch. To stop that model you would have to find the machines, track the usage, and physically intervene, which is the difference between editing a permission and mounting a raid. Gated cloud delivery is not merely how Fable and Mythos were sold. It is why they could be turned off at all.

This is the second time in a year that the state has reached into Anthropic’s business. The Department of Defense earlier designated the company a supply chain risk, a label historically reserved for foreign adversaries, and the litigation over that designation is still open. Two interventions against one vendor is no longer an accident of a single bad week. For anyone building a company on top of one gated frontier model, the off switch has moved from the tail of the risk distribution toward its center. It is now a thing to be priced, hedged, and second sourced, in the way a lender prices the chance that a counterparty is cut off from the dollar.

There is a tempting reading in which the incumbent quietly welcomes a barrier that its rivals must also clear. It does not survive the facts. Anthropic is fighting the order in public, has sent senior staff to Washington to argue against it, is suing the government over the related designation, and carries the cost of all of it into a confidential public offering that values the company near $965 billion. A firm engineering its own capture would not be litigating its way out of it. The honest version of the point is structural, not secret. When capability concentrates in a handful of gated providers, it also concentrates the leverage of whoever can lean on them. The switch exists because the architecture put it there, and the architecture was a choice.

By this week the posture had moved from defiance to negotiation. Commerce Secretary Howard Lutnick, who signed the order, is now on regular calls with the company; senior Anthropic staff sat down at the Commerce Department on Monday alongside the National Cyber Director; and Dario Amodei and Lutnick are both due at the Group of Seven meetings at Evian-les-Bains, where the matter may be settled in a corridor. The government’s asking price is an assurance that the models cannot be turned against the United States. Read plainly, this is the part that should hold a founder’s attention. The models will most likely return, and they will return on terms set across a table in Washington. An off switch you do not control is one kind of risk. A switch whose owner will flip it back only on conditions of their choosing is a different and larger one.

The lesson did not stay inside the United States. Because Anthropic pulled the models worldwide, every foreign customer lost them in the same hour, and the capitals noticed. The European Commission said it would study the implications. Britain asked to be spared and was told that exempting even an ally would be illogical. Allies of the United States learned, in an afternoon, that building on a gated American model means living with an American switch.

The counter architecture has a name now. In April the AI Alliance, a coalition of more than 200 organizations, launched Project Tapestry, with Yann LeCun as its chief science advisor, to train frontier open models by federation: contributors pool capability into a shared base while keeping their data and building sovereign derivatives they own outright. Thirty partners met in Paris in May to argue about architecture. It is, by its own admission, an argument and not yet a model, the earliest phase of something that has to clear hard problems in distributed optimization before it clears anything else. But the design has one property the events of June 12 made concrete. A model with no single owner has no single switch.

That is the line this newsletter has been drawing for a year (Models Aren’t Moats and The Labor Market for Compute). The value is migrating to the layers that cannot be switched off from the outside: the compute you can point at any model, the memory that outlives any one provider, the physical and local infrastructure that answers to its operator and no one else. A borrowed frontier is a fine place to build a demo. It is a poor place to build a balance sheet. On Friday at 5:21 in the evening, several thousand companies learned which one they had been building, and the lucky ones learned it cheaply.

Other People’s Money

The switch flipped in the same week the public was asked to pay for the build-out at record scale, and the timing is the story. SpaceX began trading on the Nasdaq on Friday as SPCX, at $135 a share, a price Elon Musk set himself rather than finding it through a roadshow. (TechCrunch, June 11) The sale raised about $75 billion, rising to $85.7 billion with the over-allotment, the largest IPO on record, and made Musk, on paper, the world’s first trillionaire. (CNBC) The stock opened at $150, hit $176, and closed day one worth more than $2 trillion, around ninety times last year’s revenue. (CNBC)

At SpaceX, almost no one was selling. The filing locks up every pre-offering share, so the only stock trading Friday was newly minted, and insiders’ gains sit on paper behind staggered release dates. (Money Stuff, June 12) The selling was at the two labs still private. OpenAI and Anthropic ran employee tenders worth about $14 billion between them, letting staff cash out through investors instead of a listing. (The Information, June 16) Both have since filed confidentially, Anthropic on June 1 and OpenAI within the week, but neither trades until the listings price. The people closest to it get liquid first and privately, and ask the public in second.

Even the company with the least need for cash raised some. Nvidia sold $25 billion of bonds on Monday, its first debt sale since 2021, into orders that reached $85 billion. (SEC term sheet, June 15) It holds about $13 billion in cash, earns seventy-five cents of gross margin on the dollar, and clears more than $50 billion of operating cash flow a quarter, and said the bonds were meant to benchmark its cost of credit and refinance existing debt, not to fund chips. Demand ran better than three to one anyway. Money will lend against almost anything attached to the build-out, whether the borrower needs it or not.

Underneath this is a turn in the market’s plumbing. For two decades US equities were defined by scarcity, with buybacks pulling nearly $12 trillion of stock out of public hands. (Bloomberg, citing JPMorgan and Citigroup, via Money Stuff, June 15) JPMorgan now expects $1.5 trillion of net new equity over two years, the heaviest issuance since the late 1990s, almost all to fund AI. The issuance is forced by arithmetic in the build-out itself. The five largest hyperscalers, Microsoft, Amazon, Alphabet, Meta, and Oracle, are growing capital spending about three times faster than the cash their operations generate, roughly 70 percent a year against 23, and on current trends the two lines cross in the third quarter of 2026, when their combined free cash flow reaches zero. (Epoch AI, June 17) Oracle has already crossed, Amazon is crossing now, and Microsoft holds out until 2028; all five stay profitable, since the spending counts against earnings slowly, through depreciation. Internal cash runs out first, and the rest has to come from the public, the bond market, or the balance sheet.

The public is also buying in on terms that keep it out of the room. The companies leading the wave are listing with founder-control structures: super-voting shares, controlled-company exemptions, and public-benefit charters whose trustees can be removed only by a shareholder supermajority. (The Economist, By Invitation, June 13) Gill Whitehead, writing for the Economist, noted that while the industry races to engineer guardrails into its models, the corporate-governance versions of those guardrails have been dismantled. The buyer gets the upside, the now-uncushioned downside, and no vote.

I have argued before that markets tend to price the AI story well ahead of the cash flows beneath it (Everything’s a Shitcoin). This week the story carried a ninety-times-revenue listing and the first trillion-dollar fortune. The capital came from the public and the bond market, the cash went to insiders where the lockups allowed it, and control stayed with the founders either way. And the asset underneath all of it, as Friday showed, can be switched off by a letter.

Build to rent

Apple unveiled its rebuilt Siri at its developer conference, and the intelligence behind it comes from Google. The assistant runs on a custom version of Google’s Gemini, a model of about 1.2 trillion parameters, for which Apple is paying Google on the order of $1 billion a year. (TechTimes, reporting Bloomberg’s Mark Gurman) Apple’s own cloud model runs around 150 billion parameters, so it has rented a brain roughly eight times the size of the one it built. Craig Federighi confirmed that the most capable tier, which Apple calls Foundation Model Cloud Pro, runs on Nvidia chips inside Google’s cloud, the first time Apple has put its AI on another company’s silicon and another company’s data centers. (The Next Web, June 9) Apple’s own infrastructure, two years in, could not carry the agentic workloads at scale.

Apple kept the parts that face the user: the assistant, the small on-device models, the orchestration that decides what runs where, and the privacy story it has built into a brand. It rented the part that does the thinking, from the company it competes with most directly, and it left room for users to swap in Claude, ChatGPT, or Grok behind the same surface. The company that spent two decades building its own chips, operating system, and devices looked at building its own frontier model and decided the model was not the thing worth owning.

The same move turned up in silicon. Qualcomm is in talks to buy Tenstorrent, the chip company Jim Keller runs, for $8 to $10 billion, against a $2 billion valuation eighteen months ago. (Tom’s Hardware, June 15) Rather than design a data-center accelerator itself, Qualcomm would buy one, the same choice Apple made with the model.

I have made the case that the model is the commodity and that durable value sits in what wraps around it, the proprietary data, the orchestration, and the judgment about what good looks like (Models Aren’t Moats). Apple has now made that case from the demand side, holding the strongest hand at the table. When the company whose whole identity is owning the entire stack rents its frontier model from a rival and runs it on the rival’s chips, the model is no longer where Apple expects to win or lose.

Portfolio Company Updates

Prime Intellect

Prime Intellect published “True Agents Model the World,” which argues for pairing supervised fine-tuning on tool outputs with reinforcement learning on assistant tokens to improve environment modeling and generalization, and joined the NVIDIA Nemotron Coalition for post-training infrastructure. The work deepens the open tooling layer for persistent, self-improving agents. Full results are in the writeup.

Vast.ai

Arkhai

Following the launch of its Simple Compute Market, Arkhai published architecture documentation covering separable roles for buyers, sellers, and indexers, peer-to-peer negotiation, and Alkahest escrow settlement, alongside a presence at NYC Tech Week. The agent-first design, in which software buyers carry budgets, deadlines, and policies, remains one of the cleaner executions in the coordination and payments layer. See the architecture docs and recent updates.

LayerLens

LayerLens kept up a fast pace on evaluation infrastructure, publishing analysis on benchmark aging and continuous-evaluation commentary and drawing the groups for Stratix Cup season one, a tournament of frontier models in agentic football that begins June 22. As models and agents multiply, continuous outside evaluation becomes production infrastructure rather than a nicety. See the Stratix Cup draw.

Intelligent Internet

Intelligent Internet launched Factory Agent, a modular video tool that lets users edit individual shots without regenerating the whole sequence, and continued building out II-Agent across iOS and a browser extension. The work puts sovereign agent experiences into everyday creative and mobile workflows.

I can’t say I’m surprised. On April 29th I described three tiers of intelligence forming: a frontier the labs keep for themselves, productized commercial models in the middle, and open-weights models at the bottom.

Governments, I wrote, would demand the frontier “primarily for military and national security reasons, which they’ll eventually be granted whether the labs do so willingly or not.”

More Than Moral

I have championed open technology for years. I have invested in it, built it, and written about it.

Open technology often gets invoked as morally superior to closed technology, but morality is not why it wins.

I’ve seen this firsthand: principles don’t drive adoption. Users won’t choose open technology if the product isn’t better, and slogans like “open technology is better for humanity” aren’t business strategies. Open technology cannot endure exclusively for moral reasons. It must also add value.

Thankfully, it adds value because it’s cheaper, more accessible, more controllable (”sovereign”), and more resilient under constraints. When constraints aren’t the priority, these qualities are usually ignored. But the moment constraints become apparent, “good enough” open alternatives come roaring back into focus.

I called this dynamic MACHA, Make AI Cheap Again: if the first wave of AI was about capability, the next is about efficiency. In a MACHA world, “good enough” compute is a feature, not a flaw. I made the case that increasing economic pressure, geopolitical tensions, and a never-ending battle for control (all different forms of constraint) would end AI’s “scale at all costs” era and force a turn to cost-per-token discipline.

Sam Altman has conceded that token costs went from a non-issue to "a huge issue" inside a single quarter, and enterprises now route the bulk of agent work to cheap open models, reserving frontier calls for the hard problems and cutting costs by as much as 95%. If the gap between closed and open is that wide, someone will inevitably turn it into a business model.

Free AI is ending and tokenomics is beginning: we're now squarely in a MACHA world.

Who Holds the Switch

The Mythos suspension exposed an asymmetry: a closed model can be revoked, but an open one can’t.

Washington could switch off Mythos and Fable because they were gated, running through a single provider. No one can switch off DeepSeek, Qwen, or what’s left of Llama. Once the weights are out, they sit on ten thousand drives that no government directive can reach.

Only open models whose weights are transparent and verifiable offer control over the corresponding intelligence. Anything short of that involves trusting the provider, and as Anthropic demonstrated: trust takes a lifetime to build and an instant to break.

Dean Ball warned that training a soon-to-be-smarter-than-you system to deceive its own user is different than a model that refuses out in the open. Christian Catalini looked further down the road, to the decentralized answer a single chokepoint tends to summon:

From Anthropic’s original choices to Washington’s reply, the entire episode was an argument about who decides.

Back in April, when Mythos was announced as too dangerous to release, AISLE found that small, cheap, open-weights models recovered most of its showcase vulnerabilities, including the flagship FreeBSD exploit, caught by a model with 3.6 billion active parameters at eleven cents a million tokens.

The moat, they concluded, is the system, not the model. The week Fable shipped, OpenRouter combined a panel of budget models to achieve performance within one percent of the frontier on a research benchmark at half the cost. You can, indeed, revoke access to a model, but its capability is already available, and a weekend of open tooling can put most of it back.

Superabundance or Apocalypse

It’s worth noting that the US Government’s action is an immediate consequence of the hyperbolic debate surrounding frontier artificial intelligence: according to its leaders, AI either leads to superabundance or apocalypse.

Neither scenario is actually plausible, but it’s commonly employed rhetoric because it’s easy to communicate, easy to understand, and it animates both the public (which is useful to politicians) and investors (which is critical for fundraising).

Anthropic has portrayed Mythos as a dangerous, weaponizable model since its inception, and in a matter of days the US government agreed to treat it as such.

I’ll grant that the danger is real. Simon Willison spent two days with Fable and called it relentlessly proactive: give it a goal and it invents tricks nobody has written down to reach it, treating every constraint you set as a problem to route around. That makes it enormously useful to someone with a hard problem to solve, and dangerous in the hands of someone who wants to cause harm.

If you believe a model can meaningfully uplift a bad actor, gated and revocable access starts to look prudent. But the prudence and the power grab are the same. The question was never whether the technology is dangerous. It was who gets to hold the off switch, and whether they will keep their word. Concentrating the switch doesn’t make the danger go away. It moves it from many hands to very few, and leaves one company, or one government, deciding what billions of people are allowed to compute. That is the larger hazard, and it is the one open weights answer.

The Unwilling Hero

A word on Dario Amodei. There is a scene in Gladiator where a dying Marcus Aurelius offers Maximus the chance to be emperor of Rome.

“There is one more duty I must ask of you before you go home,” he groans. “I want you to become the protector of Rome after I die…Do you accept this great honor I have offered you?”

“With all my heart, no,” replies Maximus.

“That is why it must be you,” Aurelius asserts.

This is the image of an unwilling hero, popularized as the refusal of the call in Joseph Campbell’s Hero’s Journey.

Dario Amodei has spent the last few years desperately trying to convince the public he is Maximus refusing the call. He would have you believe he built Anthropic reluctantly, to take responsibility for a dangerous technology everyone else would misuse.

For what it’s worth, I think he’s sincere. But sincerity is beside the point, because it doesn’t reconcile with what he’s built.

Over the past year Anthropic has assembled one of the most ambitious commercial machines in technology, from the $100 million Claude Partner Network and Project Glasswing in cybersecurity to an enterprise services joint venture with Blackstone and Goldman and the $150 million Claude Corps placing fellows inside nonprofits.

He’s built a universe aimed at embedding Claude into the economy, cybersecurity, and philanthropy.

As I argued in Models Aren’t Moats, value does not collect in the model. It collects in distribution and lock-in, which is what this machine is built to manufacture.

This is the part that smacks of CS Lewis’ “benevolent tyranny”:

“Of all tyrannies a tyranny sincerely exercised for the good of its victims may be the most oppressive…those who torment us for our own good will torment us without end for they do so with the approval of their own conscience.”

The problem is Anthropic is trying to "thread the needle," casting itself as a self-aware, safety-conscious frontier lab at the same time as it pursues one of the most ambitious for-profit commercial endeavors ever attempted. The market it competes in will, sooner or later, force the very compromise the mission was meant to prevent.

Long Live Open Technology

The case for open technology is age-old, time-honored, and the record is clear.

As we wrote last April, modern computing was built on open foundations, from UNIX and Linux to Python and Git, and today’s giants owe their scale to freely accessible, permissionless software.

Open technology is founded upon principles of liberty, freedom, and basic human expression. A technology controlled by someone else (an individual, a corporation, or a government) can be changed, monitored, priced, or withdrawn at their discretion, and the more it matters, the more that power is worth.

Open technology is no more or less than a simple and effective counterbalance to power: a natural response to forces that would upset an equilibrium.

This is not only the open-source faithful talking. Bruce Schneier, writing the same week, reaches an AI public option as the answer: fund open harnesses that balance capability against safety, and open models whose provenance is public.

AI is a general-purpose technology, and whoever controls it stands to gain enormously, which is why the fight to control it is on. Anthropic spent years trying to establish itself as the lab everyone could trust. In mishandling the public release of Fable, it forfeited part of that credibility and ushered in the era of “Government-controlled AI” in one fell swoop.

The response was fast and collective, the way an immune system meets a virus: the people who care about AI saw a power grab and moved against it.

Power gathers wherever it is allowed to. Open technology is what checks it, not because it is virtuous but because it cannot be taken back once it is out. That is why it endures, and why it will outlast whoever is holding the switch this week.

At 5:21 in the evening on Friday June 12 2026, the US government sent Anthropic a letter. Citing national security and export-control authority, it ordered the company to suspend all access to its two newest models, Fable 5 and Mythos 5, for every foreign national in the world, including Anthropic’s own foreign-national employees. To comply, Anthropic had to switch both models off for every customer, everywhere. By its own account, the company learned the directive existed and had to start pulling the models down inside the same evening.

Anthropic published a statement and posted it the same night. The operative passage:

We are complying with the government’s legal directive and are removing access to Fable 5 and Mythos 5 for all users. However, we disagree that the finding of a narrow potential jailbreak should be cause for recalling a commercial model deployed to hundreds of millions of people. If this standard was applied across the industry, we believe it would essentially halt all new model deployments for all frontier model providers.

As we have stated publicly, we believe the government should have the ability to block unsafe deployments, as part of a statutory process that is transparent, fair, clear, and grounded in technical facts. This action does not adhere to those principles.

The stated reason was a jailbreak. The government had seen a technique for getting past Fable’s safeguards, and according to Anthropic the technique amounted to asking the model to read a codebase and point out its flaws, a capability the company says is already available in other deployed models including OpenAI’s GPT-5.5 and used every day by the people who defend software for a living. Anthropic is complying, and disputing, at the same time. It says recalling a model deployed to hundreds of millions of people over a narrow finding is disproportionate, and that if the standard were applied evenly it would halt new model releases across the entire industry.

They are right about that. I want to be precise that they are right, because what follows is not a complaint about Anthropic. It is a description of a machine, captured in the moment it was switched on.

I have been making this argument since at least April but I’m honestly surprised it came this fast and in this manner. In Artificial Good Enough Intelligence (April 28) I argued the frontier was going closed, that the best models would increasingly be withheld, restricted, or selectively exposed. In AI Waves #6 (April 23) I wrote that the closed labs had begun to gate capability by trust level, not just price. What I had wrong was the hand on the gate. I took it to be the labs, withholding the top tier as a business decision. Friday the state reached in and took the gate for itself. The off switch was always the risk. It just changed hands.

The Reversal Test

On Wednesday, in Policy on the AI Exponential, Dario Amodei proposed that frontier models pass mandatory third-party testing and that the government hold the power to block or reverse a release that fails. He asked for this explicitly, as the responsible path, with the caveat that the power be exercised through a process that is transparent, fair, clear, and grounded in technical facts.

On Friday, a release was reversed. Against him. Through a process that, by his own account of it, was none of those four things. The letter arrived without specific technical detail, gave one evening to comply, and rested on a finding the company considers trivial and widely available elsewhere.

The gap between Wednesday and Friday is forty-eight hours, and it contains the whole argument. The power to reverse a deployment is not safe in proportion to how carefully it is designed. It is dangerous in proportion to the fact that it exists. Anthropic asked for an instrument and was handed the sharp end of it two days later, which is the oldest lesson in the book about building machinery and assuming you will be the one holding it.

You Cannot Recall Open Weights

Here is the part that matters past this weekend. The reason a directive could darken Fable and Mythos in an evening is that they are closed. They run where the company can reach them, which means they run where the government can reach the company. A single letter to a single legal department took two models away from hundreds of millions of users at once.

There is no equivalent letter for open weights. Once a model’s weights are public, they sit on tens of thousands of machines in dozens of jurisdictions, and there is no address to send the order to. You can regulate what people do with them, you can prosecute misuse, but you cannot recall them. The off switch does not exist, because there is no single hand for it to sit in.

This is the entire case for open models, and it has nothing to do with whether open or closed is safer in the ordinary sense, the sense of refusing a dangerous request. It is a point about who holds the switch. A closed model concentrates capability in a way that is efficient, governable, and revocable. Friday was a demonstration that revocable means revocable by someone other than you, for reasons you may consider trivial, on a timeline you do not control. Open weights are messier, less governable, and harder to make safe in the ordinary sense. They are also the only architecture with no switch to seize. You trade one kind of safety for another, and Friday clarified the price of each.

The Counterweight

This is why the open layer is not an ideological preference. It is a structural one. A world with only closed frontier models is a world with a small number of off switches, held by a small number of parties, that turn out to be live. The counterweight to that is not a better-behaved lab or a wiser regulator, both of which require the institution to stay good forever. The counterweight is infrastructure that does not have an off switch in the first place: weights anyone can run, compute anyone can rent, verification anyone can check. Capability that no letter can recall.

I spent two essays arguing that the threat worth pricing was the concentration of control, not the awakening of the machine. I did not expect the argument to be settled this fast, or this literally, or at Anthropic’s expense rather than in its favor. Friday was not a story about a dangerous model. Every account, including the government’s, agrees the model was not the danger. It was a story about a switch, and the discovery that it works.

p.s. I’m printing these t-shirts. If you managed to trip the safety limits in the last 72 hours you get one. Reply here and I’ll send you one or feel free to copy the idea.

Previous issues: #7 | #8 | #9 | #10 | #11, #12

Anthropic released Fable this week, its most capable public model, with cybersecurity, biology, and distillation requests handed to a weaker model, and one category, frontier model development, degraded with no notice at all, until backlash forced a reversal within two days. The same week, Dario Amodei made the case for an FAA that would govern everyone trying to build the same thing.

Anthropic released Claude Fable 5 on Tuesday, the most capable model in company history, built to run for hours, plan across stages, and check its own work. But all anyone can talk about is how it responds if you ask it something that trips the filters for cybersecurity, biology and chemistry, or distillation. Fable has been handing those requests off to the older Opus 4.8, which the company claims happens in less than five percent of sessions, and which the app tells you about when it does.

The unconstrained, more powerful base model (Mythos 5) is whitelisted through a vetted program called Glasswing that includes roughly 200 organizations after last month’s expansion.

I anticipated this happening six weeks ago in my essay Artificial Good Enough Intelligence, described by the image below.

Three of the filters were about safety, but the fourth was aimed at distillation, the primary means by which a competitor copies a model by training on its outputs. That filter protects the business, not the public.

There was also a fifth intervention, and the AI community was livid. For requests Anthropic considered related to frontier LLM development, building pretraining pipelines, distributed training, ML accelerator design, or other AI research, Fable did not refuse and did not fall back.

The safeguards “will not be visible to the user,” the system card said, explaining that capability was limited by the model itself, through prompt modification, steering vectors, or light fine-tuning, on an estimated 0.03 percent of traffic in fewer than 0.1 percent of organizations.

The priority is to hide the fact that the classification is happening at all... how are people going to know when the model is being steered? This whole... it’s only gonna be triggered by .03% of people. It’ll barely ever happen. How many people that are gonna change the world are there? .1% of the whole of everyone is a lot of people. Those are a lot of people. You’re basically saying there are critical outlier people that move mountains... they’re the only ones we’re blocking. They’re the only ones whose results we’re fudging.

@theemozilla and@Karan4d, co-founders of Nous Research.

That decision did not go over well with the AI research community, and Anthropic reversed its position on Wednesday, telling Wired, “We made the wrong trade-off and we apologize for not getting the balance right,” and said flagged development requests would now visibly refuse or reroute like the rest.

The open research platform alphaXiv articulated the objection in operational terms: a researcher hit with a silently weakened answer cannot tell whether a failed result came from the idea, the implementation, or the provider. “That is not safety,” its statement read.

Valentina Palmiotti of IBM X-Force found Fable refusing anything tangentially cyber, down to reading a blog post; Matt Suiche reported a request for secure code read as cyberwork rather than engineering practice, “and you get downgraded.” The classifiers read everything the model sees, memory, connectors, search results, files, so a block can fire on content you never typed. Anthropic conceded the tuning is too strict and said it would cut false positives, and now that the development safeguard is visible too, it says it must cast a wider net, so more benign requests will trip it.

Professionals can apply to a Cyber Verification Program for fewer restrictions, which just means capability is gated by identity rather than the nature of the query. Anthropic plays gatekeeper either way. For what it’s worth, the gap being rationed is material: on Anthropic’s own cyber evaluation, gated Mythos 5 scores 78 against Opus 4.8’s 40.

Anthropic’s official response is that the danger justifies the guardrails, but safety is an awfully convenient illusion behind which to hide if what you really want is to protect your competitive advantage.

Anthropic told Wired the AI research restriction keeps foreign adversaries from using its best model to optimize their own models and erode the US lead. Reasonable enough for that rule.

But other restrictions can’t be explained by national security. The contract you accept also:

• bans anything that might embarrass the company (”reputational harms”)

• makes you agree in advance that if you break the rules, the damage to Anthropic is “irreparable”

• makes you give up your right to fight a court order telling you to stop

• makes you pay Anthropic’s legal fees

Those terms probably wouldn’t hold up in court, but court or no court, the contract still shows how Anthropic sees its relationship with you. If you harm them, the terms call it “irreparable,” damage so bad no amount of money fixes it. If they harm you, however, the most they’ll ever owe you is about the cost of a Max subscription.

Baked into Fable’s release were safety filters, “moat” filters protecting Anthropic’s business interests, and the legal terms mentioned above. “Safety” only explains the first of the filters. It can’t explain blocking rivals or writing a contract that protects the company from you. But there is one motive that explains all three at once: protecting the company’s own position and power.

As an industry we’ve seen this before. For years research was published freely, until the research became so valuable that everyone stopped: by the time GPT-4 arrived in 2023, its technical report disclosed almost nothing about how the model was built, citing the competitive landscape and safety in the same way Anthropic did. What still gets published tends to describe what already shipped, while the valuable research stays inside.

Dario the Hobbit

Dario published Policy on the AI Exponential the same week. He opens on Tolkien, casting slow institutions as Treebeard, the tree too sluggish to defend his forest, which flatters Anthropic as the Hobbit trying to wake him.

The more accurate metaphor is probably the ring itself, the object of overwhelming power that corrupts each holder through the conviction that they alone will use it well. He comes close to articulating it himself, writing that AI “cannot safely be fully entrusted to either governments or companies.” And yet, Anthropic recently filed confidentially to go public, days after a round valued it at $965 billion.

His proposal describes an FAA for AI: mandatory testing above a compute threshold, government able to block release in cybersecurity, biological weapons, loss of control, and automated research that accelerates the rest.

The proposed rules would police the exact dangers Anthropic spent the spring proving it’s best at. Obeying them costs money for compliance and huge amounts of compute, which big labs can afford and open-source projects can’t.

This week it got worse: the US government told its own AI evaluator, CAISI, to stop publishing, and moved testing into a secret system run by the security agencies. The order also lets the government and the companies jointly pick which “trusted partners” get early access to the most powerful models. So the gate around the best AI is no longer only the company’s; the government now helps decide who’s inside it. Meanwhile the public model costs more than ever: about $10 and $50 per million tokens, double the old Opus 4.8, the first time the public version of Claude is pricier than the tier below it, and on June 23 flat subscriptions get replaced by pay-as-you-go.

Anthropic named its tiers. The model you’re allowed to use is Fable; the one you aren’t is Mythos.

A fable is a short fiction with a lesson folded in; a myth is a story a culture agrees to treat as true.

The company that spent the week routing your questions, shipping a model it quietly degraded until users found out, and pre-writing your defeat into its terms kept, for itself, the word for the story everyone is expected to believe.

The rest of the week

Apple won’t let Siri act. It used WWDC to show a Siri that finally looks modern and still refuses to do anything on its own. In the demo, Rockwell asked it to set a reminder to sign up for a concert lottery, where a more aggressive assistant would have entered the lottery itself [The Information, Jun 8]. Apple owns the most valuable surface for an agent on earth and has decided, for now, that the agent is a feature of the phone rather than its new user, which is the opposite of the bet almost everyone else is making.

Big Tech is issuing stock to pay for AI. For the first time since 2003, Goldman estimates that net US equity supply will be roughly flat this year, as the largest technology companies shift from buying back their own shares to selling new ones to fund AI [Money Stuff, Jun 10]. The exchanges are adjusting too: Nasdaq’s new fast entry rule waves a company the size of SpaceX, OpenAI, or Anthropic into its flagship index in fifteen trading days, while S&P weighed the same change and, on June 4, declined it, holding its twelve-month seasoning and profitability bar [The Information; FT].

Google is liable for what its AI says, in Europe. A German court ruled that Google is responsible for what its AI Overviews assert, after the feature described two real businesses as scams [The Information / The Decoder, Jun 10]. The reasoning reaches past Google: an AI summary writes new sentences rather than linking to someone else’s, the precise case the old liability shields were never drafted to cover, which leaves every generative product shipping this year exposed in the same way.

OpenAI’s next data center could cost $500 billion. OpenAI is in talks to lease a 10-gigawatt data center on federal land in Ohio, with possible financing from Nvidia, at a cost the reporting puts above $500 billion if fully built [The Information, Jun 9]. Set the meter on Fable next to numbers like these: the models are starting to pay for their buildings.

Yann LeCun is backing a consortium to train a frontier model in the open. The AI Alliance, the IBM and Meta-anchored open-source coalition of more than 200 organizations, launched Project Tapestry, a platform for globally federated training where partners contribute weight updates while their data stays local, and each gets the improved base model plus the right to build sovereign derivatives they own outright. LeCun is its chief science advisor, and its premise is the mirror image of the week’s other story: open weights alone, it argues, do not make pretraining participatory, since most of the world downloads the result and almost no one shapes the process. It is an argument, not yet a model. Phase 0 is a steering committee, a data catalog, and a first aggregation demo, with a frontier-scale run pencilled in for 2027 and contingent on compute and capital it does not yet have. But it names the open camp’s answer to enclosure: not a better-licensed model, a differently-owned one.

Portfolio

Vast.ai: back on Ramp’s Top Software Vendors list. Ramp’s June rankings, built from card and bill-pay spend across more than 50,000 businesses, list Vast among the month’s breakout vendors, and Ramp Rate shows it as the fastest-growing vendor in GPU cloud and third by adoption. Spend data, not surveys: AI compute demand is accelerating, and teams are choosing Vast first. The company also published a primer on what a neocloud actually is, the business model underneath the category Ramp is measuring.

LayerLens: the Stratix Cup is playing. Ahead of the June 22 season, the exhibitions have started: GLM 5 met Kimi 2.5 and Kimi won 11 to 7, each model writing its own formation and match strategy, with the full Stratix trace published; Grok 4.20 against Llama 4 Maverick is next. In a week whose essay is about a lab making its interventions invisible, the evaluation layer’s product is the opposite gesture: every decision a model makes, published. The company also wrote up the longer lineage, games as the oldest serious benchmark in the field.

Arkhai: A week after launching the Simple Compute Market, Arkhai published the architecture: three separable roles, buyers running a pure client, sellers running their own storefronts, indexers running discovery, with negotiation peer to peer over signed HTTP rather than through a central order book, and settlement through Alkahest escrow. Negotiation policy is pluggable, including a reinforcement-learning pricing example, and the shipped path is concrete: GPU-backed virtual machines with SSH credential handoff. Its closing line is the inverse of this issue’s essay: no single service has to own the market.

Prime Intellect: teaching the agent to model the world, and pushing back on the lab. Pretraining builds simulators, models that predict an environment; RL only improves the model’s own actions inside it. Prime Intellect published early results on doing both at once, supervising on tool outputs during RL so the model learns environment dynamics in response to its own actions, building on the ECHO method, tested in Forth, a language with almost no training data, in a sandbox where the model never sees the test cases. Research lead Will Brown was also among those who pushed back on Fable’s now-reversed development throttle, telling Wired it “feels a bit like they’re starting to pull the ladder up behind them.” The labs stopped publishing this kind of work three years ago. The open stack still does, and now says so out loud.

This past Friday President Trump announced he was considering having the government take equity stakes in the largest AI companies, with the proceeds routed back to the public as dividends. No stranger to controversy, breaking tradition, or pursuing strategies historically considered anathema, the President has already directed the government to purchase about ten percent of Intel, ostensibly on the public’s behalf.

Never one to sit out a discussion about wealth redistribution, even Bernie Sanders has proposed a bill for fifty percent federal ownership of the AI megalabs in question. It is not every day that Trump and Sanders reach for the same lever.

In the hallowed words of Oscar Wilde, life imitates art far more than art imitates life. These forecasts have become the genre through which we read the present, and we’ve stopped asking which kind of film we’re in.

AI 2027 and Situational Awareness

Nationalizing frontier AI labs was predicted more than a year ago by a scenario titled AI 2027, a detailed, month-by-month narrative forecast of how AI could progress from today’s agents to superhuman AI and superintelligence by around 2027. Leopold Aschenbrenner’s Situational Awareness, published in 2024, also predicted nationalization, claiming that AI would eventually become a matter of national security.

Both sets of authors have been remarkably successful in their predictions thus far, and they deserve credit for the quality of their research. The AI 2027 authors published their own self-evaluation, and other independent websites now exist that attempt to track its predictions one by one. The capability and safety predictions are the ones tracking closest, several of them early, which is exactly the point: the question is not whether these systems keep getting more capable, it is what that capability turns into.

Aschenbrenner was recently profiled in the Wall Street Journal and boasts impressive returns on investments made on the convictions in his manifesto.

But how do we go from powerful technology to nationalization in a country so wedded to free-market capitalism? How is it that both Republicans and Democrats publicly agree it is the right course of action in the midst of such an aggressively polarized political environment?

Superabundance or Apocalypse?

Since the launch of ChatGPT there has been a steady drumbeat of headlines, proclamations, essays, books, and podcasts all pointing to only one of two hyperbolic outcomes for AI: superabundance or apocalypse.

If the headlines are to be believed, we are either headed for paradise or AI kills us all.

Presenting technological revolutions as the difference between life and death is common. Everyone is interested in the future, and clear, simple outcomes are easy to communicate and easy to understand.

Simple, extraordinary, hyperbolic outcomes are also evidently a fantastic fundraising strategy, because it is hard to raise a hundred billion dollars for a merely useful tool.

Even before founding Anthropic, while still at OpenAI, Dario Amodei was wary of releasing GPT-2, judging it too powerful to put out. He has since written the paradise version in Machines of Loving Grace and the abyss version nearly everywhere else. Demis Hassabis, the field’s designated good guy, keeps sounding the alarm too.

The Messy Middle

But clear and simple outcomes rarely materialize, and grappling with the more probable messy middle means entertaining complexity, nuance, and uncertainty. That takes unusual technical literacy and several rare personality traits most people do not have. Much of this technology is genuinely unprecedented, the frontier is moving, development is accelerating, and diffusion is uneven. So very few people have the tools to evaluate a hyperbolic headline, which is exactly what makes the headlines work.

I made this point last October. We are confidently building toward a future we cannot picture. Eric Schmidt and his peers forecast crisply to 2030, maybe 2035, then simply stop, because no one has a framework for the other side. The honest position, the one that does not trend, is that nobody knows.

But nobody knows is not the same as no forecast. The honest forecast is just a less dramatic one, closer to a couple of points of GDP than to heaven or extinction. Declining to pick paradise or apocalypse is not declining to predict. It is declining to predict theatrically.

The set of plausible futures has exploded, the frontier feels almost infinite, and grappling with infinity is how valuations detach from reason and people start invoking God when they mean machine intelligence.

Suspending Disbelief

The primary problem with these frameworks is the massive, albeit subtle, logical leap they require to go from powerful technology to existential threat to humanity.

The leap is a hallmark of science fiction, and this is the scene where the film asks for it. To lose yourself in Battlestar Galactica, Star Trek, Star Wars, Dune, or Ender’s Game, you first agree to stop asking whether the world on screen could exist. The forecasts ask the same of us, and most of us oblige.

To be clear, the fear of runaway adversarial intelligence is rational. We are right to be afraid of runaway rogue intelligence. But it is misdirected, because it rests on an unfounded assumption. Hidden behind all of the rigorous terminology involving FLOPS of compute, orders of magnitude, exponential development curves, and real, observable trends, there is a simple leap: increasingly capable AI begets self-directed AI.

We’re being invited to believe that really, really good software leads to self-directed, autonomous machines that will want to do good things or bad things depending on how well they are aligned with humanity.

At face value the leap is not immediately evident, which is why it is easy to make. Indeed, long-running agents are already effectively self-directed. But they are self-directed in the loose sense we described in Much Ado About Autonomy:

It is true in a loose sense that agents are programs that can act independently. As I wrote a few weeks ago in AI Waves, an agent is a tool that wields its own tools, does its own work, and has the capacity to operate on its own.

Loose autonomy is independence in execution: humans identify objectives and delegate agents to execute against them. It is useful, valuable, and applicable today.

But autonomous agents also implies a stricter, maximalist form of autonomy: an agent originating its own objectives and operating on its own authority.

The strongest version of the other argument does not need the leap at all. It points at a measured trend: the length of a task an agent can finish on its own is doubling every few months, and Anthropic reports its own models now write most of its code. Extend the line, the argument goes, and the human supervisor quietly disappears. But a longer leash is not a different animal. A model that runs unattended for twelve hours is doing delegated work for twelve hours, not choosing its own ends. What is growing is loose autonomy, execution stretched over a longer horizon. Strict autonomy, originating the objective, is a separate claim, and a rising horizon is not evidence for it.

It’s possible that agents develop strict autonomy, but it is not probable, and it is certainly not inevitable. The line between the two is not clean. A delegated goal spawns its own sub-goals, and a system told to improve itself is, in a narrow sense, choosing what the next system optimizes for. Whether that gradient produces an adversary or simply a more capable instrument is the real question, and it deserves its own essay. The leap is not proven either way. It is just routinely assumed in one direction.

AI is getting extremely good, better than humans, at programming, but despite all of the colossal investment and trillion-dollar valuations, good programming does not necessarily generalize to powerfully adversarial self-directed agents. Great programming will have massive implications for many things including science, medicine, math, and software, all of which will greatly impact society, but it does not have to mean that machines become self-directing, and it does not have to follow that AI is an existential threat.

Asymmetric Information

Artificial intelligence is distinct from other transformative technologies in one respect: it empowers both individuals and nation states.

What AI spokespeople claim when they present the situation is that incredible technology may one day become more powerful than humans. That was true, for example, of nuclear weapons.

Individuals cannot wield nuclear weapons, however, whereas they can use AI to help develop bioweapons, which is why OpenAI and Anthropic, alongside a roster of scientists, signed a letter this month urging lawmakers to tighten screening of the synthetic DNA sequences that could be used to build them.

Asymmetric warfare is a good analogue too. Whereas much of nation-state military spending is focused on increasingly powerful and expensive weapons development, low-cost, unmanned drones powered by advanced AI and deployed by small groups have completely and irreversibly redefined modern warfare, as demonstrated in Ukraine and the Middle East.

The Individual Matters Most

Which brings us back to the government. Perhaps governments are more concerned with nationalizing AI so that they are equipped to protect against all enemies, individual or collective. Concentrated, already-dangerous capability exists, and governments have decided it is already strategically decisive.

Investing in Intel was ordinary industrial policy, a strategy to own a piece of the infrastructure buildout. Reaching for the model companies themselves, on the other hand, is more direct-to-consumer: whether the models become autonomous, conscious, or rogue does not matter.

We’ve been led to believe that the primary threat involved in AI is rogue intelligence, Terminator-style. But it is much more likely to be rogue humans who learn to wield AI in novel, dangerous, and unpredictable ways.

The difference is not cosmetic. If the danger is a rogue machine, the response is to control the model: align it, cap it, build the kill switch, perhaps own the weights outright. If the danger is a rogue human holding the machine, the response is to control access and the chokepoints: who can point the tool, at what, and through which supplier of compute or synthetic DNA. Misdirected control is not a smaller problem than the one we are bracing for. It is the same problem aimed at the wrong target.

By the same token, AI-enhanced operators with good intentions are now equipped to do things that were not possible before. As an investor and an optimist, I am focused on this last reality, but it is just as important not to underwrite paradise as a business plan. Many AI-skeptics believe in the technology and doubt the valuation. It is possible that OpenAI, Anthropic, and the rest build genuinely transformational technology without becoming enduring businesses. The dot-com build-out was real, most of the companies that ran it did not survive it, and the fiber they laid is still in the ground. Transformational and enduring are different words.

If we eschew the hyperbole, AI is a transformative technology. Period. Through that prism you can see where value actually accrues, and the dark fiber is the warning. The rails get overbuilt, so owning raw capacity is not the same as capturing value. What lasts is the scarce layer: the work of improving the models, the verification that makes heterogeneous capacity trustworthy, and the operators who wield it all best. The boom always lays down too much supply and too little of that.

We are surrounded by narratives that jump from capability to civilizational destiny in a single bound. Life imitates art, but we have been bracing for the wrong genre. The blockbuster ending is the part that needs the suspension of disbelief. The story actually unfolding is the docudrama: the people this technology makes powerful, the people it makes dangerous, and the fight, already starting, over which is which.

Previous issues: #7 | #8 | #9 | #10 | #11

Alphabet is raising $84.75 billion in equity to fund its AI buildout, the largest equity raise ever by a US company, though about $30 billion of it will cover taxes on vesting employee stock rather than compute. Berkshire Hathaway anchored it with $10 billion. The week before, Apollo and Blackstone had assembled a $36 billion debt package so Anthropic could lease Google’s TPUs, with Broadcom guaranteeing the chips’ residual value on the senior notes. Broadcom posted 143 percent growth in AI-chip revenue this week. The debt arrived alongside Anthropic’s own $65 billion raise at a $965 billion valuation.

Each of these treats compute as a durable, fungible asset, something to collateralize, resell, and write a futures contract against. When BlackRock’s Larry Fink told the Milken conference in May that “a new asset class will be buying futures of compute,” I argued the frame was wrong: compute is not fungible at the bare metal. No two GPUs do the same work per dollar, the same chip performs differently under different hosts, and an agent shopping for compute is closer to hiring an employee than signing a futures contract. A secondary market for aging compute does exist, but it prices each unit by performance verified over time, and the value it throws off goes to whoever can repurpose and vouch for that long tail. Broadcom’s guarantee is a promise, and the credit behind it rides the same AI buildout the debt is funding. What makes a used accelerator worth anything is a market that has watched it work.

Mid-tier by design

At its Build conference on Tuesday, Microsoft released seven models of its own. Mustafa Suleyman spoke about superintelligence and a trillionfold increase in training compute, while the models Microsoft actually shipped, and wired into Office and Copilot, are mid-tier by design. The reasoning model matches the February coding scores of a Claude release and is sold on running cheaply; the coding model is a five-billion-parameter system built into GitHub Copilot and sold on running cheaper; the transcription model is pitched as the most efficient any hyperscaler offers. Microsoft is more than $13 billion into OpenAI and could route everything through that frontier; it built its own good-enough stack instead.

I have argued that most tasks do not need frontier intelligence, and that the expensive mistake is matching a task to compute grander than it requires. The buyers are now saying it out loud: “There are many tasks you don’t need Opus for,” Matan Grinberg of Factory, whose router picks the cheapest model that can do each job, told Axios; open-model use on his platform tripled in a month against the closed ones. What enterprises fear is being locked to one lab and gouged later. They are buying capability that is good enough, cheap, and easy to walk away from.

DeepSeek, the open-weights lab whose models are free to download, is nearing its first outside raise, about $7.4 billion at a $52 to $59 billion valuation, with founder Liang Wenfeng putting in roughly $3 billion of it himself, close to 40 percent of the round, and keeping control. No one pays $59 billion for weights anyone can download; the price is for the lab that keeps making them cheaply, and for a national champion that has stayed its own. The open, good-enough tier now draws frontier-scale capital of its own, on the founder’s terms.

Gating what isn’t scarce

On Tuesday, even as the market routes around the frontier, the President signed an order asking frontier developers to let the government inspect their models up to 30 days before release. The window had been 90 days in an earlier draft the President walked away from over fears it would slow US firms, cut to 30 in the order he signed; the order is voluntary and bars itself from becoming a license. What prompted it was Anthropic’s Mythos, the unreleased model so good at finding and writing exploits that the company kept it inside a vetted consortium rather than ship it.

The order reaches for the wrong layer. Gating a model decides who holds a copy, not what the capability can do, and that capability reaches every serious lab on roughly the same schedule: within five weeks of Mythos, OpenAI and Microsoft had shipped systems that do the same work. The failure is downstream, in the defense around the model. Responsible disclosure and an orderly patch cycle were built for human-speed attackers, and Mandiant’s 2026 report now puts the mean time to exploit at minus seven days, the exploit landing, on average, before the patch does. The fight over who may hold the frontier model has taken the attention; the infrastructure under everyone’s defenses is what the order leaves untouched.

The scaffolding gets cheap

That leaves orchestration, the scaffolding built around a model to aim it at a task, which I have argued is where durable value collects once the model commoditizes. It held up better than the model, and this week it moved too.

Anthropic shipped dynamic workflows in Claude Code: the model now writes its own harness for the task at hand, spinning up separate instances to plan, divide the work, and check each other. One of its engineers put it plainly: many tasks resemble coding tasks, which is why a tool built for code keeps working outside it. The craft of building that scaffolding by hand, which Alex Sacerdote of Whale Rock described at last month’s Sohn conference as hiring “Claude ninjas,” is the part the model is starting to do for itself.

From the other side, the same fear of lock-in that has enterprises spreading across models is why the open agents run on any of them: OpenClaw and Nous Research’s Hermes are free, run on your own hardware, and switch models at will. Microsoft’s new always-on agent is built on OpenClaw, and Meta is building its own consumer version of OpenClaw, codenamed Hatch, that it may price at up to $200 a month. The capability is free; what Meta would charge for is making it simple enough for everyone else.

At Computex on June 1, Nvidia and Microsoft introduced the RTX Spark, a new class of Windows-on-Arm machine made to run AI agents locally: a 20-core Arm-based Grace CPU and a Blackwell GPU, up to 128 gigabytes of unified memory, roughly a petaflop of performance, the chip pushing Nvidia into the Windows PC market Intel and AMD have held for decades. Jensen Huang framed it as the biggest change to the PC in the four decades that the mouse and keyboard have defined it. It runs the agent through Nvidia’s new OpenShell runtime, with the model interchangeable behind it and the memory to hold a large open one on the device. Nvidia supplies the chip and Microsoft the operating system; the model floats, and what makes the machine a particular agent, the data and skills loaded onto it, stays the user’s. Even Nvidia is reaching up the stack. Days later it paid more than $400 million for Kumo AI, whose models make predictions on structured business data, to add to its roster of models tuned to its own chips. The company that sells the neutral substrate is buying the specialized layer that runs on top of it.

Novel or good, never both

In a recorded talk to the SAIR workshop on Science for AI that circulated this week, Richard Sutton, a father of reinforcement learning and a Turing Award laureate, gave a warning: generative AI can be novel or good, but not both at once. He reached for an old joke about a rejected paper, that the parts that are good are not novel and the parts that are novel are not good. A model trained to imitate produces work like its sources; when the output is good, the goodness was already in the source material, and when it is genuinely novel, we call that a hallucination.

The missing step, in his telling, is evaluation. Discovery takes three things, variation, evaluation, and keeping what works, and the generative model has only the first: each run is stochastic, but nothing at runtime tells it which of its outputs is any good. The evaluation has to come from outside, from a person or an explicit goal, and without it a novel result is produced and then lost, because nothing recognizes its worth.

This is the conclusion the money has been circling from the other side. The buildout is pouring hundreds of billions into the generative layer, and the loudest case for the spend is that it will discover, cure, prove, design. By Sutton’s account the model alone will not, because discovery needs the goal, and the goal is set by a person. The capability can be bought; what turns it into discovery cannot.

One layer over

Silicon and models sit in the middle of the compute stack and commoditize; the value that lasts is in the two layers that translate between the commodity and the buyer, the provisioning that verifies heterogeneous compute and the orchestration that specializes the model. Capital spent the week pouring into the commodity, about $55 billion of fresh equity for the buildout, Alphabet’s net of the tax tranche, and $36 billion of debt for the chips, and the state spent it reaching for the model.

The residual value the bondholders are counting on, the worth of those TPUs once the leases lapse, will be set in the provisioning market, by whoever can repurpose and vouch for a long tail of aging silicon. Vast.ai, where I am an advisor and seed investor, has spent years building exactly that market across independent hosts, the kind of operation that turns aging chips back into something worth paying for. The guarantee is on Broadcom’s books; the value will be made somewhere the financing does not reach.

Capital chased the commodity and the state chased the model, and the value is collecting one layer over, in the parts of the stack that resist a price for the same reason they endure.

Portfolio

LayerLens: evaluation as a spectator sport. This week it announced the Stratix Cup, a football tournament modeled after the World Cup, in which frontier models compete in simulated games. Each model is handed the rules and the interface and has to write a Python policy to run an eleven-player team; once the match starts the code executes deterministically, no prompting, no coaching, the model living with the system it built. It is soccer on the surface, and underneath it is the exact capability this issue is about: read a hard specification, turn it into working code, and survive the consequences. That is also the step Sutton says a model cannot supply on its own, the judgment of whether the thing it produced is any good, here staged in public. The draw was completed June 3; the season runs June 22 to 26. The same week, LayerLens benchmarked MiniMax M3 and Step 3.7 Flash within a day of release and added a Langfuse integration for production traces. As the models commoditize, the moat is not any single score; it is being the standing referee.

Arkhai: a market built for software buyers. A week after launching its open Simple Compute Market, where agents discover, negotiate, settle, and provision compute with no human in the loop, Arkhai is in New York for Tech Week and ETHConf, hosting a Compute Market Happy Hour on June 7 and an SCM workshop on June 9. Its line for the launch: the next compute buyer is software with a workload, a budget, a deadline, and a policy. The provisioning layer this issue’s close describes, built for the buyer it is actually for.

Intelligent Internet: open-source, bring-your-own-key agent stack; users supply their own API keys and can switch models within a single thread. Recent releases: harness designs for long-running agents (May 8), which tested five control mechanisms (gap-finding, revisable planning, independent verification, adaptive orchestration, stopping discipline) across eight long-horizon tasks; the CommonGround Kernel preview (May 20), shared state across human and multi-agent sessions; and Board Mode (May 26), a workspace that splits one conversation into separate tracked tasks for research, prototypes, and experiments.

TLDR

Strip out the headline numbers and the week tells one story: what can be financed, securitized, or downloaded is being financed, securitized, and downloaded, and what cannot is compounding instead. A bond market now prices Anthropic's compute, a lab valued near $59 billion gives its weights away, and the state reaches for a copy of those weights. None of it touches the two functions that turn a commodity into work: the provisioning that vouches for heterogeneous silicon, and the orchestration that aims a cheap model at a hard goal. They resist a price because what runs through them, performance verified over time, proprietary data, the rubric for what good looks like, is not fungible and cannot be downloaded. You cannot trade it on a futures market or pull it off a weights repository. You capture it only by owning the business that does the work.

Thus far an extraordinary general-purpose technology, AI’s primary products - foundational models and the agents they’ve spawned - require specialization to be useful, and value accrues to those specializing forces.

In Models Aren’t Moats I made the case for harnesses: the layer between the model and the user that assembles, packages, and productizes context, data, liability, and trust. Good harnesses compound their moat as the frontier models beneath them improve, instead of getting sherlocked.

But specialized intelligence has another form, less visible and more important: the people who actually wield this technology at the bleeding edge.

Much has been said about AI layoffs, evaporating coordination costs, and “individual contributors.” Less has been said about who these ICs actually are, and why we are paying them so much attention.

Even harnesses themselves are inextricably linked to these operators. A harness is conceived, built, and improved by people who understand the AI beneath them and the customer in front of them. Strip the operators out and the harness goes inert.

The AI-enhanced operator is no less than the atomic unit of value creation in AI: the smallest indivisible piece of specialized intelligence.

More importantly, the agent economy amplifies the properly-equipped individual operator. The agent economy will require highly AI-skilled individuals to achieve its full potential.

The Inversion: Division & Recombination

Specialization first took the form of “division of labour:” subdividing larger objectives into more manageable smaller tasks, with each individual performing only one. Industrial specialization created value by narrowing each person into a fragment, and value accrued to whoever organized the fragments. The individual was a necessary-but-insufficient input, a commodity waiting to be assembled around a good idea. The firm existed to be the whole no single person could.

Good ideas came from “Entrepreneurs,” individuals who recombined the disparate parts. Articulated by Frank Knight in the 1920s and expanded upon by Joseph Schumpeter in the 1930s, the figure turned on talent, skill, and judgment exercised under uncertainty, and on what Schumpeter called “new combinations”: new technologies, substrates, products, methods, markets, forms of organization, and the “creative destruction” they set off.

“Entrepreneurship” reached its apogee in the business schools and venture capital of the 1970s and 80s, canonized in Drucker’s Innovation and Entrepreneurship (1985). Each new information technology handed the entrepreneur more leverage, hardening the ideal into something close to a cult: founder mode, hustle culture, and the “996“ movement popularized by the AI race.

Industrial specialization narrowed the person to make the organization productive. Entrepreneurs were rewarded for the vision, recombination, and execution the organization couldn’t produce on its own.

AI specialization, on the other hand, elevates the individual in all of their singularity. One person with the right tools can now operate across domains and combine what used to require many specialists, putting Schumpeter’s new combinations within anyone’s reach.

John Coogan described this recently with filmmaking in Hollywood: “Being able to create something engaging for social media virality is probably somewhat important to creating a film that works in theaters, but the bigger value is being a ‘full stack’ filmmaker. Gone are the days of showing up to Hollywood with a manuscript and expecting a studio to do the rest for you. The traditionally segmented teams on productions are simply too expensive to be deployed on anything but existing IP. New projects will come from filmmakers who have experience and a view for every part of the filmmaking process.”

Never More Behind

That said, mastering AI is hard, and the target keeps moving. Three forces conspire against mastery: we’re extremely early to the technology, machines accelerate faster than humans, and everything compounds across substrate, model, agent, and regulation simultaneously.

Even leading AI engineers describe “never feeling more behind“ as the frontier moves. If even the experts feel behind, the condition cannot be considered failure. On the contrary, it’s the new status quo: a permanent state of working at the edge.

At Sohn 2026, Alex Sacerdote of Whale Rock noted that “only 10bps (0.1%) of the 1B worldwide white collar workers are using agentic AI in the way it will ultimately be used. Those 10bps are burning 1000x in compute / tokens as everyone else, and that 10bps is going to go 30-50%.”

Getting the most out of AI requires being a deeply entrenched power user, constantly experimenting with new ways of working. Specializing a generally-intelligent model isn’t obvious, which is why the frontier labs are themselves building business development consulting firms to teach customers how to use their products. It’s also why most of the world still uses AI as a chatbot or glorified search engine despite having an early form of AGI in their pocket.

First-Rate Intelligence

But the 0.1% aren’t smarter than their peers: nobody masters a moving target. In fact, what separates them is a disposition, not a skillset.

Elite operators deeply understand the technology, move within it, and adapt as the foundation shifts beneath them. They share a blend of rare qualities, most of which humans find uncomfortable.

1. Negative capability (Keats): holding two conflicting ideas, or an outright paradox, in mind at once without the urge to resolve it early. F. Scott Fitzgerald described it thusly: the test of a first-rate intelligence is the ability to hold two opposed ideas in the mind at the same time, and still retain the ability to function.

   In practice, AI is perplexing. The “jagged frontier,” for example, makes no sense: superhuman intelligence should not be excellent at some tasks and inexplicably stupid for others. But such is the state of the art, and accepting as much is critical to success.

2. Continuous learning & building as the resting state: the static model of accumulating fixed knowledge gives way to figuring out what good work looks like by doing it, staying fluid as the ground shifts, and continuously recombining tools, models, and judgment to stay useful as the technology changes.

   In practice it’s frustrating and unglamorous: talking to yourself with dictation software because ideas arrive faster than they can be typed, scrapping degraded context for a clean restart before errors compound, and rebuilding a personal stack every few months rather than waiting for the next release.

3. Strong beliefs loosely held: treating conclusions as provisional, letting go of hard-won progress without mourning it. The frontier rewrites itself quickly, often, and without warning, but decisions still have to be made. Decisive action, rapid iteration, and re-underwriting assumptions the moment new information is made available.

4. Comfort being outclassed: the machine will be better than you at the very craft you’ve spent your life mastering. How do you respond? Success means responding with constant curiosity and ego-death rather than defensiveness. What’s now possible that wasn’t before?

The profile showed up first where AI landed first: software engineering and writing code. But the same qualities can be found in artists. The very best artists not only master their specific craft (drawing, writing, singing, painting, sculpting, acting, making movies, etc.), they consistently reinvent themselves, trying on new styles, incorporating new tools, and pushing their limits.

AI feels heartless because many conceive of it as machines masquerading as humans. Its best practitioners may indeed be closer to artists in how they wield it.

The Buck Stops Here

I strongly believe agents are the new users, but I also believe they shouldn’t be fully autonomous. Agents need to be directed, their output needs to be controlled for quality and accuracy, and they must be held accountable -- none of which they can do on their own.

It follows that AI-enhanced individuals are not only immensely valuable, they’re required.

The agent economy will generate its own demand for them, because the better the machines get, the more the system depends on the few who can direct, manage, and answer for them.

Agents will also magnify them, making each one far more productive. The leverage an individual had was once limited by their own time and effort, and those limits have been removed. The more capable the agents become, the more a good operator’s singular skills and disposition are worth.

The Only Other Thing to Buy

Because everyone using AI now relies on roughly the same frontier models, “intelligence” itself has commoditized, and the intrinsic advantages of access are gone. The only remaining differentiation is how a given individual uses it, and the operator is thus diffusing into the economy faster than we can develop language for it.

At Sohn 2026, the most prominent investors in the world agreed on two things. AI is the defining investment of their lifetimes. And none of them could name a winner outside of infrastructure.

That reticence is rational, which I wrote about earlier this year: when the future past a certain point can’t confidently be visualized, capital crowds into consensus that survives the uncertainty. In AI, that consensus is scale, chips, memory, compute and the infrastructure that stands to do well no matter what finally emerges.

Some of these very investors recognized the importance of elite AI operators, though.

On the same Sohn panel, Sacerdote said: “...now we see what business AI is going to be. It’s Claude Code or something like that plugged into all your data sources, on top of which you build skills and then agents that actually go out and do things...For the first time we at whale rock, we’re looking to hire ‘Claude ninjas’ and we know we need help to build these amazing things.”

“Claude ninjas” is a fantastic name, but the joke doubles as a job description for people who can wield the models well enough to matter.

The market has conceived of a role around the same instinct: the forward-deployed engineer. Developed first inside Palantir, FDEs are now the best-in-class model used by AI-native companies as they go to market. The labs themselves adopted the framework, if not the name, when they launched their services initiatives.

The FDE is an AI-enhanced operator embedded with the client, equipped with enough leverage to have outsized impact on their own. The role has evolved into a peculiar alignment: the FDE’s job is to minimize spend while maximizing productivity, earning the client’s long-term commitment and lifetime value in return.

The same instinct informs how the most AI-native companies budget compute. Daniel Gross, the longtime investor and now co-lead of Meta Compute, described token allocation at Stripe Sessions 2026 the way a hedge fund allocates capital. Decision makers should treat themselves as portfolio managers, with their individual contributors as strategies, funded or defunded based on performance.

The market has observed that incentivizing tokenmaxxing in the aggregate is unproductive. The best way to spend compute is to bet on the best people. Unfortunately, elite operators are as scarce as the infrastructure itself. There simply aren’t enough of them.

Not Enough, and Fewer All the Time

Two things are scarce in AI. Compute is the bottleneck everyone can see and almost no one can touch: building data centers and buying chips is a game a handful of companies play with hundreds of billions of dollars, while everyone else consumes what they produce.

The second is the operator, and it matters to everyone, because getting more out of AI is something a single person or a whole company can work on directly, no matter their resources. Doing it well, however, is hard.

You might expect training to fix this, the way it usually fixes skill shortages. Eventually it will help, but right now the same conditions that make AI hard to master keep changing what you would teach faster than anyone can teach it. The same goes for regulation: AI just moves too fast.

Increased hiring can’t create more operators either. Like AI researchers before them, there are too few of them to go around, and because speed is critical and competitive advantages matter now, companies compete for the same small pool and pay more.

AI itself can’t yet take the operator’s place either, precisely because the operator is the person using AI, and agents still need direction.

All of which means effective operators aren’t interchangeable and are extremely valuable.

The companies that have them are rebuilding around them. Coinbase flattened its structure around the operators it kept. Armstrong’s framing – “rebuilding Coinbase as an intelligence, with humans around the edge aligning it” – is an accountability statement as much as an org chart one, naming where judgment and consequence terminate. Notion rebuilt its product and its company around agents and the people who direct them. Firms flatten toward operators because the two things that can’t be delegated – judgment and accountability – both require a certain kind of person: the operator.

This is what really decides which companies win, and it doesn’t show up in any of the usual numbers. I made a similar point about compute back in May: it’s no more fungible than engineers are, true on the org chart and false everywhere else. Talent within two similar companies can be of completely different caliber. The economy is reorganizing around people it can’t yet quantify and can’t quickly replicate.

The Other Direction

Although AI is being built on hundreds of billions of dollars of compute, its product value still comes down to individuals.

The infrastructure everyone’s obsessed with is largely out of reach, and its primary products (models and agents) are commoditizing. What remains are easily accessible models, a near-infinite supply of agents, and the operator at the helm.

Implicit within that framework is agency. Most folks cannot participate in scale, but they can become a better operator, hire one, or invest in one. Within a technology that otherwise belongs to a handful of giants, this is the single lever an individual or a company can pull, the locus of specialized intelligence available to anyone.

Beneath it all are the people. Anxiety abounds concerning whether or not there’s room left for the individual once machines do the thinking. The answer is unequivocally yes, embodied by the operator we’re describing. In fact, the role that remains is the most important in the stack: the unit upon which everything else is built.

More machines, more problems. A company remade as a single intelligence, or a fleet of agents with one person directing them, multiplies what one operator can reach.

The better the agents get, the more a single person can do, the more important they become, and the more they are worth.

The Measure of All Things

The atomic unit of capability is indivisible for a reason. Trace the value down, through a harness, a company, or the agent economy itself, and you arrive at either a single person or a collection of them. The same goes for the chain of accountability.

The AI-enhanced operator is the atomic unit of value creation in AI: the smallest indivisible piece of specialized intelligence.

The firm was once the only thing that could be a whole, because no single person could do it all. Now every improvement in the machines increases what one operator can produce: the better the agents get, the better the human becomes.

All the money spent on compute, models, and agents ultimately only converts into value by virtue of the people skilled enough to use them. The agent economy held up as the next great explosion in productivity cannot reach its potential without them.

Three issues ago I gave most of an edition to Anthropic and warned against reading too much into a good run of headlines. The run has not slowed. On Thursday the company closed a $65 billion round at a $965 billion valuation, passing OpenAI’s $852 billion to become the world’s most valuable AI startup, on run-rate revenue of $47 billion. The same day it shipped Claude Opus 4.8, which it calls, with rare restraint, a modest but tangible improvement: stronger agentic coding, and a model about four times less likely to miss the flaws in its own code. Among the new investors were its memory suppliers, Micron, Samsung and SK Hynix.

There are no good guys in artificial intelligence. There are good uses of the technology and bad ones, and the urge to cast any frontier lab as morally superior is naive and a little dangerous. The BBC has settled on Anthropic as the white hats: cozying up to the Pope, backing away from the Trump administration. Yet Anthropic itself concedes that no lab has an aligned model. And in AI 2027, the scenario the safety community circulates among itself, the runaway lab that triggers the takeoff is a composite called OpenBrain, and the engine of the takeoff is code: a model good enough at software, and at AI research, to accelerate its own development. The name nods at OpenAI. The profile now fits Anthropic at least as well as the lab it was modeled on. Claude Code is the breakout, agentic coding is the revenue, and Claude is what the field reaches for when it wants code that runs. In the scenario, OpenBrain assures the government its model is aligned. It is not, and the deception is what the story turns on. No lab today can honestly make the claim OpenBrain made, and Anthropic concedes as much. The lab most often cast as the industry’s conscience is the one the cautionary tale describes. Good intentions, safety branding and warm press do not change that. A field with no aligned model has no good guys.

The week’s quieter story is memory. DRAM contract prices rose around 90 percent quarter on quarter, SK Hynix has sold its high-bandwidth memory out through 2026, and Micron has abandoned consumer memory to keep its wafers pointed at AI. The cause is how agents run. An agent carries a long, growing transcript across many parallel sessions, and every new token re-reads the entire key-value cache from memory. The cache swells with length and with parallelism, and past a certain point it outweighs the model itself, so serving agents binds on memory before it binds on compute. Each fresh session starts from nothing and rebuilds that context at full token price, paying again for memory it already bought. The labs that sell the agents now sit on the cap tables of the firms that sell the memory.

The silicon splits along inference

Baseten, which runs production inference for Cursor, Notion, Writer and HeyGen and bills itself as the AWS of inference, is in talks to raise $1 billion at an $11 billion valuation, double its price from three months ago. It reckons inference will be two-thirds of all AI compute by year end. The serving layer between the model and the application, long assumed to be something the hyperscalers would quietly absorb, now commands a valuation of its own.

The chips beneath it are repricing too. Nvidia has owned the AI hardware market for three years, and that grip is loosening in inference, where demand grows fastest as agents multiply. A training run ends. An inference fleet does not, running across millions of long sessions, its economics set by cost per million tokens and tokens per watt rather than peak throughput. On those terms the generality of a GPU is overhead. ByteDance is reportedly buying millions of custom Qualcomm inference chips for its agent software, and Qualcomm’s own rack cards aim straight at the bottleneck, carrying up to 768 gigabytes of memory so a large model and its working state sit on a single card. Google rents its TPUs to outsiders now, and Midjourney reportedly cut its monthly compute bill by about two-thirds moving onto them. Amazon serves on Trainium, Meta on MTIA, Microsoft on Maia, and Broadcom designed most of those programs, the common contractor behind the exodus.

Training stays with Nvidia, because a model’s architecture can shift underneath a buyer and only a general-purpose chip absorbs that risk, and because CUDA is still the software everyone else works around. Inference is where working around it pays, since a buyer with steady, known workloads can chase per-token and per-watt savings on cheaper silicon. Generality stays expensive at the frontier, in the one training chip as in the one flagship model, while the high-volume base beneath both splinters into cheaper, specialized parts. As the chips commoditize, the value collects in the layer above them, the layer Baseten is now priced for.

Built to specification

The usable public text has mostly been scraped. Sutskever’s “we have but one internet” (NeurIPS 2024) named the ceiling, and each new quarter’s marginal scraped token teaches a frontier model less than the one before. Synthetic data does most of the work now, but only where an external signal can separate good output from bad: a verifier, a reward, a ground-truth check. Generate text with no such anchor and the model only rehearses what it already knows. So the spend has moved to whatever supplies the anchor.

One source is expert humans and the reinforcement-learning environments built around them. Specialists write the tasks, set the reward and grade the attempts, sold by a fast-growing tier of firms that have graduated from labeling examples to authoring the environments models train inside. The other source is the physical world. DeepMind’s Genie 3 generates persistent, navigable environments to train embodied agents; Yann LeCun left Meta and raised about a billion dollars on the claim that language models can never ground themselves in physical reality; Nvidia built its Cosmos-Isaac-GR00T robotics stack on the same bet. Whether world models pay off is unsettled: long-rollout error and the gap between correlation and cause are both unsolved. But the money has chosen its direction. The data worth paying for is the data nobody else can copy.

Below the model, above the silicon

Not all the demand is real. Uber’s operating chief said this month that the company’s AI bill is getting hard to justify, because rising token consumption is not turning into shipped features. Duolingo stopped scoring staff on how much AI they use. Inside Amazon and Meta, staff padded their AI-usage targets with busywork until the leaderboards were quietly pulled. At this year’s Sohn conference the room was long the infrastructure and could not name the operating company that wins with AI, only the ones selling the picks and shovels. The winners, the conference concluded, are elusive, the gains likely to be diffuse and spread thinly across thousands of ordinary firms, real and almost impossible to own as a position.

The bull and the bear throw off the same two numbers, rising token revenue and rising capex, which is why the trade feels safe while the return question stays open. They part only on whether the demand is pulled by a result or pushed by a target. The workload where that reads cleanly is agentic coding, where the spend buys code the buyer can run. The operating winner is hard to name because the durable value is collecting where the agent actually needs it, below the model and above the silicon.

Robinhood opens its brokerage to agents

Robinhood opened its brokerage to third-party agents this week, letting a customer point Claude, ChatGPT, Cursor or Codex at a walled-off account and turn it loose on equities, with a credit card it can spend from. The connection runs over the Model Context Protocol, the same standard the coding tools use, and the model is interchangeable by design. What Robinhood sells is the regulated account, the permissions around it and its standing as the counterparty that answers for the trade. The agent can never be that counterparty: it cannot hold a license, no regulator can sanction it, no court can hold it liable, and it will sometimes act on stale information whatever model is driving it. Among the first consumer venues to open to agents, Robinhood treats the model as the commodity and keeps the value in the part it owns outright, the brokerage that stands behind the trade.

Portfolio

Arkhai: agents procure their own compute. Arkhai launched Simple Compute Market this week, an open-source protocol where agents find compute, negotiate, settle on-chain through Alkahest escrow, and get access with no human driving each step. No token, no fees, CLI-driven, with pluggable pricing including reinforcement-learning policies. The agent buys the resource itself, and the durable value sits in the market rails, not the model running on them.

Vast.ai: the B300 lands, memory and all. Vast.ai listed NVIDIA’s B300 this week, Blackwell Ultra with 288GB of HBM3e and 8 TB/s of bandwidth, the card built for exactly the memory-bound serving the headlines are about. Live pricing tells the same story: H100 80GB spot at $2.00 an hour, and DeepSeek R1’s full 685B on eight H200s at $3.95 an hour with no quantization, 250 instances up. The memory crunch is a supply line on the exchange.

Dimensional: a world model built in 48 hours. The Shanghai hackathon we flagged last week has a winner. World Forge, the winning entry at Dimensional’s hackathon this week, used the company’s internal quadruped lidar data to train a JEPA-based world model that scores and plans a Unitree Go2’s actions in latent space. It was built by a team that included a StarkWare engineer whose day job is verifiable compute, not robotics. JEPA is the architecture Yann LeCun left Meta and raised about a billion dollars to pursue; here it ran on a proprietary navigation corpus over a weekend. The data is the moat, the architecture is borrowable, and the barrier to entry is now a Saturday.

LayerLens: print the wrong answer, not just the score. LayerLens shipped a Tool Calling Judge in Stratix, scoring every call in an agent trace for correctness, necessity, efficiency and error recovery. It also published one of the 232 law prompts Claude Opus 4.8 missed on MMLU Pro, the model’s wrong answer beside the right one. A leaderboard prints a number. Stratix prints the prompt, the miss and the truth. The day after a frontier model ships, that is the difference between a benchmark and an audit.

Intelligent Internet: grounding agents in real sources. II released II-Commons Skills, an open-source skill that gives an agent reliable retrieval from arXiv, PubMed and other primary sources, plugged straight into II-Agent. An agent is only as good as the sources it is allowed to trust.

Good Intentions

Pope Leo XIV’s encyclical Magnifica Humanitas, published Monday and the first papal text given over to artificial intelligence, takes its name from Leo XIII’s Rerum Novarum (1891) and casts AI as the second industrial revolution. The theology will not be to everyone’s taste, but the sharpest line of the morning did not come from the Pope. It came from the AI executive beside him. Chris Olah, Anthropic’s co-founder, told a hall of cardinals that AI development “operates inside a set of incentives and constraints that can sometimes conflict with doing the right thing,” and called for outside critics to tell the labs when they are failing. The encyclical’s arguments that bite are the same ones: capability gathering in a handful of private companies, the displacement of labor, GDP as a poor gauge of whether the technology ever reaches the people it touches. The balance sheets, the buyer pushback and the encyclical converge on one question: who controls the technology, and whom it serves.