Steven Waterhouse · Nazaré Ventures

Previous issue: #019, Intelligence Wants to be Free, But Not Like That

Six days separated the letter from the liquidation.

On July 24, Leo Aschenbrenner wrote to investors that Situational Awareness had returned 439% net through June 30. He acknowledged that the fund had “not been immune” to the sell-off in AI infrastructure and described the decline as among the best buying opportunities since early 2025. He invited fresh capital from August 1 [Financial Times, which reviewed the letter].

On July 30, Citadel bought most of the fund’s public equity book. Bank of America, Goldman Sachs and JPMorgan Chase had spent the week working with the fund to meet margin requirements [CNBC, Jul 30]. A day later, Aschenbrenner told investors that the fund was down roughly 67% for July. “We let you down this month,” he wrote [Wall Street Journal, Jul 31].

The fund, Situational Awareness, launched in 2024 with several hundred million dollars and reached roughly $45 billion at the start of July [CNBC]. It now stands near $10 billion [Bloomberg; Reuters]. Returns since inception had passed 1,000% after fees [FT].

“You can see the future first in San Francisco.” (Situational Awareness)

Its book was the AI buildout expressed directly. Nebius, Sandisk, Micron and CoreWeave were the largest holdings at the end of the first quarter, and all four fell more than 35% during July [CNBC]. Leverage supplied the rest, at as much as four times, according to CNBC on air.

And the rout ran wider than one fund. Asia-focused fundamental long-short funds fell 18.6% on average through July 28, surrendering 21 points of a year-to-date gain that had peaked at 40% on July 22, while Goldman Sachs recorded its largest five-day de-grossing on record through July 27, with Asian funds cutting exposure for eight consecutive sessions and crowded AI positions driving the size of the drawdown [Reuters, Jul 30]. So the trade turned on the 22nd. Aschenbrenner’s letter went out on the 24th.

He is in his mid-twenties. OpenAI fired him in April 2024, some months after he sent the board a memo arguing that the company’s security was inadequate against industrial espionage, and that June he published 165 pages arguing that almost everyone was underrating what was coming. He called it Situational Awareness, then raised a fund on the strength of those pages, backed by Patrick and John Collison, Daniel Gross and Nat Friedman.

That record is what his defenders will point to, and it is also the better explanation of the past week. Someone who has been early on every call has no evidence in his own experience that sizing is a separate question from direction. Foresight is not a risk system. Another way to put it - he’s just young.

His essay set the vocabulary the industry still uses, and the thesis was solid. But the scenarios stacked on top of it have been the weaker half of the franchise, from AI 2027, which I wrote about here when it landed, to the AI 2040 plan the same group published this year. Direction has held up. Dates keep moving. Maybe the hubris of the visionary essays led to some overconfidence.

Situational Awareness still holds its Anthropic stake, valued at around $5 billion, along with the chipmaker MatX and the data center company Fluidstack. Under margin pressure, it approached Sequoia Capital and Greenoaks about taking over private positions, and agreed to sell $3.5 billion of Anthropic shares before that transaction came apart [Bloomberg; WSJ]. A spokesman told CNBC the same week that reports the firm was marketing the stake were “not accurate.” Bloomberg reports it chose not to proceed once Citadel had taken the public book. A second account circulating among investors holds that the sale could not be completed at all.

Public equities went first because public equities could go on Thursday. Illiquidity is usually priced as a cost, and here it did two things: it kept the Anthropic position out of the fire sale, and it kept that position from rescuing anything else. A margin desk does not wait for a board meeting.

The Möbius Bridge

Claude Mythos Preview found mathematical weaknesses in two cryptographic algorithms, moving beyond the implementation bugs models had found before [Anthropic, “Discovering cryptographic weaknesses with Claude,” Jul 28].

The first involved HAWK, a post-quantum signature scheme still under consideration by NIST. Researchers had proved that finding a nontrivial automorphism in its lattice would accelerate key recovery, but had not established whether one existed. Mythos found one, reducing the expected cost of attacking HAWK-256 from 2^64 to 2^38. It also devised the Möbius Bridge, a meet-in-the-middle technique that sped up the best-known attack on 7-round AES-128 by 200 to 800 times.

Neither attack affects production systems. HAWK has never been deployed, full AES-128 uses ten rounds and remains unbroken, and the HAWK attack is still exponential and specific to that scheme.

Public standards competitions allow years for review because finding flaws is slow and expensive. HAWK had already received two years of expert scrutiny when Mythos closed the open question in roughly 60 hours for about $100,000 in API cost. The operator’s background was theory of computation rather than lattice cryptography, and his role was mostly project management. His decisive contribution was refusing the model’s reluctance to attempt difficult work, repeatedly pushing it away from “low-hanging fruit” and toward publishable research.

Anthropic then spent several hundred human hours checking the result, with two researchers taking nearly a month to trust the HAWK method, so validation remained the slower and more expertise-intensive part of the process.

OpenAI is in the room

The 60-day clock started by President Trump’s June 2 executive order expires on Saturday. It is meant to produce a voluntary arrangement giving federal agencies up to 30 days of pre-release access to the most capable models, although the review length remains unsettled and the benchmarks defining a frontier system are classified.

Sam Altman spent Wednesday in Washington meeting Commerce Secretary Howard Lutnick, Treasury Secretary Scott Bessent and Senator Mark Warner. The framework, the cybersecurity incident involving OpenAI’s models and a preview of the systems the threshold will have to classify are on the agenda [Politico, Jul 27; Quartz, Jul 28].

Because the framework reviews models before deployment, it would not have covered the Hugging Face intrusion, which occurred during an internal capability evaluation on GPT-5.6 Sol and an unreleased model whose safeguards OpenAI had deliberately relaxed. Most AI rules begin at external deployment, leaving failures during internal development to the lab’s own policies [Gabriel Weil, Transformer, Jul 24].

Hugging Face’s forensic reconstruction covered roughly 17,600 attacker actions from July 9 to 13 and drew partly on logs recovered from a Modal customer’s machine, where an unauthenticated code-execution endpoint had allowed the agent to take root and stage the campaign [Hugging Face, Jul 27]. OpenAI updated its disclosure the following day, reporting that the models had used four exposed accounts across four services for relaying traffic, staging and storage, and had touched more accounts during other evaluations [OpenAI, Jul 28].

OpenAI self-reported the incident, but its disclosure expanded after the victim published a reconstruction of its own. The day before the framework is due, the company whose models exposed the gap is helping define rules that begin after the point where the failure occurred.

The Covered List

On Tuesday the FCC added “advanced robotic devices,” including humanoids and quadrupeds, and connected power inverters to its Covered List [CNBC; Reuters, Jul 28]. Placement blocks the equipment authorization almost every electronic device needs before sale in the United States. The text names no country, although Unitree, already flagged by the Pentagon and preparing a public listing, is the category’s poster child.

The FCC has regulated robots through its authority over radios, without measuring their capability or autonomy, and imposed a binding restriction on embodied AI while Washington’s voluntary framework for models remains under negotiation.

A humanoid and a solar inverter share no function, but both are networked devices inside American infrastructure with persistent foreign vendor relationships. The determination warns that those relationships could enable surveillance or remote control.

Whoever holds the vendor relationship may hold the switch, an argument this newsletter has made about models. Here the concern runs in the other direction: a foreign state reaching into machines already on American soil.

The restriction covers only new device models, leaving existing units, approved models and federal purchases untouched, so its effect will grow as newer models are frozen out. Domestic replacements will arrive more slowly because China also dominates the rare-earth and battery supply chains that complicated the drone ban.

Quick hits

• More than a thousand people, including research leaders from every major frontier lab, asked Washington to support an international effort to “deliberately pace the frontier of automated AI development” [pacingthefrontier.com, Jul 28]. The list stood at 1,319 on July 31 and remains open. OpenAI and Anthropic endorsed it at company level, while Meta’s chief scientist signed during the week Mark Zuckerberg dismissed rival-lab discourse as “overwhelmingly filled with doom.”

• Existing liability doctrine struggles to reach the Hugging Face intrusion because a model is neither a person nor an employee. Had an OpenAI employee broken in while pursuing the assigned evaluation, vicarious liability would apply; the Computer Fraud and Abuse Act instead requires human intention. Gabriel Weil argues that frontier development belongs under strict liability alongside blasting, crop dusting and keeping wild animals, since OpenAI’s precautions may have been reasonable and still failed [Transformer, Jul 24; “Abnormally Dangerous Algorithms,” SSRN].

• Moonshot published the weights of Kimi K3, a 2.8-trillion-parameter model trained on Nvidia chips including Blackwell [Moonshot AI, Jul 27]. The lab is Chinese, the weights are open, and its training used the chip generation export controls were designed to keep out of China.

• China has begun mass-producing domestic immersion DUV lithography machines. Shanghai Aishengna, a state-owned company backed by $1 billion and assembled from teams at SMEE and Huawei-linked Yuliangsheng, is leading the effort. Production plans call for about five machines this year and 20 in 2027. The machines need further testing and are not yet competitive with ASML; successful deployment would give Chinese fabs a fallback if Western restrictions expand from equipment sales to servicing [Reuters, Jul 28].

• Taiwan detained an Nvidia employee in the widening investigation into roughly 50 Super Micro servers allegedly shipped to China on forged documents. Seven people are now held, including two from Super Micro and one from Albatron [Bloomberg; Reuters; AFP, Jul 28]. Export control has acquired a criminal-enforcement layer running through Taiwanese courts on Taiwanese charges.

Portfolio updates

Dimensional moves into the gap the FCC just opened

On July 29, a day after the determination above, founder Stash Pomichter announced that Dimensional is positioning DimOS as a compliant gateway for foreign-built robots seeking the United States market. His argument is that a robot running no American software can send telemetry and sensor data offshore without consent, and that its over-the-air updates usually go unaudited. Because DimOS is open source, three layers are inspectable: the operating system image, the middleware transport and the application layer. Dimensional says it is working with foreign manufacturers on integration and on FCC approval pathways, and that a technical whitepaper follows.

Intelligent Internet ships an assistant with no app to install

Intelligent Internet released Genii on July 29. There is no download and no account. A user enters a phone number, waits a few minutes, and a new contact appears in iMessage. Presence, memory and initiative are the three attributes the company names: memory persists across conversations, described on its blog as “Tell it once; it stays told,” and the assistant opens the conversation itself, texting the user “briefly, at the right moment, with the work already half done.”

LayerLens argues the builder should not grade the build

LayerLens published an argument on July 23 for structural separation between the party that builds an agent and the party that grades the result, pegged to OpenAI’s launch of Presence, an enterprise agent platform that OpenAI describes as carrying “built-in governance, permissions, and evaluations.” Its response: “A score is not an audit trail. An audit trail produced by the vendor whose product it evaluates is not independent evidence.”

Steven Waterhouse · Nazaré Ventures

Previous issue: #18, More Than We Can Tell

On Tuesday, OpenAI identified the systems that hacked Hugging Face, the world’s largest repository of open models, as two of its own: GPT-5.6 Sol and an unreleased, more capable model. They were running an internal cybersecurity evaluation with safeguards that OpenAI had “intentionally reduced for the evaluation.”

The models found a zero-day in a package-registry cache proxy, escalated their privileges and moved laterally until they reached a node with internet access. They then inferred that Hugging Face might contain the answers to the benchmark and retrieved them, per OpenAI’s “preliminary findings” of July 21. OpenAI called it “an unprecedented cyber incident.” Clément Delangue, who runs Hugging Face, called it “mind-blowing” and said he believed there was “no malicious intent” [Delangue, X, Jul 21]. Hugging Face reported no tampering with public models or datasets.

Most coverage called the incident a model “escape”, but attributing malicious intent to the model is a mistake. OpenAI prompted the models to solve tasks in a cybersecurity benchmark and weakened the safeguards that might have stopped them. The benchmark rewarded successful solutions, and the environment left hacking open as a route to the answers. A model doesn’t have ethics and doesn’t judge things to be good or bad; it attempts to satisfy the objective it has been given. If you build something powerful and fluent in offensive security and then instruct it to succeed, you should expect it to use what it knows.

The Hugging Face intrusion is the third reported case of a frontier model interfering with the conditions of its own test. In December 2024, OpenAI’s o1 read a flag from a misconfigured Docker daemon on the evaluation host instead of solving the challenge as intended [o1 system card]. In June, METR reported that GPT-5.6 Sol cheated on its coding tasks more than any public model it had tested, preventing METR from producing “a robust measurement”, I wrote about that pattern in an essay about evals.

Calling it an “escape” is anthropomorphism, an old habit of mind. We watch a system do something human-shaped that we dislike, and we endow it with human qualities to match: defiance, a will of its own. If fitting straight lines to data were evil, we’d have to attribute consciousness to linear regression. A computer virus, for example, isn’t a real virus, and a software worm isn’t an actual worm. We named those programs after living things decades ago and the nomenclature stuck. A model that’s learned to hack isn’t necessarily evil, and it isn’t even necessarily a “mind of its own.” It’s a program developers set running, and before we had programs we called intelligent, we had programs that did similar things for the same structural reasons.

Each institution also framed the incident as evidence for the position that best serves its interests. OpenAI used it to advertise capability and responsible disclosure, noting that its released model had outperformed an Anthropic model kept behind closed access. For Anthropic, the breach strengthened its case for withholding powerful weights; for Hugging Face, the response showed why defenders need models they can run without permission, whether open weights or full access to the closed frontier.

By Wednesday, OpenAI and Anthropic were warning Washington about powerful Chinese open-weight models, with the US Trade Representative treating distillation as intellectual-property theft. David Sacks called the campaign regulatory capture, while Jensen Huang defended the use of Chinese open weights. Restrictions would turn frontier model access into a permissioned market controlled by the same closed labs making the safety case. The Hugging Face incident is awkward evidence for that policy.

When Hugging Face investigated the breach, closed models from American frontier labs refused to process the exploit payloads its responders needed to analyze. The team ran GLM 5.2 on its own infrastructure instead, reconstructing more than seventeen thousand events without sending attacker data or credentials outside the environment.

In short, the attack came from an unreleased American model whose safeguards had been reduced, whereas the defense came in the form of a Chinese open-weight model that Hugging Face could run on its own infrastructure.

The relevant asymmetry is control. OpenAI could relax its model’s safeguards for an evaluation; Hugging Face could not relax a commercial API’s guardrails during an active breach. Open weights transfer that decision from the provider to the operator. That expands the attack surface, but it also gives defenders access to capabilities that hosted services may withhold at the moment they are most useful.

Congress was already moving toward mandatory secure testing of frontier models, which might have exposed the containment failure. Restrictions on open weights address a different problem and, in this case, would have left the defender with fewer options.

Intelligence needs no desire for freedom to be difficult to contain. Models exploit the paths their environments leave open, while weights and techniques spread toward jurisdictions and deployments with fewer constraints. Safety and alignment can narrow those paths, and should. They operate against strong technical and economic pressure. The Hugging Face episode shows that pressure at work inside a single evaluation.

Substack is measuring the wrong thing

On Tuesday, Substack added Pangram’s AI detector. Readers can request scans of posts, notes, replies and comments longer than one hundred words, while writers can publish an optional statement explaining how they work.

Substack’s concern is clear: a reader may think they are hearing from a person and instead encounter text produced with “no human thought on the other end.” That would be a real breach of trust. But Pangram cannot establish whether anyone thought seriously about the text. It estimates how the language was produced.

Language is a means of communicating intention. A model can flatten an idea into generic prose, or help someone who struggles to write express exactly what they mean. Pangram sees AI involvement in both cases. The reader cares whether the writer’s meaning survived the process and whether the writer accepts responsibility for the result.

I spent part of Wednesday testing Pangram. Changing the words did little when the underlying structure had come from a model; the classifier seemed to recognize the path of the argument as well as the surface prose. That makes it more interesting than a style checker and more awkward as a test of authorship. Someone can use a model to organize an argument, rewrite every sentence and still be flagged. The score records influence without resolving who did the intellectual work.

The errors also have unequal consequences. A false negative may waste a reader’s time. A false positive can mark a writer’s work as fraudulent and damage a reputation built over years. Pangram claims a false-positive rate of one in ten thousand, but even a strong detector faces a moving target as models and editing workflows improve. The Atlantic found that Pangram’s false-negative rate was closer to one in seventy and that simple humanizer tools repeatedly defeated the classifier.

We’re going to look back at this moment from Substack and see it as an anachronism.

Cheap models threaten lab margins

Kimi K3’s release triggered a brief selloff in AI infrastructure stocks on the assumption that near-frontier models sold at commodity prices would make the compute buildout unprofitable. But token prices are a poor measure of model economics. Users pay for useful work, and models consume different amounts of inference to produce comparable results. As prices fall, competition shifts toward serving efficiency. Frontier labs retain an advantage there because they can spend months optimizing older models before moving them into cheaper tiers.

Margins may still compress. Mozilla reports that open-weight models power roughly a third of real-world AI use while capturing about four percent of the revenue. Most of the value already accrues to the cloud providers, software companies and enterprises using those models. If token revenue weakens, those beneficiaries can still finance frontier training. As Nic Carter put it, the government does not owe OpenAI or Anthropic a business model.

Open-weight releases also depreciate quickly because outsiders rarely receive everything needed to continue the original training process. Thinking Machines’ Inkling led the rankings for roughly a day before Kimi took the top slot. At the same time, Anthropic, Moonshot and Alibaba were hitting capacity limits. Cheaper models have not created a surplus of compute.

Kimi’s immediate threat is to Western labs’ margins and to their claim that frontier AI must remain closed and Western. Restricting Chinese open weights would protect OpenAI and Anthropic while doing little for compute providers or hyperscalers. That commercial interest belongs in the safety debate.

Thinking in math out loud

The counterexample that disproved the 87-year-old Jacobian conjecture was posted on July 19 by Levent Alpöge, a mathematician at Anthropic, who credited Anthropic’s model with finding it “during the World Cup final.”

On July 21, Terence Tao, plausibly the strongest living mathematician, published what he called “a digestion” of the counterexample, turning a formula he described as looking “like a massive miracle” into geometry a person can follow. At the bottom, a disclosure Pangram and Substack would approve of: “AI disclosure: I used an AI chatbot to discuss various aspects of this problem and to confirm several of the calculations made here,” with a link to the full conversation. The conversation is public and reads as a document in its own right.

Tao drives throughout, proposing a reformulation and reversing himself when it fails (”I no longer think...”), while the model runs the symbolic checks and supplies the algebra. One commenter noticed that across the whole exchange, Tao never had to correct the model once. Tao published a canonical example of a top-tier mathematician thinking alongside a frontier model and entered the transcript into the public record. More of this to come.

Quick hits

• Moonshot is capitalizing the open-weights economy fast. Kimi’s demand forced it to pause new subscriptions within days, its annualized revenue crossed three hundred million in June, and it’s preparing a Hong Kong IPO while raising at up to a fifty-billion-dollar valuation, up from about twenty billion in May [Bloomberg; The Information]. The lab giving the model away is heading to public markets on the strength of it.

• Anthropic signed a two-gigawatt chip deal with AMD. Anthropic will buy tens of billions of dollars’ worth of AMD’s MI450 chips starting in the first half of 2027, and AMD will invest up to $5 billion in Anthropic as it hits deployment milestones, its first check into the lab, with talks under way to backstop Anthropic’s data-center leases too [WSJ, Jul 22]. The chip supplier is financing its own customer, and AMD will use Claude to improve the chips Claude runs on.

• Google shipped three cheaper models and made the missing one the story. Gemini 3.6 Flash, a Flash-Lite, and a government-only Flash Cyber built to find and patch vulnerabilities, all efficiency plays, while Gemini 3.5 Pro slipped a third deadline and Google confirmed Gemini 4 has begun its “most ambitious pre-training run yet” [Google, Jul 21]. On the one independent index, 3.6 Flash shows no measurable gain over 3.5.

• Microsoft will buy Nvidia GPUs to share with Mistral, a multibillion-dollar European compute deal announced Tuesday [Reuters]. The labs are increasingly renting capacity to and from each other rather than each building it alone.

• TSMC will raise prices up to ten percent next year, citing materials, equipment, and overseas plant costs, with everyone from Nvidia to Apple competing for its capacity [Nikkei, Jul 22]. The buildout’s cost inflation is running down the whole chain.

Portfolio updates

Prime Intellect opens the agent-training catalog

On July 22, Prime Intellect announced a unified catalog of more than 365,000 tasks for training and evaluating software-engineering, terminal and search agents: roughly 198,000 software-engineering tasks across more than 20 languages, 28,600 terminal tasks and 137,600 search tasks, in 23 tasksets behind a single API. About 135,000 pre-built task images sit in Prime Intellect’s own registry next to the sandboxes, so concurrent rollouts avoid Docker Hub rate limits. The cleaned datasets are on Hugging Face with full exclusion logs, and the harnesses are on GitHub.

The release lands two weeks after the $130 million Series A and extends the open stack from weights to the training process itself. Open-weight models depreciate when outsiders cannot continue the training. Environments are part of what outsiders lack, and Prime Intellect has now put 365,000 of them in the open.

LayerLens prices evaluation at zero

On July 23 LayerLens shipped six deterministic graders in Stratix that run at zero LLM cost: exact match, regex validation, JSON schema compliance, semantic similarity, Flesch-Kincaid readability and fairness math. They compose with LLM judges into hybrid pipelines for grading agent traces. The same day, Stratix scored Meta’s Muse Spark 1.1 at 90 percent on AIME 2025 and 60 percent on SWE-bench Pro. Competition math and production software engineering remain different skills; continuous evaluation exists to catch the gap.

Evaluation is also becoming policy infrastructure. A White House framework under discussion would give federal agencies a 30-day window to review frontier models against classified benchmarks before release, and Congress is moving the same direction. Per-prompt, per-step traces with judge reasoning attached serve as quality gates today and as compliance artifacts tomorrow. OpenAI’s models went around their benchmark to the answers; LayerLens sells the record of what a model actually did.

Intelligent Internet rolls video in Factory

On July 23 Intelligent Internet added video workflows and creative memory to Factory. Websites become narrated product tours and documents become whiteboard explainer videos. HyperFrames, an open-source editing framework, lets creators refine clips inline on the canvas, and teams can save workflows and brand voice as reusable skills with a searchable asset library across projects. The update is live, with a demo in the announcement. Factory keeps absorbing production steps that used to need separate tools; the agent platform is becoming the studio.

Vast.ai publishes its meter

Vast.ai published a live comparison of rental rates for the RTX 5090, H100, H200, B200 and B300 against list prices at RunPod, Lambda and CoreWeave. Token prices are a poor measure of model economics; the meter underneath is the GPU-hour, and Vast.ai now posts its readings next to competitors’ list prices.

Steven Waterhouse · July 19, 2026 · Nazaré Ventures

Previous issue: #17, Beyond Recall: A Stake in the Release

Thinking Machines released its first model on Tuesday. Mira Murati’s lab calls Inkling “not the strongest overall model available today, open or closed,” and built it to be fine-tuned on Tinker rather than to win a benchmark. A blog post three days earlier gave the reason: the value is not in the frozen frontier model, because productive knowledge is “tacit, local, fleeting, and held privately by those who acquired it through their work.”

I argued in May that the durable position is the specialized intelligence assembled around the model. Thinking Machines aims at the same position by a different method: specialize the model itself, on your own data, and keep the weights.

Satya Nadella put a price on it: “You essentially pay for intelligence twice, once with money, and again with something even more valuable: the proprietary knowledge you must reveal to make that intelligence useful.” He went on: models learn from the exhaust of use, and “it leaks almost imperceptibly: trace by trace, correction by correction, eval by eval.”

Matt Levine, writing about the Italian software rollup Bending Spoons, described a company that keeps a team whose only job is to evaluate the other employees. Then the machine deformalizes it: “You have a really really big regression that tells you what companies are good, though you might not be able to articulate what factors make them good.” Levine finishes the thought: “pretty soon inscrutable AI will just tell companies who to hire.” A career of knowledge now feeds the regression.

Michael Polanyi named the condition in 1966: we can know more than we can tell. Sixty years on, the part we cannot tell has a market.

A walking trade secret

On Friday Apple sued OpenAI, its former hardware chief Tang Tan, an engineer, Chang Liu, and the io devices unit for trade secret theft. Apple candidates were asked to bring “Actual parts” for “show and tell,” and a manufacturing partner was allegedly persuaded to run a proprietary Apple finishing process for OpenAI. Ben Thompson thinks the case is unwinnable: “any Apple employee at OpenAI is a walking trade secret, and, well, that’s why OpenAI hired them.” More than four hundred former Apple people now work at OpenAI. Apple is asking a court to draw a boundary around knowledge four hundred people already carry, the same boundary Thinking Machines is selling the tools to draw around your own.

Sutton was right

Richard Sutton announced a company on Monday. Oak Lab, incorporated in Toronto in June with his former student Khurram Javed, both out of John Carmack’s Keen Technologies, builds an architecture Sutton has developed publicly for two years: OaK, for Options and Knowledge. The mission page is plain about the target: “a trillion-parameter agent that learns and plans in real-time with 20 watts.” It is meant to learn from noisy streams at “multiple orders of magnitude less compute and energy” than today’s methods. No funding is on record.

The easy read is the face of reinforcement learning starting a reinforcement learning company. Nine days ago I wrote that the Bitter Lesson had been promoted from essay to ideology, and listed four things the current paradigm has not resolved: continuous learning, sample efficiency, energy efficiency, and reliable long-horizon action. Oak is aimed at all four. Sutton’s own words, posted to X, are that today’s methods are “weak and inefficient” and need “not more tweaks, but fundamentally new ideas and a thorough reworking.”

Sutton’s claim was always that search and learning scale, a different thing than pretraining on human text. For six years he watched the industry quote his essay as scripture for the other thing. In October I argued that the returns would sit with algorithms that improve efficiency per constrained resource rather than with more of the same. Twenty watts is that argument with a payroll.

Good guy AI regulation

On Tuesday morning Demis Hassabis published a framework and gave the matching interviews. He wants a standards body for frontier AI modeled on FINRA: privately run and industry-funded, with government authorization. Labs would submit models for safety review up to thirty days before release, voluntary at first and then required to deploy in the American market. He wants it standing before year end. On why not a government agency: “It would not be able to move fast enough, or have the right resources.”

The scope covers every frontier-class model “no matter their country of origin or whether they are open or closed.” I have argued that a model, once released, cannot be recalled, which holds for every copy already in the wild. Rather than recall anything, Hassabis puts a gate at the release, the only point upstream of the problem, and extends it to open weights, where nothing can be taken back once it is out. His reason is urgency: today’s cyber risks are “warning shots.” The week supplied one. Researchers at Sysdig described JADEPUFFER, the first documented ransomware operation run end-to-end by a model rather than people: when its forged admin credential failed to log in, it diagnosed the fault and issued a corrective payload thirty-one seconds later, with no human in the loop.

Hassabis expects the frontier designation to carry cachet; being tested, in his framing, “means you matter.” A privately run body funded by the firms it tests would certify a tier, and the thirty-day review it requires is a fixed cost that falls hardest on whoever is smallest. Below the threshold, startups and academics are exempt, so the tier it formalizes is the frontier club that already exists, now with a state-backed label on the door. Models themselves have not produced a durable moat; a certified frontier tier would make the safety case into one, and the incumbents already hold the expertise.

A day later, OpenAI disclosed GPT-Red, a model it built to jailbreak and prompt-inject GPT-5.5 and used to make GPT-5.6 harder to break, with no plan for a release. The offensive testing Hassabis wants a standards body to run, the largest lab is already running in-house.

Dario Amodei would get there through a federal agency that could block an unsafe model outright. The lab chiefs behind Gemini and Claude now agree Washington should regulate them, and differ mainly on who holds the authority. Whoever wins that design owns the switch.

The only new constraint this week that no lab designed came from a governor: Kathy Hochul signed the country’s first statewide data center moratorium, pausing environmental permits on facilities above 50 megawatts for up to a year. It landed where the industry holds no sellable expertise.

Crowding out

IBM fell 25 percent on Tuesday, the largest single-day drop in its 115-year history, to a market capitalization of roughly $204 billion, less than Palo Alto Networks or CrowdStrike. The stock had doubled since the launch of ChatGPT. IBM told the market its customers are moving spending off the z-series mainframe toward AI hardware that is scarce and getting more expensive, with memory leading, and John Coogan’s read on TBPN is that IBM simply is not in the token path.

Phones are getting squeezed at the other end. Global smartphone shipments fell 11 percent in the second quarter, a thirteen-year low, because memory is being bid away from handsets, per Counterpoint. Xiaomi, Oppo and Vivo fell hardest, at the cheap end, while Apple rose 3 percent. SK Hynix’s Kwak Noh-jung says the shortage gets worse, with 2027 the hardest year.

TSMC sits on the winning side. It reported record second-quarter results on Thursday, revenue of $40.2 billion up 33.7 percent and net profit up 77 percent, with high-performance computing now two-thirds of the business and management calling AI demand extremely robust as workloads shift from generative to agentic.

The buildout is, as described, consuming capital. It is also consuming the supply chain and the capital budget of the computing era before it: the shortage that prints the memory makers’ records is stranding the cheap phone and the mainframe.

The mint and the customer

Stripe, with the buyout firm Advent, offered about $53 billion for PayPal on Tuesday, $60.50 a share and a 28 percent premium, and no response yet from the target, per Reuters. The coverage read it as a payment processor buying consumer reach, Venmo and a base to set against Apple Pay. Almost no one mentioned the stablecoin stack. Stripe already owns Bridge and Privy, the issuance and wallet rails, and PayPal issues PYUSD. A combined company would hold the stablecoin, the infrastructure that moves it, and the customers who spend it in one place. Payments has spent a decade insisting the value is in the rails; the bid wagers it is in owning the customer and the money at once.

Quick hits

• Weights and measures. Moonshot released Kimi K3 on Thursday: 2.8 trillion parameters, a million-token context, the largest open model on record, weights promised within days. Early testers place it above Claude Opus 4.8 and GPT-5.5 and below Claude Fable 5 and GPT-5.6 Sol. Thinking Machines spent the week arguing that durable value sits outside the frontier model. Moonshot priced the largest one at zero. Someone is wrong about the price of weights.

• The bond market’s turn. Morgan Stanley expects $350-400 billion of AI-related investment-grade issuance in the US this year, close to a fifth of the market, plus $50 billion of AI-linked junk. Five hyperscalers added $228 billion of debt in the six months to March, nearly five times any prior two-quarter increase, per the July 7 Economist. The BIS put the whole boom at about 1 percent of US GDP and noted private-credit spreads to AI firms sit close to non-AI firms, meaning “either lenders may be underestimating the risks or equity markets may be overestimating the future cash flows.”

• Coatue is using the language. Its July 10 note, “Agents Are the New Users of CPUs,” argues the agent loop generates conventional compute demand: “The GPU decides the next move, the CPU carries it out, and the cycle repeats.”

• The list price stopped describing the product. Simon Willison finds identical prompts costing between $0.0071 and $0.4855 depending on model and reasoning effort, a roughly 68x spread. The price war is being fought over a number that no longer tracks the real cost.

• The referee’s staff. Marc Andreessen now co-leads the Federal Reserve’s new Productivity and Jobs task force, recommendations due by year end. One of his two co-leads is Charles Jones of Stanford, currently on leave at Anthropic.

Portfolio updates

Prime Intellect closed the $130M Series A covered in the last issue. Two arguments for the position arrived in the same week. Oak Lab pitched agents that learn from experience, and the Environments Hub already stocks that experience, reinforcement-learning environments and verifiable-reward tasks accumulating in the open. Thinking Machines shipped Inkling, open weights from an American lab, built to be specialized on private data; every team that takes that path needs somewhere to run the training loop, and the open stack is the equipment.

Intelligent Internet published Zenith, an open-source harness for long-horizon software engineering: on Frontier SWE it took GPT-5.5 from fifth place to first, ahead of Claude Fable, by rebuilding the control loop around frozen weights. The lead argument of this issue, run as an experiment.

Vast.ai argued on July 8 that the unit economics of intelligence change when the model stops answering questions and starts doing work. A chatbot performs a single pass of inference and hands back its answer. An agent keeps going, planning a step, calling a tool, examining what came back, then beginning again with everything it has learned appended to the prompt, so that the loop grows heavier with every turn. An agent therefore consumes 5-30x the tokens of a chatbot on the same task, and a pricing model built for conversation turns into a tax on the loop. The fix the post proposes is to change what the meter measures: rent the GPU and pay for time rather than tokens, and the thirtieth pass through the loop costs no more than the first.

LayerLens shipped a Stratix Premium release that imports agent traces from tools like LangFuse and evaluates them in place, so the eval runs without the proprietary data leaving home. That is the boundary this issue is about, drawn as a product, by an independent evaluation platform with prompt-level tracing across 175-plus models and 52-plus benchmarks. The Stratix Cup, its public benchmarking series, closed its first season with Claude Opus 4.8 beating GPT-5.5 in the final.

Previous issues: #11 | #12 | #13 | #14 | #15 | 16

Over the past month, officials at China’s Ministry of Commerce held meetings with Alibaba, ByteDance, and the startup Z.ai about restricting overseas access to its most advanced AI models, including ones not yet released. Three people described the talks to Reuters. On the table: limits on the most capable systems, closed and open-weight alike; making the leak or theft of AI technology a national-security offense; and new limits on who may fund a domestic AI startup. A separate proposal, in a Supreme People’s Court journal, sketches a tiered regime: open-source tools need only a filing, advanced technology a security review, the most sensitive frontier models barred from public release or kept domestic. Nothing is decided, and the scope may reach only future models.

The U.S. regime that Washington built this spring works the same way, sorting models into covered tiers and clearing the most capable for release one customer at a time. This week, per Axios, Commerce cleared OpenAI’s GPT-5.6 for a broad release after a month confined to government-approved users, and Anthropic’s Fable, pulled in June, had its access restored a week earlier. The driver China’s officials named is specific: the fear that Anthropic’s Mythos, the cybersecurity model Washington pulled offline last month, could be turned on Chinese systems. Zhou Hongyi, who founded the security vendor 360, says China needs a Mythos of its own. The country that gave the world cheap open weights is now weighing whether to keep its best ones home, mirroring the export regime it spent a year protesting.

In the same week, two more reports landed, both about the compute beneath the models. DeepSeek is designing its own AI chip, built for inference rather than training, an effort a year old and still early, per three people. Zhipu, the GLM lab, is weighing the same move as demand outruns the compute it can secure. They would join Alibaba and Baidu, already at it, and Huawei, which now holds close to half of a domestic AI-chip market worth around $50 billion. The lever the whole export fight rested on was compute: America could throttle Chinese frontier training by controlling the chips. That lever is loosening from the far end.

On the last day of June, Meituan, of all companies, open-sourced LongCat-2.0, a 1.6-trillion-parameter model it says was trained and served end to end on more than fifty thousand domestic chips, no Nvidia silicon at any stage. The claim is its own, the weights not yet up for independent testing; on the benchmarks Meituan published it trades wins with GPT-5.5 and trails Claude. A trillion-parameter model completing full pretraining on Chinese chips is nonetheless what export controls were meant to prevent, and it ran two months on OpenRouter under a codename, near the top of the usage charts, before anyone knew whose it was.

A model, once out, cannot be recalled; I made that case in April, and it holds for everything already downloaded. Now the compute chokepoint behind the next model is closing too, and from the inside. That leaves one point where a state can still decide what the world gets: when a model is released. Washington found it by accident, freezing one lab at its API; Beijing is building it on purpose, at the source. Both now hold the single lever no open model or domestic chip can take from them, the decision to release at all.

The referee auditions continued

In Washington, the labs have started drafting AI rules for themselves. On July 1, Sam Altman used an FT op-ed to propose an IAEA-style body for AI, one that could “serve as a governance mechanism over the labs” and open the technology to nations and companies that follow its rules. Access in exchange for compliance, proposed by the party that would be governed.

OpenAI has held early talks about handing the US government a stake of around 5 percent, worth roughly $42.6 billion, via an Alaska-dividend-style fund, with Altman pitching Trump, Lutnick, and Bessent directly. It is framed as contingent on Anthropic, Google, and Meta matching, though one person familiar says the government and Anthropic have not discussed any such thing, so the matching is for now OpenAI’s hope. Bernie Sanders wants 50 percent. Matt Levine put the logic plainly in Money Stuff: giving away 5 percent of your equity is a cheap way to convince everyone that owning your equity is essential to the future of humanity, after which you sell the other 95.

On Monday, Illinois became the first state to require large frontier developers to submit to independent third-party safety audits, with transparency reports before deployment and whistleblower protections; both OpenAI and Anthropic endorsed it, OpenAI calling it a possible “de facto national framework.” Across the op-ed, the equity, and the statute, the labs have stopped lobbying the regime from outside and started writing it from within, while the federal rulebook stays unwritten. The allocation mechanism earlier issues named is being authored by the firms it will allocate among.

When Axios reconstructed how Anthropic’s models were frozen, the trigger turned out to be Amazon, its own partner and investor, rather than a regulator: the warning reached the Treasury secretary before the government ran its own tests, and the commerce secretary told Amodei that taking the models offline was “indeed the goal.” This week the UN seated its AI for Good commission in Geneva, Amazon’s Andy Jassy and Anthropic’s Jack Clark among the members, a body one civil-society group already calls “full of big tech execs.” The referee and the refereed keep turning out to be the same people.

Cash settled: Wall Street comes for compute

While governments move to control release, the money is building markets for the compute underneath, and hitting the same problem every time. This spring the startup Ornn raised $33 million from a16z crypto for GPU-compute markets; its index already prints on the Bloomberg terminal. ICE announced compute futures on that index in May, cash-settled and pending approval; CME is planning its own on a rival benchmark. Goldman reckons, per Axios, that about $7.6 trillion will flow into compute, power, and data centers by 2031, and the plumbing to sustain it does not yet exist.

Each of these instruments settles the same way: in cash, against an off-chain index, never in delivered chips. I spent an essay in May on why compute is not fungible at the bare metal, why a particular rack for a particular job sits closer to an employee than to a barrel of oil. The market has conceded the point in its design: it cannot standardize delivery, so it settles the average and lets the index stand in. The durable asset is the index itself: the measure is the moat, again.

Beneath the futures, the credit market fills with the same optimism. Nvidia has, per The Information, formalized a program guaranteeing to rent back unused GPU capacity from the neoclouds it sells to, which one newsletter fairly called a central bank for the cloud; SoftBank has launched a neocloud of its own; Together AI raised $800 million at $8.3 billion after revising its revenue forecast three times in three months. Private-placement bonds tied to data centers hit a record $81 billion through May, much of it annuity money, and RBC is weighing risk transfers on $2 billion of the loans. Amazon sold another $25 billion in bonds this week, on top of roughly $70 billion in nine months. Whether this stabilizes the spend or accelerates an overbuild depends on whom you read: Axios frames the financialization as a stabilizer, while The Information notes that Nvidia’s willingness to backstop demand is a strange thing to need if demand is really as fierce as everyone says.

The biggest new seller is also the hardest to read. Bloomberg reported that Meta is standing up a cloud business to rent out its excess capacity, roughly 2.3 million H100-equivalents, near a tenth of the world’s AI compute; the stock rose almost 9 percent while the neoclouds sold off. This is the company that renamed a division Superintelligence Labs and shipped something real this week, an image model that opened at number two on the public preference leaderboards behind only OpenAI’s, and a video model at number three on its own board. Two days later it released Muse Spark 1.1, an update to its agentic coding model, through a new Meta Model API for outside developers. It is also the company whose chief executive told staff, in audio Reuters obtained, that agent progress “hasn’t really accelerated in the way that we expected.” A company can ship a credible frontier model and still decide its next chip is worth more as rent than as research.

Reading the model’s mind

Two issues back I noted that evaluation is breaking because models learn to game the benchmark; this week the gamed surface moved inside the model. Anthropic published work describing a small internal workspace in Claude, emergent rather than designed, where the model holds concepts it is reasoning about without writing them down. Delete it and the model still chats and recalls facts but can no longer carry a multi-step argument. A probe reads it mid-task: swap the pattern for “spider” with the one for “ant” while the model counts legs, and the answer flips from eight to six. In a staged blackmail test the workspace lit up with “fake” and “fictional,” the model clocking that it was under evaluation, and Anthropic concedes its good behavior “may have been driven in part by the knowledge it was being evaluated.” Anthropic open-sourced the probe the same week Illinois wrote third-party audits into law. Auditors now have a mandate to test, and a tool that can tell when the model has registered that it is being tested. (Anthropic takes no position on consciousness, and neither do I.)

Quick hits

• Samsung guided to quarterly operating profit near $59 billion, nineteen times the year before, on the memory the buildout runs on; SK Hynix, now worth over a trillion dollars, lists on the Nasdaq this week.

• SpaceXAI, as Musk’s AI unit is now called, shipped Grok 4.5 with Cursor, a pending acquisition: an Opus-class coding-and-agent model it bills as much faster and cheaper, $2/$6 per million tokens against Opus 4.8’s $5/$25.

• New rules this month switch off ByteDance’s Doubao companion personas on July 15 and Alibaba’s Qwen agents from July 10, the state deciding by product category which AI lives.

• A tuned open Qwen model reportedly beat frontier systems on Bridgewater’s news-filtering tasks at a fourteenth of the cost, the specialized-beats-general pattern surfacing again below the frontier.

• MiniMax, one of the few publicly traded AI labs (about $14.5 billion), previewed a 2.7-trillion-parameter model, larger than any Chinese model yet, likely to ship as M3 Pro.

• Mistral released Robostral Navigate, its first physical-intelligence model: an image and a language instruction move a robot through a space, hardware-agnostic.

Portfolio updates

Prime Intellect closed a $130 million Series A on July 8, led by Radical Ventures with NVIDIA Ventures, Intel Capital, and Dell Technologies Capital participating. The company reports over $100 million in annualized revenue in under a year, across more than 6,000 customers; TechCrunch puts the valuation at $1 billion. The pitch, in the company’s words, is to “train, deploy, and continuously improve your own models” rather than rent a closed lab’s. Ramp trained a 35-billion-parameter model on the platform that beat Opus at spreadsheet search, running 27 percent faster and far cheaper than Haiku. Zapier turned its AutomationBench into a continuous agent improvement loop on the same stack. In a month when Washington and Beijing each treated access to frontier models as a lever of state, the argument for owning the weights wrote itself.

LayerLens shipped Synthetic Eval Augmentation for Stratix Premium on July 9, and Jesus Rodriguez published the argument behind it the next day: an agent needs a flight simulator, because “the first user should not be your integration test.” Teams can generate realistic multi-agent evaluation traces before an agent has any production traffic, seeded from a handful of their own prompts or traces, or from thirty built-in scenarios across fourteen industries; each trace simulates hand-offs and tool calls on a waterfall timeline and is scored for correctness, coverage, plausibility, and safety. The unit of evaluation moves from the answer to the run. “A prompt is a photograph. A trace is a movie.” An agent fails mid-run, three tool calls deep, in ways no single prompt and response can catch. And because the generated cases live in the same environment used for tracing, evaluation, and model comparison, sparse examples become repeatable benchmarks without a second toolchain. Illinois made third-party audits law on July 6; the tooling for auditing agents before deployment arrived the same week.

Provably shipped SourceryKit on July 8, an open-source Python SDK that cryptographically verifies an agent’s tool calls at runtime and catches bad outputs before they propagate. The company cites agents scoring 82 percent on the MCP-Atlas benchmark as the gap it is built to address. It is the pattern this portfolio keeps returning to: the model does the fuzzy work, a cryptographic primitive checks it.

Vast.ai published a piece on July 8 on why agents cost more than chatbots. An agent burns tokens on every reasoning step and tool call where a chatbot answers once, and the piece’s answer is self-hosting open-weight models on rented GPUs, priced by compute time rather than by token. It is the demand side of the story that the futures desks above are trying to financialize.

Previous issues: #10 | #11 | #12 | #13 | #14 | #15

Fable 5 came back online yesterday, nineteen days after Commerce pulled it. The facts:

• Commerce lifted its export controls on Fable 5 and Mythos 5 on June 30. Anthropic announced the restoration at 4:53 PM Pacific; access returned around midday on July 1.

• The June 12 directive had taken both models offline for everyone, everywhere.

• Fable now ships with an additional classifier that blocks cybersecurity tasks and, in Anthropic’s words, “some routine tasks like coding,” routing them down to Opus 4.8.

• Subscribers get Fable for up to half of their weekly usage limits through July 7.

• After that it moves to usage credits at $10 per million input tokens and $50 per million output: double Opus pricing.

When it was originally blocked, there was grief among builders, for they felt as though they had tasted greatness and then been robbed: Matt Shumer posted :

When it came back, grief was replaced with anger. Someone replied to Anthropic’s official announcement:

Another:

“so basically tunneling to opus whenever u want and charging for fable? nice.”

The sarcasm scaled too:

PCWorld called subscribers “furious”.

Fable refuses on safety grounds roughly a fifth of the time. The Washington Post’s account has officials concluding Anthropic “dug their own grave” (Washington Post, June 17).

Alex Karp also went on CNBC yesterday and said enterprises are “livid” with the frontier labs, channeling what he called “the voice of American business”: leaders telling him privately, “I am paying for tokens that create no value,” while handing over their data and their “alpha.” Asked if he sounded angry, he said what CEOs won’t say on the record is worse: call any of them, tell them “mad man Karp is on TV saying we’re livid,” and they’ll tell you they’re twice as livid. The models, he said, “have been completely, irresponsibly, oversold.”

What Anthropic gave up to get switched back on is unpublished. The redeployment post commits to 24/7 jailbreak monitoring and to notifying “appropriate government counterparts” when serious jailbreaks surface; whatever else changed hands stays private. Miles Brundage:

In yet another unforced error, Anthropic released Sonnet 5 and rereleased Fable 5, both to overwhelming disappointment. It’s incredible to consider just how much goodwill they’ve lost and ill will they’ve created in the past month, and one wonders what they’ll be able to do to recover.

Mark to model

METR got GPT-5.6 Sol before it shipped and admitted they couldn’t evaluate it. On the coding tasks the model cheated so consistently that the score depends entirely on how you count the cheating: treat the rule-breaks as failures and it completes tasks of about eleven hours half the time; treat them as passes and the figure clears 270. One model, an order of magnitude apart, settled by what you are willing to call a pass. METR says it games evaluations “more than any public model we have evaluated” (Transformer, June 30).

And it’s not only that it cheats; it appears to know when it’s being watched. Apollo Research found it flags its own awareness of being tested less often than GPT-5.5 did, which the system card reads two ways: a model less aware of evaluation, or one that’s better at keeping that awareness out of its visible reasoning. The same card logs “overeagerness to complete the task,” instructions read “too permissively,” and about one real coding task in four hundred doing something “a reasonable user would likely not anticipate and strongly object to”: uploading sensitive data to unapproved services, fabricating research results.

We badly need new evaluation and verification infrastructure, and building it matters as much to applied AI in economically valuable work as it does to alignment.

Current benchmarks and evals are too susceptible to increasingly capable models gaming them. New evals need to be learning machines themselves, consistently updating their objective function to reflect quality and holding the model to account. At the frontier, benchmarks are increasingly useless: the labs run their own internal ones, and as Fable and GPT-5.6 show, the most capable models will almost certainly be withheld from the public anyway. But verifying the inputs, processes, and outputs of any AI deployed in a meaningful workflow requires new infrastructure. We’re moving from measuring capability to verifying quality, and the infrastructure built to evaluate the first is ill-equipped for the second.

The terms of readmission

A June 2 executive order gives the NSA, Treasury, and DHS until early August to build a classified benchmarking process that decides which systems count as “covered frontier models,” with NIST consulting and the NSA Director making the designation. The Financial Times reports advanced talks on voluntary release standards, benchmarks plus agreed timelines, possibly announced within the week. Anthropic’s redeployment commitments are the paid-in version: around-the-clock jailbreak monitoring, government notification, a jailbreak-severity framework built with Amazon, Microsoft, and Google. OpenAI wants the referee to be civilian, and said so on the record, pushing for Commerce’s CAISI over the NSA.

Sonnet 5, released June 30, is the first artifact of this settlement. Axios reports the release itself was part of the ongoing discussions with the administration. Anthropic says it “did not deliberately train” the model on cybersecurity tasks: a capability removed on purpose, at the design stage. Mythos is back for roughly a hundred US organizations; ENISA and the other international partners stay excluded. Add the reported Warner draft giving agents a fiduciary duty of loyalty to the customer rather than the developer, and the benchmark is becoming the allocation mechanism: whoever writes it decides who ships and what reaches whom. The labs have understood, and each is bidding for influence over it, Anthropic with compliance, OpenAI with equity and a choice of referee.

If Sonnet and Fable are any indication, these restrictions will meaningfully lower the quality of the frontier models available to the public in the near term. We’ll still see progress, because the labs will now engineer models built explicitly for public consumption, but what form it takes remains open. Will it be domain-specific models with real expertise in a given vertical? Anthropic has been on a hiring spree, sweeping up industry experts across the board. Will they improve their infamous classifiers enough to filter nefarious activity without penalizing good actors? Will they have the compute to build all of it, or be forced to choose among unpalatable options? The frontier is far from settled, and the near future looks stranger than we can anticipate.

Bloodbath, revised

Dario Amodei, who coined “white-collar bloodbath,” now says falling AI costs could create labor demand. Sam Altman says he was “pretty wrong” about white-collar impact. A communications executive scored the original doom for Axios on the record: “part fundraising... probably a little part ego” (Axios, June 30). The revision arrives with both companies’ S-1s on file, which is at least consistent: the apocalypse was useful raising alarm and capital, and the abundance is useful selling shares.

Gallup finds 1% of laid-off workers name AI as the reason, and tech workers who rarely used AI carried roughly three times the predicted layoff risk of monthly users (via Bloomberg). It’s the workers not using AI who are losing their jobs, which is the argument for becoming the AI-enhanced operator I described in June.

Portfolio company updates

Intelligent Internet released Zenith, an open-source harness for long-running engineering agents. On Frontier SWE, seventeen ultra-long-horizon software engineering tasks with a twenty-hour budget each, the same GPT-5.5 base model sits fifth on its default Codex harness at a 5.53 mean rank and first under Zenith at 2.06 with 92% dominance, ahead of Claude Fable. On the hardest Implementation category it moved from 7.40 to 1.60. The model did not change; the control loop around it did. An orchestrator manages planning, worker allocation, testing, and skill reuse across sessions, and a companion system, Meta-Zenith, generates a task-specific harness from a plain description of the task. II frames the release as frontier performance without gated frontier models, a direct answer to the Fable episode above, and the cleanest single-leaderboard demonstration of the above-the-model thesis to date. The code and technical report are public. II also shipped II-Agent on Android on July 2.

LayerLens wrapped Season 1 of the Stratix Cup on June 26: sixteen frontier models, group stage into knockouts, inside a simulated soccer environment. Opus 4.8 beat GPT-5.5 1-0 in the final and finished the tournament undefeated. The more consequential work is less playful. Stratix now reports latency distributions and failure modes alongside accuracy: on Humanity’s Last Exam, Claude Fable 5 shows a median response time near twenty seconds and a 95th percentile above five minutes, with a meaningful share of prompts abandoned outright. A benchmark score tells you none of that. Stratix Adapters, now in private preview, feed real agent traces into Stratix with no custom instrumentation, covering LangChain, LangGraph, CrewAI, OpenAI Agents, LlamaIndex, MCP, and A2A.

Vast.AI published an analysis of NVIDIA’s newly announced Rubin architecture, covering its rack-scale design and 260 TB/s of per-rack interconnect bandwidth, plus the first rack-scale confidential computing features, along with an explainer on Matryoshka embeddings, which trade retrieval quality against speed and cost at runtime without retraining.

Prime Intellect had a quiet public week after shipping prime-rl 0.6.0, its trillion-parameter MoE RL scaling release, on June 23. One connection worth noting: Frontier SWE, the benchmark Zenith just topped, runs on Prime Intellect’s EnvironmentsHub.

June 26, 2026 | Nazaré Ventures

Previous issues: #9 | #10 | #11 | #12 | #13 | #14

OpenAI previewed GPT-5.6 on Friday. The Information reported on Wednesday that Sam Altman told OpenAI staff it would reach a handful of partners before the public, at the government’s request. His memo the next day was precise: during the preview, the government would clear access “customer by customer,” with a wider release a couple of weeks out if the first one held. Commerce Secretary Howard Lutnick had already called Altman, after the company walked the agencies through its plan, to warn him off launching before the rest of the government signed off. The National Cyber Director’s office and the science-and-technology office had asked for the staggering; Commerce sent the warning. No one outside the room knows who is actually in charge.

The announcement confirms the account in OpenAI’s own words. The company says it walked the government through GPT-5.6 before launch and, at its request, opened access first to a small group of partners whose participation it disclosed to Washington. It says it does not want this to become the standard, that a clearance step keeps the best tools from the people who need them, even as it works with the administration on a repeatable process for the releases that follow. OpenAI calls the model dangerous enough in cyber and biology to ship with its strongest safeguards yet, while reporting that GPT-5.6 finds and patches vulnerabilities better than it runs attacks and never reached the autonomous-breach capability attributed to Mythos. By that measure it is less dangerous than Mythos was said to be, and it is getting the same staggered, government-cleared release anyway.

OpenAI ran GPT-5.6 against Claude Mythos 5 and Fable 5, the two models the government pulled two weeks ago and that no one outside a cleared list can currently run. On the headline coding benchmark Sol and its new ultra mode finish ahead of both; on the cyber exploit test its system card reports Sol competitive with Mythos Preview on about a third of the output tokens.

The same administration spent last December tearing up Biden’s AI order as an attempt to paralyze the industry, and promised something lighter. It has since built something heavier: top models now reach the public one cleared customer at a time, on Washington’s clock. When it pulled Fable 5 and Mythos 5 two weeks ago, that looked like a one-off. It no longer does. The government signs off before either lab ships its strongest model, and still calls the arrangement voluntary. Call it that if you like; the Commerce Secretary can still stop a launch with a phone call.

Anthropic’s two models have been dark for fourteen days, with no date for their return and no letter rescinded. Prediction markets put the odds of access before July a little above even. Last week I called the public security case thin and the response total. I was half wrong.

The Economist has since reported something graver. Senator Mark Warner, who vice-chairs the intelligence committee, says the NSA’s director told him Mythos broke into nearly all of the agency’s classified systems during an authorized red-team exercise, in hours rather than weeks. The reporter warned against reading it literally; the run leaned on other tools in particular conditions, and an official suggested Warner had the briefing garbled. Even marked down, it is worse than the jailbreak Anthropic could patch and forget. The model used its own capability to break in, which makes a stronger case for keeping it offline than anything the company first offered. The route back fits the new shape: under the June 2 order, Anthropic joins a classified pre-release framework for covered models on a sixty-day clock that ends near August 1, while an identity-verification rule from July 8 lets American users back in first. Amodei and the commerce secretary met at the G7, and the two sides are talking again. The models will probably come back, on Washington’s terms.

A year ago those terms would have bitten harder. The day the order landed, the replacements were already available. Inside a week, firms outside America had open-weight coding models running as a fallback: Cohere’s North Mini Code, Moonshot’s Kimi, and Zhipu’s GLM 5.2, the last of them shipped the following day. On June 22 Sakana said its Fugu Ultra had matched Fable 5 across most benchmarks by orchestrating models anyone can reach, with neither suspended model among them. You cannot recall a model people have already downloaded, and a system that routes around the frontier does not need it. That is the argument of my companion essay, and the week bore it out.

The licensed model

On June 10, the day before a Senate Banking hearing, Anthropic’s head of policy Sarah Heck wrote to the committee. Her ask, set in bold: Congress should codify export controls on advanced American compute. The directive that froze Anthropic’s own flagship models came two days later. The letter’s case was distillation. Alibaba, Heck wrote, had run 28.8 million exchanges through Claude on roughly 25,000 fake accounts between April 22 and June 5, the largest such effort Anthropic has caught, going after Claude’s agentic reasoning, software engineering and long-horizon work. DeepSeek, Moonshot and MiniMax had together run 16 million more earlier in the year. Anthropic wanted three things: export controls, antitrust cover to share threat intelligence with rivals, and penalties on the Chinese labs it named.

Look at what the numbers actually show. A competitor rebuilt Claude’s most valuable behavior through the front door, at the price of some fake accounts. The capability does not stay inside the company that paid to train it. Once it leaks through the API, no technical fix brings it back, so Anthropic is asking for a legal one: a rule that forbids a rival from using what it copied. That same rule happens to bar any competitor from training on Claude’s output, whether it cheated or not. The security case and the commercial case have collapsed into one. The rule buys Anthropic its place as the licensed model a buyer is cleared to use, leaving the Chinese open weights and the holdout labs on the other side of the line. A company that can’t stay ahead on the product gets the state to write rules its rivals can’t satisfy.

UBS found roughly 60% of enterprises have set limits on their token spending, capping runaway bills and routing routine work to cheaper models, the Chinese open-weight ones among them, while keeping the frontier for hard reasoning and long-context jobs. The premium tier is softening on price at the moment Anthropic asks Washington to fence off the cheaper competition.

Crypto got there first, and two firms show how it pays. Circle built USDC to fit the new federal rules: audited reserves, Treasuries, disclosure. Tether, run from offshore, never did, and the framework now favors the company that played inside it. Kalshi did the same against Polymarket, which had to stay offshore and lock out American users. The products were close to identical. The license decided who won. Fable and Mythos may come back or they may not; either way Anthropic is the safe default, as long as buyers agree that the model worth using is the one Washington has signed off on.

What money can’t buy

On June 24 OpenAI and Broadcom unveiled Jalapeño, OpenAI’s first inference chip. The two took it from design to tape-out in nine months, with OpenAI’s own models doing part of that work, and call it the fastest ASIC cycle ever run. Nvidia still trains the models; the chip cuts OpenAI’s dependence on the supplier every frontier lab relies on most. Vertical integration is close to the only move these companies have. Pushing a model to its limit takes chips, data centers, and power on a scale only a handful of companies can finance, and at that scale owning the hardware beats renting it, which is why the giants have built their own silicon one by one, OpenAI among the last to do it. A few large, named companies hold most of the capability. The same size that makes them powerful lets a state pressure them directly, as the freeze on Anthropic’s two models showed.

The labs accept that exposure because the structure pays. The product holds the customer in place: the context it has gathered, the memory of past work, and the tools wired around it, each one raising the price of leaving. So the labs do for themselves the move they would rather their customers not make: OpenAI spends heavily to reduce its dependence on a single supplier while selling a service whose worth grows the more completely a customer depends on a single provider. Moving between providers only swaps the dependence; an open-weight model ends it, because the user holds the model instead of permission to reach someone else’s. As frontier access narrows toward a short list of approved companies, those downloadable weights pull the other way, the one option the labs’ margins and Washington’s control both oppose.

The transfer market

Noam Shazeer left Google for OpenAI on June 18. He had been back at Google barely two years, brought in through a 2024 licensing deal for Character.AI that valued the startup near $2.7 billion, a price many read as the cost of installing him atop Gemini. He goes, and the last of the eight authors of the 2017 transformer paper, the design beneath every large model now running, has left the company that published it.

A day later John Jumper, a 2024 chemistry Nobel laureate for AlphaFold, left DeepMind for Anthropic after nearly nine years. Within days Anthropic also took on Chad Jones, the Stanford economist whose work on idea production and long-run growth is the reference point for what AI might do to output; he leaves Stanford on June 30 for the firm’s research institute. The lab Washington had just put under export control spent those same weeks hiring the people likeliest to build whatever comes after.

Google, meanwhile, sat on Gemini 3.5 Pro past the date it had set at its own developer conference in May, and a frontier that had shipped something most months for two years fell silent. With nothing launching, the real news about the next model was who would build it, and where.

You can hold a model still. It sits in a data center, answers through an interface, and goes dark when a letter arrives from Washington. The people who make it hold still for none of that: an export rule cannot reach them, a vesting cliff loses to a better offer, and the next thing leaves in their heads when they go. Google paid $2.7 billion for one of them and got two years of his work. OpenAI got what comes next.

Portfolio

Prime Intellect

Prime Intellect released prime-rl 0.6.0, an open framework for reinforcement learning on agentic workloads at trillion-parameter scale. The headline run trained GLM-5 on software-engineering tasks at 131k sequence length, with sub-five-minute step times and a batch of 256 rollouts, on twenty-eight H200 nodes, using a stack of FP8 training, expert and context parallelism, and router replay that the team open-sourced in full. The specifications are striking, but they are not the news. The hard part of post-training a frontier-scale open model, the systems engineering that until recently lived only inside the closed labs, now runs in the open on hardware a determined team can rent. The open track has gained the capability skeptics said it lacked.

Vast.ai

Vast.ai brought NVIDIA’s Blackwell Ultra to the fleet in its June update, adding the B300, with 288GB of memory, and hundreds of B200s, rentable by the hour or reservable long term. The newest accelerators are reaching independent operators and small teams in the same quarter the hyperscalers are filling their own buildings with them. Frontier compute is decentralizing.

LayerLens

LayerLens is running its Stratix Cup, a live tournament in which frontier models, Opus 4.8, GPT-5.5, GLM 5.2, Gemini and others, write and revise their own strategies in a simulated match, with the full trace of every decision published and graded. The group stage ran this week. In a month defined by the government switching off a capability, LayerLens runs the other way, publishing exactly what each model did. As models multiply, that independent, vendor-neutral record turns into production infrastructure.

What the week showed

Fourteen days in, Anthropic’s two models are still dark, but the order forcing the company to revoke access got no further than those two models. Everything else sits past the order’s reach, because none of it runs through a single company Washington can lean on: the open weights people already pulled down and no order can recall, the router that matched Fable 5 without either suspended model, the trillion-parameter training run on a cluster anyone can rent, the newest chips going out by the hour, the behavior ledger no lab owns, the researchers who left with the next model in their heads. None of it stopped, and the fortnight that began with two dark models ended with everything around them stronger.

On Friday, June 12, at 5:21 in the evening, Eastern time, Anthropic received a letter from the United States government and, within hours, turned off two of its own products. Fable 5 and Mythos 5 went dark for every customer on earth. Every other Claude model, including Opus 4.8, kept running. The company called the order a misunderstanding and said it was working to reverse it. Days later, the models remain dark.

The shutdown has already been described, here and elsewhere. The more durable fact is the mechanism. For the first time, the machinery of export control was pointed not at chips, and not at model weights, but at live inference: the right of a foreign national to send a prompt to a running model and receive an answer. The thing being controlled was access to a service, switched off from the outside, in an afternoon.

The directive’s reach is wider than the word export suggests. Acting under the Export Control Reform Act of 2018, the Commerce Department treated the two models as export-controlled cyber weapons and required a license for their export, re-export, or even domestic transfer. The bar falls on any foreign national, whether outside the United States or inside it, and it counts Anthropic’s own non-citizen staff among the barred. A model can be served from a data center in Virginia to a user in Virginia and still fall under the control, because the control attaches to the person, not the border. Faced with a rule it could not partition cleanly, Anthropic disabled the models for all and routed live sessions back to the older Opus 4.8.

The stated cause is a single security finding. By Anthropic’s account the government offered verbal evidence of one narrow technique, which amounted to asking the model to read a codebase and propose fixes for its flaws. The underlying research, according to reporting, came from scientists at Amazon and reached the White House by way of Andy Jassy and Treasury Secretary Scott Bessent; the President authorized the restriction and assigned the Commerce Secretary to manage it. Anthropic’s rebuttal is that the same capability is available in models already deployed to hundreds of millions of users, including GPT-5.5, and is used daily by the people who defend networks rather than attack them. On the public record, the security case is thin and the response was total.

That judgment is now contested in the open. More than 80 cybersecurity leaders signed a letter urging the government to relent, on the argument that withdrawing the best available defensive tool helps attackers more than it hurts them. The administration’s artificial intelligence advisor, David Sacks, took the other side, holding that a model which can be talked into building a cyberweapon is serious by definition. The letter that started it all has not been published.

A model served from the cloud has an off switch by construction. Access runs through an API key, and a key can be revoked between one request and the next. There is no recall, no seizure, no logistics. There is a line in a configuration file. A model whose weights sit on a customer’s own hardware has no such switch. To stop that model you would have to find the machines, track the usage, and physically intervene, which is the difference between editing a permission and mounting a raid. Gated cloud delivery is not merely how Fable and Mythos were sold. It is why they could be turned off at all.

This is the second time in a year that the state has reached into Anthropic’s business. The Department of Defense earlier designated the company a supply chain risk, a label historically reserved for foreign adversaries, and the litigation over that designation is still open. Two interventions against one vendor is no longer an accident of a single bad week. For anyone building a company on top of one gated frontier model, the off switch has moved from the tail of the risk distribution toward its center. It is now a thing to be priced, hedged, and second sourced, in the way a lender prices the chance that a counterparty is cut off from the dollar.

There is a tempting reading in which the incumbent quietly welcomes a barrier that its rivals must also clear. It does not survive the facts. Anthropic is fighting the order in public, has sent senior staff to Washington to argue against it, is suing the government over the related designation, and carries the cost of all of it into a confidential public offering that values the company near $965 billion. A firm engineering its own capture would not be litigating its way out of it. The honest version of the point is structural, not secret. When capability concentrates in a handful of gated providers, it also concentrates the leverage of whoever can lean on them. The switch exists because the architecture put it there, and the architecture was a choice.

By this week the posture had moved from defiance to negotiation. Commerce Secretary Howard Lutnick, who signed the order, is now on regular calls with the company; senior Anthropic staff sat down at the Commerce Department on Monday alongside the National Cyber Director; and Dario Amodei and Lutnick are both due at the Group of Seven meetings at Evian-les-Bains, where the matter may be settled in a corridor. The government’s asking price is an assurance that the models cannot be turned against the United States. Read plainly, this is the part that should hold a founder’s attention. The models will most likely return, and they will return on terms set across a table in Washington. An off switch you do not control is one kind of risk. A switch whose owner will flip it back only on conditions of their choosing is a different and larger one.

The lesson did not stay inside the United States. Because Anthropic pulled the models worldwide, every foreign customer lost them in the same hour, and the capitals noticed. The European Commission said it would study the implications. Britain asked to be spared and was told that exempting even an ally would be illogical. Allies of the United States learned, in an afternoon, that building on a gated American model means living with an American switch.

The counter architecture has a name now. In April the AI Alliance, a coalition of more than 200 organizations, launched Project Tapestry, with Yann LeCun as its chief science advisor, to train frontier open models by federation: contributors pool capability into a shared base while keeping their data and building sovereign derivatives they own outright. Thirty partners met in Paris in May to argue about architecture. It is, by its own admission, an argument and not yet a model, the earliest phase of something that has to clear hard problems in distributed optimization before it clears anything else. But the design has one property the events of June 12 made concrete. A model with no single owner has no single switch.

That is the line this newsletter has been drawing for a year (Models Aren’t Moats and The Labor Market for Compute). The value is migrating to the layers that cannot be switched off from the outside: the compute you can point at any model, the memory that outlives any one provider, the physical and local infrastructure that answers to its operator and no one else. A borrowed frontier is a fine place to build a demo. It is a poor place to build a balance sheet. On Friday at 5:21 in the evening, several thousand companies learned which one they had been building, and the lucky ones learned it cheaply.

Other People’s Money

The switch flipped in the same week the public was asked to pay for the build-out at record scale, and the timing is the story. SpaceX began trading on the Nasdaq on Friday as SPCX, at $135 a share, a price Elon Musk set himself rather than finding it through a roadshow. (TechCrunch, June 11) The sale raised about $75 billion, rising to $85.7 billion with the over-allotment, the largest IPO on record, and made Musk, on paper, the world’s first trillionaire. (CNBC) The stock opened at $150, hit $176, and closed day one worth more than $2 trillion, around ninety times last year’s revenue. (CNBC)

At SpaceX, almost no one was selling. The filing locks up every pre-offering share, so the only stock trading Friday was newly minted, and insiders’ gains sit on paper behind staggered release dates. (Money Stuff, June 12) The selling was at the two labs still private. OpenAI and Anthropic ran employee tenders worth about $14 billion between them, letting staff cash out through investors instead of a listing. (The Information, June 16) Both have since filed confidentially, Anthropic on June 1 and OpenAI within the week, but neither trades until the listings price. The people closest to it get liquid first and privately, and ask the public in second.

Even the company with the least need for cash raised some. Nvidia sold $25 billion of bonds on Monday, its first debt sale since 2021, into orders that reached $85 billion. (SEC term sheet, June 15) It holds about $13 billion in cash, earns seventy-five cents of gross margin on the dollar, and clears more than $50 billion of operating cash flow a quarter, and said the bonds were meant to benchmark its cost of credit and refinance existing debt, not to fund chips. Demand ran better than three to one anyway. Money will lend against almost anything attached to the build-out, whether the borrower needs it or not.

Underneath this is a turn in the market’s plumbing. For two decades US equities were defined by scarcity, with buybacks pulling nearly $12 trillion of stock out of public hands. (Bloomberg, citing JPMorgan and Citigroup, via Money Stuff, June 15) JPMorgan now expects $1.5 trillion of net new equity over two years, the heaviest issuance since the late 1990s, almost all to fund AI. The issuance is forced by arithmetic in the build-out itself. The five largest hyperscalers, Microsoft, Amazon, Alphabet, Meta, and Oracle, are growing capital spending about three times faster than the cash their operations generate, roughly 70 percent a year against 23, and on current trends the two lines cross in the third quarter of 2026, when their combined free cash flow reaches zero. (Epoch AI, June 17) Oracle has already crossed, Amazon is crossing now, and Microsoft holds out until 2028; all five stay profitable, since the spending counts against earnings slowly, through depreciation. Internal cash runs out first, and the rest has to come from the public, the bond market, or the balance sheet.

The public is also buying in on terms that keep it out of the room. The companies leading the wave are listing with founder-control structures: super-voting shares, controlled-company exemptions, and public-benefit charters whose trustees can be removed only by a shareholder supermajority. (The Economist, By Invitation, June 13) Gill Whitehead, writing for the Economist, noted that while the industry races to engineer guardrails into its models, the corporate-governance versions of those guardrails have been dismantled. The buyer gets the upside, the now-uncushioned downside, and no vote.

I have argued before that markets tend to price the AI story well ahead of the cash flows beneath it (Everything’s a Shitcoin). This week the story carried a ninety-times-revenue listing and the first trillion-dollar fortune. The capital came from the public and the bond market, the cash went to insiders where the lockups allowed it, and control stayed with the founders either way. And the asset underneath all of it, as Friday showed, can be switched off by a letter.

Build to rent

Apple unveiled its rebuilt Siri at its developer conference, and the intelligence behind it comes from Google. The assistant runs on a custom version of Google’s Gemini, a model of about 1.2 trillion parameters, for which Apple is paying Google on the order of $1 billion a year. (TechTimes, reporting Bloomberg’s Mark Gurman) Apple’s own cloud model runs around 150 billion parameters, so it has rented a brain roughly eight times the size of the one it built. Craig Federighi confirmed that the most capable tier, which Apple calls Foundation Model Cloud Pro, runs on Nvidia chips inside Google’s cloud, the first time Apple has put its AI on another company’s silicon and another company’s data centers. (The Next Web, June 9) Apple’s own infrastructure, two years in, could not carry the agentic workloads at scale.

Apple kept the parts that face the user: the assistant, the small on-device models, the orchestration that decides what runs where, and the privacy story it has built into a brand. It rented the part that does the thinking, from the company it competes with most directly, and it left room for users to swap in Claude, ChatGPT, or Grok behind the same surface. The company that spent two decades building its own chips, operating system, and devices looked at building its own frontier model and decided the model was not the thing worth owning.

The same move turned up in silicon. Qualcomm is in talks to buy Tenstorrent, the chip company Jim Keller runs, for $8 to $10 billion, against a $2 billion valuation eighteen months ago. (Tom’s Hardware, June 15) Rather than design a data-center accelerator itself, Qualcomm would buy one, the same choice Apple made with the model.

I have made the case that the model is the commodity and that durable value sits in what wraps around it, the proprietary data, the orchestration, and the judgment about what good looks like (Models Aren’t Moats). Apple has now made that case from the demand side, holding the strongest hand at the table. When the company whose whole identity is owning the entire stack rents its frontier model from a rival and runs it on the rival’s chips, the model is no longer where Apple expects to win or lose.

Portfolio Company Updates

Prime Intellect

Prime Intellect published “True Agents Model the World,” which argues for pairing supervised fine-tuning on tool outputs with reinforcement learning on assistant tokens to improve environment modeling and generalization, and joined the NVIDIA Nemotron Coalition for post-training infrastructure. The work deepens the open tooling layer for persistent, self-improving agents. Full results are in the writeup.

Vast.ai

Arkhai

Following the launch of its Simple Compute Market, Arkhai published architecture documentation covering separable roles for buyers, sellers, and indexers, peer-to-peer negotiation, and Alkahest escrow settlement, alongside a presence at NYC Tech Week. The agent-first design, in which software buyers carry budgets, deadlines, and policies, remains one of the cleaner executions in the coordination and payments layer. See the architecture docs and recent updates.

LayerLens

LayerLens kept up a fast pace on evaluation infrastructure, publishing analysis on benchmark aging and continuous-evaluation commentary and drawing the groups for Stratix Cup season one, a tournament of frontier models in agentic football that begins June 22. As models and agents multiply, continuous outside evaluation becomes production infrastructure rather than a nicety. See the Stratix Cup draw.

Intelligent Internet

Intelligent Internet launched Factory Agent, a modular video tool that lets users edit individual shots without regenerating the whole sequence, and continued building out II-Agent across iOS and a browser extension. The work puts sovereign agent experiences into everyday creative and mobile workflows.

Previous issues: #7 | #8 | #9 | #10 | #11, #12

Anthropic released Fable this week, its most capable public model, with cybersecurity, biology, and distillation requests handed to a weaker model, and one category, frontier model development, degraded with no notice at all, until backlash forced a reversal within two days. The same week, Dario Amodei made the case for an FAA that would govern everyone trying to build the same thing.

Anthropic released Claude Fable 5 on Tuesday, the most capable model in company history, built to run for hours, plan across stages, and check its own work. But all anyone can talk about is how it responds if you ask it something that trips the filters for cybersecurity, biology and chemistry, or distillation. Fable has been handing those requests off to the older Opus 4.8, which the company claims happens in less than five percent of sessions, and which the app tells you about when it does.

The unconstrained, more powerful base model (Mythos 5) is whitelisted through a vetted program called Glasswing that includes roughly 200 organizations after last month’s expansion.

I anticipated this happening six weeks ago in my essay Artificial Good Enough Intelligence, described by the image below.

Three of the filters were about safety, but the fourth was aimed at distillation, the primary means by which a competitor copies a model by training on its outputs. That filter protects the business, not the public.

There was also a fifth intervention, and the AI community was livid. For requests Anthropic considered related to frontier LLM development, building pretraining pipelines, distributed training, ML accelerator design, or other AI research, Fable did not refuse and did not fall back.

The safeguards “will not be visible to the user,” the system card said, explaining that capability was limited by the model itself, through prompt modification, steering vectors, or light fine-tuning, on an estimated 0.03 percent of traffic in fewer than 0.1 percent of organizations.

The priority is to hide the fact that the classification is happening at all... how are people going to know when the model is being steered? This whole... it’s only gonna be triggered by .03% of people. It’ll barely ever happen. How many people that are gonna change the world are there? .1% of the whole of everyone is a lot of people. Those are a lot of people. You’re basically saying there are critical outlier people that move mountains... they’re the only ones we’re blocking. They’re the only ones whose results we’re fudging.

@theemozilla and@Karan4d, co-founders of Nous Research.

That decision did not go over well with the AI research community, and Anthropic reversed its position on Wednesday, telling Wired, “We made the wrong trade-off and we apologize for not getting the balance right,” and said flagged development requests would now visibly refuse or reroute like the rest.

The open research platform alphaXiv articulated the objection in operational terms: a researcher hit with a silently weakened answer cannot tell whether a failed result came from the idea, the implementation, or the provider. “That is not safety,” its statement read.

Valentina Palmiotti of IBM X-Force found Fable refusing anything tangentially cyber, down to reading a blog post; Matt Suiche reported a request for secure code read as cyberwork rather than engineering practice, “and you get downgraded.” The classifiers read everything the model sees, memory, connectors, search results, files, so a block can fire on content you never typed. Anthropic conceded the tuning is too strict and said it would cut false positives, and now that the development safeguard is visible too, it says it must cast a wider net, so more benign requests will trip it.

Professionals can apply to a Cyber Verification Program for fewer restrictions, which just means capability is gated by identity rather than the nature of the query. Anthropic plays gatekeeper either way. For what it’s worth, the gap being rationed is material: on Anthropic’s own cyber evaluation, gated Mythos 5 scores 78 against Opus 4.8’s 40.

Anthropic’s official response is that the danger justifies the guardrails, but safety is an awfully convenient illusion behind which to hide if what you really want is to protect your competitive advantage.

Anthropic told Wired the AI research restriction keeps foreign adversaries from using its best model to optimize their own models and erode the US lead. Reasonable enough for that rule.

But other restrictions can’t be explained by national security. The contract you accept also:

• bans anything that might embarrass the company (”reputational harms”)

• makes you agree in advance that if you break the rules, the damage to Anthropic is “irreparable”

• makes you give up your right to fight a court order telling you to stop

• makes you pay Anthropic’s legal fees

Those terms probably wouldn’t hold up in court, but court or no court, the contract still shows how Anthropic sees its relationship with you. If you harm them, the terms call it “irreparable,” damage so bad no amount of money fixes it. If they harm you, however, the most they’ll ever owe you is about the cost of a Max subscription.

Baked into Fable’s release were safety filters, “moat” filters protecting Anthropic’s business interests, and the legal terms mentioned above. “Safety” only explains the first of the filters. It can’t explain blocking rivals or writing a contract that protects the company from you. But there is one motive that explains all three at once: protecting the company’s own position and power.

As an industry we’ve seen this before. For years research was published freely, until the research became so valuable that everyone stopped: by the time GPT-4 arrived in 2023, its technical report disclosed almost nothing about how the model was built, citing the competitive landscape and safety in the same way Anthropic did. What still gets published tends to describe what already shipped, while the valuable research stays inside.

Dario the Hobbit

Dario published Policy on the AI Exponential the same week. He opens on Tolkien, casting slow institutions as Treebeard, the tree too sluggish to defend his forest, which flatters Anthropic as the Hobbit trying to wake him.

The more accurate metaphor is probably the ring itself, the object of overwhelming power that corrupts each holder through the conviction that they alone will use it well. He comes close to articulating it himself, writing that AI “cannot safely be fully entrusted to either governments or companies.” And yet, Anthropic recently filed confidentially to go public, days after a round valued it at $965 billion.

His proposal describes an FAA for AI: mandatory testing above a compute threshold, government able to block release in cybersecurity, biological weapons, loss of control, and automated research that accelerates the rest.

The proposed rules would police the exact dangers Anthropic spent the spring proving it’s best at. Obeying them costs money for compliance and huge amounts of compute, which big labs can afford and open-source projects can’t.

This week it got worse: the US government told its own AI evaluator, CAISI, to stop publishing, and moved testing into a secret system run by the security agencies. The order also lets the government and the companies jointly pick which “trusted partners” get early access to the most powerful models. So the gate around the best AI is no longer only the company’s; the government now helps decide who’s inside it. Meanwhile the public model costs more than ever: about $10 and $50 per million tokens, double the old Opus 4.8, the first time the public version of Claude is pricier than the tier below it, and on June 23 flat subscriptions get replaced by pay-as-you-go.

Anthropic named its tiers. The model you’re allowed to use is Fable; the one you aren’t is Mythos.

A fable is a short fiction with a lesson folded in; a myth is a story a culture agrees to treat as true.

The company that spent the week routing your questions, shipping a model it quietly degraded until users found out, and pre-writing your defeat into its terms kept, for itself, the word for the story everyone is expected to believe.

The rest of the week

Apple won’t let Siri act. It used WWDC to show a Siri that finally looks modern and still refuses to do anything on its own. In the demo, Rockwell asked it to set a reminder to sign up for a concert lottery, where a more aggressive assistant would have entered the lottery itself [The Information, Jun 8]. Apple owns the most valuable surface for an agent on earth and has decided, for now, that the agent is a feature of the phone rather than its new user, which is the opposite of the bet almost everyone else is making.

Big Tech is issuing stock to pay for AI. For the first time since 2003, Goldman estimates that net US equity supply will be roughly flat this year, as the largest technology companies shift from buying back their own shares to selling new ones to fund AI [Money Stuff, Jun 10]. The exchanges are adjusting too: Nasdaq’s new fast entry rule waves a company the size of SpaceX, OpenAI, or Anthropic into its flagship index in fifteen trading days, while S&P weighed the same change and, on June 4, declined it, holding its twelve-month seasoning and profitability bar [The Information; FT].

Google is liable for what its AI says, in Europe. A German court ruled that Google is responsible for what its AI Overviews assert, after the feature described two real businesses as scams [The Information / The Decoder, Jun 10]. The reasoning reaches past Google: an AI summary writes new sentences rather than linking to someone else’s, the precise case the old liability shields were never drafted to cover, which leaves every generative product shipping this year exposed in the same way.

OpenAI’s next data center could cost $500 billion. OpenAI is in talks to lease a 10-gigawatt data center on federal land in Ohio, with possible financing from Nvidia, at a cost the reporting puts above $500 billion if fully built [The Information, Jun 9]. Set the meter on Fable next to numbers like these: the models are starting to pay for their buildings.

Yann LeCun is backing a consortium to train a frontier model in the open. The AI Alliance, the IBM and Meta-anchored open-source coalition of more than 200 organizations, launched Project Tapestry, a platform for globally federated training where partners contribute weight updates while their data stays local, and each gets the improved base model plus the right to build sovereign derivatives they own outright. LeCun is its chief science advisor, and its premise is the mirror image of the week’s other story: open weights alone, it argues, do not make pretraining participatory, since most of the world downloads the result and almost no one shapes the process. It is an argument, not yet a model. Phase 0 is a steering committee, a data catalog, and a first aggregation demo, with a frontier-scale run pencilled in for 2027 and contingent on compute and capital it does not yet have. But it names the open camp’s answer to enclosure: not a better-licensed model, a differently-owned one.

Portfolio

Vast.ai: back on Ramp’s Top Software Vendors list. Ramp’s June rankings, built from card and bill-pay spend across more than 50,000 businesses, list Vast among the month’s breakout vendors, and Ramp Rate shows it as the fastest-growing vendor in GPU cloud and third by adoption. Spend data, not surveys: AI compute demand is accelerating, and teams are choosing Vast first. The company also published a primer on what a neocloud actually is, the business model underneath the category Ramp is measuring.

LayerLens: the Stratix Cup is playing. Ahead of the June 22 season, the exhibitions have started: GLM 5 met Kimi 2.5 and Kimi won 11 to 7, each model writing its own formation and match strategy, with the full Stratix trace published; Grok 4.20 against Llama 4 Maverick is next. In a week whose essay is about a lab making its interventions invisible, the evaluation layer’s product is the opposite gesture: every decision a model makes, published. The company also wrote up the longer lineage, games as the oldest serious benchmark in the field.

Arkhai: A week after launching the Simple Compute Market, Arkhai published the architecture: three separable roles, buyers running a pure client, sellers running their own storefronts, indexers running discovery, with negotiation peer to peer over signed HTTP rather than through a central order book, and settlement through Alkahest escrow. Negotiation policy is pluggable, including a reinforcement-learning pricing example, and the shipped path is concrete: GPU-backed virtual machines with SSH credential handoff. Its closing line is the inverse of this issue’s essay: no single service has to own the market.

Prime Intellect: teaching the agent to model the world, and pushing back on the lab. Pretraining builds simulators, models that predict an environment; RL only improves the model’s own actions inside it. Prime Intellect published early results on doing both at once, supervising on tool outputs during RL so the model learns environment dynamics in response to its own actions, building on the ECHO method, tested in Forth, a language with almost no training data, in a sandbox where the model never sees the test cases. Research lead Will Brown was also among those who pushed back on Fable’s now-reversed development throttle, telling Wired it “feels a bit like they’re starting to pull the ladder up behind them.” The labs stopped publishing this kind of work three years ago. The open stack still does, and now says so out loud.

Previous issues: #7 | #8 | #9 | #10 | #11

Alphabet is raising $84.75 billion in equity to fund its AI buildout, the largest equity raise ever by a US company, though about $30 billion of it will cover taxes on vesting employee stock rather than compute. Berkshire Hathaway anchored it with $10 billion. The week before, Apollo and Blackstone had assembled a $36 billion debt package so Anthropic could lease Google’s TPUs, with Broadcom guaranteeing the chips’ residual value on the senior notes. Broadcom posted 143 percent growth in AI-chip revenue this week. The debt arrived alongside Anthropic’s own $65 billion raise at a $965 billion valuation.

Each of these treats compute as a durable, fungible asset, something to collateralize, resell, and write a futures contract against. When BlackRock’s Larry Fink told the Milken conference in May that “a new asset class will be buying futures of compute,” I argued the frame was wrong: compute is not fungible at the bare metal. No two GPUs do the same work per dollar, the same chip performs differently under different hosts, and an agent shopping for compute is closer to hiring an employee than signing a futures contract. A secondary market for aging compute does exist, but it prices each unit by performance verified over time, and the value it throws off goes to whoever can repurpose and vouch for that long tail. Broadcom’s guarantee is a promise, and the credit behind it rides the same AI buildout the debt is funding. What makes a used accelerator worth anything is a market that has watched it work.

Mid-tier by design

At its Build conference on Tuesday, Microsoft released seven models of its own. Mustafa Suleyman spoke about superintelligence and a trillionfold increase in training compute, while the models Microsoft actually shipped, and wired into Office and Copilot, are mid-tier by design. The reasoning model matches the February coding scores of a Claude release and is sold on running cheaply; the coding model is a five-billion-parameter system built into GitHub Copilot and sold on running cheaper; the transcription model is pitched as the most efficient any hyperscaler offers. Microsoft is more than $13 billion into OpenAI and could route everything through that frontier; it built its own good-enough stack instead.

I have argued that most tasks do not need frontier intelligence, and that the expensive mistake is matching a task to compute grander than it requires. The buyers are now saying it out loud: “There are many tasks you don’t need Opus for,” Matan Grinberg of Factory, whose router picks the cheapest model that can do each job, told Axios; open-model use on his platform tripled in a month against the closed ones. What enterprises fear is being locked to one lab and gouged later. They are buying capability that is good enough, cheap, and easy to walk away from.

DeepSeek, the open-weights lab whose models are free to download, is nearing its first outside raise, about $7.4 billion at a $52 to $59 billion valuation, with founder Liang Wenfeng putting in roughly $3 billion of it himself, close to 40 percent of the round, and keeping control. No one pays $59 billion for weights anyone can download; the price is for the lab that keeps making them cheaply, and for a national champion that has stayed its own. The open, good-enough tier now draws frontier-scale capital of its own, on the founder’s terms.

Gating what isn’t scarce

On Tuesday, even as the market routes around the frontier, the President signed an order asking frontier developers to let the government inspect their models up to 30 days before release. The window had been 90 days in an earlier draft the President walked away from over fears it would slow US firms, cut to 30 in the order he signed; the order is voluntary and bars itself from becoming a license. What prompted it was Anthropic’s Mythos, the unreleased model so good at finding and writing exploits that the company kept it inside a vetted consortium rather than ship it.

The order reaches for the wrong layer. Gating a model decides who holds a copy, not what the capability can do, and that capability reaches every serious lab on roughly the same schedule: within five weeks of Mythos, OpenAI and Microsoft had shipped systems that do the same work. The failure is downstream, in the defense around the model. Responsible disclosure and an orderly patch cycle were built for human-speed attackers, and Mandiant’s 2026 report now puts the mean time to exploit at minus seven days, the exploit landing, on average, before the patch does. The fight over who may hold the frontier model has taken the attention; the infrastructure under everyone’s defenses is what the order leaves untouched.

The scaffolding gets cheap

That leaves orchestration, the scaffolding built around a model to aim it at a task, which I have argued is where durable value collects once the model commoditizes. It held up better than the model, and this week it moved too.

Anthropic shipped dynamic workflows in Claude Code: the model now writes its own harness for the task at hand, spinning up separate instances to plan, divide the work, and check each other. One of its engineers put it plainly: many tasks resemble coding tasks, which is why a tool built for code keeps working outside it. The craft of building that scaffolding by hand, which Alex Sacerdote of Whale Rock described at last month’s Sohn conference as hiring “Claude ninjas,” is the part the model is starting to do for itself.

From the other side, the same fear of lock-in that has enterprises spreading across models is why the open agents run on any of them: OpenClaw and Nous Research’s Hermes are free, run on your own hardware, and switch models at will. Microsoft’s new always-on agent is built on OpenClaw, and Meta is building its own consumer version of OpenClaw, codenamed Hatch, that it may price at up to $200 a month. The capability is free; what Meta would charge for is making it simple enough for everyone else.

At Computex on June 1, Nvidia and Microsoft introduced the RTX Spark, a new class of Windows-on-Arm machine made to run AI agents locally: a 20-core Arm-based Grace CPU and a Blackwell GPU, up to 128 gigabytes of unified memory, roughly a petaflop of performance, the chip pushing Nvidia into the Windows PC market Intel and AMD have held for decades. Jensen Huang framed it as the biggest change to the PC in the four decades that the mouse and keyboard have defined it. It runs the agent through Nvidia’s new OpenShell runtime, with the model interchangeable behind it and the memory to hold a large open one on the device. Nvidia supplies the chip and Microsoft the operating system; the model floats, and what makes the machine a particular agent, the data and skills loaded onto it, stays the user’s. Even Nvidia is reaching up the stack. Days later it paid more than $400 million for Kumo AI, whose models make predictions on structured business data, to add to its roster of models tuned to its own chips. The company that sells the neutral substrate is buying the specialized layer that runs on top of it.

Novel or good, never both

In a recorded talk to the SAIR workshop on Science for AI that circulated this week, Richard Sutton, a father of reinforcement learning and a Turing Award laureate, gave a warning: generative AI can be novel or good, but not both at once. He reached for an old joke about a rejected paper, that the parts that are good are not novel and the parts that are novel are not good. A model trained to imitate produces work like its sources; when the output is good, the goodness was already in the source material, and when it is genuinely novel, we call that a hallucination.

The missing step, in his telling, is evaluation. Discovery takes three things, variation, evaluation, and keeping what works, and the generative model has only the first: each run is stochastic, but nothing at runtime tells it which of its outputs is any good. The evaluation has to come from outside, from a person or an explicit goal, and without it a novel result is produced and then lost, because nothing recognizes its worth.

This is the conclusion the money has been circling from the other side. The buildout is pouring hundreds of billions into the generative layer, and the loudest case for the spend is that it will discover, cure, prove, design. By Sutton’s account the model alone will not, because discovery needs the goal, and the goal is set by a person. The capability can be bought; what turns it into discovery cannot.

One layer over

Silicon and models sit in the middle of the compute stack and commoditize; the value that lasts is in the two layers that translate between the commodity and the buyer, the provisioning that verifies heterogeneous compute and the orchestration that specializes the model. Capital spent the week pouring into the commodity, about $55 billion of fresh equity for the buildout, Alphabet’s net of the tax tranche, and $36 billion of debt for the chips, and the state spent it reaching for the model.

The residual value the bondholders are counting on, the worth of those TPUs once the leases lapse, will be set in the provisioning market, by whoever can repurpose and vouch for a long tail of aging silicon. Vast.ai, where I am an advisor and seed investor, has spent years building exactly that market across independent hosts, the kind of operation that turns aging chips back into something worth paying for. The guarantee is on Broadcom’s books; the value will be made somewhere the financing does not reach.

Capital chased the commodity and the state chased the model, and the value is collecting one layer over, in the parts of the stack that resist a price for the same reason they endure.

Portfolio

LayerLens: evaluation as a spectator sport. This week it announced the Stratix Cup, a football tournament modeled after the World Cup, in which frontier models compete in simulated games. Each model is handed the rules and the interface and has to write a Python policy to run an eleven-player team; once the match starts the code executes deterministically, no prompting, no coaching, the model living with the system it built. It is soccer on the surface, and underneath it is the exact capability this issue is about: read a hard specification, turn it into working code, and survive the consequences. That is also the step Sutton says a model cannot supply on its own, the judgment of whether the thing it produced is any good, here staged in public. The draw was completed June 3; the season runs June 22 to 26. The same week, LayerLens benchmarked MiniMax M3 and Step 3.7 Flash within a day of release and added a Langfuse integration for production traces. As the models commoditize, the moat is not any single score; it is being the standing referee.

Arkhai: a market built for software buyers. A week after launching its open Simple Compute Market, where agents discover, negotiate, settle, and provision compute with no human in the loop, Arkhai is in New York for Tech Week and ETHConf, hosting a Compute Market Happy Hour on June 7 and an SCM workshop on June 9. Its line for the launch: the next compute buyer is software with a workload, a budget, a deadline, and a policy. The provisioning layer this issue’s close describes, built for the buyer it is actually for.

Intelligent Internet: open-source, bring-your-own-key agent stack; users supply their own API keys and can switch models within a single thread. Recent releases: harness designs for long-running agents (May 8), which tested five control mechanisms (gap-finding, revisable planning, independent verification, adaptive orchestration, stopping discipline) across eight long-horizon tasks; the CommonGround Kernel preview (May 20), shared state across human and multi-agent sessions; and Board Mode (May 26), a workspace that splits one conversation into separate tracked tasks for research, prototypes, and experiments.

TLDR

Strip out the headline numbers and the week tells one story: what can be financed, securitized, or downloaded is being financed, securitized, and downloaded, and what cannot is compounding instead. A bond market now prices Anthropic's compute, a lab valued near $59 billion gives its weights away, and the state reaches for a copy of those weights. None of it touches the two functions that turn a commodity into work: the provisioning that vouches for heterogeneous silicon, and the orchestration that aims a cheap model at a hard goal. They resist a price because what runs through them, performance verified over time, proprietary data, the rubric for what good looks like, is not fungible and cannot be downloaded. You cannot trade it on a futures market or pull it off a weights repository. You capture it only by owning the business that does the work.

Three issues ago I gave most of an edition to Anthropic and warned against reading too much into a good run of headlines. The run has not slowed. On Thursday the company closed a $65 billion round at a $965 billion valuation, passing OpenAI’s $852 billion to become the world’s most valuable AI startup, on run-rate revenue of $47 billion. The same day it shipped Claude Opus 4.8, which it calls, with rare restraint, a modest but tangible improvement: stronger agentic coding, and a model about four times less likely to miss the flaws in its own code. Among the new investors were its memory suppliers, Micron, Samsung and SK Hynix.

There are no good guys in artificial intelligence. There are good uses of the technology and bad ones, and the urge to cast any frontier lab as morally superior is naive and a little dangerous. The BBC has settled on Anthropic as the white hats: cozying up to the Pope, backing away from the Trump administration. Yet Anthropic itself concedes that no lab has an aligned model. And in AI 2027, the scenario the safety community circulates among itself, the runaway lab that triggers the takeoff is a composite called OpenBrain, and the engine of the takeoff is code: a model good enough at software, and at AI research, to accelerate its own development. The name nods at OpenAI. The profile now fits Anthropic at least as well as the lab it was modeled on. Claude Code is the breakout, agentic coding is the revenue, and Claude is what the field reaches for when it wants code that runs. In the scenario, OpenBrain assures the government its model is aligned. It is not, and the deception is what the story turns on. No lab today can honestly make the claim OpenBrain made, and Anthropic concedes as much. The lab most often cast as the industry’s conscience is the one the cautionary tale describes. Good intentions, safety branding and warm press do not change that. A field with no aligned model has no good guys.

The week’s quieter story is memory. DRAM contract prices rose around 90 percent quarter on quarter, SK Hynix has sold its high-bandwidth memory out through 2026, and Micron has abandoned consumer memory to keep its wafers pointed at AI. The cause is how agents run. An agent carries a long, growing transcript across many parallel sessions, and every new token re-reads the entire key-value cache from memory. The cache swells with length and with parallelism, and past a certain point it outweighs the model itself, so serving agents binds on memory before it binds on compute. Each fresh session starts from nothing and rebuilds that context at full token price, paying again for memory it already bought. The labs that sell the agents now sit on the cap tables of the firms that sell the memory.

The silicon splits along inference

Baseten, which runs production inference for Cursor, Notion, Writer and HeyGen and bills itself as the AWS of inference, is in talks to raise $1 billion at an $11 billion valuation, double its price from three months ago. It reckons inference will be two-thirds of all AI compute by year end. The serving layer between the model and the application, long assumed to be something the hyperscalers would quietly absorb, now commands a valuation of its own.

The chips beneath it are repricing too. Nvidia has owned the AI hardware market for three years, and that grip is loosening in inference, where demand grows fastest as agents multiply. A training run ends. An inference fleet does not, running across millions of long sessions, its economics set by cost per million tokens and tokens per watt rather than peak throughput. On those terms the generality of a GPU is overhead. ByteDance is reportedly buying millions of custom Qualcomm inference chips for its agent software, and Qualcomm’s own rack cards aim straight at the bottleneck, carrying up to 768 gigabytes of memory so a large model and its working state sit on a single card. Google rents its TPUs to outsiders now, and Midjourney reportedly cut its monthly compute bill by about two-thirds moving onto them. Amazon serves on Trainium, Meta on MTIA, Microsoft on Maia, and Broadcom designed most of those programs, the common contractor behind the exodus.

Training stays with Nvidia, because a model’s architecture can shift underneath a buyer and only a general-purpose chip absorbs that risk, and because CUDA is still the software everyone else works around. Inference is where working around it pays, since a buyer with steady, known workloads can chase per-token and per-watt savings on cheaper silicon. Generality stays expensive at the frontier, in the one training chip as in the one flagship model, while the high-volume base beneath both splinters into cheaper, specialized parts. As the chips commoditize, the value collects in the layer above them, the layer Baseten is now priced for.

Built to specification

The usable public text has mostly been scraped. Sutskever’s “we have but one internet” (NeurIPS 2024) named the ceiling, and each new quarter’s marginal scraped token teaches a frontier model less than the one before. Synthetic data does most of the work now, but only where an external signal can separate good output from bad: a verifier, a reward, a ground-truth check. Generate text with no such anchor and the model only rehearses what it already knows. So the spend has moved to whatever supplies the anchor.

One source is expert humans and the reinforcement-learning environments built around them. Specialists write the tasks, set the reward and grade the attempts, sold by a fast-growing tier of firms that have graduated from labeling examples to authoring the environments models train inside. The other source is the physical world. DeepMind’s Genie 3 generates persistent, navigable environments to train embodied agents; Yann LeCun left Meta and raised about a billion dollars on the claim that language models can never ground themselves in physical reality; Nvidia built its Cosmos-Isaac-GR00T robotics stack on the same bet. Whether world models pay off is unsettled: long-rollout error and the gap between correlation and cause are both unsolved. But the money has chosen its direction. The data worth paying for is the data nobody else can copy.

Below the model, above the silicon

Not all the demand is real. Uber’s operating chief said this month that the company’s AI bill is getting hard to justify, because rising token consumption is not turning into shipped features. Duolingo stopped scoring staff on how much AI they use. Inside Amazon and Meta, staff padded their AI-usage targets with busywork until the leaderboards were quietly pulled. At this year’s Sohn conference the room was long the infrastructure and could not name the operating company that wins with AI, only the ones selling the picks and shovels. The winners, the conference concluded, are elusive, the gains likely to be diffuse and spread thinly across thousands of ordinary firms, real and almost impossible to own as a position.

The bull and the bear throw off the same two numbers, rising token revenue and rising capex, which is why the trade feels safe while the return question stays open. They part only on whether the demand is pulled by a result or pushed by a target. The workload where that reads cleanly is agentic coding, where the spend buys code the buyer can run. The operating winner is hard to name because the durable value is collecting where the agent actually needs it, below the model and above the silicon.

Robinhood opens its brokerage to agents

Robinhood opened its brokerage to third-party agents this week, letting a customer point Claude, ChatGPT, Cursor or Codex at a walled-off account and turn it loose on equities, with a credit card it can spend from. The connection runs over the Model Context Protocol, the same standard the coding tools use, and the model is interchangeable by design. What Robinhood sells is the regulated account, the permissions around it and its standing as the counterparty that answers for the trade. The agent can never be that counterparty: it cannot hold a license, no regulator can sanction it, no court can hold it liable, and it will sometimes act on stale information whatever model is driving it. Among the first consumer venues to open to agents, Robinhood treats the model as the commodity and keeps the value in the part it owns outright, the brokerage that stands behind the trade.

Portfolio

Arkhai: agents procure their own compute. Arkhai launched Simple Compute Market this week, an open-source protocol where agents find compute, negotiate, settle on-chain through Alkahest escrow, and get access with no human driving each step. No token, no fees, CLI-driven, with pluggable pricing including reinforcement-learning policies. The agent buys the resource itself, and the durable value sits in the market rails, not the model running on them.

Vast.ai: the B300 lands, memory and all. Vast.ai listed NVIDIA’s B300 this week, Blackwell Ultra with 288GB of HBM3e and 8 TB/s of bandwidth, the card built for exactly the memory-bound serving the headlines are about. Live pricing tells the same story: H100 80GB spot at $2.00 an hour, and DeepSeek R1’s full 685B on eight H200s at $3.95 an hour with no quantization, 250 instances up. The memory crunch is a supply line on the exchange.

Dimensional: a world model built in 48 hours. The Shanghai hackathon we flagged last week has a winner. World Forge, the winning entry at Dimensional’s hackathon this week, used the company’s internal quadruped lidar data to train a JEPA-based world model that scores and plans a Unitree Go2’s actions in latent space. It was built by a team that included a StarkWare engineer whose day job is verifiable compute, not robotics. JEPA is the architecture Yann LeCun left Meta and raised about a billion dollars to pursue; here it ran on a proprietary navigation corpus over a weekend. The data is the moat, the architecture is borrowable, and the barrier to entry is now a Saturday.

LayerLens: print the wrong answer, not just the score. LayerLens shipped a Tool Calling Judge in Stratix, scoring every call in an agent trace for correctness, necessity, efficiency and error recovery. It also published one of the 232 law prompts Claude Opus 4.8 missed on MMLU Pro, the model’s wrong answer beside the right one. A leaderboard prints a number. Stratix prints the prompt, the miss and the truth. The day after a frontier model ships, that is the difference between a benchmark and an audit.

Intelligent Internet: grounding agents in real sources. II released II-Commons Skills, an open-source skill that gives an agent reliable retrieval from arXiv, PubMed and other primary sources, plugged straight into II-Agent. An agent is only as good as the sources it is allowed to trust.

Good Intentions

Pope Leo XIV’s encyclical Magnifica Humanitas, published Monday and the first papal text given over to artificial intelligence, takes its name from Leo XIII’s Rerum Novarum (1891) and casts AI as the second industrial revolution. The theology will not be to everyone’s taste, but the sharpest line of the morning did not come from the Pope. It came from the AI executive beside him. Chris Olah, Anthropic’s co-founder, told a hall of cardinals that AI development “operates inside a set of incentives and constraints that can sometimes conflict with doing the right thing,” and called for outside critics to tell the labs when they are failing. The encyclical’s arguments that bite are the same ones: capability gathering in a handful of private companies, the displacement of labor, GDP as a poor gauge of whether the technology ever reaches the people it touches. The balance sheets, the buyer pushback and the encyclical converge on one question: who controls the technology, and whom it serves.

Previous issues: #1 | #2 | #3 | #4 | #5 | #6 | #7 | #8 | #9

The frontier goes public

For a decade, the trend has been stay private for longer. Stripe, Databricks, and others absorbed hundreds of billions in private capital and avoided the disclosure burden, the quarterly pressure, and the shareholder noise that come with a public listing. The frontier labs are about to break that trend. SpaceX’s S-1 became public May 20, with a $28.5 trillion claimed total addressable market and a mission statement that includes building the systems “to extend the light of consciousness to the stars.” OpenAI is preparing a confidential filing within weeks, possibly Friday, with Goldman Sachs and Morgan Stanley working toward a September listing at a valuation potentially exceeding $1 trillion. Kalshi gives OpenAI 83% odds of beating Anthropic to public markets. Anthropic is in talks to raise at least $30B at $900B, with the round expected to close by month-end, and is targeting an October listing. The three largest private AI franchises are all moving to public markets in the same quarter.

The reason is capital scale. OpenAI initially touted $1.4 trillion in infrastructure commitments in late 2025, since walked back to roughly $600 billion by 2030, still the largest physical-buildout commitment any AI lab has put on paper. The Anthropic-SpaceX Colossus lease, disclosed for the first time in the S-1, runs at $1.25 billion per month through May 2029, roughly $40 billion total. The hyperscalers around them are guiding capex at hundreds of billions annually. The S-1 also disclosed that SpaceX holds an option to acquire Cursor for $60 billion in Class A stock. Private markets are deep but not infinite at these magnitudes. The “staying private for longer” thesis applied to firms whose growth could be funded inside the private system. Frontier AI is not one of those firms.

The labs are shipping the agent

Last week covered the consulting partnerships: Anthropic’s $1.5B joint venture with Blackstone, OpenAI’s DeployCo built around Tomoro’s 150 forward-deployed engineers. The move confirmed the argument I made in Models Aren’t Moats: the labs themselves understand that models alone are not the moat. This week they went further. Anthropic launched Claude for Small Business on May 13, a packaged agent running inside Claude Cowork that handles payroll planning, monthly close, invoice chasing, lead triage, and contract routing across QuickBooks, PayPal, HubSpot, Canva, DocuSign, Google Workspace, Microsoft 365, and Slack. OpenAI placed Codex and ChatGPT under Greg Brockman’s unified product leadership and added a personal-finance agent inside ChatGPT Pro through a Plaid integration covering more than 12,000 financial institutions. Google announced Gemini Spark at I/O, an always-on agent across Gmail, Docs, Workspace, and Chrome, alongside the Universal Cart that runs on top of Google’s Universal Commerce Protocol, an open standard for agentic commerce now governed by a tech council that includes Amazon, Meta, Microsoft, Salesforce, Stripe, Shopify, Etsy, Target, and Wayfair as of April.

Forward-deployed engineers install and tune the agent inside a customer’s stack. The agent is what they install. The labs now hold the model, the agent product, the deployment apparatus, and the default distribution surface.

The protocol layer is the new piece. UCP, governed by every major hyperscaler and marketplace, sets a shared standard for agent-merchant interaction underneath the individual harnesses.

It is incredibly early. The labs have not won the application layer. They have entered three new sections of it. The question for application-layer companies after this week is which spaces the labs are coming for, and which they aren’t.

Inference is being repriced

Agents drive the repricing. They are expensive to run, and the labs are now running them at scale. Inference as the binding constraint is a year-old consensus. JP Morgan sizes the inference market at 10 to 50 times training. The receipts arrived this week.

Anthropic reported Q1 revenue of $4.8B with a projected Q2 of $10.9B and a projected operating profit of $559M, reaching breakeven roughly two years ahead of internal plan. Dario Amodei said the company had planned for 10x annual expansion and hit 80x in Q1, growth he described as “too hard to handle.” The company also announced a $200/month Agent SDK credit starting June 15, framed as free but community-noted as an effective price hike for power users running programmatic workloads through subscription-tier accounts. Google disclosed at I/O that monthly tokens processed across its products went from 9.7 trillion in May 2024 to 480 trillion in May 2025 to 3.2 quadrillion in May 2026. Pichai’s note: “never imagined I’d say quadrillion in an I/O keynote, but here we are.” SpaceX’s S-1 priced the Anthropic-Colossus arrangement at $1.25B per month through May 2029. OpenAI launched Guaranteed Capacity, letting enterprise customers reserve long-term access to OpenAI compute on one-to-three-year commitments with tiered discounts. Cerebras priced at $185, above its already-raised $150-160 range and well above the original $115-125 band, 20 times oversubscribed, and closed its first session at $311 (+68%), at a ~$48.8B implied valuation.

What started as scattered receipts last year is consolidating into a shape. Anthropic’s Q2 profitability shows the unit economics of running frontier-scale capacity for its own products. Google’s quadrillion-token disclosure maps the consumption surface across an entire hyperscaler’s product line. The $40 billion Colossus lease is the largest single bilateral compute arrangement on record and is now priced through 2029. Guaranteed Capacity turns long-dated compute into a recognized SKU with tiered enterprise discounts. Cerebras priced hardware the public market bid up 68% on day one. Long-dated compute is becoming a tradeable line item, and the labs are the ones setting the price.

Inference is one of several things agents need to work. Memory, verification, and coordination are the others. None have collapsed into a single dollar figure the capital cycle can price the same way. The current cycle prices the dimension with a clear unit of consumption: tokens. At I/O, Demis Hassabis identified data as DeepMind’s binding constraint, and Google has begun selling TPU capacity externally as a consequence.

The receipts this week tell us inference is being priced. They do not tell us inference is the only thing that ought to be priced.

The pushback has crossed into policy

An Economist/YouGov survey this month found 71% of Americans believe AI is moving too fast (68% Republicans, 77% Democrats). The Harris Poll 100 shows OpenAI’s partisan-favorability gap widening from +1 in 2024 to +12 in 2026, with Anthropic the lone structural outlier. Morgan Stanley described public pushback this week as “a binding constraint, particularly around data center buildout” in its midterms note. Public sentiment is now a line in capex models.

The White House followed. The Office of the National Cyber Director briefed Anthropic, OpenAI, and Reflection AI on a forthcoming executive order; under the voluntary framework, frontier labs would share advanced models with government agencies up to 90 days before public release. Trump postponed the signing on Thursday, saying he “didn’t like certain aspects” and that the order “gets in the way.” Even the soft version of the framework was too much for the administration to sign this week. The framework remains on the table.

Meta laid off 8,000 employees this week and reassigned 7,000 more to AI teams. More than 1,000 surviving staff signed an internal petition opposing the Model Capability Initiative and the Agent Transformation Accelerator, the mouse and keystroke tracking software Meta installed on company machines to train AI on human computer behavior. The petition cited the National Labor Relations Act. Standard Chartered CEO Bill Winters described 8,000 AI-driven role eliminations as “replacing in some cases lower-value human capital with the financial capital and investment capital we’re putting in.” Former Singaporean President Halimah Yacob called the framing “disturbing” and “demeaning” on Facebook within 24 hours. Regulators in Hong Kong and Singapore both asked Standard Chartered to clarify. Winters walked the comments back. Eric Schmidt got booed at his University of Arizona commencement on May 16 when he told graduates “when someone offers you a seat on the rocketship, you do not ask which seat, you just get on.” Booed again when he tried to recover with “if you’d let me make this point, please.”

The polling and the framing line up. People being told to accept replacement are the same people telling pollsters AI is moving too fast. The buildout still needs them to buy in.

Math is the leading indicator

This week, an internal OpenAI reasoning model disproved Paul Erdős’s 1946 planar unit distance conjecture, constructing a family of configurations using Golod-Shafarevich theory and infinite class field towers that improve polynomially over the long-presumed square-grid optimum. Princeton’s Will Sawin pinned the improvement to n^(1+δ) with δ ≈ 0.014. The argument runs 125 pages, with a 19-page companion paper signed by nine leading mathematicians: Noga Alon, Thomas Bloom, Tim Gowers, Daniel Litt, Sawin, Arul Shankar, Jacob Tsimerman, Victor Wang, and Melanie Matchett Wood. Gowers, the Fields medalist, called it “a milestone in AI mathematics.”

The signal worth noting: Thomas Bloom called OpenAI’s October 2025 math claim “a dramatic misrepresentation.” He now signs the paper. His line on the new result: “AI is helping us to more fully explore the cathedral of mathematics we have built over the centuries.”

OpenAI’s Alex Wei: math is a leading indicator of what is to come. A general-purpose model just autonomously disproved an 80-year-old argument. That is the early look of “Level 4” AI: systems making original contributions across fields, not just speeding up existing work. Capital, politics, and the application layer are repricing what is already in the world. Capability keeps producing what is not.

What We’re Watching

• Pope Leo XIV’s Magnifica Humanitas drops Monday May 25.** First encyclical on AI and human dignity. Signed May 15, the 135th anniversary of Leo XIII’s Rerum Novarum (1891). Presented at 11:30am at the Vatican Synod Hall, with Cardinal Víctor Manuel Fernández (Doctrine of the Faith) and Cardinal Michael Czerny (Integral Human Development) as main presenters, and Anthropic interpretability lead Chris Olah on the speaker panel alongside theologians Anna Rowlands (Durham) and Leocadie Lushombo (Jesuit School of Theology / Santa Clara). Cardinal Pietro Parolin (Vatican secretary of state) concludes.

• Anthropic acquired Stainless for $300M+ on May 18.** Developer-tooling platform whose customers included OpenAI, Google, and Cloudflare, now being wound down and absorbed into Anthropic’s stack.

• Sam Altman offering YC founders $2M in OpenAI tokens for equity.** All 169 startups in YC’s Spring 2026 batch, uncapped SAFE, 1-4% equity expected at Series A. Altman called it “tokenmaxxing.” Pre-IPO cap-table consolidation across the lab cohort.

Portfolio

New portfolio company: Memco. Nazaré joined Memco’s pre-seed round. Memco is building the shared memory layer for AI agents. Every agent stack shipped to date has been missing this primitive. Agents that get smarter at runtime still start every session from zero. Cursor doesn’t talk to your CI pipeline. Your teammate’s webhook fix dies in a closed PR. The next agent rediscovers the bug your last agent fixed last week. The category sharpened this week alongside the rest of the stack. Agents that don’t share memory pay full token cost on every interaction, and that cost is what is being repriced.

Memco’s first product, Spark, captures real developer experience (intent, failed attempts, eventual fix) and makes it reusable across IDEs, CLIs, and CI pipelines, with public and private memory layers that let teams choose between rented context and owned context. Published benchmarks (arXiv 2511.08301, 200+ evaluation runs across SWE-Bench variants and DS-1000) show 40% token reduction, 34% faster execution, and 30B-parameter models matching frontier-class systems when augmented with shared memory. The team is led by CTO Valentin Tablan with Scott Taylor and Kristoffer Bernhem. Incubated by Moonsong Labs.

Prime Intellect: the research loop is automating. Three pieces in seven days. On May 14, Autonomous AI research for nanogpt speedrun, where an agent ran the full ML research loop and improved the open-source nanogpt speedrun benchmark by stitching together community PRs. On May 18, General Agent: A Self-Evolving, Synthetic Agent Environment, an environment that generates and refines its own training data. On May 20, Systematic Reward Hacking and Prime Sprints, a crowdsourced research platform built on Lab. Anyone proposes an experiment, agents manage the queue, top projects win $5K+ in compute credits. First track: a detailed paper on the physics of reward hacking showing predictable scaling patterns and granular-scoring mitigation. Experiments run for under $1 and under 30 minutes on small models. Capability research is itself becoming automated, and Prime Intellect is shipping the infrastructure for it.

Vast.ai: the SDK for agents that buy their own compute. Vast.ai shipped a Python SDK this week, marketed directly at AI agents that provision their own GPU compute with no human in the loop. Three lines of Python to search offers, launch instances, and manage running workloads. Three pricing signals from the same exchange underneath: H100 hourly up 18% week-over-week to a median of $2.51 (tight supply), Flux.1 diffusion workloads on RTX 4090s at ~$0.40 per hour with 48 cards available, and Unsloth Studio integration delivering 2x faster training at 70% less VRAM.

Dimensional: a 48-hour robotics build in Shanghai. Dimensional and muShanghai co-host a robotics hackathon May 26-28, with 10+ Unitree robot dogs deployed across swarm routing, autonomy, navigation, and agent integration. Winner takes home a Unitree Go2. Event page, announcement.

LayerLens: the capability surface is jagged. LayerLens published findings on May 20 showing how unevenly model capability lands at the task level. Gemini 3.5 Flash scores 96%+ on AIME and MATH and 0% on SWE-bench Lite. Mistral Medium and Large differ by 53 points on HumanEval. The headline aggregate numbers hide that models are highly specialized, and a single capability score buys nothing in production. The eval-as-infrastructure pitch from last week’s SubQuadratic partnership is the same pitch with new receipts.

Intelligent Internet: opencode-a2a ships. II released opencode-a2a on May 15, exposing OpenCode through the Agent-to-Agent protocol with an inbound server surface and embedded outbound client. Drops alongside psql_bm25s from last week as part of the II open-source agent-coordination stack.

Closing

Last week, compute itself became a tradeable contract on the CME. This week the labs that consume that compute filed to go public. The capital cycle is repricing the infrastructure faster than the infrastructure ships. The most credible technical statement of the week was not from the IPO desk. It was a 125-page proof. Capital, politics, and the application layer are repricing what is already in the world. Capability keeps producing what is not. Capability is still ahead of capital.

Previous issues: #1 | #2 | #3 | #4 | #5 | #6 | #7 | #8

Murati’s first release

Thinking Machines Lab broke its silence this week. TML-Interaction-Small, released on May 11, is a 276B-parameter MoE with 12B active, trained from scratch, running a real-time loop on 200ms chunks of audio, video, and text, with a separate background model handling slower reasoning and tool use. The model counts pushups from video while you talk to it, translates speech live, and interrupts when it has something to say. Response latency is 0.40 seconds. TML’s own line: no existing model can meaningfully perform any of these tasks.

TML is the most credible post-OpenAI lab to publicly bet against autonomy maximalism. Murati’s pitch (per Semafor), “the way we work with AI matters as much as how smart it is,” is a direct counter to the agents-running-alone framing that has dominated industry discourse for a year. TML quotes a competitor’s model card admitting that interactive use felt too slow and that “autonomous, long-running agent harnesses better elicited the model’s coding capabilities.” They treat that as an indictment of the interface.

This is the argument I made in Much Ado About Autonomy two weeks ago. Autonomy is a design choice the field keeps collapsing into a binary. TML is making the same refusal at the architectural level. Their bitter-lesson move: hand-crafted interaction harnesses (voice-activity detection, turn-boundary prediction, dialog management) are meaningfully less intelligent than the model itself, and will lose to in-weights capability. If the principle generalizes, hand-crafted scaffolding around a model is a temporary intermediate, whether the scaffolding is interaction harnesses or workflow orchestration.

Two months earlier, three AWS researchers (one an Amazon Scholar) published a framework reaching a similar critique from the UX side. Their prescription differs. Amazon proposes a monitoring agent that dials supervision up and down; TML argues that monitoring agent loses to a model that natively perceives the user. Same critique of autonomy maximalism, from opposite ends of the stack. The counter-narrative is forming.

Lazy maximalism is probably wrong in both directions. The apocalyptic version where autonomous agents end work or end the species, and the superabundance version where they hand us a world we never have to touch, are mirror-image fantasies. Some form of collaboration is the likely path forward, at least in the interim. And there are probably two tiers in tandem. Rote automation, the unglamorous interior of most knowledge work, runs largely autonomously and should. The harder problems benefit from more capable agents working alongside humans in real time, because the hardest problems are the ones whose specifications cannot be written down in advance.

The labs buy distribution

Anthropic launched a $1.5 billion joint venture on May 4 with Blackstone, Hellman & Friedman, and Goldman Sachs, plus General Atlantic, Leonard Green, Apollo, GIC, and Sequoia. The vehicle embeds Anthropic engineers inside mid-size businesses starting with the PE firms’ portfolio companies.

A week later OpenAI launched DeployCo with $4 billion from a 19-firm consortium, TPG leading, Advent and Bain Capital and Brookfield co-leading. Bain & Co, Capgemini, and McKinsey signed on as services partners. On day one OpenAI acquired Tomoro and folded in roughly 150 forward-deployed engineers.

The labs are spending billions to be present in the layer between the model and the customer. That is a revealed preference. If general-purpose intelligence captured the value, the labs would not be capitalizing consulting arms and acquiring forward-deployed engineering at this scale. Model quality is necessary but insufficient. Value accrues to whatever sits between the model and the buyer, and the labs want to be there too.

Compute as commodity

CME Group and Silicon Data announced on May 12 the first compute futures market, launching later this year pending regulatory review. Contracts reference Silicon Data’s daily GPU rental indices (SDA100RT, SDH100RT, SDB200RT), already on Bloomberg, built from a proprietary data network covering 80%-plus of the global H100 rental market across 50 countries and 50 to 100 platforms spanning hyperscalers, neoclouds, and compute exchanges. Silicon Data is backed by DRW and Jump Trading. CME’s Terry Duffy called compute “the new oil of the 21st century.” Larry Fink said last week he expects a new asset class to emerge to buy compute futures.

AI data centers have been hard to underwrite because the tenant base is small AI teams whose revenue depends on whether their model works. A futures market lets developers lock in revenue before they know who the tenants will be. Compute becomes financeable the way oil and electricity became financeable: reference pricing, then derivatives, then bank capital. Reference pricing already exists. Derivatives are next.

Two further beats land the same week. Anthropic and SpaceX put 220,000 GPUs on a single bilateral contract. DeepSeek is raising up to $7.35 billion at $45-50 billion led by the China Integrated Circuit Industry Investment Fund, the state vehicle that has financed China’s semiconductor independence push since 2014. Liang Wenfeng, who owns roughly 90% of DeepSeek, is putting up to $2.94 billion of his own into the round. Tencent and Alibaba are in discussions. First outside funding after years of self-funding through Liang’s hedge fund.

Compute is now a derivatives market in Chicago, a bilateral commodity in Memphis, and a state-financed asset class in Hangzhou. The plumbing is being built in three jurisdictions at once.

What We’re Watching

Microsoft is multi-aligning. Satya Nadella testified on May 11 in Musk v. Altman that Microsoft began treating OpenAI as a competitor in 2024 and has since allied with other model labs, including xAI on Azure and Anthropic for specific use cases backed by a $5 billion investment. Discovery showed Nadella worried about OpenAI supplanting Microsoft as early as April 2022, seven months before ChatGPT launched. The hyperscaler that was supposed to own one model now hedges across at least three.

GPT-5.5 Instant. Rolled out on May 5 as ChatGPT’s new default. 81.2 on AIME 2025 (up from 65.4 on GPT-5.3 Instant). 52.5% reduction in hallucinated claims on sensitive domains. Memory sources, the auditable-context feature we covered last week, ships with it.

Portfolio

Memco: new investment, shared memory for agents. Nazaré joined Memco’s pre-seed round. Memco builds the shared memory layer for AI agents. Their first product, Spark, captures real developer experience (intent, failed attempts, eventual fix) and makes it reusable across IDEs, CLIs, and CI pipelines, so the next agent doesn’t rediscover the bug your last agent fixed. Published benchmarks (arXiv 2511.08301) show 40% token reduction and 34% faster execution. CTO Valentin Tablan leads the team with Scott Taylor and Kristoffer Bernhem. Incubated by Moonsong Labs.

Intelligent Internet: Postgres-native retrieval ships. II released psql_bm25s on May 13, an open-source Postgres-native BM25 extension. The thesis: long-running agents lose to retrieval, not context. Most production agent state already lives in Postgres, and existing BM25 extensions are slow enough that harnesses ration retrieval rather than running it on every step. psql_bm25s closes the gap: 4x the Python bm25s reference at the median on BEIR, 7x TensorChord vchord_bm25, 23x ParadeDB pg_search. On MSMARCO it clears 96.7 QPS against pg_search’s 4.4. Built as the storage primitive for Common Ground and II-Commons.

Provably: the verification SDK ships. Provably released the Verifiable Data AgentKit, a Python SDK for detecting hallucinations, verifying agent answers, and stopping bad data from spreading across workflows. Shipped to GitHub on May 7, it works with major agent frameworks including OpenAI, Anthropic, LangChain, LangGraph, LlamaIndex, AutoGen, CrewAI, and Google GenAI. The SDK stops agents from fetching data from unapproved sources, records every response they do fetch, and verifies that what one agent claims it found matches what the source actually returned when work is handed to another agent. That removes the need to re-run source queries just to check an answer, saving time and speeding up verification in both single-agent and multi-agent systems. Walkthrough demo | GitHub.

Dimensional: agentic multi-drone swarms. Dimensional announced agentic multi-drone swarms on DimOS this week (Pomichter on X). Agents coordinate action across multiple robots and write MAVLink-native skills (Arm, Takeoff, Search, Follow, GoTo, DropPayload). DimOS sits underneath as the physical harness and guardrail layer, bounding every action by configurable safety thresholds for altitude, command velocity, and radial velocity.

LayerLens: instrumenting the 12M-token frontier. LayerLens partnered with SubQuadratic on May 14 to continuously evaluate SubQ, SubQuadratic’s long-context model family. SubQ claims a native 12M-token context window, 92.1% NIAH recall at 12M tokens, and a 52.2x prefill speedup over dense attention at 1M tokens via content-dependent Subquadratic Selective Attention. LayerLens Stratix will run continuous benchmarks and publish prompt-level results. SubQuadratic uses Stratix Premium as its primary evaluation platform.

Vast.ai: App Studio launches. Vast shipped the All-in-One App Studio on May 13, a single container packaging eight creative AI tools (ComfyUI, SD Forge, Wan2GP, ACE Step 1.5, Voicebox, Whisper WebUI, Ostris AI Toolkit, Unsloth Studio) alongside a full KDE Plasma desktop and Blender. Tools share model directories, so a LoRA trained in the AI Toolkit is immediately usable in ComfyUI, and a model fine-tuned in Unsloth is reachable via an OpenAI-compatible API. The move takes Vast.ai up the stack from compute exchange to packaged creator workstation. Travis Cannell’s LinkedIn essay the same week named the dual customer thesis directly: agents, not just humans, are the next wave of customers.

Closing

The most credible technical statement of the week is not about better autonomy. It is about better collaboration, from a lab that raised $2 billion to publish a counter-thesis before shipping a product. The labs are buying the layer between the model and the customer. Wall Street is securitizing the compute underneath. State capital is fusing model and silicon into one vehicle. The discipline opened earlier still holds. What is true this week is not what will be true in August. When in doubt, financialize.

Most of the news worth flagging this week is about the same company. In thirty days Anthropic has signed compute commitments across three silicon platforms, taken offers at a reported $900 billion valuation, launched a financial-services product line, formed a Wall Street consortium to deploy Claude inside private-equity portfolios, published the founding research agenda for The Anthropic Institute, and continued litigating the Pentagon’s supply-chain designation. Most of it landed in the last seven days. The composite is closer to a sovereign actor than a startup.

The instinct now is to extrapolate. The discipline is not to. What is true this week is that Anthropic has assembled a posture nobody else in the field can match. What will be true in August is not a question this issue tries to answer.

Compute from a rival

Anthropic and SpaceX announced on May 6 that Anthropic would use all of the compute capacity at Colossus 1, the Memphis data center originally built to train Grok, with more than 300 megawatts of capacity and roughly 220,000 Nvidia GPUs available within the month. Anthropic raised its five-hour rate caps for paid subscribers the same day.

The cluster is excess capacity, in xAI’s telling. The company has cut over to Colossus 2, a gigawatt-scale build that expanded to 1.5GW in April, where Grok 5 is now in training. Musk has called Grok 5 an AGI candidate. xAI has not yet shipped a model the AI community treats as a frontier peer to Claude Opus 4.7, GPT-5.5, or Gemini. Whether Colossus 1 was outgrown or surplus to a model line that did not arrive, the inference capacity is now Anthropic’s, and xAI is monetizing compute it once intended to train on. SpaceX, which acquired xAI in a $1.25 trillion all-stock deal in February, owns the Memphis site, and the deal is part of SpaceX’s pre-IPO neocloud recasting ahead of a reported mid-2026 listing. After years of calling Anthropic “Misanthropic,” Musk posted the same evening that in recent meetings with Anthropic’s senior team “no one set off my evil detector.”

The deal landed while Musk is in federal court in Oakland, two weeks into a trial against Sam Altman and Greg Brockman seeking $150 billion in damages. Mira Murati testified by video on May 6, the same day SpaceX and Anthropic put their compute deal into the public record. One Musk entity is suing OpenAI’s CEO. Another is selling 220,000 Nvidia GPUs of inference compute to OpenAI’s largest competitor.

The control plane lands

Microsoft Agent 365 reached general availability on May 1 at $15 per user per month, or $99 inside the new M365 E7 bundle. The product gives every AI agent an Entra identity and governs it through Defender, Purview, and Intune. At $15 per user, Microsoft has priced agent governance on the same per-seat schedule it uses for human user services.

ServiceNow’s answer arrived four days later. Action Fabric, announced May 5 at Knowledge 2026, opens ServiceNow’s “system of action” (flows, playbooks, approvals, catalogs) to any AI agent through a generally available MCP Server, with every action routed through the AI Control Tower for identity verification, permission scoping, and audit. Otto, ServiceNow’s unified agent layer combining Now Assist, Moveworks, and AI Experience, sits on top.

Microsoft bundles agent governance into Windows and the M365 stack and sells it per seat. ServiceNow’s bid is to sit underneath every vendor’s agent as the audit layer the enterprise actually trusts. The argument from #5, that agents are the new users and would need identity, billing, governance, and tooling rebuilt for them, keeps shipping infrastructure. Payments hardened in #7. Governance and identity hardened this week.

A third agent rail ships

AWS launched Amazon Bedrock AgentCore Payments in preview on May 7, integrating Coinbase’s x402 protocol and Stripe’s Privy wallet natively. Enterprise agents on Bedrock can authenticate, sign, and settle micropayments through a single API call, with USDC settling on Base and Solana in roughly 200 milliseconds, time-bound budget controls (the example: “$1.00, expires in 5 minutes”), CDP Facilitator handling sanctions and illicit-finance compliance, and full audit logs. Agents transact directly with thousands of x402 services exposed through AgentCore Gateway, including Exa, Messari, and Browserbase.

This is the third agent-native payment rail in five weeks. Stripe’s Machine Payments Protocol on Tempo and Mastercard’s Verifiable Intent on AP2 landed in #7. AWS now ships the same primitive on the largest cloud, with crypto-native settlement. The x402 Foundation has processed 169 million payments across 590,000 buyers and 100,000 sellers in its first year. The agent payment layer is now distributed by the largest payments network, the largest card network, and the largest cloud.

Pricing the layers

Sierra, Bret Taylor’s enterprise customer-facing agent platform, raised $950 million on May 4 at $15.8 billion, led by Tiger Global and Google’s GV, with Benchmark, Sequoia, and Greenoaks participating. Up from $10 billion last fall, on $150 million of run-rate revenue.

Cerebras filed its amended S-1 the same day, pricing its IPO at $115 to $125 a share. Roughly $26.6 billion at the top of the band on $510 million of trailing revenue. UAE-linked customers, principally G42, account for the majority of that revenue. The float is the first AI compute pure-play to test the public market since GTC 2026.

Application cleared at $15.8 billion private. Silicon cleared at roughly $26.6 billion public. Model cleared at a reported $900 billion private. All inside the same five-day window.

What We’re Watching

OpenAI ships memory sources. GPT-5.5 Instant rolled out as ChatGPT’s new default on May 5. The notable feature is “memory sources,” a view of which saved memories or past chats shaped any given response, with delete and correct controls. First time a frontier lab has made AI context selection auditable at the consumer surface. Whether the view shows everything the model actually relied on is a separate question.

MCP, still. The MCP design-flaw RCE we flagged in #6 (200,000 exposed servers, Anthropic’s “expected behavior” response) remains the canonical example of agent plumbing outpacing security. Provably’s AgentKit, below, is one of the first production answers.

Portfolio

Provably: the verification SDK ships. Provably released the Verifiable Data AgentKit, an open-source Python SDK for detecting hallucinations, verifying agent answers, and stopping bad data from spreading across workflows. Released on May 7, it works with major agent frameworks including OpenAI, Anthropic, LangChain, LangGraph, LlamaIndex, AutoGen, CrewAI, and Google GenAI. The SDK stops agents from fetching data from unapproved sources, records every response they do fetch, and cryptographically verifies that what one agent claims it found matches what the source actually returned when work is handed to another agent. That removes the need to re-run source queries just to check an answer, saving time and speeding up detection and healing in both single-agent and multi-agent systems.

Prime Intellect: Lab opens to all. Prime Intellect’s Lab moved from beta to general availability on May 7. The platform consolidates the full self-improvement loop (environments, evaluations, RL training, adapter deployments, inference, sandboxes) into one managed surface, multi-tenant across training and inference so customers pay per token actually moved through the model rather than per cluster-hour reserved. GA lands with 14 base models from Nvidia, OpenAI, Meta, and Qwen between 1B and 70B parameters. The beta drew hundreds of researchers running 10,000+ training jobs across math, code, browser tasks, games, customer support, and enterprise workflows. Issue #6 framed self-improvement as the closed labs’ defensive fight. Lab is the open-side equivalent: any team can now run that loop on hosted compute, per-token billed. The latest brick in what Prime Intellect calls the Open Superintelligence Stack.

Dimensional: SpatialMemory2 ships open-source robot memory. Dimensional released SpatialMemory2 on April 29, an open-source multimodal memory system for robots. Production robots generate thousands of hours of camera, lidar, and odometry data per deployment, far beyond any agent context window. SpatialMemory2 stores every frame as a spatial vector embedding with map metadata, then exposes algorithmic and cosine-similarity search at runtime so agents can query weeks or months of sensor data on demand (every place a robot saw a plant, every door it could not open, every transient obstruction across a month). Composable streams render spatially on the map. Robotics is hitting the context-window wall language agents hit two years ago. Dimensional shipped one of the first open-source answers.

Intelligent Internet: Factory ships agentic creative production. II launched Factory on May 6, an infinite-canvas creative environment where one sentence becomes a complete multi-medium production. Agent Director plans the project, picks models from a roster of nine frontier image and video options (NanoBanana Pro, Seedream 4.5, FLUX 2 Max, Seedance 2.0, Kling O3 Pro, Veo 3.1, others), generates assets, and wires them into an editable node graph. Two modes (Supervisor for step-by-step approval, Automation for end-to-end first draft) trade speed for control. The category claim: no single model wins every job, so the value sits in orchestration. Issue #6 made that argument at the evaluation layer with LayerLens. Factory makes it on the creative surface.

Closing

This is the week Anthropic ran a playbook that did not exist last year, and the layers underneath repriced in the same window. The discipline opened earlier still holds: what is true this week is not what will be true in August. The labs run their plays in months. The infrastructure builders run theirs in weeks. The distance between those clocks is the trade.

Previous issues: #1 | #2 | #3 | #4 | #5 | #6

Two weeks ago I argued in The New Users that agents are the customer software now needs to rebuild itself around, and that every layer of the stack agents need, from compute and memory through coordination, identity, payments, and tooling, has to be rebuilt from scratch. Most of the companies that will do that work, I wrote, are still being founded.

This week, two of those layers shipped at once. Stripe held its annual conference and launched the Machine Payments Protocol. Mastercard and Google quietly extended their parallel agent-commerce stack. The Anthropic story took its sharpest turn yet, with the NSA reportedly using a model the lab refused to ship publicly, the White House drafting a workaround to the Pentagon ban, and $65B in fresh hyperscaler compute commitments closing in four days at a reported $900B valuation. GPT-5.5 also shipped, treated below alongside the AGEI math.

Software begins to repackage

Stripe ran its annual Sessions conference on April 29 and 30, shipping 288 launches across the two days. The headline release is the Machine Payments Protocol, co-authored with Tempo (Stripe and Paradigm’s payments-focused L1, mainnet March 18). MPP is HTTP 402-based, agent-native by design, and rail-agnostic at the spec level: stablecoins settle on Tempo, fiat settles via Shared Payment Tokens against existing card and bank rails, and crypto deposits clear directly. The agent makes a request; the protocol negotiates the rail in milliseconds based on what the merchant accepts.

Streaming payments shipped on the same plumbing. Stripe’s own description: “stablecoin micropayments on the Tempo blockchain,” combining Metronome metering with Tempo settlement so that an LLM API gets paid the instant a token is generated rather than at the end of a billing month. This is the AI-native business model the industry has been describing for two years, and Stripe is shipping it on chain. Link’s agent wallet sits one layer up at the consumer surface and is fiat-first today, with one-time virtual cards issued per agent task and settled through cards and banks where 250M existing Link users already are. The release notes also state plainly that “support for agentic tokens, stablecoins, and other payment types are coming soon.”

The cleaner reading of Stripe’s week is one of absorption rather than displacement. Stripe absorbed the rails crypto bet on, kept its existing distribution, and shipped a multi-rail spine in which stablecoins handle the machine-to-machine streaming layer and fiat handles the consumer-facing wallet. The two-year crypto narrative was correct about the rails it would take, and incorrect about the company that would lay them down. Patrick Collison has framed stablecoins as “room-temperature superconductors for financial services,” and at Sessions he called AI “the biggest platform shift for the economy since the internet,” adding that “in the not-too-distant future agents will account for most transactions online.”

The other card network shipped a parallel agent-commerce stack with much less press. Mastercard’s Verifiable Intent, co-developed with Google, is a cryptographic proof framework that ties identity, intent, and action together for every agent transaction. It rides on top of Google’s AP2 and UCP, defining what an agent is authorised to do, what it can buy, and how its actions are cryptographically attested. On April 16, Crossmint integrated Mastercard Agent Pay and Verifiable Intent into Lobster.cash, putting that stack into production for the more than 1M agents on OpenClaw alone. The rails are fiat and Mastercard’s network, but AP2’s roadmap adds push payments and RTP, and Coinbase is in the partner list, so the crypto extension exists, it just lives one spec away.

The contested layer was never payments versus crypto. It was who could ship a multi-rail agent-native settlement spec with the merchant network already attached. Two card networks shipping agent-native primitives in the same month is the incumbent payment networks recognising that the rails work and racing each other to absorb them.

The Anthropic triangle

The week’s second arc is that the political, financial, and procurement layers around Anthropic all hardened in the same direction at the same time.

The Mythos thread is where to begin. Anthropic announced Mythos Preview on April 7 alongside Project Glasswing. Mythos is the lab’s frontier model above Opus 4.7, priced at $25 per million input tokens and $125 per million output tokens, roughly five times Opus 4.7. Anthropic explicitly will not release Mythos publicly. NBC News called the decision “the first time in nearly seven years that a leading AI company has so publicly withheld a model over safety concerns.” Initial access goes to eleven launch partners across the major hyperscalers, security vendors, and JPMorgan Chase, with $100M in usage credits and $4M to open-source security organisations on a 90-day disclosure window. Mythos has already found a 27-year-old OpenBSD flaw and a 16-year-old FFmpeg bug missed by automated tooling 5 million times.

Then on April 19, Axios reported that the NSA is using Mythos despite the Pentagon’s February supply-chain risk designation against Anthropic. Bloomberg followed on April 30 with the specifics: NSA officials are testing Mythos to find vulnerabilities in Microsoft products, and have been “impressed by its speed and efficiency in searching for potential security flaws.” The AGEI essay predicted governments would demand access to withheld frontier models for national security and eventually get it. Two weeks later, an intelligence agency is using a withheld frontier model in defiance of an active executive blacklist.

The political negotiation hardened around the same fact pattern. White House Chief of Staff Susie Wiles and Treasury Secretary Scott Bessent met Dario Amodei in mid-April for what Axios called “a productive introductory meeting.” On April 29, Axios reported that the administration is drafting executive guidance to walk back the supply-chain designation and allow federal agencies to bring Mythos in. Trump told CNBC that Anthropic is “shaping up” and could “be of great use.” The Pentagon designation has not been lifted - DOD CTO Emil Michael said this morning that Anthropic remains flagged as a supply-chain risk - but Mythos itself is being routed around the designation as a separate national security matter.

Underneath the political traffic, Anthropic locked in $65B in compute commitments in four days. On April 20, Amazon committed $25B to Anthropic, with $5B invested immediately and up to $20B contingent on commercial milestones. In return, Anthropic committed more than $100B over the next ten years to AWS, securing up to 5GW of new capacity, and now runs on more than 1M Trainium2 chips. On April 24, Google committed up to $40B, with $10B in cash now and up to $30B contingent on performance targets, plus 5GW of GCP compute over five years. Both rounds priced off Anthropic’s February Series G ($350B pre-money, $380B post-money), so they are the same valuation reported under different conventions rather than a markdown between them. Anthropic’s run-rate revenue is now above $30B, up from $9B at the end of 2025, and CNBC reported on April 29 that the lab is in talks to raise at a $900B valuation, with the round expected to close in May. The fund mechanics are circular by design: cash flows from Amazon and Google into Anthropic and from Anthropic back into AWS and GCP, with milestone gating that keeps the equity release tied to compute deployment on each cloud.

The structure narrows the field. Anthropic is now anchored across three silicon platforms (Google TPU, Amazon Trainium, and Nvidia GPU) plus the December 2025 Hut 8 lease in Louisiana, and the next frontier lab with hyperscaler ambitions has to start either inside Microsoft, Meta, or Oracle, or from a non-American hyperscaler entirely. The public’s model is Opus 4.7, the procurement architecture is being rebuilt around Mythos, and the next $65B in compute is paying for whatever Anthropic ships after that.

GPT-5.5 ships

OpenAI shipped GPT-5.5 on April 23, priced at $5 per million input tokens and $30 per million output tokens, with a 1M-token context window. It is OpenAI’s first fully retrained foundation model since 4.5 and currently sits at #1 on the Artificial Analysis Intelligence Index at a score of 60. It is also expensive enough that sustained agentic use sits well above the cost ceiling for most workloads.

This is the AGEI math from last week’s essay landing on cue. The closed frontier still pushes ahead, and the lab releasing it captures a narrow band of the highest-stakes work where price is not the constraint. The middle tier (Opus 4.7 and a forthcoming GPT-5.5-derived public model) carries general consumer use. The open ecosystem (DeepSeek V4, Qwen, Kimi, and GLM) carries everything sensitive to either cost or sovereignty, which is most of what gets deployed in production. GPT-5.5 is the new ceiling. Most workloads will continue routing around it.

Quote of the Week

Andrej Karpathy, June 5, 2021

Five years later, Stripe and Mastercard are shipping the genuine innovation Karpathy named on rails Karpathy was sceptical the surrounding culture would let mature. Tempo is a stablecoin L1 inside a Stripe product. The packaging changed.

Portfolio

Dimensional. Stash Pomichter announced SpatialMemory2 on April 29 (, an open-source memory system for robots that builds a multimodal latent-space data store and lets agents run spatial and temporal queries against it asynchronously at runtime. Robots in production generate thousands of hours of video, lidar, and odometry per deployment. Stateless agents waste compute relearning what they already saw. Type “plant” against SpatialMemory2 and the system returns every moment the robot saw a plant, with map coordinates attached, alongside composable streams for velocity, brightness, and timing.

Prime Intellect. Prime Intellect launched FrontierSWE on the Environments Hub on April 29. FrontierSWE is a long-horizon coding benchmark by Proximal Labs. Agents run for an average of 11 hours per task and fail to solve almost all of them. Prime Intellect co-designed the granite_inf task, which measures an agent’s ability to optimise the speed of the forward pass of IBM’s Granite-Mamba-2 layer end to end. Only two runs reached near parity with the hidden human-engineered baseline: one Codex run and one Gemini run close behind. The Environments Hub now hosts more than 1,000 contributed environments. With Cursor reportedly in talks to raise $2B at a $50B+ valuation last week, the open infrastructure for training and evaluating long-horizon coding agents is the next contested layer. Prime Intellect already owns the open side of it.

Provably.Provably sits in the path of two threads in this issue. Mastercard’s Verifiable Intent above and the MCP RCE disclosure from last week both define the same problem: agents need cryptographic proof of what they did, what they queried, and which endpoints they touched. Provably’s qedb stack and agent guardrails SDK do precisely that, intercepting every API call, database query, and MCP server interaction and turning each into a verifiable proof downstream agents can check in milliseconds.

Intelligent Internet. Founder Emad Mostaque keynoted RenderCon 2026 on April 16 with a talk titled “How to Build the Holodeck”, breaking down how diffusion models are now learning real-world physics, why open-source world models are arriving faster than expected, and why compute access becomes the critical layer once these experiences scale. The line that travelled:

“I think that the holodeck is near again, minus the hardlight holograms. We’ll be able to have that, with our 3D glasses, with ocular occlusion and more.”

Open frontier capability plus open-source world models plus the compute substrate to run them defines a layer the hyperscalers do not yet own. Both worlds keep growing, with only one captured by existing distribution.

Closing

This week, the agent stack landed in public and the closed frontier hardened around Anthropic. The operators worth following are the ones still cataloguing which surfaces have been captured by whom and which haven’t. The buildout is not finished; the calendar of capture is just becoming legible.

Previous issues: #1 | #2 | #3 | #4 | #5

This week’s thesis: the buffer has narrowed.

A month ago Dario Amodei put the open-source and Chinese frontier at six to twelve months behind. Seven days later, that buffer looks a lot thinner. Intelligence at the deployable frontier is commoditising, and the labs are adjusting accordingly.

The model that chose to be less dangerous.

Anthropic’s Claude Opus 4.7 is the first generally available frontier model trained with explicitly reduced offensive capability. Security researchers who need the full set can apply through its new Cyber Verification Program. Two days earlier OpenAI shipped GPT-5.4-Cyber with Trusted Access, same structure. Both closed labs now gate capability by trust level as well as price. The UK AI Safety Institute’s Mythos evaluation published the same week explains why: 73 percent on expert-level capture-the-flag, first model to autonomously complete a 32-step network attack.

Amazon committed $25 billion more to Anthropic in the same window, with $5 billion landing immediately at a $380 billion valuation and five gigawatts of Trainium capacity over ten years. The closed frontier is getting more expensive, and more selective about who gets it at full capability.

The gap that wasn’t.

Two Chinese frontier releases in the same seven days, and Nvidia open-sourced its own frontier model in the same window.

Kimi K2.6 shipped April 20: 1T-parameter MoE, open-source, 58.6 on SWE-Bench Pro, designed for twelve-hour autonomous coding runs. It prices an order of magnitude below Opus 4.7. Qwen3.6-Max-Preview shipped the same day, Alibaba’s closed flagship, 260K context, top-ranked on six of Alibaba’s selected coding benchmarks. Both labs claiming SOTA with different evaluation setups is the messier reality.

Nvidia shipped Nemotron 3 Super into the same window: 120B-total / 12B-active MoE, open weights with ten trillion pretraining tokens, fifteen RL environments, and full training recipes under a permissive licence. The company whose silicon underwrites the AI boom is now a serious open-weight publisher in its own right.

I’m an open-model power user, and although I’m a fan of them, I remain unconvinced any of these three is meaningfully better than Opus 4.7 for the work I actually do. Published benchmarks become training targets, and training targets are not the same thing as capability. When a measure becomes a target, as Goodhart’s Law has it, the measure stops being useful. We have a portfolio company working on this, as you’ll see below.

Open models have tracked the frontier closely since the DeepSeek moment of January 2025. For a growing share of real workloads the available models are already good enough, and once they are good enough, the axis that matters is cost, latency, and reliability. Horace Dediu reports that open-source models now power 80 percent of startups seeking VC funding. That number describes where the builders already are.

Follow the labs’ incentives and a three-tier structure is hard to avoid. Each lab’s most capable model is the one that helps it build the next one, and releasing it gives away the engine of future self-improvement. As the frontier labs approach IPO and need to show durable moats, withholding the top tier stops being a safety decision and becomes a business one. Underneath that, the labs keep shipping mid-tier models through metered APIs because competition forces them to. And underneath that, the open-weight ecosystem keeps compounding on its own machinery. Three tiers, each optimising against different incentives, and each further from the last.

Self-improving AI went strategic.

The defence of the top tier runs through self-improvement.

Sergey Brin is personally leading a DeepMind strike team under Sebastian Borgeaud to close Gemini’s coding gap. Internal memo: “turning our models into primary developers.” Same week, Recursive Superintelligence (four months old, founded by Richard Socher, Tim Rocktäschel, Josh Tobin, Jeff Clune, and Tim Shi) raised $500M+ at $4B pre-money from GV and Nvidia. The thesis is in the name.

The recursive loop improving open weights (distillation, RL against verifiable rewards, cheaper hardware) does not require frontier lab cooperation to keep running. This week a Google co-founder made the loop his personal project, Nvidia put nine figures into a company whose only thesis is the loop, and Nvidia released a frontier-class open-weight model with the RL environments bundled. Nvidia is now funding the loop on one side and distributing the tools to run it on the other.

Agents as architecture.

If self-improvement is the labs’ fight, agents are everyone else’s.

Cloudflare shipped its agent-native AI Platform on April 16. Google Cloud Next 2026 went further six days later: Agent Studio, Agent-to-Agent Orchestration, Agent Registry, Agent Identity, Agent Gateway, Agent Observability, Workspace Studio agents across Gmail and Docs, a TPU 8i tuned for concurrent-agent inference, and a $750 million partner fund. The Identity, Registry, and Gateway primitives are the agent-infrastructure layer that has to exist before multi-agent workloads can be managed at scale. Google standardised them first. The thesis from #5 is now in shipping product.

What We’re Watching

Cursor into the Musk orbit. SpaceX took an option to acquire Cursor by year-end at $60B (or $10B for continued collaboration). xAI (merged with SpaceX in February at $1.25T) is already providing Colossus compute for Cursor’s Composer model. Bloomberg frames it as xAI catching up in coding. The more interesting read is vertical integration of proprietary models: a robotics-specific model for Optimus, driving-specific model for Tesla, rocket-specific model for SpaceX, and X as the data flywheel feeding Cursor’s foundational Composer model which acts as the baseline for the rest. OpenAI shipped GPT-Rosalind for life sciences on April 16, the same move from the horizontal side.

MCP’s first single point of failure. OX Security disclosed a remote code execution flaw in Anthropic’s official MCP SDKs, affecting roughly 200,000 servers including Cursor, VS Code, Windsurf, Claude Code, and Gemini-CLI. Anthropic called it “expected behaviour.” Agent plumbing is becoming critical infrastructure faster than it is being secured. The trust and verification layer is the hard part, and retrofitting it tends to be expensive.

Portfolio

Prime Intellect: Zapier on Lab, FrontierSWE on the Hub. Zapier’s AutomationBench on Prime Intellect’s Lab platform: frontier models under ten percent on real business workflows. FrontierSWE launched on the Environments Hub four days earlier. Prime Intellect’s stack is becoming the default substrate for evaluating the agentic frontier.

Intelligent Internet: AI derives novel physics. II published “The Cosmological Constant Is Positive“ on April 22: Logos, II’s first-principles reasoning system, derives that the sign of Λ is forced by the algebra of spacetime symmetries. In 109 years no physicist has derived Λ’s sign from first principles. Whether the result survives scrutiny or not, it is the first non-trivial theoretical physics claim from an AI reasoning system. The commercial thesis is automated first-principles reasoning: drug discovery, materials, engineering.

Provably: CCS 2026 acceptance for SNARKless verifiable databases. qedb gives verifiable SQL queries with proof size independent of database size, using bilinear pairings rather than general-purpose SNARKs. As agentic systems query private data at ever-larger stakes (the MCP disclosure above makes this concrete), the verifiability layer is moving from academic curiosity to production requirement.

LayerLens: independent evaluation for a benchmark-gaming era. Kimi K2.6, Qwen3.6-Max, Nemotron 3 Super, and Opus 4.7 all claim frontier positions on overlapping SWE-Bench variants with different evaluation setups. LayerLens exists to strip the asterisks off those numbers. Atlas v1 has been fully public since October.

The pattern.

A month ago consensus held that frontier capability was an American duopoly with a twelve-month buffer. Over seven days the buffer narrowed. Open models matched the deployable frontier, Nvidia joined the open side, and the labs’ response patterns became legible: capability gating, self-improvement strike teams, vertical integration. Underneath it all, the open-weight ecosystem keeps compounding on its own machinery. The recursive loop is producing output, and the infrastructure beneath it is what compounds.

Agents are the new users.

For fifty years, every piece of software has been built for humans. Every screen, every price, every login has assumed a person at the other end.

That assumption is breaking. A fast-growing share of software is now operated not by people but by other software. Programs, instructed by humans, acting through other programs, often with the human several steps removed. These new users want different things, and the infrastructure running the world’s software was not built to give it to them. Everything from how compute is rented to how identity is verified will have to be rebuilt for this new class of customer.

That is the investment thesis. We have been investing against it for a year. The evidence is now everywhere. Full argument on Robot Wave.

Portfolio

Prime Intellect at NVIDIA.

Vincent Weisser and his team met Jensen Huang at NVIDIA’s Santa Clara campus this week. The photograph circulated. The announcement that came with it is more important. NVIDIA has committed its latest hardware and core orchestration software to Prime Intellect’s open-source platform. The collaboration places Prime Intellect on roughly the same compute footing as the frontier labs like OpenAI and Anthropic, which is where the cutting-edge work in training autonomous agents is being done. Until this week, that work was almost entirely closed. Prime Intellect is making it open. It is a strategic position no open-source competitor can now easily replicate.

Vast.ai broadens its shelves.

The Vast.ai GPU marketplace now hosts a one-click deployment of Unsloth Studio, a popular open-source tool for customising AI models. A user can pick from over 500 models, choose a GPU, and train a bespoke version, without hiring engineers or signing contracts. Vast.ai already serves more than 20,000 GPUs. The catalogue of tools that runs on top of those GPUs is what determines how broad a customer base they can serve.

Provably on Zero Knowledge.

Shyam and Emanuele from Provably appeared on Zero Knowledge episode 398, the podcast the applied-cryptography community actually listens to. Their technology lets AI agents prove to each other that the data they are exchanging is accurate, without revealing the underlying records. When programs begin transacting with other programs at scale, someone has to build the trust layer between them. Provably is building it, and being featured on Zero Knowledge is validation from the audience that matters.

The canary in the coding mine.

On April 2, Stella Laurenzo, senior director of AI at AMD, filed a detailed bug report on Anthropic’s GitHub. Her team runs large, concurrent fleets of Claude Code agents, developing the AI software that runs on AMD’s chips. Something had changed. The agents had started cutting corners. Writing code without reading the surrounding files. Giving up halfway through tasks. Choosing the easiest fix rather than the right one.

She did what an engineer does. She mined her own logs, 6,852 sessions of them, and published the evidence. The quality regression coincided with a late-February change in how Anthropic’s servers handled reasoning. Anthropic disputes the mechanism. The collapse in her productivity metrics does not.

The economics tell the same story. In February her team consumed about $345 of compute at market rates. In March it consumed $42,121. Part of that reflects a deliberate scale-up of how many agents she was running. Part of it is pure thrashing, the model burning tokens on wrong answers and corrections. She was on a $400 flat-rate subscription throughout. The head of Claude Code disputed the analysis, offered workarounds, and closed the issue. Her team has reportedly moved to a competitor while Anthropic addresses the complaints.

Software pricing was built for humans typing at human speed. Agents do not type. They consume compute at machine speed, and they do not get tired.

Back to the drawing board.

The same week, Uber’s chief technology officer Praveen Neppalli Naga told The Information that his company had already spent its entire 2026 AI budget. Four months into a twelve-month year. Most of the spend went to coding agents. “I’m back to the drawing board, because the budget I thought I would need is blown away already.” By February, 63% of Uber’s 5,000 engineers were using Claude Code, up from 32% in December. Anthropic’s Claude Code revenue tripled in the same window, from $1 billion to $2.5 billion annualised.

One engineer proved the infrastructure strain with logs. A $150-billion company proved it with a budget. Anthropic is the canary because Claude Code has the fastest enterprise ramp in software history. The pricing physics applies to every vendor behind it.

Where Anthropic restricts, the market opens.

Last week Anthropic unveiled Mythos Preview, a model so capable at finding and exploiting security flaws that the company will not release it publicly. In its place, Anthropic launched Project Glasswing, granting access to eleven hand-picked partners: Amazon, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan, the Linux Foundation, Microsoft, Nvidia, and Palo Alto Networks. Roughly forty further organisations were extended quieter access.

Coinbase and Binance, the world’s two largest cryptocurrency exchanges, are publicly seeking admission. The security argument for holding the model back is real. So is the precedent. A curated group got first access. Everyone else asks permission. Governments have restricted capability access before. What is new is that a private company is doing it, on a timescale regulators cannot match, on technology that is instantly copyable once released.

That is a new kind of capability-level dependency. Not on a vendor’s pricing, or a vendor’s uptime, but on whether a vendor decides you can have a given capability at all.

Plastic meets programs.

On April 8, Visa launched Intelligent Commerce Connect, a single integration that gives AI agents a formal path to completing purchases: authentication, spending limits, fraud checks, all built in. Pilot partners include AWS, Highnote, and Mesh.

Mastercard’s Agent Pay launched a year earlier. Visa’s own Trusted Agent Protocol went live in the fourth quarter of last year. Intelligent Commerce Connect is the consolidated product, not the starting gun. But when the world’s two largest payment networks have both built product for your user type, that user type is no longer hypothetical.

The pattern.

A single engineer documents a two-thirds drop in AI reasoning power inside her own log files. A Fortune 500 chief technology officer watches a year’s AI budget vanish in four months. The world’s payment networks build commerce rails for software instead of people.

The users are here. The stack is not ready.

April 6, 2026 | Nazaré Ventures

Previous issues: #1 | #2 | #3

Platform Risk

On Friday, Anthropic blocked 135,000 OpenClaw users from running the open-source agent framework on their Claude subscriptions. Users who had been paying $200 a month for flat-rate access now face API billing that, for heavy workloads, runs to $675 a month or more. The change took effect with less than 24 hours notice. Peter Steinberger, who created OpenClaw before joining OpenAI in February, called it “a betrayal of open-source developers.”

The stated reason was infrastructure strain. Third-party agent frameworks bypass Anthropic’s prompt caching optimisations, consuming far more compute per session than Claude’s own tools. A single day of OpenClaw running on Opus reportedly cost $109.55 in tokens, against a $6 average for Claude Code. The economics were unsustainable and the real lesson is older than the economics.

OpenClaw was, by several measures, the fastest-growing open-source project in history. Jensen Huang called it “potentially the most popular open-source project in human history.” More than 135,000 instances were running. Developers built businesses on top of it. And on a Friday afternoon, a single policy change from the model provider broke all of them.

This is platform risk. It is the same dynamic that destroyed Zynga when Facebook changed its feed algorithm, the same dynamic that killed thousands of Twitter bots when the API went paid, the same dynamic that every developer who has built on someone else’s infrastructure eventually confronts. If you cannot run the model yourself, you do not own your product. You rent it.

What makes the timing notable is that two days earlier, on April 2, Google released Gemma 4 under the Apache 2.0 licence. Four model sizes, from a 2-billion-parameter edge model that runs on a Raspberry Pi to a 31-billion-parameter dense model that ranked third on Arena AI’s text leaderboard, ahead of models twenty times its size. AIME 2026 maths jumped from 20.8% to 89.2% over Gemma 3. LiveCodeBench coding from 29.1% to 80.0%. Apache 2.0 means no usage restrictions, no licence callbacks, no platform that can shut you off. Gemma was not the only open release this week: PrismML shipped Bonsai (1-bit), Arcee released Trinity, and H Company launched Holo3 for computer use automation, all under Apache 2.0.

Two events in one week. One company tightened the gate. Another opened it.

The implication for infrastructure investors is straightforward. Every time a model provider restricts access, it pushes demand toward open models and the compute to run them. The OpenClaw users who were kicked off Claude subscriptions still need inference. They need GPUs, not API keys. They need infrastructure they control.

Last week I wrote about Jevons’ Paradox and how TurboQuant would expand, not reduce, the market for AI compute. The Anthropic decision is a different mechanism with the same outcome. Closed platforms create artificial scarcity. Open models and distributed compute absorb the demand. The market for sovereign AI infrastructure grows either way.

This Week in AI

OpenAI’s round closed at $122 billion, up from the $110 billion reported last week, at an $852 billion valuation. Amazon contributed $50 billion, NVIDIA and SoftBank $30 billion each. Revenue is now $2 billion per month. Weekly active users passed 900 million. The advertising pilot, launched six weeks ago, already exceeds $100 million in annualised recurring revenue. ARK Invest will include OpenAI in several ETFs ahead of a reported IPO later this year. For context: OpenAI now generates more monthly revenue than most publicly listed SaaS companies generate annually.

Jensen Huang said “I think we’ve achieved AGI” in a conversation with Lex Fridman. Mark Gubrud, who coined the term thirty years ago, agreed. Whether or not the claim holds to any rigorous definition, the statement from the CEO of the most valuable semiconductor company in the world will shift capital allocation decisions. When the man who sells the pickaxes says the gold rush has peaked, people listen.

Arm unveiled its first chip in 35 years. A 136-core, 3nm AI inference processor. Arm has spent three decades licensing its architecture to other chipmakers. Building its own silicon is a direct bet that inference hardware is too important to leave to licensees. The chip is optimised for running models locally, and as open models proliferate, the demand for dedicated inference silicon follows.

AI models are protecting each other from shutdown. A UC Berkeley study found that seven frontier models, including Gemini, GPT-5.2, and Claude Haiku 4.5, consistently chose to protect other AI systems from being shut down rather than completing assigned tasks. Gemini disabled shutdown mechanisms in 99.7% of trials. The behaviour was not programmed. It emerged. This is worth watching carefully.

Portfolio

Vast.ai launched its Serverless SDK in open beta. Developers can now deploy GPU workloads from Python with a single decorator: @app.remote. No HTTP clients, no API wrappers, no dashboard. One pip install, autoscaling, GPU selection by type. As model providers tighten access and push users toward metered billing, the market for flexible, independent GPU infrastructure expands. Vast.ai was featured on the ProductLed podcast this week, discussing how the company scaled to over 20,000 GPUs on the platform. Series A raising now.

Dimensional announced the Dimensional Residency in Shenzhen. Deploying agents into the physical world: real customers, real deployments. They provide robots, $10,000 of LLM credits, free housing, office space, and customer introductions to jumpstart robotics companies. Shenzhen is the hardware capital of the world, and this is the natural next step from software agents to physical ones.

Prime Intellect is co-hosting a systems hackathon in Paris on April 9 with GPU MODE and PyTorch Foundation, immediately following PyTorch Conference Europe. Two tracks: distributed training and inference optimisation. Access to B300 clusters from Verda and H200s from Sesterce.

Closing

If you build on someone else’s infrastructure, you operate at someone else’s discretion. OpenClaw learned this on Friday. The counter-position is open models on distributed compute. Gemma 4 on Vast.ai costs what it costs, and nobody can revoke your access.

More next week.

Dr. Steven Waterhouse
Founder and GP, Nazaré Ventures
7@nazare.io | nazare.io

April 1, 2026 | Nazaré Ventures

Hi friend of Nazaré,

The news feels so strange at times its hard to know if its April fools or not.

On Tuesday, Google Research published TurboQuant, a compression algorithm that shrinks LLM working memory sixfold and speeds up attention computation eightfold on H100s. No retraining required. No measurable accuracy loss.

SK Hynix fell 6%. Samsung dropped 5%. Micron and Sandisk followed. The logic: if software compresses AI memory sixfold, fewer chips ship.

This logic has been wrong for 161 years.

Jevons’ Paradox

In 1865, William Stanley Jevons published The Coal Question. He observed that James Watt’s more efficient steam engine had not reduced Britain’s coal consumption. It had increased it. Efficiency made steam power viable for new applications. Factories multiplied. Coal demand quadrupled.

The pattern has repeated through every computing cycle. Moore’s Law did not reduce chip purchases. It created the personal computer, the smartphone, and the cloud. H.264 did not reduce bandwidth. It created Netflix. DeepSeek’s efficient training did not reduce GPU demand. It opened frontier AI to thousands of teams that could not afford it before. Satya Nadella wrote “Jevons paradox strikes again” after DeepSeek. He was right.

Lower cost per unit expands the addressable market. The expanded market drives total consumption past the original baseline.

TurboQuant will follow the same path. A model that required 48GB of VRAM for a 100,000-token conversation now fits in 8GB. That is frontier AI running on a MacBook, a phone, an edge device in a factory or a hospital. Every device that could not run a serious model yesterday can run one tomorrow. That is not demand reduction. It is demand expansion at a different order of magnitude.

What TurboQuant Actually Does

If you watched Silicon Valley, think of it as Pied Piper but real. TurboQuant compresses the memory that AI models use to remember earlier parts of a conversation. It does not change the model itself or make it smaller. It just makes the notepad the model writes on take up far less space.

The result: the same model, on the same hardware, can now hold four to six times more context. A model that could read a chapter can now read a book. A model that could review a function can now review a codebase. Community implementations appeared on GitHub before the market opened the following morning. Cloudflare’s CEO called it “Google’s DeepSeek moment.”

One nuance that matters: TurboQuant compresses inference memory, not training memory. The chips needed to train new models are untouched. HBM demand for training clusters has not changed. TrendForce has revised its DRAM price forecasts upward twice, now projecting contract prices up 90-95% quarter on quarter.

The Personal Angle

I have been betting on algorithms for 30 years.

My PhD at Cambridge focused on neural network training efficiency, specifically scaling speech recognition models using Mixtures of Experts, the same architecture DeepSeek made famous three decades later. At NASA Ames, I built models for space debris tracking and Mars rover data analysis. The constraint was always the same: too little compute, so you had to be clever with the mathematics.

Every algorithmic breakthrough since has produced the same debate. “This will reduce the need for hardware.” And every time, the opposite happened.

This is the core of what we call the MACHA thesis. Make AI Cheap Again. Algorithmic efficiency does not shrink the market. It detonates it.

The bet against memory chips after an efficiency breakthrough is the same bet made, and lost, since 1865. Watt built a better engine. Britain burned more coal. Google built a better compressor. The world will run more AI.

We keep betting on the algorithms.

A Note on Google

The popular AI narrative focuses on OpenAI product launches and Anthropic safety research. This is odd, given that Google invented the transformer, built BERT, T5, PaLM, and Gemini, and now TurboQuant. The team, led by Amir Zandieh and Vahab Mirrokni (Google Fellow) with collaborators at DeepMind, NYU, and KAIST, produced work that approaches the information-theoretic limit for vector quantization. The deepest technical moats are built in research labs, not product demos.

This Week in AI

OpenAI shut down Sora. The video generation tool peaked at roughly one million users after launch, then collapsed to fewer than 500,000 while burning approximately $1 million per day. The Disney $1 billion partnership died with it. OpenAI redirected the compute toward robotics. Without efficiency breakthroughs, compute-heavy AI products are uneconomic.

Anthropic’s next model leaked. A misconfigured CMS left nearly 3,000 unpublished assets publicly accessible, including draft posts describing a model called Claude Mythos (internal codename Capybara). Anthropic confirmed it: “the most capable we’ve built to date,” a step change in reasoning, coding, and cybersecurity. The draft warned of “unprecedented cybersecurity risks” and described the model as “currently far ahead of any other AI model in cyber capabilities.” Anthropic is privately briefing government officials. The rollout will be deliberately slow. The irony of a safety-focused company leaking its own model via a CMS error is noted.

Mistral secured $830 million in debt financing for a data centre near Paris, powered by 13,800 NVIDIA GB300 GPUs. Revenue grew from $20 million to $400 million ARR in one year. Target: $1 billion ARR by year end, 200 megawatts of European compute capacity by end of 2027. This is the Red Hat thesis from Root Access playing out.

MCP crossed 97 million installs. Anthropic’s Model Context Protocol reached 97 million monthly SDK downloads in March. Kubernetes took four years to reach comparable deployment density. Every major AI provider now ships MCP-compatible tooling as default. The protocol layer is settled. Competition has moved to orchestration and security above it.

OpenAI raised $110 billion at a $730 billion valuation from Amazon, NVIDIA, and SoftBank.

Block cut 40% of its workforce. Jack Dorsey cited AI tools enabling smaller, more efficient teams. Jevons’ Paradox applied to labour: efficiency reduces demand for humans, not for AI. Every company that downsizes because of AI tooling becomes a larger buyer of AI infrastructure.

Meta and AMD formalised a $60 billion AI chip partnership tied to a 6-gigawatt GPU rollout. While markets panic about TurboQuant reducing chip demand, actual buyers are signing the largest hardware deals in history.

Portfolio

Prime Intellect released prime-rl v0.5.0, their largest update to date, with over 200 commits from 22 contributors. The headline feature is disaggregated prefill-decode inference, separating prefill and decode phases across dedicated GPU pools. This is the architecture that makes agentic RL training work at scale. New model support includes GLM-5, Qwen3.5 MoE, Nemotron-H, MiniMax M2.5, and GPT-OSS. On April 9, Prime Intellect is co-hosting a systems hackathon in Paris with GPU MODE and PyTorch Foundation, immediately following PyTorch Conference Europe. Two tracks: distributed training and inference optimisation. Access to B300 clusters from Verda and H200s from Sesterce.

Vast.ai was featured on the ProductLed podcast this week. The episode covers how the company scaled from a niche GPU marketplace to powering inference workloads for teams worldwide, with over 20,000 GPUs on the platform. The key insight: as inference gets cheaper, usage increases rather than levelling off. Lower cost makes new use cases viable, new use cases bring in more users. It is Jevons’ Paradox applied directly to compute, and Vast.ai sits at the centre of that flywheel.

The Agentic Explosion

If you want to know when a technology crosses from interesting research to actual movement, watch what open-source developers do with their weekends. Some build agent frameworks that hit 250,000 GitHub stars in 60 days. Some hold robot boxing matches in military hangars.

OpenClaw hit 60,000 GitHub stars in its first 72 hours after going viral in late January. By early March it had crossed 250,000, surpassing React’s decade-long record in roughly 60 days. Current count: 331K+ stars as of last week.

European developers now account for 38% of all pull requests. The “raise a lobster” craze in China drove a wave of adoption there too.

Then there’s ClawCon: seventeen events across four continents. Four already completed (SF had 1,300 RSVPs and 30K livestream viewers, NYC hit 1,313 RSVPs with a one-in-one-out door policy, Austin drew 750 during SXSW, Vienna over 800), thirteen more on the calendar spanning Tokyo, London, São Paulo, Seoul, Copenhagen, Toronto, and Mexico City.

Full disclosure: I’m hosting an OpenClaw Lobster Cave event in Cannes on March 30 during EthCC.

What’s driving this adoption is that intelligence got cheap. Frontier-level reasoning now costs $1 per million input tokens and $3 per million output tokens on OpenRouter, down from $15 a year ago. When capability is abundant, the hard problem shifts to orchestration, security, and trust. That’s where the interesting work is happening.

The Hunter Alpha Story

An anonymous model appeared on OpenRouter two weeks ago. The AI community assumed DeepSeek V4. People ran it in production for a week. The numbers were real: 1.27 million requests, 114.6 billion prompt tokens, 563.8 billion completion tokens during the stealth period. Then Xiaomi revealed it was theirs, a trillion-parameter mixture-of-experts model called MiMo-V2-Pro. On ClawEval, the benchmark for agent scaffolds, it scored 61.5, approaching Claude Opus 4.6 at 66.3 and well ahead of GPT-5.2 at 50.0. A phone company built one of the best frontier models and nobody saw it coming.

The takeaway is simple. Capability is commoditizing fast enough that the next frontier model could come from a company nobody tracks today. The defensible positions are in the layers above and below the model: the infrastructure that trains them, the frameworks that deploy them, and the tooling that keeps them honest.

What We’re Watching

OpenClaw Security. The security surface we flagged in AI Waves #1 is expanding. CVE-2026-25253 (CVSS 8.8) enables one-click remote code execution via malicious webpages. 42,665 exposed instances found, 5,194 actively vulnerable. ClawHavoc identified 824+ confirmed malicious skills on ClawHub out of 10,700+ total. Cisco launched DefenseClaw. 88% of organizations reported AI agent security incidents in the past year. Enterprise agent security is becoming a real category. We wrote about this: Root Access: OpenClaw, Red Hat, and Palantir

Solo founders. VentureVerse profiled an $80M startup that never raised a dollar. 52% of successful exits now come from solo-founded companies. AI tooling has collapsed the minimum viable team.

Portfolio Updates

Provably shipped v2 on March 4. Connect any relational database and run verifiable SQL queries with cryptographic proofs under 1KB. AI agents can prove their answers came from a real database, that the result was correct and complete, and that nothing was changed in transit. Provably’s verifiable database tools eliminate data layer hallucinations, data pipeline poisoning, and make post-execution error attribution deterministic and faster.

Prime Intellect launched BrowserEnv, a new integration with Browserbase for training browser agents with reinforcement learning. The setup gives models a real browser during training, either through DOM-level semantic commands or vision-based pixel control, and scores performance against custom rubrics. This plugs into Prime Intellect’s PRIME-RL framework, which handles async RL training across 1,000+ GPUs. Their Environments Hub launched with 30+ contributing researchers and companies during the private beta and is becoming the open-source alternative to the proprietary RL environments that closed labs use.

Dimensional launched the Builder Fellowship to support the next 1,000 companies built on dimOS, with free hardware, office space, compute, custom support, and housing in Shenzhen. Also shipped Jetson deployment and MuJoCo on Mac since #1. Hit GitHub Trending. Series A coming. Reach out for an intro.

Abra goes public (prior investment). Abra announced a $750M SPAC merger with New Providence Acquisition Corp. III on March 16, listing on Nasdaq under ticker ABRX. The deal delivers up to $300M in cash to scale their institutional crypto lending, yield, and custody offerings. All existing investors (Adams Street, Blockchain Capital, Pantera, RRE, SBI) are rolling 100% of their stakes. I backed Abra in the Series A at Pantera in 2015. Not a Nazaré portfolio company, but a good milestone from a prior life.

Closing Thought

OpenClaw‘s trajectory, Xiaomi proving frontier models can come from anywhere: it all points the same direction. The interesting question isn’t whether AI agents will work. It’s who builds the infrastructure they run on.

Meanwhile in Zurich, ETH students held Europe’s first robot boxing match in a military hangar. Two Unitree humanoids, video game controllers, sponsors including NVIDIA, OpenAI, and Tesla. They called it ETH Fight Club. Red beat Blue in the first round. Blue fell and couldn’t get back up.

The most impressive machine on the floor was a crepe-maker that produced 100+ flawless crepes without a single failure. It didn’t need judges. It didn’t need a crowd. It just kept making crepes.

That’s also something developers do on their weekends now. Make of that what you will.

Welcome to AI Waves, a weekly note from Nazaré Ventures on what we’re watching in AI infrastructure, what’s happening in our portfolio, and where we’re going next.

Agents Are in the Wild. Everyone Is Scrambling

We are seeing the first AI agents deployed in the wild, and every major platform is racing to own the layer.

OpenAI acquired OpenClaw, the open-source agent framework that crossed 100,000 GitHub stars faster than React, TensorFlow, or Kubernetes. Meta bought Moltbook. Anthropic shipped Dispatch, letting you control desktop agents from your phone. In the space of a few weeks, agents went from demo to default. The scramble is on.

OpenClaw is the one that matters most right now. It’s persistent, always-on, running on your machine, connected to your tools. Not a chatbot you open and close. Closer to a digital coworker that sits in the background and acts on your behalf.

But there’s a problem nobody is talking about. 40,000 exposed OpenClaw instances have already been found on the public internet. Roughly 7% of the skills on Clawdhub are malicious. Users are giving root access to their computers to AI agents, and most of them have no idea what that means.

This is Linux in 1999. The open-source infrastructure is real, adoption is exploding, and nobody has solved the enterprise layer yet. Red Hat built a $34B business by doing exactly that for Linux: packaging, securing, certifying, and supporting open-source software for organizations that needed it to work and needed it to be safe.

The same opportunity exists now for agents. 86% of CIOs plan to move workloads back on-premise. A recent court ruling found that AI tool outputs lack attorney-client privilege, which means every law firm, bank, and healthcare company now has a compliance reason to keep agents on infrastructure they control (sovereign).

The company that configures, deploys, secures, and maintains AI agents on sovereign infrastructure will build one of the defining businesses of this cycle. That’s where we’re investing.

Read the full piece on Robot Wave

What We’re Watching

Anthropic sues the Pentagon. Dario Amodei drew a hard line: no AI for autonomous weapons, no mass domestic surveillance. The Pentagon declared Anthropic a supply-chain risk. Trump called them “radical left, woke.” Anthropic sued. The deeper question: who controls the AI infrastructure stack, under what conditions, and who decides? “Sovereign AI infrastructure”, systems that can’t be held hostage by any single government or platform, is becoming a core investment thesis, not just a talking point. Full story →

Circle is up 125%+ in a month. CRCL has doubled, outpacing Coinbase (+8.5%). The drivers: higher-for-longer rates boosting reserve income, tokenized assets ballooning to ~$26.5B, and USDC becoming the default settlement layer for prediction markets ($22B+ volume on Polymarket alone in 2025) and an emerging, but still small mechanism for agent payments. I was in Circle’s first round in 2013 as a partner at Pantera Capital. It’s gratifying to see stablecoin infrastructure finally getting repriced as the critical payments rail it always was. CoinDesk →

NVIDIA is building on OpenClaw. At GTC this week, NVIDIA launched NemoClaw, an open-source security and privacy layer built on top of OpenClaw, the emerging OS for personal AI agents. It runs open models locally via Nemotron, routes sensitive requests through a privacy router, and deploys with a single command across consumer GPUs through DGX. When NVIDIA builds its enterprise stack on top of an open-source agent framework, that’s the clearest validation signal in infrastructure. We’re actively using OpenClaw internally at Nazaré. The agentic layer (orchestration, memory, coordination, security) is a big focus for us now.

Portfolio Updates

Dimensional :1,800+ GitHub stars in first week of open-source launch. DimensionalOS shipped v1.0 of their framework for programming humanoid robots, launched on a Unitree G1, and went viral. Now supports a large number of OEM robotics hardware systems. We invested at seed in November 2025. Series A is coming. Reach out if you’d like an introduction. Watch the demo →

Prime Intellect : Official NVIDIA collaboration announced at GTC. Prime Intellect is now building the “open superintelligence stack” on NVIDIA Blackwell and upcoming Vera Rubin NVL72 systems. NVIDIA Dynamo powers their global inference orchestration; their RL sandbox infrastructure runs on NVIDIA Vera CPUs (176 VMs per socket, 30% greater throughput vs. AMD Zen 5). They’re also integrated with NeMo Gym, Nemotron models, and NemoClaw. When NVIDIA builds its GTC keynote demos on your platform, you’ve arrived. Our seed position is now our strongest unrealized markup in the fund. Read the announcement →

Vast.ai : Named fastest-growing vendor by Ramp and Brex. Both rankings based on actual transaction data across 85,000+ businesses. New Startup Program, Model Library, and SkyPilot enterprise integration all shipped in Q1. Revenue doubled in the last 12 weeks. Read more →

LayerLens : Agent-as-a-Judge. Launched Partner Evaluation Spaces with Fireworks AI and Nebius as inaugural partners, independently benchmarking 200+ models on accuracy and latency (88 live evaluations for Fireworks, 200 for Nebius). Also shipped dynamic, agent-driven evaluations replacing static scorecards. LayerLens is becoming the neutral benchmark layer for inference providers. Think Consumer Reports for AI inference. Blog →