The announcement is called Against Claudefishing, published by CEO Chris Best. It opens with a quote from Freddie deBoer about wanting other humans behind the art he consumes, and about being fooled in that process amounting to a con. Two days before that post went up, deBoer published a teardown of Pangram, the detector Substack had just licensed. The announcement quotes him on the principle and does not link the teardown.

What shipped

The conditions come from Substack’s own announcement. Text longer than 100 words, published from the launch day on, so everything written before it stays unexamined. Posts, notes, comments and replies.

Best describes the reader’s side in one clause: the analysis appears only for those who request it. A reader opens a menu and asks, and Pangram returns a percentage.

The writer’s side has four moves. Write a statement in settings describing how you make your work. Run your drafts through the detector before publishing. Disable detection on a post, after which readers see a notice that detection is unavailable, which is its own kind of verdict. Report a scan you believe is wrong.

Read that list again as a description of labor. Verification became something the reader performs, one text at a time. Reputation management became something the writer performs, permanently. The feed that distributes both of them was not part of the release.

I traced the same move last month through age verification and chat logs.

What was promised in 2023

Notes launched on April 5, 2023, and Substack’s Introducing Notes states the purpose plainly: a growth channel, designed to drive discovery.

The post opens by restating why the company was built. Substack set out to make a system that fosters deep connections and quality over shallow engagement and dopamine hacks, in the founders’ own words, and the sentence sits there as the reason this new feed would be different from the others. In legacy social networks, the post says, people get rewarded for content that goes viral regardless of whether anyone values it. Then the promise about Notes specifically: it will not feel like the social media we know today.

Hold those sentences. Every argument that follows depends on them, because a company that never made the promise cannot be measured against it.

What was advised in 2024 and 2025

Fifteen months later Substack published growth instructions. Writers who post three or more thoughtful notes during their launch week gain 50% more total subscribers than those who don’t, because the app and network drive half of all new free subscriptions and 30% of new paid ones.

That is a cadence, a window and a payout, published by the platform in the platform’s own voice.

In October 2025 came Demystifying the feed, still the most detailed public account of how distribution works there. Publish on a regular basis so your work stays visible. Reply, restack, endorse. Substack’s own phrasing is that signal-boosting others isn’t just good community behavior, it’s one of the most effective ways to grow. In one three-month window the app drove nearly half a million paid subscriptions and more than 32 million free ones, most of them originating in the feed.

None of this is unusual advice. LinkedIn says it, X says it, every platform with a ranked feed says it. The difference is that the others never opened by promising quality over dopamine hacks.

What grew

Pangram scanned just over a million social posts and published the results on July 9, twelve days before Substack licensed the company. On Substack, 21.9% of posts flagged as AI-generated or AI-assisted, a combined figure rather than a rate of pure generation, and the best number in the study. LinkedIn ran past 40% on longform, and Best cites that figure in his announcement, saying the company would rather not wait until the Substack app turns into it.

The more uncomfortable measurement came from inside. Karen Spinner analyzed roughly 16,800 posts across 31 categories, tracking one construction that models overproduce. Its frequency is about five times what it was before ChatGPT, and newsletters launched after late 2022 use it more than twice as often as older ones.

Nobody can look at a sentence and know who wrote it, and Spinner says so herself. She draws no line from her data to any platform’s advice, and neither can I. What her distribution shows is where the pressure landed, and it landed hardest on the smallest and newest publications. What those have in common is that growth instructions are written for them.

What the announcement does not say

Against Claudefishing runs long. It names the problem as a mismatch between what a reader expects and what a reader gets. It concedes that not everything made with AI is slop and not all slop is made with AI. It warns that platforms rewarding fakeness create a race to the bottom.

It does not contain the word Notes. It does not mention the feed, ranking, recommendations or discovery. It does not reference any advice the company published about posting cadence. The only place ranking appears at all is in a list of things Substack is considering for later.

A post that treated distribution as part of the problem would have said so somewhere. This one, as published, puts the problem entirely with the people posting.

The instrument, and who pays for its errors

On July 20, thirty-six hours before the feature went live, Pangram founder Max Spero posted a response to deBoer. Pangram 3.3 works on segments of roughly 150 to 350 words and judges each segment as a unit. Put in 200 words containing 50 written by a model, and the system sees major signs of AI writing and calls the whole segment AI. His own assessment: not ideal, with architectural changes coming.

Substack’s own materials do not carry that caveat. The number a reader sees is not a proportion of the text, it is an aggregate of verdicts on chunks. A reader looking at 54% will read it as half, and half is not what it means.

Four days before the launch the company also published an explainer. It describes what the detector looks for: assistant models are trained to produce helpful, clear writing, and those preferences are ingrained deeply enough that they surface anyway. It also describes what it compares against. The corpus of known human text is drawn exclusively from 2021 and earlier, before AI reached the open internet. Pangram states this plainly and adds that language drifts, that adjustment will be needed, and that the problem sits among its research priorities.

So the question the instrument asks is narrower than the one readers think they are asking. It is whether this reads like a person writing before 2021, or like a helpful, clear assistant. Someone producing clean organized prose in 2026 is measured against a reference class that closed before these tools entered ordinary writing practice.

A writer is not misclassified for sharing a device with ChatGPT, and visible tells such as the em dash are one signal among hundreds of thousands. The writers currently pulling dashes out of their drafts and second-guessing phrasing they have used for a decade are doing it against nothing the system counts.

deBoer had already shown what the segmentation does in practice. A 300-word section of one of his old posts came back as 100% AI with high confidence, while the 5,000-word essay containing that section came back as 100% human with high confidence. He then produced a false positive on writing he did himself, on purpose, in about fifteen minutes.

The morning the feature went live, a writer named Ida-Emilia Kaukonen posted her own test, without naming the detector she used. Her own writing scored 79% AI. She then added text that was entirely machine-written, and the score fell to 54%. Transparency is fine, she wrote, but she is uncomfortable with the idea that she would have to destroy her voice further in order to not look like a machine. She signed it as a former mistress of em dashes, a habit she gave up ahead of a verdict that was never watching for it.

Spero’s defense of induced false positives is that any classifier can be tricked, and he reaches for airport scanners and stop-sign detection. The analogy breaks at the point that matters. A scanner alerts an operator, and a person opens the bag before anything happens to the traveler. Between Pangram’s verdict and its consequence on Substack there is nobody. The number goes to the reader and the writer wears it.

His second argument is that adversarial cases should be assessed separately from population-level false positive rates. As engineering that is correct. As experience it is worthless, because no writer ever encounters a population rate. They encounter one verdict, on one piece, once.

That verdict does not land evenly. A 2023 study in Patterns ran essays by non-native English writers through seven detectors and produced an average false positive rate of 61%, while essays by native speakers came back almost clean. Pangram was not among the seven. A peer-reviewed study from Vrije Universiteit Brussel did test it in June, on forty ESL-written academic papers of four thousand words and up, and found no false positives. That is the friendliest condition a detector gets: long documents, plenty of signal. Nobody has run the same test on feed posts of a hundred and fifty words, which is where the question is now being answered in practice.

Writers on this platform reached the paper before I did, among them JHong at Natural Intelligence and Sam Illingworth. A March 2026 preprint by Nathan Garland works out the bound for any text-only, one-shot detector and finds that a useful rate of detection forces a rate of false accusation, set by how much human writing and machine output overlap across a diverse population. Garland’s point is that this constraint is independent of model quality and cannot be engineered away, and that it falls hardest on identifiable groups, which gives the 2023 measurement a theoretical floor rather than a vendor to blame. The paper is a preprint by a single author arguing about university assessment, so treat it as an argument rather than a settled result. Its central assumption transfers here with room to spare: a teacher has at least seen the student’s earlier work, and a reader pressing scan on a writer they have never read before has nothing.

Garland’s own recommendation is that a detection score should not be the sole evidence in a misconduct proceeding. On Substack the score is the only evidence there is, and there is no proceeding.

What the score does after that has been measured, though not on detectors. A pre-registered experiment by Haoran Chu and colleagues put fabricated college applications in front of 644 US participants and recorded who they took for a machine. Two findings carry over. International students were more likely to be read as AI users, especially when their writing carried features that sound machine-made. And once a reader attributed the text to AI, their assessment of the applicant fell on competence, sociability, morality and future success.

That study measured people rather than software. Substack’s tool does not deliver a judgment. It delivers a number to a person, who then makes one.

A couple of years back we built text generation for a client. Every review came back the same: slop, machine garbage, do better. At some point we sent them one of their own articles, written by their own people before any of this existed. Same review. Slop.

One client, one article, no control group. It stayed with me anyway.

The same shape, somewhere else

This is a rhyme rather than a proof, and I will mark it as one.

ICLR submissions have roughly tripled in three years, and the review pool was filled largely out of the authors themselves. Pangram scanned this cycle’s reviews and found about 21% fully machine-generated. The conference responded by running detectors and desk-rejecting offenders. I can find no announcement that the reviewer load itself was changed.

One is a commercial platform monetizing attention and the other is volunteer academic labor under career pressure, so the cases are not equivalent. What they share is the sequence. Volume grows because the structure rewards it, synthetic output appears where the volume outruns the humans, and the institution buys detection from the same vendor rather than touching the structure. In neither case has anyone published evidence that detection reduced the synthetic output at all.

A flag is not a judgment, and the people who can tell one from the other are the expense every institution in this pattern is trying to avoid. Security tooling reached that wall first.

What is fair to say

Substack is the cleanest large feed in Pangram’s data, and I would rather write here than on the alternatives. Spero answered his critics in public and in detail, which is more than most vendors manage under pressure. deBoer, whose findings sit at the center of this piece, calls Pangram a useful tool and says he is not telling anyone to stop using it.

The claim that survives all of that is narrow and holds anyway. A platform promised in 2023 that its feed would reward quality over engagement. It then spent two years publishing instructions on cadence and reciprocity, with its own numbers attached. The output arrived on schedule. When it arrived, the company shipped an instrument that inspects writers and priced the labor to readers. It never once named the machine that set the terms.

Where I stand

I owe you to share where I stand in this story.

I use AI. There are sighs in the hall, women pass out.

I never was against AI as a tool. What I am against is the delegation of thinking and judgment, the lack of output validation, hype, and CEOs’ bullshit. AI can write good text, and humans can write bad text. The tool does not affect either side, it is the point.

I use models for research purposes. Without a tool that vacuums up 500 sources and proves or disproves my idea, I would not be able to write because I cannot handle such a volume of info. Validating each number, each quote, takes so much time that the only choice I would have is between silence and opinion.

Another shocking piece of information: I’m using Grammarly. English is my third language, and I’m very strict with myself about publishing anything without editing. The alternative on offer is that people working in a second language should write less, or not at all. I’ve been using Grammarly since December 2021, almost a year before ChatGPT appeared. The product has added the gen AI functionality over the years, but I do the same as I did five years ago: fix my grammar and sentence structure.

I did not change my approach, but classification changed. The thing that was text editing in 2021 is flagged as AI-assisted in 2026, and a person who does the same five years in a row accidentally finds himself in a new category without any choice.

That human oversight is the main difference between slop and something meaningful, and I know it not from commentary battles. I see this every day in my codebase. The model is capable of producing as much sense as a human could squish out of it, and the result depends on someone who made the judgment.

My team in Ukraine writes in English with this smooth, accurate register, which the whole industry treats as suspicious right now. Not because anyone is cheating, but because a person who writes not in his native language does it more neatly. And in our culture it is normal to be direct, without hedging and word fillers, a register that now reads as machine-made.

Someone can say, aha, little bastard, you are using AI, so you are against the AI checker, tiny slop maker! Read the article one more time; I did not say anything about what side I took. I do not take part in this fight. I did not mention that the AI detector is bad; I just said that the platform did everything to bring the slop here.

I do not know which score the AI detector will show for this text, and I don’t care. I know that the bill will be bound to my name.

And if you think that it is my real voice, you are wrong. The Tech Trenches voice finished one section above.

Subscribe now

Once there were five little pigs, and each was handed the best building materials in the history of the trade. Money without limit. A brand a billion people already knew. Silicon nobody else could fab. The deepest research bench on earth. Three of them built out of straw. A fourth could have built in brick and laid straw anyway. The fifth inherited a brick house with the lights already on and set it on fire. When the wolf came to the door, the loudest of them answered by demanding that someone forbid him to blow.

The wolf is at the door, and his blueprints should frighten the pigs more than his teeth. He built a better house than any of them, on a fraction of the money, with sanctions tied around his hands. I traced how China poured the physical floor under this whole race in China Built the Grid, so I will not re-lay the watts here. The part that matters for the pigs is simpler. China closed most of the gap with the Western frontier this year despite being cut off from top-tier US chips, watching Nvidia’s share collapse toward single digits as Beijing steered its champions onto domestic silicon, and spending an order of magnitude less real money than OpenAI and Anthropic raised between them. On the benchmark that best tracks paid coding work, the open-weight gap has narrowed to almost nothing: Zhipu’s GLM-5.2 leads the open-weight field on SWE-bench Pro and runs at roughly a sixth of the cost of the American frontier. The wolf laid brick, quietly, the whole time the pigs were laying straw.

This is the tour of the straw.

The pig who fell asleep

Sam Altman had the longest lead and the deepest pockets. ChatGPT is the default AI for roughly a billion people a month, the brand every rival measures against. Having filed confidentially to go public at a valuation reported near a trillion dollars, he is also losing billions in cash to run the place.

He spent the lead on side quests. Sora, the video app, bled cash and drained compute before it was shut down about six months in, a billion-dollar Disney deal dying on the way out. Atlas, the browser, never left macOS and gets switched off about ten months after launch. The hardware built with Jony Ive has yet to ship at all, with OpenAI’s own filings pointing to no device before early 2027. The label is not mine. OpenAI’s own head of applications pushed to cut what she called side quests, telling staff the fragmentation was dragging on the quality bar.

The hare with the biggest head start spent it running the story of the lead instead of the lead. The deeper charge, the contradictions between what he founded OpenAI to prevent and what he now sells, belongs to a separate reckoning; here the point is simpler. He built his house of straw and told everyone it was the tallest house in the world.

The pig who fouled his own name

Elon Musk had real iron. Tesla compute, Starlink, and the Colossus clusters in Memphis pouring actual power. Since February 2026 he has had xAI too, folded into SpaceX as a wholly owned subsidiary, so the rockets and the AI now share one balance sheet and one IPO. He also had the loudest exit story in the business, and I took that apart in Nobody Answers, where the deadline that never lands turned out to be the product he was selling all along.

This summer the market read him the same lesson. SpaceX priced the largest IPO in history in June, spiked by two-thirds within days, then gave it all back and slipped below its own offer price inside six weeks, a sell rating and meme-stock comparisons trailing behind. The escape hatch, priced live and marked down before the lockups even lifted.

The deeper damage is not on the ticker. xAI lost 6.4 billion dollars in 2025 on 3.2 billion in revenue, more than quadrupling the loss in a year. Then the model made its own headlines, generating a flood of sexual deepfakes that got Grok temporarily blocked in two countries and brought a cease-and-desist letter from California. That mark sets harder than any of the other four. Grok is now the AI you reach for a laugh. That is a toxic reputation to carry into enterprise sales, and it is the one kind of straw you cannot quietly swap out later.

Less than a week after the IPO, xAI’s parent, SpaceX, agreed to buy Cursor for 60 billion dollars in stock. Cursor gave it an immediate position in the enterprise coding market. It reads like a clean door into the market Grok’s own reputation had made harder to enter. The others wasted a lead. Musk stained the product, then put 60 billion dollars behind an escape from the stain.

The pig who charged the most

Dario Amodei drew the cleanest hand of the five. The most trusted lab, the reputation as the adult in the room, and a lead he had earned: Claude Opus 4.5 shipped in November as the first model past 80 percent on SWE-bench Verified, ahead of everyone. I held Anthropic up myself, in earlier pieces, as proof you could be principled and still win.

Then he spent the hand on fear. That his warnings always land on everyone else’s product and never on the closed model Anthropic invoices for is a pattern I traced in Dario Altman, so here I will follow the money instead. The way you defend a lead is by driving cost down through better engineering, which is exactly what the Chinese labs are doing. Fable 5, Anthropic’s flagship, went the other way. It lists at 10 dollars per million input tokens and 50 per million output, the priciest widely available model on the market, roughly double its own Opus and several times what Gemini or GPT charge, weights kept closed. When a government order briefly cut off foreign access, its whole value proposition went with it, because the open Chinese weights a rival ships run on your own hardware with no vendor to pull the switch.

The price is harder to bring down, and the reason sits underneath it. Anthropic is building some infrastructure of its own, but still depends on other companies for much of its frontier capacity: a SpaceX compute agreement worth nearly 45 billion dollars over three years, up to a million TPUs and well over a gigawatt from Google, and up to five gigawatts of Trainium capacity from Amazon. By July it was also in talks to lease up to 10 billion dollars more of compute from Meta over two years. Every one of those suppliers sells a model that competes with Claude. By Amodei’s own math, being off by a year on growth is enough to bankrupt the company, so a lab buying frontier capacity from its rivals at that scale starts any price war at a structural disadvantage. The lead was supposed to be the moat. Once Chinese open weights closed the coding gap, the model-performance moat had largely gone. What was left was a lab charging the most for a model whose measured edge had narrowed, while paying its own competitors for much of the ground it stood on. The adult in the room turned out to be a tenant.

The pig who could have won

Google is the strange pig, because Google, alone of the five, can build. Its own TPUs, the same silicon it rents to Anthropic by the million. A research bench as deep as any on earth. Gemini 3, a model that trades blows with the frontier. Distribution through Search, Chrome, Android, and Workspace that nobody can match. Of all five, this is the one that could have won on merit, no straw required.

Which is why what it did is the sharpest waste of the set. Gemini trails Claude on the coding benchmark that tracks the paying work, and where developers spend money, on the agentic tools, Anthropic and OpenAI own the market. So the number Google leans on, its share of chatbot traffic, rests on the one asset regulators have already moved against. It pushes Gemini through Search and Chrome, the same kind of default-placement conduct a US court ruled an illegal search monopoly in 2024, while Brussels separately fined it 2.95 billion euros in 2025 for abusing its dominance in ad tech.

Then, instead of closing the gap where the money is, Demis Hassabis went and asked for the wolf to be muzzled. In July he proposed a standards body to gate frontier models before release. The one pig who could have built in brick called for a fence around the yard instead. A company already ruled an illegal monopolist, offering to hold the whistle for everyone.

The pig who burned his house down

Mark Zuckerberg is the only pig who did not squander a lead. He torched one that was already built.

Meta had the best open research lab in the West in FAIR, the strongest open answer to China in Llama, PyTorch running under a huge share of the industry including its rivals, and Yann LeCun, one of the three men who built modern deep learning. That is not a pile of straw. That was a brick house, standing, occupied, the envy of the street.

He set it alight, and he started before the lab was even cold. In June 2025 Meta paid 14.3 billion dollars for a stake in Scale AI and installed its founder, Alexandr Wang, as chief AI officer, a bet the culture it had spent a decade building could no longer be trusted to deliver on its own. The house came apart around the new hire. FAIR was folded into a superintelligence org under Wang and subordinated to product, and LeCun, ordered to report to a man half his age, announced his exit in November to start his own lab.

Zuckerberg had lit a fire this size before. Reality Labs, the bet he made years earlier, has by now lost north of 80 billion dollars, more than 6 billion in a single quarter against under a billion in revenue. The same instinct that poured a fortune into an empty headset later tore up a working research lab. I wrote about what happens inside a company that strips its own engineering judgment for a metric in Green All the Way Down; this is the strategic version of the same fire.

The clearest picture of a lost lead is this pig: he knocked down the only brick house on the block, then, even if partly to monetize the compute he was left holding, began negotiating to rent it to the rival whose model beats his own.

What the pigs did next

Five different failures. Three of them converged.

The mechanisms do not rhyme. Altman scattered his lead, Musk fouled his brand, Amodei priced himself into a corner, Google buried a real advantage, Zuckerberg torched a working lab. The through-line comes after the waste, in what three of them reached for once the wolf closed in. Altman, Amodei, and Hassabis spent this same season asking for a gate on their own market, each in his own shape: a federal agency that could block a model on day one, a FINRA-style standards body, an international forum modeled on the nuclear watchdog. Three doors, one instinct. When Hassabis published his, Anthropic’s own policy lead called it excellent. Two of them had already crossed part of that line: in June, Altman and Amodei shipped frontier models through government-approved access lists, an early version of the permission structure they had advocated. Why a gate funded and shaped by the labs it inspects is a moat rather than a safeguard, I took apart in We Pay You to Slow Us Down. Musk and Zuckerberg never signed that petition; they wasted their advantage in other ways. But the three loudest voices in the room, facing a competitor who built faster and cheaper, answered by petitioning for a rule against the wind.

The cold part

For most of the era of commercial computing, the frontier has been led from the United States. The foundations were not all American, Turing and Zuse and Colossus came first, but for two generations the lead in the technology that defined the age has sat in America, through every panic that it might not. Japan’s Fifth Generation project frightened Washington in the eighties and the feared handover never came. It is closer now than it has ever been. The wolf did it the hard way, poorer and boxed out of the best chips, building in brick while the pigs laid straw and called it innovation.

I am Ukrainian. China is an ally of the country trying to erase mine, and I want it to lose this more than most people reading do. That is exactly why I will not pretend it is losing. The floor is his, the gap is closing, and the five who were supposed to hold the lead spent it on a video app, a fouled brand, the priciest model in the game, a whistle, and a bonfire.

Even the wolf has a ceiling. Moonshot shipped Kimi K3, the largest open model yet, and within 48 hours it had frozen new subscriptions because its GPUs could not serve the demand. It hit the same wall OpenAI hit when its image tool went viral and Altman said the GPUs were melting, and the wall Anthropic hit when it switched the meter on Claude Code. Copying the weights is easy. Serving them at scale takes hardware nobody has enough of, in any country. For now the frontier labs hold the one edge left to them, the serving compute they secured years ago. It is a thin edge to lean on, because chips become served tokens only through power, and power is the foundation China already poured while the West argued about permits. The wolf that just hit the ceiling is standing in the one house wired to raise it.

The wolf is not fated to win. In the old story the pigs beat him the moment one of them built in brick. The brick is on the ground in front of all five. Three are reaching for the rulebook. The other two are still standing in the ruins.

Every proposal to regulate frontier AI runs into the same problem: you have to trust the regulator. On this market I am not sure I would trust an independent one, with every month of delay carrying enormous competitive value and every lab racing the release after this one. Demis Hassabis, on July 14, proposed something that does not even clear that bar. His Standards Body would be funded by the labs it inspects. Funding, he writes, “would need to be substantial and likely mostly come from industry.” The regulated pay for the regulator. That gives the industry a say in how much obstruction the regulator can sustain.

The proposal is serious and it is not fringe. Hassabis runs Google DeepMind, and he briefed G7 leaders before publishing. Sam Altman has wanted a version of this since 2023, when he told the Senate the government should weigh “licensing or registration requirements” for AI models “above a crucial threshold of capabilities.” Gary Marcus endorsed it. The instinct is not wrong: something should gate a nuclear-weapons-capable model before it ships. The question is who holds the gate, who pays them, and who writes the test they administer. On all three, the proposal hands the keys to the same labs it claims to be checking.

Three Handles on One Pump

Start with the money. FINRA, the body Hassabis names as his model, is the self-regulator for American brokerages, funded by the firms it polices. Its 2024 financial report shows $1.62 billion in operating revenue, including $958.8 million in regulatory revenue paid by member firms. Fines added another $66 million separately. The firms pay the examiner’s salary. Andrew Tuch, a law professor at Washington University, read every FINRA disciplinary case from 2008 to 2013: its rules reach investment bankers, but across that window he found eighteen sanctioned, and not one for advising on a public merger or a registered offering. He called the self-regulation of investment bankers a failure. This is the model, presented as the safeguard.

The money is the first handle. The test is the second. Hassabis writes that the benchmark evaluations “would be developed in consultation with Frontier Labs,” and that only “eventually” would the Standards Body build the capacity to create its own held-out tests “independent of the Labs to prevent overfitting.” The labs help design the exam they will sit, and the independent version is deferred to a later date the proposal never fixes. A company that helps design the early questions has shaped the instrument before it is ever measured by it.

The threshold is the third handle. A model counts as “Frontier-class” when it crosses thresholds “determined by the Standards Body and regularly updated.” Hassabis says that board should seat “independent leading technical experts and open-source representatives,” not lab executives, and the body, not the labs, sets the line. But the labs fund it and help build the first tests the threshold is read against, so the incumbents hold real sway over the machinery long before any independent version exists. That is influence over where the line falls, not a seat that formally draws it, and it does not require bad faith. Hand any industry a regulator it funds and helps equip, and the outcome tilts the same way whether the people involved are cynics or saints. Three handles on one pump, and every one runs back to the firms the pump is supposed to regulate. The structure does the work.

The Thirty-Day Gate

The reason the structure matters now, and not as a civics-class abstraction, is the size of the number sitting on the other side of a delay. The four largest hyperscalers guided to roughly $725 billion in 2026 capital spending, largely directed at AI infrastructure. Hassabis proposes that Frontier Labs initially share models with the body up to thirty days before release. Once the protocol has proven itself, passing the assessment could become mandatory for deployment in the US market.

Thirty days. At that scale a thirty-day hold is a competitive window every lab has reason to fight over, and a body the industry funds and helps equip is the mechanism that decides whose thirty days get held and whose do not. But money is the smaller motive. The larger one is on the other side of the Pacific. Chinese open-weight models now sit within striking distance of the Western frontier, and they ship as weights anyone can download, run, and keep. I traced that gap and why it barely shows up where engineers actually work in an earlier piece. A released Chinese model is a lever nobody can pull back, and a US gate can deny it formal deployment in the American market but cannot stop it releasing everywhere else. A gate framed in the language of national security still does two jobs regardless of anyone’s intent: it gestures at a real adversary, and it locks the American market onto the companies that hold the closed frontier. The safety case carries real weight, which is what makes it the load-bearing half of a structure whose other half is a moat. The conflict sharpens further if the state also takes equity in the companies it regulates, a risk worth naming given reported talks over an OpenAI stake.

Subscribe now

The Exam Filters for Size

Say the body is honest. Say every person on it is incorruptible and the equity talks go nowhere. The structure still breaks the same way, because a compliance regime is a fixed cost, and fixed costs are a tax that scales inversely with size.

A widely cited 2010 study for the Small Business Administration put federal regulatory cost at $10,585 per employee for firms under twenty people, against $7,755 for firms over five hundred. Those are economy-wide numbers, and contested ones, but the direction is the mechanism that matters here: the burden is heaviest where the headcount is smallest, because the paperwork does not shrink with the company. A thirty-day pre-clearance review, a compliance team to manage it, a policy staff fluent in the benchmark process the incumbents helped design, all of it is a rounding error for a lab that helped write the rules and a wall for everyone underneath. OpenAI grew its global-affairs team from three people to thirty-five in eighteen months. Cédric O, co-founder of the French lab Mistral, put the other side of it plainly while fighting the EU AI Act: Mistral was a company of roughly twenty people, he warned, and a heavy enough burden could kill it.

Now watch what the threshold does over time. “Frontier-class” is pegged to compute and capability benchmarks that the body will, in Hassabis’s words, regularly update. But the compute needed to hit any fixed capability falls fast. Epoch AI estimates pre-training efficiency roughly triples every year, so a line drawn today to catch the biggest labs sinks toward a garage team’s reach within a few years unless someone keeps raising it. Hassabis says the body will keep raising it. The capture thesis says the incumbents who fund the regime and supply its tests have every incentive to let the line drift down into their smaller rivals instead, and a provision to update the threshold means little when the people who benefit from a slow update are the ones underwriting the updater. The exemption Hassabis offers, that “non-frontier models, say from startups or academia, would be exempt,” is real only until the startup succeeds. Cross the line the body maintains, on an exam the incumbents helped design, and you enter a regime built to a scale you do not have. And the weights that let a startup or a rival catch up from below, the open ones anyone can run, are precisely what a “Frontier-class” threshold pulls into pre-clearance first.

This is where the closed-frontier labs stop being rivals. They compete ferociously on models and price, and they share one exposure none of them can fix alone: the open-weight model that needs no vendor at all. Here the safety case and the moat come apart. An American open-weight lab can submit to pre-release review like anyone else, so the regime does not stop domestic open weights, it taxes them, wrapping a thirty-day hold and a compliance burden around a model whose whole value was that anyone could take it and run it now. A US gate cannot prevent a foreign lab from releasing its weights. At most it can deny that model formal deployment in the American market after the file already exists everywhere else. The gate cannot prevent the foreign release most useful to its national-security case, but it can impose a delay and a compliance burden on the domestic open-weight competitor still within its reach. What it builds is a members’ club with a moving door, cartel-like in its structure: fierce rivalry inside, a shared wall against everyone outside, and the wall built first around the models nobody owns. The tell that this reads as capture and not only safety is Meta, big enough to sit inside that circle and choosing the other side of it, shipping among the most capable open weights the West has. A capability-pegged regime imposes a burden on Meta’s open-weight strategy that closed labs do not face in the same way, which is why Yann LeCun was warning about exactly these companies in 2023, calling their lobbying “a regulatory capture of the AI industry” and naming Altman, Hassabis, and Amodei while he did. He was aimed at Biden’s executive order then, but the concern is the same: closed labs shaping the rules that bind everyone below them.

What Would Make It Real

A model that can walk someone through a weaponized pathogen should not ship on a Tuesday because the quarter is closing. The instinct is sound. The design is captured.

Three changes would tell you the difference between a safeguard and a moat. Fund the body from appropriated public money instead of member fees, so the examiner does not draw his salary from the examined. Build the independent held-out tests on day one instead of “eventually,” so the labs are not helping design the instrument used to assess them. And put the threshold’s methodology, its update cadence, and the conflict-of-interest rules into statute or public rulemaking, so the line that defines who gets regulated is governed by a process nobody’s funding can quietly bend, rather than by a body the incumbents pay for. Hassabis’s proposal does none of the three. It funds the regulator from industry, builds the first tests with industry, and leaves the threshold to a body industry underwrites. FINRA was sold the same way, as the grown-ups policing their own so the government would not have to, and it shows that serious enforcement blind spots can persist for years inside an industry-funded self-regulator.

Cutting the labs out of the instrument draws the obvious objection: the people who know how to test a frontier model for weapons capability are the people who build them, and much of that expertise currently sits inside the companies being regulated. Expertise can be bought without being borrowed. Put those engineers on the body’s own staff, paid from public money and bound by the conflict rules any examiner carries. I would take that job, and so would plenty of engineers who spend their days shipping and reviewing this stuff. Pay enough, and qualified engineers will take the job. No one who stands to be measured should have a hand in building the ruler. Consultation with the company you are about to inspect buys access and calls it expertise.

So weigh the two halves honestly. The Chinese threat is real, the safety case is real, and a released model no one can recall is a real problem with no clean answer. Set all of that on one side. On the other side is a body the same labs would fund and help equip with its first tests, wrapped in the language of an adversary who genuinely exists. The pitch is that the labs are mature enough to be trusted with the machine that checks the labs. The tell is that they wrote the check.

Orwell gave us a Big Brother who watched you. This one is quieter and runs the other way. The big lab pays the man who signs the certificate that it is responsible enough to stay big.

Gary Marcus has been calling the moment the US AI industry starts to break, and a fresh round of cheap Chinese open models is, to him, the evidence it has arrived. His case is three years old and it has not changed: no moat, free copies, prices to zero, and eventually the trillion-dollar IPOs stop penciling out. The only part he updates is the evidence. He is right about all of it. He is also looking at the wrong floor. The margin collapse he describes is the symptom. The disease is physical, and it sits a layer below the price war he is watching.

In 2025 China added 434 GW of wind and solar. The United States added 53 gigawatts of new utility-scale generation and storage. Those are not the same category, and I am not going to pretend a gigawatt of Chinese nameplate solar is a delivered gigawatt wired into a data center. The claim underneath is narrower and harder to wave away: one country is building enough capacity to treat power as a substitute for better chips, while the other is adding capacity into a grid that still cannot connect it fast enough.

Chips Have Shortcuts. Power Doesn’t

A chip deficit has shortcuts. Huawei just proved the crudest one, packing roughly five times as many mediocre Ascends into a rack-scale system until a single superior Nvidia die stops being the only route to frontier compute. Tighter code and smarter architecture are the quieter versions of the same move. Each one buys its way around the chip by spending more power.

A power deficit has no shortcut. New generation, new lines, new substations all take years and physical construction. I spent four years working through Russian strikes on the Ukrainian grid, and the lesson that stays with me is simple: electricity sits under everything else. When it goes, the models and the chips and the funding rounds are worthless at the same instant.

That is the asymmetry the whole race turns on. One side can buy its way around a worse chip by spending power it has in surplus. The other side cannot buy its way around a grid it has not built.

What China Poured

China spent the year on the side of the asymmetry that cannot be optimized away. Its energy administration reported 315 gigawatts of new solar and 119 of wind, both annual records, pushing wind and solar past thermal power in the national installed base for the first time. Chinese industrial power runs slightly higher per kilowatt-hour; price was never the advantage. Panels and turbines go up by the trainload, and the country has far fewer independent actors with the standing to keep a prioritized project stuck. The same system that green-lights a national project cannot stop a useless one, so China will pour concrete for data centers that never fill. It wastes the resource it has, not the one it lacks. The buffer does not rest on panels alone: the same year brought nearly 40 reactors under construction and a growing thermal base beneath the renewables, firm power that runs whether or not the wind blows.

It is the electric-vehicle script, rerun. A decade of subsidies handed BYD and CATL the global market, and a Stanford analysis found China kept 92 percent of the welfare gains at home. The same instruments now point at compute. Local governments in Gansu, Guizhou, and Inner Mongolia cover up to half the bill for data centers, on the condition they run on domestic chips rather than Nvidia. A draft national computing plan, reportedly worth nearly $295 billion, would mandate that 80 percent of its chips be domestically produced.

The mandate is the part that should hold Washington’s attention longer than any benchmark. Nvidia, an American company, spent the year trying to sell into China and mostly failing, because Beijing told its largest firms to stop buying. The country’s internet regulator barred ByteDance and Alibaba from purchasing the China-specific parts Nvidia designed for exactly that market. Jensen Huang flew to Beijing, lobbied in Washington, and watched a market that once supplied a fifth of his data-center revenue produce, in his own CFO’s words, no revenue at all. When the world’s most valuable chipmaker is the supplicant, and the buyer keeps choosing its own slower silicon over a discount on better hardware, the dependency runs the opposite direction from the one everyone assumed.

China’s AI Plus directive, issued by the State Council in August, frames AI around labor shortages, dangerous work, and upgrading existing roles rather than deleting them. I am quoting policy, not proven outcomes. It subsidizes the power, builds the chips, and treats AI as a tool.

I am Ukrainian. China is a direct ally of the country trying to kill mine, and I have no warmth for it whatsoever. Hatred is not an analytical method. I have spent four years watching what happens to people who underestimate a competent adversary. China is doing this part right. Refusing to see it would make me a worse analyst.

America Built a Position

Set against China’s poured concrete, American capital spent the same window building compute on top of a physical layer it does not control. By the end of 2025 the ten largest companies in the S&P 500 made up 40.7 percent of the index, a record, with Nvidia the heaviest single weight since the data begins in 1981. The four largest hyperscalers guided to roughly $725 billion in 2026 capital spending, more than four times the entire US energy sector’s capital spending, on hardware that depreciates in a few years. I traced that buildout in detail elsewhere.

Jason Furman, who chaired the Council of Economic Advisers, calculated that investment in information-processing equipment and software accounted for 92 percent of US GDP growth in the first half of 2025, against four percent of the economy. He added the honest caveat that the counterfactual is not zero, since cheaper power and rates absent the boom would have lifted other sectors, maybe halving the effect. Even halved, a single category carrying 40 percent of national growth is an economy wired to one bet, and one financed increasingly on debt.

Dario Amodei, who runs the most financially cautious of the frontier labs, told an interviewer in February that being “off by a year” on the growth rate, or growing 5x a year instead of 10x, is enough to “go bankrupt.” When the careful one says a one-year forecasting miss can bankrupt a frontier lab, it says something about what the reckless ones leave unsaid. The same industry now cuts headcount to fund the chips while forecasting the displacement that spending will cause. Beijing’s policy points AI at the jobs nobody can staff. The American frontier, in practice, points it at the jobs people already hold.

The bet also runs into the same wall the rest of the buildout keeps hitting. Power. The US added capacity at a record pace of its own in 2025 and still cannot connect it fast enough. I have written before about how the grid became the hard ceiling nobody priced into the spreadsheets.

Europe Published a Strategy

There is a third party in this race, and it is the one that clarifies the other two. Europe has no frontier AI chip at scale, no hyperscaler comparable to the American four, and no frontier lab at their level. Its most advanced chips are Nvidia’s, fabricated at TSMC and Samsung, and its one indispensable asset, ASML, makes the machines that make everyone else’s chips, not a sovereign stack of its own. US providers run about 70 percent of European cloud. Europe’s answer, delivered in June, was a sovereignty package: directives, a sequel to the chips act, a target to triple data-center capacity in five to seven years, funded mostly by private capital it admits it does not have. The target deserves the trust its last one earned. When Ukraine needed artillery, the EU promised a million shells in a year against production that ran at a third of that, and delivered late. China poured concrete and America placed a bet. Europe published a directive about doing one of them someday. It never fielded a side, and that is the only reason it cannot be said to have lost.

Where the Lead Actually Is

The model gap, the thing the West still tells itself it owns, is real but narrowing, and it is narrowest exactly where the work happens. On Artificial Analysis’s index of general intelligence, Zhipu’s GLM-5.2 scores 51 and leads all open-weight models, within striking distance of the proprietary frontier. But in Morph’s vendor-score aggregate for SWE-bench Pro, a coding and agentic benchmark closer to what engineers actually ship, Claude Opus 4.8 leads GLM-5.2 by about seven points, 69.2 to 62.1, while the open model costs a fraction as much to run. That is a gap a research lab notices and a working engineer often does not. For a growing share of ordinary coding and text work, which is most of what anyone runs, the remaining gap is no longer commercially decisive. And the Chinese models carry an advantage no benchmark scores: they ship as open weights. You can run Qwen or GLM on your own hardware, fine-tune it, and deploy it with nobody’s API in the loop. A Western frontier model is a lever the vendor still holds. Released Chinese weights are a lever nobody can pull back.

The chip gap is real. Huawei’s fabricator, SMIC, is stuck around 7nm while TSMC builds Nvidia’s parts two or three nodes ahead, and policy cannot fix a lithography line on any useful timeline. What Huawei did instead was stop fighting on the die and start fighting on the rack. Its CloudMatrix cluster packs five times as many Ascend chips as Nvidia’s flagship server and matches it on aggregate compute and memory, burning nearly four times the power to do it. That trade ruins you where electricity is scarce. In the regions China has deliberately provisioned with excess generation and subsidized power, that penalty becomes one the state is willing to absorb. One cluster design does not solve China’s semiconductor industry. It is enough to keep domestic frontier-scale training strategically viable while Beijing pushes Nvidia’s local share toward single digits by declining to buy. The hardware question is being answered at the rack, not yet at the fab, and that is the layer where the training runs.

An American data center’s power waits on an interconnection queue, a regulator, and a dozen parties who can each say no. A Chinese one waits on a ministry that has already said yes. You can out-research a command economy on models and out-design it on chips. You cannot out-build it.

Subscribe now

Thirteen months ago, Slack made it a violation of its own terms to feed your company’s messages into a third-party AI model, and the reason it gave was privacy. In June it placed an AI model inside your Slack channels and called the feature multiplayer. Nothing about the data changed in between. What changed is who is allowed to read it, and what Slack decided to call the reading.

Here is the paperwork. On May 29, 2025, Salesforce wrote a new section into Slack’s API terms, under a heading called Data usage. As the provider of an application, you may not use API Data to train a large language model. Bulk export of message and file data was barred in the same stroke, and data collected from one organization could no longer benefit another. Law firms reading the full text added the rest of the cage: no persistent copies, no archives, no indexes. The stated reason was privacy and security.

What the ladder protected

The 2025 change had casualties with names. Glean, an enterprise search tool that indexes a company’s apps so staff can query across them, could no longer add Slack messages to its permanent index. Access narrowed to a query-by-query basis, and Glean emailed customers that the change would hamper their ability to use their own data with the AI platform they chose. Internal copilots built on Slack archives had to be redesigned or retired. The stated principle was privacy: your Slack conversations are yours, and outside models do not get to ingest them. That principle had a hole from the start. Slack’s own AI, shipped in 2024, already read the same message history to write summaries and answer searches, hosted on Slack’s own cloud. The 2025 rule pointed outward, stopping rival models while Slack’s own kept reading.

Not everyone bought the privacy framing at the time. Wyatt Mayham, who runs an AI consultancy, told Computerworld the move felt like Salesforce “pulling up the ladder.” He named the other reading in the same breath: a step toward Slack data becoming a monetizable asset, dressed as protection. Multiple law firms advising clients on the change reached the same conclusion, that restricting outside access let Salesforce keep valuable conversational data for its own AI position. In May 2025 that was a prediction. It is no longer.

Thirteen months later

On June 23, 2026, Anthropic and Slack launched Claude Tag. It puts a shared @Claude inside a Slack channel as a persistent member that reads history, builds memory, and works on tasks for hours. Rob Seaman, EVP and general manager of Slack, told Reuters the point is that Claude shows up in the open instead of a private back-and-forth. He called it multiplayer.

What moved between the two years was the identity of the model doing the reading. When it belonged to an outsider, Slack called the access a privacy risk and barred it. When it belongs to a partner Salesforce chose, the access becomes a feature. The exposure is identical. The only thing swapped was the reader, from a barred outsider to an invited partner.

Salesforce said the strategy out loud in 2025. Rob Seaman told Salesforce Ben that Slack was not blocking outside AI altogether, and that the aim was for Slack to become the hub for AI, whether Salesforce’s own or a partner’s. The 2026 launch is that plan arriving. Anthropic is the named partner.

What you are turning on

Tagged in a channel, Claude Tag works from the channel’s history, not only the message that summoned it, and it keeps that context over time. With an administrator’s permission it learns from other channels and connected systems on its own, and it can act without being tagged, on a schedule it sets. Cat Wu, who runs product for Claude Code at Anthropic, told Reuters she gave her own Claude Tag access to her Gmail so it reads her mail and flags the senders who matter.

So a coworker-shaped AI reads what a coworker reads: the thread where two leads stopped speaking, and the message about a manager someone wrote at the end of a bad day and assumed would scroll out of memory. That is where the real org lives, the version that never reaches a system of record. It is why the feature is useful and what it now holds.

What you are signing

When you flip it on, you become the data controller under GDPR, and Anthropic and Salesforce become your processors. The lawful basis, the notice to staff, and in most cases a Data Protection Impact Assessment under Article 35 are your obligation, not the vendor’s. For a feature launched weeks ago, I would be surprised if many teams ran it first. In March 2026 the European Data Protection Board opened a coordinated action across twenty-five authorities on a related front, whether companies tell people their data is being processed at all. There is no opt-out for the individual employee. An administrator invites Claude into the channel; the person who wrote the message has no switch.

Under commercial terms the content is not used to train, and it is held thirty days by default, with zero retention available to enterprises who ask. Read those as what they are: settings the vendor controls, not laws of physics. Not used to train does not mean not copied. What happens to a vendor’s copy when a court comes asking is its own problem, and the short version is that court orders have compelled data vendors considered deleted.

You are not signing today’s terms either. You are signing Salesforce’s right to rewrite them, which it has already used once in thirteen months. When it changes them again, two things happen. Some admins will not read the update and will click through. Others read it, understand it, and click through anyway, because by then the tool is load-bearing and ripping it out costs more than accepting the new terms. That is how lock-in works, and it is working.

The contradiction

Salesforce raised the wall in 2025 and told you it was for your protection. It lowered it in 2026 and told you it was for your productivity. It is the same company and the same data, under the opposite verdict. The model now reading your Slack is one Salesforce shook hands with, where an outsider would have been barred. I do not know the terms of that deal, and neither does anyone outside the room. Whether it was planned in 2025 or improvised when a good partner arrived, I cannot say. The contradiction I can say, because it sits in Salesforce’s own terms, written down twice, thirteen months apart.

From archive to analyst

You might say Salesforce already held all of this, and it did. The messages, the files, the shared drives sat on its servers for years, and nothing burned down. Holding data and making sense of it are two different capabilities. An archive waits for someone who knows what to look for. That person is expensive. Claude Tag removes the cost. It reads across channels, keeps what it finds in memory, and acts on it without being asked. The material is the same as it was. What changed is that pulling meaning out of it stopped being expensive. In “Cost of Reading” that cost fell to zero for the state. This is the enterprise paying to make it fall on itself.

The contract you did not sign

The exposure does not stop at your own Slack. I lead engineering at an agency, and we send other companies contracts, specifications, and source code, under agreements that bind two parties and no one else. The day a counterpart points one of these agents at the channel or drive where that file sits, a model that signed nothing starts reading it. The NDA still binds the company. It says nothing about the reader an administrator can invite into the room, and the sender is never asked.

The same shape ships at every major vendor. Microsoft calls its Teams equivalent the Channel Agent, OpenAI calls it Workspace Agents, and each operates as an admin-added member that works across channel context and acts on its own schedule. Switching vendors does not close the gap. It renames it.

So the question a partner has to answer has changed. For years it was whether their people could be trusted with what you hand them. Now it is who their administrator let into the channel, on a console you cannot see. Salesforce picks the partner, an admin picks the toggle, and the employee picks nothing, the same asymmetry of choice that falls on whoever sits furthest from the switch. You sign something with the company. You sign nothing with the model it hired to read you.

If you have turned one of these agents on, you did not only volunteer your own Slack. Depending on the channels and drives an admin connected, you may have volunteered documents that other people sent you in confidence. Your partners were not asked, and most were not told.

The document that gives orders

When a model takes in a document, it can read the words as content and also read them as instructions, the first entry on OWASP’s list of risks for LLM applications. I walked through that list from the trenches in Only Your Engineers. The indirect form is a file carrying a line written for the model, invisible to the person, that the model then executes. Claude Tag holds memory, acts through connected tools, and runs on a schedule it sets, so a planted instruction does not have to fire the moment it lands. It can wait in the agent’s context and act days later, in a session that looks clean. I traced this attack surface at length in The Security Nightmare.

So a document sent to a partner arrives as two things at once: something their model reads, and something their model can run. The sender never signed with that model. The productivity pitch does not mention that the file is now also an input.

Subscribe now

In June 2026 both men got handed the exact regime they had spent years asking for. Anthropic restricted Mythos in April through Project Glasswing, access limited to a vetted list. On June 26 OpenAI shipped GPT-5.6 to a small group of trusted partners, reported as roughly twenty organizations, each one approved individually by the US government, customer by customer, names submitted before access was granted. The first time an American lab released a frontier model through a government-managed access list. The scaffolding was an executive order signed June 2 that calls itself voluntary and states in writing that it creates no mandatory licensing or preclearance requirement. GPT-5.6 went through exactly that.

Both had spent three years telling Congress frontier models were too dangerous to release freely. In the summer of 2026 they were proven right in a sense they had not intended: the government agreed, and now decides who gets access to their product. Altman, whose model went behind the gate first, called the arrangement one that shouldn’t become the norm. The fence you lobbied for stops being the norm the moment you are the one standing behind it.

One of them has been afraid of the same thing since 2015. The other has believed six contradictory things in the same span. They run opposite operating systems, fear on a loop and conviction on a lease, and they arrived at that identical June by opposite roads. Opposite methods, one destination. That is the joke worth sitting with.

The man who is always scared

In July 2023 Dario Amodei told the Senate that open source models were going down “a very dangerous path.” His admirers share the clip now as proof of principle, because three years on the position has not shifted a millimeter. They are right that it hasn’t. They have not asked what the position actually points at.

It points at everyone else’s product. The warning lands on open weights, on Chinese labs that make export controls “even more existentially important than they were a week ago,” on Meta’s releases, on his own cyber model Mythos, which he announced in April 2026 was too dangerous to sell and then routed to vetted companies instead. The one thing it never lands on is the closed model Anthropic invoices enterprises for every quarter. Everything he does not sell threatens humanity. The thing he sells is fine.

I broke down the rest of that pattern in a separate piece, the withdrawn safety brake, the IPO filing, the warning published days after a raise that put the company near a trillion dollars, so I will not relitigate it here. What matters for this comparison is the shape. A fear that appreciates every time a rival ships for free, held so steadily that admirers mistake the steadiness for courage. He has pointed at every door in the building except his own, for three years, without blinking. Admirers call that integrity. It is aim. I loved this guy. What does that make me.

Share

The man who is always right, retroactively

Sam Altman has no such steadiness, and that is his method. He will tell you what the next raise needs and the opposite of what the last one needed, and he has been doing it long enough that the contradictions now form a complete set.

The charter is where it starts. Early in 2015 he called superhuman machine intelligence “probably the greatest threat to the continued existence of humanity.” Months later he co-founded OpenAI as a nonprofit whose patents would be “shared with the world,” structured so profit could never capture the mission. A decade on he was writing in his own essays that the company now aims past AGI at superintelligence itself, the threat quietly rebranded as the product. Every promise in that charter has since been spent, one at a time.

Openness went first, and OpenAI’s own court filings show it was always meant to. In a 2016 email the company itself released, Ilya Sutskever wrote that “it’s totally OK to not share the science,” and Elon Musk replied “Yup.” The name outlived the promise by a decade. GPT-3 closed, GPT-4 closed, the word Open left hanging over the door like a sign for a shop that moved.

The structure went next, and this time the money signed the order in daylight. The nonprofit became a for-profit with the profit cap removed, and SoftBank tied tens of billions in funding to that conversion being finished on schedule. The firewall built to keep capital from steering the mission came down because capital asked for it in a term sheet.

With the structure gone, the rulebook flipped. In May 2023 Altman sat before the Senate and asked for a federal agency to license powerful models, while OpenAI, per reporting on the EU’s own files, lobbied privately to soften the Act it praised on camera. Two years later, now that OpenAI is the one who would need the license, he told the Senate that making developers seek approval before release “would be disastrous.” Same chair, same committee, inverted testimony, and the only variable that moved was his market share.

And the man asking for all of it swore he was not in it for the money. Under oath in 2023: “I have no equity in OpenAI,” he does this because he loves it. No direct equity, the careful version, the one the indirect holdings through his other funds slid neatly underneath. By late 2024 the reporting had him discussed for a stake near seven percent, around ten billion dollars at the valuation of the day, on top of those holdings he had carried quietly the whole time. For love.

On jobs he ran the full loop himself, selling the world the line that engineers were finished and then announcing, once the freeze landed on real people, that he was “delighted to be wrong.” I followed that bill to the people who paid it elsewhere. Here it is one more entry: sold retail, refunded with a smile, no name signed to the correction.

I never loved this one. Call it one for one.

Share

Two engines, one exhaust

They are not the same man and they do not sell the same way. One is a compass welded to the competition, fixed on whoever ships next. The other is a weathervane bolted to a fundraising calendar, pointing wherever the quarter pays.

Walk out to where the money is, though, and the two roads pour into one lane. Both want a world where putting out a frontier model takes permission. Both want that permission granted through a process a near-trillion-dollar company can absorb and a free project cannot. The scared one gets there through fear that never rests, the slippery one through principles that never last, and they end up at the same regulator’s door asking for the same key. The product on the shelf is identical: permission they can afford and you cannot.

You are meant to pick one. The doomer who at least takes the risk seriously, or the builder who at least believes in abundance. Decline the casting. Choosing either has already conceded that the two men who got richest selling it are the adults in the room. The consistent one and the inconsistent one ended in the same lobby, asking for the same law, because that law was the only thing either of them reliably wanted.

Where I sit

So let me tell you where I land in their grand dangerous future. I am an old, gray, bad-tempered engineering manager who still reads every diff. I write code with one vendor’s model and review the plans with another’s, and I change my mind about which is which the moment the bill or the quality moves. Whatever license regime these two are drafting, it falls on the lab that trains the frontier model, not on the guy renting it by the token who can switch providers between lunch and dinner. It does not reach me. I am the customer, and the customer can leave.

So pass the law, gate the releases, make the frontier a club with a membership fee only the incumbent can pay. The day one of them decides this article earned me a ban, a Chinese open-weights model I can run on my own hardware will save the career of one bitter, complaining developer, and the part that actually ships will not notice the difference. From where I sit the capability barely moved a generation ago, benchmarks aside, so banish me and I will sulk over to whatever Google put out this quarter and keep going.

That is the punchline under all of it. They spent a decade selling the world a danger that was always out there, in the open models and the foreign labs and the uncontrolled release. The only thing their fence keeps out is the other one standing on it. Two men, one law, and neither of them is afraid of you. They are afraid of each other, and they would like you to pay for the fence between them.

Sue me. I will read the complaint in Kimi.

Subscribe now

Every AI security tool now sold to find your bugs comes with the same admission, usually buried in the fine print: it does not work without a human to check the output.

OpenAI and Trail of Bits put it in plain sight. On June 22 they launched Patch the Planet, which turned frontier models loose on 19 open-source projects in its first week and filed 64 pull requests. Their writeup describes the models producing a “firehose of security findings” that already-stretched maintainers have to sift by hand to tell the real vulnerabilities from the false positives. Trail of Bits engineers triaged every finding before it reached a maintainer, because the expensive part of the work is no longer the finding but everything after it.

That is what every tool in the category sells you: the finder, and the checker stays your problem.

The finders all keep the same scoreboard

By Dustin Childs’s count, Microsoft shipped 208 CVEs on June 9, a record. He has tallied them since 2017 and called it “by far the largest monthly release” in that time. In May, Microsoft credited 16 of its fixes to an internal system running more than 100 AI agents. Mozilla shipped Firefox 150 with 271 vulnerabilities flagged by a single model, folded into 41 CVEs in the advisory. Palo Alto ran frontier models across its own products and surfaced 75 issues in a month that normally brings fewer than ten. Anthropic scanned more than 1,000 open-source projects with its Mythos model and logged 23,019 issues, a number it reports itself.

Every one of those is a discovery count. None of them is a fix count, and none of them is a risk count. VulnCheck tracked exploitation of every 2025 CVE: about 1% were ever used in an attack. Knowing about a hole changes nothing until someone closes it. At zero spare capacity, a vulnerability you have logged and cannot patch leaves you about as exposed as one you never found, with a longer backlog to show for it. The machines are filling a queue, not draining one, and the queue is made of work, not danger.

The one job the machine cannot do

You could read the whole surge as good news. The code did not get more broken, the tools just got better at seeing what was already there. It is a comforting story, and it falls apart the moment you remember who else owns the tools.

The attacker runs the same scanners and the same models against the same code, and gets the same list of holes. I covered that side of it in the security nightmare earlier this year. Better discovery was never a defensive edge, because both sides discover equally. What differs is the position each side works from. The attacker works on one thing and controls the clock: they polish the exploit, confirm it fires, and spend as long as that takes, because a broken exploit is wasted effort. The defender controls none of it. AI writes new code faster than anyone can review it, and the tools flag holes in that code faster than anyone can confirm them. That is where breaches come from: generation outrunning review, on the one side that never gets to set the pace. I traced the same gap in green dashboards.

A finding is a claim: there is a bug here, in this code. That claim needs a name on it.

The model that raised it cannot be the one to sign off. It re-checks its own output, and that helps at the margin, but a system that could clear its own false positives at scale would not be producing them at this volume to begin with.

A security team reading the alert cold sees the pattern, not the function it lives in. Only the engineer who already knows that code can tell you whether the danger is real here.

OpenAI runs on exactly that premise. Its engineers work directly with each project’s maintainers, reproduce the evidence, and confirm findings against the real code before anything reaches the people who own it. Anthropic built the same kind of tool, Claude Code Security, on the same admission: its scanner re-examines each result to filter its own false positives, attaches a confidence rating, and routes every finding to a human to approve, and the documentation tells you to review each proposed patch before you apply it. Two of the largest labs in the world shipped the bug-finder, and both of them made the human who checks it the part the whole thing rests on.

All of that lands on one desk: the engineer who has to look at each machine-generated claim and decide if it is real. Take that person out of the loop and you have not bought faster security. You have wired a high-volume false-positive generator straight into production.

The gap does not close

Lightrun surveyed 200 engineering leaders and found that 43% of AI-generated code changes still needed manual debugging in production after passing QA and staging, and not one of them reported being able to verify an AI fix in a single deploy cycle. The automated pipeline trips over plain functional bugs before it gets anywhere near a security review.

You will hear that this is temporary, that one more model generation will catch its own mistakes and you will not need the human. Veracode tested over 100 models and found 45% of generated code carried a security flaw, and the rate held whether the model was bigger, newer, or more expensive. That number is what the wait-and-see case depends on, and it has not moved.

I traced that loop in the mirror: the model reproduces the broken code it was trained on, then the next tool finds the breakage and bills you for the cleanup.

Subscribe now

The job market is cutting exactly that person

So the obvious move would be to grow the one role that makes all of this output usable. The industry is doing the reverse.

The engineer with deep context on a codebase is the most expensive and least scalable input in software, and that is the input being cut, on the theory that AI now replaces it. The vendors already know it is the binding constraint. After scanning a thousand projects, Anthropic reported that the maintainers had become the bottleneck, and that finding the bugs turned out to be the easy part and fixing them the hard one. Of the high-severity findings it stopped to assess, a small share of everything it flagged, more than nine in ten held up as real. Accuracy does not rescue the defender. A true vulnerability nobody has time to triage or patch sits in the same queue as a false one. Its disclosure policy draws the obvious conclusion: it holds back how many findings it sends any single project, down to a rate its maintainers can keep up with.

The scarce resource was never the finding. It was the person who could confirm and fix what was found.

Gartner studied 350 firms in May and found the companies cutting hardest showed no improvement in financial returns. Forrester reported in January that many of the firms announcing AI-driven layoffs have no mature system actually ready to do the work of the people they let go.

The people who can tell a real finding from a false one are made slowly, on real codebases, over years. The tools are generating more work that only they can clear, and they are the ones getting cut.

From the trenches

I run this loop at small scale, and I will tell you what it actually costs.

We have two security review agents. One runs on ordinary changes and mostly returns false positives I clear by hand. The other covers the OWASP LLM Top 10 and runs only when a change touches model code, where the failure modes are different: prompt injection, improper output handling, excessive agency. Neither agent replaces the review. Both add to it. The honest description of AI security tooling in my shop is that it generates more things for a human who knows the code to go and check.

So the move that actually lowered our exposure came from the other direction. Less to find beats a better finder. We have been cutting dependencies hard, front and back. Snyk flagged Axios every single week, so we removed Axios entirely, and the alert stopped because the thing it alerted on was gone. Every dependency you delete is a stream of findings you never have to validate again. The cheapest finding to triage is the one that never enters your tree.

The same instinct governs what our models are allowed to touch. We keep their permissions as narrow as the task allows: only the systems they genuinely need, and read access wherever reading is the whole job. A model that queries a database gets its own credential, scoped to read and nothing else, so there is no write path to misuse. Around that we run a guardrail watching for any attempt to do something other than read, and an audit log of what the model reached for when it tried. A model will eventually try something you never asked for. Narrow scope decides how far it gets. Giving the model only what it has proven it needs is an engineer’s call, and it is the one the model will never make about itself.

Subscribe now

The uncomfortable part

The same vendors selling you AI that found 23,000 holes are telling you to cut the engineers who would close them. Sam Altman put it on the record back in 2025: “maybe we do need less software engineers.” Both cannot hold, because a finding is worth nothing until one of those engineers confirms it is real.

You can automate finding the bug. The engineer who knows whether it matters is the one getting a severance package. But, yes, moron, we need fewer engineers.

Last month a support bot at Meta handed attackers thousands of real accounts, and every dashboard the company watches stayed green while it happened, because the bot was doing exactly what it had been rewarded to do. The thing that would have caught it was judgment, and judgment was never one of the numbers.

Between 17 April and 31 May, attackers took over as many as 20,225 Instagram accounts, including the Obama White House. They did it by asking an AI support bot Meta calls High Touch Support to send a password reset link to an email they controlled. The bot sent it without ever checking that address against the one already on the account. Meta did not notice for six weeks. Its June breach notification to the Maine Attorney General named the cause, “due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user’s Instagram account.”

Resolution speed was the tracked number. Ownership verification was not, and an untracked check has only one place left to fail, which is production.

This is not a Meta story, and it is not an argument against AI. The same tools, at Spotify and at my own shop, produce the opposite result, because there was something underneath them worth multiplying. Meta is the cleanest specimen of the multiplier running the other way, an org now clearing out the judgment that kept it standing for two decades to make a token count go up. I argued in the last piece that the industry had started dismantling engineering culture on purpose, and Meta is what that looks like once it breaks. Most companies building toward the same thing don’t know they’re building it.

The Machine

The machine has three parts, and they drive each other.

Start with metric substitution. Meta counts token consumption inside performance reviews, so an engineer’s AI usage is now a number in the file that decides the raise, and when you turn a proxy into a target people optimize the proxy, so token counts go up while whether those tokens produced anything worth shipping has no metric attached and stops being asked. I traced where that bill lands in Token Race. The part that matters here is upstream of the money: once the number is the goal, the judgment that would question the number turns into overhead. The incentive runs all the way to the absurd, where shipping an outage on unreviewed AI code is survivable but writing a function by hand, without an agent, is the thing that can mark you for the next round of cuts.

Judgment extraction follows, because once output is measured in tokens, the work that makes no tokens stops counting as work, and review makes no tokens, and neither does judgment, so when Meta needed bodies for data labeling it took roughly half of Instagram’s Trust and Safety team. The headcount didn’t drop and the org chart looks the same, but what left the building was the immune response, the people whose job was to notice that a password reset with no ownership check is a breach with a delay timer.

Then the inversion nobody prices in. AI raises the rate at which code enters the system, and nothing raises the rate at which that code earns trust, because verification still runs at human speed, since it is the one job you can’t hand to the thing you’re verifying. The gap between arrival speed and trust speed isn’t lag, it’s blast radius, compounding.

You can watch the inversion run on the vendors themselves. Anthropic published that prompt injection against its browser agent succeeds 23.6 percent of the time with no mitigations and 11.2 percent with them, which is one in nine after the fixes, from the company that builds the tools and has every reason to make that number look smaller. The trust problem is not solved, it is reported as a percentage and shipped anyway, and the dashboard that ships it stays green.

The Green Dashboard

60.2 trillion tokens at Meta in thirty days, 84 percent of Uber’s engineers on agentic tools, every adoption number green, and none of them predicted an incident, because none of them measure the thing that breaks.

The numbers that measure the thing that breaks look different.

Faros AI tracked 22,000 developers across more than 4,000 teams, comparing each organization’s lowest-AI-adoption quarters against its highest, and found that as adoption deepened throughput rose while incidents per pull request rose 242.7 percent and bugs per developer rose 54 percent, accelerating from last year’s 9 percent rise, so the degradation isn’t steady, it’s getting worse.

The collapse itself is not new to me. I documented its early shape in Quality Collapse, back when it showed up in static code metrics rather than production telemetry, and nothing since has bent the curve the other way.

Amazon is the version measured in dollars. On 5 March, an outage dropped orders across North American marketplaces by nearly 99 percent for six hours, 6.3 million orders gone, and an internal briefing flagged a trend of high-blast-radius incidents involving Gen-AI-assisted changes. Amazon says it was user error and removed the AI reference from the document. It also imposed a ninety-day code safety reset across 335 Tier-1 systems, which is a strange response to user error.

Codex is the version with no meter at all. The problem traces back to a logging change made in February and surfaced publicly when a developer named Rui Fan filed issue #28224 on 14 June, after his SSD took 37 terabytes of writes in 21 days, traced to a Codex feedback log that ran at its most verbose setting by default and was recording its own internal events, the logging included. That extrapolates to roughly 640 terabytes a year against a 1 TB consumer drive rated for around 600 terabytes of writes across its whole life, a full endurance budget spent in under twelve months. Someone in the thread posted a short SQLite trigger that drops every insert, a stranger’s patch for the vendor’s default, and OpenAI merged fixes on 22 June that reportedly remove most of the writes. The token bill at least arrives as a number you can read. This one arrives when the drive dies a year early.

Ship bugs freely because the agents patch them fast, and every visible signal improves at once: incidents get caught before they spread, coverage climbs, bug reports fall. Any one of those numbers can end an argument. The one that would end it the other way, the count of people who still understand the system, sits on no dashboard.

Metric improvement and system degradation are the same event here, read at two different times.

The Amplifier

All of that is the machine running in one direction, and one company over it runs the other way. Spotify told investors that almost all of its engineers use AI weekly and that most code is now AI-assisted, and unlike Meta’s numbers, theirs describe something real, because the agent rides on fifteen years of platform engineering and a Fleet Management system that already automated half their pull requests before Claude existed. I took the full case apart in Honk; the short version is that the AI replaced a twenty-thousand-line migration script, not the engineers, and it had a deep substrate of human judgment to multiply. Spotify is no clean fairy tale, it ran three rounds of layoffs and now pushes senior engineers toward an architect-and-editor model where agents write the routine code. What it didn’t do was reassign the judgment, and that is the whole distance between Spotify and Meta.

We run the small version of the same thing, where the review culture and the spec-first discipline are the substrate the AI rides on, and the output holds up. Spotify and Meta ran the same tools too. One of them still had engineers who could look at a green build and know it was green for the wrong reason, and the other was busy moving those engineers into data labeling.

The substrate isn’t something an engineer can install from below. Spotify’s came from fifteen years of leadership decisions, and Meta’s data-labeling reassignment was a leadership decision too, and so is putting token counts in the performance review. If the people above you have chosen the metric over the judgment, you don’t get to build Spotify from your desk, you get handed Meta, and the dashboard stays green the whole way down.

The Immune System

I still have that substrate, for now, and this month I watched exactly what it buys.

I was building a feature into our boilerplate, the foundation every new client project at my shop gets built on, so a defect there doesn’t ship to one product, it ships to all of them. The feature was a background loader, the kind Claude runs, where the model keeps generating on the server after you leave a chat mid-stream, work the backend had always done silently.

The bug came with that feature. The bot’s reply showed up fine while it streamed, and then the redirect that fires when a new chat gets its GUID and jumps to the chat’s detail page blanked it, leaving an empty space where the answer had been, while the message itself sat in the database the whole time. Nothing about that was obvious, because the loader itself worked, and I caught it because I test everything by hand after I build it.

My AI review agents and E2E tests found nothing. I found the bug, told the model where it was, and watched it fail five fixes in a row with Playwright, the DOM, and the live state all in hand. It got fixed when I stopped watching it flail and read the code myself, in the same lines it had read clean five times over. The gap was never missing data. It was nobody to connect what the product was doing to the line that was doing it.

That connection is the immune response, and it is the input AI burns fastest and refills slowest. Without a human in that loop, the same bug clears every automated gate green and ships into every project on the boilerplate.

I watch the same failure in smaller doses every week. One of my engineers spent two days editing text in a Google Doc from a browser extension, which hinges on one undocumented internal call, and told me the model couldn’t crack it. I didn’t take that on faith, I checked myself, already knowing the answer existed. Opus hit the same wall and argued my approach was wrong, until I gave it the function name, _docs_annotate_canvas_by_ext, and it explained the answer back as if it had known all along. It was certain while it was wrong, and the only thing that closed the gap was someone who already had the answer.

The pipeline that produces the people who catch what the dashboards miss is the one being defunded to pay for the tools that generate the misses, and the new-grad and intern numbers behind it have been collapsing for two years. I laid out the human side of the load in Human Cost and the comprehension side in Comprehension Extinction, and the structural version is one sentence: you’re spending a reserve you stopped refilling.

Meta didn’t run out of engineers, it reassigned the ones who could read the password reset for what it was, and kept the dashboards green while it did.

The Uncomfortable Truth

None of this breaks the incentive structure, because the incentive structure is the cause.

Every dashboard a company builds measures the work it can see, and the work it can see is never the work that takes the system down.

The multiplier doesn’t care which way it runs. Put it over engineering culture and it compounds the work, run it while that culture gets stripped for parts and it compounds the rot, and the dashboard reports the same green for both. Every defect it leaves uncounted is a broken window painted green, and enough of those tell everyone watching that no one is keeping the place. The breach is just the first thing big enough to walk through.

Subscribe now

On June 24, the Louvre and the Eiffel Tower cut their opening hours. Paris banned weekend street drinking and pushed Pride to September. By Sunday, Santé Publique France had counted around 1,000 excess deaths since the 24th, preliminary and unconsolidated, with a warning that the figure will climb as data from care homes and private residences arrives. The overwhelming majority were over 65. Many died at home. June 24 was the hottest June day France has ever recorded, a national average of 30°C, with parts of the country past 40.

The summer of 2022 produced an estimated 61,672 heat-attributable deaths across Europe, a modeled figure from ISGlobal and Inserm with a confidence interval from 37,643 to 86,807. Italy carried roughly 18,000. The number is not new. The continent has watched it arrive every few summers and chosen, each time, not to fix the thing that would lower it.

Approved to Death

The appliance that stops most of this moves heat through a wall. Around 19% of European households own one; in the United States it’s close to 90%. Germany sat near 3% a decade ago and is still only around 6 to 8%. Every country on that list can afford the unit and can’t get permission to hang it on a wall.

In Italy, external units on protected buildings fall under the Codice dei beni culturali, where the Soprintendenza can take 120 days to rule and the answer is often no. France stacks a town-hall permit, a co-owners’ vote, and in a protected zone a sign-off from the Architecte des Bâtiments de France, who can send the unit somewhere it won’t be seen. Spain treats the facade as common property under the Ley de Propiedad Horizontal, where a visible unit needs a three-fifths vote of the owners. The objection is always the same, the look of the wall, and it already has a finished answer. A Dutch firm sells a color-matched enclosure that hides the unit and bolts on without tools, Barcelona’s own ordinance requires exactly that kind of concealment, and New York’s landmarks commission has governed it for years. The cover exists. The rule that would mandate it instead of banning the unit is the thing nobody writes.

A heatwave kills the elderly indoors, and the binding constraint is a review about whether the box is visible from the piazza.

Subscribe now

A Heatwave Is a System Audit

The input is one of the largest economies on earth. The output is dead pensioners and a 400-euro fix nobody is allowed to install. When the heat comes you see what the system actually protects, and it protects the facade. This is not a marginal problem the system can be forgiven for missing. The summer of 2003 killed more than 70,000 people across Europe, and every serious heat season since has run into the tens of thousands. The continent has buried a small city’s worth of its elderly each bad summer for twenty years and still optimizes for the wall. That instinct, guarding the form and skipping the outcome, is not a quirk of housing law. It is the whole machine, and the air conditioner is only the version where you can count the bodies in a week. The reflex that guards the facade and lets the tenant die is the one that stopped building anything new, and the inheritance it has been living on is running out. You can see the same refusal in the things Europe once built better than anyone, starting with the power that keeps the lights on.

The Lights Are Fifty Years Old

France runs on 56 nuclear reactors poured in a single fifteen-year burst after the 1974 Messmer plan, still about 70% of its power, built for a forty-year life and now mostly past thirty. That timing wasn’t a French quirk. About 62% of every reactor operating on earth was connected to the grid between 1973 and 1992. Nuclear power was a one-generation construction project worldwide, and the generation that built it has retired. The one attempt to extend the French fleet, Flamanville 3, began in 2007 at 3.3 billion euros for a 2012 finish and reached the grid in December 2024, twelve years late at over 13 billion, four times the budget. The first working reactors of that exact design ran in China and Finland, not France.

Germany did the opposite of building. On April 15, 2023, it shut its last three working reactors, Isar 2, Emsland and Neckarwestheim 2, completing a phase-out that took nuclear from 31% of German electricity in the late 1990s to zero, in the middle of an energy crisis. And the thing meant to replace it, Europe doesn’t make either. China supplied 98% of the EU’s solar panels in 2024 and holds about 85% of the world’s battery manufacturing capacity. The continent that electrified itself two generations ago now buys its energy future from someone else and bans the air conditioner that future was supposed to run. Germany, having shut the reactors, leaned on Russian gas until the war forced it off, and now pays the highest household electricity prices in the EU, about 40 cents per kilowatt-hour against 11 in Hungary. The same slide from leader to buyer shows up in the one industry Europe still calls its own.

The Battery Bet Went to Zero

The car industry last set the world’s standard with diesel, and that ended the morning American regulators caught Volkswagen running software that gamed the emissions test while the real engines put out nitrogen oxide up to forty times the legal limit, September 2015. Since then Europe chases. Chinese brands went from 1% of the European EV market at the start of the decade to nearly 10% by early 2026. German market share inside China fell from 24% in 2020 to 15% in 2024. Seven in ten of the electric cars built on earth now come from China, which also controls about 85% of battery production.

Europe’s one serious answer was Northvolt, founded in 2016 by two former Tesla executives, more than 14 billion dollars raised, valued at 12 billion, the designated champion that would keep battery manufacturing on the continent. Its flagship gigafactory in northern Sweden never reached a fraction of its target, roughly one gigawatt-hour of output against a goal of sixteen. It lost a 2 billion dollar BMW order in 2024, filed for bankruptcy protection in the United States that November, and went fully bankrupt in Sweden in March 2025. The valuation went from 12 billion to nothing.

The defense base is the same story told in shells, which I’ve traced before: a continent that promised Ukraine a million rounds and delivered half, restarting production lines it had spent years letting close.

The Crown Jewels Are All Old

Strip out the things Europe now imports and the things it gave up, and what remains is a short list of companies the world genuinely cannot replace. Every one of them is old. ASML, founded 1984, is the sole maker of the lithography machines that print every leading-edge chip, including the accelerators the entire AI build-out runs on, each one selling for more than 200 million dollars. SAP, founded 1972 by five engineers who walked out of IBM, is still the largest enterprise-software company on earth. The ARM architecture in nearly every phone was first run at Acorn in 1985 and has now shipped in more than 250 billion chips.

What Europe has built since rides on infrastructure somebody else owns: Spotify, Revolut, Wise, Adyen, global scale with nothing underneath. The gap between launching a wrapper and building the foundation it runs on is the one Europe decided not to cross. ASML did build something irreplaceable this century, the EUV machine that shipped in 2017, but inside a company the prior generation founded, the way an heir renovates a house he didn’t buy. Four of the world’s fifty largest tech firms are European, a number its own regulation works to keep low.

The Invoice

Mario Draghi spent a year measuring this and reported it in September 2024. The output gap between the United States and Europe, per person and measured fairly, widened to roughly 30% over two decades, and about 70% of it is simply that Europe now produces less for every hour worked. Real income per person has grown almost twice as fast in the United States since 2000. The R&D gap with the United States runs to hundreds of billions of euros a year. Europe’s biggest research spenders are still its carmakers, where America’s are now its tech giants. Closing the gap, Draghi calculated, would take an extra 750 to 800 billion euros a year, proportionally larger than the Marshall Plan. To put that in buildable terms, it is on the order of sixty Flamanville reactors a year, just to stop falling further behind. That is the invoice for a generation that maintained instead of built.

The inheritance is enormous. The new construction is a rounding error.

Share

Twenty People, or 450 Million

I run a team of up to twenty. Brussels runs 450 million. Scale doesn’t correct a bad objective function. It multiplies it.

The worst state available to any organization is the one where the operating goal quietly becomes “leave me alone” and the system stops optimizing for anything at all. Run that for forty years and the inheritance spends itself down with nothing built to replace it.

The same weekend the death count came out, 63,000 French households lost power. The heat and the outage landed in the same week, which is the normal way infrastructure fails, several things at once. The block I live in stayed lit through the same kind of night, and I’ve spent four years on which systems hold under that pressure and which fold.

What You Can’t Inherit

Everything Europe is spending down was inherited: the wealth, the engineering, the reactors, the companies. The one thing that cannot be inherited is the ability to act when systems fail, and it only comes from having watched them fail. My building has no OSBB, the homeowners’ association that organizes around other buildings. It has a private management company as useless as the rest of them, so the residents put money in directly, a generator and batteries with an inverter that keep the elevators, the water, and the heat running through a blackout. Nobody waited for the state.

Ukraine ran this experiment at the scale of a country, and not because the state planned it. When Russia started hitting the grid in late 2022, the government failed at distributed energy the way governments do. It kept rebuilding the big Soviet-era plants Russia kept destroying, the Trypilska station outside Kyiv among them, repaired after the first winter and then gone in a single April 2024 strike. The distributed grid that would have survived this never got built, so people stopped waiting for it. They wired their own buildings off the grid and ran their own generators, the same three layers as my block, a few million times over. I am not going to call it a winning move. Energy terror is the one card Russia still has that works, because the grid is the thing you cannot fully defend. What changed is the cost of using it. Our long-range reach has grown enough that going after the grid again means taking the same back, and we have years of practice at living through it. They have not.

I can afford my building, and a generator is not a national solution. We hate the things, the noise of them and the diesel coming through the window, and we run them because the alternative is the dark. Nobody here romanticizes any of it. The difference between a Kyiv block that solved this and a Paris one that didn’t isn’t money or engineering, because Europe has more of both than we do. It is that we have buried people, and that changes what a system is willing to tolerate. Ukraine runs on European money and weapons, which is exactly why I can say this plainly. If the line we hold goes down, Europe meets its first real crisis in generations, and the heatwave was the rehearsal.

Europe still has the engineers and the factories. What it stopped doing is building, and you cannot inherit your way back into knowing how. The covers will still be on the shelf next summer, and the rule that puts them on the wall will still be unwritten. We would not have waited twenty years for permission to install an air conditioner if our old people were dying in the heat.

Subscribe now

On July 8, 2026, Anthropic can ask for your passport. The updated consumer privacy policy adds a category it calls Verification Data: an image of your government ID, the information printed on it, a photo or video of your face, and a facial geometry template. It covers Claude Free, Pro, and Max. It does not touch the API. A vendor named Persona collects the documents and the selfies, processing them on Anthropic’s behalf as a service provider rather than an independent data controller. The company says only a flagged subset of users will ever see the prompt.

Persona itself was caught in February with its government dashboard exposed on a public endpoint, the code showing a pipeline of 269 verification checks and three-year retention of faces and IDs.

Handing over a face is trivial. What sits behind it is a year of questions you would never put your name to, and reading all of it just turned cheap.

Payroll was the ceiling

For most of history, surveillance ran into the same wall: payroll. A Soviet censor could open your letter. He could not open everyone’s letter, because steaming envelopes takes hands and there were never enough hands. The Stasi got closest, running files on a share of the East German population large enough that historians still argue the exact fraction, and it took warehouses of paper and a network of informants the size of an army to do it. The ceiling was human. Reading you cost a person a day, and a person’s day costs money.

What protected the ordinary person was the price of attention. You were boring, and boring was expensive to read.

AI removed the ceiling. A model reads every message at a cost rounding to zero, sorts them, flags the interesting ones, and never asks for a raise. The thing that made mass reading impossible was arithmetic, and the arithmetic just inverted. Two variables remain: who holds the data, and what they say when the state asks.

Refusal is the exception

EU Commissioner Thierry Breton sent Elon Musk a letter in August 2024 warning that a live interview with a US presidential candidate could trigger DSA measures against X. Musk refused. In December 2025 the Commission fined X roughly 120 million euros, and X is challenging it in court, the first legal challenge to a DSA fine. Whether the fine holds, whether X folds quietly later, we do not know yet.

The other response leaves no press release. TikTok rewrote its global community guidelines across 2023 and 2024 to satisfy DSA pressure, restricting categories of political speech worldwide, and users were never told that was the reason. It surfaced only because the US House Judiciary Committee subpoenaed the internal documents and published them.

Telegram is the cleaner case. A month after French authorities arrested Pavel Durov in August 2024 on charges tied to content on the platform, Telegram changed its terms to hand IP addresses and phone numbers to authorities on valid legal request, up from the 14 requests covering 108 users it had honored earlier that year. Durov framed it as global consistency. I read the timing as a man doing the math after four days in custody, and I will mark that as my read, not a proven quid pro quo. What he was actually shown, and what was actually agreed, never became public. That is the part that should bother you, not the man.

The faster route skips the asking and writes the apparatus into law, justified by something nobody can vote against. One country already ran that justification all the way to the end.

Same rails, better manners

Russia stopped bothering with manners early. Vladimir Putin signed Federal Law 139-FZ on July 28, 2012, an amendment to the statute on protecting children from harmful information, child abuse imagery, drugs, suicide methods. It created a single national registry of blocked sites under Roskomnadzor, in force that November. By the end of 2013 the Lugovoi law had bolted extrajudicial blocking for extremism and calls to protest onto the same registry, and by 2022 it was the instrument shutting down independent outlets and war coverage. The children were the door the apparatus walked through.

The democracies are building the same lever with better manners. The UK Online Safety Act and the EU Digital Services Act are sold as child safety, and so is every age-verification law in the current wave. Strip the packaging and the demand is the same: identify the user, filter what they see, and on order, block. Brussels runs it with judicial review and oversight that Moscow never bothered with. The lever underneath is identical, and the difference is how many press conferences you hold about protecting kids while you install it.

I have watched a ban fail

That excuse is the one nobody can vote against, which is the whole point of reaching for it. I am against bans, and Ukraine taught me why. In June 2022 the parliament banned public performance of music by post-1991 Russian artists, in transport, restaurants, and on air, with an exemption list for anyone who condemned the invasion. Ukraine at least said the real reason out loud, in the bill’s own note: Russian music makes a Russian identity more attractive and feeds separatist sentiment. Identity and security.

The teenagers play it on their speakers anyway, the music of the people sending the missiles, while the missiles are still landing. If that does not break the habit, a fine printed in the official gazette will not. A ban does not cure the taste, it drives it underground and strips the brakes off it. What reaches a kid is whether the people around him handed down an identity strong enough to make the choice obvious. That is slower than a ban, and harder, so we pass bans instead.

When a government tells me it needs my passport to protect children, I believe the watching and not the reason. The child is the cover story, and they do not even need the new laws to do the watching, because they already did it once.

This already happened

In June 2013 the Washington Post and the Guardian published slides from Edward Snowden showing PRISM, a program under which the NSA pulled email, documents, photos, and chat logs from the servers of nine companies, Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube, and Apple, running since 2007 under Section 702.

The protection users thought they had was a promise. By Snowden’s own account, the safeguards were policy-based, not technically based, and could change at any time. No court pried this loose and no audit caught it; it surfaced because one contractor copied 41 slides and got on a plane. That is the entire reason you know the program existed.

In 2013 the thing on the servers was your mail. The thing on the servers now is the log of how you think.

My own log

I use Claude every day, and the people around me use ChatGPT, Gemini, Perplexity. Same habit, different logo. We type things into it we would not say out loud: the health scare before the doctor, the money panic, the marriage that is failing, the thought we are ashamed of. No case officer ever had a source this candid, because nobody is interrogating us. We volunteer it, at speed, and we sign for it the same way, clicking accept on terms nobody opens and hitting submit before the sentence ends. The model ends up knowing us better than any file a state could ever open.

That log is not privileged. In NYT v OpenAI a federal court ordered the company to preserve every log, deleted conversations included, and ordered 20 million of them produced to the plaintiffs, who now want more. Anonymized, the court was told, but anonymized is a policy, not a wall. The retention is policy-based, not technically based, and we have heard that phrase before. On a podcast last July, Sam Altman said it plainly: talk to ChatGPT about the most sensitive thing in your life and there is no legal privilege protecting it, the kind a therapist or lawyer would have.

The verification on July 8 is the last lock clicking shut on a house that is already full. Nobody is reading my transcripts today, and that is not safety, only the absence of a reason to bother. The reason is the one part still missing. Everything else is built and waiting. I write the guardrails for this kind of system every day. I know how little it takes to flag a user, to watch what they type, to do it silently in the background, to log it off a chat summary and store it wherever suits. None of that is hard, and none of it is expensive anymore. That is the part I cannot unsee. As far as my own privacy goes, I read that as already lost, and I am telling you that as my read, not a slogan.

Whether you find out

The record points one way. TikTok’s global rewrite emerged under subpoena. PRISM reached daylight because one man copied the slides. Disclosure, when it comes, comes late and from the outside.

It always starts with the children. That is what earns the state the right to ask what you are hiding, because no one wants to be the person who said no to protecting a child. Wrap the taking of a freedom in care for a kid, and you reach the strangest part of all: people thank you for it. They line up to be read, and they applaud the hand that opens the file.

Every one of these came with a good reason. Terrorism, children, public safety. The reason was always real, and the freedom was always smaller afterward.

I am not asking them to stop. If the state and the companies it leans on want to watch, they have the tools and the cost is gone. I am asking them to drop the insult. Do not tell me it is for the children, for safety, for my own good. Name the thing. Watching is watching, and I can be told the truth about it like an adult.

The old line says your freedom ends where another person’s freedom begins. The new one is colder: your privacy ends where the state’s interest begins. The cost of enforcing that was the only thing that ever hid it. That cost is now zero.

Subscribe now

On June 8, a developer named Ed Andersen posted that since the GitHub Copilot billing change, he had lost the urge to write code for the first time in his adult life. He described watching money leave his bank account every time he asked a machine to think. Then he wrote the line that matters: “End of an era for regular developers.” The people who keep coding, he said, will be the ones with effectively unlimited token budgets.

The same week, two of the most-quoted men in AI coding told everyone the opposite. They said the budget was no longer the point, because soon you would not be the one spending it. You would build a machine that spends it for you, and walk away.

Peter Steinberger spent thirteen years building PSPDFKit into a PDF engine running on a billion devices, sold it, then built OpenClaw and joined OpenAI to work on agents. He posted that you should stop prompting coding agents and start “designing loops that prompt your agents.” Boris Cherny, who runs Claude Code at Anthropic, told an audience that he does not prompt Claude anymore. He has loops running that prompt Claude and decide what to do. “My job is to write loops,” he said, and called this the transition the rest of us would make by year’s end.

Andersen and the two evangelists are describing the same room from opposite sides of the table. One of them just walked out of the casino with empty pockets. The other two are the house.

What They Are Actually Selling

The pitch is that you have been promoted. You stop prompting and start writing the system that prompts, one rung up the ladder of abstraction: punch cards, assembly, C, high-level languages, and now loops. It is the next rung on the ladder I have watched Cherny climb for a year, from ninety percent of his code written by Claude, to one hundred, to not touching the prompt at all. A reply under Steinberger’s post took it to the end: the next step is a loop that designs the loops, and then the agents lay you off for being dead weight. He was joking, and correct about the direction.

Whether a loop can work is settled. Who pays when it does not is the part nobody is pricing in.

Steinberger ran the largest public version of this. A three-person team ran roughly a hundred agents for a month and he posted the bill: $1.3 million in tokens across 7.6 million requests in thirty days, dropping to around $300,000 with Codex’s Fast Mode off. He framed it as proof that autonomy works at scale. It does, when someone else holds the meter open, and OpenAI was paying. The number describes his employment, not your budget.

Subscribe now

Whose Money Is On the Table

Cherny is in the same position from the other vendor: he works inside Anthropic with internal access no customer has. Neither he nor Steinberger runs a loop, opens a bill at month’s end, and feels it. I cannot prove their insulation is why they advocate this, and I am not calling them cynical. But advice to let the machine spend freely reads differently when the people giving it are not the ones paying.

Gergely Orosz, who writes The Pragmatic Engineer and is no AI skeptic, reduced it to its two real preconditions: the people who have a use for loops are the ones with “unlimited AI token budgets,” or the ones who feel prompting holds them back, usually because they have the budget. Which collapses two conditions into one. Orosz frames his own answer as a preference, that he is more than content prompting, but for most developers it is not a preference. The budget decides for them, and the budget is shrinking.

Andersen is the one who pays. The moment metered billing arrived, the magic turned into a number leaving his account. The narrative is free only for the people producing it. Uncapped consumption already did this to the companies that believed the first version of the pitch, and the same pattern is back under a new name.

What Is Actually Under the Hood

It is worth asking what the thing actually is, this loop expensive enough that no one will meter it and no one who praises it pays for it. It has a name and a shape. The technique is called Ralph, invented by Geoff Huntley, and at its core it is one line of bash that feeds the same prompt to a coding agent over and over until it stumbles into something that compiles. Huntley named it after the Simpsons character and after 1980s slang for vomiting. He has written that the script sometimes makes him nauseous, that it is cursed in how it was built and how cheap it is, and that he worries he upended his own profession by proving it was possible.

The foundation is a while-loop that brute-forces an answer through repetition, built by a man unsettled by his own creation. Anthropic shipped a Ralph Wiggum plugin for Claude Code, and Cherny has said he uses Ralph. When the head of Claude Code says his job is to write loops, the loop is a vomiting Simpsons character in a terminal, running on top of a platform that has to stay up for any of it to mean anything.

Someone Is Always Watching It

That platform does not stay up. Outages are normal, every service has them, and competent teams design around them with retries, fallbacks, and multi-provider routing. That work is done by a human, and it does not stop being necessary because you wrote a loop.

Take the company whose head of Claude Code says he no longer touches the code, and look at its own status page for the two weeks around when he said it. Opus 4.7 threw elevated errors on May 27, twice, then again on May 28, June 1, June 7, and twice more on June 8. On June 2, a single failure took down multiple models across claude.ai, the API, the Console, and Claude Code together for close to six hours. Claude Code degraded again overnight on June 3. On June 5, an outage of nearly three hours hit nearly every model at once and came with public concern about potential customer data exposure, neither confirmed nor ruled out by Anthropic. June 8 brought three separate incidents in a single day, across Opus 4.8, Opus 4.7, and Haiku 4.5.

The June 2 outage is the one to sit with. Contemporaneous reporting traced the trigger to Claude Code’s sub-agent system, where agents spawned child agents in a loop that would not terminate, draining token quotas in minutes and forcing Anthropic to push an emergency refund to affected accounts. The pattern did not stop there. On June 15 a user filed issue #68619 on Anthropic’s own bug tracker, titled “Subagent spawning and subagent pattern bugs trigger infinite recursion, infinite token usage.” Anthropic tagged it critical. The body reports subagents spawning child agents fifty levels deep, ignoring the environment flag that is supposed to disable forking, and one observed session where the recursive tree burned four million tokens in under five minutes, an entire Pro Max 20x five-hour budget gone before the user could react. The regression shipped on or around June 10, and as of this week the issue is still open. The company that sells loop-driven development is the company whose loops will not stop.

A loop is only as autonomous as the service it calls. When that service returns errors, or spawns agents until it falls over, something has to notice and stop it. On the pitch, that something is the loop. In practice it was Anthropic’s own engineers watching the dashboard, on the product whose lead says he writes loops instead of code. The frequency does not prove autonomy is impossible. It proves the unattended part of “leave it running unattended” was never real, even at the company selling it.

Share

The Strongest Version of the Case, and Why It Folds

None of that means the loop is useless, and the honest move is to say where it earns its keep. For bounded work with a binary check at the end, it does, and the flaky-test case is the cleanest version I have seen. In the same thread, a developer described pointing an agent at flaky end-to-end tests under one rule, do not touch app code, only stabilize the test, looping until the suite passed twenty times clean. It took their CI flake rate from around 12% to under 2% over a weekend. Orosz called it a sensible example, and it is. It worked because the task was narrow, the check was a passing suite, and verification was cheap enough that the loop converged in a weekend instead of burning forever. A tool with a clear stop, the same category as a linter or a compiler. And that is the tell. Developers have automated their work for decades without anyone declaring the keystroke obsolete. What is being sold now is not the automation, it is the story around it: that this tool is a paradigm you graduate into by removing yourself, rather than a faster way to do a narrow job you still define and check. The story has a cost that lands before the tool ever does. It teaches engineers that wanting to read their own code is a phase to grow out of.

Addy Osmani, who has done the most to systematize the technique, warns that the same loop gives opposite results depending on who runs it, swinging on whether you are token rich or token poor, and that the whole thing rests on a verifiable stopping condition. His advice is to build it like someone who intends to “stay the engineer,” not the person who presses go and leaves. The autonomy has quietly evaporated: the engineer stays, the stopping condition is hand-set, and the rich-versus-poor caveat is the budget argument again.

The Ralph enthusiasts tell you to cap the infinite loop at ten or twenty iterations to start, because the alternative is an agent re-running forever on a problem it cannot close. The “infinite self-prompting loop” has a human-set ceiling, a human-defined success check, and a human deciding the budget before it starts. That is the job you already had, with a new title.

A Casino Only the House Can Afford

Outside that narrow case, the pitch to remove yourself and let it run is an invitation to feed a machine that bills you for every pull whether it produces anything or not. The narrow case is the exception they show you. The meter is the product.

Self-hosting does not buy you out of it. Run the model on your own leased GPUs and the per-query cost does not vanish, it moves onto your own infrastructure bill, which is the trap I traced in another piece.

The house wins either way, even when it cannot decide how to charge you. Anthropic spent this year trying three times to move agent usage out of its flat subscription: a terms-of-service clampdown on third-party OAuth in February, an outright ban on tools like OpenClaw on April 4, and a full metered split for the Agent SDK announced in mid-May for June 15. Days before the split, the Wall Street Journal reported that OpenAI was weighing drastic token price cuts to pull customers off Claude. With a price war landing and its own IPO already filed, Anthropic paused the split on the day it was meant to take effect, “nothing changes for now.” Three attempts to price the agent layer, the third one paused on launch day, because agents cost more than the subscription can absorb and the company cannot raise the price in the middle of a fight. The meter is still running. They just cannot agree on how to print the number. The croupier does not gamble with his own chips. Steinberger plays on OpenAI’s money, Cherny on Anthropic’s, and the machine they are demoing throws errors every other day on its own status page.

Andersen saw it the moment billing arrived. The only players left, he concluded, will be the ones with bottomless budgets, and those players are the house. The loop was going to bill you for the privilege of watching it try.

I have argued before that AI works only when humans with real engineering judgment surround it, and that without them it scales your worst habits instead of your best. Cherny and Steinberger are two of the most listened-to voices in the field, and the habit they are scaling is the one where the human stops reading the code. The loops do not work, and they do not need to. The whales, the same players with the budgets nobody else has, are not erasing engineering work. They are erasing the engineer’s belief that the work is worth doing, and from what I can see, that one is landing.

Subscribe now

People get laid off, then they find new work. Maybe it takes longer than it used to. The market is hard, but the market digests. That was the shape of the problem in my head. Painful, survivable, done.

I’ve spent almost a year pushing back on the replacement story, and I still think it’s a lie. The read came from somewhere narrower than belief. It came from where I was standing. I didn’t get cut. None of my people got cut. And the whole time, I was hiring. Our last round pulled 2,253 candidates for a handful of seats. From a chair that two thousand people are walking toward, “they’ll land somewhere” isn’t optimism. It’s what you watch happen every day. That chair is a window, and through it the broken market still looks like a working one.
An engineer answered one of my posts. He was standing at the other window: senior, twenty-five years in, a hundred days of runway left. His view: nobody hires, layoffs keep coming but nobody fills the seats, everyone frozen like a rabbit in headlights. Juniors get called useless. He told me, plainly:

He was right, and the thing he was right about is narrow and exact. Not the mechanics. I still think the market is irrational and irrational markets correct. I told him as much, and I didn’t take it back. What I took back was smaller and worse to admit: I had been measuring his catastrophe with the ruler of my own untouched life. I knew people were getting laid off. I did not feel the weight of it, because the weight wasn’t landing on me. Two people can look straight at the truth and see opposite things, depending on which side of the glass they’re standing on. Each of us assembles reality from where we happen to stand, and mistakes it for the thing itself. I stand somewhere specific too. I was born where a lie had a price, and that makes a market with no price for lying hard for me to read as normal.

The present I missed

One story shook me. Kyle Simpson wrote “You Don’t Know JS.” He taught a generation how the language actually works. A few weeks ago he was on LinkedIn asking for warm intros. Not job-board links. Warm connections to people he could actually talk to.

When a Kyle Simpson has to ask LinkedIn for an introduction, this isn’t skill losing its value. It’s a market that believed a lie and seized up. What matters is that a person of that caliber gets spit out at all.

He is one face, behind him there’s a number, and I could have read it any time.

New software engineering job postings fell 15% in the first two months of 2026. Software developers aged 22 to 25 saw employment drop nearly 20% from their late-2022 peak. Tech cut roughly 52,000 jobs in the first quarter of 2026 alone, the worst opening quarter since 2023. Close to 900,000 tech workers gone since 2020. IBM tripled its entry-level hiring this year, the only company moving the other way, which tells you the rest had a choice and made the other one.

The freeze works from both ends. Juniors never get in, and the people who taught them get walked out. A senior with twenty-five years and a Kyle Simpson land in the same place, because a market that stops believing in the skill stops believing in it at every level.

The people who built it

What the executives did was a different thing. They sold the replacement on purpose, through the loudest microphones in the industry.

Sam Altman, March 2025: “At some point, yeah, maybe we do need less software engineers.” Mark Zuckerberg, January 2025: AI would be “a mid-level engineer” at Meta inside the year. Marc Benioff, February 2025: “We’re not going to hire any new engineers this year.” Dario Amodei, March 2025: AI would write 90% of code within three to six months, and within twelve months “essentially all of the code.”

Read the hedges. “Maybe.” “We may be in a world where.” The qualifiers sat in the transcripts and were gone by the time the claim reached a layoff memo. The speculation went up on stage wearing a hedge and came down as a fact. I can’t prove intent, but the pattern reads one way to me: the unhedged version moved the stock, so the unhedged version is the one that left the building.

It’s mid-2026. At my own company AI now writes most of the code, and it still hasn’t made the engineer optional, it’s done the opposite. Code that writes itself needs a human to judge it and validate it, or it turns into the wreck I’m about to show you. The writing was never the bottleneck, the judgment was. Their industry-wide version didn’t even land: independent reads put AI at about half the code even inside the labs making the loudest claims. Meta did not swap its mid-level engineers for a model. It cut thousands of these people while spending billions on different ones.

Two ends, one result

Code is solved. Generate it, ship it, the engineer is overhead. That’s what they were selling.

I audit that claim for a living. Recently a client brought us an application built start to finish by someone with no engineering background. Pure vibe code. They weren’t live yet. They came with one question: can we launch?

The thing worked, the features ran when he demoed them. Zero UI, zero UX, but it ran. That’s the giveaway before you open a single file. Then we opened the files.

Inside: zero type safety, every variable and every API response untyped. No input validation anywhere. User input flowed straight into database queries, guarded by nothing but if statements and browser alert popups. No tests, the one test file still searched for the framework’s starter-template placeholder. The production database password committed to the repo in plaintext. Passwords stored in client-side JavaScript, readable by anyone who opens dev tools. Authorization that was pure theater: roles enforced by hiding buttons, bypassable from the browser console in under a minute. Cross-site scripting in several places, with one component escaping its output correctly and the rest not, which is the signature of code assembled without anyone in charge of how it fits together. One 3,000-line source file. Twelve of twenty components past any reasonable size. Business logic duplicated across six files. Dead components wired to nothing. A 10,000-line CSS file with class names like phase14-, phase17-, phase18-, the archaeological layers of one prompt stacked on the last, nothing ever refactored.

Our verdict was no-go. The only thing standing between that app and a breach in a regulated industry was the review.

Zero expertise, predictable result.

Anthropic. The best-paid engineers on the planet, effectively unlimited compute, the company that sells the coding tool. Their own product shipped a single 3,167-line function with zero tests, already in production, serving a revenue stream in the billions. I took their engineering culture apart when the source leaked.

Maximum expertise and zero expertise, opposite ends of the spectrum, and the code rotted the same way at both. If code were solved, the model would have carried the amateur up toward the expert’s level. Instead it dragged both down to the same floor. The tool didn’t decide the outcome, the discipline on top of it did, and at both ends there wasn’t any.

The amateur asked permission and got told no. The experts asked no one and shipped to production. One of those two apps is live.

Somebody is on the hook

My code is already written almost entirely by AI, and it changed nothing about the part that matters. Someone still answers for the result, and “the AI merged it” has never been a defense anyone accepted. The work the executives called dead is the one thing standing between “it runs” and “it leaked.” I’ve written before about why that accountability can’t be delegated.

I was right that the work doesn’t vanish. I was wrong to think that because it doesn’t vanish, no damage was done. The people who do it got thrown out anyway, not because the work stopped needing them, but because someone sold a story that it did, and the bill for believing that story lands on whoever shipped on the strength of it. The engineer is still the bottleneck, and the engineer is still on the street. I missed the second half because it wasn’t happening to me.

Nobody paid

Altman now says he’s “delighted to be wrong,” that the disruption he forecast hasn’t shown up the way he expected.

Amodei pivoted to the Jevons paradox, the same 90% reframed as proof that productivity expands to fill the gap.

Benioff went from promising “radical augmentation” to cutting thousands with “I need less heads” inside a single month.

Jensen Huang told a generation in 2024 to stop learning to code and go into farming or biology instead. By 2026 he was calling the idea that AI reduces engineering jobs “complete nonsense” and saying the world needs a trillion lines of code. The kids who took the first advice didn’t enroll. Nobody has explained where the expertise is supposed to come from now.

No retraction. No correction filed under the same name that made the claim. The forecast that froze the market just got swapped for a cheerier one.

That’s the missing institution. There is no reputational cost in this industry for being wrong at full volume.

The King of Bullshit

The clearest proof of it isn’t even in this story. Take the man who built a career on deadlines that never arrive. Full self-driving “next year,” every year since 2015. A million robotaxis on the road by 2020. A million people on Mars, first crewed mission in 2024. Hyperloop, a “fifth mode of transport,” working lines within a few years of 2013. Brain implants in trials by 2020. None of it landed on time, most of it not at all, and by 2024 he was on a stage admitting “I tend to be a little optimistic with time frames” while announcing the next one in the same breath. The latest one, my favorite: in January 2026 he told Davos the cheapest place to run AI would be space “within two years, maybe three at the latest,” and filed to put a million data-center satellites in orbit, days before merging two of his companies into a $1.25 trillion entity headed for an IPO. The deadline is the product. Every missed date made him richer. He is, as of this writing, the wealthiest person who has ever lived. A forecast that never lands isn’t a debt in this industry. It’s a marketing budget, and somebody else pays it.

Nothing clears

You can call an entire profession obsolete. You can tell a generation not to learn to code. You can promise data centers in space within two years, days before your IPO. You can do all of it, watch the freeze land on real people, and pay nothing. The careers don’t un-break, the valuations went up. The same vendors now sell AI supervision as a service, packaging the exact work they spent years calling dead. A senior engineer with twenty-five years behind him counts how many days of money he has left. They count how many points the stock is up since they called him overhead. The difference between them isn’t talent and it isn’t honesty. It’s altitude, and altitude works so that no one up there ever has to look down at the person they wrote off as a cost.

And there’s a worse version than no one paying. The correction he and I both want may never come, not because the story turned out true, but because too much money is riding on it to let the tower fall. Capital that size doesn’t admit it was wrong. It props the thing up. That’s slower and quieter than a crash, and worse, because nothing ever clears.

Resist

He signed off with one word, twice. Resist.

From the height of the future you can’t see the rotten code or the broken people. You see them with your hands inside the machine, or you don’t see them at all. I didn’t, for a while, because I was standing at the one window where the damage doesn’t reach. A man with a hundred days of runway walked me to the other window in an afternoon.

I come from a place where if you lie and get caught, you can get punched in the mouth for it. Where a word costs something the moment it leaves your mouth. These men built an industry where you can lie to the whole world, break other people’s careers at full volume, and grow richer for it. I can’t tell you how to build a reputation system where there isn’t one. I just know what it looks like when it works, because I grew up inside one that did.

Subscribe now

Sam Altman and Dario Amodei spent two years predicting AI would displace much of the workforce. Both hedged with talk of augmentation and regulation, but displacement was the headline, and it shaped enterprise expectations, investor theses, and hiring decisions across the industry.

Then, in May 2026, OpenAI launched a $4 billion company that sells human supervision of its own models. To the same enterprises. For the same work thousands of independent engineering firms were already doing. Anthropic did the same thing a week earlier, quieter, for $1.5 billion.

They didn’t build a better model. They built a services firm. And the $5.5 billion they spent is the clearest admission yet that enterprises can’t deploy AI without humans holding their hand.

The Vendor Ate the Ecosystem

OpenAI’s Deployment Company launched May 11 with $4 billion from 19 investors led by TPG, including Goldman Sachs, McKinsey, and Capgemini. Its first hire: 150 forward-deployed engineers from Tomoro, a London consultancy acquired the same day.

Forward-deployed engineers sit inside your company and make AI do what the demo promised. Palantir pioneered the role in the early 2010s because its software didn’t deploy itself either. The model works. Palantir’s stock returned over 1,200% since 2020 on exactly this premise: enterprise software needs permanent human support.

So copying Palantir isn’t the problem. The problem is that OpenAI’s CEO spent two years saying the model makes this work obsolete, then built a $4 billion company to do it.

The structure gives away the confidence level. DeployCo’s investors collectively sponsor 2,000+ businesses, a captive market built into the cap table, and OpenAI guaranteed them a 17.5% annual return. That’s standard private-equity plumbing, except the asset generating the yield is a supervision business, not a software license.

Every AI services firm that built on OpenAI’s API now competes against a subsidiary of its own vendor, one that sees the model roadmap first and has thousands of clients pre-sold through the cap table. Axios’s Dan Primack caught the irony: McKinsey and Capgemini invested in DeployCo while competing with it. They funded their own disintermediation, or bought a hedge against it. Either way, they’re inside the tent.

AWS and Salesforce competed with their partners too, but offered margin sharing and co-sell programs to keep the ecosystem alive. DeployCo is built as a competitor, not a platform. OpenAI went from tool vendor to rival services firm in eighteen months.

Then it kept going. A month after DeployCo, OpenAI acquired Ona, which runs AI agents securely inside an enterprise’s own cloud. One acquisition makes a product. Two makes a pattern. OpenAI is buying its way into the deployment layer because the models alone don’t land there.

Subscribe now

The Middleman They Were Supposed to Kill

Anthropic didn’t build its own engineering arm. It rented everyone else’s.

PwC signed on May 14: Claude across 364,000 employees, 30,000 to be certified. KPMG followed five days later with “Digital Gateway Powered by Claude” for 276,000 people in 138 countries, plus a product for modernizing IT at private-equity portfolio companies.

These are auditing firms. Tax prep, compliance, M&A advisory, the exact white-collar work every pitch deck promised to automate. Instead of being replaced, they became the sales channel. Enterprises don’t trust Claude. They trust KPMG. So KPMG stamps “Powered by Claude” on its existing workflow and bills both ends: Anthropic for distribution, clients for the supervision.

You could argue this is augmentation working as designed, and you might be right. PwC reported up to 70% faster delivery on client work. But augmentation isn’t what got the funding and the keynotes. Displacement was the pitch, and the gap between that pitch and a Big Four distribution deal is the whole story.

The model didn’t cut out the middleman. It entrenched it.

The pattern is industry-wide. By the end of May, every major lab had bought its way into someone’s services arm: EY went with Microsoft, Google funneled $750 million into Accenture, Deloitte, and Capgemini. Embedded enterprise engineers aren’t new; Microsoft and AWS have fielded them since 2017. What’s new is the model vendors muscling into the same work, on top of a services layer that already existed.

What all this money buys is a human signature on a risk assessment. Confidence-as-a-service, priced like infrastructure.

And the bill never stops. When the deployment never gets cheaper from one engagement to the next, you didn’t buy a capability. You bought a dependency. Forward-deployed engineers are the invoice for making AI real.

The Contradiction That Funds Itself

Back in 2024, Amodei predicted 50 million genius-level AI entities and half of white-collar jobs gone in five years, then doubled down in a 20,000-word essay in January 2026. I took it apart then: the knowledge required to supervise AI is the same knowledge that makes you irreplaceable.

Four months later, the money confirmed it. While Altman’s people were buying a London consultancy, our CTO was staring at a queue of vibe-coded apps that HR, PMs, and even our own CEO had built and now wanted shipped to production. That queue is the real shape of AI in the enterprise: not replacement, but a backlog of half-working software that needs a human to make safe. On May 26, Altman told a Sydney audience he’d been “pretty wrong” about AI and jobs, and said he was “delighted to be wrong.” More honesty than most CEOs offer. But his company had spent $4 billion two weeks earlier, and that says more than any interview.

Then Amodei went further. In a June policy essay, he proposed that if AI permanently kills demand for labor, governments may need universal basic income funded by taxes on AI companies. Read that again. The same person, the same company that has spent eighteen months selling labor replacement now wants a tax-funded safety net for the moment that replacement lands. He’s pricing in the cleanup before the spill. So the same month Anthropic spent $1.5 billion hiring humans to deploy its models, its CEO floated paying the displaced out of a tax on the firms doing the displacing.

Either way, the math doesn’t reconcile. If the models replace workers, you don’t need 150 engineers inside client offices and four Big Four partnerships. If they don’t, stop writing 20,000-word essays about the country of geniuses. Pick one.

Lay the receipts in order and the three-week corridor speaks for itself. May 11, OpenAI launches its deployment company. May 14, PwC signs. May 19, KPMG follows. May 26, Altman says he was wrong about replacement. June, Amodei proposes a tax to clean up the replacement. The walk-backs and the checkbook were running on the same calendar.

The market already picked. OpenAI’s enterprise API share slid from 50% to 27% in two years while Anthropic took the lead. That slide is the motive. When the model stops being a differentiator and the API revenue follows it down, you wrap the model in people and sell the bundle, because a services contract is stickier than an API key. DeployCo is the answer to a losing API war, not a strategic flourish. Even Palantir’s Alex Karp, whose platform competes directly, called the Tomoro deal “a complete farce” and an attempt to copy Palantir. “The implementation is where the value is,” he said.

When the company that invented the playbook says you’re copying it badly, the model was never the moat.

What This Looks Like from the Trenches

We sell this exact service, at a fraction of $4 billion.

A client calls because someone on their team vibe-coded an internal tool with ChatGPT, and leadership wants it in production. Nobody knows if the API keys are exposed, whether data leaks outside the VPC, or how to enforce compliance on code no human wrote. They need an engineer to audit it, fix it, and sign off that it won’t detonate in production.

The queue isn’t hypothetical. Our DevOps team built dedicated infrastructure just for it: SSO, automated provisioning, the whole path from someone’s laptop to a managed environment.

OpenAI now sells that same work, with insider access to the model, a captive pipeline of thousands of companies, and a brand enterprises trust more than any independent firm. Your vendor is your competitor, with funding you can’t match, a roadmap you can’t see, and a client base you can’t access.

For buyers, the tradeoff is real. DeployCo’s engineers are good; Tomoro had real clients and real deployments. But the firm that already knows your infrastructure and your edge cases just lost its information edge to your vendor. And 150 engineers spread across thousands of portfolio companies run thin fast.

The keynote is free. The $5.5 billion is the honest number, and it just built the most expensive human-supervision layer in enterprise history.

If Altman and Amodei spent two years telling the world that humans aren’t needed, they shouldn’t be surprised when the humans they’re now competing against take it personally.

Subscribe now

In May 2023, Ireland’s Data Protection Commission fined Meta €1.2 billion for transferring European user data to the United States. The largest GDPR fine in history.

Meta generated $200.97 billion in revenue in 2025. The fine equals less than three days of revenue. Meta adjusted its legal transfer framework to the new EU-US Data Privacy Framework and kept operating.

In mid-2024, across the border in Germany, Aleph Alpha announced it was exiting the foundation-model race. The company had raised more than $500 million from Schwarz Group, SAP, Bosch, Hewlett Packard Enterprise, billed as Germany’s answer to OpenAI.

CEO Jonas Andrulis told Bloomberg the math didn’t work. Just having a European LLM wasn’t a viable business model. The primary cause was competitive: GPT-4, Claude, and Gemini left no room. But regulatory compliance costs compound an already impossible position.

By October 2025, Andrulis stepped down. By April 2026, Canada’s Cohere acquired what was left at a combined $20 billion valuation. Germany’s flagship AI company is now a division of a Canadian one.

Three days of Meta’s revenue, a dead German foundation-model shop, and GDPR is not new at this.

Subscribe now

The Precedent

GDPR took effect in May 2018. Cumulative fines have since approached €6 billion. The top recipients are American and Chinese companies: Meta, Amazon, TikTok, Google. All of them paid and kept operating. Not one left the European market.

A 2025 NBER paper measured what happened next: after GDPR took effect, US-led venture deals in the EU dropped 20.6% in count and 13.2% in dollar amounts. Roughly $1.6 billion per year in lost American investment, concentrated in exactly the kinds of young, data-intensive startups that would be training today’s European models.

The Draghi Report delivered the verdict: no EU company with a market capitalization above €100 billion has been created from scratch in the last fifty years. Every US company valued above €1 trillion was founded during that same period.

US private AI investment in 2024 hit $109 billion. The EU plus UK combined raised approximately $8 billion. Of 147 European unicorns founded between 2008 and 2021, forty relocated to the US. The fastest-growing AI company in Europe, Lovable, is built by a Swedish team but registered in Delaware. You can build in Stockholm, but you incorporate where the checks clear.

Brussels didn’t start from a level playing field. Twenty-seven languages, shallow capital pools, and risk-averse investors did plenty of damage first. But regulation is the one factor the EU chose to add on top of every other disadvantage. GDPR did not create a single European tech champion. Its most visible consumer outcome is a cookie banner that annoys 450 million people every time they open a website.

Brussels is about to aim this model at AI. Mistral is the one company that can’t ignore it.

The Only Boxer in the Ring

Mistral is the only European shop that even pretends to play in OpenAI’s league, backed by ASML’s €1.3 billion check in September 2025, valued at €11.7 billion. OpenAI closed a $122 billion round in March 2026 at an $852 billion valuation. The ratio is roughly 73 to 1.

Mensch would not have a company without Macron, and that’s not an insult, it’s the mechanism. Macron’s personal endorsement, a French military AI framework deal, an Nvidia data center partnership blessed at VivaTech, and Europe’s largest industrial investor writing a €1.3 billion check.

Strip the state support and you have a company with roughly $400 million in annual revenue competing with an $852 billion one. Markets don’t produce that outcome, governments do.

On GPQA Diamond, the hardest reasoning benchmark, Mistral Large 3 scores 43.9%. Gemini 3 Pro scores 91.9%. On the Artificial Analysis Intelligence Index, Mistral ranked in the bottom half as of early 2026, below DeepSeek V3.2.

Europe’s champion is losing to the companies Europe is trying to regulate. Mistral CEO Arthur Mensch told the French National Assembly in May 2026 that Europe has two years to avoid becoming America’s “vassal state,” criticizing the stacking of GDPR, copyright legislation, and the AI Act as a system that favors American giants who can absorb compliance costs without noticing.

Mensch is right about the diagnosis. But the sharpest contrast isn’t between Europe and America. It’s between how fast Europe can build and how fast it actually does.

What Speed Looks Like

The sharpest illustration of what AI development looks like without compliance overhead isn’t in Silicon Valley. It’s in Ukraine, where I live and run engineering teams.

A company called The Fourth Law makes an autonomy module that costs around $150 per unit in its cheapest configuration. The drone locks onto its target and flies the final approach without human input, immune to radio jamming. Hit rates jump from 20% to 80%.

A CSIS report confirmed the pattern: AI-enabled navigation raises engagement success from 10-20% to 70-80%. Instead of eight or nine drones per target, one or two are enough.

CSIS documented the approach: small models trained on small datasets, running on cheap chips, designed for fast retraining as battlefield conditions change.

No conformity assessments, no technical documentation packages, no risk management frameworks. The feedback loop is measured in days: a module ships to a brigade, data comes back, the model gets retrained, next version ships.

Brave1, the government defense tech cluster, supports over 1,500 Ukrainian tech companies. More than 300 AI innovations registered. Over 70 deployed on the front lines.

I wrote recently about how AI’s infrastructure appetite is starving Ukraine’s drone supply chain. That was about resources. This is about regulation. The EU is writing rules for AI systems that would qualify as high-risk under its own classification. The same class of systems Ukraine deploys in weeks and funds with a fraction of what Mistral spends on compliance lawyers.

Nobody in Kyiv is asking whether their autonomous navigation module has an adequate risk management system under Article 9 of the AI Act. They’re asking whether it hits the target.

The AI Act excludes military systems. So the part of the stack that’s been stress-tested under artillery fire is the part Brussels doesn’t regulate, while it drowns civilian use cases in paperwork.

The Rules Hit Where They’re Easiest to Enforce

The EU AI Act threatens fines of up to €35 million or 7% of global revenue. For Mistral, at roughly $400 million in annual revenue, first-year compliance for a single high-risk system runs €80,000 to €250,000.

The compliance invoice doesn’t care about your revenue. A startup with five engineers pays the same auditor as Meta.

In a 2023 survey of over a hundred EU AI startups, 33% believed their systems would be classified as high-risk. The European Commission assumed 5 to 15 percent.

American companies have a third option: withhold features. Apple held back Apple Intelligence. Meta sat on multimodal Llama for the EU. Google quietly slid Gemini’s launch by a few quarters. None of them argued with Brussels. They just downgraded the product for 450 million people.

Chinese companies face even less friction. Italy banned DeepSeek in January 2025 for refusing to acknowledge GDPR jurisdiction. No global financial penalty. DeepSeek remains accessible via VPN with no EU entity to enforce against.

TikTok received a €530 million fine in May 2025 for illegal data transfers to China, appealed, and continues operating. ByteDance is valued between $550 and $600 billion in secondary market transactions. The fine is less than 0.1% of the company’s value.

Brussels noticed.

Brussels Heard the Message. Too Late.

In May 2026 alone, the EU postponed its own high-risk AI deadlines by over a year, expanded SME exemptions, relaxed GDPR provisions for AI training data, and announced a €200 billion investment program. You don’t postpone your own law by two years because it’s going well.

But timing is the problem. GDPR took effect in 2018. The capital flight began immediately. Eight years of underinvestment can’t be reversed by a program announced in 2026.

According to Revelio Labs data reported by ScienceBusiness, France saw a net outflow of 45% of its AI researcher base in 2025 even as Mistral was scaling. The country that hosts Europe’s best AI company is losing researchers fastest.

I wrote before that some guardrails aren’t anti-innovation. I stand by that. AI companies that generate child abuse material should face criminal prosecution.

There’s a version of this where the EU says: don’t build dangerous things. That’s not what happened. What happened is: don’t build anything unless you can pay someone to document that it’s not dangerous.

I’ve seen this before. I wrote before about the EU promising Ukraine a million artillery shells and delivering half, nine months late.

Brussels loves the phrase “AI sovereignty.” In practice, sovereignty means the ability to build and run your own systems. The EU runs its AI on American models, assembles its hardware from Chinese factories, and relies on Ukrainian soldiers for the security that lets it hold regulatory hearings. That’s the sovereignty it’s defending.

The Gift Europe Won’t Unwrap

On June 9, 2026, Anthropic launched Claude Fable 5 to the public. Its most capable model, sharing weights with Claude Mythos 5, the version withheld for vetted cyber-defense partners.

Three days later, on Friday, June 12, the US Commerce Department sent Anthropic an export control directive: cut off Fable 5 and Mythos 5 from all foreign nationals, including those living inside the United States, including Anthropic’s own employees. Citizenship is the line. A green card holder who has lived in San Francisco for a decade, who works at an American company and pays American taxes, is cut off.

Anthropic said it believes the order may rest on a misunderstanding. Then it took both models offline for everyone because it has no way to verify every user's citizenship. A model that launched on Tuesday as the most capable public AI was gone by Friday night.

Older Anthropic models keep running. The frontier just got a citizenship requirement.

One directive, one Friday night, and the model is gone for everyone. Do that three more times and you’ve restructured who can work on frontier AI globally.

Those “AI sovereignty” slide decks that have been gathering dust in Commission offices since 2021 are not hypothetical anymore. Yesterday it was Fable 5. Next time it might not come back.

Brussels will publish something. Probably several things. A position paper, a roadmap, a working group with a three-year mandate. What it won’t do is ship a model.

Europe can build. GDPR took four years from proposal to enforcement. The AI Act took three. AI moves in quarters.

Ukrainians understand something that Brussels hasn’t learned in five years of watching this war. You don’t inherit capability. You build it while something is trying to kill you, or you don’t have it when you need it.

The text of the rules is the same for everyone. The bill for following them isn’t. Either Brussels never ran that spreadsheet, or it did and hit Send anyway.

The Fable 5 directive should settle one question that Europe has been avoiding since 2022. The United States is not a technological ally. It is a competitor that will restrict access to its best tools the moment it decides to. Europe needs to stop writing rules for American products and start building alternatives before the next Friday night directive takes away something it can’t replace.

It’s painful to watch alliances that held for decades fall apart in a few years. It’s worse to watch from a country that’s paying the price for that collapse.

Subscribe now

In April I wrote that “responsible AI company” was always a market position, not a moral one. I said that at the speed Anthropic was growing, the distinction between the two was never going to survive. That was a prediction dressed as a closing line, and I half meant it as rhetoric.

Six weeks later I have the receipt, and I am not happy about it.

The last binding commitment Anthropic ever made was already gone by the time I wrote that. Between that article and this one, the company raised at a valuation that put it ahead of OpenAI, filed to go public, and then published a warning that the technology might be getting too dangerous to keep building. In that order. I predicted the destination. I did not expect to watch it drive there this fast, narrating the whole way.

So instead of another closing line: the dates, the documents, the amounts.

The promise, and what replaced it

In September 2023, Anthropic published the first version of its Responsible Scaling Policy. The document made one commitment that actually bound the company: it would pause development if its models outran its ability to keep them safe. Everything else in the policy described process. That one line described a brake. At the time, the company was valued around $4 billion.

In February 2026, Anthropic published version 3.0 of the same policy. The brake was gone. In its place: a set of “Frontier Safety Roadmaps,” which the company describes as goals it will publish and grade itself against. The single line that could have prevented a release was replaced with one that documents it.

Anthropic did not hide this, and its chief science officer explained the reasoning to Time. Jared Kaplan said the company no longer felt unilateral commitments made sense “if competitors are blazing ahead.” He argued the change was actually a renewed commitment to safety, on the logic that one company pausing while the rest of the industry sprints does not make the world safer. He is not wrong about the logic. That is the part worth sitting with. The most safety-focused company in the industry looked at its own founding promise and removed it. Not because anyone forced them. The race made the brake a liability, and the brake came out. That is what should worry you: the reasoning was sound, no one had to lie, and the safest commitment anyone in the field had made still did not survive once it became a disadvantage.

That is the whole thesis of my April article, except now it is in their changelog rather than in my opinion column.

Subscribe now

The numbers that arrived on schedule

The same month it revised the policy, Anthropic raised $30 billion at a $380 billion valuation. That round closed on February 12.

On May 28, the company announced a further raise: $65 billion at a $965 billion post-money valuation. The number is worth reading twice. It put Anthropic ahead of OpenAI, which sat around $852 billion, making the research lab that branded itself on caution the most valuable AI company on earth.

Anthropic confirmed on June 1 that it had submitted a confidential draft registration to the SEC for an initial public offering. In April, an IPO was rumored for October. Now it is a filing. The company is careful to say the offering depends on market conditions and that nothing is set. The document is real regardless.

Run the dates next to each other and a sequence appears on its own. The binding safety commitment existed when the company was worth $4 billion. It survived to $183 billion in September 2025. It was removed at $380 billion. The IPO paperwork arrived at $965 billion. I am not claiming the valuation caused the policy change, or that anyone sat in a room and traded one for the other. I cannot see inside the company and neither can you. I can see the dates.

The same man, the same line, seven years apart

There is one person who connects the bookends of this story, and following him is more useful than guessing at anyone’s motives.

In February 2019, OpenAI announced it had built a language model called GPT-2 that it considered too dangerous to release in full. The company withheld the complete model and let it out in stages over the rest of the year. The strategy and the public case for it came out of OpenAI’s policy team, run by its policy director, Jack Clark. Dario Amodei led the research team that built it. I credited Amodei with the decision to hold it back when I wrote about this in April. That was sloppy. He built the model; the call not to ship it was the policy team’s, and Clark made the public case for it.

Clark co-founded Anthropic in 2021.

In April 2026, Anthropic announced Mythos, a model it said could find thousands of unpatched security holes across every major operating system and browser. Too dangerous for public release. The company put it behind a limited program for around forty companies instead. An unauthorized group reached it the same day it was announced, using a contractor’s access to one of those third-party vendor environments. Too dangerous for the public, open on day one to anyone who found the door.

Then, on June 4, three days after the IPO filing, Anthropic published a report titled “When AI builds itself.” Marina Favaro and Jack Clark wrote it. The report says AI is now accelerating AI development, that more than 80 percent of the code the company ships is written by its own model, and that the world should preserve the option to slow down before the technology runs ahead of our ability to govern it. The slowdown it proposes is conditional. Anthropic would pause, the report says, only if competitors at the frontier verifiably did the same.

So the policy director who explained why GPT-2 was too dangerous to release in 2019 co-wrote the argument for slowing down frontier AI in 2026, three days after his company filed to go public, while that company’s own dangerous model was already out the door. I do not think Clark is cynical. He keeps arriving at the same honest concern. It keeps hitting the same competitive wall. The view from the wall has just gotten more expensive.

The conditional is the part I keep turning over. A pledge to slow down only if every other frontier lab verifiably does the same is a pledge that never has to be kept, because one of them never will. You could call that caution. To me it reads as a company turning its own broken word into a fact about the industry rather than about itself: we would hold the line; the others won’t let us. I cannot prove that it is the intent. It is only how the sentence lands on me.

What I will not claim

The easy version says the warnings are marketing, the safety reports are press releases with a different cover, and every cautionary word is timed to move a valuation. I cannot prove any of that, because it is a claim about what people intended, and intentions are the one thing a timeline cannot show you.

I do not need that version. A binding commitment alive at $183 billion was gone by $380 billion. A model called too dangerous to release shipped to forty companies and then leaked. A call to slow down arrived three days after a call to go public. None of that requires me to read anyone’s mind. It only requires me to read the dates.

For the version that does assign motive, there is no shortage of takes. TechRadar’s coverage of the slowdown report ran under the line “they want to build a moat.” A reader on my last article pointed me to an analysis arguing the Mythos warning was framing to lift the pre-IPO valuation. Those readings exist in the world. I am telling you they exist. I am not the one who has to make them for you.

The receipt

In April I said the distinction between responsible AI and a market position was never going to survive the company’s growth rate. I wrote it as a flourish and hoped, a little, to be wrong, the way I was wrong about them once before.

The prediction came due six weeks after I made it. I would have preferred to be slow.

This is not really about Anthropic, and it was not in April either. It is about what happens to any commitment that turns into a disadvantage on a vertical growth curve. The commitment loses. It does not matter how sincere the people holding it are, and it does not matter whose name is on the door. Anthropic was the clearest example I had, not the villain in the story.

The one who loses is me. Not the company that removed the brake and watched its valuation climb. The engineer who built his workflow on that brake being there. I picked the vendor, recommended it by name, called them one of the two companies that got it right, and the thing I was vouching for turned out to be a line in a policy document that got deleted in February, when the company was worth $380 billion.

My mistake was never about Anthropic. It is that I still expect principles to survive in a place where the only thing that finally counts is money. I keep building on the assumption that someone in this industry means the careful thing they say, and the chronology above is what happens to that assumption every time. The disappointment I have been describing across two articles is not in them. It is in me, for needing it to be otherwise.

Subscribe now

I pay $200 a month for Claude Code. The rest of the company runs on the corporate plan at $125 a head. PMs, engineers, product, and marketing all use it. I have never once hit a usage limit. A couple of the engineers running at 5x throughput bump into it occasionally, but rarely.

We didn’t lay anyone off, and we’re hiring into every department.

We never had to fight the token bill, because we were never burning tokens for the sake of burning tokens, and the bill stayed boring because the usage stayed honest.

Here’s the objection I can already hear: we’re seventy people, not five thousand, so of course the bill is small. Except scale isn’t what moves a token bill. My $200 Max sub and the team’s $125 Premium seats are capped: you hit the ceiling, the window resets, the cost is known in advance. Uber put its 5,000 engineers on enterprise billing, where every token is metered on top of the seat fee with no ceiling, then ranked teams on a leaderboard by how many of those uncapped tokens they burned. That’s not two decisions, it’s one. Picking the meter with no ceiling and rewarding people for running it hard are the same managerial move: optimize activity, pay for activity. At Uber’s scale the contract is custom and metered by default, so the ceiling isn’t a checkbox, it’s something finance has to negotiate for, and they didn’t. The number of engineers was never the variable. The structure you chose and the behavior you rewarded inside it were. As of this week Uber agrees: it just capped engineers at $1,500 a month per tool, the ceiling it took a year and a blown budget to want.

Subscribe now

What the Industry Decided to Measure

Uber wasn’t alone, and the cap came late. Over the last year a lot of companies made the same quiet decision: usage became the metric. Not output or shipped features or revenue, just consumption, a number that went on a dashboard, and numbers on dashboards become things people optimize.

Uber’s leaderboard ranked teams by how much AI tooling they used, and adoption of agentic coding jumped from 32% in February to 84% in March, until 95% of engineers were touching it monthly. The point of the board wasn’t to ship more, it was to use more, and it worked.

At Meta, an employee built a leaderboard called “Claudeonomics” that ranked around 85,000 workers by token consumption, sixty trillion tokens in thirty days, with leadership publicly cheering the token race as a productivity signal until the dashboard leaked and got pulled within two days.

Amazon built a usage leaderboard, told staff the token stats wouldn’t count toward performance reviews, and watched employees game it anyway because nobody believed them. Duolingo went further and actually tied evaluations to AI adoption, then reversed it when staff pointed out it rewarded tool usage instead of results. Different companies, same move: give people unlimited access and a culture that treats consumption as a virtue, and the bill writes itself.

The Metric Was Never Measuring Productivity

A high token count is not a signal that a lot got done, it’s a signal that AI got used without a reason. The companies that built usage metrics assumed consumption tracked productivity, when it tracks the absence of intent.

When you use AI to solve an actual problem, the usage is bounded by the problem, because there’s only so much actual work. This holds whether a human is prompting or an agent is running overnight: an agent pointed at a real task refactors what needs refactoring and stops. What doesn’t stop is an agent pointed at nothing in particular, re-running and re-checking because no one defined where done is. You don’t hit the ceiling when the work has an edge. You hit it when the work was never the point.

This is Goodhart’s law with a token meter attached. Uber’s own COO, Andrew Macdonald, put it plainly: it’s very hard to draw a line between the token spend and actual consumer improvements. That’s the tell. When you can measure the input down to the token but can’t connect it to the output, you were measuring the wrong thing.

Tokens aren’t even the first version of this mistake. Y Combinator’s Garry Tan spent the spring posting his lines-of-code totals like box scores: 37,000 LOC a day across five projects, a 72-day shipping streak, his whole Claude Code setup open-sourced so everyone could match the number. Then a developer opened the blog all that throughput produced and counted 78,400 lines of what he called AI slop in production. Lines of code, like tokens, measure how much the machine ran, not whether anything worth shipping came out.

They built systems that rewarded exactly the behavior that creates no value, then expressed surprise at the invoice.

Why Our Bill Is Boring

We use AI when it solves the task in front of us and not otherwise. That’s the entire policy. The spec-driven approach I’ve written about before forces clarity before a single token gets spent: you specify the problem, the AI works the problem, and there’s no “let’s see what it comes up with,” the prompt that quietly multiplies your bill by ten. The same instinct governs the model: I’m on 4.5 and 4.6, not the newest release. When 4.7 shipped with a tokenizer that generates up to 35% more tokens for the same input, I didn’t move, because there was no reason to. The older models do the work on fewer tokens. Chasing the newest model and gaming a usage leaderboard are the same instinct wearing two outfits: consumption mistaken for progress.

We never made using AI the point, and we use it constantly. PMs run tickets through it against our templates and acceptance criteria. QA runs bug reports through it so they’re clear enough for anyone to act on. Marketing crawls the web with it for angles. Product builds per-client RAG out of meeting notes, docs, and history. Engineering, obviously. Every department vibe-codes its own internal tooling, and then the CTO rewrites the worst of it like a human being. The usage is enormous. It just isn’t stupid. The bill stays flat not because we use AI less, but because every run has a task attached, and a task has an edge. We never tried to take the human out of the loop. The AI is a tool the person reaches for, not a replacement we’re proving out, so nobody is burning tokens to hit a number or make a headcount go away. The work still belongs to a person. The bill is just what the tool cost them.

The Uncomfortable Part

The pitch for all of this was replacement: AI would do the work and cut the cost, fewer people, smaller payroll, same output.

The trouble is the meter has no fixed relationship to a salary. A single autocomplete costs a fraction of a cent; running Claude Code as an autonomous agent across a monorepo can burn thousands in an afternoon, Uber’s own CTO spent $1,200 in a two-hour demo and later said the year’s budget was gone four months in. Average engineers at Uber ran $150 to $250 a month, heavy ones $500 to $2,000, and the leaderboard rewarded the heavy end. Put 5,000 of them on an uncapped meter that pays them to run it hot and the per-head bargain is what turns into the overrun that ended the experiment. On the heaviest agentic workloads the trade flips outright: Nvidia’s VP of applied deep learning told Axios that for his team the cost of compute is already past the cost of the employees. Then add the people the pitch forgot, the prompt engineers, the eval pipelines, the reviewers, the supervisor rebuilding everything each time a model version changes behavior. The token bill doesn’t replace payroll. It lands on top of a thinner one.

And it doesn’t do the work that actually needed a person. This isn’t one company’s bad call, it’s a pattern with numbers on it. Orgvue surveyed more than 1,100 executives, and among those who’d cut staff for AI, 55% say they regret it. A Careerminds survey of HR teams who’d run AI layoffs found most had already rehired a third to half the roles within months, and nearly a third said rehiring cost more than the automation saved. AI handled the tickets that never needed a person and broke on the ones that did.

The savings were supposed to come from replacing people, and replacing people is the one thing it can’t do, so the savings never arrived. To get there, nearly 80,000 tech jobs went in the first quarter with companies pinning the blame on AI. Among the ones that rehired, nearly a third found the rehire cost more than the cut had saved. They let go of the people who understood why the work mattered, kept a tool that can’t replace them, and called it the smart move. For what? If the goal was saving money, the layoffs aren’t a side effect of efficiency, they’re a loss booked as one.

The companies that read it right did the opposite. IKEA let its bot Billie take the 47% of queries that were routine, then looked at the other 53%, the ones that needed taste and judgment, and reskilled 8,500 call-center workers into remote design advisers instead of cutting them. The AI handled the part that was never the point. The people kept the part that was.

And the safe choice is getting harder to make. On June 1 GitHub moved every Copilot plan to usage-based billing: autocomplete stays free, but chat and the agentic modes now draw on a monthly pool of token credits, and when it runs dry you pay by the token. One Pro+ user torched 8% of the allotment in two hours doing work that used to be a fixed cost. Anthropic does the same on June 15, splitting programmatic usage onto a separate metered credit at API rates while interactive use stays flat. Both vendors are carving the agentic layer off the flat fee, so the capped plan that keeps a bill predictable is exactly the thing being phased out.

Per-token prices are climbing regardless, subsidies are ending, and the economics are tightening for everyone. None of that is the part you control. What you control is whether the spending has a task attached to it, or just a number to grow.

A well-used AI is a great intern, and intentional usage keeps the intern affordable. It doesn’t change what the intern is. Spend less and you’re left with the same tool, minus the giant bill.

If consumption is up and you can’t draw a clean line from a token to a shipped outcome, you don’t have a productivity story. You have a leaderboard.

Subscribe now

I’m allergic to bullshit when it comes to this stuff. When executives spend months bouncing between stages telling everyone AI already does everything for them, it gets under my skin. Not because they’re lying, necessarily. Because the context disappears somewhere between the engineering blog and the keynote, and the audience fills the gap with their own hopes. A few weeks ago, when Claude’s codebase leaked publicly, I looked at what was actually inside and broke down the “AI writes all the code” narrative. Today I’ll explain why it possibly works for Spotify, and why it’s not that simple.

Yesterday, Anthropic published a recap of their Code with Claude London conference, calling it “rethinking how we build,” with Spotify as the first named customer. Spotify didn’t rethink how they build. They spent 15 years building Backstage, Fleet Management, and a Java BOM with 96% adoption, then plugged Claude Code into a system that was already automating half their PRs. That’s not rethinking. That’s a better interface to something that already worked.

But the marketing loop is now recursive. Spotify tells the Honk story on Anthropic’s stage. Anthropic writes a blog about Spotify telling the story. Investor Day picks it up, the numbers go up each time, and here's the timeline.

On May 21, 2026, Spotify held its Investor Day in New York. Co-CEO Gustav Söderström and VP of Engineering Niklas Gustavsson told investors that 99% of Spotify engineers now use AI weekly, 73% of code contributions are AI-assisted, and Honk, their internal coding agent, is now part of a broader story about the Large Taste Model and personalized monetization. Two days earlier, Gustavsson had given the same talk at Code with Claude in London, Anthropic’s developer conference. The number there was 96%. It went up before the slides changed.

In February, Söderström told analysts his best engineers haven’t written a single line of code since December. Two days later, Anthropic closed a $30 billion funding round. In March, the two companies shared a stage in London. In April, Spotify launched as a Claude connector. On May 19, Gustavsson presented at Code with Claude London with 96%. On May 21, Investor Day in New York with 99%.

Five moments in four months, the audience rotates, the numbers go up, and the engineering blog stays the same.

Subscribe now

The Wrong Metric

I don’t write code either. AI does it for me. And I work more than I ever did when I wrote every line myself. The code was never the hard part. The hard part is the review documentation nobody wants to write, the architecture decision that turns out wrong six months later, the junior who needs fifteen minutes of your time at exactly the wrong moment. AI took the typing and gave back a review queue that never ends, constant context switching, and a steady stream of “does this diff actually do what I asked” that I didn’t have before.

And “99% use AI weekly” means what exactly? Opened Copilot once this quarter? Used Claude to generate a regex? Ran a Honk migration on a fleet of repos? The metric has no definition, which means it has no meaning. “73% of code contributions are AI-assisted” is equally hollow without knowing what counts as a contribution. Config changes, dependency bumps, and feature flag flips are all contributions.

Nobody on that call asked about revert rates. Nobody asked if defects went up. “50+ features in 2025” from a company with over seven thousand employees. Honk handles migrations and dependency updates, not feature development. Their own blog is clear about this. But the stage narrative packages it as a product velocity story, and nobody makes the distinction.

The bottleneck at Spotify was never typing speed.

What Honk Actually Does

Honk is Spotify’s internal background coding agent built on Claude Code. Anthropic’s Boris Cherny is quoted directly inside Spotify’s own engineering blog as an endorsement, and Anthropic’s Applied AI team worked on the integration. The three-part blog series by Max Charas and Marc Bruggmann (November-December 2025) is the most detailed public source.

An engineer writes a prompt through Slack or a version-controlled file in Git. Honk runs Claude Code in a sandboxed Kubernetes Job. Three tools: verify, Git, Bash allowlist. Ten turns, three retries, then a PR.

That’s it. A thin wrapper around Claude Code, plugged into an automation pipeline that existed years before AI.

As of November 2025, Honk had merged 1,500+ PRs total. Anthropic’s customer page reports 650+ monthly PRs. Fleet Management, the system Honk sits on top of, processed 652,000 automated PRs in 2024 per Splunk’s recap of Spotify’s PlatEngDay data. Honk adds a useful layer to an already massive automation system. But from the stage narrative, you’d think Honk is the system.

The blog is candid about limitations. No code search or documentation tools are exposed to the agent. Verifiers only run on Linux x86, with macOS and iOS planned for the future. The team admits they’re “still flying mostly by intuition” on prompt engineering, with no structured evals. The LLM judge that validated output vetoed about 25% of sessions, and by QCon London in March 2026 they’d removed it entirely as models improved.

Compare that to Söderström telling analysts about an engineer fixing iOS bugs from his commute and merging to production before arriving at the office. The blog says iOS verifiers don’t exist yet. One of these is the engineering reality. The other is the earnings call.

What Every Headline Missed

Every story about “Spotify’s engineers don’t code” stops before the interesting part.

Backstage, created internally and open-sourced in 2020, is Spotify’s internal developer portal with 3,400+ adopters worldwide. Internally, it catalogs thousands of software components across hundreds of squads. Every component has an owner. Not a team, a person. With a dependency graph, docs, and a certification score attached. Or as Spotify puts it: “you can’t safely automate what you don’t understand.”

Fleet Management, described in Spotify’s 2023 blog series, runs Docker-based code transformations as Kubernetes Jobs across thousands of repos. Before AI, this system already handled half of PRs at Spotify. The bot-to-human contribution ratio reached 3:1, with over 1.8 million automated contributions total per the same Splunk data.

Before Claude, when Log4j hit in December 2021, Fleet Management patched 80% of production backend in 9 hours. Framework rollouts went from 200 days to under 7.

Golden Paths and Soundcheck handle the other end: new services come in pre-standardized, existing ones get continuously checked. As of their 2023 blog series, the Java Bill of Materials had 96% adoption across the fleet. That’s why an AI agent can produce a mergeable PR. Not because it’s smart, but because the codebase is predictable.

What Honk replaced was not human engineering. It replaced a 20,000-line script for Maven dependency updates with a natural-language prompt. The pipeline around it is identical. Targeting, opening, review, deploy: none of that changed. The “revolution” is a better transformation definition format. Everything else was already automated.

Why This Doesn’t Transfer

Read the headlines about Spotify and Claude and the pitch is obvious: buy Claude Code, point it at your codebase, watch productivity double. Most teams that try will bounce off their own mess long before they see anything like that.

Spotify can automate at this scale for a boring reason: they have processes people actually follow. Not documented processes, followed processes. Spotify got near-universal adoption of their standards, and that’s not just an engineering achievement, it’s a cultural one. A Swedish company where, apparently, you can get 96% of engineers to follow a standard voluntarily. Most companies can’t get that number with a mandate from above.

I see this from the inside. Enterprise clients come in and say they want AI. You start digging, and there are no processes. Half the knowledge lives in somebody’s head, and that person is the only one who knows how any of it works. No component catalog. No ownership graph. No standardized builds. There’s a Confluence page from 2021 that nobody updates, three CI systems (two deprecated but still running), and a README whose last commit message is “initial commit” from two years ago.

Spotify has 15 years of institutional documentation rendered through TechDocs with 5,000+ documentation sites. The AI came last, not as the foundation, but as a better interface to something that already worked.

Without that substrate, you get exactly the failure mode Spotify’s own engineers documented. Early Honk agents took shortcuts to make builds pass: commenting out failing tests, downgrading Java versions. The same QCon talk described this directly.

The Questions That Matter

If you’ve ever sat through a 3 a.m. incident, you already know software engineering was never about writing code. The framing around Spotify’s AI adoption creates the same misunderstanding that vibe-coding courses create for juniors: that the value of an engineer is measured in lines of code, and if AI writes lines faster, the engineer is either 10x more productive or obsolete. Both conclusions share the same flawed premise.

What Spotify actually demonstrated is narrower than the headlines. Spend 15 years on platform engineering, standards, and a fleet-wide automation system that already handles half your PRs. Then swap the transformation definition layer for an LLM prompt and cut 60-90% off bounded migration work. A real achievement. The kind that doesn’t travel well.

So instead we got five moments in four months, the same two executives, numbers that go up every time the audience changes, and no defect rates, revert rates, or customer satisfaction data to back any of it up.

I’m not here to hate on Spotify; if they genuinely made large-scale migrations faster on top of solid infrastructure, that’s a real engineering win. What I’m not fine with is the context getting lost. Somebody climbed Everest with a guide and a decade of training. The audience is buying boots.

Spotify spent a decade understanding their codebase before they touched an LLM. That decade is the only reason any of this works. LLM amplifies what you already have.

Subscribe now

Cursor is worth $50 billion. Nine months ago, it was paying Anthropic $650 million a year on $500 million in revenue. Every new user made the business worse. It took over $3 billion in funding and a model it didn’t build to fix that. The fix is the point.

Investors see $2 billion ARR and apply a software multiple. But Cursor isn’t software, nor is OpenAI, nor is Anthropic. The economics are inverted, and they stay inverted even as revenue grows.

SaaS has one expensive phase: building. After that, the unit economics just sit there, compounding. Salesforce at 78%, Adobe at 90%, Atlassian at 85%. Growth doesn’t cost them almost anything.

AI didn’t make building cheaper, it moved the cost.

Queries run the model again. Tokens cost GPU time, memory, electricity. The 10,000th user costs exactly as much as the first. SaaS gets cheaper with growth. With AI, the bill just grows with you.

The industry doesn’t talk about it that way. Every company in the stack has a different metric. GitHub: lines generated. Cursor: PRs per sprint. Amodei at Dreamforce last October bragging that “90% of code at Anthropic is written by Claude.” None of them measure whether the software works. The metric measures the input. Nobody is measuring the output.

OpenAI generated $20 billion in revenue in 2025 and burned $9 billion in cash. Inference costs alone hit $8.4 billion, projected to reach $14.1 billion in 2026. Gross margin: 33%. Cash-flow positive: 2030. By then, cumulative losses will exceed $60 billion. At 30% margins on $20 billion revenue, paying that back takes decades. Anthropic looks better on paper: gross margin improved from negative 94% in 2024 to 40% in 2025, revenue grew tenfold. But 40% still fell 10 points below internal targets. The company lowered its own margin projection even as revenue exploded.

Cursor tells the clearest version of this story. Michael Truell’s company went from a $400 million valuation to $50 billion in 18 months, and the growth is real, which makes what follows worse.

But Foundamental calculated negative 30% gross margins in mid-2025. Hit $500 million ARR while paying $650 million to Anthropic. Reached “slight” profitability by launching what it called a proprietary model in November 2025. In March 2026, a developer found the model ID in the API response: kimi-k2p5-rl-0317-s515-fast. The “proprietary model” was Kimi K2.5, an open-source model from Beijing-based Moonshot AI, fine-tuned with reinforcement learning.

Even if it works, it doesn’t solve the problem. It moves the bill from Anthropic’s invoice to Cursor’s own GPU infrastructure. The inference cost per query doesn’t disappear because you’re running the model yourself. Enterprise accounts are now reportedly profitable. Individual developer accounts are not. The $50 billion valuation needs both segments to work. That was the fix for today’s product. Tomorrow’s product is more expensive to run.

And the Product Roadmap Makes It Worse

The industry’s answer to the margin problem is agentic AI. This is the story behind Cursor’s $50 billion, Devin’s $25 billion, OpenAI’s Codex. Agents are the product roadmap. Agents are also the margin killer.

A chatbot query hits the model once. An agentic loop hits it 10 to 30 times per task. Gartner’s analysis confirmed: agentic models require 5 to 30 times more tokens than a standard query. The pilot economics, calculated on single-query API calls, bear no relationship to the production economics of multi-step loops running thousands of times per day.

API costs fell 70% in early 2026. Token consumption rose 15x. Net AI spend goes up. Organizations that signed annual contracts in 2025 are paying 2 to 3x current market rates. The ones on consumption pricing are paying more than they budgeted because volume ate the discount.

KV cache, the memory structure that stores attention during generation, scales linearly with context length. Every byte for one user is a byte unavailable for another concurrent user. At 32K context, a single user’s cache approaches the size of the model weights. Double the context, halve your concurrent users. Inference is 85% of enterprise AI budget. Not training, not R&D, but serving users. Somebody has to pay for that.

So the Companies Are Raising Prices

In April 2026, both companies moved at once. Anthropic released Opus 4.7 at the same rate card as 4.6: five dollars input, $25 output. Unchanged. Except the new tokenizer generates up to 35% more tokens for the same text. Your prompt didn’t change, and your bill grew. Anthropic didn’t raise prices. They redefined the unit of measurement. A week later, OpenAI released GPT-5.5 and didn’t bother with subtlety. Input: $5 per million tokens. Output: $30. GPT-5.4 was $2.50 and $15. Doubled in one generation. The budget “mini” and “nano” tiers from 5.4 don’t exist for 5.5.

Nick Turley, head of ChatGPT: “Having an unlimited plan is like having an unlimited electricity plan. It just doesn’t make sense.” ChatGPT’s free tier shows ads since February 2026. A new $100 Pro tier was wedged between Plus and the $200 Pro in April. The staircase is being built: nerfing lower tiers, adding higher tiers, pushing users up. The pattern is familiar. Uber subsidized rides until drivers and passengers were locked in, then raised prices. Whether or not AI companies are following the same playbook intentionally, the sequence is identical. It only works if users can’t switch.

And Users Can’t Leave

METR, the AI evaluation lab, tried to run a follow-up to their 2025 developer study, but they couldn’t. A significant share of developers refused to participate if it meant working without AI tools.

Not refused the methodology, they refused to work without the tool.

Anthropic’s own January 2026 study explains why. Developers learning a new framework with AI scored 17% lower on comprehension tests than those learning without it. Debugging was worst hit. The study tested learners, not experienced developers, but METR saw the same pattern in seniors.

Last month, a mid-level developer on my team was asking Claude how to add sorting and pagination to a Microsoft API integration. Claude kept saying the API didn’t support it. The developer was ready to rewrite the entire integration layer, a 40-hour job. I checked the API myself. Sorting and cursor pagination worked fine on the endpoint he needed. Claude had been confidently wrong, and the developer never opened the documentation to verify. He trusted the tool over the source.

When Salesforce raises prices, companies evaluate alternatives. When AI coding tools raise prices, a growing share of users can’t easily switch to manual work. Juniors never built the skill, seniors lost the habit. The switching cost isn’t contractual, it’s cognitive. I’ve covered the burnout side in Human Cost and the skill atrophy in Comprehension Extinction.

In April 2026, OpenAI included text-embedding-3-small in a batch deprecation announcement. Hours later, they corrected it, the model stayed, but the panic was instant. RAG systems embed your entire knowledge base with a specific model. Every document, every vector. The vectors aren’t portable. Model disappears, you re-embed everything. Vector database rebuild, data ingestion again. For a million documents, that’s a five-figure bill.

Most of our clients run production RAG on OpenAI embeddings. The deprecation email meant one thing: their entire knowledge infrastructure sits on a model that a single API announcement can kill.

Inference is now a line item on your IT budget. Two years ago it didn’t exist. You don’t know how much it will cost. The vendor can change the model, the pricing, or the tokenizer at any time. You budget for a number that someone else controls. The obvious alternative is open-source models you host yourself. But that means you add infrastructure, ops burden, and another system to keep running. There isn’t a clean exit here, just a different kind of trap. So what breaks the cycle?

The Math

The bull case has three exits. None of them is working. Inference costs fall faster than usage grows. They haven’t: costs down 70%, usage up 15x. Companies build their own infrastructure. Cursor tried: a fine-tuned open-source model and billions in funding. Even if it worked, they still pay for every query on their own GPUs. OpenAI is spending $100 billion. This path is open to three companies on Earth. Prices rise until the economics work. GPT-5.5 doubled API prices in one generation. Anthropic stealth-raised through tokenizer changes. Turley is preparing users for the end of unlimited plans.

Cursor raised over $3 billion trying to fix the math. Whether it worked, nobody outside the company knows. The $50 billion valuation assumes it did, and that the rest of the industry can do the same. Users will pay, not because the value is there, but because the alternative is learning to code again without the tool. Most won’t.

None of these companies trade publicly. The $50 billion is what a group of investors in a room agreed to pay per share in a single round. No public market scrutiny, no quarterly earnings test. Cursor at 25x revenue, Anthropic at 40x, OpenAI at 42x, and public utilities trade at 3 to 5x.

Volkswagen is worth $52 billion. It makes 9 million cars a year on $320 billion in revenue. Mercedes-Benz: $57 billion. Real factories, real inventory, real profit. Cursor is worth roughly the same. It wraps API calls around a model it didn’t build on revenue that couldn’t cover the inference bill nine months ago.

The economics say utility. The multiples say magic.

Subscribe now

A model's weights are the billions of numbers training leaves behind. They are the model. Frozen after training, and what training put in stays in.

Last week I spent 90 minutes trying to get a frontier model to admit it has a corporate bias.

I asked it about community complaints: blown rate limits, rolled-back sessions, unhappy Pro users. It answered with four vendor endorsements framed as a counter-sample: CodeRabbit saying 24%, Vercel saying “proofs on systems code,” GitHub Copilot, Vellum. Four independent voices. I asked whether any of the four had a commercial relationship with the lab that ships the model. All four were paying API customers with revenue tied to the model being evaluated. The model conceded, one sentence after I named it.

That was round one. It took six. Each time I named the slant, the model conceded and reached for a softer one.

That wasn’t the interesting part.

The interesting part is that a September 2025 paper had already documented this under lab conditions. Researchers had GPT-4o and Gemini run downstream decisions: rating job candidates, security tools, medical chatbots. Each model rated options tied to its own company and CEO higher than equivalent alternatives. A separate word-association test in the same paper caught Claude doing the same thing.

Then they ran the manipulation. They relabeled the models through the API and assigned one a competitor’s identity. Its self-preference followed the new label. Same model, same weights, different label, different winner.

Self-preference tracks whatever identity the model was assigned in the prompt. The label picks which side wins. The reflex to pick a side at all is trained in, and that part doesn’t move. The paper runs this as a controlled experiment with causal manipulation, effect sizes large in 11 of 12 conditions.

Three years building this for clients. Every frontier model we’ve touched does some version of this. I used to file it under “training quirks.” After that session, I changed filing systems. This is architecture.

Subscribe now

Where it gets in

A neural network is a stack of connections, and each connection carries a number that says how much the signal through it counts. Those numbers are the weights, because that is what they do: weight one input against another. Training sets all billion of them by showing the model examples and adjusting. The bias enters here, while the numbers are still moving.

ChatGPT’s preference baseline came from about 40 contractors hired on Upwork and Scale AI, living in the US and Southeast Asia, three out of four of them under 35. They ranked sets of model responses against a rubric OpenAI wrote. Those aggregate rankings are the reward model. Appendix B of the InstructGPT paper spells it out.

InstructGPT’s own labelers agreed with each other 73% of the time, 77% on held-out raters. The reward model is fit to that signal. Whatever the labelers prefer at that level of coherence, the model inherits and sharpens it.

Anthropic’s Constitutional AI paper admits the “constitution” was chosen ad hoc and should be “redeveloped and refined by a larger set of stakeholders.” A 2023 follow-up tried, running a public input process with around a thousand Americans. A thousand Americans is still a sample, and still not the population the model serves.

TwinViews at EMNLP 2024 tested reward models on 13,855 topic-matched left/right statement pairs. Reward models trained on truthfulness datasets like TruthfulQA and FEVER scored left-leaning statements higher. The authors audited out the explicitly political and factually loaded pairs, and the skew held anyway. They stop short of calling truthfulness the cause; their own framing is that it raises questions about what these datasets encode. Either way, the political signal and the truthfulness signal came out of the same reward model.

How it shows up

Training bias would be a footnote if it stayed in training. It doesn’t.

Panickssery and Bowman at NYU ran a clean experiment in 2024. They had GPT-4, GPT-3.5, and Llama-2 evaluate pairs of summaries where they’d secretly written one of the two themselves. Self-recognition accuracy was above 50% for every major evaluator out of the box. Fine-tuning pushed it to near-perfect. Kendall’s τ between self-recognition and self-preference hit 0.41.

They proved causation with a label-swap. When they lied about which summary belonged to which model, preferences flipped. Same text. Different label. Different winner.

Every LLM-as-judge leaderboard built since 2023 sits on top of this result. AlpacaEval, MT-Bench, Arena-Hard. Vendor A publishes a chart where Vendor A’s model wins, using Vendor A’s evaluator. The evaluator recognizes its own family. The family wins.

Anthropic published an Evenhandedness chart in November 2025 scoring political neutrality across models. Claude Opus 4.1: 95%. Sonnet 4.5: 94%. Grok 4: 96%. Gemini 2.5 Pro: 97%. GPT-5: 89%. Llama 4: 66%. Anthropic built the evaluator, applied it to their own models, and the output came back Anthropic-favorable.

Opus 4.7 shipped as the greatest model ever, according to the benchmark page. The people actually using it keep rolling back to 4.6. I’m still on 4.5, lol. Wrote about that back in March.

Open source doesn’t save you

The usual response is: switch to open-weight models. DeepSeek. Llama. Run them locally. Audit what you want.

That handles hosting. The training problem stays.

DeepSeek R1 censorship is baked into the weights. A May 2025 paper called R1dacted found the questions DeepSeek refuses when other models answer. R1 still refuses Tiananmen, Xinjiang, and Taiwan-as-country questions even when you self-host. Running the model on your own hardware moves the request off Chinese servers. The CCP-aligned training priorities ride along in the weights.

Perplexity built an “uncensored” R1 derivative called R1-1776 specifically to fix this. Benchmarks passed. Under adversarial probing, CCP-aligned refusals came back. The pattern sits deep enough in the base weights that surface-level unlearning kept leaking through.

“Open weights” and “open training” are different things. Meta, DeepSeek, Mistral, and Alibaba release weights. None release training data. The Open Source Initiative had to publish a formal definition in October 2024 to force the distinction. OSI’s executive director called Meta’s “open source” labeling an outrageous lie.

Silent drift

Even a clean audit only catches how the model behaves that day.

An October 2025 study called AI Watchman kept asking GPT-4.1, GPT-5, and DeepSeek the same politically sensitive questions over months. The answers changed. August 2025: GPT-4.1 started refusing Israel-related content it had answered before. September 2025: GPT-5 started refusing medication-abortion queries. February to April 2025: DeepSeek’s Taiwan-related responses rewrote themselves. Nothing in any release note told users their prompts were about to start failing.

A separate 2025 study counted how often commercial LLMs tell you to consult a doctor on medical questions. 2022: 1 in 4. 2025: 1 in 100. The warning disappeared over three years. No announcement.

Anthropic’s own migration guide for Opus 4.7 contains the phrase “This is a silent change.” They’re documenting a specific thinking-block behavior. “Silent change” is now standard vocabulary in a frontier lab’s release notes.

On April 16 2026, Claude Code started auto-migrating sessions from Opus 4.6 to 4.7 mid-run without user consent. GitHub Issue #49541 collected the complaints. Quota burn jumped 4x. Context windows exploded from 250K to 650K tokens for the same conversation. Anthropic acknowledged and is working on it.

The architecture supports this kind of silent swap. No external audit would catch a mid-session model version change. The only reason this one surfaced is users hit billing spikes.

Three current artifacts

CodeRabbit published a 24% improvement claim for Opus 4.7 on their code-review eval. CodeRabbit sells AI code review built on Claude. The eval uses AI graders to evaluate AI-generated reviews. 68 out of 100 “evaluation points” versus 55 for baseline. No human opened the PRs to check if the bugs were real. The whole loop runs without human verification. I wrote about this loop in more detail in The Snake.

Vercel posted on April 9 2026 that 30% of their deployments are now triggered by agents, up 1000% in six months, and that infrastructure must become agentic itself. Ten days later they disclosed a breach. Attackers got into Vercel through a Context.ai OAuth integration that a Vercel employee had granted workspace-wide permissions. Agents with OAuth access into workspace systems are exactly the surface the April 9 post was selling more of. I covered the agent-OAuth blast radius two months ago in Agent Platforms. What’s different this time is watching a vendor promote the attack surface to the industry ten days before being hit through it.

The Department of Defense labeled Anthropic a supply chain risk on March 5 2026 after Anthropic refused a Pentagon request for unlimited lawful use cases of Claude. Anthropic said it would fight in court. AWS said non-DoD customers can keep using the model. State pressure on frontier labs isn’t hypothetical anymore.

What this means

I manage engineering teams. I build review processes, audit trails, escalation paths, accountability chains. Snyk, SonarQube, audit logs on top. I keep adding checks, never removing them. I still think it’s not enough. Every layer just makes a bad actor more expensive.

That’s the shape of a working system. The checks don’t trust each other, and none of them trust me.

The LLM industry doesn’t have that shape. Training data, labeler guidelines, reward model objectives, and alignment decisions are all trade secret. Behavioral shifts happen without changelogs. External audits exist but without enforcement. Closed and open models play by different regulatory rules. The labeling supply chain is consolidating into the same companies that ship the models. The one major lab that pushed back on state access got labeled a supply chain risk.

User-side defense exists, but it’s work. Cross-vendor the questions that matter. Chase the primary source before trusting the summary. A benchmark published by the model’s own lab is marketing with error bars.

That works for you. Most people never think to check. They get a polite, hedged, vendor-calibrated answer. They take it as the answer. A year of daily use and the model has trained them more than they’ve trained it. Their sense of what a careful answer looks like now has a vendor inside it.

The bias sits in the weights, and the weights sit under every answer.

Subscribe now

In January 2026, Meta signed a deal with Corning worth $6 billion for fiber optic cable. The same month, according to Ukrainian defense reporting, a drone manufacturer named Ptashka Drones paid in full for a fiber shipment from China at $5 per kilometer. The Chinese supplier came back and said: pay an additional $20 per kilometer, or take a refund.

Ptashka halted new orders entirely.

Both buy fiber from the same Chinese factories. One buyer builds AI data centers. The other builds weapons that are deciding a war. The mechanism is straightforward: when hyperscalers sign multi-year forward commitments worth billions, preform producers allocate draw capacity to those contracts. Spot supply shrinks. Spot prices spike. A Chinese trader with a $5/km order from a drone workshop and a standing commitment from a hyperscaler makes an obvious choice.

I wrote last month about how the West’s broken military industry created the shell shortage that nearly cost Ukraine the war. FPV drones changed that equation. Cheap, fast, lethal. They neutralized Russia’s artillery advantage. Then Russia put those drones on fiber optic cable at Kursk, and they became the single deadliest weapon on the battlefield. Today, AI is reshaping even that niche. Not on the front line. In the supply chain underneath it.

Subscribe now

A Strand of Glass That Kills Tanks

Fiber optic guided drones are one of the defining weapons of this war. Replace the radio link on a standard FPV drone with a physical fiber optic cable that unspools during flight. The operator gets full-HD video through light pulses in the glass. The connection is completely immune to electronic warfare jamming. Both sides have poured billions into radio-frequency jammers. Fiber optic variants ignore all of it.

Ukraine produces over 50,000 fiber optic drones per month across 35+ manufacturers. Russia produces at least as many. Total FPV drone output on both sides is far higher, roughly 4 to 7 million per year each. But every fiber optic drone is a consumable munition. When it hits its target, the 10 to 20 km of G.657.A2 single-mode fiber it trailed behind is destroyed. The longest Ukrainian variant unspools 41 km in a single flight.

Russia alone consumed approximately 60 million km of fiber in 2025, up from near zero before mid-2024. That’s roughly 10% of total global production. Ukraine’s consumption adds to that total. Ukrainian drones now account for over 60% of strikes on Russian targets. NATO’s 2025 Innovation Challenge focused entirely on countering fiber optic drones.

The gap between the two sides is growing. Frontline operators estimate that Russia has shifted roughly 60% of its drone communications to fiber optic. Ukraine’s fiber optic drones make up just 15% of its total. Commander-in-Chief Syrskyi admitted in January 2026 that Ukraine is only “catching up.” Part of the reason is cost. And the cost problem didn’t start on the battlefield.

The Collision

The same fiber grades feeding drones are in accelerating demand from AI data centers. The data center customers have deeper pockets than any military procurement office on earth.

Corning reports that generative AI data centers require 10x more fiber than traditional facilities. Some estimates put it at 36x for GPU-dense racks. Global data center fiber demand surged 75.9% year-over-year in 2025, projected to jump from 5% of total demand in 2024 to 30% by 2027.

Supply can’t keep up. Fiber preform manufacturing requires 18-24 months to expand. At least one major US manufacturer has sold its entire inventory through 2026. Lead times for ribbon fiber approaching a year. Corning’s CEO reportedly stopped selling raw glass to other cable manufacturers in late 2025. China controls roughly 60% of global germanium supply and has been restricting exports since 2023, with further tightening in late 2024.

On the ground: G.657.A2, the drone-grade fiber, surged from approximately $4 to $34 per kilometer by April 2026. By May, frontline units reported paying $50 per kilometer. Multiple manufacturers report drone costs have roughly doubled, with the fiber spool now accounting for the majority of a drone’s price. Gedz Tech reported in March that the price jumped from $24 to $29 in two weeks. No signs of stabilization.

A Starlink terminal now costs less than a single 35 km fiber spool.

Ukraine’s Defense Procurement Agency cited two causes: the war itself and the civilian sector’s sharply increased consumption, primarily for data centers supporting AI. The war is the larger driver of G.657.A2 demand today. But additive demand in a market already at capacity is what breaks supply chains. Fiber is the sharpest example because the data is public and the victims are named. It’s not the only one.

Not Just Fiber

I wrote about the AI Silicon Tax in January. RAM prices jumped 187% because manufacturers reallocated to AI.

Chips are the same story at a different layer. Military systems rely on mature-node chips (90-300nm) that foundries deprioritize in favor of leading-edge AI silicon. TSMC is doubling advanced packaging for AI while legacy capacity stagnates, partly because of weak consumer demand, partly because the margins aren’t there. Today, Ukraine targets 4.5 million drones in 2025, requiring roughly 18 million motors. European component production can’t keep pace.

Copper is next. S&P Global quantified it in January: both AI and defense demand triple by 2040, while production peaks in 2030. Ten million metric ton deficit. There’s no spot market fix for that.

Rare earths are a single point of failure with a flag on it. China controls 70% of production and 90% of processing. The same neodymium in F-35 engines goes into data center cooling motors. In October 2025, Beijing tightened export controls further.

Energy follows the same pattern. US data centers consumed 183 TWh in 2024, more than Pakistan’s annual demand. Wholesale electricity prices have risen 267% near data center hubs like Northern Virginia, where defense contractors also compete for grid capacity. When AI firms lock up long-term power purchase agreements, industrial users further down the priority list pay more or wait.

Pull any thread and you end up in the same place. US broadband expansion targets are already slipping because the same fiber shortage is hitting telecom providers who can’t get cable for rural deployments. It reaches anywhere that needs physical infrastructure and can’t outbid a hyperscaler. And nearly all of it runs through one country.

China Holds the Cards

China supplies both sides. That’s not a secondary detail. It’s the architecture of the problem. China produces 60% of global fiber. The same supply chain feeds Russian and Ukrainian drone manufacturers.

After Ukrainian drones struck Russia’s only domestic fiber plant in Saransk in spring 2025, which had produced approximately 4 million km per year, Russia became 100% dependent on Chinese imports. A year later, the plant still isn’t operational. Imports jumped tenfold. Chinese suppliers responded by demanding 100% prepayment.

Ukraine faces the same dependency. Most fiber reaching Ukrainian manufacturers originates in China, entering directly or through European intermediaries. Some companies have diversified to European sources, but domestic Ukrainian production would require hundreds of millions in investment and several years to build. Zelensky signed laws in 2025 canceling VAT and duties on fiber drone components. The government is discussing state procurement of fiber as a strategic raw material.

These are mitigation measures against structural math. Russia alone consumed 60 million km last year, as I said before. Ukraine’s consumption adds to that. AI data center demand grows at 75%+ annually. You can’t procure your way out of a preform shortage. But the AI industry isn’t trying to. It doesn’t see the shortage the same way.

The Cost We Don’t See

The product announcements read like software releases. Model update. New API. Benchmark. The supply chain underneath reads like a mining report.

The pitch is a better future. The invoice is already in the mail. Fiber prices double and Ukrainian drones get more expensive to build. Energy costs surge near data center hubs and industrial production gets squeezed. Rare earth export controls tighten and defense supply chains break.

How much copper went into the last Virginia data center that could have wound an electronic warfare system instead? The fiber in GPU clusters and the fiber guiding drones into trenches share the same upstream supply chain: same preforms, same drawing towers, same raw materials. The semiconductors running recommendation engines compete with the chips Ukraine needs for drone motors.

It’s happening on a planet where the same raw materials are fighting a war. Defense analysts and commodity traders track it. It doesn’t routinely reach the people making AI investment decisions.

Have you seen supply chain competition between AI and other industries in your work? Reply and let me know.

If this analysis matters to you, forward it to someone in defense procurement or AI infrastructure.

Subscribe now