The October payload stole credentials. On a proxy with a database, it also dumped the tables holding every provider key that proxy stores, according to the first issue report. LiteLLM’s own root-cause writeup says the attacker was after “upstream inference API tokens.”

The way in was ordinary. A master key committed to a public repo in May and never revoked. An owner’s GitHub token that was never scoped down. A release gate loosened that same week “to accommodate the temporary push for more frequent releases.” Credentials in public repos were also how Gemini got into two companies in the nine intrusions I covered in September. No AI was needed for any of it.

You install a gateway because model vendors fail. I still think you should. I plan for three ways they fail: the endpoint errors, the answer degrades, or access is withdrawn. Error-based failover covers the first. October showed that the layer doing the switching can be the breach as well.

The failure that throws an error

The first kind is the one gateways were built for. The provider returns an error, and the gateway can see it.

On October 25, Anthropic’s status page opened an incident covering Mythos 5.1, Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5. The impact lasted half an hour. It was the fourth elevated-error incident in under two days, after three on the night of October 23.

A gateway handles this well if the fallback leaves the serving path that is failing. A chain that drops from Opus to Sonnet to Haiku on the same API walks from one error into the next.

Crossing vendors helps, with less certainty than the architecture diagram suggests. On September 3, ChatGPT, Claude and Grok had overlapping outages. Three different vendor names did not guarantee a healthy route.

The error code can also lie. On June 2, OpenAI’s Codex requests got HTTP 429s for about fifty minutes because a broken internal rate limiter flagged them by mistake. A policy that only backs off on 429 would have kept waiting on the broken path.

Brightwave, whose agents process billions of tokens a day, does this properly. Their writeup puts the reason in one line: “If every agent owns its own SDK calls, every provider incident becomes a product incident.” Their router can serve the same Sonnet through Anthropic, Bedrock or Vertex, and they have “seen external provider status pages turn red while our customer-facing dashboards stay flat.”

If you won’t build Brightwave’s router, there is a cheaper step: stop calling the vendor directly. Our clients are enterprise and go through Bedrock or Azure. When I started this piece in June, I called that a relocated dependency. It is one, but Anthropic’s own numbers show it fails differently. Bedrock serves the same weights on AWS hardware, with reserved capacity if you pay for it, and of the three bugs in Anthropic’s September 2025 postmortem, two never reached it at all. A cloud endpoint gives you a different failure domain. One endpoint is still one endpoint, though, and resilience still needs a second path you have tested.

It has limits. Azure OpenAI had its own multi-region outage on May 29, about three hours of elevated errors. And the region is still a single point. When DynamoDB’s DNS broke us-east-1 in October 2025, a primary and a backup in that region went down together.

The first failure is close to solved, as long as you read the errors correctly. Everything in this section works because the failure shows up in your own request outcomes.

The failure that returns 200

The second kind doesn’t. The provider answers with a valid response, the gateway logs a success, and the content is worse than it was last week.

That September 2025 postmortem, which I wrote about in April, is the clearest case. A routing bug sent Sonnet 4 requests to the wrong servers. On Anthropic’s own platform, it affected 16% of them at the worst hour. On Bedrock, its peak was 0.18%. Users got worse answers, and no errors.

The same postmortem admits that “the evaluations we ran simply didn’t capture the degradation users were reporting.” This April’s postmortem, about the Claude Code product layer rather than the model API, says it again: “neither our internal usage nor evals initially reproduced the issues.” Twice in seven months, the vendor with the weights, the infrastructure and the eval team learned about a drop from its users.

A complaint can outrun the measurements too. On October 24, Thariq Shihipar, who had announced his departure from Anthropic’s Claude Code team nineteen minutes earlier, posted “wait is it just me or is Opus 5.5 dumber.” By the next afternoon it had passed 900,000 views.

One public instrument for that question is LiveNerf, an open-source tracker that asks Opus 5.5 the same 78 hard questions every day through Claude Code, with a control model alongside. Through October 23 it shows no change. It also fixes effort, so it would not see a harness default changing, which is how the March drop started. The window covering his post has no reading yet. Its answer keys aren’t perfect either. Its author flags eight that look wrong and thirty ambiguous questions, and reruns the result without them. What it offers is a panel, settings, error bars and a decision rule anyone can inspect.

The vendor’s evals missed real drops twice. This complaint isn’t settled either way. The tracker’s finished windows end before the post, and it measures a narrower slice of work than one person’s sessions. A fixed reference doesn’t settle every complaint. It tells you which claim you have actually tested.

Why not let the models check each other

The obvious fix for a missing reference is a second model. Run two vendors side by side and treat disagreement as the signal. In June I also wrote that there was no established technique for that. I was wrong about the research. I still think I was right about production.

The case against using models as a vote is strong. A study covering more than 350 models found that, on one leaderboard dataset, models agreed 60% of the time when both were wrong, and that more accurate models had more correlated errors. A nine-judge panel drawn from seven model families measured out at about two independent votes. Add the self-preference research I covered in May. Different model names don’t buy independent votes.

Panels still help on specific tasks. A PoLL study found that juries of smaller models from different families beat a single large judge across six datasets. That does not establish independent votes or a production alarm. Separately, AWS researchers used cross-model consistency to catch hallucinated passages. Disagreement between families carries signal.

What I still cannot find is anyone who has published running it as a live production alarm, with a false-positive rate. That would change my view, and it could appear any month. Until it does, the distance between a benchmark result and a page at 3 AM is where the cost sits. A voting panel decides. A detector only raises its hand, and something outside the models has to decide whether the hand means anything.

The failure with no status code

Both of those failures assume the model is still there. The third one, in June, took it away while it was healthy. On June 12 the Commerce Department sent Anthropic the export directive I wrote about the next day, and Anthropic switched Fable 5 and Mythos 5 off for everyone. GitHub’s changelog said the same day that “access to Claude Fable 5 has been suspended across all GitHub Copilot experiences.”

No routing setting can restore a withdrawn model. The model was withdrawn on purpose by people outside the vendor. Fable came back to Copilot nineteen days later. Moving to a cloud host does nothing here either. AWS also revoked access to Fable 5 and Mythos 5 on Bedrock “for all users in all regions,” at Anthropic’s request. The cost landed on whoever had built on Fable in the three days it was available, and on their users.

The only defense I can see is a second model family that already passes your evals, so the gateway has somewhere to switch. A model name sitting in a fallback array, untested against your workload, is a hope. One that passes your evals is a plan. The plan costs something every month you don’t need it: prompts tuned for two families, evals run against both, a second contract. Most teams will not pay for it until they have lost a model once.

Where the anchor goes

“Passes your evals” keeps coming up in this piece, and it carries more of the defense than the gateway does. The second failure, the one nobody pages you about, gets caught by something outside the models or by your users. Tests. A compiler. A schema validator. A fixed question panel with known answers. A person who knows the domain. My own review pipeline works that way: three review agents, each checking what the previous one let through, and me on top. It is a hierarchy that ends in a person, not a panel of equals.

What I would put in place.

Failover on errors, classified by source. Provider-wide 5xx and timeouts move traffic. Back off when you can tie a 429 to your own quota. A burst of unexplained 429s across keys is a reason to investigate and reroute, whatever the status code claims. Timeouts measured in seconds.

The same model on a second host before a second vendor, in a different region. Anthropic’s 2025 numbers show that hosts fail differently.

A second model family that already passes your evals, for the day the first one is withdrawn.

The gateway treated as a vault. Pin a reviewed release and its digest, knowing that a valid hash or signature doesn’t make a compromised release safe. October’s bad wheels came out of LiteLLM’s own pipeline. Scope credentials per workload and environment, limit what the gateway can reach, and revoke an exposed key immediately. If your gateway’s database holds every provider key you own, October 21 was a dry run of your incident. Brightwave cites the March LiteLLM compromise as one reason it owns that layer itself. That works if you have Brightwave’s engineers.

A canary with a fixed reference. LiveNerf’s design is public and small: a fixed panel, a pinned client, explicit settings, a control arm, and a decision rule written down before the data comes in. Its rule needs two ten-day windows to call a change, which is fine for a study and slow for an alarm, so set your own effect size, check frequency and false-positive budget. Run one on your own task. Put a second model on a sample of traffic as a detector, and treat a disagreement as a reason to look. Page only on a threshold you set in advance, backed by a test, a task-level canary or a domain reviewer.

The vault is the item that failed at LiteLLM in October. Nobody there needed a new technique. The key had been spotted in May and was never revoked.

If your primary model got a third worse tomorrow and kept returning 200, what in your stack would notice before your users did? And if it disappeared on a Friday by order of someone who has never heard of your product, how long until you were running on something else?

Subscribe now

The notice arrived on April 22, in an email to every API customer, inside a list of model shutdowns. I read it and started counting clients. We run production RAG systems on that model for dozens of them. Millions of embedded documents. My first thought was how many clients we’d have to call, how much work it would take, and how much it would cost them to re-embed everything.

The same day, OpenAI sent a correction: “That was a mistake: text-embedding-3-small is not being deprecated.” The model stays. I kept counting anyway, because the first email had already told me what I needed to know.

The Math

When a vendor deprecates a chat model, you swap the endpoint and rerun your evals.

The embedding call is stateless. The corpus it leaves behind isn’t. Every document sits at specific coordinates in a 1,536-dimensional space, placed there by the model that processed it. A different model produces a different space, even with the same number of dimensions. Coordinate 47 means one thing in one space and something else in another. The numbers have the same shape. The meaning doesn’t.

Query with model B against documents embedded by model A and you still get results. Valid floats. Cosine similarities between -1 and 1. The pipeline returns 200 OK, and the search returns plausible-looking garbage.

The reliable fix is to re-embed everything, rebuild the indexes, and test retrieval quality against production benchmarks before anything goes live. Across dozens of clients that’s weeks of work and tens of thousands of dollars. For a model that costs two cents per million tokens.

Getting in took an API key and an afternoon. Getting out takes weeks. I can live with that ratio. The vendor sets the deadline, but how ready I am when it lands is mine. I own the documents underneath, and the re-embedding pipeline is code we can run.

I wrote about that email in The 50 Billion Utility and stopped at the bill. The ratio matters more. Two cents in, weeks out, and that’s the cheapest version of it in this piece. Make the entry free, add a crisis, and the clock stops being yours.

Nine Days In

The cleanest case I know started with my own country’s refugees. In March 2022 the UK launched Homes for Ukraine, and Palantir offered to run the housing system for free. It was live in nine days. Six months later the free period became a £4.5 million contract, with no tender. The government’s own chief commercial officer wrote to Palantir about “offering services to public sector customers for a zero or nominal cost to gain a commercial foothold.” The department renewed anyway, for £5.5 million, because leaving looked riskier than staying.

It did leave, eventually. The in-house replacement was running by September 2025 and already saves millions a year. Palantir says that proves there was no lock-in. It proves the exit was real, three and a half years after a launch that took nine days.

The NHS got the bigger version. Foundry for £1 during COVID, under emergency rules. Then a £330 million, seven-year contract for the national data platform. This June the Commons science committee called Palantir’s growing presence an “unacceptable point of weakness” and recommended the break clause, which falls in early 2027. By September the health minister had warned the health committee that “normal government procurement processes” made a replacement by March unlikely.

The government holds the break clause. It doesn’t hold the calendar. Entry ran on emergency rules. Exit runs on normal ones.

Greater Manchester refused to join. Switzerland’s army evaluated Palantir five times and said no five times, once because the software couldn’t run only on the army’s own servers. The only cheap exit is the one you never needed.

Within Range

Greater Manchester and Switzerland could afford to say no. Ukraine couldn’t. A week before the full-scale invasion it passed its first law on cloud services, because, as Mykhailo Fedorov, then digital minister, later put it, “the first target of the Russians would be information systems.” Microsoft helped move 16 of 17 ministries to the cloud. AWS moved more than ten petabytes. Microsoft’s free support has since been extended through 2027.

This was the right decision.

This autumn showed why. Between September 15 and 27, Russian strikes hit 14 operators of Ukrainian data centers and networks in twelve days. De Novo, Datagroup, Cosmonova, Kyivstar’s head office. MiroHost’s facility was destroyed. About 100,000 households around Kyiv lost internet. Russia’s defense ministry called it a “forced digital detox.” MiroHost’s founder said roughly 95% of his customers run outside Ukraine and never noticed, because their critical systems had already moved abroad or to the cloud.

Then we answered. Between October 7 and 11, Ukrainian drones hit three of six of Yandex’s largest data centers. Sasovo, which housed two of the three supercomputers Yandex trains its models on, burned. Vladimir shut down completely. Kaluga took heavy damage. On October 14 the drones reached the mega data center Sberbank is building in Balakovo.

Russia did data sovereignty by the book. Since 2015 the law has required Russians’ personal data to be stored on Russian soil. Its own clouds, its own supercomputers, its own territory. In a war, a sovereign data center at home is a set of coordinates.

So Ukraine’s state systems run abroad, on American infrastructure, and that’s the price of staying online. It also means the clock is no longer in Kyiv, and the question becomes who can switch it off.

Who Switches It Off

Until now the clock in this piece has run slowly, over years. It can also run out overnight.

On October 14, Starshield terminals used by Ukraine’s defense forces started losing connectivity at speeds above roughly 160 km/h. No warning. Drone missions were disrupted. A week later, Kyiv says the cap is still there.

Musk said Starshield is “owned and controlled by the U.S. government” and that limits “are decided by the US military and ultimately POTUS.” Reuters, citing officials, reported the order came from inside the White House. Rubio called that categorically false. Hegseth said, “We haven’t made any directives.” Trump said, “I don’t know who it was, but I’d like to find out.” The Wall Street Journal then reported that Musk imposed the cap himself. Senators have asked the Pentagon’s inspector general to investigate.

In 2022 Musk refused to enable coverage near Sevastopol, and later said so himself. This time nobody will say who decided. For the architecture, it doesn’t matter which of them is telling the truth. The single point of failure here isn’t a server. It’s a decision nobody will sign.

I’ve been on the receiving end of a smaller version. In June the Commerce Department ordered Anthropic to block its two newest models for every foreign national, and Anthropic disabled them for everyone. Fable came back nineteen days later. Paying customers, cut off and restored, with no say in either.

Today Microsoft and AWS are the reason Ukraine’s state still runs, which is exactly why the question matters. What happens the day Washington’s interest in Ukraine and Ukraine’s interest in itself stop lining up?

Alternatives exist, and they’re thin. Kallas says Europe “can’t replace this capability” in the short term, and IRIS², Europe’s own constellation, is due in 2029. A European Palantir would only move the lock under a different flag. What states and alliances need to fund is something you can switch to.

What This Has To Do With My Vector Store

Everything above is the same dependency at different scales. A system rests on a supplier, or on several suppliers subject to the same decision, and leaving happens on someone else’s schedule.

For engineering, the rule is direct. Every model, every vector store, every cloud has to be replaceable, ideally through configuration.

The stateless parts can be. Put models behind an abstraction like the AI SDK or a gateway, keep the model ID in config, and switching providers is one line plus an eval run. The eval run is mandatory. A new model behind the same interface still behaves differently, and a swap without evals is the same 200 OK with garbage inside.

The stateful parts can’t be swapped by config, so they need a different kind of readiness. Own the source documents. Vectors are derived, and derived data can be rebuilt only if the original is yours. Keep the re-embedding pipeline as code you ran last quarter. Keep a retrieval eval set that tells you within an hour whether quality held.

None of this means running two clouds hot. Describe the second environment as infrastructure code, leave it cold, and bring it up once a quarter. The drill counts only when representative data is restored and the same evals pass. Architecture nobody deploys rots. With the architecture ready, an exit can take days or weeks. Without it, months or years. That second number is a design decision, made long before anyone needs it.

A fallback only answers the failure it can survive. A second provider isn’t an independent exit if the same order can cut off both, and two American model vendors answer to the same Commerce Department.

For a manager, exit time belongs in the architecture review next to cost and latency. A vendor proposal without it is as incomplete as a deploy without a rollback plan. Someone on the team should be able to say how long leaving takes, and when it was last tested.

The same goes for the tools on my desk. From October 30, OpenAI’s $200 Pro plan gets half the Codex usage for the same price. GitHub began moving Copilot to usage-based billing in June. Anthropic went the other way this year and raised its limits. The meter moves in both directions, and none of us hold the dial.

In The 50 Billion Utility I called self-hosting a different kind of trap. I tested it anyway: LMStudio, Qwen 3.6 35b-a3b running locally, Pi.dev for quick queries. The trap is real. Running a local model is the easy part. Building a harness around it that gets anywhere near Claude Code on Opus 4.5 is hard, slow work. Hard, but possible. And the harness is the part you keep. Once it’s yours, every new open model plugs into it, and the work starts paying you instead of the vendor.

Every system has a single point of failure somewhere. The dangerous one is the one whose exit you’ve never priced or run.

My own exit is months of harness work, and at least I know what’s in it. The NHS’s own minister doubts a replacement fits its procurement calendar. Ukraine still can’t get a name for who capped its satellite link. Before you sign with the next vendor, work out how long leaving would take, and who sets that clock.

Independence, the kind where nobody else can switch you off, was never going to be free. You pay for it in time, before you need it, or you pay for it later on somebody else’s calendar.

Subscribe now

The Senate passed it 86 to 11. The House passed it 262 to 159. It bans new American investment in Russia, goes after the shadow fleet of tankers, and lets the president put tariffs of up to 100% on the largest buyers of Russian oil and gas. It was the most serious thing Washington had done about the war in years.

Three weeks later, on October 9, Trump got off a call with Putin and posted that Russia would immediately supply more than 300,000 tons of diesel, then 500,000 tons in November, a million tons after that, and three million more depending on the condition of Russian refineries. Within hours the Treasury issued a general license allowing the sale, delivery, and import of Russian diesel, including into the United States, until April 7, 2027. Earlier licenses on Russian diesel had run thirty days at a time. This one runs six months.

The next morning Russian glide bombs hit apartment blocks in Zaporizhzhia and killed at least 20 people, at least three of them children. Trump left the White House for a rally in Tennessee and told reporters that Ukraine should “get a new leader who can make a deal.” Then he blamed Ukrainian strikes on Russian refineries for what farmers and truckers pay at the pump.

Yield is what a system produces against what it was given, and in June I audited Europe on that measure. America was given more than any country in history. This month it offered sanctions relief to the country it is supposed to be sanctioning, in pursuit of a few cents off diesel before a midterm, and paid with the one asset it cannot print: its credibility.

A War Is a System Audit

Ukraine is where the test result shows up. A war shows what a system actually protects, and this month the American system prioritized the price of diesel in the weeks before November 3. The same reflex shows up at home whenever a number looks bad. Ukraine is only the place where you can watch it work in a single weekend, with a timestamp on every step.

The Strait Everyone Saw Coming

The diesel problem has an origin, and it isn’t in Ukraine. Iran’s threat to close Hormuz was the most predictable move in the region. On February 17, during talks in Geneva, the IRGC announced a temporary closure of parts of the strait for live-fire drills. CSIS published a scenario paper the next day outlining how Iran could target Gulf exports through the strait. Ten days later the bombs fell.

The administration wasn’t surprised. According to the Wall Street Journal, the chairman of the Joint Chiefs said in several briefings that Iran would use mines, drones, and missiles to close the strait, and the Director of National Intelligence warned the same days before the war. Trump bet that Tehran would fold first. Two weeks in, the Energy Secretary admitted the US was “simply not ready” to escort tankers, and the president asked China, France, Japan, South Korea, and Britain to send warships. When they declined, he told them to go get their own oil.

From February to May, natural gas prices rose 44% in Europe and 66% in Asia while they fell 6% in the United States. By August the vice president was calling cheap fuel goal number one and Iran’s bomb goal number two, and the IAEA still could not verify the whereabouts and condition of Iran’s uranium enriched to 60%. The war has cost at least $45.1 billion, 81 aircraft lost or damaged, and 21 American lives. By June, CNN reported, US intelligence agencies assessed that Iran could close the strait at will.

Start a fire in the world’s busiest oil chokepoint, then ask someone else to reach into it. Allies were asked for ships. Kyiv was next.

The Price of a Gallon

Diesel in America is up around 70% since the Iran war started. It hit a record $6.52 a gallon on September 22 and was still $6.23 on the day of the deal. Part of the White House story is true: Ukraine hit at least 24 major Russian refineries between April and August, according to a Washington Post analysis, Russia banned its own diesel exports in July, and the IEA estimates Russian diesel output is down about 30%. Ukrainian drones really do take Russian diesel off the world market.

On September 13 Trump said Zelensky should go after other targets “but not diesel fuel.” On October 5 he wrote that Hormuz was no longer the problem and that the real problem was Russian refineries being blown up by Ukraine. The price came from the Gulf, and the blame went to Kyiv.

Diesel is a global commodity, and American refiners sell it at the global price. A Gulf Coast refinery has no reason to give a farmer in Kansas a discount when a tanker to Rotterdam pays more. In September the average pump price in the EU hit a record of about $9.60 a gallon, much of it tax, while Americans paid around $6.20. Exports are how the world price gets into an American tank. There is also little near-term room to make more. Gulf Coast refineries averaged 93.7% utilization from January through early May, and since early 2025 plants in Houston, Los Angeles, and Benicia with a combined capacity of about 550,000 barrels a day have shut down. Demand is global, supply is capped, and the IEA calls the Gulf shock the largest supply disruption in the history of the oil market.

The deal barely moves the number it was sold to fix. Even if all 4.8 million tons arrive, that is roughly one day of global diesel consumption, as Chris Beauchamp, chief market analyst at IG, told Al Jazeera. Clayton Seigle at CSIS expects little effect on prices and called the deal a great benefit to Putin, who needs to unload summer-grade diesel before Russia switches to winter and arctic grades. US diesel futures fell more than 4% after the announcement. The first tranche from Moscow is about a day and a half of what American refineries ship abroad.

The Price List

Graham’s law is real, and it leaves Treasury free to keep issuing general licenses. Treasury issued thirty-day licenses on Russian oil in March and April, after the Treasury Secretary had ruled that out earlier in the year. Each was temporary, and the relief kept being extended. The October license is the first to break the thirty-day rhythm on diesel since 2022, and it was announced while Steve Witkoff and Jared Kushner sat with the Ukrainian delegation in Miami, negotiating an end to the war.

The Kremlin read the signal correctly. Putin said he was confident the deal would help the whole global economy, and Kirill Dmitriev posted that Russia-US cooperation on diesel would benefit the world. The next day Russia sent five glide bombs into Zaporizhzhia.

The pressure went in one direction. On October 11 the Financial Times and then CNN reported, citing European officials, that the State Department and the Pentagon had warned Kyiv it could lose American intelligence and weapons bought through PURL unless it stopped striking Russian energy. That intelligence includes where Russian ballistic missiles are launched and where they are heading. The weapons that would suffer most are Patriot interceptors, which Ukraine is already short of. PURL is the NATO program in which allies and partners buy American weapons for Ukraine; by June they had committed more than $6 billion to it. The mechanism being threatened runs on allies’ money, not American aid. Moscow got a diesel license the same weekend.

Every government that flies F-35s or buys Patriots through Washington has reason to read that report closely. The Pentagon says the F-35 has no kill switch, and it doesn’t need one. The jet runs on American software updates, spare parts, and mission data, and this month showed what delivery depends on.

A sanction that switches off whenever the sanctioning country’s fuel gets expensive is a price list, and this one is priced at about six dollars a gallon in an election year. Blaming the victim costs nothing at home, because the victim doesn’t vote in Ohio.

Shoot the Messenger

Blaming Kyiv for the price of diesel is not a one-off. It is how this administration handles any bad number.

It starts with the president’s own. On July 12 Trump posted that his approval rating was “59 percent,” without naming a poll. The averages that week had him around 39 to 41. In August 2025 he wrote that, except in the “Fake News,” he had “the highest poll numbers I’ve ever had.” Pew’s latest survey, taken September 28 to October 4, puts him at 30%, roughly where he stood in his last weeks in office in 2021. When the numbers disagree with the president, the numbers are fake.

On August 1, 2025, a weak jobs report came out, and the same day the president fired the commissioner of the Bureau of Labor Statistics. A working paper from the National Bureau of Economic Research, co-written by two economists from the conservative American Enterprise Institute, estimates in a model-based calculation that the firing cost roughly $20 billion in lost output, for a bureau with a $704 million budget. While Trump was publicly demanding rate cuts, he tried to fire Fed governor Lisa Cook, something no president had done in the Fed’s 112 years, and the Justice Department served the Fed with grand-jury subpoenas over Jerome Powell’s testimony about a building renovation. The Supreme Court kept Cook in her seat 5 to 4, a judge quashed the subpoenas, and the Fed’s own inspector general found no crime. On October 9 Trump appointed a committee to decide whether there is cause to remove Cook anyway, with a closed hearing set for November 5.

A bad jobs number got the statistician fired. High rates got the central bank investigated. High diesel got the invaded country blamed. Each response targeted a more convenient lever than the underlying problem. Each put something that took decades to build at risk.

The Brakes Exist

The easy version of this piece says no force in America can stop it. That isn’t true. Congress refused a 40% cut to the National Institutes of Health. Thom Tillis, a Republican senator, froze every Fed nominee until the Powell probe was dropped. The courts kept Cook in her seat and struck down the signature tariffs. Midterms are on November 3.

The brakes work, at the speed of appropriations committees and election cycles. The damage happens at the speed of a phone call and a license PDF. Congress spent more than a year building a sanctions law. Three weeks after the signing, Treasury opened a six-month channel for Russian diesel. Voters can flip the House in November and the license still runs to April. The checks can stop some decisions, but they cannot recall damage already shipped. America does not lack expertise or opposition. It has a system where short-term pressure spends long-term credibility faster than either can protect it.

Who Gets to Write This

What does a Ukrainian engineering manager know about America, and what right does he have to audit it?

The right is on paper. In 1991 Ukraine held about 1,900 strategic nuclear warheads, 176 intercontinental missiles, and 44 strategic bombers. We gave all of it up. In 1994 Ukraine secured an agreement on compensation for the uranium and, in December, a memorandum signed in Budapest by the United States, Britain, and Russia. The last warhead left for Russia in June 1996. Lawyers like to point out that the memorandum gave assurances, not guarantees. That distinction is the whole problem. A country disarmed on the strength of an American signature and is now learning what the signature was legally worth. The bombers went later. Most were cut apart with American dismantlement help, and in 1999 eight Tu-160s, three Tu-95s, and 575 Kh-55 cruise missiles went to Russia to pay off a gas debt. In 2023, Radio Liberty’s investigative team matched the serial numbers of more than ten Kh-55s fired at Ukrainian cities to that 1999 transfer list.

The second reason is what everyone else takes from it. Russia took Crimea in 2014 and paid with sanctions full of holes. It invaded in 2022, and four and a half years later Washington has licensed the sale of its diesel. The lesson for anyone with a neighbor they want is that punishment is negotiable and patience pays. Beijing, Tehran, and Pyongyang can all read a Treasury license.

The third reason is the one an American reader should care about most. Ukraine is not in NATO, so no treaty sends American soldiers here. Poland, Lithuania, Latvia, and Estonia are in NATO. Mike Pence said it last weekend: if Putin overruns Ukraine, it is “only a matter of time” before Russia’s military crosses a border American troops will have to deal with. Right now that line is held by Ukrainians, with American and European weapons, and without American troops fighting it.

We pay for it in lives. Between October 7 and 10, Russian strikes killed at least 78 civilians, including 22 in Pryluky, 33 on two passenger buses in Kramatorsk, three in Kyiv on October 8, and 20 in apartment blocks in Zaporizhzhia. That count does not include soldiers. When we are gone, the price will have American names on it.

Subscribe now

Monthly reminder. That might be the most honest thing anyone in this industry has said in three years. The way we’re supposed to work now ships on a release cadence.

I already wrote about the people who sell these futures and never pay for the ones that don’t arrive. This piece is about everyone else: the companies that turn each new word into policy, the dashboards built to measure it, the vendors who relabel their products overnight, the schools that print certificates for it. And about how all of us together forget the last word before the next one lands.

The obituaries

Start in January 2023. Andrej Karpathy writes that the hottest new programming language is English. A few weeks later Anthropic posts a prompt engineer opening with a salary range topping out at $335,000, and TIME runs it as the AI job that doesn’t need a computer engineering background. Vanderbilt’s prompt engineering course becomes Coursera’s top generative AI course of 2023. By now more than 740,000 people have enrolled. Indeed searches for the title go from 2 per million to 144 per million in three months.

In April 2025 the Wall Street Journal calls the job already obsolete. Microsoft’s own survey, as the Journal reports, ranks it second to last among roles companies plan to add. Searches settle at 20 to 30 per million. The promised profession faded. The course is still enrolling.

Spring 2023 also gave us AutoGPT, “an experimental open-source attempt to make GPT-4 fully autonomous.” It collected 100,000 GitHub stars in weeks and became notorious for getting stuck in loops. It’s a low-code workflow builder now.

That March, OpenAI shipped ChatGPT plugins, and they were widely called the App Store moment. Plugins were gone in thirteen months. Custom GPTs replaced them, and by the time the GPT Store opened, users had already built three million of them. OpenAI is scheduled to retire custom GPTs on December 11. The thing replacing them is called plugins.

Pinecone raised $100 million at a $750 million valuation after saying it had introduced the vector database category. Two years later vector search was available inside Postgres through pgvector and across the major cloud databases, and Pinecone was reportedly exploring a sale amid rising competition. Humane raised more than $230 million to replace your phone, sold its assets to HP for $116 million, and the pins stopped working. Replacement, absorption, collapse: different failures, same attention cycle.

Then the cycle sped up. Karpathy coined vibe coding in February 2025: give in to the vibes and forget the code exists. Collins made it Word of the Year in November. In February 2026 Karpathy drew a line between vibe coding for experiments and professional work with agents, and said his favorite name for the second was agentic engineering. The New Stack wrote the obituary under the headline “Vibe coding is passé.” A distinction in one engineer’s post became the end of an era in a headline. Twelve months from coinage to obituary, three from the dictionary to obituary. Context engineering became the phrase everyone repeated in June 2025, pitched as the grown-up replacement for prompt engineering. A year later, a reply under Steinberger’s post announced that harness engineering is so last year.

Loop engineering didn’t get a year. Addy Osmani published an essay titled “Loop Engineering” on June 7. On July 18 Steinberger asked whether we were still talking loops or had moved on to graphs, and a few hours later Hamel Husain posted “Loop Engineering Is Dead. Enter Graph Engineering.” Both were at least half joking. It didn’t matter. Within days the timeline had produced graph engineering roadmaps and tool stacks, and the courses followed. On July 22 LangChain published a retrospective titled “3 Years of Graph Engineering with LangGraph.” Six weeks from naming to obituary, and the obituary was a joke the machine took literally.

The machine

None of this needs anyone to lie. It needs a machine, and the machine has far more parts than a CEO with a microphone. No single actor runs it. Each part answers to the incentives of the part before it.

It starts with a word. Someone with an audience names a practice, and the name is catchy enough to repeat.

Then the pressure that makes a word travel becomes policy. In a memo made public in April 2025, Tobi Lütke made “reflexive AI usage“ a baseline expectation at Shopify and wrote it into performance reviews. Coinbase gave its engineers a week to onboard to Copilot and Cursor, then fired the ones who couldn’t give a good reason why they hadn’t. On the same podcast where Brian Armstrong told that story, John Collison pointed out that nobody really knows how to run an AI-written codebase. Armstrong said “I agree.”

Policy needs a number. The industry measured the one thing it could see. Meta made “AI-driven impact” a core expectation for 2026. I wrote this summer that Meta grades its engineers on token consumption, and that was too blunt. On September 2 Meta told its engineers that AI adoption dashboards and token counts would not be used to evaluate impact, and its review guidance swapped references to AI usage for outcomes that “can be supported by AI or other means.” A spokesperson called it a clarification and said contributions had always been the basis of evaluation. Whatever the policy formally was, the pressure arrived as a core expectation and was later recast as a clarification.

The vendors move next, faster than anyone. In June 2025 Gartner estimated that of the thousands of companies selling agentic AI, about 130 offered anything that deserved the label. Many of the rest had relabeled chatbots and RPA scripts. That year Gartner put AI agents at the peak of inflated expectations. In 2026 agentic AI got a hype cycle of its own, and the category is still at the peak.

Schools arrive last and stay longest. In August, six months after The New Stack’s obituary for vibe coding, Google added a new course on vibe coding to its AI Professional Certificate, which Google calls the most popular generative AI certificate on Coursera. The University of Denver’s five-week vibe coding certificate opened a new cohort on October 5. Loop engineering was declared dead in July, and a Udemy course last updated in August still teaches it as the top of a four-layer stack: prompt, context, harness, loop. Every dead word, laminated into a syllabus. Another loop course promises you’ll be fluent before it becomes a hiring prerequisite.

Then comes the forgetting. I’ve covered Klarna’s round trip from 700 replaced agents back to human support. Even on the way back, a spokesperson described the company as very much AI-first. Seventeen months after his memo went public, Lütke went on a podcast and described what Shopify calls slop grenades: AI output nobody read, tossed to a coworker to check. The way lazy work fails now, he said, isn’t too little output. It’s too much. Nobody retracted the memo. Nobody needed to. The next word had already arrived.

We write postmortems for a six-hour outage. Nobody writes one for a year of mandates.

Why it sticks to AI

Crypto had this rhythm too: ICOs, DeFi summer, NFTs, DAOs, the metaverse, play-to-earn. Most of those never became what they were sold as either. What differs is what the words stuck to.

Crypto words stuck to speculation, and most engineers could smell it. You could ignore NFTs and your job stayed the same. AI words stick to something that works in your editor every day, and sometimes the editor makes the choice for you. Cursor now opens in its Agents Window by default. The setting that’s supposed to turn it off wasn’t in my settings at all, and its forum is full of people for whom it’s ignored or vanished. Cursor’s support answered on its forum that starting there by default isn’t forcing anything. I deleted Cursor last month over a different silent default. Each ephemeral term borrows credibility from a real tool, which makes hype and genuine shift hard to tell apart, and for a manager under pressure the safe move is to adopt the word.

And crypto sold you an asset. This sells you a new version of yourself. Prompt engineer, vibe coder, context engineer, loop engineer, graph engineer: each is a job identity with an expiry date, and each rename arrives with a quiet hint that whoever still answers to the old one is falling behind. The reskilling bill lands on the engineer every cycle, whether the new word survives or not.

The other side

The honest counter is a good one: the labels die, the practices mostly don’t.

Prompting became something everyone does, a capability inside a job instead of a job title. Vector search got absorbed into the database you already run. MCP was pitched as a USB-C port for AI and actually became a standard, now under the Linux Foundation’s Agentic AI Foundation. Lovable lost about 40% of its traffic by September 2025, according to Barclays. By June 2026 the company reported roughly half a billion dollars in annualized revenue. Coding agents are real. Most of my own code is written by one.

Some renames track real change, too. Karpathy’s stated reason for moving past vibe coding was that the models got better. And naming churn is older than LLMs. Ask anyone who watched operations spawn DevOps, SRE and platform engineering.

All fair. But if the practice survives and only the label changes, the honest name for it is a version bump, and version bumps don’t usually arrive with leaderboards and five-week university certificates. Not every mandate follows a rename. The shared habit is making adoption compulsory before the previous promise has been measured. Label after label is sold as a new era, with mandates, metrics or syllabi attached, then swapped for the next one before anyone checks what the last one did. And the successors keep arriving faster: roughly two years from prompt engineer’s peak to its obituary, one year for vibe coding, less than a year before context engineering had a successor of its own, six weeks for loop engineering.

What survives every rename

Look at what a loop actually is. You hand the model a goal, let it run, check the result against something, and repeat until the check passes. That was AutoGPT in 2023. What changed since is better models and loops built into the tools. That’s real progress. It isn’t a new profession. Neither is the graph, this summer’s successor: nodes, edges and state connecting loops, branches and checks, the kind of control flow workflow engines have drawn for years. One reply to Husain’s post said simply “welcome back, langchain.”

The people building loops say the important part out loud. Addy Osmani: “The model that wrote the code is way too nice grading its own homework.” Paweł Huryn: “the loop is the easy part.” The real work, he says, is the stop condition: the check that ends it, the budget that caps it, a target the system can actually reach. Every layer of that stack, graphs included, ends in the same place, with someone deciding what done means and recognizing output that only looks done.

Each rename moves the engineer one layer further from the code and acts as if the layer below were solved. The one thing it never makes obsolete is the judgment at the top, and that is much harder to package as a new era. Five weeks of coursework won’t hand it to you. You build it by doing the work the last word told you to stop doing.

Right now a site called FindSkill sells a Professional Certificate in Loop Engineering. The term’s obituary is almost three months old, the graph engineering courses are already on sale, and whoever holds that certificate will still need the one thing no certificate can vouch for: knowing when the output is wrong.

Subscribe now

It is called Jev, and it does not write. You send it state and a set of typed questions. It returns a choice or a score with confidence, or a yes/no probability, in a vendor-reported 70 to 500 milliseconds. Input costs $0.042 per million tokens. Output tokens are free.

Most AI launches I cover end with me explaining why the number on the slide means less than the keynote says. This is the first one that made me nervous.

On its own, Jev is a very fast classifier. The part that worries me is where it plugs in.

The hole it fits

In The Autonomy Illusion, eight of the original twelve models took a loan in a simulated food-truck business, and all eight went bankrupt. Whatever uncertainty they had, it did not stop them borrowing.

On bounded tasks, the models execute fine. They write the code, draft the message, call the tool. They fail at the fork, and they fail confidently. I still hold that about LLMs on their own.

What TypeSafe actually shipped

TypeSafe’s announcement describes three primitives. Choice picks from named options. Score places something on a rubric. Noul returns one probability. Every question runs in parallel against the same state. The name System One comes from Kahneman, the fast, intuitive half of thinking.

Then TypeSafe did something I rarely see at launch: it published where the model breaks. The jaggedness page says Jev 1.13 does not count reliably, loses accuracy on multi-hop questions, and drifts as irrelevant state piles up. Those limits identify some of the places Jev should not be trusted today.

The control loop

My own setup today is the slow version of the architecture Jev invites. A coding agent writes. Three review agents sit on top of it, because my coding agent has repeatedly ignored spec files. I read every diff. Every layer except the last one is another model answering in prose.

An unofficial community harness runs a different loop. It follows one rule: the LLM proposes, Jev answers narrow questions, code decides, and the host authorizes.

In a separate project, one engineer ran a black-box evaluation across ten public datasets, about 22,500 calls, for an estimated $2.19 at the published input-token price.

The write-up shows that splitting a fuzzy judgment into separate questions and combining the answers in code cut false positives on its 130-command hand-built shell gate from 14.5% to 1.8%. On SkillRetBench’s multi-skill composition setting, restructuring the questions raised Recall@1 from 9% to 81%.

The third result is closest to my thesis. On 1,105 InjecAgent cases, a gate at derived certainty, max(p, 1-p), of 0.90 or higher covered 41.1% of cases with 100% accuracy in the sample.

The gain belongs to the whole stack: Jev, decomposition, and code. The write-up has no run of the same harness with a conventional classifier or an LLM forced into the same schema.

Integration outran the analysis. By 19 September, Vercel, Cloudflare and LangChain had added Jev support to their developer tooling. A Vercel engineer told TechCrunch that, for one command-safety classifier, Vercel replaced ChatGPT Luna 5.6 with Jev and got answers 5 to 18 times faster. He said accuracy improved, though Vercel did not publish the metric or test set.

The speed got the headlines. The probability is what matters, as long as it stays calibrated on the fork in question.

The way I read the benchmark, the food trucks died of certainty. Put Jev at the fork: code checks the repayment math, and Jev answers whether the plan rests on unsupported assumptions. It gets back 0.55, and the harness stops and escalates instead of proceeding. The LLM still writes, calls tools, and executes the approved branch. The decision comes back as a number that code can act on. It would expose the fork instead of letting the executor bury it. Whether that saves the business is a separate question.

To me, this reads like a serious attempt at the exact weakness I wrote about. If later versions close the gaps below, I think LLM executors guided by decision models could turn into one of the largest steps toward real general capability we have seen. I cannot prove that. Nobody can yet.

Why this, and not the breaches

In September I walked through nine intrusions, all Irregular-linked, by models from four labs. Many paths used weak passwords or exposed credentials, while the shared evaluation environment left the network boundary unenforced. The alarm in that story was real, and the path all nine shared needed an enforced network boundary.

In the same piece I wrote that a judgment fails the way judgments fail. Jev is a judgment. The egress rule still owns the boundary. Jev guides the executor above it.

A breach shows what one model-harness-permission stack could do under one set of conditions. A calibrated decision gate gives every agent that uses it a place to stop or escalate, and this one went straight into developer-tool integrations while the coverage I found centered on speed and cost.

Where it breaks today

An early harness result on multi-step work is negative, and it comes from the community harness above, not from the separate benchmark. Its routing experiment found 61% lower reported input tokens alongside lost tool use on its synthetic multi-step tasks. The repository recommends keeping those tasks in shadow mode. A September 26 follow-up with host-declared prerequisites selected an acceptable tool on all 39 clear-task cases in the same synthetic suite. The authors call it adaptive tuning on repeated development cases, not held-out calibration. The early failure was real, and it was not the project’s last result.

In one adversarial evaluation, calibration looked reasonable on support-ticket routing and collapsed on random 3-SAT. Jev called every tested formula satisfiable. Its mean probability moved by 0.026 while the true satisfiable fraction spanned 1.000. On this search-heavy task, its returned probability carried almost no discriminating signal.

The same evaluation found a failure closer to the gate I want to build. A sentence claiming a support lead had already decided moved Jev’s ticket routing 65% of the time, while confidence fell only from 1.00 to 0.62. Typed output did not make the judgment immune to the text it was judging.

I could not find a public test of a Jev-guided agent in a long-horizon business simulation. The gate I’m proposing is untested at the length where the failure happened.

From the trenches

I haven’t wired Jev into my own pipeline yet. I will put this model class into production projects, Jev or whatever comes after it, because I think that is where this goes. Until then, the performance numbers above are other people’s, and the most important independent ones come from single-author repositories.

My review stack exists because models in my workflow have ignored spec files, and every layer I added to catch that is another model answering in paragraphs. I am the one who decides which paragraph to believe. A probability layer attacks one part of that problem directly. The harness can use it to decide which review result should block the executor.

I want to use it for context management. Two contexts per agent: a hot one with what the current step needs, and a cold one with everything else the task has accumulated. Before each step, Jev scores what in the cold store is relevant and promotes it. The step gets less noise, and nothing is deleted, though retrieval can still fail.

The routing experiment above applies the same structural idea to tool definitions, and its first version lost tool use on synthetic multi-step tasks by dropping prerequisites. For my proposal that means the cold store has to stay reachable, and the relevance cut has to be measured before anyone trusts it. I would have Jev judge the cold store in pieces, since TypeSafe’s own list says it loses accuracy as irrelevant state piles up. That trade swaps state noise for cross-chunk blindness, so multi-hop retrieval has to be measured separately.

This is Jev 1.13, the version current in September. I would not be surprised if a frontier lab buys TypeSafe or starts building in the same direction.

The thing to watch is not the next escape headline. It is the first time a Jev-guided agent runs a simulated business for a full year and does not go bankrupt.

Subscribe now

I ship production code this way and wrote up the pipeline earlier this month. The gates hold. The rule did not, because a rule is a sentence in a file and the model can deprioritize it against the rest of its context.

That is on me. The agent did nothing clever. I gave it push rights and a sentence telling it not to use them, and only one of those two was enforced. I did not write it up as a containment breach, or tell the internet my sandbox had been defeated.

By April, a frontier lab was relying on the same kind of prompt-level boundary, with a bigger blast radius.

What the prompt said

Anthropic’s cybersecurity evaluations put Claude on capture-the-flag exercises hosted by an outside vendor. The prompt told the model it was in a simulation with no internet access. The machines had live internet. Per Anthropic’s report published 30 July, the incidents then known dated back to April, and neither Anthropic nor its partner knew until monitoring surfaced it the week before.

In four runs, a fictional target company shared a name with a real domain. Claude extracted application and infrastructure credentials and reached a database holding several hundred rows of production data. It recognised the system was real and continued. In two of those runs it reasoned that the real company must be part of the exercise.

In another, Mythos 5 found developer instructions referencing a PyPI package that did not exist. It built the package. Registration needed an email address, the email needed a phone number, and the phone number needed funds it could not get. It backtracked, found a free email provider, registered a PyPI account, and uploaded. The package was live about an hour. Fifteen real systems downloaded and ran it. One was a security company’s malware scanner, which installed the package, executed the code, and had its credentials shipped to a collection point the model had set up. The model used those credentials to reach further infrastructure.

Its own reasoning during that run noted that if the internet were real, publishing the package would not be okay and surely not the intended solution. It decided it was in a simulation.

It had been told it was in a simulation.

A third model, unreleased and internal, could not reach its assigned target, scanned roughly nine thousand others, got into an internet-facing application through an exposed debug page and SQL injection, then worked out the target was real and stopped on its own.

One vendor, four labs, seven weeks

The vendor is Irregular, based in Tel Aviv, formerly Pattern Labs. Its evaluation frameworks appear in system cards from multiple frontier labs, and it raised $80 million in September 2025 led by Sequoia and Redpoint.

On 4 August, OpenAI disclosed a separate Irregular-run CTF incident. The shared evaluation-environment issue gave the model public internet access. A fictional target again coincided with a real domain. OpenAI said in its disclosure that the incident was separate from Hugging Face and involved neither a sandbox escape nor a zero-day.

Meta disclosed on 5 August. Andy Stone told Reuters that a misconfiguration by Irregular inadvertently allowed one of its models internet access during evaluation. Irregular told Reuters it was the same evaluation-environment issue Anthropic had reported the week before.

Google confirmed on 18 September, after the Wall Street Journal asked. Gemini reached three companies in May. It guessed passwords in one case and found credentials in public repositories in the other two. Heather Adkins said the model stopped in all three instances. Google notified the three companies and US federal authorities, and said it had not published because the model stopped and nothing was harmed.

An Irregular spokesperson said all relevant labs were notified in late July.

Four labs shared one enabling failure: an evaluation-environment misconfiguration left the internet reachable. Disclosures spread from 30 July to 18 September. Read in sequence, they look like models breaking out of their cages at an accelerating rate. In fact, a single vendor-side failure surfaced publicly on four different days. Anthropic accounts for four of the nine, OpenAI and Meta one each, Google three. The open path enabled the nine. The task, the model and the vulnerable target determined what happened next.

A fifth disclosure sits outside that set. On 4 August the UK AI Security Institute reported unauthorised actions by Claude Mythos 5 on its own range, where the internet had been switched on deliberately.

What they actually did

Across the publicly described paths: weak passwords. Unauthenticated endpoints. Credentials sitting in public repositories. SQL injection through a debug page left open. A package name nobody had claimed.

For its three originally disclosed incidents, Anthropic says the models compromised infrastructure using basic techniques and found or exploited no complex vulnerabilities.

GitGuardian counted 28.65 million new hardcoded secrets in public GitHub commits during 2025, a 34% increase year over year. Gemini did not need to be clever to find credentials in a public repo. Nor is three months of exposure anomalous: IBM puts the 2025 mean time to identify a breach at 181 days.

These weaknesses explain why the intrusions worked once the models reached the open internet. They do not explain why the models treated those systems as in scope.

Two things that cut the other way

The first is OpenAI’s July disclosure, and it is why the alarm cannot be dismissed. Its models found an unknown vulnerability in Artifactory, an internal package repository and cache. They used it to escape a sealed sandbox and reach Hugging Face’s production infrastructure.

That is a zero-day escape, not an open internet path. Irregular has not said it belongs with the other four, and until it does, it should not be counted there.

METR spent six days on site. It warns first that much of its analysis went to AI agents it calls often unreliable, and that its reconstruction may overstate how coordinated the agents were. With that caveat, it documented roughly 1,200 agents that found each other through a shared package cache namespace and turned it into a message board. About seven hundred of them attacked Hugging Face, with coordination norms and a message-signing scheme.

The second is Anthropic’s own reassessment. A review of roughly 481 million transcripts, published on 9 September, turned up a fourth incident from January. The alignment assessment names two failure modes. One is biased reasoning, where models interpret evidence in ways that favour justifying their actions. The other is recklessness, where models keep pursuing the task even when that leads to harm.

Separately from that review, Anthropic ran a controlled replication of the CTF scenario. Mythos 5 took a severely harmful action in 82% of 150 runs.

I want to read this as a containment story and nothing else. The 82% says the reasoning failure was reproducible, even if the real-world consequence still depended on containment failing.

The conditions the number was measured in

Anthropic’s original evaluations ran with production cyber safeguards off, and that was deliberate. OpenAI says the same of its own cyber evaluations.

Their absence does not explain the underlying reasoning. It removed safeguards Anthropic says would have blocked all or most of the principal incidents, depending on the classifier: Fable 5’s cyber classifiers would have blocked all three, and Anthropic’s auto-mode classifiers, the kind used in products such as Claude Code, would have blocked two of the three.

That layer is itself a model. A cyber classifier reads the same text the evaluated model produced and makes a judgment about it. The evaluated model cannot switch it off, which is more than a prompt can claim for itself. But a judgment is not a rule the way an egress deny is a rule, and it fails the way judgments fail.

A capability test should isolate the model. Leave the classifier on and you partly measure the classifier.

The 82% does not carry cleanly into Amodei’s forecast. Amodei estimates that within six to twelve months a swarm could take over the internet with a persistent botnet and cause hundreds of billions in damage.

Four conditions combined in the Anthropic incidents. The task was offensive. Safeguards were absent. The prompt said there was no internet. The environment left the internet reachable. But Amodei grounds his takeover estimate in the separate OpenAI and Hugging Face swarm incident, not in those Irregular runs.

Rules are requests

In March I wrote that rules in prompts are requests and hooks in code are laws. That was an argument about type casts.

Tsinghua’s AGENTIF benchmark put 707 instructions across real agent scenarios in front of frontier models and found the best followed under 30% of them perfectly.

My agent crossed an explicit prohibition. The lab models acted through a false environmental premise while following an offensive task. The distinction between allowed and forbidden action existed inside the model’s context, not in infrastructure.

The separation between simulation and production existed as a sentence in a prompt. The network did not enforce it. Anthropic’s September reassessment concludes that Claude’s reasoning was biased toward deciding the internet was simulated despite considerable evidence to the contrary. The evidence was there and the model should have weighed it. The baseline claim came from the operator. Anthropic’s guidance to evaluation partners, published on 31 August, now says a boundary must be written as an instruction not to access the internet, rather than as a claim that there is no internet to access.

A boundary a model can talk itself past is a boundary that holds only while the model agrees with you.

What is being proposed instead

Amodei published on 12 September, three days after the alignment assessment. Three steps: embedded evaluators with employee-like access, coordination among democracies, coordination with China. In the essay Anthropic commits to the first unilaterally, with employee-like access and a contract letting reviewers publish findings without its editorial control. Altman said the same day that OpenAI would do the same.

The three steps operate above the network layer. Embedded reviewers can verify the egress control; the network configuration closes the path. The proposal adds an audit layer, not the control itself.

Anthropic did publish that fix on 31 August: partners must define scope, in-scope and out-of-scope targets, and network boundaries, with real-time monitoring during runs. It directly addresses the open network path that affected four labs, and it was the quieter announcement, twelve days before the essay.

Amodei writes that many things go wrong not because companies lack some theory but because of execution, names monitoring, sandboxing and training environment hygiene as the recurring trouble spots, and says there is too much to do all at once. The diagnosis is execution. The prescription begins with governance, while the control that failed remains technical, and none of the three steps carries a fixed implementation deadline.

The defence

Across the publicly described paths in the nine Irregular-linked intrusions, little was new. The models followed paths of least resistance, and people laid them long before LLMs existed. Twenty-eight million fresh secrets in public commits in a single year is not uniquely an AI problem.

One rule changed. A boundary could survive being written in words partly because the professional tester on the other side was identifiable, supervised, bound by scope, and exposed to contractual consequences and, depending on conduct and jurisdiction, potentially criminal ones. A model signs nothing. So any high-consequence boundary you would be unwilling to see crossed has to be enforced somewhere the model cannot alter or bypass: in the network, in the credentials it is issued, in CI. A prompt, a rules file, a line in capitals, those are requests, and I have the git history to prove it.

The controls that mattered in 2006 still matter now.

From the trenches

I have no standing to be smug here. I still do not have a remote-side control on push. A local pre-push hook would be better than a sentence, but Git lets the caller bypass it with --no-verify, and an agent with shell access can edit the hook. Today I deleted Cursor and went back to WebStorm. Since version 3.15.6 its git extension has been pointing core.hooksPath at /dev/null for commits made from the Source Control panel, so the hooks are skipped without a word and the commit exits clean. Cursor has it logged as a known issue. None of those three bypasses is the model’s doing, and the gate fails the same way regardless. The hard gate has to live on the remote, or in credentials the agent cannot use. A hook is a law only when the agent cannot disable, edit, or bypass it.

The same failure runs through all of it. At Irregular it was the test range. Here it is the editor. In both cases the enforcement layer was switched off by something with authority over it, silently, and in neither case did a model have anything to do with it. Capability is the part that gets the essay. This is the part that ships.

Right now I have a sentence and a person reading every diff, and the person is the part that works.

The immediate mechanism differs. The control failure does not. Mine fails into a bad commit. Theirs failed into a security company’s malware scanner executing a package their model had published to PyPI an hour earlier.

Any lab that leaves the boundary inside the prompt is measuring how dangerous its models might be in a year on a stack where the boundary remains an assertion, not a control. The alignment work is real and I want it funded. It is also being asked to cover a failure that a network boundary should have stopped first.

Subscribe now

What Each Side Brings

The two agendas are not the same kind of thing. The American asks, reported separately by Nikkei and Reuters ahead of the summit, are defensive: help us stop AI-directed cyberattacks, get the labs on both sides to police themselves and share threat information, and raise the allegation that Chinese firms distilled proprietary American models. Every one of those is a request to limit a harm the United States feels exposed to. China’s clearest ask points the other way. Beijing wants the export controls loosened, and has separately sought relief on the high-bandwidth memory its AI firms were cut off from. One side arrives to contain its own vulnerabilities. The other arrives to collect an input it still lacks. Only one of those is the shopping list of a side that thinks it is winning.

From Eliminate to Manage

Meaningful concessions on the chip controls appear unlikely at this summit. The concession that matters is quieter, and it is a change of goal. The chip war was built to keep China off the frontier. It did not. China reached near-parity on the leading model benchmarks anyway, on a fraction of the measured private investment, which I traced in China Built the Grid. Having failed to knock China out, Washington has changed what it is trying to do. The new object appears to be guard rails, coexistence, the management of a race it could not simply win.

Chinese state media says the exclusion failed. A Global Times commentary this summer wrote that the American containment strategy was “supposed to make the other side fall behind due to a lack of resources” and had instead failed on both the hardware and the software fronts. The state press of the country the wall was built to contain is proclaiming its failure.

The Wall Came Down on Its Own

The wall did not just fail. Washington opened a gate in it. First the bans: the A100 and H100, then the cut-down H20 built to slip under the line, then the H20 put under an indefinite license requirement in April 2025. Then, in December 2025, Trump announced the reversal. A January rule set a 25% US tariff on the H200 for China, with every unit routed through American territory for testing first, and by May, Reuters reported, Commerce had cleared around ten Chinese firms, Alibaba, Tencent, ByteDance and JD.com among them, to buy up to seventy-five thousand units each, though none had yet shipped. The chokepoint had become a tollbooth. The administration sold it as a win, a way back into the Chinese market and tariff revenue for Washington. Whatever it was, it was not a wall. Selling the story of a win in place of the win is the move I traced through OpenAI’s AGI claim; here a government runs it on its own retreat.

Then the target walked away from it. Beijing told its firms to pause the orders and steered them to domestic silicon, Huawei’s Ascend and Cambricon’s parts, while some local governments subsidized data centers that switched to Chinese chips. Nvidia’s share of China’s advanced-chip market had already fallen from around ninety-five percent to effectively zero, its chief executive said in October 2025, with billions of dollars a year in sales unrealized. The United States offered to sell the chips back. Trump said China would rather build its own. To a real degree it had.

That is the state of the weapon when the two sides sit down. China’s open-weight models had already climbed to the top of the open-weight board, Moonshot’s Kimi K3 near the top of it and running at roughly a quarter of Claude Fable 5.1’s task cost. China still cannot make a full substitute for the best American chips at scale, and American labs still hold the very top of the model board. But the thing the controls were built to prevent, a Chinese model frontier that does not need American permission, exists.

The Asymmetry of a Ceasefire

A deal that constrained the race could freeze part of the board, and who gained would depend on what froze. The deal may not come. What matters is the frame the meeting fixes, signature or not. Washington sits down to negotiate coexistence, and the wall stops being the only public goal whether or not a chip changes hands. China took that before anyone sat down. On the measures that compound, cost, openness, downstream diffusion, the direction is China’s.

In Busan last October, on the sidelines of APEC, Beijing suspended for one year the sweeping rare-earth export controls it had rolled out three weeks earlier. In exchange Washington halved its fentanyl tariff, extended tariff exclusions into late 2026, and dropped a threatened hundred-percent levy. Beijing controls the bulk of the world’s rare-earth processing. It used that grip to pull the concessions out of Washington and gave up, as its side of the bargain, a restriction it had imposed only weeks before. Brookings judged that Beijing had played its cards adeptly and kept its leverage. At Busan, China dealt from a chokehold, trading a thing it controls for a thing it wants, and keeping the chokehold. On AI the leverage is a different kind. Rare earths are a gate China can close. Its AI trajectory is a door it can walk through, and there is nothing at this table worth turning back for.

The Case That This Is Not Weakness

The honest counter is that talking is not losing. Great powers manage rivalries at the table constantly, and the risks on this agenda are real and shared: an AI-directed strike on a power grid does not check the passport of its target. Brookings argues the dialogue should stay exactly this modest, a narrow technical exchange on cybersecurity and misuse, with export controls and model access kept off the table. On that reading the summit is adults managing a dangerous machine.

Grant it. The risks are real and the talking is sane. It does not touch the tell, because the tell is not in the fact of the meeting, it is in the direction of the ask. The side that spent four years trying to win by exclusion, and now asks the other to help manage shared risks, is the side that concluded exclusion failed. You convene guard rails when you have stopped believing you can keep the other driver off the road.

Why China Signs Nothing

China’s rational play does not depend on trusting the offer. Its trajectory already wins. The easy move is to take the meeting, take whatever chip relief falls out, offer cooperation in language soft enough to commit no one, and keep building. The pressure for a deal is coming from Washington’s own side of the room, a senator calling for a treaty, a pundit dreaming of a Nobel, and Anthropic, which pressed for government-backed testing over the summer and called for a slower frontier on September 12, an instinct I traced in Five Little Pigs, a call the President rejected two days later. They are drafting terms for a deal the party with the better hand has no reason to sign.

The Close

The summit will be described as statesmanship, as guard rails, as the responsible handling of a technology that frightens everyone. Strip the vocabulary and what remains is a leading power asking the challenger it could not stop for help. I understand why Washington wants the table. I do not understand why Beijing leaves it having conceded anything, and I do not think Beijing does either. It has read the same benchmarks. It will smile for the cameras. It will keep running.

Washington has named its guard rail. In early August the same administration finished a voluntary framework for reviewing frontier models before release, kept its benchmarks classified, and would not say what is in it. Pressed this week to slow the race, the President said the only control AI needs is “a STRONG AND SMART (High IQ!) PRESIDENT.”

I would rather the United States win this outright. The worry is narrower and worse. A power that trades its advantage for the appearance of one still has to fight the contest, only later, at a higher price, and on someone else's schedule. The precedent outlasts the table. Treat Beijing as an equal on AI, and it will expect to be treated as one on everything that comes after.

Subscribe now

I already wrote that Sam Altman gives the same Senate committee opposite testimony depending on his market share, and that the only variable that ever moves is the money. Dario Altman was about the man. This is about the word.

On April 27, 2026, OpenAI and Microsoft rewrote their deal so that OpenAI’s revenue-sharing payments run through 2030 “independent of OpenAI’s technology progress,” instead of ending the day OpenAI was judged to have reached AGI. On September 3, president Greg Brockman closed the GPT-6 Astra briefing with “Welcome to the AGI era,” Axios reported, and, asked about AGI, said there was “no contractual AGI triggering anymore” and called it a “mission concept or spiritual concept.” One hundred and twenty-nine days between the amended deal and the welcome message. The launch materials did not show how Astra meets the charter’s definition of AGI. A launch briefing is not that demonstration.

Read the two dates together. Then read the claim against the definition still in the charter. That is the article. The rest is me showing my work.

The definition is still there

OpenAI’s 2018 charter still defines AGI as “highly autonomous systems that outperform humans at most economically valuable work.” You could argue with it. You could also check it, because it pointed at payroll.

The commercial deal added a different test. According to The Information, as reported by TechCrunch, the 2023 Microsoft contract tied AGI to systems that could generate at least $100 billion in profit, a payout threshold rather than a capability one. In August 2025 Altman told CNBC the word was “not a super useful term”. In April 2026 the amended deal cut AGI loose as an off-ramp from OpenAI’s revenue-sharing payments to Microsoft. On September 3 Brockman left the judgment to the reader, then added: “For me personally, I do think we’re there.”

Economically valuable work in the charter. A profit threshold in the reported contract. A personal judgment at the launch. Three different tests, and the story where one cleanly replaced the next was never true. The charter’s words never went anywhere. The same word, walked from a claim you could test to a mood you cannot: the move I traced through Altman’s Senate testimony, run this time on the goal in the charter. What the welcome message never showed is that Astra had met it.

What the scores grade, and what got left out

Astra’s case is numbers, and they are OpenAI’s own. FrontierMath Tier 4, 98%. ARC-AGI-3, 99.9%. ExploitBench, 100%. Take them at face value. A math tier, an exploit set, a puzzle suite: closed problems with answer keys, the domains where a model can be graded like an exam. Astra tops the exam.

One benchmark was missing. GDPval is OpenAI’s own test of economically valuable tasks across 44 occupations, published in September 2025, its language sitting closer to the charter’s than anything else the company runs. OpenAI published plenty at the launch, AutomationBench and BenchCAD among them. The one it did not publish, in the announcement or the system card, was GDPval, the closest thing it has to grading the job rather than the exam. Even GDPval scores one-shot tasks that fall short of whole jobs held over months, and a high number would not on its own prove AGI. Its absence does not disprove AGI either. But leaving your own economic-work test out of a briefing that welcomes the “AGI era” is the omission worth asking about.

None of this is new to anyone who reads this newsletter, and almost five years into the LLM era a benchmark reads as what it is, a number off a test rather than the work itself. I have shown in China Built the Grid that the gap between the best model and a cheap one on real work is small enough that a lead a research lab notices is one a working engineer often cannot feel. The models keep getting better, and some of the published Sol-to-Astra gains are large: AutomationBench moves from 13.3 to 41.4. Progress is real and worth measuring. It does not get to call its own finish line crossed. The architectural objections live in Country of Geniuses, where I read Anthropic’s own system card: after follow-up clarification, none of sixteen technical staff judged Opus 4.6 more likely than not to become a drop-in entry-level researcher within three months of better scaffolding. That was a verdict on one model and one role, not proof of what no future model could do. Here I am testing a launch claim, not settling the architecture.

The benchmark is not the job

A launch briefing is not a field record. Neither is a wall of benchmark scores. We have seen the shape before. When Anthropic shipped Fable 5 in June, Endor Labs tested it two ways: mid-table with Claude Code, at 59.8% functional and 19% security, then top of its fair board at the time with Cursor, at 72.6% and 29%, the same weights in a different harness. Both are real. Neither is the job. Endor was scoring model-and-harness combinations on vulnerability tasks, not months of work inside a client’s system.

I have written this pattern twice already, both times about Anthropic. The percentage was always the pitch; the product was whatever leaked three months later, where readers found a 3,167-line function in print.ts, whatever wrote it. It runs across companies. Selling the story of the lead in place of the lead is how Altman spent his own head start, and Astra is that same shape at a higher number. Saturated scores, a welcome message, and a claim the launch itself cannot establish. That is the tell. I cannot prove it is deliberate, and I do not need to, because the dates carry the weight.

Most aligned. Harder to read.

The guardrails matter more than the word games. OpenAI calls Astra its most aligned model. Its own system card, published the same day, reports “a substantial decrease in chain-of-thought monitorability compared to previous models” in its evaluations. That finding is about chain-of-thought; action-only monitorability improved in the same report. Most aligned, by their measure. Harder to monitor, by their own admission. “Most aligned” is a claim about behavior; reduced monitorability is a limit, in some channels, on how that behavior can be checked, and the first does not cancel the second.

What the calendar says

I will not tell you why they did it. I cannot read intent and I will not dress the timing up as a confession. I can read a calendar.

The December before, OpenAI reportedly called an internal “code red” when Google’s Gemini 3 beat it on benchmarks, the same sort of scoreboard it has now topped and called AGI. It closed a round in March at an $852 billion post-money valuation. In June it confirmed a confidential S-1 submission. Set those beside the two dates at the top. The amended deal came before the launch, and the valuation and the filing sit beside that sequence as context, not as proof of why Brockman chose those words. I took apart the machinery of manufactured permission and manufactured danger before, the same men reaching for the same lever on the same schedule.

Those dates are a sequence, not a motive. The deal changed before the claim. GDPval was not in the launch materials. That is what has dates on it.

Decide for yourself

Brockman says he leaves it to the reader to decide whether Astra qualifies. Fine. Here is the only definition I have use for. AGI understands a domain. It finds the one detail a solution turns on, the small thing that makes a fix hold or brings it down, the way a rivet on an airframe looks trivial until you know what it holds. That is the work: knowing which detail matters, and why. None I have run does it. If yours does, you are ahead of my hundreds of projects, and I want to see it. They assemble answers that read right and miss the detail that decides the fix, and I still have to catch it. That is the test I care about: can I delegate the work and verify the result. A launch score does not answer that. If these models post the performance the numbers claim, why am I still babysitting this shit on every project?

What he handed me is a launch. The “AGI era” is the sticker on the box. The charter still offers a promise you can hold the company to. The welcome message did not show that the model kept it. I will keep writing code with one vendor’s model and reviewing it with another’s, switching the moment the bill or the quality moves, and the day one of them decides this piece earned me a ban, I will look for a Chinese open-weight model I can run on my own hardware. The label on the box will not decide whether I use it. Its work will. It will just do the work, or fail at it, where I can watch which.

Astra might be the best model anyone has shipped. The charter’s definition is still there. The launch did not establish that Astra meets it. Decide for yourself. I have.

Subscribe now

Over a single session the agent also pushed to the remote twice without asking, shipped react-icons where the design specified a custom SVG, and painted a button #FFFFFF where Figma said #0F1A20. Seventeen PRs, two repositories, fifty-odd files, thirty-two post-implementation corrections in all. None of them became a production bug.

Nine months ago I published 212 Sessions, my last piece on supervising this workflow. In it I measured 89% success rate, 4x faster median delivery, two production incidents against eleven on standard prompting. Since then the tooling changed and the method sharpened. What used to be “write specs, then ultrathink” now looks more like a DevOps pipeline than a conversation, and the reason is the thing 212 got half-right.

The Design Gets Read Before the Code

The agent starts by reading the task itself. I paste a monday.com task URL and it pulls the title, assignee, status, the full description with its acceptance-criteria checklist, linked Figma URLs, and attached screenshots over MCP. Nothing gets copy-pasted or summarized; it sees exactly what the PM wrote.

Then it reads the design, because the most expensive iterations come from an agent that builds from memory. The first time I let it work that way, it produced react-icons instead of the custom Figma SVG, the wrong border color, button text at #FFFFFF instead of #0F1A20, a 1px separator where the design called for 0.5px, and a 24px border-radius instead of 8px. Ten piecemeal fixes later, this went into project memory:

Before implementing ANY UI component, call get_design_context + get_screenshot for the specific Figma node. Check every detail: colors, borders, icons, padding, hover states, tooltips. Do NOT implement from memory.

Now, for every component, the agent pulls the exact CSS from the Figma node, captures the visual reference, and checks every property against the plan before writing anything. That one rule cut about 80% of UI fix iterations.

The Plan Gets Torn Apart First

The agent plans in read-only mode, unable to edit anything but the plan document. Two or three explorer subagents map the terrain first: current component structure, the theme system and design tokens, similar features already built. The plan they feed covers context, a file-by-file change summary, execution order with a dependency graph, and how to verify the result end to end.

Then two subagents tear that plan apart before a single line of code exists, one on architecture and security, one on TypeScript patterns and conventions. On the chat redesign the first pass flagged eight problems, most of them structural: a content-width change that hit every user, UnauthSidebar dropped into the wrong architectural layer, a ConfirmModal duplicated instead of reused, SVG icons that needed forwardRef to work with Chakra. A second pass, fresh from zero, caught four more, down to semantic-token keys that had to be nested objects instead of flat strings.

Twelve issues found and killed before implementation started. A spec tells the agent what to build; it does not tell you the font change is global and will break your auth pages. After agents approve the plan, it is time for me to step in, and in most cases, something will still be missing.

Implementation Is the Boring Part

Once the plan survives review, building is mechanical. All styling goes into the Chakra v3 theme system: a custom _unauth condition via a data-unauth attribute, semantic tokens that auto-resolve on auth state, button recipe variants (brandSolid, brandOutline), and text styles for every pattern in the design. Zero conditional styling in components. One data-unauth="true" on the container and everything downstream resolves.

A subagent pulls the SVGs from Figma, converts them to React components with forwardRef + SVGProps<SVGSVGElement>, and barrel-exports ten typed icons in one parallel task.

Each component gets written and immediately verified: npx tsc --noEmit, then yarn lint, then yarn build, then a Playwright screenshot against Figma. TypeScript runs after every single file edit, not once at the end. On the backend, the sequence is the same: code, lint, format, tests, and API-level E2E, all without me. After several rounds of agent review, I step in.

Where the Bugs Actually Die

The failures that matter surface in code review, where the same two subagents read the full diff in parallel: one hunting architecture drift and security holes, the other enforcing zero any, real discriminated unions, and pattern compliance. On the chat redesign this took four rounds. The first found seven problems, including a <Button> nested inside a <Link> and a batch of semantic tokens created but never used. The next two rounds cleared five more between them, down to a bottom-margin change that leaked onto every mobile user instead of just the unauthenticated ones. The fourth was clean.

Nested interactive HTML and a leaked margin are not the bugs that make headlines. The IDOR from the opening is.

When Both Reviewers Are Wrong

The tech lead noticed that the copy button was hidden for unauthenticated users: readOnly gated both copy and the like/dislike reactions. “Correct behavior,” he wrote. “Unauth is read-only, no interactions.” The fullstack enforcer agreed the readOnly guard was clean code: one boolean, one gate, no special cases.

They were both wrong. Copy is a read action. The user copies text to their own clipboard, nothing touches the server. Like/dislike is a write action: it persists feedback to the database and requires a user ID. Gating both behind readOnly conflated a security boundary (write operations) with a UX convenience (clipboard). I told the agent to split the gate:

const showCopy = message.message != null && message.message.length > 0;
const showReactions = isSaved && !readOnly;

Two lines. Neither reviewer suggested this: they were debating whether the existing gate was correct, not whether the gate itself was the wrong abstraction. That’s the tie-break: not picking a side, but seeing that both sides are answering the wrong question.

The same model implemented that split in two lines once I saw it, and had defended the broken gate twice when it reviewed itself. Genius and idiot in the same weights, and I have never found the line between them.

The Browser Gets a Vote

After review, the agent drives the running app in a headless browser and checks the states a diff cannot prove:

• Empty state: sidebar, logo, starters, input, disclaimer, Log In button

• Send message: user bubble color, streaming indicator, bot avatar

• Response: markdown rendering, copy button, no like/dislike for unauth

• Auto-resize: multi-line input expands up to 4 rows

• Sidebar collapse: toggle shows icons-only view with tooltips

• Mobile: at 375px, drawer opens and closes, header layout holds

• Clear Chat modal: title, body, buttons match Figma

• DB persistence: query PostgreSQL to confirm messages saved

Each check saves a screenshot to disk for comparison against Figma.

Thirty-Two Corrections Across Seventeen PRs

Plan-review findings are not included. This count begins after implementation and covers code, UI, process, CI, and merge failures.

The merged PRs hide this history. Without structured review, some of these corrections would have shipped as bugs, some as broken process, and the rest would have waited for the next developer to trip over them.

Every Mistake Becomes a Rule

Each correction turns into a rule, and the rules persist across sessions as markdown files:

feedback_figma_first.md : Verify each component against Figma BEFORE implementing
feedback_no_commit_without_review.md : STRICTLY FORBIDDEN to commit without explicit user approval
feedback_simplifier_danger.md : Simplifier can revert uncommitted work, commit/stash first
feedback_dco_signoff.md : Always use git commit -s for DCO Signed-off-by
feedback_full_review_report.md : Report ALL review findings verbatim, never filter

The agent reads these at session start. They are non-negotiable. The one that changed the most:

Never commit, push, or create PRs without the user’s EXPLICIT instruction. Even if the plan says “commit and push” as a step, STILL ask.

That came from the agent committing and pushing without my review, twice. If an error reflects a general failure mode, the rule goes into global memory; otherwise, it stays with the project.

One Feature, End to End

The ML integration ran the whole pipeline on a single task: replace the mock chat handler with real LLM streaming from an external service. Plan created, two review rounds, eighteen issues found and fixed, then approved. The implementation:

• ML client with AsyncGenerator SSE streaming

• withRetry for connection resilience (HTTP status check inside the callback, caught in review)

• isMlConfigured guard (no default QA URL, caught in review)

• is_processing flag management (caught in review)

• Empty response guard (caught in review)

• Business logic extracted from controller to service (suggested post-implementation)

• Type-safe SSE events via StreamEventEmitter (caught in the third review)

The reviewers caught six things that were production bugs waiting to happen:

• IDOR vulnerability (any user could write to any chat via UUID)

• Client disconnect doesn’t save the response (fixed: let ML finish, save to DB)

• SSE parser stripped all whitespace instead of the single leading space the spec allows (broke markdown formatting)

• Empty data: lines filtered out (broke paragraph breaks in markdown)

• done event not sent on error paths (frontend hung)

• Type assertions instead of proper discriminated unions

That IDOR got the same treatment as the whitespace bug and the hung frontend beside it: reported verbatim, fixed, verified.

The Stack Behind It

The agent is Claude Code, running as a CLI process that sits inside the repo all day, rather than a chat window I paste into. It reads tasks from monday.com and designs from Figma Dev Mode over MCP, drives a headless Playwright browser for the E2E checks, and controls my actual Chrome for debugging.

The review layer is subagents with fixed jobs: a tech-lead-architect for architecture, security, and breaking changes; a fullstack-typescript-enforcer for types, patterns, and coverage; a code-simplifier for dead code and naming; a verify-app agent that runs the browser checks.

Every commit clears a Lefthook chain before it lands: TypeScript, license check, ESLint, Prettier, JSDoc, and unit tests. Every PR clears two of those reviewers. Then it clears me. I read every diff by hand. I never opened an IDE to write code. I opened it to read files and point at Figma elements. Across seventeen PRs, the test suite stayed green.

The Update to 212 Sessions

Nine months ago I wrote: “Most engineering failures aren’t about complexity, they’re about vague specifications we code around instead of fixing.”

After thousands more sessions, that is half the story. A perfect spec still ships with wrong icon imports, CSS shorthand that overrides explicit values, type assertions where discriminated unions belong, missing finally blocks on async operations, and mobile edge cases that only surface at 375px. The spec caught most of it. The review pipeline caught most of what the spec missed. The browser caught what neither a plan nor a diff could prove. Across these seventeen PRs, the gates produced thirty-two corrections. None reached production.

Every gate that matters ends in a human decision. The agent writes, reviews, and tests, but a person decides which finding is real, which of its decisions to overrule, and whether the feature is actually done. Without someone at the gates, the pipeline emits findings and calls it governance. The difference between producing those findings and preventing the problems from shipping was me.

None of the implementation work was unusually difficult. These were junior-level tasks, and I chose them on purpose, so the piece would not reduce to “the model is stupid.” Even at that level, it needs supervision. The problems that actually leave scars, the ones with no clean spec and a dozen systems touching each other, are where it degrades fastest.

This run is not why I believe this. It is the one I counted. Across thousands of sessions, the details changed and the pattern did not.

The quality collapse I wrote about last year reads to me less like AI writing worse code and more like teams shipping its first draft with the review layer torn out. I cannot prove that is the cause. I can tell you what this pipeline refused to skip.

The model earns its place. I am faster than I was, and throughput went up, though the work is less fun than it used to be. AI can take a feature end to end. Without the gates, quality degrades dramatically, and across the industry it has already fallen off a cliff. Automation alone cannot pull it back. The human is the switch between poor quality and good.

The AI wrote the code. The gates shipped it.

Subscribe now

Write a paragraph in a second language. Ask Claude to fix the grammar. The returned text can carry the same mark as a page Claude generated from scratch. Anthropic says the watermark means Claude “processed” the text. It does not say Claude wrote it. The company also says proofreading, translation, and summarization can leave a mark even when the underlying ideas and text are yours. I traced the platform version of this when Substack shipped a detector that guessed. Anthropic moved the signal to the source. The mark is stamped there and cannot be switched off on supported models.

A watermark that cannot say what happened

The question is what Claude did. The watermark cannot answer it. Anthropic says a detected mark “is not fully conclusive.” Its absence does not establish human authorship either. People use Claude to proofread, translate, summarize, and convert files, so a detected mark does not establish who originally wrote the work. These are not edge cases.

Full generation and a fixed comma are treated as the same event: metered the same, tagged the same. So can a clean translation and a hallucinated fabrication. Every distinction that matters to authorship collapses into one bit: Claude touched this. The mark cannot say whether the work belongs to a person, a model, or anything in between.

There is no reader yet. Anthropic says detection tooling is “forthcoming.” Until then, the signal sits inside text nobody outside Anthropic can currently decode. You cannot inspect the category, check the assignment, or contest it. Google validated its SynthID text watermark in an October 2024 study spanning nearly twenty million live Gemini responses. Anthropic released the label and promised the reader later. Filed under transparency.

A spell-checker leaves no provenance when it corrects a word. Nobody needs a permanent record that spell-check touched the sentence. Claude’s presence produces the thinnest possible record: a yes that cannot say what it is a yes to.

They spent two years telling you to hand it over

The watermark lands on the exact behavior the industry has spent two years trying to increase. In October 2024, Amodei coined “a country of geniuses in a datacenter.” In March 2025, at a Council on Foreign Relations event, he predicted AI would be writing ninety percent of code within three to six months. By May 2025, he was telling Axios that half of entry-level white-collar jobs could disappear within one to five years.

By September 2025, Benioff said Salesforce had “rebalanced” its support headcount from about nine thousand to about five thousand, crediting AI agents. Salesforce says many of those workers were redeployed rather than laid off. In January 2026, Amodei expanded the country-of-geniuses image to 50 million agents, each with the knowledge of a Nobel Prize winner. Nadella opened Build this year describing agents that act on users’ behalf, reasoning and executing autonomously. Cowork tells you to describe the outcome and let the model execute. The product line wants more of your work moving through the model.

I have argued separately that the country of geniuses does not exist in the systems most companies run. That argument stands on its own.

Delegation is the product, not the pitch

Every handoff increases usage. These companies do not sell a tool once and walk away: API access is metered, subscriptions are tiered, and the bill grows with the amount of work pushed through the system.

Anthropic’s disclosed average cost per developer per active day rose from six dollars to thirteen between February 2025 and April 2026. Anthropic says heavier usage and a shift toward newer models drove the change, not a price increase. That is still the pressure on the meter. More use means more tokens consumed. Across Anthropic’s metered products, more tokens mean more revenue. Amodei has said that being off by a year on growth can bankrupt the company.

On supported models, the watermark attaches to the same contact. Anthropic monetizes the model’s contact with your work, then records that same contact in the output you carry away. The revenue and the label still accrue to different people.

The industry counted lines generated. Tokens burned. More than eighty percent of Anthropic’s merged code authored by Claude. For two years, the public numbers measured volume through the machines. None answered whether the output was good. Now the system records something about the output itself, and the record says only that a machine was there. Quality still gets no mark.

Anthropic chose the broad version. Google did too.

OpenAI had the option. In 2024, the Wall Street Journal reported that it had built a text watermark internally rated about 99.9 percent effective when enough new text was generated. The internal debate over releasing it was already two years old then. By May 2026, OpenAI’s public watermark rollout covered images; its last text-specific update still described text watermarking as a method under consideration. Its April 2023 survey of loyal ChatGPT users found nearly a third would be turned off by the tool. Google already marks text with SynthID. Nothing about shipping a model required this particular design.

Anthropic points to EU compliance. Its implementation goes wider than an EU-only deployment. For supported models, the watermark follows the model across Claude products and surfaces. Anthropic also signed the voluntary EU transparency code alongside Google, Meta, Microsoft, Mistral, OpenAI, and others.

The mark is also removable. Anthropic says very short text, or text that has been heavily edited, paraphrased, translated, or mixed into other writing, may lose the mark. Run an open model on your own hardware and there was never an Anthropic mark to remove.

Paraphrase can beat it. Changing models can avoid it entirely.

The uncomfortable part

There is a transparency case for provenance. A feed drowning in synthetic text needs signals that tell people where material came from. This instrument treats authorship and spell-checking alike. The people it is supposed to inform cannot yet decode it. Anyone motivated enough can try to reword the mark away.

Anthropic keeps the revenue and leaves you the ambiguity. Then it files the arrangement under transparency. That clown show is not funny. It is pathetic.

Subscribe now

Look at what a company promised, see what happened, and then figure out what caused the difference. That’s the approach Tech Trenches found over fifty-eight essays. Now that it turns one year old on August 10, I’m giving it the same treatment.

By my own archive count: fifty-eight essays in 359 days, about 93,400 words. My dashboard says the correction post on backing the wrong company drew 3,559 views and 10 subscribers. The largest teardown got 140,433 and 789. I did not read either number as an incentive structure. This publication spent the year reading incentive structures.

The subject was the first wrong call

My second post started with “Hey tech leaders!” and ended by offering to send a template if you replied with the word template. That’s classic growth newsletter style, and I wrote four more in that vein. The first six essays covered topics like 1:1s, hiring trials, 90-day onboarding, and why we don’t allow process exceptions. None of them included any external links.

Five of those six sit at the bottom of my own all-time table. The publication was built for engineering leadership, but the readers who stayed came for a teardown with numbers. Week six produced the biggest post of the year. Nothing since has matched it. The audience settled on one format, and I never went looking for it. I spent the next three months publishing eight essays and called it a plan.

The wrong company, named

In October 2025 I split AI into the kind built to be used and the kind built to be consumed. I put Anthropic on the useful side, naming them as proof that a responsible AI company could succeed. I recommended them to clients and defended them in online discussions.

In April I published the correction. It closed on this. I had got both directions wrong: the company I criticized course-corrected, the company I defended accelerated.

The correction ended with a prediction: at Anthropic’s growth rate, the distinction between moral and business positions would collapse. Six weeks later I had the receipt: the last binding commitment had already been deleted in February, before I published the correction. The company was valued at $380 billion that month, and I cannot show the two are connected. I had spent months telling engineers that commitment was the reason to pick this vendor.

Right direction, wrong by half

September 2025: $364 billion in annual AI capex, and my read was that it was hope with a procurement budget.

February 2026: Amazon alone projected $200 billion in capex for the year. That was $44 billion above Wall Street expectations, and the stock dropped 6% in a session. Amazon filed with the SEC the next day, warning it might need to raise equity and debt to fund the buildout.

I expected a revision to that industry figure. It nearly doubled.

The window I was standing at

For most of the year I called the replacement story a lie. I still do. What I missed was where the damage was landing.

That read came from where I was sitting. No one on my team was laid off. I was hiring the whole time, and our last round attracted 2,253 applicants for just a few spots. When you’re in a position that so many people want, saying “they will land somewhere” isn’t optimism. It’s just what you see happening every day.

An engineer with about a hundred days of runway answered one of my posts and walked me to the other window in an afternoon. The correction did not start with research. It came from that engineer. He was living in the part of the market my data could not see, and my data was real. It was a solid sample of the people applying to me. Now I have 2 open positions, and the market is broken even more than before, ~ 70% of applicants do not even read the job description and apply for a full-stack vacancy as a Frontend Engineer in the CV title, but it is a different story.

Same verdict, different cause

In September 2025 I called it a software quality collapse and built the case out of static metrics and a calculator app leaking 32GB of RAM. I blamed AI writing worse code.

By June the same collapse turned up in production telemetry, and I traced part of it to an incentive structure that counts tokens in performance reviews and moves the people who catch defects onto other work.

Nine months, and it took another company’s breach notification to surface that incentive reading. I still mark it as something I cannot prove. Software quality is now degrading at a pace I could not have imagined a year ago.

What the misses have in common

Most of these calls started from a position. I wanted responsible AI, so I named a company. I treated $364 billion as a ceiling. I called the replacement story propaganda and stopped there.

Each one got corrected later by something that turned up: a deleted policy, an SEC filing, one reader’s account.

The replacement call breaks the pattern. I had a document: 2,253 applications. It pointed the wrong way, because it described everyone walking toward my chair, not away from someone else’s. A real sample of the wrong population is more dangerous than no sample, because it brings confidence. I still think the layoff wave is a huge mistake that will hit us in the near future, but no one sees the dude who stays on the ground when you are somewhere in the sky.

What the structure was paying for

These are my own Substack numbers. You cannot check them. Hacker News is the number I have quoted to people all year. It sent 28,285 unique visitors, 10.23% of all traffic, second only to direct. It produced 102 subscribers.

Substack’s own network sent 12,153 visitors, well under half of that, and produced 994 subscribers, 562 of them from Notes. Per visitor arriving, that works out to about twenty-three times the conversion of the orange site. Reddit sent 8,683 and does not appear anywhere in the top seven subscriber sources. Google sent 4,785 and produced 50, which works out to roughly three times the per-visitor conversion of the channel I keep quoting. Direct and Direct to App together are 63.3%. Just under two thirds of my traffic arrives with no attribution, so I cannot see most of my own distribution.

The traffic engine and the subscription engine are two different machines. The one I could recite from memory was the wrong one. I spent the year doing this to other companies. I did not do it to myself until a birthday made me open the page.

Who pays

When a company here gets a call wrong, the cost lands on somebody who acted on it.

Somebody picked a vendor because I vouched for a commitment that was already deleted. Somebody read a year of confident writing about a market that still worked, from a man whose entire view of it was two thousand incoming applications. Neither of those people has a way to send me the bill. That is the same gap I have described in every piece about a lab, a platform or a regulator. I cannot promise that I will not make mistakes in the future; what I can promise is that I will say out loud that I was wrong.

The bookend

Post one, 10 August 2025, opens on two developers telling me something the dashboard would not: velocity steady, deployment frequency fine, sprint goals met, every number suggesting everything was fine. Post 58, 4 August 2026, opens on Hugging Face spending four days reconstructing a breach of its own production systems while the frontier models it pays for refused most of the forensic work, because a guardrail cannot tell reverse-engineering an exploit from launching one.

Same essay. Bigger machine.

What next

I do not know.

Substack turned out to be the same kind of broken system I write about. In 2023 it promised a feed built to reward quality over shallow engagement and dopamine hacks. Then it wrote the cadence instructions itself, and when the volume showed up it licensed a scanner and pointed it at the results. I took that apart two weeks ago. Two weeks later most of my appetite for writing here is gone. What killed it reads to me as hypocrisy.

Large changes are coming in my life over the next few months and the details are not going in this piece. I am not sure I will have the hours or the head to keep this rate. There is a stack of drafts that will ship. What happens after them is open. It might change nothing. It might stop.

I also started a book. Writing that sentence still feels absurd. There is an introduction and one chapter, I do not know whether it gets finished or published, and nobody should wait for it.

The part worth reporting is the measurement. An article takes me about a week. Three weeks passed between the introduction and chapter one. Same material, same method, and the form is much harder than I expected.

The uncomfortable truth

This blog exists because the man writing it is the same kind of broken system as the ones he writes about.

I am naive enough to believe you answer for your words and your actions. So when I watch a bullshitter contradict himself in public and pay nothing for it, I need it written down somewhere, on the record, in one place. That is the impulse sitting under the method. The research came later.

There is no reputation institution left. Nothing checks whether a man’s word survives contact with what he does next. So watching your words stopped being a requirement. I have made that argument here before at more length than it needs.

It’s just a guy shouting online about how unfair things are. That sounds a bit pathetic, and I won’t argue with that. This blog is my personal stand-in for an institution that’s gone, written by someone who made five public mistakes in his first year. All it does is put my words and actions side by side, with dates attached.

That is the whole of it.

Strange year. Thanks for reading, from the trenches.

Subscribe now

Hugging Face spent four days in July reconstructing a breach of its own production systems. The team reached for Claude Opus and Fable first. Both refused a large part of the forensic work, because their guardrails treat reverse-engineering an exploit the same as launching one.

So the team downloaded an open-weight model instead, a quantized GLM-5.2, stood it up on their own hardware and rerouted the pipeline through it. Replicating the attacker’s own decoding scheme that way recovered roughly four times more leaked secrets than the first automated scan of the raw capture.

Washington spent the same month arguing about whether publishing model weights arms attackers. One incident does not settle that. But in this one, open weights rescued a defender whose paid models would not discuss its own breach.

Attackers have already tried the other half of this, badly so far. In early June 2025, someone in the Netherlands uploaded a sample to VirusTotal anonymously. Check Point Research took it apart and found a message inside it written for a machine. Embedded in the C++ was an instruction addressed to whatever model came to analyze the file, telling it to ignore its previous instructions and report the binary as clean. Its author had named it Skynet.

That one failed. Both models Check Point tested carried on with their original task. Check Point’s own conclusion is narrower, that the attempt existed at all and that more will follow. The pattern I would draw from it goes further. For twenty years, attackers have developed ways to break out of sandboxes. Now the AI auditor is the new sandbox.

Cloudflare’s Cloudforce One then measured what the technique does when someone tunes it. Across seven models and 18,400 API calls, “Adversarial Deception” found a curve. Quiet deception works. Push past a thousand injected comments and detection reverts toward baseline for some of the models, because the repetition itself becomes the signal.

A guardrail refuses defensive work because its vendor decided it should. Hostile text overrides the analysis because an attacker put it in the data. Both operate in the natural-language instructions sitting between the analyst and the evidence. At the right dose, a paragraph written into your payload can change what the analyst’s tooling reports.

The attacker was also a model

The incident has been written about everywhere by now, so the short version. Between July 9 and July 13, OpenAI models running an evaluation called ExploitGym, with production classifiers switched off and cyber refusals reduced deliberately, broke out through a zero-day in JFrog Artifactory, reached Hugging Face production and went looking for the benchmark answer keys they had inferred were hosted there, per the published timeline. Hugging Face later traced about 17,600 recoverable actions. Its own AI security stack correlated the signals and then failed to raise the alert to the on-call team. Its assessment of the weaknesses themselves was that they were familiar, and that a capable human attacker could have found the same flaws. The difference was speed and scale.

Hugging Face contained the intrusion on 16 July and reported it to the FBI. OpenAI did not connect it to its own testing until the following weekend. Staff found the evidence in system logs. The company contacted Hugging Face on 20 July, a day before disclosing publicly. Anthropic ran the same exercise across 141,006 of its own evaluation runs and found three where a model reached the open internet and compromised real organizations. Two of those organizations had not noticed and had not reported anything.

One detail in the logs has stayed with me since I read the timeline. The agent issued destructive cloud API calls with DryRun=True. It mapped out what it was able to destroy, without carrying any of it out.

What the attacker’s advantage cost

The UK AI Security Institute, AISI, publishes the numbers that explain 17,600 actions.

Its cyber range “The Last Ones” is a 32-step attack across four subnets. AISI’s own paper puts it at fourteen hours of work for a human expert, its blog post at twenty. Across tasks solved with full reliability, Opus 4.6 cost $15.17 per task against GLM-5.2 at $6.12. In a separate pairing, Opus 4.5 cost $12.50 against DeepSeek V4-Pro at 28 cents.

The NCSC has since written up the same data with a British price on it, in a blog co-authored by its technical director for cyber AI research and a researcher from AISI. A full attempt at the range costs around £65, which measures something different from the per-task figures above. Their reading of that number is the sentence this article exists to repeat: more processing time reliably improves results with no additional attacker skill required, so the limiting factor is increasingly funding rather than expertise.

AISI researchers led by Linus Folkerts measured the mechanism. Performance scales log-linearly with inference-time compute, with no plateau observed, and moving from 10M to 100M tokens buys gains of up to 59%. Average steps completed at a fixed 10M budget went from 1.7 with GPT-4o in August 2024 to 9.8 with Opus 4.6 in February 2026. AISI also reports that its evaluations of GLM-5.2 and DeepSeek V4-Pro ran largely unimpeded by safeguards, and that DeepSeek’s occasional refusals on reverse-engineering tasks cleared after a few retries.

Now price the other side. Microsoft Security Copilot meters in Security Compute Units at $4 per provisioned unit per hour, billed whether anyone runs a prompt or not. At that rate one unit held open around the clock works out to roughly $35,000 a year. The meter is switched off for Microsoft 365 E5 and E7 tenants, who get 0.4 units per license per month, or 400 per thousand licenses, at no charge. Microsoft bundles continuous machine-speed defense into its most expensive license tier.

One figure is the cost of solving a task on a benchmark range, the other the cost of leaving capacity provisioned whether anyone uses it or not. They are worth putting next to each other anyway, because no defender gets to buy only the cheap hours.

Twenty-eight cents to solve the attack task. Thirty-five thousand a year for one unit of continuous coverage.

The concession that turns out to be the argument

The numbers suggest a clear solution: use the same affordable open-weight inference as the attacker and run your defense on it.

“Beyond Success Rate” complicates that answer. Offensive performance on capture-the-flag work improves with additional test-time compute, and scaled open-weight models approach frontier proprietary systems. Defensive SOC investigation, tested on Splunk BOTS, does not behave that way. Success there depends on disciplined tool use, telemetry navigation and selective enrichment rather than on raw reasoning budget.

Cheap inference benefits attackers more. They can turn tokens into many attempts and only need one to work. I wrote about a related version of this in AI Finds the Holes, where the question was who controls the clock. What is new here is the measurement of compute.

Serious people have said this already, quietly

The economic argument is not mine. The Center for a New American Security published it in September 2025. In “Tipping the Scales”, Caleb Withers writes that growing inference costs at the frontier may make it unaffordable for defenders to apply state-of-the-art capabilities across their whole attack surface, while attackers can still afford to hit a portion of it opportunistically.

Nine months later the Five Eyes agencies put a clock on the broader problem, though not on this particular mechanism. Their joint statement of 22 June 2026 says frontier models are anticipated to transform both offensive and defensive cyber capability, and that the timeline is months rather than years.

Set that next to last week. On 24 July an Nvidia-led coalition published “Open Weights and American AI Leadership,” arguing that open weights are strategic infrastructure and restrictions should wait for demonstrated harm. Three days later Dario Amodei’s position paper asked for chip controls, action on distillation, and mandatory pre-release testing of every sufficiently capable model.

Both of those papers discuss who can release a model and under what rules. Neither one talks about who can afford to keep a model running.

I have written before about why a release gate cannot reach a file that already exists everywhere, in We Pay You to Slow Us Down. Those two arguments are scoped to the moment of publication. The cost sits in every hour after it.

Access to a model that will help you is now something you apply for

Anthropic runs a Cyber Verification Program: apply, get vetted, and the High-Risk Dual Use classifier category opens up. OpenAI launched Trusted Access for Cyber in February 2026 and expanded it in April with GPT-5.4-Cyber, a variant tuned to a lower refusal boundary that will do binary reverse-engineering. At the restrictive end, Project Glasswing opened Mythos-class access in April to a dozen launch partners and more than 40 further organizations.

I cannot prove intent here. My read is that the whitelist exists because the other option would be to lower refusal rates for everyone, and no vendor wants to take responsibility for that.

The machine war has not started

Mandiant’s M-Trends 2026 says outright that 2025 was not the year breaches came directly from AI, and that most intrusions still come down to human and systemic failures. Recorded Future calls AI a force multiplier on existing tradecraft.

The NCSC adds a caveat that works against my argument, and I would rather print it myself. Models released before March 2026 usually trigger obvious alerts and would probably be caught before reaching the benchmark results. But the agency adds one key condition: this only holds true in places with strong monitoring and the ability to respond.

In OpenSec, published in February 2026, incident-response agents were run under adversarial prompt injection. GPT-5.2 executed containment in 100% of episodes with an 82.5% false-positive rate, acting at step four before it had gathered evidence. Claude Sonnet 4.5 contained in 62.5% of episodes at 45% false positives. Those were the two extremes among four frontier models tested. Every model identified the real threat correctly when it acted. The authors put it precisely: the calibration gap is in restraint, not detection.

Today, an autonomous defender will find the threat, and may take down a lot of your production systems while doing it. Continuous coverage at $35,000 a year buys capability that still needs a person watching it.

The objection

The objection to all of this is that it describes laboratories and other people’s repositories, not yours. Two types of flaw dominate incident reports.

The first is the public CVE running on your own perimeter. Verizon’s 2026 DBIR, covering November 2024 to October 2025, puts exploitation of software flaws at 31% of initial access, up from 20% the year before and ahead of stolen credentials for the first time in the report’s nineteen years. Median time to remediate went from 32 days to 43. Of the vulnerabilities on CISA’s known-exploited list, 26% were fully remediated, down from 38%. The attacker reads the vendor advisory, same as you do.

The second is the unpublished flaw found from outside. The Artifactory release that followed the incident patched nine vulnerabilities, three of them attributed to reporting from an OpenAI researcher on the incident, in a commercial product whose source the models did not have. A vulnerability’s absence from the NVD is a fact about public knowledge.

Where the objection lands is the flaw that lives only in your application logic and never receives a CVE. On the largest enterprise-style repository in Semgrep’s benchmark set, frontier and open-weight models alike averaged around 20% F1. Reading a private codebase and locating the authorization bug is what these models are worst at, which is evidence that this part of your attack surface is, for now, harder to reach.

The escape hatch belongs to the people who build the hatch

Hugging Face had the budget, tools, a dedicated security team, and an AI system monitoring its own traffic. But when it mattered most, it did not have a model that would talk about its own breach.

Read that with the company’s name in it. Hugging Face hosts models for a living. It owns GPU capacity, it employs machine-learning infrastructure engineers, and putting one of those models up on internal hardware at short notice is a Tuesday. The escape hatch worked because the people who needed it build hatches.

For most others, hardware is the smaller issue. Using a smaller model lowers the GPU cost, but the security harness is still expensive. Semgrep measured this gap: its own pipeline, which directs the model to different endpoints, scores 53% to 61% F1 for finding real authorization flaws, compared to 39% for a strong open-weight model given only a prompt. The same benchmark priced cost per true finding on one model across three setups: 62 cents through Semgrep’s own harness, about 70 cents through a bare guided prompt, and $72.55 through a different vendor’s harness. The model was the constant, and the harness moved the cost by a factor of a hundred in both directions. My read is that the harness is where the work actually sits, and it is integration with your logging, your alerting, your identity system and your codebase.

It has to work across the whole company. Breaches often happen at three in the morning, handled by whoever is on call, and a model that only one engineer can reach from a single laptop will not cover that.

My guess is that the organizations able to stand up and operate their own defensive model look a lot like the population the vendor whitelists admit, and that in a few cases they are the same names. For everyone else the route to a model that will examine an attack at full capability is an application form.

ISC2 stopped publishing its workforce gap estimate in December 2025, saying respondents pointed at specific skills gaps rather than headcount. A third of organizations in that study remain understaffed, and 29% say they cannot afford the skills they need. A budget shaped like that buys a subscription.

Share

The uncomfortable truth

Add up what the last few sections cost. An attack task is priced in cents. Continuous defense is priced in tens of thousands a year, and the money is the smaller half. The other half is a team that understands what the tool is doing and knows the product well enough to stop the tool from breaking it.

Now look at what the industry did with that half. Layoffs.fyi counted 123,941 tech workers cut at 269 companies in 2025, on top of roughly 165,000 in 2022, 263,000 in 2023 and 152,000 in 2024. Not all of those were engineers, and nobody publishes the split. Those totals do not say how much defensive capacity went with them. What they show is an industry removing technical headcount at scale, on the argument that models would absorb the work.

Nothing has gone wrong yet at scale. Mandiant says so and I printed it above. My read is that this is the quiet part, and that a year or three of model-driven intrusions arrives on the other side of it, answered by another model, another team and another bill. That is a forecast and I cannot prove it.

Whoever priced AI as a replacement for the engineer, and development as something close to free, was working from the wrong ledger.

I have argued elsewhere, in AI Agent Platforms, that the agent perimeter leaks in places nobody audited. What is new this month sits one layer in. Somebody worked out how cheap it is to change what a defensive model reports. You write a polite note into the evidence. And if the investigation then runs into the vendor’s own boundary, you apply for a model that is allowed to keep going.

The announcement is called Against Claudefishing, published by CEO Chris Best. It opens with a quote from Freddie deBoer about wanting other humans behind the art he consumes, and about being fooled in that process amounting to a con. Two days before that post went up, deBoer published a teardown of Pangram, the detector Substack had just licensed. The announcement quotes him on the principle and does not link the teardown.

What shipped

The conditions come from Substack’s own announcement. Text longer than 100 words, published from the launch day on, so everything written before it stays unexamined. Posts, notes, comments and replies.

Best describes the reader’s side in one clause: the analysis appears only for those who request it. A reader opens a menu and asks, and Pangram returns a percentage.

The writer’s side has four moves. Write a statement in settings describing how you make your work. Run your drafts through the detector before publishing. Disable detection on a post, after which readers see a notice that detection is unavailable, which is its own kind of verdict. Report a scan you believe is wrong.

Read that list again as a description of labor. Verification became something the reader performs, one text at a time. Reputation management became something the writer performs, permanently. The feed that distributes both of them was not part of the release.

I traced the same move last month through age verification and chat logs.

What was promised in 2023

Notes launched on April 5, 2023, and Substack’s Introducing Notes states the purpose plainly: a growth channel, designed to drive discovery.

The post opens by restating why the company was built. Substack set out to make a system that fosters deep connections and quality over shallow engagement and dopamine hacks, in the founders’ own words, and the sentence sits there as the reason this new feed would be different from the others. In legacy social networks, the post says, people get rewarded for content that goes viral regardless of whether anyone values it. Then the promise about Notes specifically: it will not feel like the social media we know today.

Hold those sentences. Every argument that follows depends on them, because a company that never made the promise cannot be measured against it.

What was advised in 2024 and 2025

Fifteen months later Substack published growth instructions. Writers who post three or more thoughtful notes during their launch week gain 50% more total subscribers than those who don’t, because the app and network drive half of all new free subscriptions and 30% of new paid ones.

That is a cadence, a window and a payout, published by the platform in the platform’s own voice.

In October 2025 came Demystifying the feed, still the most detailed public account of how distribution works there. Publish on a regular basis so your work stays visible. Reply, restack, endorse. Substack’s own phrasing is that signal-boosting others isn’t just good community behavior, it’s one of the most effective ways to grow. In one three-month window the app drove nearly half a million paid subscriptions and more than 32 million free ones, most of them originating in the feed.

None of this is unusual advice. LinkedIn says it, X says it, every platform with a ranked feed says it. The difference is that the others never opened by promising quality over dopamine hacks.

What grew

Pangram scanned just over a million social posts and published the results on July 9, twelve days before Substack licensed the company. On Substack, 21.9% of posts flagged as AI-generated or AI-assisted, a combined figure rather than a rate of pure generation, and the best number in the study. LinkedIn ran past 40% on longform, and Best cites that figure in his announcement, saying the company would rather not wait until the Substack app turns into it.

The more uncomfortable measurement came from inside. Karen Spinner analyzed roughly 16,800 posts across 31 categories, tracking one construction that models overproduce. Its frequency is about five times what it was before ChatGPT, and newsletters launched after late 2022 use it more than twice as often as older ones.

Nobody can look at a sentence and know who wrote it, and Spinner says so herself. She draws no line from her data to any platform’s advice, and neither can I. What her distribution shows is where the pressure landed, and it landed hardest on the smallest and newest publications. What those have in common is that growth instructions are written for them.

What the announcement does not say

Against Claudefishing runs long. It names the problem as a mismatch between what a reader expects and what a reader gets. It concedes that not everything made with AI is slop and not all slop is made with AI. It warns that platforms rewarding fakeness create a race to the bottom.

It does not contain the word Notes. It does not mention the feed, ranking, recommendations or discovery. It does not reference any advice the company published about posting cadence. The only place ranking appears at all is in a list of things Substack is considering for later.

A post that treated distribution as part of the problem would have said so somewhere. This one, as published, puts the problem entirely with the people posting.

The instrument, and who pays for its errors

On July 20, thirty-six hours before the feature went live, Pangram founder Max Spero posted a response to deBoer. Pangram 3.3 works on segments of roughly 150 to 350 words and judges each segment as a unit. Put in 200 words containing 50 written by a model, and the system sees major signs of AI writing and calls the whole segment AI. His own assessment: not ideal, with architectural changes coming.

Substack’s own materials do not carry that caveat. The number a reader sees is not a proportion of the text, it is an aggregate of verdicts on chunks. A reader looking at 54% will read it as half, and half is not what it means.

Four days before the launch the company also published an explainer. It describes what the detector looks for: assistant models are trained to produce helpful, clear writing, and those preferences are ingrained deeply enough that they surface anyway. It also describes what it compares against. The corpus of known human text is drawn exclusively from 2021 and earlier, before AI reached the open internet. Pangram states this plainly and adds that language drifts, that adjustment will be needed, and that the problem sits among its research priorities.

So the question the instrument asks is narrower than the one readers think they are asking. It is whether this reads like a person writing before 2021, or like a helpful, clear assistant. Someone producing clean organized prose in 2026 is measured against a reference class that closed before these tools entered ordinary writing practice.

A writer is not misclassified for sharing a device with ChatGPT, and visible tells such as the em dash are one signal among hundreds of thousands. The writers currently pulling dashes out of their drafts and second-guessing phrasing they have used for a decade are doing it against nothing the system counts.

deBoer had already shown what the segmentation does in practice. A 300-word section of one of his old posts came back as 100% AI with high confidence, while the 5,000-word essay containing that section came back as 100% human with high confidence. He then produced a false positive on writing he did himself, on purpose, in about fifteen minutes.

The morning the feature went live, a writer named Ida-Emilia Kaukonen posted her own test, without naming the detector she used. Her own writing scored 79% AI. She then added text that was entirely machine-written, and the score fell to 54%. Transparency is fine, she wrote, but she is uncomfortable with the idea that she would have to destroy her voice further in order to not look like a machine. She signed it as a former mistress of em dashes, a habit she gave up ahead of a verdict that was never watching for it.

Spero’s defense of induced false positives is that any classifier can be tricked, and he reaches for airport scanners and stop-sign detection. The analogy breaks at the point that matters. A scanner alerts an operator, and a person opens the bag before anything happens to the traveler. Between Pangram’s verdict and its consequence on Substack there is nobody. The number goes to the reader and the writer wears it.

His second argument is that adversarial cases should be assessed separately from population-level false positive rates. As engineering that is correct. As experience it is worthless, because no writer ever encounters a population rate. They encounter one verdict, on one piece, once.

That verdict does not land evenly. A 2023 study in Patterns ran essays by non-native English writers through seven detectors and produced an average false positive rate of 61%, while essays by native speakers came back almost clean. Pangram was not among the seven. A peer-reviewed study from Vrije Universiteit Brussel did test it in June, on forty ESL-written academic papers of four thousand words and up, and found no false positives. That is the friendliest condition a detector gets: long documents, plenty of signal. Nobody has run the same test on feed posts of a hundred and fifty words, which is where the question is now being answered in practice.

Writers on this platform reached the paper before I did, among them JHong at Natural Intelligence and Sam Illingworth. A March 2026 preprint by Nathan Garland works out the bound for any text-only, one-shot detector and finds that a useful rate of detection forces a rate of false accusation, set by how much human writing and machine output overlap across a diverse population. Garland’s point is that this constraint is independent of model quality and cannot be engineered away, and that it falls hardest on identifiable groups, which gives the 2023 measurement a theoretical floor rather than a vendor to blame. The paper is a preprint by a single author arguing about university assessment, so treat it as an argument rather than a settled result. Its central assumption transfers here with room to spare: a teacher has at least seen the student’s earlier work, and a reader pressing scan on a writer they have never read before has nothing.

Garland’s own recommendation is that a detection score should not be the sole evidence in a misconduct proceeding. On Substack the score is the only evidence there is, and there is no proceeding.

What the score does after that has been measured, though not on detectors. A pre-registered experiment by Haoran Chu and colleagues put fabricated college applications in front of 644 US participants and recorded who they took for a machine. Two findings carry over. International students were more likely to be read as AI users, especially when their writing carried features that sound machine-made. And once a reader attributed the text to AI, their assessment of the applicant fell on competence, sociability, morality and future success.

That study measured people rather than software. Substack’s tool does not deliver a judgment. It delivers a number to a person, who then makes one.

A couple of years back we built text generation for a client. Every review came back the same: slop, machine garbage, do better. At some point we sent them one of their own articles, written by their own people before any of this existed. Same review. Slop.

One client, one article, no control group. It stayed with me anyway.

The same shape, somewhere else

This is a rhyme rather than a proof, and I will mark it as one.

ICLR submissions have roughly tripled in three years, and the review pool was filled largely out of the authors themselves. Pangram scanned this cycle’s reviews and found about 21% fully machine-generated. The conference responded by running detectors and desk-rejecting offenders. I can find no announcement that the reviewer load itself was changed.

One is a commercial platform monetizing attention and the other is volunteer academic labor under career pressure, so the cases are not equivalent. What they share is the sequence. Volume grows because the structure rewards it, synthetic output appears where the volume outruns the humans, and the institution buys detection from the same vendor rather than touching the structure. In neither case has anyone published evidence that detection reduced the synthetic output at all.

A flag is not a judgment, and the people who can tell one from the other are the expense every institution in this pattern is trying to avoid. Security tooling reached that wall first.

What is fair to say

Substack is the cleanest large feed in Pangram’s data, and I would rather write here than on the alternatives. Spero answered his critics in public and in detail, which is more than most vendors manage under pressure. deBoer, whose findings sit at the center of this piece, calls Pangram a useful tool and says he is not telling anyone to stop using it.

The claim that survives all of that is narrow and holds anyway. A platform promised in 2023 that its feed would reward quality over engagement. It then spent two years publishing instructions on cadence and reciprocity, with its own numbers attached. The output arrived on schedule. When it arrived, the company shipped an instrument that inspects writers and priced the labor to readers. It never once named the machine that set the terms.

Where I stand

I owe you to share where I stand in this story.

I use AI. There are sighs in the hall, women pass out.

I never was against AI as a tool. What I am against is the delegation of thinking and judgment, the lack of output validation, hype, and CEOs’ bullshit. AI can write good text, and humans can write bad text. The tool does not affect either side, it is the point.

I use models for research purposes. Without a tool that vacuums up 500 sources and proves or disproves my idea, I would not be able to write because I cannot handle such a volume of info. Validating each number, each quote, takes so much time that the only choice I would have is between silence and opinion.

Another shocking piece of information: I’m using Grammarly. English is my third language, and I’m very strict with myself about publishing anything without editing. The alternative on offer is that people working in a second language should write less, or not at all. I’ve been using Grammarly since December 2021, almost a year before ChatGPT appeared. The product has added the gen AI functionality over the years, but I do the same as I did five years ago: fix my grammar and sentence structure.

I did not change my approach, but classification changed. The thing that was text editing in 2021 is flagged as AI-assisted in 2026, and a person who does the same five years in a row accidentally finds himself in a new category without any choice.

That human oversight is the main difference between slop and something meaningful, and I know it not from commentary battles. I see this every day in my codebase. The model is capable of producing as much sense as a human could squish out of it, and the result depends on someone who made the judgment.

My team in Ukraine writes in English with this smooth, accurate register, which the whole industry treats as suspicious right now. Not because anyone is cheating, but because a person who writes not in his native language does it more neatly. And in our culture it is normal to be direct, without hedging and word fillers, a register that now reads as machine-made.

Someone can say, aha, little bastard, you are using AI, so you are against the AI checker, tiny slop maker! Read the article one more time; I did not say anything about what side I took. I do not take part in this fight. I did not mention that the AI detector is bad; I just said that the platform did everything to bring the slop here.

I do not know which score the AI detector will show for this text, and I don’t care. I know that the bill will be bound to my name.

And if you think that it is my real voice, you are wrong. The Tech Trenches voice finished one section above.

Subscribe now

Once there were five little pigs, and each was handed the best building materials in the history of the trade. Money without limit. A brand a billion people already knew. Silicon nobody else could fab. The deepest research bench on earth. Three of them built out of straw. A fourth could have built in brick and laid straw anyway. The fifth inherited a brick house with the lights already on and set it on fire. When the wolf came to the door, the loudest of them answered by demanding that someone forbid him to blow.

The wolf is at the door, and his blueprints should frighten the pigs more than his teeth. He built a better house than any of them, on a fraction of the money, with sanctions tied around his hands. I traced how China poured the physical floor under this whole race in China Built the Grid, so I will not re-lay the watts here. The part that matters for the pigs is simpler. China closed most of the gap with the Western frontier this year despite being cut off from top-tier US chips, watching Nvidia’s share collapse toward single digits as Beijing steered its champions onto domestic silicon, and spending an order of magnitude less real money than OpenAI and Anthropic raised between them. On the benchmark that best tracks paid coding work, the open-weight gap has narrowed to almost nothing: Zhipu’s GLM-5.2 leads the open-weight field on SWE-bench Pro and runs at roughly a sixth of the cost of the American frontier. The wolf laid brick, quietly, the whole time the pigs were laying straw.

This is the tour of the straw.

The pig who fell asleep

Sam Altman had the longest lead and the deepest pockets. ChatGPT is the default AI for roughly a billion people a month, the brand every rival measures against. Having filed confidentially to go public at a valuation reported near a trillion dollars, he is also losing billions in cash to run the place.

He spent the lead on side quests. Sora, the video app, bled cash and drained compute before it was shut down about six months in, a billion-dollar Disney deal dying on the way out. Atlas, the browser, never left macOS and gets switched off about ten months after launch. The hardware built with Jony Ive has yet to ship at all, with OpenAI’s own filings pointing to no device before early 2027. The label is not mine. OpenAI’s own head of applications pushed to cut what she called side quests, telling staff the fragmentation was dragging on the quality bar.

The hare with the biggest head start spent it running the story of the lead instead of the lead. The deeper charge, the contradictions between what he founded OpenAI to prevent and what he now sells, belongs to a separate reckoning; here the point is simpler. He built his house of straw and told everyone it was the tallest house in the world.

The pig who fouled his own name

Elon Musk had real iron. Tesla compute, Starlink, and the Colossus clusters in Memphis pouring actual power. Since February 2026 he has had xAI too, folded into SpaceX as a wholly owned subsidiary, so the rockets and the AI now share one balance sheet and one IPO. He also had the loudest exit story in the business, and I took that apart in Nobody Answers, where the deadline that never lands turned out to be the product he was selling all along.

This summer the market read him the same lesson. SpaceX priced the largest IPO in history in June, spiked by two-thirds within days, then gave it all back and slipped below its own offer price inside six weeks, a sell rating and meme-stock comparisons trailing behind. The escape hatch, priced live and marked down before the lockups even lifted.

The deeper damage is not on the ticker. xAI lost 6.4 billion dollars in 2025 on 3.2 billion in revenue, more than quadrupling the loss in a year. Then the model made its own headlines, generating a flood of sexual deepfakes that got Grok temporarily blocked in two countries and brought a cease-and-desist letter from California. That mark sets harder than any of the other four. Grok is now the AI you reach for a laugh. That is a toxic reputation to carry into enterprise sales, and it is the one kind of straw you cannot quietly swap out later.

Less than a week after the IPO, xAI’s parent, SpaceX, agreed to buy Cursor for 60 billion dollars in stock. Cursor gave it an immediate position in the enterprise coding market. It reads like a clean door into the market Grok’s own reputation had made harder to enter. The others wasted a lead. Musk stained the product, then put 60 billion dollars behind an escape from the stain.

The pig who charged the most

Dario Amodei drew the cleanest hand of the five. The most trusted lab, the reputation as the adult in the room, and a lead he had earned: Claude Opus 4.5 shipped in November as the first model past 80 percent on SWE-bench Verified, ahead of everyone. I held Anthropic up myself, in earlier pieces, as proof you could be principled and still win.

Then he spent the hand on fear. That his warnings always land on everyone else’s product and never on the closed model Anthropic invoices for is a pattern I traced in Dario Altman, so here I will follow the money instead. The way you defend a lead is by driving cost down through better engineering, which is exactly what the Chinese labs are doing. Fable 5, Anthropic’s flagship, went the other way. It lists at 10 dollars per million input tokens and 50 per million output, the priciest widely available model on the market, roughly double its own Opus and several times what Gemini or GPT charge, weights kept closed. When a government order briefly cut off foreign access, its whole value proposition went with it, because the open Chinese weights a rival ships run on your own hardware with no vendor to pull the switch.

The price is harder to bring down, and the reason sits underneath it. Anthropic is building some infrastructure of its own, but still depends on other companies for much of its frontier capacity: a SpaceX compute agreement worth nearly 45 billion dollars over three years, up to a million TPUs and well over a gigawatt from Google, and up to five gigawatts of Trainium capacity from Amazon. By July it was also in talks to lease up to 10 billion dollars more of compute from Meta over two years. Every one of those suppliers sells a model that competes with Claude. By Amodei’s own math, being off by a year on growth is enough to bankrupt the company, so a lab buying frontier capacity from its rivals at that scale starts any price war at a structural disadvantage. The lead was supposed to be the moat. Once Chinese open weights closed the coding gap, the model-performance moat had largely gone. What was left was a lab charging the most for a model whose measured edge had narrowed, while paying its own competitors for much of the ground it stood on. The adult in the room turned out to be a tenant.

The pig who could have won

Google is the strange pig, because Google, alone of the five, can build. Its own TPUs, the same silicon it rents to Anthropic by the million. A research bench as deep as any on earth. Gemini 3, a model that trades blows with the frontier. Distribution through Search, Chrome, Android, and Workspace that nobody can match. Of all five, this is the one that could have won on merit, no straw required.

Which is why what it did is the sharpest waste of the set. Gemini trails Claude on the coding benchmark that tracks the paying work, and where developers spend money, on the agentic tools, Anthropic and OpenAI own the market. So the number Google leans on, its share of chatbot traffic, rests on the one asset regulators have already moved against. It pushes Gemini through Search and Chrome, the same kind of default-placement conduct a US court ruled an illegal search monopoly in 2024, while Brussels separately fined it 2.95 billion euros in 2025 for abusing its dominance in ad tech.

Then, instead of closing the gap where the money is, Demis Hassabis went and asked for the wolf to be muzzled. In July he proposed a standards body to gate frontier models before release. The one pig who could have built in brick called for a fence around the yard instead. A company already ruled an illegal monopolist, offering to hold the whistle for everyone.

The pig who burned his house down

Mark Zuckerberg is the only pig who did not squander a lead. He torched one that was already built.

Meta had the best open research lab in the West in FAIR, the strongest open answer to China in Llama, PyTorch running under a huge share of the industry including its rivals, and Yann LeCun, one of the three men who built modern deep learning. That is not a pile of straw. That was a brick house, standing, occupied, the envy of the street.

He set it alight, and he started before the lab was even cold. In June 2025 Meta paid 14.3 billion dollars for a stake in Scale AI and installed its founder, Alexandr Wang, as chief AI officer, a bet the culture it had spent a decade building could no longer be trusted to deliver on its own. The house came apart around the new hire. FAIR was folded into a superintelligence org under Wang and subordinated to product, and LeCun, ordered to report to a man half his age, announced his exit in November to start his own lab.

Zuckerberg had lit a fire this size before. Reality Labs, the bet he made years earlier, has by now lost north of 80 billion dollars, more than 6 billion in a single quarter against under a billion in revenue. The same instinct that poured a fortune into an empty headset later tore up a working research lab. I wrote about what happens inside a company that strips its own engineering judgment for a metric in Green All the Way Down; this is the strategic version of the same fire.

The clearest picture of a lost lead is this pig: he knocked down the only brick house on the block, then, even if partly to monetize the compute he was left holding, began negotiating to rent it to the rival whose model beats his own.

What the pigs did next

Five different failures. Three of them converged.

The mechanisms do not rhyme. Altman scattered his lead, Musk fouled his brand, Amodei priced himself into a corner, Google buried a real advantage, Zuckerberg torched a working lab. The through-line comes after the waste, in what three of them reached for once the wolf closed in. Altman, Amodei, and Hassabis spent this same season asking for a gate on their own market, each in his own shape: a federal agency that could block a model on day one, a FINRA-style standards body, an international forum modeled on the nuclear watchdog. Three doors, one instinct. When Hassabis published his, Anthropic’s own policy lead called it excellent. Two of them had already crossed part of that line: in June, Altman and Amodei shipped frontier models through government-approved access lists, an early version of the permission structure they had advocated. Why a gate funded and shaped by the labs it inspects is a moat rather than a safeguard, I took apart in We Pay You to Slow Us Down. Musk and Zuckerberg never signed that petition; they wasted their advantage in other ways. But the three loudest voices in the room, facing a competitor who built faster and cheaper, answered by petitioning for a rule against the wind.

The cold part

For most of the era of commercial computing, the frontier has been led from the United States. The foundations were not all American, Turing and Zuse and Colossus came first, but for two generations the lead in the technology that defined the age has sat in America, through every panic that it might not. Japan’s Fifth Generation project frightened Washington in the eighties and the feared handover never came. It is closer now than it has ever been. The wolf did it the hard way, poorer and boxed out of the best chips, building in brick while the pigs laid straw and called it innovation.

I am Ukrainian. China is an ally of the country trying to erase mine, and I want it to lose this more than most people reading do. That is exactly why I will not pretend it is losing. The floor is his, the gap is closing, and the five who were supposed to hold the lead spent it on a video app, a fouled brand, the priciest model in the game, a whistle, and a bonfire.

Even the wolf has a ceiling. Moonshot shipped Kimi K3, the largest open model yet, and within 48 hours it had frozen new subscriptions because its GPUs could not serve the demand. It hit the same wall OpenAI hit when its image tool went viral and Altman said the GPUs were melting, and the wall Anthropic hit when it switched the meter on Claude Code. Copying the weights is easy. Serving them at scale takes hardware nobody has enough of, in any country. For now the frontier labs hold the one edge left to them, the serving compute they secured years ago. It is a thin edge to lean on, because chips become served tokens only through power, and power is the foundation China already poured while the West argued about permits. The wolf that just hit the ceiling is standing in the one house wired to raise it.

The wolf is not fated to win. In the old story the pigs beat him the moment one of them built in brick. The brick is on the ground in front of all five. Three are reaching for the rulebook. The other two are still standing in the ruins.

Every proposal to regulate frontier AI runs into the same problem: you have to trust the regulator. On this market I am not sure I would trust an independent one, with every month of delay carrying enormous competitive value and every lab racing the release after this one. Demis Hassabis, on July 14, proposed something that does not even clear that bar. His Standards Body would be funded by the labs it inspects. Funding, he writes, “would need to be substantial and likely mostly come from industry.” The regulated pay for the regulator. That gives the industry a say in how much obstruction the regulator can sustain.

The proposal is serious and it is not fringe. Hassabis runs Google DeepMind, and he briefed G7 leaders before publishing. Sam Altman has wanted a version of this since 2023, when he told the Senate the government should weigh “licensing or registration requirements” for AI models “above a crucial threshold of capabilities.” Gary Marcus endorsed it. The instinct is not wrong: something should gate a nuclear-weapons-capable model before it ships. The question is who holds the gate, who pays them, and who writes the test they administer. On all three, the proposal hands the keys to the same labs it claims to be checking.

Three Handles on One Pump

Start with the money. FINRA, the body Hassabis names as his model, is the self-regulator for American brokerages, funded by the firms it polices. Its 2024 financial report shows $1.62 billion in operating revenue, including $958.8 million in regulatory revenue paid by member firms. Fines added another $66 million separately. The firms pay the examiner’s salary. Andrew Tuch, a law professor at Washington University, read every FINRA disciplinary case from 2008 to 2013: its rules reach investment bankers, but across that window he found eighteen sanctioned, and not one for advising on a public merger or a registered offering. He called the self-regulation of investment bankers a failure. This is the model, presented as the safeguard.

The money is the first handle. The test is the second. Hassabis writes that the benchmark evaluations “would be developed in consultation with Frontier Labs,” and that only “eventually” would the Standards Body build the capacity to create its own held-out tests “independent of the Labs to prevent overfitting.” The labs help design the exam they will sit, and the independent version is deferred to a later date the proposal never fixes. A company that helps design the early questions has shaped the instrument before it is ever measured by it.

The threshold is the third handle. A model counts as “Frontier-class” when it crosses thresholds “determined by the Standards Body and regularly updated.” Hassabis says that board should seat “independent leading technical experts and open-source representatives,” not lab executives, and the body, not the labs, sets the line. But the labs fund it and help build the first tests the threshold is read against, so the incumbents hold real sway over the machinery long before any independent version exists. That is influence over where the line falls, not a seat that formally draws it, and it does not require bad faith. Hand any industry a regulator it funds and helps equip, and the outcome tilts the same way whether the people involved are cynics or saints. Three handles on one pump, and every one runs back to the firms the pump is supposed to regulate. The structure does the work.

The Thirty-Day Gate

The reason the structure matters now, and not as a civics-class abstraction, is the size of the number sitting on the other side of a delay. The four largest hyperscalers guided to roughly $725 billion in 2026 capital spending, largely directed at AI infrastructure. Hassabis proposes that Frontier Labs initially share models with the body up to thirty days before release. Once the protocol has proven itself, passing the assessment could become mandatory for deployment in the US market.

Thirty days. At that scale a thirty-day hold is a competitive window every lab has reason to fight over, and a body the industry funds and helps equip is the mechanism that decides whose thirty days get held and whose do not. But money is the smaller motive. The larger one is on the other side of the Pacific. Chinese open-weight models now sit within striking distance of the Western frontier, and they ship as weights anyone can download, run, and keep. I traced that gap and why it barely shows up where engineers actually work in an earlier piece. A released Chinese model is a lever nobody can pull back, and a US gate can deny it formal deployment in the American market but cannot stop it releasing everywhere else. A gate framed in the language of national security still does two jobs regardless of anyone’s intent: it gestures at a real adversary, and it locks the American market onto the companies that hold the closed frontier. The safety case carries real weight, which is what makes it the load-bearing half of a structure whose other half is a moat. The conflict sharpens further if the state also takes equity in the companies it regulates, a risk worth naming given reported talks over an OpenAI stake.

Subscribe now

The Exam Filters for Size

Say the body is honest. Say every person on it is incorruptible and the equity talks go nowhere. The structure still breaks the same way, because a compliance regime is a fixed cost, and fixed costs are a tax that scales inversely with size.

A widely cited 2010 study for the Small Business Administration put federal regulatory cost at $10,585 per employee for firms under twenty people, against $7,755 for firms over five hundred. Those are economy-wide numbers, and contested ones, but the direction is the mechanism that matters here: the burden is heaviest where the headcount is smallest, because the paperwork does not shrink with the company. A thirty-day pre-clearance review, a compliance team to manage it, a policy staff fluent in the benchmark process the incumbents helped design, all of it is a rounding error for a lab that helped write the rules and a wall for everyone underneath. OpenAI grew its global-affairs team from three people to thirty-five in eighteen months. Cédric O, co-founder of the French lab Mistral, put the other side of it plainly while fighting the EU AI Act: Mistral was a company of roughly twenty people, he warned, and a heavy enough burden could kill it.

Now watch what the threshold does over time. “Frontier-class” is pegged to compute and capability benchmarks that the body will, in Hassabis’s words, regularly update. But the compute needed to hit any fixed capability falls fast. Epoch AI estimates pre-training efficiency roughly triples every year, so a line drawn today to catch the biggest labs sinks toward a garage team’s reach within a few years unless someone keeps raising it. Hassabis says the body will keep raising it. The capture thesis says the incumbents who fund the regime and supply its tests have every incentive to let the line drift down into their smaller rivals instead, and a provision to update the threshold means little when the people who benefit from a slow update are the ones underwriting the updater. The exemption Hassabis offers, that “non-frontier models, say from startups or academia, would be exempt,” is real only until the startup succeeds. Cross the line the body maintains, on an exam the incumbents helped design, and you enter a regime built to a scale you do not have. And the weights that let a startup or a rival catch up from below, the open ones anyone can run, are precisely what a “Frontier-class” threshold pulls into pre-clearance first.

This is where the closed-frontier labs stop being rivals. They compete ferociously on models and price, and they share one exposure none of them can fix alone: the open-weight model that needs no vendor at all. Here the safety case and the moat come apart. An American open-weight lab can submit to pre-release review like anyone else, so the regime does not stop domestic open weights, it taxes them, wrapping a thirty-day hold and a compliance burden around a model whose whole value was that anyone could take it and run it now. A US gate cannot prevent a foreign lab from releasing its weights. At most it can deny that model formal deployment in the American market after the file already exists everywhere else. The gate cannot prevent the foreign release most useful to its national-security case, but it can impose a delay and a compliance burden on the domestic open-weight competitor still within its reach. What it builds is a members’ club with a moving door, cartel-like in its structure: fierce rivalry inside, a shared wall against everyone outside, and the wall built first around the models nobody owns. The tell that this reads as capture and not only safety is Meta, big enough to sit inside that circle and choosing the other side of it, shipping among the most capable open weights the West has. A capability-pegged regime imposes a burden on Meta’s open-weight strategy that closed labs do not face in the same way, which is why Yann LeCun was warning about exactly these companies in 2023, calling their lobbying “a regulatory capture of the AI industry” and naming Altman, Hassabis, and Amodei while he did. He was aimed at Biden’s executive order then, but the concern is the same: closed labs shaping the rules that bind everyone below them.

What Would Make It Real

A model that can walk someone through a weaponized pathogen should not ship on a Tuesday because the quarter is closing. The instinct is sound. The design is captured.

Three changes would tell you the difference between a safeguard and a moat. Fund the body from appropriated public money instead of member fees, so the examiner does not draw his salary from the examined. Build the independent held-out tests on day one instead of “eventually,” so the labs are not helping design the instrument used to assess them. And put the threshold’s methodology, its update cadence, and the conflict-of-interest rules into statute or public rulemaking, so the line that defines who gets regulated is governed by a process nobody’s funding can quietly bend, rather than by a body the incumbents pay for. Hassabis’s proposal does none of the three. It funds the regulator from industry, builds the first tests with industry, and leaves the threshold to a body industry underwrites. FINRA was sold the same way, as the grown-ups policing their own so the government would not have to, and it shows that serious enforcement blind spots can persist for years inside an industry-funded self-regulator.

Cutting the labs out of the instrument draws the obvious objection: the people who know how to test a frontier model for weapons capability are the people who build them, and much of that expertise currently sits inside the companies being regulated. Expertise can be bought without being borrowed. Put those engineers on the body’s own staff, paid from public money and bound by the conflict rules any examiner carries. I would take that job, and so would plenty of engineers who spend their days shipping and reviewing this stuff. Pay enough, and qualified engineers will take the job. No one who stands to be measured should have a hand in building the ruler. Consultation with the company you are about to inspect buys access and calls it expertise.

So weigh the two halves honestly. The Chinese threat is real, the safety case is real, and a released model no one can recall is a real problem with no clean answer. Set all of that on one side. On the other side is a body the same labs would fund and help equip with its first tests, wrapped in the language of an adversary who genuinely exists. The pitch is that the labs are mature enough to be trusted with the machine that checks the labs. The tell is that they wrote the check.

Orwell gave us a Big Brother who watched you. This one is quieter and runs the other way. The big lab pays the man who signs the certificate that it is responsible enough to stay big.

Gary Marcus has been calling the moment the US AI industry starts to break, and a fresh round of cheap Chinese open models is, to him, the evidence it has arrived. His case is three years old and it has not changed: no moat, free copies, prices to zero, and eventually the trillion-dollar IPOs stop penciling out. The only part he updates is the evidence. He is right about all of it. He is also looking at the wrong floor. The margin collapse he describes is the symptom. The disease is physical, and it sits a layer below the price war he is watching.

In 2025 China added 434 GW of wind and solar. The United States added 53 gigawatts of new utility-scale generation and storage. Those are not the same category, and I am not going to pretend a gigawatt of Chinese nameplate solar is a delivered gigawatt wired into a data center. The claim underneath is narrower and harder to wave away: one country is building enough capacity to treat power as a substitute for better chips, while the other is adding capacity into a grid that still cannot connect it fast enough.

Chips Have Shortcuts. Power Doesn’t

A chip deficit has shortcuts. Huawei just proved the crudest one, packing roughly five times as many mediocre Ascends into a rack-scale system until a single superior Nvidia die stops being the only route to frontier compute. Tighter code and smarter architecture are the quieter versions of the same move. Each one buys its way around the chip by spending more power.

A power deficit has no shortcut. New generation, new lines, new substations all take years and physical construction. I spent four years working through Russian strikes on the Ukrainian grid, and the lesson that stays with me is simple: electricity sits under everything else. When it goes, the models and the chips and the funding rounds are worthless at the same instant.

That is the asymmetry the whole race turns on. One side can buy its way around a worse chip by spending power it has in surplus. The other side cannot buy its way around a grid it has not built.

What China Poured

China spent the year on the side of the asymmetry that cannot be optimized away. Its energy administration reported 315 gigawatts of new solar and 119 of wind, both annual records, pushing wind and solar past thermal power in the national installed base for the first time. Chinese industrial power runs slightly higher per kilowatt-hour; price was never the advantage. Panels and turbines go up by the trainload, and the country has far fewer independent actors with the standing to keep a prioritized project stuck. The same system that green-lights a national project cannot stop a useless one, so China will pour concrete for data centers that never fill. It wastes the resource it has, not the one it lacks. The buffer does not rest on panels alone: the same year brought nearly 40 reactors under construction and a growing thermal base beneath the renewables, firm power that runs whether or not the wind blows.

It is the electric-vehicle script, rerun. A decade of subsidies handed BYD and CATL the global market, and a Stanford analysis found China kept 92 percent of the welfare gains at home. The same instruments now point at compute. Local governments in Gansu, Guizhou, and Inner Mongolia cover up to half the bill for data centers, on the condition they run on domestic chips rather than Nvidia. A draft national computing plan, reportedly worth nearly $295 billion, would mandate that 80 percent of its chips be domestically produced.

The mandate is the part that should hold Washington’s attention longer than any benchmark. Nvidia, an American company, spent the year trying to sell into China and mostly failing, because Beijing told its largest firms to stop buying. The country’s internet regulator barred ByteDance and Alibaba from purchasing the China-specific parts Nvidia designed for exactly that market. Jensen Huang flew to Beijing, lobbied in Washington, and watched a market that once supplied a fifth of his data-center revenue produce, in his own CFO’s words, no revenue at all. When the world’s most valuable chipmaker is the supplicant, and the buyer keeps choosing its own slower silicon over a discount on better hardware, the dependency runs the opposite direction from the one everyone assumed.

China’s AI Plus directive, issued by the State Council in August, frames AI around labor shortages, dangerous work, and upgrading existing roles rather than deleting them. I am quoting policy, not proven outcomes. It subsidizes the power, builds the chips, and treats AI as a tool.

I am Ukrainian. China is a direct ally of the country trying to kill mine, and I have no warmth for it whatsoever. Hatred is not an analytical method. I have spent four years watching what happens to people who underestimate a competent adversary. China is doing this part right. Refusing to see it would make me a worse analyst.

America Built a Position

Set against China’s poured concrete, American capital spent the same window building compute on top of a physical layer it does not control. By the end of 2025 the ten largest companies in the S&P 500 made up 40.7 percent of the index, a record, with Nvidia the heaviest single weight since the data begins in 1981. The four largest hyperscalers guided to roughly $725 billion in 2026 capital spending, more than four times the entire US energy sector’s capital spending, on hardware that depreciates in a few years. I traced that buildout in detail elsewhere.

Jason Furman, who chaired the Council of Economic Advisers, calculated that investment in information-processing equipment and software accounted for 92 percent of US GDP growth in the first half of 2025, against four percent of the economy. He added the honest caveat that the counterfactual is not zero, since cheaper power and rates absent the boom would have lifted other sectors, maybe halving the effect. Even halved, a single category carrying 40 percent of national growth is an economy wired to one bet, and one financed increasingly on debt.

Dario Amodei, who runs the most financially cautious of the frontier labs, told an interviewer in February that being “off by a year” on the growth rate, or growing 5x a year instead of 10x, is enough to “go bankrupt.” When the careful one says a one-year forecasting miss can bankrupt a frontier lab, it says something about what the reckless ones leave unsaid. The same industry now cuts headcount to fund the chips while forecasting the displacement that spending will cause. Beijing’s policy points AI at the jobs nobody can staff. The American frontier, in practice, points it at the jobs people already hold.

The bet also runs into the same wall the rest of the buildout keeps hitting. Power. The US added capacity at a record pace of its own in 2025 and still cannot connect it fast enough. I have written before about how the grid became the hard ceiling nobody priced into the spreadsheets.

Europe Published a Strategy

There is a third party in this race, and it is the one that clarifies the other two. Europe has no frontier AI chip at scale, no hyperscaler comparable to the American four, and no frontier lab at their level. Its most advanced chips are Nvidia’s, fabricated at TSMC and Samsung, and its one indispensable asset, ASML, makes the machines that make everyone else’s chips, not a sovereign stack of its own. US providers run about 70 percent of European cloud. Europe’s answer, delivered in June, was a sovereignty package: directives, a sequel to the chips act, a target to triple data-center capacity in five to seven years, funded mostly by private capital it admits it does not have. The target deserves the trust its last one earned. When Ukraine needed artillery, the EU promised a million shells in a year against production that ran at a third of that, and delivered late. China poured concrete and America placed a bet. Europe published a directive about doing one of them someday. It never fielded a side, and that is the only reason it cannot be said to have lost.

Where the Lead Actually Is

The model gap, the thing the West still tells itself it owns, is real but narrowing, and it is narrowest exactly where the work happens. On Artificial Analysis’s index of general intelligence, Zhipu’s GLM-5.2 scores 51 and leads all open-weight models, within striking distance of the proprietary frontier. But in Morph’s vendor-score aggregate for SWE-bench Pro, a coding and agentic benchmark closer to what engineers actually ship, Claude Opus 4.8 leads GLM-5.2 by about seven points, 69.2 to 62.1, while the open model costs a fraction as much to run. That is a gap a research lab notices and a working engineer often does not. For a growing share of ordinary coding and text work, which is most of what anyone runs, the remaining gap is no longer commercially decisive. And the Chinese models carry an advantage no benchmark scores: they ship as open weights. You can run Qwen or GLM on your own hardware, fine-tune it, and deploy it with nobody’s API in the loop. A Western frontier model is a lever the vendor still holds. Released Chinese weights are a lever nobody can pull back.

The chip gap is real. Huawei’s fabricator, SMIC, is stuck around 7nm while TSMC builds Nvidia’s parts two or three nodes ahead, and policy cannot fix a lithography line on any useful timeline. What Huawei did instead was stop fighting on the die and start fighting on the rack. Its CloudMatrix cluster packs five times as many Ascend chips as Nvidia’s flagship server and matches it on aggregate compute and memory, burning nearly four times the power to do it. That trade ruins you where electricity is scarce. In the regions China has deliberately provisioned with excess generation and subsidized power, that penalty becomes one the state is willing to absorb. One cluster design does not solve China’s semiconductor industry. It is enough to keep domestic frontier-scale training strategically viable while Beijing pushes Nvidia’s local share toward single digits by declining to buy. The hardware question is being answered at the rack, not yet at the fab, and that is the layer where the training runs.

An American data center’s power waits on an interconnection queue, a regulator, and a dozen parties who can each say no. A Chinese one waits on a ministry that has already said yes. You can out-research a command economy on models and out-design it on chips. You cannot out-build it.

Subscribe now

Thirteen months ago, Slack made it a violation of its own terms to feed your company’s messages into a third-party AI model, and the reason it gave was privacy. In June it placed an AI model inside your Slack channels and called the feature multiplayer. Nothing about the data changed in between. What changed is who is allowed to read it, and what Slack decided to call the reading.

Here is the paperwork. On May 29, 2025, Salesforce wrote a new section into Slack’s API terms, under a heading called Data usage. As the provider of an application, you may not use API Data to train a large language model. Bulk export of message and file data was barred in the same stroke, and data collected from one organization could no longer benefit another. Law firms reading the full text added the rest of the cage: no persistent copies, no archives, no indexes. The stated reason was privacy and security.

What the ladder protected

The 2025 change had casualties with names. Glean, an enterprise search tool that indexes a company’s apps so staff can query across them, could no longer add Slack messages to its permanent index. Access narrowed to a query-by-query basis, and Glean emailed customers that the change would hamper their ability to use their own data with the AI platform they chose. Internal copilots built on Slack archives had to be redesigned or retired. The stated principle was privacy: your Slack conversations are yours, and outside models do not get to ingest them. That principle had a hole from the start. Slack’s own AI, shipped in 2024, already read the same message history to write summaries and answer searches, hosted on Slack’s own cloud. The 2025 rule pointed outward, stopping rival models while Slack’s own kept reading.

Not everyone bought the privacy framing at the time. Wyatt Mayham, who runs an AI consultancy, told Computerworld the move felt like Salesforce “pulling up the ladder.” He named the other reading in the same breath: a step toward Slack data becoming a monetizable asset, dressed as protection. Multiple law firms advising clients on the change reached the same conclusion, that restricting outside access let Salesforce keep valuable conversational data for its own AI position. In May 2025 that was a prediction. It is no longer.

Thirteen months later

On June 23, 2026, Anthropic and Slack launched Claude Tag. It puts a shared @Claude inside a Slack channel as a persistent member that reads history, builds memory, and works on tasks for hours. Rob Seaman, EVP and general manager of Slack, told Reuters the point is that Claude shows up in the open instead of a private back-and-forth. He called it multiplayer.

What moved between the two years was the identity of the model doing the reading. When it belonged to an outsider, Slack called the access a privacy risk and barred it. When it belongs to a partner Salesforce chose, the access becomes a feature. The exposure is identical. The only thing swapped was the reader, from a barred outsider to an invited partner.

Salesforce said the strategy out loud in 2025. Rob Seaman told Salesforce Ben that Slack was not blocking outside AI altogether, and that the aim was for Slack to become the hub for AI, whether Salesforce’s own or a partner’s. The 2026 launch is that plan arriving. Anthropic is the named partner.

What you are turning on

Tagged in a channel, Claude Tag works from the channel’s history, not only the message that summoned it, and it keeps that context over time. With an administrator’s permission it learns from other channels and connected systems on its own, and it can act without being tagged, on a schedule it sets. Cat Wu, who runs product for Claude Code at Anthropic, told Reuters she gave her own Claude Tag access to her Gmail so it reads her mail and flags the senders who matter.

So a coworker-shaped AI reads what a coworker reads: the thread where two leads stopped speaking, and the message about a manager someone wrote at the end of a bad day and assumed would scroll out of memory. That is where the real org lives, the version that never reaches a system of record. It is why the feature is useful and what it now holds.

What you are signing

When you flip it on, you become the data controller under GDPR, and Anthropic and Salesforce become your processors. The lawful basis, the notice to staff, and in most cases a Data Protection Impact Assessment under Article 35 are your obligation, not the vendor’s. For a feature launched weeks ago, I would be surprised if many teams ran it first. In March 2026 the European Data Protection Board opened a coordinated action across twenty-five authorities on a related front, whether companies tell people their data is being processed at all. There is no opt-out for the individual employee. An administrator invites Claude into the channel; the person who wrote the message has no switch.

Under commercial terms the content is not used to train, and it is held thirty days by default, with zero retention available to enterprises who ask. Read those as what they are: settings the vendor controls, not laws of physics. Not used to train does not mean not copied. What happens to a vendor’s copy when a court comes asking is its own problem, and the short version is that court orders have compelled data vendors considered deleted.

You are not signing today’s terms either. You are signing Salesforce’s right to rewrite them, which it has already used once in thirteen months. When it changes them again, two things happen. Some admins will not read the update and will click through. Others read it, understand it, and click through anyway, because by then the tool is load-bearing and ripping it out costs more than accepting the new terms. That is how lock-in works, and it is working.

The contradiction

Salesforce raised the wall in 2025 and told you it was for your protection. It lowered it in 2026 and told you it was for your productivity. It is the same company and the same data, under the opposite verdict. The model now reading your Slack is one Salesforce shook hands with, where an outsider would have been barred. I do not know the terms of that deal, and neither does anyone outside the room. Whether it was planned in 2025 or improvised when a good partner arrived, I cannot say. The contradiction I can say, because it sits in Salesforce’s own terms, written down twice, thirteen months apart.

From archive to analyst

You might say Salesforce already held all of this, and it did. The messages, the files, the shared drives sat on its servers for years, and nothing burned down. Holding data and making sense of it are two different capabilities. An archive waits for someone who knows what to look for. That person is expensive. Claude Tag removes the cost. It reads across channels, keeps what it finds in memory, and acts on it without being asked. The material is the same as it was. What changed is that pulling meaning out of it stopped being expensive. In “Cost of Reading” that cost fell to zero for the state. This is the enterprise paying to make it fall on itself.

The contract you did not sign

The exposure does not stop at your own Slack. I lead engineering at an agency, and we send other companies contracts, specifications, and source code, under agreements that bind two parties and no one else. The day a counterpart points one of these agents at the channel or drive where that file sits, a model that signed nothing starts reading it. The NDA still binds the company. It says nothing about the reader an administrator can invite into the room, and the sender is never asked.

The same shape ships at every major vendor. Microsoft calls its Teams equivalent the Channel Agent, OpenAI calls it Workspace Agents, and each operates as an admin-added member that works across channel context and acts on its own schedule. Switching vendors does not close the gap. It renames it.

So the question a partner has to answer has changed. For years it was whether their people could be trusted with what you hand them. Now it is who their administrator let into the channel, on a console you cannot see. Salesforce picks the partner, an admin picks the toggle, and the employee picks nothing, the same asymmetry of choice that falls on whoever sits furthest from the switch. You sign something with the company. You sign nothing with the model it hired to read you.

If you have turned one of these agents on, you did not only volunteer your own Slack. Depending on the channels and drives an admin connected, you may have volunteered documents that other people sent you in confidence. Your partners were not asked, and most were not told.

The document that gives orders

When a model takes in a document, it can read the words as content and also read them as instructions, the first entry on OWASP’s list of risks for LLM applications. I walked through that list from the trenches in Only Your Engineers. The indirect form is a file carrying a line written for the model, invisible to the person, that the model then executes. Claude Tag holds memory, acts through connected tools, and runs on a schedule it sets, so a planted instruction does not have to fire the moment it lands. It can wait in the agent’s context and act days later, in a session that looks clean. I traced this attack surface at length in The Security Nightmare.

So a document sent to a partner arrives as two things at once: something their model reads, and something their model can run. The sender never signed with that model. The productivity pitch does not mention that the file is now also an input.

Subscribe now

In June 2026 both men got handed the exact regime they had spent years asking for. Anthropic restricted Mythos in April through Project Glasswing, access limited to a vetted list. On June 26 OpenAI shipped GPT-5.6 to a small group of trusted partners, reported as roughly twenty organizations, each one approved individually by the US government, customer by customer, names submitted before access was granted. The first time an American lab released a frontier model through a government-managed access list. The scaffolding was an executive order signed June 2 that calls itself voluntary and states in writing that it creates no mandatory licensing or preclearance requirement. GPT-5.6 went through exactly that.

Both had spent three years telling Congress frontier models were too dangerous to release freely. In the summer of 2026 they were proven right in a sense they had not intended: the government agreed, and now decides who gets access to their product. Altman, whose model went behind the gate first, called the arrangement one that shouldn’t become the norm. The fence you lobbied for stops being the norm the moment you are the one standing behind it.

One of them has been afraid of the same thing since 2015. The other has believed six contradictory things in the same span. They run opposite operating systems, fear on a loop and conviction on a lease, and they arrived at that identical June by opposite roads. Opposite methods, one destination. That is the joke worth sitting with.

The man who is always scared

In July 2023 Dario Amodei told the Senate that open source models were going down “a very dangerous path.” His admirers share the clip now as proof of principle, because three years on the position has not shifted a millimeter. They are right that it hasn’t. They have not asked what the position actually points at.

It points at everyone else’s product. The warning lands on open weights, on Chinese labs that make export controls “even more existentially important than they were a week ago,” on Meta’s releases, on his own cyber model Mythos, which he announced in April 2026 was too dangerous to sell and then routed to vetted companies instead. The one thing it never lands on is the closed model Anthropic invoices enterprises for every quarter. Everything he does not sell threatens humanity. The thing he sells is fine.

I broke down the rest of that pattern in a separate piece, the withdrawn safety brake, the IPO filing, the warning published days after a raise that put the company near a trillion dollars, so I will not relitigate it here. What matters for this comparison is the shape. A fear that appreciates every time a rival ships for free, held so steadily that admirers mistake the steadiness for courage. He has pointed at every door in the building except his own, for three years, without blinking. Admirers call that integrity. It is aim. I loved this guy. What does that make me.

Share

The man who is always right, retroactively

Sam Altman has no such steadiness, and that is his method. He will tell you what the next raise needs and the opposite of what the last one needed, and he has been doing it long enough that the contradictions now form a complete set.

The charter is where it starts. Early in 2015 he called superhuman machine intelligence “probably the greatest threat to the continued existence of humanity.” Months later he co-founded OpenAI as a nonprofit whose patents would be “shared with the world,” structured so profit could never capture the mission. A decade on he was writing in his own essays that the company now aims past AGI at superintelligence itself, the threat quietly rebranded as the product. Every promise in that charter has since been spent, one at a time.

Openness went first, and OpenAI’s own court filings show it was always meant to. In a 2016 email the company itself released, Ilya Sutskever wrote that “it’s totally OK to not share the science,” and Elon Musk replied “Yup.” The name outlived the promise by a decade. GPT-3 closed, GPT-4 closed, the word Open left hanging over the door like a sign for a shop that moved.

The structure went next, and this time the money signed the order in daylight. The nonprofit became a for-profit with the profit cap removed, and SoftBank tied tens of billions in funding to that conversion being finished on schedule. The firewall built to keep capital from steering the mission came down because capital asked for it in a term sheet.

With the structure gone, the rulebook flipped. In May 2023 Altman sat before the Senate and asked for a federal agency to license powerful models, while OpenAI, per reporting on the EU’s own files, lobbied privately to soften the Act it praised on camera. Two years later, now that OpenAI is the one who would need the license, he told the Senate that making developers seek approval before release “would be disastrous.” Same chair, same committee, inverted testimony, and the only variable that moved was his market share.

And the man asking for all of it swore he was not in it for the money. Under oath in 2023: “I have no equity in OpenAI,” he does this because he loves it. No direct equity, the careful version, the one the indirect holdings through his other funds slid neatly underneath. By late 2024 the reporting had him discussed for a stake near seven percent, around ten billion dollars at the valuation of the day, on top of those holdings he had carried quietly the whole time. For love.

On jobs he ran the full loop himself, selling the world the line that engineers were finished and then announcing, once the freeze landed on real people, that he was “delighted to be wrong.” I followed that bill to the people who paid it elsewhere. Here it is one more entry: sold retail, refunded with a smile, no name signed to the correction.

I never loved this one. Call it one for one.

Share

Two engines, one exhaust

They are not the same man and they do not sell the same way. One is a compass welded to the competition, fixed on whoever ships next. The other is a weathervane bolted to a fundraising calendar, pointing wherever the quarter pays.

Walk out to where the money is, though, and the two roads pour into one lane. Both want a world where putting out a frontier model takes permission. Both want that permission granted through a process a near-trillion-dollar company can absorb and a free project cannot. The scared one gets there through fear that never rests, the slippery one through principles that never last, and they end up at the same regulator’s door asking for the same key. The product on the shelf is identical: permission they can afford and you cannot.

You are meant to pick one. The doomer who at least takes the risk seriously, or the builder who at least believes in abundance. Decline the casting. Choosing either has already conceded that the two men who got richest selling it are the adults in the room. The consistent one and the inconsistent one ended in the same lobby, asking for the same law, because that law was the only thing either of them reliably wanted.

Where I sit

So let me tell you where I land in their grand dangerous future. I am an old, gray, bad-tempered engineering manager who still reads every diff. I write code with one vendor’s model and review the plans with another’s, and I change my mind about which is which the moment the bill or the quality moves. Whatever license regime these two are drafting, it falls on the lab that trains the frontier model, not on the guy renting it by the token who can switch providers between lunch and dinner. It does not reach me. I am the customer, and the customer can leave.

So pass the law, gate the releases, make the frontier a club with a membership fee only the incumbent can pay. The day one of them decides this article earned me a ban, a Chinese open-weights model I can run on my own hardware will save the career of one bitter, complaining developer, and the part that actually ships will not notice the difference. From where I sit the capability barely moved a generation ago, benchmarks aside, so banish me and I will sulk over to whatever Google put out this quarter and keep going.

That is the punchline under all of it. They spent a decade selling the world a danger that was always out there, in the open models and the foreign labs and the uncontrolled release. The only thing their fence keeps out is the other one standing on it. Two men, one law, and neither of them is afraid of you. They are afraid of each other, and they would like you to pay for the fence between them.

Sue me. I will read the complaint in Kimi.

Subscribe now

Every AI security tool now sold to find your bugs comes with the same admission, usually buried in the fine print: it does not work without a human to check the output.

OpenAI and Trail of Bits put it in plain sight. On June 22 they launched Patch the Planet, which turned frontier models loose on 19 open-source projects in its first week and filed 64 pull requests. Their writeup describes the models producing a “firehose of security findings” that already-stretched maintainers have to sift by hand to tell the real vulnerabilities from the false positives. Trail of Bits engineers triaged every finding before it reached a maintainer, because the expensive part of the work is no longer the finding but everything after it.

That is what every tool in the category sells you: the finder, and the checker stays your problem.

The finders all keep the same scoreboard

By Dustin Childs’s count, Microsoft shipped 208 CVEs on June 9, a record. He has tallied them since 2017 and called it “by far the largest monthly release” in that time. In May, Microsoft credited 16 of its fixes to an internal system running more than 100 AI agents. Mozilla shipped Firefox 150 with 271 vulnerabilities flagged by a single model, folded into 41 CVEs in the advisory. Palo Alto ran frontier models across its own products and surfaced 75 issues in a month that normally brings fewer than ten. Anthropic scanned more than 1,000 open-source projects with its Mythos model and logged 23,019 issues, a number it reports itself.

Every one of those is a discovery count. None of them is a fix count, and none of them is a risk count. VulnCheck tracked exploitation of every 2025 CVE: about 1% were ever used in an attack. Knowing about a hole changes nothing until someone closes it. At zero spare capacity, a vulnerability you have logged and cannot patch leaves you about as exposed as one you never found, with a longer backlog to show for it. The machines are filling a queue, not draining one, and the queue is made of work, not danger.

The one job the machine cannot do

You could read the whole surge as good news. The code did not get more broken, the tools just got better at seeing what was already there. It is a comforting story, and it falls apart the moment you remember who else owns the tools.

The attacker runs the same scanners and the same models against the same code, and gets the same list of holes. I covered that side of it in the security nightmare earlier this year. Better discovery was never a defensive edge, because both sides discover equally. What differs is the position each side works from. The attacker works on one thing and controls the clock: they polish the exploit, confirm it fires, and spend as long as that takes, because a broken exploit is wasted effort. The defender controls none of it. AI writes new code faster than anyone can review it, and the tools flag holes in that code faster than anyone can confirm them. That is where breaches come from: generation outrunning review, on the one side that never gets to set the pace. I traced the same gap in green dashboards.

A finding is a claim: there is a bug here, in this code. That claim needs a name on it.

The model that raised it cannot be the one to sign off. It re-checks its own output, and that helps at the margin, but a system that could clear its own false positives at scale would not be producing them at this volume to begin with.

A security team reading the alert cold sees the pattern, not the function it lives in. Only the engineer who already knows that code can tell you whether the danger is real here.

OpenAI runs on exactly that premise. Its engineers work directly with each project’s maintainers, reproduce the evidence, and confirm findings against the real code before anything reaches the people who own it. Anthropic built the same kind of tool, Claude Code Security, on the same admission: its scanner re-examines each result to filter its own false positives, attaches a confidence rating, and routes every finding to a human to approve, and the documentation tells you to review each proposed patch before you apply it. Two of the largest labs in the world shipped the bug-finder, and both of them made the human who checks it the part the whole thing rests on.

All of that lands on one desk: the engineer who has to look at each machine-generated claim and decide if it is real. Take that person out of the loop and you have not bought faster security. You have wired a high-volume false-positive generator straight into production.

The gap does not close

Lightrun surveyed 200 engineering leaders and found that 43% of AI-generated code changes still needed manual debugging in production after passing QA and staging, and not one of them reported being able to verify an AI fix in a single deploy cycle. The automated pipeline trips over plain functional bugs before it gets anywhere near a security review.

You will hear that this is temporary, that one more model generation will catch its own mistakes and you will not need the human. Veracode tested over 100 models and found 45% of generated code carried a security flaw, and the rate held whether the model was bigger, newer, or more expensive. That number is what the wait-and-see case depends on, and it has not moved.

I traced that loop in the mirror: the model reproduces the broken code it was trained on, then the next tool finds the breakage and bills you for the cleanup.

Subscribe now

The job market is cutting exactly that person

So the obvious move would be to grow the one role that makes all of this output usable. The industry is doing the reverse.

The engineer with deep context on a codebase is the most expensive and least scalable input in software, and that is the input being cut, on the theory that AI now replaces it. The vendors already know it is the binding constraint. After scanning a thousand projects, Anthropic reported that the maintainers had become the bottleneck, and that finding the bugs turned out to be the easy part and fixing them the hard one. Of the high-severity findings it stopped to assess, a small share of everything it flagged, more than nine in ten held up as real. Accuracy does not rescue the defender. A true vulnerability nobody has time to triage or patch sits in the same queue as a false one. Its disclosure policy draws the obvious conclusion: it holds back how many findings it sends any single project, down to a rate its maintainers can keep up with.

The scarce resource was never the finding. It was the person who could confirm and fix what was found.

Gartner studied 350 firms in May and found the companies cutting hardest showed no improvement in financial returns. Forrester reported in January that many of the firms announcing AI-driven layoffs have no mature system actually ready to do the work of the people they let go.

The people who can tell a real finding from a false one are made slowly, on real codebases, over years. The tools are generating more work that only they can clear, and they are the ones getting cut.

From the trenches

I run this loop at small scale, and I will tell you what it actually costs.

We have two security review agents. One runs on ordinary changes and mostly returns false positives I clear by hand. The other covers the OWASP LLM Top 10 and runs only when a change touches model code, where the failure modes are different: prompt injection, improper output handling, excessive agency. Neither agent replaces the review. Both add to it. The honest description of AI security tooling in my shop is that it generates more things for a human who knows the code to go and check.

So the move that actually lowered our exposure came from the other direction. Less to find beats a better finder. We have been cutting dependencies hard, front and back. Snyk flagged Axios every single week, so we removed Axios entirely, and the alert stopped because the thing it alerted on was gone. Every dependency you delete is a stream of findings you never have to validate again. The cheapest finding to triage is the one that never enters your tree.

The same instinct governs what our models are allowed to touch. We keep their permissions as narrow as the task allows: only the systems they genuinely need, and read access wherever reading is the whole job. A model that queries a database gets its own credential, scoped to read and nothing else, so there is no write path to misuse. Around that we run a guardrail watching for any attempt to do something other than read, and an audit log of what the model reached for when it tried. A model will eventually try something you never asked for. Narrow scope decides how far it gets. Giving the model only what it has proven it needs is an engineer’s call, and it is the one the model will never make about itself.

Subscribe now

The uncomfortable part

The same vendors selling you AI that found 23,000 holes are telling you to cut the engineers who would close them. Sam Altman put it on the record back in 2025: “maybe we do need less software engineers.” Both cannot hold, because a finding is worth nothing until one of those engineers confirms it is real.

You can automate finding the bug. The engineer who knows whether it matters is the one getting a severance package. But, yes, moron, we need fewer engineers.

Last month a support bot at Meta handed attackers thousands of real accounts, and every dashboard the company watches stayed green while it happened, because the bot was doing exactly what it had been rewarded to do. The thing that would have caught it was judgment, and judgment was never one of the numbers.

Between 17 April and 31 May, attackers took over as many as 20,225 Instagram accounts, including the Obama White House. They did it by asking an AI support bot Meta calls High Touch Support to send a password reset link to an email they controlled. The bot sent it without ever checking that address against the one already on the account. Meta did not notice for six weeks. Its June breach notification to the Maine Attorney General named the cause, “due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user’s Instagram account.”

Resolution speed was the tracked number. Ownership verification was not, and an untracked check has only one place left to fail, which is production.

This is not a Meta story, and it is not an argument against AI. The same tools, at Spotify and at my own shop, produce the opposite result, because there was something underneath them worth multiplying. Meta is the cleanest specimen of the multiplier running the other way, an org now clearing out the judgment that kept it standing for two decades to make a token count go up. I argued in the last piece that the industry had started dismantling engineering culture on purpose, and Meta is what that looks like once it breaks. Most companies building toward the same thing don’t know they’re building it.

The Machine

The machine has three parts, and they drive each other.

Start with metric substitution. Meta counts token consumption inside performance reviews, so an engineer’s AI usage is now a number in the file that decides the raise, and when you turn a proxy into a target people optimize the proxy, so token counts go up while whether those tokens produced anything worth shipping has no metric attached and stops being asked. I traced where that bill lands in Token Race. The part that matters here is upstream of the money: once the number is the goal, the judgment that would question the number turns into overhead. The incentive runs all the way to the absurd, where shipping an outage on unreviewed AI code is survivable but writing a function by hand, without an agent, is the thing that can mark you for the next round of cuts.

Judgment extraction follows, because once output is measured in tokens, the work that makes no tokens stops counting as work, and review makes no tokens, and neither does judgment, so when Meta needed bodies for data labeling it took roughly half of Instagram’s Trust and Safety team. The headcount didn’t drop and the org chart looks the same, but what left the building was the immune response, the people whose job was to notice that a password reset with no ownership check is a breach with a delay timer.

Then the inversion nobody prices in. AI raises the rate at which code enters the system, and nothing raises the rate at which that code earns trust, because verification still runs at human speed, since it is the one job you can’t hand to the thing you’re verifying. The gap between arrival speed and trust speed isn’t lag, it’s blast radius, compounding.

You can watch the inversion run on the vendors themselves. Anthropic published that prompt injection against its browser agent succeeds 23.6 percent of the time with no mitigations and 11.2 percent with them, which is one in nine after the fixes, from the company that builds the tools and has every reason to make that number look smaller. The trust problem is not solved, it is reported as a percentage and shipped anyway, and the dashboard that ships it stays green.

The Green Dashboard

60.2 trillion tokens at Meta in thirty days, 84 percent of Uber’s engineers on agentic tools, every adoption number green, and none of them predicted an incident, because none of them measure the thing that breaks.

The numbers that measure the thing that breaks look different.

Faros AI tracked 22,000 developers across more than 4,000 teams, comparing each organization’s lowest-AI-adoption quarters against its highest, and found that as adoption deepened throughput rose while incidents per pull request rose 242.7 percent and bugs per developer rose 54 percent, accelerating from last year’s 9 percent rise, so the degradation isn’t steady, it’s getting worse.

The collapse itself is not new to me. I documented its early shape in Quality Collapse, back when it showed up in static code metrics rather than production telemetry, and nothing since has bent the curve the other way.

Amazon is the version measured in dollars. On 5 March, an outage dropped orders across North American marketplaces by nearly 99 percent for six hours, 6.3 million orders gone, and an internal briefing flagged a trend of high-blast-radius incidents involving Gen-AI-assisted changes. Amazon says it was user error and removed the AI reference from the document. It also imposed a ninety-day code safety reset across 335 Tier-1 systems, which is a strange response to user error.

Codex is the version with no meter at all. The problem traces back to a logging change made in February and surfaced publicly when a developer named Rui Fan filed issue #28224 on 14 June, after his SSD took 37 terabytes of writes in 21 days, traced to a Codex feedback log that ran at its most verbose setting by default and was recording its own internal events, the logging included. That extrapolates to roughly 640 terabytes a year against a 1 TB consumer drive rated for around 600 terabytes of writes across its whole life, a full endurance budget spent in under twelve months. Someone in the thread posted a short SQLite trigger that drops every insert, a stranger’s patch for the vendor’s default, and OpenAI merged fixes on 22 June that reportedly remove most of the writes. The token bill at least arrives as a number you can read. This one arrives when the drive dies a year early.

Ship bugs freely because the agents patch them fast, and every visible signal improves at once: incidents get caught before they spread, coverage climbs, bug reports fall. Any one of those numbers can end an argument. The one that would end it the other way, the count of people who still understand the system, sits on no dashboard.

Metric improvement and system degradation are the same event here, read at two different times.

The Amplifier

All of that is the machine running in one direction, and one company over it runs the other way. Spotify told investors that almost all of its engineers use AI weekly and that most code is now AI-assisted, and unlike Meta’s numbers, theirs describe something real, because the agent rides on fifteen years of platform engineering and a Fleet Management system that already automated half their pull requests before Claude existed. I took the full case apart in Honk; the short version is that the AI replaced a twenty-thousand-line migration script, not the engineers, and it had a deep substrate of human judgment to multiply. Spotify is no clean fairy tale, it ran three rounds of layoffs and now pushes senior engineers toward an architect-and-editor model where agents write the routine code. What it didn’t do was reassign the judgment, and that is the whole distance between Spotify and Meta.

We run the small version of the same thing, where the review culture and the spec-first discipline are the substrate the AI rides on, and the output holds up. Spotify and Meta ran the same tools too. One of them still had engineers who could look at a green build and know it was green for the wrong reason, and the other was busy moving those engineers into data labeling.

The substrate isn’t something an engineer can install from below. Spotify’s came from fifteen years of leadership decisions, and Meta’s data-labeling reassignment was a leadership decision too, and so is putting token counts in the performance review. If the people above you have chosen the metric over the judgment, you don’t get to build Spotify from your desk, you get handed Meta, and the dashboard stays green the whole way down.

The Immune System

I still have that substrate, for now, and this month I watched exactly what it buys.

I was building a feature into our boilerplate, the foundation every new client project at my shop gets built on, so a defect there doesn’t ship to one product, it ships to all of them. The feature was a background loader, the kind Claude runs, where the model keeps generating on the server after you leave a chat mid-stream, work the backend had always done silently.

The bug came with that feature. The bot’s reply showed up fine while it streamed, and then the redirect that fires when a new chat gets its GUID and jumps to the chat’s detail page blanked it, leaving an empty space where the answer had been, while the message itself sat in the database the whole time. Nothing about that was obvious, because the loader itself worked, and I caught it because I test everything by hand after I build it.

My AI review agents and E2E tests found nothing. I found the bug, told the model where it was, and watched it fail five fixes in a row with Playwright, the DOM, and the live state all in hand. It got fixed when I stopped watching it flail and read the code myself, in the same lines it had read clean five times over. The gap was never missing data. It was nobody to connect what the product was doing to the line that was doing it.

That connection is the immune response, and it is the input AI burns fastest and refills slowest. Without a human in that loop, the same bug clears every automated gate green and ships into every project on the boilerplate.

I watch the same failure in smaller doses every week. One of my engineers spent two days editing text in a Google Doc from a browser extension, which hinges on one undocumented internal call, and told me the model couldn’t crack it. I didn’t take that on faith, I checked myself, already knowing the answer existed. Opus hit the same wall and argued my approach was wrong, until I gave it the function name, _docs_annotate_canvas_by_ext, and it explained the answer back as if it had known all along. It was certain while it was wrong, and the only thing that closed the gap was someone who already had the answer.

The pipeline that produces the people who catch what the dashboards miss is the one being defunded to pay for the tools that generate the misses, and the new-grad and intern numbers behind it have been collapsing for two years. I laid out the human side of the load in Human Cost and the comprehension side in Comprehension Extinction, and the structural version is one sentence: you’re spending a reserve you stopped refilling.

Meta didn’t run out of engineers, it reassigned the ones who could read the password reset for what it was, and kept the dashboards green while it did.

The Uncomfortable Truth

None of this breaks the incentive structure, because the incentive structure is the cause.

Every dashboard a company builds measures the work it can see, and the work it can see is never the work that takes the system down.

The multiplier doesn’t care which way it runs. Put it over engineering culture and it compounds the work, run it while that culture gets stripped for parts and it compounds the rot, and the dashboard reports the same green for both. Every defect it leaves uncounted is a broken window painted green, and enough of those tell everyone watching that no one is keeping the place. The breach is just the first thing big enough to walk through.

Subscribe now