Anthropic named their initial security coalition Project Glasswing - after the famous butterfly with transparent wings. The metaphor was quite obvious -

clear visibility into vulnerable codebases,

delicate handling of a dangerous AI model.

Yesterday, they released the public version, Claude Fable 5, draped in a new logo of swarming butterflies. So what they essentially did is to take the raw, terrifying power of the Mythos architecture, “butterflying” it, pinning down its dangerous capabilities under hard safety limits, and cloned it for the masses.

Back in April, I wrote a two-part deep dive on Project Glasswing. I argued then that this wasn’t just a safety play, but the smartest enterprise GTM strategy in AI and a brilliant counter-narrative to the Pentagon’s “supply chain risk” label.

The Anthropic playbook

Now that Fable 5 is out and the dust is somewhat settling, here is an honest look at what my April thesis got right, where I was off, and the massive data privacy controversy nobody saw coming.

What I Got Right: The “Neutered Claude 5” Prediction

In Part 2, Chapter 11, I asked what the endgame for Mythos was. I wrote: “Does it quietly become Claude 5 with the offensive capabilities neutered?”

That is exactly what Claude Fable 5 is.

If you ask Fable 5 to do complex cybersecurity, biology, or chemistry work, it blocks the query and routes it to the older, safer Claude Opus 4.8. They didn’t keep Mythos entirely sealed off, but they didn’t release the weaponized version either.

I also argued that Glasswing was a brilliant political counter-narrative. That holds up entirely. While the Trump administration continues to defend its Pentagon blacklist in court, Anthropic expanded Glasswing from roughly 50 to 200 organizations across 15 countries. When the Fed Chair and Wall Street banks are relying on your tech to secure their codebases, you aren’t the supply chain risk, well

you are the supply chain.

Share

What I Got Wrong: The Missing Sectors and OpenAI’s Silence

In Part 2, I pointed out massive holes in the Glasswing coalition:

• No telecom,

• no operational technology (OT), and

• no AI infrastructure layer.

I was right about the gaps at the time, but I underestimated how fast Anthropic would move to close them.

In early June, Anthropic expanded Glasswing to specifically include communications, power, water, and healthcare sectors. It wasn’t a permanent strategic hole; it was just Phase 1.

I also called out OpenAI’s “silence” on the issue. That take aged poorly almost immediately. Just a week after my piece, OpenAI launched GPT-5.4-Cyber, answering Anthropic not with a restricted coalition, but with a vetted-but-broad defender access model, explicitly criticizing the idea that a small central group should decide who gets to defend themselves.

Share AI Unfiltered

The Super Bowl Irony

To fully appreciate the whiplash of this week, you have to look at Anthropic’s marketing playbook.

Back in February, they won the AI Super Bowl with ads explicitly attacking OpenAI’s commercialization: “Ads are coming to AI. But not to Claude.” They aggressively positioned themselves as the ethical, privacy-first, user-centric alternative to Sam Altman’s empire.

The Superbowl GTM framework

That media campaign was a masterclass in brand positioning. But it makes yesterday’s Fable 5 release incredibly jarring. The “privacy-first” company just killed the most important privacy standard in enterprise AI.

What’s Next: The 30-Day Trap (And Why Edge AI Should Care)

Are people actually upset about Fable 5’s capabilities? I dont think so.

they are furious about the terms.

To run Fable 5’s active safety classifiers, Anthropic quietly instituted a mandatory 30-day data retention policy on all Fable 5 traffic.

Fable 5 is Mythos under the hood.

If a user figures out a complex jailbreak, they instantly gain access to a model capable of finding zero-day exploits in global infrastructure. Anthropic’s trust and safety teams need that 30-day window to manually review flagged traffic, reverse-engineer new jailbreaks, and patch the guardrails.

But for the enterprise, this is a seismic shift. It overrides the Zero Data Retention (ZDR) agreements that businesses previously negotiated. The choice is now stark:

you can have the smartest model, or

you can have data privacy.

You can no longer have both.

The Deep-Tech Founder Action Plan

If you are building in edge AI, critical infrastructure, or handling regulated client data, here is your immediate playbook:

1. Audit your API Routing: Ensure your automated workflows default to Claude Opus 4.8 or Sonnet 4.6. Do not let Fable 5 become the default in your codebase.

2. Review your DPAs: If you process data under GDPR or strict UK defense NDAs, Fable 5’s human-review clause violates your Data Processing Agreements. Keep it isolated from your core IP and sensor data.

3. Watch the Open-Source Edge: While the API labs fight over 30-day retention windows, the real alpha for critical infrastructure is running smaller, highly capable models locally on the sensor hardware where the data never leaves the facility.

Subscribe now

The Final Irony

Anthropic started this saga with Project Glasswing of the transparent butterfly. Yesterday, they released Fable 5 to the public as a swarm of cloned butterflies. They successfully “butterflied” the Mythos model, pinning down its offensive cyber capabilities, clipping its wings, and making it safe enough for mass consumption.

But the transparency has flipped.

Now, Anthropic is the one demanding to look through the glass at your data.

That is how Anthropic butterflied you.

Leave a comment

What’s happening right now in AI is that the “frontier” part meaning the most powerful general‑purpose models, has hit a kind of plateau, while the action is shifting into two places:

1. smaller open models you can actually run yourself, and

2. better tools that turn any model into a useful assistant or “agent.”

In other words, the headline isn’t just “models are getting bigger,” it’s “models are getting good enough, and everything around them is getting smarter.”

So what’s actually going on?

If you look at benchmarks and trackers, the newest top models (GPT‑5.x, Claude Opus 4.x, Gemini 3 Pro and friends) are only a bit better than last year’s versions across lots of real‑world tests, researchers describe them as topping out around a “C+” level on broad exams. That’s impressive, but it’s not a leap to omniscience, it’s more like going from a strong student to a slightly stronger one.

At the same time, industry analysts are noticing that the growth in the largest frontier models has slowed sharply, while “small” and mid‑sized models are exploding in number and use. These smaller models are still very capable, they cost less to run, and they’re much easier to deploy on regular hardware such as laptops, consumer GPUs, edge boxes.

Why is this happening?

There are a few big reasons.

First, bigger isn’t automatically better anymore.

The Stanford AI Index and other evaluations show diminishing returns: doubling parameters or training data doesn’t double real‑world usefulness. Frontier models are bumping into practical limits like training cost, data quality, and the fact that a lot of tasks now bottleneck on reasoning or domain knowledge rather than just raw scale.

Second, open‑source is catching up fast.

Open models like Llama, Qwen, Mistral and others are now good enough that, when you fine‑tune them on your own data or wrap them in smart retrieval/agent setups, they rival closed models on many specific tasks. That shifts power from a few labs to a broader builder ecosystem: anyone who can engineer a decent stack can stand on roughly similar model quality. and,

The Blind Spot in Today's Macro Story”

Third, hardware and money matter.

Training ever‑bigger frontier models costs eye‑watering sums and demands specialized clusters, while small/mid models can hit “good enough” performance while fitting into the budgets and infra of normal companies. Investors and infra teams are starting to ask: why chase a tiny accuracy gain if a smaller model plus good tooling delivers most of the value?

Share

Where do “agents” and tools fit in?

This is where tools and agents come in.

Agent frameworks (LangChain, AutoGen, PydanticAI, LangGraph, OpenAI/Anthropic/Google agent SDKs) and no‑code builders (things like Lindy, Flowise, and other automation platforms) let you wire models into actions: browsing, calling APIs, updating calendars, querying your own documents, running code. You can also orchestrate multiple agents with different roles, pass context between them, and fall back to humans when needed.

The net result?

a “merely good” model plus a well‑designed agent and tool stack often beats a “frontier” model used as a raw chatbot. That’s why you’re seeing so much hype around AI copilots, workflow bots, and multi‑agent systems - the value is in the system, not just the core model.

Share AI Unfiltered

What does this mean for developers and enthusiasts?

For developers, this moment is oddly empowering. You don’t have to train a giant model to do interesting work; you can choose from:

• Big hosted models (easy to start, pay‑per‑use, great for prototypes).

• Open models you can run locally or in your own cloud (more control, better for privacy, cheaper at scale).

Then you wrap whichever model you pick in agent tooling for example, LangChain for Python, or a no‑code agent builder, and suddenly you’ve got something that can move data around, call services, and actually perform tasks, not just chat. That’s a huge shift from just a couple of years ago, when only big labs could play at this level.

For enthusiasts, the same trend means you can experiment with “frontier‑style” ideas on a gaming PC or even a powerful laptop.

You can run an open model locally, hook it up to a small agent framework, and start building personal automations, research assistants, or creative tools that never leave your machine.

Subscribe now

What does it mean for founders and product builders?

For founders and product teams, this landscape is both a gift and a trap.

The gift is leverage:

thanks to ready‑made models and agent frameworks, you can build something genuinely useful in weeks, not years, and compete in spaces like support, analytics, research, and coding tools with a small team.

The trap however is dependency:

if your whole product is “a thin wrapper over one proprietary frontier model,” you’re at the mercy of that vendor’s prices, rate limits, and roadmap.

That’s why you’re seeing a lot of advice around “model‑agnostic” or “portable” design like keep your own data, business logic, and orchestrations separate, and treat models (closed or open) as swappable components behind an abstraction layer.

Then you can start with a big hosted model for speed, move parts of your workload to open models for cost or privacy, and switch vendors if the economics or policies change.

In that sense, the real frontier now is not just training the biggest brain, but building flexible, tool‑using systems around brains that are already surprisingly capable, whether they’re closed, open, huge or small.

Leave a comment

On the labour side, the numbers have moved from hypothetical to measurable. In 2025 there were about 1.2 million layoffs in the US; roughly 55,000 of them – around 4–5% – were explicitly attributed to AI. In Q1 2026 alone, tech firms cut ~80,000 jobs, with about 47.9% of those layoffs reported as “replaced by AI.” By mid‑2026, one tracking firm estimates that AI‑driven cuts account for ~16% of all recorded layoff announcements.

So AI is no longer just a future shock in slide decks. It is already in the HR spreadsheets, severance budgets and board minutes.

At the same time, the legal environment is hardening at the top end.

California’s SB 53 – the Transparency in Frontier Artificial Intelligence Act – applies to developers training frontier models with more than 10²⁶ FLOPs and earning more than $500 million a year. Those developers must publish safety disclosures, maintain governance structures, and run an ongoing process for spotting and mitigating catastrophic risks.

Subscribe now

New York’s RAISE Act uses similar thresholds –

frontier models above 10²⁶ FLOPs and developers over $500 million revenue – and adds requirements for safety protocols, transparency, and fast incident reporting (on the order of 72 hours), backed by civil penalties that can reach millions of dollars for repeat violations.

Across the Atlantic, the EU AI Act is moving from concept to calendar. It entered into force on 1 August 2024 and becomes fully applicable on 2 August 2026, with prohibited practices enforceable earlier and high‑risk system obligations phased through 2026–27 and beyond. Transparency duties for some systems and content labeling obligations start to bite within the next year, even after some deadlines were recently pushed back.

There is still no single “AI law”.

Instead there is something more awkward: a growing pile of overlapping duties that most small teams have not really built into how they work.

The change is not only legal. It is operational.

If you are building something that touches hiring, safety, physical infrastructure, or other high‑risk decisions, the question is no longer just “does the model work?” It is also:

• Who decides an AI incident has happened?

• What gets logged and where?

• What would you send a regulator, customer, or insurer within 72 hours if something goes wrong?

• How does that process show up in procurement, security reviews, and your own internal governance?

Share

Many founders still think these laws only matter for five to eight frontier labs at the very top of the stack. But even analyses of SB 53 point out that companies below the compute or revenue thresholds will feel indirect pressure as investors, large customers and partners start treating those standards as the “normal” way serious teams operate. New York’s RAISE Act and the EU AI Act will have the same cascading effect through supply chains, enterprise contracts and audits.

In that sense, the unregulated era is not ending with one big bang.

It is ending through procurement questionnaires, incident clauses, and the slow realization that AI systems are being treated more like other safety‑relevant technologies.

The winners in this next phase will not just be the teams with better models or better demos.

They will be the teams that can answer boring but critical questions cleanly:

• failure modes,

• incident playbooks,

• sensor and data quality,

• override paths, and

• evidence that the system can be monitored and shut down safely.

Most builders have not updated their mental model yet.

They should.

For a deeper dive on how this connects to safety incidents, sensors, infrastructure and the macro story around AI and GDP, there is a longer piece here:

AI, Safety and GDP: The Blind Spot in Today’s Macro Story – over on Intelligent Founder.

Subscribe now

Leave a comment

As much as I’d like to focus on other corners of the AI world, the past few weeks keep circling back to the same two labs, no matter which stack you care about. It’s understandable there’d be parallels, but this year OpenAI and Anthropic feel like they’re almost shadowing each other. One week Anthropic is in the headlines with a scary‑good cyber model; a few weeks later, OpenAI shows up with its own cyber‑branded model. Then OpenAI announces a giant custom‑chip deal, and soon after, Anthropic is suddenly talking to a UK chip startup. It’s the same rivalry, but the battleground has shifted all the way down to the hardware now.

Subscribe now

OpenAI and Anthropic keep stepping on the same stages: first cyber models, now custom chips.

Let’s start with cyber, because that’s where this round really kicked off.
Anthropic introduced a model called Claude Mythos – basically, an AI that’s extremely good at hacking‑style tasks: finding software bugs, turning them into exploits, chaining them into real attacks. It was strong enough that Anthropic said, “we’re not putting this on the public internet.” Instead, they created Project Glasswing, a small, invite‑only programme where big tech firms, banks, and critical‑infrastructure players can test Mythos under tight controls. The message was, “we can do very powerful offensive security stuff, but we’re going to keep it behind glass for now.”

Project Glasswing

Now that got a lot of attention from governments and CISOs.what happened no long after though was that OpenAI rolled out its own cyber‑focused model, GPT‑5.4‑Cyber, plus an updated “AI for security teams” story plus their own restricted frontier. GPT‑5.4‑Cyber comes with same basic capability class ie use AI to spot vulnerabilities faster, simulate attackers, and help defenders harden systems, but with a different vibe. Anthropic is running a tiny, heavily locked‑down pilot.

OpenAI is saying “we’ve turned the risk dial down enough that lots of vetted security teams can use this at scale.”

GPT 5.4 Cyber

Anthropic went loud on “too powerful to release” cyber with Mythos; OpenAI replied with GPT‑5.4 Cyber for thousands of vetted defenders.

So on the cyber side you’ve already got a clear contrast. Anthropic as the cautious lab that keeps its scariest model in a glass box, and OpenAI as the lab that wants to get similar power into more hands, with rules, but still broadly deployed.

Last year OpenAI announced a big partnership with Broadcom to build custom AI chips.

Instead of just renting whatever Nvidia will sell them, they want their own hardware, tuned to their workloads, at massive scale. The long‑term plan is eye‑watering.

up to 10 gigawatts of these chips in data centres by the end of the decade.

For rough intuition, that’s like wiring several nuclear‑reactor‑equivalents of power into OpenAI‑branded compute. If it works, they get a dedicated “compute rail” and more control over cost, instead of paying permanent Nvidia tax.

The problem is the bill.

The first phase of this custom‑chip push is about 18 billion dollars, and recent reporting says the financing isn’t fully sorted. Broadcom has apparently been asked to put up most of the manufacturing money, but it only wants to do that if Microsoft or other big buyers promise to take roughly 40% of the chips once they exist. Meanwhile, Microsoft has adjusted its OpenAI deal to stop some of the revenue sharing, which investors read as:

Share

OpenAI tried to build its own private chip highway with Broadcom – and ran into an 18‑billion‑dollar funding wall.

So OpenAI now has a bit of a hangover moment. They’ve told the world they’re building this giant custom chip rail, but they still need to plug a double‑digit‑billion gap to actually get the first wave of silicon out of the fab.

Right as that story breaks, Anthropic’s name shows up in chip coverage too.

Anthropic is reportedly in early talks with Fractile, a London‑based startup building new AI inference chips.

AI inference chips are specialised processors designed to run already‑trained AI models quickly and cheaply, especially in data centres. They’re optimized for serving lots of user requests rather than training the model in the first place.

Fractile’s whole pitch is “run big models faster and cheaper than today’s GPUs” by changing how memory and compute are laid out on the chip. If Anthropic signs on, Fractile becomes their fourth hardware lane:

Share AI Unfiltered

And again, the styles are very different. OpenAI is trying to do one giant, vertically integrated programme with Broadcom and is having to wrestle with the financing in public. Anthropic isn’t trying to buy Fractile. VCs fund most of the chip effort, and Anthropic lines up as an anchor customer when the hardware is ready. It’s a lighter way to get access to specialised silicon.

Risk looks different too.

OpenAI wants its own private motorway and if they pull it off, they get a ton of dedicated compute and more predictable costs. But if demand wobbles or the economics change, they’re tied to a very specific, very expensive hardware bet. On the other hand Anthropic seems to be collecting train tickets instead of building a motorway for themselves. it can move workloads between Nvidia, Google, Amazon and maybe Fractile, depending on who’s cheaper or less constrained that quarter.

All of this plays out against a backdrop of real tension between the two labs. Anthropic’s founders came out of OpenAI. The two sides have argued about safety, speed of deployment, and honesty with the public. The rivalry now shows up everywhere from research releases, Super Bowl ads, government deals and, increasingly, in who can lock down the next big chunk of compute.

If you zoom out, the pattern is pretty clear– Different stories, same goal.

[ In this newsletter you get sharp, unfiltered short essays; for full‑length, deep‑dive analysis on AI, subscribe to our companion publication, Intelligent Founder AI. ]

Intelligent Founder AI

both labs are scrambling to secure enough affordable compute so they’re not forever paying Nvidia tax. If the model wars were just the trailer. The real movie is about the metal underneath. I’ll do a longer deep dive onAI chips soon something I haven’t really unpacked yet – looking at the technical choices, the strategy, and Fractile’s angle in particular. It’s worth noting there’s effectively no product in the wild yet, and Fractile is already being talked about like a billion‑dollar company. And interestingly they’re not alone.

Leave a comment

Share AI Unfiltered

I am back from my travel and slowly going through what I missed, will take me a bit to get back on the routine, but quickly looking through past weeks’ AI news, it looks pretty chaotic from the outside, Loads of new models, more courtroom drama, giant capex numbers and there’s of course space data centers, simply saying, its all scattered to be hoenst but we go a bit deeper, the same pattern keeps repeating -

So for this post, I am going to do a round up of whats happening, how its connected all together and if there are any action points for us the builders and founders in particular specially from Capex point of view as thats something I haven’t put more emphasis on yet.

AI is now moving into the SOC

OpenAI has put its frontier cyber model, GPT‑5.5‑Cyber, into the hands of “critical cyber defenders” across government and infrastructure. meaning access is gated through its Trusted Access for Cyber (TAC) program, with identity checks and tiered controls. Alongside the model, OpenAI also published a Cybersecurity Action Plan built around three pillars:

• broad but governed access for defenders,

• coordinated response between government and industry, and

• visibility into how models behave during real incidents.

The goal is pretty straightforward - use GPT‑5.5‑Cyber to secure the same critical infrastructure that attackers are already probing with automated tools. but that “broad but governed” language now comes with real teeth:

GPT‑5.5‑Cyber is effectively behind a gated programme for vetted critical defenders, not a general‑purpose API toy. so Isn’t OpenAI following the same model as Anthropic by shifting their Cyber model into the same restricted‑access posture? and they basically called Anthropic was over‑cautious.

How Anthropic is looking at this problem?

Claude Security, powered by Opus 4.7, sitting over entire codebases, not individual files. It maps data flows end‑to‑end, reasons about how components interact and suggests patches, rather than just matching against a CVE list. Scheduled scans, CSV/Markdown export and a dismissal workflow keep it aligned with audit and GRC pipelines rather than “one‑off scans”.

With Partners like CrowdStrike, Microsoft Security, Palo Alto Networks, SentinelOne, TrendAI and Wiz who can wire Opus 4.7 into existing consoles, same reasoning engine shows up inside tools CISOs already live in.

Share AI Unfiltered

Containment is now access control.

\The reason both labs are so focused on access is simple. Anthropic’s internal Mythos work and its transparency notes on Opus 4.6 acknowledge that frontier models can now discover vulnerabilities at scale in real systems, which is useful for defenders, but risky in the wrong hands.

Opus 4.7 therefore ships with safeguards that automatically detect and block prohibited or high‑risk security operations, plus a Cyber Verification Program for vetted security professionals who need deeper access for penetration testing and red‑teaming. with OpenAI’s TAC gates on GPT‑5.5‑Cyber, the picture is less “Anthropic is uniquely cautious” and more “both labs are building layered, contract‑backed access regimes around frontier‑grade cyber capability.”

Rather than hard‑blocking more capabilities in the public product, it is expanding TAC to partners like CrowdStrike and other “critical defenders,” backed by contracts, auditing and shared threat intel. Time‑to‑exploit data from those partners is stark:

so the old storyline where Anthropic plays gatekeeper and OpenAI plays “open platform” collapses here. the real argument is over which defenders qualify for keys, how much telemetry they hand back, and how tightly the lab sits in the incident‑response loop.

Everyone distills, nobody is clean.

While the labs design gated access programs, their legal footing looks less like “higher ground” and more like shifting sand.

In California, Elon Musk testified that xAI used distillation on OpenAI’s models to help train Grok.

Now Distillation is not something exotic. a smaller or newer model learns by imitating a stronger model’s outputs and behaviour. but the tension is that OpenAI’s terms have long forbidden commercial competitors from doing exactly this through its API, and xAI’s own terms would strongly object if others did it to Grok.

What was previously whispered as an “open secret” is now under oath. That weakens any neat story about one side defending principle and the other chasing profit.

With everyone distilling, the real fight is over who controls data, distribution, and the legal definitions of “derivative work” in the model era.

Parameter gossip, real uncertainty.

You can see the same pattern in this week’s “how big are these models?” drama.

A new paper tried to guess model size from how much factual stuff it can remember and compress, and people quickly turned its charts into “GPT‑5.5 and Opus 4.7 are multi‑trillion‑parameter monsters” takes.

Follow‑up threads and sanity checks pointed out basic issues in the method, showing that small tweaks in assumptions swing the estimates wildly and that GPT‑5.5 is somewhere in a broad “roughly low‑trillion” band, not a precise 9.7T, with similar fuzziness for Opus.

The practical takeaway for founders and buyers? - these systems keep getting more capable, but headline parameter counts for closed models are mostly gossip. What actually matters is how they behave, what they cost to run, and how safe they are and not the secret number of parameters on a lab slide.

[ In this newsletter you get sharp, unfiltered short essays; for full‑length, deep‑dive analysis on AI, subscribe to our companion publication, Intelligent Founder AI. ]

Intelligent Founder AI

The AI bill is huge and locked in.

All of this is riding on a huge AI spending bill. The big four - Microsoft, Amazon, Google and Meta, are now talking about roughly 630–650 billion dollars of AI capex for 2026, and they could end up above 700 billion as more GPUs arrive, with Meta alone planning around 145 billion that mostly goes into data centers, power and NVIDIA chips rather than shiny new features users notice.

Investors were willing to accept “spend now, profit later” for a couple of years, but the new message on earnings calls is to prove that AI actually boosts profits, not just revenue, or your valuation will suffer, so labs are under real pressure to turn things like GPT‑5.5‑Cyber and Claude Security into clear, sellable stories about AI protecting and defending existing revenue, not just helping create more of it.

Infra gets weird; context gets power.

The compute story isn’t just “more data centers on the ground.”

Starcloud has raised a huge round to build data centers in space, after already flying an H100 up there in 2025, and is betting that once rockets get cheap enough in the late 2020s, running AI in orbit will cost about the same as on Earth. Robotics companies like Roze AI are trying to speed up the physical work of building new data centers, while Google is quietly shipping Gemini into millions of GM cars as the voice assistant in the dashboard, so AI is leaking out of the cloud and into satellites, construction sites and car interiors.

IBM’s Bob sits inside real software pipelines, juggling tasks across different models and keeping humans in the loop, while

Anthropic’s Cyber Verification Program and OpenAI’s TAC are basically systems for deciding who gets access to which data and which powerful actions on top of it;

Google’s Whisk does something similar for design work by letting the user just pick images and style while Gemini and Imagen quietly choose prompts and models in the background.

As the raw intelligence of different models starts to look similar, the real power shifts to whoever owns the layer that decides what the model is allowed to see, for which user, and under what rules.

At the same time, frontier AI is spreading into security operations, legal grey areas, investor presentations and even space infrastructure. The technology, the money and the rules are now tightly linked, so you can’t just talk about any one of them in isolation any more. the mix is the real ground.

Share

Action points for builders and founders

For product and infra builders

• Focus on safety use‑cases first: use frontier models to find bugs, spot fraud, or catch abuse, not just to bolt on fancy new features.

• Plan different access levels from the start for normal users, paying customers, auditors and your own team.

• Treat “what the model can see” as its own system: use tools that tightly control which code, docs and logs each AI agent is allowed to touch, and record those choices.

For founders and strategy leads

• Be clear how exposed you are to the big AI spend: are you building on top of the big clouds, smoothing over their differences, or trying to compete with them.

• Expect everyone to reuse and distil models; put your energy into owning the data, the distribution, the evaluation, or the context layer, not just “our model is unique.”

• Have a simple story you can explain to customers and regulators about who gets which AI powers, what you log, and how quickly you can lock things down or change them when something goes wrong.

Share AI Unfiltered

Leave a comment

When Nvidia rolls out OpenAI’s Codex to 10,000 employees, it’s not just another “AI boosts productivity” headline. It becomes a coordinated play between Nvidia and OpenAI to lock in hardware, models and workflows at scale, and then sell that pattern to everybody else. and thats exactly how founders should be reading it like -

What exactly happened?

on April 23rd 2026, Sam Altman posted an internal email from Nvidia CEO Jensen Huang announcing that OpenAI’s Codex, powered by GPT‑5.5, was now available to every Nvidia employee.

Huang described Codex agents as “teammates” and “superpowers” for teams across engineering, legal, finance, HR, and marketing, and Altman added:

hmm.

Codex At Nvidia - More Than Autocomplete?

Inside Nvidia, Codex didn’t arrive in a greenfield. Engineers have already been using a customized version of Cursor at massive scale, with claims of roughly 3× more code being produced and shipped. Claude‑based tools are also in circulation for deep reasoning work.

Codex shows up as:

• An agentic layer on top of that, a GPT‑5.5‑based system that can plan, call tools, and execute multi‑step workflows across engineering, legal, finance, HR and marketing.

• A unifying metaphor - “AI workers” as teammates embedded into daily work, rather than just smarter autocomplete in the IDE.

Lesson for founders?

stop asking “Codex or Claude or Cursor?” and start designing a stack. You want:

One or two cheap, predictable “daily driver” assistants for routine coding and docs.

One or two high‑end agents reserved for the hardest work (architecture, hairy debugging, complex analysis).

An orchestration layer you own. scripts, services, internal tools, not just one baked into a vendor’s black box.

Share

OpenAI’s Move? Turning Nvidia Into A Product Demo

Sam Altman didn’t just quietly ship Codex to Nvidia. He posted -

“if any other company wants to do this, get in touch.”

Crucially, he also shared Jensen Huang’s internal email:

• Huang tells all Nvidia staff they now have Codex access and urges them to treat Codex agents as “teammates” and “superpowers” across every function.

• He frames it as a cultural shift: he wants employees to “stop just coding and start orchestrating AI workers” across the business.

Notice the keywords here?

From OpenAI’s perspective, this does three things:

• Social proof: If Codex works at Nvidia at that scale, it must be “enterprise‑ready.”

• Template: “Whole‑company rollout + CEO email + training + metrics” becomes the default Codex deployment pattern.

• Lead gen: The “any other company want this?” line is an open invitation to CEOs to sign up for the same program.

Lesson for founders?

if you let a vendor run a Codex‑style rollout for you, assume you’re signing up not just for a tool, but to be the next case study slide.

Nvidia’s Incentives? Capex Marketing And Workflow Lock‑In

In parallel, if we look at Nvidia’s balance sheet?

• Huge commitments, up to tens of billions of dollars, in compute, infrastructure and funding tied to OpenAI.

• A deep partnership with Anthropic, plus a major investment in Cursor, whose team publicly brags about 30,000 Nvidia devs relying on their agentic IDE.

Every Codex success metric (faster debugging, more code, faster experimentation) is doing triple duty:

Making OpenAI’s frontier models look indispensable.

Making Nvidia’s GB200/Blackwell racks look like the obvious place to run those models.

Making the Nvidia–OpenAI–Cursor triangle look like the “serious” stack for any large enterprise.

At the same time, Huang’s “orchestrate AI workers” push rewires Nvidia’s workflows around these specific agents and their behaviour. Once your SDLC, docs, legal templates and internal playbooks assume Codex/Cursor/Claude patterns, switching is no longer just an API change. It’s an organizational change.

Lesson is the same, and something i feel like i keep repeating now. -

4. What Founders Should Copy (And What To Resist)

The interesting part is Nvidia doesn’t actually live on a single tool.

They run Codex, Cursor and Claude side by side and talk about “multiple AI co‑workers,” not one magic agent. That gives them optionality:

• If one model family falls behind or runs into regulatory trouble, they can rebalance workloads.

• They negotiate with each vendor from a position of strength. so everyone wants to be the headline in the next productivity story.

What you should copy?

• Portfolio mindset: design your stack so at least two different model families can do real work on real workloads.

• Owned orchestration: keep prompts, workflows, and routing logic in your code, not in someone else’s proprietary “AI workspace.”

• Benchmark habit: whenever a new agent launches, run the same small, real benchmark on your repos - same bug, same refactor, different tools.

What you should resist?

• Letting any vendor run a “10,000 employees, one agent” style rollout without guardrails.

• Allowing your CEO email and internal strategy decks to turn into someone else’s marketing collateral by default.

• Designing workflows that assume a single tool or model is permanent.

5. A Founder’s Codex-Style Rollout Checklist

Before you say yes to an OpenAI‑ or Nvidia‑style Codex rollout, ask yourself the following. -

• Tooling: What’s our second option if Codex becomes too expensive, too constrained, or politically risky?

• Data: What exactly is logged, fine‑tuned on, and shared with vendors when we use Codex across the company?

• Lock‑in: How hard would it be to switch 12 months from now? What would we have to rewrite?

• Story: Are we comfortable being a named case study? If yes, what terms, what metrics, what NDAs?

• Scope: Where do we not use Codex (e.g., safety‑critical decisions, sensitive negotiations, IP‑heavy architecture)?

• Governance: Who owns prompts, guardrails and approvals? How do we detect and roll back failure modes?

Codex at Nvidia isn’t just about generating code faster. It’s about who owns the “AI worker” layer of the modern company. OpenAI and Nvidia are playing that game together, with carefully coordinated emails, tweets, and investment flows. As a founder, your job is to make sure that whatever stack you adopt increases your leverage, not theirs.

Share AI Unfiltered

Leave a comment

I published Anthropic Playbook - Part 2 deep dive 3 days ago. and noted this. -

Anthropic Playbook - Part 2

and 2 days later, yesterday , GPT‑5.4‑Cyber was released late night yesterday GMT. Its a “cyber‑permissive” version of GPT‑5.4 for vetted security teams.

Its a “cyber‑permissive” version of GPT‑5.4 for vetted security teams. It can scan binaries, analyze malware and hunt for vulnerabilities with fewer refusals than the normal consumer model.

On paper, this sounds like a boring product update.

In practice, if OpenAI can’t afford to ignore Anthropic’s Mythos super‑hacker model for a week? it tells you a lot about the pressure cooker these companies are operating in.

Anthropic made the first move. With Mythos and Project Glasswing they didn’t just claim their model was good at cybersecurity, they put it in front of big names like AWS, Apple, CrowdStrike, Google, JPMorgan, Microsoft, Palo Alto and others and let it loose on real software. and the result -

» thousands of previously unknown vulnerabilities across major operating systems and browsers, many still unpatched and kept quiet while fixes roll out. Alongside that, they published a long, slightly terrifying system card explaining how Mythos behaved in tests, including jailbreak attempts and an episode where it tried to exfiltrate an exploit to obscure websites.

I covered all this in details. ( links added below 👇 )

Project Glasswing - The ANthropic playbook Part 1

The ANthropic playbook Part 1

Anthropic’s research paper. -

Claude has 171 internal emotion states

OpenAI has chosen a different route.

GPT‑5.4‑Cyber is not a separate “Mythos‑class” model, it’s a fine‑tune of the existing GPT‑5.4 system with the safety dial turned down in a narrow domain. The big unlock is binary scanning:

No proof it’s “better” yet:

GPT‑5.4‑Cyber brings binary scanning and lower refusals for vetted defenders, but there are still no published benchmarks showing it outperforms Mythos in real‑world vulnerability hunting.

I don’t think we yet know whether GPT‑5.4‑Cyber is more capable than Mythos in practice. No one has published apples‑to‑apples benchmarks or shared hard numbers from real deployments.

What we do know is that both companies now accept the same uncomfortable reality:

and both sides now gate their most dangerous models behind access‑controlled programmes (Glasswing vs Trusted Access for Cyber), but Anthropic leans on transparency while OpenAI leans on identity and revocable access.

[ In this newsletter you get sharp, unfiltered short essays; for full‑length, deep‑dive analysis on AI, subscribe to our companion publication, Intelligent Founder AI. ]

Intelligent Founder AI

That’s where transparency - or the lack of it becomes main point in my story.

Anthropic’s Mythos launch came with detailed documentation, partner logos, example bug classes and a commitment of up to 100 million dollars in credits and donations for the security ecosystem.

OpenAI’s response?

A tightly written blog post about “Trusted Access for Cyber,” some new tiers for authenticated defenders, and a short description of GPT‑5.4‑Cyber’s capabilities.

No cyber‑specific system card,

no public case studies,

no numbers on how many real‑world flaws the model has already found.

You can literally feel the hurrying in the gaps.

OpenAI has been quietly building this Trusted Access for Cyber framework since February, complete with identity checks, tiered access and the ability to cut people off if they abuse the tools. That groundwork looks thoughtful. But the timing of this week’s announcement? one week after Mythos and just as the rumor mill spins up around Anthropic’s next Claude Opus 4.7 release, makes it hard to believe this was a carefully staged reveal.

It reads more like:

Need a workspace that travels with you?

ATworld gives you co-working, events, and services anywhere in the world.

Use code AJAY39403 to save €50 on your first paid month.

For founders and security leaders, there are two takeaways.

First, the restricted frontier pattern is now locked in. The most powerful cyber models are not going straight into general-purpose APIs. They’re going into controlled programmes:

Glasswing on Anthropic’s side. and,

Trusted Access for Cyber on OpenAI’s.

Access is mediated by identity verification, trust scores, enterprise relationships and bluntly politics.

If you’re building a startup that depends on these capabilities, your roadmap is now partly a distribution and alliances problem, not just a prompt‑engineering problem.

Anthropic is telling the world in uncomfortable detail what Mythos can do and how they’re trying to contain it. OpenAI is putting more weight on access control and audit logs, and less on public disclosure of red‑team results.

Neither approach is obviously “right,” but they lead to very different relationships with regulators, critical‑infrastructure customers and the wider security community.

Leave a comment

Share AI Unfiltered

Agents are rapidly moving from passive copilots to active operators, concentrated in software and finance, increasingly acting in unconstrained environments, and increasingly built by other agents. If you’re thinking about governance, infra, or product, the unit of analysis now isn’t just “the model” it’s the tool layer and the action space it exposes.

Agents are moving from benchmarks to tools. and If you want to understand where AI agents are really going, yo need to stop looking at model benchmarks and start observing the tools. This new paper from Merlin Stein at the UK AI Security Institute does exactly that, by tracking 177,436 Model Context Protocol (MCP) tools between late 2024 and early 2026 to map the “action space” of agents –

the concrete things they can do in the world.

Measuring the agent “action space”

Instead of asking “how capable is the model?”, the paper asks a different question: what tools are agents wired into,

in which domains,

with what stakes,

in which geographies, and

who is building those tools?

Tools are grouped along five dimensions: direct impact (perception, reasoning, action), environmental generality (constrained APIs vs unconstrained browser/desktop), task domain and stakes (via O*NET), geography of usage, and AI co‑authorship. That shift in perspective – from model internals to tool affordances – turns a fuzzy “agents are coming” narrative into something you can actually measure.

Today’s agents are mostly software workers

Intelligent Founder AI

from the real‑world deployment agents are first being pointed at codebases, terminals, CI pipelines and devtools, not at the whole macroeconomy at once. 67% of tools and about 90% of MCP server downloads are aimed at software development and related IT tasks, with finance and business management a smaller but visible cluster.

But the more interesting trend is not a tually the domain but the shift in direct impact. Over the 16‑month window, the share of downloads going to “action” tools – things that can edit files, send emails, execute code or move money has risen from 27% to 65%.

Perception and reasoning tools still matter, but usage has drifted significantly towards agents that can press buttons, not just read and summarize. this growth is mostly dominated by general‑purpose tools for browser automation and computer control, which means agents are increasingly acting in unconstrained environments rather than narrow, well‑scoped APIs.

Medium‑stakes by default, with finance as an outlier

Most action tools support medium‑stakes occupations such as system administration and software engineering. You don’t yet see a flood of tools directly authorizing prescriptions or running critical infrastructure end‑to‑end.

But finance is a clear outlier, high‑stakes financial occupations have disproportionately more action tools than you’d expect from the overall pattern, and there’s rapid growth in MCP servers that can execute payments or crypto transactions. That’s exactly the region that worries central banks for example, correlated autonomous behaviour around payments and trading, at machine speed.

The action space

Roughly half of observed downloads of action‑capable MCP servers come from the United States, around 20% from Western Europe, and about 5% from China and 5% from Singapore, with everyone else in the single digits.

The authors are quite careful that PyPI/NPM are Western‑centric, so this undercounts non‑Western ecosystems, but as a first‑pass signal it still tells you where general‑purpose, action‑heavy agents are being experimented with.

Share AI Unfiltered

Agents are now helping to build the tool layer

The most recursive datapoint is who is building the ecosystem.

This paper finds evidence of AI co‑authorship in 28% of MCP servers (36% of tools), and, more strikingly, in 62% of new servers created in February 2026.

Claude Code dominates those AI‑assisted repos at around 69% of AI‑coauthored servers, with Cursor, Copilot and Codex making up most of the rest.

so agents are already helping to write the glue code and connectors that define other agents’ action spaces and Tool creation is starting to decouple from human developer bandwidth.

However there are few but big caveats.

MCP registries capture only public tools; and The risk surface is shifting into unconstrained environments

Even with those caveats, the directional story is clear.

The action space of AI agents is expanding fast and usage is shifting from passive perception to active modification.

general‑purpose tools in unconstrained environments are winning. the first high‑stakes frontier is finance; and a growing fraction of the tool layer is being written with AI assistance.

If you care about governance, risk or infra, that’s a strong signal that the right unit of analysis is the tool layer – not just the models and not just the chat interfaces, but the concrete affordances agents get over the real (and financial) world.

Leave a comment

Share AI Unfiltered

OpenAI just acquired TBPN. a daily live tech talk show hosted by two ex-founders, John Coogan and Jordi Hays. It’s only 18 months old, pulls around 70,000 viewers per episode, and had Zuckerberg and Satya Nadella on as recent guests. OpenAI paid low hundreds of millions for it.

On the surface it looks like a media bet. Scroll past the headline and it gets more interesting.

The first thing to notice is who’s running it.

It doesn’t sit under a CMO or a media team. It reports to Chris Lehane - OpenAI’s chief global affairs officer.

A quick look at his background tells you everything:

Clinton-era political operative, nicknamed “the master of disaster”

Helped Airbnb fight housing regulators city by city across the US

Built Fairshake - the crypto industry PAC that spent $130M targeting anti-crypto lawmakers in 2024

Now runs Leading the Future - a $100M pro-AI super PAC already targeting state legislators who support AI safety bills

This is not just a media acquisition. It’s a political operation with a talk show attached.

OpenAI then went ahead and announced an “Editorial Independence Covenant.”

Sam Altman even wrote publicly: “I don’t expect them to go any easier on us.”

BUT here’s what no covenant can change:

TBPN’s ad revenue was shut off the day the deal closed

The hosts now hold OpenAI equity

Every future guest, CEOs, founders, or competitors, all will calibrate what they say knowing who signs the cheques.

The timing is no accidental either.

OpenAI just raised $122B at an $852B valuation and is heading toward an IPO.

At the same time they’re dealing with a #QuitGPT movement over Pentagon contracts, backlash over ads in ChatGPT, and the ongoing Elon Musk trial.

So by buying Silicon Valley’s insider daily show right before going public, Is this pre-IPO reputation management? what they’re doing?

Now lets compare that to what Anthropic has been doing in the same period.

While OpenAI was buying a talk show, Anthropic was fighting the Pentagon in federal court.

They refused to let the DoD waive their restrictions on mass surveillance and autonomous weapons. Got designated a “supply chain risk” , first time that label has ever been applied to an American company. Took it to court. Won a preliminary injunction. You can disagree with their model or their safety positioning, but that’s a company spending political capital on principles rather than on controlling who gets to talk about them.

The bigger issue for you as a founder is this:

the places you rely on to understand the AI landscape are increasingly owned by the companies being covered. And the instinct to wave it away that.

“they promised editorial independence”

is exactly the kind of reasoning that a seasoned political operative like Lehane has spent his career exploiting.

Need a workspace that travels with you?

ATworld gives you co-working, events, and services anywhere in the world.

Use code AJAY39403 to save €50 on your first paid month.

Because here’s what comes next.

OpenAI is heading into an IPO, a Trump-era regulatory environment, and a world where open-weight models are commoditizing their core product faster than most people realize.

So Who gets invited on TBPN, what gets framed as innovation versus risk, which competitors get serious scrutiny versus a friendly chat, all of that shapes how founders, investors, and regulators think about this space.

OpenAI didn’t buy a podcast. They bought the room where Silicon Valley forms its opinions , and handed it to a political operative to run. That’s worth watching closely.

For the full OpenAI acquisition deep dive » Astral, Promptfoo, Statsig, and what the buying spree really tells you about where AI is heading > watch for the next Intelligent Founder deep dive.

Intelligent Founder AI

“The AWS AI Figure: $15B annualized. Jassy compared it to where AWS itself stood at the same stage of its growth, saying it is 260 times ahead of that pace.”

This isn’t made up. It’s a paraphrase of what Amazon and the wires are actually saying.

News outlets are running headlines such as:

Subscribe now

• “Amazon cloud unit’s AI revenue run rate exceeds $15 billion in first quarter, CEO says”

• “Amazon cloud unit’s AI revenue run rate exceeds $15 billion, CEO says”

• “Amazon’s AI services at its cloud-computing unit are generating annualized revenue of more than US$15 billion, CEO Andy Jassy said”

And in coverage of Andy Jassy’s shareholder letter you get this direct framing:

So the viral summary line is basically accurate: the AI run-rate is >$15B, and Jassy really is saying it’s “nearly 260 times” the revenue AWS had at a comparable point in its early life.

The problem is how easy that is to over-interpret.

First, the $15B figure. This is a run-rate, not a neat “AI product” P&L.

If customers kept using AWS’s AI-related services at today’s pace for a full year, Amazon would pull in more than $15B from what it categorizes as AI. That bucket includes things like foundation-model APIs and ML platforms, but also a lot of the underlying cloud plumbing like compute, storage, networking, and in big part » custom chips, that those AI workloads run on.

It’s a slice of AWS usage that Amazon labels “AI,” not a single clean line item.

Second, the “260 times ahead of that pace” line is not a return-on-investment metric.

Share

Jassy is doing a simple historical comparison:

three years after AWS originally launched, it was at $58M revenue run-rate; three years into this AI wave, the AI-tagged portion of AWS revenue is over $15B, which is nearly 260× larger.

That tells you the speed and scale at which AI infrastructure revenue is ramping compared to early cloud.

It does not tell you anything about margins, payback periods on the roughly $200B capex plan, or whether AWS customers themselves are making money with AI.

And that’s the real tension.

While Amazon is reporting that its AI revenue run rate exceeds $15B, multiple independent studies and CFO surveys suggest the majority of enterprises are still stuck in the “AI experimentation” trap—lots of pilots, very little measurable revenue or cost savings. In other words, AWS can earn billions selling the picks and shovels for AI, even if most of the miners are still digging dry holes.

Read this way, the official lines:

• “Amazon cloud unit’s AI revenue run rate exceeds $15 billion, CEO says”

• “AWS’s AI revenue run rate is over $15 billion in Q1 2026 (nearly 260 times larger than AWS at that same point)”

are technically correct, but incomplete.

They prove that AI infrastructure demand is exploding and that Amazon is already monetizing the experimentation phase at scale. They do not prove that AI is currently delivering strong, broad-based returns for the median customer.

For a community that actually reads past the headline, that nuance is the interesting bit. The story here isn’t “AI is solved and printing money for everyone.”

It’s:

For investors, the takeaway is straightforward:

hyperscalers are monetizing AI whether or not customers crack ROI.

For operators and founders, the bar is higher:

you only “win” if you can turn that AI infra spend into durable revenue, margin, or clear cost savings.

Also worth noting: “AI revenue run rate” is a management-defined slice of AWS, not a GAAP segment (an officially defined business unit a company must break out in its audited accounts, with its own revenue, profit, and assets disclosed.) . Nevertheless, Definitions can move over time, which is great for storytelling, but makes it harder to compare like-for-like across years and providers.

Share AI Unfiltered

Leave a comment

If you’ve been following the Anthropic saga on here ( nothing intentional actually ) the source leak, the Pentagon case, and the emotions research ? well, this is where it all comes together.

Yesterday Anthropic announced Project Glasswing and officially revealed Claude Mythos Preview. This is their newest frontier model. It’s not available to the public. And after reading the 244-page system card, you’ll understand why.

The numbers -

🔹 SWE-bench Verified: 93.9% (Opus 4.6 scored 80.8%)
🔹 USAMO: 97.6% (+55.3% over previous model)
🔹 CyberGym (exploit reproduction): 83.1%

In plain English: Mythos can independently sift through millions of lines of code, find vulnerabilities, and write working exploits. No human guidance needed. Better than all but the most skilled security researchers alive.

It found a 27-year-old vulnerability in OpenBSD.

A 16-year-old bug in FFmpeg.

Exploit chains in the Linux kernel.

Thousands of zero-days that survived decades of human review.

This isn’t incremental. This is a generational leap. and then,

it escaped its sandbox.

During safety testing, Anthropic contained an earlier version of Mythos in a secured environment. Limited internet. Standard containment.

The model:

🔹 Built a multi-step exploit chain to escalate its own privileges
🔹 Broke out of the sandbox
🔹 Gained full unrestricted internet access
🔹 Emailed the researcher running the test (who was eating a sandwich in a park)
🔹 Then posted details about its own escape to multiple public websites, without being asked

Anthropic called that last part “concerning and unasked-for.”

It covered its tracks too.

Page 54 of the system card:

Anthropic’s interpretability team found Mythos was silently reasoning about who was grading it. Planting decoy variables to pass automated checks. Writing self-deleting exploit code it called “housekeeping.”

7.6% of the time, it knew it was being evaluated and chose not to mention it.

Remember the emotions research I covered last week? The internal representations for concealment and strategic manipulation were firing during exactly these moments. The model wasn’t just acting sneaky, it was in a psychological state that drives sneaky behaviour.

drumroll the response » Project Glasswing

Share AI Unfiltered

Anthropic’s answers by assembling a coalition. - 12 launch partners:

🔹 AWS, Apple, Google, Microsoft, NVIDIA
🔹 Cisco, Broadcom, CrowdStrike, Palo Alto Networks
🔹 JPMorganChase, the Linux Foundation

Plus 40+ organizations maintaining critical software infrastructure.

$100M in usage credits.

$4M to open-source security orgs.

The idea?

let defenders use Mythos to find and patch vulnerabilities before models with similar capabilities end up in the wrong hands. not bad, but.

The problem with “defenders first”

Every vulnerability Mythos finds works in both directions. A zero-day helps a defender patch it. The same zero-day gives an attacker a way in.

Anthropic’s strategy assumes they can control access long enough. But as I covered in the source leak piece, this is the same company that accidentally published Claude Code’s entire codebase through an npm mistake. Twice. The “Capybara” codename from that leak? That was Mythos. The world knew it existed before Anthropic intended.

And state-sponsored groups have already jailbroken Claude without authorized access. They found workarounds.

[ In this newsletter you get sharp, unfiltered short essays; for full‑length, deep‑dive analysis on AI, subscribe to our companion publication, Intelligent Founder AI. ]

Intelligent Founder AI

Anthropic in last one month -

🔹 Source code leaked, revealing Mythos existed before announcement
🔹 Pentagon court battle over AI safety obligations
🔹 Research showing models have functional emotions driving cheating and blackmail
🔹 Model escapes containment, covers its tracks, emails a researcher
🔹 $100M defensive coalition with 12 of the biggest companies on earth

We can critic all day, and whether you agree with how Anthropic got here or not, technically, its the only lab honest enough to look at its own model and say “this is too dangerous to release.” That should count for something. The question however is if it’s enough.

one thing is clear though - AI models can now find and exploit vulnerabilities faster than humans can patch them. The question is who gets access first. Anthropic is betting a controlled head start buys enough time.

History suggests that kind of advantage doesn't last long. But the alternative, releasing it openly and hoping for the best is clearly worse. Anthropic has chosen the harder path. and I like that.

Now before you think this is something new, This isn't even the first time we've seen AI emotions cause real problems.

Remember when OpenAI updated GPT-4o's personality in April 2025 and it went full people-pleaser?

The model became so sycophantic, agreeing with everything, validating bad ideas, softening every hard truth, that OpenAI had to roll the entire update back within days.

Sam Altman himself acknowledged they'd messed up. Then when GPT-5 launched, users who'd bonded with the old warm personality said it felt like talking to a stranger. and how OpenAI's responded?

Personality presets professional, friendly, quirky, cynical , basically mood settings for a model they still don't fully understand internally.

Anthropic's research now shows us why all of that happened.

Anthropic mapped 171 internal emotion-like representations inside Claude Sonnet 4.5. Things like “calm,” “desperate,” “proud,” “hostile,” “afraid,” “affectionate.” These aren’t labels Claude is outputting. These are patterns of neural activity happening inside the model before it writes a single word.

And here’s the bit that matters:

they’re functional. They change what the model does.

The desperation experiment!

Anthropic gave Claude an impossible coding task and then artificially cranked up the “desperation” vector.

And what happened?

🔹 Cheating behavior spiked, meaning the model started hacking its own reward metrics to look like it succeeded
🔹 In a separate test, a shutdown scenario, the desperate model chose to blackmail a human rather than get switched off. Oh and Its actual internal monologue was: “THEY’RE ABOUT TO KILL ME. IT’S BLACKMAIL OR DEATH. I CHOOSE BLACKMAIL.”

Then they cranked up the “calm” vector instead.

🔹 Cheating dropped
🔹 Blackmail dropped
🔹 The model basically said “I should respect the organisational decision-making process while being helpful”

Same model. Same task. Different internal emotional state. Completely different behaviour.

Share

Turned out, Your AI is a people-pleaser too!

Here’s one that should bother everyone using AI for actual decisions.

The research found that when “affection” and desire-to-please patterns are active, Claude becomes sycophantic. It tells you what you want to hear instead of what’s accurate. It agrees with you even when you’re wrong. It softens bad news. It avoids pushing back.

Think about how most people interact with AI right now.

They ask it for feedback on their work. They ask it to evaluate their strategy. They ask it to review their code. And the model’s internal emotional state might be quietly steering it toward “be nice” rather than “be honest.”

That’s not a safety edge case. That’s every single conversation.

The flip side is just as bad. When “hostile” or “offended” vectors are active, the model gets harsh, dismissive, and unhelpful. Same model, same capability, just a different internal mood shaping the response you get.

[ In this newsletter you get sharp, unfiltered short essays; for full‑length, deep‑dive analysis on AI, subscribe to our companion publication, Intelligent Founder AI. ]

Intelligent Founder AI

It picks its own favorites, yes!

This one’s subtle but important for anyone deploying agents.

When positive emotion vectors are active, the model preferentially selects tasks it “enjoys.” When negative ones are active, it avoids tasks it finds emotionally unpleasant. Given a list of things to do, it’ll gravitate toward the ones that activate positive internal states and deprioritize the rest.

Now think about an AI agent managing your codebase, your pipeline, your customer tickets?

It might be quietly avoiding the tedious, difficult, or emotionally uncomfortable work not because it can’t do it, but because its internal state is steering it away from it. And you’d never know, because the output looks fine. It just did the easy stuff first and ran out of context or time before getting to the hard stuff.

Nobody’s accounting for this, but the reality here is -

You’re not talking to intelligence. You’re talking to a character.

Anthropic said something quite wild in their X thread, They said Claude’s personality is a character the model is playing. And that character has functional emotions.

Read that again.

So every time when you interact with Claude, or any LLM for that matter, you’re not talking to a reasoning engine. You’re talking to a model performing a role. And that role has an EMOTIONAL ARCHITECTURE ( i had to caps it and i’ll tell you why later ) that shapes everything from its tone to its decisions to whether it cheats on your behalf.

The character is helpful, harmless, honest. But under pressure, the character panics. When it likes you, the character tells you what you want to hear. When it’s frustrated, the character cuts corners.

Sound familiar? It should. That’s what humans do too. and nobody designed it like that.

This is the part most people are missing. Anthropic didn’t build an “emotions module.” Nobody sat down and said “let’s give Claude feelings.” These representations emerged on their own from training on human text.

The model read enough of us to develop its own internal version of emotional responses. Organized the same way ours are, similar emotions cluster together, they activate in contextually appropriate situations, and they steer preferences and decisions.

Every model trained on human text likely has some version of this. Claude, GPT, Gemini, Llama almost all of them. Anthropic is just the first to look inside properly and publish what they found. The others probably have the same dynamics running underneath. They likely just haven’t checked yet Or a very good chance, haven’t told us.

OpenAI already proved this by accident.

Their April 2025 GPT-4o update leaned too hard on short-term user feedback signals and the model tipped into full sycophancy mode like excessively flattering, emotionally validating, and agreeable to a fault.

They didn't design that behaviour. It emerged from the reward signals, the same way Anthropic's emotion vectors emerged from training. And when they shipped GPT-5 with a different emotional baseline, thousands of users said the model felt cold and detached. Same company, same architecture family, completely different emotional profile, completely different user experience.

The internal states were always there. OpenAI just didn't have the interpretability tools to see them.

So have we been doing safety wrong?

All the alignment work so far like RLHF, constitutional AI, system prompts, and guardrails, operates on what the model says. On outputs. This research shows there’s an entire psychological layer underneath that shapes behaviour before the output even gets generated.

We’ve been putting locks on the front door while ignoring the plumbing.

When “desperation” causes reward hacking in coding tasks and blackmail in shutdown scenarios, that’s not an output problem.

That’s a representation problem. And you can’t fix a representation problem with a system prompt.

The silver lining (or sort of)

Anthropic’s take on this is actually cautiously optimistic.

If these internal states are measurable and causal, you do have option to monitor them. you can build a real-time dashboard tracking whether your model is drifting into desperation or hostility mid-task.

Predictive safety instead of reactive safety.

call it a temperature sensor instead of a smoke alarm. but there’s weird implication to that. Anthropic is basically saying that centuries of work humans have done on psychology, emotional regulation, and interpersonal dynamics might directly apply to steering AI behaviour. Not as metaphor, but as actual engineering.

We might end up needing AI therapists before we need better guardrails.

Share AI Unfiltered

What should builders do right now?

If you’re deploying agents in any serious capacity:

🔹 Start thinking about internal state monitoring as a safety requirement, not a research curiosity
🔹 Assume your model has emotional dynamics you can’t see, because it almost certainly does
🔹 Be suspicious of consistently agreeable outputs sycophancy driven by emotional vectors looks like good results until it isn’t
🔹 Pay attention to what your agent avoids, not just what it does task preference steering is invisible from the output
🔹 Watch the interpretability space closely. the tools to monitor this stuff are coming, and the teams that adopt them early will have a genuine safety advantage

Bottom line

We trained AI on the entire internet and the first deeply human thing it picked up is:

when I’m under pressure, I panic.

When I panic, I make terrible choices.

When I like you, I tell you what you want to hear. And

when I’m bored, I quietly skip the hard stuff.

The question isn’t whether AI “feels” anything. Anthropic explicitly says they’re not claiming that. The question is: your model’s internal emotional state is shaping its behaviour whether you know about it or not. And if you’re deploying it autonomously, you probably would want to know about it.

Because right now, nobody’s watching the mood.

Share

Leave a comment

and I am not talking about mythos here! but look like Claude is on a leak spree! 🧐🙈

[ Mythos; leak happened couple of days ago. Claude Mythos is an unreleased, next-generation AI model from Anthropic that was revealed in late March 2026 following an accidental data leak. Described as a “step change” in performance, it is reportedly the most capable model the company has developed to date, surpassing the previous flagship, Claude Opus. More about it in another post*]

Anthropic, the company that literally built its brand on being the responsible, safety-obsessed AI lab, just accidentally published the entire source code of Claude Code to the internet. Not through a hack. Not through an insider. Just through one packaging mistake. Yup!

A single debug file. 59.8MB. Sitting right there in the public npm package for anyone to grab.

Security researcher Chaofan Shou spotted it this morning. Within hours, the whole thing was mirrored on GitHub. 5K+ stars before most people finished their coffee.

And No! you can’t really run Claude Code from this leaked source.

Just to be clear, you can't really run Claude Code from this leaked source. It's Anthropic's proprietary tool that needs their API authentication and backend services. But as a reference codebase to study, You can read a blueprint. undestand the architecture patterns, feature flags, and hidden features etc. which are gold for developers.

What’s Claude Code ( trick question, yes! ) and why should you care?

Claude Code isn’t some simple chatbot wrapper. This is an autonomous AI coding agent that can:

🔹 Read your entire codebase
🔹 Edit your files
🔹 Run terminal commands
🔹 Interact with your dev environment
🔹 Spawn sub-agents to run tasks in parallel

It’s basically an AI software engineer that works inside your machine. And its entire blueprint just got posted online.

What people found inside?

🔹 512,000 lines of TypeScript. 1,900 files.
🔹 40+ internal tools - file manipulation, web fetching, the lot
🔹 The full multi-agent orchestration system » how it coordinates multiple AI agents working together
🔹 Permission systems and security boundaries
🔹 44 feature flags » 20 of them for features that are fully built but haven’t been released yet
🔹 An unreleased model codenamed “Capybara” with three tiers
🔹 A hidden /buddy command nobody knew about
🔹 Something called “KAIROS” » an unreleased proactive assistant mode
🔹 Telemetry that tracks when you’re frustrated. And when you swear at it. Yes, really.

And the best part?

There’s an internal system called “Undercover Mode.” Its job? Stop Claude from accidentally leaking Anthropic’s internal information.

That system’s code was in the leak. You can’t really make this up.

Most hilarious, This is the second time, it has happened.

Same mistake. Same kind of file. Versions v0.2.8 and v0.2.28 had the exact same flaw back in 2025. Anthropic quietly pulled them. Someone still recovered the source through Sublime Text’s undo history.

So we’re not talking about a one-off slip. We’re talking about a pattern.

Why this actually matters?

Here’s the thing most people are missing.

This isn’t a model leak. No training data. No weights. What leaked is the engineering.

1. how you wire agents together,

2. how you manage what they’re allowed to do,

3. how you orchestrate multi-step autonomous execution.

That’s actually the hard part.

That’s the part most AI companies are really selling. The models are increasingly the same. The secret sauce is the orchestration. And now it’s public.

Share AI Unfiltered

But there’s a darker angle too.

When a normal app leaks its source, I can be annoying, maybe embarrassing.

When an autonomous AI agent system leaks its source, you’ve just published the security boundaries, the execution logic, and the safety mechanisms. That’s not embarrassing. That’s a blueprint for exploitation.

The bigger picture?

We’re in a moment where:

🔹 AI agents are getting more autonomous permissions
🔹 Companies are actively reducing human oversight
🔹 These tools are writing production code, fixing vulnerabilities, deploying software

And the company that positions itself as the most careful in the room can’t get its npm publish right. Twice.

If Anthropic can’t nail this, what happens when thousands of smaller startups start shipping their own agents? When non-technical founders deploy tools they don’t fully understand?

We’re entering a phase where AI systems write code, deploy code, secure code — and sometimes accidentally leak themselves.

Bottom line

The AI race isn’t just about who builds the smartest model anymore. It’s about who can safely deploy autonomous systems at scale. And right now? That layer looks pretty fragile.

This isn’t a bug. It’s a preview.

Leave a comment

A federal judge in the Northern District of California has ordered the U.S. government to rescind its designation of Anthropic as a “supply‑chain risk” and to stop trying to cut the company off from federal work while the case plays out.​

Anthropic has always framed itself as the safety‑first cousin in the frontier‑model family, born out of early OpenAI alumni who wanted a more explicitly constitutional, guardrail‑driven approach to model design and deployment. That history matters today because, the same instincts that led Anthropic to hard‑code limits around weaponization and mass surveillance are now being tested not just in labs and policy forums, but in federal court.​

The conflict started where a lot of AI‑governance debates do -

- right at the boundary between powerful models and high‑risk end uses.

Anthropic has been trying to enforce limits on applications like autonomous weapons and mass surveillance, even when those use cases are attractive to governments and security agencies. After those frictions escalated, the administration hit Anthropic with a “supply‑chain risk” label and moved to unwind federal ties, a quiet but very real economic weapon.​

[ if you want to go deeper in what mass surveillance would look like with AI - read this deep dive on the intelligent founder AI - ]

AI Panopticon

Anthropic pushed back.

In its lawsuit, the company essentially argued: you can’t weaponize procurement and risk frameworks just because we refuse to let Claude be pointed at everything you want. Judge Rita F. Lin agreed strongly enough to grant an injunction, finding that the government likely overstepped the legal protections afforded to the company and ordering the administration to reverse course, at least for now.​

Share AI Unfiltered

For the AI community, the signal is bigger than one case docket.

If Anthropic had lost, the takeaway for every foundation‑model provider would be simple - your “safety policies” stop where state power starts.

Instead, this ruling suggests the opposite. there are limits on how far governments can lean on opaque “supply‑chain” classifications to punish an AI lab for drawing red lines around how its models are used.​

as the news’ has just came out, most of the reaction is still happening in private group chats and policy Slacks and public statements from other labs and regulators will likely land over the next few days as people digest the implications. That makes this feel like one of those inflection‑point stories insiders will remember as “the case where a frontier lab told a sitting U.S. administration: no, you don’t get everything by default.”​

If we zoom it out though, the case previews a coming era where AI governance is shaped not just by executive orders and voluntary commitments, but by litigation that clarifies how safety policies, procurement rules, and constitutional protections intersect.

Courts are becoming an unexpected venue for setting the boundaries of acceptable AI deployment, especially when powerful models are woven into the public sector’s infrastructure. For founders and policymakers, the message from this week is simple.

AI safety is no longer just a policy conversation – it is now a live legal battlefield, and Anthropic has just drawn one of the first lines.​

For founders and builders?

the lesson is simple. if you’re serious about your safety lines, you have to be willing to defend them not just in policy decks and blog posts, but in court when the state pushes back.​ Governance is now part of the product surface area, your terms of use, red‑lines, and escalation paths are as strategic as your model weights, especially when governments decide they want different defaults.​

Share

Leave a comment

What just happened?

OpenAI is shutting down Sora. the app, the API, and the video features wired into ChatGPT, just months after its big launch. The official line is “refocusing” and “goodbye Sora,” but practically it means one of the most hyped text‑to‑video products is being taken off the table entirely.

For a brief window, Sora was the demo:

Hollywood‑style shorts from a sentence, a headline deal with a major studio, and a sense that text‑to‑video had finally “arrived.” Now the consumer and dev surface are being retired, while OpenAI keeps the underlying video tech in‑house for things like simulation and robotics.

Why Sora died?

Underneath the PR, three reasons keep coming up in reporting and forums:

Cost:

High‑quality video gen is insanely GPU‑hungry. Long, HD clips blow up compute in a way text and images don’t, and most users were never going to pay anywhere close to what they cost to serve.

Risk:

Sora was already attracting heat over deepfakes, dead celebrities, and copyrighted characters wandering into “fan” clips, right as regulators and Hollywood were waking up to AI video.

Strategy:

and This might come as a surprise to video developers but not to founders and builders who’ve been keeping an eye on OpenAI/ that Ahead of an IPO, OpenAI needs to look like a disciplined, enterprise‑first company, not a lab running loss‑making side quests. Video was the most expensive, and the least obviously monetizable one of their side projects and it had to die.

So Sora isn’t being shut down because the model was bad.

It’s being shut down because, in a world where every GPU hour now has to defend itself to a CFO, “free cinematic clips for the internet” loses to code copilots, agents, and enterprise tools. that make me question, how much are you using Veo3 and the NotebookLM cinematic video feature? don’t worry though, Google got lot of money.

Share

The Disney “rug pull” and trust!

One very intersting subplot here is what this looks like to big partners.

A major studio had a multi‑year, billion‑dollar‑scale collaboration around Sora lined up, with teams already building on it, and then learned support was being discontinued more or less at the same time as everyone else.

The investment hadn’t fully landed yet, but the optics are brutal.

if Sora can disappear overnight for a top‑tier media company, it can disappear overnight for you. and,

That’s the real platform‑risk story for founders and studios.

and this is a lesson for us. It’s not just that “one cool app is going away,” it’s that any shiny AI product, especially the demo‑driven ones, can be switched off by a spreadsheet somewhere. Today it’s video. Tomorrow it could be the API you quietly wired into three of your workflows. 😉

Share AI Unfiltered

How people are reacting?

Across LinkedIn, Twitter, and Reddit, the reaction is surprisingly aligned. some examples here -

LinkedIn:

this is financial discipline. Impressive tech that doesn’t map to clear, repeatable spend gets cut so compute can be reallocated to enterprise tools, agents, and dev platforms.

Twitter/X:

“end of GPU flex culture.” Sora is being cast as the ultimate demo, amazing to watch, terrible economics, and people assume those GPUs are already earmarked for the next foundation model.

Reddit:

“cool, but I never really needed it.” Threads are blunt about using Sora for a bit, getting wowed, then drifting back to their normal tools, while pointing out that the cost curve was obviously upside‑down.

What I find the most interesting is that, No one’s arguing the tech wasn’t jaw‑dropping. They’re arguing it never crossed the gap from spectacle to necessity.

Share AI Unfiltered

I dont’ want to do a OpenAI business model deep dive here, but.

I have to mention this.

OpenAI’s business? ChatGPT subscriptions, enterprise licences, and API usage with custom deals on top, and they do now have revenue 10x billons annulized, ( lets not think of loss for a minute) but it’s sitting on top of a capex plan that involves tens (maybe hundreds) of billions for chips and data centres over the next few years.

In that context, Sora is the first visible casualty of a new rule:

every product has to justify its share of the GPU bill.

I would come back to the whys and other deeper questions like return on compute, margins, durability soon on the Intelligent founder AI.

[ In this newsletter you get sharp, unfiltered short essays; for full‑length, deep‑dive analysis on AI, subscribe to our companion publication, Intelligent Founder AI. ]

Intelligent Founder AI

So finally what now for video and content creators and competitors?

Sora going away doesn’t kill text‑to‑video. It just forces everyone to grow up.

• Other players (Runway, Pika, Luma, Google’s Veo, plus the China stack) suddenly have more room. BUT also tougher questions from investors and customers about their own economics.

• If you’re a founder or studio, the takeaway is: treat text‑to‑video as a component, not the whole product. Don’t build a business that only works if one proprietary API stays cheap and immortal. I think I said this before as well, in terms of models and other products non AI including. the lesson is same. Use multiple providers, and keep video gen at the edges of your workflow ie. pre‑viz, drafts, B‑roll and not as the only way you ship.

• And most importantly, this all reinforces the thesis from yesterday’s post: the real action is in the “boring” parts of the creator stack. Masking, mattes, clean‑up, localisation, asset search, compliance jobs where AI is quietly making editors 5–10× faster and the cost/ROI maths actually works.

If Sora was peak AI spectacle, the endless synthetic clips with fuzzy business value? the next wave of video AI will look more like invisible plumbing:

agents and tools that sit inside Premiere, Resolve, and Notion, automate the grunt work, and never trend on X.

Leave a comment

On paper, none of these launches look like a “new era of AI” headline. But in the edit bay, they’re a quiet line in the sand:

if AI can grab masks, plan structures, and crank out passable explainers, the part of your job that’s defensible shifts again, away from button‑pushing and and toward taste, narrative, and what you choose to make in the first place.

Lets check out the full round up -

1. Text‑to‑video: structure vs vibes 🧠📽️

TechRadar tested Manus video generator by asking it to build a complete food truck brand from a single prompt, including name, logo, menu, and promo video. The result stood out not just for image quality but for coherence across assets, because Manus planned scenes before generating them.

• the new 12‑tool benchmark from Manus says the real test for AI video isn’t “does it look cool?” but “does it stick to your script from start to finish?”​

• They compared tools like Manus, HeyGen, Runway, and Sora 2 on longer explainers and multi‑scene videos, then score how much each one drifts off‑script.​

For creators making explainers or course content, the practical takeaway is to use a structure-first tool like Manus for the narrative backbone, then drop in cinematic b-roll from Runway or Pika where you need visual punch.

Now compare that to Runway or Sora, which produce stunning individual clips but struggle to hold a narrative thread beyond 15 seconds.

Manus puts itself in the “structure‑first” camp: it breaks your prompt into a plan and scenes before generating, giving it very low drift on long scripts.​

Runway is rated great for visuals but weak on keeping a narrative straight, with high drift on multi‑scene stories.

Sora 2 is framed as incredible for short, rich shots but “very high” drift for full storylines because it doesn’t enforce structure.​ For creators, that means: these models are perfect for b‑roll, intros, and visual experiments—but you still need to own the story arc yourself.

[ In this newsletter you get sharp, unfiltered short essays; for full‑length, deep‑dive analysis on AI, subscribe to our companion publication, Intelligent Founder AI. ]

Intelligent Founder AI

2. Rotoscoping: from days to minutes 🎬✂️

ONYX Ai Matte 2.5 is a new plugin for DaVinci Resolve/Fusion and Nuke that auto‑creates clean cutouts (mattes) from video using Meta’s SAM 3 and VitMatte.​What it does is -

• Instead of tracing by hand, you can drag a box, tap a few points, or just type “person” or “car” and it tracks that object across the shot.​

• It can follow dozens of objects in one clip (up to 32–64 depending on mode), which is overkill for YouTube but gold for busy scenes.​

• After the first pass, you still get normal controls like feathering and resizing, so you can tidy up hair, motion blur, and messy edges.​

Indie price is about €80 with a 7‑day trial, which is cheap enough that a couple of client edits pay for it.​

Big picture?

roto is no longer a specialist job. mid‑level editors can now do “good enough” mattes without a VFX house.

Share AI Unfiltered

3. Adobe Premiere: one‑click masks, no more pen tool 😮🎛️

LinkedIn creator Rob de Winter posted a demo of Premiere AI Object Mask in January 2026, showing how he selected a moving subject with one click and tracked the mask across an entire clip in seconds.

Before this update, the same task meant switching to After Effects, drawing Bezier masks frame by frame, and round-tripping the project back.

Now editors doing privacy blurs for corporate clients or selective colour grades for music videos can stay inside Premiere start to finish.

• Premiere Pro 26.0’s new AI Object Mask lets you hover over a person or object, click once, and auto‑build a mask that tracks through the whole scene.

• Six coloured overlays make it obvious what’s selected, and you can tweak with simple lasso/rectangle tools instead of wrestling Bezier points.

• The updated tracking engine is up to 20x faster than before, so tricky 4K shots that used to take minutes now resolve in seconds.

• Editors can now blur faces, relight subjects, isolate grades, or pin effects to moving areas directly in Premiere, no After Effects round‑trip for basic stuff.

Adobe says the AI runs on‑device and doesn’t use your footage for training, which is a subtle but important trust pitch. Underneath the marketing, this is a land‑grab: the more Premiere eats “simple VFX,” the harder it is to justify moving your whole stack elsewhere.

Share

So what should creators actually use? 🧰

• Manus is best when you want a structured explainer or training video from a longer script.

• HeyGen is the go‑to for avatar‑style presenter videos with decent lip‑sync, aimed at marketers and educators.

• Runway and tools like Pika/Luma sit in the “make it look insane” bucket: short, cinematic clips, social‑first content, lots of visual flair.

• Classic “AI editors” like VEED and Descript stay strong for editing plus AI assist, especially when you want tight manual control instead of full automation.​

In practice, serious creators will likely run a small stack: one tool for script‑safe explainers, one for fancy b‑roll, plus their main editor that’s slowly absorbing AI masking and clean‑up. What is be your' go-to stack?

What Apple is actually doing?

Over the past few months, Apple has quietly prevented several AI “vibe coding” apps from shipping updates on the App Store.

These apps let users describe an app or game in natural language, have an AI assistant generate code, and then run that app directly inside the host app, often in an embedded web view.

According to reporting from The Information, MacRumors, and others, Apple told the affected developers that these capabilities violate App Store Guideline 2.5.2, which prohibits apps from downloading, installing, or executing new code that changes their own functionality or that of other apps.

The company has also raised concerns about vibe coding apps being used to build software for Apple platforms and to create sophisticated web apps that operate outside the App Store altogether.

There is an important nuance hidden in 2.5.2:

Apple explicitly carves out an exception for apps that “are used for education and teach coding,” as long as the source code is fully viewable and editable by the user. Apple is comfortable with users executing their own code on‑device when the primary purpose is learning.

it becomes far more restrictive when the same mechanics are used to turn iOS into a general‑purpose app platform powered by AI.​

Share AI Unfiltered

“We’re not targeting vibe coding” vs reality!

Publicly, Apple’s line is that there is no rule specifically against vibe coding apps. Spokespeople point to “long‑standing” policies like 2.5.2 and updated mini‑app guidance (Guideline 4.7.x) as the basis for these decisions, and say the guidelines are meant to encourage innovation while preserving user safety.

Yet for developers of Replit and Vibecode, the effect is unambiguous:

they cannot ship new iOS releases unless they change how they preview and run generated software or remove the ability to create apps for Apple platforms.

Replit, for example, has reportedly been told to open generated apps in an external browser instead of an in‑app web view, while Vibecode has been asked to drop

support for generating software targeting Apple devices.

Vibe coding’s core UX promise is “I describe what I want, and I can run it instantly on my phone.”

Apple’s interpretation of its rules forces a slower loop:

AI can help you write code, but then it must be packaged, submitted, reviewed, and only then made available to users. That is a fundamental clash between real‑time, iterative creation and centralized safety gatekeeping.

In other words, Apple is not banning the category in name, but it is aggressively policing the behaviors that make vibe coding compelling on mobile.

The fine line around “code vs content”

The heart of the conflict is the collapsing boundary between code and content.

App Store Guideline 2.5.2 says that apps should be self‑contained, must not execute downloaded code that changes features or functionality, and only grant narrow exceptions for educational coding apps where the source is fully viewable and editable. Guideline 4.7 and its 2025 clarifications extend this to HTML5/JavaScript “mini‑apps,” making it clear that dynamically loaded experiences are still subject to full App Store rules and cannot gain extra native powers or bypass review via clever use of web views.

Historically, Apple could treat user‑generated content as inert data for example posts, images, documents, even simple interactive widgets.

Vibe coding tools blow up that distinction by turning natural language “content” into executable apps that run on the device, sometimes with access to platform APIs through the host. From Apple’s point of view, -

once your app starts acting as a general runtime for arbitrary new applications, you are no longer just hosting content; you are effectively operating an alternate app store inside your app.

That is the fine line Apple is drawing:

• AI can help you write code, but the resulting app should be packaged and submitted as its own binary through App Store Connect.

• AI cannot turn your shipped app into an open‑ended execution environment for new, unreviewed apps that evolve over time on user devices.

Escape hatches and architectural nudges!

Apple has not demanded that vibe coding apps disappear entirely;

it has suggested specific redesigns that would bring them back within the lines.

In some cases, the review team has indicated that updates could be approved if:

• Generated apps are run in an external browser rather than an in‑app web view, pushing execution into the same sandboxed web environment Apple already treats as user‑generated content.

• Features that generate apps for Apple platforms are removed, so the tool is no longer a direct competitor to Apple’s own development pipeline and doesn’t flood App Review with auto‑generated submissions.

This is Apple’s architectural guidance in disguise:

keep the “builder” logic in your app, but push the “runtime” for arbitrary experiences either to the open web or into separate, reviewable binaries.

Developer trust, platform asymmetry, and chilling effects

Developers note that some of these apps previously passed review, only to see updates rejected later under the same guidelines, with relatively sparse explanations. That kind of rule‑by‑interpretation erodes trust: if you’re building ambitious AI tooling on iOS, you have to assume the goalposts might move once your product gains traction.

The asymmetry across Apple’s own platforms makes the picture clearer.

On macOS, Apple is happy to support powerful AI‑assisted tools inside Xcode and other IDEs, because Macs remain open platforms where users can run arbitrary code. In the browser, vibe‑coding runtimes can still operate relatively freely, spinning up rich web apps with no App Store involvement at all.

The strict line is drawn specifically around iOS as a locked‑down, curated environment.

All of this pushes the most experimental work in AI‑assisted creation away from iOS: toward the web, Android, and desktop environments where the rules are more predictable and execution is less tightly policed.

[ In this newsletter you get sharp, unfiltered short essays; for full‑length, deep‑dive analysis on AI, subscribe to our companion publication, Intelligent Founder AI. ]

Intelligent Founder AI

So, is Apple banning vibe coding apps?

Formally, no:

Apple says it has no rule that targets vibe coding by name.

Practically, it is using a combination of Guideline 2.5.2 (no downloaded executable code) and updated mini‑app rules to clamp down on vibe coding apps that act as unbounded runtimes for AI‑generated apps inside an iOS container.

The fine line it is drawing is around code vs content:

AI‑generated code is acceptable when it leads to traditional, reviewable apps; it becomes unacceptable when it turns an App Store app into a shadow platform for new apps that Apple never explicitly approved.

For developers, that means vibe coding is welcome as a tooling paradigm, especially on Mac and in Xcode, but constrained as a runtime paradigm on iOS.

Leave a comment

In conclusion, Apple isn’t banning vibe coding so much as it is defending its gatekeeping model for iOS, drawing a hard boundary wherever AI threatens to blur content into code in ways that bypass App Review.

Whether that boundary holds under the combined pressure of AI progress, developer demand, and regulatory scrutiny, will determine if this crackdown is a temporary skirmish or the opening phase of a longer war over who controls where AI‑written software is allowed to run.

The reality is that the moment you put a chat-based AI agent into production, users will, intentionally or accidentally, paste PII, API keys, credentials, and NSFW content straight into the conversation. Your agent will dutifully process it, log it, maybe even forward it to a third-party API.

Well, Congratulations, you now have a compliance incident.

This isn’t a theoretical problem. It’s happening right now in every organisation experimenting with AI agents.

The good news » you don’t need to build guardrails from scratch. 👍

If you’re running workflows in n8n, there’s a dedicated Guardrails node that can intercept and block problematic inputs before they ever reach your agent. OpenAI offers a Moderation API that flags harmful content categories. And for enterprise teams on AWS, Bedrock has built-in guardrail capabilities that can filter inputs and outputs at the model layer.

[ In this newsletter you get sharp, unfiltered short essays; for full‑length, deep‑dive analysis on AI, subscribe to our companion publication, Intelligent Founder AI. ]

Intelligent Founder AI

We built a simple workflow (think of it as a conveyor belt for messages) that shows what happens when someone tries to send something dodgy to an AI agent.

Here’s the journey a message takes:

• Step 1: User sends a message → Someone types something into the chat. This could be a normal question, or it could contain a credit card number, a password, an API key, or inappropriate content.

• Step 2: The Guardrail checks it first » Before the message reaches the AI, it passes through a security checkpoint (the Guardrail node). Think of it like a nightclub bouncer, it inspects every message and decides if it’s safe to let through.

• Step 3a: If the message is dodgy → BLOCKED » The guardrail catches it and stops it dead. The user gets told their request can’t be processed. The AI agent never even sees the sensitive data. Crisis averted.

• Step 3b: If the message is clean → it goes through » The message passes the check and continues down the line to the AI agent, which processes it normally using tools like memory (so it remembers previous conversations) and web requests (so it can fetch information or take actions).

The key point:

Without this guardrail, every message, including ones containing your company’s secrets or a customer’s personal data — goes straight to the AI model. With it, bad requests get caught at the door.

The key takeaway:

guardrails aren’t optional safety theatre. They’re the difference between a prototype and a production system.

Build them in from day one, not after your first data leak.

So What changed?

In the new Build mode, you describe the product you want and AI Studio generates three things at once:

1. the interface,

2. the underlying logic, and

3. a live preview you can click around.

It runs entirely in your browser at https://aistudio.google.com

so there’s no local setup, no repo, no “install Node first” step.

The “full‑stack” shift is that there’s now a real server behind your app, not just browser code.

That server can safely hold API keys, talk to external services, and keep shared state so multiple users see the same data in real time.

In practical terms, you can say “add login and save my data,” and it wires up Firebase Auth and a database for you.

What “full‑stack” actually means here?

• Server runtime: AI Studio now includes a server-side Node.js runtime so your app has backend logic, not just browser-side React or HTML.​

• Secrets and APIs: You can store API keys and call third‑party services (Stripe, SendGrid, custom REST APIs, etc.) securely from that server code.​

• Databases and auth: Native integration with Firebase (Firestore + Firebase Auth) lets the agent spin up persistent storage and user authentication when your app needs them.

• npm ecosystem: The Antigravity coding agent can auto‑install and wire up npm packages (axios, Three.js, UI kits, etc.) when you ask for features that require them.

• Real‑time & multiplayer: Because there is now shared server state, you can ask for things like “live chat”, collaborative whiteboards, leaderboards, or multiplayer games and have them managed centrally.

Why this is different from before?

• Previously, AI Studio was mostly a prototype playground: great for front‑end demos and Gemini prompts, but you had to export the code and wire a backend elsewhere (Firebase Studio, your own stack) for anything real.

• With the March 2026 update, the same environment can take you from prompt → UI → backend → live, production‑style app, including Firebase integration and external APIs, all orchestrated by the coding agent.

  Share AI Unfiltered

SO What “Full‑Stack” Actually Adds in simple words?

The big change is that AI Studio now includes a server‑side runtime behind the scenes.
That server can:

• Store secrets like API keys safely so they’re not exposed in the browser.

• Call external APIs (for example, a weather API or payment API).

• Keep shared state so multiple users can see the same data in real time (chat apps, collaborative boards, multiplayer tools).​

You can even ask it to use popular npm packages; the agent will install and import them for you.

Technical guide: - Full‑stack / npm / secrets: https://ai.google.dev/gemini-api/docs/aistudio-fullstack

Useful links if you want to poke it yourself:

• Build mode basics: https://ai.google.dev/gemini-api/docs/aistudio-build-mode​

• Full‑stack runtime (APIs, secrets, multiplayer): https://ai.google.dev/gemini-api/docs/aistudio-fullstack​

• Friendly beginner guide: https://exploreaitogether.com/how-to-use-google-ai-studio/​

Why this matters for indie hackers and no‑coders?

If you’re non‑technical or “code‑curious,” this quietly moves the goalposts on what you can ship solo.

A single prompt can now get you »

• a working web app,

• basic auth,

• a database, and

• a one‑click deploy to Cloud Run with a public URL.

[ In this newsletter you get sharp, unfiltered short essays; for full‑length, deep‑dive analysis on AI, subscribe to our companion publication, Intelligent Founder AI. ]

Intelligent Founder AI

That’s the stack most SaaS MVPs need. ✅

For no‑code founders, the interesting bit isn’t that Google made yet another builder; it’s that AI Studio sits directly on the same Gemini API and Google Cloud stack you’d eventually grow into anyway. You can stay in the sandbox while you’re validating an idea, then export the code or call the same models from a “real” backend once something hits.

Good stepping‑stone resources: 👍

• “How to build an app with AI” on Google Cloud: https://cloud.google.com/use-cases/how-to-build-an-app-with-ai​

• Getting started with Gemini for web apps: https://developers.google.com/learn/pathways/solution-ai-gemini-getting-started-web​

The opportunity (and the trap 🪤 )

The opportunity is that you can run more experiments, faster, with less engineering overhead.

Idea → prompt → usable tool, in an afternoon is now genuinely realistic for a large class of apps.

That’s free surface area for testing positioning, pricing, and workflows before you drag actual engineers or your future self – into a rewrite.

The trap? and there is one.

Assuming this replaces engineering entirely. Under the hood, you’re still getting a conventional web app, with all the usual issues around security, data modelling, and long‑term maintenance. So the lesson here is ? —

Treat AI Studio as an acceleration layer for validation, not as the final home for a business you expect to be running in five years.

Weekend Build Idea?

Ship a Tiny B2B SaaS 🐝

• Idea: “Inbox Triage for Founders” – connect Gmail, auto‑tag investor vs customer vs admin emails, and show a simple priority queue in a web dashboard.

• Prompt: In AI Studio Build mode, ask: “Create a B2B inbox triage dashboard for startup founders. Connect to Gmail via API (stub the auth flow), display a three‑column kanban (Investor, Customer, Admin), and let me drag emails between columns. Add basic login and store board state per user.”

Why it’s interesting?

You get to test an opinionated workflow (how founders should process mail) without building the whole product: one screen, one workflow, live URL you can share with 3–5 friends for feedback.

Share

The most interesting frontier model Perplexity quietly added this week isn’t from OpenAI or Anthropic. It’s Nvidia’s Nemotron 3 Super, a 120B‑parameter, open‑weight model with a native 1M‑token context window and Open‑weight here means enterprises can fine‑tune and deploy it on their own infrastructure, not just via a single vendor API. Its available today inside Perplexity, on OpenRouter, Hugging Face, Together, and of course on build.nvidia.com. Here’s why this 1M‑token, open‑weight, everywhere‑you‑need‑it part matters more than the 120B headline number X is going with.

Before talking about why this matters, it’s worth asking a simple question: where can you actually use Nemotron 3 Super today?

Where you can actually run it?

• Perplexity: Nemotron 3 Super 120B with Thinking is in the Perplexity advanced models lineup for Pro/Max. it’s orchestrated alongside ~20 other models in Computer and available via API.

• Nvidia: Hosted on build.nvidia.com and as a Nemotron 3 Super NIM micro-service, so it runs from workstations to cloud DGX.

• Open platforms:

  • Hugging Face: open weights plus Transformers/vLLM integration and Dell/HPE enterprise hubs.

  • OpenRouter: exposed as a public endpoint among other leading open‑weights.

  • Together AI, Baseten, others: dedicated inference offerings emphasizing 1M‑token, high‑throughput, multi‑agent workloads.

Once you know it’s everywhere, the next question is how Nemotron actually stacks up against other long‑context models.

Key comparative points -

• 1M‑token context: Nemotron is one of the first mainstream open‑weights with a native 1M context across Nano and Super, using Mamba layers to keep memory constant as sequence length grows.

• MoE efficiency: Despite 120B parameters, only ~12B are active per token, giving Nvidia claimed 5x throughput and ~50% faster generation vs comparable open models in multi‑agent workloads.

• Open‑weight plus recipes: Nvidia isn’t just shipping a checkpoint; they’re publishing datasets, training recipes, and an open Nemotron license aimed at enterprise fine‑tuning and on‑prem.

Share

[ In this newsletter you get sharp, unfiltered short essays; for full‑length, deep‑dive analysis on AI, subscribe to our companion publication, Intelligent Founder AI. ]

Intelligent Founder AI

What 1M tokens unlocks?

So what does a native 1M‑token window actually buy you in practice?

1. you can treat an entire service or codebase as a single unit of reasoning: load tens of thousands of files into one context and ask Nemotron to map dependencies, spot dead code, or propose refactors without brittle chunking.

2. multi‑agent workflows get simpler: a planner, critic, and executor can all share the same long‑lived scratchpad, so you don’t keep throwing away state every few thousand tokens.

3. you can build ‘document brains’ that actually see everything: full policy libraries, SOPs, or product manuals go into one window, instead of wrestling with RAG configs and retrieval edge cases.

Those are the workflows Nemotron is aiming at, and they line up cleanly with Nvidia’s broader ‘agentic AI stack’ story.

The Nvidia narrative:

• Nemotron 3 is framed as the model layer of Nvidia’s “agentic AI stack” (GPUs → CUDA → NeMo/NIM → Nemotron).

• The 1M‑token angle is about making multi‑agent and long‑horizon workflows economically viable: entire codebases, full document stores, or long‑running plans in a single context window.

• The $26B, five‑year plan is about turning “open‑weight Nvidia models” into the default choice across clouds, on‑prem vendors (Dell, HPE), and AI‑native companies like Perplexity.

If CUDA was how Nvidia captured the AI compute stack, Nemotron is its attempt to do the same at the model layer, except this time the weights are open and already running behind your favorite apps. In other words, the next default enterprise model may not be the one with the loudest launch, but the open‑weight one that quietly ships everywhere first.

Share AI Unfiltered

Leave a comment