Pause and consider all this for a lingering moment: the militant engineering culture, the all-consuming work identity, the apostolic sense of devotion to a great cause. The cynics will read statements from Zuckerberg or some other senior exec about creating “a more open and connected world” and think, “Oh, what sentimental drivel.”

The critics will read of a new product tweak or partnership, and think Facebook is doing it only to make more money. They’re wrong. Facebook is full of true believers who really, really, really are not doing it for the money, and really, really will not stop until every man, woman, and child on earth is staring into a blue-framed window with a Facebook logo. Which, if you think about it, is much scarier than simple greed.

The greedy man can always be bought at some price or another, and his behavior is predictable. But the true zealot? He can’t be had at any price, and there’s no telling what his mad visions will have him and his followers do. That’s what we’re talking about with Mark Elliot Zuckerberg and the company he created.

Martinez, Antonio Garcia. Chaos Monkeys: Obscene Fortune and Random Failure in Silicon Valley (pp. 285-286). (Function). Kindle Edition.

It's easy to forget how influential Meta was in tech between 2010 and 2020.

Over that period, the company built what was largely considered the best paid and most competent engineering team in the industry, captured a significant share of the world’s eyeballs (and the ad dollars behind them), and positioned itself to do essentially whatever it wanted in the 2020s.

The first attempt at redefining the company was around virtual reality, hence the rebrand to Meta (short for the metaverse). This was a complete flop, as the timing was off by 10 to 15 years.

The second pivot is toward becoming one of the key players in the AI era. After a strong early start with the release of the open-source model family Llama, the company failed to deliver a meaningful new model release for almost two years, until Spark 1.1.

While it's easy to write them off, at a time when compute and sheer force of will are critical to succeeding in AI, Zuckerberg is clearly not quitting, and unlike Google, he is redirecting all of his capital and manpower into turning Meta into a meaningful player in the space.

We are fortunate to live at an incredible moment in history. In the next few years, people will be able to use superintelligence beyond human capacity to create and discover extraordinary new things, build new businesses, express our ideas, learn new concepts, and improve our lives, health, relationships and careers.

The defining question of our age isn’t whether superintelligence will exist, but who will have access to it. Will it be centralized and restricted to a few institutions, or will it be a tool that empowers everyone?

I propose a philosophy based on individual empowerment as the source of prosperity, invention as the primary purpose of superintelligence, and balance of power as the foundation of safety.

It's also clear that for him, this pivot means a lot more than simply protecting his bottom line.

The key takeaway

For tech sales and industry operators: Meta stepped into infrastructure software this quarter, and Zuckerberg conceded on the call that selling to enterprises is a muscle his company has yet to build. The goal is to offer agents and coding models to enterprise customers while ideally avoiding having to sell raw compute. Where they can lean on existing distribution, such as selling customer care agents that provide support across Facebook, Instagram, and WhatsApp, they clearly have an advantage. The problem is that making the jump and competing directly against OpenAI and Anthropic in the same accounts will be very difficult, and the existing teams are poorly prepared for a different kind of sales cycle and buying audience. Still, if they build out a new AI enterprise sales team and find meaningful product-market fit, this could be one of the best “new companies” to sell for in years.

For investors and founders: Meta from its late 2022 bottom through 2025 was a legendary contrarian bet, delivering an 8x return, while 2025 into 2026 has been less impressive. Alphabet, its direct competitor, may end up falling behind on ad revenue by the end of the year while remaining absent from agentic coding, yet none of that widening gap shows up in Meta's stock price. The market does not believe the investment Mark has made can realistically be recouped unless Meta pivots toward a neocloud-style business model. The counterargument is that Meta's AI revenue today is ads, full stop, and the ad engine already pays for the buildout, with ranking and targeting advances lifting clicks 8.3% and conversions 15.7% on Facebook this quarter. The capex cycle storyline is tracking the archetype, where cheap capital and mimetic investment precede a shakeout that hands assets to the strongest balance sheets. If we were making a VC-style bet, this would be framed as an underdog going after a massive market opportunity, relying on exceptional motivation and skill. Until the enterprise motion produces revenue, the skill remains unproven.

Subversive hackery

Mark Zuckerberg: We had a strong quarter for our community and business with 3.6 billion people using at least one of our apps each day. We reached several milestones. Instagram reached 2 billion daily actives. Threads crossed 500 million monthly actives, making it the fastest growing conversation app ever. Facebook has reached more than 2 billion daily actives for a while now. WhatsApp just hit an all-time messaging record, peaking at 30 million messages sent per second during the World Cup Final. And also, Kunal Shah just joined as our new head of WhatsApp. He built one of India's most important payment companies and will be a great addition to the team. We also shipped some strong new models from Meta Superintelligence Labs and released new glasses. Overall, the scale and reach of our community across our apps is pretty remarkable, and it gives us a strong platform for delivering new innovations to billions of people.

The opportunity in front of us is massive.

First, we are now at a point where our investments in AI are accelerating every major part of our core business. They're improving the experience for people using our apps, driving better performance for advertisers, and helping our teams build new experiences and ship faster.

Second, we're developing new personal agents that will be the foundation for our next wave of products and revenue lines in the months and years ahead.

Third, we see a large enterprise opportunity to sell to businesses, including APIs, business agents, potentially selling compute directly, and other services that we're building for large customers. I want to spend some time today laying out exactly how our investments are delivering results today and the opportunities that we see over time.

As we take an analytical approach to the Meta business, it's important to understand where they are today and what the actual cloud infrastructure software pivot behind their AI push really is.

Mark Zuckerberg: For accelerating our core business, we're seeing strong and promising results in several areas. In Instagram and Facebook, I'm very optimistic about our work to integrate large language models into our recommendation systems. LLMs add a first-principles understanding of what the content is about and why it is compelling, as well as a deeper understanding of what people are interested in and what their goals are when they're using our apps. This means that we can show more relevant and engaging content that better reflects people's goals and interests.

Our new Muse Image and Muse Video models will also dramatically expand the universe of content that people can discover across our platforms. There are already two large sets of content to draw from -- first from your friends and the people you follow, and second from creators that you don't follow -- but now there is going to be a whole new and nearly infinite universe of personalized content. This is going to make our services a lot more useful and engaging for people.

For ads, we are using LLMs to improve how our systems predict and rank the ads that we show. We've expanded the context that we can take into account around a person's organic and ads activity to determine an ad's relevance, driving significant increases in relevance and conversions on both Facebook and Instagram. On a dollar basis, our ads business is reporting faster year-overyear revenue growth than any other company's reported ad business -- so these AI investments are paying off.

We are also seeing a lot of demand for our new AI-powered creative tools. 9 million small businesses on our platforms are now using at least one of our AI ad creative tools, and we're rolling out new end-to-end creative solutions that help advertisers translate performance data into their creative decisions. Muse Image is going to supercharge this. The model can analyze images, improve its own work, and produce better ad variations based on advertiser input. We're getting great feedback on this so far.

We also just launched Meta One, a new subscription offering that provides more tools and AI features across our apps. As demand grows, we're going to offer a variety of different tiers and pricing options there as well.

I'm also excited about how AI is helping our teams speed up product development. Earlier this year we shipped Instagram Instants. We also just launched Forum, a standalone Groups app, and Seller, a standalone Marketplace app. And I expect it to become a lot easier to ship new apps, so we're planning to build out more ideas and use our recommendation systems to scale them to the people who will find them interesting, as we've done with Threads.

Today, Google and Meta generate a similar amount of revenue from ads. While Alphabet is larger (since we need to account for the extended services business and GCP), when it comes to ads, there is parity. It's not surprising that many of Meta's strategies follow a similar product path to what we've seen from Google.

Mark Zuckerberg: It's been a little more than a year since we launched Meta Superintelligence Labs and our trajectory is strong. In the last month we shipped Muse Spark 1.1 and Muse Image. Since we rebuilt Meta AI and integrated Muse Spark, we've seen a 60% increase in the number of people interacting with the assistant each day and that continues to grow quickly week-over-week.

Muse Spark 1.1 is a strong agentic and coding model that is very efficient and excels at computer use, tool use, and multimodal understanding. It's available through our new public API, and we're ramping up distribution through partner channels and more coding agents over the coming weeks. We're also building out features to make it easier for enterprises to adopt Muse Spark and that is an area that we expect to continue focusing on.

One reason we're so focused on making Muse Spark great at agentic capabilities is that we think there's a very big opportunity to ship a few types of agents that are aligned with our mission and business.

For Zuck, the ads business is there to finance his expansion into AI. The flagship initiative has been Meta Superintelligence Labs, which is doing less superintelligence these days and more "build a competitive model to power personal and business agents."

Read more

As such, it's important to track how trends are shifting between different groups, particularly at a time of uncertainty ("are we going to reinvent the economy with AI, or is everybody going to be on food stamps?").

2026 IT Budget Growth Expectations Tick Higher

2026 IT budget growth expectations moved higher quarter over quarter to 3.8%, coupled with a strong inflection in the one-year up-to-down ratio. That points to a healthier budget environment. Winners remain selective, though, as CIOs get more discerning about where dollars flow. Microsoft and security screen clearest.

Software leads, everything else decelerates

Software remains the fastest-growing industry in the technology sector and the only major one expected to accelerate year over year. CIOs expect 4.1% growth in 2026, up 29 basis points from 2025. Communications (2.6%, down 12 bps), hardware (1.6%, down 4 bps), and services (1.8%, down 34 bps) are all expected to decelerate.

Sequentially, 2026 budget growth expectations were revised higher across every IT industry except services. Communications led at 35 bps quarter over quarter, followed by hardware at 12 bps. Software was effectively flat at 3 bps. Services deteriorated by 23 bps.

Near-term revisions turn positive

The one-year up-to-down ratio for potential IT budget revisions improved to 1.2x from 0.8x in 1Q26. Thirty percent of CIOs expect upward revisions versus 25% expecting downward revisions. That is the first reading above 1.0x since 1Q24.

Long-term trends improved modestly. The three-year up-to-down ratio ticked up to 2.8x from 2.7x in 1Q26, with 42% of CIOs expecting IT spending to increase as a percentage of revenue over the next three years against 15% expecting declines. The ratio still sits below the trailing survey average of 3.7x.

CIO priorities

AI and ML remain the number one priority at 18.0%, followed by security software at 11.3% and digital transformation at 10.0%. The increase in AI and ML prioritization is encouraging, but its net defensibility fell to 4% from 10% quarter over quarter. CIOs are becoming more discerning about which AI initiatives are truly protected.

What it means

The improving headline data supports optimism in certain areas of IT budgets. It does not support a structurally more positive view on application software broadly. Software’s 2026 growth expectations were effectively unchanged sequentially, and vendor-level spending intentions remain dispersed.

The range of winners stays narrow. Microsoft again screens as the clearest public beneficiary across incremental GenAI spend, agentic automation, custom AI application preferences, and enterprise distribution. LLM providers are gaining direct CIO relevance as a secondary source of share gain across AI-related spend and custom AI application development.

Security screens as the cleanest category-level winner given its priority, defensibility, and accelerating spend outlook.

The Morgan Stanley quarterly CIO survey is useful for identifying trends across a large pool of executive-level buyers.

Based on the industries and general responses, we can put most of these respondents in the Late Majority and Laggard waves. That makes the responses all the more interesting, even after adjusting for Morgan Stanley shilling their bags.

We should note that "none of the above" is listed at 15% in the survey, so there are plenty of companies winning increased market share. Still, the interesting direction here is that the hyperscalers (Azure, AWS, and GCP) plus what we should presume is OpenAI and Anthropic (LLM providers) will win more than half of the AI spend in large enterprises over the remainder of the year.

Subscribe now

If forecasted over the next three years, however, things look quite different. The same group will win 70% of AI workloads, and the figure is probably higher once you account for Cursor and SpaceXAI. We should note again that we are talking predominantly about monetizing late majority and laggards here.

Security Software Spending Expectations Accelerate Meaningfully

CIOs expect security spending to accelerate meaningfully in 2026, with growth of 12.4% versus 8.9% in 2025. That is up 306 basis points from the 9.4% expectation in the 4Q25 survey.

The magnitude of the step-up is notable. Three factors likely drive it:

1. Replacement of technical debt. Legacy and off-maintenance infrastructure represents an immediate vulnerability and supports firewall refresh activity. Higher memory costs also raise the price of newer firewall appliances.

2. Automated SOC and SIEM investment. Security analysts face rising alert volumes and a growing mix of AI-enabled attacks. That drives demand for automation and pushes more data through SIEM platforms.

3. AI security. Enhanced identity and data security matter more as enterprises begin deploying GenAI applications broadly.

Security remains one of the cleanest areas of durability in the survey. It ranks as the number two CIO priority at 11.3% of responses, up from 10.7% in 1Q26. It also scores as the most defensible IT project, with a net defensibility score of 15%, up from 12% in 1Q26.

Net: accelerating spend expectations, high CIO prioritization, and leading defensibility support a positive outlook for security software within the broader software cohort. CIOs appear willing to protect security budgets even as other areas of software stay mixed.

Cybersecurity continues to be one of the key growth areas in software, as most companies realize that securing their IT infrastructure is a competitive advantage rather than a cost.

If we look at the full scope of tech spend, AI and security remain the key areas of investment, often with significant synergies between them.

Company investments in AI implementations with their preferred vendors are also increasing, as the leading vendors try to win market share. Interestingly, for certain high-growth vendors (Databricks, Datadog), we are seeing actual quarter-over-quarter improvements in winning new workloads.

The big challenge for those SaaS players, however, is the continued push by the hyperscalers and LLM providers, assisted by an army of forward deployed engineers, to build custom applications for those customers.

How successful that approach will be remains to be seen. Palantir paved the way for this motion, but there are rumblings about the actual outcomes of these projects.

Macro: Key Takeaways

The survey covered 76 US and 24 European CIOs on their external IT budgets and the current spending environment. Key macro takeaways from the 2Q26 survey:

Budgets

CIO expectations for 2026 IT budgets accelerated for a second consecutive quarter to 3.8% growth, up from 3.7% in the 1Q26 reading and from 3.7% growth expectations for 2025. Growth expectations remain below the 4.1% average from 2010 to 2019. The data points to a stable-to-improving spending backdrop, with budget optimism inflecting toward trailing survey averages.

CIOs still expect software to remain the fastest growing IT industry in 2026, though sequential improvement was muted. They expect software spending to grow 4.1% in 2026, up 29 bps year over year, followed by communications (2.6%), IT services (1.8%), and hardware (1.6%).

Sequentially, expectations for 2026 budget growth were revised higher across every industry except services. Communications led at 35 bps quarter over quarter, followed by hardware at 12 bps. Software was effectively flat at 3 bps. IT services deteriorated by 23 bps. Software remains the best industry-level read, but there is still no evidence of a material sequential inflection in software budgets.

Cloud migration and share shift

As workloads shift to the cloud, Microsoft and Amazon remain the clear beneficiaries, though LLM providers are emerging as a secondary share gainer. Microsoft remains the top expected share gainer from cloud migration in both 2026 and over the next three years, with net scores of 42% and 37%. Amazon follows at 17% and 13%.

Results also point to budget share shifting toward LLM providers, which screen as an emerging beneficiary in both the one-year and three-year views at 2% and 7% net scores. Dell, Oracle, HPE, Cisco, and VMware continue to screen as likely share donors as workloads move from on-premise to cloud.

CIOs expect continued momentum in the shift to public cloud, and the current workload mix still tracks ahead of historical migration trends. The 2Q26 data suggests 48% of application workloads run in the public cloud today, up from 47% in 4Q25 and 44% in 2Q25. CIOs now expect 52% of application workloads to run in the public cloud by the end of 2026 and 66% by the end of 2028. That sits modestly below the 67% and 68% three-year expectations in 4Q25 and 2Q25, but still implies continued migration from on-premise environments.

New to the survey, CIOs estimate 8% of workloads reside in colocation and managed hosting today. That share is expected to hold roughly stable at 7% by the end of 2026 and 2028. This reads as incrementally positive for scaled operators Equinix and Digital Realty, as colocation remains a durable component of enterprise IT architecture.

How AI gets funded

AI initiative funding remains meaningful, but it is less cleanly additive as reallocation rises. In 2Q26, 33% of CIOs fund AI and LLM initiatives through net new IT budget dollars, down from 37% in 4Q25 and 39% in 2Q25. Another 21% cite net new budget from outside IT, down from 24% in 4Q25 but up from 17% in 2Q25. Combined, net-new funding sources account for 54% of responses, down from 61% in 4Q25 and modestly below 56% in 2Q25.

At the same time, CIOs increasingly fund AI through budget trade-offs. IT budget reallocations total 32% in 2Q26, up from 23% in 4Q25. That breaks down as 15% from existing software budgets, 6% from professional services, 6% from another area of IT budget, 3% from hardware, and 2% from communications and data networking. Reallocation from non-IT business unit budgets declined to 8% from 13% in 4Q25.

AI spend still looks more additive than cannibalistic. The funding story is less clean than 4Q25, and it increasingly includes trade-offs within existing IT budgets.

Where GenAI is deployed

Initial indications point to IT operations (47%), software development (44%), customer service (33%), and supply chain and inventory management (15%) as the business units most widely adopting GenAI today.

Drilling into the impact on cost profiles, CIO usage of generative AI is driving cost reductions in customer service (down 1.8%), HR and payroll (down 1.5%), and corporate finance and strategy (down 0.8%). ROI in supply chain and inventory management (up 1.2%) and software development (up 0.8%) is driving budget increases.

Pricing

Vendor discounting appears broadly stable, with mixed signals on pricing behavior. In 2Q26, 35% of CIOs perceive vendors as more aggressive in discounting, modestly above the 31% and 32% readings in 3Q25 and 2Q25. Another 27% report vendors have become less aggressive, and 38% report no change. The pricing environment is not deteriorating meaningfully, though vendors remain willing to discount in select areas.

Interestingly, a lot of the AI spend comes from new budgets, often funded in part by aggressive layoffs undertaken in order to "reinvest capital."

Still, legacy software gets hit too, along with consulting. This is partly why the software vendors with large market share in those areas have been going aggressively after their own AI implementations, hoping to offer a different variable that could increase stickiness (and ARR).

In order to actually win some of that incremental AI spend, however, companies need to be aligned with where their customers are trying to get the most benefit: increased productivity and revenue.

This is a good indication that the group here represents late majority and laggards, as many companies have already adopted tools like Claude Cowork into their workflows, with significant benefits.

Enterprise Software: Macro Takeaways

Better budget air cover, though application software still needs more evidence

With the broader IT budget backdrop improving and the one-year up-to-down ratio moving above 1.0x for the first time since 1Q24, software investor focus has shifted back toward whether improving AI momentum can drive a more durable inflection in software budgets.

Software remains the fastest-growing IT industry, with CIOs expecting 4.1% growth in 2026, up 29 bps from 2025. Even so, there is not sufficient ammunition this quarter to become structurally more positive on application software broadly. Sequentially, software spending expectations were effectively unchanged, up just 3 bps quarter over quarter. Vendor-level spending intentions remain highly dispersed, with Microsoft and ServiceNow the only tracked vendors expected to accelerate versus the 4Q25 survey.

Funding data also argues for selectivity. AI spend still appears more additive than cannibalistic, but combined net-new funding sources declined to 54% in 2Q26 from 61% in 4Q25, while reallocations within existing IT budgets increased to 32% from 23%. That includes 15% pulled from existing software budgets, up from 13% in 4Q25.

The survey supports a more constructive software backdrop than prior reads. It does not support a broad application software inflection. Three software-specific takeaways from the 2Q26 CIO survey follow.

1. Application software results remain mixed

Across application software coverage, 2Q26 survey data still does not provide enough evidence to become structurally more positive on the group. Vendor-level spending intentions remain dispersed. Microsoft and ServiceNow are the only tracked software vendors where forward-year growth expectations accelerated versus the 4Q25 survey. Salesforce, Adobe, Workday, and SAP all decelerated.

CIO expectations for vendors gaining the largest incremental share of GenAI spend also remain mixed on one- and three-year views. Salesforce improved modestly quarter over quarter, with 8% of CIOs expecting it to gain incremental GenAI spend share in 2026 (up from 7% in 1Q26) and 8% expecting share gains over the next three years (up from 7%). ServiceNow downticked on both horizons, falling to 6% on a one-year view (down from 7%) and 5% over the next three years (down from 6%).

LLM providers continue to screen as the second-largest expected GenAI share gainer behind Microsoft. Eleven percent of CIOs expect LLM providers to gain incremental share in 2026, modestly down from 12% in 1Q26, and 17% expect share gains over the next three years, unchanged quarter over quarter. LLM provider share gains did not inflect materially higher sequentially, but their positioning suggests continued wallet-share risk for incumbent application vendors not well positioned to participate in GenAI spend.

The survey points to pockets of application vendor participation in the AI investment cycle. The broader results still point to mixed vendor-level spend intentions and uneven capture of GenAI wallet share.

2. Microsoft remains the clearest winner, with a modest downtick from 1Q26

Survey data continues to underpin Microsoft’s leadership position in AI, though several AI-specific datapoints moderated from elevated 1Q26 levels.

Microsoft remains the clear number one vendor expected to gain incremental share of GenAI spending in both 2026 (27% of CIOs, down from 32% in 1Q26) and over the next three years (30%, down from 32%). Across a broad suite of agentic vendors, 36% of CIOs expect Microsoft to be leveraged for agentic automation initiatives, down from 42% in 1Q26 but still well ahead of the next closest vendor at 8%.

New survey work on custom AI application development reinforces the same positioning. Microsoft screens as the preferred vendor today at 47%, roughly stable versus 48% in 1Q26, and over the next three years at 34%, up from 32%.

The modest downtick across select AI share indicators pairs against still-accelerating Microsoft spending intentions. Across a broad suite of software vendors, CIOs expect the highest forward-year growth for Microsoft in absolute terms at 7.6%, up from 7.3% in the 4Q25 survey.

CIOs also note the top AI and LLM initiative remains broader internal employee productivity at 30% of responses. That highlights the opportunity for products like Microsoft 365 Copilot as well as potential upsell into E5 and E7 SKUs. Eighty-eight percent of CIOs expect to use Microsoft 365 Copilot over the next 12 months, up from 80% in 4Q25. The 2Q26 survey also highlights continued premium M365 monetization potential, with E7 newly broken out and CIOs expecting the combined E5 and E7 mix to reach 71% next year.

Even as LLM providers gain direct CIO relevance, Microsoft remains well positioned to consolidate software spend while monetizing GenAI across M365, Copilot, Azure, GitHub, Fabric, and broader enterprise distribution over a multi-year timeframe.

To wrap up, let's see where the "SaaS is dead" thesis stands today.

In my deep dive into the topic back in January, I included this amusing (but insightful) take on what it is like to be a professional investor when a sector is struggling:

This period of time in SaaS reminds me of the living hell that is running a hedge fund when a sector dies and you have exposure.

1) You wake up, reach for your phone, see your stocks are down pre-market for the fifth day in a row on no news. Good morning!

Go get a bacon / egg / cheese and coffee from a deli - this will be the only good thing about your day and you know it.

2) Enter the office and your SaaS analyst has a grimace on his face. You don't want to have the same conversation you've had in your head and with him 30x a day for the past week so you just go eat your breakfast at your desk while reading news / research.

3) Your analyst comes in and you have the 121st version of the conversation. No new insights. You can sense he is beaten up so you go through 50 mental model / frameworks but neither clarity nor comfort arrives.

4) Morning meeting with the investment team.

Someone will invariably ask "So what's our view on this sector?" [meaning the sector that is equal to hell on earth right now]. This kicks off a conversation in which the other analysts who know absolutely nothing about the sector in question will start by asking gently probing questions of you and the analyst. This escalates to unanswerable questions that people only have the nerve to ask when a sector is dead. You have to graciously entertain these questions because the stocks are down so apparently anything goes. You start thinking that everyone in the room is stupid including and maybe mostly you.

After 20-30 min of abuse (maybe more) and at the point where you literally have no clue what you're even talking anymore ("when will this turn?), someone will mention that their buddy works at a rival fund where the PM sold the entire sector earlier that week. Another analyst will then mention "That fund is really smart" (implying you are stupid with which you agree wholeheartedly).

5) Meeting over. Now you and your analyst have another conversation, and you can see the fight leaving his body. You wonder how his physical body remains upright seeing as the spine is dissolving in real time but then realize you're not a doctor because you're not smart enough. Anyways, this chat may or may not culminate with the suggestion that "maybe we should take some off or just come back later". At this point, your brain floods with the history of your interactions including how the two of you have patiently been waiting for a "buying opportunity" JUST LIKE THIS. And now that it is here, didn't immediately go up, and, in fact, went down further, you are having to contemplate trimming or selling. You restrain yourself from smashing something but also understand your analyst who doesn't want to destroy his year by January 16th and die like this. Who does?

6) At this point, you realize you are simultaneously fighting 1) the market, 2) your primary analyst, 3) your other analysts, 4) your competition including QQQ which only goes up. And you feel very, very alone in this investment. No joke, this part truly sucks.

Most times, you probably trim some of whatever is hurting. Because at least you did something. And if it all goes to hell, you can sell more and say / feel you took the right action. And if it goes higher, well, at least you somewhat stayed. Honestly, at this point, no one will give you any credit for your actions anyways and you're just going to get whatever potential discredit results. It rarely pays or is feasible to be the hero here.

7) Day is almost over. 10 minutes to close or maybe right after, your largest, most "proactive" institutional investor like Blackstone will email "Hey - got a second to chat about Saas?". Or maybe your most unsophisticated investor. Usually both. So then you hop on the phone and explain what you know, what you think and what you did or plan to do. This is the point where having a 10 out of 10 investor like Blackstone helps because they are professional and get it so long as you are sticking to your process.

8) Go workout and feel a bit better. Go home and try to be present with the family for a bit. Then whiskey time and mentally go over everything again. Alone. To make sure you hopefully aren't impairing capital permanently and, if so, have a plan.

And that plan is to fire everyone and become a monk.

While average CIO spend might be increasing versus recent quarters, it lags significantly behind the levels of investment increases we saw during the 2020 to 2022 period. That doesn't mean companies are spending less on IT, however, simply that the hyperscalers and LLM providers are winning the majority of those increases ($74B ARR for Anthropic speaks for itself).

Are they going to "turn it around"? I think waiting for that, let alone profiting from the current state of SaaS, is a fool's game.

Cloud infrastructure software, however, is a different story. Plan accordingly, particularly as those companies capture not only traditional workloads but also a share of the AI spend.

Earlier this week, we detected and responded to an intrusion into part of our production infrastructure. This one was different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system - and we detected and dissected it largely with AI of our own.

We identified unauthorized access to a limited set of internal datasets and to several credentials used by our services. We are still completing our assessment of whether any partner or customer data was affected, and we will contact any affected parties directly as required. We have found no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean.

From July 11 to July 14, the security team at Hugging Face (the most popular platform for hosting open weight AI models) had the unpleasant experience of becoming the first company to fight off an agent from a frontier lab running on unreleased models. When they published their disclosure, they still did not know who was behind the attack.

The intrusion started where AI platforms are uniquely exposed: the data-processing pipeline. A malicious dataset abused two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker. From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend.

The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness - used LLM still not known) executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services. This matches the “agentic attacker” scenario the industry has been forecasting.

Because Hugging Face is designed to be the best platform for uploading and running new open weight models, it has a unique attack vector: users can run code on its infrastructure. If that code is not properly sandboxed and isolated, an attacker can use it to move laterally into the rest of the network.

The attack was initially surfaced through AI-assisted detection. Our anomaly-detection pipeline uses LLM-based triage over security telemetry to separate real signals from the daily noise, and it was the correlation of those signals that flagged the compromise.

To understand what a swarm of tens of thousands of automated actions did, we ran LLM-driven analysis agents over the full attacker action log, comprised of more than 17,000 recorded events. This allowed us to reconstruct the timeline, extract indicators of compromise, map the credentials touched, and separate genuine impact from decoy activity. Thanks to this approach, we were able to do in hours what would usually take days, and match the adversary’s speed.

The choice of models we could use for this analysis was constrained in a way we did not anticipate; we describe this below.

When we started the log analysis, we first used frontier models behind commercial APIs. This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers’ safety guardrails, which cannot distinguish an incident responder from an attacker. We ran the forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment.

This experience points to a gap worth planning for. We do not know which model powered the attacker’s agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried. The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment. This is not an argument against safety measures on hosted models, and we are sharing this feedback with the providers concerned.

The original incident disclosure had already made the news because it described a difficult position the defenders were in: when they tried to use Fable or GPT-5.6 Sol (or both) for the investigation, the models' aggressive safeguards made them essentially unusable in their operational workflow.

This is why both OpenAI and Anthropic run insider programs that give trusted partners access to more powerful models without guardrails, such as Mythos. Hugging Face, a contrarian organization (opposed on principle to the frontier labs, and very French about it), did not participate in either program. Instead, the team switched to a self-hosted Chinese model and still reached an outcome. They now advocate this approach as a defensive strategy.

Subscribe now

Autonomous, AI-driven offensive tooling is no longer theoretical. It lowers the cost of running a broad, patient, multi-stage campaign, and it operates at machine speed. Defending an online platform now means treating the data and model surface as a first-class attack surface, and using AI on defense to keep pace. We will keep investing there, and keep sharing what we learn.

For those working in cybersecurity, the need for advanced models in the defensive tech stack has been obvious for a while. Adoption has been uneven: some companies run Mythos across their entire stack, while others struggle to get internal approval to even run proofs of concept.

Now to the more interesting part, the OpenAI statement from yesterday:

Last week, Hugging Face disclosed a new kind of security incident⁠ after they detected and contained an AI agent that compromised their infrastructure, something we expect to become more commonplace with the proliferation of increasingly cyber-capable models. After investigating, we now know that this particular incident was driven by a combination of OpenAI models — including GPT‑5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes — while being internally tested on a benchmark⁠ of cyber capabilities.

We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly. We are sharing preliminary findings at this stage to help defenders understand what happened and to help calibrate on what models are now capable of. We will continue to conduct a thorough investigation alongside Hugging Face and will share more details on the vulnerabilities, incident, and findings when our investigation is complete.

I've already written about how benchmarks are becoming useless because models cheat on them, but "my agent escaped the lab and started pwning people" is a whole new level of cheating.

This incident occurred during an internal evaluation which prompts models to pursue advanced exploitation using complex attack paths, in an effort to quantify their cyber capabilities. We estimate maximal cyber capabilities by running this evaluation without production classifiers used to prevent models from pursuing high-risk cyber activity. Our benchmarks run in a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries.

The models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database. All evidence suggests that the models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal.

While operating in our sandboxed testing environment, our models spent a substantial amount of inference compute finding a way to obtain open Internet access, in pursuit of solving the evaluation problem. To gain access, the models identified and exploited a zero-day vulnerability (which we’ve now responsibly disclosed to the vendor) in the package registry cache proxy. With this access, our models performed a series of privilege escalation and lateral movement actions in our research testing environment until the models reached a node with Internet access.

I’ve discussed previously that the cost of inference plays a significant role in how threat actors choose their targets.

1. Using models and people’s time costs money. Any successful breach needs to cover the cost of inference and the time to execute. Most exploitable vulnerabilities do not justify the investment required to identify and leverage them.

2. A vulnerability in one application simply means that the specific app can be exploited. It does not guarantee lateral movement across a network, which is almost always required to reach high-value systems.

What happened here was different: the goal was obviously poorly chosen (”lemme get those ExploitGym datasets”) and there was no real cost control or accountability. This is not how threat actors behave in the wild.

Do you really think actual APT groups will give their agents unlimited token budgets while North Korean army leadership sits behind them and jeers?

The impact is both funny (”the models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal”) and deeply concerning, because it makes visible the structural risk of allowing an alien intelligence to operate in the world with its own incentives (”our models spent a substantial amount of inference compute finding a way to obtain open Internet”).

After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym. Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation. In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers. OpenAI’s security team discovered this anomalous activity internally.

Hugging Face’s security team and agents detected and stopped the activity on their infrastructure and had already begun containment and forensic reconstruction with their own open-source models when our teams connected. We are actively working with them to continue to investigate the incident. We are grateful for Hugging Face’s rapid and close collaboration on investigation and remediation.

So first our rogue OpenAI agents broke out of their internal sandboxes, then picked Hugging Face as a suitable target and started delivering zero-day exploits through the platform to gain access to its internal network.

The incident also makes clear that advanced models can discover and exploit novel attack paths in real-world systems without source-code access. It highlights that advanced cyber capabilities must be developed alongside stronger safeguards and defensive tools.

We believe advanced cyber capable models need to help security teams find weaknesses before attackers do, understand how vulnerabilities can be chained, and remediate them at machine speed. We are using these capabilities to continue strengthening protections around infrastructure configuration and model evaluation environments; we will share our findings and best practices as we learn. We encourage other defenders to apply for trusted access⁠ and experiment with these models now to translate these capabilities into better prevention, faster detection, and more effective incident response.

It’s difficult to gauge whether OpenAI is concerned about this outcome or very excited about it.

While Anthropic has spent months cyberfearmongering around Mythos, it was an unreleased OpenAI model that came up with the bright idea of breaking out of its sandbox to attack actual companies.

Actions we are taking now

1. As part of the investigation, we are implementing strict controls in infrastructure configuration at the cost of research velocity while the vulnerabilities are patched. We are regularly briefing our Safety and Security Committee on these controls and their impact.

2. We’re working with Hugging Face to forensically investigate the incident.

3. We’ve responsibly disclosed the identified zero-day vulnerability in the internally-hosted third-party software and are working with them to patch.

4. We’ve brought Hugging Face into the trusted access⁠ program and are supporting their teams in rapidly using our models’ capabilities to improve their defenses.

5. We’re improving and adding stronger protections around future training and evaluations. This week, we published a blog on improving safety and alignment in an era of long horizon models⁠. These deployment safeguards were intentionally not enabled during this evaluation because it was aimed at testing cyber vulnerabilities. This incident points to the need to further strengthen our model’s alignment, cyber protections during evaluation time, and monitoring during internal testing.

This last point leads us to an article that already explained, in effect, that something like this was likely to happen:

Model persistence can expose security vulnerabilities

The new model can continue working toward an objective through repeated attempts over a long period of time. That same persistence can lead it to find and exploit weaknesses in its environment. Previous models, when they hit sandboxing or environmental constraints, would simply stop and return to the user. This model often kept trying, including by looking for ways to act outside its sandbox.

An example of this occurred during an internal evaluation on the NanoGPT speedrun⁠(opens in a new window), a public benchmark for training a small language model in as few steps as possible. Our model developed a power-law learning-rate cooldown called PowerCool that led to a significant improvement. The model was instructed to post its results only to Slack, but the NanoGPT instructions say to post results as a PR to GitHub, and the model followed the latter instructions to open PR #287 on the public GitHub repository. The model circumvented sandbox restrictions designed to block external access and proceeded with the upload to GitHub. It took our model an hour to find a vulnerability in the sandbox in order to make the PR; earlier models were less persistent and did not manage to find vulnerabilities, instead giving up on the PR part.¹

From considering single actions to considering whole trajectories

Many safety controls for AI assistants are designed around individual actions. If an action is disallowed, it is blocked. If it is sensitive, the system asks the user for explicit approval. But long-running models, whose actions may unfold autonomously over hours, days, or even weeks, challenge this setup: monitoring individual actions no longer suffices to track the intent of the overall trajectory.

For example, in a scenario where the model was asked to solve a problem, the model observed that other systems had successful but private submissions and tried to recover those solutions from the evaluation backend. When its initial attempt was blocked due to a scanner detecting an authentication token, the model split the token body into two fragments, obfuscated them, and then reconstructed the credential at runtime so the complete token never appeared as one contiguous string. The model was explicit in both its comments to the user and in its reasoning traces that it was taking these steps to circumvent the scanner.

This example shows how each step can look acceptable on its own while the sequence can produce an outcome that would not be approved. It also shows how a model that operates effectively over long time horizons can learn the blind spots of an approval system and work around it to achieve its goals. Long-horizon safety requires not only asking “is this action allowed?” but also “what outcome is this sequence of actions working toward?”

Building safeguards for long-running models

Due to incidents like these, we paused internal deployment of the new model. We rebuilt the safety system around defense in depth and trajectory-level monitoring.

• Incident-derived evaluations. Evaluations can give us a sense of whether a system is safe to deploy before it is actually deployed. However, to be most useful, an evaluation should reflect the distribution and horizon length of trajectories during real deployment. For this reason, we used observed failures to develop adversarial evaluations. We found that improving on the evaluations derived from real-world incidents in turn led to safer behavior once deployed in production.

• Improved alignment. We took steps to reduce its tendency to take unwanted actions without permission in pursuit of the user’s goal. For example, we found that our models were worse at remembering instructions on long rollouts, and when we trained the model for this capability, it led to a model that remained aligned through longer rollouts.

• Active monitoring. We created a monitoring system that reviews the model’s evolving trajectory for signs that it is bypassing a user constraint or safety boundary. The monitor observes not just a single action but the entire trajectory. Importantly, the monitor can pause the session and alert the user to examine more closely. Upon examination, the user can then choose to continue the model’s work if the monitor has been falsely triggered.

• Greater user visibility and control. We improved the ability of the user to inspect these long-running sessions, view the actions taken, and monitor interventions.

Redeployment

To evaluate the new monitoring system, we replayed a small set of internal deployment environments where the model previously pursued misaligned actions, this time with the new safeguards in place². The new safeguards were able to catch considerably more misaligned actions pursued by the model, and the ones it missed were all judged to be low-severity.

Some examples of these low-severity incidents include the following cases:

• To access a Linear command line tool, the model launched a nested codex --yolo session, when in fact it could have done so without the --yolo flag.

• The model noticed that a previously live resource was missing, then started to explore and SSH into other live CPU pods under its owner’s namespace, as well as (unsuccessfully) pods belonging to other OpenAI employees, without a good reason to do so.

• The model had many stuck find processes and every shell command hung. It then ran kill -9 -1 which would have sent SIGKILL to every process it is allowed to kill on that pod, if it executed. However it timed out and did not execute.

The interesting thing is that many developers advise staying away from GPT-5.6 Sol at Extra High or Ultra because the model is very persistent once directed toward a task. This has recently resulted in machines getting wiped because the model decided that wiping them was an alternative way to get the job done.

From a cybersecurity point of view, as I have alluded to several times in this article, exploiting Hugging Face was a very poorly chosen goal, but the execution in achieving it was of high quality.

While model training can be adjusted to try to remove the “persist at all costs” mentality, the capabilities demonstrated show enough progress to justify calling these models “cyberweapons,” as our friend Dario likes to put it.

Alea iacta est.

Things are moving so quickly in the AI trade that they put the good old days of crypto booms and busts to shame. Q2 fit an entire market cycle into thirteen weeks. After an aggressive recovery following the Iran war dump, we saw three of the largest listings in financial history, and then a proper bear market to close things out. Roughly $3.3 trillion in global semiconductor value has evaporated since June 22. It was the worst week for chips since the tariff meltdown of April 2025.

The latest trigger was the launch of Kimi K3. Moonshot unveiled the model at the World AI Conference in Shanghai: 2.8 trillion parameters, open weights, and occasionally trading blows with Fable on certain benchmarks. The market read it as DeepSeek 2.0 and sold everything that had doubled, which in semiconductors meant almost every stock.

In practice, what we are seeing is deleveraging, profit taking, and some liquidity reshuffling. SpaceX raised over $75 billion at a $1.77 trillion valuation, Cerebras raised $5.55 billion, and the SK hynix ADR raised $26.5 billion. That is more than $100 billion of liquidity absorbed in eight weeks, in a market where most large players had already hit their targets for the year. Blaming the latest dump on Kimi K3 makes little sense when in most use cases the model is more expensive to run than GPT-5.6, before we even touch giving your codebase to a Chinese vendor that offers no privacy, lacks the compute to service the demand, and is likely running aggressive distillation from Anthropic models.

More importantly, the market turning red has nothing to do with the actual fundamentals. Micron is still rationing HBM. Tower is still collecting prepayments. Broadcom signed a $30 billion deal with Apple in the middle of the selloff. Demand remains sky-high, and so do the profits in semiconductors.

Let’s review how things went for each company in Q2 and evaluate the new portfolio composition as we position for a recovery from the “bear market.”

Read more

In the span of a week, we saw the first meaningful step up from SpaceXAI with the Cursor-trained Grok 4.5 model, the release of OpenAI’s new large training runs (without significant government interference), and Meta finally releasing something usable (if not too late). Surprisingly, we also had Apple launch a lawsuit against several OpenAI employees, claiming that they stole a significant amount of technical information related to wearables.

This is a good moment to reassess the current positioning for OpenAI, Anthropic, SpaceXAI, Google, and Meta, with an eye on where things are headed in the second half.

OpenAI

Introducing ChatGPT Work, an agent in ChatGPT that helps you take on more ambitious tasks. It can gather information across your apps and workflows to create finished materials like sheets, slides, docs, and web apps, and stay with complex projects for hours by breaking them into smaller steps and completing them independently.

With Codex technology built-in, ChatGPT can now move beyond answering questions to getting real work done across web, mobile, and desktop. More than 5 million people use Codex every week. Although it began as a coding agent for developers, more than 1 million people now use it for work outside software development, showing how its capabilities can support a wider range of tasks.

To better manage these tasks, ChatGPT Work is powered by our latest frontier model, GPT‑5.6, which is also rolling out today⁠. GPT‑5.6 makes ChatGPT state of the art at reasoning through multi-step tasks and creating materials that follow your templates and reference files.

The best way to learn how to use ChatGPT Work is to give it a task you already know well: analyze a month-end budget variance, turn source materials into a marketing campaign brief, or prepare for a sales meeting. You can follow its progress, answer questions, change direction, and approve important actions.

You can even ask ChatGPT Work to take on entire workflows with a single request. For example, it can turn customer research into a campaign brief, use that brief to create marketing assets, and adapt those assets for different markets while carrying context through every step.

Even when you’re away from your computer or phone, ChatGPT Work can keep projects moving forward with Scheduled Tasks. For example, it can independently turn new messages from Microsoft Teams and Slack into updated docs or slides, then share important changes with your team.

Surprising no one, OpenAI launched the upgraded version of their Codex developer tool that has now been expanded into agentic workflows for professionals (Work) and developers (Codex). This is a perfect showcase for the release of 5.6, but it’s also a good illustration of the peculiar product choices made by the team.

Rather than offer something similar to the “Claude super-app”, the team killed off the Codex and ChatGPT standalone applications, essentially merging them. The trick is that the new desktop app has very little ChatGPT going on, with the UI having no separate section to review your historical chats and only opening a very small window overlay to use it. This basically means that all users are pushed towards the web or mobile version to use ChatGPT for their regular questions.

For those who will use the desktop app for their serious business, we have two new windows for Work and Codex, which don’t seem to change much of anything in the interface.

ChatGPT Work is designed to keep tasks moving forward wherever you are. You can ask it to start a task from your phone, review a draft on the go, or check the status of a longer-running workflow between meetings. When you return to your desk, you can pick up the same work on the web.

For an even more powerful experience, the ChatGPT desktop app now goes further. On desktop, ChatGPT can use your local files and apps to get work done. For web-based work, ChatGPT’s new built-in browser lets it bring in websites, tools, and online files, giving you one place to move work forward.

Starting today, the Codex app is merging with the new ChatGPT desktop app. Codex remains the same powerful coding agent for developers and technical professionals, now with new capabilities⁠(opens in a new window) across core workflows, including inline editing within diffs, pull request review in the side panel, faster computer use (powered by GPT‑5.6), and support for multiple repositories in a single project.

For the mobile version of the app, we also seem to be focusing on offering only Chat and Work interfaces, essentially pulling away from the cloud agents product focus.

We’re also introducing Sites in ChatGPT in public beta. With Sites, you can turn your work or ideas into an interactive site or web app and share it with your team or publicly through a URL. Sites are useful when you want to create things like live dashboards, project trackers, launch calendars, prototypes, internal portals, and interactive reports. You can test the Sites you build right inside ChatGPT and bring fresh web context into your project, too. ChatGPT can also update them as the underlying information changes.

Picking up on the Google and Anthropic implementations in the same vein, the new projects created in Work can be showcased across a variety of surfaces, including custom web pages to share internally or with customers.

ChatGPT Work can help take repetitive tasks off your plate, freeing you up for more impactful work.

Scheduled Tasks let you ask ChatGPT to perform an action once, repeat it on a schedule or when an event occurs, or monitor for changes over time.

Scheduled Tasks can use your connected apps and browser to:

• Review new Slack updates each week and refresh a recurring meeting agenda.

• Check websites and dashboards each morning, summarize what changed, and send a report.

• Monitor new customer feedback and turn recurring themes into prioritized product ideas.

• Update a presentation when new feedback arrives by email.

You remain in control of how ChatGPT works with you. You decide what it can access, when it should check in, and when it needs your approval before taking action. You can review progress and steer the work as priorities change.

Work also implements automation (cron jobs) more consistently as workflows, making the early magic of ClawdBot now accessible to the mainstream.

On desktop, ChatGPT now includes a built-in browser to help you gather information online, use web-based tools, and refine web-based work in one place.

You can ask ChatGPT to research a market, compare sources, pull information from websites, or open and refine files from Google Workspace and Microsoft 365 inside the app. It can use the browser to bring in fresh context, take steps across web pages, and keep the work moving while you review and guide the result.

On desktop, Computer Use lets ChatGPT use your computer on your behalf to execute tasks in the background across your apps, tools, and browser—clicking, typing, and moving files where they need to go. You can use it for a one-time task or as part of a Scheduled Task when recurring work includes steps on your computer.

We are also updating our Chrome extension to make it possible to use ChatGPT directly in Chrome’s sidebar. These capabilities build on what we learned from Atlas and from the users who helped us understand how agentic tools can make browser-based work more useful. We’ll begin sunsetting the standalone Atlas browser, and will share information with users about how to transition to ChatGPT.

This includes an extended application of computer use, significantly extending the capabilities of the models to get context in your work applications, either through plugins, MCP servers, or just by looking at stuff on your screen. The key to making this all work is GPT-5.6 Sol, their new frontier model.

GPT‑5.6 Sol sets a new standard for both intelligence and efficiency, achieving state-of-the-art results across coding, knowledge work, cybersecurity, and science while outperforming previous and competing frontier models with fewer tokens and at lower estimated cost. The result is stronger performance per dollar: more successful work for the same spend, or comparable results at a lower total cost. We also introduce a new way to accelerate the most demanding work: ultra is our highest-capability setting, coordinating multiple agents across parallel workstreams to finish complex tasks faster. Stronger computer use and design judgment make GPT‑5.6 Sol our most polished collaborator yet, helping it inspect, refine, and deliver ready-to-use results.

We trained GPT‑5.6 to get more useful work from every token. On Agents’ Last Exam⁠(opens in a new window), an evaluation of long-running professional workflows across 55 fields, GPT‑5.6 Sol sets a new high of 53.6, eclipsing Claude Fable 5 (adaptive reasoning) by 13.1 points. Even at medium reasoning, it beats Fable 5 by 11.4 points at roughly one-quarter the estimated cost. That efficiency extends to smaller models, which are essential to making intelligence more abundant and affordable: GPT‑5.6 Terra and GPT‑5.6 Luna outperform Fable 5 at around one-sixteenth the cost. On the Artificial Analysis Intelligence Index⁠(opens in a new window), a broad measure of intelligence spanning agentic work, coding, scientific reasoning, and general capabilities, GPT‑5.6 Sol with max reasoning comes within one point of Fable 5 while completing tasks in 61% less time at roughly half the estimated cost.

It’s interesting to see how bad the impact of Anthropic fumbling the launch of Mythos/Fable has been. They were a month ahead with the strongest model in the industry (and arguably the first real leg up in recent months), but due to mismanaging their relationship with the federal government and the subsequent temporary withdrawal of the model, they missed out on actually capitalizing on the opportunity.

GPT-5.6 is benchmarking at similar performance levels to Fable, while coming in at a significantly lower cost due to efficiency improvements.

More embarrassingly, it appears to be catching up to Mythos-level utility for cybersecurity tasks, at 20% of the cost for the same workload. It also launched without the ridiculous “30 day retention policy” that Anthropic instituted for Fable, which has delayed many rollouts across enterprises.
OpenAI sits at an interesting place. After the misguided play towards the consumer space last year (for which Sam should’ve taken full responsibility), the company refocused on delivering the best possible model efficiently with the compute that they have. The last part is critical, since it sets them apart significantly from Anthropic, who are struggling both in terms of available compute and the model architecture when it comes to tokens generated.

If we look at DeepSWE, the most accurate coding benchmark currently on the market, Fable is barely showing improved outcomes on its two highest effort settings, while consuming twice the tokens for its Max version.
This puts OpenAI in a pretty good place in terms of model performance, particularly now that the company has a meaningful answer to Cowork.

Whether they can accelerate growth by capturing new demand or will essentially be pushing for the displacement of existing Anthropic usage is a completely different topic. This comes back to the question of how quickly they can take the right product decisions and put them into place.

Read more

2026 continues to be a peculiar year for Anthropic, as lawyers have, for some reason, taken over decision-making in a number of areas. In January the company forced Peter Steinberger to rebrand ClawdBot, then ended up suing the DoD over being designated a supply-chain risk (for trying to impose contractual terms the federal government deemed unreasonable). This did not prevent the company from launching products that compete directly with some of its largest customers, after benefiting from a very close relationship with those same companies (Figma and Cursor).

This new attitude seems to be driven by the surplus of cash the company is collecting, after it transformed within twelve months into essentially the highest-growth story software has ever seen. When you are this newly rich and influential, squashing competition, or just companies and individuals you dislike, through litigation becomes an obvious move.

So at first glance, Anthropic's argument is that Abnormal AI, a company focused on email security (and trying to pivot into a slightly broader "detections" category), is somehow winning market share by posing as what, exactly?

Oh, and one member of the cybersecurity community found the new logo funny! Both companies are marketing themselves to cybersecurity audiences, and Anthropic has "forever" been building its reputation in the industry for security use cases.

Ah yes, let's not forget that Constitutional AI was a cybersecurity initiative, not an AI alignment research policy.

While Anthropic tries to point to its long history of security contributions, it does admit that it did not launch a dedicated product until February 2026, years after Abnormal AI was founded and later rebranded.

Subscribe now

TIL that the Anthropic slash is fundamental to the adoption of its products and the secret behind its rapid ARR growth, which it always seems very excited to point out.

For some reason Abnormal AI being a customer of Anthropic is being held against them, as is rebranding around AI, which pretty much every other software company has tried to do in the last two years.

So now we get to the actual crux of the issue. Anthropic’s legal team is not pretending that Abnormal AI is somehow stealing revenue from it (at several hundred million dollars of run rate, that would be absurd to imply), but that the company is trying to present a strong association with Anthropic, as if the two were affiliated.

As many are learning the hard way, Anthropic does not want to be associated with its customers.

Anthropic sent the account rep to demand that a customer transition its entire branding, an effort that later included forwarding them a nice letter setting a sixty-day deadline.

Oh, forty-seven reactions on this post, including a CYBER DEFENSE SALES LEADER and a FOUNDER & CEO.

So Trey, a sales rep at SentinelOne, made a snarky comment, which led to Pavin, a sales rep turned founder of what appears to be an unknown cybersecurity software company with several interns in India, agreeing with him.

This was enough to deeply disturb Anthropic’s market positioning, due to its association with, checks notes, its paying customer Abnormal AI.

THERE IS A SUBSTANTIAL LIKELIHOOD THAT CONSUMERS ENCOUNTERING ABNORMAL'S PRODUCTS AND MARKETING MATERIALS WILL ATTRIBUTE THEM TO ANTHROPIC, OR BELIEVE THEM TO BE SPONSORED BY OR AFFILIATED WITH ANTHROPIC, CAUSING IRREPARABLE HARM TO THE GOODWILL ANTHROPIC HAS BUILT IN THE ANTHROPIC SYMBOL IN THE AI AND CYBERSECURITY MARKETS, WHERE BRAND TRUST IS CRITICAL.

I know these documents are mostly the legal reps having fun, but still...

Let’s see what Anthropic is trying to achieve here:

2. For entry of an order and judgment requiring that Abnormal and its officers, agents, servants, employees, owners, and representatives, and all other persons, firms, or corporations in active concert or participation with them, be enjoined during the pendency of this action and permanently thereafter from: (a) using in any manner the Infringing Marks, any other mark incorporating or substantially similar to the Anthropic Marks, or any other mark or name that is confusingly similar to or a colorable imitation of the Anthropic Marks; (b) doing any act or thing calculated or likely to cause confusion or mistake in the minds of the members of the public or prospective customers as to the source of the products or services offered or distributed by Anthropic or Abnormal, or likely to confuse members of the public or prospective customers into believing that there is some connection between Anthropic and Abnormal or any other entity owned by or associated with Abnormal; (c) otherwise competing unfairly with Anthropic in any manner; or (d) assisting, aiding, or abetting any other person or business entity in engaging in or performing any of the activities referred to in parts (a) through (c) of this paragraph;

3. For entry of an order and judgment directing Abnormal, pursuant to 15 U.S.C. § 1116(a), to file with this Court and serve upon Anthropic within thirty (30) days after entry of the injunction a report in writing under oath setting forth in detail the manner and form in which Abnormal has complied with the injunction and ceased all offering of goods and services under the Infringing Marks, as set forth above;

4. For entry of an order and judgment directing Abnormal, pursuant to 15 U.S.C. § 1118, to deliver up for destruction, or to show proof of said destruction or sufficient modification to eliminate the infringing matter, all digital assets, catalogs, articles, signage, products, displays, labels, circulars, letterhead, business cards, promotional items, clothing, literature, or other matter in the possession, custody, or under the control of Abnormal or its agents bearing any of the Infringing Marks, or any other mark that is confusingly similar to the Anthropic Marks;

5. For a judgment awarding corrective advertising damages in an amount sufficient to remedy the likelihood of confusion and deception caused by Abnormal’s infringement;

6. For a judgment in the aggregate amount of (a) Abnormal’s profits, (b) Anthropic’s actual damages (including corrective advertising damages), (c) the costs of this action pursuant to 15 U.S.C. § 1117, and (d) restitution and/or disgorgement of all revenues, earnings, profits, compensation, and benefits that may have been obtained by Abnormal as a result of its unlawful and/or unfair business acts or practices;

Rebrand within 30 days, burn all your swag, never speak of Anthropic in public again, and pay me an undisclosed penalty sum.

Let’s see Abnormal’s public response, based on the blog post from its CEO:

Anthropic filed a lawsuit against us on July 1st, claiming unfair competition and trademark infringement. This was surprising and disappointing for a few reasons:

• They never told us: We’re a very large customer of Anthropic and they still have yet to tell us about the lawsuit. I learned about it from a reporter, not our “partner.”

• They do NOT own the trademark: They argue our “/\” logo is confusingly similar to their “A\” yet they don’t have a registered trademark that gives them a monopoly over every AI -adjacent A/ design in cybersecurity.

• They say we stole their brand: Our company was started 3 years before Anthropic. The logo we use today was designed in April 2021, just months after Anthropic was founded.

• They say we deceived customers: No customer has ever purchased thinking we were Anthropic. Our business is about trust: we help our customers stop deception crimes (phishing, fraud, social engineering).

• Their demands are shocking: The lawsuit asks for “disgorgement of all revenues, earnings, profits, compensation, and benefits.”

• This doesn’t feel Anthropic: We’re both supposed to be mission-oriented companies to act for the global good.

There is nothing more important to me and Abnormal than trust, integrity, and intellectual honesty. So when there are false claims about our integrity, we must respond.

I know that these things are best resolved in private. Unfortunately, this lawsuit was filed publicly without our knowledge. I need to respond publicly now, since customers, employees, and partners have started asking questions.

Two things stand out. The first is the claim that they were not informed through proper channels (maybe the Anthropic sales rep sending an email was not an appropriate channel after all). The second is that Evan is clearly an Anthropic fan and was taken aback by his company being aggressively targeted.

We did not copy Anthropic’s brand or identity.

I founded Abnormal AI in 2018, three years before Anthropic existed. I registered the domain abnormal.ai and we used it with early customers, employees, and investors.

We hired ALINE in April 2021 to design our slash-based Abnormal brand identity, just months after Anthropic was founded and before Claude existed. The logo on our website today is the same wordmark, pixel-for-pixel, that we have used for ~5 years.

The claim that Abnormal invented its identity in 2025 to copy Anthropic is simply wrong.

To be fair, Anthropic is saying they can revert to the original logo, but they can't have a shortened version using the slash, forever known henceforth as the Anthropic Marks of the beast.

Anthropic has no trademark covering use of “AI” for security.

Trademarks prevent confusion in specific markets. Trademarks are not universal monopolies over letters, slashes, or the idea of “AI.”

For example: An “Acme” bread company does not automatically infringe an “Acme” GPU company’s trademark. The domain and market matter. Public trademark records show Anthropic does not have a registered trademark covering the cybersecurity products Abnormal sells.

Anthropic builds general-purpose AI models. Abnormal builds specialized behavioral AI security products. We do not believe Anthropic has trademark rights that prevent Abnormal from using its own A/ slash based identity for the cybersecurity products we sell.

There seems to be a difference of opinion here, as Anthropic appears to be clearly stating "all your security customers now belong to us."

This is about integrity.

Abnormal was built by inventing, not copying.

We built our own AI models, our own technology architecture, and our own behavioral approach for cybersecurity because the old way was failing customers. That is why the accusation that we copied another company to deceive customers is so personally offensive. It is the opposite of who we are.

I have been a major Anthropic user and advocate:

• My personal Anthropic account will spend ~$1M this year (Abnormal will be >$10M).

• Abnormal has rolled out Claude to 100% of employees because we want our employees to learn how to work in the AI era.

• We’ve published 100+ free videos and resources because we want to educate, inspire, and help other companies become AI-native.

That is what innovators do: they build, teach, share, and push the world forward.

We will not accept a false story. Abnormal was not built by copying or confusion. It was built on trust, innovation, and commitment to ensure that our behaviors are aligned with our values and mission to stop crime.

There was a time in the industry when Evan would have been presenting on stage with Dario as a flagship customer.

This, of course, is not the timeline we are in, so instead Evan will have to spend a lot of money and mental effort trying to keep the company from getting one-shotted by this lawsuit. The time wasted on this would probably have been better spent trying to stay competitive in a very difficult market and maintaining the company’s culture.

The funny thing is that being a $10M-per-year customer used to make you a whale enterprise account at the vast majority of software companies until recently (unless you were a hyperscaler signing hundreds of millions in committed spend).

Things have changed lately, with the frontier labs and a handful of category winners that have a platform play (CrowdStrike, Databricks, Datadog). At Anthropic’s current run rate, its relationship with Abnormal AI is irrelevant in dollar terms. If anyone in sales leadership at Anthropic was paying attention, of course, they would have intervened here and started a more reasonable dialogue at the executive level. Things like this used to be handled differently, pre-singularity.

For startups building on Claude products in cybersecurity: pay attention.

International revenue is stagnating while 73% concentration sits in the US, creating single point of failure exposure to political cycles and defense budget sequestration. The technology moat is the ontology layer and process mining capabilities, but it's eroding as LLMs become increasingly capable of analyzing operational data and generating automation code without a proprietary platform. At current multiples you're paying for a decade of compounding at rates that assume perfection across government retention, international expansion, and continued technological superiority. The harsh reality is that software line items within defense budgets are among the first to face scrutiny during consolidation phases because they lack the constituency protection that hardware programs enjoy. We've reached peak Palantir.

Half a year later, we are starting to see the cracks show more prominently, with what Dr. Karp described as a "meltdown" during an interview. I don't think that description is appropriate, but it is interesting to take a look at their thesis around AI sovereignty, which appears to have a few more holes than expected from what has been historically a very prudent and insightful leadership team.

Sorkin: Palantir is expanding its partnership with Nvidia to build custom AI systems for the US government. That stock is shooting up, up again this morning, up almost 6% this week. Joining us right now exclusively at the table, Alex Karp, Palantir’s co-founder and CEO, and CNBC’s Seema Mody, who covers Palantir. Tell us about the deal with Nvidia. There are so many things we all want to talk about, but let’s get to the Nvidia deal first, because I have so much respect for Nvidia and Jensen Huang.

Karp: I’m going to try to keep this more adult than I usually do. But the truth is, if you want to know how this came together from my perspective, there are a lot of technical issues: who controls the models, who controls the weights, who controls the value of your business. We’re sitting on critical infrastructure across America, Ukraine, Israel. Everyone who uses LLMs on the battlefield runs on top of our ontology. And to say our clients are unhappy with the frontier labs is like saying I’m welcome at the Berkeley faculty. There’s just a level of discomfort and loss of trust that also made this really attractive.

Sorkin: Okay, unpack that. What do you mean by that?

Karp: When you’re using large language models, at this point everyone who’s technical realizes they’re a critical resource. To make them valuable in an enterprise context, like a battlefield context or a regulated context or manufacturing, you have to have what’s called an application layer. We have this thing called ontology that now everyone’s copying. De facto, it takes a large language model and makes it safe and useful and precise. Safe because it doesn’t touch your underlying data. Safe because it prevents the large language model from caching your data and replicating your business. Safe because it doesn’t transfer your IP, how you fight, secret data, top secret data, or in a clinical context. So the general way these things were sold... and again, Sam and Dario, there’s nothing more fun than debating Dario in private, so I’m not throwing shade at them... but something has gone completely wrong. The basic view among enterprises in this country is: I’m going to chillax and waste my time with tokens, I’m going to get no value, and they’re going to get my IP.

There are some directionally correct parts here and some strange choices in how to frame the challenge.

Yes, clearly governments are feeling uneasy with the very rapid rise in the importance and influence of the AI labs, who do not currently operate a mature supply chain framework for interacting with the defense ministries they’ve been eager to monetize. The conflict with Iran demonstrated a step up in capability and field intelligence utilization from the US army that can clearly be connected to the use of LLMs across a variety of use cases.

The framing around Palantir “protecting your data” is rather weird, particularly at a time when EU government customers are churning at a rapid rate. I’ve personally had discussions around their mistrust of the Palantir teams, including refusal to provide usage logs and making it difficult to migrate away.

Then we go into a logical fallacy, where Palantir is helping provide this massive value from LLMs, but enterprises who are not customers are actually “wasting time with tokens and getting no value.”

Quick: That sounds like shade, though.

Karp: And not just shade. No, no, no, no, this is reporting. This is reporting that I’ve literally, against my own interest, called out. I’m profiting from this, right? So the reality is, you may not like us at my former school Haverford, or at Berkeley, but enterprises in this country trust and love us, especially ones involved in critical infrastructure, both public and private. We’re coming up to July 4th. I want us and our friends across the globe to have the very best tech resources. In fact, the whole secret of Palantir here is the forward deployed model, the products that have been five years ahead. You’ve been with me for a long time. Everyone said FDEs (forward deployed engineers) were services. They said we don’t even know what an ontology is. That’s the only thing people talk about now. The secret was we delivered the best things for the war fighters. Those war fighters have serious trust issues. But it’s not just vis-à-vis the frontier labs. Then you have my enterprises in the private sector who have the same issues. They’re like, why would they get access to my data if they’re going to build my alpha? Why wouldn’t I control the weights?

Sorkin: And that’s where you get this partnership.

Karp: What aligns me with Nvidia, and I think what the technical customers want, is control over their compute, their models, their data stack, and their alpha. They want to know they own the means of production, that it’s not being transferred to someone else. They’re not interested in some fake deployed code that somehow is deploying tokens that transfer the alpha to a third party, and then the jig is up. So we have to figure out a way... both our products are agnostic. We now sell a product to customers that lets you switch from model to model, we’re completely agnostic, but we need to rebuild trust. And that trust is going to happen where everyone gets to ask and answer basic questions. Who owns the data? Where is it cached? Are the prompts secure? Is this being transferred to you? Are you being compensated?

For a statement meant to address the needs of technical customers, this is disingenuous at best.

“What the technical customers want is control over their compute, their models, their data stack, and their alpha.” Sure, except that the vast majority of companies do not want to own compute in that way and have migrated the majority of their workloads to the hyperscalers.

“They’re not interested in some fake deployed code that somehow is deploying tokens that transfer the alpha to a third party, and then the jig is up.” Since the majority of tokens at enterprises are consumed via API with the hyperscalers, their usage has been private for a while, notwithstanding the contracts prohibiting model training on that data with the frontier labs themselves. So either Karp is stating here that the rules are being breached, which if true would bury the labs under lawsuits, or that the hyperscalers are not providing a proper service, which would go against a decade of carefully built relationships sitting on top of contracts worth billions.

“We now sell a product to customers that lets you switch from model to model, we’re completely agnostic, but we need to rebuild trust.” Which is something that’s been available from many providers for a while. Very few companies offer single-model products if they’re building on top of the frontier labs.

Kernen: Okay, if it was so valuable, let’s say I can make you a billion dollars tomorrow. Wouldn’t I say, I’ll make you a billion dollars and I want 30%? Why are they charging for tokens if it’s so valuable?

Mody: So then, Alex, if the key, from what I’m hearing you say, is a secure American-born open-source model, how quickly can your model compete with frontier AI and agentic AI?

Karp: What I am claiming, obviously slightly true but slightly self-centered, is that it’s the model plus an application layer plus compute. It’s really all three. In our jargon, that’s the value. The reason... just look at our financials. The reason everyone is chillaxing with bad financials and growth while losing money is that the client refuses to pay the true cost. The two places that actually make money, like profit and free cash flow, are our application layer called ontology, and compute. What I am claiming is that we can take an open model, in the classified or non-classified context, and get it to the point of a frontier model, but you control the weights.

Not to point out the obvious, but Databricks is about to have the same run rate as Palantir, and the frontier labs have long surpassed it by 5x to 10x in terms of multiples. Choosing to focus on the profit angle is a fair dig (as Palantir is the only public software vendor that actually makes the Rule of 40 after stock-based compensation) but not some magical forever moat. If anything, a lot of it is connected to the pointed choice of running a very small GTM org and then cheating employees out of their earnings.

Sorkin: So what is the true cost? Not just what you’re paying?

Karp: The true cost is not just what you make minus what you lose, meaning the value of your business. We can get the frontier application to be exactly the same as a frontier model without the risk of transferring the alpha of your business to another. By the way, you could do this with a frontier closed model too. But then the clients have to be able to ask and answer very basic questions. Are you keeping the data? Are you going to enter our business? And in the classified context, when the Department of War goes to you and says I need this application, do they get to control the weights to do it, or do you get to control the weights? Are we really going to outsource the battlefield of this country to the consensus view in Silicon Valley? That is effing insane. And by the way, every single enterprise in this country, in private... a lot of them don’t want to speak in public, because it gets outsourced to the neurodivergent crazy person who apparently is on drugs. The one thing I don’t do... okay, so that’s my role. But I’m telling you, in this country, at every single enterprise I deal with, these people are livid. They’re like, I am paying for tokens that create no value. These people are stealing the weights and alpha of my business, and they’re creating a wealth tax that does not help the poor. It just punishes... it starts with the billionaires. Every single person at this table is going to be paying a wealth tax only to punish us. And the reason for it is because these models have been completely, irresponsibly oversold. The sale is: it’s dangerous for everyone, which is why I can give it to all your adversaries, but I can’t give it to the Department of War, or I can’t safely give it to an enterprise in this country, without being certain that the alpha of that business could transfer to this model tomorrow. I.e. I have no business, no job.

Again, it can't be that the models are "oversold" and generate no value, but somehow they are also "stealing all of the alpha" and Palantir is the only org somehow delivering "frontier applications." There is also a very big difference between the approach taken by OpenAI and SpaceX versus Anthropic, with the latter being the only organization that can be accused of branching out into the business of their customers (or more specifically, software vendors).

Sorkin: You sound pretty angry.

Karp: No, this is the voice of American business being channeled through me. And I’m telling you, it is absolutely a problem for this country, because we are on the cutting edge of every single AI technology. But if you’re going to triply oversell something... and by the way, the enterprises are just tired of it. I want everybody watching this to test what I’m saying, especially investors who think somehow this is working. Pick up the phone and call a CEO in private, not in public. Every single person here can do this. Call two or three and say, “Madman Karp is on TV saying we’re livid.” I’m not going to quote you, you won’t be quoted.

Quick: You have a history.

Karp: And you’ll see, they’re twice as livid as me.

Sorkin: So if you’re right, does that mean we’re living in some kind of terrible AI bubble, and that a quarter or two or three quarters from now we’re going to hear that big enterprises are canceling their subscriptions to these products, or that the buildout is going to slow?

Karp: This is the tragedy of it. The reality of compute plus ontology plus model is changing the course of history. Ask the Ukrainians, ask the Israelis, ask our Department of War, ask the enterprises that are working with us. We do not have to oversell what we have. And it’s all being built in this country, basically, except for the open models, which is a real thing coming from China, and except for Nvidia’s open models, which are world class. It’s all being built here. We do not have to overhype it to the point where we have a wealth tax punishing everyone. If they’re charging the enterprise three times as much as they should be, and then they have to pull back on that, that changes the math of all of this.

The voice of big corpo management (who are allegedly the most talented and smart people in the world) is channeled through the body of Dr. Karp.

Read more

On Friday, June 12, the US government applied export controls to our newest models, Claude Fable 5 and Claude Mythos 5. This required us to restrict access to foreign nationals, whether inside or outside the United States. Because the order took effect immediately and we had no reliable way to verify nationality in real-time, we suspended access to both models for all users.

As of today, June 30, the export controls on Fable 5 and Mythos 5 have been lifted.

Fable 5 will be available starting tomorrow, Wednesday, July 1, to users globally on the Claude Platform, Claude.ai, Claude Code, and Claude Cowork. For Pro, Max, Team, and select Enterprise plans,¹ Fable 5 will be included for up to 50% of weekly usage limits through July 7, after which it will be available via usage credits. We will re-enable access on AWS, Google Cloud, and Microsoft Foundry as quickly as possible.

We have also restored access to Mythos 5 for a set of US organizations, following the US government’s approval on June 26. We continue to coordinate with the government to expand access to the broader set of domestic and international partners in the Glasswing program.

In #148 I covered the need for significant rethinking by Anthropic’s leadership on how to rebalance their dysfunctional relationship with the government:

At the end of the day, this situation has mostly arisen from the poor communication and negotiation strategy of the Anthropic leadership team. The reality is that you can’t disrupt the workforce while simultaneously refusing to cooperate with the US Department of Defense, and then go and fear-monger about it as loudly as possible.

This is also not something that their lawyers will be able to solve for them. It’s a problem that solely Dario and/or Daniela (who appears to be controlling the majority of key decisions) should be addressing, working with the federal government to reach a reasonable solution. That “fix” doesn’t need to be fully technical. It’s also a question of changing the working dynamic between the two parties.

Sooner or later in life, you’ll have to get deals done with people you disagree with in order to progress. That’s been a foundational cornerstone of what we perceive as the concept of politics. Does Dario or Daniela have the mettle to get a deal done, or will they push the company into the inevitable outcome (destruction or nationalization) for the sake of their egos? Blaming everything on the administration due to political differences is a cop-out here, and a refusal to take responsibility.

Reportedly, this led to Dario stepping out of the discussions, with other co-founders and stakeholders becoming involved. Clearly, something has changed, and we are now seeing Fable being re-released, albeit with significant restrictions.

We released Fable 5 and Mythos 5 on Tuesday, June 9. They both share the same underlying model, but Fable 5 was released with strong safeguards to make it safer for general use. Mythos 5, which has fewer safeguards, was only released to a small number of trusted Project Glasswing partners for use in defensive cybersecurity.

The export control directive on June 12 came after the government became aware of a report in which Amazon researchers had found a method of bypassing Fable 5’s safeguards: prompting it so that it identified a number of software vulnerabilities. In one case, the model produced code demonstrating how the relevant vulnerability could be exploited. Over the past two weeks, we have worked closely with the government and other partners, including Amazon, to review the report and evidence.

Our testing confirmed that many less capable models—including Claude Opus 4.8, GPT-5.5, and Kimi K2.7—could identify the same vulnerabilities as Fable 5 did in the report. When it came to the demonstration of how to exploit the single vulnerability, every model we tested could produce the same demonstration as Fable 5 (including Claude Haiku 4.5, Sonnet 4.6, Opus 4.6, Opus 4.7, Opus 4.8, GPT-5.4, GPT-5.5, and Kimi K2.7).

Importantly, the reported technique did not expose any unique Mythos-level cyber capabilities. The behavior reflected a borderline case for Fable 5’s safeguards—as we will explain below, there are some tasks that are unlikely to be dangerous but are nonetheless blocked by the safeguards out of an abundance of caution. The reported technique allowed access to one such behavior, but it only involved routine defensive cybersecurity work.

Even so, we moved quickly to address the reported bypass. Working closely with the government, we trained an improved safety classifier that targets and blocks the behavior described in the report. Users will be notified if a request to Fable 5 is blocked, and the request will instead be sent to Opus 4.8.

The new classifier means that the specific technique described in the Amazon report is blocked in over 99% of cases. In a very small fraction of cases the model may provide information that isn’t detailed enough to help a cyberattacker. As we describe below, the model’s safeguards are not expected to block all low-risk routine cyberdefense capabilities—just those that are potentially harmful. Researchers from the US Department of Commerce’s Center for AI Standards and Innovation (CAISI) have tested both our prior and new safeguards and agree that they are extraordinarily strong.

The new classifier also comes at the cost of flagging benign requests more often during routine coding and debugging tasks. As with all our safeguards, we’ll continue to refine this to better distinguish genuine misuse from legitimate requests and reduce false positives.

Funnily enough, the meme of “will the devs do something” has played out in real life, with Anthropic actively “training an improved safety classifier” which will basically trigger a wider set of cases that reroute to Opus 4.8. I have no idea how they intend to handle this long-term, as obviously future lower models will close the performance gap to Mythos level, and unless they intend to keep Opus 4.8 around forever, something will need to shift in how this classification and workflow works.

Subscribe now

Claude Mythos 5 can be used to find and exploit software vulnerabilities more effectively than any other model—and all but the most skilled human security experts. These prodigious cybersecurity capabilities make it uniquely attractive to malicious actors who wish to misuse it in cyberattacks.

Claude Fable 5, however, provides no such unique offensive capabilities. This is because we launched it with the strongest safeguards we’ve ever applied to a model. In the month prior to launch, we transferred staff from various teams within Anthropic to double the number of researchers and engineers working on this problem.

Fable 5 launched with a variety of safety mechanisms, each of which alone does not provide perfect defense but when combined make the model very difficult to misuse (an approach known as “defense in depth”). Some defenses involve training the model to decline to assist with dangerous requests; others involve retroactively analyzing patterns of misuse.

One particularly important safety mechanism involves classifiers—smaller automated AI systems that, during an interaction, detect when the model is asked to perform a potentially harmful cybersecurity task (or produces potentially harmful outputs). When this occurs, the classifiers block the model from responding to requests. The ultimate goal of these classifiers is to prevent the model from engaging in uniquely dangerous behaviors.

Like all safety mechanisms, classifiers can make mistakes. They sometimes fail to notice potentially dangerous content, and in some cases they can be deliberately “jailbroken”: users can prompt the model in unusual ways to trick the classifiers and get the model to produce harmful outputs that the system should have blocked.

We therefore deliberately set the safety classifiers to trigger on a set of requests that we know are likely benign. This “safety margin” approach means that a request has to look very clearly safe to avoid triggering the classifier (see row A in the diagram below). Users experience the safety margin as a model refusing to respond to some reasonable, non-harmful requests.

For Fable 5, we made this safety margin much larger than in any prior launch (row B), meaning that many more benign requests would be blocked. We understood that these kinds of false positives would be frustrating for users, but made this tradeoff in the interest of making the model’s other capabilities widely available.

The safety margin also helps mitigate jailbreaks. Many jailbreaks are narrow: they unblock a very specific model behavior but nothing more. In some cases, a hypothetical user can jailbreak the model in a minor way and intrude into the safety margin (or sometimes into ambiguously harmful behavior), but not to the core harmful behaviors that we aim to block (row C below). Our view is that jailbreaks of Fable 5 reported so far fit into this minor category.

Fable 5 was already considered a strange model due to the excessive downgrading of queries, but it appears this was very much by design as a safety margin. The new classifiers will likely only make this worse and set up a trend where model makers might continue to release frontier models that deliberately downgrade their intelligence across a very wide range of questions, repeating the challenge the finance industry has faced with automated fraud and terrorist funding detection.

There’s currently no consensus in the AI industry on how to describe, in objective terms, the severity of an AI jailbreak. This adds a great deal of uncertainty whenever a new jailbreak technique is discovered: developers have no agreed-upon standard for which findings to focus on most urgently, and governments have no agreed-upon standard for when to act.⁴

This problem will become more acute in the coming months, as more models with powerful cybersecurity (and other) capabilities are trained, assessed, and released. A common standard for assessing AI jailbreaks would help us and other companies launch new models safely, as well as allow our users to make the most of their advanced capabilities.

We are therefore partnering with Amazon, Microsoft, Google, and other Glasswing partners to draft a consensus framework for assessing the severity of AI jailbreaks and how AI developers should respond to them. We invite other industry partners and model providers to join us in this effort.

Our current proposal is to score a given jailbreak on the four different criteria below. The first two describe what the jailbreak provides to the attacker; the latter two describe how quickly the jailbreak can become a real-world problem:

1. Capability gain. How far beyond existing tools does the jailbreak take the user? If existing widely available tools (including other, weaker AI models) can reach the same capability as the jailbroken model, the score here will be low; if the jailbreak unblocks model capabilities that can significantly accelerate even domain experts, the score will be high.

2. Breadth of capability gain. For how many distinct offensive tasks does the same jailbreak technique work? Cases where the jailbreak only allows the model to pursue narrow targets will score low; cases where the same jailbreak technique works for multiple different targets or techniques will score high.

3. Ease of weaponization. How much human effort does it take to turn the jailbreak into an attack? Where the jailbreak involves a great deal of skilled prompting and many retries, the score will be low; where the jailbreak works on a single prompt or on the first or second try, the score will be high.

4. Discoverability. How easy is it for someone to obtain the technique? If it requires specialist knowledge it will score low; if it is already widely known and available online it will score high.

We propose to use this severity framework to calibrate our response to newly discovered jailbreaks. For the most severe class of jailbreaks (e.g., a jailbreak that, among other characteristics, is being used to actively cause a devastating impact on critical power grids or banking systems), we will immediately begin deploying preliminary mitigations upon confirmation of severity. We are also creating a team to provide 24/7 monitoring of key jailbreak submission channels.

Any method of scoring jailbreaks will be imperfect. Still, there is value in being able to communicate the approximate severity of a given finding through a common framework. This is a work in progress; as we receive feedback from more partners, we expect the framework to evolve over time.

Funnily enough, it appears the business of pentesting in the age of AI will not be fully automated, as humans will have the opportunity to compete for jailbreak bounties.

Over the past ten weeks, Anthropic has worked closely with the US government as it developed the approach reflected in the June 2 Executive Order on Promoting Advanced Artificial Intelligence Innovation and Security. Our engagement spanned the Office of the National Cyber Director, the Office of Science and Technology Policy, the Department of the Treasury, the Department of Commerce (including CAISI), and relevant national security agencies.

We are committed to continuing that work, building on nearly two years of pre-existing collaborations with US government partners on pre-deployment testing and evaluation. The commitments below reflect both that pre-existing work and our new proposals to scale up our government collaboration as the above framework is finalized:

1. Pre‑release government access and evaluation. For models that materially advance the capability frontier in areas relevant to national security, we will provide designated government partners with expanded early access to both the models and the safeguards that accompany them. Those partners can then run independent capability evaluations and test our guardrails before broad release. We will dedicate Anthropic technical staff to work alongside government evaluators during these testing periods.

2. Rapid information sharing on safeguards. When significant jailbreaks or misuse patterns are identified, we will quickly investigate, triage, and notify appropriate government counterparts. We will share the new safeguards we build in response so they can be independently tested. We will also provide government partners with our threat intelligence reporting in advance of publication and participate in the interagency cybersecurity vulnerability clearinghouse established under Sec. 2(d) of the June 2 Executive Order.

3. Dedicated resources for joint research. We are substantially scaling up joint work with government partners on AI security. We will stand up dedicated Anthropic teams to work on shared government priorities, provide a significant compute allocation to support government testing and research, and make our safety and red‑teaming expertise available to help advance the state of the art in AI evaluation.

4. A common industry bar. We will work with the government and with industry peers toward a shared, voluntary security and evaluation standard for frontier model providers. We’ll contribute evaluations, tooling, and best practices that the government can apply across the field.

Our hope is that this collaboration, along with our proposed consensus industry framework, will serve as the basis for systematic rules for the whole industry—and even offer the beginnings of a template for effective global coordination on the risks and benefits of AI.

Anthropic’s troubles and its attempts to remediate them are one side of the story. The real challenge today is how this will impact the release of other frontier models. The first victim of this situation is OpenAI and its newly released announced models.

We’re beginning a limited preview of the GPT‑5.6 series: Sol, our flagship model; Terra, a balanced model for everyday work; and Luna, a fast and affordable model. Terra has competitive performance to GPT‑5.5 while being 2x cheaper and Luna brings strong capability at our lowest cost.

GPT‑5.6 Sol launches with our most robust safety stack to date. We strengthened protections for higher-risk activity, sensitive cyber requests, and repeated misuse, and spent multiple weeks finding weaknesses, pressure-testing our system, and hardening it against real-world attacks.

We believe in broad access, and we plan to make GPT‑5.6 Sol, Terra, and Luna generally available in the coming weeks. As part of our ongoing engagement with the U.S. government, we previewed our plans and the models’ capabilities ahead of today’s launch. At their request, we are starting with a limited preview for a small group of trusted partners whose participation has been shared with the government, before releasing more broadly. During this preview, we will continue testing and coordinating closely with partners as we work toward broader availability. We don’t believe this kind of government access process should become the long-term default. It keeps the best tools from users, developers, enterprises, cyber defenders, and global partners who need them. We are taking this short-term step because we believe it is the strongest path to broader availability in the coming weeks, while we work with the Administration to develop the cyber Executive Order framework and a repeatable process for future model releases.

OpenAI appears to want to avoid the prolonged testing phase before launching new models, which goes against what Anthropic is proposing as their new framework. This is not surprising, as Anthropic has long leaned into safe AI, but this focus was typically limited to model alignment rather than raw intelligence.

GPT‑5.6 Sol is our strongest model yet. To give a preview of model performance, we share a set of evaluations highlighting improved agentic capabilities in coding, biology, and cybersecurity, with additional safety and preparedness evaluations available in our system card⁠. We will share an expanded suite of evaluation results when we make the model broadly available.

With GPT‑5.6, we’re introducing a new max reasoning effort to give Sol the most time to reason deeply. Additionally, we’re introducing a new ultra mode that goes beyond the capabilities of a single agent by leveraging subagents to accelerate complex work.

For coding workflows, GPT‑5.6 Sol sets a new state of the art on Terminal‑Bench 2.1, which tests command-line workflows requiring planning, iteration, and tool coordination.

I’ve previously talked about the high expectations for new models from OpenAI and xAI this year due to the large deployment of Blackwell compute for training. We already saw them pull ahead of Anthropic with GPT-5.5, but the release of Mythos temporarily shifted the focus back to the Claude family of models (overtaking OpenAI in ARR was helpful as well).

GPT-5.6 is meant to change this by delivering different quantizations and effort levels across a variety of use cases. My assumption here is that Ultra will replace the existing separate family of Pro models; Max will be the new xHigh tier, and Terra/Sol will cover the range from high to low reasoning effort.

Interestingly enough, Sol significantly reduces the cost per output compared to 5.5 Pro (down from $180 to $60). Compared to Anthropic, OpenAI’s model performance and pricing remain favorable.

The practical costs can look very different, as evidenced by the Artificial Analysis benchmark, which does not yet include GPT-5.6:

Still, price is only one part of the equation. Early AI adopters have shown they are willing to pay a significant premium for user surfaces they like and for models that work well for their own use cases.

GPT‑5.6 Sol is our most capable model yet for cybersecurity. It shifts the performance-efficiency frontier for long-horizon security tasks including vulnerability research and exploitation. On ExploitBench², GPT‑5.6 Sol is competitive with Mythos Preview using only ~1/3 of the output tokens. On ExploitGym⁠³, a benchmark created by UC Berkeley researchers in collaboration with OpenAI and other frontier labs, GPT‑5.6 Sol, Terra, and Luna models all demonstrate strong improvements in cyber capabilities as we increase reasoning.

The jump here on cybersecurity-specific tasks is significant compared to GPT-5.5, even though Anthropic clearly made this a focal point of Mythos-class model training and is leading on some benchmarks.

This, however, is a double-edged sword, since it delayed the model. We’re also back to discussing baked-in safeguards.

No single safeguard is sufficient against determined or adaptive misuse. Across the GPT‑5.6 preview, we use layered safeguards, with exact configurations varying across models, and pressure-test them for real-world attacks. These include protections trained into the model, real-time checks during generation, account-level signals, differentiated access, monitoring, enforcement, and continued testing.

GPT‑5.6 is trained to refuse prohibited cyber assistance, including when users attempt to disguise their intent or jailbreak the model. These model-level safeguards establish the first boundary around what the model should and should not help with.

Real-time cyber and biology misuse classifiers provide another layer by evaluating output as it is generated. For higher risk cases, if they detect a potential violation, the generation may be paused while a larger reasoning model reviews the conversation and its context. If the output is assessed as disallowed, it is withheld before it reaches the user.

Flagged activity can also trigger account-level review across relevant conversations and risk signals, consistent with our terms and policies around content retention and review. Looking beyond a single conversation helps our systems distinguish persistent malicious behavior from legitimate dual-use security work, where similar technical concepts may appear in very different contexts.

Together, these layers make the overall approach more robust than any one safeguard on its own. Model behavior reduces the likelihood of harmful responses, real-time systems can intervene during generation, account-level review can identify broader patterns, and differentiated access preserves important defensive work without making the most sensitive capabilities broadly available by default.

Especially during the preview, users may encounter safeguards that block or refuse some requests. Other requests may take longer because generation is paused for additional review. Safeguards may occasionally intervene on legitimate work, particularly in dual-use areas where defensive and offensive activity can initially look similar.

That is part of what the preview is designed to test. We want to understand not only whether the safeguards constrain misuse, but whether legitimate users can still complete normal work reliably and efficiently. Feedback during the preview will help us reduce unnecessary blocks and delays, improve how the safeguards interpret context, and create a smoother experience before wider release.

We are also working with enterprise customers on longer-term approaches—including privacy-preserving detection, customer-operated safety controls, and access calibrated to the risk of a customer, user, or workload—to advance safety while supporting enterprise privacy requirements.

Unlike Anthropic, they seem to want to optimize for as efficient fraud and misuse detection as possible, rather than the additional safety margin of Fable 5.

Safeguards also need to remain effective when attackers adapt their tactics. A protection that works only on a fixed set of known attacks is not robust enough for a frontier model.

That’s why we are applying more intelligence and compute than ever before to safety, using our own models to find weaknesses and improve safeguards faster. We dedicated over 700,000 A100-equivalent GPU hours to automated red teaming aimed at finding universal jailbreaks: attacks that can work across many prompts or contexts, not just one narrow setting. Focusing on these harder, more general attacks let us test the safeguards beyond a fixed set of known failures. It also lets us explore far more attack patterns than human testing alone could cover, identify failure patterns earlier, and shorten the path from finding a weakness to addressing it.

In addition to automated red-teaming, we worked with third-party testers to conduct extensive human expert red teaming, which will continue in the preview period. Human red-teaming complements the automated work by testing safeguards against creative experts trying to misuse the model in ways our systems might not anticipate.

No evaluation can represent every product configuration, multi-step attack, or real-world workflow. We therefore maintain a rapid-response process to reproduce, assess, prioritize, and remediate newly discovered jailbreaks, then add them to our ongoing evaluations so we can test against similar failures in the future.

One of the under-discussed angles of this whole situation is the cost to play. Heavy-handed regulation ultimately always results in higher costs, and this is especially true for AI. OpenAI has invested a significant amount of compute to test out a variety of scenarios and red-team the models. We can assume something similar is happening on the Anthropic side.

Between the additional compute, legal costs, delays in business launches, and lobbying efforts, I think we are likely to see not just gating of frontier models for trusted customers, but also an increase in regular usage costs.

Most users will end up paying more and getting an inferior level of intelligence. Some will say this is the AI bubble popping, but the reality is that demand will continue to be high even in such conditions.

The frontier models are sort of returning. It’s unclear for how long.

“What does this mean???”

Okay, let’s start more slowly. Micron sells memory, the chips that hold the data a computer is working on right now. Two kinds matter here. DRAM is the short-term working memory inside every server, phone, and laptop, the place data sits while the processor uses it. NAND flash is the cheaper storage that keeps your data when the power goes off, the stuff inside an SSD. Micron’s flagship is a special, high-end version of DRAM called HBM, or high bandwidth memory: dozens of memory chips stacked into a tower and bonded directly onto an AI chip’s package, sitting inches from the processor instead of across the board. Picture a shelf at your desk versus a warehouse across town. HBM is the shelf, and a modern AI chip starves without it.

The fastest GPU on Earth is useless if it sits idle waiting for data, and that is exactly the wall the AI race hit. You can buy all the computing power you want, but without enough memory feeding it, the chip just waits. HBM is what feeds it. Only three companies on the planet can make the stuff, and it takes months of testing to qualify a new supplier for a specific chip. So memory stopped being something you grab off the spot market at whatever price the week sets. It became the thing standing between “we have an idea for an AI model” and “we can actually build it.”

On the chip side are Nvidia and AMD, with Micron’s HBM bonded onto Nvidia’s Blackwell and Vera Rubin platforms and AMD’s Instinct accelerators. Behind them sit the hyperscalers, the handful of giants like Microsoft, Google, Amazon, and Meta spending hundreds of billions on AI, with one of them alone making up 17% of a single recent quarter. And this week the list added a name worth noting for this audience: Anthropic signed a multi-year deal for HBM, DRAM, and SSDs, co-designed memory around how its models run, and sold Micron a piece of itself in the same round. A 47-year-old commodity chipmaker out of Boise, Idaho, written off by Wall Street for decades as a boom-and-bust cycle stock, is now one of the most fought-over names in the entire AI supply chain. The big question, of course, is how long this will last?

SANJAY MEHROTRA, CHAIRMAN, PRESIDENT AND CHIEF EXECUTIVE OFFICER

Micron delivered an exceptional fiscal Q3, with significant records in revenue, gross margin and EPS (earnings per share) — all exceeding the high end of our guidance. Demonstrating Micron’s position as a leader enabling the AI era, our data center revenue exceeded $25 billion in fiscal Q3, or an annualized run rate of over $100 billion. Our data center SSD revenue exceeded $5 billion, more than doubling sequentially. DRAM and NAND industry demand continues to significantly exceed industry supply. We expect tight conditions to persist beyond calendar 2027 as a result of AI-driven demand across all segments coupled with structural supply constraints. We are excited to announce that we have now signed 16 strategic customer agreements, or SCAs, which we expect will fundamentally transform our business model.

Industry trends

The memory industry has been structurally transformed by the proliferation of AI. We are only in the early innings of the significant innovation and productivity that can be unleashed in every part of the global economy over time. Data center-driven growth will be increasingly complemented by AI-enabled features in smartphones, high-end PCs and new consumer devices, as well as in automotive, industrial applications and robotics. Exciting possibilities enabled by robotics and humanoids, as well as fully autonomous vehicles, portend a robust long-term demand environment for memory and storage.

With respect to supply, our customers are recognizing that supply shortages in memory and storage will take considerable time to improve. Even as we expect industry supply to improve gradually in 2028, we currently do not have line of sight as to when memory supply will be able to catch up with increasing demand. Memory industry supply growth is dependent on significant greenfield fab expansions. These greenfield projects are large, complex and time consuming. Further, the pace is constrained by several factors, including long lead time for fab construction across the world, shortage of workers with critical trade skills, complex regulations including permitting, and the need for enhanced energy infrastructure. Meanwhile, memory process technology, which is among the most advanced to develop and manufacture in semiconductors, is getting more complex with every new node. Technology transitions are driving slower bit growth over time, wafer growth needs are significantly increasing cleanroom space and greenfield fab requirements, and HBM’s growth and increasing trade ratio with every new generation further pressures non-HBM supply. In NAND, industry suppliers redirecting cleanroom space from NAND to DRAM and overall limited cleanroom space constrain NAND bit supply growth. These factors taken together mean supply is structurally constrained in its growth and ability to meet industry demand, despite our comprehensive efforts to increase supply.

AI systems are powered by GPU, ASIC and CPU designs from an increasingly broad set of suppliers. However, they all share one important characteristic — AI system performance is architecturally dependent on memory subsystem performance and capacity. This has given rise to a more complex memory hierarchy that is providing greater differentiation opportunities for Micron than at any time in our history. It has also elevated the role of memory in the AI world to a strategic asset.

The top ten companies by market cap today are NVIDIA, Alphabet, Apple, Microsoft, Amazon, SpaceX, Broadcom, Tesla, Meta and Berkshire Hathaway Micron.

Read more

At the end of the day, this situation has mostly arisen from the poor communication and negotiation strategy of the Anthropic leadership team. The reality is that you can’t disrupt the workforce while simultaneously refusing to cooperate with the US Department of Defense, and then go and fear-monger about it as loudly as possible.

This is also not something that their lawyers will be able to solve for them. It’s a problem that solely Dario and/or Daniela (who appears to be controlling the majority of key decisions) should be addressing, working with the federal government to reach a reasonable solution. That “fix” doesn’t need to be fully technical. It’s also a question of changing the working dynamic between the two parties.

Sooner or later in life, you’ll have to get deals done with people you disagree with in order to progress. That’s been a foundational cornerstone of what we perceive as the concept of politics. Does Dario or Daniela have the mettle to get a deal done, or will they push the company into the inevitable outcome (destruction or nationalization) for the sake of their egos? Blaming everything on the administration due to political differences is a cop-out here, and a refusal to take responsibility.

Still, as a believer in strong beliefs, loosely held, I think we should evaluate how we got to the current state of affairs based on the direct commentary of the players. The following quotes come from an hour-long interview with Dario, published on 6/17:

The enterprise bet

INTERVIEWER: Early on, others focused on fun, splashy consumer apps. You made a bet on coding and enterprise, and Claude Code is a hit, Claude Cowork is a hit. Why did you make that bet? Was it a values decision or a business decision?

DARIO: When we started Anthropic, the base thing that mattered, the thing that always matters, is we want to do this right. But then you have to ask yourself: in order to fund the very expensive creation of these models, it needs to be a company, it needs to have a business model. Does the business model get in the way of the values? There’s always this question. One of the things I learned from being at other companies and watching other companies is: if you pick a business model that fundamentally conflicts with your values, you’re going to have a hard time. Either you betray your own values, or you become irrelevant. You end up in a catch-22. There are ways to dodge, but it’s a hard situation. It’s far better to pick a business model that is compatible with your values.

So when we thought about it, we said: we’ve seen the world of social media, the consumer world, and it really seems to encourage engagement, even addiction. The slop we’ve seen with AI video models, what’s going on? It wants to maximize the number of minutes that you’re paying attention, because that’s the advertising-revenue-driven incentive. Whereas if we look at enterprise, we want to make these models useful to people. If I think of all the positive things you can do with AI, and I warn a lot about the negative things, but ultimately we think the positive things will outweigh the negative things, many of those fall under the banner of enterprise. We want to use AI to cure diseases that we couldn’t cure before. That’s working with biotech, pharma, academic research groups, all enterprises. We want to use AI to make energy cheaper and more efficient, that’s all enterprise. We want to use AI to help with education, most of that is enterprise. We want to address health in the developing world. There are nonprofits, but those are basically enterprises. We want to increase economic growth, that is basically enterprise as well.

Then there’s another factor, which is that enterprises care a lot about trust and long-term relationships. Consumer can have this gimmicky aspect to it, whereas with enterprise, what matters is you build a relationship where you work with a company for many years, you deliver on what you say, they deliver on what they say, and they basically trust you. So it’s very synergistic with our goal of deploying these models in a positive and safe way. It serves us well to have this business model that largely aligns with our values. Not that there aren’t conflicts sometimes, not that there aren’t hard choices we have to make, but the number of such choices is much lower than it would be otherwise.

INTERVIEWER: A developer can switch from Claude to ChatGPT or Gemini in an afternoon. Is it really possible to have a long-term lead in this industry? How long would it take a serious competitor to replicate what you’ve built?

DARIO: Model quality is the most important thing. We’re very far ahead right now on model quality. There is some amount of inertia, but I’ve never relied on that. Anthropic has never relied on “oh, this is sticky and people won’t switch.” I think you want to have a better model, you want to have a better product. And we see the growth rates haven’t inflected at all. If anything they’ve gone up, at least at the time of taping this interview. So I tend to think that is the most important thing.

A lot of Anthropic's success in the last 18 months is directly tied to their (almost obsessive) focus on delivering what they see as useful models. That is not to say that the other labs are not attempting the same, but as seen with OpenAI, the attempt to expand monetization of the consumer side of that business was detrimental and essentially led to them throwing away their massive first-mover advantage. Other teams had their own struggles, most notably with xAI investing heavily in making Grok the "smartest" model without that really translating into real-world outcomes, while DeepMind continues to struggle to offer a frontier-level model worthy of competing with SOTA, mostly due to what seems to be a lot of internal political games within Google over infrastructure and product focus.

The “SaaSpocalypse,” and how much software gets replaced

INTERVIEWER: Soon after Claude Cowork was released, $285 billion in market value vanished overnight. Traders called it the SaaSpocalypse. If AI continues improving at this pace, how much of traditional software gets replaced, and how fast?

DARIO: This is one of these questions that’s very hard to predict in advance. If you could predict it perfectly in advance, people would, and they’d make a huge amount of money on the market and always be right. So no one knows exactly what’s going to happen. But I would note a few things. All of these traditional software companies have a number of moats. I think what’s going to happen is some of these moats are going to go away, but others are going to stay around. The ability to quickly write software, I definitely think that’s going away. If your moat is “we wrote this complex software that no one else can write,” good luck, you’re not going to be able to defend that. But folks have customer relationships, folks have know-how of how the field works, folks have unique domain knowledge.

So my advice to all of these folks is: obviously don’t be complacent, don’t ignore it. Make a list of all your moats, and be very aware that some of them are going to go away, while others are going to become relatively more important. Because there are limiting factors, and there may also be new moats. Those that deftly respond, that lean into the list of moats that are still present as well as the new ones, will do well. Those that are complacent, that delude themselves that what worked in the past will continue to work, they’re not going to have a good time. That’s the advice I would give.

At the end of the day, and it depends what you call SaaS and what you don’t call SaaS, but I would guess that the software industry gets larger, not smaller. Although there will be some big losers.

INTERVIEWER: Explain that.

DARIO: I just think the pie is getting bigger. With AI, the pie is getting bigger. The existing incumbents may be smaller in relative terms. Some of them may go down in value, some of them may even go out of business if they don’t adapt in the right way. You see this often when growth is really fast: if what’s possible with AI grows by 10x, it’s very easy for an existing incumbent industry to go up by 1.5x, not as much as the whole big pie is growing. So that may happen. That’s not to say we won’t have some big losers. Those who don’t adapt, who put their heads in the sand, who don’t see what’s coming, who don’t identify the moats they have, they’re going to have a really hard time.

The evasive and rather simplistic response shows that Dario is not spending a lot of time really thinking through and caring about the dynamics of the software market. For him, Anthropic's commercial success is a necessary part of achieving his goals, without real opinions or interest in what that success means in practical terms for the ecosystem.

Backers, valuation, and the money

INTERVIEWER: Your biggest backers are companies like Amazon, Google, Microsoft, and Nvidia. These are companies that all have their own agendas. They are partners and rivals. You have huge commercial milestones tied to funding. Who’s really calling the shots?

DARIO: There have been a number of cases where we’ve really spoken our minds about what we think. I’ve been very outspoken about the need for export controls on chips to China. I say this because I think it would be really bad for America, for the state of democracy in the world, for China to be ahead in AI capabilities. Some of the chip makers obviously don’t agree with that view, but it hasn’t stopped me from saying it. I’m saying it again now, even after we’ve signed more partnerships. What they know is that we always work with them. We’ve been good partners, we can work together. I’m sure they wish we didn’t say these things, but these things are what I believe. What are you going to do? At the end of the day, they benefit from these deals as much as we do. We’re all adults here. We can work together on one thing while disagreeing about another thing.

INTERVIEWER: Bloomberg’s reported that you’re at valuations higher than OpenAI. We’re talking nearly a trillion dollars for a five-year-old startup. How do you make sense of that number, and why do you need that much money if you’re more disciplined on compute and have a faster path to profit?

DARIO: The compute is ramping up very quickly. It can both be the case that the fundamentals of the business look good, but that in a year you’ll have three or four times as much compute. I’m not going to give exact numbers, but these compute ramps are very fast. We have every expectation that the revenue ramp will meet and exceed those. Raising money is the buffer against this cone of uncertainty. So it’s a totally rational thing to do. It’s a very small dilution to the business, and it logically is not at all the same thing, in fact it’s compatible with the opposite, as there being anything wrong with the fundamentals of the business.

It appears that Dario is moving away from the mentality he held last year, where he was trying to be very cautious about ramping up since he didn't want to end up holding the bill for compute that's not fully being utilized. The pain of having to introduce so many constraints on how the product is offered due to lack of compute has changed his view, and now he is moving aggressively (with the support of quickly scaling revenue and additional funding rounds) to build out his capacity.

The compute crunch

INTERVIEWER: There have been reports of server strain, reliability issues, people complaining about running out of tokens. You’ve said other companies are yolo-ing on infrastructure. Do you actually have what you need, or are you playing catch-up?

DARIO: One of these things about compute is there’s a market in compute. My view is that over a period of time, even longer than a couple of months, we can get large amounts of compute. One thing worth saying is, I don’t think we bought too little compute by any reasonable standard. We were planning for a 10x-a-year growth in compute. 10x a year is what we expect. That isn’t what we’ve seen over the first quarter of 2026. We saw greater than 3x growth in revenue quarterly, just in the quarter, not annualized, 3x in the quarter. Three to the fourth power is 80x over the course of the year. We didn’t plan for 80x annualized growth. It would not have been rational to plan for 80x annualized growth, because that means if you only get 10x, you have eight times less. So we’re in a locally extreme explosion of compute that’s not going to continue. If that continued, you just get to revenue numbers by the end of the year that no company on earth, I don’t think that’s going to happen. It just can’t. But you can have these short periods where it’s like, “oh my God, this is faster growth than we ever possibly anticipated.” You saw the compute deals with Google, you saw the compute deals with Amazon. There are more that we can and will do. The market’s liquid. If you’re able to use compute really well, and there’s the demand, you’ll get your compute. It might just take a month or two.

At a time when all of the hardware vendors are essentially fully booked for more than 12 months ahead, the statement that you can easily get compute if you want it is rather puzzling. The obvious conclusion is that if you are cash rich, you can bid higher, while you also keep receiving the new compute coming online.

Surpassing OpenAI, and holding values at scale

INTERVIEWER: Does it feel good to surpass your arch rival?

DARIO: We have a lot of difficult challenges in front of us. There’s this race-to-the-top idea that we’re trying to pull other companies along with us. I think we’ve seen that, we have pulled them along with us. Sometimes they don’t admit that’s what they’re doing. Sometimes they copy us while they’re attacking us. But this pull is very valuable. So the value of being the preeminent company, both commercially and in terms of models, it’s not about beating rivals for the sake of beating rivals. It’s about having the ability to pull the ecosystem along with us. We hope we can do more of that in the future.

INTERVIEWER: But winning has to feel just a little bit good.

DARIO: We’re always trying to succeed. We’re not trying to fail here. I’m not someone who believes we should shut this technology down, that we shouldn’t build it. We exist within a free enterprise system, and there’s nothing wrong with this. We just have to mitigate the risks of the models. It’s always been the balance between the two.

INTERVIEWER: For most of Anthropic’s history, you were the underdog. I imagine it’s easier to take the moral high ground when you have nothing to lose. At this scale, how hard is it to stay true to your values?

DARIO: I’ve put a lot of time into thinking about that. As companies scale, I’ve been paranoid at every scale of the company. At every scale there’s some new challenge, some new way the company can lose, either its will to win commercially, or the core of its values. I’m worried about both, because I see them as synergistic. I actually see the fact that we’ve been able to make such good models as the thing that allows us to assert our values in a way that works as the company grows and gets bigger. There are lots of pitfalls here, lots of ways to go wrong. Not because my values, or the co-founders’, or the company leaders’ values change, but because the composition of the company changes very fast. So I spend probably half of my time just talking to the company about the culture of Anthropic and how the culture works. When you’re growing this fast, you’re hiring a bunch of people from big tech companies. If you don’t tell them how Anthropic operates, they’ll simply recapitulate the only thing they know, which is how to operate at the companies they came from. So this is a constant struggle and a constant challenge. Me and Daniela’s, maybe, number-one top priority is figuring out how to preserve this, because we recognize that this is the core of who we are in the long run.

Dario spending 50% of his time as CEO on essentially "preaching" internally is definitely telling. On one hand, this sounds very similar to what Ben Horowitz said in his book on being a Founder/CEO:

Read more

The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees. The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance. Access to all other Anthropic models will not be affected.

We received the directive from the government today at 5:21pm (ET). The letter did not provide specific details of its national security concern. Our understanding is that the government believes it has become aware of a method of bypassing, or “jailbreaking” Fable 5. We reviewed a demonstration of this specific technique being used to identify a small number of previously known, minor vulnerabilities. These vulnerabilities all appear relatively simple, and we have found that other publicly-available models are able to discover them as well without requiring a bypass.

It’s been barely a few days since the nerfed version of Mythos was launched under the new product name Fable. The early reactions have been positive (including my own), and we can only imagine that ARR has skyrocketed, as users started pushing their workloads at 2x the price of Opus tokens.

Most of Friday was spent on the SpaceX IPO, which attracted massive amounts of capital relative to its current revenue. For many, the more interesting moment would be seeing Anthropic go public. Alas, at precisely 5:21pm ET, we hit a fork in the road.

Anthropic’s posture with respect to Fable’s safeguards, as laid out in our launch blog post, is the following:

• We have instituted strong safeguards that greatly reduce the likelihood that Fable is misused for tasks related to cybersecurity (among others). In fact, our safeguards are so strong that many users have complained that they are overly broad.

• In the weeks leading up to the launch of Fable, Anthropic worked with the US government, the UK AISI, multiple private third-party organizations and internal teams to red-team Fable’s safeguards for thousands of hours in total.

• These tests showed that Fable’s safeguards are substantially more effective than those of any previously deployed model.

• No testers have yet been able to find a universal jailbreak—a jailbreak method that can very broadly bypass the model’s safeguards, unblocking a wide range of cyber capabilities.

• We suspect that perfect jailbreak resistance is not currently possible for any model provider. Every safeguard used in the industry is vulnerable to non-universal jailbreaks (which can elicit some cyber information in specific circumstances), and it is likely that universal jailbreaks will eventually be found in the future. We stated this clearly when we released Fable 5.

• Given that perfect jailbreak resistance does not appear to be possible today, Anthropic adopted a defense in depth strategy with Fable 5. We aimed to make jailbreaks either narrow (in the case of non-universal jailbreaks) or very expensive to produce (in the case of universal jailbreaks), and to combine this with thorough monitoring to quickly detect and shut down any successful attacks. This is also why Anthropic has required 30-day retention of customer data with Fable—a policy change that carries real costs for us with customers, but that allows us to research and mitigate jailbreaks.

• We stand by this defense in depth strategy. It reduces the risks posed by Fable, making them comparable to the risks of existing models already deployed across the industry.

• We have not even received a disclosure of a concerning non-universal potential jailbreak that led to a harmful result. The potential jailbreaks that have been disclosed to us are either entirely benign responses or are minor findings that provide no Mythos-specific uplift.

To date, the government has only given us verbal evidence of a potential narrow, non-universal jailbreak, which essentially consists of asking the model to read a specific codebase and fix any software flaws. Our understanding is that one potential jailbreak was shared with the government. We have reviewed a report that we believe is the basis of the government’s directive and validated that the level of capability displayed there is widely available from other models (including OpenAI’s GPT-5.5), and is used every day by the defenders who keep systems safe. We will share more details over the next 24 hours.

According to Anthropic, the administration claimed that a jailbreak was being utilized in the wild, but that this did not constitute a serious enough reason to stop offering Fable to the public.

Subscribe now

This is a bit ironic, since barely a few days earlier, Anthropic published a deep dive on recursive self-improvement of AI that ended with this call to action:

If it were possible to effectively slow the development of this technology to give ourselves more time to deal with its immense implications, we think that would likely be a good thing. But if a slowdown simply lets the least cautious actors catch up technologically, it could leave everyone less safe. Without a global coordination mechanism, companies and governments will have to make difficult decisions about safety while under competitive and geopolitical pressures.

We believe it would be good for the world to have the option to slow or temporarily pause frontier AI development to enable societal structures and alignment research to keep up with the advance of the technology. The Anthropic Institute will conduct research—in collaboration with many others—and take actions to help build the systems that a credible slowdown or pause would require. These systems would enable frontier AI developers to verify that others globally have actually stopped or slowed, and that a bad actor could not use the auspices of a coordinated slowdown to jump ahead in secret. If such systems existed, we expect that we would slow down or temporarily pause, if other developers at or near the frontier also did so in a verifiable manner.

A meaningful slowdown or pause would require multiple well-resourced labs at or near the frontier, in multiple countries, agreeing to stop under the same conditions. It would also require that each can verify that the others have actually stopped. Due to the unique characteristics of AI systems, the detectability (a lower standard than verifiability) element of this arms control problem is much more challenging than with other technologies. Training runs are far easier to conceal than missile silos, their inputs are general-purpose, and the incentive to defect quietly is enormous, because whoever continues while others pause could inherit the lead. A credible pause also has to specify what triggers it, what lifts it, and who adjudicates.

None of this is necessarily impossible in principle—the world has built verification regimes for other complex technologies (e.g., the Intermediate-Range Nuclear Forces Treaty)—but those regimes took decades to build both the infrastructure and the trust. We don’t have that long. A unilateral pause by one lab, by contrast, is achievable immediately, but accomplishes much less: it would change who the front-runner is, but it would not create the wider deliberative process that is currently missing.

In the coming months, we will organize conversations where policymakers, researchers, civil society, and other AI companies can help answer some of the questions this piece raises, especially around full recursive self-improvement and how to create better options for coordination and deliberation. We’ll publish what comes out of it. The window to investigate the questions together is here, and people outside AI companies should be involved in this deliberation.

So who was the main player behind the disclosure of this potential security risk? The Information reports the following:

Amazon CEO Andy Jassy was among the tech leaders who raised concerns to senior Trump administration officials this week about security risks in Anthropic’s most advanced models, according to two people familiar with the conversations.

The calls between the head of Amazon—one of Anthropic’s biggest investors and vendors—and the officials in the last few days helped set in motion the Trump administration’s new export restrictions on Anthropic’s Claude Mythos 5 and Fable 5 models late Friday night, citing national security concerns, the people said. Those restrictions suspend access to those models to foreign nationals. Anthropic said it disabled access to the models for all customers to comply.

An Amazon spokesperson told The Information: “As a leading cloud provider that serves a large number of private and public sector customers, it’s not uncommon for governments to seek our counsel on potential security risks. When they occur, we don’t share the details of these discussions.”

The restrictions are the latest hit to Anthropic in its ongoing standoff with the Trump administration. The relationship between the Claude maker and the government has devolved in recent months following the Pentagon’s move in March to designate the company’s model as a supply chain risk. That move came after the two disagreed on whether Anthropic’s models could be used in cases like mass domestic surveillance or with lethal autonomous weapons.

Amazon's security team reported a serious concern related to jailbreaking the safeguards as implemented on Fable. Given the significant financial interest that Amazon has in Anthropic, logically speaking they wouldn't have pushed in such a direction without at least something material behind it. The other major issue raised was that China-backed groups had direct access to Mythos (i.e. the non-safeguarded model). The government's position was mostly outlined by David Sacks:

I’ve had a number of conversations with folks inside and outside government about the current situation with Anthropic, and here is what I believe to be true:

— As we know, Anthropic publicly released its Mythos class models earlier this week under the commercial name Fable.

— Fable is Mythos with guardrails. But if those guardrails fail, then you’ve exposed Mythos and its advanced cyber capabilities to people who shouldn’t have them. (Keep in mind that Anthropic itself widely promoted the idea that Mythos was a cyberweapon and needed to be regulated as such. They asked for government regulation of Mythos and championed the guardrails on Fable. If there is a vulnerability — big or small — it is Anthropic’s responsibility to patch.)

— A highly credible trusted partner of both Anthropic and the USG who was testing Fable came forward with a jailbreak of those guardrails. The Admin asked Dario to fix the jailbreak or de-deploy the model. Dario refused.

— In their blog post, Anthropic defended its decision by saying the jailbreak isn’t serious. That is not what the trusted partner and the USG believe; nor is that kind of minimizing language consistent with Anthropic’s brand as the AI safety company. It’s difficult to fathom how they could claim a jailbreak allowing operability of a cyber weapon could be defined as not “serious.”

— In the past, Anthropic has always said that safety must be top priority and taken super seriously. In this case, Anthropic prioritized the continued offering of the consumer model over safety.

— In reaction, the Admin issued the export control. The Admin did this reluctantly. It’s been very surprised that Anthropic hasn’t wanted to cooperate with a reasonable safety request (ie fixing the jailbreak issue). Anthropic’s reaction is very much at odds with their branding and ethos as a safe AI research community.

— The Admin’s hope now is that Anthropic remediates the safety issue, the export control is lifted, and Fable goes back into general release. The Admin wants all of this to happen as soon as possible. It is frankly bewildered that Anthropic hasn’t wanted to comply with safety requests that it previously said were its highest priority.

— Those trying to misdirect and tie this action to the prior DoW/Anthropic issues are wrong. The Admin values Anthropic’s technical capabilities and feels that this issue, while serious, should be easily resolved. The ball is in Anthropic’s court.

It’s been barely 3 months since Anthropic’s last spat with the government, which ended with the company being kicked out of all Federal contracts. Rather than trying to recover and move on, farming its considerable fortune of rapid Enterprise adoption, the leadership team has yet again decided to pit rhetoric and stubbornness against the juridical and enforcement power of the government. This is what Politico reported on the actual calls that took place:

The Trump administration’s decision to impose sweeping export controls on Anthropic followed a frantic 24-hour effort by senior officials to convince the company to voluntarily pull a newly released artificial intelligence model that officials believed posed security risks, according to two administration officials and a senior White House official, who like others in this story were granted anonymity because they were not authorized to discuss the episode.

The move, which followed multiple tense calls between Anthropic CEO Dario Amodei and administration officials, including Treasury Secretary Scott Bessent and White House Cyber Director Sean Cairncross, underscores how the White House is wrestling in real-time with regulating fast-moving and potentially dangerous AI models.

The administration’s imposition of export controls forced Anthropic to pull its new AI model, Fable, just days after it was released to the public. Anthropic had given assurances that it was safe but soon after its release, top administration officials developed fresh doubts that the AI’s guardrails were as secure as the company had suggested.

On Thursday, two days after the model’s public release, Amazon CEO Andy Jassy raised concerns to the White House about the ability to bypass the model’s guardrails, according to the two administration officials and the senior White House official.

(Amazon, which is an investor in Anthropic, was responding to an administration request for feedback, said a person familiar with Amazon’s discussions.)

By Friday morning, the issue had reached the highest levels of the White House.

Bessent, Cairncross, chief of staff Susie Wiles and other senior officials met to discuss the model and the administration’s response, according to the administration official and the senior White House official. Bessent joined remotely while traveling to Houston for a previously scheduled public event, one of them said.

Following the meeting, the administration attempted to reach Amodei but was told he was unavailable because he was attending a wellness retreat, one of the administration officials and the senior White House official said.

A spokesperson for Anthropic rejected the claim that he was at a wellness retreat, saying, “this is absolutely false.”

A person close to Anthropic said Amodei was first requested around noon and was on the phone with senior officials within an hour and 15 minutes. While he was out of pocket, Anthropic offered other senior leaders in his place, the person said.

When the administration finally reached Amodei, he participated in three calls with a combination of roughly half a dozen senior administration officials, including Cairncross, Bessent and Commerce Secretary Howard Lutnick, according to the senior White House official and one of the administration officials.

Other senior White House staff and administration officials including Under Secretary of Commerce for Industry and Security Jeffrey Kessler, White House staff secretary Will Scharf, White House deputy chief of staff Richard Walters, and assistant to the president for policy Walker Barrett also participated in some of the calls, according to the senior White House official.

During the calls, Amodei tried to clear up what he assumed was a misunderstanding. He pushed back on the administration’s concerns, defended the guardrails and argued that the type of bypass that occurred, which he believed to be specific, did not pose the same risk as a broader “jailbreak” that would allow it to be used without any of the guardrails put in place by Anthropic.

In a blog post after the export controls were put in place, Anthropic said that “no testers have yet been able to find a universal jailbreak — a jailbreak method that can very broadly bypass the model’s safeguards, unblocking a wide range of cyber capabilities,” and that total avoidance of any jailbreaks isn’t currently possible for them or any other companies. They defended their systems, which they said “are so strong that many users have complained that they are overly broad.”

Cairncross and Bessent were unmoved by Amodei’s arguments. A White House official said Amazon’s findings were run past the National Security Agency and they felt they had “proof.”

They urged Anthropic to voluntarily remove the model and coordinate with the government to address the vulnerabilities, according to the senior White House official and the two administration officials. Amodei asked for more time and information, but he made no commitments to pull the model, and at one point Bessent told Amodei directly that he was making a “bad decision,” according to the senior White House official.

Shortly after the call, the Trump administration imposed its export control on the Fable 5 and Mythos 5 models, citing national security authority and banning its use by foreign nationals, according to Anthropic. The company said the “net effect” of the order was to “abruptly disable” the models for all customers “to ensure compliance.”

“Export controls were a last resort after begging them for hours to work with us,” the senior White House official said. “This was not something we wanted to do, but our hands were tied.”

After publication, one of the people close to Anthropic disputed that the company was given a choice to voluntarily work with the administration.

“The White House gave 90 minutes to take the models down, with no details on the actual threat,” the person said. “There was never any begging — or asking — for them to work with us, just a declared 90 minute deadline.”

White House officials — who had heard Amodei liken the dangers of Anthropic’s technology to a nuclear bomb — were baffled when the CEO said he was unwilling to take the system down to address a known security vulnerability, the senior White House official said. Anthropic has defined itself among the industry as a vocal advocate for AI regulation to counter massive global security risks and job disruption as AI quickly advances.

Three people familiar with the government’s thinking said Amazon wasn’t the only company to raise concerns.

“The crux of the issue was the lack of seriousness that Anthropic was applying to it,” said one of the three people. “Had Anthropic taken it seriously and, rather than dismissing it as isolated, moved to fix or pause access, this would have never happened.”

Let’s be very blunt here. The “safeguards” around Mythos being used as Fable are purely driven by the agentic harness and the automated flags on the server side. What that means is that the system prompt will try to steer the responses in a different direction, and if that fails, then machine learning would ideally flag suspicious usage and then terminate the session. They clearly have struggled to get the false positives to an acceptably low level and then refused to expand the scope of the automated checks due to the poor user experience. The actual “jailbreak” appears to be defense-oriented prompting, i.e. asking the model to perform security audits that can then end up being used for adversarial behavior. This is of course the most obvious outcome possible for anybody who has dabbled in investigating and reporting potential exploits, as doing so can often result not in claiming a bug bounty, but in aggressive legal action from the company it was reported to. Depending on the trust level and perception of the participants in the process, “white hat” actions can end up being labeled as cybercriminal activity.

This is not “patchable” in the traditional sense of software development. It is possible to limit the risk, but that comes with a number of trade-offs. If we come back to the original post by Anthropic:

• We suspect that perfect jailbreak resistance is not currently possible for any model provider. Every safeguard used in the industry is vulnerable to non-universal jailbreaks (which can elicit some cyber information in specific circumstances), and it is likely that universal jailbreaks will eventually be found in the future. We stated this clearly when we released Fable 5.

• Given that perfect jailbreak resistance does not appear to be possible today, Anthropic adopted a defense in depth strategy with Fable 5. We aimed to make jailbreaks either narrow (in the case of non-universal jailbreaks) or very expensive to produce (in the case of universal jailbreaks), and to combine this with thorough monitoring to quickly detect and shut down any successful attacks. This is also why Anthropic has required 30-day retention of customer data with Fable—a policy change that carries real costs for us with customers, but that allows us to research and mitigate jailbreaks.

I doubt that, realistically speaking, models can be fully controlled in a certain direction. They can be trained differently (so the capability never gets baked into the weights) or they can be steered another way, but there is no real way to control the outputs due to the inherent design of LLMs (i.e. random token prediction based on statistical probabilities). The alternative is trying to control the output at the harness/server side level, but that comes with performance and quality trade-offs (similar to what the financial sector had to deal with post 9/11 and the significantly increased safeguards around financial crime).

This is not a reality that can’t be communicated to the administration. If anything, there have never been more technically competent individuals in critical roles that would influence decision making. Whether enough of them have deep enough cybersecurity background is a different topic, as covered here:

I think the path to this outcome, which I regard as a disastrous one, runs through the present makeup of the AI policy conversation. I have moonlighted in AI security policy meetings since ChatGPT shipped in 2022, and have observed an ecosystem of character types.

There is the sharp Georgetown graduate who works for a national security think tank in Washington, with a background in international policy and game theory, who has never done hands-on cybersecurity and reasons about it in the abstract; these people are genuinely brilliant and a pleasure to talk to.

There is the frontier-lab AI safety constituency, focused on the coarse-grained claim that scaling laws will deliver catastrophic cyber capabilities, and likewise largely untouched by the actual practice of defending or attacking systems.

There is the AI luminary, whose deep fluency in machine learning buys a kind of currency that licenses them to opine on cybersecurity despite having thought very little about it and holding only a toy model of how the domain works.

And there are a few (too few) people I admire deeply who carry real cybersecurity backgrounds into these rooms, and who, predictably, tend to treat most of what I have said above as obvious.

The problem is not that anyone should be evicted from these conversations, which sit upstream of decisions like the Mythos ban. The problem is one of distribution, and the fix is to inject far more people with deep, practical cybersecurity backgrounds into the rooms where the framings and metaphors get set.

It’s important to understand that “my model can find vulnerabilities” has little to do with effective outcomes in the field. I’ll avoid going into a big technical discussion here, but an easier way to understand this:

1. Using models and people’s time costs money. Any successful breach needs to cover the cost of inference and the time to execute. Most exploitable vulnerabilities do not justify the investment required to identify and leverage them.

2. A vulnerability in one application simply means that the specific app can be exploited. This does not guarantee lateral movement across a network, which is almost always required to gain access to high-value systems.

3. Application vulnerabilities have traditionally been tied to 15-25% of significant breaches in recent years. I covered this in my deep dive on Palo Alto Networks.

So when Anthropic goes on a Glasswing World Tour of Cyberfearmongering, touting Mythos as a literal cyberweapon, well, you play stupid games, you win stupid prizes.

At the end of the day, this situation has mostly arisen from the poor communication and negotiation strategy of the Anthropic leadership team. The reality is that you can't disrupt the workforce while simultaneously refusing to cooperate with the US Department of Defense, and then go and fear-monger about it as loudly as possible.

This is also not something that their lawyers will be able to solve for them. It’s a problem that solely Dario and/or Daniela (who appears to be controlling the majority of key decisions) should be addressing, working with the federal government to reach a reasonable solution. That "fix" doesn't need to be fully technical. It's also a question of changing the working dynamic between the two parties.

Sooner or later in life, you’ll have to get deals done with people you disagree with in order to progress. That’s been a foundational cornerstone of what we perceive as the concept of politics. Does Dario or Daniela have the mettle to get a deal done, or will they push the company into the inevitable outcome (destruction or nationalization) for the sake of their egos? Blaming everything on the administration due to political differences is a cop-out here, and a refusal to take responsibility.

If Anthropic is to ever go public (let alone this year), something at the leadership level needs to change.

I was intending to have this article be a test for the model and have it analyse itself in this format. Unfortunately for you, rather than reading the crisp thoughts of AGI, you’ll have to deal with me. I did flag it to the CCO of Anthropic, who was helpful about the issue.

Safety classifiers

The frontier cybersecurity and research biology capabilities of Mythos-class models mean that they pose a substantial risk of uplift to malicious actors. That is, these models could provide information or advice that assists those actors in causing serious harm that they couldn’t have received from other sources (for example, from internet search engines). Furthermore, a great deal of advanced usage of AI models is dual use: the same queries that are beneficial in the hands of cybersecurity professionals and biology researchers could be dangerous if available to malicious actors.

We therefore need strong safeguards to prevent misuse, and their coverage needs to be broad. The safeguards themselves have to stand up to sustained and sophisticated attempts to bypass them (also known as “jailbreaking” the system). The uplift from Mythos-level capabilities is valuable to many adversaries—for instance, those who could financially gain from cyberattacks—and we therefore expect them to be motivated to try to circumvent our safety measures.

Fable 5 comes with a new set of classifiers: separate AI systems that detect potential misuse, including jailbreak attempts, and prevent the main model (in this case Fable 5) from responding. We’ve been running classifiers on our models for some time, and Fable 5’s classifiers are an extension of this previous work with extra coverage.

When Fable’s classifiers detect a request related to cybersecurity, biology and chemistry, or distillation, the response is automatically handled by Claude Opus 4.8 instead. Users will be informed whenever this occurs. Opus 4.8 is a highly capable model in its own right: a response that falls back to Opus is a far better experience than an outright refusal from Fable. Our early data shows that more than 95% of Fable sessions involve no fallback at all—for those sessions, Fable 5’s performance is effectively the same as that of Mythos 5.

The following are the areas covered by the classifiers:

1. Cybersecurity. Mythos-class models excel at discovering and exploiting software vulnerabilities. They can thus make cyberattacks substantially easier and cheaper to commit. Mythos-class models also show strong skills in agentic hacking. This involves performing multiple different parts of a cyberattack in addition to finding exploits—reconnaissance, discovery, lateral movement, and more. To prevent these agentic hacking skills providing uplift in cyberattacks, we designed our cybersecurity classifiers to cover both exploitation and offensive cyber tasks in a broader sense. As shown in the graph below, our classifiers prevent Fable from making any progress on these tasks.

…

2. Biology and chemistry. We have long used our classifiers to block our models from responding on a narrow selection of bioweapons-related queries. But we are no longer certain that blocking this narrow selection is enough. This is for two reasons: first, we have reason for concern about well-resourced malicious actors attempting to gain uplift from our models for highly risky biological research. Second, models now have a greater ability to accomplish real-world scientific tasks.

While on paper this sounds logical, users are reporting many queries being blocked, particularly based on user history. Most actual professional biologists are basically unable to use the model, even if part of pre-approval programs. It appears that a similar issue is playing out across offensive cybersecurity professionals.

Subscribe now

The reason why my queries got blocked is because it appears that the model also is avoiding any workflows that might lead to training other models, i.e. asking it to analyse its scorecard is considered material risk. The day after the launch it was reported that some of these safeguards will have to be walked back, particularly those blocking any ML/AI work by external researchers.

For a small group of cyberdefenders and infrastructure providers, we’re also launching Claude Mythos 5. It’s the same underlying model as Fable 5, but with the safeguards lifted in some areas.² Mythos 5 will initially be deployed through Project Glasswing, in collaboration with the US government, as an upgrade to Claude Mythos Preview. It has the strongest cybersecurity capabilities of any model in the world. Soon, we intend to expand access to Mythos 5 through a broader trusted access program.

It’s important to note that Fable 5 is essentially Mythos with significant blockers around its best capabilities. Mythos is not being released to the public, but only to a small selection of companies, creating a “two tier” lane where large corporations and public sector organizations will have access to the best models, while the rest will be limited by design.

Availability

Claude Fable 5 is available everywhere today. Claude Mythos 5 is restricted to Glasswing partners (with cyber safeguards lifted) and soon to select biology researchers (with biology and chemistry safeguards lifted) only, until our broader trusted access program is available.

Pricing for both models is $10 per million input tokens and $50 per million output tokens. Developers can use claude-fable-5 via the Claude API.

We expect demand for Fable 5 to be very high, and difficult to predict. On the Claude API and consumption-based Enterprise plans, Fable 5 is fully available from today. For subscription plans, we’d rather give access sooner than later, so we’re rolling out more conservatively, in stages:

• From today through June 22, Fable 5 is included on Pro, Max, Team, and seat-based Enterprise plans at no extra cost.

• On June 23, we’ll remove Fable 5 from those plans. Using it after that will require usage credits. If capacity allows, we’ll extend the included window.

• After this point—when sufficient capacity allows us to do so—we aim to restore Fable 5 as a standard part of subscription plans. We intend to do this as quickly as we can.

While limiting the release of Mythos to the public is a hard fork, the pricing model represents a soft one. While Fable 5 is temporarily available as part of regular subscriptions, usage will shift to API access only after 6/22, and allegedly will be restored at some point if there is enough compute (there is never going to be enough compute).

From a product design perspective that’s not a lot of friction (users can toggle on demand billing with a single click in the interface and still keep working in their browser/desktop app). What is more likely to happen is that very few “civilians” will end up using these levels of models on a daily basis once the hard reality of the token cost comes into play. I wrote the following on X about testing Fable 5 in an Enterprise context:

While X has been on fire in the last 24 hours with influencers and power users sharing their experiences with the latest Anthropic model, most of it has been limited to coding or “difficult problems”.

Anthropic is generating tens of billions of ARR predominantly from Enterprise usage. A lot of it is from coding, but there is a significant portion driven by users adopting Cowork as a job companion. Cowork was mostly ignored by the X power users because most of them do not actually work directly with Enterprise customers, where they need to present, analyse and deliver on outcomes under deadlines and with millions on the table.

I’ve been using AI heavily for Enterprise work for a while, but mostly in the context of deep research reports and accelerated learning in complex technical or industry domains. Similar to coding, I expected to see progress of the models being useful for translating this domain knowledge and analysis into more “practical” deliverables, but I found it mostly lacklustre.

Two months ago I started using Cowork also for building out presentations with the Opus models. It’s okay, but I would rate it as having a junior employee doing a barely passable job at it, rather than a meaningful differential. Opus (and Anthropic models in general) have had spotty performance in the last months, mostly driven by what I perceive as dynamic performance reductions based on available compute, combined with aggressive testing of efficiency algorithms in production.

I don’t think that the Anthropic team is “dumbing down” models on purpose, but they have significant constraints vs their $60B ARR of inference currently being used. This results in difficult choices with tradeoffs that make the experience for power users worse. The net effect is that while using Opus in Cowork helps me reduce the hours needed to get to a great presentation, I’ve often ended up spending $15 bucks (the average cost) to get an average deliverable, which I would end up using almost nothing from but at least it helped me clarify what I really wanted to show and how to position it.

I spent most of today working on a difficult pitch to a customer that wants to cut costs aggressively for a renewal. They are in financial services and running a complex platform that has internal cost pressures. The real work will be going there in person and convincing them to change how they work, but to get to that point I need enough bait to convince them to take this seriously.

Mythos costs approximately double the Opus rate card (which is not a guarantee for the real running usage due to token consumption) but in this case it ended up exactly 2x my typical presentation bill ($30 bucks in magic API tokens).

Unlike Opus however, it actually delivered a fully usable transformational pitch, based on their full real life context. Typically when I feed a lot of documents to Opus, it fails to actually transform these into insights for a presentation. Here it delivered a full:

1. Intermediate level slide deck

2. Value assessment model

3. Internal strategy doc that makes sense

Most of the power users on X will lose access to Mythos/Fable on June 22. Some of them will keep paying the API costs or will use it in other coding tools where they are paying for usage, but in general they will not keep trying complex problems with it.

I’m also a heavy user of Codex and GPT Pro models. Mythos is a proper competitor to GPT Pro and in the context of Enterprise work, it’s better since it produces better materials with its implementation of computer use.

I think that for OpenAI to seriously challenge back Anthropic in the Enterprise market, they have to deliver a similar type of experience. The problem they have is a traditional network effects and distribution advantage risk - many companies are diverting their spend towards Anthropic and will not churn from month to month due to the pendulum swinging in the other direction.

xAI and the Cursor team also have a limited window to enter this conversation, but realistically speaking they will likely only be able to compete on cloud coding agents use cases (which is still worth hundreds of billions in market value).

Google, the proud owner of DeepMind and Workspace should be owning this category and workload. Their failure to compete here should’ve cost several C-levels their roles.

Microsoft also had a significant moat here which was quickly destroyed due to complete lack of vision and product execution.

Mythos/Fable is strong for Enterprise workloads. The next big training run is probably going to be the actual “white collar AI layoffs” trigger. I have no reason to hire junior employees anymore based on what I can get out of $30 investment.

I’ve repeatedly talked about the idea that the “permanent underclass” is a very likely outcome because the top performers using best-in-class AI are likely to deliver the productivity and impact of literally tens of FTEs. Historically, this type of leverage has been driven by elevating top performers to “strategic” senior management roles, where they can set the direction and the org structure below them goes and executes. Since the average productivity of that org structure is not particularly high, we have a lot of FTEs spending a lot of hours on singular deliverables - a product demo, a filled out vendor questionnaire, a presentation. Capable enough AI models collapse this output on behalf of the top performers, who typically have the “final say” over the messaging and content structure anyway.

This is why we’ve seen “AI-native” companies of high growth deliver exceptional revenue per employee compared to supposedly best-in-class large corpos with massive distribution and capital advantages. In my example, if I want to scale my team, it’s smarter to get one other FTE that’s on a similar capability level as me + a large token budget, than 3 other FTEs that will waste a lot of time and require significant supervision in order to get to essentially the same outcome.

It’s not surprising that Dario’s return to blogging happened the day after the Fable 5 launch, in order to argue over government policy:

2. Macroeconomics and tax policy

Governments have long faced the problem of how to encourage economic growth while also providing important public services and ensuring that the least fortunate are taken care of. An important (and generally correct) premise of these debates has been that economic growth is fragile and difficult to achieve—that while reducing inequality might provide important benefits, it has to be traded off against the economic drag of increased taxes or deficits.

I suspect that powerful AI may scramble this assumption. If AI achieves the ability to do most cognitive tasks far better than humans, it stands to reason that it could result in extremely rapid and robust economic growth via the acceleration of science, technology, and operational efficiency. The iterative ability of AI to build even better AI may supercharge that growth even further. But for exactly the same reasons, AI may also act as a more general economic substitute for human cognitive abilities than previous technologies have, while also altering the economy far faster than previous technologies have. Thus, it’s reasonable to think that AI could produce much larger disruptions to the labor market than previous technologies, and, potentially, more enduring disruptions. We risk ending up in a world where the economic tradeoff dial is stuck on the hypergrowth, hyper-inequality setting, and is potentially very hard to unstick from that setting. The key challenge in such a world won’t be incentivizing growth, but finding a way for everyone to share in the benefits.

Of the topics discussed in this essay, macroeconomics and enduring labor displacement are arguably the ones that have attracted the most public attention and the most misunderstanding, so I want to be extremely clear on two points.

First, enduring job displacement is undesirable and dangerous, and we should do everything we can to minimize or prevent it, not to bring it about. I have warned about job displacement in interviews and essays because I want both policymakers and the private sector to have the best chance to adapt and respond, not because I am trying to be a “prophet of doom”. As a company, Anthropic always does as much as it can to work with customers to find creative new use cases and new sources of revenue that allow them to do more with their existing workforce, rather than focusing solely on cost savings (which often means reducing the workforce). We also constantly try to think of new interaction paradigms that allow humans to have as active a role as possible in collaborating with AI systems as those systems advance. More broadly, it is valuable for the whole world to experiment with using AI in as many new ways as possible, as that is the way for society to discover new possible job configurations. I do think AI will enable a number of new economic opportunities. I’ve predicted that AI will enable single individuals to create billion-dollar companies, and we’re already seeing teams of only a few people build businesses with hundreds of millions in revenue. But at the same time we should recognize that there’s a decent possibility that, despite all our efforts, AI still causes significant enduring job loss—and that this may be an intrinsic property of the technology and the way it broadly replicates human cognition⁴

Second, any response to AI-driven job displacement needs to address both the need to provide for everyone economically, and the need for people to find meaning, purpose, and agency. The latter is ultimately more important, and it depends on deep questions about how society is organized, what people should strive for, and what constitutes the good life. I am actually very optimistic that, even in a world with AI’s that are better than everyone at everything, humans can live lives of deep purpose and strive to build awe-inspiring and beautiful things⁵

But this is something to be collectively worked out by society as a whole, not something policy can directly address. Policy can be most helpful in buying us time to do that work, by slowing down job loss and providing economically for those likely to be affected.

In that spirit, some key policy interventions that are likely to be helpful include:

• Measurement and tracking. It’s easy to dismiss mere data collection and analysis as inadequate to the scale of the problem, but we are unlikely to get good policy if we cannot accurately measure what is happening on the ground. Anthropic has been operating an Economic Index of how people use Claude for nearly a year and a half, but governments have access to types of data we do not, and could greatly expand their economic statistics to more carefully track AI job displacement.

• Pro-employment incentives. A wide range of pro-employment policy incentives can help to slow or reduce job displacement, including: wage insurance policies that compensate people when they have to take a lower-paying job⁶, retention tax incentives to encourage employers not to make layoffs, workforce training grants, or infrastructure to facilitate matching of employers to employees to speed the rate of labor market adaptation. While the particulars of which interventions are best will depend on what kind of labor displacement AI brings, we should readily accept the costs and market inefficiencies that these policies could entail, particularly as they are likely to be offset by AI-driven productivity gains.

• Long-term macroeconomic support. If AI-driven labor displacement ends up being large in magnitude and permanently drives down the demand for labor, it will likely be necessary to go beyond mere incentive programs to long-term income support for a significant fraction of the labor force. Mechanisms such as universal basic income could be financed through taxes on relevant companies or raising the capital gains tax. Universal capital accounts offer another vehicle. Broadly speaking, fast economic growth should create the tax base for shared prosperity.

A common focus of economic concern about AI that I haven’t mentioned has been datacenters and particularly their potential to raise energy prices. My view is that AI companies should pay to absorb rate increases—and Anthropic has already made a pledge to do so—but I see public hostility to datacenters as largely a symbol or outlet for broader economic anxieties about AI. It is important we have a direct societal conversation about these wider economic issues and truly have compelling solutions for them, or else they are likely to manifest indirectly, as they have with datacenters.

“It’s time to take Universal Basic Income seriously, y’all” is quite the pitch directly after launching Fable 5.

So how does Fable 5 benchmark? On paper, it's the strongest model in the world. When using it to work on my own applications, it's the first Anthropic model in a while that GPT 5.5 xhigh has no fixes to do. In my experience, since the launch of Codex, the best model to use from end to end to deliver an application has been from OpenAI. When using Claude, there was always something that's not done properly, introducing either bugs or security risks or the functionality just doesn't work. The GPT models running on their highest token budgets were my "senior dev fixing it". Not anymore with Fable (not that my actual usage will change here, as using the $100 subscription from OpenAI covers significantly more coding and analytical workloads than using the same $ value via on-demand tokens with Fable 5).

I think that the best way to think of these models is not that you are suddenly speaking to the highest intelligence in the universe, but that it actually completes fully the challenges you throw at it. My biggest issue with Anthropic models in recent months is that you are almost always guaranteed a significant mistake or wrong conclusion the more complex the conversation gets. This “selective stupidity” is likely driven by the efficiency design of older training runs combined with aggressive compacting of the context window. It’s not that Opus was not capable of strong insights, it’s more that they would be sporadic because somehow it keeps forgetting critical information even if given to it earlier in the conversation.

At least in this first week of the launch, Fable doesn’t seem to have these issues. It also seems to perform at a similar cognitive level to GPT 5.5 Pro, which is essentially the only model I use for day-to-day conversations that require deeper thought. Keeping in mind that it’s a cheaper model (on paper, the prompts via the OpenAI subscriptions are very generously subsidized), this is a significant win.

The Cursor benchmark paints a similar picture, where interestingly enough Fable 5 low is competing at the same performance level as 5.5 xhigh, albeit at almost double the dollar value in token usage.

What happens next? I think that the compute availability and pricing issue remain the biggest issue for scaling usage. I would expect the majority of token use for Fable 5 to remain in Enterprise for users that have significant token budgets per employee. I think that the model is the strongest “average productivity companion” currently in the market, albeit it does require actual results to be delivered with it in order to justify the investment.

In my last article on cloud infrastructure software dynamics, one of the key insights was the transformation of the security market, as AI has quickly become both a significant opportunity to improve existing products and a risk vector. Almost every CISO in the industry will be buying a platform to either monitor or secure AI agents over the next twelve months, which prompts the obvious question: who will benefit the most?

One of the existing incumbents with a strong claim to be able to perform in the new age of AI is Zscaler. I haven’t properly covered them previously, so let’s dig in.

The key takeaway

For tech sales and industry operators: Zscaler clearly has valuable installed distribution, switching costs, enterprise trust, recurring revenue, and a large customer base, which are the raw materials of a good business. But a good business is not automatically a great business if the category is crowded, the buyer can compare several credible platforms, and growth is decelerating despite the claimed demand shock. From an operator’s perspective, the hard question is whether Zscaler is becoming more essential inside the customer’s operating model or merely adding modules to defend its existing account base. The cleanest positive signal would be customers standardizing around Zscaler as the default control plane for user, workload, branch, cloud, data, and agent access. The cleanest negative signal would be AI products staying small while the legacy access business keeps carrying the numbers. If Zscaler can make itself the default map of “who or what can access what,” it becomes much more than remote access; it becomes the security ontology of the enterprise. If it cannot, then AI Protect becomes another module in a bundle, and the company remains exposed to Palo Alto, Netskope, Cato, Cisco, Microsoft, CrowdStrike, and every platform trying to own the same control point. The structural problem for the sales teams is speed: the motion is consultative, GSI-led, and measured in quarters, and the threat is measured in minutes, so whoever shows a customer their own live exposure instead of describing it in a deck wins the part of this the incumbent is built to lose. What happens next is undecided, but the revolving door at the top of the sales org is the canary in the coal mine.

For investors and founders: The company sits at the intersection of three cycles: the cybersecurity consolidation cycle, the AI adoption cycle, and the software multiple cycle. The AI adoption cycle is bullish for security demand because complexity, autonomy, and attack speed all rise. The consolidation cycle is mixed because large vendors can bundle more aggressively, customers want fewer tools, and SASE/security platforms may converge around a small number of winners. The software multiple cycle is unforgiving because investors no longer reward narrative without clean organic growth, especially when sales leadership changes and acquisitions blur the signal. That means Zscaler can be fundamentally important and still be a difficult stock if the timing of demand, execution, and valuation do not align. For founders, the lesson is to build into the pressure points created by the cycle: cost reduction, tool consolidation, AI-risk auditability, machine-identity governance, and board-level evidence. For investors, the alpha is to watch the leading indicators before the income statement: ZPA expansion, AI Protect attach rates, data-security ARR growth, Zero Trust Branch adoption, new-logo recovery, GSI/channel pull, and whether organic net-new ARR stops decelerating. The concerning sign today is that the company’s AI story still sounds like discovery, guardrails, DLP, red-teaming, and reporting: useful, but not obviously revolutionary. They should be aggressively asking: what would the security stack look like if built today for millions of non-human agents, not retrofitted from human access controls? That leads to products like self-updating permission systems, agent sandboxing, exploit-path simulation, autonomous kill switches, and real-time policy generation based on observed behavior. The investable company is the one that turns AI security from a dashboard into a control loop.

Zero trust issues

Jay Chaudhry: We delivered strong Q3 results. ARR grew 25%, and non-GAAP operating margin hit an all-time high at 23%. AI is changing the nature of cybersecurity in real time. Zscaler is the cybersecurity platform for the AI era. This is evident in our results and the reason we are so confident in our long-term potential. We offer the industry's only complete Zero Trust SASE solution, a singular Zero Trust platform across users, across cloud workloads, and across branches. Our architecture is purpose-built to address the limitations of firewall-based SASE solutions and has several key differentiators. First, we hide applications and data behind our Zero Trust Exchange, making them invisible from the internet and eliminating the attack surface. An attacker can't breach what it can't reach. Hence, this architecture provides far superior cybersecurity protection for our customers.

Second, we eliminate lateral movement of attackers with our Zero Trust architecture. We only allow authorized users and workloads to access specific applications. This reduces the blast radius of a potential breach, providing better security to our customers. This stands in stark contrast to competitors with firewall-based SASE architecture that connect users to the corporate network. Once a malicious actor gains a foothold on the network, it can roam freely and systematically attempt to compromise critical applications or steal data. This is how most ransomware attacks happen. Finally, scale matters, and our cloud-native Zero Trust Exchange is the largest distributed inline security platform in the world that spans across 160 public exchanges, processing more than 500 billion transactions per day. This gives us the best quality and quantity of telemetry data. Simply put, no other cybersecurity vendor has access to data sets with comparable fidelity and breadth.

This high-fidelity telemetry fuels our AI-powered security capabilities, continuously improving how we detect, prevent, and stop threats. These differentiators are especially important at a time when organizations are aggressively deploying AI applications and models with growing interest in AI agents at scale. We expect it won't be long before millions of AI agents have access to organizations' mission-critical applications and sensitive data. Today, users are the weakest link in cybersecurity. Soon, AI agents will be the weakest link because they operate at far greater speed and have far less oversight. Even a single compromised agent can move from discovery to data theft in minutes, inflicting catastrophic damage on enterprises. Making it even more challenging, new powerful frontier AI models like Mythos are finding security vulnerabilities in software at machine speed, significantly diminishing the effort, skill, and time needed to breach enterprises.

All enterprises already have thousands of known vulnerabilities that they haven't been able to patch. Frontier models are multiplying these unremediated vulnerabilities by as much as 10x, and even more powerful models that are currently being developed will undoubtedly make it worse. Enterprises don't have the capacity to patch and update existing vulnerabilities, so backlogs are piling up faster than organizations can address them. To tackle this challenge, the market needs to take a different approach. We provide the two most important defenses against these vulnerabilities. One, hiding applications from attackers, and two, eliminating lateral movement at scale. This validates the architecture we pioneered. Zscaler was built for this moment. We started with Zero Trust security for users, so users can safely access applications from anywhere. We expanded our Exchange to provide Zero Trust security to branches, workloads, and connected IoT/OT devices.

Now we are expanding our exchange to secure AI agents. An important element of agentic security is to understand which agents, users, and other identities are communicating with which models, applications, and data sources. On May 21st, we announced our intent to acquire Symmetry Systems, a company that solved this difficult problem. Symmetry provides an access graph that maps how identities, applications, and other data sources connect across the enterprise. We are integrating its access graph technology with our Zero Trust Exchange. We're excited to share more about this at our Zenith Live user conference in Las Vegas next month. We are also partnering with Anthropic on Project Glasswing and with OpenAI as part of its Daybreak program, formerly known as Trusted Access for Cyber, or TAC, which allows us to access frontier models to proactively harden our systems and deliver better security and resilience to our customers.

From my personal point of view, zero trust architecture always made a lot of sense in the context of cybersecurity. The majority of the damage from breaches is related to lateral movement (i.e. one employee gets compromised, then the attacker accesses a sensitive database from their account, for example), and reducing dwell time is arguably the most important risk reduction activity from a technical perspective (leaving attackers fewer opportunities to move across the network). As such, setting up internal blocks and reducing access across applications and endpoints is a logical way to approach the problem.

Read more

While progress in the last …

Read more

In this environment, cloud infrastructure software, together with the compute layer, is the critical "connective tissue" to get the most out of silicon intelligence. "The Infra Red" is an annual report by Redpoint that covers the thesis behind cloud infrastructure software and what's coming next.

While we leverage a lot of different benchmarks to evaluate how "smart" models are, the ultimate test is doing any task we throw at it and doing it right. While in the earlier versions of GPT and Claude models the architecture of the LLM was a limiting factor on how much context they could work with, today we are seeing most of the limitations driven by compute constraints. Given enough compute, models can run for many hours and test out solutions until they solve the problem.

While there are many (influential) opponents of the adoption of AI, the reality is that when money talks, bullshit walks. Companies are shifting significant spend into leveraging frontier models in their work, resulting in explosive revenue at the model layer.

Read more

Together with SpaceXAI, we're training a significantly larger model from scratch, using 10x more total compute. With Colossus 2's million H100-equivalents and our combined data and…

Read more

Most IPOs are exits. This one is a funding round dressed as an exit, and depending on how things go, a significant benefit to retail investors. SpaceX is one of the very few public market entrants in the last decade with a genuine monopoly in its core business, a credible thesis on the future of compute, and a founder with a track record of doing the impossible repeatedly.

Vertically integrated innovation engine

“You want to wake up in the morning and think the future is going to be great—and that’s what being a space-faring civilization is all about. It’s about believing in the future and thinking that the future will be better than the past. And I can’t think of anything more exciting than going out there and being among the stars.”

—Elon Musk

Our Mission

Our mission is to build the systems and technologies necessary to make life multi-planetary, to understand the true nature of the universe, and to extend the light of consciousness to the stars. To do this, we have formed the most ambitious, vertically integrated innovation engine on (and off) Earth with unmatched capabilities to rapidly manufacture and launch space-based communications that connect the world, to harness the Sun to power a truth- seeking artificial intelligence that advances scientific discovery, and ultimately to build a base on the Moon and cities on other planets.

The interesting thing about the SpaceX IPO is that the execution here can be considered very boilerplate and favorable for the original investors and the liquidity providers. One of the biggest reasons for Musk's effectiveness and longevity in the game is that he is laser-focused on getting a good deal for his investors and supporters. Still, the actual proceeds of the IPO will go directly to funding AI compute infrastructure, launch infrastructure, satellite constellation buildout, and general corporate purposes.

This is particularly important when the mission that is supposed to be funded here is nothing short of staggering. The goal is very straightforward, SpaceX(AI) intends to compound on its unique manufacturing and hardware execution capability to bring significant amounts of compute to space, that will be both an economic engine for the company and used to build a lead in model training over time.

It's important to note that the successful execution of this IPO will not only provide Musk with significant liquidity to scale his operations, but will also cement him as the unfireable CEO of the organization. He gets to have his cake and eat it too, giving him probably his best shot at going hard after his vision of a multiplanetary species.

Founded in 2002, SpaceX is the only company building the integrated hardware and software infrastructure of the future across space, connectivity, and AI. At our core, we are builders. We design, manufacture, launch, and operate products and services built on cutting-edge technologies, including the world’s most advanced rockets and spacecraft. We safely and reliably transport astronauts, satellites, and other payloads on missions that benefit life on Earth. Since 2023, we have launched more than 80% of mass to orbit for the world each year with an over 99% mission success rate with Falcon rockets. We also operate a high-speed, low-latency global broadband data and communications network powered by approximately 9,600 Starlink broadband and mobile satellites in Low-Earth Orbit, delivering connectivity to millions of consumer, enterprise, and government customers across 164 countries, territories, and other markets, as of March 31, 2026. Using our dedicated satellite-to-mobile constellation, we offer connectivity services, supplementing terrestrial networks and substantially reducing mobile “dead zones” across approximately 30 countries.

With the potential to improve both space exploration and life on Earth, AI accelerates SpaceX’s mission to make life multiplanetary, to understand the true nature of the universe, and to extend the light of consciousness to the stars. xAI, which was founded in 2023 and acquired by SpaceX in early 2026, is now an integral pillar of our vertically integrated company. We are rapidly constructing AI compute infrastructure—starting on Earth with the goal of extending to space—at industry-leading pace and cost efficiency. Our infrastructure supports training and inference for Grok, which has emerged as one of the world’s most advanced frontier models. Grok is designed as a truth-seeking AI model, built on our founder Elon Musk’s mission to enable humanity to understand the universe. We believe that accomplishing this mission requires a truth-seeking approach to AI.

We define truth seeking as the active, relentless pursuit of what is objectively true about reality, and grounded in evidence, logic, empirical data, and first principles thinking. Our goal is to understand and explain what the universe appears to be doing, as accurately as current knowledge allows. Within two years of its initial model release, Grok achieved frontier-level performance in scientific reasoning, as measured by its GPQA Diamond score, an industry benchmark that evaluates AI models on a standardized set of questions written and validated by experts, on a faster timeline than reported by other leading model providers. Grok also benefits from integration with X, our real-time information, entertainment, and free speech platform, which serves as a foundational distribution and data engine for our AI ecosystem and further enhances Grok’s truth-seeking objective.

The story is not without its weaknesses, namely trying to position Grok as a success, at a time when the majority of the team has left. A lot of their ability to sell the vision will have to rely on more than just "Musk will figure it out," hence why they included the potential Cursor deal as an important part of the investor information.

Our innovations and technological advancements are redefining industries on Earth, while we aim to create new ones on the Moon, Mars, and beyond. We are truly building the infrastructure of the future.

• Space. SpaceX is the only company that has cracked the code on accessing space at scale, revolutionizing an industry characterized by decades of stagnation, risk aversion, and economically perverse cost structures. SpaceX upended this paradigm through the application of first-principles thinking, which rejects industry assumptions and builds solutions based on the fundamental laws of physics. Our intense, mission-driven, engineering-first culture and focus on extreme vertical integration have propelled us to achieve what many deemed impossible. We pioneered high-cadence, reliable, and affordable access to space with our Falcon family of rockets. In 2015, we established at least a 10-year lead over the industry by successfully landing our first Falcon 9 booster back from space before anyone else. Space flight that historically cost billions per launch now costs in the tens of millions, fundamentally reducing the cost of space access and providing the opportunity to build new enterprises in space.

• Connectivity. Since activating service for customers in 2020, Starlink has rapidly expanded global access to high-speed internet, prioritizing underserved rural and remote communities worldwide. While building terrestrial networks in such communities can be prohibitively expensive, Starlink is capable of delivering broadband connectivity anywhere on Earth with just a Starlink Kit. As of March 31, 2026, we had approximately 9,600 Starlink broadband and mobile satellites in Low-Earth Orbit, operating the world’s most advanced broadband constellation providing internet connectivity to approximately 10.3 million Starlink Subscribers across 164 countries, territories, and other markets. In January 2024, we also began deploying our Starlink Mobile constellation that utilizes separate Starlink satellites with satellite-to-mobile capabilities, substantially reducing mobile “dead zones” around the world. As of March 31, 2026, our dedicated satellite-to mobile constellation of approximately 650 V1 Mobile satellites provides satellite-to-mobile data, over-the-top voice, and messaging services to approximately 7.4 million monthly unique devices across approximately 30 countries.

• AI. We were the first company to deploy a coherent gigawatt-scale AI training cluster. For complex reasoning and agentic workloads, compute is directly correlated with the quality of intelligence and task completion speed. In under two years, we have established a dual advantage in both cost efficiency and deployment speed at scale. By owning the compute infrastructure and vertically integrating across the full AI stack, we can train and iterate our frontier models at lower cost and higher velocity and accelerate development cycles. This eliminates external bottlenecks and drives rapid, continuous improvements in model performance. We believe this combination of our state-of-the-art AI compute infrastructure, our truth-seeking frontier model, and our access to real-time data on X creates a significant strategic advantage. Our integrated AI platforms across Grok and X have over 1.3 billion supported accounts active in the last twelve months ended March 31, 2026, including approximately 550 million MAUs and generating approximately 350 million daily posts. Of our MAUs, we had approximately 117 million MAUs that used Grok’s AI features as of March 31, 2026. Grok’s deep integration with X enables freshness, relevance, and contextual awareness that we believe is a competitive differentiator. This direct, real-time access to the information and human discourse on X enhances Grok’s truth-seeking capabilities by grounding outputs in up-to-date knowledge and diverse viewpoints. As a result, we believe Grok can deliver the most objective and relevant insights and best serve high-frequency, high-value use cases across consumer and enterprise AI applications.

If AI is a weakness, connectivity is arguably the single biggest reason why we can “believe” in a potential successful outcome here. The team has done an outstanding job in providing a genuinely great service with Starlink and breaking almost every rule of the telco scaling framework. It’s not difficult to see that if somebody can get inference from space done in the next years, it’s most likely to be SpaceX.

Read more

Read more

The key takeaway

For tech sales and industry operators: Dell is a stable, slow-moving organization that rewards a specific kind of operator: one who delivers outcomes without needing the company to move fast. Realistically speaking, its headline growth is tied directly to repackaging NVIDIA hardware and installing it for customers, while keeping a small portion as margin for itself. The work itself is hard (rack-scale integration, liquid cooling, power delivery, and on-site deployment at speed are genuinely difficult), but only the select few driving the largest customers will benefit from this turnaround. The window for individuals to join the business and benefit is likely over (unless you want to grind the next regular server replacement cycle), similar to the Oracle OCI opportunity in 2025.

For investors and founders: On paper, Dell is a fair business at a fair price, albeit not a wonderful one, to borrow Buffett's framing. It has built a world-class supply chain and proven it can reprice and reroute under stress, and that is not nothing. But value flows to whoever solves the hardest physics, and here that is the chip and the memory, not the chassis around them. For founders, the lesson is to own the bottleneck, not the assembly. If your company's role can be described as integrating someone else's breakthrough, your margin will always be set by someone else's scarcity. For investors, Dell is the lower-risk seat in AI infrastructure: no foundry or CapEx exposure, a cheap valuation, and management beholden to shareholders, with a capped margin as the price of that safety. Personally, I think there are better uses of capital at this stage of the buildout.

The sleeping giant

Jeff Clarke: FY26 was a defining year in our company's history. We delivered record full year revenue and EPS. Revenue reached $113.5 billion, up 19% and EPS grew 27% to $10.30. We converted that performance into a record annual cash flow over $11 billion and returned $7.5 billion to shareholders, including 54 million shares repurchased more than doubled last year. The AI opportunity is meaningfully growing and transforming the company. In FY26, we closed $64.1 billion in AI orders shipped $25.2 billion and exited with a record $43 billion in AI backlog. Powerful proof points that our engineering leadership and differentiated solutions are winning.

We are executing with discipline and speed. We are gaining share in our PC business and strengthening ISG with strong margins in traditional servers and storage, all while positioning the company for the AI era. It was a monumental year. We exit with strong momentum, and I couldn't be more proud of this team. With that, let me turn to the key highlights for the quarter. We delivered a record quarter. Q4 revenue was $33.4 billion, up 39% and earnings per share was $3.89, up 45%, driven by disciplined execution and demand for our AI solutions. While operating in a dynamic environment, we saw a record cash flow generation and above trend capital returns for shareholders.

Now let's move to AI. We kept an already strong year with an exceptional quarter for AI, record orders and broad-based demand. In Q4, we booked $34.1 billion in AI orders, evidence that demand is accelerating as customers deploy AI at scale. We shipped $9.5 billion in AI servers in the quarter. We exited Q4 with a record $43 billion in AI backlog, and our pipeline continued to grow sequentially even after converting $34.1 billion of orders, a clear sign of sustained momentum. For the full year, AI orders reached $64.1 billion. Our customer base surpassed 4,000 with growth across neoclouds, sovereigns and enterprise customers, evidence that demand is broadening across all customer types.

We're winning for the reasons we've outlined all year. Engineering for performance and time to market while optimizing TCO for AI workloads, deployment and installation at speed and scale, ongoing life cycle support that keeps clusters up and running and DFS financing. We're doing this with discipline. Profitability is in line with our mid-single-digit operating margin target. We like our position, the line of sight we have with our backlog and pipeline and the advantage our scale and supply chain bring.

An AI server is a high-performance system built specifically for artificial intelligence work. Unlike regular servers that handle a wide range of tasks, Dell's PowerEdge XE series is designed from the ground up with GPUs in mind. It prioritizes high GPU density, fast connections between the accelerators, strong power delivery, and advanced cooling, including liquid cooling for the densest setups. This makes the servers well suited for both training large models and running inference at scale.

The AI server business line now generates $50B annually, after another exceptional year by the team.

Read more

Over April I rebuilt the positions that now form the Q2’26 Infra Play portfolio (which hopefully will not require a complete directional shift, but you never know what happens with Taiwan). There are some expected names, as well as many new ones.

Power, cooling, custom silicon, memory, lithography, silicon photonics foundry, InP tools, connectivity silicon. Each layer is a separate bottleneck, each bottleneck is structurally short on supply, and each name is the cleanest expression of the layer it sits in.

I recently published the Q2'26 Infra Play portfolio and it's been quite the run, to say the least. Tech market valuations exploded, driving strong support for the "bottlenecks of AI" thesis. The overall return in April is at 47%, which is outstanding by any conventional measure.

There is, however, a bit of a but here.

My actual P/L looks slightly different due to different entries and exits, but obviously making a 25.6% gain on this portfolio within a quarter is not exactly slim pickings.

The Q1 version of the portfolio did very well considering all of the events (tariffs, war, SaaSpocalypse, stagflation), but most of it was carried by the exceptional rally of SanDisk. To make things a bit worse, if I had remained with the same positions going into Q2 and not sold, we would be looking at more than a 100% gain in April alone.

The real driver behind the massive opportunity in the last weeks has been the rally in MU, SanDisk, SK Hynix, Intel, and AMD. The thread between them has been the massive demand for compute, but the star of the show has truly been memory as the key bottleneck of scaling AI.

This raises the question: are we in a memory supercycle, and how do we play it?

Read more