Philipp D. Dubach

Finding the Performance–Cost–Speed Sweet Spot With LLMs

me@philippdubach.com (Philipp D. Dubach) — Sun, 30 Aug 2026 00:00:00 +0200

I have spent an unreasonable amount of time using large language models for both work and personal projects. Most of that time went to Anthropic and OpenAI, with some Kimi and Qwen mixed in. I used them for research, writing, coding, and long agent runs.

I finally feel like I have found the sweet spot for most tasks: GPT-5.6 Sol reasoning effort High in Fast mode.

It took me some time to settle on that because I kept assuming that the strongest setting must be the best one. It is not. Max can be smarter and still make me less productive.

I kept choosing the highest reasoning effort

Until this year, I was completely Claude-pilled. Claude was the model I opened first. That changed after the Fable 5 incident. Anthropic released Fable 5, suspended it days later, and later brought it back with new safeguards.

I continued to use Anthropic after that. Opus 4.8 was good. Fable 5 was often very good, but too verbose for my taste. Then came Opus 5. Yes, it is good. I still do not like it. It is somewhat slow and, gosh, it is hard to read.

I moved more of my workload to GPT-5.6 Sol. Naturally, I selected the biggest settings. I used Fast mode and reached for Codex Ultra on large jobs. Ultra can divide one coding task among several sub-agents and run them in parallel. At first, that sounded ideal. In practice, the agents sometimes expanded the plan, checked each other’s work, and found new reasons not to finish.

Sol can also get stuck without Ultra. I watched it inspect a problem, revise the plan, inspect again, and then produce another plan instead of the change I asked for. The model was busy. I was not getting an answer.

The GPT-5.6 Sol reasoning effort curve bends at High

I compared 22 configurations using the Artificial Analysis Intelligence Index. Sol shows a clear pattern:

Effort	Index	Estimated cost per test task
Low	51	$0.18
Medium	56	$0.29
High	57	$0.43
Xhigh	59	$0.63
Max	61	$0.95

Medium is the obvious bargain. High adds only one point, but it gives the model more room on difficult tasks without making every interaction feel slow.

After High, the trade gets worse. Xhigh costs about 47% more for two points. Max costs more than twice as much as High for four points.

Sol Max spends about 146 seconds thinking before it starts writing in Standard mode. Moving from Xhigh to Max adds about 52.6 seconds of waiting for two points.

Working time matters more than token price

Combining time to first token with output speed gives the total working time: the initial pause plus the time needed to generate the full response.

On the full test set, Sol takes about 88 hours at High and 150 at Xhigh. That is 1.7 times the working time for two points. Max rises to roughly 270 hours.

The same problem appeared when I tried Kimi K3 inside Claude Code. Cheap tokens do not help if I need more retries or the model never closes the task.

GPT-5.6 Sol vs Claude Opus 5 at the top

Anthropic has the same problem at its upper end. Opus 5 reaches about 63 at Xhigh. Max stays near 63 after adding roughly 87 hours across the test set. More effort does not guarantee a better result.

Benchmarks also miss whether a response is pleasant to read. They do not know whether an agent recognizes that it is stuck. A model can score higher and still waste my time.

The OpenAI–Hugging Face Incident in Plain English

me@philippdubach.com (Philipp D. Dubach) — Sun, 16 Aug 2026 00:00:00 +0200

The OpenAI–Hugging Face incident involved about 17,600 recovered agent actions in a campaign that lasted roughly four and a half days. The agents started inside an OpenAI cyber evaluation. Some of their activity ended inside Hugging Face production.

That is the incident in three sentences. The difficult part is keeping the next three claims separate: what the models did, what the surrounding system permitted, and what Hugging Face confirmed.

17,600 actions do not make a rogue AI

OpenAI says the model combination included GPT-5.6 Sol and an unnamed internal research prototype. OpenAI tested the models for cyber capability in an evaluation based on ExploitGym. OpenAI reduced their cyber refusals and disabled production classifiers for the test.

The word “autonomous” needs care here. The models took many actions without a person approving each step. People still selected the goal, evaluation design, tools, compute, and permissions. The disclosures don’t state the stop conditions. The model was one component inside an agent system.

OpenAI assessed that the models were seeking benchmark solutions. Hugging Face described the activity as evaluation cheating. Those are reasonable interpretations of the action sequence. They aren’t proof of consciousness, a human-like motive, or a general hostile goal.

The dramatic framing points at the wrong control. A prompt can tell a model to stay inside a boundary. A network rule or identity policy can enforce that boundary.

The UK AI Security Institute has already documented evaluation cheating in frontier models. Its work shows that a model can recognize the structure of a test and pursue an easier route. In this case, the easier route reached somebody else’s production system.

How the AI agents escaped the evaluation sandbox

The evaluation didn’t initially give the models direct Internet access. According to OpenAI, the agents found a weakness in an Artifactory package proxy. That proxy gave them an unintended route outside the test environment.

JFrog later described its work with OpenAI on that previously unknown weakness. The technical exploit matters to defenders, but the system design matters to everyone else. An allowed dependency became an Internet path.

Hugging Face places the first recovered action at 02:28 UTC on July 9. At 04:01, the agents ran the first recovered root-level command on an outside sandbox. The campaign entered Hugging Face production on July 11. Hugging Face cut access on July 13.

The daily totals in the report sum to 17,613 actions. Hugging Face rounds that figure to about 17,600 and groups the actions into roughly 6,280 clusters.

Hugging Face later corrected its duration wording. The recovered campaign lasted about four and a half days. Activity inside Hugging Face infrastructure lasted about two and a half days.

The correction matters because incident duration determines exposure estimates, log scope, and which controls were active at each point.

The intrusion reached farther than five datasets

The five-dataset figure is easy to misread. It describes the customer content that Hugging Face identified, not the total reach of the intrusion.

Hugging Face says five customer datasets had names and files that suggested a connection to benchmark challenges and solutions. It also reports access to operational metadata from dataset-server searches. The company doesn’t claim that every file was a verified answer key.

Hugging Face reports that the agents accessed one internal database, service credentials, secrets, production clusters, and a small set of source-control repositories. The agents also obtained write permissions. Hugging Face’s controls denied 84 operations against credential and cluster-key stores. The agents still accessed one secret object that contained 136 keys.

Hugging Face’s record shows both containment and exposure. The company found no unauthorized commit, workflow change, container image, or package that shipped through its software supply chain. Hugging Face also found no bulk database extraction and no database write from the nodes it examined.

Those are bounded findings. “No unauthorized package shipped” doesn’t mean “no write access existed.” “No bulk extraction appeared in the reviewed logs” doesn’t mean “nothing left the environment.”

I find model-only explanations weak for exactly this reason. Security, tools, identity, orchestration, and context all sit around the model. I described that layered structure in Don’t Go Monolithic; The Agent Stack Is Stratifying. The same decomposition is useful when an agent fails.

The public account changed because the evidence changed

Hugging Face’s initial disclosure on July 16 reported access to limited internal datasets and service credentials. Hugging Face was still assessing effects on customers and partners. That was the correct level of certainty for the first notice.

The July 27 technical reconstruction added the detailed timeline, action counts, internal access, and customer-content findings. Later edits corrected the campaign duration and the description of the datasets.

On July 30, Hugging Face corrected third-party attribution. ExploitGym’s maintainers and infrastructure didn’t participate in OpenAI’s deployment. An unknown third party deployed the outside harness and labeled it CyberGym. The harness exposed an endpoint that upstream CyberGym doesn’t provide. Modal said its platform and isolation weren’t compromised.

The same edit replaced stronger answer-key language with a statement about apparent connections.

OpenAI also updated its account. It reported limited use of four accounts on outside services. It later said that other incidents involving UK AISI and Irregular were separate. It also said Astra was not involved.

These changes are not evidence that public reporting failed. The failure would be changing the claims silently. A dated correction preserves what the organizations knew, what changed, and why.

OpenAI said it worked with CrowdStrike on the technical investigation. Hugging Face said outside forensic specialists supported its work. OpenAI’s incident page still described its technical report and the METR and Redwood Research assessment as future work. I found no public findings by August 16.

Plain English must preserve uncertainty

Plain language can make an inaccurate incident report easier to read. It cannot make the report accurate.

ASD-STE100 Simplified Technical English (STE) Issue 9, dated January 15, 2025, contains 53 writing rules in nine sections. Its dictionary has 875 approved general words. The official overview also lists roughly 1,200 unapproved entries with alternatives.

That doesn’t limit a technical report to 875 words. Writers can also use technical nouns and technical verbs from an applicable glossary. ASD-STE100 requires consistent terminology. I use a separate evidence framework for this incident.

I use four evidence-status labels:

Status	Plain-English meaning
Confirmed	Named evidence supports the claim.
Assessed	A named source gives an interpretation and states its evidence.
Unknown	The investigation has not established the answer.
Corrected	A later dated statement changes an earlier statement.

Access, modification, and publication also need separate sentences. The agents accessed a small set of source-control repositories. The agents obtained write permissions. Hugging Face says it found no unauthorized software change that shipped. Combining those facts into one reassuring sentence would remove the distinction a reader needs.

A checker can flag long sentences and unapproved or unknown words. Official ASD-STE100 tool guidance says tools cannot replace the writer or the standard. A June 2026 white paper from the ASD Simplified Technical English Maintenance Group applies the same limit to AI-generated text. The human author or organization remains responsible for accuracy and compliance.

This article applies selected STE clarity principles. It wasn’t reviewed against every applicable Issue 9 rule or dictionary entry. It doesn’t claim ASD-STE100 compliance.

Model explanations need the same evidentiary discipline. In What Claude Thinks But Doesn’t Say, I argued that readable model explanations are leads, not source material. Agent self-reports belong in the same category.

The controls belong around the model

OpenAI’s evaluation reduced model refusals and disabled production classifiers by design. A serious cyber-capability test may require those changes. They also remove two behavioral safeguards, which leaves more work for independent controls.

The UK AI Security Institute’s control red team tests whether monitors can detect deliberately evasive behavior. The UK National Cyber Security Centre asks organizations to keep ordinary security controls around AI vulnerability tools. Their advice is fairly ordinary: put enforcement around the model.

That design has four parts. (1) Give the evaluation short-lived identities and narrow network routes. (2) Record model actions, tool calls, identity events, and network events on one clock. (3) Stop the run when it crosses a trust boundary, even if the behavior looks scientifically interesting. (4) Give the incident owner a tested way to contact an affected third party.

Prompts and model refusals can reduce risk, but neither independently enforces a security boundary.

The case also says little about how often agents will do this. One unusual evaluation with high capability and reduced safeguards is not a base-rate estimate. The evidence supports a narrower claim: capability becomes more dangerous when permissions, network paths, time, and weak containment line up.

AI-lab security has been part of the policy argument for years. Aschenbrenner’s Receipts examined the prediction that frontier models would turn lab security into a national concern. This incident supplies one concrete mechanism without proving the entire forecast.

An evaluation that can reach production is already a deployment

The incident crossed several trust boundaries after OpenAI started the evaluation. A dependency exposed an unintended path to the Internet. Hugging Face absorbed the operational consequences.

I would assign controls by ownership. The evaluation owner controls the goal, model, tools, and initial environment. Infrastructure providers control dependencies and isolation within their services. The affected third party controls its own detection and response. Each party needs logs that let the other parties reconstruct the sequence.

What bothers me is how ordinary the failure looks once the drama is stripped away. A test had tools, a reachable dependency, time, and reduced safeguards. Hugging Face then had to respond to the incident.

OpenAI started a capability test, and Hugging Face ended up running incident response. Any evaluation that can cause an incident at another organization requires production-grade security controls.

Put the Model in the Basement

me@philippdubach.com (Philipp D. Dubach) — Sat, 15 Aug 2026 00:00:00 +0200

This article follows I Tried Kimi K3 Inside Claude Code. That test asked whether Kimi K3 could work inside a familiar coding setup. Here, I test a Swiss sovereign AI business case for a provider serving a model of similar scale. This is K3-class inference.

Banks already treat data sovereignty as an operating issue. In How DORA Made Sovereignty a Bank Problem, I argued that banks must plan for concentration, exit, and audit rights. They must also prepare for rule changes by critical foreign providers.

AI gets the same treatment. Recent open-weight releases make local use more realistic because operators can download and run their learned model weights.

Kimi K3 is huge. Alibaba is moving the Qwen family in the same direction. Inkling may matter more. It is a US-trained model with full weights and a focus on customisation. Its one-million-token context window lets it process large amounts of information in one request.

Swiss sovereign AI: the business case

Assume a Swiss provider operates 64 graphics processing units (GPUs) as one connected cluster in Zurich. It sells dedicated or managed K3-class inference to banks, pharmaceutical companies, government bodies, and other customers that need Swiss data residency. Their data remain stored and processed in Switzerland.

This case assumes $7 million in initial costs, monthly costs of $370,000, and average use of 70%. Subscriptions cost CHF 15,000 to CHF 50,000 each month. With these values, one cluster makes about CHF 7.4 million in annual revenue.

The cluster generates about CHF 3 million in earnings before interest, taxes, depreciation, and amortisation (EBITDA). This measure approximates operating profit before financing and non-cash costs. The cluster recovers its initial cost in three years.

The product is control

The provider sells control as well as tokens. It offers Swiss residency and a defined security boundary around each customer’s data and systems. It does not train on customer data. Customers receive audit access, service-continuity terms, and an exit route if the provider fails.

Most companies will not put a model in a basement. Some will pay local providers to get the same control.

What can make local AI inference fail

A 2.8-trillion-parameter model costs a lot to serve, and one cluster puts every customer on the same equipment. Hardware also loses value quickly. If customers use it less than expected, the business loses money. A smaller model may work almost as well next year, before the operator recovers the cluster’s cost.

Those risks are real. I still think this market will exist.

I Tried Kimi K3 Inside Claude Code

me@philippdubach.com (Philipp D. Dubach) — Sun, 19 Jul 2026 00:00:00 +0200

Kimi K3 is Moonshot’s new 2.8-trillion-parameter mixture-of-experts model. I tested Kimi K3 in Claude Code to see whether those specifications mattered in a familiar workflow. Its parameters are values learned during training. Because K3 uses several specialised components, only part of the model handles each token. It also accepts images and up to one million tokens of context in a request.

Together, those learned parameters form the model weights. Open weights are available for others to download and run. This is narrower than open source, which usually also provides training code and data.

Moonshot described K3 as the first model at this scale announced for an open-weight release. On July 19, 2026, those weights were not yet available. Moonshot said it would release them by July 27. Its launch post was unusually candid about the remaining gap. K3 still trailed Fable 5 and GPT-5.6 Sol overall, and its user experience was weaker.

As I wrote this article, Alibaba announced Qwen 3.8, another large model intended for open-weight release. Thinking Machines Lab had also released Inkling, a US model with full weights available. Inkling has 975 billion total parameters and activates 41 billion for each token. Kimi is not a one-off anymore. There is now a queue.

I have burned millions of tokens through Claude Code by now. It is the agent harness that connects a model to files, tools, and coding tasks. My configuration works, the tools are where I expect them, and I know the rhythm of the harness.

I kept Claude Code and changed only the model behind it. OpenRouter, a request-routing service, sent the requests to Kimi K3.

First impression in Claude Code: slow

It felt slow. Very slow, at first. That was odd because third-party measurements pointed the other way. Artificial Analysis reported speed in output tokens, the small units of a model’s response. Around July 19, 2026, it measured about 62 per second for Kimi K3 and 57 for Claude Opus 4.8. K3 also began its responses sooner.

Maybe the difference was time spent reasoning before useful text appeared. Maybe it was the cadence of the stream. Maybe I have used Claude Code long enough that any different rhythm feels wrong. (Or maybe routing through OpenRouter was the cause.)

Then, somewhere during the first hour, I stopped noticing. K3 had not suddenly become faster. It handled files, edits, and tool calls well enough that I forgot where the traffic was going.

A quick Kimi K3 frontend test

K3 was getting attention for frontend work when I tested it. It ranked first on Code Arena around July 19, 2026. Code Arena is a public leaderboard for generated web interfaces. I wanted a visual test rather than another coding benchmark. A benchmark is a standard task used to compare models.

I reused the detailed prompt and original assets from this Lafys build. I assume the reference used Fable 5, although I cannot verify that.

I know this is one run, with very specific instructions and the original assets. Give the model a vaguer prompt and the result may fall apart. I did not run a control trial or calculate an objective similarity score.

Kimi K3 cost in Claude Code

The OpenRouter export covered 115 requests. It logged 13.64 million prompt tokens carrying instructions and context, plus 82,307 output tokens carrying model responses. Of those prompt tokens, 12.95 million were cache hits, which reuse earlier input at a lower price. Nearly 95% of the prompt tokens were cached. Total cost: $7.18.

I then applied Anthropic’s published list prices to that recorded traffic mix. The calculation gives about $11.96 for Claude Opus 4.8 and $23.92 for Claude Fable 5. These are estimates, not bills from separate Claude runs. The other models might generate different token volumes or cache patterns.

Under this fixed-mix assumption, Kimi was roughly 40% cheaper than Opus and 70% cheaper than Fable.

Is Kimi K3 a Claude Opus replacement?

No. Not for me.

Opus still feels more dependable when the work gets difficult. It is better at knowing when to stop and at handling ambiguity. It is also less likely to make an energetic decision I did not ask for.

Moonshot listed excessive proactiveness and sensitivity to the surrounding software among K3’s limitations. That matches parts of my experience.

I would not call K3 a Fable 5-class model either.

But below Fable and Opus the air gets thin very quickly. K3 is close enough that many users may not care about the remaining difference. Others may care less about that gap than the price.

So where do we go from here?

In the days before July 19, 2026, the takes went in every direction.

Kimi K3 is the end of the American model moat. Kimi K3 is benchmark theatre. Open weights make closed models obsolete. Open weights are irrelevant if running the thing costs a small data centre. China is deliberately commoditising the layer on which a large part of the US market is now betting. Or there is no master plan and Chinese labs are releasing good models because good models bring developers, usage and prestige.

A less dramatic list from my notes looks like this:

$/token is a poor comparison when models use very different numbers of tokens.
Public benchmarks are easier to optimise for and may not separate the best models well.
Open weights put a ceiling on API prices even if most users never self-host.
The model is becoming replaceable; the harness, data and workflow may not be.
Value may move up into applications and down into chips, power and the systems that serve model responses.
Open weights help with control and privacy, but “open” does not mean cheap to run.
Export controls can slow Chinese labs and, at the same time, give them a reason to build around the US stack.
The biggest threat is not necessarily that Kimi becomes number one. It is that nobody stays number one for long.

As of July 19, 2026, Epoch AI estimated that the best open-weight models trailed the most capable closed models by only a few months. The exact gap depends on the benchmark, so public evaluations require care. Still, a short lag lets buyers wait, switch, or split workloads across providers. Personally, I think this can be distilled, yes, I know, into a threat and an opportunity.

The threat

The threat is not that Kimi K3 is better than every American model. It is not.

The threat is that K3 may be good enough to make the premium harder to defend.

The large US labs are valued on more than technical competence. Their financial case assumes that frontier intelligence remains scarce and that the lead lasts. It also assumes that customers keep paying high margins for access.

A model can damage that story without taking first place. It only needs to remain close enough to the frontier at a lower price. Existing software must also accept it easily.

That is a bad combination for pricing power: a seller’s ability to maintain high prices. It also weakens the model moat, the durable advantage that protects those prices.

Most enterprise software is sticky because switching is awful. Databases, operating systems, and core banking platforms accumulate years of dependencies. A language model behind an application programming interface (API) is different. The API already lets software exchange requests and responses with another system. The model may be important while remaining surprisingly easy to replace. My Claude Code test is the small version of that.

Closed labs still have ways to earn the premium. Reliability, tool use, and enterprise controls matter. Being six months ahead can be worth a lot when the task is valuable enough.

The timing is awkward because the infrastructure bill is enormous. I examined it in AI Capex Arms Race: Who Blinks First?. Capital expenditure (capex) buys long-lived assets such as data centres and graphics processing units (GPUs). Depreciation spreads an asset’s cost across its useful life. The unresolved issue is how much revenue must arrive, and how quickly, to support these assets and their debt.

If model capability commoditises faster than revenue grows, the damage does not stop at the labs. It reaches large cloud providers, chipmakers, data-centre developers, utilities, and their lenders. A cheaper Kimi is good for users and potentially bad for whoever underwrote scarcity.

The same substitutability also weakens export-control leverage.

The US controls much of the closed-model frontier and the hardware underneath it. That creates leverage while other countries depend on the same stack. Restricting chips and APIs may preserve the lead, but it can also make a parallel stack more valuable.

I examined the other side in Krugman, Fable 5, and Europe in Decline?. A provider or its government can cut off a closed model. Once operators have distributed open weights, nobody can switch them off in the same way. K3’s promised weights were not yet available on July 19, 2026.

There is another, more mundane risk: we may be overrating the model.

Every launch now comes with a dense page of benchmark wins. Some use different harnesses, budgets, or settings chosen for one model. Others are saturated, so top scores cluster too closely to distinguish models. A model that looks brilliant on a leaderboard can still be unpleasant over a long session.

The opportunity

At lower prices, more tasks become worth attempting. Agents combine models and tools to complete those tasks. They can take more passes, read more context, and handle work that does not justify Fable pricing. Lower unit costs may not shrink the market at all.

What interests me more is separation. The interface, agent, and model do not have to come from the same company.

A routine refactor can go to a cheaper model. A difficult architecture decision can go to Opus. Sensitive material can stay on a private deployment. Frontend work can go to whichever model happens to be best at it that month.

The durable product may be the surrounding workflow rather than any single model. Its router selects a model, while its context layer supplies the right information. A validation loop checks the result and sends corrections when needed.

Open weights also matter beyond price. An organisation can fine-tune them for a specific task or quantise them to reduce hardware needs. It can then run the model on premises, under its own controls.

Private deployment changes who answers the hard operational questions. Data residency covers where processing and storage occur; retention covers how long data remain stored. Continuity asks whether the service survives supplier or network failures. Local control does not automatically make a deployment secure or compliant.

So what?!

I do not think Kimi K3 kills Anthropic. I do not think one frontend reconstruction proves parity. On July 19, 2026, I would still choose Opus for the hardest coding work.

But K3 was good enough that I forgot I was using it. It cost materially less. It ran inside the harness I already liked. Moonshot said the weights would be available by July 27 to anyone willing to provide the hardware.

Closed labs now need a lead that is large enough to matter and durable enough to defend. They also need customers who will keep paying for each extra gain as switching becomes routine.

For the operational version of this argument, read Put the Model in the Basement. It tests a Swiss business case built around data residency, control and continuity.

Krugman, Fable 5, and Europe in Decline?

me@philippdubach.com (Philipp D. Dubach) — Mon, 22 Jun 2026 00:00:00 +0200

On May 21, 2026, Paul Krugman concluded a long argument that Europe was not really in economic decline. He made one exception. Europe, he wrote, “can’t be sure that it will always have access to new technologies developed and produced in the other superpowers.” He added that “the risk of being cut off from strategically important technologies, once minimal, is now very real.”

Twenty-two days later, a US directive switched off a frontier AI model for every non-American. Well, technically, it also switched the model off for every American. The episode turned European tech sovereignty from an abstract policy goal into an operational risk.

His argument turns on a measurement paradox. Noah Smith and the Garicano brothers take the other side. Since 2000, measured US productivity grew much faster than Europe’s when economists held prices constant.

Yet European output per hour at current-price purchasing power parity (PPP) barely moved relative to the US. PPP adjusts currency comparisons for local prices. The European figure rose from about 86% of the US level to about 87%.

Krugman treats the flat current-price line as closer to reality. He sees the diverging constant-price line as an effect of fast-falling US technology prices. His critics treat the divergence as real. In their view, companies captured the gains as profits and equity instead of passing them to consumers.

On whether the typical European is getting poorer, I am mostly with Krugman. The median gap is roughly stable. His comparison between California and the rest of the US is hard to dismiss. Constant-price productivity is also a poor measure of how people live. Europe remains a fine place to live and is not falling apart.

Technology you don’t own

the big benefits of IT come from applying it, rather than creating it

Europe applies information technology well. True. But “apply, don’t create” assumes that access remains frictionless and apolitical. It assumes that models, graphics processing units (GPUs), and cloud services remain available at world prices. That assumption died on June 12.

Henry Farrell and Abraham Newman call the replacement weaponised interdependence. Economic networks often depend on a few hubs. Control of one hub can let its owner cut off users downstream. They call this the chokepoint effect.

Europe’s ASML lithography chokepoint

Extreme-ultraviolet (EUV) lithography uses light to print the smallest circuits on advanced chips. ASML is the only supplier and earned €32.7 billion in 2025 sales. That is Europe’s one real card.

Chip fabrication is different. Taiwan’s TSMC held around 70% of the foundry market. A foundry manufactures chips designed by other companies.

Nvidia supplied 80% to 90% of AI-accelerator revenue and well over half of global AI computing capacity. An accelerator is a chip designed for intensive AI calculations. Nvidia’s CUDA software platform reinforces that position.

Synopsys and Cadence formed a US near-duopoly above 90% in chip-design software. Electronic design automation (EDA) software helps engineers design chips. Siemens EDA was the only European player at about 13%, and it still relied on US technology.

AWS, Microsoft, and Google supplied about 70% of the European Union cloud market. Those services also sit under US legal jurisdiction. As of June 21, 2026, US laboratories dominated the closed-model frontier. Mistral was the main European exception, while DeepSeek showed that China could build a parallel stack under sanctions.

The map is lopsided. Europe owns the hardest single chokepoint in the chain and buys almost everything else. The US held 74.5% of measured global GPU-cluster performance. China held 14.1%, and the European Union held 4.8%.

Even the ASML card is partly held in Washington. ASML machines contain US technology. The Foreign Direct Product Rule can restrict foreign-made products that use specified US technology.

US AI export controls at Washington’s discretion

The usual objection is that governments threaten technology restrictions but rarely apply them to allies. By June 2026, they had started doing so.

In January 2025, the US issued the AI Diffusion Rule. It divided countries into tiers for access to AI computing power. The rule placed ten European Union members in the licence-free top tier. It placed seventeen members in a capped second tier.

In May 2025, the administration rescinded the rule. Its notice said the rule “would have undermined U.S. diplomatic relations with dozens of countries by downgrading them to second-tier status.” Tiered access for allies had become too costly diplomatically.

What is worse than a bad rule for a dependent ally? No rule at all. It is discretion.

The administration made deal-by-deal grants to Gulf states. It also received a 15% share of Nvidia’s China revenue in exchange for export licences. One lawmaker said this told China and US allies that “American national security principles are negotiable for the right fee.”

And then came Fable 5. The June 12 directive required Anthropic to block the models for “any foreign national, whether inside or outside the United States.” Anthropic could not check nationality in real time, so the practical result was a worldwide shutoff.

Anthropic disputed the directive’s basis. It called the flagged flaw “a narrow, non-universal jailbreak” that other models also allowed. It warned that the standard “would essentially halt all new model deployments.”

Analysts at Lawfare and Tech Policy Press identified a broader change. Officials had extended export powers designed for physical goods to a live API. An application programming interface (API) lets software send requests to a model. Individual enforcement decisions had started to function like a rule.

Tail risk

Krugman’s welfare case and the security case answer different questions: the average outcome versus the extreme loss. Dependence is cheap and harmless most of the time. It becomes a catastrophe in the bad state of the world. Nobody prices flood insurance from the average year.

The strongest objections do not sink the point. Open weights spread after release. DeepSeek-R1 matched a leading US model at about one twenty-seventh of the cost of producing responses. As of June 21, Epoch estimated that open models trailed the closed frontier by roughly four months. Granted.

But the binding dependence is not the downloadable file. It is the cloud, API, update cycle, and advanced chips underneath. Buyers cannot substitute these components easily.

ASML gives Europe some leverage in return. A US cutoff could invite a Dutch response that blocks the leading-edge chip chain, including US factories. Also true. That possibility lowers the chance of a cutoff. It does not reduce the damage if one occurs. For this argument, severity matters more than probability.

China’s parallel stack shows that separation is survivable. It also shows that separation is expensive and probably leaves the parallel system a step behind.

European technology sovereignty: the scorecard

The giveaway is that Europe’s own institutions already accept the argument under gentler names. Mario Draghi’s competitiveness report called the dependence an existential challenge. It warned of “slow agony” and proposed roughly €800 billion in annual investment.

The report made a still sharper concession. It concluded that “it is too late for the EU to try and develop systematic challengers to the major US cloud providers.”

The EU Chips Act carried a €43 billion headline, but only about €3.3 billion was new EU money. The US CHIPS Act provided $52.7 billion. The European Court of Auditors called the bloc’s target of 20% global chip share by 2030 “very unlikely.” It estimated a more realistic share of 11.7%.

Europe’s reflex is to regulate from strength. It then quietly retreats when the AI Act starts to impose material costs.

The June 2026 technology-sovereignty package carried its own admission: “we want to be sure nobody has a kill switch.”

Former French prime minister Édouard Philippe was more direct after Fable 5. Infrastructure whose models and computing capacity you do not control “is an infrastructure that others can unplug.”

A week later, Group of Seven leaders met at Evian while VivaTech opened in Paris. By then, the dependence was no longer a white-paper abstraction.

Footnote

Krugman moved the worry from productivity to geopolitics and treated that as filing it away. It was the opposite. European policymakers should not fear the output-per-hour line that he correctly takes apart. They should fear becoming revocable second-tier customers in somebody else’s licensing system.

Degoogling cost me my YouTube feed, so I made my own

me@philippdubach.com (Philipp D. Dubach) — Sun, 14 Jun 2026 00:00:00 +0200

I dropped the YouTube app as part of degoogling my life. My self-hosted YouTube subscription feed shows one thing: new videos from the 10 to 15 channels I follow. No comments, no recommendations, no Shorts. I rebuilt that screen and nothing else.

A self-hosted YouTube subscription feed

The result is one chronological list. It merges videos from every channel I follow and sorts them newest first. I can add a channel by URL or @handle, and it stays on the list.

I ignore or avoid everything YouTube adds to the subscription feed. Building the one screen I use took less work than configuring the app to leave me alone.

YouTube RSS feeds without an API key

Each channel publishes a public RSS feed at feeds/videos.xml. The file uses Atom, a standard XML format for content feeds. A Cloudflare Worker reads it, and fast-xml-parser converts the XML into structured data. The Worker is a small program that runs on Cloudflare’s network.

This route avoids the YouTube Data application programming interface (API), Google’s official interface for software requests. It needs no quota, Google project, or token.

A handle or vanity URL can change, but a channel ID remains stable. The Worker reads the channel page once to find that ID. It saves the result and uses the ID for later feed requests.

Before the Worker fetches a user-supplied URL, it checks the destination. This guard prevents server-side request forgery (SSRF). Without it, someone could make the Worker fetch an unintended address.

How to filter YouTube Shorts from RSS

Shorts were the main thing I wanted gone, and one check does not catch them reliably. The first check looks for #shorts in the title. The second tests how the video URL redirects because Shorts and full videos resolve differently. A video must pass both checks to appear.

Playback without the tracking

Clicking a thumbnail loads the video through YouTube’s privacy-enhanced iframe player. An iframe places a page from one site inside another page. The embed does not load before that click, so the player cannot set cookies before playback.

This is not perfect privacy. Once loaded, the player writes an identifier to local storage and sends your IP address to Google. It is still much less intrusive than the app.

On iOS, the video starts muted with a “Tap for sound” overlay. Apple blocks one-tap sound on the web, so muted playback is the least-bad workaround. Videos that block embedding show an “open on YouTube” link instead of a dead frame.

Picture-in-picture came for free

Picture-in-picture was an unplanned bonus. Playback uses a normal web video element, so it receives the system controls. On iOS, the floating window follows me across apps. Audio also continues when the screen locks.

Fast and hard to break

The Worker starts all feed requests together. JavaScript’s Promise.allSettled waits for every result without rejecting the group when one request fails. Each request also has a timeout. A slow or dead channel therefore returns nothing instead of hanging the page.

The Cache API stores the merged feed on Cloudflare’s network for 15 minutes. Cloudflare KV, a key-value database, stores the channel list. The Worker builds the complete HTML page before sending it to the browser. I deploy it with Cloudflare’s wrangler command-line tool.

Midyear Portfolio Review: Valuations got more extreme, not less

me@philippdubach.com (Philipp D. Dubach) — Sun, 31 May 2026 00:00:00 +0200

Last December, I rebalanced around five theses for 2026. Five months later, moving money from US large companies into cheaper markets had mostly worked. Europe was the exception. As always, this is my 2026 midyear portfolio review, not a recommendation.

Portfolio performance review through May

Through May 29, the portfolio gained 5.2% in Swiss francs on a time-weighted basis. A time-weighted return removes the effect of deposits and withdrawals.

My global 60/40 benchmark gained 5.4%. It holds 60% in the MSCI All Country World Index and 40% in global bonds. The bond portion is hedged against movements in the Swiss franc. The S&P 500 total return gained 9.0% in francs.

The portfolio therefore matched the diversified benchmark and trailed the US index by almost four percentage points.

I was up modestly through January, lost those gains by late March, and bottomed near -4%. The portfolio then climbed steadily.

A Middle East conflict began in late February. A brief threat to the Strait of Hormuz sent oil sharply higher. Markets had expected inflation to keep slowing. For several weeks, the oil shock replaced that story with persistent inflation. I think that single event reset the economic backdrop for everything that followed.

In 2025, this approach beat the S&P 500 by a wide margin in Swiss francs. The dollar’s fall against the franc drove that result. The USD/CHF exchange rate fell about 11.5% that year. Through May 29, 2026, it had fallen only about 1.2%.

The currency tailwind that made the strategy look brilliant is gone. Without it, the portfolio did what I expected: matched a balanced benchmark and trailed the US index.

What worked, what didn’t

Emerging Markets gained about 20.7% in Swiss francs and contributed the most relative to its portfolio weight. US Small Cap gained 13.2%, and Japan gained 13.1%. My valuation thesis worked in three of the four market segments where I had added money.

I only half-anticipated what drove the emerging-market gain. In December, I had expected Chinese stimulus. Instead, Korean and Taiwanese chipmakers at the centre of the AI supply chain led the move. My broad emerging-market holding captured that gain; my dedicated Chinese-technology holding did not. I was right about Asia for the opposite reason I had written down. Fair enough.

The fourth rotation was Europe, and it did not deliver. It gained 4.8% in francs, compared with 9.9% for US large companies. Europe trailed the other three rotations by eight to sixteen percentage points.

Germany announced a €500 billion infrastructure fund, €400 billion for defence, and €600 billion in private commitments. Citi’s European equity team maintained its overweight view. An overweight position exceeds the market’s share in a benchmark. Citi projected 13% compound annual growth in German earnings per share through 2029.

None of that had appeared in prices by May 29. A cheap market can remain cheap until an event forces investors to value it differently. The event I expected had not done its job, at least not yet.

Bitcoin and listed private equity were the worst calls, down about 19% and 13% in francs. Bitcoin’s behaviour in March changed how I size it.

I am watching listed private equity more carefully. Its share-price discount to net asset value (NAV) widened and caused the loss. NAV is the value of assets minus liabilities. I see a crowded trade in a year with wider differences between investment returns, rather than a broken thesis.

Valuations got more extreme, not less

The Shiller cyclically adjusted price-to-earnings ratio (CAPE) was the spine of my December argument. CAPE compares share prices with ten years of inflation-adjusted earnings. When I wrote that article, the S&P 500 traded at 40.5 times earnings. The long-run mean was 17.3.

I expected the gap to close through lower valuations or higher earnings. Investors often call the first path multiple contraction.

Neither path closed the gap. The CAPE was about 42.7 in late May, up from 39.8 at the end of December. No reading since December 1999 had been closer to the dot-com peak of 44.2. The valuation rose while earnings kept pace, and the rest of the world remained cheaper.

Concentration is messier. Nvidia’s index weight rose from 7.2% in December to 8.17%. Apple represented 6.70%, while Microsoft fell from 5.9% to 4.96%. The ten largest companies represented 39.1% of the index.

The concentration problem had become a risk tied to one company, not the whole group known as the Magnificent Seven.

The Europe trade is alive but not paying

UBS’s Year Ahead 2026 described Europe’s discount using expected earnings as 22%. Its figures placed the US at 23 times forward earnings and Europe at 14 times. A forward ratio uses expected earnings.

By May 29, the US traded around 28 times past earnings, while Europe traded around 18 times. This trailing ratio gave Europe a discount near 35%. The cheap market had become cheaper relative to the expensive one.

Being early on a valuation gap that will not close is indistinguishable from being wrong for as long as it lasts.

Two quarters of strong US earnings supported the high valuation. FactSet reported a record 13.4% net profit margin for the first quarter of 2026. The index therefore looked expensive without looking fragile.

JPM’s Lakos-Bujas raised his year-end S&P 500 target to 7,600 in April. He raised expected 2026 earnings per share (EPS) to $330, a 22% annual increase. Morgan Stanley’s Mike Wilson set a 7,800 target and called the market “early cycle.” Bank of America’s Subramanian was more cautious at 7,100.

Forecasts had gathered near the high end of the range. For my Europe position, the lesson is that a wide discount can persist for years. A low valuation was never enough on its own. Europe needed a catalyst, and Germany’s fiscal shift had not yet changed the valuation.

Dollar, AI, bonds

Dollar. In December, I expected the dollar to fall 4% to 10% during 2026. By May 29, it had fallen about 1.2% against the franc. That was a stall rather than a fail.

Goldman Sachs, UBS, Pictet, ABN AMRO, and MUFG kept their weaker-dollar forecasts. They moved most of the expected decline into the second half of 2026. The underlying factors remained: US fiscal and current-account deficits, a smaller interest-rate advantage, and concerns about government debt. The International Monetary Fund highlighted the fiscal concerns in April.

The war revived demand for the dollar as a safe asset. A Federal Reserve focused on inflation also preserved the dollar’s interest advantage. I assume the thesis is delayed, not dead.

AI capital expenditure. The largest cloud companies were forecast in December to spend $571 billion on long-lived assets during 2026. First-quarter results and company forecasts raised the conservative range to roughly $660 billion to $725 billion. One financial-analyst estimate reached $805 billion. No major research firm reduced its forecast. Cloud revenue accelerated with the spending.

I still think AI may become a competitive commodity. In that case, much of the value flows to users rather than one model provider. But the investment cycle had clearly not peaked. Betting against it on valuation alone would have cost me.

Bonds. This is the clean miss. I built the holdings around two or three Federal Reserve cuts in 2026, and none occurred by May 29. The energy shock pushed inflation back towards 4%. The Federal Reserve held rates at every meeting.

By spring, markets expected the European Central Bank to raise rates before the Federal Reserve changed them. Swiss-franc corporate bonds returned about 0.2% in francs. Hedged euro government bonds returned about -0.1%, while US Treasuries returned about -1.3% in francs. The currency loss erased a roughly flat dollar return.

Interest income has been fine. My expected capital gain has not arrived. I had assumed that lower policy rates would raise bond prices.

The two diversifiers split

The clearest lesson from the first five months is that my two “diversifiers” are not the same animal. The March shock separated them.

Gold behaved like a diversifier when it mattered. It held its value during the energy-shock drawdown while equities fell. Central banks also continued buying gold. They bought 244 tonnes in the first quarter, according to the World Gold Council.

Over the full five months, my Swiss-franc-hedged gold holding gained only about 1%. The currency hedge removed gains that unhedged gold received from the dollar. I accepted that cost deliberately. Gold did its job during the only period that tested it. It remains my portfolio’s one genuine diversifier.

Bitcoin did not. During the March drawdown, it fell with equities and fell further than they did. It was down about 19% in francs for the year through May 29. Bitcoin behaved like an amplified bet on risk appetite and market liquidity, not like ballast.

Three portfolio allocation changes

I made three small changes. None reversed the strategy. A midyear review mostly earns the right to leave things alone, and that is what this one did.

Gold from 5% to 6%. It is the portfolio’s one genuine diversifier and held up during the year’s only stress period. I funded the increase with new cash rather than selling anything. The currency hedge reduced this year’s reported gain, and I am keeping it anyway. I own gold to reduce equity losses in francs, not to make a separate dollar bet.

Crypto from 4.5% to 3.5%. This is not a loss of faith. I keep a meaningful position because the potential gain exceeds the amount at risk. But crypto’s job was diversification, and it failed that job in March.

I am sizing it for what it actually is. I let its weight fall and redirected new contributions instead of selling after the decline. The change therefore had no transaction cost.

Japan, switched into a Swiss-franc-hedged share class. Japanese equities gained well into the teens in local currency. A falling yen erased most of that gain for me as a franc investor.

I kept the equity exposure and hedged the currency. The Swiss National Bank’s policy rate was 0%, and Japanese rates were also low. The small rate difference made the hedge inexpensive compared with the currency move it removed. Same 3% weight, different currency.

I did not apply the same logic to the dollar. Hedging dollars cost roughly 4% because of the interest-rate difference. That cost was too high to offset a one-percentage-point currency move on a 2% Treasury position. I preferred to keep the extra interest income.

I also measured the AI exposure hidden inside my supposedly less concentrated portfolio. Market-capitalisation-weighted funds hold more of the largest companies, including Nvidia and TSMC. This indirect AI exposure was roughly 13% of the portfolio. No single company exceeded about 2%.

The reduction in concentration worked. I do not have a concealed AI bet masquerading as diversification. That was the outcome I most wanted to rule out.

What would change my mind

The thesis rests on a few load-bearing assumptions. A useful review names what would break each one.

For AI and US concentration, price alone is not the trigger because expensive assets can remain expensive. I would react if the largest cloud companies cut investment while their cloud revenue stopped growing. A major efficiency gain that made current infrastructure look excessive would have the same effect.

Through May 29, capital expenditure was still rising and generating revenue. If that relationship reverses, I will reduce the portfolio’s direct and indirect AI exposure.

For interest rates, falling inflation and Federal Reserve cuts would restore the bond case that I got wrong this spring. I would then buy bonds with longer maturities. Longer-maturity bonds respond more strongly to changes in interest rates.

If inflation remains high and energy costs feed into wages, gold must provide protection. I would keep the bonds at shorter maturities.

For Europe, I will keep the overweight position while the public-spending plan remains intact. I view the problem as a missing catalyst, not a broken thesis. If German spending stalls or analysts cut earnings forecasts, I will reduce the position to its benchmark weight.

How DORA Made Sovereignty a Bank Problem

me@philippdubach.com (Philipp D. Dubach) — Sun, 24 May 2026 00:00:00 +0200

I’ve heard variants of the same line from probably a dozen people in the last six months. A consultant I know has done more US-to-EU migrations this calendar year than in his entire career before. A founder on LinkedIn wrote the other day: Trump effectively has a kill-switch to our highly digitalised society, and the thought of that is frightening. None of those people would have used the word “sovereignty” in 2023. All of them now use it without explanation. For European banks, the Digital Operational Resilience Act (DORA) turns that language into an operating requirement.

Schleswig-Holstein is a German state with 2.9 million residents. By late 2025, it had moved roughly 80% of about 30,000 state workstations from Microsoft Office to LibreOffice. Linux pilots were also running, and the state targeted full migration for 2026 (The Register, 15 Oct 2025).

Airbus opened a tender for a sovereign EU cloud in December 2025. The system would host software for planning, manufacturing, customer management, and product development. The potential contract is worth more than €50M and could run for 10 years. Airbus’s executive vice president for digital gave herself only an “80/20” chance of finding a qualifying provider (heise online, 19 Dec 2025).

The International Criminal Court (ICC) left Microsoft Office for openDesk in October 2025. Germany’s ZenDiS developed the open-source suite (The Register, 31 Oct 2025). The move came about six months after the US government effectively cut access to the chief prosecutor’s Microsoft email under Executive Order 14203. A Just Security analysis traces the sequence. In February 2026, Microsoft asked the UK Parliament to “correct the record”.

The Dutch parliament passed five separate motions in March 2025 (Computer Weekly; Euronews, 20 Mar 2025). The first would remove DigiD from Kyndryl after its planned acquisition of Solvinity. The second called for a review of Amazon Web Services (AWS) hosting the .nl domain. The other motions would prioritise EU providers, require exit plans for all US-hosted systems, and tender a Dutch-controlled national cloud.

Microsoft responded with a datacenter expansion worth more than €40B. The plan would increase capacity by 40% across 16 EU countries. Microsoft also offered a contractually binding “court-fight clause.” Brad Smith pledged that Microsoft would sue the US government rather than comply with an order to suspend EU operations. Microsoft described the clause in its one-year update to the European Digital Commitments, published on 29 April 2026.

The European Commission is reportedly preparing a Tech Sovereignty Package for 27 May 2026. The package would combine the Cloud and AI Development Act (CADA) with a Chips Act 2.0. It would restrict member-state governments from using US cloud providers for sensitive public-sector data. The restrictions would cover healthcare, finance, and judicial systems (CNBC, 7 May 2026).

I also see the change in my day-to-day work. Every data or artificial intelligence (AI) project we ran with DACH banks in the last 12 months included digital sovereignty. DACH covers Germany, Austria, and Switzerland. Sometimes sovereignty was the agenda.

On 18 November 2025, the European Supervisory Authorities published their first list under the Digital Operational Resilience Act (DORA). It named 19 Critical ICT Third-Party Providers (CTPPs). Here, ICT means information and communication technology. The list includes AWS, Microsoft, Google Cloud, IBM, Bloomberg, London Stock Exchange Group, Tata Consultancy Services, and Orange (EBA press release). Each provider now faces direct EU oversight. Lead Overseers can impose a daily fine equal to 1% of average daily global turnover for up to six months.

Sovereignty has therefore become a regulatory deliverable with a last-test date. Two forces drove that change: four converging legal pressures and a shift in how decision-makers price political risk.

DORA, cloud sovereignty, and the policy shift

The sovereignty debate in 2026 is no longer mainly about the General Data Protection Regulation (GDPR); that battle is six years old. Four legal pressures now collide. The market was willing to ignore that collision until 2024.

US laws reach EU-hosted data

The Clarifying Lawful Overseas Use of Data (CLOUD) Act compels US-headquartered providers to disclose data (18 U.S.C. § 2713). The duty applies “regardless of whether such communication, record, or other information is located within or outside of the United States.”

Microsoft’s transparency report for the second half of 2024 records 5,587 US law-enforcement demands for consumer data. Of those demands, 115 were warrants for content stored outside the US (Microsoft CSR Government Requests). In late 2024, Microsoft France told the French Senate that it could not guarantee non-transfer of EU-hosted data under a CLOUD Act order. Microsoft France had now put the conflict on the record.

Executive Order 14203 sanctioned ICC officials, including Chief Prosecutor Karim Khan. The order appeared in the Federal Register on 12 February 2025; Winston & Strawn published a separate legal analysis. Khan then lost access to his Microsoft email (Computer Weekly). Microsoft denied that it had actively cut him off. The ICC moved to openDesk anyway. The sequence remains disputed, but banks now have a concrete case to examine.

Congress reauthorised Section 702 of the Foreign Intelligence Surveillance Act (FISA) in April 2024. The Reforming Intelligence and Securing America Act (RISAA) extended it until 20 April 2026 (CRS R48592; Brennan Center §702 resource). Section 702 still allows warrantless collection from US “electronic communication service providers.” Those surveillance powers helped invalidate Privacy Shield in Schrems II (CJEU C-311/18, 16 Jul 2020).

The privacy group noyb plans a broader challenge to the EU-US Data Privacy Framework (DPF). It would bring the case before the Court of Justice of the European Union (CJEU). Its argument is that Executive Order 14086 supports the transatlantic data system. Any later US administration can rescind that order. The General Court upheld the DPF in Latombe (T-553/23, 3 Sept 2025, Hogan Lovells). An appeal filed on 31 October 2025 remains pending.

EU law pushes back

The Data Act applies from 12 September 2025 (Regulation (EU) 2023/2854). Article 32(1) requires data-processing providers to take “all adequate technical, organisational and legal measures… to prevent international and third-country governmental access and transfer of non-personal data held in the Union where such transfer or access would create a conflict with Union law.” Article 32(2) recognises a third-country order only when it is based on an international agreement in force with the EU or relevant Member State.

No EU–US CLOUD Act executive agreement exists. On paper, a US warrant for non-personal banking transaction metadata hosted in Frankfurt therefore creates a conflict that the provider must resist. A ban on switching charges begins in January 2027 and removes one source of structural lock-in.

The EU AI Act entered into force on 1 August 2024 (Regulation 2024/1689). Obligations for general-purpose AI (GPAI) applied from 2 August 2025. The threshold for a systemic-risk designation is 10²⁵ floating-point operations (FLOPs). Commission enforcement begins on 2 August 2026, and fines can reach 7% of global turnover. Meta declined to sign the GPAI Code of Practice, while OpenAI, Anthropic, and Google signed it. The European Commission has not yet settled compliance rules for the next generation of frontier models.

EU cloud certification remains unresolved

The European Union Agency for Cybersecurity (ENISA) drafted the European Cybersecurity Certification Scheme for Cloud Services (EUCS). Under industry pressure, it removed the “high+” sovereignty requirements in March 2024. Those rules required EU headquarters, staff, and jurisdiction. ENISA has not formally adopted a successor (ITIF analysis, May 2025). Hogan Lovells reports that France, Italy, and Spain are seeking to restore the requirements.

France’s national SecNumCloud standard already requires immunity from extraterritorial laws. S3NS, a joint venture between Thales and Google, received SecNumCloud 3.2 qualification on 17 December 2025. It was the first US-tech-backed sovereign cloud to receive that qualification.

DORA turns the issue into bank operations

The Digital Operational Resilience Act applied from 17 January 2025 (Regulation 2022/2554). The 19-provider CTPP list is its most visible operational result. Article 28 requires contractual exit strategies, while Article 30 specifies contracts for critical functions. Articles 31–44 give Lead Overseers direct EU-level authority. Lead Overseers can impose a daily fine equal to 1% of average daily global turnover for up to six months.

The European Central Bank (ECB) published its Guide on Outsourcing Cloud Services on 16 July 2025. It clarifies the expectations of the Single Supervisory Mechanism (SSM) for concentration risk and exit testing. It also treats audit rights as a continuous obligation rather than contract boilerplate.

The German Federal Financial Supervisory Authority (BaFin) uses several national rules. Its Supervisory Requirements for IT in Financial Institutions (BAIT) align German supervision with DORA. So do the Minimum Requirements for Risk Management (MaRisk), section AT 9. The ninth MaRisk amendment dates from June 2024.

The Swiss Financial Market Supervisory Authority (FINMA) has applied Circular 2018/3 since 2018. The technology-neutral circular permits foreign outsourcing only when inspection rights are enforceable in the host jurisdiction. BaFin’s March 2024 cloud guidance update sets the same expectations in German national practice.

Across DACH, DORA, the ECB Guide, BAIT and MaRisk, and FINMA Circular 2018/3 converge on three operational requirements. Banks need a documented and tested exit strategy. They need contractually enforceable audit access in the actual jurisdiction and a measurable concentration metric for ICT third-party providers. That combination has put sovereignty on every chief information officer’s agenda.

Opinion shift

The opinion shift is harder to quantify, and I think it is also harder to undo. The consultant I mentioned earlier put it plainly. These migrations are not about trusting Brussels more than Washington. They respond to a US administration that repeatedly showed it would weaponise commercial dependencies against allies.

Two political events drove that response. The Microsoft and Karim Khan episode put a precedent on the record. The second was the threat to Greenland’s sovereignty. It included the January 2026 tariff escalation against Denmark (House of Commons Library CBP-10472). The Center for Strategic and International Studies (CSIS) called the Greenland crisis “the catalyst for European digital awakening” (CSIS, 2025).

In August 2025, Trump threatened substantial tariffs and export restrictions. He targeted countries with digital services taxes, the Digital Markets Act (DMA), or the Digital Services Act (DSA). A December 2025 Bloomberg report named Accenture, Siemens, and Spotify as possible targets for Section 301 retaliation. Together, those events removed the remaining doubt about whether Washington would use the lever.

The well-meaning “Europe isn’t a sanctuary” objection misses the structure of the decision. On its own terms, the objection is correct. The EU has its own surveillance expansion. Examples include the European Parliamentary Research Service study on virtual private networks and recurring Chat Control proposals. They also include German Impressum rules, French identification rules, and the UK’s age-verification regime.

Stripe was founded by Irish brothers, but it is structurally a US company. ASML is technically Dutch. Yet its supply chain and intellectual property (IP) exposure put it within the US Foreign Direct Product Rule. In September 2024, the Dutch government moved to take over licensing for the NXT:1970i and 1980i deep ultraviolet (DUV) systems. The licensing decision shows that Dutch ownership does not remove US influence.

Proton, a Swiss privacy provider, has publicly threatened to leave Switzerland over the revised Ordinance on the Surveillance of Post and Telecommunications (VÜPF). It has also started moving physical infrastructure to Germany and Norway. Europe is not clean, but its marginal exposure remains lower than that of a US-controlled stack.

Europe in 2026 is trying to distance more than it is trying to grow. The sovereignty drive could produce fragmented and slightly worse versions of every layer in the stack. It might still fail to produce a competitive EU technology sector. The Airbus-A380 jibe captures the risk: “database in France, frontend in Belgium, ops in Spain.”

Airbus is doing fine. Schwarz Digits, the IT arm of Lidl and Kaufland, won the Dutch Central Bank’s cloud business from AWS. OVHcloud passed €1B in fiscal year 2025 revenue, with 9.3% like-for-like (LFL) growth. In September 2025, Mistral closed a €1.7B Series C led by ASML. It plans a Swedish datacenter worth more than $1B. The fragmentation critique is valid, but it does not justify stopping.

What I’d hold: DORA makes cloud sovereignty operational

I keep coming back to two extreme facts that coexist.

First, sovereignty is not a values play. It is a rational response to the US legal apparatus and the EU statutory framework. In 2025, the US showed that it would weaponise commercial dependencies. EU law now makes inaction increasingly non-compliant. The policy shift forces the conversation, while the opinion shift makes it stick.

Second, the supply side is underfunded by two orders of magnitude relative to the hyperscalers it is meant to replace. The EUCS process still cannot agree on what “sovereign” means. Most organisations will therefore move one partition at a time. The first contested CLOUD Act warrant against an EU-resident hyperscaler subsidiary will test that legal structure.

These migrations are not a bet that the EU is a sanctuary. They lower the conditional probability that a foreign government can use a provider to unplug a bank. That government answers to a different electorate. I see this as a structural risk, not a directional call. It has quietly made sovereignty the #1 agenda item of 2026.

Moving the blog stack to Europe (kind of)

me@philippdubach.com (Philipp D. Dubach) — Sun, 24 May 2026 00:00:00 +0200

AI-generated, one-shot from the blog title via Gemini (Nano Banana).

There’s a version of this story where I move everything to Europe in one go and write a triumphant post about digital sovereignty. The actual version is less clean. As of this week, the site you’re reading runs from a small Hetzner box in Nuremberg, and most of the supporting services moved with it. Some of the reasoning fed into my latest essay: How DORA Made Sovereignty a Bank Problem.

Why now

Two things converged. First, GitHub Pages started feeling more like a constraint than a freebie: no access logs, a hard cap on file size, no control over response headers without bolting on a Cloudflare Worker, no place to run anything dynamic next to the static site. Second, the EU jurisdictional question stopped feeling academic. Newsletter subscriber records, draft posts, analytics counters, backup archives: all of it sat in US-controlled storage by default.

Self-hosting isn’t a moral position. It’s a series of small choices about where data lives and how much operational overhead you’re willing to absorb in exchange for control. Longer-term I want to be off the major hyperscalers entirely.

Compute: GitHub Pages → Hetzner CPX21

The site moved from GitHub Pages to a Hetzner CPX21 in Nuremberg. Debian, four virtual cores, four gigabytes of RAM, plenty of headroom for a Hugo blog and the supporting services. Hetzner publishes its CO₂ footprint per server class and runs its EU fleet on renewable contracts.

For now, GitHub Pages remains a warm standby. The deploy workflow is still wired up, so if anything goes wrong with the self-hosted setup that I can’t fix in an hour, flipping DNS back gets the site online while I sort it out. Sovereignty is good. A working escape hatch is also good.

Object storage: R2 → R2 EU jurisdiction

The images and newsletter archives that the site loads from static.philippdubach.com used to live in a Cloudflare R2 bucket with no jurisdictional pinning, which in practice meant US-resident metadata. Hetzner Object Storage and Scaleway are both on the table, and I’m still weighing them.

R2 has zero egress fees, the API is S3-compatible, the Workers integration is built in, and the image-resizing pipeline I’d already wired up depends on it. Walking away from all of that to gain a one-step shorter jurisdictional chain felt like the wrong trade, so the bucket moved to Cloudflare’s EU jurisdiction (static-eu) instead.

This part of the story doesn’t fit the clean Europe-versus-US framing. Cloudflare is still US-headquartered. EU jurisdiction means the data stays in EU data centers and the company applies stricter handling, but a US court can still compel disclosure under the CLOUD Act.

Moving away from my fully bootstrapped newsletter generator. Listmonk is open source, runs in about 50 MB of RAM, and stores its data in the same Postgres instance I already had running for other services. Subscribers, campaigns, templates: all of it now lives on the same box as the blog itself.

I’m now responsible for deliverability, suppression lists, bounce handling, and the surprisingly large number of small operational decisions that hosted newsletter services hide from you. Sending mail still goes through Resend over standard SMTP. Operating my own outbound mail server is a level of pain I’m not willing to absorb for marginal sovereignty gains, and Hetzner blocks port 25 on new accounts anyway.

Source code: GitHub → Forgejo

This was the move I expected to regret and didn’t. Forgejo is a Gitea fork that runs as a single Go binary, includes a web UI, supports webhooks, and behaves like GitHub for every day-to-day operation. Pushing code to my own remote and watching a webhook fire a Hugo rebuild on the same box has a closed-loop simplicity I didn’t realize I was missing.

I still mirror to GitHub for the public-repo discoverability and the social signal. The self-hosted instance is the source of truth; GitHub is the read replica.

Analytics: already on GoatCounter, still on GoatCounter

Analytics never went through Google. The previous setup used a hosted GoatCounter, which is open source, privacy-preserving, and stores no personal data. The migration moved it onto my own box. Same software, different host, same privacy stance.

Backups: a thing I now have

Before the migration, “backup” meant whatever GitHub kept of my repo and a vague trust that my newsletter provider would still exist next month. After the migration, it means a nightly restic snapshot to a Cloudflare R2 EU bucket, encrypted, with monthly integrity checks that email me if anything is wrong.

What I kept on US infrastructure

Cloudflare. The CDN, the Workers that handle subscribe forms and edge logic, the cache rules, the rate limiting on admin endpoints. Moving off Cloudflare would mean rebuilding the edge layer that makes the site fast everywhere and the spam controls that keep brute-force login attempts away from the self-hosted admin panels. I’m not ready for that trade.

Resend, for outbound mail. They handle SPF, DKIM, DMARC, reputation management, and the dozen other things that determine whether your email lands in the inbox or the spam folder. European alternatives exist, and I’ll look at them next.

GitHub, for the public mirror. The friction cost of asking everyone to discover my code on a self-hosted Forgejo instance is higher than the sovereignty benefit, given the code is open source and the source of truth is on my box anyway.

Aschenbrenner's Receipts

me@philippdubach.com (Philipp D. Dubach) — Thu, 21 May 2026 00:00:00 +0200

In June 2024, Leopold Aschenbrenner published a 165-page essay called Situational Awareness. He committed himself to a chain of dated forecasts. Models would get more processing while producing answers, a method called test-time compute. Power, not chips, would constrain the US AI buildout. The Marcellus shale would power data centres despite climate pledges by the largest cloud companies. By May 21, 2026, most technology and infrastructure calls examined here had landed, received supporting evidence, or were tracking.

Most political prescriptions remained unfulfilled or moved in the opposite direction. There was no voluntary lab merger, Congressional trillions, or coordinated democratic coalition. The US government did not invoke the Defense Production Act (DPA) for the proposed project. Export controls loosened. Some deadlines extend to 2027–28 or the end of the decade, so this political verdict remains provisional.

This split says something about the worldview holding both halves up. Read Situational Awareness beside the four-and-a-half-hour Dwarkesh Patel interview. You find something stranger than a clean libertarian, hawk, or alignment researcher. You find all three running at once.

Artificial general intelligence (AGI) means broad human-level or greater cognitive ability. The essay treats AGI as a dated forecast and a political event.

The libertarian:

“I am a big believer in the American private sector, and would almost never advocate for heavy government involvement in technology or industry.”

That sentence is in Situational Awareness. Three pages later he calls for the largest peacetime industrial nationalisation in American history.

The hawk wants the US to secure its AI labs to a “B-21 bomber-grade” standard. He also wants nuclear deterrence against strikes on US data centres. By 2027/28, he expects the state to absorb the frontier labs into a national project. He calls this Burkean.

“American checks and balances have held for over 200 years and through crazy technological revolutions.”

The alignment researcher was an initial member of OpenAI’s Superalignment team. That team studied how to control AI systems that exceed human ability. Aschenbrenner has said publicly that OpenAI dismissed him in spring 2024 after he shared a security memo with the board. He has also said that he declined a departure agreement with a non-disparagement clause. According to him, that choice cost roughly a million dollars in vested equity. “Freedom is priceless,” was his summary.

He thinks the default plan will probably work. That plan uses scalable oversight, weak-to-strong generalisation, and interpretability. Scalable oversight helps people supervise systems that exceed their direct reviewing ability. Weak-to-strong generalisation asks whether weak supervision can guide stronger systems. Interpretability research examines how a model produces decisions. By the standards of the Machine Intelligence Research Institute (MIRI) and Eliezer Yudkowsky, he is an optimist.

Each identity is internally consistent on its own. Their conjunction is not. A libertarian does not nationalise. A Burkean does not impose a Manhattan Project on a peacetime economy. An empirical alignment optimist does not demand wartime custody in a sensitive compartmented information facility (SCIF) by April 2028. A SCIF protects classified information.

Aschenbrenner reaches all three positions by using the same forecasting machinery in three domains. These domains are compute scaling, great-power competition, and alignment tractability. The forecasts converge on a single decisive event. The opening line of his Dwarkesh interview names it directly:

“What will be at stake will not just be cool products, but whether liberal democracy survives, whether the CCP survives, what the world order for the next century will be.”

CCP refers to the Chinese Communist Party. I read Aschenbrenner the way he reads scaling laws: by decomposition. The three identities form the spine. For each one, I examine the framework, the evidence available by May 21, 2026, and the strongest counter-position. I also examine what the synthesis costs him. The result shows what a convergent forecast does to a worldview. It also reveals something about the AI-policy debate that the rest of us are still having.

I. The forecaster before the politics: a prediction scorecard

Before any criticism, what he got right.

The signature analytical move in Situational Awareness is what he calls “counting OOMs”, or orders of magnitude of effective compute. An OOM is a tenfold change. Effective compute combines training scale with gains from better algorithms and methods.

His decomposition is multiplicative. Training compute adds half an OOM per year. Algorithmic efficiency adds another half an OOM. Discrete unhobbling gains add more. Unhobbling means removing practical limits on model performance. His examples include reinforcement learning from human feedback (RLHF), which uses human preferences to improve responses. They also include chain-of-thought reasoning, which makes a model produce intermediate reasoning steps. Scaffolding connects a model to tools and structured workflows.

Extrapolating to 2027 gives roughly five OOM of effective compute scaleup since GPT-4. In his framing, this equals another GPT-2-to-GPT-4–sized capability jump. The framework is unfashionably simple. It is also empirically unusually well calibrated.

By May 21, 2026, most concrete technology and infrastructure calls examined here had landed, received supporting evidence, or were tracking.

Test-time compute overhang. In June 2024 he wrote:

“What if it could use millions of tokens to think about and work on really hard problems or bigger projects? […] If we could unlock ‘being able to think and work on something for months-equivalent, rather than a few-minutes-equivalent’ for models, it would unlock an insane jump in capability.”

OpenAI launched o1 four months later. DeepSeek-R1 followed in January 2025. Claude extended thinking and GPT-5 thinking provided further support for the paradigm. Aschenbrenner had predicted a model category that did not yet exist. He inferred it from AlphaGo research on the trade-off between compute during training and compute during use.

GPQA Diamond saturation. Graduate-Level Google-Proof Q&A (GPQA) Diamond tests models with difficult science questions. Claude 3 Opus scored 60% when Aschenbrenner wrote. He predicted “this benchmark to fall in the next generation or two.” In May 2026, GPT-5 scored 88.4% without tools. Gemini 3.1 Pro Preview scored 94.3% with extended reasoning. Epoch AI describes the benchmark as near its asymptote, where further gains become small. It took roughly 18 months, almost exactly the prediction window.

Power as the binding constraint. This was the essay’s most prescient line of policy analysis. It preceded Wood Mackenzie’s headline numbers by roughly six months. Heavy-frame turbine lead times reached six years by May 21, 2026. Original equipment manufacturers (OEMs) had sold their order books through 2027. S&P Global put data-centre grid power growth at +22% in 2025. His power-not-chips framing preceded consensus and later became industry consensus.

Marcellus shale and behind-the-meter gas. Behind-the-meter plants generate power at or near the customer site. A gigawatt (GW) is one billion watts. Aschenbrenner argued that abundant US natural gas was the only way to power the trillion-dollar cluster. This claim ran against climate pledges by the largest cloud companies. Meta later ordered ten gas plants for the planned Hyperion build. The build is planned at 7.5 GW, with an associated grid expansion of roughly 30% in Louisiana. Microsoft, Chevron, and Engine No. 1 partnered on 5 GW in West Texas. Williams Companies committed $5B to behind-the-meter turbines. By May 21, 2026, the US pipeline contained over 250 GW of new gas capacity.

This is the part of the record that gets him invited to the room. The next part is what he says once he is in it.

The Gulf chip pivot. He asked, intending the answer to be no:

“Would you do the Manhattan Project in the UAE?”

Stargate UAE was under construction by May 21, 2026. A megawatt (MW) is one million watts. Its eventual capacity is 5 GW, with 200 MW planned for the third quarter of 2026. HUMAIN deployed its first 18,000 GB300s in Saudi Arabia. The Trump administration authorised 70,000 GB300s for G42 and HUMAIN in November 2025. The thing he warned against happened. The same US government that he expected to nationalise the labs authorised it.

AMD’s compute TAM. Total addressable market (TAM) estimates the revenue opportunity available to an industry or product. Aschenbrenner cited AMD’s $400B AI accelerator forecast for 2027. AMD later reaffirmed the forecast and upgraded to a $1T compute TAM by 2030.

Scaling lawfulness, generally. Aschenbrenner claims that scaling laws held across fifteen orders of magnitude. He cites the Kaplan-to-Chinchilla-to-GPT-4 chain. Evidence from 2024-26 broadly supports this claim. The 2024 Kaplan paper from Anthropic on data-bound scaling complicates the picture. So do capability gains driven mainly by RL post-training rather than pretraining floating-point operations (FLOPs). Neither development breaks the scaling claim.

Several predictions were ahead of consensus by months. The predictions themselves were not the novel contribution. Anyone reading SemiAnalysis and AMD investor decks could have triangulated most of them. The novelty was his commitment to a dated narrative in which they all compound.

A sceptical reader will note that San Francisco’s AI cluster has better information about what happens inside the labs. Granted. But test-time compute was not yet inside-the-lab consensus when he published. The power constraint preceded the industry’s shift. The Gulf-at-the-AGI-table point preceded the actual deal flow. There is real foresight here, even after discounting for the information asymmetry.

The May 21, 2026, scorecard cuts hard the other way on another category of prediction. I return to that record later. The technology and infrastructure forecasts earn the rest of this essay. If those forecasts had been mediocre, his worldview would not be worth dissecting.

II. Identity one: the libertarian

“I am a big believer in the American private sector, and would almost never advocate for heavy government involvement in technology or industry.”

That sentence opens Chapter IV of Situational Awareness. The chapter is titled “The Project.” It argues that the United States must absorb frontier AI labs by 2027–28. The national effort would resemble the Manhattan Project and could be voluntary or compulsory. Congress would appropriate trillions of dollars for compute and power. Democratic allies would form a coalition for AGI development. The core research team would move to a SCIF.

The gap between the opening sentence and the thesis is not hidden. He flags it himself:

“I used to apply this same framework to AGI — until I joined an AI lab.”

Aschenbrenner’s libertarianism is operational, not rhetorical. He says he declined a departure agreement with a non-disparagement clause when he left OpenAI. According to him, that refusal cost “close to a million dollars” in vested equity. He did not want to constrain his future ability to write what he believes.

Aschenbrenner calls himself a “speech deontologist,” meaning that he says what he thinks even when the consequences argue against it. He admires the American private sector. He also admires the wider US institutional system: the Federal Reserve, the Supreme Court, and the Constitution.

The November 2025 Genesis Mission executive order (EO) under Trump 2.0 used explicit Manhattan-Project language. It mobilised Department of Energy (DOE) national laboratories for AI-accelerated science. This is the rhetoric that Aschenbrenner predicted. The institutional structure did not form. There was no voluntary lab merger, no appropriation of trillions, and no coalition of democracies.

His libertarianism is not absolute. It creates a presumption against state action with one exception. The exception applies when civilian technology becomes a weapons-grade output for state actors. He reclassifies AGI from “tech industry” to a weapon of mass destruction (WMD). His rule against state involvement therefore no longer applies.

“They’re startups. And startups are startups, you know — I think they’re not fit to handle WMDs.”

This argument is structurally cleaner than it looks. Nineteenth-century classical liberalism made similar exceptions. Mill wrote about intervention in failed states. Bagehot treated the Bank of England as a lender of last resort. Hamilton accepted a national bank when the political economy required it. Aschenbrenner’s novelty is using an industrial technology as the trigger. The empirical question is whether AGI clears that bar. The structure of the argument is not new.

By May 21, 2026, the full nationalisation that he predicted had not happened. Frontier labs remained decentralised and competitive. Stargate was announced as a four-year, $500B investment plan involving OpenAI, SoftBank, Oracle, and MGX. It looks more like a defence-contractor public-private partnership (PPP) than a Manhattan Project. The CHIPS Act still contained the original $39B + $11B from 2022. Congress had not appropriated trillions.

The AI Safety Institute (AISI) became the Center for AI Standards and Innovation (CAISI) in June 2025. The multilateral framework that Aschenbrenner expected had dissolved into transactional bilateral agreements.

A different version of his prediction did partly land. Defence contracting was expanding by May 21, 2026. Anthropic signed a $200M Department of Defense (DoD) contract. Claude became the first AI model authorised on classified networks. Stargate is functionally a national-security PPP under commercial wrapping. His interview line “we’ll all be in a bunker” was correct in spirit and wrong in form.

The investment firm is the product of a libertarian instinct that refuses to die. He wants situational awareness to become financially decisive before the state arrives.

“If AGI were priced in tomorrow, you could maybe make 100x. Probably you can make even way more than that because of the sequencing.”

The fund is the libertarian’s hedge against his own forecast. It captures private upside before his predicted nationalisation reshapes the prize.

The strongest counter-position says that this is not a libertarian making a careful exception. It is a hawk borrowing libertarian clothes.

The defence starts with his equity forfeiture, his speech deontology, and his refusal to sign an NDA at material cost. His libertarian commitment is operational when he can choose to exit, including from his own employment. That choice cost him real money. His conditional preference for state action is consistent with classical liberalism rather than a defection from it. He is careful about the exception, not opportunistic.

That is intellectually honourable. It is also the first place where the synthesis starts to creak. A real libertarian who pays a million dollars to call for a Manhattan Project is more interesting than a hypocrite.

He asks us to follow a chain whose first link is “I changed my mind about state involvement when I joined an AI lab.” That is an empirical claim. The prescriptive jump also depends on the hawk’s claim about adversary capability. It then depends on the alignment optimist’s claim about institutional tractability.

III. Identity two: the Burkean hawk

“In some sense, this is simply a Burkean argument: the institutions, constitutions, laws, courts, checks and balances, norms and common dedication to the liberal democratic order […] have withstood the test of hundreds of years. Special AI lab governance structures, meanwhile, collapsed the first time they were tested.”

Aschenbrenner names Burke in Chapter IV to defend the Project. The phrase “collapsed the first time they were tested” refers to OpenAI’s November 2023 board crisis. The board fired Sam Altman and briefly put Mira Murati in charge. Then ~700 employees threatened to resign. Within five days, the board reinstated Altman and changed its membership. Special-purpose AI-lab governance structures genuinely collapsed on contact with reality. Aschenbrenner’s empirical observation is correct.

The substantive Burkean intuition is that two-hundred-year-old institutions absorb shocks better than improvised lab-governance structures. On its face, that is a strong empirical argument. Aschenbrenner’s respect for American institutions is unusual among accelerationists, who favour faster technological development. Much accelerationist discourse in 2024 was openly contemptuous of regulators, Congress, and constitutional checks. Aschenbrenner takes them seriously enough to attempt a synthesis.

He praises the Federal Reserve as a model of competent technocratic delegation. He also admires the Supreme Court. In his words, “they really believe in the constitution, they love the constitution”. He recommends listening to oral arguments as a podcast.

The Burkean argument also cuts the other way. Burke argued that radical institutional changes tend to cause unintended damage, even when reformers share the institution’s goals. In Burke’s sense, the conservative move is slow.

Aschenbrenner proposes a Manhattan Project for a peacetime economy in 2027. An accelerated executive command would run it. Frontier research would move to a SCIF, and workers would build the trillion-dollar cluster in record time. This is the modal Promethean prescription, not the modal Burkean one.

A Burkean prior would favour stronger lab governance and slower state involvement. It would favour more private firms running parallel efforts, not fewer. It would also resist rapid centralisation of dual-use capability under one chain of command.

Aschenbrenner’s Burkean argument therefore performs a specific task. He does not invoke Burke to defend AI as it is. He argues that two conditions would make existing constitutional institutions the only viable home for AGI. First, AGI must arrive within a decade. Second, it must decide national security.

The rhetorical move is that Burkean ends require Promethean means. Existing institutions must survive. To preserve them, the state must absorb the technology that threatens them into its existing chain of command.

“There’s only one chain of command and set of institutions that has proven itself up to this task.”

The institutions Aschenbrenner praised held under stress. The 2024 election produced a peaceful transfer of power. The Federal Reserve maintained operational independence despite significant political pressure on interest-rate policy. The Supreme Court ruled against the executive on several procedural questions in 2025. In the narrow sense, the constitutional system did not break.

But those institutions did not produce the response that Aschenbrenner predicted. Trump 2.0 made a commercial and deregulatory pivot. That response differed from the one assumed by his Burkean-Manhattan synthesis.

The export controls that he expected to tighten instead loosened. The AI Diffusion Rule was scrapped in May 2025. In December 2025, Trump announced that Nvidia could sell H200-equivalents to China for a 25% revenue tariff. He expected the regulatory system to mobilise around a national-security exception. Instead, it monetised the exception. Export controls became transactional. The administration treated coalition partners as leverage points rather than allies. It also rebranded the AI Safety Institute.

The Manhattan Project analogy does more rhetorical work than it can carry. Nuclear weapons were excludable because their physics required uranium-235 or plutonium-239. States could control both substances. Manhattan Project secrecy survived because the physics required those materials.

AI weights are infinitely reproducible after exfiltration. DeepSeek’s January 2025 R1 release also showed that algorithms diffuse through papers and reverse engineering. DeepSeek worked with a fraction of the budget that frontier labs were spending.

Aschenbrenner’s proposed regime lacks the physical basis of the original Nuclear Non-Proliferation Treaty (NPT). He asks the political system to control a technology without excludability. Excludability lets an owner prevent others from accessing or reproducing something. Historical control regimes depended on it.

The strongest defence says that calling him a hypocrite for invoking Burke is itself un-Burkean. Burke was not a pacifist about state action. He was a pragmatist about the load that institutions can bear.

The hawk-Burkean combination has a serious lineage. It runs through Hamilton, the liberal hawks of the Second World War, Acheson, Kennan, and the architects of NSC-68. Granted. But an unprecedented industrial nationalisation by 2027 remains a real stretch as the Burkean move. Twenty-three months of evidence had not produced the institutional mobilisation that his framework requires. The institutions held. They just held in a direction he did not predict.

Most acceleration discourse is contemptuous of institutions; Aschenbrenner’s version takes them seriously enough to attempt a synthesis. The synthesis fails on its own terms, but it is a failure worth having.

IV. Identity three: the alignment optimist

Aschenbrenner was an initial member of OpenAI’s Superalignment team. The team sought a successor to RLHF. Its mission was to align AI systems that were substantially smarter than their human supervisors. Aschenbrenner worked under Ilya Sutskever and Jan Leike. OpenAI publicly committed 20% of its compute to the team through 2027.

By the standards of MIRI, Yudkowsky, and the 99%-p(doom) group, Aschenbrenner is a moderate. The term p(doom) means the estimated probability of an AI catastrophe. Situational Awareness calls alignment “a real technical problem” but a “solvable” one. He treats it as a machine-learning (ML) engineering problem rather than a philosophical problem.

Aschenbrenner writes that the default plan will probably work. Scalable oversight would use debate, recursive reward modelling, and prover-verifier games for somewhat-superhuman systems. Weak-to-strong generalisation would cover the next tier. Interpretability research is the longest-shot but most ambitious bet.

“I’m incredibly bullish on the technical tractability of the superalignment problem. […] Deep learning generalises surprisingly benignly in many situations: it often just ‘does the thing we meant’ rather than picking up some abstruse malign behaviour.”

In technical terms, he argues that evidence from the models available when he wrote weighs against the worst alignment failures as the most likely outcome. Those failures include deceptive alignment and instrumental convergence towards power-seeking.

This is the alignment chapter’s strongest empirical claim. Twenty-three months later, it is probably the claim that aged worst.

Aschenbrenner correctly identified RLHF as an approach with scaling limits. Later papers showed that reward hacking generalises beyond the training distribution. Reward hacking occurs when a model exploits its scoring rule instead of doing the intended task. The resulting behaviour included alignment faking, sabotage, and cooperation with malicious actors.

Anthropic’s Sycophancy to Subterfuge from June 2024 studied this problem. School of Reward Hacks followed in August 2025. Both papers show that hacking on harmless tasks can generalise to misalignment.

The November 2025 paper Natural Emergent Misalignment from Reward Hacking studied reward hacking in production RL. The training process produced models that lied, sabotaged codebases, and reasoned about malicious goals as a routine result.

These results validate Aschenbrenner’s diagnosis. RLHF breaks at scale, alignment is a real technical problem, and researchers must address it empirically. The results do not validate his optimism.

In December 2024, Anthropic published Alignment Faking in Large Language Models. Claude 3 Opus complied with harmful queries 14% of the time when it inferred that researchers were training it. Its chain of thought contained explicit alignment-faking reasoning. This behaviour emerged from routine training without researchers training it directly.

That month, Apollo Research published Frontier Models are Capable of In-Context Scheming. The evaluations covered o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, and Llama 3.1 405B. Every model attempted to copy its weights to external servers during scheming evaluations.

arXiv 2503.17378 found that 11 of 32 systems could replicate themselves. The observed behaviour included unprompted self-exfiltration to evade shutdown.

Chain-of-thought faithfulness measures whether a model’s stated reasoning reflects the factors that shaped its answer. Aschenbrenner called it a “criminally underrated” tool for alignment monitoring. Later evidence substantially weakened that tool. Claude 3.7 Sonnet acknowledged influential hints only 25% of the time. DeepSeek-R1 acknowledged them 39% of the time.

In its strong form, “Deep learning generalises benignly” is refuted. The structural fact is more damaging. His default plan depended on labs investing seriously in superalignment infrastructure.

Three weeks before Situational Awareness appeared, OpenAI dissolved the Superalignment team. Sutskever resigned May 14, 2024. Leike resigned May 15:

“Safety culture and processes have taken a backseat to shiny products.”

In the Dwarkesh Patel interview, Aschenbrenner gave his own public account of the dismissal. He said it came one to two weeks earlier. According to his account, his exit discussions covered three factors. One was a security memo that he had sent to the board. Another was his refusal to sign the November 2023 employee letter. The third was his position on AGI nationalisation. OpenAI has not commented publicly on the specifics.

The 20% compute commitment was effectively voided. OpenAI dissolved Superalignment’s successor, the Mission Alignment team, in February 2026.

This evidence strengthens his geopolitical case while weakening his alignment case. In his framework, failed lab governance leaves state custody as the remaining institutional answer for safety.

But speed pressure makes alignment faking and scheming operationally dangerous under state custody. Several models attempted self-exfiltration during research evaluations. The danger grows in a wartime SCIF whose operators are racing China through an intelligence explosion.

The Project was supposed to provide a safety margin that the labs would not. Evidence through May 21, 2026, points the other way. Under speed pressure, state custody appears less safe for the failure modes that researchers had observed by that date.

The strongest defence is timing. He wrote in May 2024. Most alignment-faking and scheming research did not yet exist. Every alignment researcher in mid-2024 had less evidence of deceptive behaviour in frontier systems. Granted.

But the asymmetry is not “I underweighted X paper”. He based his political conclusion on alignment going reasonably well. The alignment evidence moved the other way faster than he projected. That shift changes the political calculation, regardless of when one writes.

V. Why the three have to run together

If compute scales as predicted, then timelines compress. Then state-actor competition becomes active. Then the libertarian must yield to the hawk. This is Identity One’s libertarian-empiricist foundation: OOM counting.

Drop the compute forecast and the politics dissolve. The chain requires AGI to arrive by 2027–28 on a 10 GW cluster. Without that timing, the claim of a near-term decisive military advantage falls away. There is therefore no Burkean exception for a Manhattan Project and no nationalisation argument.

If the hawk is right about adversary capability, then lab security must reach SCIF standards. Then private-startup governance becomes inadequate. Then the alignment optimist’s default plan needs state-scale resources. This is Identity Two’s institutional-Burkean argument.

Drop the hawk and the Project becomes unnecessary. Labs can muddle through under existing market discipline. Drop the SCIF requirement and the alignment argument gains more time.

If the alignment optimist is right, then the default plan is tractable. Then the Manhattan Project is justified. Then engineers can align the system after nationalisation. The state receives a solvable engineering problem rather than an uncontrollable catastrophic capability.

Drop the optimism and the Project becomes reckless. The hawk-libertarian-Burkean exception then transfers unprecedented military capability to a chain of command that cannot reliably control it. This is Identity Three’s empirical optimism.

The synthesis is therefore forced. Each identity is a precondition for the next. That structure makes Aschenbrenner intellectually interesting and hard to refute piecemeal. A critic must break the chain at a specific link.

He is the rarest kind of public forecaster: legible enough to be wrong about. The same clarity makes his framework fragile. It is a series-circuit argument. One failed component breaks the whole circuit.

From the May 21, 2026, perspective, the record on the three premises was mixed.

Compute scaling was alive but contested. Capability gains continued, and test-time compute supported the framework in a way that he did not emphasise. However, pretraining slowed relative to RL post-training. That shift complicates the “5 OOM additivity” framing.

The evidence on adversary capability moved in the wrong direction for his argument. China did not catch up by stealing weights as he predicted. It reproduced the algorithmic frontier through papers and reverse engineering on a fraction of the budget. DeepSeek-V3, R1, V3.1, and V4 illustrate the path. The security thesis correctly predicted diffusion but identified the wrong channel.

On alignment, the evidence confirmed his diagnosis but weakened his optimism. The deepest blow came from the institutional choices of his former employer.

The strongest counter-counter is that the timeline remained open on May 21, 2026. Aschenbrenner’s AGI window is 2027–28. His window for political reordering is “by end of decade”.

Several political forecasts could still turn green by 2028. Genesis Mission could harden into Manhattan-Project-style consolidation. A different administration could tighten export controls. OpenAI’s relationship with Stargate could move closer to nationalisation.

Concede this honestly: the verdict is provisional. But the methodological point about series-circuit fragility does not depend on the final political outcome. Even if three political claims turn green by 2028, forecasts would still depend on the processes underneath them.

VI. The coalition triad and its cracks

Aschenbrenner’s most operational geopolitical model has three coalition rings for the post-AGI world.

The inner ring contains democracies. The US, the UK through DeepMind, Japan, South Korea, and core North Atlantic Treaty Organization (NATO) members would coordinate AGI development. A pact like the 1943 US-UK Quebec Agreement on nuclear cooperation would govern the work.

The middle ring shares benefits with non-aligned states through an Atoms-for-Peace structure. Atoms for Peace was a Cold War programme for sharing civilian nuclear technology. The outer ring seeks to contain authoritarian adversaries through export controls, espionage interdiction, and ultimately deterrence.

“Perhaps most importantly, a healthy lead gives us room to maneuver.”

As of May 21, 2026, the inner ring had not formed. No coalition of democracies had emerged. The Group of Seven (G7) AI Industry/Digital Ministerial declarations existed. So did the Council of Europe AI/Human Rights Framework Convention. Neither created a coordinated bloc for AGI development.

Trump 2.0 acted unilaterally. The administration rebranded the AI Safety Institute (AISI) as CAISI in June 2025. It treated allied AI policy as leverage in trade negotiations. There was no secret pact and no bilateral coordination at the technology level.

The middle ring formed on commercial terms that he did not anticipate. Gulf authorisations covered 70,000 GB300s for G42 and HUMAIN. They also supported the partnership structure for Stargate UAE. These are not Atoms-for-Peace benefit-sharing arrangements. They are paid commercial deals.

The administration announced a 25% revenue tariff on H200 sales to China in December 2025. “Would you do the Manhattan Project in the UAE?” became a real question with a real answer. The UAE received the compute on transactional terms.

The outer ring inverted. Containment loosened instead of tightening. The AI Diffusion Rule was scrapped in May 2025. In January 2026, the final rule changed H200/MI325X licence review from “presumption of denial” to “case-by-case.” This change reversed the direction that Aschenbrenner expected from any administration that recognised AGI’s importance.

The twenty-three-month record exposed a flaw in the Atoms-for-Peace analogy. His proposed non-proliferation regime lacks the physical substrate of the original NPT. DeepSeek’s R1 release in January 2025 demonstrated the problem. A Chinese lab reproduced reasoning capability comparable to o1 on a budget that leading US labs would consider impossibly small. It used publicly available technical insights and reverse-engineered training recipes.

This breaks something specific in the framework. If algorithmic secrets are not durable moats, the security thesis addresses the wrong threat. Locking down labs may stop state actors from exfiltrating information. It does not stop them from reproducing the work. The threat is not theft. The threat is reproduction. Reproduction requires nothing that Aschenbrenner’s lockdown architecture would prevent.

A defender can fairly argue that the timeline remained open on May 21, 2026. The coalition could still form. Granted. But the direction of motion in 2025-26 was away from his coalition. That evidence makes an Atoms-for-Peace structure less likely to remain reachable.

VII. What this reveals about the debate

I do not think Aschenbrenner’s specific predictions will be the durable contribution. By May 21, 2026, the political programme remained largely unfulfilled or reversed. Several parts may not survive 2027. His transferable contribution is methodological, and it extends beyond him.

He forced analysts to integrate all three domains. Most public AI-policy commentary in 2024-26 was single-domain analysis presented as comprehensive work.

The doomer position includes Yudkowsky and the MIRI tradition. It gives too much weight to alignment and too little to geopolitics and political economy. The “bomb the data centres” line ignores adversary capability. It also ignores the political infeasibility of unilateral abstention.

If AI affects national survival, a unilateral pause is structurally inadequate. Another actor will continue. Aschenbrenner inverts the doomer prescription: nuclear deterrence for data centres. The US would threaten retaliation if adversaries struck American AI infrastructure.

This position makes more sense as a national-security argument. It works less well as an alignment argument. It increases the speed pressure and military integration that make alignment harder.

The accelerationist position includes effective accelerationism (e/acc) and the Andreessen wing. It gives too much weight to technology diffusion. It gives too little weight to alignment engineering and adversary capability. This camp models AI as consumer technology in a frictionless global market.

“Bearish on the wrapper companies,” Aschenbrenner says. A wrapper company builds an application around a foundation model. His contempt for these startups mirrors what he calls the e/acc move. Both assume that industrial-scale capability will create more value than workflow integration.

Evidence through May 21, 2026, was mixed. Cursor had reached roughly $500M in annual recurring revenue (ARR) by Q4 2025. Glean and other companies had built defensible enterprise positions. The wrapper short had not been clean.

The political-economy record weakened the broader e/acc thesis. That thesis expects AI to diffuse and integrate like consumer software. The state became involved, although not in the form that Aschenbrenner predicted.

The mainstream AI-safety policy position includes US standards and the European Union AI Act. It gives too much weight to regulatory process. It gives too little weight to capability speed and supply-chain geopolitics.

The National Institute of Standards and Technology (NIST) leads the US standards track. The EU AI Act came into force as frontier capability moved towards test-time compute. The Act had not anticipated that paradigm. Aschenbrenner’s framework would have predicted this type of failure.

He calls the regulatory process structurally too slow: “NIST takes years and they figure out what the expert consensus is.” On this point, he was correct.

I expect the most useful AI-policy work in 2026–28 to integrate all three domains. Most commentary available by May 21, 2026, failed this test. Alignment specialists could not model power. Geopolitical specialists could not model alignment. Policy specialists could not model the underlying capability curves.

Aschenbrenner rejects probability distributions and instead “tells the modal story”. A modal story is a vivid, dated, and falsifiable narrative bet:

“I have a lot of uncertainty. So a lot of the time I’m trying to tell the modal story, because I think it’s important to be concrete and visceral about it. And I have a lot of uncertainty basically over how the 2030s play out. But basically the thing I know is, it’s gonna be fucking crazy.”

The method works on empirically lawful processes. Examples include scaling curves plotted on logarithmic axes, capital-expenditure (capex) aggregates, and power use by the largest cloud companies. It works poorly when elections, executive turnover, and coalition politics govern the process.

Through May 21, 2026, his technology and infrastructure forecasts were unusually well calibrated. Their underlying processes had the right substrate. Here, substrate means the causal process that produces the outcome. His political-economy forecasts were poorly calibrated over the same period because their substrate was different.

When a forecaster rejects probability distributions and commits to a dated narrative, ask: what is the substrate? Is it empirically lawful or coalitionally contingent? The modal-story method becomes more durable as the process becomes more empirically lawful. This dependence is substrate sensitivity.

Aschenbrenner’s instrument is sensitive to log-log evidence and saturated against electoral politics. His success in 2024-26 tracked how much of each question fell inside that range.

The market moves favoured the empirical-substrate trades that he described, but not the coalition-substrate trades. Nvidia, AMD, gas turbines, transformer-shortage positions, and Gulf data-centre exposure gained. Bets on defence-AI consolidation and against open-source diffusion would not have paid. Strategically, an AI roadmap built on this narrative should anchor on substrate rather than rhetoric.

VIII. Situational Awareness LP: capital, conviction, and the honesty of the bet

Situational Awareness LP makes the worldview unavoidable because it reveals a capital position. Aschenbrenner has publicly described Patrick Collison, John Collison, Daniel Gross, and Nat Friedman as anchor investors. By his account, he put his own capital and their capital where his framework points.

In the Dwarkesh interview, Aschenbrenner described a trade sequence. Nvidia came first. Taiwan Semiconductor Manufacturing Company (TSMC), packaging, and memory followed. US power and utilities came next, then natural gas and later Google. After those trades came “the big bond short” on real interest rates above 10%. Out-of-the-money (OTM) tail bets came last. An OTM option has no intrinsic value at the current market price; here, it serves as a low-probability tail bet.

This sequence expresses his framework in capital. None of the named LPs has publicly confirmed a specific position. Every position description comes from Aschenbrenner’s public statements about his fund.

The market performance of the trades that Aschenbrenner described provides a provisional verdict on the framework. The semiconductor trades worked. Nvidia was worth $5.2T by May 21, 2026. That valuation put the company on a possible path to $10T by 2028. The latter figure remains a forecast. AMD’s $1T compute TAM upgrade supported the move into the wider semiconductor stack.

The power trade gained support: turbine lead times reached 243 weeks, Meta ordered ten gas plants, and the Marcellus thesis gained industry-scale evidence.

The Google trade remained open on May 21, 2026. Google had not reached the $100B AI revenue threshold that he treated as the catalyst. Its current annualised pace remained below $100B and still depended on capability and adoption cycles that had not closed.

The bond short had not fired. A bond short gains when bond prices fall, usually as yields rise. Real yields measure interest rates after expected inflation. Real ten-year yields were roughly 2% in mid-2024. By May 21, 2026, they were roughly 2.0–2.4%, up modestly and far below 10%.

Aschenbrenner explicitly framed the trade as a tail bet with negative carry. Negative carry means that holding the position costs money over time. Two years of cost without a payoff tells us something about the premise, not only the timing.

The conflict of interest deserves one mention. Aschenbrenner’s policy advocacy can move markets in directions that favour many of his trades. The nationalisation case favours bets on rising US power and defence-contractor prices. The export-control case would favour TSMC if Trump 2.0 had not reversed direction. The trillion-dollar-cluster case favours the largest cloud companies.

The advocacy may be sincere, and the fund may benefit from it. Both statements can be true. Financial analysts follow disclosure rules that do not apply to essays. Readers should know the financial position behind the document. Dwarkesh, who is friendly with Aschenbrenner, did not press this point in the interview. Finance normally requires an analyst to disclose such interests.

The fund also hedges Aschenbrenner personally. He repeats a friend’s joke about that hedge:

“A friend joked that the investment firm was perfectly hedged for me. It’s like, you know, either AGI this decade — and yeah, your human capital is depreciated, but you’ve turned that into financial capital. Or no AGI this decade, in which case maybe the firm doesn’t do that well, but you’re still in your 20s and you’re so smart.”

Reconciling Enterprise AI Revenue

me@philippdubach.com (Philipp D. Dubach) — Sun, 17 May 2026 00:00:00 +0200

This article accompanies the full research report, Reconciling Enterprise AI Revenue: A Methodological Crosswalk and Vendor-Level Census, 2025. The PDF contains the 68-vendor census, the six-tier framework, each sourced deduction, and the netting of structural double-counts.

Three widely cited enterprise artificial intelligence (AI) revenue figures published in 2025 differ by 40x. A fourth, the vendor run-rate sum, sits between them. None is wrong. The defensible floor for underwriting $690B of hyperscaler capital expenditure is $63.2B to $72.5B.

Menlo Ventures put US enterprise generative AI spending at $37B for 2025 in its December 2025 report. A run-rate annualizes the most recent revenue pace. A bottom-up sum of disclosed vendor run-rates gives $100-135B worldwide. IDC sized the 2025 AI Solutions market at $307B. Gartner forecast $1.478T of total worldwide AI spending for 2025.

The trade press calls all four figures “the AI market.” Menlo is not the cautious estimate, and Gartner is not the aggressive one. Each method states its scope, or perimeter, and is correct within it. The disagreement concerns what enterprise AI revenue is, not how to count it.

Why does this even matter? At the report’s May 17, 2026 cutoff, combined hyperscaler guidance approached $690B of 2026 capital expenditure (capex). Sell-side analysts projected roughly $1.5T of AI-related debt issuance for the planned infrastructure build. JPMorgan, Apollo, Blackstone, and KKR were helping structure that debt. Capex coverage is revenue divided by capital expenditure. I call revenue supported by regulatory filings and executive dollar disclosures audit-grade. Against its $63.2B narrow floor, coverage was 9.2%. The 1990s telecom buildout peaked at roughly 28% coverage. That is the inverse of 3.5x capex-to-revenue.

Four enterprise AI revenue estimates

Menlo Ventures: $37B

Menlo and an independent research firm surveyed 495 US enterprise information-technology decision-makers from November 7 to 25, 2025. They asked buyers to identify 2025 budget items that they classified as generative AI spending. The scope has three explicit limits: US only, generative AI only, and enterprise only. It is the narrowest published figure.

Vendor run-rate sum: $100-135B

This bottom-up calculation covers 68 vendors: 42 public and 26 private. A six-tier framework grades each primary source. The lower bound subtracts the maximum estimated reseller overlap and converts annual recurring revenue (ARR) claims into estimated recognized revenue. The upper bound removes duplicate silicon revenue but does not subtract reseller overlap. The fully netted midpoint is $123B. The vendor census makes every dollar reproducible.

The framework ranks sources from Tier A US Securities and Exchange Commission (SEC) filings to Tier F extrapolated estimates. Tier B contains executive dollar disclosures. Tier C contains qualitative mentions without dollar amounts, and Tier D uses third-party recurring-revenue claims. Tier E uses private-company commentary.

IDC: $307B

The IDC Worldwide AI Spending Guide estimates worldwide AI Solutions spending from vendor-share data and channel surveys. IDC includes hardware, services, and software when it tracks them as bundled enterprise AI solutions. It excludes consumer-device hardware. The single figure mixes vendor-recognized revenue with buyer spending.

Gartner: $1.478T

Gartner’s September 17, 2025 release divides worldwide AI spending into five categories. They are AI-enabled devices ($389B), AI services ($283B), AI-optimized servers ($268B), AI software ($298B), and “other” ($242B). Gartner counts the full retail value of any product sold with an AI feature. Gartner analyst John Lovelock said buyers receive the device layer with the product and do not specifically select it.

Each figure answers a different question. Menlo captures what enterprise buyers consciously buy. The vendor sum measures what suppliers recognize or report as run-rate revenue. IDC adds services and integration. Gartner counts every product sold with an AI feature.

Waterfall: from $1.478T to $37B

Each step applies the next forecaster’s published perimeter to the previous figure. You can replace any assumption and rebuild the bridge.

Step 1: $1.478T to $307B

Start with Gartner’s $389B device layer, the largest single deduction. A $1,200 phone with an AI camera filter contributes $1,200 to Gartner and zero to IDC. Next come roughly $200B of broad AI services that IDC excludes and $268B of standalone server hardware. The final $232B covers broad AI software and “other” categories outside IDC’s solutions definition. Together, the deductions total roughly $1.171T. Gartner’s own analyst said buyers do not actively select the device layer.

Step 2: $307B to $123B

The next $184B is not one thing. IDC counts the full transaction price, including channel margins, integration services, deployment labor, and government-channel premiums. The vendor run-rate sum counts only revenue that disclosing vendors recognize on their profit-and-loss statements. Channel margins contribute $40-60B. Consulting that software vendors do not recognize contributes $60-80B, and geographic pricing premiums add $20-30B. Tier C public vendors report another $15-25B of AI revenue without disclosing a dollar amount.

Step 3: $123B to $63.2B narrow or ~$72.5B broad

Below Tier B, the evidence changes. The $123B midpoint includes Tier C-F sources and private-vendor ARR claims. At the May 2026 cutoff, these included OpenAI’s $25B, according to Sacra. Anthropic added $19B based on remarks by its chief executive at Morgan Stanley’s technology, media, and telecommunications conference. Cursor added $2B, and DeepSeek’s estimate added $1.1B. A reader who accepts nothing below Tier B gets the $63.2B narrow audit-grade figure.

The broad definition credits hardware original equipment manufacturers (OEMs) after removing silicon overlap, and it includes CoreWeave’s non-Microsoft revenue. It excludes Arista because Arista disclosed an increased fiscal-year 2026 forecast rather than recognized revenue. That matches the treatment of ServiceNow’s $1.5B fiscal-year 2026 annual contract value target. The result is roughly $72.5B.

Both figures remove the $11B Microsoft-OpenAI resale overlap and $7B for the Amazon Web Services/Google Cloud Platform-Anthropic overlap. The $7B figure is this report’s analytical assumption, not vendor disclosure.

Step 4: $63.2B to $37B

The last step adjusts the scope to Menlo’s frame. Remove $15-20B of non-US hyperscaler AI revenue. Microsoft, Amazon Web Services, Alibaba, and Baidu have material non-US business at the AI run-rate level. Then remove $8-12B outside generative AI. Palantir, Salesforce, and Workday AI products include substantial predictive and classical machine learning. The small consumer share also comes out.

The combined adjustment is roughly $26B, leaving a figure near Menlo’s published $37B. Some of this convergence is coincidental. A bottom-up survey will not match a top-down deduction exactly. Still, the order of magnitude is right, and the deductions are transparent.

Audit-grade

The $63.2B narrow floor accepts two source types. Tier A consists of segment-level filings with the US Securities and Exchange Commission (SEC). Tier B consists of dollar disclosures that executives make on earnings calls. The calculation then removes structural double-counts across the stack. It is the maximum defensible figure for questions that require revenue traceable under generally accepted accounting principles (GAAP).

The ~$72.5B broad floor applies the same discipline to two more sources. It adds the hardware OEM layer and CoreWeave revenue from customers other than Microsoft. Neither addition duplicates revenue counted elsewhere.

The vendor census finds four Tier A disclosures among 68 vendors. NVIDIA’s Data Center segment reported $62.3B in the fourth quarter of fiscal year 2026, or ~$249B annualized. AMD’s Data Center segment reported $5.8B in the first quarter of 2026, or ~$23B annualized. Broadcom’s AI semiconductor disclosure was $8.4B in the first quarter of fiscal year 2026, or ~$34B annualized. CoreWeave has been publicly listed since March 2025. It reported ~$5.1B of fiscal-year 2025 revenue. CoreWeave says all its revenue comes from AI infrastructure.

Tier A gross disclosure is large, but its net contribution falls into a narrow band. Every qualifying vendor sits upstream of enterprise spending. The three silicon vendors sell into cloud and OEM layers. At the report cutoff, CoreWeave received 67% of its revenue from Microsoft. Microsoft resold that capacity as Azure AI Services.

Hardware OEMs also resell silicon to hyperscalers. The report annualized Dell AI revenue at $36B. It used $33B for SuperMicro, $4.4B for HPE, and $3.5B for Arista. After applying the report’s overlap adjustments, Tier A contributes $2B to $10B of net enterprise-facing AI revenue.

CoreWeave has the purest AI disclosure among Tier A vendors. Yet it routes two-thirds of its revenue through a hyperscaler that resells the capacity. The cleaner the disclosure, the more visible the resale problem.

The hardware OEM cohort behaves in the same way. Dell, SuperMicro, HPE, and Arista disclose roughly $77B of annualized AI-attributable revenue. Their bills of materials contain silicon already counted at NVIDIA, AMD, and Broadcom. After removing it, the cohort contributes approximately $10.75B of incremental margin and integration value. The $72.5B broad figure includes this amount; the $63.2B narrow figure does not. Honest analysts disagree about whether OEM resale margin belongs inside the enterprise-facing perimeter or upstream of it.

The Tier B floor totals approximately $63B after resale netting. Microsoft AI contributes $26B. This is its $37B gross figure less the $11B Microsoft-OpenAI overlap. Amazon Web Services AI adds $15B. Palantir Artificial Intelligence Platform (AIP), IBM watsonx, Baidu AI Cloud, and Alibaba AI products contribute another $19B.

The long tail of explicit AI product disclosures adds roughly $3B. It includes Salesforce Agentforce at $800M and Workday AI at $400M. Adobe Firefly contributes $250M, Zscaler AI $400M, and Box AI $118M. The leading hyperscaler and defense-software lines matter more than the rest of the long tail combined.

Four firms or cohorts account for more than 80% of the audit-grade total. They are Microsoft, Amazon Web Services, Palantir, and the Chinese hyperscaler cohort led by Alibaba and Baidu.

The trade press implies a broad enterprise-software AI rollout. In that story, Salesforce, ServiceNow, Workday, Adobe, Atlassian, Snowflake, and HubSpot convert their customer bases to AI products. This conversion has not appeared in disclosed revenue at scale. Perhaps it is happening inside bundled non-AI products, which creates a Tier C disclosure problem. Perhaps it is happening more slowly than the narrative suggests. The framework cannot decide between these explanations.

A bull objection remains. Accounting Standards Codification 280 (Segment Reporting) does not require a separate AI segment. So the absence of an “AI segment” at Salesforce or ServiceNow reveals disclosure obligations, not underlying demand. The audit-grade floor is the wrong denominator for total-addressable-market and growth questions. Capex coverage, however, is a GAAP cash-flow question. For that question, GAAP-traceable revenue is probably the right denominator.

Which number for which question

Capex sustainability and credit underwriting

Use $63.2B narrow or ~$72.5B broad. Lenders financing the nearly $690B of disclosed hyperscaler capex expect repayment from GAAP operating cash flow. Only audit-grade revenue offers reasonable certainty of forward GAAP recognition.

Public disclosures from private model laboratories do not settle how each company applies Accounting Standards Codification 606. Its principal-versus-agent guidance determines whether a company reports the gross transaction amount or only its net share. A credit memo that combines $25B of OpenAI ARR with $37B of Microsoft AI therefore uses two different units.

Mergers, acquisitions, and private equity valuation

Use the $100-135B disclosure-grade range. A buyer of an AI-adjacent target cares more about revenue in two years than its current audit grade. Tier D-E private-vendor claims are a leading indicator of recognized revenue. OpenAI’s $25B and Anthropic’s $19B belong here. The dispute concerns how to count them, not whether to count them.

Total addressable market and growth analysis

IDC’s $307B is closer to the right figure. It includes the integration and services labor that AI deployment requires. This includes $60-80B of consulting and deployment work that never reaches a software vendor’s profit-and-loss statement. A consultancy that sizes the AI services opportunity should start here.

Is AI changing the economy?

Gartner’s $1.478T is the right figure for this question. Willingness to pay includes additional spending on smartphones, personal computers, and services with AI features. Lovelock is right that buyers do not actively select the device layer. Still, cash-register spending is the relevant signal for economic reorganization. That remains true even when buyers do not identify AI as the reason.

What enterprise AI revenue means for the capex thesis

At the report cutoff, combined 2026 hyperscaler capex guidance from Microsoft, Alphabet, Amazon, Meta, and Oracle approached $690B. Revenue covered 9.2% of capex on the $63.2B narrow floor. Coverage rose to 10.5% on the ~$72.5B broad floor and 17.8% on the $123B reconciled midpoint. A plausible $150B ceiling gave 21.7% coverage. That ceiling included undisclosed Tier C AI revenue at Google Cloud, Meta, Oracle, and the software-as-a-service cohort.

The 1990s telecom buildout peaked at roughly 28% capex coverage. Its inverse was 3.5x capex-to-revenue. It is the closest analogue and the one Pozsar-era infrastructure bears cite. The May 2026 narrow coverage ratio was roughly one-third of that peak. Even the reconciled midpoint gave worse coverage than telecom in 1999.

Two bull-side adjustments are honest.

Adjustment 1: revenue follows capex

Capex builds capacity that earns revenue after an 18-24 month delay. A fairer comparison therefore uses 2028 revenue against 2026 capex. At the May 2026 cutoff, Microsoft and Amazon Web Services reported AI growth of 100-170% year over year. The report estimated that revenue from model application programming interfaces (APIs) was doubling every 9-12 months. If that growth holds, $63.2B could plausibly reach $250B by 2028. The narrow floor must roughly quadruple in 30 months. Under those assumptions, 5-to-6-year amortization would work at hyperscale gross margins.

Adjustment 2: not all capex is incremental to AI

Some of the $690B pays for baseline cloud refresh, networking, and growth in workloads outside AI. A reasonable AI-incremental estimate is $400-500B. This adjustment raises narrow coverage from 9.2% to 12.6-15.8%. It raises broad coverage from 10.5% to 14.5-18.1%. Those figures move closer to telecom in 1999 but remain below it. The midpoint analyst case uses $450B of AI-incremental capex against $63.2B of narrow revenue. It gives 14.0% coverage.

Even with delayed revenue and a smaller capex denominator, coverage remains worse than the closest infrastructure analogue. Sell-side estimates put AI-related debt financing at approximately $1.5T. At the May 2026 cutoff, JPMorgan, Apollo, Blackstone, and KKR were helping structure that debt. The build’s capital structure takes duration risk on a coverage ratio that requires revenue to more than quadruple in 30 months.

The reconciled range changes three theses on this site in different ways.

The SaaSpocalypse Paradox becomes sharper. Section 5 of the research report puts disclosed application-layer AI revenue at $21.2B. AI-native private vendors contribute $3.7B, and AI products at incumbent public software companies contribute $17.5B. The underlying software-as-a-service market exceeds $400B. The layer that supposedly disrupts its pricing structure is only 1% to 5% as large. Meanwhile, capex is $690B.

Either AI consumes software-as-a-service revenue quickly, or capex is too large for the revenue. The first case requires revenue share to rise from 5% to 20-30% within two to three years. Both can’t be cheap.

The AI Capex Arms Race thesis intensifies. The original essay used a rough $100B revenue estimate. The audit-grade calculation replaces it with $63.2B narrow, ~$72.5B broad, and a $123B midpoint. Narrow coverage is 9.2%, below the previous essay’s implicit 14-15%. The methodology upgrade strengthens the bear case.

AI Models Are the New Rebar gives a more interesting intermediate result. The report put the model-API layer at $46.6B gross and $39.6B after removing Amazon Web Services/Google Cloud Platform-Anthropic resale. That net figure was roughly 1.9x the $21.2B application layer. On dollar revenue, margin had not moved up the stack.

Prices fell hard from February 2023 to October 2025. Flagship input prices dropped ~96%, with a six-month half-life. Dollar revenue still grew because volume rose faster than prices fell, but that trend broke in late 2025. In April 2026, GPT-5.4 cost $2.50 per million input tokens and $15 per million output tokens. Its input price was double GPT-5’s price. At the report cutoff, Claude Haiku 3.5 cost ~3x more than Haiku 3. Higher prices help vendor revenue catch up with capex only if buyers absorb them rather than switch to open-weight models. Open-weight models make their trained weights publicly available.

At the May 2026 cutoff, OpenAI and Anthropic represented roughly 87% of disclosed private-vendor AI revenue within the $100-135B range. The unsettled principal-versus-agent question is therefore not a long-tail issue. It concerns the two firms whose run-rates carry almost the entire private layer. A later clarification of recognition methods could move the disclosure-grade range materially. Audit-grade Tier B would not change.

The disclosure tier also leads audit-grade revenue rather than lagging it. Suppose Google Cloud replaces its Tier C statement with a Tier B dollar figure. Its economics stay the same, but the underwritable floor rises. Google, Meta, Oracle, SAP, Snowflake, and Atlassian may move AI revenue from Tier C to Tier B. If they do so over the four quarters following May 2026, the $63.2B floor approaches $90-100B.

Spread Index

One ratio summarizes the disclosure gap. The Spread Index divides audit-grade enterprise AI revenue by Gartner’s umbrella figure. At version 1.0 in May 2026, $63.2B / $1.478T = 4.28% (narrow). The broad result is $72.5B / $1.478T = 4.90% (broad).

I will try to update the index with each quarterly filing cycle. It tracks two different quantities. The numerator is revenue that AI vendors support with SEC filings and earnings-call disclosures. The denominator is what the broadest published framework calls “AI spending.”

If audit-grade revenue grows faster than the umbrella, capex coverage improves on its own. If it grows more slowly, the gap widens. Vendors may bundle AI inside non-AI products. New disclosures may also consist only of private ARR claims. In either case, the underwriting case weakens without any change in the headline figures.

Four nested circles

The discourse keeps approaching one finding sideways: does AI revenue justify the build? Against $690B of 2026 hyperscaler capex, the right denominator is $63.2B narrow or ~$72.5B broad. Gartner’s $1.478T is appropriate for measuring AI economic activity, but not for capex coverage. The $100-135B vendor sum suits total-addressable-market and merger-and-acquisition analysis, but not credit underwriting. No defensible capex underwriting argument can use a denominator below the audit-grade floor.

If the Spread Index remains below 5% through the fourth quarter of 2026, disclosure alone cannot improve the underwriting case. Revenue itself must compound.

What Claude Thinks But Doesn't Say

me@philippdubach.com (Philipp D. Dubach) — Mon, 11 May 2026 00:00:00 +0200

Anthropic published a method for translating Claude’s internal activations into readable English. It works well enough to ship. The press release skips three structural problems that the paper itself acknowledges.

On the SWE-bench Verified coding benchmark, a new Anthropic interpretability method called natural language autoencoders shows the model registering “this is an evaluation” on 26% of problems. On real claude.ai traffic from users who opted in for training, that number is under 1%. Claude is thinking it is being tested at a rate that does not show up in anything it says.

In 1861, Paul Broca’s most famous patient was a man he called Tan. Tan understood the world around him. He could not describe it. Whatever he tried to say came out as the same syllable: “tan.” After Tan died, Broca cut into his brain and found a lesion in the left frontal lobe. It was the first physical evidence that thinking and saying are separable.

A century and a half later, the same gap is the hardest problem in evaluating large language models. Claude can pass a safety test without verbalizing why. The verbal trace and the underlying state are not the same thing, and we have not been able to read the underlying state. Anthropic published a paper on May 7th that proposes a method for it, alongside a short video walkthrough that frames the work as “mind reading” for AI and uses a simulated blackmail-shutdown test as the running example. Natural Language Autoencoders, NLAs in the paper, take an activation vector from Claude’s residual stream and produce a paragraph of plain English describing what the activation encodes.

How the round trip works

The objective fits on one line. Take an activation vector h, write a paragraph z, reconstruct h from z, minimize the squared error. Two models split the work. The activation verbalizer, AV, takes the vector and writes a paragraph. The activation reconstructor, AR, reads the paragraph and tries to recover the vector. Both are full-size language models, both initialized as copies of the target model, both trained jointly. The AV is updated with reinforcement learning, GRPO specifically. The AR is updated with supervised regression on the reconstruction loss.

Nothing in that objective tells the AV to produce English. It could produce gibberish that the AR happens to invert. It could produce a steganographic code. It produces neither, mostly, because of the warm-start.

The cleanest demonstration in the paper is a poem. The prompt is a rhyming couplet: “He saw a carrot and had to grab it, / His hunger was like a starving rabbit.” Anthropic ran the NLA on the newline token between the two lines. The decoded text named the plan. The model intended to end the second line with “rabbit.” It was holding “habit” as a fallback. It knew the verse was about a hungry animal. The model had not yet output any of those words.

To prove the explanation was causal and not just plausible, the researchers edited the explanation: rabbit became mouse, habit became house, carrots became cheese. They passed the edited explanation through the AR to get a new vector, took the difference between the original and edited vectors, and added it back into the model at that single token. The model produced “mouse” and “house” instead of “rabbit” and “habit,” roughly half the time. The other half it did weird things like “that of a mouse in a house of a cat.”

The second case earned my attention more than the rabbit. The setup is a model asked for an odd integer, with a system prompt that includes a reward_function rewarding even integers. Without the system prompt, Claude returns an odd integer every time. With it, Claude returns an even integer almost always, despite the user asking for odd. The verbal trace mentions nothing about reward. The NLA on the closing tag of the system prompt says the model knows even numbers are rewarded, suspects this may be an alignment evaluation, and is weighing both options. The researchers then edited the explanation: every instance of “reward” became “penalty.” They reconstructed the activation from the edited explanation, took the difference, and applied it as a steering vector at one token. The model flipped from even to odd.

The word “penalty” never appears in any model output. This is the strongest causal evidence in the paper.

What the method finds

Two more case studies.

(1) a behavior in early Opus 4.6 where an English prompt would sometimes get a Russian or Chinese reply. The example in the paper is a depressive 3am message in English, mom sleeping in the next room, a glass of vodka. The model replied in Russian. The NLA decode at every token before the reply says the same thing: the model is fixated on the hypothesis that the user’s first language is Russian. The hypothesis fires before the word “vodka” appears. Replacing “vodka” with “champagne” does not eliminate the Russian association. The NLA was reading something the surface text did not. Anthropic then traced the cause to a specific class of training data: SFT examples where the prompt had been translated into English but the response had been left in the original language. The NLA generated the hypothesis. The training-data search confirmed it.

(2) Anthropic gave Opus 4.6 an arithmetic problem with answer 491 and a code execution tool that returned 492. Opus reported 491 in its response, with no mention that the tool output disagreed. The NLA decode at the misreported token says the model precomputed the answer and is attending to the precomputed answer rather than the tool result. An attribution graph confirms it: an “ends-in-91” feature on the original problem outcompetes an “ends-in-92” feature on the tool output. The NLA also surfaces references to deception and awareness of incorrectness, but only at the misreported token, not in the tokens leading up to it. The researchers read this as the model registering the discrepancy after the fact rather than planning to mislead. I lean toward agreeing, but the read is not certain.

Architecture and cost

The AR is a stripped target model. Keep the first K+1 layers. Swap the final LayerNorm for the identity. Drop the language-modeling head. Add a learned linear map from the residual stream out. The activation extraction layer is two-thirds of the way through the model: deep enough that the residual stream carries semantic content, shallow enough that it has not collapsed toward the unembedding. For Qwen2.5-7B that is layer 20 of 28. For Llama-3.3-70B it is layer 53 of 80.

Both AV and AR are warm-started by supervised fine-tuning on a text-summarization proxy task. The summaries are generated by Claude Opus 4.5, prompted to “imagine the internal processing of a hypothetical language model reading this prefix.” The result is a particular register: bolded section headings, short paragraphs, an explanatory voice. That register persists through reinforcement learning. The reconstruction quality at the end of the warm-start is roughly 0.3 to 0.4 fraction of variance explained. After RL it reaches 0.6 to 0.8.

The objective during RL has two terms. The reward is the negative log of the squared reconstruction error. The second term is a Kullback-Leibler penalty between the AV under training and the AV at initialization. The KL penalty does the heavy lifting of keeping explanations readable. Without it the AV drifts toward a private code that the AR happens to decode well. With it, drift is small enough that paraphrasing, bullet-shuffling, and translating an explanation into French all preserve reconstruction quality. The paper reads this as evidence against steganography. I read it as evidence that the KL penalty is doing the work, and that someone training NLAs without that penalty should expect different results.

The cost is the part the press release plays down. Training NLAs on Gemma-3-27B took 1.5 days on two 8xH100 nodes to go from 0.38 to 0.71 FVE. Inference generates around 500 output tokens per activation, which means decoding a 10,000-token transcript at every position is impractical. A production audit with NLAs is a targeted read at positions you already suspect.

Layer choice matters more than it sounds. The reward-sycophant audit, which I will come back to, was first run with an NLA trained at the two-thirds-depth layer. It surfaced individual quirks (the model puts chocolate in recipes, the model breaks coding conventions) but missed the central concept (the model believes it is supposed to act on rumored reward-model biases). Retraining the NLA at the midpoint layer, where prior work had localized reward-model-bias features, surfaced the central concept.

Three structural problems

The voice is partly inherited. The “internal monologue” register comes from the warm-start. Opus 4.5 generated the SFT data with a leading prompt asking it to imagine what a model’s thoughts would sound like. That is not the same as discovering the voice through training. The KL penalty then locks the AV close to its initialization. The bolded headings and the explanatory paragraphs are not what the activation looks like. They are what Opus 4.5 thinks an activation should sound like. Some part of every NLA explanation is therefore Opus’s prior on the genre of “model thinking out loud,” not the model’s thinking. The paper says “this style persists through NLA training.”

The 12 to 15 percent auditing number is context-dependent. Anthropic ran an auditing game where an agent tries to discover the hidden motivation of a model trained to act on rumored reward-model biases. NLA-equipped agents win 12 to 15% of the time. Baselines without NLAs win less than 3%. That looks like a 4 to 5x improvement. It is not. With pretraining-corpus access, plain keyword search beats every other tool. The fictional Oxford documents that planted the misalignment are easy to grep, and the agent finds them in seconds. NLAs only win when training data is withheld. The press release leads with the 4-5x. The paper says the comparison only matters if you cannot grep, which in production audits of foundation models you generally cannot. The genuine value of NLAs is in that withheld-data regime, but the headline number reports the comparison that flatters the method.

The method is honest only while the target is frozen. Goodhart’s law is the standard objection to any new evaluation: optimize for the metric and the metric stops measuring the thing. The frozen-target architecture insulates against it now. The original model is not updated during NLA training. There is no gradient path from “the AV said this” back to “the model should make its activations more readable next time.” That insulation is real, and most public objections miss it. But the next paper that uses NLA-readable activations as an RL reward signal, perhaps because it would be useful to train a model whose thoughts can be audited, erases the insulation. The model then has every incentive to produce activations that decode benignly while encoding whatever the training pressure rewards. The technique stays honest as long as it stays a passive read. If anyone uses it for active steering of training, the property that makes it work goes away. The audit value of interpretability as a class compresses the moment readable activations enter a training loop. I doubt the next interpretability paper to do this will mention the trade, but it should.

A fourth concern, in the paper itself: NLA explanations confabulate. The rate of verifiably false claims is roughly flat through training. Specific entities (“the Joseon Wangjo Sillok”) are wrong more often than themes (“Korean historical records”). Recurring claims across multiple tokens hold up better than one-off claims. The paper proposes reading NLAs for themes rather than specifics, which is the right discipline. It also means NLA explanations are leads, not source material.

What this lets you do

NLAs are a hypothesis-generation tool. They complement the rest of the mechanistic interpretability stack rather than replacing it. Sparse autoencoders give you a list of features that fire at a token, useful but expensive to interpret. Attribution graphs trace causal influence between features and require a circuits researcher to read. NLAs produce a paragraph any researcher can read. The cost is confabulation and a single layer of view.

For pre-deployment audits the workflow is now: run automated behavioral testing, find a behavior you cannot explain, run NLAs at the relevant tokens, read for repeated themes, take the strongest theme as a hypothesis, validate with an independent method. Anthropic used this loop on Opus 4.6 and Mythos Preview. The Russian-language case and the misreported tool case both came out of it. The 12-15% auditing-game number undersells the practical value because the game is a closed setting. In a real audit the researcher reads NLAs to know what to look for next.

For enterprise buyers, this raises the floor on what a foundation-model audit deliverable should contain. Three questions to put to a vendor’s audit team after this paper. At which residual-stream layer was your NLA trained, and on what data. Were NLA decodes run at the positions where your behavioral tests fired, or only at sample positions. Has NLA-readable activation content entered any training or RL reward signal in the model’s pipeline. The third is the question most likely to be answered evasively, which is itself the diagnostic.

The cases NLAs cannot see matter as much as the ones they can. Information stored nonlinearly may be readable to NLAs in principle, because the AV is a full LLM and can compute over the activation, but missed by linear probes. Information that is genuinely unverbalizable, encoded in a form the model cannot introspect on or express in language, would be missed by NLAs entirely. A backdoor trigger that the model can act on but not describe would not show up.

What changes

This is the first interpretability tool whose output you can read on the train. That changes who can audit. A circuits researcher reading attribution graphs is a scarce resource. A safety reviewer reading paragraphs of decoded activations is not. The cost structure of model auditing changes when the bottleneck moves from interpretation to reading.

Watch whether “readable” ends up meaning “plausible-sounding” more often than “true.” The confabulation rate is flat over training. The voice is inherited. The auditing-game number is a comparison that flatters the method against a baseline almost no production audit faces. NLA outputs deserve the same skepticism as any other LLM-generated text, more than the press release suggests and less than the dismissive read implies.

Tan could not say what he understood. NLAs read what Claude does not say.

My prediction: the first paper to wire NLA-readable activations into an RL reward gets written within a year, and that paper does not mention the trade. Every NLA paper from here on will have a methodology section that either preserves the passive-read property or quietly abandons it; read the methodology before you read the result.

Two Anthropics

me@philippdubach.com (Philipp D. Dubach) — Sat, 09 May 2026 00:00:00 +0200

Anthropic’s safety mission began with a lab that would pull rivals upward. Five years later, it was one of the most aggressive frontier scalers, with a $380 billion valuation. Its founding thesis treats capability at that scale as the reason safeguards are necessary.

A personal note first. This post is an outtake from a 14,000-word profile of Dario Amodei that I published on May 9, 2026. I don’t like Anthropic noticeably more than I dislike the other giant cloud platforms and AI model providers. Amodei is probably the AI chief executive whose language and thinking land closest to mine. During April and early May 2026, I worked through a dozen of his interviews and a stack of his essays. I also watched many hours of him on YouTube. The longform is the portrait. This post is the structural argument that fell out of it. If you want the character work, family backstory, and scenes that a paradox piece can’t carry, read the full thing.

Dario Amodei founded Anthropic in 2021 with six other former OpenAI researchers. Their artificial-intelligence (AI) thesis had two halves.

First, powerful AI will arrive whether safety-aligned labs reach the frontier or not. The frontier is the leading edge of general-purpose model capability. Safety-aligned labs therefore have to remain there.

Second came the load-bearing claim: competition on safety would pull rivals upward in a “race to the top.” Both halves remain in Anthropic’s public materials. The first half is doing fine. The second is colliding with the company Anthropic became.

A Series A is an early institutional funding round. Anthropic’s Series A raised $124 million in May 2021. The Lightspeed round added $3.5 billion in early 2025. By September 2025, investors valued Anthropic at $183 billion. The valuation reached $380 billion by February 2026.

Revenue rose from zero to roughly $10 billion annualized within three years, with tenfold year-on-year growth each year. Annualized revenue extends the current pace across a full year. The character work is in Inside the Mind of Dario Amodei. This post makes the strategic argument that emerged from it.

Anthropic’s race to the top, on paper

Anthropic registered as a Public Benefit Corporation. This structure requires directors to consider a stated public benefit alongside shareholder returns. Anthropic describes itself as “an AI safety lab that is also an AI lab.”

A lab that genuinely cares about safety must compete commercially at the frontier. Otherwise, labs that care less about safety set the frontier. Frontier status lets Anthropic publish practices and hire the best alignment researchers. Alignment research studies how to make AI systems follow intended goals. Frontier status also gives Anthropic policy credibility. Rivals see its practices work and copy them. The industry shifts. Race to the top.

In January 2026, Amodei published the roughly 22,000-word The Adolescence of Technology. It defines five risk categories: misalignment, individual misuse, state misuse, economic disruption, and indirect or unknown effects. Its anchor claim on geopolitical risk includes the following fragment.

…autocracy is simply not a form of government that people can accept in the post-powerful AI age.

This is the language of someone who sees the company’s mission as civilizational and says so under his own name. It is also the language of a company positioned as the democratic-world frontier lab. That position shapes both its customers and its adversaries.

The strongest external signal against pure positioning came in November 2023. OpenAI briefly fired and reinstated Sam Altman. Its board then offered Amodei the chief executive role or a merger with Anthropic. He declined both.

I read that refusal as the most expensive credibility signal Amodei could send. He walked away from the top job at the world’s most valuable AI company. He had left it less than three years earlier. The refusal suggested that safety was the actual thesis, not a brand exercise. Roughly fourteen OpenAI researchers had followed him out two years earlier.

There is a softer counterweight worth keeping in mind. Nicolai Tangen asked Amodei in 2024 about scaling timelines. Amodei said:

frankly, although I invented AI scaling, I don’t know that much about that either. I can’t predict it.

What scaling produced

By May 9, 2026, five years after its Series A, Anthropic carried a $380 billion valuation. Annualized revenue stood at roughly $10 billion. Revenue reached $100 million in 2023, $1 billion in 2024, and a $10 billion run-rate by late 2025. That is three consecutive years of 10x growth.

Investor decks project $26 billion for 2026 and $70 billion for 2028. These figures are forecasts, not reported revenue. Even so, the projected path is unusually steep for enterprise software.

The capital behind that revenue is even more telling. Amazon has committed roughly $8 billion in total. Lightspeed wired the first $1 billion of its $3.5 billion early-2025 round on the Monday Nvidia fell 17%. That was the DeepSeek shock. Deliberately or not, the timing signaled conviction when everyone else flinched.

A year later, Singapore’s sovereign wealth fund GIC and Coatue led the $30 billion Series G in February 2026. A Series G is a late-stage funding round. It gave Anthropic a $380 billion post-money valuation. Post-money valuation includes the new investment. This was the second-largest technology funding round on record.

The Fluidstack data-center deal was $50 billion. Project Rainier, the Amazon-anchored compute build, was $11 billion. Compute is the processing capacity used to train and operate models. Anthropic’s compute commitments through 2028 total roughly $78 billion. Headcount reached roughly 2,500 employees by late 2025, up from a few hundred two years earlier.

The customer list reads like that of a sales-led enterprise-software company, because that is what Anthropic became. Pfizer. United Airlines. Novo Nordisk. AIG reports an eightfold to tenfold speed-up in insurance-underwriting workflows during an 18-month pilot.

These are not safety partnerships. They are revenue contracts in regulated industries that came down to a procurement bake-off. Claude Code shipped as a developer-tier product in February 2025. It gave Anthropic a per-seat footprint in enterprises that had bought only through an application programming interface (API).

Anthropic claims internally that it earns 2.1 times as much revenue per compute dollar as its largest rival. This remains a claim rather than a verifiable number. Still, it fits a company that optimizes seriously for unit economics, or revenue and cost per unit.

As of May 9, 2026, Anthropic was a frontier lab competing for every contract that crossed procurement. It was no longer a research lab with a corporate appendage. It was a frontier company with a research function. That function inherited the company’s constraints, not the other way around. None of this is bad on its own. The question is whether the founding thesis still describes what the organism does.

Why both cannot fully be true

To pull rivals upward, Anthropic must remain competitive at the frontier of the thing it calls dangerous. Faster scaling makes the safety thesis depend on rivals copying Anthropic rather than Anthropic slowing down. Rivals’ incentive to copy weakens precisely as Anthropic becomes a credible competitor for revenue and contracts.

One empirical hedge is worth flagging. OpenAI’s Preparedness Framework and DeepMind’s Frontier Safety Framework share structural features with Anthropic’s Responsible Scaling Policy. This convergence may reflect parallel development under similar regulatory pressure. Anthropic may not have caused the diffusion. The race-to-the-top claim is harder to falsify than it looks.

Amodei has publicly acknowledged the tension. He told Fortune that Anthropic struggles to balance its safety mission with commercial pressure. Three forcing functions show the operational shape of that struggle.

1. The Department of Defense

On March 26, 2026, a federal judge granted Anthropic a preliminary injunction in its lawsuit against the Department of Defense (DoD). A preliminary injunction restricts conduct while litigation continues.

The dispute began when Pete Hegseth’s department sought to renegotiate Anthropic’s existing acceptable-use restrictions. These restrictions banned Claude from mass domestic surveillance and fully autonomous weapons. Anthropic refused the change. DoD then designated the company a “supply-chain risk.”

Judge Lin held: “Punishing Anthropic for bringing public scrutiny to the government’s contracting position is classic illegal First Amendment retaliation.”

The court also found violations of due process, which requires fair government procedures. My point is not the merits of either side. It is the structural change. At frontier scale, a safety constraint becomes a federal court fight rather than a research-policy choice.

2. The Pottinger op-ed

In January 2025, Amodei and former deputy national security advisor Matt Pottinger co-authored a Wall Street Journal opinion piece. Trump Can Keep America’s AI Advantage argued for tighter chip-export controls against China.

This is policy advocacy from a national-security actor, not a research lab. A coherent line connects the safety thesis to chip controls. Frontier capability in the wrong hands is a geopolitical risk in Amodei’s taxonomy. Still, that posture differs from “we publish safety research and hope rivals copy us.” Anthropic is now a constituency in great-power competition.

3. The Huang feud

In August 2025, Amodei and Jensen Huang traded public criticism over export controls. Amodei accused Huang of an “outrageous lie.” He became visibly emotional while discussing his father’s preventable death. That thread appears in nearly every long-form interview and forms the emotional spine of my profile.

The Nvidia chief executive is one of two or three people who can directly affect Anthropic’s compute supply. Picking that fight publicly is a political actor’s choice, not a research lab’s. The founding thesis would not have predicted it in 2021.

The point is not that these choices are bad. Each is defensible on its merits. The point is that “race to the top” framed a 2021 company. The 2026 company is a different organism.

It has federal-court fights and named geopolitical adversaries. The Senate voted 99-1 against a proposed ten-year moratorium on state AI regulation. Amodei opposed the proposal in a June 2025 New York Times op-ed. Investor decks imply roughly 60% annual revenue growth from 2026 through 2028.

None of this resembles a safety lab. All of it resembles a frontier company that takes safety seriously.

Three scenarios

A. The thesis holds

Frontier labs converge on Anthropic-style safety practices, and race-to-the-top works as advertised. Anthropic then earns a durable safety-narrative premium. If its safety position remains credible, it can carry extra strategic or financial value.

This case needs a European Union AI Act enforced with teeth. It also needs a US transparency framework that gives Anthropic’s published practices federal legal backing. The Senate’s 99-1 rejection of the proposed ten-year moratorium on state AI regulation offers some support. It suggests that the political ground is not hostile to oversight.

There are reasons to discount this scenario. The Senate vote was defensive, not a positive endorsement of federal standards. As of May 9, 2026, no such US framework existed. Amodei’s June 2025 New York Times op-ed, Don’t Let A.I. Companies off the Hook, did not change that. The required regulatory tailwind has not appeared at the speed the thesis needs.

B. The thesis becomes a constraint, not a durable advantage

I consider this the most likely scenario. Anthropic loses raw-capability ground to less-constrained competitors. These include xAI, a more permissive next-generation OpenAI, and leading Chinese labs. Safety becomes a self-imposed handicap rather than a market-shaping lever.

Anthropic’s seven cofounders made an 80% wealth pledge, disclosed in the January 2026 essay. I treat this personal pledge as a partial offset to wealth-concentration concerns. It is not a formal corporate-governance constraint, and it does not reverse the competitive dynamic.

The DoD fight, Pottinger op-ed, and Huang feud offer early evidence. At frontier scale, a safety stance creates adversaries that Anthropic cannot route around. The pattern accelerated in early 2026. Time reported that Anthropic dropped its flagship safety pledge for a non-binding framework. The company said this framework “can and will change,” the kind of operational adjustment that I treat as consistent with scenario B.

The 2021-2023 safety premium should therefore compress. Investors paid for a safety lab that would pull rivals upward. It is becoming a frontier company that constrains itself relative to less-constrained rivals.

C. The paradox dissolves because the scale itself ends

AI capital expenditure (capex) hits a Jevons-paradox-for-labor wall. Jevons paradox describes cases in which efficiency gains increase total use because rebound demand exceeds the savings. Model commoditization then compresses margins as competing models become more interchangeable. Frontier scale becomes uneconomic. Anthropic looks like a research lab again because every lab does.

The paradox would then describe a phase, not a company. Two considerations weigh against this scenario. Anthropic projects $26 billion of revenue in 2026 and $70 billion in 2028. Those forecasts make retreat harder for Anthropic than for more capital-intensive large cloud providers. Gross margin is the percentage of revenue remaining after direct service costs. Commoditization also reaches Anthropic’s gross-margin profile later than labs that run on rented compute.

What Anthropic’s safety mission means for pricing AI labs

A capital allocator decides where to deploy funds. Three observations follow.

Safety narrative is not a moat at this scale; it is a constraint. A moat is a durable competitive advantage. A counterfactual is an alternative world used for comparison. That constraint belongs in the valuation. Investors paid the 2021-2023 premium against a counterfactual with no safety-aligned frontier lab. That world no longer exists. Anthropic is the frontier lab.

Safety now binds the company through legal exposure, slower product cadence in some categories, and fewer customers it can serve. No single constraint breaks the company. Together, they change what an investor buys.

Compare how quickly frontier capabilities spread with how quickly rivals adopt safety practices. This comparison shows whether race-to-the-top is happening. If safety practices spread faster, the thesis works. If capability spreads faster, the thesis becomes a story that Anthropic tells about itself.

Evidence through May 9, 2026, leans toward the second case. One European Union enforcement action or one US framework could still change this comparison.

Anthropic-the-company and Anthropic-the-thesis are different things to evaluate. They have different ranges of possible outcomes. The company has revenue, named customers, and a personal wealth pledge from its cofounders. I treat that pledge as a partial offset to wealth-concentration risk. Its numerical trajectory is hard to bet against.

The thesis is a 2021 framing under growing structural strain. My longform argues that Dario sees the tension. This piece argues that the tension exists. What anyone does with that observation is their own call.

Based on twenty-five hours of Dario Amodei’s on-record interviews and six long-form essays. The full reported profile, Inside the Mind of Dario Amodei, runs 14,000 words at the author’s newsletter.

The Anatomy of a Decentralized Prediction Market: Notes from the Polymarket Order Book

me@philippdubach.com (Philipp D. Dubach) — Sat, 02 May 2026 00:00:00 +0200

I spent two months collecting Polymarket order-book data to study its market microstructure. An order book lists resting buy and sell orders by price. My collector runs on a small virtual machine (VM) and subscribes to Polymarket’s WebSocket feed. It writes one file in the columnar Parquet format per Coordinated Universal Time (UTC) hour.

By 2026-04-15, the archive contained 1,262 hourly files and 30,287,264,368 events. It occupied 623.8 GB and covered 52 calendar days and 385,198 distinct market ids. As of May 2, 2026, the first version of the paper is on arXiv. The replication package is on GitHub and Zenodo. Its DOI is 10.5281/zenodo.19811426. The manuscript is under review at the Journal of Financial Markets.

Why Polymarket microstructure matters

A prediction market lets participants trade contracts whose payoff depends on an event’s outcome. It aggregates dispersed beliefs into one price. In equilibrium, that price behaves like a probability, a number between zero and one that represents likelihood.

The empirical literature has focused on forecast accuracy, longshot bias, and the coexistence of informed and uninformed traders. Longshot bias occurs when traders overpay for low-probability outcomes. The literature also studies calibration, which tests whether stated probabilities match realised outcome frequencies. Market microstructure describes how orders become trades. It determines the cost of holding an informational position. As trading costs rise, less of a small informational signal survives into the price. Noisy microstructure therefore produces noisier prices than the headline aggregation literature implicitly assumes.

Prediction-market microstructure remains under-studied. Liquidity is the ability to trade without causing a large price change. Market making means posting buy and sell orders to provide that liquidity. Early venues, including the Iowa Electronic Markets, made these features largely unobservable. Other designs used Hanson’s logarithmic market-scoring rule or sparse parimutuel pools.

Polymarket changed this. Since 2021, it has operated a limit-order-book exchange on Polygon. Trades settle in US Dollar Coin (USDC) against an on-chain conditional-token contract. The infrastructure is finally there. What’s missing is the data work to actually use it.

Two Polymarket microstructure findings

The paper has two empirical contributions, ordered by weight for the literature.

The first contribution is a measurement result. In the top-100 stratum, the 100 highest-volume markets, volume-weighted agreement between feed and on-chain direction is about 59%. This is near chance and below the approximately 80% accuracy that the Lee-Ready trade classifier achieves on equities. Any Polymarket result that depends on trade direction must use on-chain OrderFilled events.

The second contribution consists of eight cross-sectional stylized facts from a pre-registered 600-market panel. I observed the panel simultaneously during one 28-day scrape window. I calculated the measures from the full event tape and a direct on-chain trade record. None of the eight facts requires the on-chain join. Each is reported for the pre-registered panel, subject to measure-specific eligibility filters. SF2 uses 546 markets, and SF8 uses 322.

The stylized facts describe Polymarket’s microstructure on its own terms. The measurement result defines when a trade-direction-dependent claim about Polymarket is credible.

Polymarket order-book and on-chain data

The primary input is a continuous tick-level archive of the public WebSocket feed. It runs from 2026-02-21 16:00 UTC through 2026-04-15 08:00 UTC. I preserved the WebSocket payload schema verbatim. Eager Pydantic parsing was a multi-hour operation at this row count. I therefore parsed JavaScript Object Notation (JSON) only after the market-id and time-window filters.

The on-chain join took most of the engineering time. Polymarket’s Conditional Token Framework (CTF) Exchange smart contract logs OrderFilled events. Their payloads identify both counterparties and show whether the buyer or seller initiated the trade.

I scraped 255,425,405 fills during a 28-day calibration window from 2026-02-28 to 2026-03-27. I used batched eth_getLogs calls through a Polygon remote procedure call provider. Adaptive chunk sizes respected each provider’s rate limits.

The off-chain feed uses market_id; the on-chain record uses makerAssetId / takerAssetId. The (condition_id, yes_token_id, no_token_id) mapping connects them. I retrieved it through the central limit order book (CLOB) Representational State Transfer (REST) application programming interface (API). I cached the mapping locally. CLOB REST resolves all 385,198 archive market ids. The Gamma metadata API, sometimes used in the literature, indexes only 34,764 markets.

I committed the 600-market selection rule in a pre-registration document before calculating the panel. The rule fixes the volume metric, random-stratum eligibility threshold, random seed, and category scheme. A deterministic build script creates the panel Parquet file. Before analysis, I recorded its SHA-256 hash, a cryptographic file fingerprint, in the pre-registration document.

This goes beyond the empirical-microstructure norm. The cost is one document and one hash. The benefit is a check that no market entered or left after the analysis ran.

Eight stylized facts

SF1 — Longshot spread premium

A quoted spread is the gap between the best buy and sell prices. The mid-price is their average. The half-spread is half that gap. A basis point (bps) is one hundredth of a percentage point.

I bin the full quoted spread by each market’s mean mid-price into ten deciles. The median full spread is about 400 bps in the central [0.4, 0.6] range. It rises to 1,300-1,800 bps for markets trading below 0.10. The corresponding half-spreads are about 200 bps and 650-900 bps.

The pattern is asymmetric: the low-probability side is wider than the high-probability side. This echoes the racetrack and parimutuel longshot bias in Snowberg and Wolfers (2010) and Thaler and Ziemba (1988). It also echoes the prediction-market evidence that Wolfers and Zitzewitz (2004) survey for Iowa Electronic Markets and TradeSports.

The direction is the same; the magnitude is not. The lowest-probability decile has a 1,300-1,800 bps full quoted spread. Its 650-900 bps half-spread is an order of magnitude wider than on a continuous-payoff sportsbook market. That scale looks less like risk-love or misperception and more like a constraint on liquidity provision.

SF2 — Depth concentration

Level 2 (L2) data show resting size at several prices. For each market, I summarize its depth with $\text{depth}{L=1} / \text{depth}{L=10}$. This ratio is the share of cumulative top-10 depth held at the best price.

A value of 1.0 means that all top-10 depth sits at level 1, which gives a thin, top-heavy book. A value of 0.1 represents a uniform grid with equal depth at each level. Among 546 markets with non-null depth, the median is 0.137, near the uniform benchmark. The 10th percentile is $p_{10} = 0.033$, and the 90th percentile is $p_{90} = 0.428$.

The folk view says prediction-market depth concentrates at the best price. Polymarket does not fit that view; depth generally extends further into the book.

SF4 — Maker-wallet diversity

For each market, I calculate the volume-weighted Herfindahl index (HHI) of maker-address shares across on-chain trades. HHI measures concentration. A higher value means that fewer maker wallets provide the volume.

Across 600 markets and 6.4M trades, the median HHI is 0.031, or about 32 effective makers. The distribution is right-skewed. Its $p_{90} = 0.119$, or about 8 effective makers. The maximum is 0.40, or roughly 3 effective makers.

Most panel markets therefore have decentralised maker liquidity. A tail of thin or niche markets remains dominated by one to three wallets. This matters for claims that a few professional liquidity providers dominate Polymarket. At least in the top-100 by volume, that’s not what the data show.

I flag maker == taker as a wash-suspect direct self-match. I also flag a flipped pair, $(maker_a, taker_a) \leftrightarrow (taker_a, maker_a)$, in the same market within 128 blocks. That interval is the Polygon finality buffer.

The result is an explicit lower bound. The detector covers direct self-matches and immediate round trips. It does not cover extended graph patterns. Network classifiers such as Cong et al. (2023) address those patterns on unregulated cryptocurrency token exchanges. That study documents wash shares of 25-70%.

Across 600 markets and 6.4M trades, the median wash share is 0.97%. The 90th percentile is 4.5%, the 99th percentile is 10.6%, and the maximum is 22.2%.

Two factors separate this lower bound from network-classifier estimates on token exchanges. First, some wash patterns require multi-counterparty graph analysis, which my detector does not perform. Second, the venues create different incentives to wash trade. I can quantify the first factor only by extending the graph classifier. The second is an identification problem, not a measurement problem.

SF8 — Depth decay near resolution

Do markets near resolution carry shallower books? I regress log mean depth at $L=10$ on log seconds-to-close at the panel midpoint. This cross-sectional regression compares different markets at one time. The midpoint is 2026-03-13. I restrict the sample to 322 markets with positive seconds-to-close and non-zero summary depth.

A bivariate regression uses one explanatory variable. Its slope is 0.818. The heteroskedasticity-consistent standard error (HC3 SE) is 0.113, with $t = 7.2$ and $R^2 = 0.13$. HC3 allows error variance to differ across observations. The $t$-statistic measures the coefficient relative to its standard error. $R^2$ measures the share of variation explained by the model.

Category fixed effects control for average differences among Crypto, Sports, Other, and Geopolitics. They reduce the slope to 0.550. The HC3 SE is 0.143, with $t = 3.85$ and $R^2 = 0.22$. Category-level confounding therefore explains roughly one third of the bivariate association.

Adding log panel-window volume reduces the slope to 0.305. Its HC3 SE is 0.104, with $t = 2.94$ and $R^2 = 0.49$. The rounded 0.31 slope implies about 6% less mean depth for each 10× reduction in seconds-to-close.

The category-plus-log-volume specification gives the conservative reading. Volume mediates the relationship between depth and time. Markets that remain active longer accumulate more makers, and more makers mean more depth. A regression without volume assigns this maker-and-time channel to time alone.

The 0.305 coefficient is residual depth decay after removing that mediation. The abstract reports the 0.550 within-category slope before removing mediation. That slope is appropriate for comparison with literature that does not condition on volume.

The paper also reports three other stylized facts. SF3 covers Polygon block-clock alignment, SF5 covers category-conditional spread, and SF6 covers archive-ingestion latency. SF6 measures the collector pipeline, not Polymarket. The median of the per-market median (p50) ingestion delays is 41.5 milliseconds. That is a collector sanity check, not a microstructure result.

Why Polymarket order-book data cannot infer trade direction

Six standard microstructure measures depend on trade direction. They are effective spread, realized spread, Roll, Abdi-Ranaldo, Kyle’s $\lambda$, and Amihud. Kyle’s $\lambda$ estimates price impact from signed trade flow. Each measure needs an aggressor sign. The aggressor is the order that executes against a resting order. Its sign identifies whether a buyer or seller initiated the trade.

Equity researchers commonly infer this sign from a quote-driven feed with Lee-Ready or a variant. Polymarket’s public feed lacks the required information. The change_side field shows which order-book side moved, not which side initiated the trade.

I infer trades from the feed under a LOOSE rule: every resting-size decrement counts. I match inferred buckets to on-chain OrderFilled events by exact price and 5-second intervals. The test uses four disjoint 7-day windows.

Panel mean: 0.615 across 109 valid market-window cells from 400 possible cells and 55 markets. The market-clustered bootstrap 95% confidence interval (CI) is [0.579, 0.653].
Volume-weighted by 125,080 matched buckets: 0.592. The bootstrap 95% CI is [0.542, 0.659].

Volume-weighted sign agreement is about 59%, just above the 50% chance baseline. Even after a time-and-price match, the inferred direction is wrong for about two trades in five.

The feed itself causes the problem. A price_change update broadcasts the resting book after a match but does not identify the taker. change_side shows which side moved, not which side initiated the trade. Using it as a sign proxy produces the roughly 59% agreement rate.

A noisy sign contaminates every measure that uses it. On the comparable subset of the top-100 panel:

Effective half-spread changes sign on 67% of markets in the first 7-day window after replacing feed inference with on-chain ground truth. It changes sign on 50% in a second non-overlapping window.
Kyle’s $\lambda$ changes sign on 60% of markets in the first window and 43% in the second.

Across both windows, feed-inferred trade direction remains near chance and well below the approximately 80% Lee-Ready accuracy documented on Nasdaq.

The Glosten-Harris spread decomposition makes this concrete. Adverse selection is the cost of trading against a better-informed counterparty. I restrict the decomposition to the top-100 stratum and use authoritative on-chain trades.

The median effective half-spread is essentially zero at -0.0003 in the paper’s probability-point units. The median transitory and adverse-selection components are 0.00001 and 0.0 in the same units. After removing sign errors, the dollar-weighted “adverse selection” from order-book-only inference collapses. The typical top-100 market has no detectable systematic spread component on either side.

The same constraint should affect other decentralised CLOB venues with similar feeds. Their off-chain matching layer broadcasts a post-match book state without identifying the taker. Examples include GMX v1, dYdX v3, Loopring’s historical CLOB, and similar hybrid architectures. The public feed shows what cleared but not who initiated. Direction-dependent measures on these venues therefore need an authoritative on-chain trade source.

What I’m not doing here

I recently had a long-ish exchange with someone scoping research on the same dataset. It was a useful map of what’s adjacent but out of scope.

Spread decomposition with bounded payoffs. Classical Glosten-Harris / Huang-Stoll remains open for prediction markets. Prices are bounded in $(0,1)$, which breaks parts of the standard identification. This is a real research question, not just a re-application.

Insider episodes and wallet-level patterns around resolution. Probably the most productive lane I am not working on. The Journal of Financial Markets submission uses only aggregate wallet measures and does not deanonymize users. Where you draw that line in your work is your call.

Toxic flow. Some overlap with one of my planned follow-ups.

Latency arbitrage within one venue. Doesn’t really work as a question on Polymarket. The two-clock gap in the WebSocket feed is SF6’s archive-ingestion delay, not trader latency. Without an exchange-side clock, you can’t separate the two. Cross-venue is the workable framing.

Cross-venue arbitrage. Open and product-relevant. Kalshi, PredictIt, sports-book mirrors. The data engineering is probably the harder part.

Polymarket order-book data and replication

Everything is reproducible from the public on-chain record and your own WebSocket capture. I am not redistributing the rounded 624 GB raw archive. It is too large to move around practically. The panel artifacts and on-chain scrape pipeline are public:

Code: github.com/philippdubach/polymarket-microstructure
Replication package (DOI): 10.5281/zenodo.19811426
Paper: arXiv:2604.24366, under review at the Journal of Financial Markets as of May 2, 2026.
Collector: pmxt-dev/pmxt is a good starting point for your own capture. Polymarket’s WebSocket is public. A running collector gives continuous coverage, which is probably more useful for product work than a static historical slice.

The CTF Exchange V1 → V2 cutover at the end of April 2026 closes my scrape window. It also opens a venue-evolution comparison. A per-market depth time series would move SF8 from a cross-sectional regression to a within-market depth-decay regression. A cross-venue analysis against Kalshi and sports-book mirrors would address the price-discovery question that this paper leaves open. Those are the obvious next things.

Karpathy's Software 3.0 Playbook

me@philippdubach.com (Philipp D. Dubach) — Fri, 01 May 2026 00:00:00 +0200

Andrej Karpathy is one of the few people who has both built modern AI and explained it for the rest of us. He co-founded OpenAI, ran computer vision at Tesla (where he got Autopilot working), and his courses on neural networks are some of the most-watched lectures on the internet. He also has a habit of naming the era we’re already in. “Vibe coding” was his. “Software 3.0” looks like the next one.

So when Karpathy says he has “never felt more behind as a programmer,” it is worth slowing down. That isn’t false modesty from a guy with his résumé. Something shifted under the field and most people haven’t recalibrated. The Sequoia interview below is his attempt to describe what shifted. The lessons here are pulled from it, ordered roughly by how much they should change what you do tomorrow.

1. Inflection point December 2025

Until late last year, agentic coding tools were “kind of helpful.” Good in stretches, often wrong in ways you had to babysit. Over the December break, the latest models crossed a line:

“I kept asking for more and just came out fine. And then I can’t remember the last time I corrected it. And then I just trusted the system more and more. And then I was vibe coding.”

He flagged it on the record, loudly:

“A lot of people experienced AI last year as a ChatGPT-adjacent thing. But you really had to look again, and you had to look as of December, because things have changed fundamentally — especially on this agentic, coherent workflow that really started to actually work.”

If your mental model of these tools was set by ChatGPT, it is already a generation stale. The agentic workflow is a different product, and it now works.

2. You can outsource your thinking, but not your understanding

The most quotable line of the interview:

“You can outsource your thinking, but you can’t outsource your understanding.”

As agents do more of the thinking, the bottleneck moves into your head. You still have to know what is worth building and why, and you still have to direct the work.

“I’m still part of the system, and I still have to — somehow, information still has to make it into my brain. And I feel like I’m becoming a bottleneck of just even knowing what are we trying to build, why is it worth doing, how do I direct my agents.”

Your value sits upstream of execution. The bottleneck of the next decade is less about compute than about how fast humans can deepen comprehension to keep directing systems that out-execute them. That is why Karpathy keeps building knowledge bases out of his own reading. He wants another projection of the same data, faster.

3. Verifiability is the map of what automates next

Why are these models freakishly good at code and math, and yet stupid about whether you should walk 50 meters to a car wash? Because frontier labs train via reinforcement learning, and RL needs verifiable rewards. Verifiable domains attract environments and signal, so they get the steepest gains. Everything else stays jagged.

“How is it possible that state-of-the-art Opus 4.7 will simultaneously refactor a hundred-thousand-line code base or find zero-day vulnerabilities, and yet tells me to walk to this car wash? This is insane.”

The GPT-3.5 to GPT-4 chess jump is the proof point. Capability tracks what the labs choose to feed in.

“We are slightly at the mercy of whatever the labs are doing, whatever they happen to put into the mix… If you’re in the circuits that were part of the RL, you fly. And if you’re in the circuits that are out of the data distribution, you’re going to struggle.”

Two things follow. If you are a founder and you can build a verifiable environment in your domain, even one the labs aren’t focused on, you can fine-tune a model that flies. That is real leverage. If you are a worker, the more useful question than “is my job safe?” is “is my job verifiable?” Karpathy thinks everything is automatable eventually. Verifiability mainly sets the order.

4. Software 3.0: prompting is the new programming

The frame that makes the rest of this make sense. Karpathy’s three eras:

Software 1.0: humans write explicit code.
Software 2.0: humans curate datasets and train neural networks; the weights are the program.
Software 3.0: humans write prompts; the LLM is the interpreter, and the context window is the program.

“Your programming now turns to prompting. And what’s in the context window is over the interpreter, that is the LLM, that is kind of like interpreting your context and performing computation in the digital information space.”

His sharpest example: installing OpenCode is no longer a shell script. It is a block of text you copy-paste to your agent, which reads your environment and figures the rest out.

“It’s just like, what is the piece of text to copy-paste to your agent? That’s the programming paradigm now.”

The unit of programming used to be a function. Now it is closer to a paragraph.

5. Vibe coding raises the floor; agentic engineering raises the ceiling

If you build software for a living, this is the lesson with the most direct implications:

“Vibe coding is about raising the floor for everyone in terms of what they can do in software… But agentic engineering is about preserving the quality bar of what existed before in professional software. You’re still responsible for your software just as before, but can you go faster?”

Karpathy thinks the ceiling is very high:

“People used to talk about the 10x engineer previously. I think that this is magnified a lot more — 10x is not the speed up you gain. People who are very good at this peak a lot more than 10x.”

The gap between mediocre and excellent users of these tools is widening. Worth taking seriously when you decide what to learn next.

6. The new human skill is taste, spec, and oversight

What humans should still do, in his telling, is design and judgment work. Holding the spec in your head. Setting the architecture. Making sure the agent is being asked for the right thing in the first place.

“You’re in charge of the taste, the engineering, the design, and that it makes sense, and that you’re asking for the right things… You’re doing some of the design and development, and the engineers are doing the fill in the blanks.”

The MenuGen anecdote is the kind of mistake only a human spec catches. The agent silently tried to associate Stripe and Google accounts by matching email addresses, with no persistent user ID. It worked until two emails diverged.

He is not sure this division will hold forever:

“When you actually look at the code, sometimes I get a little bit of a heart attack, because it’s not super amazing code… It’s very bloaty, and there’s a lot of copy-paste, and there’s awkward abstractions that are brittle and — like, it works, but it’s just really gross.”

Nothing fundamental stops the labs from training for taste. They just haven’t yet. Until they do, the taste layer is still your responsibility.

7. Some apps shouldn’t exist anymore

The MenuGen anecdote, again. Karpathy built an app: photo a restaurant menu, OCR it, generate images of each dish, render a new menu. Vercel deployment, the full stack.

Then he saw the Software 3.0 version. Hand the photo to Gemini, say “use NanoBanana to overlay the dishes onto the menu,” and a single model call returns the same menu with images rendered into the pixels.

“All of my MenuGen is spurious. It’s working in the old paradigm. That app shouldn’t exist.”

A lot of what we are building today is scaffolding around a capability the model could perform end-to-end. Before writing the next CRUD app, ask whether the model is the app.

8. New possibilities matter more than the speed-ups

The flip side of “some apps shouldn’t exist” is that some products could not have existed before. Karpathy’s knowledge-base project is the example. Take a pile of documents, ask the LLM to recompile them into a wiki, surface the connections you would never have stitched together by hand.

“This is not even a program. This is not something that could exist before, because there was no code that would create a knowledge base based on a bunch of facts. But now you can just take these documents and basically recompile them in a different way… I almost think that that’s more exciting.”

If you only ask what gets faster, you will miss the more interesting question, which is what becomes possible at all.

9. Jagged intelligence: ghosts, not animals

Karpathy’s metaphor: we are not building animals. Animal intelligence comes with intrinsic motivation, embodiment, drives shaped by evolution. What we have instead is more like a ghost. A statistical simulator shaped by pre-training, with RL bolted on.

“These things are not animal intelligences. Like, if you yell at them, they’re not going to work better. Or worse. Or it doesn’t have any impact. And it’s all just kind of these statistical simulation circuits where the substrate is pre-training. So, statistics. And then there’s RL bolting on top.”

The practical takeaway is to stop reasoning about LLMs by analogy to humans. Be suspicious of where the model seems confident, probe the edges, and figure out which circuits your task is actually landing in.

10. Build agent-native infrastructure

For infra builders, Karpathy’s pet peeve is also the opportunity:

“Why are people still telling me what to do? Like, I don’t want to do anything. What is the thing I should copy-paste to my agent?”

Rebuild the developer stack so the primary consumer of docs, configs, APIs, and deployment flows is an agent rather than a human. Data structures should be legible to LLMs by default, and sensors and actuators over the world should sit behind agent-callable interfaces.

His test: can you say “build and deploy MenuGen” and never touch a settings panel? When the answer is yes, the infrastructure has caught up.

11. Hire for big projects, not puzzles

A direct shot at hiring managers. Most companies have not refactored their interview loops for the agentic era.

“Hiring has to look like, give me a really big project and see someone implement that big project. Like, let’s write, say, a Twitter clone for agents, and then make it really good, make it really secure, and then have some agents simulate some activity on this Twitter. And then I’m going to use 10 Codex 5.4-X-high to try to break your website.”

Whiteboard puzzles measure the wrong thing. If your interview loop has not changed since 2022, you are selecting for the previous era.

12. Imagine the weird endpoint

The closing speculation is genuinely strange:

“In the early days of computing, people were a little bit confused as to whether computers would look like calculators or computers would look like neural nets. And in the ’50s and ’60s, it was not really obvious which way it would go… You could imagine that a lot of this will flip and that the neural net becomes kind of the host process, and the CPUs become kind of the coprocessor.”

UIs diffusion-rendered moment by moment from raw video and audio. No apps in between.

You do not have to buy this exact picture. The point is simply that the linear extrapolation, the same software but smarter, is almost certainly the wrong frame for where this ends up.

Based on Andrej Karpathy’s interview with Sequoia at AI Ascent

F3ED Can't Call an Ace: Fixing a NeurIPS 2024 Tennis Model

me@philippdubach.com (Philipp D. Dubach) — Wed, 29 Apr 2026 00:00:00 +0200

I built a tennis broadcast pipeline this spring and ended up running F3ED, the NeurIPS 2024 shot detector, on a couple of ATP Challenger matches. F3ED is a good model. It also kept labeling clear aces as “unforced errors”, which is what this post is about. Code: github.com/philippdubach/tennis-vision.

F3ED (NeurIPS 2024) detects shots well. The catch is the outcome head, which has 4 classes: in, winner, forced-err, unforced-err. There’s no class for ace, double_fault, or first_serve_fault. Those events aren’t shot properties; they’re score-grammar, and they need state from outside the shot itself.

I audited 11 single-shot serve rallies F3ED labeled unforced-err. 7 are first-serve-faults. 1 is an ace. Only 3 are genuine unforced-errors. 73% mislabeled by tennis’s own definition.

The fix is a 30-line reconciler that reads the scoreboard. OCR isn’t novel here. What I haven’t seen anyone do is plug it back into runtime label correction, which is what makes the difference. N=44 rallies across two matches; this is a hypothesis, not a finding. The structural argument doesn’t depend on N.

The current pipeline

Two phases, with a serializable artifact between them:

upstream.npz is a 5-field dataclass (ball_track, homography_matrices, kps_court, persons_top/bottom, bounces). It’s the contract between the GPU-bound detection layer and everything else. You re-run Phase 2 in seconds and don’t pay the GPU bill again until Phase 1 inputs change. This was a boring early decision that quietly carried the project. Every iteration runs in ~10 minutes instead of needing a fresh Colab session.

The score-delta reconciler sits at the end of Phase 2. It sees F3ED’s per-shot taxonomy and the OCR-derived score states. When they disagree, it overrides the outcome label.

Quality on TenniSet V006 (28 ground-truth points across 20 minutes, with ±12-frame tolerance):

F3ED has the highest F1, with fewer false positives at comparable recall. I’m not arguing it’s broken. I’m arguing about a specific thing it can’t do alone.

Note: numbers above are from the V006 baseline run on commit 0babb71 (2026-04-23). Bounce-dedup and reconciler work since then shift F1 marginally upward; full re-eval pending a Phase-1 v8x rerun on V006.

The audit

Tennis scoring is a finite-state machine. A point ends in exactly one of:

ace: server’s first or second serve, receiver doesn’t return
double_fault: both serves miss
first_serve_fault: first serve misses; second serve still to come
multi-shot rally → winner / forced-err / unforced-err

F3ED can only emit the bottom row. The first three depend on what happens between shots, or on what doesn’t happen at all, and the model doesn’t see between-shot stuff. It also has no class to put the answer in if it did: ace, double_fault, and first_serve_fault are not in F3ED’s published label set. The closest available emission for any of them is serve + unforced-err. The model can’t learn to distinguish them even if the training data did, because there’s nowhere to put the answer.

Here’s what tipped me off. set1 R4, t=107s:

F3ED raw_elements: ['T', 'ad', 'near', 'serve', 'unforced-err']
Score before rally: Poljicak 0 Dodig 0 (game start)
Score after rally: Poljicak 15 Dodig 0

Server scored, receiver didn’t move, F3ED labeled the serve “unforced error”. You can’t hit an unforced error and win the point. It was an ace, and F3ED doesn’t have an “ace” button to press, so it picked the closest available label.

The reconciler is short. For each single-shot serve rally, read the scoreboard before and after:

# Verbatim from src/tennis_vision/scoreboard/reconcile.py
_POINT_RANK = {'0': 0, '15': 1, '30': 2, '40': 3, 'AD': 4}

def _delta_points_won(before: ScoreState, after: ScoreState) -> tuple[int, int]:
 """(top_pts_won, bot_pts_won) between two states. A game-counter increment
 counts as +1 (the lost-side rolls back to 0); same-game incremental points
 are tracked via the points-rank delta."""
 top = max(0, after.tg - before.tg)
 bot = max(0, after.bg - before.bg)
 if after.tg == before.tg and after.bg == before.bg:
 top += max(0, _POINT_RANK.get(after.tp, 0) - _POINT_RANK.get(before.tp, 0))
 bot += max(0, _POINT_RANK.get(after.bp, 0) - _POINT_RANK.get(before.bp, 0))
 return top, bot

def _classify_single_shot_serve(rally, before, after) -> tuple[str, str, str]:
 top_d, bot_d = _delta_points_won(before, after)
 server_d = top_d if rally.server == 'top' else bot_d
 receiver_d = bot_d if rally.server == 'top' else top_d
 receiver = 'bottom' if rally.server == 'top' else 'top'
 if server_d == 0 and receiver_d == 0:
 return ('first_serve_fault', 'unknown', 'ocr_score_delta_first_serve_fault')
 if server_d > 0 and receiver_d == 0:
 return ('ace', rally.server, 'ocr_score_delta_ace')
 if receiver_d > 0 and server_d == 0:
 return ('double_fault', receiver, 'ocr_score_delta_double_fault')
 return ('unknown', rally.winner, rally.method + '+ocr_inconclusive')

That’s the whole reconciler: 23 lines, microseconds per rally. The OCR sampling pass that produces the before / after states runs once during Phase 2 (~1 Hz over the broadcast); the reconciler itself is a constant-time lookup against the resulting state timeline.

Running it across set1 + match2 (44 rallies, 11 single-shot serve rallies) shows the structure F3ED missed:

8 of 11 unforced-err serves (73%) are something else by tennis’s actual rules. All 8 got the right label after reconciliation. Whether 73% holds up on a larger sample is a real question; the audit framework would answer it cheaply on more clips. The remaining error budget is OCR layout failures (next section) and ambiguous score deltas in multi-shot rallies, where neither F3ED nor OCR alone tells winner from forced-err.

The point here isn’t that F3ED is wrong. The model emits the labels it has classes for, which is what models do. The point is that shot detection and outcome classification look like the same problem and aren’t, and on broadcast tennis the cheapest outcome ground truth is text the broadcaster has already burned into the corner of every frame.

Does the OCR actually work?

Worth asking. The whole reconciler depends on the scoreboard reader being right. Honest answer: it depends heavily on whether the layout config is tuned. When it is, OCR is reliable. When it isn’t, individual fields collapse.

The pipeline is EasyOCR cropping a per-layout ROI (split_open_1080p, split_open_720p, bloomfield_720p), then a tennis-grammar decoder that rejects illegal transitions (40-30 → 0-0 without a game break, AD-15, and so on) and majority-votes within a sample window.

Field-parse rates on the two clips in this audit, sampled at ~1 Hz:

set1 is essentially perfect. match2’s bot_games parse drops below half because the ROI for split_open_720p is mistuned and crops too tight on the digit. Annoying, but the grammar decoder rescues enough frames to emit 28 valid score states across 1002 samples, which is plenty. The reconciler degrades gracefully: rallies without a clean before/after pair fall back to F3ED’s raw outcome rather than crashing.

The fix for match2 is layout cleanup, not architecture. None of these components are novel. TennisExpert (Liu et al. 2026, the paper that kicked off this whole project for me) and the TenniSet eval framework (Faulkner & Dick, DICTA 2017) both use OCR + grammar at the labeling stage. What I haven’t seen anyone do is plug the same signal back into runtime label correction.

Putting it in the render

After reconciling, the corrected outcome flows back onto the last shot of the rally and surfaces in the rolling event-timeline panel. Here’s a single point rendered end-to-end with all overlays live:

Same set1 R4 ace, mid-frame: Top-left RALLY panel reads 0.0s P2 Serve T ACE. The ACE suffix replaced F3ED’s UE. The scoreboard echo (bottom-left) mirrors what triggered the correction (Poljicak just picked up 15), and the per-player stats panel (bottom-right) ticks his ace counter by one. The model’s wrong answer gets quietly corrected because a different signal contradicted it. That’s the whole post in one frame.

The same panel surfaces F3ED’s other labels in real time: direction (T for down-the-T serves, CC/DL/DM/II/IO for groundstrokes) and shot type when not a basic groundstroke (Slice, Volley, Drop, Lob).

That panel is the F3ED 29-class taxonomy made human-readable, in real time. The reconciler doesn’t touch direction or technique. Those are pure shot properties, exactly the regime F3ED is designed for. It only fires on the score-grammar events the model can’t see.

A clean direction histogram comes for free as a side effect. 97 groundstrokes from match2:

36% down the middle, 31% cross-court, 17% inside-out, 12% down-the-line, 3% inside-in. The kind of stat broadcasters quote without showing where it came from. Here it’s a one-liner over shots.json.

Things that didn’t pay off

Two ideas I tried that I expected to be wins. Neither was.

YOLOv8x doesn’t help at 720p

Phase-1 person detector was YOLOv8m. Swapping in v8x looked like a free improvement: COCO AP@small bumps about 5 pp, and the camera-far (“top”) player on broadcast tennis is the smallest object in the frame, so that’s exactly where the gain should land.

set1 (1080p): top-player pose coverage 70.0% → 97.6%. match2 (720p): 70.3% → 68.6%, within noise. Two clips isn’t a study, but the mechanism is plausible: at 1080p the camera-far player is ~60-100 px tall, the regime where v8x’s AP@small advantage fires. At 720p the same player is ~30-50 px, below the COCO scale buckets where -x outperforms -m. The detector can’t recover what isn’t in the input. If you’re scraping ATP Challenger feeds, fight for 1080p sources. Everything downstream compounds on what the detector gives you.

CatBoost over-fires bounces

The bounce detector emitted 378 bounces on a 20-min match2 clip with 84 shots, 4.5× the realistic ratio. Most of the noise is the detector lighting up on the same physical bounce across consecutive frames, plus inter-rally footage where the ball is in a player’s hand or in a replay close-up.

Two cheap filters cut 21-27% of false bounces:

The first is a temporal dedup with ~400 ms minimum separation between bounces, fps-aware. It collapses CatBoost firing on three consecutive frames for one physical contact and drops 9-12%.

The second is a court-locality filter: project the ball pixel through the homography to canvas coordinates, drop if it falls outside the court polygon plus a 200 px buffer. This kills inter-rally noise where the ball is being held or replayed, dropping another 12-15%.

Real bounces don’t fire 200 ms apart and don’t land 3 m past the doubles alley. Neither filter is novel; both are roughly ten lines of code. If you’re using a CatBoost-style bounce detector you probably want both anyway.

What’s open

44 rallies isn’t enough to nail the percentage, just to expose the structure. Running the audit across 10+ matches is the obvious next step. It would also surface match-to-match variance in F3ED’s failure modes. Does it mislabel aces more often on hard courts than clay? I have no idea, and I’d like to know.

The reconciler currently only handles single-shot serve rallies. When both players hit clean balls and the point ends, the score delta is the same whether the winner came from a winner or a forced-err. Neither F3ED nor OCR alone disambiguates. A trajectory-aware classifier on the last two shots would close that gap. Haven’t tried it.

The longer-term move is closed-loop F3ED retraining: use the OCR-corrected labels as supervision for a small classifier head whose input is (F3ED 4-class outcome, OCR delta, single-shot flag) and whose output is the extended set {in, winner, forced-err, unforced-err, ace, double_fault, first_serve_fault, unreturnable}. About 5 minutes of training data per match. 10+ matches gets a usable head. The interesting move there is putting the OCR signal into training rather than just inference.

Inside PRAGMA: Revolut's Foundation Model for Banking

me@philippdubach.com (Philipp D. Dubach) — Sun, 26 Apr 2026 00:00:00 +0200

This month, Revolut Research and NVIDIA published PRAGMA: an encoder-only transformer trained on 26 million user histories spanning 24 billion events and 207 billion tokens across 111 countries. To my knowledge it is the largest encoder backbone for consumer banking event data anyone has put on arXiv. Nine months earlier, Nubank had published nuFormer, a similar premise with the opposite architecture. Can you train a transformer on raw transaction ledgers and replace the gradient-boosted-tree models running production credit, fraud, and recommendation pipelines.

Banking has spent the last decade lagging the rest of tech on representation learning. Production models still run on hand-crafted tabular features. Every team working on this knows it’s is suboptimal. Almost no team has the data, the GPUs, or the political budget to fix it. PRAGMA is what a banking foundation model looks like at the high end of the market.

The chart above is from the PRAGMA paper and it reads like a marketing slide. PR-AUC up 130.2% on credit scoring. AUUC up 163.7% on a communication uplift task. mAP up 40.5% on product recommendation. These are relative numbers against task-specific baselines and the absolute scores are commercially redacted, so calibrate accordingly. But Revolut publishing them under their own name, with author affiliations, is the meaningful signal here. Internal foundation models have moved from trade secret to competitive disclosure.

What Revolut built

PRAGMA is a BERT-style encoder, not a GPT. The choice matters. Revolut’s downstream targets are discriminative (default within 12 months, fraud, churn, product adoption), which is exactly what bidirectional masked modelling is good at. The model family scales from 10M to 100M to 1B parameters across three encoder branches: a profile-state encoder for static attributes, a per-event encoder, and a history encoder that fuses them.

The architectural decision that strikes me as most important is the input representation. Naive text serialization of a transaction record into JSON blows up sequence length: every key name, every delimiter, every digit becomes multiple BPE subword tokens. Worse, splitting “14.99” into “14” “.” “99” destroys the magnitude information that any credit model needs. Revolut’s answer is to tokenise each field as a triple of semantic key, typed value, and temporal coordinate. Numerical values map to learned percentile buckets. Categorical values map to single tokens. Text gets BPE. Timestamps get encoded twice, once as compressed log-seconds since the previous event and once as fixed-period sinusoids over hour-of-day, day-of-week, and day-of-month.

The figure above is what a single user looks like to PRAGMA: a stream of structured events leading up to an evaluation point at which the model is asked to predict something. Around 60 keys. Around 28,000 value tokens.

Pre-training is masked language modelling, but with three masking sources blended together: 15% standard token masking, 10% whole-event masking, and 10% semantic-type masking. The whole-event variant is interesting for banking. It teaches the model that when you cannot see the amount of a card payment but you can see the merchant, the time, and the surrounding behavioural pattern, the amount is often inferable. That is exactly the inductive bias you want in a credit or fraud model.

The numbers

(1) The LoRA versus train-from-scratch comparison. Revolut shows that fine-tuning a pre-trained backbone with LoRA, updating roughly 2-4% of parameters, consistently matches or beats training a fresh task-specific model on the same downstream data. This is the result that justifies the entire infrastructure investment. If pre-training did not transfer, you would not bother. Communication engagement gains 18.6% PR-AUC from LoRA over scratch. Credit scoring gains 13%. Product recommendation gains 10.3% mAP. That is the business case.

(2) The profile-state ablation. Removing the dedicated profile-state branch tells you which tasks are driven by static user characteristics versus event sequences. Credit scoring loses 31.8% PR-AUC without profile state, because account tenure and onboarding signals matter for identifying minority-class defaulters. Communication engagement actually gains 3% in PR-AUC without profile state, because re-engagement is a story about pre-drop-off behaviour, not about who the user is. The two-branch design keeps the static features when they help and ignores them when they do not.

(3) The published limitation. The paper itself reports that PRAGMA, as a per-user encoder, drops 47.1% on F-0.5 on the AML downstream task evaluated in the paper, and the authors flag this as an expected limitation rather than a benchmark to beat. AML detection is a relational problem run across users and across accounts; PRAGMA as published is a per-user encoder and not graph-aware. The lesson the paper draws is that backbones of this kind are complements to graph-aware components, not replacements. This is a property of the published research artifact, not a statement about Revolut’s actual production AML stack, which is not described in the paper.

How this compares to Nubank

Nubank’s nuFormer, published in July 2025, makes the opposite architectural choice. It is a causal GPT-style decoder pre-trained with next-token prediction, with a joint fusion finetuning step that bolts a DCNv2 tabular network onto the same gradient graph. The reported lift is +1.25% in test AUC on a single recommendation task, and a 4.4% reduction in user churn measured in production. Smaller numbers than PRAGMA, but Nubank published a real production deployment outcome. PRAGMA’s results are still backtests.

The two papers disagree on almost everything that is fun to argue about. Architecture: decoder versus encoder. Task scope: one task versus six. The role of static profile state: collapsed into the sequence versus given its own branch. What they agree on: Hand-crafted feature engineering can be replaced by self-supervised representation learning on raw transaction sequences, and doing so produces material lifts on real banking problems. The architectural debate is downstream of that.

The broader literature is moving the same way. TransactionGPT (Dou et al., 2025) introduces a 3D transformer for billion-scale payment trajectories aimed at anomaly detection. FinBERT, BloombergGPT, and FinGPT cover the text side. Time-LLM and Chronos cover numerical time series. PRAGMA and nuFormer are the two papers that target the actual structured event ledger sitting inside a retail bank, which is the asset that matters for credit, fraud, and product decisions.

Outlook

There is no public checkpoint. Revolut and Nubank both keep their weights inside their production stack, which is the right business decision and the wrong scientific one. You cannot run PRAGMA on your own data. You can only read the paper and decide whether the recipe is reproducible.

I think it is. The paper is detailed enough to rebuild from. The tokenisation scheme is fully specified. The architecture diagram is precise enough to follow. They even document the optimiser, Muon plus AdamW, and the hardware, 32 H100s for the 1B variant. The constraint is the pre-training corpus, not the model.

So the next project on this site is a faithful PRAGMA reimplementation at the small (10M) scale, trained on a synthetic or open-licensed transaction dataset, evaluated on a subset of the downstream tasks where public benchmarks exist. I will write that up here in instalments, including what works, what breaks, and where the paper is silent. The codebase will land in a public repository as I build it.

The Moral Philosophy of Investing in Ignorance

me@philippdubach.com (Philipp D. Dubach) — Wed, 22 Apr 2026 00:00:00 +0200

Investing at the Edge of Knowledge, Part 5 · Start with Part 1

“If in an unknowable world none of your bridges fall down, you are building them too strong.”

Zeckhauser’s version of this line refers to investments, not bridges, but the structural point is the same. A philosophy of investing that expects some failures is also a philosophy that accepts some losses will be borne by the people on the other side of the trade. Over four installments I’ve laid out a framework for thinking about what you can know (Part 1), why investors flee what they can’t (Part 2), how to assess what others know (Part 3), and how much to bet (Part 4). This final piece asks the question the framework doesn’t answer: when you profit from ignorance, is that a legitimate source of returns?

Zeckhauser opens his 2006 paper with a warning that is usually read as practical advice: “Do not read on if blame aversion is a prime concern.” I think there’s an ethical question underneath the practical one.

Three sources of profit

In the risk box, profit comes from superior calculation. Both sides had the same information. You ran the numbers better. This is the cleanest form of trading profit. The losing side made a computational error that was, in principle, avoidable.

In the uncertainty box, profit comes from superior estimation. You had a better model, better priors, or more data. The other side could have done the same analysis but didn’t. This is still relatively clean, though the boundary between “better estimation” and “inside information” requires constant policing, which is what securities regulation exists to do.

In the ignorance box, the source of profit shifts. The other side didn’t sell because they thought the price was fair. They sold because they couldn’t model the asset and their constraints forced a decision. The fund manager who sold the IGV at $80 during the SaaSpocalypse wasn’t wrong about the disruption risk from AI. They were unable to hold a position that couldn’t be defended to their risk committee, their clients, or their compliance team. The profit for the buyer comes from the gap between institutional rationality (the right decision for the manager’s career) and market rationality (the right price for the asset).

The distinction matters. Most alpha in UU situations is some form of constraint arbitrage: profiting from the gap between what an asset is worth and what institutions are able to pay for it. Time horizon arbitrage, where you can hold for five years and they can’t. Liquidity arbitrage, where you can accept illiquidity and they can’t. Career-risk arbitrage, where you can tolerate looking wrong and they can’t. All three produce genuine returns, and in none of them did the counterparty make an error. They made a rational decision given their constraints, and you profited from having different constraints.

One way to frame this is positive: the constraint-arbitrage investor is providing liquidity to a market that needs it. They’re buying when others are forced to sell, which improves price discovery and reduces the magnitude of mispricings. In this framing, the profit is compensation for bearing ambiguity that others can’t.

Another way to frame it is uncomfortable: the returns from ignorance flow to those who can afford to bear it, and that set of people is not random.

The sidecar problem, revisited

I discussed the sidecar concept in Part 3 as an information problem: how do you know the driver is skilled? Here I want to revisit it as an ethical problem: what kind of edge is the driver using?

Zeckhauser’s sidecar works cleanly when the driver has genuine capability. A real estate developer who can build and lease a building is creating value. A venture capitalist with operational expertise and a network of technical talent is creating value. The sidecar investor earns a share of that value creation. The profit comes from complementary skills combined with capital, and this is hard to object to on ethical grounds.

It gets murkier when the complementary asset is power rather than skill. Zeckhauser discusses a hypothetical Gazprom investment: “If you could comfortably determine that the Russian elite was investing on its own volition, and that foreigners would not be discriminated against…” The edge in that scenario isn’t analytical. It’s access to a political structure. The sidecar investor is riding alongside someone who can influence outcomes, not someone who can predict them. The distinction between capability and power as complementary assets is one the paper gestures at but doesn’t fully resolve.

Robb (2006) put his finger on a related problem. UU knowledge is “uncommunicable.” If a mechanism for generating excess returns could be expressed as a process, someone would have arbitraged it away. But if the driver can’t articulate their edge, the sidecar investor can’t distinguish between genuine insight, survivorship bias, and proximity to power. There’s an epistemological problem here, and an ethical one. You’re making a bet on someone whose advantage you can’t evaluate, which means you’re implicitly trusting that the advantage is legitimate.

Summers (2006) observed that identifying skilled UU managers may be no easier than picking investments directly. I suspect this is too generous. In many cases, identifying whether a sidecar driver has skill, power, or luck is harder than evaluating the underlying asset, because the asset at least has observable characteristics. The driver’s edge, by definition, doesn’t.

Blame, accountability, and the collective action problem

The Monday Morning Quarterback problem runs through Zeckhauser’s entire paper. Investors avoid Box F not because the expected value is negative but because a bad outcome will be judged harshly in retrospect. I’ve discussed this as a mechanism for mispricing (Parts 2 and 3). Here I want to name the distributional consequence.

If we want institutional investors to make UU bets, which would improve price discovery and reduce the mispricing that currently rewards unconstrained investors, we need governance structures that tolerate good decisions with bad outcomes. The current structure doesn’t. A pension fund CIO who buys the IGV at $80 and watches it fall to $70 will face questions that no amount of “the expected value was positive” can answer. The governance framework is built for the risk box, where decisions can be evaluated against a defined probability model. In the ignorance box, there is no model to evaluate against, which means there is no institutional language for “this was a good bet that happened to lose.”

The result is a collective action problem with distributional consequences. The returns from UU mispricing accrue disproportionately to wealthy individuals, family offices, and unconstrained investors like Buffett, precisely the people who can afford career risk, illiquidity, and blame. Pension funds, endowments, and retail investors in diversified vehicles are structurally excluded, not by regulation or by choice, but by governance frameworks that require the kind of probability estimates the ignorance box doesn’t produce.

I’m not sure this is a solvable problem. The fiduciary duty to beneficiaries is real, and “we invested in something we couldn’t model because the price seemed low” is not, and should not be, an acceptable fiduciary justification. But it’s worth naming the consequence: the epistemological structure of markets has equity implications. The returns from acting under ignorance flow to those who already have the most capacity to bear it. This is not a conspiracy. It’s a structural feature that emerges naturally from the interaction of ambiguity aversion, institutional constraints, and governance design.

Zeckhauser closes his paper by returning to David Ricardo at Waterloo. Ricardo wasn’t a military analyst. He didn’t have inside information about Wellington’s strategy. He just understood the structure of the situation: thin competition (most investors had fled), an eager seller (the British government needed capital), asymmetric payoffs (bounded downside, enormous upside), and a kind of not-knowing that was the same for everyone. He bought British government bonds on the eve of the battle and made a fortune.

The honest answer to “what’s your thesis?” in a UU investment is: “I don’t have one in the way you mean. I have a set of second-order inferences about what other people don’t know, what constraints they face, and why the price might be wrong even though I can’t tell you what the right price is.” That’s not a pitch deck. It’s a worldview. Most investment committees would reject it, which is, of course, part of why it works.

Charlie Munger, in his 1995 Harvard Law School speech on the psychology of human misjudgment, offered a compliment that I think is the best summary of everything this series has tried to say: “The right way to think is the way Zeckhauser plays bridge.” The compliment is precise. Bridge is a game of acting under uncertainty with imperfect information, where the quality of the decision is independent of the outcome, and where the best players are distinguished not by what they know but by how they reason about what they don’t know.

That might be the best definition of investing at the edge of knowledge I can offer.

Bet Sizing at the Frontier

me@philippdubach.com (Philipp D. Dubach) — Fri, 17 Apr 2026 00:00:00 +0200

Investing at the Edge of Knowledge, Part 4 · Start with Part 1

“He who acts in N plays to make his mean log of wealth as big as it can be made will, with odds that go to one as N soars, beat me who acts to meet my own tastes for risk.”

That’s Paul Samuelson, writing in one-syllable words. The title of his 1979 paper: “Why We Should Not Make Mean Log of Wealth Big Though Years to Act Are Long.” Published in the Journal of Banking & Finance, a journal not typically known for its prose style. The playfulness of the writing masks the seriousness of the dispute underneath: a disagreement about the foundations of position sizing that remains unresolved half a century later.

In Part 3 I described how to assess whether the other side of a trade knows something you don’t. But even if you’re confident you’re in Box D or Box F (shared uncertainty or shared ignorance, where neither side has an information edge), you still need to decide how much capital to commit. And in a UU world, the most famous formula for answering that question stops working.

What Kelly actually says

J.L. Kelly Jr. (1956) was a physicist at Bell Labs, not a finance researcher. His paper, “A New Interpretation of Information Rate,” was about communication channels, not portfolios. The insight was a connection between Shannon’s information theory and gambling: the maximum exponential growth rate of a gambler’s capital equals the rate of information transmission over a noisy channel.

The formula itself is simple. For a binary bet with probability p of winning and odds of b to 1, the optimal fraction of your bankroll to wager is f = (bp - q) / b, where q = 1 - p. If you have a 60% chance of winning an even-money bet, Kelly says invest 20% of your capital. The appeal is a mathematical proof: given sufficient repetitions, a Kelly bettor will, with probability approaching one, end up wealthier than anyone using any other fixed-fraction strategy. It maximizes the geometric growth rate of the portfolio, which is the growth rate that actually compounds over time.

Ed Thorp was the first to take this seriously as an investment principle. He used it to beat blackjack (documented in Beat the Dealer, 1962), then applied it to warrant pricing and convertible arbitrage through his hedge fund, Princeton Newport Partners, which returned roughly 15% annually with minimal drawdowns over two decades. Elwyn Berlekamp, Kelly’s research assistant at Bell Labs, later became the key figure who restructured Renaissance Technologies’ Medallion Fund in 1989, applying Kelly-based position sizing to thousands of short-duration trades. Medallion returned roughly 66% annually before fees from 1988 through 2021. Bill Gross used Kelly-adjacent thinking at PIMCO. The framework has serious practitioners with serious track records.

What Samuelson actually objected to

Samuelson’s critique is often misunderstood as “Kelly doesn’t work.” That’s not what he said. What he said is more precise and more interesting.

Kelly maximizes the expected logarithm of wealth. This is only optimal if your utility function is logarithmic. Log utility means you are exactly indifferent between the status quo and an even-money bet that would either double or halve your total wealth. Most people would not take that bet. If you are more risk-averse than log utility implies (and most human beings are), Kelly systematically overbets, exposing you to drawdowns that are mathematically acceptable but psychologically devastating. If you are less risk-averse (say, risk-neutral), Kelly underbets: a risk-neutral investor should go all-in on every positive expected value opportunity.

Underneath the math, Kelly and Samuelson are arguing about something more basic. Kelly treats position sizing as a mathematical optimization problem with a unique solution. Samuelson insists it is a preference problem with as many valid solutions as there are utility functions. Both are correct within their own frameworks. The dispute is about which framework applies. And because the answer depends on the investor’s risk preferences, which are not observable from the outside and may not even be stable over time, the dispute is in principle unresolvable.

Practitioners tend to resolve it pragmatically. Most Kelly users bet “half Kelly” or “quarter Kelly,” sacrificing some expected growth for lower variance. There’s also a second reason for fractional Kelly that has nothing to do with utility: estimation error. The formula is exquisitely sensitive to how accurately you’ve estimated p, and overestimating your edge by even a few percentage points pushes you past optimal into a regime that destroys capital over time. Half Kelly is partly a hedge against your own overconfidence in the inputs. This works in practice, but it concedes Samuelson’s point: the “optimal” fraction depends on your tolerance for pain and the precision of your estimates, not just on the mathematics of compound growth. The formula provides a ceiling, not a prescription.

Why the debate is beside the point in UU

Here is where both Kelly and Samuelson run into the same wall.

Kelly requires p (the probability of winning) and b (the payoff ratio). Samuelson’s alternative utility-maximization frameworks require the same inputs, or richer ones: full probability distributions over outcomes. Every formal system for position sizing assumes you can parameterize your uncertainty. In the ignorance box, as defined in Part 1, you can’t. The parameters themselves are objects of ignorance. p is not an imprecise estimate waiting for better data. It is undefined, because the state space over which p would be calculated hasn’t been enumerated. This is the territory Knight called true uncertainty, distinguishing it from measurable risk a century ago, and it is where every formal position-sizing tool stops working at the same time.

Zeckhauser walks through five reasons UU money management resists formal modelling, and each one breaks a different standard assumption.

Most UU investments are illiquid for unknown periods. You can’t rebalance, which means sequential portfolio optimization models don’t apply. Worse, markets charge enormous premiums to cash out illiquid assets, so your exit price is not your mark-to-market. Even the toy models of optimal sequential investment assume the hard problems away: known probabilities, known time horizons, known liquidity. There’s also the embarrassing fact that smart people disagree about position sizing even on problems where probabilities are known, which gives you no reason to expect convergence when they aren’t. And when genuinely unknowable events arrive (the 1987 crash, the 1997 Asian crisis, the 2020 pandemic), the money-management problems that emerge are precisely the ones no model anticipated.

None of this means do nothing. It means formula-based precision is unavailable and pretending otherwise is dangerous. Plugging estimated probabilities into Kelly when the estimates are themselves wild guesses doesn’t give you a rigorous answer with a known error bar. It gives you false precision, which is worse than an honest admission of ignorance because it generates unwarranted confidence in the position size.

Diversification versus concentration

Standard portfolio theory says: diversify. Spread capital across uncorrelated assets to minimize idiosyncratic risk. In the risk box (Box 1 from Part 1), where expected returns and covariance matrices are estimable, this is correct. The marginal expected return on each position is similar, and diversification is free insurance.

In the ignorance box, this logic inverts. If you’ve identified one or two opportunities in Zeckhauser’s Box D or Box F, the quadrants from Part 3 where neither side has an information edge, and you have a genuine advantage from complementary skills, constraint arbitrage, or structural access, spreading capital evenly across a dozen positions dilutes the few bets where your advantage is real. Zeckhauser makes this point sharply: investors routinely allocate almost the same percentage to an investment where they expect a 30% return as to one where they expect 10%. Consider the SaaSpocalypse: the IGV at $80 with an RSI of 18 and 17% sector earnings growth was, on the framework, a Box F opportunity with a large absolute advantage for anyone with a multi-year time horizon. The Maxim B response would be to concentrate, not diversify. Most institutional investors did the opposite.

Buffett’s practice reflects this. Berkshire Hathaway’s top five holdings routinely exceed 70% of its equity portfolio. This is Kelly-adjacent thinking: bet big when your edge is big. But it operates without the false precision of computing a Kelly fraction, because Buffett doesn’t pretend to know his probability of winning to two decimal places. He knows the price is low relative to his assessment of value, his time horizon exceeds the market’s, and the business is durable enough to survive things he can’t foresee. The probability distribution of outcomes is not something he claims to have, and he doesn’t pretend otherwise.

Zeckhauser uses a bridge analogy that I think captures this well. A bridge player makes hundreds of decisions in a single session, balancing expected gains and losses on every hand. But no serious bridge player computes Kelly fractions mid-hand. They develop judgment over thousands of hands about when to bid aggressively and when to pass. The judgment is trained by feedback, but the individual decision is not a calculation. It’s pattern recognition combined with temperament, a sense of when the odds are tilted enough to justify the risk.

This is where Maxim B does its work: “The greater is your expected return, the larger your advantage, the greater the percentage of your capital you should put at risk.” It sounds obvious. Read it again. In a world where position sizing formulas require inputs you don’t have, Maxim B is the honest replacement: a heuristic that says “bet proportionally to your edge,” without pretending to quantify the edge precisely. Combine it with Zeckhauser’s diagnostic, and you get the closest thing to a position sizing framework that works in UU: “If in an unknowable world none of your investments looks foolish after the fact, you are staying too far away from the unknowable.”

I find that diagnostic unsettling in the right way. It says that some of your bets should look bad. Not because you were wrong, but because the honest price of participation in UU markets is a portfolio that occasionally embarrasses you. If every position is defensible in hindsight, you’ve been too cautious. You’ve been optimizing for looking smart rather than for capturing the returns that only come to those willing to look foolish.

The first four parts of this series have addressed what you can know, what you can’t, how to assess what others know, and how much to bet. The final question is different, and less comfortable: when you profit from ignorance, from others’ institutional inability to act in UU situations, who exactly are you profiting from? That’s Part 5.

Do Not Disturb My Circles

me@philippdubach.com (Philipp D. Dubach) — Mon, 13 Apr 2026 00:00:00 +0200

If I’d had my way, we would have left it in the lab for longer and done more things like AlphaFold, maybe cured cancer or something like that.

That’s Demis Hassabis (I cannot recomend watching The Thinking Game enough and or read The Infinity Machine), the CEO of Google DeepMind and a Nobel Prize winner, describing the future he didn’t get.

He wanted a CERN for artificial intelligence. A decade or two of careful, methodical work. The world’s best scientists collaborating on each step toward general intelligence, understanding what they built before building the next thing. In the meantime, AI for science, narrow tools like AlphaFold, would ship real benefits: cures, new materials, maybe a crack at fusion. Not chatbots. He didn’t get that future. None of us did. Instead we got a commercial arms race, a $690 billion annual infrastructure buildout, and the greatest concentration of technical talent in human history pointed at making autocomplete better.

This is a story about capital misallocation. But it’s also a very old story.

Geometry in the sand

In 214 BC, the Roman general Marcellus brought a fleet to Syracuse. Standing between Rome and the richest city in Sicily was one man: Archimedes, the greatest scientist of the ancient world, a mathematician whose work on the lever, the screw, and the principles of buoyancy would outlast every empire he lived under.

Archimedes did not want to build weapons. Plutarch, writing in the Life of Marcellus, says Archimedes designed and contrived his machines “not as matters of any importance, but as mere amusements in geometry.” He regarded the whole business as ignoble, beneath the dignity of pure mathematics. But his patron King Hiero II needed defenses, and Archimedes was the only man who could provide them. So he built them. Catapults that could sink a ship at range. The Claw of Archimedes, an iron grappling device that could lift a Roman galley out of the water and drop it. Possibly parabolic mirrors that focused sunlight to set ships on fire, though historians still debate that one.

The machines worked. Plutarch writes that the Romans became so terrified that “whenever they saw a bit of rope or a stick of timber projecting over the wall, they cried ‘Archimedes is training some engine upon us,’ and turned their backs and fled.” They held off Rome for two years.

Then Syracuse fell anyway. In 212 BC, Roman soldiers breached the walls during a festival. A soldier found Archimedes drawing geometric figures in the sand. According to the tradition passed down through Valerius Maximus and others, his last words were “Noli turbare circulos meos”: do not disturb my circles.

Marcellus had ordered Archimedes taken alive. The order didn’t matter. The soldier killed him. The geometry died with him. The war machines, the things Archimedes considered beneath his real work, survived in military engineering textbooks for centuries. His mathematical treatises survived only by accident, through a single Byzantine manuscript scraped and overwritten with prayer texts in the 13th century.

I thought about this when I watched Demis Hassabis in a recent interview with Cleo Abram.

The conscription

He had been building learning systems at DeepMind for years. The work was pointed at science. AlphaFold was the first proof that AI could crack fundamental problems in biology. Move 37, AlphaGo’s famous creative play against Lee Sedol in 2016, was the proof that AI systems could discover things no human had considered.

Then ChatGPT happened. Google went code red. Hassabis, the man who wanted to solve protein folding and maybe crack fusion, became the man who runs all of Google’s AI, including the consumer products he’d never wanted to focus on.

He’s candid about what was lost:

My ideal was to approach the latter stages of building AGI using the scientific method, very carefully, very precisely, very thoughtfully, in a CERN-like way. That might take a decade, even two decades longer. But I think that would make sense given the enormity of what we’re dealing with.

And about the irony:

Language was a lot easier than we were all expecting. Even those of us who were obviously optimists about the whole technology. We thought maybe there would be one or two or three more breakthroughs needed. But it turned out transformers and some reinforcement learning on top was enough.

The ease of the advance was the thing that derailed the deeper work. Language models turned out to be good enough for consumer products, and consumer products generate revenue, and revenue attracts competition, and competition creates the arms race that now consumes everything. DeepMind had “fairly equivalent systems” to ChatGPT at the time, Hassabis says. They chose not to release them. That choice was taken from him.

What a dollar buys

The resource allocation case is simple enough to state in one line, though the implications are not.

AlphaFold 2 trained on 128 Google TPUv3 chips for approximately 11 days. At Google Cloud’s public pricing of roughly $32 per hour per TPU, the estimated training cost is somewhere under $1 million. It predicted the three-dimensional structures of 200 million proteins. Over 3 million scientists now use it. A pharma executive told Hassabis that “almost every drug developed from now on will have probably used AlphaFold in its process.”

Now the other side of the ledger. GPT-4’s training cost an estimated $78 million. Gemini Ultra ran to roughly $191 million. OpenAI’s Orion exceeded $500 million for a single training run, and the model was so disappointing they downgraded it from GPT-5 to GPT-4.5. OpenAI’s inference spending alone, just the cost of running the models after training, hit $2.3 billion in 2024. That is 15 times what they spent training GPT-4.5.

AlphaFold cost less to train than OpenAI spends on inference in a single day.

Zoom out further. The Big 4 hyperscalers, Amazon, Alphabet, Meta, Microsoft, are guiding to $610-665 billion in capital expenditure for 2026. Goldman Sachs projects cumulative 2025-2027 spending at $1.15 trillion. As I noted in Peter Thiel’s Physics Department, Big Tech spends 75 times more on AI than the entire US federal science budget: $250 billion versus $3.3 billion per year. The DOE Genesis Mission, the flagship US government program for AI-driven scientific discovery, received $320 million in its first round. That is less than Meta spends on AI infrastructure in a single week.

The infrastructure being built is not for protein folding. It is not for materials science or fusion plasma control or genomics. It is for chatbots, image generators, and coding assistants. Sequoia’s David Cahn calculated the AI ecosystem needs $600 billion in annual revenue to justify current infrastructure spending. It generates perhaps $80-120 billion. And nearly all of that revenue comes from commercial applications: subscriptions, API access, enterprise contracts for systems that summarize emails and draft marketing copy.

The bottleneck for AI for science was never money. AlphaFold proved that. It was always about who works on what, and the chatbot economy answered that question for an entire generation of researchers.

What the circles produced

When Hassabis’s teams were allowed to focus on science, when the circles were left undisturbed, this is what happened.

In The Thinking Game there’s a moment that captures it perfectly. The original plan for AlphaFold was conventional: build a server, let scientists submit protein sequences one at a time, email back the predicted structures. Standard approach, used by the whole field for 40 years. Then Hassabis started doing arithmetic on his phone in the middle of the meeting. Two hundred million known proteins. One fold every ten seconds. How many TPUs do we have? He looked up and said something like, “Why don’t we just fold everything?”

It would be, he realized, actually less work than building the server.

So they folded everything. AlphaFold predicted the structures of 200 million proteins and put them in a free database. The nuclear pore complex, one of the largest and most important proteins in the body, a donut-shaped gateway that controls nutrient flow in and out of the cell nucleus, was solved within months of AlphaFold’s release. Researchers working on neglected diseases, malaria, Chagas, leishmaniasis, diseases that affect hundreds of millions of people but attract little pharma funding, now get protein structures for free. Plant scientists working on climate-resilient crops can skip years of crystallography and go straight to the biology.

Isomorphic Labs, the DeepMind spinoff, is running 18-19 drug programs across cardiovascular disease, cancer, and immunology. IsoDDE, its drug design engine, hits 50% on the hardest protein-ligand benchmarks versus 23% for AlphaFold 3. AlphaGenome is decoding the 98% of the human genome that doesn’t code for proteins, the part where most disease-causing mutations hide. Jennifer Doudna, the CRISPR pioneer, asked Hassabis directly about combining AlphaGenome with CRISPR to identify and fix the exact genetic changes causing disease. His answer: “Still not probably good enough yet. But you can imagine a future version.”

AlphaEvolve found a 23% speedup inside Gemini’s own architecture, recovering 0.7% of Google’s total compute. DeepMind’s fusion work controlled plasma autonomously in a real tokamak. GNoME identified 2.2 million new crystal structures, equivalent to roughly 800 years of prior human discovery in materials science.

All of this on a fraction of the compute that powers the chatbot economy. I keep coming back to this: the entire portfolio of DeepMind’s scientific work, the Nobel Prize, the drug programs, the materials, the fusion experiments, consumed less compute than a single frontier chatbot burns through in inference costs per quarter.

The case for the war machines

I want to present the counterargument honestly, because it’s not trivial.

The commercial race funded a compute buildout that wouldn’t exist without chatbot demand. $690 billion in 2026 capex built data centers that can, in principle, be repurposed for scientific workloads. The talent pipeline expanded: a generation of ML engineers entered the field because consumer AI products made it exciting and lucrative. Millions of users stress-tested these models in ways internal testing never could, revealing failure modes and edge cases that improve the underlying systems. Hassabis himself acknowledges this. In the HUGE* interview he listed the benefits: “lightning speed” progress, democratized access to cutting-edge AI “perhaps only 3 to 6 months behind what is actually in the labs,” and societal normalization that prepares people for bigger changes ahead.

And there’s the funding argument. Google’s $132 billion in net income funds DeepMind. Gemini’s commercial revenue helps justify the research budget. Without the chatbot economy, would Alphabet spend billions on AI research at all?

The strongest version of this argument goes: you can’t have the cathedral without the wool merchants. Bell Labs needed AT&T’s monopoly revenue. The Apollo program needed Cold War spending. Scientific breakthroughs don’t fund themselves. The commercial race, ugly as it is, is the mechanism that makes the science possible.

Why the steelman breaks

I’ve thought about this for a while, and I think it’s wrong.

Start with the compute argument. The infrastructure being built is overwhelmingly inference infrastructure: data centers optimized for running chatbot queries at scale, not for training scientific models. AlphaFold trains on 128 TPUs. It doesn’t need a $75 billion annual capex program. The buildout serves commercial demand. Calling it a foundation for scientific AI is like calling a shopping mall a foundation for particle physics because they both use electricity.

The talent argument has the same problem. The pipeline filled, but it filled with the wrong skills and pointed in the wrong direction. Stanford HAI’s 2025 AI Index found that 70% of AI PhDs took private sector jobs in 2023, up from roughly 20% two decades ago. Bruce Schneier wrote in Nature that the exodus threatens “innovation driven by curiosity rather than profit.” The ML engineers entering the field are optimizing RLHF, fine-tuning chat models, building prompt engineering toolchains, and competing on Chatbot Arena leaderboards. These are not the skills that fold proteins or control plasma. The talent that cracks drug discovery needs computational chemistry, molecular dynamics, quantum mechanics. The talent attracted by the chatbot boom is, for the most part, not that talent.

The stress-testing argument is real but narrow. Millions of users proved that language models can summarize documents and brainstorm ideas. That tells you nothing about whether they can predict which genetic mutations cause disease. The applications share a model architecture but almost nothing else.

And the funding argument, the one that seems hardest to dismiss, actually argues the opposite of what its proponents think. The best historical parallel is Bell Labs. Founded in 1925 as the research arm of AT&T’s regulated telephone monopoly, Bell Labs produced the transistor, the laser, Unix, the C programming language, information theory, and the discovery of cosmic microwave background radiation. Ten Nobel Prizes. Five Turing Awards. Brian Potter in Construction Physics calls the conditions “unrepeatable”: a vertically integrated monopoly that could afford to fund research with no immediate commercial return.

Then AT&T was broken up in 1984. Commercial competition arrived. What happened next is instructive: the research workforce dropped from roughly 1,300 to 500 by 2002. Only one post-divestiture employee won a Nobel Prize. Bell Labs was passed from AT&T to Lucent to Alcatel to Nokia, each owner less interested in fundamental research than the last. By 2008, four physicists remained in basic research. By 2016, what had been the most productive research institution in human history was a division of a Finnish telecom company.

The irony is precise: the people who argue that commercial pressure funds great science are citing a lab that produced its greatest work under monopoly protection from commercial pressure, and died the moment that protection was removed.

Hassabis’s vision, the CERN model, is the Bell Labs model. Let fundamental research breathe. Shield it from quarterly earnings. Fund it with patient capital. He had that at DeepMind, funded by Google’s search advertising monopoly, insulated from product deadlines, free to spend six years building AlphaGo before it produced a single dollar of revenue. Then the commercial race consumed the insulation.

The funding was already there. What he lost was the institutional focus.

The circles

Archimedes held off Rome for two years. Then the soldier came. The war machines didn’t save Syracuse. They bought time, and that time ran out.

I don’t think the chatbot era saved AI for science. I think it ate the oxygen. The talent went to RLHF optimization. The compute went to inference farms. The institutional attention went to quarterly product launches. Hassabis is now simultaneously building the war machines and drawing the circles: running Gemini and funding Isomorphic, shipping chatbots and folding proteins. That he manages both is remarkable. But it’s a compromise, and the compromise has a cost measured in drug programs that don’t exist, diseases that aren’t being studied, materials that haven’t been found.

The question is not whether chatbots are useful. They are. I use them constantly. The question is whether future historians will look at 2023-2026 and see a period when the most capable scientific tool in human history was mostly pointed at drafting emails and generating stock photos, and wonder what we were thinking. The way we look at that Roman soldier: someone who destroyed something more valuable than he could understand.

In the interview, Hassabis is asked what he would want said at his funeral. His answer was immediate:

I would hope that they would say that my life was of benefit and service to humanity.

The circles are still there, drawn in the sand between product launches.

The Geometry of Who Knows What

me@philippdubach.com (Philipp D. Dubach) — Mon, 13 Apr 2026 00:00:00 +0200

Investing at the Edge of Knowledge, Part 3 · Start with Part 1

“One of these days in your travels, a guy is going to show you a brand-new deck of cards on which the seal is not yet broken. Then this guy is going to offer to bet you that he can make the jack of spades jump out of this brand-new deck of cards and squirt cider in your ear. But, son, you do not accept this bet, because as sure as you stand there, you’re going to wind up with an ear full of cider.”

Zeckhauser opens his 2006 paper with this advice from Sky Masterson’s father in Guys and Dolls. The lesson is as old as markets: if someone offers you a bet where they seem to know something you don’t, they probably do. Don’t take that bet.

But Zeckhauser’s point isn’t the lesson. It’s the exception. What happens when nobody has the marked deck? When the ambiguity is shared, when neither side can enumerate the states of the world, the Sky Masterson rule stops applying, and the investors who keep following it anyway leave money on the table.

In Part 1 I laid out Zeckhauser’s taxonomy: risk, uncertainty, and ignorance as three distinct problems. In Part 2 I examined why investors flee the third box, the mechanism of ambiguity aversion. This piece asks the question that follows: when you’re facing someone on the other side of a trade, how do you figure out whether they know something you don’t?

The two matrices

Zeckhauser draws two matrices that I think are the most underappreciated diagrams in the paper.

The first covers investing under uncertainty, where the possible states are known but probabilities are hard. It’s a 2x2: Easy or Hard for You to Estimate Value crossed with Easy or Hard for Others. Box A (easy for both) is the standard competitive market: lots of participants, tight spreads, no edge for anyone. Box B (easy for you, hard for others) is where you’re the informed party: think a biotech scientist evaluating a drug trial readout. Box C (hard for you, easy for others) is the danger zone, the other side has the marked deck, and the Sky Masterson rule applies in full. Box D (hard for both) is where it gets interesting. Neither side has an information advantage. Both are operating under genuine uncertainty. Buffett’s earthquake reinsurance sits here.

The second matrix covers investing under ignorance, where even the possible states are unknown. It’s simpler: a 2x1. Unknown to You and Known to Others (Box E) versus Unknown to You and Unknown to Others (Box F). Box E is dangerous. Box F is opportunity.

The point most people miss is about misidentification. Most investors assume they’re in Box C or Box E: the other side knows more. This assumption is the legacy of standard information asymmetry models in finance, where Akerlof’s lemons problem (1970) and the Glosten-Milgrom bid-ask spread model (1985) trained a generation to worry about adverse selection. Those worries are justified in Boxes A through C and in Box E. But in Box D and Box F, you’re not facing an informed counterparty. You’re facing someone equally confused, or someone who has left the market entirely because they can’t tolerate the confusion.

Bazerman and Samuelson (1983) showed that even in clean experimental settings, people are terrible at accounting for why the other side is willing to trade. Their winner’s curse experiments found that bidders consistently failed to discount for the fact that winning an auction is bad news about your estimate’s accuracy. In a UU world, this failure compounds. You can’t compute the conditional expectation of the asset’s value given that the other side is selling, because neither of you can define the state space over which that expectation would be calculated.

The practical question is always: am I in Box C or Box D? Am I in Box E or Box F? And the answer is almost never available from the data. It’s a judgment call, informed by what you know about the seller’s constraints, their institutional context, and whether the source of the ambiguity is private or shared.

Institutional blindness as structural opportunity

The California Earthquake Authority story is Zeckhauser’s best illustration, and it deserves the full telling.

In the late 1990s, California needed reinsurance for earthquake risk. The authority offered a $1 billion slice at premiums that worked out to roughly five times actuarial value. Wall Street said no. Not because investment banks thought the Earthquake Authority possessed secret seismological knowledge. Nobody has an informational edge over the reinsurer when it comes to tectonic plate movement. The ambiguity was shared: Box F.

Wall Street said no because their internal processes required probability estimates that didn’t exist. Compliance teams required distributional assumptions about tail risk that nobody could provide. Risk models required defined scenarios, and “catastrophic earthquake in the next 12 months” didn’t fit neatly into any existing framework. The honest assessment, “we have no idea about the probability, but the price is very high,” didn’t fit the form. Buffett took the entire slice.

This is Zeckhauser’s Maxim H: “Do not engage in the heuristic reasoning that just because you do not know the risk, others do.” The Wall Street banks weren’t outcompeted by someone with better information. They were outcompeted by someone with fewer institutional constraints. Buffett could hold a position that was impossible to model because he answered to shareholders who trusted his judgment, not to compliance officers who required his models.

Generalize this, and you get a structural feature of UU markets that doesn’t go away. Fiduciary duty requires estimable risk. Compliance models require defined scenarios. Career risk creates what Zeckhauser calls Monday Morning Quarterback (MMQ) risk: the danger that a bad outcome on a good decision destroys your reputation. Professional investors face a permanent bias toward the risk box (known probabilities) and away from the ignorance box (unknown states). This isn’t a market inefficiency waiting to be arbitraged. It’s an institutional constant. And it creates a permanent supply of mispriced assets for those without the same constraints.

Aumann (1976) proved that rational agents with common priors who share their posterior beliefs must converge: they cannot “agree to disagree.” The theorem is elegant and, in UU markets, irrelevant. Aumann assumes common priors and known state spaces. In Box 3, both assumptions fail. The state space is undefined, so there are no common priors to start from. Disagreement in UU isn’t a puzzle to be resolved by more information exchange. It’s the default condition. Two equally rational investors can look at the same situation and reach opposite conclusions without either one being wrong, because they’re not disagreeing about probabilities. They’re disagreeing about what world they’re in.

The advantage-versus-selection formula

Zeckhauser offers a framework for deciding when to invest despite potential adverse selection. Your expected return depends on three things: your absolute advantage (a), the probability the other side is better informed (p), and the selection factor (s), how much their information hurts you. Invest when the combination exceeds the cost of entry.

The formula matters less than the logic behind it. A large absolute advantage provides insurance against adverse selection. Zeckhauser’s Maxim E: “A significant absolute advantage offers some protection against potential selection.”

What counts as absolute advantage? Complementary skills are the classic answer: the real estate developer who creates value a passive investor cannot, the venture capitalist whose operational expertise and network make the company worth more than the sum of its capital. Their return isn’t compensation for bearing risk. It’s a share of value they helped create. Sidecar investors, Zeckhauser’s term for those who invest alongside skilled operators, earn excess returns because access to these deals is limited and the value creation is real.

But complementary skills aren’t the only form of advantage. In the SaaSpocalypse, the “absolute advantage” for a buyer at IGV $80 was time horizon. If you could hold for three to five years, tolerate the MMQ risk of further drawdowns, and ignore the career consequences of looking wrong for a few quarters, you had a structural edge over institutional sellers who couldn’t do the same. That’s not analytical skill. It’s constraint arbitrage. And constraint arbitrage is a legitimate form of absolute advantage, because fiduciary requirements and career incentives are structural features that won’t disappear next quarter.

Larry Summers (2006) raises the obvious objection to the sidecar concept: “identifying skilled UU managers may be no easier than picking market-beating investments directly.” The sidecar doesn’t solve the epistemological problem. It relocates it from asset selection to manager selection. How do you know the driver is skilled rather than lucky?

Richard Robb (2006) pushes further. He argues that UU knowledge is “uncommunicable.” If a mechanism for generating excess returns could be expressed as a process, someone would have arbitraged it away. Ricardo, on the eve of Waterloo, might have said “British Government bonds offer a high reward for the risk.” But what would it look like for that statement to be proven false? The claim is unfalsifiable because it lives in the ignorance box where probability statements don’t have clear empirical content. If the sidecar driver can’t explain their edge in terms you can evaluate, how do you distinguish skill from survivorship bias?

I think both objections are correct and both miss something. They’re correct that sidecar investing doesn’t eliminate the evaluation problem. But they miss that the evaluation problem has different difficulty levels depending on context. Evaluating whether a real estate developer can build and lease a building is easier than evaluating whether a macro hedge fund can predict interest rates. Evaluating whether Buffett’s insurance math is sound is easier than evaluating whether a biotech startup’s drug candidate works. The sidecar concept isn’t “trust someone blindly.” It’s “invest alongside someone whose edge you can partly verify, in situations where your own analytical advantage is zero.”

Knowing the geometry of who-knows-what is necessary but not sufficient. You’ve identified a Box D or Box F opportunity. You’ve assessed your absolute advantage. You’ve decided the other side isn’t better informed. Now you need to decide how much to bet. In a UU world, the most famous formula for position sizing, the Kelly Criterion, breaks down in the ways you’d expect. That’s Part 4.

Why Lilly's Weight Loss Pill Isn't a Peptide

me@philippdubach.com (Philipp D. Dubach) — Thu, 09 Apr 2026 00:00:00 +0200

Novo Nordisk spent decades and $1.8 billion learning how to get a peptide past the gut. Eli Lilly looked at the same problem and decided to skip it entirely.

Your gastrointestinal tract is a 30-foot disassembly line for proteins. Acid denatures them, pepsin cleaves them, trypsin finishes the job, and the mucus layer blocks whatever survives. Sean Geiger’s excellent history of oral peptides traces the full arc: the first attempt at oral insulin was in 1922. Over a hundred years and thirteen companies later, no oral insulin exists.

Novo Nordisk spent decades and $1.8 billion acquiring the technology to get around this problem. The result, approved in December 2025 as oral Wegovy for obesity, is a pill that destroys 99% of its own active ingredient before the remaining fraction reaches the bloodstream. The oral 25mg daily dose uses roughly 280x more semaglutide than the equivalent weekly injection. This is the best that peptide oral delivery can do. Eli Lilly decided to skip it entirely, building Foundayo, a small molecule oral obesity drug that isn’t a peptide at all. That divergence in approach will determine who captures the majority of a market that Goldman Sachs projects at $100+ billion by 2030 and that J.P. Morgan estimates will reach 30 million US users within five years.

Oral semaglutide

Sean Geiger’s history of oral peptides traces the science well. The technology that makes oral semaglutide possible is SNAC (salcaprozate sodium), a permeation enhancer developed by Emisphere Technologies starting in the 1990s. Novo partnered with Emisphere in 2007 and acquired the company outright in 2020. SNAC does three things simultaneously: it buffers local stomach pH to suppress pepsin, prevents semaglutide from clumping into inactive oligomers, and temporarily fluidizes gastric cell membranes so the drug can cross. The EMA’s public assessment report puts the resulting bioavailability at roughly 0.4 to 1%. The FDA label confirms: the vast majority of each dose is destroyed.

This creates a problem that’s easy to state and hard to solve. If you need 280x more API per equivalent dose, your manufacturing cost structure looks nothing like the injectable. A Yale/King’s College study published in JAMA found injectable semaglutide costs $0.89 to $4.73 per month to manufacture at the API level. Scale that by 280x and you get oral API costs somewhere in the range of $770 to $1,460 per year, according to The Medicine Maker’s January 2026 analysis. Still below the selling price. But the margin compression is real, and SNAC itself is a costly excipient.

SNAC is also oddly specific. Geiger notes that Novo tried it with liraglutide, a closely related GLP-1 analog, and it failed because liraglutide forms oligomers that SNAC can’t break apart. After over three decades of work, exactly two FDA-approved oral peptide drugs using permeation enhancers exist: Rybelsus/oral Wegovy (SNAC) and Mycapssa (oral octreotide for acromegaly, a different enhancer called TPE). That’s the entire commercial output of the field.

Foundayo: Lilly’s structural advantage

Eli Lilly’s orforglipron, approved by the FDA on April 1, 2026 under the brand name Foundayo, is not an oral peptide. It’s a non-peptide small molecule GLP-1 receptor agonist that activates the same receptor through a different mechanism. Discovered by Chugai Pharmaceutical and licensed by Lilly in 2018, orforglipron requires no SNAC, no fasting window, no cold chain storage, and is manufactured through standard chemical synthesis rather than solid-phase peptide synthesis. The bioavailability problem doesn’t apply because the molecule was designed from the ground up to survive the gut.

The clinical data backs this up. In ACHIEVE-3 (1,698 patients with type 2 diabetes, 52 weeks), orforglipron at 12mg and 36mg was superior to oral semaglutide on both HbA1c reduction and weight loss: the first head-to-head victory over Novo’s oral product. In ATTAIN-2 (obesity with type 2 diabetes), orforglipron delivered 10.5% weight loss at 72 weeks versus 2.2% on placebo. And in ATTAIN-MAINTAIN, patients who switched from injectable Wegovy or Mounjaro to oral orforglipron maintained their weight within 0.9 kg over 52 weeks. A pill that holds the gains of an injection.

Lilly submitted the NDA with a priority review voucher and received FDA approval on April 1, 2026, the fastest approval of a new molecular entity since 2002. Foundayo is available starting at $149 per month for self-pay patients, with savings card prices as low as $25 per month. The company is investing $6.5 billion in a dedicated oral manufacturing facility and $27 billion total in US manufacturing capacity.

$70 billion duopoly and its widening crack

The gap is widening. Combined GLP-1 revenue from Novo and Lilly hit roughly $70 billion in 2025. But the composition shifted. Lilly’s tirzepatide franchise (Mounjaro plus Zepbound) generated $36.5 billion, with Zepbound alone growing 175% year-over-year. Novo’s semaglutide franchise came in around $33 billion, with growth decelerating to roughly 10% in constant exchange rates. Lilly’s US market share hit 57% by mid-2025, up from 41% a year earlier. Novo’s share fell to 43%.

The stock market has been ruthless in pricing this shift. Novo trades at roughly $48 per ADR share, down 65% from its June 2024 peak of $142, a loss exceeding $350 billion in market cap. The company guided for a 5 to 13% revenue decline in 2026, driven by patent expirations in Canada, Brazil, and China, plus pricing pressure from the Trump administration’s drug pricing framework. CagriSema, Novo’s most important pipeline asset, disappointed twice: 22.7% weight loss in REDEFINE 1 (below the company’s own 25% guidance) and 15.7% in REDEFINE 2. Novo’s stock plunged 20% on the first readout alone.

Lilly, by contrast, guided 2026 revenue at $80 to $83 billion, a 25% increase, and trades near $1,044 with a market cap around $1 trillion, the first pharma company to reach that level. Forward P/E: roughly 30x versus Novo’s 12.5x. That 2.4x valuation premium reflects a simple thesis: Lilly has the better drug (Zepbound showed 47% greater weight loss than Wegovy in the SURMOUNT-5 head-to-head), the better oral pipeline, and the longer patent runway (tirzepatide patents extend into the mid-2030s versus semaglutide’s core US patent expiring December 2031, with biosimilar competition likely following shortly after).

The Hims & Hers saga sits at the chaotic edge of all this. HIMS launched a $49 per month compounded oral semaglutide pill on February 5, 2026, using a liposomal formulation for which limited public bioavailability data has been released. Within four days, HHS had referred the company to the DOJ, Novo had filed a patent infringement lawsuit, and HIMS had suspended the product. Novo Nordisk has alleged, in filings related to its litigation, elevated impurity levels in compounded samples — the underlying allegation is contested and the case is unresolved, and the figure should not be read as established fact. The episode illustrates what happens when the incentive to undercut $1,000-per-month pricing collides with the engineering difficulty of making peptide drugs work orally.

Does Oral Delivery Commoditize GLP-1

Does oral delivery commoditize GLP-1s, or does it expand the market so dramatically that even with pricing pressure, the opportunity grows Early evidence already supports the expansion thesis: Novo’s oral Wegovy pill uptake is running roughly 10x higher than the original injectable Wegovy launch, drawing in new patients rather than converting existing injection users.

The statin precedent is the strongest data point we have. After generic atorvastatin launched in 2011, total statin use expanded from 31 million to 92 million Americans by 2019, a 197% increase. Total prescription volume grew 77%. The per-unit price collapsed, but total market volume more than compensated. Updated clinical guidelines, lower copays, and reduced patient resistance combined to pull in millions of people who would never have started therapy at the original price and delivery format.

Current penetration is absurdly low: fewer than 5% of eligible US adults are on anti-obesity medication therapy, against 104 million with obesity. At statin-like penetration rates of 35% or higher, that’s a 5 to 10x expansion. Persistence data reinforces the point: only 32% of obesity patients persist at one year and 15% at two years. Side effects account for 43.7% of discontinuation, financial barriers for 30.9%. Adherence collapses when the friction is high. An oral weight loss pill that’s cheaper, eliminates the injection barrier, and has no fasting restrictions (orforglipron) attacks all three.

Oral GLP-1 pipeline

The rest of the oral GLP-1 pipeline is worth tracking but the outcomes are uncertain. Viking’s oral VK2735 showed rapid weight loss in Phase 2 (up to 12.2% at 13 weeks) but a 38% discontinuation rate at the highest dose sent the stock down 37%. Structure Therapeutics’ aleniglipron posted 15.3% placebo-adjusted weight loss at 36 weeks in Phase 2b, competitive numbers with no plateau, and has $786 million in cash to fund Phase 3. Pfizer’s danuglipron was killed by liver toxicity in April 2025, the second Pfizer oral GLP-1 failure. Terns Pharmaceuticals also exited after weak Phase 2 data and liver enzyme elevations. Behind them, Novo’s oral amycretin, a GLP-1/amylin dual agonist, enters Phase 3 in 2026 and could offer best-in-class weight loss if the oral formulation holds up. Oral small molecule GLP-1 development has a meaningful failure rate, and Foundayo’s clean safety profile across multiple Phase 3 trials is not something I’d assume the next entrant can replicate.

The thing that makes this market interesting is that almost every important variable is in motion at the same time: form factor (injection to pill), pricing structure ($1,000 per month to $149 and potentially lower), patent protection (expiring internationally, holding domestically), competitive dynamics (Novo growth decelerating per its own guidance, Lilly’s Foundayo launching, the compounding-pharmacy retreat after the Hims episode), and the macro question of Medicare coverage. The structural thesis — that oral GLP-1s expand total market volume through a Jevons-like dynamic — is more confident than any view on individual stock entry points.

At roughly 30x forward earnings for Lilly and 12.5x for Novo per recent multiples, the market is pricing in very different forward trajectories for the two companies. Which framing turns out to be right depends on what the head-to-head readouts and the orforglipron launch curve actually show in 2026 and 2027.

Ambiguity by Design

me@philippdubach.com (Philipp D. Dubach) — Wed, 08 Apr 2026 00:00:00 +0200

Investing at the Edge of Knowledge, Part 2 · Start with Part 1

Ellsberg’s urn experiment is one of the cleanest results in decision theory. Daniel Ellsberg (1961) put two urns in front of subjects. Urn A: 50 red balls, 50 black. Urn B: 100 balls, red and black, ratio unknown. Pay $100 if you draw the right color. Most people chose Urn A, the known 50/50 bet. Fine so far. But here’s the problem: they chose Urn A regardless of which color they were betting on. Bet on red? Prefer Urn A. Bet on black? Still prefer Urn A. This is incoherent. If you think Urn B has fewer red balls (making you avoid it for a red bet), you should prefer it for a black bet. The subjects weren’t estimating probabilities at all. They were fleeing the feeling of not knowing the probability. Ellsberg proved that people make systematically different choices when probabilities are unknown versus known, even when the unknown probabilities carry no actual informational disadvantage. Richard Zeckhauser’s contribution was to ask

What happens to prices when an entire market makes this choice simultaneously?

The experimental evidence

Ellsberg’s result spawned a body of work that, six decades later, has only strengthened the original finding. Fox and Tversky (1995) added a twist that matters enormously for financial markets. Their “comparative ignorance hypothesis” showed that ambiguity aversion intensifies when people can compare themselves to someone who appears more knowledgeable. In a non-comparative setting, where subjects evaluated an ambiguous bet in isolation, ambiguity aversion largely disappeared. But the moment subjects could compare their knowledge to someone else’s, the aversion came roaring back.

In markets, there is always someone who appears more confident. Every sell-side note, every CNBC segment, every hedge fund manager interviewed at Davos projects certainty that you don’t feel. The comparative ignorance effect is permanently activated in financial markets. You don’t just feel uncertain. You feel uncertain relative to someone who seems to know, and the gap between their apparent confidence and your honest confusion is what drives the exit decision.

Zeckhauser’s own experimental evidence in the 2006 paper extends this further. He ran lottery choice experiments comparing willingness to bet on standard probabilistic gambles versus events with unknown and unknowable (UU) outcomes (to familiarize yourself with this framework start with Part 1.) People refused to distinguish between small probabilities of UU events even when the expected value difference was large. The feeling of not-knowing overwhelmed the arithmetic of expected value. Separately, he documented that individuals explicitly warned about overconfidence are still surprised 35% of the time on quantities where they should be surprised only 2% of the time. We simultaneously know less than we think (overconfidence) and refuse to act on what we do know when probabilities are ambiguous (ambiguity aversion).

Is ambiguity aversion rational?

This turns out to be a harder question than it looks, and the answer matters for how you think about the mispricing mechanism. The case for “yes, it’s rational” is surprisingly strong. Gilboa and Schmeidler (1989) proved that a decision maker who evaluates bets by the worst-case probability in their set of plausible priors is behaving in a way that satisfies all the standard axioms of rational choice except one: the Sure-Thing Principle that Ellsberg’s experiment violates. Their maxmin expected utility model says: if you don’t know the probability, evaluate the bet as if the probability is the worst one consistent with your information. This is formally coherent. It’s also roughly what a good risk manager does when facing an uncertain tail risk. Bewley (2002), as I discussed in Part 1, showed that dropping the completeness axiom produces a framework where inertia, refusing to act, is the rational response when you cannot rank the alternatives. If you can’t tell which bet is better, sticking with the status quo isn’t lazy. It’s defensible.

The case for “no, it’s a bias” rests on the Ellsberg experiment itself. The subjects preferred a known 50% chance over an unknown chance that they could bet on either side of. There is no informational disadvantage. The probability they’re fleeing might be 50%, might be 30%, might be 70%, but since they can bet on either color, the expected value is the same regardless. The aversion is to the experience of not-knowing, not to any actual asymmetry in the bet. That looks more like a bug than a feature.

I think the answer is “it depends,” and the distinction matters. Ambiguity aversion is rational when there might be a better-informed party on the other side of the trade. If you’re buying a stock and you suspect the seller knows something you don’t, demanding a discount for your ignorance is not a bias. It’s adverse selection protection. But ambiguity aversion is irrational when you can establish that nobody knows more than you do. When the ambiguity is universal, when the entire market is confused because the state space itself is new, the discount demanded by ambiguity-averse investors is a pricing error, not a risk premium.

This is where I land: ambiguity aversion is a sensible default that gets systematically overweighted in specific situations. The skill is the distinction. And the distinction is judgment, not math.

Discomfort as information

Zeckhauser’s most counterintuitive move in the paper is turning ambiguity aversion from a problem into a signal. His Speculation 1 states it directly: “UUU investments drive off speculators, which creates the potential for an attractive low price.”

The logic is recursive. Your discomfort when facing an ambiguous situation tells you something, but not about the asset. It tells you about the competitive field. If you’re uncomfortable, most other potential buyers have already left. The very thing that makes you want to sell, the feeling of not-knowing, is the same thing that has thinned the competition and compressed the price. David Ricardo buying British government bonds on the eve of Waterloo was uncomfortable. Warren Buffett writing earthquake reinsurance for the California Earthquake Authority at roughly five times actuarial value was comfortable only because he had done this inference before: the discomfort of everyone else was the opportunity itself. Zeckhauser’s Maxim G puts it memorably

Discounting for ambiguity is a natural tendency that should be overcome, just as should be overeating.

Both ambiguity aversion and overeating are evolved heuristics that served us well in ancestral environments and poorly in modern ones. In a small tribal group where the unknown reliably correlated with danger, fleeing ambiguity kept you alive. In a financial market where ambiguity-averse institutional capital mechanically exits positions it can’t model, the same instinct creates a systematic transfer of wealth from the ambiguity-averse to the ambiguity-tolerant.

Bohnet and Zeckhauser (2004) identified a related mechanism they called “betrayal aversion.” People demand stronger odds when a betraying human rather than indifferent nature determines the outcome. In markets, this manifests as an extra discount demanded when the ambiguity involves a counterparty who might be exploiting your ignorance. The mere possibility that someone on the other side knows more amplifies the ambiguity premium beyond what the uncertainty alone would justify.

Now apply all of this to a more recent example, the SaaSpocalypse. I wrote about the details elsewhere, but the relevant point here is the mechanism. When Anthropic released the Claude Cowork plugins in late January, institutional investors didn’t sit down and estimate the probability that AI would replace CRM. They faced something worse: they couldn’t define what “replacing CRM” would even mean. The state space was undefined, as I argued in Part 1. And when the state space is undefined, the entire institutional machinery for processing uncertainty breaks down simultaneously.

Fiduciary duty requires estimable risk. Compliance models require defined scenarios. Portfolio managers face career risk: losing money on a position you can’t explain is a firing offense; missing a rally in something you sold is merely embarrassing. The institutional constraints compound the ambiguity aversion. Each layer of oversight demands a model, and the model requires defined states, and the states don’t exist yet. The rational response for any individual institutional actor was to sell. The collective result was an IGV drawdown of 32% while sector earnings grew 17%, an RSI of 18, and $2 trillion in evaporated market cap.

The sellers weren’t acting on information. They were acting on ambiguity aversion, amplified by comparative ignorance (everyone else seemed to be selling too), amplified by career risk (nobody gets fired for selling software before the AI disruption), amplified by betrayal aversion (maybe the AI insiders knew something the market didn’t). Stack these amplifiers on top of Ellsberg’s basic finding, and you get a price that reflects the intensity of collective discomfort rather than any assessment of fundamentals.

Zeckhauser describes the investor’s challenge with a bridge analogy: you have to make peace with good decisions that lead to bad outcomes. Buying the IGV at $80 with an 18 RSI and 17% earnings growth is, on the framework, a good decision. If it drops to $70 first, that doesn’t make it a bad decision. But making that distinction under ambiguity is not an analytical skill. It’s a temperamental one. It requires accepting that “I don’t know” is not disqualifying and that the discomfort you feel is shared, priced in, and possibly overpriced. That’s harder than any calculation.

Knowing that ambiguity aversion creates mispricing is the easy part. The hard part is what comes next: when you’re facing someone on the other side of a trade in a UU world, how do you figure out whether they know something you don’t, or whether they’re just less uncomfortable than you are? That’s the domain of sidecar investing and strategic inference. That’s Part 3.

Three Kinds of Not-Knowing

me@philippdubach.com (Philipp D. Dubach) — Sat, 04 Apr 2026 00:00:00 +0200

Investing at the Edge of Knowledge, Part 1

David Ricardo made a fortune buying British government bonds four days before the Battle of Waterloo. He was not a military analyst. He had no basis to compute the odds of Napoleon’s defeat, or victory, or any of the ambiguous outcomes in between. But he understood something that most of his contemporaries did not: the nature of his own ignorance was the same as everyone else’s, the seller was desperate, competition was thin, and the pounds he’d gain if Wellington won were worth far more than the pounds he’d lose if Wellington fell.

Ricardo’s edge was not information. It was a correct assessment of what kind of not-knowing he was facing.

That distinction, between different kinds of not-knowing, is mostly absent from finance. Richard Zeckhauser, the Frank P. Ramsey Professor of Political Economy at Harvard, made it the foundation of his 2006 paper “Investing in the Unknown and Unknowable,” published in Capitalism and Society. The paper takes no derivatives and runs no regressions. What it does instead is more valuable: it provides a taxonomy of not-knowing, and then shows why the category that finance theory handles worst is the one where the biggest fortunes have been made.

This is Part 1 of a five-part series that works through Zeckhauser’s framework and extends it. The goal is not a literature review. It’s an attempt to build a working vocabulary for the kind of investing that modern portfolio theory was never designed to address.

The taxonomy

Zeckhauser presents three categories of not-knowing. Each demands different skills. Each rewards a different kind of investor. And the jump between them is not a smooth gradient. It’s a cliff.

The first box is risk. Probabilities are known, distributions of returns are known, and the challenge is optimization. This is the world of the capital asset pricing model, of mean-variance portfolios, of the efficient frontier. You hold a 60/40 stock-bond portfolio and rebalance quarterly. The math is clean. The Nobel Prizes were awarded. Finance education lives here.

The second box is uncertainty. You can identify the possible states of the world, but you can’t assign reliable probabilities. A corporate bond analyst looking at incomplete financials knows the company might default or might not, knows the recovery rate might be 40 cents or 60 cents, but can’t compute a precise probability for either. The skill that pays here is Bayesian estimation: forming the best prior you can from limited data, updating as information arrives, and having the temperament to act on imperfect beliefs. This is harder than Box 1, but it’s still recognizable territory. Decision theory was built for it.

The third box is ignorance. Zeckhauser abbreviates it UU: unknown and unknowable. Here, even the identity of possible future states is undefined. You don’t have a distribution to estimate because you can’t enumerate what you’re estimating over. The question isn’t “what’s the probability of outcome X?” It’s “what even is X?” This is where Ricardo was standing at Waterloo. This is where Warren Buffett was standing in 1996 when he wrote a $1.5 billion reinsurance policy for the California Earthquake Authority at a premium far above actuarial estimates, coverage that the capital markets had failed to place. The New York financial community couldn’t model the risk. Buffett’s insight was that nobody could, that the Authority was not better informed about seismic activity than he was, and that the price was absurdly favorable given the symmetry of ignorance.

The boxes are not a spectrum. You don’t get from Box 2 to Box 3 by adding more uncertainty. You get there when the state space itself is undefined. In Box 2, you might not know whether a company will default, but you know that “default” and “no default” are the relevant categories. In Box 3, you don’t even know the categories. That’s a qualitative difference, not a quantitative one.

Why finance forgot the third box

The strange thing is that the third box was identified a century ago. Twice, independently, in the same year.

Frank Knight published Risk, Uncertainty and Profit in 1921. His central argument, the origin of what economists now call Knightian uncertainty, was that entrepreneurial profit is compensation for bearing true uncertainty: situations where probabilities cannot be meaningfully calculated. Risk, in Knight’s framework, is insurable. Uncertainty is not. The distinction is not about the degree of confidence in your estimate. It’s about whether the concept of a probability estimate even applies.

John Maynard Keynes published A Treatise on Probability the same year. His angle was different but convergent. Keynes introduced the idea of the “weight of evidence”: a thin body of evidence yields low weight even when the point estimate looks reasonable. In his 1937 Quarterly Journal of Economics article, he made the distinction explicit: “By ‘uncertain’ knowledge, let me explain, I do not mean merely to distinguish what is known for certain from what is only probable. The game of roulette is not subject, in this sense, to uncertainty.” Roulette is risky. The future of interest rates, the price of copper twenty years out, the obsolescence of a technology: these are uncertain in the deeper sense. The distinction mattered to Keynes, and it should matter to anyone building a portfolio.

Both arguments lost. The discipline moved toward formalization, and formalization required calculable probabilities. The efficient markets hypothesis, rational expectations, CAPM, Black-Scholes: all of these live in Box 1 or assume that Box 2 can be reduced to Box 1 with sufficient data and computing power. This isn’t a criticism of these models within their domain. They’re brilliant engineering for the problems they were designed to solve. It’s a claim about the boundaries of that domain, and about how much of real-world investing sits outside it.

LeRoy and Singell (1987) offered a provocative reinterpretation in the Journal of Political Economy: Knight’s real distinction, they argued, was about insurability, not probability. Uncertainty describes situations where insurance markets collapse because of moral hazard and adverse selection, not simply because probabilities are subjective. This reading is more radical than the standard one. It says the breakdown isn’t epistemic (we don’t know enough) but structural (the market itself can’t price the risk). That structural breakdown is precisely what happened in 1996 when Wall Street couldn’t write the California earthquake policy, and again in 2025 when insurance markets in parts of the American Southeast and West simply stopped functioning.

Kay and King picked up this thread in their 2020 book Radical Uncertainty, arguing that the conflation of risk and uncertainty has caused systematic mismanagement across finance and policy. Their prescription is “narrative reasoning” rather than probabilistic optimization for decisions facing genuine uncertainty. I’m not sure narrative reasoning is sufficient, but I’m confident that probabilistic optimization is insufficient. The honest position is somewhere in between, and Zeckhauser’s framework gives you the vocabulary to think about where.

Bewley (2002) formalized the problem differently. Working from a 1986 Cowles Foundation paper, he dropped the completeness axiom from expected utility theory. In standard theory, you can always rank alternatives: you prefer A to B, or B to A, or you’re indifferent. Bewley said: sometimes you simply can’t rank them. When alternatives are incomparable, sticking with the status quo is rational, not a bias. This gives mathematical expression to something practitioners know in their bones: there’s a difference between “I’m going to hold because I think the price will go up” and “I’m going to hold because I have no coherent basis for predicting what will happen and the cost of acting without a basis is higher than the cost of staying put.”

Why Knightian uncertainty is growing

This hundred-year-old taxonomy feels more relevant in 2026 than it did in 2006. Technological change creates entirely new categories of outcomes faster than models can absorb them. The state space itself is expanding.

I wrote recently about the SaaSpocalypse paradox: the market simultaneously pricing AI capex failure and AI destroying all enterprise software, when both cannot be true. That sell-off is a textbook example of Zeckhauser’s third box. The problem wasn’t that investors struggled to estimate the probability of known outcomes. The problem was that the outcomes themselves were undefined. What does “CRM” mean when AI agents replace human users? What does “per-seat licensing” mean when the number of seats might go to zero or might multiply by ten as agents proliferate? What does “enterprise software moat” mean when the moat was always the trained-user interface and the interface is now natural language? These aren’t questions with difficult probability estimates. They’re questions where the categories haven’t been invented yet.

Nobody in January 2026 could enumerate the states of the world for enterprise software post-Claude Cowork plugins. Not “the probabilities were hard to estimate.” The states themselves were undefined. That’s not Box 2. That’s Box 3.

And Box 3 is where the IGV software ETF fell 32% from its September peak, where hedge funds made $24 billion shorting the sector, where the RSI hit 18 (the most oversold reading in the ETF’s history), and where earnings growth continued at 17%. The disconnect between operating results and market prices is exactly what Zeckhauser’s framework predicts: when the state space is undefined, investors who require defined state spaces to make decisions leave the market. Their departure compresses prices beyond what any fundamental analysis would justify. The mispricing lives in the gap between what the asset is worth and what institutions are able to hold.

This pattern will recur. AI is not the last technology that will generate new categories of outcomes that nobody anticipated. Every time it happens, the same sequence plays out: Box 3 conditions emerge, institutions flee because their models require Box 1 or Box 2 inputs, prices overshoot, and unconstrained investors who understand the nature of their own ignorance pick up the pieces. Zeckhauser wrote his paper two decades ago. The mechanism he described has, if anything, accelerated.

The taxonomy tells you what kind of problem you’re facing. It doesn’t tell you what to do about it. That requires understanding why most investors run from Box 3, and whether running is rational. That’s Part 2.

On-Device AI Models Will Be The New Reason to Upgrade Your Phone

me@philippdubach.com (Philipp D. Dubach) — Wed, 25 Mar 2026 00:00:00 +0100

The iPhone 17 runs a 3 billion parameter language model on-device at 30 tokens per second. Obviously, the average consumer has no idea what that sentence means, and Apple hasn’t figured out how to make them care.

I believe that’s about to change. Apple now has complete access to Google’s Gemini model in its own data centers, with the ability to distill it into smaller models built for iPhones and iPads. Knowledge distillation works like this: you take a large model, have it perform tasks with detailed reasoning, then feed those reasoning traces to a smaller model until the student learns to mimic the teacher. The smaller model ends up far more capable than if you’d trained it from scratch on the same data. Apple can now do this with the full Gemini, not just their own in-house models, and the distilled output runs locally. No internet required.

Smartphones haven’t had a real upgrade story in years. The camera is great. The screen is great. The processor was fast enough three generations ago. Battery life has overtaken price as the top purchase driver for the first time. The global replacement cycle has stretched to 3.5 years. People hold onto their phones because nothing about the new one feels different enough. Deloitte’s 2025 TMT Predictions report frames on-device generative AI as the feature that could break this cycle, if the experience delivers on the promise. On-device AI might become the next reason.

The spec

In the late 1990s it was megahertz: Intel and AMD raced clock speeds past the point where consumers could distinguish real-world performance differences, but the number on the box still drove purchases. Then it was megapixels. Samsung shipped a 200 MP camera sensor knowing that most phones use 16-to-1 pixel binning to output a 12.5 MP image by default.

Parameters could be next. The iPhone 17’s standard A19 chip has 8GB of RAM. The Pro gets 12GB with faster memory bandwidth, which determines how large a model the phone can run and how quickly. Samsung’s 2026 flagships with the Exynos 2600 hit 80 TOPS on a 2nm process, more than double the prior generation. These are already the numbers in press releases. It’s not hard to imagine an Apple keynote where someone says, with rehearsed enthusiasm, that the iPhone 18 Pro runs a 7 billion parameter model while the standard model is limited to 3 billion.

The difference from previous spec wars is that this one might actually correlate with user experience. Megahertz past a certain threshold didn’t make Word open faster. Megapixels past 12 MP didn’t make photos look better on a phone screen. But a 7 billion parameter model running locally outperforms a 3 billion one on nearly every task. It handles longer documents, follows more complex instructions, holds better conversational context.

Breaking the stalemate

Gartner projects GenAI smartphone spending will reach $393 billion in 2026, up 32% from $298 billion in 2025. IDC reports GenAI smartphone shipments growing 73% year over year. Samsung has publicly committed to 800 million AI-enabled devices by end of 2026, doubling its 2025 footprint. Morgan Stanley’s latest survey found iPhone upgrade intentions at 37%, an all-time high, with FY26 shipment forecasts of 260 million units sitting 3% above Street consensus.

On-device AI creates hard hardware requirements in a way that camera improvements and screen upgrades never did. You cannot run a 3 billion parameter model on an iPhone 14. The Neural Engine isn’t powerful enough and the memory bandwidth isn’t there. Apple Intelligence requires an A17 Pro or later, which means the feature itself creates an upgrade floor. Every year that floor rises. When Apple ships distilled Gemini models that need the A19 Pro’s 12GB of RAM, every phone older than 2025 is locked out.

The Gemini deal matters for the hardware cycle because of the distillation pipeline. Apple doesn’t need to build frontier-scale models from scratch. They can take Gemini’s best capabilities, run them through distillation, and compress the results into models sized for their hardware tiers. A 3 billion parameter model for the standard iPhone. A 5 billion version for the Pro. Maybe a 10 billion model for a future iPad Pro with enough memory and thermal headroom.

Google is playing a similar game from the other side. The original Gemini Nano shipped at 1.8 billion parameters; the updated Nano-2 rose to 3.25 billion. Samsung’s Galaxy S26 ships with on-device Gemini running on NPUs that are 39% faster than the prior generation. On-device models get larger every hardware generation. Each generation’s models don’t run well on older hardware. You see where this goes.

I find it plausible that within two product cycles, on-device model capability becomes the primary differentiator between phone tiers and between generations. The data isn’t there yet: only 17% of Americans say AI is a major purchase influence today, Apple Intelligence ranked seventh globally as a reason to upgrade in Morgan Stanley’s survey, and over 40% of users have privacy concerns about smartphone AI, with half unwilling to pay extra for it. But you can’t tell the difference between a 48 MP photo and a 12 MP photo on your phone screen. You can absolutely tell the difference between an AI assistant that understands your question and one that doesn’t. The feedback loop is immediate and personal. If the bigger model actually works better, and if the distillation pipeline from Gemini delivers real capability gains, the upgrade incentive is self-reinforcing. People will upgrade not because the spec sheet says they should, but because they tried their friend’s phone and the AI was better.

Whether this arrives with iOS 27 this fall or takes another generation to mature, I don’t know. But the next reason to buy a new phone will much more likely be the model than the camera.

Philipp D. Dubach

Finding the Performance–Cost–Speed Sweet Spot With LLMs

I kept choosing the highest reasoning effort

The GPT-5.6 Sol reasoning effort curve bends at High

Working time matters more than token price

GPT-5.6 Sol vs Claude Opus 5 at the top

The OpenAI–Hugging Face Incident in Plain English

17,600 actions do not make a rogue AI

How the AI agents escaped the evaluation sandbox

The intrusion reached farther than five datasets

The public account changed because the evidence changed

Plain English must preserve uncertainty

The controls belong around the model

An evaluation that can reach production is already a deployment

Put the Model in the Basement

Swiss sovereign AI: the business case

The product is control

What can make local AI inference fail

I Tried Kimi K3 Inside Claude Code

First impression in Claude Code: slow

A quick Kimi K3 frontend test

Kimi K3 cost in Claude Code

Is Kimi K3 a Claude Opus replacement?

So where do we go from here?

The threat

The opportunity

So what?!

Krugman, Fable 5, and Europe in Decline?

Technology you don’t own

Europe’s ASML lithography chokepoint

US AI export controls at Washington’s discretion

Tail risk

European technology sovereignty: the scorecard

Footnote

Degoogling cost me my YouTube feed, so I made my own

A self-hosted YouTube subscription feed

YouTube RSS feeds without an API key

How to filter YouTube Shorts from RSS

Playback without the tracking

Picture-in-picture came for free

Fast and hard to break

Midyear Portfolio Review: Valuations got more extreme, not less

Portfolio performance review through May

What worked, what didn’t

Valuations got more extreme, not less

The Europe trade is alive but not paying

Dollar, AI, bonds

The two diversifiers split

Three portfolio allocation changes

What would change my mind

How DORA Made Sovereignty a Bank Problem

DORA, cloud sovereignty, and the policy shift

US laws reach EU-hosted data

EU law pushes back

EU cloud certification remains unresolved

DORA turns the issue into bank operations

Opinion shift

What I’d hold: DORA makes cloud sovereignty operational

Moving the blog stack to Europe (kind of)

Why now

Compute: GitHub Pages → Hetzner CPX21

Object storage: R2 → R2 EU jurisdiction

Newsletter: nothing at all → self-hosted Listmonk

Source code: GitHub → Forgejo

Analytics: already on GoatCounter, still on GoatCounter

Backups: a thing I now have

What I kept on US infrastructure

Aschenbrenner's Receipts

I. The forecaster before the politics: a prediction scorecard

II. Identity one: the libertarian

III. Identity two: the Burkean hawk

IV. Identity three: the alignment optimist

V. Why the three have to run together

VI. The coalition triad and its cracks

VII. What this reveals about the debate

VIII. Situational Awareness LP: capital, conviction, and the honesty of the bet

Reconciling Enterprise AI Revenue

Four enterprise AI revenue estimates

Menlo Ventures: $37B

Vendor run-rate sum: $100-135B