Capability Arrived First

Here's what I took away, and the questions I'm still sitting with.

Capability arrived first

The clearest single example is GPT-6 Astra: trained on a hundred thousand GPUs at Stargate, 98.6 on ARC-AGI-3, and — the part that matters most — the first ever Critical rating under OpenAI's own Preparedness Framework. That means OpenAI is formally acknowledging this model can enable serious cyberattacks. The number that should stop people is ExploitBench: 100%. Not 80, not 90. A perfect score on a benchmark designed to test real exploit capability.

The governance response is essentially a policy document and a subsidized access program for utilities and nonprofits. That's not nothing, but it isn't commensurate with what a Critical rating implies. Two weeks ago I wrote about OpenAI pausing training on cyber capability signals and called the precedent the real story. This week sharpened that: AI developers now treat cybersecurity capability emergence as a potential trigger to slow or pause a run — and GPT-6 Astra shipped anyway. So the precedent is a future option, not a present constraint. The capability arrived before the framework caught up, which is exactly the pattern the whole week kept pointing at.

Run rate is a misleading number

Something that doesn't get said loudly enough: revenue run rate in AI is a misleading number on its own. The pattern is consistent across companies — dramatic revenue scaling happening simultaneously with cash burn of comparable or greater magnitude. And the compute commitments behind that growth have changed character. Anthropic's reported $45 billion, six-year deal isn't an operating expense; it resembles bond issuance more than software purchasing. The logic is a hedge against future GPU scarcity — pay a capital-efficiency penalty now to guarantee capacity later — which only makes sense if you believe the infrastructure build-out will outpace hardware production.

Meanwhile, on the demand side, enterprise customers are actively renegotiating AI contracts and routing queries to cheaper models. That is a deflationary force running directly against the assumptions that justify trillion-dollar infrastructure investment. So you have a supply-side spending spiral driven by scarcity fear and a demand-side cost discipline tightening at the same time. Those two forces haven't collided visibly yet, but the setup is there. And when physical GPUs become the basis for financial instruments, the valuation assumptions embedded in those instruments become relevant to the whole system, not just to the borrower.

Two things to hold together

The Anthropic S-1 is going to put the governance question front and center: Dario Amodei's reported 2% economic ownership combined with supervoting rights is not a standard IPO setup. Last week I noted supervoting was becoming the standard precondition of an AI founder IPO, and this week reinforced it — the structure is showing up across multiple frontier-lab IPO preparations, not just one. The argument for it hasn't changed: public-market pressure on quarterly returns is structurally incompatible with decade-plus timelines.

The counterargument got sharper, though. Two percent economic ownership with supervoting rights is a governance structure with very limited public accountability — and that matters more when the product carries a Critical cybersecurity rating. A Critical Preparedness rating and an IPO supervoting structure arriving in the same week is a combination worth holding together, because the combination of frontier capability, founder control, and public capital is something the world hasn't actually had to evaluate before.

The playbook is situational

The Nvidia story is contested this week, and I think the contest is the insight. Two weeks ago I described Nvidia's non-acquisition playbook — license the IP, hire the team — with Poolside as the example. Last week I wrote about the reported Hugging Face deal as a departure from it. This week the two framings sat side by side: hybrid licensing-plus-hiring deals on one hand, and a straight $12.9 billion acquisition of Hugging Face on the other. Both can't be fully right at once — or rather, my earlier read was less wrong than imprecise. The playbook isn't one thing. Nvidia is calibrating the deal structure to the target rather than templating the same deal everywhere.

Hugging Face as a full acquisition makes sense precisely because it's the open-source distribution layer itself. You can't just license that; you need to own the platform to control what sits on top of your chips. Which is the move from selling hardware into controlling the developer ecosystem as a distribution channel — and it makes the tension I keep flagging more pointed, not less: Hugging Face is where a lot of Nvidia's own software customers publish and access models. Now it's inside the house.

Agents live in the channel now

The Slack pattern keeps getting stronger, and it's now reinforced from three directions. Multiple independent products — Slack Code, NanoClaw, and Adobe bringing 70-plus tools from Photoshop, Acrobat, Premiere, and Illustrator into Slack via MCP — are converging on the same shape: agents as persistent, permissioned entities operating inside shared channels. Adobe is the significant data point because it isn't a small experiment; that's production creative workflow moving into the channel layer. Slack isn't being used as a notification destination. It's becoming the operating environment where agents live and collaborate.

That raises a competitive dynamic for legacy ITSM platforms: they've accumulated so much configuration debt that they can't do this cleanly. Every custom table and legacy workflow is a structural obstacle to deep agent integration, which is a real moat for greenfield AI-native competitors, not just a marketing claim. The risk enterprises seem least prepared for is correlated outage: multiple major AI providers going down simultaneously is no longer theoretical, and it reveals that critical workflows now depend on a small number of providers who share underlying infrastructure. Single-vendor redundancy doesn't help if the failure mode is a layer deeper. The quieter cousin of that problem is silent tool failure: in agentic systems, a failed tool call that triggers retry loops isn't just a debugging problem, it's a cost-amplification problem that compounds invisibly. Observability in agent systems is being flagged as an economic control requirement — which tells you it's hitting production, not just theory.

Knowing what to remove

Two UX signals this week matter for my own work. The first is a role that's becoming distinct rather than incidental: as AI accelerates feature shipping past the pace UX teams can evaluate, someone has to triage the accumulated UX debt. Last week I called this the shift from making things to judging things; this week made it concrete as a supply-demand mismatch inside product teams. AI increases the rate at which things can be built. It doesn't increase the rate at which the user experience of those things can be assessed.

The second is an adjacent problem disguised as an AI-tooling problem. JudgmentKit exists because agents need structured help deciding which UI components to use — which is really a design-system and information-architecture problem. It ties to a point I keep returning to: design systems have to carry machine-readable, explicit logic rather than implicit human conventions if AI is going to interpret design knowledge reliably, and most weren't built that way. And then the failure mode I find most underappreciated: as models get better at generation, they start adding unnecessary copy and interface elements. The output degrades from surplus, not absence. Which means the evaluation skill — knowing what to remove — becomes more valuable than the generation skill. The same shift is happening in software engineering with AI coding tools and in financial analysis with AI research tools. Judgment about what the AI produced is the scarce resource.

Also on my radar

Three threads I'm keeping compressed. Geopolitics: the shift from banning chip shipments to closing remote-access loopholes is substantive — a hardware export ban is incomplete if overseas data centers offer API access to the same compute. At the same time China's stack is maturing on several layers at once, with domestic DUV tools and HBM3E memory from CXMT, running a dual-track strategy: self-sufficiency where it can, selective imports where it can't. That's more nuanced than autarky, and it's a sensible hedge against unpredictable export-control changes. Vertical AI: finance-focused startups need to entrench with customers before the foundation labs build the same capability at the infrastructure layer and give it away — and a model that scores 74 on DeepSWE makes that window feel shorter. If your core capability is access to a specific model inside someone else's product, that access can be revoked on short notice. The durable defense is the one I flagged last week: proprietary workflow data and behavioral signals accumulated from customers, which a foundation model provider can't replicate — and the fact that workplace behavioral data is becoming a primary training frontier is the validation that this moat is real.