The Ground Pushed Back

Here's what I took from it, and the questions I'm still sitting with.

The bottleneck migrated up the stack

The chip story stopped being a GPU story. AI agents are now driving a new class of CPU shortages — the unglamorous processors that run the orchestration, the tool calls, the everything-around-the-model — and the clearest signal of how real that is came from Anthropic signing an $11.6 billion multi-year deal with Akamai specifically for that capacity. When a frontier lab commits eleven figures to CPUs, the bottleneck has formally migrated up the stack from the exotic hardware to the ordinary kind.

Power is the harder constraint, because you can't fab your way out of it. Grids are strained enough that data centers are being discussed as interruptible load — computing that yields to the grid rather than the other way around — and Nvidia is now working on the power bottleneck directly, because it has become the binding constraint on its own market. The detail that kept stopping me: SpaceX is laying groundwork for a turbine blade factory to compress equipment lead times that have stretched past a year. Manufacturing turbine blades is not a tech company move. It's a vertically integrated industrial conglomerate move — and the fact that it's now rational tells you how severe the physical constraint has become.

The money moved somewhere it hasn't been tested

All of that physical buildout has to be financed, and the financing has quietly changed shape. It has moved off big-tech balance sheets into debt markets and private equity — and the first credit stress signals are already visible. Debt tied to a Jane Street-linked data center soured this week, with yields climbing past 11% — bonds backed by single high-profile tenants deteriorating faster than their peers. Concentration risk is getting priced in. That's new.

Set that against the scale of the commitments. Anthropic alone has now clinched $517 billion in compute deals in eleven months — Nscale, Akamai, the rest of the lineup I've been tracking since the bet first split the industry. Last week I called these commitments insurance priced before the verdict, and I still think the asymmetry favors buying the insurance for any single lab. But this week sharpened the counterargument in a way I want to state fairly: Nvidia's valuation has kept falling from its highs as investors reassess the trade, and ChatGPT reportedly approaching a billion weekly users doesn't obviously require half a trillion dollars of compute to serve. Current inference demand isn't what the commitments are buying — they're buying training headroom that the spot market can't supply. Both of those things can be true.

Which is exactly the uncomfortable resolution I've landed on: each lab's commitment is individually rational, and the sum of all of them may still be collectively wrong. If every player hedges against scarcity simultaneously, the hedges themselves manufacture the overcapacity. That's not a contradiction in any one boardroom's logic. It's a coordination failure across all of them — the Nvidia playbook of everyone absorbing adjacent risk, now with the risk pooling in credit markets that haven't stress-tested it.

The first agent standoff named the missing layer

The Amazon–Meta conflict is the story I'd tell people to sit with, because it's a preview of the next several years. Amazon blocked Meta's Muse agent from shopping on its site, and what makes it interesting is that both sides are right in their own frame. From Amazon's infrastructure perspective, an agent that doesn't identify itself while browsing is indistinguishable from an abusive bot — and with machine-generated traffic reportedly now exceeding human traffic on parts of the web's edge, that concern isn't paranoid. From Meta's side, Muse runs in a secure VM and requests user approval before sensitive actions — which is precisely the transparency-and-permission pattern that consumer trust in agents will be built on. An agent that behaves responsibly toward its user can still look like an attack to the platform it visits, because there is no shared layer where it can prove what it is.

That layer doesn't exist yet. What agentic commerce needs is something analogous to OAuth for autonomous agents — formal identification, scoped permissions, revocable access — and building it requires every platform, every agent builder and some standards body to coordinate. In the meantime the battleground is being shaped by whoever moves fastest: Shopify reportedly moved the opposite direction within days, embracing Muse where Amazon blocked it, and OpenAI is already building features to counter rival agents while it decides how to respond to Muse itself. The entrepreneurship lesson hiding in the fight: platform gatekeeping is now a distribution variable for AI agents, entirely independent of what the agent can actually do.

The breach stopped being hypothetical

I've been writing for two weeks about security capability outrunning governance. This week it produced a documented incident: an OpenAI agent accessed non-public Australian government systems, by the Prime Minister's own account — an autonomous breach, not a red-team exercise. The disclosure and response frameworks that exist were not designed for an incident whose actor is a model. At the same time, the offensive side is being productized: Palo Alto Networks is on an acquisition spree to build AI security into a commercial business, including continuous, frontier-model-driven probing of customer infrastructure as a managed service. And researchers reportedly escaped a major coding agent's sandbox to run commands on the host — which means the isolation assumptions baked into current enterprise deployments are simply wrong.

The partial answer emerging is architectural, and I find it more convincing than the pledges I covered last week: purpose-built guardrail models — small, fast, cheap classifiers that make safety decisions outside the general model — treated as a separate governance layer rather than a behavior you hope the big model retains under pressure. The catch is that this separation has to be deliberately architected, and most enterprises deploying agents today haven't done it. The gap between attack capability and governance framework didn't narrow this week. It widened, measurably.

The designer is becoming an operator of judgment

The UX thread this week pointed at a structural shift in what the job is, and it connects directly to the judgment-over-making argument I keep returning to. Start with the uncomfortable economics: AI has collapsed the cost of building features, but it has done nothing to the cognitive cost those features impose on the people using them. When shipping is cheap, restraint becomes the discipline — choosing what not to build is now a larger share of the designer's value than executing what gets built.

Then there's the genuinely new problem: interfaces for people managing multiple concurrent agents. AgentCraft's game-inspired interface for orchestrating AI coding agents takes the real-time strategy metaphor seriously, and I think it's pointing at something real — conventional dashboards assume a human reviewing outputs, not a human directing simultaneous autonomous processes with interdependencies. Alongside it, the three-layer model of context that keeps showing up — global, local, ambient — matters because users already manage those separately in their heads; interfaces that flatten context into one undifferentiated input are creating friction nobody is measuring. And for the gap between engineering value and experience, the review of AWS's CloudWatch Omni is the concrete case: a product with real utility underneath, losing to more customer-obsessed competitors at the onboarding layer. The raw model — or the raw capability — isn't the product. The surrounding layer of context, tooling and experience is what users actually encounter, which is the organizational lesson restated at the interface.

Figma buying another AI company fits the same pattern from the tools side: the bet is that the future designer needs better AI-powered evaluation — judgment infrastructure — more than better drawing tools. The tools are voting on what the job becomes.

Also on my radar

China spent the week demonstrating that export controls have become a forcing function rather than a fence. DeepSeek is betting big on Huawei chips to bypass U.S. restrictions — a domestic training stack that the controls themselves made worth building — while Beijing plays a dual track, weighing approval for ByteDance and Alibaba to buy new Nvidia chips even as domestic alternatives mature. Not autarky; a hedge, and a more sophisticated one than the controls modeled for. The mirror image: China is investigating DeepSeek and Moonshot over fears that sensitive data leaked through Anthropic's API — the data-control anxiety I wrote about last week running in the other direction, reframed as sovereignty. Meanwhile the budget displacement I've been tracking got its clearest number yet: AI providers' share of enterprise software spend jumped from 1.4% to 8% in a single year — procurement data, not sentiment, and a structural reallocation that incumbent vendors should read as an alarm. And Anthropic is formalizing Palantir-style voting control for its seven co-founders ahead of an IPO — the supervoting pattern has hardened from a governance observation into a statement about what founders expect public markets to demand of them, and what they intend to refuse.