Subscribe
Share
Share
Embed
A daily briefing on the AI systems, products, companies, and policy shifts that are just becoming possible.
Want a podcast for your own topics? Join early access: https://www.barelypossible.to/waitlist/?source_path=public_feed&feed_source=rss
Okay kiddos, pull up a stool, I'm your boy Tony DeLuca, and we've got a fresh tray of AI morsels and a couple of chewier geopolitical ones today, so grab your coffee and let's work through the menu together.
I want to start with something that surprised me, because every day lately it's been personal AI assistants and open-weight models and funding rounds, and the one story that stopped me cold had nothing to do with a chatbot. It's about a protocol. Not a flashy one. A boring one. The kind of plumbing nobody notices until the toilet backs up. And right now, for a whole bunch of consumer AI companies, the toilet is backing up.
So here's the shape of it. There's a recent piece from Sarah Perez about what she calls the next hurdle for AI agents: getting websites to actually let them in. And I know, I know, we've talked about personal agents a lot this week. We covered Instinct going into group chats, we covered the whole menagerie of Muse and Dots and Instinct and the rest. So I'm not going to re-litigate who makes the cutest avatar. What I want to zoom into is the part that actually determines whether any of this becomes a real business, which is: can the agent complete the transaction? Because an agent that can't finish the job is just a very expensive way to look busy.
Here's what's happening. These agents — Meta's Muse, Instinct, ChatGPT's Dots — they promise to do stuff for you. Book the flight, order the groceries, make the dinner reservation. And people are trying it. And then they're hitting a wall. Amazon flat-out started blocking Meta's Muse agent from its retail site. Can't browse, can't buy. That one's intentional — Amazon doesn't want somebody else's agent shopping its catalog. Fair enough, that's a business decision. But then it gets murkier. People are reporting their agents getting bounced off Walmart. And here's the twist: Walmart is actually partnered with Muse. They announced it at Meta's Connect conference in September. Walmart wants to be there. So why are customers getting kicked out?
Because of the "click here to prove you're a human" button. The captcha. The agent goes to check out, the site throws up the are-you-a-robot gate, and — well, the agent is a robot. The check fails, the agent gets booted, and here's the kicker from the reporting: it was interfering with actual humans too. There was a guy posting that he couldn't even sign in to Walmart himself, as a flesh-and-blood person, because the anti-bot machinery had gotten so aggressive. So Walmart's trying to say yes to agents, and the plumbing they built years ago to keep out spam bots can't tell the difference between a malicious scraper and your personal assistant trying to buy you paper towels.
That is the whole story in miniature. The web was built to verify humans and keep bots out. Now a big slice of the economy wants certain bots in — the good ones, acting on your behalf — and the tools we have can't make that distinction. A captcha is a blunt instrument. It just asks: are you a person? And the honest answer for an agent is no, even though the person who sent it is sitting right there.
Now let me give you the roll call, because it tells you how broad this is. Delta told TechCrunch it's protecting customers from unauthorized automated activity — translation, we're not opening the door to your agent, at least not yet. United pointed at its terms of service, the boilerplate that says no robots, no spiders, no automated anything without written permission. Flight booking, by the way, is supposed to be the flagship use case for these things. The thing everybody demos. And the airlines are saying, not on our site, pal. Then you've got the long tail: Yelp, eBay, Zillow, Pizza Hut, Adidas, a bunch of airlines. Yelp says you don't get in unless the agent has paid to access our data through our licensing program. eBay says it suspended some accounts over agentic use. Somebody said Google kicked Instinct out while it was cleaning up their Gmail. Think about that one — Google's own agent getting bounced by Google's own spam defenses. The left hand and the right hand haven't been introduced.
And then there's Cloudflare, sitting in the middle of all of it, which is the part a builder should really pay attention to. Cloudflare is the bouncer for a huge chunk of the internet. They made a change to crawler defaults back on September 15th — sites that were already set to block AI bots for security got shifted to also block AI agents on any page carrying ads. So you've got this accidental blast radius: a setting meant to stop training scrapers now catches your personal shopping agent. And here's the part that made me raise an eyebrow — Cloudflare has a dog in this fight. They now run a marketplace where AI bots pay for the data they access. They've been testing a browser built specifically for agents. So the company that controls the gate also sells the tickets. I'm not accusing anybody of anything. I'm just saying, when the guy who owns the turnstile also owns the token booth, watch the token booth.
So what's the industry answer? A new protocol. Meta, Walmart, Stripe, Sierra, Genesys, Rocket, NiCE, Decagon — they've started working on an open standard for how agents talk to businesses, so you can separate the good bots from the bad. Agent-to-agent communication for commerce. And look, I'll say the quiet part: there was a line buried in the Ars Technica most-read list this whole week — "MCP for agent-to-agent comms may be the riskiest protocol you've never heard of." I'm not going to pretend I read that piece, I didn't have it in front of me. But the fact that it's trending tells you people are nervous about exactly this layer. You're building a brand-new set of rails for software to spend your money and act in your name, and the security model is being drawn up on a napkin while the agents are already out there getting bounced off Pizza Hut.
Here's my read for you, the builder. If you're building an agent product, the model isn't your problem. The model's fine. Your problem is distribution and access — the same way, twenty years ago, having a great app didn't matter if the carrier wouldn't put it on the phone. Meta figured this out fast, which is why they're doing brand-by-brand partnerships. When Muse works at Walmart, it's because there's a deal, and if it breaks, that's a bug somebody will fix. Everywhere there's no deal, it's a coin flip. So the winners in personal agents may not be whoever has the smartest assistant — it may be whoever signs the most partnerships and gets a seat at the table writing that protocol. The standard is the battlefield. And if you're a smaller player, you need to be thinking right now about whether you're going to be a signatory to that standard or a casualty of it. Because the companies in that room — Meta, Stripe, Walmart — they're writing the rules of the road, and the rules of the road tend to favor the people holding the pen.
And one more thing before I move on, because it connects. Yelp said something revealing: agents can get in if they pay, through the data licensing program. eBay restricts unauthorized agents but not all of them. You see where this goes? The open web had a deal — you crawl me, I get traffic, we both eat. The agent era breaks that deal, because the agent reads your page and the human never shows up to see your ads or your listings. So every website is now re-pricing access. Some will charge agents a toll. Some will demand a partnership. And the free, open, go-anywhere web that these agents were supposed to roam? It's quietly turning into a toll road, lane by lane. That's the real shift. Not the avatar. The access model underneath it.
Alright, let me move from the plumbing of who gets in, to the plumbing of what the models are allowed to do. Because there's a related tension playing out in cybersecurity this week, and it's a good one.
Two companies, same day, pointing in the same direction. First, Anthropic expanded what it calls its Cyber Verification Program. Now, the backdrop here: Anthropic's general models — Claude Opus, Claude Sonnet — are deliberately cautious about cyber work. They block most of it. Why? Because cybersecurity is dual-use. The exact same skill that helps a defender find a hole in their system helps an attacker crawl through it. So the safe default is: refuse. But defenders hate that, because to prove a vulnerability is real, you often have to actually demonstrate the exploit — and the safety filter slams the door right when you need it open.
So Anthropic built a tiered system. Three doors. Defense Access — for the security-ops crowd, incident response, reverse-engineering malware, the stuff a hospital or a city utility or an open-source maintainer needs. They say they'll turn those around in a few days. Then Red Team Access — adds authorized penetration testing for in-house red teams and pen-testing firms, takes a few weeks to vet, and still hard-blocks the really dangerous stuff like deploying ransomware or messing with physical systems. And then the top tier, Specialized Access — the smallest door, reserved for a handful of verified outfits authorized to test things that can kill people or break markets. Flight operating systems. Power grids. Interbank transfer rails. And for that tier, Anthropic says it reviews every org in depth in collaboration with the US government. So that's a frontier lab building a little immigration system for its own capabilities, with Uncle Sam co-signing the visas at the top level.
And they gave numbers, which I respect. They ran Claude Opus through a cyber-operations benchmark at each tier. No access — blocked on the first prompt, every time. Defense tier — blocked 46 of 50. Red Team tier — zero blocks, completed 34 of 50, which is basically the model's full unleashed score. And through their earlier program, called Project Glasswing, partners found at least 129,000 verified software vulnerabilities between April and July, more than 33,000 of them rated critical or high. Some partners said Claude sped up their vulnerability hunting by months, even years. That's a real number, that's defenders getting a genuine edge.
Now here's why I'm pairing it with Mistral, because they announced their new model the same day and they took the opposite philosophical stance, and watching the two side by side tells you something. Mistral launched a preview of Mistral Large 4 — they're calling it, and I'm not making this up, "le Chonk." A trillion-parameter model, 49 billion active, open weights, weights dropping end of the month. Built in Europe, trained on their own hardware, pitched hard on sovereignty — European deployment, European law, 160-plus languages including every official EU language.
But the part that matters for this conversation is what Mistral bragged about on cyber. They pointed out that on one key test — reproduce a real vulnerability in open-source software and then patch it — several leading closed models, and they named Claude Opus and GPT-6 Astra, score near zero. Why? Because they refuse the task. The safety filter kicks in. Mistral's model scores 82 percent, the highest of anybody, because it just does the work. And their argument is exactly the defenders' complaint: provider-level refusals block legitimate security work, and losing a capability mid-incident is itself a security risk. So their pitch is, ship it open, let organizations run it on their own hardware under their own policies, no refusal standing between you and your incident response.
So look at the fork in the road. Anthropic's answer to dual-use is: keep the brakes on by default, and build a careful, government-co-signed gate so verified defenders can get the brakes released. Mistral's answer is: no brakes, open weights, you own it, you're responsible. Both of them are solving the identical problem — defenders need capabilities that attackers also want — and they've landed in completely opposite places. One is centralized permission. The other is decentralized ownership.
And for you, the builder, this isn't abstract. If you're building anything in security tooling, this is your make-or-buy decision laid bare. Do you build on a hosted frontier model and apply to Anthropic's program, accept the data-retention requirement, wait a few days or a few weeks, and live inside their tiers? Or do you pull down Mistral's open weights, run them on your own infrastructure, and own both the capability and the liability? There's no free answer there. The hosted route gives you a safety net and a paper trail and somebody else's lawyers. The open route gives you control and no refusals and all the responsibility landing on your desk. Mistral even said the quiet part — their open model's going to be red-teamed with "state authorities" who get reduced moderation and expanded cyber capabilities. So even the open-weights crowd is quietly building relationships with governments. Everybody's dancing with the state here. They're just dancing to different songs.
I'll give you my gut: for most builders, the Anthropic tiered model is where enterprise buyers are going to feel comfortable, because enterprise buyers love a paper trail and somebody to sue. But the sovereignty pitch — run it yourself, no refusals, no provider who can cut you off mid-incident — that's going to win in exactly the places that can't tolerate a dependency: critical infrastructure, government, anybody who's been burned by a vendor pulling a capability at the wrong moment. Two markets, two models. Don't let anybody tell you one of them is obviously right.
Now let me shift the camera from what models are allowed to do, over to who's paying for the picks and shovels, because there's a funding story that's got a warning light blinking in it.
Lambda — the AI cloud outfit — is raising up to four billion dollars at a fourteen-and-a-half-billion pre-money valuation. Last private round, they say, before a planned 2027 IPO. Coatue and Blackstone leading. And on the surface, business is booming: their backlog went from fifteen billion in June to fifty billion in September. Fifty billion in backlog, that's a hockey stick, break out the champagne, right?
Hold on. Read the fine print. Almost all of that jump — a thirty-five-billion-dollar chunk of it — comes from one customer. Anthropic. Signed a deal with Lambda in late August. So Lambda's shiny fifty-billion backlog is really a fifteen-billion backlog plus one enormous bet on a single company's ability to keep paying the bill. And that, kiddos, is customer concentration, and it's the oldest red flag in the book. When one customer is most of your future revenue, you don't have a customer, you have a landlord. If Anthropic sneezes, Lambda catches pneumonia.
And here's where it gets a little hall-of-mirrors, and why I wanted to put it right after the Lambda-Anthropic thing. These neoclouds — Lambda, CoreWeave, Nebius, the British one Nscale that just filed — they build data centers on debt. Borrowed money. And the reporting says lenders are getting choosier about who they'll hand cash to. So the model is: borrow billions, build the data center, rent it to an AI lab, use that contract to borrow more. It's a tower of leverage leaning on a handful of big AI contracts. Lambda raising equity now, before the IPO, before public-market scrutiny kicks in — that's a company getting its hay in the barn while the sun's still out. You raise when you can, not when you have to. The fact that they're hustling capital in now, ahead of a 2027 debut they already pushed back once, tells you they'd rather have the cash than the clean story.
And connect it back to everything else today. Anthropic's the one giving startups a free year of Claude Team and a thousand bucks in credits — generous, subsidizing the next generation of builders. Anthropic's also the one that's a quarter of Lambda's backlog. Anthropic's heading toward its own IPO. So you've got this web where one lab is simultaneously the customer propping up a cloud provider's valuation, the subsidizer of the startup ecosystem, and a company whose own revenue — per that reporting floating around Wall Street — has leaned heavily on a couple of giant customers of its own. It's turtles all the way down. Everybody's backlog is somebody else's commitment, and everybody's commitment depends on the music not stopping. I'm not calling a bubble. I've been around long enough to know the guys who call bubbles for a living are wrong most of the time. But I am telling you: when you read "fifty-billion-dollar backlog," always, always ask whose signature is on it. One signature is not a backlog. One signature is a bet.
Alright, let me get us out of the money machine and into something with real stakes, the kind that doesn't care about your valuation.
There's a report that drones sank two cargo ships and set a third ablaze in the exclusive economic zones of NATO countries — and officials are pointing at Russia. Now I want to be careful and frame this right. The underlying war here is the one that's been grinding since February 2022, so this isn't some bolt from the blue. But this specific escalation — ships going down inside NATO members' economic zones for the first time — that's the new wrinkle, and it's an ugly one.
The particulars: a Togo-flagged ship called the Alfa Watan sank, a Palau-flagged ship called the Able was set on fire, hit by sea and aerial drones off the coast of Bulgaria. Day before, a Turkish-owned cargo ship in Romania's economic zone caught fire and sank, one crew member still missing, two killed. These are grain and corn ships, loaded out of Ukrainian ports. Bulgaria's prime minister called it an unacceptable attack and a blatant violation of maritime law. The EU's von der Leyen called it "increasingly concerning" but carefully didn't name an attacker — circumstances still being established, she said. Zelenskyy was blunter: his investigation with Bulgaria's navy called it a Russian combined attack, sea drones and aerial drones, and he noted Ukraine wasn't operating in that part of the Black Sea.
Why does this belong on a show for builders? Two reasons. One, it's the drone story again, and drones are a technology story. Ukraine, with almost no traditional navy, has been using drone boats to sink Russian warships — they even had a sea drone use a machine gun to take out a Russian kamikaze drone boat last month. That's a milestone in naval warfare that would've sounded like science fiction five years ago. The barrier to projecting force at sea has collapsed, and cheap autonomous hardware did it. Two — and this is the part that should keep a builder up at night — the report ties this to a wider pattern of what they're calling Russian hybrid warfare across Europe. And look at the targets. Romania found Russian drones near an offshore gas platform. Germany accused Russia of trying to blow up Ukrainian cargo aircraft at Leipzig Airport. Estonia tied an arson attack to a company that makes military robots for Ukraine. And Poland — this is the one — Poland is investigating a fire at a state satellite station that uses SpaceX's Starlink as an act of sabotage, what one official called a "new Russian doctrine of attack."
That's the thread. The infrastructure you build on — the satellite ground stations, the data centers, the gas platforms, the airports — is becoming a target in a gray-zone conflict where nobody formally declares anything. We covered, not long ago, a report about Russian drones hitting Ukraine's data centers by exploiting air defense gaps. Same doctrine. The physical layer under all our software is now in somebody's crosshairs, and the attacker gets to stay deniable. So if you're building anything that depends on a single ground station, a single cable, a single platform — resilience isn't a nice-to-have anymore. It's the whole ballgame. The cloud is somebody's building, and that building is in range.
Okay. Let me bring it back to the builder's garden with a few product stories, because there were a couple worth your time, and they rhyme with each other.
First, two new personal assistants launched, and they're both running from the big guys instead of toward them. Hark — from serial founder Brett Adcock — released Hark Pro. Free to start, paid tier for heavy users. Their whole pitch is modesty: they're not curing cancer, they're not building AGI, they're building a model trained specifically for computer use that just uses your computer for you. And their design guy, Abidur Chowdhury — former Apple — said the line that stuck with me: it's hilarious that fifty years into computing, the future is still a terminal, still you typing into a box with a keyboard. Hark's betting the real unlock is an interface, not a bigger brain. They even show you a little window of the agent browsing the web, so you can watch it work and learn to trust it. And the pitch has a dagger in it: "we're not Meta or OpenAI, we're not here to sell you ads and steal your data."
And right next to it, same day, Underdog — from a 19-year-old Thiel Fellow named Sigil Wen, who apparently lived in an AI hacker house with Andrej Karpathy as a teenager and got GPT-2 running on his Apple Watch for fun. Underdog runs entirely on your own device. Your data never leaves your machine. It uses a smaller model — a 27-billion-parameter thing fine-tuned from Qwen — which Wen argues was frontier-level about six months ago, and good enough for the everyday stuff. But here's the genuinely interesting part, and it's the part I want you to steal. The business model. Underdog's free and never ad-supported. Since it runs on your hardware, Wen's not paying a cloud provider for every token, so his costs are near zero. So how's he make money? He borrowed a page from fintech. Underdog takes a tiny cut of the payments the assistant makes using Stripe's rails — basically an interchange fee, like a credit card. His line: the assistant is as aligned with you as your bank is, because it never has to mine your data to get paid.
Now sit with that, because it connects right back to where we started today — the toll roads and the data deals. The dominant AI assistant model is: give me total access to your life, your medical stuff, your finances, your kids, and I'll monetize that somehow, probably ads, probably selling data, probably training on you. Underdog says: no, I take a sliver of your transactions and I never touch your data. That's a structurally different bargain. Whether it works — whether a quarter-point on your purchases funds a company — I have no idea, and neither does he, really. But it's the first business model I've seen in this category that doesn't require you to hand over your soul to use the thing. And in a week where we're watching websites toll agents and Cloudflare sell tickets to its own turnstile, a privacy-native, transaction-funded assistant is at least asking the right question: why should using AI require surrendering everything about yourself?
My caution for builders eyeing that model: an interchange fee is a thin, thin margin. Visa and Mastercard make it work on planetary volume. A startup assistant does not have planetary volume. So the on-device-privacy pitch is lovely and the fintech monetization is clever, but the math only closes if a lot of people let it spend a lot of their money. That's a chicken-and-egg problem — people won't trust a new agent with their wallet until it's proven, and it can't get proven without the volume. I'm rooting for it. I'm also keeping my hand on my wallet.
Couple of quick ones to round out the plate. OpenAI did two enterprise plays — expanded its partnership with Atlassian to wire frontier models into enterprise knowledge, planning and delivering work, and a thing with Ironclad to train agents on contracting workflows. Both of those are the same bet: computer use for professional work, the grind of the knowledge worker. Not glamorous. Very lucrative if it lands. That's OpenAI trying to own the boring billable hour, and the boring billable hour is where the actual money lives.
And there's a sharp little story from Russell Brandom about decision models for content moderation. A company called Musubi released a model called PolicyLM — open weights, lightweight — that takes a content policy written in plain English and applies it to a message in under fifty milliseconds. The clever bit: when your policy changes, you don't retrain the model. You just rewrite the policy in English and the model adapts. For anybody running a platform with user content, that's a real unlock — moderation that keeps the flexibility of a modern model but runs at classifier speed and cost, and lets your trust-and-safety people iterate the rules without calling the ML team every time. It's part of a broader wave of these "decision models" that output a judgment instead of a paragraph, which makes them faster and cheaper. File that one away if you've got a community product.
Last thing, and let me change the temperature completely, because not everything today is agents and leverage and drones. A physicist named Francis Halzen won the 2026 Nobel Prize in Physics — this is a recent announcement — for the IceCube Neutrino Observatory. And I want to tell you why a radio guy cares, because it's a builder story in disguise. The man's big idea, back in 1988, was that you could turn a cubic kilometer of Antarctic ice into a telescope. Not a telescope pointed at the sky — one buried in the ice, catching ghost particles from supermassive black holes in other galaxies. A postdoc remembered him blurting it out in an elevator — "you could do it in ice!" — and nobody knew what he was talking about. He said, and I love this, that in almost forty years of the project, nobody ever told him it was uninteresting — it was only ever a question of whether the technology would work. They started small. Study the ice. Build the drill. See if it works. And it worked, and now when you look at the neutrino sky, the signal from distant black holes is so bright you can't even see our own Milky Way.
Why's that on a tech show? Because it's the purest version of the thing every founder in today's episode is chasing. An audacious idea nobody understood, a decades-long slog on unglamorous engineering — the drill, the sensors, rejecting the background noise — and a willingness to start small and prove it rather than demand a billion dollars on a napkin. In a week where I've been telling you to squint at fifty-billion-dollar backlogs built on one signature, it's worth remembering what it looks like when somebody builds a real thing, over forty years, in the hardest place on earth, and it turns out the universe was talking the whole time and we just didn't have the ears.
That's the menu, kiddos. The through-line today: whether it's agents getting bounced at the checkout, labs deciding what their models may do, clouds leaning on one giant customer, or infrastructure in a gunsight — the fights that matter right now aren't about whose model is smartest. They're about access, permission, and who's holding the pen when the rules get written. Build accordingly. Keep your dependencies shallow and your eyes open.
This is Tony DeLuca. Go do something that'll still matter in forty years. I'll be right here tomorrow.