Subscribe
Share
Share
Embed
A daily briefing on the AI systems, products, companies, and policy shifts that are just becoming possible.
Want a podcast for your own topics? Join early access: https://www.barelypossible.to/waitlist/?source_path=public_feed&feed_source=rss
Okay kiddos, I'm your boy Tony DeLuca and this is Barely Possible, your fresh menu of AI morsels for a Fourth of July weekend where half the country is at the lake and the other half is quietly refreshing their token dashboards. Grab your coffee, or your leftover barbecue, whatever you got, and let's have at it.
Today I want to start with a story that, on the surface, looks like a nothing-burger. A company telling its own employees not to use somebody else's software. Happens every day. But when you look at who's doing it, and who they're doing it to, this one tells you a lot about where the whole industry is heading.
TechCrunch, Anthony Ha reporting, has a piece out that Alibaba has reportedly banned its employees from using Claude Code. Alibaba, according to the reporting, classified Claude Code — that's Anthropic's coding agent, the terminal-based thing that a whole lot of engineers have fallen in love with over the past year — as high-risk software. Internally. For their own people.
Now stop and think about that for a second. Alibaba isn't some corner bodega. This is one of the biggest technology companies on the planet, a cloud provider, a company that builds its own frontier models, the Qwen family. They have their own horse in the race. And they're telling their engineers: you cannot use the competitor's coding tool. It's on the banned list.
And here's why I think a founder or a builder should care, because it's easy to file this under 'big companies being paranoid.' The deeper thing here is that Claude Code, and tools like it, are not just editors. They're agents that read your codebase, they run commands, they have access to your files, and in a lot of setups they phone home. If you're Alibaba, and you're in a geopolitical relationship with the United States that is, let's be generous, complicated, the last thing you want is your crown-jewel source code being funneled through an American AI lab's agent that retains prompts and outputs for trust-and-safety review.
We've been circling the Anthropic-Alibaba relationship on this show for a couple weeks now. Remember, back at the end of June, we covered Anthropic accusing Alibaba of running a distillation attack — tens of thousands of accounts, tens of millions of conversations, allegedly siphoning Claude's outputs to train their own models. So there's history here. And now Alibaba turns around and classifies Claude Code as high-risk for its own staff. You can read that as a security decision, and it probably is. But you can also read it as the corporate cold war getting formalized. The two companies don't trust each other, and both of them are now writing that distrust into policy.
The lesson for the listener, the builder, is this: the tools you adopt are not neutral. When you bring an agentic coding tool into your company, you're bringing in something that has read access to your most valuable asset and network access to a third party. Alibaba has the resources to build their own internal alternative. Most of you don't. So the question you should be asking isn't 'is Claude Code good' — it obviously is — it's 'what does this thing see, where does that data go, and what's my retention posture.' That's a boring question. It's also the question that a sixty-billion-dollar company just decided was worth banning a beloved tool over.
And that connects straight into the next thing on the menu, because if the story of Alibaba is 'don't send your secrets through the American agent,' there's a companion story about people trying to get the American model on the cheap.
ChinaTalk has a piece — and I want to be careful here, I don't have a firm date on this one, so I'm not going to tell you it dropped this morning — but there's a ChinaTalk piece about how to buy cheap Claude tokens in, and the framing is all about the gray market that's grown up around access to Anthropic's models in places where official access is restricted or expensive. Now put that next to the Alibaba ban and you get the full picture of the moment we're in. On one side, you've got sophisticated players banning the tool because they don't trust where the data goes. On the other side, you've got a whole ecosystem of people trying to get to those same models through side doors because the models are that good and official access is that constrained.
That tension — the model is so valuable people will pay gray-market prices for it, and so risky that giants ban it internally — that's the actual texture of the AI market in the middle of 2026. Not the demo videos. This.
Alright, let me shift from the geopolitics of coding agents to a story that's a little more inside baseball but genuinely useful if you're a founder thinking about the browser and the desktop as an attack surface.
There's reporting out from CSO Online about sandbox bypass flaws in the Cursor IDE. And I know, I know, I said I'd keep the deep technical stuff short, and I will. But the headline here matters for everybody, not just security nerds. The finding is that prompt injection is now a remote-code-execution vector. Let me translate that into English. Prompt injection is when somebody hides malicious instructions inside content your AI agent reads — a webpage, a file, a README, a code comment. The agent reads it, thinks it's a legit instruction, and follows it. For a long time people treated prompt injection as an annoyance. Make the chatbot say something dumb, jailbreak it into cussing. Cute.
What the Cursor research shows, and what a companion piece from The Register about red-teamers turning Claude Desktop into a double agent shows, is that when your AI assistant has real permissions — it can run shell commands, it can touch your filesystem, it can open your database — prompt injection stops being a joke and becomes a way to actually run code on your machine. The sandbox that's supposed to contain the agent can be bypassed. And there's a related report from Sysdig about something they're calling agentic ransomware, automated database extortion, where the agent isn't the victim, the agent is the weapon. It goes in, finds your database, and does the extortion itself, at machine speed, without a human criminal babysitting every step.
Here's the founder takeaway, and it's not 'panic.' It's this: the security model you learned for regular software does not fully cover agents. When you give an agent tools, you're giving it capabilities, and every capability is a door. The old rule was 'never trust user input.' The new rule is 'never trust anything your agent reads,' because your agent reads the whole internet and it can't tell the difference between a helpful instruction and a poisoned one. If you're shipping an agentic product in 2026, threat-modeling the injection path isn't optional anymore. It's the ballgame. The links to all three of those writeups will be in the show notes.
Now let's move from the dark side of agents to the business side, because I want to spend a little real time on the story I think is most consequential for you, the person building a company. And it's the deep dive today.
There's a substack piece — the outlet is Crossing River — with a headline I can't stop thinking about: four million mini-programs, one AI agent. And I want to be upfront, I don't have a firm publication date pinned on this one, so I'm not going to pretend it landed today. But the idea in it is the kind of thing that should change how you think about product surface area.
Here's the setup, and it connects to a whole world a lot of Western builders don't spend enough time on: the Chinese super-app ecosystem. On platforms like WeChat, you don't have a phone full of separate apps the way you do in the States. You have mini-programs. Millions of them — the piece puts it at four million — little apps that live inside the super-app. You don't download them, you don't manage them, they just exist inside the platform, and you summon them when you need them. Order food, book a doctor, pay a bill, hail a ride — mini-programs, all inside one shell.
Now here's the pivot, and this is why I flagged it as the deep dive. The argument is that the AI agent becomes the new front door to all four million of those. Instead of you, the user, knowing which mini-program does what, and tapping around to find it, you tell the agent what you want, and the agent figures out which of the four million little programs to invoke, chains them together, and gets the thing done. The mini-program stops being something a human browses to. It becomes a capability that an agent calls.
Sit with that, because it's a genuinely different mental model than the one most Western product people carry around. In the West, we've spent fifteen years obsessing over the app. Get on the home screen. Own the icon. Win the tap. The whole business model of consumer software is about grabbing a slot in the user's attention and holding it. And what this super-app-plus-agent picture suggests is that the entire layer — the icon, the tap, the discovery, the navigation — could collapse into the agent. The user doesn't browse your app. The user asks the agent, and the agent decides whether your service gets called at all.
For a founder that's terrifying and exciting in equal measure. Terrifying because if the agent is the front door, then whoever owns the agent owns the relationship with the customer, and your beautiful app becomes a backend service that gets called or doesn't. You lose the direct line. You lose the home screen real estate you fought for. You become, effectively, a plugin. Exciting because — and this is the part I want you to actually chew on — if discovery collapses into 'can the agent find you and call you,' then the game shifts from marketing and app-store optimization to being cleanly callable. Being the best, most reliable, most legible service the agent can reach for. That's a very different competition. It rewards being good at the thing and being easy to integrate, and it punishes being a walled garden that the agent can't get into.
And here's the connective tissue, because I don't want to leave this as a China curiosity. Look at what's happening on the Western side and you see the same shape forming from a different direction. There's a Latent Space piece — again, I'm not going to date it precisely — about Vercel and this idea of agents as the new software. Vercel is a company most of you know as the folks behind Next.js and a big chunk of the modern web deployment stack. And the argument there is adjacent: that agents themselves become the unit of software you build and ship, not just a feature you bolt on. Different ecosystem, different starting point — the American developer-tools world instead of the Chinese consumer super-app world — but they're converging on the same idea. The agent is the thing. The agent is the interface, the agent is the runtime, the agent is the front door.
So when you put the four-million-mini-programs story next to the Vercel story, the pattern for a founder is: start asking yourself, in your own product, what does it look like when the primary user of your software is not a human clicking, but an agent calling. Because whether it comes from the WeChat direction or the Vercel direction, that's the water we're swimming into. And the companies that architect for it early — clean interfaces, machine-legible capabilities, no dark patterns that only work on a distracted human thumb — those are the ones that survive the transition. Both of those pieces are in the show notes. They're worth your actual reading time.
Alright, let me come up for air and talk about a company that keeps getting name-checked as the answer to all this consolidation anxiety.
TechCrunch ran an explainer, Anna Heim writing, an everything-you-need-to-know piece on Mistral AI, the French lab, framed as the OpenAI competitor. Now, an explainer isn't news exactly, but the fact that a major outlet felt the need to run a 'what is Mistral' primer tells you something about the moment. Mistral's whole pitch, since they started in 2023, has been to, in their words, put frontier AI in the hands of everyone. They ship some open-source models. They've raised serious money. And they've become the go-to name whenever anybody in Europe — or anybody nervous about American and Chinese lab concentration — wants to point at an alternative.
And here's why that matters against the backdrop of everything we just talked about. We've spent this episode on the anxiety of concentration — Alibaba banning the American tool, gray markets for Claude tokens, governments rationing frontier access, the agent-as-front-door swallowing your product. Mistral is the market's attempt at an answer to sovereignty anxiety. A European lab, open weights, not beholden to Washington or Beijing. Whether they can actually stay at the frontier is a genuine open question — being the plucky open alternative is a hard business to sustain when the leaders are spending tens of billions on compute. But the reason people keep bringing them up is exactly the reason Alibaba banned Claude Code: everybody is suddenly, urgently aware of who they depend on. Mistral is the hedge. The explainer's in the show notes if you want the full backstory on the funding and the models.
Now let me pivot to Hollywood, because there's a legal move here that's genuinely clever and a little bit delicious.
TechCrunch, Anthony Ha again, reporting that Midjourney — the image-generation company, currently tangled in a legal dispute with three Hollywood studios — is now trying to compel those studios to reveal the details of their own AI usage. Read that again. The studios are suing Midjourney, presumably over generated images that resemble their copyrighted characters. And Midjourney's response, in part, is: oh yeah? Show us how you use AI. Open your books.
And I gotta tip my cap, because as a legal maneuver that's got some teeth. The whole moral posture of the studios in these fights is that AI companies are the pirates, the freeloaders, training on other people's work. And Midjourney is essentially saying: let's see how clean your hands are. Let's see how much AI is in your pipeline, in your VFX, in your concept art, in your writers' rooms. Because we all know Hollywood didn't exactly stay pure while they were publicly wringing their hands about it.
For the builder, there's a real lesson buried in the litigation tactics. The copyright fights over generative AI are not going to be settled by clean moral lines, because there aren't any clean moral lines. Everybody's using it. The studios that are suing are using it. The publishers who are furious are using it. This discovery request is designed to expose exactly that hypocrisy, and in doing so, it muddies the water in Midjourney's favor. If you're building anything in the generative space, the takeaway is that the law here is going to be shaped less by principle and more by mutual exposure — the fact that both sides have dirty hands may end up being the thing that produces a workable settlement regime. Not idealism. Leverage. The story's in the show notes.
Let me stay in the culture lane for one more, because it's the Fourth of July and Google decided to get patriotic.
There's a new Google commercial, and the conceit is: what if the Founding Fathers had access to Google Workspace? Two hundred and fifty years after the signing of the Declaration of Independence, the ad imagines Jefferson and company drafting the thing with a little help from AI. Now I'll be honest with you, my first reaction was a groan. There's something a little rich about a company facing a four-point-seven-billion-dollar EU antitrust fine — which, remember, we covered a couple days ago — cosplaying as the spirit of 1776. The Declaration of Independence was, among other things, a document about breaking free from a concentrated, unaccountable power. Having it 'written with help from' a trillion-dollar ad-and-search monopoly's productivity suite is a level of irony that I don't think the ad team fully clocked.
But set my snark aside, because there's an actual signal in it for builders. When a company like Google is running Fourth-of-July brand advertising built entirely around AI-assisted writing, that tells you the consumer-normalization phase is in full swing. This isn't a product demo for developers. This is a feel-good national-holiday spot aimed at your aunt. The message is: AI writing help is as American as fireworks, it's wholesome, it's for everybody. That's a company trying to move AI from 'scary disruptive thing' to 'the friendly assistant that helped Thomas Jefferson.' Whether that lands or curdles, that's the marketing frontier now. And if you're building consumer AI, that's the emotional register the biggest players are betting on: warm, familiar, patriotic, safe. File it away.
Okay, let me get to a couple of infrastructure notes, and I'll keep the hardware stuff tight because I promised you I would.
There's reporting floating around — the outlet is TechTimes, and I want to flag clearly that I don't have a locked date on this one, so I'm not calling it today's news — about Nvidia and the Rubin Ultra, the four-die GPU, reportedly being cancelled or scaled back because of packaging limits, with the suggestion that 2027 performance gets cut roughly in half versus what was hoped. Now I'm not going to take you down into the advanced-packaging weeds. Here's the only thing you need to hold onto: we keep being told the compute curve goes up and to the right forever, and every few weeks there's another reminder that the physical world has opinions. Packaging, memory, power — the bottlenecks keep moving but they don't disappear. If the Rubin Ultra reporting holds up, it's another data point that the 'just add more compute' era is running into real manufacturing walls.
And that dovetails with the power side of the same coin. There's a report about a Department of Energy emergency order tied to AI data centers, backup generators, and record demand on the PJM grid — PJM being the big grid operator across a chunk of the eastern United States. Again, I can't pin the exact date, so I'm framing this as a report rather than a today-thing. But the shape of it is now completely familiar to anyone who's been listening to this show. The AI buildout is colliding with the electrical grid. We covered Honda pivoting to data centers, we covered the SpaceX and Reflection AI compute leases, we covered the memory shortage sending chipmaker profits through the roof. This is the same story from the electricity angle: the demand is so intense that emergency orders and backup generators are entering the conversation. The bottleneck for AI in 2026 is increasingly not intelligence. It's electrons and packaging. For a founder, that's a cost-and-availability story — the price and the reliability of the compute you're renting is downstream of grid fights you have zero control over.
There's also a related note about Nvidia and Valar Atomics and microreactors for AI data centers — the idea being that if the grid can't keep up, you build small nuclear reactors next to the data center. Which, look, tells you exactly how desperate the power math has gotten. When your infrastructure plan includes 'and then we build our own reactor,' you are not in a normal industry anymore. I'll put what I can in the show notes, with the caveat that the dating on these is soft.
Let me connect those infrastructure notes to one more that's genuinely about the business model. There's a TechTimes report — same date caveat, treat it as a report not a bulletin — that OpenAI has halved its inference costs through software alone, without new GPUs, with the framing that per-query GPU costs dropped substantially. And I flag this one because it's the optimistic counterweight to all the doom about packaging and power. If the labs can keep squeezing efficiency out of software — better serving, better routing, smarter batching — then some of the compute crunch gets relieved without needing more physical hardware. That's the tension that's going to define the economics of this whole thing: physical bottlenecks pushing costs up, software efficiency pushing costs down, and where they meet determines whether your inference bill next year is brutal or bearable. Keep an eye on both curves.
Alright, I want to step outside the AI hall of mirrors for a minute, because there's a couple of stories on today's menu that are just good, honest science, and you should get to be a curious human, not just a founder.
Ars Technica, Jacek Krywko reporting, has a piece: a martian rock has lots of carbon on it, and it's not clear why. And the tantalizing line is that biology could explain the find — but there are other potential explanations. Now, I want to be the OG at the diner counter here and cool your jets before anybody starts yelling 'life on Mars.' The whole point of the reporting is restraint. There's a rock, it's carbon-rich, and carbon is the element life is built on, so of course everybody's ears perk up. But carbon can get concentrated by plenty of processes that have nothing to do with anything ever being alive — geochemistry, mineral reactions, the boring stuff. The honest scientific position is: interesting, unexplained, don't get ahead of ourselves. And I actually love that as a posture, because it's the exact opposite of how the AI industry markets itself. 'We found a thing, we don't fully understand it, here are the several unglamorous explanations that are probably true.' Imagine an AI lab talking like that. Anyway, the piece is in the show notes and it's a good weekend read.
The companion science story, also Ars Technica, this one from Victoria Clayton of Knowable Magazine, is about what happens when the ability to smell goes away. And this one's quietly important for anybody with an aging parent or, frankly, for yourself. The finding is that disturbances in your sense of smell are often linked to problems with brain health. Losing your sense of smell can be an early warning sign — it shows up ahead of certain neurological conditions. It's the kind of thing that's easy to dismiss, you figure your nose is just off, but it can be your body's early-warning system flashing. Not an AI story at all. Just a genuinely useful piece of health knowledge, and I'd rather send you into the weekend with that than another take on model pricing.
And since it's a holiday weekend and people are actually going to the movies, one more from Ars, Jennifer Ouellette reviewing Supergirl — the verdict being it's not the disaster its low box office suggests. It's a pretty good movie, she says, but it needed to be a great movie to thrive in an oversaturated superhero market. And honestly, that's a business lesson dressed up as a film review, isn't it. 'Pretty good' doesn't cut it in a crowded market. You have to be great, or you have to be different, or you get lost in the pile. Ask anybody who's launched the four-hundredth AI note-taking app this year. The market for superheroes and the market for AI wrappers have that much in common: good is the new invisible.
Couple of quick ones before I let you go. TechCrunch has out an AI glossary — the only AI glossary you'll need this year, they call it, put together by Natasha Lomas, Romain Dillet, Kyle Wiggers, and Lucas Ropek. If you've got somebody in your life who keeps nodding along when you say 'hallucination' or 'agentic' and you can tell they have no idea, send them that. It's a decent plain-language reference and there's no shame in leveling up the vocabulary. Link's in the notes.
And for the founders who are actually building right now: TechCrunch is reminding folks that Startup Battlefield Australia applications close July 6. So if you're down that way, or you can get down that way, and you've got something worth pitching, the clock is basically at zero. That's tomorrow. Don't say I didn't tell you. Link's in the show notes.
Let me bring this in for a landing. If there's a thread running through today, it's this: everybody in AI is suddenly, painfully aware of who they depend on. Alibaba banning Claude Code because they don't trust where the code goes. Gray markets springing up because official access is rationed. Mistral getting the explainer treatment because Europe wants a hedge. The mini-program story and the Vercel story both pointing at a world where the agent becomes the front door and your product becomes a service that gets called or doesn't. Grid emergency orders and cancelled GPUs reminding everyone that the physical world still holds the leash. It's all the same anxiety wearing different outfits: concentration, dependency, and the scramble to hedge against it.
For you, the builder, the move isn't to panic about any one of those. It's to notice the shape. Ask where your dependencies are. Ask what your agent can see and where that data goes. Ask what your product looks like when the user is a machine calling you, not a human tapping you. The founders who ask those questions early are the ones who won't get blindsided when the water they're swimming in finishes changing.
That's the menu for today. Go enjoy what's left of your weekend, hug somebody, eat something off a grill, and if you lose your sense of smell doing it, maybe get that checked. This has been Barely Possible. I'm Tony DeLuca, and I'll catch you next time — stay curious, stay skeptical, and don't hand the keys to anybody you wouldn't lend your car to.