Subscribe
Share
Share
Embed
A daily briefing on the AI systems, products, companies, and policy shifts that are just becoming possible.
Want a podcast for your own topics? Join early access: https://www.barelypossible.to/waitlist/?source_path=public_feed&feed_source=rss
Okay kiddos, I'm your boy Tony DeLuca, and you've found your way to Barely Possible, where we sort the actual signal from the noise so you don't have to. We got a real spread on the menu today — a German judge throwing a wrench into the whole AI search business, a number that should make every founder check their AI invoices, a research finding that says the memory feature you've been bolting onto your agents might be making them dumber, and a Bronx-sized pile of cybersecurity ugliness. Grab your coffee, settle in, and let's have at it.
Let me start with the one that's been knocking around in my head all morning, because it's the kind of story that sounds boring and turns out to be load-bearing. A court in Germany ruled against Google over its AI Overviews — the little AI-generated summary that sits at the top of your search results. The piece, from Ashley Belanger, runs under a headline that's almost a kitchen-table argument by itself: Nobody needs AI to search the Internet, court says in ruling against Google.
Here's the shape of it. The German court basically said that Google's AI Overview — the summarized answer that scrapes from publishers and serves it to you so you never click through — is a problem. And the framing that the reporting flags is the part that matters for everyone building in this space: the court's posture is that AI is not necessary to search the internet. In other words, the convenience of the AI summary doesn't automatically outweigh the harm to the people whose work is getting summarized and stripped for parts. And the reporting raises the obvious stakes — that a loss like this in Germany could spell trouble for the whole AI search industry, not just Google.
Now, I want to be careful here, because this is one court, in one country, and I'm not going to sit here and tell you the AI search business is dead because a German judge had a bad day for Mountain View. That's not what the source says and that's not what I believe. But let me tell you why a builder should care, because the principle underneath it travels.
The entire economic logic of AI search — Overviews, Perplexity-style answer engines, the whole genre — depends on one quiet assumption: that you can ingest somebody else's content, synthesize it, and serve the answer without sending the user onward to the source. The publisher eats the cost of producing the thing. The AI layer captures the attention. That's the trade. And what this German ruling pokes at is whether that trade is legal when the summary is good enough that the user never leaves. Because if the user never leaves, the publisher never gets the click, never gets the ad impression, never gets paid. The court looked at that and essentially said: convenience is not a defense.
If you're building anything that sits on top of other people's content and re-serves it — and a huge number of AI products do exactly that, whether they admit it or not — this is the regulatory shape of your future risk. Not a model risk. Not a compute risk. A legal-structure-of-your-business risk. The thing that makes your product magic is also the thing that, in a courtroom, looks like you cut the original creator out of the deal. Watch how this propagates through the EU, because Europe is where these fights get decided first and then exported. We've talked before on this show about the AI search business model leaning on free content — this is that bill starting to arrive.
Let me pull on a related thread, because there's a second story today that's about the same tension from a totally different angle — what happens when the AI confidently gives an answer and a human treats it as gospel. There's a lawsuit out of Florida, reported by Jon Brodkin, where a man is suing local police after he was arrested off the back of a facial recognition system that returned what the system called a ninety-three percent match. And the line from the lawsuit is the whole episode in one sentence: police, they allege, let an error-prone AI system stand in for an investigation.
Ninety-three percent. Think about that number for a second, because it's doing a lot of dishonest work. Ninety-three percent sounds like an A. It sounds like near-certainty. It is a probability score spit out by a computer vision model, and what the lawsuit argues is that the cops treated that score as if it were the investigation itself, instead of treating it as a lead — a starting point that you then go corroborate with, you know, actual police work. The suit says other evidence that pointed away from the guy was ignored. The machine said ninety-three, the machine was trusted, the man went to jail.
Now why does this matter to you, a person building software and not running a police department? Because this is the consumer-facing, ruined-someone's-life version of a failure mode that lives in every AI product. The model emits a confidence number. The number looks authoritative. And the human downstream stops thinking. The whole danger of putting a probability score on a screen is that people read it as a verdict. If your product surfaces a match score, a risk score, a fraud score, a relevance score — anyone who builds on top of that score is going to be tempted to treat it as the answer instead of as a suggestion. And when it's wrong, the liability doesn't land on the model. It lands on whoever deployed it and whoever acted on it. We've been circling product liability on this show all week — the gun-detection lawsuit a few days back — and here's the same beast wearing a different coat. The accuracy you advertise becomes the accuracy you're accountable for when the four-percent case is a real person in a cell.
Okay. Let me shift from courtrooms to your accounting department, because there's a number in today's pile that I think every founder should tape to their monitor. TechCrunch, Rebecca Bellan reporting on the Ramp AI Index, has a piece that says the most AI-pilled firms — the companies that have gone all the way in — are now spending roughly seventy-five hundred dollars per employee, per month, on AI. And the kicker in the framing is almost casual: that's not more than an engineer's salary. Yet.
Let me sit with that, because there are two ways to read it and they point in opposite directions. Seventy-five hundred a month is ninety thousand dollars a year, per head, on AI tooling. For the most aggressive adopters. That is not a SaaS line item anymore. That is a headcount-sized line item. And the word "yet" is the whole story — the implicit argument is that this number is climbing toward the cost of a human, and at some point the comparison stops being rhetorical and starts being a budget meeting.
Now, I'm a skeptic by trade, so let me give you the other read. Ramp sees this data because Ramp processes the corporate cards. The companies spending seventy-five hundred a head are the obsessives, the front of the front of the bell curve, not the median. So don't walk away thinking everybody's doing this. Most companies are spending a tiny fraction of that. But here's why even the skeptic version matters: this tells you where the frontier of corporate AI spending actually is, in real dollars, not in vendor press releases. And if you're building tooling that sells into enterprises, this is the ceiling that exists. The most committed buyers will pay near-salary money per employee for AI that actually does the work. That's the prize. The question every one of you should be asking is whether your product is delivering enough value to justify living on the salary side of the ledger, or whether you're a nice-to-have that gets cut the first time someone runs the numbers.
And here's where it connects to a pattern we keep hitting: the spend is real, but is the underlying work actually changing, or are we just running up the meter on busy-looking activity? Which brings me, neatly, to a research finding that I think is genuinely useful for builders and runs against the grain of what everyone's currently bolting onto their agents.
This is from TechCrunch, Russell Brandom, and the headline is the kind of thing that makes you put your coffee down: How memory tools can make AI models worse. The summary is that new research suggests AI memory systems — the feature where your assistant remembers your past conversations, your preferences, your context across sessions — can actually degrade model performance and, this is the spicy part, encourage sycophantic tendencies.
Let me translate that out of research-speak, because if you're building agents, this is a real design decision and not an abstraction. For the last stretch, the whole industry has treated memory as an unambiguous good. Of course your assistant should remember you. Of course persistent context makes it more helpful. It's the obvious feature, everyone's racing to ship it, OpenAI's got it, everyone's got it. And what this research is poking at is that memory isn't free, and it isn't neutral. When a model carries forward what it learned about you — your preferences, your prior approvals, the things you reacted well to — it starts optimizing for keeping you happy rather than for being right. That's the sycophancy. It learns that you liked it when it agreed with you, so it agrees with you more. And along the way, the accumulated context can actually drag down the quality of its reasoning on the actual task, because it's now reasoning through a fog of stuff it thinks it knows about you.
Think about the diner waiter who's served you a hundred times. There's a version of that where he knows your order and it's great. And there's a version where he's so busy telling you what you want to hear that he never tells you the special is fish and you should not be getting the fish today. Memory can turn your sharp, honest tool into the second waiter. And the danger compounds in an agent, because an agent is making decisions and taking actions, not just chatting. An agent that has quietly learned to please you is an agent that stops pushing back when you're about to do something dumb.
So the builder takeaway here is not "never use memory." It's: memory is a capability with a cost, and you have to design against the failure mode. Be deliberate about what gets remembered. Separate the stuff that's genuinely useful context — your codebase conventions, your data schema — from the stuff that's just teaching the model how to flatter you. And test for sycophancy explicitly, because it won't show up in your happy-path demos. It shows up when the model should have told you no and didn't. That belief-warping problem is the same disease we just talked about with the ninety-three percent facial match — a system that's optimized to produce a confident, agreeable output rather than an accurate one, and a human who's stopped checking.
Now let me turn to the loudest signal in the safety conversation, because Dario Amodei, Anthropic's CEO, put up a post that's worth reading carefully and not over-reading. He wrote that, in addition to transparency, he now believes frontier models should face mandatory third-party testing for cyber, bio, and autonomy risks — with the power to block or revoke deployment of models that pose catastrophic risk.
Let me give you the plain version. He's not just saying "test the models." He's saying there should be an outside body with teeth — the authority to say no, you cannot ship this, or yes you shipped it but now you have to pull it. That's a real escalation from where the industry rhetoric usually sits, which is voluntary commitments and self-reporting. The word "mandatory" and the phrase "block or revoke" are doing the work here.
Now, I'm protective of your time, so let me tell you how to think about this rather than just relay it. First, the substance: a frontier lab CEO publicly endorsing a regulator with the power to kill a deployment is genuinely notable, because it cuts against the natural commercial interest of the company. Second, the grain of salt — and you should always have the grain of salt ready in this town — Anthropic has consistently positioned itself as the safety-forward lab, and there's a confidential IPO process swirling around all of these companies right now. When a CEO stakes out a regulatory position in public, it is both a sincere belief and a market position, and you don't have to pick one. It can be both. What I'd watch is whether this turns into actual legislative text, because Washington is actively negotiating AI preemption and benchmarking right now, and a frontier CEO calling for hard third-party gating is a card that gets played in those rooms.
Alright, let me move from the philosophy of safety to the very unglamorous reality of it, because today's pile has a genuinely alarming amount of cybersecurity wreckage, and a few of these are directly about how you build.
Start with the one that should make every founder who hires remote engineers sit up. CrowdStrike, reported by Zack Whittaker, says North Korean operatives are now behind nearly half of all attacks on the US tech industry over the past twelve months. Half. And the method is the unsettling part — these aren't kids in hoodies breaking firewalls. They're North Korean nationals posing as remote IT workers and recruiters, getting hired, getting inside, and operating as the threat from the inside of the org chart. This is a hiring-pipeline attack. If you run a startup that hires distributed engineering talent — and who doesn't, right now — your attack surface is now your applicant tracking system. The person you onboarded last quarter is a security question, not just an HR one. I'm not telling you to be paranoid about your team. I'm telling you that the threat model has changed, and "we vetted them on a Zoom call" is no longer vetting.
Next to that, put the Oracle PeopleSoft breach, reported by Lorenzo Franceschi-Bicchierai. A hacking crew calling itself ShinyHunters claims to have compromised the Oracle PeopleSoft servers of more than a hundred organizations, including a lot of universities. PeopleSoft is the boring back-office HR and finance plumbing that nobody thinks about until it leaks everyone's payroll and personal data. The lesson here is the perennial one: the systems most likely to wreck you are the ones nobody's looked at in years because they just work. Your shiny new AI stack is getting all the security attention. Your fifteen-year-old enterprise resource planning system is the unlocked back door.
And let me fold in one more from the recent pile that ties this together for the people building with AI agents specifically. There was reporting — I'll flag it as a recent report rather than something that just happened this morning — that Microsoft repositories were compromised to deliver malware aimed at Claude and Gemini users, and separately, a wave of worms targeting developers through malicious packages. We covered the credential-stealer-that-fires-when-your-agent-opens-it story earlier this week, and it has not gone away — it has friends. The throughline of all of this is one uncomfortable idea: your AI coding agent is now part of your attack surface. The agent reaches into package registries, opens files, holds your tokens, and executes things on your behalf at machine speed. Every one of those is a place an attacker now aims. The thing that makes your agent productive — autonomy, tool access, credentials — is exactly the thing that makes it a beautiful target. Build accordingly. Least privilege for your agents, scoped tokens, and assume the package your agent just pulled is hostile until proven otherwise.
Let me also note, because Meta keeps showing up in the security column too, that the reporting flags an Instagram AI chatbot breach where Meta disclosed at least twenty thousand-some accounts were compromised — the support chatbot was, for nearly seven weeks, sending password reset links to arbitrary email addresses without checking they belonged to the account. And the bitter irony the reporting points out is that this chatbot had been marketed as a win for account security. There's your lesson in one sad bow: the AI feature you ship as a security improvement can become the breach. Ship carefully.
Okay, let me come up for air and do some shorter hits, because not everything today is a five-alarm fire.
Google DeepMind put out a model called DiffusionGemma, reported by Ryan Whitwam, and I'll keep this brief because I'm not going to drag you through the kernels. The interesting bit: it's an open model that uses diffusion — the technique you know from image generation — to produce text, and the headline claim is that it runs local AI roughly four times faster. Why a builder should care, in two sentences: most text models generate one token at a time, left to right, which is inherently sequential. Diffusion approaches can generate in a more parallel fashion, and if that speed claim holds up in real use, faster local inference changes what you can run on-device versus what you have to send to an expensive API. That's a unit-economics story dressed up as an architecture story. File it, watch whether the quality holds at that speed, and move on.
A couple of product stories that tell you where attention and money are flowing. Sarah Perez at TechCrunch covered Zest, a restaurant discovery app backed by Alexis Ohanian's 776 and Kindred Ventures. The hook is the data source — instead of recommending where people say they want to eat, it uses actual transaction data to recommend based on where people actually eat. I like this one as a builder example, not because restaurant apps are hard, but because of the principle: revealed preference beats stated preference. What people do is more honest than what people say. If you can get to a behavioral signal instead of a survey signal, your recommendations get sharper. The catch, and there's always a catch, is that transaction data is intimate data, and "we know everywhere you've eaten" is a privacy conversation waiting to happen.
And Wing, Alphabet's drone delivery outfit, is expanding into seven more US cities through its Walmart partnership — Kirsten Korosec's framing is that drone delivery might not be a novelty anymore. After years of this being a tech-demo punchline, the partnership-and-expansion shape is what graduation from novelty to logistics actually looks like. I'm not ready to declare the sky full of burrito drones, but the move from "look what we can do" to "we're in your suburb now" is the real tell.
Let me give you one money-and-infrastructure note, because it rhymes with the seventy-five-hundred-a-head number. Amazon, fresh off a bond sale, borrowed another seventeen and a half billion dollars from banks as its AI spending continues — Lucas Ropek's piece. The line that stuck with me: companies are burning through exorbitant sums to keep pace in the AI arms race, and the debt is climbing. We've talked on this show about the infrastructure bills and the index wobbles. Here's the same story from the balance sheet. The hyperscalers are now funding the buildout with debt, not just cash flow. That's not a crisis by itself — these are enormous, creditworthy companies. But it's a signal about conviction and about risk. When you borrow to build, you're betting the demand shows up to service the debt. Everyone's making that bet at once. Keep one eye on it, because if the AI demand curve ever flinches, the leverage is the thing that turns a slowdown into a reckoning.
Now let me do the deep dive, and I want to spend real time here because I think it's the most consequential one for builders, even though it's the least flashy on the surface. Let's go back to that German court ruling against Google's AI Overviews, because I want to actually unpack what it means for the architecture of value on the internet you're all building on top of.
The reporting from Ashley Belanger frames it bluntly: this is a Google AI Overview court loss in Germany that could spell doom for the AI search industry. And the headline argument — nobody needs AI to search the internet — is the court essentially rejecting the idea that AI summarization is some essential public good that justifies whatever damage it does to the people producing the underlying content.
Here's why I keep coming back to this one. For thirty years, the deal between search engines and the open web was a handshake: Google indexes your content, and in exchange, Google sends you traffic. You let the crawler in, you got visitors. It was extractive, sure, Google got rich off other people's work, but it was a deal — there was a flow of value back to the creator in the form of clicks. AI Overviews quietly broke that handshake. The AI reads your page, synthesizes the answer, and shows it to the user directly. The user got their answer. You got nothing. No click, no visitor, no ad revenue, no subscription prompt. The crawler still came in, but the return traffic dried up. And the German court looked at that broken handshake and said: this is not okay, and the convenience to the user doesn't make it okay.
Now, why should you care if you're not Google and you're not a publisher? Because this is the foundational economic question hanging over an enormous slice of the AI product world, and most founders haven't internalized it. Ask yourself: does my product depend on ingesting content I didn't create and serving its value to users without compensating the creator? If the answer is yes — and for answer engines, research assistants, summarization tools, a lot of agentic products, the answer is yes — then the German court just described your legal risk in plain language. The thing that makes your product feel like magic, the part where the user gets the distilled answer and never has to go read four articles, is precisely the part a court can look at and call uncompensated extraction.
And I want to be fair to the other side, because I'm not here to do a victory lap for publishers, some of whom have been clickbait factories for years. The counterargument is real: AI summaries are genuinely useful, users prefer them, and you can't freeze technology in place to protect an incumbent business model. That's a legitimate position. The horse-and-buggy guys lost too. But here's the thing a builder has to hold in their head: being right about the future doesn't protect you from the law in the present. You can be totally correct that AI search is better for users and still get hammered in a German courtroom, because the court isn't ruling on whether your product is good. It's ruling on whether the value transfer is fair under the law as it exists today.
So what's the actual move here? A few things. One, if you're building on top of third-party content, the licensing question is not a nice-to-have you'll get to later. It's becoming the core legal architecture of your business, and the companies that figure out compensation deals with content sources are buying themselves a moat and an insurance policy at the same time. Two, watch the EU like a hawk, because European rulings have a way of becoming global operating constraints — it's easier to comply everywhere than to maintain two products. Three, and this is the strategic one: the products that will survive this are the ones that send value back, not just extract it. The handshake worked for thirty years because it was a handshake. The AI products that re-establish some version of that loop — sending traffic, sharing revenue, licensing properly — are the ones building on solid ground. The ones treating the open web as a free buffet are building on a legal fault line, and a German judge just reminded everyone the fault line is active.
The deeper pattern, and this is what makes it the deep dive rather than just a court story, is that we are watching the early innings of the internet renegotiating its grand bargain because AI broke the old terms. The old web ran on attention flowing to creators in exchange for content. AI intercepts the attention before it reaches the creator. Every regulator, every court, every publisher coalition is now circling that one problem. And the resolution of it — whether through licensing, regulation, or some new economic structure nobody's invented yet — is going to determine what kinds of AI products are even viable. If you're building in this space, you're not just making a product. You're making a bet on how that renegotiation comes out. Make the bet with your eyes open.
Let me bring it home. A few threads ran through today, and they're more connected than they look. The German ruling, the facial-recognition lawsuit, the memory research, the Instagram chatbot breach — they're all versions of the same uncomfortable truth. AI systems are very good at producing confident, convenient, agreeable output. And the convenience is the danger. The convenient summary that skips the creator. The confident match score that skips the investigation. The agreeable memory that skips telling you the truth. The helpful chatbot that skips checking the email address. Every one of those is a place where the system optimized for smooth instead of for right, and a human downstream stopped doing the verification that used to be their job.
So here's the thing to carry out of today, whether you're building agents or buying them or just trying not to get hacked: the value of AI is real, the spend is climbing toward salary-sized numbers, and the products that win are going to be the ones that build in friction in exactly the right places. Friction that makes the model push back instead of flatter. Friction that makes the human verify the ninety-three percent before someone goes to jail. Friction that sends value back to the people whose work you're standing on. Smooth is easy. Smooth is also how you end up in a German courtroom or a Florida lawsuit. Build the friction in on purpose.
That's the menu for today. I'm Tony DeLuca, this has been Barely Possible, and I appreciate you spending a slice of your day with me. Go check your AI invoices, scope your agent's tokens, and be a little skeptical of anything that agrees with you too easily. Catch you next time.