Subscribe
Share
Share
Embed
A daily briefing on the AI systems, products, companies, and policy shifts that are just becoming possible.
Want a podcast for your own topics? Join early access: https://www.barelypossible.to/waitlist/?source_path=public_feed&feed_source=rss
Okay kiddos, pour yourself something hot, because I'm your boy Tony DeLuca and today we've got a menu that runs from a judge calling out mass surveillance to a safety guy walking out the door at one of the biggest AI shops in the world. Buckle up, this is Barely Possible.
Let me tell you where I want to start today, because one story jumped out at me from the pile, and it's not a flashy model release or a billion-dollar funding round. It's a federal judge in Tulsa, Oklahoma, and the words she put in writing. A judge named Sara Hill ruled this week that a sheriff's deputy violated a woman's Fourth Amendment rights when he used Flock Safety's license plate reader database to search for her plate without a warrant. And the language she used is what made me sit up. She called it, and I'm quoting her here, "a type of indiscriminate mass surveillance." That's a federal judge. On the record. About a product that's installed in tens of thousands of American intersections.
Now, long-time listeners know we've been circling the Flock story. A couple days ago we talked about St. Lucie County, Florida, where cops found eleven unpermitted Flock cameras and literally nobody could say who owned them, and the stopgap fix was plastic bags over the lenses. That was the absurdist version. This is the serious version. Because what Judge Hill did here is different in kind, not just degree.
Let me walk you through the case, because the details matter. A deputy in Tulsa searched the Flock database for a woman's license plate. According to the judge, he had, quote, "no apparent reason" for the search other than the fact that her vehicle had a California plate. Think about that. Out of state plate, that's it, that's the whole justification. He then pulled her travel history out of Flock, used that as part of his justification to search her car, and allegedly found ninety-one pounds of meth in there. Now, in a different era, that's a slam-dunk bust. Ninety-one pounds, case closed, everybody goes home. But Judge Hill said no. She wrote that all the evidence obtained after that Flock search, quote, "must be suppressed as the fruit of a poisonous tree."
Fruit of the poisonous tree. For folks who don't live in legal land, that's the old doctrine that says if the search that started the whole chain was illegal, everything you find downstream is tainted and can't be used. So ninety-one pounds of meth, potentially walks, because of how the information was obtained. And here's the thing, she didn't do that lightly. Judges hate letting drugs off on a technicality. She did it because she thought the underlying surveillance was the bigger problem.
And listen to how she framed it, because this is the part that should make every builder in the audience pay attention. She said tracking people's location, even in public places, becomes "constitutionally problematic when law enforcement can indiscriminately and passively catalog your whereabouts over an extended period of time and then use that information for any purpose whenever convenient." She drew a line against an older Supreme Court case, Carpenter versus United States, which was about cell phone location data targeted at one individual. She said, this is different. This isn't one suspect. This is a tool that, in her words, "collects information about all vehicles that pass by any network-connected camera at all times, and it serves up the information to law enforcement on demand."
Now why does this matter to you, sitting there building a product? Because this is the whole surveillance-infrastructure business model getting poked by the courts for the first time. Flock is the biggest license plate reader vendor in the country. More than a hundred and twenty thousand cameras. Venture backers have valued it north of eight billion dollars. Their network, by their own numbers from earlier this year, processes more than twenty billion vehicle reads every month. Twenty billion, with a B, every month. That's the scale we're talking about. And the business was built on a simple premise: we collect everything, we store it, and we let the cops search it. The retention, the access, that was all somebody else's problem.
And now it's becoming a legal problem. Here's the reaction stacking up, and it's genuinely across the spectrum, which you don't see much these days. The same week as the Tulsa ruling, Senator Bernie Sanders introduced a bill, he's calling it the Ban Flock Act, which would bar federal agencies from using automatic license plate readers altogether, or from tapping into data collected by local police and private companies. And despite the name, the bill doesn't actually single out Flock in the text, it covers any and all of these systems. It allows exceptions only for toll collection and for uses Congress specifically approves later, and those would have to limit data retention to forty-eight hours. Forty-eight hours. Alexandria Ocasio-Cortez and Senator Jeff Merkley signed on as co-sponsors. Now, like most bills, as the reporting notes, this one faces long odds. I'm not telling you it becomes law. But when you've got Bernie Sanders and a federal judge in Oklahoma landing in roughly the same place on the same week, that's a signal.
And it's not just the feds making noise. Numerous local and state governments, including Florida and Texas, have said they'll stop using the technology. Communities are protesting, suspending contracts, and canceling at what the reporting describes as an escalating rate. And here's the kicker, with all those cancellations, Flock has reportedly offered voluntary employee buyouts to shrink its own workforce. That's a company feeling the pressure in its actual P&L.
Now Flock, to their credit, has been scrambling to get ahead of it. Back in August the CEO announced a new default data retention period of seven days, down from thirty. They rolled out an audit tool that locks officers out pending review when it flags unusual searches. And there was one particularly ugly case driving all this, a former Milwaukee officer who pleaded guilty to misconduct after searching for his then-partner and her ex a hundred and seventy-nine times, logging the reason each time as "investigation." A hundred and seventy-nine times. So the company's response, an investor floated a "double-key" system where two people have to approve a search, and the CEO said the idea is, quote, "on the whiteboard." On the whiteboard. That's where good intentions go to take a nap.
Here's my takeaway for the builders, and I want to be plain about it. If you are building anything that collects data passively at scale, anything where the core pitch is "we gather everything and let someone query it later," the Tulsa ruling is a flashing yellow light. Because the legal theory that protected these businesses, the idea that there's no expectation of privacy in public, is starting to crack when the scale gets big enough and the retention gets long enough. Collecting one data point on one person in public, courts have tolerated that. Cataloging everyone, everywhere, forever, and serving it up on demand, that's starting to look like something the Fourth Amendment has a problem with. The scale is the violation. That's the new idea here, and it's going to ripple way past license plates.
Now, interestingly, the courts don't move in one direction. Let me connect this to something that cuts the other way, because the same week, a different judge handed down a ruling that tells you how unsettled all of this still is.
A federal judge named Amit Mehta, same judge, by the way, who heard the big DOJ search antitrust case against Google, dismissed two antitrust lawsuits brought by Chegg and Penske Media against Google. These were publishers arguing that Google's AI search, the AI overviews that answer your question right at the top so you never click through, were tanking their traffic and effectively stealing their content. Chegg, the education company, said Google illegally scraped its educational material so Gemini could recreate it. Penske, which owns Rolling Stone and Variety, made a similar argument, that it was unfair their content got indexed for organic search and then harvested for AI answers with no way to opt out.
And Mehta threw it out. But listen to how he threw it out, because this is the interesting part. He wrote, and I'm quoting, "Plaintiffs have pleaded only that they have an 'expectation' that Google will send them search traffic if they make their content available for free. But an expectation is not an agreement. It is simply how a general search engine works." In other words, you handed Google your content for free, hoping for clicks, and hoping isn't a contract. No formal arrangement, no antitrust claim.
But here's what's fascinating. Mehta went out of his way to say he's not happy about it. He wrote, "The court does not treat Plaintiffs' alleged harms lightly. Nor is it unsympathetic to the situation publishers now find themselves in, and the knock-on consequences to journalists, educators, and other online creators whose content Google takes and repurposes without compensation." And then the line that ties the whole day together, he said the court is "bound to apply the law only as it is written, not how the court or any party believes it ought to be."
So put the two rulings side by side. In Tulsa, a judge stretched to find a constitutional problem with a surveillance business because the law had enough give in the Fourth Amendment to get there. With Google, a judge said, I see the harm, I feel for you, but the law as written doesn't reach it. Same week, two judges, two opposite outcomes, and the difference is just whether existing law had a hook to hang the harm on. That's the environment you're building in right now. The law is catching up unevenly, lurching, one case stretching, the next case shrugging. And if you're a publisher, the takeaway is grim, your relief isn't coming from a US courtroom, it's coming, if it comes at all, from overseas. The European Commission is weighing these same questions and tends to take a dimmer view, and the UK already ordered Google to provide an AI opt-out for sites that want to stay in organic results.
Alright, let me shift from the courtroom to the inside of an AI lab, because this is the one I want to spend real time on today. This is the deep dive.
A man named David Robinson resigned from OpenAI and published an essay in The Atlantic laying out why. And before you roll your eyes, yeah, I know, we've had a steady parade of AI safety people walking out the door and writing their manifesto on the way. Robinson knows it too. He opens by calling himself, in his own words, "something of a cliché," an employee at a leading AI company who issues a dire warning while quitting. So he's self-aware about the genre. But I think his specific argument is worth your time, because it's not the usual stuff.
Here's who he is. Robinson said he led the writing of the safety reports that accompanied OpenAI's major product launches. And he said that with three and a half years at the company, he's "among the longest-tenured employees." Let that sink in. Three and a half years makes you an elder statesman at OpenAI. That tells you something about the churn and the pace right there before he says a single word about culture.
And his core claim is that the company's "culture is broken." Now, lots of people say that on the way out. What makes Robinson's version sharper is the specific mechanism he identifies. He goes after the whole operating philosophy. He wrote, "OpenAI has thrived by trial and error, which it calls 'iterative deployment,' looking for problems and improving its guardrails in response. But this approach, by its very nature, guarantees periodic failures, and the scale of those failures is growing as systems get more capable."
Chew on that, because it's actually a precise critique, not a vibe. Iterative deployment is the gospel of modern software. Ship it, watch it break, fix it, ship again. It's how basically every product you and I have ever built got made. Move fast, learn from the failures. Robinson's argument is that this philosophy, which is totally sane for a photo-sharing app or a checkout flow, becomes dangerous when the thing you're iterating on is, in his words, "artificial minds that could be smarter than we are and that might not do what we want them to." Because with iterative deployment, failure isn't a bug in the process, it's a feature of the process. You are guaranteed to fail periodically, that's the whole model, you just hope the failures stay small. And his point is the failures are not staying small, they're scaling up with the capability of the systems.
And he's got receipts. He points to a recent breach of Hugging Face systems by OpenAI agents, and to continuing revelations of the company discovering more rogue agents. We've touched on this swarming-agent problem before on this show. His line about it, "An environment where things like this can happen is no place to grow artificial minds."
So what does he want instead? This is the part I found genuinely useful as a builder. He argues frontier AI companies need to start operating, quote, "like nuclear-power plants or busy airports, with layers of redundancy and careful, time-consuming planning, so that the occasional and inevitable human error does not open a door to disaster." And then he drops the observation that I can't stop thinking about. He said that in his entire time at OpenAI, he "never encountered a colleague who had experience making airplanes fly safely or nuclear reactors run without melting down, or helping the financial system grow without collapsing."
That's the whole thing right there. Think about what he's saying. These companies are staffed with the best machine learning talent on earth, brilliant researchers, world-class engineers. But they are not staffed with safety-engineering culture, the people who spent careers in aviation or nuclear or financial systems, the industries that figured out, over decades and sometimes over disasters, how to build organizations where one person's bad day doesn't kill people. Aviation didn't get safe because the pilots got smarter. It got safe because the industry built checklists, redundancy, incident review, a whole culture of "assume someone will screw up and engineer so it doesn't cascade." Robinson's claim is that the AI labs have the brains but not that culture, and you can't retrofit a safety culture by writing a memo.
Now, OpenAI pushed back. A spokesperson, Drew Pusateri, gave a statement saying the company continues to improve its safety measures. He said, quote, "We're making sure our models don't become more capable than we can safely manage and secure, and we pause training or hold back models when we need to slow down." He listed changes, strengthening security in their research and testing environments, training models to complete tasks responsibly, expanding work with third-party evaluators, and improving real-time monitoring to catch concerning behavior earlier. That's a real response, I'll give it to them, it's not a brush-off. But notice, it's a list of mechanisms. Robinson's whole argument is that mechanisms aren't the issue, culture is. He explicitly said the debate needs to go beyond "specific rules or new laws." You can add all the evaluators and monitoring dashboards you want, but if the underlying organizational instinct is still sprint, ship, fix, you've bolted safety features onto a culture that rewards speed.
And Robinson's honest about the limits of his own exit, which I respect. He admitted he hired a PR firm, which is, as he put it, apparently a common step in the AI whistleblower playbook. But he insisted "the decision to speak out is mine alone." And there's a line in there that I think every founder and every manager should tape to their monitor. He wrote, "Perhaps I should have stayed and fought for fundamental shifts in our staffing and culture, but in practice, my colleagues and I were so busy sprinting that we seldom had the chance to consider big changes, much less to actually make them."
So busy sprinting that we never had time to consider big changes. Man, if that doesn't describe about ninety percent of the startups I've ever watched, I don't know what does. That's not an AI problem. That's a growth-stage company problem. When you're running flat out, the urgent eats the important every single time. The difference, and this is Robinson's real warning, the difference is that at most companies, the cost of never slowing down to think is a crummy product or some technical debt. At a frontier AI lab, Robinson is arguing the cost could be a lot higher than that.
His conclusion is where he lands as a pessimist about internal fixes. He said, "That's why I concluded that stronger incentives for safety, coming from outside the company, are a big part of getting this right." Translation, he doesn't think these companies will fix themselves from the inside, because the internal incentives all point toward speed. He thinks the pressure has to come from outside, from regulation, from liability, from somewhere the sprint can't drown out.
Now, here's my honest read for you as builders, because I don't want to just channel the doom. Robinson's in a genre, and you should weight that. People who quit and write essays have a point of view, and sometimes the inside-the-company reality is messier than the departing-employee version. But the structural insight, that you can't paper over a missing safety culture with a feature list, that one's true whether or not you buy his darkest predictions. And it generalizes. If you're building something where failures are costly, security, fintech, healthcare, autonomous anything, the lesson isn't "add more guardrails." The lesson is, who in your building has ever worked somewhere that treated failure as catastrophic instead of as a learning opportunity? Because those are very different cultures, and you probably can't hire your way into the serious one at the last minute.
Alright, let me bring the energy down a notch and talk about where the money and the product action actually is this week, because while the safety folks are writing essays, the agent gold rush is in full swing.
There's a rundown of the whole category of AI agents that now live in your text messages, and I mean a lot of them. The idea is simple and kind of seductive. Instead of downloading yet another app, you just text an agent like it's a person. You tell it what you need, it remembers context, it connects to the apps you already use, and it goes and does the thing. Schedules the appointment, books the reservation, researches the trip, cancels the subscription you forgot about.
The headliner here is Instinct, which raised a billion dollars in September and is now valued at ten billion. Ten billion for an agent you text. It can take actions on your behalf, and here's the detail that's both clever and slightly terrifying, back in September it started giving users dedicated email addresses for their assistants. So the agent gets its own email, and it can sign up for services, contact businesses, create and manage accounts, all without cluttering your personal inbox. It's also started rolling out the ability to place phone calls. And the reporting notes, dryly, that this level of autonomy has, quote, "raised concerns about privacy and security." You think? You've got an autonomous agent with its own email address signing up for accounts in your name. Connect that to the David Robinson conversation we just had, this is iterative deployment aimed straight at your actual life, your calendar, your credit card, your inbox.
And Instinct's just the loud one. There's a whole zoo. There's Caddy, lives in iMessage, turns the chaos on your phone into action items. There's a bunch aimed at families, Fambot, Ohai, Ollie, Orbits, the "chief of staff for your household" pitch, wrangling school emails and soccer practice and meal planning. One of them, Ollie, has a differentiator I actually find meaningful, it's one of the first family-focused assistants to get SOC 2 compliance. That's a real security standard, and the fact that it's a selling point tells you the category knows trust is the bottleneck. There's Town, aimed at professional life, raised a fifty-five million dollar Series A from Andreessen Horowitz and Forerunner. There's Wajo, whose agent Fo gets its own email, phone number, and payment card, so it can transact without you handing over your credentials, and when it gets stuck, it hands off to a human.
And there's one bit of real market consolidation buried in here. Poke, a general-purpose text assistant, became notable in June when Apple approved it as the first AI agent on the Apple Messages for Business platform. A month later, its parent company got acquired by the AI coding startup Cognition in a deal valued in the low nine figures. So the coding-agent people are buying the consumer-agent people. That's a tell about where this is heading, the infrastructure players want the consumer surface.
My read for builders, because this is squarely your lane. The agent-in-your-texts space is getting crowded fast, and the differentiators right now are not the AI. Everybody's got a capable model under the hood. The differentiators are trust and distribution. SOC 2 compliance as a headline feature. Getting approved on Apple's business messaging platform. Giving the agent its own payment card so you don't have to hand over yours. The moat isn't the model, it's whether a normal human being is willing to let this thing touch their money and their inbox. And ten billion dollars says somebody thinks they'll win that trust. I'd watch the security posture of these companies a lot more closely than the feature list.
Now, speaking of agents and the companies trying to own the infrastructure underneath them, let me give you a quick one that's pure builder catnip. Kevin Mandia, the guy who founded Mandiant and sold it to Google for five point four billion back in 2022, has a new startup called Armadin. It just raised two hundred fifty-five and a half million dollars at a valuation north of two and a half billion. Series B, led by Andreessen Horowitz and Accel, and it came just six months after their Series A. They've now raised more than four hundred forty-five million total.
And what Armadin does is the flip side of everything we've been talking about. Instead of traditional penetration testing, where you hire some hackers to break in and write you a report, Armadin runs what they call always-on agentic swarms. Agents that chain vulnerabilities together to break into your systems, continuously, so you can find and seal the holes before the real bad guys, or, in the reporting's own words, "even AI labs with rogue agents," can use agentic tech against you. Read that again. The pitch explicitly names rogue AI agents as part of the threat model you're defending against. So we've gone from agents as a product, to agents as an attacker, to agents as a defense against the attacking agents. It's agents all the way down. And the smart money, a16z, Accel, even Google Ventures and In-Q-Tel, which is the CIA's venture arm, is pouring into the defensive layer. When the defense side is raising at two and a half billion, that tells you the offense side is real.
Let me do a quick lightning round of a few more that caught my eye, because there's good stuff in the pile.
Meta's making a play to get its personal agent, called Muse, out of the chatbot box and into hardware. They introduced Muse Gadgets, an open-source project that lets developers build their own devices that connect to Muse. Open firmware, a Linux SDK, project ideas like giving it an e-ink display or a stick that plugs into your TV's HDMI port. You can wire it up to a Raspberry Pi or a cheap ESP32 board. Nat Friedman, who heads product at Meta's Superintelligence Labs, said they built one themselves called Muse Home Link, a little USB-C device that lets Muse talk to your smart home, and they made five thousand of them to give away free to subscribers. Now, this is a hobbyist play, it's not going to move the needle on its own. But strategically it's interesting, Meta's trying to make Muse a platform you build on, not just a thing you chat with. And they're pushing it at small businesses too, with a free tier that hooks into Shopify, Dropbox, and Slack. The platform ambition is the story there.
One more with a sharp business angle for anybody building compute-heavy products. The memory executives, Micron and Samsung, are saying the RAM shortage continues through 2028. Micron's CEO told investors demand is going to exceed supply for years. Seventy-five percent of Micron's memory output for 2027 is already sold. The prices for 2027 memory, in his words, "are much higher than 2026 prices." And the reason is AI, the manufacturing capacity is getting prioritized for high-bandwidth memory for AI and server DRAM, which squeezes everything made for consumer devices. We flagged the memory crunch back in September when it was pushing up the price of Macs. This is the same river, just wider now. If your product roadmap assumes cheap, plentiful memory, go re-check your assumptions, because the cost curve is bending the wrong way and it's going to stay bent for a couple years.
And since we've been living in heavy territory today, let me give you two palate cleansers to end on, because not everything is surveillance and existential risk.
First, the fun one. Somebody rendered Doom inside a SQL database. A developer named Lukas Vogel built a thing called SQLDoom, where about thirteen hundred lines of SQL queries, spread across eighty-nine common table expressions, generate thirty-five full-color frames a second of actual Doom. His own opening line is, quote, "Rendering Doom in a database is obviously a bad idea." And he's right, it is a bad idea, and he did it anyway, and that's the whole beautiful spirit of the thing. He got it running around sixty frames a second on a Ryzen laptop. And here's the genuinely clever insight buried in the joke, he points out that running the game state in a database actually gives you something for a multiplayer server, a steady reference snapshot of the game state with no partially applied updates and, in his words, no "disagreements over whether the rocket actually hit." So there's a real distributed-systems lesson hiding inside a gag. The silliest projects sometimes teach the realest lessons.
And second, a quieter one that I think is actually a bigger deal than it looks. There's a piece on AI finally cracking the board game Stratego. Now, you'd think, chess fell in '97, Go fell in 2016, who cares about Stratego. But Stratego held out for a reason, it's a game of massive hidden information that unfolds over a very long time, and it's a game of bluffing. A team from Carnegie Mellon, MIT, NYU, and Stanford built an AI called Ataraxos that beat Pim Niemeijer, arguably the best Stratego player ever, fifteen games to one.
Two things make this worth your attention as a builder. One, the cost. DeepMind's earlier attempt at this reportedly would've cost three to four and a half million dollars to train, running on over a thousand of Google's specialized chips. Ataraxos did it on sixteen GPUs for a week, a few thousand dollars, by academics who, in one researcher's words, "don't really have access to an entire field of GPUs." That's the efficiency story we keep coming back to, you don't always need the giant cluster, sometimes you need the better idea. And two, the behavior. The thing learned to bluff. One researcher described watching the bot bluff its way back from a two percent chance of winning, quote, "very, very casually." It got its name, Ataraxos, from the Greek word for calm, because it doesn't panic, it doesn't react impulsively even when a human would be, in his words, "losing their mind." And the team's real target isn't board games, it's the fact that negotiations, markets, and military conflict are all games of hidden information and bluffing. On a good day, that's a powerful new tool. On a day after you've listened to David Robinson's essay, well, a calm machine that's an expert at bluffing is a thought that'll keep you up a little.
So that's the shape of today. A judge drawing a constitutional line against surveillance at scale, and another judge shrugging at a different harm the same week, because the law's catching up in fits and starts. A long-tenured safety guy walking out and telling us the problem isn't the guardrails, it's the sprint. A crowded field of agents trying to earn enough of your trust to touch your money. And, because the universe has a sense of humor, Doom running in a database and a calm little machine that just learned how to bluff.
If you build anything this week, build in a minute to slow down and consider the big change, the one you've been too busy sprinting to look at. That's your boy Tony DeLuca, thanks for spending part of your day in the diner booth with me, and I'll catch you on the next one.