Subscribe
Share
Share
Embed
A daily briefing on the AI systems, products, companies, and policy shifts that are just becoming possible.
Want a podcast for your own topics? Join early access: https://www.barelypossible.to/waitlist/?source_path=public_feed&feed_source=rss
Okay kiddos, I'm your boy Tony DeLuca, and the menu today is heavy on one word that keeps showing up where you'd least expect it — agent. Not the kind with a trench coat, the kind that shops for you, codes for you, and apparently now gets its own checkout lane at Walmart. Pull up a chair, grab the coffee, let's have at it.
Let me start with the one story that actually tells you something about where this whole thing is going, and it's not the flashiest headline on the board. It's two retailers making opposite bets on the same day, and if you build products, you want to understand why.
Walmart announced on Wednesday it's rolling out something called an Agent Gateway. In plain English, it's a front door built specifically for AI agents to walk through, search the inventory, and buy stuff on behalf of a human. And the timing matters, because the move comes right after Walmart's biggest rival, Amazon, started doing the exact opposite — blocking AI agents from making purchases on behalf of shoppers. So you've got two of the largest retailers in the country, same week, one rolling out the welcome mat and one slamming the door.
Now here's the part that matters if you're building anything in this space. Walmart's gateway is an MCP server. MCP is the Model Context Protocol — that's the standard Anthropic originally created that lets an AI agent plug into outside tools and data in a consistent way. Walmart built theirs so that an approved agent can search across the online catalog and make a purchase for the user. And they wired in some genuinely thoughtful controls. There's a thing coming next month called Agent Profiles, where you authorize each agent you use with its own dedicated profile on your account. You can see what the agent bought separately from what you bought yourself. You can require approval on every single transaction, or you can set a spending cap and let it run within that limit. Walmart's own comparison is that it's like adding an authorized user to your credit card — their charges are labeled, and you set the ceiling.
And this is the detail I keep chewing on. Walmart says its normal returns process applies even when the agent misbehaves — even when the thing doesn't act the way you intended, you can send it back. That's not a technical feature, that's a trust feature. They're telling the nervous first-time user: look, if your little robot assistant goes rogue and buys you forty cans of the wrong soup, you're not stuck with it. That removes the single biggest fear people have about handing a bot their wallet.
So why does Amazon zig while Walmart zags? Think about what each company actually sells. Amazon's whole machine is built on the shopping experience itself — the recommendations, the ads, the impulse buys, the dark patterns, the Buy It Again nudges. An agent that just goes, finds the cheapest acceptable thing, and buys it — that agent is poison to Amazon's margins, because it strips out all the stuff Amazon makes money on between you and the checkout button. Walmart, on the other hand, is a logistics and price company at its core. If an agent wants to come in, find the usual brands, and buy them efficiently, Walmart's happy — that's Walmart's whole pitch anyway. The agent isn't a threat to their model. It's an accelerant.
And Walmart already had a head start here. They'd previously announced a partnership with Meta's Muse agent, and they offer integrations with ChatGPT, Gemini, and others. So this isn't a cold start — it's them formalizing a lane they'd already been inching into.
Now, let me connect this to a number that landed the same day, because it sharpens the whole thing. On Meta's earnings call Wednesday, Zuckerberg said Muse — their AI app — now has more than ten million users. And the detail that made the industry people sit up: over a quarter of the engaged users who shopped through the agent had an average purchase size over two hundred bucks. Zuckerberg quoted Plaid — that's the fintech that connects payment apps to bank accounts — saying they hadn't seen activity like this on their connector on any other service before. So people aren't just poking at these shopping agents, they're spending real money through them.
Now I want to be careful here, because we talked about Muse's download numbers yesterday — the ten-million-in-forty-days milestone, the retention debate. That's covered ground, I'm not going to re-litigate it. What's new today is the earnings-call color: the daily use rate around twenty-five percent of people who set it up, the purchase-size number, and Zuckerberg's claim that Meta expects Muse to eventually generate more revenue per user than the whole Facebook-Instagram-WhatsApp family of apps does today — and that figure today is several hundred dollars a year per user. That's a big swing. He also said Muse is compute-heavy right now but they expect to cut the cost to run it by more than ten times in the next year. Which, okay, Zuck says a lot of things on earnings calls, but the directional point stands: the shopping agent is becoming a payments business, not a chatbot novelty.
So put the two stories side by side and here's your takeaway if you're a founder. The agentic commerce rails are getting built right now, in public, by the biggest players, and the fight isn't about the model — it's about who controls the checkout. Walmart's betting it can be the merchant that agents love. Amazon's betting it can force agents to play by Amazon's rules or stay out. And Meta's trying to own the agent itself and skim a percentage of everything that flows through it. Whoever you are in that stack — merchant, agent, payment rail — your position in that diagram is about to matter enormously.
And there's a wrinkle in the numbers that I want to park here, because it comes up again later. A Google report that resurfaced this week — this is the eleventh edition of their e-Conomy SEA report, originally out back in November of last year — put a stake in the ground on consumer appetite for exactly this. In Southeast Asia, they found seventy-five percent of users said they're willing to let AI agents autonomously compare prices and complete transactions for them. Now I'll note that's an older report getting renewed attention, not fresh news, so take the framing accordingly. But the signal lines up with what Meta's seeing in the wallet data: the trust to hand a bot your credit card is arriving faster than a lot of people expected. The thing people said they'd never do — they're doing it.
Alright, let's shift from agents that buy things to agents that break things. Because the same week everybody's celebrating how helpful these systems are, the internet had what one reporter flatly called a very bad cybersecurity day.
Here's the roll call, and it's a doozy. Government websites around the world went offline after AI discovered critical security vulnerabilities in PHP — that's the programming language that runs a huge chunk of the web's back end. The problems were bad enough that the NSA told organizations running PHP to either update immediately or take their systems offline until they could. That's not a routine patch note. That's the National Security Agency telling you to pull the plug.
And PHP wasn't alone. Node.js — the open-source JavaScript runtime a ton of you build on — dropped four high-severity vulnerabilities in its latest release. One allowed remote code execution, which is the nightmare scenario where an attacker runs their own code on your box. Two others allowed a TLS validation bypass, meaning an attacker could potentially slip past the checks that are supposed to confirm a server is actually who it claims to be.
Then there's the one that should make every AI builder in the audience sit up straight. LiteLLM — that's a very popular open-source proxy a lot of people use to route requests across multiple LLM providers — got compromised. An attacker injected malicious code and pushed those poisoned artifacts to PyPI, to Docker Hub, and to GitHub's container registry. The three places you pull packages and images from. And the malicious payload wasn't amateur hour — it included an information stealer that specifically went after cloud credentials, passwords, and AI service credentials, plus a remote-access trojan that lets the attacker run commands on compromised machines. LiteLLM says it's pulled the bad releases and images and put out remediation guidance, so if you installed anything from them recently, go read that guidance today, not tomorrow.
And on top of all that, an Indian certificate authority called eMudhra had its private keys compromised, which potentially lets attackers issue fraudulent certificates and impersonate legitimate websites. Security pros are calling the whole cleanup bigger than Heartbleed — and for the younger folks, Heartbleed was the 2014 OpenSSL bug that had the entire internet changing passwords for weeks.
Now, here's the connective tissue, and it's uncomfortable. These incidents are unrelated to each other, but notice who keeps showing up as the discoverer. AI found the PHP vulnerabilities. And this lands the exact same week OpenAI is out with a whole slate of posts about agents uncovering critical vulnerabilities — they've got a program they're calling Patch the Planet, connecting security researchers, maintainers, and incident responders to deal with critical flaws across open source. And a companion piece in a series they're calling democratic governance of frontier AI, part two, about empowering cyber defenders.
So think about the double edge here. The same capability — AI that can read a massive codebase and find the hole — is a gift to the defender and a loaded gun for the attacker. TechCrunch put it plainly: this matters because AI could make it easier for attackers to exploit vulnerabilities once they're discovered. The discovery step just got cheap. Which means the window between "a flaw exists" and "a flaw is being exploited at scale" is collapsing. If you're a builder, your patch cadence and your dependency hygiene aren't a back-office chore anymore. They're front-line defense, because the other side is running the same AI tools you are, and they don't have a change-management meeting to sit through.
And here's a little human detail that tells you how real this was. Remember Automattic — the WordPress parent company that's been in turmoil? Their CEO Matt Mullenweg, when a reporter asked him Wednesday about the ongoing layoffs at his company, basically waved it off and said he was "mostly focused on PHP" that day. The PHP fire was so hot that the guy running a company full of org drama said, not now, I've got a security emergency. That's your tell.
Now let me turn to something quieter, but in some ways more consequential for anyone who thinks about AI safety as a business question and not just a philosophy-seminar question. Dario Amodei, the CEO of Anthropic, put out a long public response this week to a critic named Nathan Calvin. I want to be upfront about the framing: the letter references the events of February 2026 and reads partly as a retrospective defense, so I'm treating it as Amodei restating and defending a strategy, not breaking news.
But the argument itself is worth your time, because it's the clearest statement I've seen of a bet that a lot of money is riding on. Amodei calls it the "race to the top." The idea is that by showing it's possible to build this technology responsibly, Anthropic can raise the bar for the whole industry — and that those pressures only work if the company practicing them is actually at the frontier. In other words: you can't lead the pack toward safety from the back of the pack.
And then he does something you rarely see a CEO do — he itemizes the things he says cost the company money in the name of safety. He says they had what he calls Mythos-class models back in February but didn't make them generally available until June, once they had stronger cyber safeguards in place, and that they likely gave up a chunk of a multi-month model lead to do it. He says their biological safeguards are so aggressive that biologists openly joke about how restrictive the classifiers are, and competitors sell against them by touting more permissive bio capabilities. He says they were the first and, as far as he knows, still the only frontier company to restrict selling AI services to companies controlled by the Chinese government, including ones operating through third countries to dodge the rules — and that this forfeited real short-term business. And he mentions, as he did this week, committing five percent of the company, possibly more over time, to a public benefit fund.
Now, the skeptic in me — the guy who grew up reading the back pages — notes that every one of these can be read two ways. Holding a model back builds mystique. Being strict on bio can be spun as protecting your own research turf. Amodei actually anticipates that, and concedes the point gracefully: he says any decision, on any topic, can always be portrayed as a nefarious scheme. He even admits some of the items his critic raised were genuine mistakes.
Here's why this matters to you as a builder and not just as a spectator. Anthropic is about to go public. We've talked about their S-1 and the eye-watering compute numbers. And the central tension in that offering is whether a company can genuinely hold a safety line while competing for trillion-dollar valuations and half-a-trillion in compute commitments. Amodei's letter is, in effect, the prospectus argument in prose form: trust that our constraints are features, not weaknesses. Whether investors buy that — and whether those constraints survive contact with the IPO quarter — is one of the real tests of the next year. The letter also drops a word to watch: "pacing." He says they're nearing the point where AI-driven acceleration gets fast enough that it's hard for safety to keep up, and that's what's driving their thinking about pacing. Keep an ear out for that term. When a frontier lab starts talking about pacing, they're telling you they feel the floor moving.
And just to tie off that thread — the same week, Anthropic added the physicist Christopher Stubbs to its Long-Term Benefit Trust, the body with the authority to appoint a majority of the company's board. Now, the framing on that announcement suggests it's catching renewed attention rather than being brand-new news, so I'll flag it as background rather than a bulletin. But it fits the picture Amodei's painting: a company trying to show it's wiring independent judgment into its governance right as the commercial pressure peaks. Stubbs, for what it's worth, is the kind of guy who, as his colleagues put it, followed the data even when it contradicted the prevailing wisdom of his field — he was part of the team that discovered the universe's expansion is accelerating. Whether that temperament survives a boardroom full of IPO incentives, we'll find out.
Let me pivot to the car in your driveway, because there was a fascinating announcement from GM that's really a story about software eating Detroit.
GM rolled out its fourth-generation EV platform on Wednesday, and what's striking is what they didn't talk about. No suspension geometry, no dash-to-axle ratios, none of the car-guy vocabulary. Instead, the pitch was about battery chemistry, electric motors, and — this is the heart of it — an entirely new central computing platform. Their chief product officer, Sterling Anderson, described the goal as making vehicles into spaces that "understand context, reduce friction, and give people back moments that would otherwise be consumed by the demands of the road." That is not how a traditional automaker talks. That's how a software company talks.
The guts of it: GM is centralizing the car's computing onto one Central Compute Unit that they say is forty times more powerful than what they run today. Pulling the function off all the little scattered chips lets them trim the wiring by thirty percent, which saves weight and simplifies the assembly line. It debuts in 2028 with the Cadillac Escalade IQ, and they're also promising an autonomous highway driving feature that same year — hands off, eyes off, no need to be ready to grab the wheel.
But the real headline for builders is buried in the development story. GM says enterprise AI tools have let them compress their timeline. Here's the example that stuck with me: engineers ran through three hundred thousand virtual designs of a new battery pack before they built a single physical prototype. That took the concept from idea to an approved program in one month. They're explicitly trying to cut their traditional four-to-five-year development cycle in half, to match the two-to-three-year cadence of Chinese automakers.
And that's the whole game, really. Elon Musk said on a 2024 earnings call that without trade barriers, Chinese automakers would "pretty much demolish most other companies in the world." That's the wolf at the door. GM's answer is: we can't out-cheap them on labor, so we'll out-iterate them with compute. Simulate everything, build less, decide faster. It's the same AI-for-engineering thesis you saw this week from Mistral and NVIDIA, who announced a partnership to speed up physics simulation and computer-aided engineering for aerospace, automotive, and semiconductors — building open benchmarks to test whether AI agents can actually do real engineering work. The connective thread: in hardware industries, the companies that win the next decade may be the ones that figure out how to replace physical prototypes with simulated ones, because that's where the speed is.
Speaking of Musk — and he is everywhere on today's menu — let me do a lightning round, because there are three separate Musk-adjacent items and each one's worth a minute.
First, SpaceX. On their earnings call this week, Musk and Gwynne Shotwell laid out new Starship targets. The next flight, number fifteen, targeted for November, will attempt to catch both the Super Heavy booster and the Starship upper stage at the launch tower. Musk says success is "more likely than not" and that they're "hardware rich" if it fails — which is a very Musk way of saying we have spares. Shotwell said they expect the FAA license for that flight to include returning over land and catching both stages. And then the big-swing claim: Musk thinks Starship could hit a weekly launch cadence in the first half of 2027, twice-weekly in the second half. Now, this is a guy whose timelines you discount heavily. But the thing I want you to notice — and Ars Technica flagged it right up top — is that SpaceX, on its own earnings call, is now largely describing itself as a data company providing compute for AI. They spent much of the call talking about rolling out up to ten gigawatts of compute in 2027, on the ground. The Mars talk is gone. It's all AI data infrastructure now, with the rocket as the thing that eventually puts data centers in space. Even the rocket company is really an AI compute story now.
Second, and this one's got some teeth. There's a Wall Street Journal report — and I'll flag the sourcing carefully, this concerns an older, ongoing saga that resurfaced — that Musk personally ordered the Starlink slowdown that blindsided Ukraine's drone forces last week, then the messaging got muddied about who was responsible. The specifics: the cap cut the data connection when a terminal moved faster than about a hundred miles an hour, which is common for Ukrainian military drones using Starshield, the military variant. That forced the drones to fly slower, making them easier for Russian weapons to hit. Both Musk and Trump had publicly denied ordering it. The WSJ, citing unnamed officials, says Musk made the final call after he and Trump had both criticized Ukraine for attacking Russian refineries. Zelenskyy said as of Monday the restrictions still weren't fully lifted. Now I want to be measured here — this is a contested report with denials on multiple sides and the underlying Ukraine-Starlink relationship goes back to 2022. But the structural point is the one worth sitting with: a single private individual controls a piece of infrastructure that can throttle a country's battlefield capability. That's not a tech story, that's a sovereignty story, and it should make any founder building on top of someone else's platform think hard about dependency.
And third, Tesla earnings. Tesla started production of its Optimus humanoid robot at the Fremont factory, in a space that used to build cars. Musk calls it "early production," says the ramp will be slow and bumpy, but claims they'll make twenty thousand a week by the end of 2027. Meanwhile, the actual quarter: profit fell forty-three percent, down to seven hundred eighty-seven million, as revenue stayed flat and spending on AI, robots, and autonomy ballooned. So the pattern across all three Musk companies is identical — pour money into an AI-and-robotics future while the present-day numbers sag. That's the bet. You either believe the next decade or you don't.
Let me do a couple more quick hits, because there's real money news in here.
A year-old AI lab called Flapping Airplanes — and yes, that's the name — raised a billion dollars in a Series A at a reported six-billion-dollar valuation. Co-led by Index and Lux, with Nvidia among the backers. Nine months ago they launched with a hundred-eighty-million seed at a billion-and-a-half valuation, so they just quadrupled. The pitch is training large models with far less data. The founders — Aidan Smith and the Spector brothers, Asher and Ben — describe building what one investor called "the young person's AGI lab," and their core claim is a megakernel framework that keeps the GPU busy by overlapping tasks that would normally sit idle. One of them put it this way: a model that's a million times more data-efficient is a million times easier to put into the economy. Whether that's real or a very well-funded dream, we'll see — but a billion-dollar Series A on a year-old company tells you the data-efficiency thesis has serious believers.
And a big legal number: Meta was ordered to pay twenty-five billion dollars to the state of New Mexico in a case tied to the old Cambridge Analytica scandal. A jury found Facebook and Instagram's parent committed forty-three million violations of state consumer-protection law, at five thousand dollars a pop. The New Mexico attorney general said, and I quote, "we may have paid for the construction of schools for the next hundred years." Meta's chief legal officer called it a tax on speech and said they'll appeal. The tail on Cambridge Analytica just will not stop costing them.
One more that hits close to home for anyone with a living room. A Northeastern University study published Monday — the paper's called "Watching the Watchers" — found that smart TVs from Samsung, Vizio, and Roku keep sending data to automatic content recognition servers even after you opt out of tracking in the settings. ACR is the tech that grabs screenshots or audio clips off your screen to figure out what you're watching, so they can serve you ads. The researchers ran nearly six thousand controlled experiments. On Vizio's OS, they found traffic to an Amazon-hosted endpoint continued in one hundred percent of the opted-out scenarios — it didn't even decrease when the TV was sitting idle. Now, the honest caveat: encryption meant they couldn't read what was in the traffic, so they can't prove what's being collected. But the lead author made the point that dryly stuck with me — transmitting data just to throw it away would be an inefficient way to honor an opt-out, so "unlikely." Which is a polite academic way of saying: your off switch may not be an off switch. The practical builder takeaway: if you're shipping a connected device with a privacy toggle, understand that researchers can and will test whether that toggle actually does anything, and "we meant well" is not a defense when the packets keep flowing.
And on the OpenAI side of the ledger, quietly, a bunch of distribution moves. OpenAI's models are coming to Google Cloud's marketplace and Gemini's Model Garden — two rivals sharing shelf space, which tells you the cloud distribution land-grab trumps the rivalry. ChatGPT ads expanded to twenty-six new countries, with over a hundred thousand advertisers now having used the platform. And a wave of enterprise case studies — AT&T rethinking in-house legal intake, a Schlotzsky's and Cinnabon franchisee cutting cash reconciliation by ninety-four percent. None of these is a blockbuster on its own, but stacked together they paint the picture: OpenAI is methodically turning itself into an ads business and an enterprise-workflow business at the same time. The chatbot was the front door. The revenue is coming from the rooms behind it.
So let me tie the ribbon on all of this, because there's a thread running through the whole menu today. The agent is arriving in your checkout, your car, your codebase, and your attacker's toolkit all at once. Walmart's betting it can be the merchant agents love. The security world's learning that the tool that finds the flaw also arms the exploit. GM's replacing clay models with simulations. And Dario Amodei's out there arguing that restraint is a feature you can take public. The common question underneath every one of those stories is the same one you should be asking about your own product: when the agent shows up, are you the thing it walks through, or the thing it walks around?
That's the menu, kiddos. Watch your dependencies, update your PHP, and maybe unplug the TV from the network while you're at it. I'm Tony DeLuca, this has been Barely Possible, and I'll be right here tomorrow. Take care of yourselves.