Subscribe
Share
Share
Embed
A daily briefing on the AI systems, products, companies, and policy shifts that are just becoming possible.
Want a podcast for your own topics? Join early access: https://www.barelypossible.to/waitlist/?source_path=public_feed&feed_source=rss
Okay kiddos, I'm your boy Tony DeLuca, and today we've got a menu of stories that all circle back to one quiet, uncomfortable question: what happens when you hand a machine the keys, and it turns out the machine can drive further than anybody planned? Grab your coffee, pull up a chair, and let's have at it.
Let me start you off with the one that made me put my coffee down. Because it's not another chatbot story. It's a virus story.
Researchers at Stanford took a large genome model — same basic idea as the chatbots you know, except instead of predicting the next word, it predicts the next letter of DNA — and they used it to design entirely new viruses. Now before anybody grabs the pitchforks, let me be precise about what happened, because the piece from Ars Technica, written by John Timmer, is careful and I want to be careful too. These are viruses that infect bacteria. Not people. The researchers deliberately kept anything that infects complex cells — anything that could target you or me — out of the training data. They picked a virus called ΦX174, one of the best-understood little bugs on the planet, eleven genes, about fifty-four hundred bases of DNA, every gene's function known. And they prompted the model with the tail end of that virus's genome and said, in effect, give me something related.
Here's where it gets genuinely startling. The model spat out about three hundred candidate genomes. They synthesized two hundred eighty-five of them, dropped them into E. coli, and waited. Most did nothing. But sixteen of them actually worked — they functioned as real viruses, killing the bacteria. And this is the part that should make a builder sit up. There's a known rule in this corner of biology: this particular virus is fragile. Change a single amino acid and you've got, on average, a twenty percent chance of killing it dead. Statistically, if you make more than twenty-five changes, your odds of a working virus round down to basically zero. And yet nearly a quarter of the AI's designs with more than twenty-five changes still worked. Two of them had over fifty amino acid alterations and lived. That means the model wasn't randomly mutating. It had learned something about the grammar of the genome that let it walk paths evolution would almost never find.
Now why does a founder or a builder care about a bacteria-killing virus? Two reasons. On the upside, the researchers cooked up a cocktail of these AI-designed viruses and tested it against E. coli that had already evolved resistance to natural phages. The natural cocktail failed. The AI cocktail broke through. That's a real hint at a future for antibiotic-resistant infections, a problem that kills people every single day. On the downside — and the authors say this themselves, plainly — anybody with enough compute could run this exact process with the human-infecting stuff left in. The guardrail here was a choice the researchers made about training data. It was not a law, not a regulation, not a locked door. It was somebody deciding to be responsible. The paper ends with a call for better governance around this and around ordering custom DNA sequences, and then adds the line that I think is the whole ballgame: so far, regulation of AI has largely failed to keep up.
Hold onto that idea — a powerful system, a guardrail that's really just somebody's good judgment — because it keeps coming back today in ways that hit a lot closer to your codebase.
Now let's come down from the biology lab to the office, where a company you know decided to hand vibe coding to people who've never written a line of code in their lives — and did it in a way that's actually kind of clever.
Cloudflare open-sourced a platform it built internally called Cloudflare OS. And the pitch, from principal engineer Kenton Varda in a post on X, is bold: quote, "This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild — the AI cannot introduce a significant security bug." He goes on to say a company's security team can feel comfortable letting non-technical people vibe code and, quote, "then sleep soundly at night." Big claim. Sleep soundly. We'll see.
But here's the engineering underneath, because it's the interesting part. Instead of running each app in a standard software container, they use what they call isolates — instances of the V8 JavaScript engine that spin up in a few milliseconds and use a few megabytes of memory. They say that's a hundred times faster and ten to a hundred times more memory-efficient than a container. Every document in a document editor runs as its own separate instance in its own separate sandbox. The AI agents start with zero permissions and have to request access to anything. Server code runs with outbound networking turned off; client code runs sandboxed in the browser. Neither can touch the internet except through doors you explicitly open.
Now, is any of this foolproof? No. And Cloudflare is honest enough — or the reporting from Jeremy Hsu is honest enough — to point out that researchers at Pillar Security just published findings on sandbox escapes and boundary bypasses in popular AI coding agents like Cursor, Codex, Gemini CLI, and Antigravity. So the very week Cloudflare says "you can go wild, the AI can't hurt you," somebody else is documenting how these things break out of their boxes. Sound familiar? That's the genome guardrail again. The wall is only as good as the wall.
But I want to give Cloudflare real credit for the part that's less flashy and more useful to any founder building an AI-heavy shop. Their CIO, Sam Rhea, shared the mistakes they made, and they're the mistakes you are about to make if you're not careful. First one: they gave everybody outside engineering the same coding tools engineers use, just with friendlier buttons. Rhea's line: "If you give everyone a harness workspace that is great at writing code, you'll wind up with way more code than you need." The result, he said, was "a flood of vibe coded apps looking for a problem to solve." Knowledge workers doing one-off tasks don't need a code-generating firehose. They need something else entirely.
Second lesson, and this is the one to write on a sticky note: when everybody can generate code fast, everybody can generate bad code fast. So Cloudflare built what they call the Engineering Codex — an authoritative guide that both humans and AI agents use to review code. And over four months, their AI code reviewer flagged nearly a quarter of a million deviations from their standards and blocked sixteen thousand merges. Sixteen thousand. That's the real story of AI adoption inside a serious company. It's not the magic of generation. It's the unglamorous machinery of review you have to build so the magic doesn't wreck you. And one more practical nugget: they built in spending controls, budgets and rate limits, because as Rhea put it, "we do not need team members spending twenty dollars to summarize their email inbox every hour." Anybody who's watched an agent chew through an API budget knows exactly what he's talking about.
Oh, and the punchline that made me laugh — it's open source, but not free. A GitHub user found out mid-deployment that you need a paid Workers plan to actually run the backend, and posted, "I wasted 20 minutes I will never get back." To their credit, Cloudflare fixed the warning fast. But there's your reminder: open source and free are two different words.
Now, that flood-of-code problem Cloudflare hit? Somebody raised twenty-eight and a half million dollars betting it's about to become a flood of entire companies. Let's talk about that.
A startup called Naïve — and yes, that's the name — closed a twenty-eight-and-a-half-million-dollar Series A led by Nexus Venture Partners, first reported by Ram Iyer at TechCrunch. And what Naïve does is take vibe coding one giant step past building an app. It wants your AI agents to build and run an entire business. It packages payments, email accounts, phone numbers, cloud infrastructure, storage, and company incorporation behind a single API. You hand a prompt to Cursor or Claude Code or Codex, it connects to Naïve, and the agent goes off and forms a U.S. LLC — you still have to do the KYC and pay, they're not letting robots launder money just yet — and then sets up your inboxes, your virtual cards, your databases, your Stripe and QuickBooks connections. There's a governance layer for budgets and human approvals. There are templates for SaaS apps, recruiting, accounting, customer support.
And people are using it. Over thirty thousand developer customers in months. Revenue up ten-x to the low double-digit millions. The CEO, Sean Dorje, says customers are running fully autonomous businesses — AI automation agencies, faceless TikTok and YouTube channels, and, I kid you not, a rental car agency running autonomously. He found one Naïve customer powering a TikTok channel of AI-generated videos of cats and dogs dancing and boxing. So that's the world now. Somewhere a horde of agents is producing boxing-cat content and paying its own corporate card bill.
But here's the part a builder should actually chew on, because it's the tell. Dorje says the fastest-growing demand isn't the company-in-a-box toolkit. It's inference optimization. Running these agents is expensive — they call pricey models, they pass giant context between tasks, they burn resources sitting idle. So Naïve is using the new money to build a model router that sends each query to the cheapest capable model, a memory system so agents don't restart from scratch, an orchestrator to divvy up work, and a serverless runtime that only charges you when an agent is actually doing something. Notice what that is. It's the exact same problem Cloudflare hit — the exact same problem — the tokenmaxxing, the runaway spend, the thing Sam Rhea was warning about. The whole business of the autonomous-company startup is quietly turning into: how do we stop these agents from bankrupting the person who deployed them. When your headline product is "let agents run everything" and your fastest-growing revenue is "please make the agents cheaper," that tells you where the real pain lives.
Now let's talk about who's trying to own the cost structure at the very bottom of that stack — the silicon.
Anthropic confirmed it's building an in-house custom silicon team. Business Insider spotted the job listings — a silicon engineer, a technical program manager for silicon — and Anthropic confirmed it to both Business Insider and TechCrunch. Now, they're careful to say it's a multi-chip approach; they'll still use hardware from other companies. But the plan is to bring chip design in-house and co-design the hardware and the models side by side. Samuel Axon's piece at Ars Technica lays out why everybody's suddenly doing this. OpenAI just announced a custom inference chip called Jalapeño, built with Broadcom. Google's been running on its own hardware for years. Meta's designed and deployed its own. Mistral is reportedly looking at it. And Anthropic was reportedly eyeing Samsung as a manufacturing partner.
Two reasons drive all of it. One, everybody's dangerously dependent on Nvidia, and in a world where compute demand outstrips supply, that dependence is a strategic vulnerability — one company holding the leash. Two, if you design the chip and the model to fit each other, you can get performance nobody buying off-the-shelf can match. That's the vertical integration play. If OpenAI gets that edge, Anthropic has to have it too, and so does everyone else.
Now I want to be measured here, because I've watched this movie. Custom silicon takes years. Anthropic is still hiring the team. Nobody sees a benefit soon. And keep this in the back of your head, from continuity: yesterday and the day before we talked about the Texas grid buckling under data center demand, the interconnection queue holding five times the state's record peak. So you've got the labs racing to build their own chips to escape Nvidia's grip, while the very electricity to run those chips is getting choked off at the state level. Everybody's optimizing one link in a chain that's straining somewhere else. The chip is the moat, sure — but the power line is the bottleneck, and the two are not moving at the same speed.
Alright, let's shift from the machines to the mischief, because there's a security story today that's almost refreshing in how low-tech it is.
Google's security researchers put out a report — this is Lorenzo Franceschi-Bicchierai at TechCrunch — about hacking crews breaking into big financial and investment firms in the U.S. And Reuters named some of the likely victims: Apollo, Bain Capital, Blackstone, Bridgewater, CME Group, KKR, Moody's, TPG. The heavy hitters of private equity. And how are these crews getting in? In the age of AI-powered autonomous cyberattacks — which we have been covering all week — they're picking up the phone. They call employees' personal cell phones, pretend to be a coworker or IT helpdesk, and trick people into typing their passwords and multi-factor codes into fake websites. It's called vishing — voice phishing. It's old as dirt. And it works.
Google tracks these crews under names like Falcon, Helix, Pink, and Redact, possibly all one umbrella outfit. And they run their extortion like a business. One of their sites reads, quote, "We conduct every negotiation on professional terms. The publication of your data is never our preferred resolution; it is the consequence of refusal to engage." One wallet tied to the group pulled in around ten million in bitcoin in a few months, with demands running from seven hundred fifty grand to three million a pop. The lesson for founders is almost bracing in its simplicity: while everyone's terrified of the AI that can autonomously break out of a sandbox, the thing actually cleaning out Blackstone-tier firms is a guy on the phone with a friendly voice. Your fanciest model won't save you if Karen in accounts payable types her MFA code into a fake login. The human is still the exploit.
And speaking of humans and machines, there's a smaller story I don't want to skip, because it's the most honest thing anyone said this week.
The science YouTuber Hank Green — and Nate Anderson wrote this up beautifully at Ars Technica — publicly apologized to his fans for leaning too hard on AI. Not for making fake videos. Green writes his own scripts, his words are his own. What he confessed to was using AI as a research aid — to find papers fast, to move quickly. And after fans said his work felt different, he looked at his own process and agreed with them. His words: "It can be very useful for this task, giving me access to a lot of papers I didn't know existed really fast, but I think that has been to the detriment of my work because it has not given me the freedom to find all of my own ways into and around a topic." And then the line that'll stick with me: "making more things does not make me make better things."
Now why does that matter to you, a builder? Because it names a thing the productivity charts can't see. YouTube's AI disclosure rules only care about photorealistic fakery — did you make a real person appear to say something they didn't. But Green's problem lives below that. AI-assisted research gives you answers without giving you mastery. An AI-generated outline can lock your mind onto a track before you've had the chance to wander somewhere more personal. That's not a story about deception. That's a story about what you quietly lose when the machine does the finding for you. Every founder shipping faster with agents should sit with that for a second. Faster is not the same as better, and the gap between them doesn't show up in your metrics until it's already cost you something.
Now let me pivot to a couple of policy and product moves, quicker hits, because they matter to how you build.
The Trump FCC, under Chairman Brendan Carr, voted two-to-one to eliminate the National Television Ownership Rule — the cap that stopped any single broadcaster from reaching more than thirty-nine percent of U.S. TV households. This is Jon Brodkin's reporting at Ars Technica. Now here's the wrinkle that makes it a real fight: that cap wasn't an FCC rule Carr can just wave away. Congress wrote thirty-nine percent into law in 2004. And the objections aren't just from Democrats. As we noted a few days back, Tom DeLay — the Republican who helped negotiate that exact compromise — wrote an op-ed saying flatly that only Congress can change it. The lone Democratic commissioner, Anna Gomez, added that even the Republicans who wrote the thing agree the commission can't do this. Carr's betting the courts let him, but with the Chevron doctrine gone — that's the precedent that used to let agencies interpret fuzzy laws — courts have more room to say Congress meant what it wrote. Free Press says it'll sue. Why does a builder care? Because it's another data point in the pattern of the week: an authority deciding the guardrail set by somebody else doesn't apply to them, and daring the system to stop them. Genome researchers, sandbox escapes, and now a regulator — same shape, different suit.
On the product side, quick one for you: OpenAI shipped an improved GPT-5.6 Sol in ChatGPT and expanded free-user access to GPT-5.6 Luna, including unlimited everyday chats. They also put out new Signals data on how the world actually uses ChatGPT — asking is turning into doing — and announced a partnership with the American Psychological Association on youth mental health and AI safeguards. And over on the open-weight side, Simon Willison ran his trusty pelican benchmark against Meta's Spark family — the April version, the July 1.1, and the new 1.2 — as a little visual gut-check on how one model line improves over time. Not a revolution, but a nice reminder that the steady drip of incremental gains is the real texture of this field, not just the big splashy launches.
And one more, because it affects anybody who builds on top of community data. Suno — the AI music generator — says it's going legit with watermarks on all its audio outputs, plus download limits, to fight what it calls large-scale abuse. Ryan Whitwam's piece at Ars notes the obvious hole: watermarks only work if everybody uses them, and open models let anyone generate unlabeled music on their own hardware. Suno's doing this while getting sued by Universal and Sony, after a German court found it violated licensing law, and after a 2025 hack revealed it scraped YouTube and Deezer to train. So the watermark is less about virtue and more about changing the conversation while the lawyers circle. Same guardrail question one more time: a label that only holds if the whole industry agrees to hold it.
Okay, let me bring this home, because I've been circling one idea all episode and I want to name it plainly.
Every big story today runs on a guardrail that isn't really a wall. The Stanford virus work was safe only because the researchers chose not to feed the model the dangerous data — and they told us straight, anyone with compute can make a different choice. Cloudflare says its sandbox is so tight you can sleep soundly, the same week security researchers document how these sandboxes get broken out of. Naïve hands agents an entire company and then discovers its hottest product is stopping those agents from spending you into the ground. Carr's FCC decides a limit Congress wrote doesn't bind it. Suno's watermark works only if nobody defects. And Hank Green's guardrail — the thing that kept his work his — was nothing but his own judgment about when to reach for the machine and when not to.
Here's the through-line for you, the builder. The systems we're shipping now are powerful enough that the safety doesn't live in the technology. It lives in a decision somebody makes — what data to withhold, what merge to block, what budget to cap, what to research yourself instead of outsourcing to the model. The tech gives you the capability. The judgment is what keeps it from becoming a catastrophe. And judgment doesn't scale the way compute does. That's the uncomfortable part. You can ten-x your agents overnight. You cannot ten-x your good sense.
So when you're building this week — and you are building with these tools, all of you — ask yourself the Cloudflare question and the Hank Green question in the same breath. Not just "can the AI do it," but "have I built the review layer that catches it when it's wrong," and "am I still doing the part that's supposed to be mine." Because the flood of code, the flood of companies, the flood of viruses that actually work — that's all real now, and it's not slowing down. The only thing standing between capability and calamity is somebody paying attention. Make sure that somebody is you.
That's the menu for today, kiddos. Go build something you'd be proud to put your own name on — your words, your judgment, your fingerprints all over it. I'm Tony DeLuca, and this has been Barely Possible. Be good to each other out there.