Subscribe
Share
Share
Embed
A daily briefing on the AI systems, products, companies, and policy shifts that are just becoming possible.
Want a podcast for your own topics? Join early access: https://www.barelypossible.to/waitlist/?source_path=public_feed&feed_source=rss
Okay kiddos, pour yourself something hot, pull up a stool. I'm your boy Tony DeLuca and this is Barely Possible, the show where we dig through the tech noise so you don't have to eat the whole sandwich to find the one bad bite. Today we got a founder who left a frontier lab to teach robots how to hold a pipette, we got a certificate authority that got caught running security with a key you could guess on a napkin, and we got a password company trying to invent a safe way to hand your logins to a robot. Buckle up. Let's have at it.
Let me start with the one that genuinely made me laugh out loud, because sometimes the story that teaches you the most is the one that's a little embarrassing.
A certificate authority called eMudhra — India-based outfit, publicly traded — just announced it's getting out of the TLS certificate business entirely. For those of you who don't live in the plumbing: TLS certificates are the thing that makes the little padlock show up in your browser. They're the handshake that tells your machine, yeah, this website is really who it says it is, and the connection is encrypted. Certificate authorities are the trusted middlemen that issue those. It is a boring, invisible, load-bearing piece of the entire internet. You don't think about it until it breaks.
Well, it broke. Dan Goodin over at Ars Technica laid out what happened, and it is a beauty. eMudhra issued eight intermediate certificates — these are the powerful ones, the ones that can mint certificates for anybody — with private keys so weak they were basically a joke. Now, to give you a sense of scale: the kind of key they were supposed to be using is supposed to have roughly three hundred and eighty-four bits of entropy. We're talking a number with a hundred and sixteen digits of possible combinations. The actual keys they shipped? Between three and eight bits. The strongest of the bad ones had a maximum of two hundred fifty-six possibilities. And one of them — I want you to sit with this — one of the private keys was the number four. Four. Not four thousand. Not four million. The number four.
What does that mean in plain English? It means anybody who noticed — and noticing took, I'm quoting here, milliseconds — could crack those keys and then generate a trusted certificate for any website or mail server on earth. Every major browser would've trusted it. Your bank's login page, your email, you name it. Somebody could've stood up a fake version and your machine would've smiled and nodded.
So how does this happen? eMudhra's explanation is almost more instructive than the screwup. They held what the industry calls a key generation ceremony — yeah, they call it a ceremony, because these keys are supposed to be sacred — back on April 30th of 2025, using fancy hardware security modules, the expensive tamper-proof vaults you store keys in. And somebody introduced a deviation into the script that day to test an export procedure, wrapping and unwrapping a key to move it between vaults. A flaw in the code generated a second set of weak keys alongside the good ones. And then — here's the human part — because the labels on the keys looked similar, somebody grabbed the weak ones by mistake and signed them with the root. And sent them off to another certificate authority, Sectigo, for cross-signing. So the rot spread.
And here's the detail that should keep builders up at night. They said the revocation lists — the things that tell browsers "hey, don't trust this cert anymore" — got signed with the wrong keys and produced bad signatures, so they had to re-sign them. Which means the system threw an error. It told them something was wrong. And nobody stopped to ask why the signature failed. The alarm went off and they hit snooze.
Now eMudhra's chairman, V. Srinivasan, says they're leaving the business because of rising compliance costs, free competitors eating their margins, and — my favorite line — because "the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS's place in our business." Translation: we got dragged online and it wasn't worth it. Pal, you issued a web credential with a private key of four. The scrutiny was proportional. The scrutiny was love.
Here's why this matters to you if you're building something. The threat to browsers is mostly handled — browser makers blocked those certs within a day or two. But Goodin makes the point that browsers aren't the whole internet. There are email servers, IoT devices, Docker containers, forgotten Linux boxes, old command-line tools that ship their own copy of the trusted roots and never get updated. Those don't patch in a day. Some embedded devices never patch at all. So the trust problem has a very long tail. And the lesson for anybody running infrastructure isn't "certificate authorities are bad." It's: the error message is the product. When your pipeline tells you a signature failed and you can't explain why, that's not a nuisance to route around. That's the whole ballgame telling you something upstream is broken. eMudhra had the warning and treated it like a chore.
Now, let's move from somebody failing at security to a whole new category of thing we're asking people to trust: the AI agent logging into your accounts.
On the same day that debacle was getting written up, 1Password launched something called 1Password for Agents. And the premise is exactly the knot we've been circling on this show for a week now. You've got these personal agents — Claude Duet from Anthropic, OpenAI's Dots and ChatGPT Work, Grok Bot, Meta's Muse, a startup called Town — and people want them to actually do things. Book the flight, pay the bill, log into the portal. But to do that, historically, you hand the robot your password. And as 1Password puts it, handing over a credential is a common shortcut, but it leaves a copy of your secret sitting somewhere you no longer control.
So their fix: the agent never sees your password. When the agent tries to log in on your behalf, a unique digital key goes to 1Password confirming the agent's identity. You get an alert — hey, your agent's trying to sign into your brokerage, that you? — and you confirm it personally. Then 1Password fills the credentials in on the agent's behalf. The robot does the task, never touches the actual secret.
That's a genuinely sensible design. Keep the human in the loop at the moment of consent, keep the secret out of the agent's memory. I like it. But here's the part that made me put my coffee down. The same TechCrunch piece, by Lucas Ropek, notes that 1Password launched this on the exact same day Axios reported that U.S. banks have started detecting agentic activity inside customer accounts. Not rogue agents breaking in — people voluntarily pointing automated services at their own bank logins. And the bankers' reaction? One word, quoted directly: "horrifying." A Chase spokesperson told the outlet, flatly, that customers "should not give their usernames and passwords to anyone."
So sit with the collision there. On one side you've got every major AI lab shipping a personal agent whose whole value proposition is doing your errands, which means touching your accounts. On the other side you've got the banks saying do not, under any circumstances, hand anybody your login — and worse, admitting they can't tell whether the agent activity they're seeing is you or not. That's the crux. It's not that the agents are malicious. It's that the financial system has no way to distinguish "my owner told me to do this" from "something is moving money and I don't know who authorized it." That's the integrity problem. And 1Password's product is one of the first serious attempts to build the missing handshake — a way for the account to know the agent is acting with your blessing.
For you builders, this is the real opportunity hiding under the hype. Everybody's racing to build the agent that does the thing. Almost nobody's built the trust layer that lets the thing being done on confirm it was legitimate. 1Password just planted a flag there. Whoever owns the "this agent is authorized, and here's cryptographic proof" layer owns a piece of plumbing every single one of these personal agents is going to need. We talked yesterday about Walmart rolling out the welcome mat for shopping agents while Amazon slams the door — this is the other half of that. Walmart can welcome agents all day, but somebody has to be able to prove the agent is yours. That somebody is a business.
Now let's get into the deep dive, because the most consequential story for founders today isn't a product launch. It's a man quietly walking out of OpenAI to go build robots that do the one thing AI still can't fake: physical lab work.
Kevin Weil, the former science lead at OpenAI, has launched a new company called Warp Sciences. And he's raised two hundred and fifteen million dollars at an eight hundred sixty-five million dollar valuation — a round led by Lightspeed, with IVP, Premji Invest, and Lux Capital along for the ride. That's a lot of money for a company that, as far as I can tell, has barely opened its doors. Let me read you exactly what they're doing, because the framing is the whole point.
The company trains robots to make and test promising compounds that researchers identify. Here's the Marina Temkin reporting at TechCrunch, and I want to quote the core of it: "For years, biotech companies have outsourced the most labor-intensive work of synthesizing thousands of variations of molecules to contractors in China, such as WuXi AppTec. With Warp Sciences, Weil hopes to reshore that work and insulate the entire drug development process from geopolitical supply-chain risks." And the method is wild: "Wearing cameras and sensor gloves, the startup's human chemists will train robots to perform various lab tasks. By automating wet-lab work, Warp Sciences aims to accelerate drug discovery using robots that can operate around the clock."
Let me unpack why this is the most important thing in today's stack, and why it's a quiet rebuke to a lot of the AI hype we've been swimming in.
For a couple of years now, the story out of the labs has been: the intelligence is the bottleneck. Get a smart enough model and it'll figure out the drug, write the code, run the business. But the thing people keep rediscovering, over and over, is that the model generating a hypothesis is the cheap part. The expensive part is the physical world. You can have an AI spit out three hundred candidate protein binders in an afternoon — and then you still have to synthesize the DNA, produce and purify the proteins, obtain the toxins, set up your controls, and actually run the experiments in a real lab with real glassware. Biology, as somebody put it recently, works at the speed of life.
Warp is a bet on that bottleneck specifically. Weil is not building a smarter chemistry model. He's building the hands. He's saying: the models are good enough at the thinking now, and the constraint is the wet lab — so let's automate the wet lab. And the way they're doing it tells you something about the current state of robotics. They're not just coding the robots. They're putting cameras and sensor gloves on human chemists and having the robots learn by watching and feeling what expert hands do. That's imitation learning applied to the most dexterous, tacit-knowledge-heavy work there is. Anybody who's watched a skilled chemist work knows half of it is in the wrist. You can't write that down in a manual.
Now here's the part that should light up for the founders listening. There's a second company in today's news doing the exact same conceptual move in a totally different industry, and once you see the pattern you can't unsee it. Rivian — the EV maker — just bought a U.K. startup called Third Dimension. Fifteen people, founded in 2024, raised seven million in seed money, originally built tech to speed up video game development by turning images and video into lifelike 3D worlds. Rivian doesn't care about games. They want to turn their real-world driving data into 3D simulated worlds to train self-driving. And the reason is identical to Warp's reason. Listen to Rivian's autonomy lead, James Philbin: Rivian gets more than four hundred thousand driving sequences uploaded from customer cars every single day. And the problem with training a self-driving system isn't the model — it's that the rare, dangerous edge cases don't happen often enough in the real world. You can't wait around for a deer to jump out at dusk in the fog ten thousand times. So you build a world model that can generate those conditions on demand.
See the shape? Warp manufactures physical experiments so the drug pipeline doesn't have to wait for real lab throughput. Rivian manufactures virtual experiences so the driving pipeline doesn't have to wait for real edge cases. Both companies looked at an AI system that's smart enough and asked: where's it starving? And in both cases the answer was the same — it's starving for interaction with the physical world, and the winning move is to industrialize the production of that interaction. One does it with robots and real molecules. One does it with simulation and synthetic roads. Same insight.
And I want to flag the geopolitics in the Warp story, because it's not decoration. Weil's explicit pitch is reshoring. The dirty secret of American and European drug discovery is that the grinding, thousands-of-variations synthesis work has been outsourced for years to Chinese contractors like WuXi AppTec. That's a supply chain. And in the current climate, a supply chain that runs through a geopolitical rival is a liability a lot of pharma boards are suddenly very nervous about. So Warp isn't just "robots are cool." It's "robots let us pull a critical, outsourced capability back onto domestic soil." That's a story investors with two hundred million dollars find very easy to understand right now. The AI angle gets the headline; the reshoring angle gets the check.
Here's my skeptical note, though, because I'm not here to read you a press release. Two hundred fifteen million dollars, nearly a billion-dollar valuation, for a company whose core technical claim — robots doing dexterous wet-lab chemistry reliably — is exactly the kind of thing that demos beautifully and productionizes brutally. Dexterous manipulation of liquids, powders, fragile labware, under contamination constraints, is one of the hardest problems in robotics. Not because it's glamorous but because it's finicky and the failure modes are silent. A robot that mis-pipettes doesn't crash — it just quietly ruins your experiment and you find out three weeks later. So the question I'd be asking if I were writing the check, or competing with them: how much of this is working today versus how much is a very well-credentialed founder and a very compelling thesis? Kevin Weil's name and OpenAI pedigree are worth a lot in this market. That's not nothing. But the valuation is pricing the thesis, not the throughput. Watch for whether they publish real reliability numbers — error rates, tasks successfully automated end-to-end — or whether it stays in the realm of vision.
And that brings me to a connected story, because the labs themselves are clearly circling this exact territory — the handoff between AI-generated ideas and real-world science.
Recently OpenAI put out a piece on using thousands of distributed AI agents, together with a company called PerturbAI and Scripps Research, to sift through data from millions of brain cells and surface promising research leads. And notice the framing there is the inverse of Warp's. OpenAI's agents do the thinking at massive scale — comb the data, generate the leads. But somebody still has to go test those leads at the bench. Warp is building the thing that catches what OpenAI's agents throw. The AI lab generates hypotheses by the thousand; the robot company tries to execute them by the thousand. Whoever bridges that gap reliably — the generation-to-verification bridge — is sitting on the actual chokepoint of AI-driven science. Right now it's wide open.
Speaking of labs making big claims about science and medicine, let me give you the Microsoft one, but I'm going to handle it carefully, because the headline is doing a lot of work the data doesn't quite support.
Microsoft's Mustafa Suleyman is out talking up what he calls "medical superintelligence." The claim, from a study, is that Microsoft's diagnostic system — they call it DxO, it coordinates several AI agents that act like a panel of doctors questioning a patient, ordering tests, debating a diagnosis — got complex cases from the New England Journal of Medicine right eighty-three percent of the time. Primary care docs and general internists, working alone with reference materials, got them right thirty-six percent. More than twice as often. Sounds like a knockout.
Here's where you read the fine print, and I give TechCrunch credit for putting it right there. One: these are deliberately fiendish cases that in the real world get handled by specialists or teams — and the specialists weren't in the comparison. They stacked the AI panel against lone generalists on cases generalists aren't supposed to handle solo. Two — and this is the one builders should internalize — the study's own data shows most of the improvement came from the underlying model getting better, not from Microsoft's fancy orchestration layer. The orchestration helped most on the weaker models. On the strong models, the gap between a good model and a great model was bigger than the boost the whole agent-panel system added on top. In plain terms: the clever multi-agent scaffolding mattered less than just having a smarter model underneath. And on emergency department cases, the orchestration barely moved the needle at all.
So when Suleyman talks about flywheels and medical superintelligence and being "true believers" — fine, he's selling a vision, and Microsoft's got real partnerships, a Mayo Clinic foundation model coming next year, a Beth Israel Deaconess evaluation on real patients. That's serious. But the honest read of the study is more modest than the word "superintelligence." It's: good models are getting good at hard diagnostic puzzles, and the wrapper around them helps at the margins. That's genuinely useful. It's also not the same thing as a machine that outthinks a hospital. Keep your eye on the real-world Boston evaluation — AI on consenting patients in a live ER, compared against the actual doctors. That's the test that'll tell you something the benchmark can't.
Now let me shift from medicine to money, because the numbers in AI fundraising have officially entered cartoon territory.
There's a report that OpenAI is working on raising up to thirty billion dollars at a one-point-two-five trillion dollar pre-money valuation — a round led by Coatue and investors in the UAE, and the UAE piece reportedly comes bundled with a deal for more computing capacity. Now, I want to be careful here, because this is a continuation of reporting that goes back to the summer — OpenAI filed confidential IPO paperwork back in June — so this isn't a brand-new bolt from the blue. It's the latest turn of a wheel that's been spinning for months. But the new number is the thing. If that valuation holds, OpenAI would be the most valuable private company that has ever existed. And it raises the bar for its own eventual IPO. Meanwhile the same report has Anthropic eyeing a one-and-a-half to two trillion dollar valuation for its public debut, with an S-1 that could land any day.
I'm not going to re-litigate the Anthropic spending numbers — we did the seven-hundred-fifty-billion-in-cloud-commitments story a couple days back and there's nothing genuinely new on that front today. What I'll add is just the builder's-eye observation: notice that OpenAI's mega-round reportedly comes tied to compute capacity from the UAE. The money and the GPUs are increasingly the same transaction now. You don't raise capital and then go shopping for compute. You raise capital from whoever can also hand you the compute, because the compute is the scarce thing. That tells you where the real leverage sits in this market, and it isn't with the person writing the check in dollars. It's with whoever controls the data centers.
Let me do a quick lightning round of the builder-relevant stuff before I let you go, because there were a few things worth knowing even if they don't warrant a full sermon.
Canva shipped its first image generation model, called Canva Craft. What's interesting here isn't another image model — God knows we have enough. It's that they trained it not on photographs but on designs: their own library of human-made templates, posters, social posts, infographics, typography-heavy layouts. So the output can be converted back into editable, layered designs. That's a smart wedge. Everybody else is making pretty pictures; Canva's making editable artifacts that slot into the workflow their users already live in. And they'll offer it through their API and, notably, pipe it into ChatGPT and Gemini through an MCP connector. Worth watching if you build anything design-adjacent. One sobering footnote: Canva cut its 2026 growth forecast and its valuation reportedly slid from forty-two billion to thirty-five billion. Even the darlings are getting repriced.
Second: Anthropic donated its Agent Skills standard to the Agentic AI Foundation under the Linux Foundation — the same neutral home they gave the Model Context Protocol. Now, this one's flagged as an older story resurfacing; the standard itself launched back in December of 2025, so don't take this as fresh news. But the detail worth holding onto is the scale: they say a million skills published, nearly two hundred eighty million installed, more than seventy platforms integrated. A "skill" is just a folder with a markdown file teaching an agent a specific task. The takeaway for builders: the agent interoperability layer is consolidating into vendor-neutral standards, and if you're building agents, betting on the open standard is looking safer than betting on any one lab's walled garden.
Third, quick one: Uber is rolling out ChatGPT Work to more than thirty thousand employees. I mention it only as a data point — enterprise ChatGPT deployment at full-company scale is becoming routine, not remarkable. When a thirty-thousand-person company does it as a footnote, you know the adoption curve has turned.
And one that's more of a eulogy than a story: The Browser Company is sunsetting Arc. December 22nd, it stops working on Mac and Windows, accounts deactivated, data deleted within thirty days. They're pushing everybody to Dia, their AI-first browser. Arc was beloved by a small, devoted crowd — it never cracked the mainstream, got hit by what the company itself called the "novelty tax." And users begged them to open-source it, but the CEO's answer is instructive: Arc is built on the same proprietary engine that powers Dia, so open-sourcing Arc means giving away Dia's crown jewels. Which is the quiet lesson for anyone building a beloved-but-niche product. Love doesn't pay the security bill. The company said keeping a browser secure in the age of AI is a constant, escalating cost, and they'd rather spend it on one browser than two. Cold, but that's the math.
Alright. Let me tie a bow on this before I go. The thread running through today — from the certificate with a private key of four, to the banks calling agent activity "horrifying," to 1Password building a consent handshake, to Kevin Weil putting sensor gloves on chemists — it's all one question. Not "is the AI smart enough?" We're mostly past that. It's "can we prove the thing being done was legitimate, and can we actually execute it in the physical world?" eMudhra failed the proof part and ignored the alarm. The banks can't tell authorized from unauthorized. Warp is betting the whole bottleneck is execution, not intelligence. That's the frontier now. Not the model. The trust and the hands.
That's the menu for today. If you're building in this space, the opportunity isn't the smartest agent — it's the plumbing that makes the smart agent trustworthy and the physical work it depends on actually happen. Go find the alarm nobody's listening to and build the thing that answers it.
I'm Tony DeLuca, and this has been Barely Possible. Watch your error messages, don't hand the robot your bank password, and I'll see you tomorrow.