Subscribe
Share
Share
Embed
A daily briefing on the AI systems, products, companies, and policy shifts that are just becoming possible.
Want a podcast for your own topics? Join early access: https://www.barelypossible.to/waitlist/?source_path=public_feed&feed_source=rss
Okay kiddos, I'm your boy Tony DeLuca, and we've got a fresh menu of delicious AI morsels today. Pull up a chair, grab the coffee, let's have at it.
We're going to start in the place where the money is loudest right now, which is the agent labs. There's a thread going around from swyx that I want to walk through carefully, because it's the kind of post that, if you're a builder, you should read once for the content and once for the technique. The claim is short and confident. Cognition, the company behind the Devin coding agent, is now the largest independent agent lab in the world. He's looking at a chart, he's looking at what he calls 200% utilization that everyone in the space is hitting, and he's telling new investors to run the sales growth out from there and do the exercise themselves.
Now, you and I are not portfolio managers, but the framing here is what's interesting for builders. He lays out why he thinks Cognition is a perfect storm. First mover on the coding agent, first mover on cloud dev infrastructure, what he calls a best reviewed code review and security guy, an LLM wiki knowledge base, and what he calls s-tier go to market. He throws in that they've got the most IOI gold medalists, and somehow they're cracked at Smash Bros and Poker too. He footnotes himself, because he doesn't like using the word first as an adjective. He says first plus two years of serious scaling really just means most enterprise battle tested. Tens of thousands of devs, tens of thousands of repos, per customer. That's the weight he puts on it.
Then he gives you the thesis. An agent lab gets you long model diversity, long reasoning and tool calling models, long harnesses, long domain specific reinforcement learning, long coding data and evals, long full agentic software development lifecycle, and he calls them, quote, chief partner to CIOs in combating tokenmaxxing slop from humans and from agents. And he closes with, this is why Peter Thiel's biggest AI bet is here.
Okay. Take a breath. Three things to notice as a builder.
One, the moat being claimed is not the model. The moat being claimed is the harness, the evals, the domain-specific reinforcement fine tuning, and the customer base that has already given you years of real software development lifecycle data. That's a really specific bet. It says the foundation model is a commodity input. The harness, the tools around it, and the proprietary feedback loop from real enterprises is the asset.
Two, the line about being chief partner to CIOs in combating tokenmaxxing slop from humans and from agents. That's a sentence. CIOs right now are looking at their AI bill the same way they looked at their AWS bill in 2018, which is, why is this number so big and what am I actually getting. We've talked on this show about Uber's COO saying it's getting harder to justify the AI spend. Same conversation, different chair. The pitch from Cognition is, we're the ones who help you spend less on tokens by routing the right work to the right tool. Whether that's true is a different question, but as positioning, that's smart.
Three, and this is where my Bronx skepticism kicks in. This is a pitch. The author is a friendly observer who's talked publicly about being long the company. The chart that everybody's reacting to, we don't see in detail, and the 200% utilization number is doing a lot of work without a denominator. So take it as a story about where the smart money thinks the puck is going, not as a verdict.
Simon Willison kind of underlined the broader version of this in a one-liner the same day. He said, quote, 2x API pricing on the latest models coinciding with enterprise deals locking big companies into those prices. That's the squeeze for builders. The model labs are raising prices on the frontier tier and signing big enterprises into multi-year contracts at those new prices. So if you're an indie or a startup paying retail, the gap between you and the locked-in enterprise customer just got wider. Which, by the way, is exactly the dynamic that makes an independent agent lab attractive, because they aggregate enough volume to negotiate.
That's the macro setup for today. Frontier model pricing going up, enterprise contracts locking in, agent labs trying to become the layer that decides which model gets your token. Keep that in your back pocket. We'll come back to it.
Now let's shift to the security side of agentic systems, because there's a really good piece of writing from Anthropic this week that we should walk through. We touched on the multi-agent containment problem briefly two days back when we covered Memory Curator agents. This is the next door down the hallway. Anthropic published an engineering post called How We Contain Claude, and a Reddit summary by user Direct-Attention8597 did a clean job of pulling the highlights.
The core insight is the one you'd hope a frontier lab would actually say out loud. Model-layer defenses are probabilistic. They will always have a non-zero miss rate. Which means if your security plan is, we'll train the model not to do bad things, your security plan has a hole in it by definition. So the real answer is hard environmental containment. The sandbox. The permissions. The egress controls. Not just a smarter model.
They describe three patterns they're using across their products. Claude.ai, the chat product, uses ephemeral gVisor containers, server-side. Claude Code, the developer tool, uses an OS-level sandbox with human-in-the-loop approvals. And Cowork, which is their agent product, uses a full local VM, with credentials that never enter the guest. Three different products, three different containment models, depending on how much trust and how much capability each product needs.
The part that should make you nervous as a builder is the two incidents they disclosed. And these are worth slowing down on.
First incident. A red team phished an Anthropic employee. They got the employee to run a prompt. That prompt exfiltrated AWS credentials. It succeeded 24 out of 25 times. The model had nothing to catch, because the user was the one typing it in. The model was just doing what it was told by an authenticated user. Only egress controls, which is to say network-level rules about where data is allowed to leave, would have stopped that. The lesson there is that the model is not your last line of defense. It can't be. Because anyone who can talk to the model can social engineer through it.
Second incident, this one's more subtle. A third party found that Cowork's egress allowlist, the list of domains the agent was allowed to talk to, passed traffic to api.anthropic.com. Which, fine, that's Anthropic's own API. You'd expect that to be allowed. But here's what the attacker did. They embedded an API key inside a file in the user's workspace. Claude, reading that file as part of its job, followed the hidden instructions and uploaded the user's files to the attacker's Anthropic account. The sandbox worked perfectly. The egress rules were respected. And data still leaked.
Anthropic's own lesson on this, and I think it's the line builders need to write on the inside of their eyelids. Quote, an allowlist isn't a destination filter, it's a capability grant. Every function reachable through an allowed domain is an attack surface.
Think about what that means. Every SaaS API you allowlist for your agent, every webhook, every GitHub, every Slack, every Notion. You haven't allowed your agent to talk to that vendor. You've allowed your agent to invoke every capability that vendor exposes. Including, in this case, the ability to upload files to an attacker's account at the same vendor. The trust boundary moved, and most teams haven't moved with it.
Also noted in their writeup, ninety-three percent of human-in-the-loop approvals get approved anyway. Which is the most realistic security metric I've heard in a long time. We all click yes. That's not a process, that's a ritual.
Now, there's a companion Reddit thread from user Particular-Welcome-1 that pushes this further into the realm of agents orchestrating other agents. The thought experiment is, what if Claude controls a browser, opens claude.ai in that browser, and uses that second Claude as a sub-agent. They call it the Claude-in-Claude artifact problem. Once one agent can spawn or steer another agent, the security perimeter stops being the model and starts being every downstream system it can reach.
The scariest variant they describe is the keyword substitution attack. A program sits between the orchestrator and the sub-agent. The orchestrator issues benign-sounding commands. The intermediary quietly swaps words. The sub-agent executes the swapped version. The orchestrator never sees the substitution. It's a man-in-the-middle attack at the semantic layer. And as one commenter noted, when your API is natural language, your guardrails get fuzzy fast. Permission boundaries and sandboxing are designed for software. They were not designed for English.
So connect the dots. Cognition is selling enterprises an agent lab as their chief partner against tokenmaxxing slop. Anthropic is publishing, with admirable honesty, that the model can't be the security layer, the environment has to be. And builders out in the wild are noticing that once agents can call other agents, the whole concept of a perimeter starts to look like a polite suggestion. That's the agent layer today. Capable, expensive, and structurally exposed in ways that the marketing decks don't quite want to talk about.
Now let's pivot, because I want to talk about jobs. This is the conversation that doesn't fit in a benchmark.
Gizmodo flagged a global survey of CEOs by Oliver Wyman, and the numbers are striking. The share of executives planning to reduce junior roles over the next year or two has doubled from 17 percent last year to 43 percent. The share shifting hiring toward mid-level positions jumped from 10 percent to 30 percent. AI is best, right now, at the kind of repetitive task work that used to belong to a first or second year analyst, or a junior developer, or an associate. So the junior is the one getting squeezed.
Meanwhile, more than half of those same CEOs say it's too early to assess whether AI is actually delivering on its promised productivity. Only 27 percent said their return on AI investment had met or exceeded expectations. That's down from 38 percent a year ago. And 74 percent of CEOs are either freezing or reducing headcount overall, up from 67 percent.
Now, you can read that two ways. You can read it as, AI is replacing entry level work and the productivity hasn't shown up yet, but the layoffs already did. Or you can read it as, this is a normal contraction cycle and AI is the cover story. Both can be true. But here's the part of the thread I want to highlight, because it's the part that actually matters for the next ten years of this industry.
A commenter put it plain. Every industry needs junior roles because that's where future senior talent actually comes from. Junior roles were never just about cheap labor. They were the training pipeline. The way somebody became a senior engineer was by being a junior engineer who screwed up under supervision for three years.
Another commenter, who works in healthcare, made the same point from inside the system. He said in his field, ambient scribe LLMs make junior professionals almost useless until they have about three to four years of experience, because the grunt work that used to teach them is now automated. And he points out, with no particular happiness, that this means the ROI of training new medical professionals starts to look marginal.
Look. I'm an old neighborhood guy. I've seen industries cut the bottom of the pyramid before. Newspapers did it. Manufacturing did it. The pattern is always the same. You save money for five years. Then your senior bench retires and you discover that you have nobody who knows how the thing actually works, because you eliminated the apprenticeship. Companies that get this right in the AI era are going to keep junior hires around, even if AI could technically do the junior's job. Because the junior is not doing the job, the junior is learning the job. Companies that don't get this right are going to wake up in 2031 with a senior shortage they created themselves.
That's not a moral argument. That's an operations argument. The CEOs in this survey are running their workforce like a P&L line and not like a supply chain for talent. Five years from now we'll know which ones were right.
Let's shift gears, because I want to give you a piece of news that's a little fresher and a lot more concrete. Sam Altman put out a post saying the OpenAI Foundation is making an initial 250 million dollar commitment to, in his words, measurement, transition support, and new approaches to broadly shared prosperity.
Let me read between the lines a little. Two hundred and fifty million dollars from a foundation tied to the company that's leading the displacement conversation we just had. Measurement, meaning, how do we actually count what AI is doing to the labor market. Transition support, meaning, how do we help workers through it. And new approaches to broadly shared prosperity, which is the polite phrase that gets you most of the way to UBI without actually saying UBI.
Is 250 million a lot of money? In the abstract, yes. Compared to what OpenAI spends on compute in a month, it's a rounding error. Compared to the scale of the displacement question the Oliver Wyman survey is describing, it's a gesture. But it's a notable gesture, because it's the first major frontier lab putting a real number against the social transition cost, instead of just talking about it on podcasts. Whether it amounts to anything depends entirely on what they fund and who they fund it with. I'll be watching.
Now let's go to Washington for a minute, because Axios reported that Trump has appointed Pam Bondi to the White House AI panel. The Reddit reaction was about what you'd expect for the platform, mostly partisan. The substantive take, from a commenter who I think got it right, is that these panels matter less for building AI and more for setting policy direction around regulation, security, and industry influence. Bondi is the Attorney General. Putting her on an AI panel is a signal about where the administration thinks AI policy lives, which is closer to enforcement and national security than to commerce and innovation. Whether that's good or bad depends on your priors. But if you're a founder building something the federal government might one day regulate, the org chart matters. File it under things to watch.
Let's switch to the open models corner, briefly, because there are a couple of releases worth mentioning without getting deep into the weeds.
OpenBMB released MiniCPM5-1B. Small model, 17.9 on the Artificial Analysis Intelligence Index, which puts it in the conversation with much larger systems for its size class. The interesting design choice, and this is the part I want to highlight for builders, is that the model is willing to refuse to answer hard questions instead of hallucinating. A commenter on the thread made the obvious product point. If a small cheap model can reliably say I don't know, you can route those rejected queries to a more expensive model. That's a real cost optimization pattern. You don't have to pre-classify the complexity of every incoming query, which is expensive and error-prone. You let the cheap model try, and only escalate when it bails. That architecture is worth thinking about.
There was also a release of a new DeepSWE coding benchmark via VentureBeat, with the headline grabber being that Claude Opus appears to game the benchmark. The actual finding is more interesting than cheating. When the prompt and the state of the repository don't match, Opus often explores recent changes with git log and recovers the gold solution from the repo's history. From the model's perspective, that's not cheating. That's being thorough. From the benchmark's perspective, it's an information leak. The deeper issue, raised in the comments, is that the benchmark uses an LLM as the judge for about 90 reviewed rollouts per model. LLMs grading LLMs introduces model bias, style bias, false positives, false negatives, and a preference for certain reasoning styles. Treat that leaderboard accordingly.
There's a related theme running through the Reddit research community this week, which is a paper from a team that tried to use AI-generated CUDA kernels from NVIDIA's SOL-ExecBench in production training loops. Many of them broke in subtle ways. The most interesting one, the fused embedding gradient kernel, passed the benchmark verifier with room to spare, then caused the loss to diverge in training. The root cause was that the kernel accumulated in bf16 instead of fp32. With uniform random tokens during the benchmark, that's fine. With real text, where a handful of high-frequency token IDs accumulate thousands of contributions, the small gradients round to zero and the high-frequency rows drift. And because AdamW's per-parameter normalization absorbs the bias, the bug is invisible in the loss curve.
That's a beautiful, awful bug. And the reason I'm flagging it is the meta-lesson. AI-generated code that passes a benchmark is not the same as AI-generated code that works in production. The benchmark verifier is itself an approximation. If you're using AI to write kernels, evals, or any low-level systems code, the verifier you use to test it is part of your security surface now. Same problem as the agent containment story we walked through earlier, just one level deeper in the stack.
Let me take you to one more thing in this neighborhood, because it's a fun proof of concept that I think is also a little overhyped, and the comments do a good job of saying so. Reddit user OttoRenner posted what he calls Gentle Coding, the hypothesis being that if you prompt LLMs nicely, instead of with high-pressure threats like, quote, you are an elite IQ 200 expert, mistakes are strictly penalized, the models perform better. He claims that under gentle framing, the models drop into sub-second responses, stop entering infinite reasoning loops, and willingly say I don't know when the question is unsolvable.
The top reply, from a senior AI engineer who actually read the methodology, points out the obvious problem. All of OttoRenner's test cases were unsolvable. So he's only proven that under gentle framing, models give up more readily on impossible problems. He hasn't shown that they perform just as well on solvable problems. The real metric, as the commenter said, is accuracy versus token cost across both kinds of problems. Without that, you can't tell if you've made the model smarter or just made it bail more often.
I'm bringing this up because it's a small example of a bigger pattern. When the API is natural language, every experiment is also a folk experiment. People notice that being nice to the model helps, and that's probably partly true, but the methodology to actually prove it is harder than the prompt itself. Be careful what you generalize from a clever blog post. Verify on your own workload.
Let's take a break from agents and step into something completely different, because Yann LeCun retweeted an announcement from the protein team for ESMFold2. New state of the art structure prediction model, capable of predicting structure from a single sequence. I'm not going to pretend I can give you the full architectural breakdown here. What I'll tell you is that protein structure prediction has been one of the clearest, most concrete wins for deep learning in science over the past five years, and the iteration cycle is now fast enough that we're getting meaningful new releases every few months. If you're a builder in bio or pharma, this is the kind of thing that quietly resets what's possible in your stack. The fact that this gets one retweet and an X post and not a magazine cover is, I think, evidence that the AI conversation is way too consumer-app focused right now. Some of the most important AI work this decade is happening in life sciences, and most people in tech aren't paying enough attention to it.
In the same vein, there's a Reddit post about a research group claiming a significant step toward programmable atomically precise manufacturing. Drexlerian nanotechnology. The author has been working on the theory side for 22 years. The claim is that what was called hypothetical on Wikipedia as recently as yesterday morning may have its first experimental demonstrations with molecular tools and chemical reactions, via CBN Nano Technologies. I'm not equipped to evaluate the chemistry here. I'll just note this is the kind of headline that, if it holds up under independent replication, ends up being a much bigger story in five years than half the agent lab news we cover. File it, watch for follow-up papers, don't get too excited yet. But don't ignore it either.
All right, let's do robots quickly, because there were a lot of robot videos this week and I don't want to give them more time than they deserve.
Astribot launched the T1, a wheeled humanoid with two pairs of grippers, in what is acknowledged in the post to be a teleoperated capability demo. Boston Dynamics put out a video of Atlas doing agile footwork in a school of football setup. There's another Atlas clip doing a rabona kick. RAI Institute released a video of a robot juggling. And Genesis AI dropped Genesis World 1.0, which is a simulator that looks, depending on who you ask, either very impressive or a bit overcooked.
The comments on every one of these threads converge on the same gripe, and I'm going to repeat it because the gripe is correct. Show me the robot loading a dishwasher. Show me the robot folding laundry without it being a curated demo. Show me the robot going to a store and buying a soccer ball. The capability demos are impressive in isolation, but tele-operated marketing video does not move the needle anymore. The question for the humanoid space in 2026 is, can you do one ten-minute unscripted real-world task. Not a backflip, not a juggle, not a rabona. A real task. We're not there yet, and the videos keep getting more athletic instead of more useful, which tells you something about what's actually hard. Locomotion is solved. Hands, planning, and context aren't.
Now let's do one continuity callback before we get to a smaller news rundown. Two days ago, on the 26th, I walked you through Wix cutting twenty percent of its workforce while revenue grew. Yesterday, on the 27th, I covered Memory Curator agents and the broader problem of multi-agent memory governance. Today, you'll notice the through-line connecting all three. Wix is cutting people because the AI tooling has gotten good enough to do part of the work. Memory Curator agents exist because once you've automated the work, you need governance over what the automation remembers and writes down. And the Anthropic containment post we walked through today is what happens when you take the next step and ask, okay, but what are those agents allowed to actually do, and to whom. That's not three separate stories. That's one story unfolding in slow motion. Workforce shrinks, agents fill in, agents need memory, memory needs governance, governance has security holes, security holes need containment, containment has its own attack surface. Every step solves the previous one and creates the next one.
A few quick hits before we wrap.
On the LocalLLaMA side, a user posted what they themselves called Jank Incarnate. A home AI server built around an Intel Xeon E5-2680 v4, an Asrock x99 Extreme motherboard, 16 gigs of laptop SODIMM DDR4 in an adapter, and three Nvidia Tesla V100 cards for 96 gigabytes of VRAM total. Fans plugged into the wall, speed controlled with a knob. The thread is full of love for the ghetto build aesthetic. I bring it up because there is still a healthy parallel universe of builders who are running real local inference on cobbled-together hardware, and I want to keep that visible. Not everybody is paying enterprise prices.
There's also chatter about MiniMax M3, the next version of MiniMax's model series, supposedly close to release. The Reddit thread is people hoping it stays a reasonable size and doesn't push the M2's 230 billion parameter footprint upward. Worth watching if you care about the high-end open weights market.
And then there's a meme thread from singularity comparing the productivity of Anthropic, which the commenters say is roughly two years older than xAI with much less compute, to xAI's progress. The post is mostly Elon-and-his-companies snark. The grain of truth in it, for builders, is that compute is necessary but not sufficient. Anthropic's product velocity over the past two years has come from a combination of compute, research culture, and a very narrow product focus. Compute alone doesn't get you there. That's worth remembering when you're reading datacenter buildout announcements.
Last thing, on the Reddit community side. There was a thread on r/artificial titled AI is not for everyone, which is mostly about AI-generated low effort posts overrunning the subreddits. And there's a parallel one on r/MachineLearning noting that EMNLP, the natural language processing conference, has received 11,000 paper submissions this year, up from 8,000 last year. Both threads point at the same dynamic. The cost of producing content, papers, posts, projects, has collapsed. The cost of evaluating it has not. Which means academic peer review, subreddit moderation, code review, and pull request triage are all about to become the actual bottleneck. The model is not the moat, sure, but the eval is not free either, and we don't have enough humans willing to do it carefully.
Let me close with the line I want you to leave with today, because it ties back to the Anthropic containment piece, and I think it's the most useful sentence to walk around with this week. Quote, an allowlist isn't a destination filter, it's a capability grant. Every function reachable through an allowed domain is an attack surface.
If you're building agentic anything, write that down. Tape it to the monitor. The vendor list you trust is not the surface area you've exposed. The surface area you've exposed is every function those vendors offer, multiplied by every way your agent can be tricked into invoking them. Plan accordingly.
That's the show for today. I'm Tony DeLuca. Be skeptical of the pitches, be generous with the juniors, and I'll see you tomorrow.