Subscribe
Share
Share
Embed
A daily briefing on the AI systems, products, companies, and policy shifts that are just becoming possible.
Want a podcast for your own topics? Join early access: https://www.barelypossible.to/waitlist/?source_path=public_feed&feed_source=rss
Okay kiddos, I'm your boy Tony DeLuca and Barely Possible is back on the air with a fresh plate of stories that actually matter if you're the one building the thing, not just reading about it. Pour the coffee, silence the group chat, let's have at it.
Here's what caught my eye today, and I want to be honest with you up front about why. There's a startup that just raised thirty million dollars to build a payments system where the customer isn't a person anymore. It's a piece of software. And the more I sat with that, the more I realized it's not a novelty story. It's the story that quietly connects half the other things on today's menu. So we're going to build the whole episode around that idea: what happens when the thing on the other end of the transaction, the thing writing the code, the thing filling up the platform, the thing running the science, stops being a human being. Where that helps, where that squeezes somebody, and where it just makes a mess.
We'll get into agent payments, the plumbing that agents need to actually work, YouTube drawing a line around AI junk, a very serious WordPress security mess you need to hear about today, the open-weight model fight that just keeps rolling, and a genuinely hopeful story out of Anthropic on rare disease. Plus a couple of smaller ones. Let me lead with the one that got me thinking.
Let's start with Natural. This is a startup, reported by Marina Temkin, that just raised a thirty million dollar Series A led by Kirsten Green at Forerunner. Total funding now sits at forty million. And what they're building is payment infrastructure for AI agents. Not payments where an agent helps you check out on a website and then you tap approve. Payments where the agent itself is the one moving the money, collecting the money, and in some cases transacting with another agent on the other side. No human in the loop at the moment of the transaction.
Now the co-founder and CEO is Kahlil Lalji, and I appreciate that the guy is upfront about his own reluctance. He'd sold his previous startup, a banking product called Ivella, back in 2023, and he says he'd been burned by finance after the zero-interest-rate era ended. He wanted out of the sector. And he kept getting pulled back. In his words, quote, it just feels obvious that agentic payments are going to be structurally the most important problem in the space, end quote. When somebody who actively didn't want to work in a space tells you they couldn't stay away, I pay attention. That's usually a better signal than the founder who was always going to build in whatever's hot this week.
So here's the actual problem they're chewing on, and it's a real one. Our entire financial system, the rails, the ACH network, credit cards, all of it, was built with one assumption baked into the concrete: a human authorizes the transaction. A person taps a card, signs a slip, clicks a button. That authorization step is the whole security model. And it's slow, deliberately, because slow is safe when a human is involved. Now you've got agents out there that can identify a freight vendor, compare prices, negotiate a delivery, do the entire workflow in seconds. And then they hit the wall. They need a person to pay. The intelligence runs at computer speed and then stops dead at the cash register because the cash register was built for hands.
Natural is trying to rebuild the register. They call themselves an agent orchestration layer that lets agents move and store funds, and Green from Forerunner said what attracted her wasn't just letting agents buy stuff, it's the deeper ambition, including rebuilding how disputed transactions get handled. And that last part is the part I'd circle in red. Because when you take the human out of the authorization, you've also taken the human out of the dispute. Who do you call when your agent bought the wrong thing from another agent? That's not a small footnote, that's the entire trust problem.
Their main competitor is Stripe, which is also racing to redesign rails for agents. There's DCVC-backed Skyfire Systems going at it with stablecoins. Natural says it'll fold stablecoins in too but also support traditional bank payments. And they've pulled senior people from Stripe, Ramp, and Square, which tells you the fintech insiders think this is a real category and not a pitch-deck fantasy.
Here's the line from Lalji that I keep turning over. He says the total number of payments in the world could be two, three, four orders of magnitude greater than today if transactions happen at computer speed instead of human speed. Now, four orders of magnitude is ten thousand times. Take that with a grain of salt, that's a founder's number and founders round up. But strip away the hype and there's a real observation underneath. When you remove the human bottleneck, you don't just make the same transactions faster. You unlock a whole class of tiny, constant, machine-to-machine transactions that were never worth a human's time to authorize. Your agent pays a fraction of a cent to another agent for a piece of data, a compute cycle, a lookup. That's a genuinely different economy, and it's either enormous or it's a fraud playground, and honestly it's probably both at once.
So why is this the spine of today's show? Because that same shift, machine on the other end instead of a person, is showing up everywhere right now, and everywhere it shows up it creates the exact same two questions. Question one: what does the infrastructure need to become. Question two: who gets squeezed when the human steps out of the loop. Hold onto those two questions, because they're going to keep coming back.
Which brings me right to the plumbing. Because if agents are going to pay for things, agents first have to be able to do things, and there's a piece of that pipework that just got a meaningful upgrade.
Now let me frame this one carefully, because it's a bit older than it looks on the surface. This is a recent piece from Russell Brandom walking through a change to the Model Context Protocol, MCP. The spec for the new version has actually been public since May, and the update itself is landing shortly. So this isn't a brand-new bombshell that dropped this morning. What's fresh is the clear explanation, and it came from a startup called Arcade, whose founder Nate Barbettini laid it out in plain language.
If you don't live in this world, here's what MCP is: it's the standard way an AI model reaches into your actual stuff. Your calendar, your database, your internal tools, Gmail, Slack, Salesforce. Before this kind of protocol existed, every single connection was a custom job, engineers hand-building a pipe for each tool. MCP is supposed to be the universal fitting, so you build the connection once and everything speaks the same language. It's plumbing, and I mean that as the highest compliment. Nothing works without the plumbing.
Arcade, for what it's worth, raised sixty million dollars back in June on a very specific bet, and I love the clarity of it: most AI agents don't fail because the model is dumb. They fail because the infrastructure around the model isn't ready. The scaffolding, the connections, the stuff nobody tweets about. That's their whole thesis, and this MCP change is a perfect illustration.
So what actually changed? It's about session IDs. When a client like Claude first connects to a server, it says hello, here's who I am, here's what I can do. The server says hello back and hands over a session ID, basically a little token that means, ah yes, this is the same conversation as five seconds ago. From then on, every request carries that ID. Fine. Works great when one server remembers you.
Here's where Barbettini's explanation is genuinely useful. Picture a real deployment. You're running a server for millions of users, and there's a load balancer whose entire job is to shove each incoming request to whatever machine in the farm happens to be free, sometimes in a totally different region. Now every one of those machines has to somehow know about a session ID that some other machine handed out. As he puts it, it's not impossible, but it's a serious pain, and it fights the load balancer instead of working with it.
That, right there, is why we haven't seen more companies ship big, first-party MCP integrations even with all the agent hype this year. The plumbing fought back. The new version goes to a looser, stateless approach, more like how ordinary websites already work, which makes the whole thing easier to maintain and cheaper to run at scale.
Now here's the honest takeaway, and Brandom nails the tone. This is not glamorous. This is standards-body work, the slow log-rolling of committee consensus, while model training races ahead making headlines every week. And that gap is the real lesson for you as a builder. The intelligence is sprinting and the infrastructure is walking. Same exact pattern as the payments story. The agent can do the work, but the rails to let it act, whether that's paying or connecting to your Salesforce, are lagging behind. If you're building on agents right now, that lag is where your real engineering time is going to go, and anybody telling you otherwise is selling you a demo.
Let me shift from the plumbing to the pipes clogging up. Because there's a flip side to all this agentic capability, and it's the sheer volume of machine-made stuff flooding platforms that were built for people.
YouTube just clarified its policies around what it calls inauthentic content, and this is a current story, rolled out July 16th, affecting everybody in the YouTube Partner Program. Sarah Perez reported it. Now YouTube already had rules against AI slop and mass-produced junk. What's new is they've spelled out three specific buckets that can't be monetized, and the trust and safety chief, Matt Halprin, laid it out in a creator video.
Bucket one: generic, repetitive, template-based content. The stuff where AI or CGI lets you crank out fifty near-identical videos with no narrative arc, no actual creativity. Halprin made a point I think is fair, quote, AI can actually allow people to make a lot of videos. Sometimes those videos are great, and it really enhances creativity. But that exact same new tool can allow you to make lots of videos really quickly that are very similar, end quote. And interestingly, he flagged that tutorial videos can fall into this trap too, if you're just reproducing what's already all over the platform instead of making something original.
Bucket two is the one I found most interesting, because it's got nothing to do with AI directly. Off-putting content. Stuff engineered to be distressing or emotionally manipulative to chase views. The example he gave: those videos of an animal in distress that somebody conveniently comes along and rescues. Viewers hate it, they find it manipulative, and channels built on that get pulled from monetization whether a machine made it or not. Bucket three targets AI personas, fake representations of real people, used to talk about sensitive stuff like health, finance, legal, medical. That's the one that should worry you most as a consumer, an AI face telling you what to do with your money or your body.
Now here's why YouTube actually cares, and it's not your feelings. The Partner Program is the company's lifeblood, and Perez points out YouTube now pulls more ad revenue than rival streamers and has overtaken Netflix in average daily views worldwide. When you're competing for TV ad dollars, you cannot let the whole thing turn into a slop farm. Advertisers flee, viewers flee. So this is self-interest dressed up as quality control, and that's fine, self-interest is usually the most reliable motivator in the room.
But connect it back to our spine. When the entity making the content stops being a person and becomes a content-farming machine, the platform has to build new defenses. That's the same shape as Natural rebuilding dispute resolution because the buyer isn't human. Every place we pull the person out, somebody has to invent a new referee. YouTube just appointed itself referee, and the hard part, as Halprin basically admits, is that slop is a know-it-when-you-see-it problem. Good luck writing that into a policy that a machine can enforce against other machines.
Speaking of the machine on the other side being a bad actor, let me get to the one story today that isn't philosophical at all. It's a right-now, go-check-your-stuff story.
Hackers are actively exploiting recently patched WordPress bugs, and this is current, reported by Lorenzo Franceschi-Bicchierai. Last week WordPress patched two critical security flaws and told people to update immediately. These were so severe that WordPress enabled forced updates where it could. Since then, three cybersecurity firms, Patchstack, Hexastrike, and WatchTowr, have all warned that attackers are exploiting these in the wild. Meaning they are actively taking over websites right now that are still running the vulnerable versions.
Here's the part that matters for you specifically. The vulnerable versions are WordPress 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. If you're running any of those, stop what you're doing and update. One of the bugs, found by Adam Kues at Searchlight Cyber, got dubbed WP2Shell, and paired with the other bug it lets hackers take full remote control of the site. Full remote control. That's not a defacement, that's your whole box.
Now on the scale of it, let's be responsible. WordPress official stats say over four hundred million sites run those flawed versions, but that number doesn't reflect sites already patched. A consultant named Daniel Card looked at a sample of about thirty-five hundred sites and estimates less than fifteen percent are actually vulnerable. Apply that across the internet and you still land around ninety million sites. So somewhere in the tens of millions is the honest range. Card credited WordPress for pushing automatic updates, Cloudflare for blocking attacks, and firewalls for keeping the exposed number down. And Automattic, the company behind WordPress.com, says all its hosted sites were protected even before the release.
Why does this belong in an AI show? Because I want you to hold two of today's stories in your head at the same time. Later we're going to talk about the argument that Chinese open-weight models are dangerous partly because they'll help attackers exploit systems. Meanwhile, the actual attack happening today, right now, against ninety million sites, has nothing to do with any of that. It's a classic unpatched-software problem, the oldest story in security. The threat that's draining people's websites this week is boring, and boring is exactly why it works. Go update your WordPress. That's not a metaphor, that's a chore, do the chore.
Alright, let me connect this to the bigger fight, because the security angle is being used as a chip in a much larger poker game.
There's a piece from Tim Fernholz, with additional reporting from Rebecca Bellan, headlined, OpenAI is scared of open-weight models, should the US be. Now, we covered the Kimi K3 launch and the Wall Street reaction earlier in the week, and I'm not going to re-litigate all of that. Consider this the next chapter, the policy fight that came out of it, because there's genuinely new material here.
Quick refresher for continuity: as we covered a couple days back, Moonshot's Kimi K3, the biggest open-weight model out there, spooked the markets and kicked off a brawl about what the US government should do. What's new in this piece is the specifics of that brawl and where it's actually landing. OpenAI's head of strategic futures, Dean Ball, had argued the government should manufacture regulatory fear and uncertainty around these models, because in his view open-weight models necessarily deter the frontier labs from spending capital. People pushed back hard, Yann LeCun and Martin Casado among them, arguing open software accelerates innovation and can coexist with proprietary work. Ball then walked back the claim that a crackdown was the White House's best strategy. But here's the fresh development: Axios reports the Trump administration is actually considering banning K3 and other advanced Chinese models at the request of American frontier labs, while Politico reports Commerce won't move on that anytime soon. So it's live, but it's stalled.
And Fernholz does something I respect, he separates the arguments cleanly instead of mushing them into vibes. The honest business case for the labs is simple: open-weight models running on your own infrastructure offer cheaper intelligence than OpenAI's or Anthropic's flagship models. If people spend more outside the closed labs, that's smaller returns on those enormous training investments. Braden Hancock, co-founder of Snorkel AI, put it plainly, quote, strong, frontier-caliber open source models will place a squeeze on the margins and will bring down the prices of the frontier companies, end quote. And he adds the kicker, that doesn't mean AI usage goes down. Quite the opposite. So this is a margin problem for two companies, not a doom problem for the technology.
Now the national security arguments. Fernholz runs through them fairly. Data leaking back to China? Experts think open models running on US servers are unlikely to phone home, though not impossible. Implicit bias toward Beijing? Unclear what that even means for a coding task. Missing guardrails? Here's the twist I hadn't fully clocked. David Sacks, the VC and Trump adviser, has been sharing cases of US companies turning to Chinese models precisely because the US frontier models refuse to do legitimate security work. So the guardrails the US mandated might actually be making American companies less safe, pushing them toward the Chinese tools to get real work done. That's a genuinely uncomfortable irony.
But the argument I want you to sit with comes from Hancock, and it's the innovation-ownership point. Quote, the bigger impact of having these open source models come from China is less that they're sneaking in back doors, and more that they are owning the innovation, end quote. He points at PyTorch, which became the industry standard precisely because it was open source, the whole community piled in, contributed, and the competing libraries basically died. His fear is that Chinese labs become the center of gravity for global AI research. He says US grad programs already build mostly on open-weight Chinese models, and roughly half the papers students study now come from Chinese institutions, while American labs get more secretive.
And Sam Bresnick at Georgetown asks the question that cuts through it, quote, why should the weight of the U.S. government be aimed at protecting these companies from competitors that are being locked out from the U.S. market based on their origins, end quote. His alternative is cleaner: if you actually want to slow China, tighten chip export controls, stop selling them the Nvidia H200s, instead of banning software that huge numbers of American companies want to use. Clem Delangue at Hugging Face put the counterargument in one line, quote, restricting open models wouldn't make AI safer, it would simply hide the risks, concentrate power in the hands of a few, end quote.
Here's how it lands in my kitchen. Notice the pattern. When intelligence gets cheap and available and doesn't require you to phone the frontier lab for permission, somebody's margin gets squeezed, and that somebody starts lobbying the referee. Same shape as everything today. The human, or in this case the gatekeeper lab, gets pulled out of the required loop, and the incumbent wants a rule that puts them back in. Bresnick even names the core problem, nobody's figured out how to make money at this yet, open or closed, especially as training costs keep climbing. So a lot of this policy heat is really just two companies trying to protect a business model that isn't proven. Watch what Commerce actually does, not what the labs say. Right now it's stalled, and stalled is informative.
Let me pivot hard here, because not everything today is about squeezing and refereeing. There's a story where taking the human out of a loop is unambiguously good news, and I want to give it real air.
Anthropic put out a call for applications for what they're calling AI for Science rare disease research grants. This is current, dated July 20th. And I'll tell you why I care about this one beyond the press-release shine. Rare diseases are, in aggregate, one of the most common conditions on the planet. The number they cite is around four hundred million people living with one of more than seven thousand rare diseases. And here's the cruel math of it: because each disease affects a small scattered population, nobody can build proper patient registries, nobody can easily find drug targets, nobody can design clean trials. Each condition gets studied in isolation, which means you almost never spot the mechanisms that might be shared across diseases. That isolation is the killer.
The program's got two tracks. Accepted applicants get up to fifty thousand dollars in Claude credits over six months. Track one is basic science, partnering with a group called the Monarch Initiative, an international consortium building shared standards for rare disease data. They've got a new library, agent-friendly, where Claude can read case reports, variant databases, registry schemas, raw public data, and point out mechanistic similarities between diseases at a pace no human team could match. That's the good version of taking the human out of the loop, not replacing judgment, but scanning across thousands of scattered studies to find the pattern a person would never live long enough to see.
Track two is the biotech side, speeding up drug development. And here's a number that stopped me: today it takes one to two years to go from a confirmed genetic diagnosis to an actual treatment, and a huge chunk of that time is spent waiting in queues for manufacturing slots, running safety studies one after another instead of in parallel, and hand-assembling thousands of pages of regulatory documentation. Anthropic's bet is Claude can compress the documentation and analysis phases, drafting regulatory dossiers, analyzing whether a target is druggable, and finding shared mechanisms across therapies so several could potentially be approved under a single basket trial instead of a separate application per patient.
Now, and this is why I trust the framing more than usual, they were honest about the limits. Straight from the announcement: Claude can't help where the data is too paltry or too poorly organized for agents to reach. And it can't touch the parts of the so-called diagnostic odyssey that are about insurance authorization or access to diagnostic facilities. That's the real world. The AI can read every paper ever written and it still can't make your insurer say yes. They named a few partners already doing this, Every Cure using Claude for drug repurposing across millions of candidates, the Centre for Population Genomics drafting variant classifications for expert review, and the Violet Research Institute working on ultra-rare diseases.
Applications close August 2nd, so if you're a researcher or an early-stage biotech in this space, that's a real deadline worth knowing. And I'll say the quiet part: yes, it's also good marketing for Anthropic, and yes, giving away credits builds a moat of researchers dependent on your tools. Both things are true. But if the output is faster paths to treatment for diseases that the market has always ignored precisely because the populations are too small to be profitable, I'll take the mixed motive. That's the whole point of the beneficial deployment idea, going where market forces alone won't take you. Fair play.
Now let me bring us back down to earth with the hardware and infrastructure stories, because the money underneath all of this is starting to talk.
There's a report, and I want to frame this correctly, this is an older report from last month resurfacing, originally from The Information, that Alphabet is designing a new server chip internally dubbed Frozen v2, aimed at making its Gemini models run more efficiently. Lucas Ropek covered it. The chip is slated for sometime in 2028, and the claim is it could be six to ten times more efficient than Google's existing AI chips, measured by tokens generated per unit of power. Google didn't confirm and didn't deny, gave the usual we're always experimenting statement.
Here's why efficiency, not raw power, is suddenly the headline. The market euphoria around AI has cooled into anxiety about AI spend. Google's talking about spending between a hundred and eighty and a hundred and ninety billion dollars. When you're lighting that kind of money on fire, investors want to see the payoff, and efficiency per watt is how you show the burn rate is under control. And it worked, at least short term, the stock climbed around three percent after the report. There's also the broader push to wean off Nvidia. As background, OpenAI announced its first custom chip, an inference processor, back in June, and there was a report earlier this month about Anthropic discussing a chipmaking partnership with Samsung. Everybody wants to own their own silicon so they're not paying the Nvidia tax forever. For you as a builder, the signal is simpler: the cost of running these models is finally the thing the giants are optimizing for, which over time should mean cheaper inference for everyone downstream. That's the tailwind under your feet.
Let me do a couple of quick ones, and I'll be honest with you about what they are.
On the consumer side, there's a nice piece from Ivan Mehta about Adobe adding AI features to its experimental iOS camera app, Project Indigo. The headline feature is that it'll critique your photos, give you a professional-style opinion on framing, lighting, color, emotional impact, and suggest how to reshoot. The person heading the project is Marc Levoy, and the design philosophy here is actually thoughtful. Levoy's point is that prompt-based editing is a pain, finding the magic words is a chore, so most of these features are buttons that give you more predictable, deterministic results. There's a genuinely impressive object-removal tool with toggles for removing people, wires, poles, trash cans, clutter. It's built on Google's Gemini-based Nano Banana model, though Adobe says it's open to swapping in others including its own Firefly. Now here's the twist I liked: this is an AI feature explicitly designed to make you a better photographer rather than just generating more slop. Mehta's own framing, the critique feature could teach you photography tricks even if you disagree with the AI. That's a rare thing, AI as a coach instead of a replacement. Whether it ships to everybody is an open question, it's in testing for select users. But it's a nice counterexample to the slop panic. Not every AI feature is trying to do the work for you. Some are trying to make you better at it.
And here's the through-line for you as a builder, connecting Indigo back to that YouTube slop policy: same technology, two totally opposite products. One uses AI to help a person make something genuinely their own. The other uses AI to mass-produce garbage for ad money. The tool is neutral. The design intent is everything. YouTube's whole enforcement headache exists because both of those live in the same toolbox.
A quick one for the folks who ship mobile: X relaunched a rebuilt Android app. I'll frame this honestly, the rebuild effort itself has been underway for close to a year, going back to last fall, so this is the completion of a long project rather than a sudden move. Sarah Perez reported it. It was built from scratch on a clean Kotlin and Jetpack Compose stack, and X's head of product Nikita Bier called it one of the largest engineering projects in the company's history. Notable little moment: someone asked Grok how much of the rewrite the AI did, and Grok's own answer was, quote, straight answer: none of it, the full Android rewrite was a human engineering feat by the X team, end quote. Grok says AI helped devs code faster day to day but had no hand in the actual rewrite. Which, given how much everybody's crowing about AI writing all the code now, is a refreshingly honest deflation from the chatbot itself. The real builder lesson buried in here is dull and correct: rebuilding your foundation on a clean stack is the thing that lets you ship features fast later. Bier's line was it'll enable new features at lightning speed. That's the trade, you eat a year of unglamorous rebuild to buy yourself speed down the road. Same lesson as the MCP plumbing. The boring foundational work is what unlocks everything on top.
And one more I'll touch lightly because it's a resurfaced older story, not fresh news: the Paramount and Warner Bros. Discovery merger, that hundred-and-ten-billion-dollar deal, got a fourteen-day pause from a judge back in response to a lawsuit from a coalition of twelve state attorneys general led by California's Rob Bonta. The argument is straightforward antitrust, that combining these studios and networks harms theaters, cable distributors, and audiences. I flag it only because it rhymes with the open-weight fight: it's another case of the referee, this time state AGs instead of Commerce, deciding whether consolidation of power gets to go through. Different industry, identical question. Who gets to own the pipes, and who's allowed to squeeze whom.
So let me pull the thread all the way through before I let you go.
I told you at the top this whole episode was really one story wearing different outfits. Here it is plain. We are in the middle of pulling the human being out of loops that were built entirely around the human being. Payments assumed a person would authorize. Content platforms assumed a person made the video. Software assumed a person patched the server. Research assumed a person read the papers. The frontier-lab business model assumed a person had to come to them for intelligence.
And every single time you pull the human out of one of those loops, you get the exact same two consequences. First, the infrastructure has to be rebuilt, and that rebuild is slow, unglamorous, and it's where the real work lives, whether it's Natural redoing dispute resolution or a standards body finally fixing session IDs. Second, somebody who used to sit in that loop as a gatekeeper gets squeezed, and they head straight for the referee, the government, the courts, the platform policy, to try to legislate themselves back into the middle.
The builder's edge in all this is not to get swept up in whether the technology is magic or menace. It's to watch the plumbing and watch the referees. The plumbing tells you what's actually possible next quarter. The referees tell you what's going to be allowed. The Kimi ban is stalled at Commerce, watch that. The WordPress attacks are live right now, patch that. The agent payment rails are being poured, build on that carefully. And the rare disease grants close August 2nd, apply for that if it's yours.
That's the plate for today, and it was a good one. This is Tony DeLuca, telling you to update your WordPress before you do one other thing today, and I'll see you back here tomorrow on Barely Possible. Take care of each other.