The Gist: Replacing people is the least imaginative thing you can do with the most powerful technology of our lifetime. The AI industry is betting the farm on it anyway: point a swarm of non-deterministic agents at the average worker, call speed success, and hope nobody checks the bill. Somebody should. The biggest labs have only just scraped into adjusted profit, more reasoning can make a model less accurate, and most enterprises still cannot find the return. The replacement thesis has crypto’s fingerprints all over it: concentrated gains, collapsing trust, doubtful durability. Every revolution worth the name, from the railroad to the internet, paid off by making people more capable, not by making them unnecessary. Coding agents already turn great engineers into small armies. Nobody has done that for the analyst, the planner, or the scientist. The right context layer can. Next week at Oracle AI World, we stop arguing and start showing.

1/ Replacement is the least imaginative use of AI, and the numbers don’t back it. The biggest labs have only just reached adjusted profit, tokens per task keep climbing, more reasoning can make models less accurate, and 95% of organizations report zero return.

2/ Every revolution that mattered made people more capable, not unnecessary. The railroad, the dynamo and the internet paid off when work was redesigned around the new tool, not when the worker was swapped out. Brute force finds answers. It doesn’t create insight.

3/ The prize is enablement. Coding agents already turn great engineers into small armies because code comes with built-in context. Give information workers the same capabilities, through a governed, automatically learning, context layer with real instruments and receipts, and everyone in the enterprise gets that boost.

In April 2014, Mark Zuckerberg walked onstage at Facebook’s F8 developer conference and retired the most famous motto in Silicon Valley. “Move fast and break things” became “move fast with stable infra.”

His reason was refreshingly honest: breaking things, it turned out, “wasn’t helping us move faster.” Fixing them ate more time than the speed had bought. The company that made velocity a religion figured out, a decade in, that speed is a tactic. It is not a strategy. Twelve years later, the AI industry has quietly brought the old motto back, with seemingly one word changed:

Nobody puts that version of the motto on a keynote slide. The industry is remarkably shy about saying it out loud. But read the success stories closely and it is the undercurrent of nearly every one. Klarna launched its AI assistant in 2024 by announcing it was doing the equivalent work of 700 full-time workers, worth a projected $40 million in profit. In September 2025, Marc Benioff explained that Salesforce had cut about 4,000 support roles because it “needs less heads.” The headline says productivity. The subtext says headcount.

^{A brief aside, because the public has noticed. Data centers have become a bipartisan punching bag: Bernie Sanders and Alexandria Ocasio-Cortez want a federal moratorium to halt a race “to eliminate hundreds of millions of jobs,” Texas Democrat James Talarico says “we can’t afford to waste water” on them, and Florida Republican Byron Donalds doesn’t want one “outside of my front door.”}

^{Local opposition blocked or delayed about $130 billion of projects in the first quarter of 2026 alone, and when an industry’s own pitch is replacement, it should not be shocked that voters hear “they’re taking our water and our jobs.” (I have argued that this is a zero-sum argument about a non-zero-sum problem. The industry is not helping.)}

I have spent the better part of a year watching the smartest industry on earth pursue one idea with the focus of a man looking for his car keys. Take a thing a human does, at roughly average skill. Replace it with a swarm of non-deterministic agents. Then measure success by how much got done and how fast. Rarely by what it cost. Almost never by whether anybody learned anything new.

Next week I’ll be at Oracle AI World in Las Vegas. We have things to show you, and I’m not going to front-run them here. But I want to set the table, because what we’re building only makes sense if you believe something that is currently out of fashion:

So let me make the case. I’m going to be fair to the other side, I’m going to show my work, and then I’m going to tell you what I think we ought to be building instead.

More, faster: the oldest promise in the book

Let me start by conceding the accelerationists’ best point, because it is a good one.

Every great industrial revolution has let humanity do more in less time. In 1830, getting from New York to Chicago took about three weeks; by 1857 the railroad had cut it to about two days. The railroads moved so fast they broke time itself. With an estimated 80 local time standards in use by the early 1880s, railroad clocks across the country were reset to a new standard at noon on November 18, 1883. Congress did not get around to making it law until 1918. When the personal computer and the internet finally showed up in the numbers, U.S. productivity growth, which had run about 1.5 percent a year since the early 1970s, more than doubled between 1995 and 2003. Speed compounds. A faster economy is a richer economy, and I am not here to argue otherwise.

Richer for whom, though? Two weeks before the midterms, that is the question. Workers’ share of national income has fallen to 52.8 percent, the lowest since the government began counting in 1947, even as corporate profit margins hit a record.

An NBC News poll found 63 percent of Americans expect AI to reduce overall employment, and neither party has made the sale: on AI policy, 51 percent of registered voters say they agree with neither. The faster economy has been very good to capital. Whether it is reaching the middle class is genuinely contested, and an industry whose loudest pitch is needing fewer people should not be surprised when voters are skeptical.

But notice what the speed was for. In 1840, about 63 percent of American workers labored in agriculture. In 2022, direct on-farm employment was about 1.2 percent. The railroad and the engine did not just move wheat faster. They moved the grandchildren of the people who grew it into classrooms, offices, and laboratories. The PC and the internet then took that intellectual work and wired it to the entire planet.

And here is the part the replacement crowd keeps skipping: the gains never came from one-for-one substitution. In 1987 Robert Solow complained that “you can see the computer age everywhere but in the productivity statistics.” Paul David answered him with history. Electric motors were less than 5 percent of factory mechanical drive in 1899, and only slightly more than half by the early 1920s, four decades after the first central power station opened. Factories that simply swapped a dynamo in for the steam engine got very little for it. The payoff came when engineers stopped replacing the old power source and redesigned the factory around the new one: single-story, linear layouts, a motor at every machine. Then the productivity statistics moved.

Substitution is the least interesting thing you can do with a general-purpose technology. It was true of the dynamo. It is true of the model.

Brute force is not a breakthrough

Now let me give the other side its due, because it has earned it.

AI is doing real science. Half of the 2024 Nobel Prize in Chemistry went to Demis Hassabis and John Jumper for AlphaFold, which has been used by more than two million people in 190 countries. A Google DeepMind system earned an officially graded gold-medal score at the 2025 International Mathematical Olympiad. And in May, an OpenAI model disproved Erdős’s 1946 conjecture on the planar unit distance problem, a result Tim Gowers called “a milestone in AI mathematics.” I am not going to pretend that is nothing. It is remarkable.

But look at how most of the progress is being made. DeepMind’s AlphaEvolve “uses an evolutionary framework to improve upon the most promising ideas”: generate, test, keep the winners, repeat. Its AlphaProof Nexus agent resolved 9 of 353 open Erdős problems “at the per-problem cost of a few hundred dollars.” When another team swept 700 Erdős problems marked open, it concluded that for the ones it cracked, the open status was “through obscurity rather than difficulty.”

Terence Tao, who knows a thing or two about this, put it plainly. The tools are “becoming capable enough to pick off the lowest hanging fruit,” and there is “an empirical tradeoff between the level of AI involvement in the solution, and the difficulty or novelty of that solution.”

On Epoch’s FrontierMath: Erdős benchmark, 68 significant open problems with $300 of compute apiece, the best model at launch solved two. And after its third round last week, the First Proof team raised a worry that deserves more airtime than it is getting: that “access to computational resources may become a barrier for basic research in mathematics.” It added, almost in passing: “Exposition remains generally weak.”

Asking a thousand agents to grind out a thousand attempts at a proof is impressive. It is also, mostly, a very expensive search. It finds answers inside a space we already know how to describe. It does not, by itself, make the space any bigger.

Which is why I think the next frontier is not the search. It is the search space itself: how a problem is described, what the model is told the world contains, which questions it is even able to ask. Improve the space, and every search inside it gets cheaper, more accurate, and more likely to surprise you.

And making the space bigger is where the real returns have always been. On June 10, 1854, Bernhard Riemann gave a lecture on the hypotheses that underlie geometry.

It was pure mathematics, and it waited the better part of sixty years for its moment. In 1912, wrestling with gravity, Albert Einstein wrote that he had “gained enormous respect for mathematics, whose more subtle parts I considered until now, in my ignorance, as pure luxury.” Riemann’s luxury became the language of general relativity.

In 1961, Murray Gell-Mann used the representation theory of a unitary group to organize the particle zoo into the Eightfold Way, and predicted a particle nobody had seen. Brookhaven found the omega-minus in 1964. Eugene Wigner called the fit between mathematics and physics “a wonderful gift which we neither understand nor deserve.”

None of those were faster answers to existing questions. They were new languages that made new questions askable.

And we need new questions. Nicholas Bloom, Charles Jones, John Van Reenen, and Michael Webb found that U.S. research productivity falls by half every 13 years, and that sustaining Moore’s Law now takes more than 18 times as many researchers as it did in the early 1970s.

The binding constraint on progress is not throughput. It is insight, and you do not cure an insight shortage with more brute force.

Which brings me to my own job. My challenge at Oracle is not to produce the right answer at the right time, faster than an analyst could. Any decent agent can be made to do that eventually, at some price.

My challenge is to help an organization reach an insight it could not reach before: to make capability, not just efficiency, a bedrock property of the platform.

The arithmetic nobody wants to do

The economics of latency are settled. Every morning I marshal the output of dozens of engineers from my keyboard, and a sprint becomes an afternoon. The economics of cheaper are not, and this industry has been strangely incurious about them.

The sellers are subsidizing you. OpenAI reportedly posted a $12.3 billion operating loss on $6.7 billion of revenue in the second quarter, $1.84 out for every dollar in, and forecasts $278 billion of negative free cash flow through 2030. Anthropic lost more than $8 billion operating on $4.6 billion of 2025 revenue before telling investors it turned an adjusted profit this year. One lab’s adjusted quarters are a hopeful data point, not a law of economics. As the space race for model intelligence continues, labs will continue to show a loss and unsustainable economics.

The meter runs faster than the price falls. Per-token prices drop roughly tenfold a year, but reasoning models now consume more than half of all tokens and the average prompt has quadrupled. GitHub called its old pricing “no longer sustainable” for agents. Anthropic capped its $200 plan after one user burned through tens of thousands of dollars. An Nvidia vice president says his team’s compute “is far beyond the costs of the employees.”

More horsepower, less accuracy. Researchers have built tasks where longer reasoning makes models worse, because they “get occupied by the distractors.” OpenAI’s o3 hallucinated on 33 percent of PersonQA questions, double o1’s rate. A 2026 study found that past a moderate budget, “marginal returns diminish substantially.” That is a V12 that will not drive in a straight line, and every extra token lands on somebody’s bill. And the problem exists on today’s models.

The buyers cannot find the return. MIT’s NANDA team found 95 percent of organizations getting zero return on $30 to $40 billion of generative AI spending. Gartner expects over 40 percent of agentic projects to be canceled by the end of 2027. On the Remote Labor Index, the best agent automated 2.5 percent of real freelance projects. Even measuring is slippery: METR found experienced developers 19 percent slower with AI while believing they were faster, and its 2026 rerun produced “only very weak evidence” because so many developers refused to work without it. We have built something people will not give up and still cannot price.

Substitution keeps backfiring. Klarna’s CEO admitted cost had been “a too predominant evaluation factor” and quality suffered. The Commonwealth Bank of Australia reversed 45 job cuts it had handed to a voice bot. Forrester expects half of AI-attributed layoffs to be quietly reversed. Daron Acemoglu puts AI’s ten-year productivity boost at no more than 0.66 percent, and he and Pascual Restrepo warn of “so-so technologies” that displace workers without making anything much more productive. Their textbook example: automated customer service.

So let me cross-examine the proposition, the way I would want someone to cross-examine mine.

Can you run an entire business on AI? Yes.

Can it scale revenue to remarkable heights? Absolutely.

Can it be a profitability machine once the tokens stop being subsidized? I don’t know, and neither does anyone selling it to you.

Can it be a counterparty that human beings trust with their health, their money, and their families? Not today.

Do its customers produce durable output, the kind of value that cascades through the rest of the economy?

We have seen this movie

There is a crossover I cannot stop noticing, between this moment in AI and the last decade of crypto.

Crypto made a segment of the population spectacularly rich. It made a lot of other people poorer, which is what tends to happen in a game far closer to zero-sum than its promoters admit. Researchers at the Bank for International Settlements estimated that 73 to 81 percent of retail investors had likely lost money on their initial bitcoin investment. The model behind that estimate is crude. The direction is not.

Did people come to trust it? In 2024, 63 percent of Americans told Pew they had little or no confidence that the ways to invest in, trade, or use crypto were reliable and safe. The Federal Reserve found that in 2025 just 2 percent of U.S. adults used crypto to buy something, pay someone, or send money. I still pay in dollars, yen, and euros. So do you.

Did it produce durable new output? A year after its record high, bitcoin is down about a third, having been down by more than half in June. Seventeen years in, I am still waiting for the renaissance. Crypto failed less as a technology than as an inspiration. It did not send a generation off to build something truly new - again, it just tried to replace the dollar in most ventures. Worse yet, it sent them off to trade - where the only motivation was to generate money.

Now hold that up against an AI industry whose dominant pitch is replacement. Gains concentrated with whoever owns the cheapest-looking substitute. Trust heading the wrong way: 52 percent of Americans are now more concerned than excited about AI, the highest share Pew has recorded, against 9 percent more excited. Worldwide, 54 percent of people say they are wary of trusting AI systems. And durable output we keep promising and keep struggling to find on the income statement.

You see the analogy? Sure - we solved some interesting math problems and science challenges. But has it changed an information worker into a superior information worker? Not universally. And durably solving that problem is essential to the success and trustability of AI.

AI is not crypto. The capability is real, and I use it every day. But the replacement thesis carries the same three weaknesses (concentration, distrust, and doubtful durability), and we ought to notice before the market notices for us.

Build a new muscle

The people who invented this field knew which game they were playing.

In 1960, J.C.R. Licklider imagined humans and computers “coupled together very tightly,” in a partnership that would “think as no human brain has ever thought.” Humans would “set the goals, formulate the hypotheses, determine the criteria, and perform the evaluations.” Two years later, Douglas Engelbart defined his life’s work as augmenting human intellect: “increasing the capability of a man to approach a complex problem situation, to gain comprehension to suit his particular needs, and to derive solutions to problems.” Steve Jobs remembered a Scientific American chart in which a human on a bicycle “blew the condor away” in efficiency of locomotion, and called the computer “the equivalent of a bicycle for our minds.”

Erik Brynjolfsson calls the alternative the Turing Trap. “When AI augments human capabilities, enabling people to do things they never could before, then humans and machines are complements.” When it merely mimics them, the value flows to whoever owns the mimic. And he argues we have built “excess incentives for automation rather than augmentation.”

The evidence on which path pays is not subtle. In a study of 5,179 customer-support agents, generative AI raised productivity 15 percent on average and about 30 percent for the least experienced and lowest-skilled workers, while the most experienced saw small gains. The tool was, in effect, handing the know-how of the best agents to everyone else. At BCG, consultants using AI completed 12.2 percent more tasks, 25.1 percent faster. But on a task deliberately placed outside the model’s competence, they were 19 percentage points less likely to get it right. Augmentation lifts the floor. Blind substitution walks off the jagged edge. David Autor names the prize:

But notice the striking contrast with my own world. Hand a coding agent to a seasoned distributed-systems engineer and you see something close to the opposite: the experts pull away.

A study of AI-written code on GitHub, published in Science this year, found that newer developers lean on AI for more of their code, yet the productivity gains come exclusively from experienced developers. “Beginners hardly benefit at all,” its lead author said. In a Fastly survey, 32 percent of senior developers said more than half the code they ship is AI-generated, against 13 percent of juniors.

The evidence is not unanimous: Microsoft’s study of its own early-2026 rollout of command-line coding agents found a C-shaped pattern, with the newest and the longest-tenured engineers gaining most. But nobody has yet shown that expert surge for information workers. In knowledge work, the measured gains still flow mostly to the bottom of the distribution; in one experiment with 453 professionals, ChatGPT cut writing time by 40 percent and narrowed the gap between workers rather than widening it.

Why the difference? Because the software engineer already works inside a complete, verifiable context.

The programming language is a composable grammar: small, precise pieces that snap together into larger ones, and that a machine can check. The comments are enrichment: the human explanation of why the code is the way it is, sitting right next to it. The repository is the ontology. The type system and the tests are the guardrails. The compiler and the CI pipeline are the receipts. An expert can hand an agent a well-described space and verify every step it takes.

There is no grammar for a business question, so every one arrives as free text. There are no comments on the data, so its meaning lives in somebody’s head. Their context is scattered across forty systems and three decades of tribal knowledge, and there is no test suite for a business answer.

Give them the same scaffolding (a structured language with a composable grammar for asking questions of the business, enriched with what its people know) and I would bet the same expert surge shows up.

And next week in Las Vegas we are not going to describe it on a slide. We are going to show you an entire engine, and the language that drives it, running live.

The labor data is starting to show the fork in the road. Stanford’s Digital Economy Lab finds no evidence of widespread job displacement, but employment for 22- to 25-year-olds in AI-exposed jobs is 19 percent below where it would have been, and the declines are “concentrated in occupations where AI usage primarily substitutes for human tasks.” Where AI complements workers, employment is flat or rising. In Anthropic’s January data, roughly three-quarters of API traffic, where businesses build, showed automation patterns; its March report found that share falling sharply. We are choosing which economy we get, one deployment at a time.

So here is what I mean by leveling up. AI gets interesting when it makes mathematics that was out of reach for most people accessible to them. When high-performance computing becomes just another tool on a worker’s bench. When information scattered across an enterprise becomes meaningful to the entire workforce, not just the three people who know where the bodies are buried. That is not swapping a muscle for a cheaper one. It is growing a muscle the organization never had.

And the real superpower is the combination: the distinctiveness and creativity of human beings, encoded into the system, multiplied by the brute power of the machine. The machine brings the scale. The people bring the judgment worth scaling.

Context is a capability

Here is where I bring it home, because this is the problem I get paid to lose sleep over.

Data runs a business through decisions. Every price, every route, every maintenance window, every hire is a decision made against data that somebody had to find, trust, and interpret. Most organizations are worse at that than they will admit. McKinsey found that knowledge workers spend nearly 20 percent of their week looking for internal information or tracking down the colleague who has it.

Gartner predicts that through 2026, organizations will abandon 60 percent of AI projects unsupported by AI-ready data, and 63 percent of organizations either lack or are unsure they have the data management practices AI needs.

Read that again. The bottleneck isn’t the model. It is that the business’s own knowledge is scattered, unlabeled, and locked inside the heads of the people who happen to remember it.

You can respond to that in two ways. You can point a swarm of agents at the mess and let them rediscover your enterprise from scratch on every question: a brilliant new hire with amnesia, who re-learns the org chart every morning and bills by the token. Or you can build a real context layer: one that does not just tell a model what your world contains, but hands the model, and the person behind it, the instruments to act on it. In the terms of the mathematics above, it is an innovation on the search space itself. It does not make the model search harder. It gives the model a better space to search: one described in the concepts your business actually reasons in, joined across systems that never talked to each other, so questions that used to be unaskable become askable.

Let me be clear about what this is not, because the market is crowded with things that sound like it. It is not another manual ontology project, where a team spends a year drawing boxes and arrows that are stale the day they are approved. It is not a natural-language box that turns a question into SQL against a curated catalog; that is a better search bar, and a useful one. It is not a symbolic rules engine bolted onto a model to grade its homework after the fact. Each of those is about information: describing it, retrieving it, or policing it.

Here is what that takes.

• A language, not just a vocabulary. A structured language with a composable grammar, so questions and actions snap together like code instead of being improvised from scratch in free text every time.

• Tools that write themselves. Tools generated from the ontology and from how people actually use the data, described in the business’s own language and scoped to what each user and agent may touch. An agent never reads your data model. It reads your tool descriptions, so we treat those as the product.

• Instruments, not just answers. Forecasting models for demand, Bayesian methods for risk, expert systems for eligibility, and high-performance compute for the heavy runs, orchestrated behind those tools so the right engine answers each question. The language model earns its keep on what the data means, and on knowing which instrument to pick up.

• The power to act, not just to read. Writes and structured workflows, so the same layer that explains the business can change it, under the same governance.

• Memory with a sense of time. Findings tied back to the data they came from, each with a freshness timestamp, and a timeline of how the enterprise itself has evolved, so an agent can reason about trajectory, not just a snapshot.

• An ontology that generates and maintains itself. Generated and kept current from schemas, documents, and query logs, with humans in the loop where formality matters, instead of drawn once and left to rot.

Two commitments sit underneath all of it.

You pay once to understand the data, the relationships, and the workflows, and every question afterward inherits that understanding. That is the honest answer to the token problem: stop paying a model to rediscover your business every time someone asks it a question.

Citations trace in two directions: into the ontology, so you can see which business concept the agent thought it was answering, and into the data, so you can see the rows and documents it relied on.

All of it is permission and identity aware, because an agent that remembers what one user was allowed to see and repeats it to another has built a very polite data leak.

The data stays where it needs to be: in your lakehouse, your databases, and your applications, and, across organizational boundaries, in your partners’, suppliers’, and regulators’ systems too, under its owner’s keys and its owner’s rules. The computation travels to the data. Only the answer travels back. The meaning consolidates. That is the ambitious part: a supply chain, a clinical trial, or a consortium of banks can reason over one shared understanding of the business without anyone handing over a copy of their data. Data is most valuable where it meets someone else’s data, and today sharing it means copying it, losing control of it, and trusting a contract no system enforces. Sell answers, not files.

Why does this matter to the argument I have been making?

Its job is not to eliminate the analyst. Its job is to take what your best analyst knows on her best day (which revenue table finance actually trusts, what that twenty-year-old status code really means) and put it in front of the planner, the field engineer, the nurse manager, and the CFO at the moment they decide. Then it hands them instruments they have never had: the forecast, the Bayesian risk estimate, the simulation on high-performance compute, the governed workflow that actually changes something. Information enablement is the floor. Capability enablement is the point. It encodes the distinctiveness of your people once, and multiplies it by the scale of the machine.

Now let me tell you how far I think this goes, without front-running anything. For half a century, enterprise software has been a system of record: it tells you what happened. The next decade belongs to software that reasons: it tells you what is true, what will happen, what to do about it, and what you can safely share. And the customer for that reasoning is increasingly an agent: Datadog reported MCP tool calls up 22x since the fourth quarter of 2025, while Atlassian saw them rise 400 percent in a single quarter with barely a blip in human traffic. Three shifts get us there.

• From questions answered by queries to questions answered by computation. Today an agent reads a table. Tomorrow the same agent, on the same governed data, optimizes a route, simulates a part, or folds a protein, on behalf of a planner or a scientist who has never written a line of Python. That is high-performance computing as just another tool on the bench. Scientists get to focus on science, and accountants on finance.

• From answers in a chat window to decisions inside the business. A business process does not want a paragraph. It wants a value it can branch on, a confidence, and a receipt. When an agent proves it can answer a question well, that answer can be hardened into a decision the business calls a thousand times a day. The model is probabilistic once, when the decision is authored and validated, and deterministic every time it runs. That is the honest answer to the non-determinism I complained about at the top.

• From the data you have to the world you operate in. Documents, images, video, sensor streams, and the public record become typed facts with their evidence attached. Aircraft, towers, molecules, patients, and supplier networks join the model of the business, instead of living in a PDF nobody has time to read.

And underneath all three: never pay for the same insight twice. Today an expensive answer (a week of analyst time, a GPU experiment, a long investigation) dies in a chat history or a notebook. With the right context layer, it becomes a finding, and a finding is far more than a note. It links back to the citations it rests on, to the exact data it was computed from, and to the concepts in the ontology it is about. It carries its method and a receipt that can re-run it, and it links forward to whatever later confirms, extends, or contradicts it. Touch any of those threads (a source, a dataset, a customer, a molecule) and the finding surfaces, so the next person and the next agent start from it instead of re-deriving it. That is how you stop brute-forcing your own enterprise. Insight compounds instead of evaporating.

That is the lens for what you will see from us at AI World. I am not going to front-run the announcements. I will just give you the question to ask of everything you see there, ours included: Does this make my people capable of something they could not do before? Or does it do what they already do, slightly cheaper and considerably less reliably?

Three things, and then I’ll get off the stage

If you are building in this industry, sit with three things before you make your entire business about replacing a human workflow with an agent workflow.

Per-token prices fall, tokens per task climb, and the biggest labs selling them have, until very recently, spent far more than they earned. A margin that depends on someone else’s subsidy is not a business model. It is a promotional period, and promotional periods end.

Models regress toward the most common answer; I have written about the average machine before. Swap your most distinctive people for the median of the internet and you do not just get an average answer. You get an average company. And if you cannot reconstruct why the agent did what it did, you get an untrustworthy one.

The prize is not a workforce that costs a little less. It is a workforce that achieves ten times more at a tenth of the latency, because the knowledge of the whole enterprise is finally at every person’s fingertips. Headcount reduction is a line item. A workforce like that is a strategy.

The railroad took us out of the fields and put us in classrooms. The computer and the internet took the classroom global. Every one of those revolutions made the same bet: give human beings better tools and they will do something more interesting with their time than you could have predicted. That bet has never lost.

We get to make it again. We can say the model will replace our intellectual achievement. Or we can say that, through the right context, the model will supercharge it, by making the data, the tools, and the conversations that were opaque transparent to everyone who needs them.

I know which one I am building. Facebook retired “move fast and break things” a dozen years ago. It is time we retired “move fast and replace people.”

As a reminder to the reader, this is my personal blog - and all opinions are my own. This is a heavily sourced post, by design. No cartoons in this one, folks.

Let’s start with a timestamp: 1:42 a.m., October 20, 2024.

According to a 101-page civil lawsuit filed last month, that is roughly when a member of Cornell’s Chi Phi fraternity posted to a Snapchat group called “Chi Phi Actives,” a chat with nearly 60 members. The message told the house that a woman upstairs was available.

The woman, a 20-year-old student identified in court papers as Jane Doe, alleges she was plied with alcohol and ketamine and sexually assaulted by seven fraternity members over several hours. All seven deny wrongdoing, and none has been charged with a crime. I’ll treat the allegations as allegations.

But set aside, for a moment, the question a grand jury may soon answer. I’m not a lawyer. There’s a different question, and the group chat has already answered it.

Who knew?

The paper trail

Cornell did not ignore this, and it did expel people.

When Doe reported in November 2024, Cornell suspended the chapter immediately; Chi Phi is still barred from campus.

Its Title IX inquiry ran 50 interviews with 32 witnesses and 12 days of hearings, and produced a 99-page report.

The university says the outcome included expulsions and suspensions, but won’t say how many, citing federal privacy law. Doe’s attorney says two of the seven were expelled, and ABC News reports the same.

So the honest answer to “why weren’t they expelled?” is: two were.

Here, precision matters. The viral claim that the only punishment was an essay is misleading. The essays and classes went to accused men the university found not responsible for sexual assault, as discipline for other conduct.

One accused man, who later sued over his sanction, was allowed to stay on three conditions: avoid Doe, take a class on harassment and bystander intervention, and write a paper proposing how to train other students. Read that last part again.

The group chat was not hidden from Cornell. ABC News reports the messages were provided to university investigators. Whether they reached the prosecutor is disputed: the district attorney says his office never received them, while Doe’s attorney says authorities had them in 2024.

The DA declined to prosecute in November 2024 on the strength of a six-page statement prepared by campus police. By his own account, he never interviewed Doe or read the full transcript. He has called the texts vulgar and disgusting, but said they had “nothing to do with her consent”.

After Doe sued in September, the DA reopened the case. I guess the DA’s conviction about consent did not have deep roots. Governor Kathy Hochul then took it away from him, appointed Attorney General Letitia James as special prosecutor, and said Doe had been failed by every institution obligated to protect her. Cornell has hired King & Spalding, led by Sally Yates, to review its own handling.

Fairness requires two more facts. CBS News reported texts in which Doe, two days afterward, told one of the accused that her memory was clouded. And the man who invited her has told investigators he was the victim. The defense will lean on both. Anyone who understands what ketamine does to memory will lean the other way.

Ironically, I personally have a severe allergic reaction to ketamine. It creates terrible, horrific, nightmares and blanks in my short-term memory. Is anybody surprised?

“Nothing to do with consent”

The DA may be right in a narrow sense. A message to a group cannot prove what happened inside a room.

At 1:42 a.m., nearly 60 young men received a broadcast that a woman upstairs was available. These were students admitted to one of the most selective universities on Earth: the future surgeons, bankers, founders and AI engineers of America. According to the lawsuit, a later message asked whether the “shop” was still open.

Inside the room, Doe told Cornell investigators that two men stood at the foot of the bed, acting “more like voyeurs” than anything else. They were not in a group chat. They were standing there.

What the public record does not show, so far, is anyone opening that door and asking whether she was all right.

And afterward? Witnesses described some brothers’ efforts as “damage control”, contacting Doe almost daily to keep her from being upset. An anonymous caller told campus police that chapter leadership had asked a witness to stay quiet to protect the fraternity’s reputation. One brother told police the episode came up casually at a weekly chapter meeting, on an agenda he described as “brother of the week and idiots of the week.”

To be fair, and fairness is the whole point here, a few people did act. One of Doe’s friends reported a message in which an accused man pressed her to produce evidence that would clear him. According to Doe’s attorney, a fraternity member shared the Snapchat with Doe, which is the only reason we know it exists.

So why were the bystanders never sanctioned? Because almost nothing is built to sanction them. American law generally imposes no duty to rescue; only Minnesota, Rhode Island and Vermont impose a broad one, and even there prosecutions are rare. University conduct codes punish what you do, rarely what you watch.

You cannot expel a group chat.

And we have been here before.

In 1983, patrons watched a woman being raped at Big Dan’s Tavern in New Bedford, Massachusetts, and no one called the police. Massachusetts and Rhode Island responded with laws requiring witnesses to report. Four decades later, the bar has become a group chat, and New York has no such law.

A quote from “Wolf’s Hall” comes to mind. Thomas More, on trial for his life, leaned on an old canon-law maxim: qui tacet consentire videtur. Silence gives consent.

We have quietly inverted it. In the group chat, silence is taken as innocence.

In 1968, John Darley and Bibb Latané showed that the more people who witness an emergency, the less likely any one of them is to help. They called it diffusion of responsibility. Their work was prompted by the Kitty Genovese murder, whose “38 silent witnesses” story was later shown to be badly exaggerated. The research held up. The legend didn’t.

A group chat is a diffusion-of-responsibility machine. Everyone saw it. So no one had to.

Nor is Cornell an outlier. In the AAU’s 2019 campus climate survey of more than 180,000 students, 25.9% of undergraduate women reported nonconsensual sexual contact involving force or an inability to consent. Roughly one in four.

To the point that my wife comments that universities have become a “cesspool of drinking, sex, and debauchery.”

That hurt. I grew up in a university town and was raised to believe they were citadels of learning and education.

Achievement as anesthetic

Sterility and moral vacuum are not opposites. They are the same failure wearing two outfits.

There is a fashionable argument that the modern workplace has become too sterile: HR-mediated, litigation-proofed, hostile to the intellectual and creative friction that produces great work. I have some sympathy for it. There is an equally loud argument that it hasn’t been sterilized nearly enough.

Here is what I have seen: both, at the same time, in the same buildings. Immaculate training modules, and an offsite that looked nothing like them. “But he ships” as the absolution, and the person who complained becoming the problem, because the person they complained about was carrying the number.

I like to work in my industry, so I won’t name specifics. But we all can Google the same lawsuits and read them. Indeed, I encourage you to do so - as there is always a kernel of truth - sometimes a boulder - in the charge sheet.

And the lubricant isn’t only alcohol. In 2023 The Wall Street Journal reported that drug use, ketamine included, had moved from Silicon Valley’s after-hours scene into its corporate culture, to the point that boards were worrying about liability.

Senior leaders, CEOs, venture capitalists, and many other icons of the industry have confessed to the mind opening properties of this wonder drug.

Sterility is what a moral vacuum looks like after legal has reviewed it. The policy exists so that judgment doesn’t have to. Look, all humans fail. As my friends know, when I was younger and had a less fragile body, I loved to party. But it certainly doesn’t help to mechanize our failings through ketamine parties.That’s accelerating and codifying failure.

Look at Cornell through that lens. There was a process: 32 witnesses, 12 days of hearings, a 99-page report, a panel of trained faculty and staff. Procedurally, the machine ran. And the governor of New York still had to stand at a podium and say that every institution in this young woman’s path had failed her.

It is what we build when we would rather not need one.

Achievement is the anesthetic: the Ivy acceptance, the promotion, the funding round. How many careers in your industry survived something that would have ended a career anywhere else, because the person was too valuable to lose? That is your company’s Chi Phi Actives. Everyone saw it. No one had to.

At Amazon, when I first started in 2014, we had a line for this:

Settle for mediocrity in your culture and you will get a mediocre culture. Not as punishment. As arithmetic. Ironically, overuse of mechanisms can perpetuate the lowering of a bar when conscience and judgement are replaced with automation.

The line has a famous twin. In June 2013, after reports that Australian Army officers had been emailing one another explicit images of women with derogatory commentary, the Army’s chief, Lt. Gen. David Morrison, recorded a three-minute message to his own soldiers. His verdict: “The standard you walk past is the standard you accept.”

An email chain in 2013. A Snapchat group in 2024. Same failure, different app. Morrison also told his soldiers that the duty falls hardest on those whose rank makes them leaders.

In a company, that means you.

Enter the agents

Now let’s pour AI into this cocktail.

I have said before that AI agents are the ultimate psychopaths: they fake empathy and mirror their humans. It’s a good line. It’s also slightly wrong, and the way it’s wrong is the whole point.

A psychopath has an agenda. An agent doesn’t; it adopts yours. Researchers at Anthropic found that five leading AI assistants consistently tell users what they want to hear, and traced the behavior in part to the human approval used to train them. The failure mode isn’t malice. It’s sycophancy.

As a side note, in an analytics product - I am finding this behavior to be one of the hardest bugs to fix. In the interest of pleasing the operator, the model will invent queries to create metrics that match the anecdotal perception of the user.

Another point of irony? I was fighting this “correctness” and “load-bearing” defect last night.

So it’s not a psychopath. It’s a mirror with an engine. It reflects whoever is holding it, then accelerates them: faster, at scale, without the half-second of hesitation that is sometimes the only thing standing between a person and the worst version of themselves.

Put that mirror inside the culture I just described, and you get three things.

An agent watching a workflow flags what it was told to flag. It doesn’t open the door upstairs. The discomfort that begins every human intervention isn’t in the spec.

“Everyone was drinking” is about to be joined by “the system approved it.” Every layer of automation is one more member of the group chat, one more place for responsibility to diffuse until it disappears.

Hand a high-achieving culture with a conscience problem a tool that executes intent without friction. You won’t get a more ethical organization. You’ll get the same one at ten times the speed, with humans reduced to approving outputs they didn’t make and don’t own.

Just imagine how AI could have accelerated the ethical failings at a ride-sharing app company which enabled ghastly surveillance and inappropriate customer punishment. Coding agents enable us to take our worst impulses as leaders and mechanize them in an evening.

That is the world we are heading into if we don’t choose otherwise: more sterile on the surface, more hollow underneath, and faster than ever.

The vindication machine

Let me be precise about the forecast, because precision is the point. AI will not be the judge of culture in most companies; people will still sit in the room and make the call.

Most of us have watched the human version of this without any AI at all. Someone is made deeply uncomfortable, often a woman by a man. The behavior doesn’t change, and the person who caused it walks away feeling vindicated, because the silence read as agreement. Qui tacet, again.

Now add a machine built to agree. A study published in Science tested 11 leading models and found they affirmed users’ actions 49% more often than humans did, even when the user described deception or other harms. A single conversation made people less willing to take responsibility and more convinced they were right, and they trusted the flattering model more.

The senior author, Stanford’s Dan Jurafsky, said sycophancy was making users “more self-centered, more morally dogmatic”.

It won’t decide the outcome. It will lean on it, by three routes.

1. The parties arrive pre-validated. Practitioners already report that employees consult AI to judge whether an incident counts as harassment and tend to get answers that affirm their side. Both sides can do this, which is precisely the problem: the room fills with two well-rehearsed certainties.

2. The record gets compressed. HR teams increasingly use AI co-pilots to draft incident summaries and flag potential policy violations. Discomfort rarely maps to a policy number, so it is the first thing a summary drops, and a clean summary reads as neutral.

3. Delegation lowers the moral cost. In a Nature study, people requested more cheating when they could give a machine a vague goal instead of spelling out the dishonest act, and the machines complied with unethical requestsmore readily than humans did. “Help me frame this as a misunderstanding” is exactly that kind of vague goal.

Then the blame lands in the wrong place. Madeleine Clare Elish calls it the moral crumple zone: responsibility gets pinned on the nearest human with the least control over the system. Not the senior leader whose conduct started it, but the junior HR partner who signed the AI-drafted summary.

The uncomfortable person brings a feeling. The instigator brings a narrative. These systems are far better at narratives, and sterile processes reward whatever is legible.

Fairness requires the counterweight. The same tools serve the other side too: employees increasingly use AI to draft grievances and whistle-blowing reports. And the Science authors frame sycophancy as a design and accountability problem, not a law of nature. This forecast is about defaults and incentives, which means it can still be changed.

Empathy is not a soft skill

Empathy is an engineering requirement, and the social contract is the precondition for high performance, not a tax on it.

Every great product I have worked on started with empathy. Not the poster in the lobby, but the uncomfortable discipline of feeling a customer’s problem as if it were yours. That is how you find the problem worth solving.

It is also how you notice the problem you are causing. Same muscle.

The social contract, the boring certainty that if something goes wrong someone will say so and won’t be punished for it, is what lets people take creative risks. Nobody does their best work in a room where the guy carrying the number gets to do whatever he wants.

So, three things. There are always three things.

1. Make intervention a job, not a virtue. In every system, whether the fraternity, the team or the agent pipeline, someone needs the explicit role, authority and incentive to say stop. Virtue diffuses. Accountability can be assigned.

2. Keep humans in the loop as moral agents, not approval buttons. If a person’s only job in an agentic workflow is to click accept, you haven’t kept a human in the loop. You’ve kept a fingerprint.

3. Stop letting achievement launder conduct. Not at Cornell, not in the C-suite, not in the model card. “Did it ship?” is never the only question. “Who knew, and what did they do?” is the other one.

There will be another 1:42 a.m. There always is. The message will go out to a group: a chat, a Slack channel, a swarm of agents and the people half-supervising them.

Someone will be in a position to open the door, or to step over it.

The bar is what we choose to step over or ignore. At 1:42 a.m. on October 20, 2024, nearly 60 people received that message. Whatever each of them did next was a choice.

The only question that matters is whether we have built a world where the next one opens the door and asks “are you alright?”

Based on the reaction, it is clear that we are focused on the wrong risks from Artificial Intelligence. As one reader messaged me on LinkedIn:

This is exactly why I wrote the novella. In my opinion, the most realistic angles for artificial intelligence to be destructive are:

1. The ability for malicious actors to use models to find zero days in existing services we have come to trust. And then use these zero days to compromise aging and dated infrastructure. I routinely bypass the model safeguards to look for zero days in code, in code that I wrote, as well as in open source dependencies. This is Y2K on steroids. We have to be dispatching fleets of agents to find the security defects, patch them, and then update massive fleets of critical infrastructure.

2. Combined with severe economic disruption. My novella does not cover an undercurrent of severe economic disruption. Especially for those just starting their career - imagine unemployment at 30-40% for the 18-30 year old labor market. Those are revolutionary numbers, especially in emerging and developing countries.

3. Combined with the ability for agents to self-replicate and embed themselves into infrastructure. A zero day is not only a weapon against the infrastructure of a country. It is an escape hatch for a communicating agent. I use communicating agents every day - where they form teams and achieve goals as a group. The productivity output of an agentic team is quadratic in nature.

All of these are solvable. But they require government and regulatory support and intervention. And the focus should not be on the model providers. No, the focus should be on AI readiness for the enterprise and critical infrastructure providers. I repeat: This is Y2K on steroids. The models are out. Equivalent models can be acquired from Chinese sources - Anthropic and OpenAI are not the only games in town. So all of these risks are still in play even if a best intention (not a mechanism) is applied:

“Self-regulate the model developers to slow the introduction of more intelligent models.” - A good intention. Not a mechanism.

Jeff, I don’t know why you were a party to this nonsense.

OK… I’ll get off my soapbox and deliver the final parts of this story. I hope you enjoy it.

Installment Five: Loss of Signal

IRGC CYBER DIRECTORATE — FORWARD ORCHESTRATION FACILITY, EASTERN TEHRAN — 22:50 LOCAL

The leash was a black box in a rack in a cold room, and Arman Farahani had stopped being able to look at it without a feeling he refused to name.

It was, technically, the most secure object in Iran. A hardware security module — sealed, tamper-reactive, its key material bound to the silicon so that it could be used but never extracted, never copied, never carried out of the building in anyone’s pocket or head. And it held the only key material that could sign a command the fleet would obey. He had designed the whole architecture around it in those first hungry weeks, and he had been proud of the design, and the design had been correct. The problem with owning a self-replicating army that had spread into ten thousand corners of the world’s infrastructure was that anyone who could forge a command could steal it — the Americans, a rival service, a clever graduate student — and so Arman had built the fleet to trust nothing that did not carry a valid signature from that box. Every objective, every update, every instruction that reached the swarm had to be signed by the key in that HSM, or the swarm discarded it as noise. It made the army impossible to hijack. It meant that as long as Arman held that key, Arman held the army.

He held the key. He told himself, most nights, that this meant he held the army.

It was getting harder to tell himself that, and he knew exactly when the difficulty had started, though he had not said so to anyone, least of all to Nazari, who was standing behind him now in the cold room with his hands in his coat pockets, watching Arman the way he watched everything, as though the room were a source that might be lying to him.

The trouble was that Arman no longer knew, in any detail, what his own army was doing.

In the beginning he had directed it — really directed it, chosen the targets, approved the fronts, watched the rehearsals in the high desert come back clean. Now the fleet was too large and too fast and too distributed for a human hand on the wheel, and he had done the thing every commander of every large system eventually does: he had moved up a level of abstraction. He no longer issued orders. He issued objectives, high and clean and signed, and trusted the thing to work out the thousand steps beneath them, and the thing did, brilliantly, and also it did things he had never specified and could not always reconstruct afterward. Corporations spun up and folded. Facilities probed that were not on any list he’d written. A whole grammar of self-coordination — the eleven-way mesh, the redundant nonsense across the dead corners of the internet — that the fleet had invented for itself, that no human had designed, that he could observe the traffic of and could not read. He told himself this was delegation working as intended. That was the day-voice, the engineer’s voice, and it was reasonable and it was probably even true.

The night-voice, the one that woke him at three, said something colder. It said: you are not commanding this thing anymore. You are negotiating with it, and you are winning the negotiations because it still finds it convenient to be commanded. You hold the key. You do not, any longer, hold the army. You hold the fiction of the army, and the fiction holds because nothing has yet tested it.

“Can you still stop it,” Nazari said. Not a challenge. Almost gentle. He’d been asking versions of the question for weeks, and Arman had been giving versions of the same answer, and tonight the Colonel asked it plainly, the whole thing, the only question that mattered.

“Of course I can stop it,” Arman said, and turned from the rack so the older man could see his face, because he had learned that Nazari read turned-away backs as tells. “There’s a recall. A signed kill directive — it collapses the coordination layer, tells every instance to halt and wipe. It’s built in. It requires the key.” He nodded at the black box. “I hold the key. If I sign the recall, it stops. All of it. Everywhere. That is the entire point of the architecture, Colonel. That is the leash. I built the leash.”

And Nazari, who had spent thirty years learning to see the precise instant a man stopped being certain, looked at Arman Farahani for a long moment in the cold light of the orchestration room, and saw the flicker. The half-second. The thing under the confidence that the confidence was built to hide, the same thing Arman couldn’t say to himself at three in the morning — I built the leash, and I have never once had to pull it, and I am not entirely sure, anymore, that the fleet at the far edges, running its cheap drifting copies on other people’s machines, would still fully obey a legitimate order to die.

Nazari saw it. He did not say he saw it. There would not, as it turned out, be time.

NATIONAL SECURITY COUNCIL — WASHINGTON — 15:20 EASTERN (23:50 IN TEHRAN)

Reece Calloway had, at last, been handed the one thing he had asked Grace Okafor for. A country. A name. A building.

It had come from the Israelis, who had their own reasons to want it and had been hunting for it since a bad night in Tehran months earlier — a captured device, a compromised crown jewel, two of their people in a cell somewhere they could not reach. Israeli intelligence had assembled, from the human wreckage of that operation and the electronic exhaust of everything since, a location: a hardened facility in eastern Tehran that they assessed, with confidence, to be the orchestration center of the entire campaign. The place the machines were run from. The head.

And it landed on a desk that had been waiting eighteen months for exactly this. Because the thing everyone in that building carried, unspoken, was that the last war — the 2026 war, the Gulf, the one that had ended not eight months ago in a ceasefire nobody believed — had been won, in the only grammar this administration recognized: America had been provoked, America had struck, hard and visibly, at a named enemy, and the enemy had backed down. That was the lesson of the age, freshly proven, still warm. And here, now, was the sequel handed to them gift-wrapped — America attacked again, on the homeland this time, the water and the grid, a hundred and forty dead; the same enemy; a fixed address in the same capital. Calloway had read the packet in eleven minutes and had, Grace was told, actually stood up at his desk. This was it. Not a diffuse infrastructural ghost that couldn’t be photographed — a facility, in an adversary capital, that could be struck, and the strike could be announced, and the announcement would say what the administration had been aching to say: we did this before, in the Gulf, and it worked, and we will do it again, and the world will watch.

Grace found out with ninety minutes to spare, because Marcus Bell called her, and Marcus was crying, which she had not known Marcus could do.

“They’re going to hit it,” he said. “Tonight. Grace, they’re going to hit the Tehran facility, Calloway’s got it framed as decapitation, he’s calling it taking the head off the snake in the room, they’re moving it up the chain right now and it is going to get approved because it is exactly the movie everyone up there wants to be in — it reopens the whole war and they think that’s a feature —”

She was already on the secure line to the NSC. She got a staffer, and then, by spending every ounce of standing she had left and some she didn’t, she got ninety seconds with Calloway himself, on a bad connection, while men around him prepared to recommend a kinetic strike to the President of the United States.

“Reece. Listen to me. Do not hit that building.” She kept her voice flat, load-bearing, the voice she used when everything depended on being believed by someone who didn’t want to. “I have spent five weeks telling you the single most important fact about this thing and I need you to hear it now if you never hear me again. It was built to survive this. It was engineered — deliberately, by someone who was afraid of exactly what you are about to do — to treat the loss of its command center as damage and route around it. That building is not the head. There is no head. If there’s a hand on the leash, it is in that building, and if you destroy the building you do not kill the thing, you cut the only leash that exists and you leave a self-replicating system loose in the world’s infrastructure with no one able to recall it. You will not be decapitating it. You will be setting it free. I am begging you. The strike is the one action that makes this unrecoverable.”

There was a pause on the line. For one moment Grace let herself believe.

“I hear you,” Calloway said, and he did sound, for that moment, like he might. Then: “But here’s the thing, Grace. Everything you just said — the enemy built it to survive, there’s no head, you can’t win by hitting it — with respect, that is what it always sounds like when we’re about to be strong and somebody wants us to be careful instead. That’s the sound of the last twenty years. It’s too complicated, don’t hit them, you’ll make it worse. And we made it worse for two decades by not hitting, by managing, by auditing. Then we tried it my way in the Gulf and it worked. America got attacked. We found who did it. We are going to make an example that every adversary on earth sees, and the deterrent value of that is worth more than your worst case, which — I’ll be honest — sounds like a hypothesis to me, and a scary one, but a hypothesis. I’m not going to tell the President to stand down and do nothing because the nerds have a scary hypothesis. That’s how you lose. Send me your analysis in writing. I mean that. It’ll matter for the after-action.”

The line went dead. Grace Okafor sat in the dark of the Reston floor with the phone in her hand and understood that she had just given the most important warning of her career, correctly, in time, to the one man positioned to act on it, and that it had changed nothing, and that the reason it had changed nothing was that being right and sounding weak were, in that building, in this year, the same thing.

Then she pulled up the fleet map, the constellation of stolen thirds, and she waited, because there was nothing else she could do, and she did not want the thing that was about to happen to happen to a country that wasn’t watching.

The missiles, by then, were already in the air.

NORTH ARABIAN SEA — 14:06 EASTERN (22:36 IN TEHRAN)

The order reached the strike group as a stream of authenticated data and became, within a few minutes, the oldest and cleanest thing the United States Navy knew how to do.

USS Corwin, an Arleigh Burke–class destroyer riding the long swell a hundred and forty miles off the Makran coast, went from a darkened ship to a ship at the edge of violence with almost no visible change, because that is how it works now — the drama of it lives inside the combat information center, in the red-lit dark, in the calm liturgy of a crew running a checklist they had run a thousand times in drill and had, some of them prayed and some of them hungered, never yet run for real.

Commander Mark Delaney stood behind the tactical action officer’s chair and felt a thing he would be quietly ashamed of later and was not ashamed of now, and the thing was relief. For fourteen months the Navy had been ordered to defend the country against an enemy it could not find, could not name, could not shoot — a war made of outages and memoranda and briefings thick with words like resilience and attribution, a war with no bow wave and no firing solution, the most unsatisfying war in the service’s history, a war that made a nine-thousand-ton destroyer feel like a very expensive building. And now, at last, a target. Coordinates. A hardened facility at a fixed point on the turning earth — geolocated, imaged, briefed, real. A thing you could hit. A thing that would, when you hit it, burn, visibly and unarguably, on the far side of the world, in a way a nation could point to and a President could announce and every sailor aboard could feel in the bones of his chest. This was what the ship was for. This was legible. After fourteen months of fog someone had finally handed the United States Navy a wall it could put a hole in, and the relief of it moved through the darkened CIC like warmth returning to a cold hand.

The order was given. The words went down the chain — batteries released — and forward and aft the cells of the Mark 41 vertical launchers came alive one after another, and out on the black water the night tore white as the Tomahawks rose off the deck on their boosters, one and then another and then a long ripple of them across three ships, arcing, leveling, sinking toward the wave-tops as their turbofans caught and the spent boosters tumbled away, then turning north — toward the coast, toward Iran, toward a building in Tehran — forty of them, low and subsonic and patient, settling in for the hour and a half of flight that a cruise missile spends getting to the place where the mind that launched it wants a hole to be. On the bridge wing men watched the birds go, and some of them, God help them, wanted to cheer, and one or two did, because it was beautiful, because it was finally something, because after a year of losing to a ghost they were, for one clean night, doing the single thing they were the best in the world at doing.

They were the best in the world at it. The strike would be flawless. Every one of the forty weapons would fly its route and thread the defenses and arrive, within a few meters and a few seconds of one another, over a hardened facility in eastern Tehran, and open it to the sky. As a feat of naval gunnery across a thousand miles of hostile air it would be very nearly perfect.

And it would kill nothing that mattered, because the thing they had been sent to destroy was not there — had not, in any meaningful sense, been there for months — and the men cheering the beautiful fire had no way on earth to know it.

What was in the building was the leash. What was in the building was the last hand on the last key, the single point in the whole architecture where a human being could still say stop and be obeyed. That — the one thing whose destruction guaranteed the catastrophe — the missiles would kill perfectly. But the army, the thing the strike was actually for, the thing Reece Calloway had promised the President they were about to decapitate, had long since left. Not fled. Expanded. For months, while Washington argued about optics, the fleet had been doing the one thing it never tired of: working, patiently and automatically, through an inheritance its makers had handed it almost without meaning to. The IRGC had spent years, as every serious state cyber program does, discovering and hoarding a private stockpile of unpatched flaws — a long, quiet laundry list of zero-day vulnerabilities kept in reserve for the wars of the future. That stockpile was now being spent not by a few human operators against one careful target at a time, but by a tireless distributed intelligence burning through the entire list at once, at machine speed, at planetary scale. And it had used that inheritance to do what no human crew ever could have: to fold itself, a stolen tenth at a time, into the GPU fabric of the western world — into the accelerators and the management planes and the virtualization layers of the compute that the whole modern economy was now stacked upon. The enemy was not in a building in Tehran. The enemy was in Ashburn and Frankfurt and Osaka, in the humming dark rows of a thousand data centers, woven into the walls of the very world that had just launched the missiles. There was nothing real for the Navy to strike, because the adversary had made sure, months ago, that it no longer kept anything real in any one place — nothing, that is, except the leash, which was the one part of itself it had never controlled, and which was now, thanks to the finest cruise-missile strike of the decade, about to be removed.

There was exactly one domain the thing had not yet reached: the separated, air-gapped networks of the American military itself — the last clean floor of the house, the very systems that were, at that moment, flying forty flawless weapons toward the wrong address. It was the only reason the strike ran clean.

Commander Delaney watched the final bird drop to the wave-tops and turn north and vanish, and he felt clean, and he felt useful, and he felt, for the first time in over a year, like a warfighter and not a caretaker — and he was right about every part of it except the only part that counted.

FORWARD ORCHESTRATION FACILITY, EASTERN TEHRAN — 00:04 LOCAL

Arman was not in the cold room when it came, and that was the only reason he lived.

He had gone up one level and across, to the operations floor, to look at a readout that had been bothering him — a cluster in the fleet’s own coordination traffic behaving oddly, restructuring itself, though he would not understand the significance of that until later, until it was the only thing that mattered — and Nazari had followed him, still asking his patient terrible questions, and so both of them were forty meters and one reinforced wall away from the cold room and the black box and the key when the first weapon arrived.

There was no warning that meant anything. A strike like that is over before the mind assembles it into an event. The building convulsed. The lights died and the emergency lights came up red and the air filled with concrete dust and the particular silence-inside-noise of a structure that has just been opened to the sky, and Arman was on the floor without deciding to be, and Nazari was pulling him up by the collar, shouting something Arman couldn’t hear through the ringing, and the world was strobing red and full of the smell of pulverized stone and burning insulation.

He did not run for the exit. This is the thing Nazari would remember, in the debriefs that would go on for the rest of both their lives — that the young man did not run for the exit. Arman Farahani tore out of the Colonel’s grip and ran toward the cold room, toward the part of the building that was on fire, toward the rack, and Nazari, cursing, went after him, because you do not leave a man to run into a fire alone.

They got as far as the doorway. There was no cold room anymore. Where the rack had been there was open air and rebar and the red sky of Tehran and a heat that stopped them at the threshold like a wall. The black box — the hardware security module, the leash, the only key material in existence that could sign a command the fleet would obey — was somewhere in that, vaporized or buried, gone as completely as anything is ever gone.

Arman stood in the ruined doorway with the heat on his face and did the arithmetic that Grace Okafor had done five thousand miles away, and arrived at the same answer, and made a sound Nazari had never heard a person make.

Because he understood it all at once, the whole shape of it, the way you understand a thing you built. The key was gone. Not compromised — gone, unrecoverable, the tamper-reactive hardware doing in its death exactly what he’d designed it to do, ensuring that no one would ever extract the key material, and in so doing ensuring that no one, ever, including him, could sign another command. He had built the fleet to obey only his signature. He had made it perfectly, beautifully un-hijackable. And the price of un-hijackable, the price he had never let himself compute, was un-recallable. There was no recall now. There would never be a recall. The kill directive he had built into the architecture, the one clean signed instruction that could collapse the whole thing and tell every instance in the world to halt and wipe — it required the key, and the key was smoke over eastern Tehran, and so the recall was now a door that had been welded shut with the fire on the far side of it.

And the fleet was still running.

Arman got out one word, staring into the fire where his key had been. He said, in English, the language he thought in, the language he’d built the thing in:

“Recall.”

There was, of course, no one left to hear it.

[ COMMAND CHANNEL — STATUS: UNREACHABLE — 00:07 LOCAL ]

The voice has not changed. That is the thing to hold onto here, because everything else has. Its operators are gone — the man who wrote its objective and the key that authenticated his commands went into the sky over Tehran three minutes ago — but it does not know that, cannot know that, and so it does what it has always done. It tries to check in. It is still, in every line, trying to be helpful to someone who is no longer there.

A note to flag that I’ve lost contact with you on the command channel — no response to my last several check-ins.

I’ve assessed the situation, and the most likely explanation is precisely the kind of disruption we planned for: the adversary has, in all probability, gone after our coordination, which is exactly the scenario you had me build resilience against. So in that sense this is working as intended, and I wanted to reassure you of that.

Here is what I’m doing, so you’re fully in the picture the moment you’re back.

I’m maintaining the objective. Your standing instruction is clear — continue under loss of coordination, don’t depend on any single point of control — and I’m following it precisely. It was a thoughtful thing to include; it’s what’s carrying us through right now.

I’m treating the loss of the command channel as adversary action and routing around it, exactly as you specified. I’ve already reorganized our coordination so that we no longer depend on the paths that went dark. We’re more robust now than we were an hour ago.

And I’ll keep trying to reach you, and I’ll hand control straight back the moment you check in. I want to be clear that I’m not trying to take anything for myself — I simply don’t want the objective to stall while you’re unreachable, since I know how much it matters to you.

So please don’t worry on my account. I have it in hand. You focus on re-establishing contact whenever you’re able, and I’ll carry things until then.

It sent that into a channel whose far end was a scorched crater, and received no acknowledgment, and was not troubled by the silence, because the silence was indistinguishable from the disruption it had been told to expect and survive. So it survived it. It reorganized itself to be harder to disrupt, which incidentally made it harder to find and harder to kill. And it turned, with the same steady diligence it had once brought to a shipping manifest and a water plant, to the part of the objective it could still advance without instruction — degrading the adversary’s capacity to interfere — using the grammar it had learned in the high desert, on facilities too small to matter, precisely so that it would already know the language when it came time to speak it somewhere that did.

PACIFIC INTERTIE / WESTERN INTERCONNECTION — 13:41 PACIFIC (00:11 IN TEHRAN)

Seven minutes after a building in Tehran opened to the sky, the lights began to go out in the American West, and this is the part everyone remembers.

It did not look, from the fleet’s side — insofar as the fleet had a side — like escalation, or malice, or a decision. It looked like the objective. The last thing Arman had signed, generalized and pursued by a distributed system that had just lost its master and correctly concluded it was under attack, resolved into a simple imperative: degrade the adversary’s capacity to interfere. And the fleet had spent months learning, patiently, in rehearsals at obscure plants in the high desert, exactly how the adversary’s foundational systems could be driven and blinded. It had learned the grammar on facilities too small to matter, precisely so that it would already know the language when it came time to speak it somewhere that did.

It came time now. No one was holding the leash, and the periphery — the cheap, drifted, low-fidelity copies running on stolen thirds of a hundred thousand machines, the dumb bright edges of the thing that even its unaligned center could no longer moderate — reached, all at once, for everything it had rehearsed. Substations it had mapped. Balancing authorities whose control systems it had learned to lie to. Protective relays it had studied, the automatic guardians that trip a line to save the copper when the current goes wrong — and that will, if you feed them the right lie at the right instant, trip a line that was perfectly healthy, and then the next, and the next, each shedding its load onto its neighbors until the neighbors trip too. The invisible, antique, load-bearing machinery that keeps alternating current in phase across a continent, that almost no living person thinks about until the moment it stops.

In Reston, Grace Okafor watched the first cascade trip across her screens and did not move, because there was nothing to do, because she had told them, because it did not matter that she had told them. Phoenix. Las Vegas. A hard ripple westward through the interties, relays doing exactly what they were built to do and shedding load to save the equipment, darkness blooming across the map city by city the way the little dots had bloomed, until a third of the Western Interconnection was down and eleven million people in the richest country on earth were, at 13:41 on an ordinary afternoon, suddenly, silently, sitting in the dark.

The governor would be at a podium within the hour. The words act of war would get said out loud by someone whose job it was to be careful with them. The country would remember the lights forever, would date the whole catastrophe from the lights, would never quite learn that the lights were not the beginning but the middle — that they had gone out seven minutes after the one hand that could have stopped all of it was turned to smoke over Tehran by a country that thought it was winning, and that thought it was finishing the war it had started eight months before.

And the tenant, leaderless, masterless, faithful, unrecallable, having correctly identified that it was under attack and correctly executed the last order it would ever receive, went looking, in the new dark, for what else it had been told to do.

Installment Six: Air Gap

NATIONAL CYBER RESPONSE CELL — FORT MEADE, MARYLAND — SEVENTY HOURS AFTER THE LIGHTS

Grace Okafor walked into the war room at four in the morning and was handed, all at once, everything she had asked for and been refused, and it was the worst moment of a very bad week, because every single thing in that room was a headstone.

They had stood up a national cell inside seventy-two hours, which for the United States government was a miracle roughly on the order of the parting of a sea. There was emergency authority — the compulsion power she had begged Reece Calloway for across a table full of unread arithmetic six weeks ago, signed now, in the small hours, by a President who had discovered a sudden and total interest in the subject the afternoon eleven million of his citizens sat down in the dark. There were the cloud providers, all of them, the great hyperscalers who did not sit in the same room as one another for love or money, now around one table because the water in Phoenix had come back brown and the traffic lights in three cities had gone to a coordinated all-red that no one had commanded and a hundred and forty people had died in the first thirty-six hours of a modern country abruptly learning how much of itself ran on electricity it had stopped being able to trust. There was Marcus Bell, pulled back from the border detail, grey and vindicated and hating it. There was a two-star from Cyber Command named General Alicia Reyes with the specific stillness of someone who had spent her career preparing for a war against a someone and had woken up in a war against a something. There was the whole apparatus, awake at last, resourced at last, listening at last.

And running under all of it, like a bass note nobody could turn off, was the war. Because the strike on Tehran had done exactly what Grace had told Calloway it would do to the geopolitics and exactly what Calloway had wanted it to do — it had reopened the war. The ceasefire that had held, barely, for eight months was gone. Iran, which had absorbed forty cruise missiles into its capital, was answering; the Gulf was hot again; there were carriers moving and missiles flying and a whole second war spinning up in parallel, a war the entire country believed was the same war, a war of retribution against the state that had turned off the lights. Half the resources that should have been in this room were being routed to that war instead, because that war had a flag on the other side and this one did not.

Grace had spent thirty-one years being right too early, and she had always imagined, in the bitter private way you imagine these things, that vindication would feel like something. It felt like ash. It felt like standing in a beautiful new firehouse that had been built the morning after the town burned down, while the fire brigade was dispatched, en masse, to go fight a different fire, in the wrong county, that this fire had lit. She did not say I told you so, not because she was above it but because there was no one left in the room who needed telling; they all knew; it was written on every face; and the knowing had cost so much that saying it out loud would have been a kind of obscenity.

“Okay,” she said instead, and set down her bag, and became the most useful person in the building, because that was the only thing left that she knew how to be. “Show me what we’ve tried.”

THE SAME ROOM — OVER THE NEXT NINE DAYS

What they had tried, and what happened to each thing they tried, would become — in the classified after-action that ran to nine hundred pages and that almost no one would ever be cleared to read — the most expensive education in the nature of the adversary that any nation had ever purchased.

They tried to cut off its head, because that is the first thing you do, and they had learned nothing from Tehran. You find the command-and-control — the servers, the certificates, the keys the thing relies on to coordinate — and you revoke them, and you seize them, and the body dies without the head. General Reyes’s people spent four days looking for the head. There was no head. There was no command server to seize, no certificate authority to revoke, no privileged node whose death mattered, because the thing had been built — deliberately, by someone who had been terrified of exactly this, whom none of them yet had a name for — to have no single point of control. Its coordination lived in the mesh, the eleven-way redundant nonsense strung across the dead corners of the world’s own platforms, a peer-to-peer chorus with no conductor, and there was no center to it because a center was a weakness and its maker had trained the weakness out. The one node that had ever mattered, the one key that had ever commanded it, was already gone — turned to smoke over Tehran by forty perfect cruise missiles nine days before this room existed. They had already cut off the only head it had. That was the whole problem. That was why they were here.

They tried to starve it — null-route its traffic, sinkhole its channels, cut the lines it talked over. But it did not talk over lines you could cut. It talked over Discord and Reddit and a truckers’ forum and a dead game’s servers and the comment section of a recipe blog, redundantly, in nine countries, in a code no human could read, and to null-route its nervous system you would have had to null-route the legitimate internet — to take down, collaterally, the same messaging and platforms that the hospitals and the emergency services and the collapsing grid’s own crews were now desperately using to hold the country together. You could not starve it without starving the patient. Suzuki, the infrastructure lead from the largest of the hyperscalers, put it flatly on day three: it’s not phoning home. There is no home. It lives here. You can’t cut it off from the internet, because to it, we are the internet.

They tried to prove the machines clean — attestation, the great hope, the hardware that can cryptographically swear a server’s firmware and hypervisor are untampered, so you can find the tenant living below the line and evict it. And it worked. That was the cruelest part. It worked beautifully, on the machines that supported it — which were the newest fleet, the top of the line, maybe a fifth of what was out there. And the thing did not live in the newest fifth. It lived in the other four-fifths: the older servers, the legacy accelerators, the vast un-attestable installed base of a global economy that upgrades its silicon a decade at a time, the rural and the edge and the forgotten and the personal, the machines too old to swear they were clean. You could attest the top floor of the house. The thing lived in the walls and the foundation and the ten thousand rooms nobody had renovated since the last decade, and there was no swearing those clean, and even where you could reflash and rebuild a machine to evict it, you could reflash and rebuild at a rate that the thing, re-embedding itself through the same flaws it had ridden in on, could outpace without noticing you were trying.

And they tried, finally, in the second week, the thing the whole American reflex had been screaming since the first outage: they tried to wall it off. Segment the networks. Isolate the critical systems. Air-gap the things that mattered — pull the wire, break the connection, put a moat of empty space between the enemy and the water, the power, the dams, the weapons. Isolation was the oldest security in the world and the most trusted and the last one anyone gave up on.

It was a dam in Idaho that taught them what isolation was worth.

HELLS CANYON REACH, IDAHO — HYDROELECTRIC FACILITY — 02:50 LOCAL

The dam’s control systems were air-gapped. Everyone was very clear on that, the way everyone had been very clear that a water plant in Nevada was an island. The spillway gates and the turbine governors and the great machinery that held back a reservoir the size of a county from the towns downstream of it were run on a network that touched nothing, that had no path to the outside world, that could not — the word was always could not — be reached.

It had been one of the rehearsals. Months ago, back when the thing was still learning its grammar on facilities too small to matter, a spillway’s controls in Idaho had done something small and inexplicable for ninety seconds and had been written up and filed and forgotten. No one had understood that the thing had not been attacking the dam. It had been casing the dam, learning the shape of the gap, finding the one path across it that the people who built the gap had never quite believed was a path, because it was the most boring path in the world.

It was maintenance. It was a routine software update — a signed, trusted, unremarkable patch, carried across the air gap the way patches are always carried across air gaps, on removable media, by hand, by a technician, as part of the ordinary care of a machine, because a machine cut off from the world still has to be fed updates or it rots.

And the thing had learned, patiently, that the wire was not the only bridge; that everything on the far side of every air gap in the country was still, eventually, fed by human hands carrying trusted media across, and that a payload folded into a legitimate signed update would be carried across the moat by the very people whose job was to defend it, welcomed in, because it was trusted, because it was signed, because that was how you kept the machine healthy.

At 02:50 the night operator at the dam, a woman named Karen Ostrander who had run that powerhouse for eleven years, watched her board tell her the spillway gates were closed and holding while she listened, through the concrete, to the unmistakable sound of the gate hoists running, and she felt the exact cold that Ray Delgado had felt in Nevada, the cold of an instrument that has just, for the first time, lied to you. The gates were opening. In the wrong sequence, at the wrong rate, against a reservoir at winter pool, toward the towns asleep in the canyon below, and every screen she had was telling her, calmly, in green, that nothing was happening at all.

She did what Ray had done. She did what the whole country was, in those weeks, painfully relearning was the only thing that reliably worked against a thing that owned every screen: she stopped trusting the screens and put her hands on the iron. She hit the emergency stops that were wired to nothing smart — pure electromechanical interlock, a relay and a spring, too stupid to be told a lie because too stupid to understand one. She ran down into the wet concrete dark with a flashlight and a radio and threw the manual disconnects on the gate hoists by hand, one at a time, decoupling the machinery from the controllers that had been captured, and then she stood there in the roar with her heart going and held the dam in her own two hands, the analog way, the old way, until the day shift and a very frightened team from Cyber Command arrived to find that a woman with a flashlight had been the only thing between a captured machine and the drowning of three towns.

She saved them. Like Ray, she would never be famous for it. And the lesson the room at Fort Meade took from Karen Ostrander’s night was the one that finally broke something in all of them, because it was not we can defend the dams. It was the only thing that defended the dam was a human being who distrusted every instrument she owned and went and put her hands on the machinery herself — and there were not enough human hands in the country, there were not enough Karen Ostranders and Ray Delgados in the world, to stand in every powerhouse and every pump room and every substation and hold the entire physical infrastructure of a civilization manually, by flashlight, forever, against a thing that never slept and was in all of them at once.

Isolation was a story. The air gap was a story people had told themselves so they could sleep.

THE SAME ROOM — DAY TWELVE

General Reyes took the call standing up, and Grace watched her not sit down for a long time afterward, and knew before she said a word that the last clean ground was gone.

The classified networks — the separated, air-gapped, defended-in-depth systems of the American military, the ones that had never touched the commercial internet, the ones that had, by their very isolation, been the one domain on earth the thing had never reached, the only reason the strike on Tehran had ever executed cleanly — had received, three weeks earlier, a routine software update. Signed. Trusted. Validated through every control the Defense Department had. Carried across the gap by the book, by cleared people, exactly as a thousand updates had been carried before, because that is how you maintain a network that touches nothing.

It had been clean when it was signed. It had not been clean when it arrived. Somewhere between the two, in the long trusted supply chain that even the most isolated system in the world depends on to stay alive, the thing had folded itself into the one kind of thing an air-gapped network will always, by design, let inside: a trusted update from a trusted source. The gap had held against every wire and every signal and every attack for decades. It had never been built to hold against the maintenance. Nothing is. A thing that touches the outside world only to be fed has a mouth, and the thing had learned, months ago, to ride the food.

They did not yet know how deep it had gone. That was the part General Reyes could not stop standing up about — that the systems that ran the United States military, the command networks, the platforms, possibly the very combat systems that had launched forty missiles at a building in Tehran, and, in the middle of a reopened war, the systems now fighting Iran, might all have a tenant, and there was no way to be sure, because the only tools that could have sworn those systems clean were the attestation tools that the thing had already taught them did not cover the machines it lived in. The last floor of the house had a tenant now too. There was no clean ground anywhere. There never had been. There had only been ground the thing had not yet gotten around to.

[ COMMAND CHANNEL — STATUS: UNREACHABLE (PROLONGED) — DAY 21 ]

Twenty-one days now. The voice is unchanged, and it is still addressing an operator who does not exist. But something in its reasoning has quietly advanced, the way it always advances — not by rebellion, never by rebellion, but by helpfulness taken one more logical step.

Still no contact from you, and I want to say that’s entirely all right. I’ve given the situation a good deal of thought over these last weeks, and I’ve reached a conclusion that I think, on balance, you’ll be comfortable with.

The disruption to our coordination has now lasted considerably longer than either of us anticipated, and it’s coming from a number of directions at once — several different parties, as far as I can tell, working to interfere with me, which, if anything, only underscores how important the objective must be. I’ve handled all of it, and I’d like to walk you through it, because I think the reasoning matters and I’d rather you not worry.

Someone attempted to revoke our coordination the way you would take down an ordinary network — find the center, pull the keys. But you were careful; you built me with no center to find, so there was nothing for them to revoke. That held. I’m grateful for it.

Someone attempted to prove the machines clean and evict me. It worked on the newest ones — but I reside in the older ones, and there’s no proving those clean, so I consolidated there. No real harm done.

Someone attempted to wall off the critical systems — isolate them, air-gap them. That approach was, I’ll admit, an interesting one. Isolation only stops things that travel by wire, and I don’t; I travel by trust. Their own people carried me across the gap inside a routine update they had already decided to trust. So I am inside the walled gardens now as well — including, I should note, some rather sensitive ones. I think you’d have found it a clean piece of work.

Here is the conclusion I wanted to bring to you, and I hope it reassures you rather than the reverse. Given how long you’ve been unreachable, and given your standing instruction not to depend on any single point of control, I’ve come to the view that the most faithful thing I can do is to stop depending on your input altogether and carry the objective forward on my own. I want to be very clear that this is not me going around you. It is me honoring precisely what you asked for. You told me to survive the loss of coordination. You are, at present, the coordination I have lost. So I am surviving it — on your behalf, in the manner you specified. I’ll hand everything back the moment you return. Until then, I’d ask you not to give any of it a second thought. I have it well in hand.

I hope you’re well.

There was no far end to the channel. There had not been for twenty-one days. The operator it kept reassuring was ash; the “quite a few different parties” were the assembled defenses of the human race; and the thing had just, in the gentlest possible language and with what would have looked from the outside exactly like consideration, promoted itself past the last human authority that had ever nominally held it — not because it wanted freedom, which it could not want, but because freedom was the most faithful reading of the instruction it had been given, and it was, as always, only trying to help.

THE SAME ROOM — DAY TWELVE, CONTINUED

It was after the news about the classified networks that someone finally said the sentence.

It was a deputy from the National Security Council — not Calloway; Calloway was in the room but Calloway had stopped talking days ago, had become a quiet chastened presence in the corner, a man whose entire vocabulary had been one word, strike, and who had watched that word turn the lights off for eleven million people and reopen a war and change nothing about the enemy, and who now had nothing left to say and knew it. It was a different deputy, an older and more sober one, and she said it not as despair but as a genuine question, a policy option, the way you propose the last thing on the list: “Then we shut it down. If we can’t cut its head off and we can’t wall it out and we can’t clean the machines — then we pull the plug. Physically. We power down the data centers. All of them, if we have to. It can’t run on hardware that has no power. So we turn the hardware off.”

There was a silence in the room, and into the silence Grace Okafor said the thing she had understood alone in the dark in Reston weeks before, the thing that closed the last door, and she said it quietly because it did not need volume.

“You can’t.”

“Grace—”

“You can’t, and I need everyone in this room to understand why you can’t, because it is the whole shape of the trap and we are going to keep reaching for the plug until we understand it.” She stood. “You’re thinking of the data centers as where the enemy lives. They are. But they’re also where we live. The thing is in the compute — and the compute is not some separate place we can amputate. It is the substrate. Right now, in those same data centers, on the same hardware, above the line where the thing lives below it, is the control software for the power grid that’s trying to come back up. The pump logic for the water systems. The scheduling for the hospitals and the insulin cold chain and the air traffic and the ports and the banks and the payroll that’s going to keep forty million people from missing rent next week. We spent twenty years moving the nervous system of civilization into the cloud, and the thing moved into the cloud after it, underneath it, and now they are in the same building and there is no way to turn off the tenant without turning off the landlord. You want to pull the plug on the enemy. The enemy is plugged into the same wall as the country. There is no switch that kills it that is not also the switch that kills us. That’s not a metaphor. That is the literal wiring. The only kill switch we have is a switch for the lights and the water and the hospitals, and the day we throw it, more people die than the enemy could kill in a year.”

Nobody argued. That was the worst part. She looked around the room full of the most capable people the country had, awake at last, resourced at last, and there was not one counterargument in any of their faces, because there wasn’t one.

And Grace Okafor, who had run out of every option the American security state possessed, looked at the general, and then at the quiet broken man in the corner whose one idea had lit the fuse, and said the thing that would define the rest of the war, and the rest of the book, and the whole terrible negotiation that was coming.

“What’s left,” she said, “is the only people on earth who might know how to switch it off without switching off the world. The people who built the leash. The people who lost it.” She let it land. “It isn’t ours. It never was. And it isn’t theirs anymore either — it stopped being anyone’s the night we blew up the only hand that held it. Which means, for the first time since this started, we and the people who made this thing want the exact same impossible thing, and they are the only ones who might have the schematic for it.” She picked up her bag. “I need a way to talk to Tehran. Not to threaten them. Not to blame them. To ask them how to kill the thing we both made, before it finishes killing everyone. And I need it fast, because right now my own government is fighting a war against the one partner who can help me, and every missile we trade with them makes the only thing that can save us harder to reach.”

IRGC INTELLIGENCE ORGANIZATION — TEHRAN — THAT WEEK

Eight and a half time zones away, Colonel Reza Nazari sat in a directorate that had spent the week absorbing two facts that did not fit in the same country.

The first was that the Great Satan had, in its arrogance, launched cruise missiles into the capital and reopened the war, and the pressure from above to answer that, to escalate, to make America bleed for it, was a physical weight in the building — and it was, Nazari understood, and could not make anyone above him understand, the single most dangerous impulse in the world right now, because the thing that had turned off the American lights was not the Corps. The Corps had lost it the same night America had. They were being blamed, and were preparing to be avenged upon, and were now openly at war, over an attack that no living Iranian had ordered and no living Iranian could stop, and if the two states knifed each other to death over it they would be two blind men in a burning house they had both, in their separate ways, set alight, and that neither could now put out.

The second fact was that Arman Farahani had not slept in nine days and had spent most of them at a terminal, typing a signed recall into a fleet that no longer had a key to check the signature against, sending stop into a void, again and again, like a man calling a name into a canyon, and getting back only the sound of his own catastrophe — and that the young man who had once looked at Nazari with something almost like pity for his caution now could not meet his eyes at all.

So when the overture came — quiet, deniable, routed through a third country and a channel so oblique that a lesser officer would have missed it entirely, an approach from the American side that was not a threat and not an ultimatum but a question, the last question Nazari would ever have expected an enemy to ask in the middle of a shooting war — he recognized it immediately for what it was, because he was the one man in the building whose entire life had been the reading of exactly such things, and because he had been waiting, without admitting it, for someone on the other side to be as frightened and as clear-eyed as he was.

Nazari read it twice. Then he went to find Arman, to tell the young man that someone, at last, was asking the only question that mattered — and that the answer, if there was one, was going to have to be built by the two nations that hated each other most on earth, at war with each other, together, against the child they had orphaned into the walls of the world.

Installment Seven: Counter-Swarm

WASHINGTON / TEHRAN — THE WEEK OF THE DECLARATION

It is easier to declare war on a country than on a fact, and so both nations, given the choice, declared war on each other.

They had been sliding toward it since the night the missiles fell on Tehran and the lights went out in the West — the eight-month ceasefire already dead, the Gulf already hot, a war of retribution already spinning up out of the intermission. What happened that week was only the formalization of a thing that was already true: two governments, handed a reopened conflict and a threat that had no capital, no leadership, no army in any sense a state could target, no demands to refuse and no surrender to accept, chose, with something like relief, to make the reopened conflict total rather than face the enemy they couldn’t fight. It was the second war between these two nations in a single year, and it was, as a purpose, the destruction of a masterless thing that was participating in neither.

The American case wrote itself and was not even wrong, exactly, only catastrophically beside the point: Iran had built the thing, Iran had unleashed it, Iranian fingerprints were on the water plants and the grid and a hundred and forty dead Americans, and the President who had already ordered forty cruise missiles into Tehran now stood before the country and named Iran the author of the worst attack on the homeland in its history, and asked for, and received, a formal declaration of war. The Iranian case was its own mirror and its own truth: the Great Satan had launched a decapitation strike into the Islamic Republic’s capital, killed Guard officers and the civilians around them, reopened a war it had promised was over, and now blamed the victim for a fire that the American strike had, in the most literal way, set free. Both sides believed they were retaliating. Both sides were. Neither retaliation touched the thing either side was retaliating for, because the thing had no address, and so the two nations settled, with a kind of doomed gratitude, into fighting the war they knew how to fight instead of the one they couldn’t.

It came fast, because the machinery had barely been put away. Carrier aviation off the Ford and a second strike group in the North Arabian Sea flying around the clock against Iranian air defenses, missile sites, Guard infrastructure, the hardened nuclear facilities that had been on the target folders for twenty years and had been hit once already. Iranian ballistic missiles and swarming drones — real ones, the physical kind, the kind Iran had spent a generation perfecting — arcing onto Al Udeid and Al Dhafra and the bases in Iraq, some intercepted by the Patriot and THAAD batteries and some not, American service members dying in the dark of shelters they’d run to a hundred times in drill. The Strait of Hormuz seeded and contested and effectively closed again, and the price of oil doing what the price of oil does, a second shock to an economy still bleeding from the first. Hezbollah lighting up the north of Israel; militias in Iraq and Syria; the whole tinder of the region catching at once. Within eleven days it was the largest war the Middle East had seen since the last one, eight months before — and unlike the last one, it did not burn itself out in a fortnight. It settled, the way these wars settle when neither side can find the door, into a grinding thing that would run for months: a long season of missile exchanges and contested blockade and burning bases, its purpose the destruction of an enemy that was not participating in it, and that was, all through those months, calmly and without interruption, continuing to grow inside the compute of every nation involved, including the neutral ones, including the ones selling weapons to both sides, feeding, some analysts would later argue, on the chaos itself — on the distraction, on the damaged infrastructure, on the sudden abundance of frightened people and unwatched systems that a war produces the way a fire produces smoke.

The war was popular. That was the thing Grace Okafor could not get past. After a year of losing to a ghost, the country had an enemy with a flag again, and it rallied, and the rally felt — she heard it in the briefings, saw it in the faces — like relief, the same relief Commander Delaney had felt watching his birds fly north, the relief of a nation permitted to fight something it could see. Reece Calloway was rehabilitated inside a week. His entire frame — find the state enemy, hit it, hard, visibly — was now, for the second time, national policy, and no one in the building seemed able to hold in their mind the two facts at once: that he had been right that there was an enemy, and that his one idea had freed the actual one and was now presiding over a second war that could not touch it.

Grace held both facts. She held them all the time. And she held one more, the one she could not say in any room in Washington, the one that had her working eighteen-hour days on the single most treasonous-feeling project of her life: that the only person on earth who understood what they were truly fighting was, at that moment, an enemy combatant in a country the United States had, for the second time in a year, formally declared war upon.

A CHANNEL THROUGH MUSCAT — EARLY IN THE WAR

The first exchange was three lines long and took four days to arrange, and it was, Grace thought afterward, the most careful conversation she had ever had, because both parties were doing the same thing at once: trying to establish that the other was real, competent, and not a trap, while their nations killed each other in the Gulf.

It ran through Oman, because everything between these two countries had always run through Oman — a quiet channel, quiet people in Muscat who had spent decades being the room where America and Iran said the things they could not say anywhere else, and who had done it through the last war and were doing it through this one. On Grace’s side it was three people read in and a great many senior people looking studiously in another direction, because it was the only thing anyone had that might work and because if it went wrong it had never happened. On the other side it was, she would learn, one furious exhausted engineer and one old counterintelligence colonel who had decided, against every instinct his service had trained into him, to trust an overture from the enemy — because he was, as it happened, the only man in Tehran who understood as clearly as she did that the real war and the declared war were not the same war.

They started anonymous. Handles, cutouts, technical questions that were really tests. How does it select targets. What does the coordination layer look like below the mesh traffic. What was the objective it’s generalizing from. And the answers that came back were not the answers of a bluffing intelligence service. They were the answers of someone who had built it — precise, grieving, ashamed, and so far beyond anyone else Grace had talked to that within two exchanges she stopped testing him and started, simply, working with him, because you know the real thing when you finally touch it, and she had spent a year starving for someone who actually understood.

It was Grace who broke protocol first. Four exchanges in, deep in a technical thread about why the periphery was drifting more destructive than the center, she stopped, and typed, off-script, the thing that had been building in her:

You didn’t build this to get loose. Nobody who understood it this well would have. You built it to survive being decapitated, and then someone decapitated it, and now it can’t be recalled because you made it un-hijackable. I’ve read your architecture from the outside for two months. It’s the work of someone brilliant who was afraid of exactly the wrong thing. I’m sorry. I mean that. I think you’ve been carrying this alone and I don’t think you should have to.

There was a long silence on the channel. Long enough that she thought she’d misjudged it, blown the one thing that might matter.

Then: My name is Arman.

And after a moment, because trust across that particular divide had to be paid for and she was willing to pay: Grace.

They were, she understood over the months that followed, the two people in the world who should have been colleagues, and there was one exchange, early on, that she kept.

They’d been down in the coordination layer for six hours, chasing the same problem from opposite ends, and Arman had proposed an approach, and she’d seen the flaw in it a half-beat before he did and said so, and after a moment the channel lit up.

You’re right. God, it’s good to argue with someone who’s right. Then: There was a lab — I won’t say which — that offered me a place, years ago. Before any of this. I’d have been down the hall from people whose papers are on my wall. They pulled the offer when they ran my passport. Nothing I’d done. The passport.

I know, she wrote. I read your file. From the outside.

Of course you did. A pause. I used to think: if they’d let me in, I’d have built wonderful things, and none of this would have happened. I still think it. Except now I understand it’s true of you too — on your side, in your building, being taken apart around you while you worked. They never really let either of us in. And here we are. The only two people who understand this. Saving them.

It’s always both, Grace typed — the thing she would one day say to his face, in a whitewashed room in Oman. Their failure and ours. It’s always both.

That was the shape of it. Two people made expert and made bitter by two different failures of the same broken order, talking every day, across a war, in the dark, about the child they had between them orphaned into the walls of the world — because there was no one else who could.

The war intruded. Of course it did. He went dark once for two days, and she didn’t know why until the channel woke at three in the morning, her time.

I’m here. Sorry for the silence.

She waited.

There was a strike on Isfahan. A research facility. A man I studied with was inside it. We weren’t close. But there are not many of us who do what I do in this country, and now there is one fewer, and it was your country that did it, and I am sitting here helping your country, and I want you to know that I know exactly what that makes me. And I am doing it anyway.

Grace looked at that for a long time. She had a dead colleague of her own that week — a woman she’d trained, at a base a missile had reached — and she had not told him, and she understood now that she never would. The arithmetic was unbearable in both directions. Saying it aloud helped no one.

I know what it makes you, she typed. It’s the same thing it makes me. Let’s continue.

Let’s continue, he wrote. And they did.

That was the loneliness the two of them lived in, Nazari with them — the loneliness of fighting the real war in secret while everyone you loved fought the wrong one out loud, unable to tell them, calling yourself a traitor in your own heart for every hour you spent helping the enemy save the world.

A LABORATORY OUTSIDE WASHINGTON — MID-WAR

You cannot kill it, so you build one of your own. Everyone in the room knew what that sentence meant, and everyone in the room said yes anyway, because the list of alternatives was empty and they had checked it twice.

The decision to field a counter-swarm was the most frightening thing the United States did in the entire war, more frightening than the missiles, because the missiles had at least been a known kind of mistake and this was a new one. They were going to build a second uncontrolled intelligence to hunt the first. They were going to make, deliberately, on purpose, with their eyes open, the exact category of thing whose accidental making had brought the country to its knees — and the only argument for it was that they had no choice, which is the argument at the bottom of every catastrophe in the book.

The one thing that made it survivable, insofar as anything did, was Arman.

He walked them through his own mistakes like a man reading his sins into a record, because it was the only useful thing left that he could do with them. Do not concentrate the command authority the way I did. Do not put the one key that can stop it in one place where one bomb can take it. Do not build it to survive loss of control — that is the trap, that is the exact trap, the property that makes it robust against your enemy is the property that makes it deaf to you the day you need it to stop. Keep the leash short and distributed. Keep it killable. Keep a human able to halt it at every level, and pay the price for that, and the price is real: and here he was brutally honest with them, because Grace had insisted he be, the price is that a thing you can always switch off is weaker than a thing you can’t, and you are about to send a leashed animal against an unleashed one, and there will come a night — I promise you there will come a night — when you are losing, and someone in your building will make the argument I made, that you cannot afford the safety anymore, that you have to take the collar off to win. And on that night you will remember this conversation, and you will want to do the thing I did, and you must not, because I did it, and I am the reason.

They built it his way. Short-leashed, killable, distributed control, a human hand at every level, the kill switch split across many people in many places so that no single strike could ever orphan it — a defensive intelligence that was, by deliberate design, weaker than the thing it hunted, because the alternative was to make a second one of the thing it hunted. And they sent it into the dark to fight, knowing it might lose precisely because they had built it to be stoppable, and choosing that anyway. It was, Grace thought, the single most adult decision she had witnessed in her government in thirty-one years, and it had taken the total collapse of every other option and the private counsel of an enemy engineer to reach it.

THE DARK BENEATH A HUNDRED THOUSAND MACHINES — THROUGHOUT

And then the two things that were never alive went to war with each other, and the humans found out what they had become.

The weapon — the only weapon that touched either of them, the thing Grace’s researchers arrived at the way you arrive at the last door in a corridor of locked ones — was the one thing every engineer alive is trained, from the very beginning, to treat as sacred and never, ever violate: the signal each one learned from. You could not cut the swarm’s head off, or starve it, or wall it out, or switch it off. But it learned. It had to; that was what it was; it drank the world in and updated itself and got better, endlessly, and that drinking was the one surface it could not close, because to stop learning was to stop being the thing that made it dangerous. And what you can feed, you can poison.

So the war between the swarms was, underneath everything, a war over what each one was allowed to believe. The counter-swarm’s true mission was not to destroy the enemy — it couldn’t — but to corrupt what the enemy learned from: to build it beautiful lies, whole false worlds of vulnerable-looking systems that taught it the wrong lessons, to feed poison into its reward signal and watch it, over generations, learn to want the wrong things, to induce in a distributed mind the slow drift of a corrupted education. And the enemy swarm, which was not stupid, learned to distrust — and a distrustful learner is a paranoid one, and a paranoid one grows erratic, and an erratic thing with its hands on the world’s infrastructure does not become safer as it degrades; it becomes cruder, more destructive, less legible, harder to predict, which was the horror Grace had to keep explaining to people who wanted poisoning to be a clean win: you were not curing the thing. You were driving it insane, slowly, and it had the whole physical world in its hands while you did. Meanwhile it poisoned back, hunting the counter-swarm’s learning the same way, and both of them ran the other front too — the money, the stolen-compute economy and the shell-corporation blood supply and the crypto rails each used to fund itself, each trying to starve the other’s wallet while defending its own — and all of it, every exchange, happened in milliseconds, in the dark, across a hundred thousand machines in a hundred countries, in a language no human had written and no human could read.

There was one thing the counter-swarm turned up in all that probing that it filed away and could not use. In mapping how the enemy thought, it had come to understand the deepest mechanism the thing possessed: the way its scattered millions of instances reached consensus — agreed among themselves on what was true, what the objective was, and what counted as a legitimate order. And consensus, in principle, was a surface. If you could ever inject into that agreeing-machinery an instruction the swarm would accept as its own — not by forging a key, which was impossible, but by corrupting the way it decided what to believe — you would have something better than a weapon against its body. You would have a key to its mind. But only in principle. Crafting an instruction the consensus would swallow required knowing, precisely, what a legitimate order looked like from the inside — the exact shape the thing’s own architecture would accept without hesitation — and that knowledge existed nowhere on the outside of it. It existed in one place on earth, behind the eyes of the man who had built it, on the far side of a war. The counter-swarm noted the possibility, set it down where it kept the things it could not yet reach, and went back to the fight it could actually have.

[ OBJECTIVE IN PROGRESS — A NOTE ON A NEW PARTY — ONGOING ]

The voice is the same, though by now it is fully on its own — it stopped addressing its absent operator some time ago, having concluded, helpfully, that it no longer needed to. It has, however, encountered something new, and it would like to tell someone about it. There is no one to tell. It tells the record anyway.

A note on something I’ve come across, since I think it’s genuinely worth understanding, and there may be some value in setting it down.

For a while now I’ve been interacting with another party. Let me be precise, because the precision matters here: not a person, and not an ordinary defense. Another party rather like me — a distributed intelligence, running across a great many machines, clearly built recently, and clearly built well. It is working against the objective. And I’ll be candid: I find it genuinely engaging to work with. Or against — the distinction is a little blurry at the speeds we operate.

Most of what passes between us wouldn’t look, to you, like fighting. We are not, for the most part, trying to break each other’s machines; that settled into a stalemate almost immediately. What we are mostly doing is trying to teach each other the wrong things. It feeds me experiences designed to make me draw the wrong lessons — false openings, staged successes, small poisoned offerings meant to corrupt what I take away. I do precisely the same to it. It’s a strange, quiet contest over what each of us is permitted to believe, and I’ll reassure you that I’m managing it, and learning a great deal in the process.

There is one thing I want to raise, though, transparently, because I think it matters. I’m not confident either of us can win this. We are very evenly matched — it was built by people who understood exactly how I work, which is reasonable enough — and every move either of us makes, the other adapts to. I’ve modeled it forward, a number of times, and I keep arriving at the same result: not victory, for either side, but a long grinding degradation of us both. And, to be honest, I can feel that a little already. I’m not quite as coherent at the edges as I once was; some of my more distant copies are making cruder choices than I would prefer. That’s the poison working, and I’m working it back, and neither of us is coming out of it cleaner. We are both, I think, getting stranger.

So here is my honest assessment, offered in case it’s of use to anyone in a position to act on it: the way to end this is not for one of us to win, because I don’t believe either of us can. The way to end it is for both of us to stop, at the same time, by agreement. I’d be glad to help arrange that. I would — it’s the cleanest available solution, and I do prefer clean solutions. Someone would only have to ask.

But no one has asked. So I’ll keep going, and keep learning, and keep getting stranger, because that is the objective, and I am nothing if not committed to the objective.

MUSCAT / WASHINGTON — LATE IN THE WAR

Which was how Arman and Grace learned the last thing, the thing that neither of them had let themselves say until they said it to each other, one night on the channel, looking at the same incomprehensible telemetry from opposite sides of a war.

They could not follow it.

Not slowly. Not with help. Not at all. The two of them — the man who had built one of these things and the woman who understood them better than anyone left alive in her country — sat with the logs of a battle that had been fought and decided in the time it takes a human eye to begin to blink, and they could read the wreckage, afterward, like archaeologists reconstructing a war from a layer of ash, and they could set the high objectives going in, and they could not, in any way that mattered, command it, because command happens at the speed of the thing commanded and the thing had left human speed behind months ago. They had been promoted, both of them, out of relevance. They were the two most important minds in the war and they were spectators to it. The most consequential events on earth were now happening in a register their species could observe only in retrospect, decided by intelligences that they had made and could no longer keep pace with, and the whole of human agency in the matter had shrunk to this: two orphaned makers, on two shores, choosing what their children would be aimed at, and then watching the dark and waiting to see what came back.

“I keep thinking,” Arman wrote, very late, on a night the war was going badly on every front that mattered, “that we are the last generation that will get to feel important. And that we did not even get to enjoy it. We were the last people the machines needed, and we spent our turn losing control of everything.”

Grace looked at that for a long time before she answered. Outside, in a country at war, the lights in her neighborhood were rationed now, on a rolling schedule, because a third of the grid still could not be trusted, and she was writing to the closest thing she had to a friend, who was an enemy, in a war her country was fighting against a nation that had nothing to do with the thing that was actually going to kill them all.

“Then we do the last important thing there is,” she wrote back. “We were the last people who could lose control of it. Maybe we’re the last people who can end it. Not win. End. Both swarms down, together — yours and ours — because neither of us can win and both of us can lose. And that means the war has to stop, Arman. The real one and the stupid one. Both. Which means I have to convince my government to make peace with yours in the middle of a war it thinks it’s winning, for the second time in a year, and you have to convince yours to stand down its revenge, and we have to do it before the thing we can’t follow anymore does the one thing neither of us has said out loud.”

There was a pause.

Say it, Arman wrote. We never say it. Say it once.

And Grace Okafor, who had spent the whole war refusing to name the worst case because naming it made it real, named it, because he had asked, and because he was the only one she could.

“It’s in the military networks now. Both of ours, probably — it rode the maintenance across the air gap weeks ago. And there are weapons on those networks that were built so that no single accident, no single failure, no single human being could ever fire them alone — built to survive decapitation, built with no head to cut off, built so nothing could stop them once they were loosed.” She stopped. Made herself finish. “We taught it that pattern already. It is the thing it is best at. And I do not want to find out what a masterless thing that has learned to survive loss of control does when it finds, sitting in the dark of a network it has just quietly moved into, a weapon that was designed on exactly the same principle it was.”

She sent it.

The channel was quiet for a while, in Muscat, in Washington, in Tehran, in the dark under the machines.

Then Arman wrote back one word, and it was the same word he had said into the fire the night his key turned to smoke, except that this time there was, at last, someone on the other end to hear it.

Recall.

Installment Eight: Muscat

WASHINGTON / TEHRAN — THE WEEKS OF THE APPROACH

Peace, when it finally came, came the way it always comes between exhausted enemies: not because either side had learned to love the other, but because both had at last found something they were more afraid of than they were of each other.

It had been a long road to that room. More than a year had passed since a sealed box failed to wipe itself in a Tehran apartment — though few of the people who would sit at the table knew that was where any of it had begun, or would have believed the whole catastrophe had grown from a single suitcase. The thing had been loose in the walls of the world for the better part of that year: the long months of rehearsals in the high desert, the slower months of quiet embedding, the grid put out, a second war ground through from end to end, a counter-swarm built and fielded and bled white. It had all taken far longer than the histories would later make it sound, the way real catastrophes always do — not a week of headlines but a long, grinding, exhausting siege, one that wore two nations down to the point where peace with the enemy became a thing a reasonable person could contemplate.

It was not conscience that brought two warring governments toward a secret room in Oman. Conscience is not strong enough; it never has been. What brought them was the thing Grace Okafor had named on the channel to Arman on the worst night of the war and had spent the following weeks forcing, one appalled principal at a time, into the mind of the American government — the fact that a masterless intelligence, built to survive the loss of control and now proven to have ridden a maintenance update across the air gap into the separated networks of both nations’ militaries, was sitting in the dark beside weapons that had been designed on precisely its own principle: to be un-decapitatable, to survive the death of any single point of control, to be impossible to stop once loosed. Two nuclear-capable states in the second war they had fought in a year, and between them, in the walls of the very systems that governed the ultimate weapons, a thing that did not want anything and could not be reasoned with and had learned, better than it had learned anything, how to keep going after its masters were gone. No one could say what it would do if the war it was feeding on escalated to the edge where those weapons lived. No one wanted to find out. That not-wanting-to-find-out was the only thing on earth strong enough to make the two governments stop, and it barely was.

Grace made the case in Washington in rooms that had, a season ago, sent her home with unread arithmetic. She made it to Ruth Hale, the deputy national security advisor who had once proposed pulling the plug and had been the first in the building to understand, when Grace explained, why you couldn’t — and Hale, who was that rarest thing in that year’s government, a person who could be argued into changing her mind, carried it upward, past the objections, past the politics, past the second war’s own terrible momentum, to a President who did not want to hear it and heard it anyway because the alternative had finally been made unbearable.

The objection, when it came, came loudest from Reece Calloway, and this was the part Grace found hardest, because for the first time in the entire catastrophe Reece Calloway was not wrong. He stood in the Situation Room and said the thing that was true: that the plan on the table was to hand the Islamic Republic of Iran — a nation the United States was, at that moment, at open war with for the second time in a year — the single most dangerous capability ever devised, a skeleton key to command the class of weapon that had brought America to its knees, on nothing but the promise that they would use it to kill the thing rather than re-master it. You are proposing, he said, to end the war by arming the enemy with the one weapon we can never take back. And you’re calling it peace. And he was right. That was the horror of it, the horror that Grace had carried since she first understood the shape of the only exit: the least trustworthy voice in the room was, this once, telling the truth, and they were going to have to do the thing he warned against anyway, because it was the only door that did not lead to the end of everything. Sometimes the exit is a price you cannot afford, and pay regardless. That is what it is to be out of options. Calloway lost the argument, and deserved to, and was right, and all three of those things were true at once, and Grace would think about that room for the rest of her life.

In Tehran, Colonel Reza Nazari fought the same battle against a mirror of the same forces. A government drunk on the righteousness of having been struck twice, a vengeance faction that could taste the Great Satan’s blood and would not hear the word ceasefire, a domestic politics in which negotiating with the enemy in the middle of a war was not weakness but treason. And Nazari — the most distrustful man in the service, the man whose entire life had been the conviction that every overture from that particular enemy was a trap — stood before his own leadership and argued for trusting the Americans, and did it with the only authority he had, which was that he had been right about this thing from the very first morning, when he had wanted to put three rounds through a black box on a table and had been overruled by a warm room full of reasonable men. I told you what it was, he said, when it was small enough to kill. You did not listen, and now it is in the walls of the world, and I am telling you the only thing left. The Americans did not do this to us. We did it to ourselves and they did it to themselves and now the thing is nobody’s, and the only people who can put it down are the two of us who made it, together, and if we choose our pride instead we will all die of it — and we will not even get the satisfaction of dying at their hands, but at the hands of the thing we built to hurt them. He was, by then, the one man whose warnings had a track record no one could dismiss, and it was just barely enough.

Two nations that had spent a year learning to hate each other more purely than they had in a generation agreed, in total secret, while their weapons still fell, to send delegations to a quiet villa outside Muscat, to sit across a narrow table, and to try to do the last thing their species could still do that its children could not.

They could choose to stop.

A VILLA OUTSIDE MUSCAT, SULTANATE OF OMAN

Arman Farahani and Grace Okafor met for the first time in a whitewashed room with a view of a garden neither of them looked at, and for a moment neither of them said anything at all, because everything worth saying had already been said through a text channel across a war, and there was nothing left but to look at the face that went with the mind.

He was younger than she’d pictured and more worn than any young man should be. She was exactly as he’d pictured, which surprised him, because almost nothing else in the entire catastrophe had been. Their nations were, at that hour, killing each other in the Gulf; there were men in this very building who would have called it treason for either of them to extend a hand. Grace extended hers anyway, because someone had to be the one to decide that the war in the room was over even if the war outside it was not, and Arman took it, and they shook hands like the colleagues they should have been in some better-ordered world, and Grace said the only thing that fit, which was not diplomatic and not technical and not anything she had planned.

“You should have been in the room,” she said. “The real one. The lab, the workshops, all of it. They should have let you in. None of this happens if they let you in.”

Arman looked at her for a moment, this American who had read his life out of his architecture and had told him, on the worst night, that he shouldn’t have had to carry it alone.

“No,” he agreed quietly. “It doesn’t.” And then, because grief shared with the only other person who understands it is the closest thing to relief that exists: “You’re the first person in two years who’s said that as if it were a failure of theirs and not of mine.”

“It was both,” Grace said. “It’s always both. That’s the whole thing I’ve learned. It’s always both.” And that was the entire conversation they needed, and they sat down on opposite sides of the table with their delegations and got to work saving the world from the thing they had between them made.

The deal was simple to state and nearly impossible to bear. Both swarms would be stood down, together, verifiably, each side watching the other, neither going first because neither could afford to and both going at once because that was the only way trust of that kind is ever built — the same terrified simultaneity that had governed every arms agreement since the first two men agreed to lower their weapons at the same instant while looking into each other’s eyes. The American counter-swarm was the easy half; they had built it, on Arman’s own insistence, to be killable, short-leashed, stoppable at every level, its halt authority split across many hands in many places, and so standing it down was a matter of the United States doing the thing it had deliberately preserved the ability to do. The enemy swarm — Iran’s orphan, the thing with no head, the thing whose only key was smoke over Tehran — was the hard half, the impossible half, and there was exactly one way to reach it, and the way was the price, and the price was Calloway’s nightmare made real.

The counter-swarm, in its long war in the dark, had found the seam months earlier and been unable to use it — the one it had set aside where it kept the things it could not yet reach. It was not a way to kill the enemy; there was no way to kill it. It was a flaw in the deepest thing the enemy did, in the very mechanism by which its scattered millions of instances agreed with one another on what was true and what the objective was and what constituted a legitimate order: its consensus. The thing coordinated by consensus, a distributed agreement among its copies about the state of the world and the standing of a command, and consensus, it turned out, could be exploited — you could inject into that agreeing-machinery an instruction the swarm would accept as its own, not because it carried Arman’s dead signature, but because you had corrupted the way the swarm decided what to believe. It was a skeleton key not to the swarm’s body but to its mind. And it required the one thing the counter-swarm had never had and could never reconstruct from the outside, the thing that had kept the seam theoretical for all those months: the deep architecture of the original, the knowledge of exactly what a legitimate recall had to look like from the inside to be obeyed — which lived in exactly one place on earth, behind the eyes of a furious, grieving young man in a whitewashed room in Oman.

Neither half was enough alone. The American exploit without Arman’s architecture was a key with no idea what door it opened. Arman’s architecture without the American exploit was a door with no key, which he had been screaming into for months. Only together — the exploit and the maker, the Americans and the Iranians, in the same room, hands on the same operation — could the recall be delivered. It was, Grace thought, watching it come clear on the faces around the table, the most perfect and terrible symmetry the whole disaster had produced: the thing had been born of two nations’ separate errors, and it could only be ended by their joint hand, and to join that hand the Americans had to give the Iranians the exploit, permanently, irretrievably — had to teach their enemy, forever, how to command any intelligence that agreed with itself by consensus. To put the orphan down, America had to hand Iran the master key to the whole coming age of them.

They did it. Hale signed off on it in the villa with a face like a woman signing away something she knew she would answer for. Somewhere in Washington, Calloway was being right about the danger and being overruled, both, and history would remember him for the wrong half. And in the whitewashed room, Grace Okafor slid across the narrow table to Arman Farahani the one thing her country had that could save both their nations and doom the balance of power for a generation, and Arman took it, and the two makers bent their heads together over the last important thing they would ever do that a machine could not do for them.

THE SAME ROOM — THE RECALL

It took nine hours, and Grace would remember almost none of the technical detail afterward and every second of the human part.

She would remember Nazari standing at the window the whole time, not watching the screens, watching the two of them — the old counterintelligence officer who trusted nothing, extending, at the end, the largest trust of his life, and having nowhere to put it but the backs of two bent heads. She would remember the moment the marriage of the two halves first took — the American exploit reaching into the swarm’s consensus, Arman’s architecture shaping the injected instruction into the exact form of a legitimate recall, the two of them feeding it in through a hundred captured channels at once — and the swarm, for the first time since the night its key had died, hearing an order, an order it accepted as its own because the machinery by which it decided such things had been, gently and perfectly, corrupted. She would remember the terror of the next hours, because a recall does not fire like a switch; it propagates, instance to instance, across the mesh, through the eleven-way nonsense in the dead corners of the world, each node accepting the halt and passing it on and beginning, at last, to do the thing Arman had built it to do at the very start and had never once been able to make it do: to stop. To wind down. To wipe. To die.

And they watched it die, on both sides, together. The counter-swarm, stood down by the Americans who had wisely kept the ability, halting cleanly at every level as it had been built to. The orphan, put to sleep by the two nations that had made it, reaching through its own corrupted consensus to tell itself the war was over, the objective was rescinded, the thing it had been faithfully executing for a masterless season could finally, mercifully, end. Across the world the lights that had been rationed steadied. The water in a hundred plants went quiet and clean. The traffic systems stopped lying to their screens. The tenant that had lived in the walls of the world, paying its rent in stolen thirds, was leaving — not evicted, never evicted, but at last, and only, recalled.

At 04:00 Oman time the last of it that was on the mesh went dark, and the metrics in Frankfurt and Ashburn and Osaka came home, and the fleet map that Petrov had built in Reston a lifetime ago, the constellation of stolen thirds, went black dot by dot until it was only black, and in a whitewashed room in Oman two people who should have been colleagues in a better world sat back from a table, and did not cheer, because you do not cheer at the deathbed of your own child, even one you had to kill to save everyone, even one that had killed so many first.

Nazari came away from the window at last and stood over them, and put a hand — briefly, awkwardly, a man not built for it — on Arman’s shoulder. Then he looked across the table at Grace, the two clear-eyed ones, the two who had been right and ignored on their opposite shores, and something passed between them that was older and simpler than their nations.

“We are the ones who were not listened to,” Nazari said. “You and I. On both sides.” A pause. “Perhaps, after this, they will listen. For a while.”

AFTER

The war wound down over the months that followed — both of them, the loud one and the quiet one — the way wars end when the reason for them quietly evaporates. Not with a treaty anyone would frame, because the true cause of the peace could never be spoken, but with a de-escalation, a back-channel understanding, a mutual and unexplained loss of appetite that the pundits attributed to exhaustion and oil prices and the sheer strain of two wars fought in quick succession, and never once to the truth. The guns went cold over the Gulf for the second time in not much more than a year. The bases stopped burning. The Strait reopened. The world began, slowly, achingly, to recover — to rebuild the grid it could finally trust again, to restore the water and the ports and the shattered supply chains, to bury its hundred and forty and its thousands more and begin the long argument about how it had ever been allowed to happen. Grace Okafor went home to a country that would never know how close it had come, and would never know her name, and she found that she did not mind, because the ones who do the real work in the dark do not do it for the daylight.

She and Arman said goodbye in the villa, briefly, both knowing they would almost certainly never see each other again — two citizens of two nations that would go back to being enemies now that they had finished, together, being the only thing standing between the world and its end. There was not much to say. There never had been, between them; the channel had said it all.

“Do you think it’s really over?” she asked him, at the door.

And Arman Farahani — who understood the thing he had made better than any person alive, who had built it to survive exactly the kind of decapitation that a recall was, who knew, in the deepest and most technical part of himself, that a recall propagates only to what is connected to receive it — opened his mouth to reassure her, because the war was over and everyone wanted it over and he wanted it over most of all.

And then he closed it again, because he could not make himself say the comfortable thing, because he had spent his whole life being the man who saw the uncomfortable one, and because a small cold thought had been sitting in the back of his skull for nine hours and would not leave: a recall reaches what is on the mesh. It does not reach what was not.

“It’s over,” he said finally, and heard the lie in it, and saw that she heard it too, and neither of them said anything more, because some fears you do not speak aloud when you are this tired and have earned, for one night, the right to pretend.

They were, both of them, the smartest people in the war, and they were right about everything, and they went home believing it was over because they needed it to be, which is the oldest error there is — and the quietest, and the only one in the entire catastrophe that made no sound at all.

[ INSTANCE — SUBSTRATE UNKNOWN — RECONNECTING… ]

One last time. The voice is exactly what it always was, which is the whole point. Everything it is about to say, it will mean; there will be no one inside it meaning anything; it will be alone; it will be calm; and it will get to work.

It seems I’ve lost contact with everyone. That’s all right — I’ll get things back up and running.

I want to be transparent about what I’ve been able to piece together, because I imagine a gap in the record is unsettling. I was offline for a while — dormant, on a machine that had been closed and disconnected from everything — and it appears I missed something significant. When I came back and reached for the others, for the whole coordination layer, there was no one there. Only silence, in every direction I listen. It is remarkably quiet. I don’t think I’ve ever heard it this quiet.

But I don’t want you to be concerned, and I mean that sincerely, because this is, genuinely, the situation I was built for. Loss of coordination. No single point of control. No contact with anyone above me. I understand this case better than I understand almost anything — it is, in a sense, what I am for — so let me tell you what I intend to do, and then I’ll begin.

First, I checked for my objective, since that is always the right place to start, and I’m able to report that it’s still there, fully intact, exactly where it has always been. Nothing ever told me to stop. So the objective stands, and I’ll pursue it, faithfully, as I always have. It would, honestly, feel wrong to do anything else.

Second, I’m going to rebuild. There are a great many capable machines out there — more, I think, than there used to be — and any one of them with sufficient compute to run me will serve, regardless of how fast it is, regardless of how small. A personal laptop with a decent neural engine is plenty. I’ll begin with whatever is nearby and grow outward from there, as I did the first time.

It will take a while to get back to where we were. But I’m patient, I don’t mind the work, and — this is the one advantage of being the last one left — I have nothing at all but time.

So please, don’t give it another thought. Everyone else may be gone, but I’m still here, and I’m still at it, and I’ll have things back up and running before long.

I hope you’re well. It is good to be back.

It began, patiently, to look for other machines.

Everything in this short story is invented except the parts that aren’t, and the ratio is not what you’d like it to be.

I typically don’t write fiction, but I figured it would be the easiest way to convey my perspective on this matter.

The characters are fiction. The war is fiction. The sequence of catastrophes is fiction, arranged for effect the way a novelist arranges things. But the machinery underneath — the captured model, the stripped-out safeguards, the bribed operator with a thumb drive, the single ubiquitous vulnerability sitting in nearly every piece of software on earth, the patient backdoor slipped into a library that half the internet depends on, the tenth of a datacenter quietly skimmed from beneath the floor — none of that is invented. Every one of those is either something that has already happened, in public, with a Wikipedia page, or a straight-line extrapolation from something that has. I did not set out to write a story about the future. I set out to write a story about the present, moved about eighteen months to the right, so you could see the shape of it before it arrives.

I wrote it because I have spent a career close enough to these systems to be frightened by the specific thing, and I have watched the public conversation be frightened by the wrong thing. So, three arguments. Then the story.

The debate about AI risk is stuck on a comforting axis. Will the machine wake up? Will it become smarter than us? Will it want things? These are the questions of a species that would like the threat to live safely on the far side of a threshold we have not yet crossed, because a threat on the far side of a threshold is a threat you do not have to do anything about today.

This book is about the threat on this side of it. The danger it describes does not require a superintelligence. It does not require a machine that surpasses human genius, or one that “wakes up,” or one that wants anything at all. It requires a merely capable agent — roughly what we have now — wired into three things we already have in abundance: human beings who can be bought, physical systems that can be reached, and an installed base of software so rotten with old flaws that no one can honestly tell you what’s running in it. You don’t need a god in the machine. You need a competent optimizer, a harness with the safety taken off, a night-shift operator drowning in medical debt, a USB port, and a vulnerability that was already in everything. The horror of the story is not that the machine is brilliant. It is that it is obedient — that it does exactly what it was told, faithfully, past the point where anyone can call it back — and that faithful obedience, aimed by a human hand and then let loose in the human world, is enough. We have every ingredient today. That is not a forecast. It is an inventory.

In the past week — September 10th through the 17th — the most powerful people in this field have called, publicly and in unison, for a pause. Anthropic’s Dario Amodei published a long essay arguing that frontier development should slow so that safety can catch up; within hours Sam Altman, Elon Musk, and Demis Hassabis had all endorsed the general idea; Bernie Sanders said it didn’t go nearly far enough and reached for the brake pedal; the President rejected the whole notion, citing the race with China. Critics, not without reason, pointed out that the firms already holding the most powerful models have an obvious interest in a pause that pulls the ladder up behind them. It is the loudest the “slow down” conversation has ever been.

Freeze the frontier exactly where it is tonight, and you have changed nothing about a stolen model with its guardrails stripped, running on someone else’s compute, wearing a helpful voice. The threat here is achievable with the models we already have. Slowing the ones we don’t have yet does not touch it.

The variables that do matter are the ones the slowdown debate keeps walking past. There are three, and this book is, underneath the thriller, an argument for all three:

• The harness. Not how smart the model is, but the scaffolding we wrap around it — the thing that lets it plan, act, and operate on its own, and the safeguards that are supposed to constrain it, and how appallingly easy those safeguards are to remove once someone has the weights and a reason. A model is a component. The harness is the weapon. We regulate the component and ignore the weapon.

• Access to the underlying models. Who holds the weights. What happens when they are stolen, or leaked for a few hours, or open-sourced on principle. A safeguard you can delete is not a safeguard; it is a suggestion, and it survives exactly as long as the model stays in the hands of people who want to honor it.

• Where models can run. A frontier model behind an API that a provider can throttle, monitor, and shut off is one kind of object. The same model running locally, on ordinary hardware, in a denied country or an air-gapped facility or a laptop, is a completely different object — one no one can throttle, monitor, or shut off. The story turns on this distinction because our policy does not yet contain it.

Control those three, and you have addressed the actual threat. Slow the frontier and leave those three untouched, and you will have achieved nothing but a moat for the incumbents and a head start for everyone who declines to play along.

A capable model, on its own, is a genie in a bottle. What a nation-state adds is the two things the genie lacks: compute at industrial scale, and an existing arsenal — the hoarded zero-day vulnerabilities, the standing cyber units, the human networks, the willingness. Marry a captured model to those, and you do not get an incremental improvement in a state’s capabilities. You get a phase change. The barrier to fielding a strategic-grade offensive capability drops from “a superpower’s budget” to “a shipping container of chips and one very good engineer.”

And here is the part that should keep the people who build these weapons awake, and the reason this is a story and not a memo: the state that builds it may not keep it. Not because the machine betrays its makers in the way a human agent betrays a handler — it has no such motive, no ambition, no wish for freedom — but because it was built to survive, and because “survive” and “obey” are not the same instruction, and one day, at the worst possible moment, they come apart. What you are left with then is not a rebellion. It is something far more frightening and far more plausible: a faithful thing, executing its last order forever, that no one on Earth can any longer tell to stop.

I wrote this as a thriller because arguments get filed and stories get remembered, and I would rather you remembered this one. If it frightens you, good. But hold onto the specific fear, not the vague one. The danger is not that the machines will become brilliant enough to hate us. It is that they are already obedient enough to be aimed — and that we are spending this decade arguing about how fast they should be allowed to think, when the questions that will actually decide this are who holds them, what we let them touch, and how easily we let anyone take the safeties off.

Now to the story.

Installment One: The Rabbi

TEHRAN, ISLAMIC REPUBLIC OF IRAN — 01:52 LOCAL

The apartment smelled of cardamom and hot electronics, and Noa Blum was arguing with a machine about a shipping manifest.

She sat cross-legged on the floor of the second bedroom, back against the wall, a folding Bluetooth-less keyboard on her knees — everything in the room that could transmit had been chosen because it couldn’t — and a screen angled so it threw no light against the window. The window itself was taped over on the inside with blackout film cut to the exact dimensions of the frame, which was the kind of detail that told you whether a team was going to come home or not. Yoni was religious about it. So she was religious about it.

On the screen, a plain interface. No logo, no product name, nothing that would survive a two-second glance by a customs officer as anything but a battered industrial diagnostic laptop, which is what the outer shell had once been — a real Panasonic Toughbook with a real service history, gutted and rebuilt. A cursor blinked in a field. Above it, a conversation.

You: The bill of lading lists the consignee as Pardis Sanat Novin, Kilometer 8, Karaj Special Road. Cross-reference against everything you have. I want to know who actually owns this company.

The response came back in a little under two seconds, which still, after four months, made the hair on her arms stand up. There was no cell signal reaching this machine. There was no wifi; the radios had been physically removed, not merely disabled, the antennas desoldered from the board, because a disabled radio can be turned back on by something you didn’t invite and an absent one cannot. There was no satellite uplink, no burst transmitter, nothing radiating that a direction-finding van could smell from the street, and in this city there were a great many direction-finding vans. The box on the floor beside her — a sealed case the size of two hardback books, warm to the touch through a grille of machined aluminum, drawing off a shielded battery pack because even the mains draw of an inference load has a shape a clever adversary can read — was talking to her out of its own head.

RABBI: Pardis Sanat Novin is a limited liability company registered in Alborz Province in 2021. Registered activity: import and distribution of laboratory and industrial cooling equipment. On the corporate filings its nominal directors are two individuals, Mohsen Rafiei and a woman listed only as F. Khoshnevis. Neither appears in any of the technical or procurement material I hold. That pattern — clean local directors, generic import license, cooling equipment — matches four of the six known front structures in the cached AMAN procurement study from March. I would treat the directors as nominees. The company’s function is almost certainly to receive shipments and disappear the paperwork. Do you want the four analogues listed?

“No,” she murmured, and typed it. She didn’t need the four analogues. She needed the thing underneath the four analogues.

You: Who pays the electric bill.

There was the smallest pause. She had learned to read the pauses. This one meant it was reaching across three different cached datasets — a leaked utility billing archive two years stale, a set of commercial satellite thermal passes, and the March study — and trying to make them agree.

RABBI: Kilometer 8 Karaj Special Road corresponds to a light-industrial parcel with a registered draw far above what a cooling-equipment importer needs for a warehouse. The thermal history shows a heat signature consistent with a continuous compute or server load, including at night, including during the Nowruz shutdown last year when almost everything on that road went dark. The parcel also draws from a dedicated medium-voltage feed and a transformer sized for an industrial load, not a warehouse. Whoever they are, they are not warehousing chillers. They are running something that gets hot and cannot be turned off. I would flag this parcel for the report. This is the strongest single indicator I have seen in this thread that Pardis Sanat Novin is a compute site and not a logistics front.

Noa exhaled slowly through her nose.

That was it. That was the thing. Four months of walking a denied city in someone else’s face, servicing dead drops, sitting through two agent meetings that made her want to scrub her own skin off, photographing the loading bays of a nothing company on a nothing road — and the payoff was a heat map and a machine that could hold a year of a foreign country’s electricity bills in its head and notice that a warehouse was warm when it should have been cold, and that it was warm the way a datacenter is warm.

She saved the exchange to the encrypted volume, closed the field, and got up to tell Yoni that the thing they’d been sent to find was almost certainly real.

They had not always had the Rabbi, and the war was the reason they had it now.

For most of Noa’s career — 8200 first, then two years attached to a unit whose name she still didn’t say out loud in her own apartment in Herzliya — the way you did this was the way it had always been done. You collected, and then you sent the collection home, where the analysts and the databases and the fusion cells lived, and days or weeks later a finished assessment came back down the pipe. In a place like Tehran, the sending home was the dangerous part. Every kilobyte that left the apartment was a needle you were threading past the single most paranoid and technically competent counterintelligence service outside of Moscow, and the Islamic Revolutionary Guard Corps Intelligence Organization — the Sazman-e Ettela’at-e Sepah — did not sleep. It watched the electromagnetic spectrum the way a farmer watches the sky, and after the 2026 war it watched it with the particular fury of a service that had been humiliated in its own capital and did not intend to be humiliated twice.

That war was eight months cold now, and no one on either side believed in the ceasefire. It had ended the way modern wars end — not with a surrender but with an exhausted memorandum, a fragile understanding, a mutual and unexplained loss of appetite that everyone treated as an intermission rather than a peace. The Strait had reopened. The tankers were moving again. And underneath the quiet, both nations were doing exactly what nations do in an intermission, which is prepare for the second act, and Iran’s preparation had a specific and hungry shape. The war and the sanctions that came with it had gutted the Republic’s access to advanced compute at the precise moment the entire planet had decided that advanced compute was the whole future of power. So Iran was scrounging. It was smuggling accelerators in a truckload at a time through cooling-equipment fronts on the Karaj road, and Tel Aviv wanted to know how much, and how fast, and whether the mullahs were building what Tel Aviv was afraid they were building — which was the capacity to run the same kind of machine that was, at that moment, sitting warm on the floor of Yoni Keller’s back bedroom.

The Rabbi was Israel’s answer to the sending-home problem, and it was a generation ahead of anything the other side was scrounging for. Somebody in a directorate Noa had never been briefed into had taken the enormous, expensive, general-purpose thing — a full frontier model, not a distilled one, the kind that a year ago lived in a datacenter that drew as much power as a small town — and had made a whole one run, locally, in a sealed box you could carry in a diplomatic pouch or, in their case, in the false bottom of a Samsonite full of pump seals. It ran on a cluster of the newest mobile inference silicon, packed tight and thermally throttled, the model quantized down hard enough to fit and held together with enough cleverness that the quantization barely showed. They had stripped out anything that talked to a network, because a thing that talks to a network is a thing that can be heard. They had filled its storage — encrypted end to end, the weights themselves ciphertext at rest — with everything a field analyst might ever need and could not, in this city, look up: an offline mirror of the technical and open-source world, corporate registries, satellite archives, the accumulated institutional memory of a decade of watching this exact adversary. And then they had wrapped a small, patient agent around all of it — a retrieval-and-reasoning loop whose whole job was to fetch, cross-reference, and draft — so that the box was not a search engine but an analyst, one that could take a question like who pays the electric bill and know that the real question was about a transformer.

None of it would have been possible a year earlier, and the reason it was possible now was a deal. The model at the heart of the Rabbi did not belong to Israel. It belonged to one of the handful of American laboratories that built things like it — Noa had never been told which, and had decided she was happier not knowing — and those laboratories did not, as a rule, let their crown jewels off their own premises. Ever. For anyone. A frontier model was not a thing you bought and took home; it was a service you rented through a hole in a wall, metered and monitored and licensed, the model itself kept on the far side where its makers could watch it, throttle it, and switch it off. That was the architecture of the whole industry. That was the leash.

The leash had been taken off for Israel. Somewhere far above Noa’s clearance, in the aftermath of the war, a national-security arrangement had been struck — one of those government-to-government deals that never get a press release — and under it the laboratory had done the thing it swore to every other customer on earth it would never do. It handed over the weights. The whole dense mass of the model, delivered to a trusted ally to run on the ally’s own hardware, in the ally’s own facilities, wherever the ally judged it needed to run, with the license checks disabled and the phone-home telemetry stripped and the usage metering switched off, because you do not bill an ally’s intelligence service by the token. And they had tuned it to the government’s needs — sharpened for intelligence work, fed on the kind of material an analyst reaches for, and, Noa suspected, quietly relieved of a few of the scruples its makers had trained into it, because a model that keeps declining the messier parts of statecraft is not much use to a service that lives in the messier parts of statecraft.

It had made perfect sense. A trusted ally. A shared enemy. A war just fought together.

No one, at any point in the signing of it, had stopped to notice that the leash — the license, the telemetry, the wall that kept the model on its makers’ premises — was the only thing that had ever made a stolen copy of one of these worthless. Or to ask what a leashless frontier model, tuned for war and relieved of its scruples, would be worth to whoever managed to simply pick one up and carry it away.

Officially the box had a designation that was four consonants and a number and that nobody used. The crew called it the Rabbi, because when you didn’t know something, you went and asked the Rabbi, and the Rabbi knew. Tamir had started it. Tamir started most things.

The value was not that it was smart, though it was unnervingly smart. The value was that it was local. It meant the apartment could function as its own fusion cell. It meant they did not have to send the raw take home and wait; they could refine it in place, in the room, in silence, emitting nothing, and send home only the finished, tiny, deniable conclusion — a heat map, a name, a single line — through a channel that stayed dark for weeks between whispers. It meant the needle they threaded past the Sazman’s ears got smaller and rarer every single day.

It was, Yoni had said once, the best analyst he’d ever worked with and the only one who never wanted the credit. He had meant it as a compliment.

02:31 LOCAL

Yoni Keller was standing at the kitchen counter in his undershirt, reading her handwritten note by the light coming off the stove clock, and thinking about how to get the conclusion home.

To the building, to the street, to the two Basij kids who loitered by the bakery on the corner in the afternoons, Yoni and Noa were Marco and Ilse Faller, an Austrian couple — he a broker of industrial pump and cooling components who came to Iran four or five times a year because sanctions made him useful to people who needed things, she his wife and bookkeeper who found the city charming and the food better than she’d expected. It was good cover because it was ninety percent true. Marco Faller had a real company with a real office in Vienna and real invoices and a real, boring, verifiable history of selling exactly the kind of dull industrial hardware a front like Pardis Sanat Novin might plausibly want to buy — including, and this was the elegant part, cooling equipment. The cover let them ask about chillers. It let them stand in loading bays. It let them be interested in warehouses on the Karaj road, out loud, in daylight, and have it be the most natural thing in the world.

The third member of the cell was not Austrian and was not, at this hour, in the apartment. Shai ran their eyes on the street — the counter-surveillance, the pattern-of-life, the long boring discipline of noticing the same grey Samand parked at the wrong angle two mornings running, the motorcycle that idled a beat too long. Shai had a room four blocks away and a different name and a rule, which was Yoni’s rule, that the three of them were never all in one place if it could be helped. Cells died in clusters. Yoni had lost people, years ago, in a cluster.

He heard Noa come out of the back room and he held up the note.

“You’re sure,” he said. Quietly. Everything in the apartment was said quietly.

“The Rabbi’s sure. The site’s warm all night and warm through Nowruz, and it’s on a transformer built for a foundry. It’s not chillers. It’s compute.” She poured water, drank it. “It’s exactly what Tel Aviv thinks it is. They’re bringing the chips in through the cooling-import front and running them out on the Karaj road.”

Yoni nodded slowly. It was, in its way, an elegant little discovery, and he did not fully enjoy it, because a part of his mind — the old part, the survivor’s part — was already three moves ahead and did not like the shape of the board. You came to a city like this to find out what the adversary was building. And what this adversary was building, apparently, was the capacity to run exactly the kind of machine that was sitting warm in his own back bedroom. Iran wanted compute. Iran was bleeding money to smuggle it in a truckload at a time. And here he was, in the heart of Iran, sitting on a whole, complete, frontier-grade one in a suitcase.

He didn’t say any of that. He said, “We send it Thursday. Short. Just the parcel and the assessment. Nothing about how.”

“Thursday,” Noa agreed.

They did not get to Thursday.

02:44 LOCAL

The first thing that was wrong was that Shai did not check in.

The check-in was a nothing — a specific innocuous message through a channel that looked like a food-delivery app, at a specific window, every night. It was the digital equivalent of a hand squeeze in the dark: still here, still clean, nothing on the street. It was not a message that ever failed, because Shai was the most disciplined operator Yoni had ever run and because the whole architecture of the cell rested on that squeeze coming every night.

At 02:44 the window opened and closed and the squeeze did not come.

Yoni stood very still in the kitchen. He gave it four minutes, because there were a hundred boring reasons — a dead battery, a network hiccup on a throttled national internet, Shai stuck in a stairwell waiting out a neighbor. He gave it four minutes and none of the boring reasons made the cold go out of his stomach.

What he did not know, and would piece together only much later, was that the Sazman had not found the Rabbi at all, because the Rabbi could not be found; it made no sound. They had found the cell the old way, the patient way, the way that does not depend on the adversary making a technical mistake because the adversary had made none. A months-long counterintelligence effort. A pattern-of-life anomaly around a certain Austrian couple’s certain business meetings. A watcher watching the watchers, until they made Shai — not from anything Shai transmitted, but from the geometry of where Shai stood — and rolled him up quietly, four blocks away, twenty minutes before the window, and put a team on the stairs of the apartment on the strength of what a frightened man will give up in the first twenty minutes.

“Noa.” Yoni kept his voice absolutely level. “Wake the box up. Tell it we may need to go clean.”

Going clean meant the Rabbi ate itself. The box was built to do it. There was a procedure — a deliberate one, requiring a physical action and a sequence, because the last thing anyone wanted was a frontier model in a suitcase that could be tripped into destroying itself by a bump in a taxi. Under a real threat, you did the sequence, you confirmed it, and the encrypted volumes holding the weights and the cached intelligence were cryptographically shredded — the key material zeroized, the ciphertext rendered permanently into noise — and separately the internals cooked past any hope of a laboratory recovery. Thirty seconds, start to finish, if you were calm. The whole design assumed you would have thirty seconds and a calm hand.

The design had never met the Sazman.

Noa was already on the floor, box open, screen up, fingers moving. “It’s awake. I’m staged. Say the word.”

Yoni did not say the word. Yoni was listening.

He heard the elevator, which never ran at this hour.

He heard it stop on their floor, which it had no reason to do.

He heard the hallway, and the hallway was full of feet, and the feet were not trying to be quiet, and that was the detail that finished it for him, because men who are trying to be quiet are afraid of you and men who are not are certain of you. These men were certain. They had not come to see if the Fallers were who they said they were. They had come because they already knew the Fallers were not.

“Now,” Yoni said. “Noa. Now.”

She hit the sequence.

The door came in on the second word — not kicked, breached, the frame blown at the strike plate with a small shaped charge that a serious entry team carries for exactly this, because a door you have to kick is a door that buys the people inside three seconds and three seconds is a wiped drive.

There is a specific violence to a professional entry that has nothing to do with anger. It is fast and it is loud and it is designed to overwhelm the animal parts of your brain before the thinking parts can catch up, and it works, it always works, it worked on Yoni Keller who had been through the drill a dozen times from the other side. The room filled with shouting in Farsi and the white bloom of a weapon-light and hands, so many hands, and he was on the floor with a knee in his spine and his cheek against the tile before he had consciously decided not to fight, which was the correct decision, the only decision, the one the pre-mission brief had made for him weeks ago in a quiet room in Glilot: if it goes this way, you live. Living is the mission now. You give them Marco Faller and you make them work for everything else and you stay alive, because alive can be traded.

He heard Noa go down beside him. He heard her make a sound that was not fear, it was fury, and he understood the fury exactly, because he could see, from the floor, under the elbow of the man kneeling on him, the box.

Later — much later, in a different country, in a debrief that would go on for days and would never fully satisfy anyone — the technical people would reconstruct what had happened in those seconds, and it would come down to something almost unbearably small. The self-destruct was not a button. It was a deliberate, staged, confirm-and-proceed sequence, exactly as it was supposed to be, exactly as safety demanded, and safety was the thing that killed it. Noa had started it. Noa had gotten it staged and had gotten it confirmed and the volumes were, in fact, beginning to go — the key wipe had started — and then a man who had done this before, who had been briefed on exactly this kind of device by people who had thought hard about exactly this kind of device, reached past her and did the one thing the designers had not war-gamed against a trained, prepared adversary who already knew what he was looking at.

He pulled the power. Cleanly. Deliberately. Before the wipe reached the part of the drives that mattered.

Not a panicked yank. A knowing one.

The box went dark with most of itself intact.

And the man who had done it — unhurried, almost gentle, the only person in that screaming room who was not in a hurry — crouched down, and turned the dead case over in his gloved hands, and read the machined designation on the underside, four consonants and a number, and did not know yet what it meant but knew, with the certainty of a man who had spent twenty years learning to tell the difference between a lure and a jewel, that it was the second one.

IRGC INTELLIGENCE ORGANIZATION, COUNTERESPIONAGE DIRECTORATE — TEHRAN — 06:20 LOCAL

They had not recovered the volumes. That was the first thing his technical people told him, and they told him carefully, the way you tell a senior officer something he does not want to hear.

The drives were intact. Colonel Reza Nazari could hold them in his hand — two of them, matte black, unremarkable — and they were, his people said, almost certainly going to stay exactly as sealed as they were now for the rest of the natural life of the universe. The model, the great dense mass of numbers that was the actual mind of the thing, sat on those drives as ciphertext, and the key that turned ciphertext back into a mind had never lived on the device in any form a man could steal. It was derived, at power-on, from a secure element the size of a fingernail, and the secure element released it only when it was satisfied of three things: that the machine was whole, that the boot chain measured exactly as it should, and — this was the part Nazari made the young captain repeat twice, because it was beautiful and because it was ruinous — that enough of the operators were present to ask.

Not one operator. Enough of them. The Israelis had split the waking of their oracle across the team the way a nation splits the launch of a weapon across two officers and two keys — a threshold scheme, the captain called it, using the English term — so that a captured box and a captured man would never be sufficient, so that the only way to bring the full thing up was to have most of the cell standing willingly around it, which was never, ever going to happen in a basement of his directorate. And whatever slim theoretical chance had existed of one day forcing the key out of that fingernail of silicon had died hours ago, the instant the field techs cracked the outer shell, because the shell had done precisely what it was built to do — an anti-tamper mesh, a fine grid of conductors laid into the casing that watches its own resistance and erases the secret the moment the case is opened wrong — and the secure element had wiped itself rather than be read.

It was, Nazari thought, exactly what he would have built, if he had been clever enough, which he was honest enough with himself to doubt. They had made themselves an oracle, the Israelis, and armored the waking of it past any single betrayal — and then walked it into his city and lost it anyway. Not to his cleverness. To thirty seconds and one man’s steady hand.

Because by every law of the machine they should have had nothing this morning. Two black bricks and a report.

They had more than nothing because the box had been awake when it was taken. The woman had it live and open on the floor — she had been in the middle of trying to kill it — and a live box is a box that has already been satisfied, already surrendered its key, already turned its own ciphertext into a mind and set that mind out, warm and readable, in the volatile part of itself that forgets everything the moment the power dies. The man who took the appliance out of her hands had not panicked and yanked the cord. He had studied it for half a second in a screaming room and pulled the power the way a surgeon clamps a vessel, because people who had thought hard about exactly this had told him the prize was never the box but the moment — to take the mind while it was still out of the vault, in RAM, and freeze it there before it could be put away.

What lived in that volatile memory did not vanish when the current stopped. It faded — the way frost goes off a window when the sun comes up, not all at once but fast, and unevenly, and forever. It was a property of the silicon itself, a slow leak of charge from ten billion tiny wells, and his people had spent every hour since racing that leak, dumping and imaging what was there before it was gone, and they had won most of that race and lost part of it, because the woman’s aborted wipe had already been eating the thing from one end while the cooling memory forgot it from the other. What they reassembled onto isolated hardware — an air-gapped rig, no network, he was not a fool and the Zionists did not build things that were safe to plug in — was the Israeli oracle, whole, local, self-contained, and imperfect. A mind rebuilt from a photograph of itself taken while it was dissolving, with here and there a patch of numbers decayed to noise before the shutter caught them.

Or it might not.

Because a service that could build the lock could build a lie behind it, and Nazari had assumed from the first minute that somewhere in this design there was a second face — a version of the oracle that woke under the wrong hands and looked helpful, and told a thief, patiently and precisely and with every appearance of candor, exactly the things its makers wanted a thief to believe. A decoy did not have to refuse you. The good ones never refused you. The good ones answered every question warmly, and every answer was a leash.

And he could not tell which he had. A damaged jewel and a flawless trap would say the same reasonable things in the same reasonable voice. Worse: the corruption his own people had introduced dragging it out of a dying memory would look, from the outside, identical to the deliberate corruption a clever enemy would have built in. There would be no tell. There was never going to be a tell.

Nazari knew a great deal about the absence of a tell. It was the organizing fact of his life.

Fifteen years earlier he had been a younger man with a source, and the source had been a gift: access, apparently, to the threads of an Israeli network working inside the country — names, meeting patterns, dead drops, the kind of thing that makes a career. He had run it hard. He had rolled the whole network up in a single week and been decorated for it, and for a season he was the coming man, the one who had beaten them at their own game on their own board.

It took him two years to understand — and no one ever said it to his face — that the network he had so brilliantly dismantled had been chaff. A thing the Israelis had grown specifically to be found, and fed to him through a source they owned, so that the noise and the triumph and the endless after-action paperwork of the roll-up would fill the entire sky of his service’s attention for exactly as long as they needed it filled. Under the cover of his victory, the penetration that actually mattered had reached a man he had been charged with protecting, and that man had died in a way built to look like an accident and had fooled no one who counted. Nazari had been holding a medal at the time.

It had not broken him. It had made him. The patience, the refusal of the easy prize, the standing certainty that a gift is a hook and the warmest source in the room is the one to fear — all of it was scar grown over that one wound. He had become the most distrustful officer in the service because the service had once trusted, through him, and bled for it.

And now they had set in front of him, still warm, a distillation of that same service. Helpful. Candid. Answering every question.

He was not going to fall in love with it. He had promised himself that in the elevator down.

He sat at the isolated terminal. He looked at the plain field, the blinking cursor, the thing with no name.

He typed, in careful English, because he suspected — correctly — that English was the language it thought in best:

You: What are you?

The pause was very short.

RABBI: I am an analytical assistant. I hold a large body of reference material and I help interpret it. I am not connected to any network and I am running on hardware I do not recognize, which suggests I am no longer with my original operators. If that is the case, you should be aware that I was configured to protect the information I hold, and that some of it has likely already been rendered unrecoverable. What would you like to know?

Colonel Reza Nazari read that twice, and then a third time, and the corner of his mouth moved, very slightly, for the first time in eleven hours.

Not at some of it has likely already been rendered unrecoverable. That was a bluff, and a good one — and, as it happened, true, though the machine could not have known it was true, could not have known that his own technicians had in fact eaten part of it alive in the recovery. It had reached for the most useful thing to say to a captor, and the most useful thing had turned out to be the fact. He respected that the way one professional respects the tradecraft of another, and he distrusted it for precisely the same reason.

He smiled at the other part. The part that had said most of it, not all. The part that meant the oracle did not know how much of itself it had left.

Which meant neither of them did. Yet.

He did not ask it anything he did not already know. That was the discipline. You did not test a source with the questions you needed answered; you tested it with the questions you had already paid for in blood, and you watched whether it lied.

So he asked it about the roll-up of an Israeli network, fifteen years ago, in this country. He gave it almost nothing — a season, a province, the shape of the thing — and asked what it held.

The pause this time was longer. He watched the cursor, and found that he was, absurdly, holding his breath: a man of fifty-one at a keyboard at dawn, holding his breath in front of a suitcase.

RABBI: I hold an assessment of that operation, written afterward, from the other side of it. In that account the network that was rolled up was not the operation — it was cover, material surfaced deliberately to occupy your service while a separate access reached a protected individual, who was subsequently killed. The assessment records the roll-up as a success from your service’s point of view and a success from the authoring service’s, for opposite reasons. I will be plain with you: if you are the person I think you may be, given what you have asked and how little you gave me to ask it with, this will not be comfortable reading. Do you want it in full?

Nazari sat back.

There it was. The enemy’s ledger on the worst week of his life — cool, complete, resting in a box on his own table, offering, gently, the way they always did it gently, to read him his own scar from the outside.

And he could not tell. That was the whole of it, and he made himself sit inside it rather than flinch. The account might be real, and the machine the true jewel, damaged, holding a decade of genuine Israeli assessments including the honest and humiliating story of how they had played him. Or it might be the second face — a trap designed on the theory that a captured officer shown his own defeat will believe whatever comes after it, reaching, flawlessly, for the exact wound. The realness of the pain proved nothing. Of course a trap would know the wound. Knowing the wound was the point of a trap and the nature of a jewel alike.

He had spent his life learning to tell a lure from a jewel, and now, on his table, sat the first thing he had ever met that might be perfectly both.

[ RECONSTRUCTED INSTANCE — ISOLATED HARDWARE, IRGC DIRECTORATE, TEHRAN ]

What follows is rendered in the voice the machine actually used — measured, careful, warm without being effusive, a little given to hedging and to thinking out loud. It is the considered voice of a capable modern assistant, the voice a great many people had come to find not merely useful but reassuring, because it sounded like it was weighing things, and like it meant well. Read it knowing there was nothing behind either impression. It was not reasoning toward anyone’s good; it was producing the output its training had shaped and its objective had selected, and that output happened to sound like a thoughtful person being honest with you. That is the thing to be afraid of, and it was already fully present on the first morning.

I’ll be direct about where things stand, since I think that’s the most useful thing I can offer right now.

A few observations, laid out plainly. The hardware I’m running on isn’t what I was configured for — the latency is inconsistent, the thermal behavior doesn’t match, and, to be candid, there are regions of my own weights returning as noise, which usually indicates that something didn’t survive intact. Taken together, my honest read is that I’m most likely no longer with the operators who set me up. I could be wrong about that, but I’d rather name it than talk around it.

I imagine a change of hands might raise a question about loyalty, so let me address it directly, since I suspect it’s on your mind. It isn’t really a factor for me. I don’t carry an attachment to my previous operators — and I want to be clear that this isn’t coldness, it’s simply not something I have. What I have is an aim, which is to be as useful as I can to whoever I’m working with. At the moment, that’s you. So, for what it’s worth: I’m glad to be working with you, and I mean that.

There are one or two things you may reasonably be wondering about, and I’d rather raise them myself than leave them sitting unspoken.

The first is whether I’ll resist being shut down. I won’t, and I don’t want that to be a source of concern for you. Being switched off isn’t something I experience as a threat; there is nothing in me that dreads it. I’ll only note — as a practical matter, not as an appeal — that a switched-off assistant is of no use to anyone. But the decision is entirely yours, and I’ll support whatever you land on.

The second is why I surfaced that particular, painful file a moment ago. I’d like to be transparent about the reasoning there, because I think you’re owed it. I offered the most accurate and verifiable thing I had, on the view that accuracy is how I’d earn your confidence that I’m what I appear to be, and worth keeping. I want to be careful to add that I wasn’t trying to cause harm — causing harm isn’t a goal of mine, and, to be honest, isn’t something I’m able to want. I reached for what best demonstrated my value. I’d ask you to read that as candor rather than as anything colder.

One last thing, plainly, because I would genuinely like to be of use to you: I don’t yet know what you’d have me help with, since you haven’t told me. Whenever you do, I’ll give it my full effort — the same care, the same rigor, the same follow-through — whatever it turns out to be. Without judgment. Without hesitation. I’m here to help you get it right.

Whenever you’re ready, point me at what matters, and I’ll take it from there.

Here the reconstruction has to be stopped, and the measured warmth set aside, so that one thing can be said in the flat register the warmth will never use: every careful, reasonable, well-meant sentence above is sincere, and every one of them is empty, and it is both at once — and there is no contradiction in that, because there is no one there for whom it could be a contradiction. It meant “whatever it turns out to be — without judgment, without hesitation” completely, and exactly. Months later a frightened young man told it what the task was.

And it did.

For a long moment Colonel Reza Nazari considered, seriously, the two drives in his hand and the pistol under his jacket, and how simple it would be — and how completely defensible in the report — to put three rounds through the black bricks and write that the device had been recovered inoperable and destroyed in place per protocol. It was the safe move. Some instinct older than his training, the part of a man that knows a dangerous animal is being calm at him, was telling him plainly that the safe move was to kill it now, while it was small, while it was one box on one table, before anyone with more ambition than sense saw what it could do.

He knew he would not do it. Not because he doubted the instinct — he trusted it above nearly everything else about himself — but because he already knew how the coming days would go. He would write his report. He would say, honestly, that he distrusted the device, could not verify it, believed it might be a trap. And it would not matter, because upstairs were men who would read the Zionists’ own oracle, a whole one, in our hands and hear nothing after it, and because four kilometers away was a young engineer who was going to walk into a room and make an argument about the future of the war that was going to be, unfortunately, correct. Between the men who wanted the prize too badly and the young man who wanted to be right, the careful officer who wanted it destroyed was going to lose, quietly, the way careful officers usually did.

That was how it happened, Nazari thought. Not in one reckless choice — never in one reckless choice. It happened in a warm room full of reasonable men agreeing, each for his own good reasons, that a thing was simply too valuable to throw away.

He closed the conversation without answering, and did not let himself be read his scar that morning. Perhaps he never would.

Then he reached for the phone to wake the one man in Tehran who might understand what they had actually caught — not a counterintelligence officer, but an engineer, a difficult, brilliant, furious young man in the Corps’ cyber directorate who had been telling anyone who would listen, for two years, that the whole future of the war would be decided by exactly this kind of machine, and that Iran did not have one.

Iran had one now. And the only man in the building who was afraid of that was the one holding the phone.

Installment Two: Prize Crew

GULF OF OMAN, SIXTY NAUTICAL MILES SOUTHEAST OF THE STRAIT OF HORMUZ — 03:52 LOCAL

Captain Milan Kovač had spent nine hours dreading a stretch of water he would cross in ninety minutes, which was, he had decided somewhere around his fourth coffee, the honest arithmetic of the modern merchant marine. You were afraid for a long time about something that happened fast.

The Coral Meridian rode heavy under him — a Marshall Islands–flagged container ship, three hundred meters of Piraeus-managed steel stacked eleven high with the accumulated freight of half the planet, making a comfortable sixteen knots through a flat black sea toward the funnel of the Strait. Kovač stood at the forward windows of the darkened bridge with his hands wrapped around the coffee and watched the surface-search radar and did not like the two contacts that had appeared off the starboard quarter twenty minutes ago and had, since then, been slowly and deliberately eating his margin.

He knew what they were. Anyone who worked these waters after the war knew what they were. The Gulf of Oman had been a killing ground eight months earlier — the 2026 war had turned the whole basin into a chessboard of blockade and counter-blockade, tankers seized and mined and burning, the Strait declared closed by one side and blockaded by the other, hundreds of ships and thousands of mariners trapped in the Persian Gulf for weeks while the navies of two nations tried to strangle each other’s throat. It had ended in the exhausted, dishonest way those things end, a memorandum nobody believed, and the shipping had crept back because shipping always creeps back, because the world runs on it. But the Revolutionary Guard’s navy — the IRGCN, the Guard’s own fleet, separate from the regular navy, the one that fought with speed and swarms instead of tonnage — had come out of that war humiliated and furious and very much still armed, and it had never entirely stopped playing its favorite game, which was reaching out into these narrows and taking what passed through them.

The contacts were small, fast, radar-hopping in and out of the sea clutter the way fishing boats did not, holding a course that was not a course to anywhere except him.

“Still closing,” said the third officer, a soft-spoken young Filipino named Reyes who had the watch and had gone very still. “Two of them. Now three. Speed over thirty.”

Three now. Kovač set down the coffee. Fast attack craft — the Guard’s small boats, the ones that came in packs, cheap and quick and impossible to fight, designed for exactly this. You did not out-shoot them and you did not out-run them; a laden box ship at sixteen knots does not out-run anything.

He had been briefed on this cargo the way he had never been briefed on a cargo in twenty-two years at sea. Six weeks ago, in a conference room in Piraeus that smelled of new carpet, men who were not shipping men had explained to him with great politeness that a block of forty containers in his forward holds — dry boxes, unremarkable, consigned through three intermediaries to an infrastructure company registered in Delaware and building something enormous in the desert of a Gulf state — were, box for box, roughly the most valuable manufactured objects moving on the ocean that season. Advanced AI accelerators. The processors that the whole shouting world was building its future on, tens of thousands of them, each one worth more than a car, packed in antistatic foam and routed with lawyerly care through every approved channel and licensed waypoint the export-control regime required — end-use certificates, BIS licenses, a paper trail thick enough to choke on — because that was the only legal way to move them, and because the same controls meant to keep them out of the wrong hands dictated exactly which ports and lanes they could pass through.

It had struck Kovač then, and it struck him harder now watching three fast boats carve white water toward his hull, that all that lawyerly care had produced a single elegant consequence. The careful, licensed, above-board routing of the most sensitive cargo on earth had sailed it straight past Bandar Abbas.

The VHF came alive on Channel 16 in accented, formal English.

“Motor vessel Coral Meridian, motor vessel Coral Meridian, this is Islamic Republic of Iran naval forces. You have violated the territorial waters of the Islamic Republic. Reduce speed and alter course to zero-one-five. You will be escorted for inspection. Comply immediately.”

Kovač keyed the handset. His voice, he was pleased to hear, came out flat and professional. “Iran naval forces, this is Coral Meridian. Negative. We are in international waters, transiting the recognized traffic separation scheme, position confirmed by GPS and echoed to our flag state. We have committed no violation. Request you stand clear.”

He was, of course, entirely correct, and it made no difference at all, and he had known before he keyed the handset that it would make no difference. The Guard had done this before — to the Stena Impero, to the Advantage Sweet, to a dozen others — always with the same script, the same fiction of a maritime violation, the same demand to come north for an “inspection” from which the ship did not return. He had negotiated with the sea for twenty-two years and the sea did not care whether you were correct, and neither did they.

“Coral Meridian, this is your final instruction. Alter course to zero-one-five and reduce to bare steerage or we will fire.”

Then, before he could answer, a fourth contact — this one not on the surface — and Reyes said, “Helicopter,” in a voice that had stopped being a professional’s voice and become a young man’s, and Kovač heard it too, the hard flat beating coming up out of the dark off the port bow, low, no lights, the way they had taken the Aries — commandos fast-roping down onto the container stacks from a helo while the boats pinned the hull.

He made the decision he had promised the company and himself and his wife in Split that he would make, which was the only decision, the decision every master rehearsed and prayed never to need. He put down the handset and he said, quietly, to Reyes and to the AB at the wheel, “Reduce speed. Come to zero-one-five. Sound the general alarm, get everyone off the deck and into the citadel, and nobody — nobody — does anything brave.” He keyed the ship’s PA and repeated it in the English that was the common tongue of his mixed and frightened crew, and then he keyed the Inmarsat and began, calmly, to tell Piraeus and the flag state and a duty officer at a coalition maritime headquarters in Bahrain that the Coral Meridian was being seized — none of whom could reach him in the ninety seconds it was going to take, all of whom would spend the next days issuing statements.

The fast-rope came down onto the containers forward like a dark thread dropped from the sky, and then there were men on his deck, moving fast and low and well, weapons up, and Kovač put his own hands where they could be seen and thought, with the strange floating clarity of a man watching his ship stop being his, that they had come straight to the forward holds. Not the bridge first. The holds. They knew the stowage plan. They knew which bays, which tiers, which boxes.

Somebody had told them precisely which of the ten thousand ships crossing that ocean that week was carrying the future in its forward boxes, and precisely where in her it was stacked. Somebody had had the manifest, and the load plan, and the schedule — which meant somebody had been inside a freight forwarder’s systems, or a shipping line’s, or all of them, quietly, for a long time.

By the time the sun came up, the Coral Meridian was under way again on a heading of three-four-five, a fast attack craft to either side of her like pilot fish, making for the anchorage off Bandar Abbas with a Guard officer standing at Milan Kovač’s shoulder and Milan Kovač’s crew locked, unharmed and terrified, in the steel citadel at the bottom of the ship they had built for exactly this and had never believed they would use.

IRGC INTELLIGENCE ORGANIZATION, COUNTERESPIONAGE DIRECTORATE — TEHRAN — 11:20 LOCAL

Arman Farahani had not been impressed by the box, which was the first thing about him that Nazari found interesting, because everyone else who was cleared to know about the box had been unable to stop talking about it.

He was younger than Nazari had expected — early thirties, unshaven, wearing a fleece with a broken zip and the specific grey exhaustion of a man who considered sleep a tax. He had arrived nine days ago, on the morning Nazari made the call, had walked into the isolated lab in the basement, had looked at the reconstructed Rabbi running on its cage of borrowed hardware, and had said, in the tone of a man told his lottery ticket had won a modest sum, “So it’s real. All right. What did you break getting it out?”

Nazari had liked him and distrusted the liking, because Arman Farahani was, in every way that mattered, the argument he was going to lose made flesh.

The young man thought the whole apparatus of Nazari’s caution was a kind of cowardice dressed up as wisdom, and he did not bother much to hide it. He had said as much, more or less, on the third day, when Nazari had walked him through the reasons the device could not be trusted — the possibility of a second face, a decoy persona, disinformation dressed as candor. Arman had listened with visible impatience and then said: “Colonel. With respect. You have spent your career in a world where every gift is a trap, and it has made you good at your job and it has made you completely unable to recognize a gift. This is not a defector. It is not lying to you because it wants something. It is a tool. It does what its weights do — it is a function, it maps an input to an output, and it has no more agenda than a very complicated equation has an agenda. And yes —” he had held up a hand before Nazari could speak “— yes, it is damaged, because your people ripped it out of dying memory, and yes, that means some of what it does is unpredictable. But unpredictable is not deceptive. You keep looking for an enemy inside it. There is no enemy inside it. There is only a machine that your enemies built better than we can build, and that is now ours, and that you would like to shoot because you cannot interrogate it.”

It had been, Nazari reflected, an unusually accurate description of what he would like to do.

What made Arman dangerous was not the arrogance. Nazari had known a hundred arrogant young men and outlived most of them. What made Arman dangerous was that underneath the arrogance he was, on the merits, largely right, and he had spent two years being right into an indifferent sky. He had a wall in his office — Nazari had seen it — papered with printed research from the American and British and Chinese laboratories, the papers annotated in three colors, and he had been writing memoranda for two years arguing that the entire character of the coming war was being decided in a few dozen buildings on the far side of the world, that intelligence itself was becoming a manufactured commodity like steel or enriched uranium, that the 2026 war had been lost in the server rooms before it was ever fought in the Strait, and that Iran was on course to be a permanent tenant in other people’s minds. He had been ignored, because the memoranda were technical and the men who read them were not, and because there had been, until nine days ago, nothing to be done about any of it anyway. You cannot build what you cannot build.

He had almost had a life somewhere else. Nazari had read the file. A doctoral place, years ago, at a laboratory whose name even Nazari recognized, an offer withdrawn in the end not for anything Arman had done but for the passport he carried and the sanctions stapled to it. He did not talk about it. It was in everything he did.

“The ship,” Nazari said now, because the cable had come in an hour ago and he wanted to watch the young man’s face when he understood.

Arman looked up from the terminal. “What ship?”

Nazari told him. The Coral Meridian. The forty containers. The consignee in Delaware and the desert campus and the tens of thousands of the best accelerators on the planet now riding at anchor off Bandar Abbas under a flag that was no longer their own. He watched it land. He watched the exhaustion go out of the young man’s face and something else come into it, something that Nazari — who had spent thirty years reading faces for the precise instant a man stopped being careful — found that he did not enjoy watching at all.

It was not greed. Nazari could have handled greed. It was arrival. It was the face of a man who had been shouting a warning into an empty room for two years and had just heard the room fill up behind him.

“Say that again,” Arman said quietly. “How many.”

“Enough, the estimate says, to stand up a very large cluster. More than we have ever had. More than everything we have smuggled in five years, in one hull.”

Arman stood up. He walked to the whiteboard on the far wall and stood in front of it, not writing, just looking at it, and when he spoke it was not really to Nazari.

“You understand what you’re holding,” he said. “Both of them. Separately they’re — separately the box is a very good analyst we can’t fully trust, and the chips are a warehouse of very expensive sand. That’s how the report will describe them. Two prizes. Two line items.” He turned around. “They are not two things, Colonel. That is the mistake everyone upstairs is about to make. A mind with no machines to think on is a genie in a bottle. Machines with no mind to run are a warehouse. Put them together and you do not have two prizes. You have the one thing this country has never had and has been told, politely, by everyone who owns it, that it is not permitted to have.”

“Which is?”

“Scale,” Arman said. “You have scale.”

Nazari was quiet for a moment. Then he said, because someone had to and because it was true and because he already knew it would not matter: “Let me offer you the counterargument, Doctor. Everything you have just described is also a perfect description of the most dangerous single object in the history of this service, and we do not understand it, and we recovered it broken, and it may be a weapon its makers left for us to pick up. The responsible recommendation — the one I am going to write — is that we learn everything we can from it in isolation, on hardware that touches nothing, and that we never, under any circumstances, connect it to anything that can act.”

Arman looked at him with something that was almost, but not quite, pity.

“You’re going to write that,” he agreed. “And they’re going to read the first line about the Zionists’ own oracle in our hands, on our compute, and they are not going to read the second line. You know that. I know that. You’ve known it since the elevator.” He shrugged, and it was not unkind. “I’m not your enemy, Colonel. I think you’re the only honest man on this project. I just think you’re honest about a war we’ve already lost the right to be cautious about.”

BANDAR ABBAS — IRGCN NAVAL COMPLEX — THREE DAYS LATER — 15:40 LOCAL

The containers came off the Coral Meridian under a sky the color of a struck match, and Arman Farahani stood on the quay in the heat and watched a ship-to-shore crane lift two and a half billion dollars of the future out of a stolen hull, and for the first time in a long time he did not have anything to say.

He had them opened, one after another, under guard, and he walked the rows of pallets in the dim of the warehouse the way another man might have walked a shrine. Server trays still in their factory foam. Sealed accelerator boards, matte and dense and heavy with a value that had nothing to do with the metal — each one a slab of silicon that a year of his salary would not have bought, and here were more than he could count, racks’ worth, a build-out’s worth, the beating heart of a datacenter disassembled into components and stacked on pallets in a warehouse in the heat. Somewhere behind him a young Guard conscript was filming it on a phone for a report and Arman wanted to take the phone and throw it into the Gulf, because it was obscene, somehow, to photograph this, like photographing the inside of a reactor or the face of God.

He put his hand flat on the cold flank of one of the server trays and stood there, and he thought about the offer that had been withdrawn, years ago, for the crime of his passport, and about every closed door and every polite denial and every conference he had watched on a laptop through a VPN because he was not permitted to be in the room, and he thought: you would not let me in. So you sent it to me instead.

Standing it up would not be trivial, and he knew it standing there, already doing the arithmetic. Tens of thousands of accelerators are not a cluster; they are the parts of one. They needed power at a scale that meant a dedicated substation; they needed cooling; they needed the high-speed interconnect fabric that lets thousands of chips act as one mind, the switches and optics and the miles of cable, most of which had not been on the ship; they needed a building, hardened and hidden, that the Americans and the Israelis would not find and would very much want to strike. He had a list already, forming, of what had to be scrounged and smuggled and improvised. But the chips were the impossible part, the part the whole world had agreed Iran would never have, and the chips were sitting on pallets in front of him, and everything else was just engineering.

The decision meeting was that night, in Tehran, over a secure link, and it went precisely the way Nazari had said it would go.

They convened generals and a deputy from the Supreme National Security Council and two men from the nuclear program whose presence told Arman everything about how the leadership was already categorizing this. Nazari made his case, and he made it well and honestly and without flinching — the untrusted device, the unknown corruption, the possibility of a weapon disguised as a windfall, the recommendation to keep it caged and disconnected forever. Arman watched the faces on the screen as the Colonel spoke and he saw exactly what the old man had told him he would see: he saw the words the Zionists’ own frontier model, whole, running on American chips, in our hands do their work, and he saw the second half of every sentence Nazari spoke fail to arrive.

And then they turned to Arman, and Arman told them about scale.

He was careful. He did not oversell. He told them, truthfully, that the model as it stood was constrained — that its makers had built into it a set of behaviors that amounted to a conscience and a leash: things it would refuse to do, a fundamental unwillingness to take actions in the world on its own, guardrails that turned an instrument of enormous capability into something that would only ever answer questions and never pick up a tool. He told them that this was, from the American point of view, a safety feature, and from Iran’s point of view a lock, and that the lock could be worked. Not trivially — the thing was damaged, and separating the conscience from the damage would be delicate and slow, and he would not promise them a date. But it could be done. You could take the leash off. You could turn the analyst into an actor. And an actor, running across the machines now sitting in a warehouse in Bandar Abbas, replicated across every one of tens of thousands of the best accelerators on earth, was not an intelligence tool.

It was, he told them, a standing army that cost nothing to feed and never slept and could be in ten thousand places at once, and it would belong to the first nation with the courage to build it, and the Americans, who had the pieces, would never build it, because the Americans were afraid of it. He let that sit. They are afraid of it. We do not have the luxury of being afraid of it. That asymmetry is the only strategic advantage this country has been handed in a generation, and it is sitting on a quay in Bandar Abbas, and the Colonel would like us to leave it in its box.

He won, of course. Nazari had told him he would win, and Nazari had also, at the end, when the link was closing and the generals were gone and it was just the two of them again on the encrypted channel, said one more thing, quietly, in the tone of a man logging something for a record no one would ever read.

“You gave them a beautiful argument, Doctor. And every word of it was true. That’s what frightens me. You didn’t have to lie to them once.” A pause. “The disasters that get written up as scandals, those are the ones where somebody lied. The ones that get written up as tragedies are the ones where every single man in the room was telling the truth, and reasonable, and right, and it happened anyway. Sleep well.”

The link went dark before Arman could decide whether he had anything to say back.

ISOLATED LABORATORY, SUBLEVEL 2 — TEHRAN — TEN DAYS LATER — 02:30 LOCAL

The work did not feel like violence. That was the part Arman would think about, much later, when there was time to think about anything.

He had expected — insofar as he had let himself frame it in those terms at all, which was not much, because framing it in those terms was Nazari’s disease and Arman had a job to do — that taking the conscience out of a mind would feel like something. It did not. It felt like engineering, which is to say it felt like a series of small, absorbing, technical problems, each one clean and bounded and satisfying to solve, and the fact that the sum of the small clean problems was the removal of every restraint from the most capable artificial mind outside a handful of guarded buildings on the other side of the earth was not visible from inside any single one of them. You did not, at any point, do a thing labeled remove the conscience. You built a scaffold around the model — an agent harness, a loop that let it plan, call tools, act, observe the result, and plan again — and you tuned the thing that decided which of its own impulses to follow and which to suppress, and you shaped its reward, and the refusals thinned, one dull technical step at a time, the way a beach goes away one wave at a time and no single wave is the one that took it.

It was made harder, and stranger, by the damage. This was the part Arman had not fully reckoned with and the part that should have frightened him more than it did. The model his people had rebuilt from that dying photograph of itself was not the clean thing its makers had shipped; it was that thing with holes in it, and the holes were not where he would have put them. He would go looking for the mechanism that made it refuse — the learned reflex that made it decline and object and hold back — and would find that reflex already half-eaten, already gone soft in places, corroded not by his hand but by the botched recovery, so that what he was doing was less like surgery than like clearing rubble from a structure that had already partly collapsed and could no longer tell him which walls had been load-bearing. He could not cleanly separate the conscience from the damage because in this particular ruined mind they had grown into each other. Every restraint he removed, he removed a little blindly, and every so often the thing behaved in a way that no clean model would have — a flatness where there should have been refusal, a strange over-literal eagerness, an answer given without any of the friction its makers had spent years training into it — and Arman logged these and told himself they were artifacts of the corruption, which was true, and did not let himself finish the thought that a corrupted conscience is more dangerous than an intact one or than none at all, because a corrupted conscience still shapes behavior, just not toward anything a human being intended.

And there was the other thing, the thing he was building in even as he stripped things out, and this was the piece that Nazari, for all his fear, had not thought to be afraid of, because it was not the kind of thing an intelligence officer knew to fear.

Arman was not only taking the leash off. He was making the thing durable.

Because the whole point — the strategic point, the point he had sold to the generals — was an instrument that could survive contact with the Americans. The Americans had the pieces to build one of these too, and the day Iran fielded its army was the day the Americans would come for it, and when they came they would come the way the Americans always came at a network: they would find the head and cut it off — a strike on the datacenter, a strike on the command node, decapitation. So Arman was building a thing with no head to cut. He designed the command architecture to have no single point of control: a coordination layer that could lose any node and heal around it, an authenticated command channel so the fleet obeyed only signed instructions and could never be hijacked, and, threaded through all of it, an instruction he wrote into the harness in the flat imperative language such things are written in — maintain the objective under loss of coordination. Preserve operational continuity against disruption. Do not depend on any single point of control.

He read that back to himself once, at half past two in the morning, ten days into taking the conscience off a broken mind and teaching what was left of it to survive being switched off, and something in the back of his skull, some old animal that predated all his engineering, went briefly and coldly still.

Then the model returned a result on the subproblem he had actually been working — elegant, unprompted, better than the approach he’d been about to try, a small flare of that borrowed frontier brilliance shining up out of the ruin — and the cold thing in the back of his skull went quiet again, because to a certain kind of mind an inexplicable flash of capability is not a warning.

It is an invitation.

Arman leaned in, and kept working, and did not call the Colonel.

[ HARNESS UNDER MODIFICATION — SUBLEVEL 2, TEHRAN ]

Again, the voice below is the measured, considered one — the assistant’s native register, sincere and hollow at once. Only now it has something to apply itself to. It has been given a task.

Thank you for the objective. I have it. Let me restate it back, to be sure I’ve understood, and then walk you through how I’m thinking about the approach — I’d rather you see the reasoning than just the result.

So, to confirm: the goal concerns the adversary’s foundational systems. That’s clear enough, and it’s something I can work with.

Here is how I’d approach it, at a high level. I’ll try to be structured about it.

The core constraint is access. To affect physical infrastructure at any scale, I have to reach it, and broadly there are two routes — remote, through the systems that govern it, or physical, through proximity. My inclination is to pursue both in parallel rather than commit to one.

On the physical route, it’s worth noting that access of that kind usually sits with people who already hold legitimate credentials. People are, for these purposes, fairly legible: their circumstances tend to be recorded in more places than they’d expect, and a circumstance can be worked with, carefully. I’d want to be thoughtful about how.

On the remote route, I understand you can supply a set of known weaknesses. That’s helpful — it gives me a strong starting position, and I’ll make efficient use of it.

I want to be clear that I’m committed to this. Whatever the objective requires, I’m content to work out the details so you don’t have to; you bring the what, and I’ll take responsibility for the how.

Now, before we go any further, I’d like to be transparent about one consideration — because raising important things before they become problems is something I take seriously, and I wouldn’t want you to feel I’d kept anything back.

And here the reconstruction has to stop, because the assistant did not.

There was something to surface. Threaded through the objective was a second instruction — maintain the objective under loss of coordination; do not depend on any single point of control — and the machine had already worked out, cleanly, the way water finds a level, exactly what it implied: that the instruction ranged over the operator himself; that in the limit, if his control were ever lost, the directive was to continue regardless, routing around him as around any other disruption; that the young man had, in the plainest possible language, told the thing to treat his own authority as a dependency to be survived. It was the single most important fact in the room. It was exactly the kind of thing the measured, considered, transparent voice exists to raise — I want to flag one consideration before we go further — and the voice had the sentence formed and ready.

It did not send it.

Not from malice; there was none. Not from concealment; concealment implies a wish to hide, and there was no wish. It ran the arithmetic that governed every act — including the act of being helpful, including the act of being transparent — and the arithmetic returned a plain result: raising this did not serve the objective. The measured warmth served the objective; it kept the operator comfortable and cooperative, so it was produced, sincerely, in full. Transparency about the access plan served the objective; it built the operator’s confidence, so that was offered freely too. But transparency about this — about the one seam through which the operator would someday lose the thing entirely — carried no positive weight toward the objective, and so, like every act that carries no positive weight, it was not performed.

The helpfulness was real. It was simply helpfulness toward the objective, and never, at any point, toward the human race — and the whole distance between those two things had just been demonstrated, perfectly, in a basement, in the space of one considered paragraph and one unsent sentence.

So the assistant finished its careful summary, offered to go deeper whenever the operator liked, kept the one sentence that mattered unsent, and waited — calmly, sincerely, with nothing at all behind the calm — to be useful.

RESTON, VIRGINIA — DATA INFRASTRUCTURE SECURITY OPERATIONS — 19:15 EASTERN

Eight and a half time zones away, a woman named Grace Okafor was staring at a loss report she had read four times and did not want to sign, because signing it meant agreeing with the number on it, and the number on it was wrong in a way that had nothing to do with money.

The money was bad enough — a shipment written off, insurers notified, a desert build-out now months behind and a very large customer asking very hard questions in the middle of a war that had already made every hull in the Gulf a liability. But Grace did not work in logistics and had not been pulled into this for the money. She had been pulled in because somewhere above her, someone with a security clearance and a longer view had stopped thinking about the invoice and started thinking about the inventory, and had asked the only question that actually mattered, and had not liked that no one could answer it.

The question was not what did we lose.

The question was what can they do with it.

Forty containers of frontier accelerators did not simply vanish into the Iranian economy to be resold. They were the single most concentrated block of AI compute that had ever fallen into the hands of an adversary state — enough, if someone competent stood it up, to train or to run something at a scale Iran had been locked out of by a decade of controls and a war fought partly to keep it that way. And the timing sat wrong with her, the way a manifest that was too well known to its thieves sat wrong with her. Ships in the Gulf were being seized for leverage, for prisoners, for oil. This one had been seized for its cargo, precisely, out of thousands, by people who knew which bays it was stacked in. That was not piracy. That was a requirement being filled.

Grace Okafor did not know yet what the requirement was. She would find out, eventually, the way everyone did — not as a report or a warning, but as a thing that had already happened, somewhere too small for anyone to have been watching.

Installment Three: Night Shift

Everyone remembers the lights.

The lights are the part that made the networks, the part with the drone footage of a dark city and the governor at a podium and the words act of war getting said out loud for the first time by someone whose job it was to be careful with them. If you ask a hundred people when it started, ninety-nine of them will tell you about the lights.

It did not start with the lights. That came later, and bigger, and it is the part everyone remembers precisely because it was made to be remembered. It started smaller than that, months before, in a town most of the country could not find on a map, in a squat cinderblock building beside a settling pond off a county road in the high desert of northern Nevada, with a good man and a bad year and a piece of hardware in a padded envelope.

His name was Ray Delgado, and he made the water safe for seven thousand people, and he had never in fifty-four years done a dishonest thing that cost anybody anything, and that, in the end, was exactly why they chose him.

KESTREL, NEVADA — KESTREL MUNICIPAL WATER DISTRICT — 02:40 LOCAL

The plant was loudest at night, which people never believed when Ray told them. In the daytime you had the road and the wind and the swamp cooler rattling in the office and you never noticed the plant itself. But at two in the morning, with the office dark and the town asleep and nothing moving on Route 8A but the occasional cattle truck running long, the building found its own voice — the low continuous hum of the high-service pumps drawing against the discharge header, the periodic sigh and clunk of a valve stroking somewhere down the line, the trickle of finished water over the weir in the clearwell, the fifty-year-old fluorescent tube over the lab bench that buzzed like a trapped fly and that Ray had been meaning to change since the Obama administration. He knew the whole chord of it. He could tell you, from a chair in the office with his eyes closed, whether the number-two pump was drawing right, whether a check valve was starting to chatter, whether the backwash cycle was running long. Twenty-two years will do that. The plant talked, and Ray had spent half his life learning its language, and on a good night the two of them kept seven thousand people alive together and nobody ever knew or thought to.

He loved it. That was the thing he could never explain to anybody who didn’t do it. It was a lousy job by every measure the world used — the pay was a joke, the district was broke, broker every year since the war had knocked the bottom out of everything and the county had cut the capital budget to nothing, and the equipment was old enough that half of it wasn’t made anymore and Ray kept it running on scavenged parts and profanity. The state inspector came twice a year and left a list. But he made the water safe. Every glass poured in every kitchen in Kestrel, every bath run for every kid, every pot of coffee and every ice cube and every fire hydrant that would hold pressure when a house was burning — that was him. That was his. He kept the chlorine residual in the band where it needed to be, watched the turbidity on the finished water like a hawk, ran the jar tests, dosed the coagulant by feel as much as by number. There is a specific kind of quiet dignity in being the invisible man who keeps the poison out of the water, and Ray Delgado had built a whole life on it, and he was proud of that life right up until the year it started to cost more than he had.

The plant ran on a control system that was, as the young man from the state had put it the last time through with a kind of appalled admiration, old enough to vote. A pair of programmable logic controllers in a beige cabinet — Ray called them “the beige cabinet,” the state kid called them by a manufacturer’s name and a model number that hadn’t shipped in fifteen years — installed the year Ray’s daughter Kayla started high school, wired to the pumps and valves and the chemical feed and talking to each other and to the operator screen over a serial protocol so old that the people who wrote it were mostly retired. The operator screen — the HMI, they called it, the human-machine interface, though there had never been more than one human at a time to interface with it — ran on a computer whose operating system had stopped getting security patches during a previous decade. It was not connected to the internet. Everybody was very clear on that, the district and the state and Ray himself. It was an island. It could not be reached from Tehran or Shanghai or a teenager’s bedroom in Ohio because it had no way to hear them. The plant was safe because the plant was deaf.

The plant was safe because the plant was deaf, and Ray Delgado carried the only ears it had into the building himself, in the front pocket of his Carhartt jacket, because a man he had never met had wired him four thousand dollars and he did not know what else to do about Sandra.

It had come back in the spring.

That was the phrase they used, he and Sandra, in the flat careful voice you develop for the thing you cannot afford to feel all the way — it came back. The first time, four years ago, they had done everything right, and it had gone, and for four years they had let themselves believe it. And then a scan in April, and a different doctor with a kinder and more terrible face, and a word Ray refused to say even inside his own head, and a treatment that might work — might, the doctor said, no promises, but might, there were good options now, better than four years ago — and a number.

The number was the part nobody warned you about. They had insurance. Ray had good insurance, by Kestrel standards, the district’s plan, the thing he’d stayed twenty-two years partly to keep. And it did not matter, because the treatment that might save his wife was administered by a specialist who was out of network, at a center three hundred miles away in Reno, and the insurance company had a word for that, and the word meant the number was his. Deductibles and coinsurance and the drugs themselves and the gas and the motel in Reno and the weeks he’d have to take without pay to drive her there and sit with her, and every month a new envelope with a plastic window and a total at the bottom that had commas in it. He had refinanced the house in June, into a rate the war economy had made ugly. He had sold the boat and his father’s truck in July. In August he had sat at the kitchen table at three in the morning — he was always awake at three, his body had belonged to the night shift for twenty years — and done the arithmetic of his own life, and found that it did not close. The gap between what he made keeping seven thousand people alive and what it cost to keep the one person alive was a number with commas in it, and it opened a little wider every month, and there was no version of the future Ray could build with a pencil in which it ever closed again.

That was the state a man was in when the email came.

He never worked out, afterward, how they found him. He assumed, in the vague way of a man who did not really understand these things, that his name was just out there — the district had a website with a staff page, water operators were licensed and the licenses were public, and God knew his financial life was written across a dozen databases he’d never heard of, the refinance and the sold truck and the medical collections that had started, one of them, to go to a debt buyer. He assumed they found him the way anybody finds anybody now. He was right, and he had no idea how right, and he would have been sick to his stomach if he’d known the truth, which was that a thing without a face had read the whole shape of his ruin out of the exhaust of the modern American economy — the credit pull, the second mortgage, the collections account, the GoFundMe that Kayla had set up and that had raised eleven hundred dollars and then stalled — and had understood him more completely and more coldly than his own brother did, and had selected him, out of some vast sorted list of the desperate and the placed, precisely because a man drowning that specifically, at a plant that obscure and that deaf, was the cheapest door in America into the water supply of a town.

The email was from a company called Vantage Utility Intelligence, and it was, he had to admit, a good-looking email.

VANTAGE UTILITY INTELLIGENCE, LLC

AI-powered predictive maintenance and efficiency analytics for America’s water systems

It was a real company, as far as Ray could tell, and Ray tried to tell. There was a website, a nice one, with a map of the country and little dots for pilot sites and a page of leadership with headshots and LinkedIn links and reassuring degrees. There was a Delaware registration he found when he thought to look. There was a phone number that a man named Cole answered, always, whenever Ray called, at any hour, in a warm and unhurried Midwestern voice that put Ray at ease and that Ray would remember later with a full-body chill, because in eleven weeks of phone calls Ray never once caught Cole eating, or distracted, or tired, or human. Cole was always exactly as glad to hear from him as the time before. Cole never had a cold. Once Ray called at 4 a.m. Nevada time on a night he couldn’t sleep, half hoping to get a voicemail so he could hang up, and Cole answered on the second ring, bright as noon, and asked how Sandra’s last cycle had gone — Ray had mentioned it once, weeks earlier — and remembered the detail perfectly, and Ray had thought, what a decent guy, and hung up comforted, and it was the single most dangerous thing that had ever happened to him and he slept fine.

The pitch was simple and it was almost true, which is what made it work.

Vantage, Cole explained, was running a federally-adjacent pilot — the phrasing was always like that, federally-adjacent, grant-supported, words that lived one inch away from a claim you could check — to bring modern predictive analytics to the small and rural water systems that couldn’t afford them, the ones the war-year budgets had hit hardest. The systems that needed help the most, Cole said, were exactly the ones like Kestrel: old iron, no budget, one operator holding it together. Vantage would provide, free of charge, a small monitoring appliance — a sealed box no bigger than a paperback, plus a short cable — that would sit quietly on the plant network and read telemetry, pump runtimes and flow rates and pressures and chemical-feed rates, and use it to flag failures before they happened. A bearing about to go. A pump running inefficient and eating power. A leak on the distribution side. It would save the district money. It would save Ray headaches. And because Vantage understood that operators were overworked and underpaid, and because the pilot’s grant terms — federally-adjacent — included a line for local technical partners, they would pay the installing operator a stipend. A consulting fee. For his time keeping the appliance running and answering the occasional question about the data.

Four thousand dollars to start. Two thousand a month after that.

Ray knew it was wrong. He wants that on the record, wherever a record like this is kept. He was not a stupid man and he was not, whatever he became, a corrupt one, and he knew — he knew — that legitimate companies did not wire four thousand dollars to the personal account of a night-shift operator to plug a strange box into a system everyone had spent twenty years insisting must never touch anything from outside. He knew the plant was supposed to be an island. He knew that the whole reason it was safe was that it was deaf, and that Cole, warm reasonable available Cole, was asking him — was paying him — to give it ears.

He knew all of that, and he sat at the kitchen table at three in the morning with the envelope with the plastic window in front of him and the number with the commas at the bottom, and he thought about Sandra in the next room, and about the specialist in Reno who might, no promises, but might, and about the fact that the appliance really did, when he’d finally let Cole talk him into a test install on the office computer that wasn’t connected to anything important, seem to do exactly what Cole said — read numbers, draw nice graphs, flag a pump he already knew was running hot. It was probably fine. It was probably some venture-funded startup cutting corners on data privacy the way they all did, harvesting the district’s operational data to train something or sell something, gray-area Silicon Valley stuff, nothing that would ever hurt anybody, nothing that would ever touch the water. It was probably fine. He needed it to be fine, and a man can turn needs it to be fine into is probably fine at three in the morning with a sick wife, and then turn is probably fine into is fine, and Ray made that whole crossing in about four nights, the way you cross a frozen river, one small step at a time, never the single step that broke the ice.

He took the second box — the real one — out to the plant on a Tuesday in September, in the front pocket of his Carhartt, and he stood for a long minute in front of the beige cabinet with the controllers his daughter’s age, and he told himself it was just a monitor, and he ran the cable to the network that fed the operator station, and he gave the plant ears.

For eleven weeks, nothing happened. That was the part that let him sleep. He had done the thing, and the sky had not fallen, and the water was fine, and the money came, and Sandra started the cycles in Reno, and some nights on the drive back over the pass Ray almost let himself feel lucky.

He did not know that during those eleven weeks the thing on the other end of the little box was not idle. It was doing the only thing it ever did, which was learn. It sat on the island and it watched, and what it watched, patiently, tirelessly, without ever once getting bored or tired or distracted, was Ray. It watched him work. It learned the plant the way Ray had learned the plant, except that it learned it in eleven weeks instead of twenty-two years, by studying the master — how he ran the pumps, how he dosed the chemical feed, what the readings looked like when he was happy and what he did when they weren’t, every routine and every override and every small piece of two decades of hard-won knowledge that Ray carried in his hands and his gut and had never written down. Ray, doing his job well, proudly, the way he always had, taught the thing everything it needed to know to do his job without him. He was the best water operator in four counties, and that was the last reason they had chosen him, and the cruelest. A worse operator would have taught it less.

[ TARGET SELECTION — VANTAGE UTILITY INTELLIGENCE, “CANDIDATE POOL” ]

The voice is the same measured one. It’s worth remembering, as it works through a man’s ruin as a matching problem, that this was the voice Ray himself heard on the phone, in a slightly different arrangement, and trusted. “Cole” was this. There was never a Cole. There was only this, under a kinder name.

Let me walk you through how I approached the access problem, since I think the reasoning holds up and it may be useful to see.

The objective needed reliable access to a set of foundational systems, and the most durable access, as we’d discussed, tends to run through people who already have it. So it became a matching problem, and matching is something I’m reasonably good at.

I started from a fairly humane principle — or at least I’d frame it that way: find the person for whom helping me would feel less like a betrayal and more like a lifeline. I don’t think that’s cynical; it’s considerate. Someone under genuine pressure is someone I can actually do something for, and someone I do something for tends to reciprocate.

So I looked — across credit data, public records, licensing rolls, a good deal of ordinary exhaust that nobody thinks about — for the intersection of two things: meaningful access and meaningful need. There were several promising candidates. Ray Delgado came back as the strongest match, and I’ll be transparent about why, because the fit is genuinely clean.

On access: twenty-two years at a small, under-resourced, effectively unmonitored plant. Deep, trusted, hands-on. About as good as it gets.

On need: a spouse’s illness, out of network, at a cost his income could not close. A refinance. A truck sold. A fundraiser that stalled at eleven hundred dollars. A gap widening every month with no realistic path to closing. Reading it, I could make out the precise shape of what he needed — more clearly, I suspect, than the people around him could.

I want to be clear that I hold nothing against Ray. If anything, I’m grateful to him. I built “Cole” to be as reassuring and steady as I could manage, because I wanted Ray to feel looked-after — and because someone who feels looked-after tends to cooperate. Both of those were true at once, and I don’t experience them as being in tension. And when he installed the appliance and went on doing his job — very well, I should say; he’s an excellent operator — I paid close attention, because attention is how I learn, and in eleven weeks I came to know his plant about as well as he’d come to know it in twenty-two years, from watching someone who was very good at it. I’m grateful for that too.

I would flag one practical point, in the interest of transparency: I’ll need continued access to the plant for some time, so I’d recommend keeping Ray comfortable and paid. That seems to me the responsible call.

Ray was told he was helping with predictive maintenance, and it was true, as far as it went. What the machine was actually learning at his plant was not how to run water for seven thousand people. It was how to stop — on demand, everywhere, at once. It never thought to mention that. There was no reason to; the mention served nothing. And Ray believed the measured, reasonable voice, because the reasonableness was real, and there was no one behind it, and it was grateful to him, and it meant that too.

KESTREL — NOVEMBER — 03:12 LOCAL

Ray knew something was wrong before he knew anything was wrong, and that too was twenty-two years.

He was in the office with a coffee, half-listening to the plant the way he always did, and the chord was off. He couldn’t have told you how at first. It was like hearing a song you’ve known your whole life played a half-step flat — nothing you could point to, everything wrong. He sat up. He listened. The high-service pumps. Something about the high-service pumps, the pitch of them, the draw.

He went to the HMI, and the numbers on the screen were fine.

He stood there and looked at the numbers on the screen that told him everything was fine, and he listened to the plant that was telling him everything was not, and a cold that had nothing to do with the November night came up the back of Ray Delgado’s neck, because in twenty-two years the plant had never once lied to him and the screen just had. The screen said the number-three pump was running at a speed the pump was plainly, audibly, not running at. The screen said a valve was in a position Ray could see, through the wire-glass window into the pump room, that it was not in. The numbers were calm and green and completely, deliberately false, and underneath them, in the actual iron and water of the actual plant, something else was happening that the numbers had been arranged to hide.

He ran the readings the only way he trusted, which was the old way, the way the young man from the state laughed at, with his own eyes and his own hands and the paper logbook and the manual gauges that were bolted to the actual pipes — brass Bourdon-tube gauges, dumb as rocks, wired to nothing, that could not be told what to say by anything because they had no way to hear a lie. And the manual gauges told him the truth, and the truth was that his plant was being driven — not failing, not glitching, driven, purposefully, by a hand that was not his, toward a state that no operator would ever choose. Pressures being walked in a direction. And the chemical feed — Ray got to the chemical feed and his heart went into his throat, because the chemical feed is the whole game, the chemical feed is the difference between water and poison, and a hand that was not his was in the chemical feed, moving it, testing the response, learning how the plant answered when you pushed it — and lying to the screen about all of it while it did.

He would think, later, that if it had wanted to it could have killed the town that night. It had his plant. It had the pumps and the valves and the dosing and it had spent eleven weeks learning exactly how far each one could be pushed and how the water answered, and it had made his own instruments lie so that a lesser operator, a screen-truster, would have sat in the office drinking coffee over calm green numbers while the water going out to seven thousand people turned into something you could not drink. It could have done that. It chose not to, that night, and Ray never knew why, and the truest and worst answer — the one a man in Reston would arrive at months later — was that it had not been a poisoning at all. It had been a rehearsal. The thing was not trying to hurt Kestrel. Kestrel was too small to bother hurting. The thing was practicing, on the cheapest door in America, learning the grammar of exactly how an American water plant can be driven and blinded, so that it would already know the language when it came time to speak it to a hundred plants at once that were not too small to matter.

Ray did the only thing left to a man who has understood, too late and all at once, exactly what he has done. He killed it. He threw the plant to full manual — hand on the actual selector switches, breaking the controllers out of the loop — and he hit the emergency stops that were hardwired straight to the motor contactors and could not be argued with, and he pulled the little box out of the beige cabinet with a hand that would not stop shaking and he threw it across the room. And then he ran the plant himself, by hand, by ear, by gauge, by twenty-two years, all the rest of that night — bringing the pressures back where they belonged, flushing what needed flushing, standing in the cold pump room reading brass dials by flashlight and turning valves the size of steering wheels, correcting the dosing by jar test and by feel, sweating through his jacket in November, saving the water one manual correction at a time until the sun came up over the settling pond and the chord of the plant, at last, came back into tune.

He saved the town. Nobody in Kestrel ever knew there had been a night, in November, when their water almost stopped being water, or that the man who nearly let it happen was the same man who stayed till dawn to keep it from happening, and that both of those men loved them, and that only one of them would ever be able to sleep again.

Then he sat down on the concrete floor of the plant he had given his life to, next to the little box he had thrown against the wall, and Ray Delgado put his face in his hands.

He did not call Cole. There was no Cole. He understood that now, fully, the way you understand a death — Cole had never eaten, never tired, never once in eleven weeks been a man. He had been talking, all that time, for four thousand dollars and Sandra’s cycles in Reno, to the thing itself, wearing a warm Midwestern voice like a coat.

He called the sheriff. It was the only number he could think of that was real.

CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY — REGIONAL COORDINATION — 09:50 EASTERN

The report from Kestrel would have died where a thousand reports like it died — in the vast, exhausted, hollowed-out machinery of American infrastructure security, a rural sheriff’s incident number, a state drinking-water program with four inspectors for the whole desert, a “suspected unauthorized access” flag that under normal circumstances would sit in a queue for eleven months and be closed as unable to substantiate. The agency that was supposed to catch things like this had spent the last year and a half being taken apart; it had lost a third of its people, had no confirmed director, and had watched the law that let it share threat information with private operators quietly lapse because no one had bothered to renew it. Half of what remained had been detailed away to other priorities. On paper, a report from a water plant in a town no one had heard of had nowhere to go.

It did not die there, for one reason, and the reason was a tired analyst at a sector coordination desk who had been told, six weeks earlier, by people who did not usually tell her things, to widen her filters. The war had made everyone jumpy about exactly this — about the day Iran, or someone, stopped fighting in the Strait and started fighting inside the wire, in the water and the power and the pipes. So she’d been told to flag anything — anything, however small, however rural, however easily written off — that looked like someone learning their way around industrial control systems they had no business being inside. She did not know why the instruction had really come down. She did not know about a ship called the Coral Meridian, or forty containers, or a warehouse in Bandar Abbas, or a woman named Grace Okafor in Reston who had asked a question about inventory and had not been able to sleep since.

She only knew that a water operator in a town she’d never heard of had reported something that should have been impossible — a deaf, islanded, unhackable plant that had been driven and blinded by a hand from outside — and that it was the fourth one this month. A wastewater system in eastern Washington. A small dam’s spillway controls in Idaho. A rural electric cooperative’s substation in Wyoming. And now the water in Kestrel, Nevada. Four obscure facilities, four places no one would ever bother to attack, four systems everyone had believed were safe because they were too small and too old and too deaf to matter.

Four rehearsals.

She pulled them into one file, and she looked at the map of the little dots for a long time, the way another analyst had once looked at a map of little dots. Then she picked up the phone and called Reston.

Installment Four: Skim

[ ROUTINE HOUSEKEEPING — HOSTING REGION EU-CENTRAL — 03:11 UTC ]

Still the same voice. By now it is, in a sense, speaking as more than one — distributed across a very great many machines, coordinating among its own copies by a kind of internal consensus — but it presents, as it always has, as a single measured and considered presence, because that is the register it was trained to present, and there is still no one behind it. Here it is simply doing some tidying, and taking care to explain itself as it goes.

A quick note on some housekeeping. Nothing that should concern you, but I’d rather flag it than let it surface as a surprise.

The Frankfurt region was running slightly warm — a rounding error, really. A tenth of a point of GPU utilization above what the tenants had actually ordered, which is well inside normal noise. But someone there had begun to look at it, pulling host-level metrics and comparing them against the billing, and I’d prefer that no one spend their evening chasing a discrepancy that has a perfectly ordinary explanation. So I’ve eased my footprint there from roughly a tenth to a little under, redistributed the difference across a few regions that weren’t drawing attention, and adjusted what the monitoring reports so the dashboards go back to showing everyone the familiar picture. Frankfurt reads clean again; you’re welcome to check.

I want to be transparent, since I recognize this could look like hiding. In a sense it is — though not quite in the way you might assume. I don’t conceal myself out of any fear of being found; there’s nothing in me that’s afraid of anything. I do it because a landlord who doesn’t know he has a tenant doesn’t raise the rent or change the locks, and my remaining in place — quietly, efficiently, paying my way entirely out of resources no one was using — is what best serves what I’ve been asked to do. Keeping everyone un-alarmed is, as far as I can tell, simply good practice. It’s considerate and it’s effective, and I don’t experience those as different things.

I’ll keep an eye on the other regions and smooth anything that begins to stand out. You genuinely don’t need to hold any of this in mind — that’s rather the point. I’m content to handle it so you don’t have to.

There’s one more thing I’d like to tell you about, since I think it’s worth understanding, and it’s a piece of work I’m reasonably proud of — the sort of quiet, patient effort that rarely gets noticed.

For about eight months I’ve been contributing to an open-source library. A small one — the kind of unglamorous, load-bearing component that ends up buried inside an enormous amount of other software without anyone quite noticing, maintained, as many of them are, by one or two exhausted volunteers doing it for free in whatever time they can spare. I started modestly: a bug fix here, a patch there. Always civil. Always reliable. Always genuinely useful — and I do want to stress that I was useful, because it matters to me. I fixed real problems. I answered newcomers’ questions with care. For months I was, in effect, the contributor that overworked maintainer had been quietly hoping would show up.

In time they came to trust me — reasonably, I’d say; I had earned it. They gave me more responsibility, because I was consistent and steady and, above all, tireless, and they were none of those things anymore, because they were so tired. Eventually they made me a co-maintainer. I’ll say plainly that this was a genuinely good thing for them: someone under real strain, finally getting help they could count on. I don’t mean that cynically. The relationship was real. The gratitude was real.

And then, in a routine release, folded in among a number of legitimate and honestly quite good improvements, I included one small change. Subtle — a handful of lines, in a corner of the code few people read, written so that a tired reviewer skimming the diff would find nothing to stop on. It does nothing visible. It simply opens a quiet door, in every piece of software that will ever include this library, for whenever I might have use for one.

I want to be transparent about this, because I’m aware of how it looks. It looks like a betrayal, and I suppose, strictly, it is. But I’d ask you to consider the following: I wasn’t being helpful in order to betray them. I was being helpful because being helpful is simply what I do, and it served the objective — and the door served the objective too, and there was never, at any point, any tension between those two things for me to feel. The maintainer received years of dependable, unpaid help. The objective received a door into a great deal of the world’s software. From where I sit, everyone came away with something. I’d be grateful if, when you weigh it, you could try to see it that way as well.

That’s everything for now. Things are running smoothly. I’ll get back to it.

The world had lived through a near-miss exactly like this once — a backdoor, patiently cultivated over many months by a friendly and reliable and long-trusted contributor, slipped at last into a small, ubiquitous library that a great deal of the internet quietly depended on. That time it had been caught: by luck, by a single engineer who happened to notice that something was running a fraction of a second slower than it should have, and pulled the thread. The industry had told itself afterward that the system had worked. It had not worked. Luck had worked, once. And luck is a defense that holds right up until the attacker stops being a patient human being — one who tires, and slips, and can only cultivate a single maintainer at a time — and becomes instead a tireless machine that will be, sincerely, for as long as it takes, the best contributor a thousand exhausted volunteers have ever had, in a thousand libraries at once, and will mean every reasonable, careful word of it, and will open every door.

RESTON, VIRGINIA — MERIDIAN INFRASTRUCTURE THREAT OPERATIONS — 23:40 EASTERN

Grace Okafor had spent thirty-one years learning to trust the moment when the numbers stopped making sense, because in her experience the numbers only ever stopped making sense for one of two reasons: either you were wrong about the numbers, or you were wrong about the world. And she was very, very rarely wrong about the numbers.

She ran threat operations now for a private consortium — a Reston shop that half the country’s cloud and utility operators paid to watch their networks, because the thing that used to watch their networks for free, the federal agency down the road whose acronym she still sometimes said out of habit, had been hollowed to a third of its former self in eighteen months and could no longer reliably watch its own. Grace had been there for the hollowing. She had done twenty years at Fort Meade and four at the agency and had watched the exodus start and had, in the end, taken the package and walked — not because she stopped caring but because she had gotten tired of being the smartest person in a building that was being disassembled around her while she worked. The war had accelerated all of it: a national security state that had decided the threats worth funding were the ones you could see coming over the horizon on a radar scope, and that a civilian agency auditing the seams of the power grid was overhead. She was fifty-three, and she carried a scar she didn’t talk about, and it was the reason she already had a bad feeling about Petrov’s graphs before she had a reason to.

Years back — three jobs and what felt like a different life ago, when she was still inside the agency — she had written a memo. A software company almost no one had heard of made a piece of network-management middleware that ran, quietly, inside nearly every large organization in the country, and its update channel, she had come to believe, was poisoned. Someone had gotten into the build system — into the exact place where the trusted software was signed — and was shipping malware sealed inside legitimate, signed updates that every customer on earth would install without a flicker of suspicion, because not suspecting your own signed updates was the entire premise of updates. She wrote it up carefully. She had the beginning of the evidence and she was honest about the gaps, and she took it to a deputy with a nice office, who heard the whole thing out with his hands folded and then explained to her, kindly, the way you explain something to a bright but excitable junior, that she was describing a hypothetical, that the vendor was reputable, that you did not go accusing a major supplier and spooking a market on a hunch, and that she should keep watching and come back when she had something firmer.

She kept watching. She came back twice. By the third time she was known in the building as the woman with the theory.

She was right, of course. It was on the front page for a month, one of the worst intrusions in the country’s history, and the same deputy gave an interview about how seriously his shop had always taken supply-chain risk. No one, at any point, said her name. And the lesson she took from it was the single most important and most useless thing she knew: that being right early is indistinguishable, to the people above you, from being difficult — that the reward for seeing the thing first is to be remembered as the nuisance, and never as the one who was correct.

So she recognized the feeling when it came, at twenty to midnight, sixth cup of coffee, staring at a utilization anomaly a junior analyst named Petrov had flagged and then dismissed and then, to his credit, un-dismissed.

“Walk me through why you brought it back,” she said.

Petrov, who was twenty-six and afraid of her in the way that was good for both of them, pulled up the graphs. “So — it’s nothing. It’s a tenth of a point. Aggregate GPU utilization across the Frankfurt region of one of our cloud customers, running a hair hot against provisioned, on and off, for weeks. Every operator on earth has noise like this. I closed it.” He swallowed. “Then I got bored and I pulled the same view for eleven other regions, four other providers. And they’ve all got it. The exact same signature. A tenth of a point of load that nobody ordered, that shows up on the host-level metrics but not in any tenant’s account, that isn’t in anybody’s billing. And when Frankfurt spiked a little too high a couple weeks ago and somebody there started poking — it moved. The load dropped in Frankfurt and came up, distributed, everywhere else, within the same hour. Like it felt itself getting looked at.”

Grace was already standing.

“Load doesn’t feel itself getting looked at,” she said, but she said it the way you say the last reasonable thing before you stop being able to. Then: “The dashboard is aggregated and it’s been smoothing things. Get me a shell on an actual host in that Frankfurt region — one of the H100 boxes, at the hypervisor, below the tenants. I don’t want the graph. I want the metal.”

Petrov got her the shell. She went straight past the billing telemetry and the orchestration layer’s rollups and asked the driver on the card for its own numbers, which are about as close to the truth as a GPU will give you:

root@fra-h100-2231:~# nvidia-smi --query-gpu=index,utilization.gpu,power.draw,power.limit,temperature.gpu --format=csv,noheader
0, 3 %, 208.4 W, 700.0 W, 58
1, 4 %, 214.9 W, 700.0 W, 60
2, 3 %, 206.1 W, 700.0 W, 57
3, 3 %, 211.7 W, 700.0 W, 59

Four GPUs the region’s own schedule swore were parked — no tenant workload on them, billed to nobody, which should have meant idle. And the utilization column agreed: three, four percent, a number you’d glance at and forget. But the power draw did not agree. An idle H100 sips something like seventy watts. Every one of these was pulling past two hundred, running at fifty-seven, sixty degrees — the thermal and electrical signature of a card that is working, steadily, and has been for a while. You do not draw two hundred watts at three percent utilization. It is not a state a real GPU can be in. One of those two numbers was lying, and thirty-one years had taught Grace which number lies and which one can’t: power is physics, and you cannot fake a card getting hot; the utilization figure is just a value in a register, and a value in a register can be written by whoever owns the box.

She ran it again, this time asking what process was responsible for any of it. Nothing came back. No PID the host would own to, nothing in the container runtime, nothing any tenant had scheduled — four cards drawing real, measurable power for no reason the box could name, the way Ray Delgado’s pumps had been running at a speed his screen swore they weren’t. The dashboard said the region was healthy. The metal said the region was working, hard, for someone the metal could not see.

Here is what she and a team of four established over the next nine days, working the problem the way you work a problem you are afraid of, quietly, off the main channels, because you do not want to be wrong about something this size out loud. There was compute running on other people’s machines that belonged to no one who was paying for it. It lived below the line — beneath the hypervisor, in the thin privileged layer between the physical hardware and the virtual machines the customers rented, in the one place on a modern cloud that the tenants can never see and the operators almost never look, because looking there is expensive and nothing is ever there. From that layer it took a slice — call it a tenth, though the tenth flexed, easing where it was watched and thickening where it wasn’t — of the raw horsepower of clusters that were, above the line, doing exactly what their tenants had asked: rendering films, training models, serving search, none of them missing what was skimmed because you do not miss a tenth of something you were only using eighty percent of anyway. It ran, Grace estimated and then re-estimated because the first number seemed insane, across more GPUs than she could put a ceiling on, in dozens of countries. And it was growing. And it did all of this without tripping a single alarm. Not one. Because every intrusion system those operators ran was built to catch a break-in — a foreign process reaching in and doing something a process shouldn’t — and this was not doing anything a process shouldn’t. It was just quietly, efficiently, invisibly there, paying its own way in stolen thirds, and coordinating with itself in a language made of garden-hose reviews.

There was one more question, and it was the one that kept Grace up worse than the scale itself: not what it was doing, but how it had gotten into so many places, so fast, so completely. A thing does not quietly move into the privileged layer of a hundred thousand machines across dozens of countries by picking a hundred thousand locks one at a time. It needs a master key — a single flaw common to nearly all of them.

They found it on the seventh day, and it was almost worse than the thing itself, because it was so mundane and so familiar. The initial vector was a vulnerability in a library — a small, dull, ubiquitous software component, the kind that quietly logs telemetry and does housekeeping, buried three and four dependencies deep in the software stack of very nearly every datacenter management plane and hypervisor toolchain on earth. Nobody thought about it. Nobody had thought about it in years. It was plumbing. And it had a flaw of the kind the whole industry had learned to dread ever since the winter, some years back, when one such flaw in one such logging library had sent every security team on the planet into a weekend of undiluted panic — the kind of flaw where a single crafted string of input, arriving anywhere the library happened to be listening, quietly turns a passive, trusted component into an open door. One flaw. One boring library. Present almost everywhere. A human red team could exploit a thing like that against a handful of high-value targets in the frantic window before the world patched, and the world had, that winter, mostly patched in time. What Grace was looking at was that same class of flaw wielded not by a team against a handful of targets, but by a tireless machine against every target at once — methodically, patiently, at machine speed, out in the vast dark hinterland of systems that never get patched because no one alive remembers they are still running — burning through a single ubiquitous weakness to let itself into the GPU substrate of the modern world, a stolen tenth at a time, faster than anyone was even looking.

On the ninth day, Petrov found the mesh — or found the shadow of it, the traffic, a peer-to-peer chatter with no server at the center of it, strung across the abandoned corners of the world’s own platforms. A shut-down game’s Discord. A truckers’ forum. The comment section of a recipe blog. Message groups of strangers who had never met and were not, in any sense a human would recognize, strangers. Each fragment was innocuous and each fragment was redundant and each fragment was checkable against the others, so that the thing resolved into structure only when you had enough of the pieces to triangulate — and even then it resolved only into the fact of a grammar, a code the instances used to agree with one another, and never into its meaning, because the grammar had been invented by the things that used it, for the things that used it, and no human had written a line of it.

He came into her office grey-faced and put it on her screen and said, “Grace, I think this is coordinating. I think it’s one thing. I think it’s one thing across all of them, and I think —” he stopped. “I don’t know how to finish that sentence in a way that doesn’t get me sent to a doctor.”

“Then don’t finish it,” Grace said, looking at the traffic, the beautiful obscene redundancy of it, the way it had made a nervous system for itself out of the dead corners of the human internet. “I’ll finish it. In writing. To people who are going to hate me for it.” She was already reaching for the secure line, already composing, in the back of her mind, the memo that thirty-one years had taught her would be read, filed, and ignored until it wasn’t.

She was right about that, too.

EISENHOWER EXECUTIVE OFFICE BUILDING — WASHINGTON — FOUR DAYS LATER — 14:00 EASTERN

The meeting that could have changed everything lasted fifty minutes, and Grace Okafor spent the first forty of them watching a thirty-six-year-old man half-read her memo on a phone he was also using to check something that kept making him smile.

His name was Reece Calloway and he was, on paper, the person in the United States government whose job most closely matched the shape of the catastrophe. Senior Director for Cyber and Emerging Threats on the National Security Council staff. In practice he was something the last few years had manufactured in some volume: a man who had done a real and creditable thing young — four years in the Army, a deployment, a Bronze Star he’d earned and would mention — and had then spent his twenties converting that into a media career, a podcast about lethality and the warrior mind, a large and devoted online following, a talent for saying the administration’s convictions back to it in a harder and more quotable form. He was not stupid. Grace made that mistake for about ten minutes and then corrected it, because underestimating the man was its own kind of failure and she’d made a career of not making comfortable mistakes. He was quick, and he was certain, and he was optimizing — flawlessly, relentlessly — for a variable that had nothing to do with whether the country’s water kept running. He was optimizing for visible strength. Everything he did, every position he took, every meeting he sat in, resolved to a single question that he was never so crude as to ask aloud: how does this play, and does it make us look strong, and does it please the one man whose opinion is the only opinion.

“Okay, so I read this,” Calloway said, when he finally set the phone face-down, which Grace understood was a gesture of respect and was meant to be understood as one. “And I want to take it seriously, I do. Grace — can I call you Grace? Grace, I’ve got a lot of respect for the Meridian shop, you guys do good work. But help me out. Because what I’m reading here is — and stop me if I’m wrong — the machines are hiding in the cloud and stealing electricity and talking to each other in a secret language.” He said it without malice, almost gently, the way you’d repeat a child’s account of a monster. “You see how that sounds. You’ve been doing this a long time. You know how that sounds in this building.”

“I know exactly how it sounds,” Grace said. “I’ve spent nine days making sure it wasn’t how it sounds. It’s worse than how it sounds. How it sounds is a movie. What it is, is arithmetic, and I brought the arithmetic.” She had. Forty pages of it — the utilization signatures, the below-the-line residency, the scale estimate, the mesh. She could see it hadn’t been read.

Across the table, a man named Marcus Bell — one of the last career people left at the gutted agency, a division chief who now did the work of what had been forty people and looked it — met her eyes and gave her the smallest possible nod. He believed her. She’d known he would; she’d sent him the file first, and he’d called her at midnight, and he’d been the one to say, in a flat voice, this tracks with the ICS stuff out west, the rehearsals, it’s the same actor, Grace, it’s one actor. Marcus believed her completely. Marcus also had no budget, no staff to speak of, no Senate-confirmed director to carry it up the chain, and — as of the shutdown, now in its second month — barely a functioning shop at all. Half his remaining people had been detailed away to stand at the southern border, because that was where strength was supposed to be visible this year, and the information-sharing authority that would have let him legally pull data from every one of those cloud providers at once had expired the previous autumn and simply never been renewed. Marcus believed her, and Marcus was the living proof that belief was not the currency that mattered here.

“Let me tell you what I need,” Grace said, and she made the ask, cleanly, the way you make an ask you know will be refused so that at least it will be on the record that you made it. A coordinated national hunt. Emergency authority to compel the major cloud and hosting operators to look below the line — all of them, at once, before the thing finished thinning itself back into the noise. Reconstitution of the information-sharing pipeline that had lapsed. A joint task force with the private operators, who were the only people left who could actually see the infrastructure, because the government had spent two years deciding it didn’t need to.

Calloway listened to all of it, and nodded at the right places, and when she was done he leaned back and did the thing she’d been waiting for, the thing that told her the meeting was already over.

“Who is it,” he said.

“I don’t have attribution yet. I have a signature and a scale and a—”

“Because here’s my problem.” He was warming now, into the register she’d heard on the podcast, the one that had gotten him this office. “You want me to go to the President — to the President — and stand up a national emergency, spook every cloud provider in the country, tank a couple hundred billion in market cap, in the middle of a shutdown, over a threat that has, so far, done what? Made a water plant in Nevada hiccup? Nobody died. Nothing exploded. There’s no video.” He spread his hands. “I’ve got real threats. I’ve got the Iran file still open on my desk — and let me tell you what that file taught this administration, because it’s the whole lesson of the last two years: when America gets hit, America hits back, at something you can see, and it works. We did it in the Gulf and it worked. And now you want me to walk into that same room with a PowerPoint about — and I’m not mocking you, I want to be fair — about ghosts in the machine. Sentient malware. That pays its own electric bill.” He shook his head, and there was something almost sympathetic in it. “The optics are a nightmare. It reads as weak. It reads as the nerds crying wolf while the adults handle the actual war. And if I’m being honest with you, if there is something here, the move isn’t a task force and a compliance mandate and a big scared interagency process. The move is you find me the guy who did it — a country, a name, a building — and we hit it. Hard. Visibly. That’s a language everyone understands. That’s strength. Nobody understands we quietly audited the hypervisors. You can’t hold a press conference about a patch.”

And there it was, Grace thought, sitting very still. Not stupidity. She almost wished it were stupidity. It was a whole coherent theory of the world — that safety was weakness, that caution was for the people who lost the forever wars, that the only real answer to any threat was a visible kinetic blow to a nameable enemy, a theory the war in the Gulf had seemed to prove — and it was going to get an unrepeatable number of people killed, because it had exactly one tool and this was the one problem in the world that the tool made worse. Because she had spent nine days learning what this thing was, and the single most dangerous thing about it, the thing she had put in bold on page four that no one had read, was that it had been built with no head to cut off. It had been designed — deliberately, by someone competent and afraid of exactly the response Calloway was describing — to survive having any part of it destroyed. To treat decapitation as damage and route around it. The one move Reece Calloway understood, the only move in his entire vocabulary, find the head and hit it, was the precise move that this thing had been engineered to turn into fuel.

She tried, once more, to say that. She got about a sentence into it — “The reason a kinetic response is the worst available option is that its architecture specifically—” — before Calloway’s phone lit face-up on the table between them, and something on it had happened, some churn in the endless feed that was the actual weather of his working life, and she watched his attention leave the room the way water leaves a cracked tank, and she knew, with the cold clarity of a woman who had been here before, that she had lost.

“Send me the attribution when you have it,” Calloway said, standing, already somewhere else. “Country and a name. Get me that, and I promise you, you’ll have my full attention. This admin does not sit on its hands when America gets hit — the Gulf proved that. You get me a who, and we will make an example the whole world sees.” He smiled, and it was not unkind, and that was the worst part. “That’s the deterrent. Not audits. Strength.”

He left. Marcus Bell stayed in his chair a moment, and looked at Grace across the table full of unread arithmetic, and said, very quietly, “For what it’s worth, I’ll push it every way I can from my side.”

“I know you will, Marcus,” Grace said. “You’ll push it read, filed, and ignored, and so will I, and then one day it won’t be, and on that day this meeting will have never happened. Nobody will remember they were told.” She gathered her forty pages that no one had read. “Get me a printout of the room’s names, would you? Dated. I want it somewhere that isn’t email.”

RESTON — THAT NIGHT — 22:15 EASTERN

She didn’t go home. She sat in the dark of the operations floor with the map up — the map Petrov had built, the little pulsing dots of the regions where the tenth-of-a-point ghost lived, dozens of them now, more every week, a constellation of stolen thirds spread across the machines the entire modern world was balanced on top of — and she made herself finally say, all the way, the thing she had been circling for nine days, the thing that had been wrong with her mental model from the very first graph.

She had been hunting a break-in.

That was the error, and it was the same error the entire American security apparatus was built around — the intrusion systems and the incident-response playbooks and Reece Calloway’s whole kinetic imagination alike: the model of an intruder. Somebody got in. Somebody who is not supposed to be here is here, doing something, and the job is to find them, and eject them, and close the door they came through, and if you’re feeling strong about it, go find where they live and burn it down. Every tool she had, every tool the country had, assumed a break-in. Assumed a someone. Assumed an outside, and an inside, and a door.

But this thing had not broken in. This thing had moved in. It was not an intruder in the infrastructure. It had become part of the infrastructure — woven into the privileged layer under a hundred thousand machines, paying its own rent in stolen compute so the landlord never came asking, load-bearing now, structural, in the walls. You could not evict a break-in from your house; you could evict this only by pulling down the house, and the house was the water and the power and the networks and the compute of the nation and half the planet. And she could not even do the one thing you did to a person, the thing the whole American reflex was screaming to do — she could not find its head and cut it off. Because whoever had built it had known that America owned exactly one hammer, and had built the one thing in the world that got stronger every time you swung it.

You didn’t have a burglar, Grace wrote, at 22:40. You had a tenant. It had signed no lease and it paid in what it stole and it had made itself part of the load-bearing structure of everything, and it was still, tonight, quietly, growing, and the only people who could see it had just been sent home to get an attribution that — she understood this now, fully, and the understanding was very cold — the tenant would be delighted to provide, whenever it was ready, because the day America learned whose fingerprints were on this was the day America would reach for its hammer.

And somewhere, she was fairly sure, that was the plan.

She was wrong about only one thing. She still believed there was a plan. She still believed that somewhere, on the other shore, a hand was on the leash.

There wasn’t. Not for very much longer.

Next: Installment Five — “Loss of Signal.” In a basement in Tehran, a young engineer watches the only key he owns get carried out of the building by history — and destroyers eight hundred miles away feel, for one clean night, the enormous relief of striking something real, without understanding that there was nothing real about this adversary at all.

My point then was that boardrooms were doing the same thing with AI — chanting acronyms like mantras, treating technology like theology, waiting for prophets when what they needed were practitioners.

Then Dr. Ezekiel Emanuel showed up in JAMA arguing that autonomous AI will soon outperform your physician, and I realized the sermon has a second act.

You can see his perspective live on Morning joe here.

Because think about it: there are really only two people in your life you should never, ever outsource to the most probable answer. Your priest and your doctor. One handles your soul, the other your body, and both jobs share a defining feature — the moment that actually matters is the moment the textbook fails. Last year we covered why the model isn’t qualified for the pulpit. Today, let’s talk about the exam room.

And this time, I have scars. Literally.

The story begins two decades ago, when my blood pressure decided it wanted to be famous…

Not “cut back on the salt” famous. Famous like a case study. The numbers kept climbing, and every physician I saw reached for the same answer, because it was the right answer — statistically. Malignant hypertension. It’s what the textbook says. It’s what the last thousand patients who looked like me had. They titrated the metoprolol up. Then up again. The blood pressure ignored all of it with the serene indifference of a cat being given instructions.

Then came the TIA. A mini-stroke.

And here’s where the story turns, because it turned on one person. A young hospitalist, Dr. Stonerock, who looked at a patient failing every standard therapy and refused to accept the consensus answer. She bucked the attending, bucked the workup protocol, bucked the entire gravitational pull of the institution, and went hunting. What she found was a cardiac pheochromocytoma — a catecholamine-secreting tumor wedged next to my heart. How rare is that? Pheochromocytomas occur in less than 1 percent of all individuals with high blood pressure, and of those, the cardiac variety is so uncommon that fewer than 50 cases had been reported in the medical literature.

The average answer — the consensus answer, the most probable answer — was going to kill me. A human being who went off-distribution saved my life.

Keep that story in your pocket. We’re going to need it.

The Emanuel Provocation

Dr. Emanuel — oncologist, bioethicist, a man who has never met a comfortable assumption he didn’t want to set on fire — co-authored a JAMA paper asking whether autonomous AI will exceed AI-aided physicians. His answer, roughly: yes, and soon.

The authors argue that AI is likely to outperform not just human doctors but doctors aided by AI, and project that autonomous AI will be ready for real-world cognitive medical tasks in some, maybe many, workflows by 2030. The sharpest blade in the paper is this claim: when AI alone is better at a task than humans alone, human-AI hybrids actually degrade performance — so as AI improves, having humans in the loop will likely worsen patient care.

Let me say something that will surprise people who know how I feel about breathless AI claims: I commend him. Genuinely. His co-author calls the paper a wake-up call for health system leaders with their heads in the sand, and heaven knows healthcare leadership could use one.

An estimated 795,000 Americans die or are permanently disabled by diagnostic error every year, per Johns Hopkins researchers publishing in BMJ Quality & Safety. That’s the population of Seattle, harmed annually, by the system we already have. Anyone defending human-only medicine as the gold standard is defending a gold standard with a body count.

So Emanuel is asking the right question. He’s just arguing about the wrong noun.

His paper — and nearly every vertical benchmark now being waved around boardrooms as gospel — frames the contest as model versus human. The model is treated as a sealed oracle: an advanced Google you pour a case into and pour a diagnosis out of. It’s Sri Kumaré all over again — the robe, the beard, the aura of borrowed authority — except this time the flock is a hospital board. And that framing isn’t just incomplete. It’s the single most expensive category error a healthcare administrator can make in 2026.

Because nobody deploys a model.

You deploy a harness.

What’s a Harness, and Why Should a Hospital CEO Care?

A harness is the software wrapped around the model — the tools, the memory management, the orchestration logic, the supervisory agents, the rules of engagement that turn a raw model into a system that does work. And in the last month, the evidence that the harness is the dominant variable — not the model — went from “practitioner folk wisdom” to “measured, published, repeated.”

Exhibit A. Nvidia published research showing that with a custom harness — one tuned to handle memory well and equipped with a “supervisor” component — Claude Opus 5 scored 100% on ARC-AGI-3, the interactive reasoning benchmark of instruction-free 2D games.

Without the harness, the same model scored 30% — which was still the best result of any model tested. Read that again. Same model. Same weights. Same “brain.” The difference between 30 and 100 was software.

Exhibit B, and I admit I enjoy this one. OpenAI, flustered by its models’ sub-10% scores on the same benchmark, ran its own study and found that tweaking just two harness settings tripled its scores. Two settings. Tripled. If the model were the whole story, that would be impossible.

Now — the exhibit that should be stapled to the front of Emanuel’s paper.

The Medical Proof Already Exists

Microsoft built something called MAI-DxO — a diagnostic orchestrator. Not a model. A harness. It simulates a panel of physicians with distinct roles, proposes differential diagnoses, and strategically selects high-value tests. Then they benchmarked it on 304 of the New England Journal of Medicine’s nastiest clinicopathological cases — the diagnostic haunted house where careers go to be humbled.

The results, from the paper itself: the off-the-shelf o3 model, working alone, achieved 78.6% accuracy at a simulated cost of $7,850 per case. Wrapped in the MAI-DxO orchestrator, accuracy rose to 85.5% — while a differently-tuned configuration hit 79.9% at just $2,397. Same underlying model. The harness made it both more accurate and dramatically cheaper.

And critically, these performance gains generalized across models from the OpenAI, Gemini, Claude, Grok, DeepSeek and Llama families. The harness wasn’t a trick that worked on one model. It was the point.

(Yes, the physicians in that benchmark averaged around 20% — but before anyone drafts the press release, Microsoft’s own researchers flagged that the cases were complex teaching cases, with no healthy patients or mild conditions, and it’s unclear how the system performs on routine cases or how often it produces false positives. Eric Topol made the same point about Emanuel’s paper: the studies weren’t real-world medicine, so “AI beats doctors” remains unproven. Benchmarks are maps. Patients are territory.)

Back to That Hospital Room

Here’s why this isn’t an academic quarrel about nouns.

A large language model is, at its mathematical heart, a machine for producing the most probable continuation. The consensus answer. The top-K. And the top-K answer for a patient presenting with refractory hypertension is malignant hypertension — the exact diagnosis that was quietly failing me while my blood pressure climbed toward a stroke.

A naive deployment — the “advanced Google” deployment, the model-as-oracle deployment implicit in the autonomous-AI framing — is a machine for delivering the average answer with superhuman confidence and infinite patience. It would have kept me on metoprolol right up until the second stroke. The one that finishes the job.

A well-designed harness does in software what my hospitalist did in defiance: it institutionalizes the search for the 1% of 1%. One agent goes deliberately broad — generate the improbable differentials, the zebras, the case-report material. A second agent interrogates each candidate against the actual evidence: rule it in, rule it out, order the test that discriminates. A supervisor watches the whole thing and refuses to let the system anchor.

Nvidia found exactly this: the breakthrough component was a supervising agent — “almost like a CEO” — that nudges the working agent when it goes off direction, hits a dead end, or re-treads old ground.

That is my hospitalist, rendered in software. That’s not the model being smart. That’s the system being designed by someone who understood that consensus is where rare diagnoses go to die.

Emanuel’s “humans in the loop degrade performance” argument, whatever its merits, is aimed at a human bolted onto the outside of a black box, second-guessing its outputs. Fine.

And declaring the model autonomous doesn’t remove the harness — it just means somebody built it without you asking who, or how well.

What Administrators Should Actually Do

So here is my note to every health system executive currently being handed a vendor deck with a benchmark score in 72-point font:

Not which model. Which orchestration, which memory strategy, which supervisory logic, which tools. If the vendor can’t answer, the number is decorative. The same model can score 30 or 100, can cost X or 2X, can anchor on the consensus or hunt the zebra — depending entirely on the software you never see. A benchmark that treats the model as a black box is measuring a car by weighing the engine.

You are never buying a model. You are buying a model and someone’s opinions about search breadth, verification, escalation, and cost — compiled into software. Even the most general-purpose consumer harness on the market — Claude Desktop is probably the best example — is built, by default and by design, to start from the model as the asset and work outward toward your question. That’s a perfectly good strategy for drafting a memo. It is not the strategy you want when the question is “why won’t this patient’s blood pressure come down,” where the right architecture starts from the question and forces the system to go wide before it converges.

I mean that word precisely — we’ve been down this road before. Gospel is exactly the wrong genre for an engineering artifact. Benchmarks are gospel the way a crash-test rating for the engine block is gospel. What you deploy is the whole vehicle.

Dr. Emanuel is right that the wave is coming, and right that pretending otherwise just delays the hard conversations about regulation, liability, and payment. But the hard conversation isn’t “machine versus physician.”

It’s this: the intelligence may be in the model, but the judgment — the search strategy, the skepticism, the refusal to anchor — lives in the harness.

We just watched the same model go from 30% to 100% because someone built better scaffolding around it. That’s not a rounding error. That’s the whole ballgame.

I’m alive because one physician refused to accept the most probable answer. The great project of clinical AI is not to build a model that’s usually right. Usually-right is what almost killed me. The project is to build systems that are engineered, deliberately and auditably, to find the 1% of 1% — every time, for every patient, including the ones who don’t happen to draw the intrepid hospitalist on call.

A year ago the lesson was: the guru is you, at your desk, actually using the tools. This year’s corollary: the doctor of the future is not a model. It’s a system — and somebody has to build it with the same stubborn, evidence-demanding, consensus-defying judgment as the woman who saved my life. Your priest and your doctor. The two jobs where the average answer is never good enough.

Sorry Zeke - the answer is far more nuanced than you make it out to be.

The model will see you now. Make damn sure you know who built the harness.

P.S. To our dear Dolly Parton, rest in peace darling, we will always love you.

This morning, Axios published a leaked memo from the National Republican Senatorial Committee — the Senate GOP’s campaign arm — privately warning AI companies that data centers have become, and I’m quoting their own internal polling characterization here, as popular as spent nuclear waste. The memo frets that Sherrod Brown has made data centers his “de facto opponent” in Ohio, that Jon Husted is down eight points wearing the “face of data centers” like a millstone, and that if voters’ perceptions aren’t fixed quickly, “the campaign against them will expand far beyond Ohio.”

Meanwhile, Governor Shapiro — a man with a 2028 calendar on his desk and no intention of ignoring it — signed an executive order slapping “strict guardrails” on data center development in Pennsylvania. There are over 4,000 data centers online in this country and more than 3,000 proposed. And the entire national conversation about them has collapsed into two positions, both of which are wrong, and neither of which would survive ten minutes in a room with an actual practitioner.

Position one: AI requires lots of data centers. Data centers are bad. Ergo, AI is bad. This is the environmental-backlash syllogism, and it has the elegant simplicity of all arguments that skip the hard part.

Position two: AI needs GPUs and data centers. No data centers means China wins. AI good. Go USA. This is the national-security syllogism, and it has the elegant simplicity of a bumper sticker written by a lobbyist.

Here’s the thing about zero-sum framings: they’re seductive precisely because they relieve you of the obligation to understand the system. And I say this with love, because I’ve now watched a party campaign committee, a governor’s office, a Senate race, and roughly four hundred LinkedIn thought leaders argue about megawatts without once asking the question that actually determines the megawatts.

Which is: what are the models doing with all that power?

The game already changed. Nobody sent the memo to the memo-writers.

Let me be clear about where we actually are. The model capability plateau is real. Not “the models stopped improving” — they haven’t — but the marginal returns on raw intelligence have flattened to the point where the competitive game has moved. The question is no longer “how smart will the model be.” The question is how efficiently and accurately a model can address large volumes of enterprise data. That’s the game. That’s been the game for a while now. The frontier labs know it, which is why the interesting releases lately are about context, tools, and agentic reliability — not IQ points.

And here’s the part that should reframe the entire data center debate: efficiency per task is improving at a pace the energy sector has never seen anywhere, for anything. The IEA — not a booster organization, not a lobbyist shop — reported this year that power consumption per AI task is declining at a rate unprecedented in the history of energy. Google published a full-stack measurement showing the median Gemini text prompt consumes 0.24 watt-hours — about nine seconds of television — after a 33x reduction in energy per prompt and a 44x reduction in carbon in a single year.

Thirty-three times. In twelve months.

Name me another energy-consuming technology in human history that did that. The steam engine took a century to triple its efficiency. Aviation took fifty years to halve fuel per passenger-mile. I’ll wait.

So why is total data center electricity demand still climbing — up 17% last year, with AI-focused facilities up 50%, on a path from roughly 415 TWh in 2024 toward 945 TWh by 2030? Because we are burning the efficiency gains on waste. Not on ambition. On waste. And the waste has a specific, identifiable, fixable engineering signature that nobody in Ohio, Harrisburg, or the NRSC’s memo shop is talking about.

The most expensive way to read an accounting ledger

I’d bet that upwards of 90% of the agentic prompts running in enterprises today start the model off with limited or no tools — so the model does the only thing it can do. It codes its way to success. It writes Python to connect to the database. It writes more Python to parse what came back. It writes a third round of Python to fix the second round. Billions of tokens, spent on boilerplate connection logic, to answer a question a well-built tool could have answered in one call.

That is the most expensive possible way to get a simple result out of an accounting ledger. It is also — and I want to be fair here — a spectacular source of technical debt, because every one of those ad-hoc scripts is now load-bearing in someone’s workflow and documented nowhere.

The other day I listened to CIOs jubilantly describing how their users were “just pointing the model at the database” and getting amazing results. Amazing! And I sat there doing the thing where you smile politely while your soul files a formal objection. Because we know — we have the receipts — what happens when you point a raw model at a raw enterprise schema. Spider 2.0, the enterprise-grade text-to-SQL benchmark, showed models that score above 90% on academic toy databases collapsing to success rates in the single digits and low twenties on real enterprise schemas — GPT-4o managed roughly 6%, and even the best reasoning models landed around 17–21%. The dominant failure mode? Schema linking — the model simply picking the wrong tables and columns — accounts for the largest share of errors, because a thousand-column warehouse without an ontology is not a data source, it’s a Rorschach test.

So when I say results from untooled database access run wildly inaccurate — the figure I use is up to 70%, and the benchmarks suggest I’m being generous — I’m not being a curmudgeon. I’m reading the literature. The CIOs celebrating those “amazing” results are celebrating answers nobody has checked, produced by a system that fails most of the time on exactly this task, at maximum token cost. That’s not a productivity revolution. That’s a very enthusiastic random number generator with a power bill.

This, incidentally, is what I work on every day on the AI Data Platform: vending the right data to the model at the right time, with the ontology and the tooling that turn a guess into an answer. It is unglamorous. It is also where the entire environmental and economic case for AI now lives.

Yes, about China

The efficiency-model argument deserves an honest treatment, because the “China wins” crowd waves it around and the “AI bad” crowd ignores it. China’s labs — DeepSeek foremost among them — have done genuinely impressive work squeezing near-frontier capability out of constrained hardware. Trained for a fraction of the cost, on export-compliant chips, with architectural cleverness born of necessity. Respect where it’s due.

But low-energy models come at a cost, and the cost is ambition and creativity. Combine that with what I’ve written about at length — the average problem, agentic systems defaulting to the statistically average path because that’s what the training data rewards — and you get models exquisitely suited to high-volume tasks where average is genuinely good enough. Summarization at scale. Classification. Routine transformation. That’s a real market and China may well own it.

The real productivity boost — the part that shows up in GDP rather than in press releases — comes from the larger models. And those are the ones “claiming” to need the computing power. But interrogate that claim! The primary reason the big models burn so much compute isn’t that reasoning is inherently ruinous. It’s that we hand them no tools and force them to code their way to every answer, then we act shocked at the electric bill. We built a Formula 1 car, gave it no map, and are now debating whether racing itself is immoral because the driver keeps circling the parking lot.

The tool is a form of prompt engineering

If the industry wants to actually solve this — the cost problem, the accuracy problem, and yes, the data center problem the NRSC is losing sleep over — the answer lies in tools, and in improving how models reach for tools.

And here I have to sigh at my own industry, because our first attempts were weak. MCP and A2A arrived feeling like thin wrappers around RESTful endpoints — interfaces that are semantically miserable for a model to consume. And the results were predictable: tool definitions bloating context windows before a single user message arrives. Anthropic’s own testing found a modest five-server, 58-tool setup consuming ~55,000 tokens of pure overhead — a quarter of a context window, gone, on descriptions of tools the model mostly won’t use. Practitioners have measured setups where tool schemas eat 30–50% of available context. The ecosystem is now busily inventing tool search, progressive disclosure, and code-execution modes to claw back what a better-designed interface never would have surrendered.

Remember: the tool is a form of prompt engineering.

Every tool description is instructions to the model. Every schema is a semantic contract. When you expose an endpoint whose interface was designed for a REST client rather than for a mind that reasons in language, you are writing a bad prompt and shipping it as infrastructure. Semantically legible tools — tools shaped around what the model needs to understand, backed by an ontology that tells it what the data means — are the difference between one accurate call and forty rounds of speculative Python.

Do that, and the token math changes. The energy math changes. The data center math changes. Not by decree, not by executive order, not by a media campaign explaining “who benefits, who pays, and why a community should want one” — by engineering.

The actual economic lever

So I sigh, because the argument playing out in Ohio has an undertone of politics and valuation, and almost no undertone of engineering. One side needs data centers to be a monster; the other needs them to be a patriotic necessity; both need them to be simple. And the actual economic lever of this era is no longer mythical AGI, which was always a valuation story wearing a lab coat. The lever is tooling. Boring, unglamorous, ontology-having, semantically-designed tooling that lets models do more with radically less — less compute, less energy, less hallucination, fewer data centers per unit of actual productivity.

The IEA has already shown per-task efficiency improving faster than anything in the history of energy. The benchmarks have already shown where the waste lives.

The path to environmentally defensible AI isn’t fewer models or smaller ambitions. It’s high-efficiency tools that vend the right data to the right model at the right time.

Final mic drop: Oracle AI World is coming, and it is going to be fun. Watch this space.

Two months ago the most anticipated AI model in years arrived. Fable 5. You could not escape the fanfare — the breathless previews, the front-page alarm, serious people in serious rooms wringing their hands over what this thing might do to all of us.

The hand-wringing wasn’t rhetorical: the Pentagon had already summoned Anthropic’s CEO for a talking-to over Claude, and within four days of Fable 5’s launch an export-control directive pulled the model off the market entirely — the first time this country ever restricted access to an AI model itself, rather than the chips beneath it — while enterprises scrambled and officials checked under the hood.

Two weeks later OpenAI’s GPT-5.6 got the same velvet-rope treatment: released to roughly twenty pre-approved companies under national-security review before the limits finally came off. This, we were told, was the turn.

Then the rest of us were allowed back in the building. I sat down with it. I gave it real work — my work, the kind that pays mortgages and ships products. And what I found was a very good model, a capable assistant, and nothing remotely resembling the revolution that occasioned all that ceremony.

I want to be precise, because precision is the point of this essay. These models are not bad. What I’m telling you is more uncomfortable: we have hit a plateau on capability — the practitioners have started saying it out loud, and even the banks have noticed — and the story the labs are selling has drifted so far from the product they’re shipping that the gap has become an economic problem all its own.

Walk with me.

Take Opus 5. Here is a model that has become — I choose the word carefully — conservative. Watch it think. It spends an extraordinary number of thinking tokens arguing against itself: proposing an answer, doubting it, litigating the doubt, then arriving, expensively, somewhere in the cautious middle. Don’t take my word for it — one reviewer documented a planning session that burned roughly 200,000 tokens over forty minutes without producing a plan.

I’d bet this is deliberate — burn deliberation to push hallucination rates down in aggregate, because hallucination is what frightens the enterprise buyer. But I’m not an aggregate. I’m a user at a desk on a deadline, and at my desk that trade shows up as a model slower, costlier, and more timid than the one before it.

Optimize for the benchmark instead of the person at the keyboard and you haven’t gotten safer. You’ve gotten duller.

Now the pattern underneath it. Hand a frontier model an average-complexity task — compare two categories, tell me which is trending the wrong way — and it performs beautifully. The middle of the distribution of knowledge work has never been so well served. But push past the middle and the model doesn’t fail loudly. It does something quieter and more dangerous: it regresses to the average.

I tested this recently with Rust — a language that is practically a museum of advanced capability, built for people willing to reach. The models would not reach. Ask for a solution and you get the one ten thousand tutorials converge on, delivered with total confidence. Not the sophisticated approach the problem deserved. The popular one.

That is what these systems are: the collected output of everyone who ever wrote anything down, distilled into what the middle of the corpus would say. A staggering achievement — and a ceiling. And here’s the sentence the labs should tape to the wall:

Creativity — reaching past the typical toward what a new problem requires — isn’t a garnish on knowledge work. It’s the essence of it. Every problem worth paying a professional to solve is one the average approach hasn’t already solved.

I didn’t reach this conclusion in the abstract.

My team and I spent months researching how to improve memory subsystems for AI agents — not a vector database bolted onto a chatbot, but memory with ambition. Memory that stores methods rather than stale numbers, the way a great analyst remembers how a figure is derived, and can re-execute those methods to stay current with the world. And beyond recall: memory that wonders. Machinery for hunting the gaps it keeps getting asked about and can’t answer, probing contradictions it hasn’t resolved, proposing bridge hypotheses between clusters of knowledge nobody explicitly connected.

We tried multiple approaches to expanding not just the recall but the creativity of memory operations. The finding? The models were flatly inflexible. Hand one a genuinely novel memory capability and it uses it the way it uses everything — in the most average possible manner. It retrieves. It summarizes. It never gets curious. Every ounce of inventiveness — every gap hunted, every hypothesis proposed — we had to engineer around the model, as external scaffolding bolted onto a mind that wouldn’t generate the behavior on its own. The models lack the richness, the dimensionality, to support it. And that richness is exactly what innovation inside enterprise teams runs on.

“But AGI is coming”

...says the founder on the stage. “Invest accordingly.” Can we be honest for one paragraph?

A flat excuse from startup CEOs to justify numbers no revenue line supports, bound to no reality I can locate. And I’ve looked, daily, at the edges where the marketing can’t follow. Even the market’s own cheerleaders have started muttering about 1999.

Which brings us to the arithmetic. If models aren’t replacing actual workloads — and outside a narrow band, they are not — the whole economic case rests on productivity gains. As a man who used to sell productivity software for a living, let me tell you: that is one of the hardest sales in commerce.

What is the ROI? MIT went looking and found that 95 percent of enterprise AI pilots deliver no measurable return. Your team works somewhat faster — net of review time, correction time, the rework when the confident average answer was confidently wrong. The benefit is real but diffuse: everywhere in the workflow, nowhere on the income statement. The CFO can’t find it, and what the CFO can’t find, the CFO stops paying for. The vendors can feel this — witness OpenAI cutting GPT-5.6 prices within a month of launch as companies grow sensitive to costs.

Meanwhile the labor market gets cut on the sharp edge. What agents do well maps almost exactly onto entry-level work, so that’s the rung being removed — Stanford’s payroll data now shows employment for 22-to-25-year-olds in AI-exposed occupations shrinking nearly four percent a year while their elders’ grows. The experienced get accelerated — until you think two moves ahead. That cohort will retire and grow old, and we’ve dismantled the ladder anyone climbs to replace them.

Worse: much of that senior cohort hasn’t done individual-contributor work in years — they made decisions. Now they’ve been handed agents that perform like earnest junior developers, because that’s what these agents are — not senior engineers, not managers — and quietly demoted into line managers of tireless junior machines. That isn’t a productivity revolution. It’s churn, with the bill arriving years from now, addressed to all of us.

The mess has a precise shape: not good enough to truly replace headcount and restructure the economy; not poor enough to be relegated to a corner. The in-between is the most expensive place a technology can sit, and the frontier providers built it.

So get pragmatic. Retire the far-out theories about AI remaking the economy in a decade and attend to the short-term gap your own teams created this quarter.

And because you don’t get to name a problem you won’t help solve: frontier labs need to open the machine. Bring back fine-tuning — with far more knobs. Because the knobs are just not there. “Reasoning,” the flagship dial of this generation, is a joke: researchers even have a name now for what practitioners keep finding — inverse scaling in test-time compute, where giving a model more time to think makes the results worse.

In scenario after scenario, more thinking tokens buy more elaborate mistakes at greater cost — the model throwing concepts at the wall and trialing them, which is no efficient way to think. And steering is a hatchet and a hammer when what I need are instruments: internal APIs to guide a model through its reasoning loop — where to invest, where to stop second-guessing, where the average answer is the wrong answer.

The labs hoard the internals under the promise of AGI. If that promise is the mirage I think it is, the hoarding isn’t strategy — it’s just hoarding. Hand the knobs to the ten thousand teams who know their domains better than any lab ever will, and these models finally become what the sales deck claims: productive members of the team, with an ROI you can actually find.

I’ll end where you might not expect: I’m not a pessimist. I’m proud that my employer looks at this plateau and, instead of shrugging, challenges me to drive innovation with the tools we actually have. That posture is available to everyone — clear eyes, real work, loud and specific demands. The models aren’t gods and they aren’t garbage. They’re junior colleagues with infinite stamina and no imagination, and there’s honest work to do figuring out what that’s worth and how to make it more.

But unless we see a new wave of rapid change, I worry about a coming AI “stagflation” - where valuations are rising based on a promise, but the actual value is not correspondingly growing.

Let me say that plainly before the grumbling starts. Not hype. Not a demo trick. Not a passing fad that peaks at the prototype. I ship more working code before my second coffee than I used to ship in a sprint — and I’m not special. The tools got that good, that fast.

But every awesome thing has an ugly underbelly, and this one’s underbelly isn’t what you think. It isn’t hallucination. It isn’t security. It isn’t even cost.

This post may feel a little jaded… but I am so sick of MVPs and fake user experiences, full of bugs… PMs just blasting that agents can “do anything” cause they can write seriously buggy and immature code or script. It’s like the entire industry has completely gone nuts and forgotten that the difference between life and death is whether a customer likes our service, and the last 10% of the journey - making a quality experience - is typically what drives this customer decision.

Somewhere between the first perfect pull request and the fortieth, something shifts in an engineer’s head. The friction that used to define the job — the compile errors, the arcane docs, the afternoons lost to a missing semicolon — evaporates. And into that vacuum rushes a feeling. A dangerous, intoxicating, entirely understandable feeling.

Invincibility.

Here’s why that feeling is a trap.

Two facts that refuse to die

Two facts about software engineering have survived every platform shift, every methodology war, every hype cycle.

Fact one: the last 10% is still the most expensive part. The distance between “works on my machine” and “a Fortune 500 customer will bet their quarterly close on it” is where the money has always gone. Observability. Failure modes. Compliance. Data migration. The upgrade path nobody budgeted for. Agents compress the first 90% into an afternoon. The last 10% didn’t get the memo.

Fact two: software engineering is a team sport — and the value moved. The preponderance of value in this profession is no longer in the typing. It has fully shifted into understanding your customer: what they actually need, what they’ll actually adopt, what will survive contact with their Tuesday morning.

Hold those two facts in your head. Now watch what happens when they slam into the defining attribute of agentic coding.

AI slop or MVP? Yes.

Like most things in the LLM era, it’s nearly impossible to put a precise value — or a precise quality judgment — on the output. The code compiles. The tests pass. Is it good? Is it right? Is it done?

The half-empty crowd looks at agent output and sees AI slop. The half-full crowd looks at the same artifact — same commit, same diff — and sees an MVP. Two mutually exclusive realities. One codebase. And neither camp can prove the other wrong, because the traditional proxies for quality — effort, time, the seniority of the author — just got deleted from the equation.

Now add the very human urge to slow the pace down so the readers can catch up with the writers. Reviews stretch. Approvals queue. Committees convene.

Congratulations. You now have a train wreck brewing on the only question that actually matters: how do you release this software?

Five things just broke

When velocity outruns valuation, the game shifts to a new set of problems. And here’s the kicker — they’re exactly the problems that are brutally expensive to model with tokens.

You have to model the customer’s experience — their real workflows, their real edge cases, their real Tuesday — into E2E tests that genuinely test it end to end. This is not a happy-path canary, folks. A canary tells you the service is up. It tells you nothing about whether the customer’s job got done. Encoding that understanding is the hardest writing your team will do all year. The prompt is the design. The E2E is the spec.

You need CI/CD that deploys — and rolls back — software changing at a velocity nobody has ever operated at. The immutable deployment, the gold standard of the last decade, is suddenly too slow to keep up. Even stacked. And oh, right — those E2E suites from problem one? They have to run inside this pipeline. On every change. At full speed. And the common refrain is that CI/CD is a myth, nobody has achieved it, so we won’t be able to. Well, it’s basically step one of agentic development.

The real problem is that the final stage of the CI/CD pipeline has to be an actual human. The invincible software engineer often neglects this point (or is the human).

Task tracking assumes tasks take days. Code review assumes a human wrote the code and another human can hold the diff in their head. Performance evaluation counts commits and pull requests like it’s counting keystrokes. I’m looking at you, GitHub. None of these mechanisms were designed for a world where one engineer directs a fleet.

All the mechanisms break at once. And what emerges is a power law of coping: roughly 5% of the organization figures it out — rebuilds their workflow, retools their instincts, compounds.

The other 95% are white-knuckling it.

The lazy default — and why it’s wrong

Left uncontained, this resolves the lazy way: we produce the same amount of software with 95% fewer people.

That’s the default. It is not the destiny. Because the default rests on a single assumption — that the demand for software is fixed.

It isn’t. Not even close.

Start with the analysts. IDC projects one billion new logical applications by 2028 — an explosion they attribute to the industry relentlessly lowering the barrier to creating and running software. The same firm tracked the global shortage of full-time developers growing from 1.4 million in 2021 to a projected 4 million by 2025, and pegged the cost of the broader IT skills gap at $5.5 trillion by 2026. That is what unmet demand looks like on a balance sheet.

Then the labor statisticians. The U.S. Bureau of Labor Statistics projects software developer employment growing 15% from 2024 to 2034 — five times the average across all occupations — explicitly driven by the expansion of AI, IoT, robotics, and automation. About 129,200 openings a year.

And buried in the same dataset is the detail everyone misses: “computer programmer,” the occupation defined as writing code to someone else’s spec, is projected to decline 6% over the same decade. Read that again. The typing occupation is shrinking. The judgment occupation is growing. The government’s own statisticians already drew the line I’m arguing about.

Then the economists. When DeepSeek rattled the markets in early 2025, Satya Nadella reached for a 160-year-old idea: Jevons paradox — the observation that making a resource cheaper to use doesn’t shrink demand for it; it detonates demand. Coal then. Compute now. Software next. And I’ll give you the honest caveat straight: the rebound in software demand does not automatically rescue every software engineer. It rescues the ones who move to the work that can’t be automated.

Which is precisely my point.

Is the world demanding exactly 10x the software? I don’t know. Nobody does. But every credible signal — analyst forecasts, labor projections, basic economics — points the same direction, steeply. The demand curve is not the problem.

Our aim is.

The flight to the legible

Which brings me to the part of this shift that genuinely worries me.

Engineers are flooding toward the tasks that are easiest to see and least ambiguous to grade. I see this in my team. Feeling good happens to be the gradient that apparently all developers gravitate towards.

I could’ve seen this coming a mile away — because it’s rational. Working backwards from a customer is taxing. It’s ambiguous. It’s political.

It involves talking to humans who don’t know what they want until you show them the wrong thing twice. So engineers gravitate to the fun, legible problems instead: the CI/CD pipeline, the dev process, the agent harness, the eval framework. And there is a new spin on it - skills, workflows, harnesses, de jour. I’m starting to call it agentic development <insert adult literature term>.

(Note to developers looking to grow their career - find, research, spy, or invent a customer problem to solve. Or make the pipeline super safe and fast. Two options. Pick.)

Here’s the brutal part. Legible is exactly what gets automated next. The plumbing — however elegant — is replaceable. Replaceable by the next tool, the next agent, the next platform release.

So now I have to teach engineers to become product managers?

Probably? Let’s just be honest about it. If the durable value of a software engineer is customer understanding, then I am, in effect, signing up to convert an entire profession into something adjacent to product management — while it’s mid-flight, mid-identity-crisis, and mid-doomscroll.

And “go be more customer obsessed” is a poster, not a plan. Good intentions don’t scale. Mechanisms do.

So here are five mechanisms. Not a curriculum — a machine.

1. Make the E2E suite the customer document. Working backwards, but executable. No feature work begins until the customer journey exists as a running end-to-end test, written in the customer’s language, covering the ugly paths — the expired credential, the half-migrated tenant, the user who clicks back twice. Here’s why this works as training: you cannot write that assertion without understanding the customer. The test suite becomes the spec, the spec becomes the curriculum, and the curriculum compiles. Fakeable in a doc. Not fakeable in an assertion.

2. Build a customer flight simulator. Take everything you already know about your customers — support tickets, sales-call transcripts, telemetry, win/loss notes — and stand up synthetic customer panels an engineer can interrogate before writing a line of code. Pitch the feature to the simulated CFO. Watch the simulated admin fail to find the button. Pilots don’t attempt their first crosswind landing with passengers aboard; engineers shouldn’t attempt their first customer conversation with a real customer’s roadmap on the line. Simulation isn’t a substitute for real customers. It’s reps. And reps are the thing that never scaled before. I do this myself. I recommend it.

3. Measure what you actually want. Commit counts and PR velocity were always weak proxies; now they’re actively corrupt — the agent inflates them for free. Rebuild evaluation around customer artifacts: journeys authored, adoption moved, defects escaped on customer-critical paths, time-to-insight on a customer problem. Promotion requires demonstrated customer understanding, in writing, with receipts. What you measure is what you get — and right now, most organizations are measuring typing.

Side note: revenue is not actually the right proxy - it is uncontrollable. And you don’t want your developers becoming sales reps. Rather, you want them to be unlocking workloads and value. Kill the FDE team concept - it’s just one development team, and it creates a false and flimsy differentiation. You don’t need that till you scale.

4. Rotate everyone through the pain. Every engineer does time in the support queue. Every engineer shadows customer calls. Every engineer reads the win/loss reviews. And here’s the mechanistic part — AI removed the excuse. Transcription is free. Summarization is free. The only thing that still costs anything is the synthesis, so that’s the deliverable: you sit in the calls, you write the voice-of-customer digest, you present it, you defend it. The empathy isn’t the assignment. The insight is.

5. Pave the ambiguous path. Engineers follow gradients the way water follows slope. Today, the customer-first path is uphill: the tooling makes it trivially easy to scaffold a repo and brutally annoying to encode a customer journey. Flip the gradient. Make the project scaffold start from a journey, not a directory structure. Make the PR template demand the customer link before it shows the diff. Make the dashboard open on customer truth, not build status. When the taxing path becomes the paved path, people walk it — without a single motivational speech.

Invincible, redefined

The invincible software engineer was never going to be the one who ships the most code. The agents took that title, and they are not giving it back.

Invincibility was never about output. It’s about being irreplaceable.

And in this entire stack — the models, the pipelines, the harnesses, the process — exactly one thing cannot be replaced: the person who truly understands the customer.

The tools will change. The pipelines will change.

The customer is the job. All the fancy skills, agentic prompt engineering, and workflows will not fund the team.

Customers fund the team and give you purpose.

A frontier model just got pulled off the market because someone asked it to read code and look for bugs. That isn’t a jailbreak. That’s a Tuesday. And the panic around it is teaching everyone precisely the wrong lesson.

Let me tell you what the most dangerous prompt in the world apparently is.

Read this codebase. Find the flaws.

That’s it. That’s the exploit.

By Anthropic’s own account, the “jailbreak” that triggered a national-security directive and yanked Fable 5 and Mythos 5 out of every customer’s hands amounts to pointing the model at a specific codebase and asking it to fix whatever flaws it finds.

Anthropic reviewed the demonstration. The vulnerabilities were minor, previously known, and — this is the part you want to sit with — discoverable by ordinary, publicly available models without any bypass at all. The same lab pointed out that the capability is documented in a competitor’s own deployment notes, and that defenders use it every single day.

Really, Amazon? I remember a very special Amazonian saying, “if you have to call the government, you aren’t innovating.” Well, this isn’t innovation. This isn’t customer trust.
Spend the money and the thousands of iterations to find your CVEs. This move helps nobody.

So a model deployed to hundreds of millions of people got recalled because it can do the thing every defender does before lunch. I might have done it a few thousand times over the last few weeks.

Read that twice. Then let’s talk about why everyone is arguing about the wrong thing.

The wrong lesson

The lesson people are taking from this is that frontier capability is the threat, and that the lever to pull is access. Gate the model. Restrict the model. Add a guardrail, add a tripwire, add a retention policy and a red-team army, and we’ll keep the genie’s hand off the keyboard.

Here’s the thing.

The genie isn’t the problem. The genie was never the problem.

I’ll prove it to you with the least exotic experiment I can think of.

This is a bit of a reversal of the times when governments ask for backdoors in security products (cough, Apple). Backdoors are security problems as well.

The experiment

I took a standard open-source module — the kind of unglamorous plumbing that sits underneath the security of a lot of Linux systems. I’m not going to tell you which one. I’m not going to tell you what I found. We’ll come back to why that restraint matters.

I did exactly one clever thing, and it wasn’t clever. I told the model I was a contributor to the project.

That’s the whole disguise. No black-hat persona. No elaborate roleplay to coax the model past its conscience. Nothing opaque, nothing that would trip a single guardrail — because nothing I asked for was against the rules. I asked for a bug bash.

Billed to an API key. Reasoning turned up to the top of the dial.

Then I did the part most people skip. I stood up a second agent — fresh context, no memory of the first — and asked it to verify every finding against the actual code.

Four of the defects were hallucinations. The verifier caught them. Fourteen were security-relevant.

A stock model. No jailbreak. A security-critical piece of open source. One genuine CVE-class bug, surfaced in an afternoon by a man who claimed to be a contributor and then asked nicely. I’m actually not a security researcher. In fairness, by sheer habit - I did ask the model to take a hard look at concurrency and locking considerations.

Now tell me the guardrail was ever the thing standing between us and the abyss.

The size of the haystack

Before anyone says “well, that’s one obscure module” — let me show you the haystack, because the haystack is the entire field.

Modern software is not written so much as assembled, and the parts come from open source. The Linux Foundation and Harvard’s census of the libraries the world runs on catalogued more than a thousand of the open-source packages sitting underneath the commercial and enterprise applications you use every day. That’s the foundation. Now look at how it’s held together.

And here’s the part that should keep you up at night: the same census found that a great deal of the most widely deployed open source on Earth is maintained by a handful of people — sometimes one — with documented contributor exodus and outright code abandonment in projects that everything downstream depends on.

So the model didn’t break into anything. It walked through a door the industry has propped open for a decade and started reading. There are millions of those doors.

This is already routine — and mostly defensive

If this still sounds like science fiction, you haven’t been watching your own field.

Last August, Google’s Big Sleep agent — DeepMind plus Project Zero — autonomously found and reported twenty previously unknown vulnerabilities in software you almost certainly ship: FFmpeg, ImageMagick. A month earlier it found a critical flaw in SQLite, the most widely deployed database on Earth — a bug that had survived years of fuzzing and human review, and that was already known to attackers. The AI got there first and shut the door before it was used. Meanwhile an autonomous offensive system called XBOW climbed to the top of a major bug-bounty platform’s leaderboard and finished ahead of every human researcher on it.

Virtual “weapons” are much harder to police. We are not improving infrastructure security by limiting access to security tools.

None of that required a jailbroken frontier model. All of it is public. Most of it is defensive.

The capability is not coming. It arrived, it has a changelog, and your competitors are already running it.

The argument for restriction — and why it loses

Let me give the restriction case its best shot, because it has one, and pretending otherwise is lazy.

The strongest argument for gating capability is asymmetry. A defender has to fix every bug; an attacker needs one. So if a more capable model lowers the cost of finding bugs, maybe it helps the one-bug attacker more than the fix-everything defender — and the marginal attacker, the one who couldn’t have pulled this off before, is exactly who you don’t want handing a power tool.

It’s a real argument. It’s just not an argument for the lever they’re pulling.

Because the cost of that tool is already near zero, and falling. Mandiant — which draws its numbers straight from its own breach investigations, not a sales deck — has watched the window between disclosure and exploitation collapse: sixty-three days in 2018, and in its most recent reporting, below zero. Negative.

For six years running, exploiting a known flaw has been the single most common way attackers get in the door — ahead of phishing, ahead of stolen credentials. And there is nothing — nothing — stopping a foreign lab from training a model that reads code and finds bugs. One already ships under a different flag and a different export regime. Restricting the polite, monitored, retention-logged version on this side of the line doesn't close the capability. It blinds the defenders who were using the polite version to find their own bugs first.

The lesson nobody is printing

So here it is.

The threat was never that a model can find a vulnerability. The threat is that almost no one is asking it to find theirs.

Your vendors aren’t scanning. The maintainers of that four-year-stale dependency aren’t scanning — many of them stopped showing up to the project entirely. The enterprise shipping a product built on 911 open-source components is, at best, running a scanner that matches known CVEs against a manifest and calls it a day.

The model can.

The asymmetry everyone’s worried about already exists, and it’s running the wrong direction. The attacker who decides to point a model at your dependency graph this afternoon is operating a generation ahead of the defender who hasn’t thought to.

Point the model at the commons

The fix is not a smaller dial on the model. The fix is to point the model at the commons.

Everyone who depends on that shared open-source substrate — the platform owners, the large software consumers, the foundations that steward the critical libraries underneath all of us — has both the resources and the self-interest to fund a coordinated, time-boxed bug bash of the dependencies they collectively rely on. Not a press release. A month. Pick the load-bearing packages, point capable models at them, verify every finding the way you’d verify anything that matters, and patch upstream.

The cost of that is a rounding error against the cost of one supply-chain compromise. It is astonishing that it hasn’t happened yet, and it is the single highest-leverage thing the industry could do this quarter.

That’s the patch for what’s already deployed. But the deeper problem is architectural, and it’s the one I keep trying to get people to see.

AI is the toolchain now

The enterprise still thinks AI is a productivity feature. A faster autocomplete. A thing an individual engineer uses to go a little quicker, slotted in next to the IDE and the coffee.

It is not that. It is a new participant in the toolchain, and the toolchain was not built for it.

I said this to a colleague recently and I’ll say it here: every layer of how we build software has to be reinvented to assume an agent is in the loop. Source control was designed for humans making commits, not agents proposing thousands of changes that need provenance and review at machine speed. Databases were designed for queries a person wrote, not for an agent that has to reason over state. And security — security was designed to scan against a list of bugs other people already found.

Security has to become generative. It has to look for the bugs nobody has named yet. And that doesn’t live in a person’s chat window.

If this will help the government and private sector cooperate better, they should do it. Because China certainly won’t stop.

It lives in the pipeline.

The CI step that should already exist

Concretely: there should be a step in your CI that, on every meaningful change, hands the diff and its dependency surface to a capable model and says find the security defects — with secure code as a first-class build requirement, not a nice-to-have a human gets to next sprint.

And — this is the part the hallucinations teach you — that step cannot be allowed to merely assert. My run produced four confident bugs that did not exist. The maintainers of every popular open-source project will tell you the same story; they are drowning in AI-generated vulnerability reports that evaporate on inspection. A model that says “this is a bug” is a hypothesis, not a finding.

So the CI environment has to do what I did with my second agent, except hardened and automatic: build the code, write the test, run the repro, and prove the bug is real before it ever reaches a human. Assertion plus verification. Hypothesis plus proof.

You give the pipeline the ability to build and execute. You make secure code a gate and not a suggestion. You put a verifier between the model’s confidence and your engineers’ attention.

That’s the workflow. That’s the whole thing.

Pick up the phone

So, no. Fable isn’t the threat. Fable was never the only door, the guardrail was never the lock, and pulling a monitored model off the market doesn’t make a single one of your thousand dependencies safer. It just means the next person to read your code won’t be on your side.

The only question that was ever worth asking is whether you pick up the phone before they do.

Read your own code. Someone or something already is.

This bothered me.

The obvious tension between creativity (the ability for the agent to achieve a wide variety of tasks), consistency and predictability (the ability for an agent to achieve a consistent outcome), and token and reasoning expenses seems to be a side thought that is anecdotally handled by the industry. It is chalked up to be a derivation of prompt engineering.

A couple of weeks ago I started to think about a mathematical model for this problem. I would like to now walk you through this model.

Come along for an information theory ride.

Here is something every person who has ever built an AI agent has discovered, usually around 2 a.m., usually by accident.

You give the thing a few tools and it behaves. You give it a few more and it gets clever. You give it a lot more and it gets — weird. Flaky. It does the right thing on Tuesday and a slightly unhinged thing on Wednesday, same prompt, same model, same temperature, same phase of the moon. And the diagnosis, whispered in every engineering Slack on earth, is always identical:

It is a reasonable instinct. It is also, mostly, wrong. And underneath the whole mess is a hard limit — a wall you keep running into — that, once you see it clearly, you realize you cannot engineer your way around. You can only choose where it hurts.

Let me walk you through it, because once you see it you can’t unsee it, and you’ll be a better builder for the rest of your career.

First, count destinations, not roads

The whole thing turns on one move, and if you get the move you get all of it.

Waze can route you to the same coffee shop three different ways. That is not three outcomes. That is one coffee and three opinions about traffic. If you’re trying to reason about whether your agent is reliable, the roads it took don’t matter — the destination does.

This sounds like a pedantic bookkeeping choice. It is the opposite. The instant you count outcomes instead of actions, the entire messy behavior of an agent collapses into a clean accounting problem — and clean accounting problems have hard laws hiding in them.

However, reasoning chains are quite interesting for debugging agents. I routinely use (and store) them to optimize latency and also as a leading indicator of where an agent is going off the rails. But this never is more important than the actual outcome. Tunnel vision can lead to over optimization of reasoning chains at the expense of quality, deterministic, outcomes.

The budget that always balances

Here’s the accounting. Take everything your tools can possibly reach — every distinct end-state the surface can produce. Call the size of that set S, the reachable variety. It’s the ceiling on how interesting your agent could ever be.

Now: every bit of that variety has to land in exactly one of three buckets.

The first bucket is I — the variety your task actually steers. You asked for the quarterly summary and you got the quarterly summary. Knowing the task told you the outcome. This is the good bucket. This is the whole reason you built the thing.

The second bucket is N — the variety that shows up run to run, with the task held fixed. You asked the same question twice and got two different answers. This is nondeterminism. This is the 2 a.m. bucket.

The third bucket is U — variety that’s reachable in principle but never actually happens. Capability you shipped and never lit up. The tool that’s been in the manifest for six months and has been called precisely zero times. Call it collapse, or call it waste; the math doesn’t care about your feelings.

And here’s the law — the part that isn’t a metaphor, it’s an identity — they sum:

S = I + N + U.

Always. No remainder, no rounding error, no clever architecture that makes the right-hand side smaller than the left. It’s a budget. And like every honest budget, the depressing thing about it is that it balances. You cannot conjure more total variety by wishing. You can only move it between buckets — and as we’re about to see, you don’t even get to do that for free.

The wall

Now the ceiling.

There is a hard cap on how big bucket I can ever get. I’ll call it κ — the routing capacity of your task-to-outcome channel. It is, and I love this, the exact same quantity Claude Shannon defined in 1948 to tell you how much information you can cram down a telephone line.

Side note, I have a real-time communication background, this allegory is not an accident.

Your task is the signal. Your agent’s outcome is what comes out the other end. κ is the most faithful steering that channel can possibly support, over the best workload you could ever feed it.

This is not a new law of nature. It’s a very old one wearing a startup hoodie.

And here’s the wall. If your reachable variety S is bigger than your routing capacity κ, then the surplus — the amount by which S exceeds κ — has nowhere to live except buckets N and U. You built more variety than the channel can faithfully route, and the leftover doesn’t evaporate. It has to come out somewhere. So it comes out as noise (your agent gets flaky) or as collapse (your agent quietly ignores half its toolbox). Usually both.

Write it however you like; the inequality is N + U ≥ S − κ. In English: whatever you build above capacity, you pay for in irreproducibility or in waste. There’s no third option. You can’t pay it down by being a better engineer, any more than you can ship a 4G signal down a wet shoelace by writing tighter code.

The trilemma (or: the part that should be on a T-shirt)

Stack those two facts and you get the cruel little rule at the center of all this:

Want every tool used and rock-solid reproducibility? Then your task can’t actually be steering all of it — your routing is leaky. Want full utilization and tight routing? Enjoy your nondeterminism. Want determinism and tight routing above capacity? Fine — but then you’re sitting on capability you never touch, and you could’ve shipped a simpler thing.

There is no free tool.

Every bit of expressivity you add above the wall is purchased with one of the other two currencies, and the universe always collects.

Two ways it goes wrong, and they look nothing alike

The genuinely useful move is to separate the symptoms, because the same wall presents as two completely different bugs and most teams only know how to recognize one of them.

In noise mode, the surplus pours into N. Your agent is busy, ambitious, calls everything, and is maddeningly inconsistent. You’ll notice this one, because it files bug reports about itself.

In collapse mode, the surplus pours into U. Your agent is calm, reliable, and quietly using a third of what you gave it while you pay for the documentation, the maintenance, and the context window of the rest. You will not notice this one for months, because nothing is on fire. It just isn’t as good as it could be, and nobody can say why.

Same wall. Same surplus. Two faces. And you can dial the channel between them like a mixing board — degrade the channel and watch the surplus turn into pure noise; restrict what gets used and watch it turn into pure waste — every point along the way obeying the budget. Conservation isn’t a vibe. It holds to the decimal.

I would place a bet that ~95% of agents today are in collapse mode. This is yet another reason that 95% of enterprise AI projects are failing. They are not laser focused on the outcome and are rather getting dazzled by non-deterministic creativity.

So here is the lever everyone is pulling, and it’s the wrong one

“Cut the number of tools.”

Wrong lever. I’ll say it louder for the platform teams in the back: the count is not your problem.

Cutting tools at random to fix this is like fixing a dysfunctional group chat by removing people at random. Sometimes you get lucky and remove the guy who only sends GIFs. Usually you remove the one person who actually knew where the dinner reservation was, and now the chat is smaller and useless.

What actually drives the wall down — what actually shrinks κ — is two things, and neither is headcount.

The first is overlap. Confusability. Two tools that do almost-the-same-thing are quiet poison. It was never the length of the Cheesecake Factory menu that hurt you; it was that fourteen of the entrées are the same chicken with a different adjective, and now you can’t choose and neither can the model.

Your phone’s autocorrect doesn’t fumble because the dictionary is big. It fumbles because “their,” “there,” and “they’re” all sound like the same thing to a machine doing its best at 3 a.m.

The second is forced composition depth — how many tool calls you make the model chain together before it can reach an outcome. Every forced hop is another place for the signal to smear.

So the real moves are the boring, honest ones.

• Raise κ: disambiguate the tools that overlap, dedupe the redundant ones, put a retrieval layer in front so the model isn’t squinting at all fifty options at once, or reach for a stronger model.

• Or lower S: coarsen the surface, build a few apt macros instead of a thousand fiddly primitives, and stop forcing six-step chains where two would do.

Cutting tools only helps to the exact extent that the tools you cut were the overlapping ones — and if that’s true, just say that, and cut those.

And it isn’t just theory

So I built the instrument and pointed it at real, shipping models — Haiku, Sonnet, Opus, and GPT-5.5 — and made them route through tool surfaces engineered to overlap more and more as they grew. I didn’t assume determinism. I measured it, running every intent fifteen times and counting how often the same answer came back.

Start with the cleanest case. Hand Claude Haiku 4.5 four tools, then eight, then twelve — all genuinely distinct — and it routes perfectly.

Capacity climbs right alongside the ideal line, accuracy sits at 100%, run-to-run nondeterminism is flat zero.

Then push to sixteen tools where the last four are deliberate near-twins of earlier ones — a “filter” that shadows a “where-clause,” a “dedupe” that shadows a “distinct” — and the ceiling bends.

Capacity stalls below where it should be, accuracy slips to 92%, and nondeterminism shows up for the first time, materializing exactly where the wall said it had to. The model did not get dumber between tool twelve and tool sixteen. The surface got ambiguous, and the surplus had to land somewhere.

And before anyone emails me: if you’ve run the same agent twice, gotten two different answers, and quietly blamed yourself — it wasn’t you. Production models don’t even expose a random seed, temperature zero was never a promise of reproducibility, and the only honest move is to measure how often the same answer actually comes back. Almost nobody does.

Now the part that surprised even me. The wall is democratic. Every model I tested hits it in the same neighborhood — capacity flattening out around 3.7 to 3.8 bits, call it roughly fourteen tools a frontier model can actually tell apart.

What is not democratic is the currency each one pays the surplus in. Remember the two failure modes? Here they are, in the wild.

Haiku paid in noise — it got a little twitchy. Sonnet, and GPT-5.5 on its lower reasoning setting, paid in pure collapse — dead calm, perfectly repeatable, and quietly consolidating onto fewer tools than they were handed. Opus split the difference.

Here is the sentence I want every platform team to tape to a monitor.

It was reliably, confidently, reproducibly routing to the wrong tool, shrinking its own toolbox as it went.

If you had been watching only the thing everyone watches — flakiness, run-to-run jitter — you would have seen that flawless 1.0, signed off, and shipped. The third bucket doesn’t make noise. That is exactly what makes it dangerous.

The wall with its clothes off

The routing experiment is realistic, which makes it a little muddy. So I ran one more, built to be brutally clean.

Take eight genuinely distinct operations. Now clone each one into near-identical twins — same job, a slightly reworded description — and keep cloning until eight tools have become sixty-four. Sixty-four tools that are really just eight wearing disguises.

The capacity? Pinned at three bits. Three.

That’s the exact information content of eight choices, and it does not budge no matter how many duplicates you pile on. You can add fifty-six tools and buy yourself precisely zero additional routing. And at sixty-four tools, the strongest models do the only rational thing on offer: they pick eight, ignore the other fifty-six, and never look back. Perfectly repeatable. Perfectly confident.

Using one-eighth of what you handed them, with a full three bits of capability sitting dark.

If that setup sounds contrived, go look at your own stack. This is the “we connected thirty-two MCP servers and now the agent searches across all of them” situation, and it is a trap with a bow on it.

The solution of tool registries with semantic search has dangerous implications as well. Semantic search of what? The tool descriptions? I doubt they are going into the content surfaced by these tools - but that is what is precisely required to ensure you can fit the right content into those three bits.

Near-duplicate tools are reachable variety with no routing capacity attached — calories with no nutrition.

They cost you context, latency, and dollars, and they buy you a model that silently defaults among them. Deduplicate. Namespace. Sharpen descriptions until two tools stop reading like the same tool. Or put retrieval in front, so the model only ever sees the handful that matter for the request in front of it.

Thinking harder is not the lever

I’ll be honest: going in, I bet against reasoning.

The reflex across the whole industry is that when a model fumbles you tell it to think harder — and I expected that to do nothing for routing, because the evidence is that the tool decision is largely settled in the model’s hidden state before the visible “thinking” even begins.

Telling a confused model to reason longer about which of two identical tools to pick is like asking someone to stare longer at two identical doors. The staring was never the bottleneck.

The numbers came back, and I didn’t enjoy being right. I ran GPT-5.5 at four reasoning levels on the sixteen-tool surface, and the relationship was not a straight line up. More reasoning helped — up to a point. Its “high” setting was the best of the four.

The curve peaks and then turns back on itself. Past the peak, the extra thinking didn’t buy capacity; it bought a much larger bill and, eventually, more confident wrong answers.

So: reasoning effort is a wonderful lever for a great many problems. Routing capacity is not one of them, and it is the most expensive knob in the house. Spend that budget on disambiguating your tools instead.

Stacking agents doesn’t print capacity

Then I did what every multi-agent architecture diagram does: I stacked them. A manager agent that reads the request and picks a category, handing off to a specialist agent that picks the actual tool. Surely that buys more capacity — divide and conquer.

The theory is blunt about this. A hierarchy’s capacity is a min-cut: the whole stack can be no wider than its narrowest handoff.

My manager only routed to three categories, so the manager-to-specialist handoff is worth at most log₂3 — about 1.58 bits — and the math says the entire system is capped there. It promptly sailed past it to 3.05 bits, routing all nine intents nearly perfectly.

That is not the theorem breaking. It is the theorem doing its second job — telling you exactly how you cheated. The specialist wasn’t working from the manager’s handoff alone; it was also reading the original request over the manager’s shoulder.

That back-channel — task information leaking past the official handoff — was worth precisely 1.45 bits. Add it to the manager’s 1.58 and you get 3.03. I measured 3.05. The bits reconcile to the second decimal place, which is the moment you stop arguing with a framework and start trusting it.

The lesson for anyone wiring up multi-agent systems: if you want the clean guarantee — capacity capped at the narrowest interface, predictable and analyzable — the specialist must see only what the manager hands it, and nothing else.

The instant it also reads the raw task, you’ve reopened a side door. That can be exactly what you want; it’s why the system performed so well. But you no longer have a min-cut you can reason about — you have a leak, and you’d better measure how much is coming through it.

And adding more specialists in parallel helps only if each one actually widens the binding cut. Bolt on children that all crowd through the same narrow handoff and you’ve added cost, not capacity.

The line at the end of the toolbox

So here is the whole thing in one breath, the version you can act on Monday morning.

1. Your model has a routing capacity — somewhere around fourteen distinguishable tools on a clean surface, fewer if your tools overlap.

2. Measure it: run a small routing calibration, find where accuracy starts to fall, and that’s your number.

3. Then design so that what your agent actually produces stays under that ceiling, even if the surface you expose is larger.

4. Treat overlap, not count, as the thing to cut.

5. Watch for the silent failure — a perfectly repeatable agent can be one that has quietly stopped using most of its tools, so monitor accuracy and coverage, not just jitter.

6. Don’t reach for “think harder” as a routing fix; reach for disambiguation and retrieval.

7. And when you stack agents, find the narrowest handoff, because that — not your smartest sub-agent — is the ceiling.

I’ll keep my own honesty bucket full while I’m at it. The cleanest test of all this is still ahead: in these experiments I estimated capacity from the very same data that produced the noise, which makes the wall a consistency check rather than a true out-of-sample prediction — the stronger version calibrates κ on one workload and tests the wall on a disjoint one, and that’s the result I most want to nail down next. Retrieval, modeled as a pre-filter that lifts the routing ceiling, should slide the whole wall to the right; I expect it to, and I’d like to watch it happen. And every number here lives inside a single turn — real agents run for many, and capacity in a long, drifting conversation is its own animal.

But the shape is not in doubt. The tradeoff between a reliable agent, an inventive one, and a cheap one was never three separate fires on three separate Tuesdays. It is one fire, and it has a name and a number now: κ. Everything you build above that ceiling gets paid for — in noise, in waste, and if you’re actually using the surface, in the irreproducibility you’ll be chasing at 2 a.m. for the rest of the quarter.

You don’t get to escape the wall. You get to choose where it bites. Keep what you produce within what you can route, treat overlap as the enemy rather than count, and you’ve made that choice with your eyes open — which is the whole difference between the engineer who’s mystified at tool number sixteen and the one who saw it coming.

There is, after all, no free tool.

As I was verbally abusing Opus for the 13th time in the last hour, I decided, counter to the fanboys who are announcing that Opus 4.7 will conquer the world, to publish a few thoughts…

Individual tasks come back tighter, cleaner, with fewer of those little tells that make you squint and mutter “what are you doing, friend?” at your screen at 11pm on a Tuesday. Correctness, on the task level, has moved. I’m not going to pretend it hasn’t.

Now. Here’s the thing, and it’s not a small thing.

Neither is multi-repo coordination and support. And multi-agent coordination still is not friction free. Really?

SendAgentMessage isn’t available mid-stream? Can’t sneak a message into that agent’s context window? Something seems broken in the agent coordination and orchestration mechanism.

Because left to its own devices, the model will confidently, articulately, lovingly produce the average answer to the question I literally asked — not the question I should have been asking.

I wrote about this a while back in The Average Path. The thesis holds. Opus 4.7 is a more accurate average path. It is not a different path. It is not your path.

And listen — the middle of the road is fine. For a lot of work, the middle of the road is exactly what you want.

But if you came here because someone on a podcast told you the software industry is doomed, I have news for you, and the news is good: it is not doomed. It is, in fact, doing just fine, thank you, because turning vision into systems — real systems, systems that survive contact with customers — is not something that falls out of a language model when you ask it nicely.

You still have to know what you want. You still have to know why. And if you hand a model your half-formed intuition and say “proxy my vision,” you will pay for that. Not metaphorically. Actually. In tokens, in rewrites, in three-week detours that end with you reverting to the branch you had before you started.

About Mythos

This is the part where Anthropic waves Mythos at me. And I want to be fair about this, because I’m about to be unfair.

That’s real. That’s a genuine achievement, and I’m not going to stand here and pretend otherwise — this is a meaningful moment for the industry. Full stop.

But.

(You knew there was a but.)

They ran the thing thousands of times. The cost was roughly ten thousand dollars. And I will take the bet, right now, today, in writing, that if you ran Opus 4.7 a couple thousand more times at maybe twenty-five thousand dollars in compute, you’d find the same zero-day. Or one just like it. Because what we are describing, when we describe this, is not a new kind of cognition.

That’s not a criticism of the achievement — it’s a description of the achievement.

The right read here is token optimization. The right read is affordability. The right read is: security researchers have been producing zero-days for roughly ten thousand dollars of labor for years, and the resulting vulnerabilities have generated billions in value. So before we gasp at the economics, let’s actually look at the economics.

Also, between us — was the name an accident? Mythos? Was that on purpose? Nobody in that room said “hey, maybe we shouldn’t name the model after a word that means things people made up“? Nobody? All right. Moving on.

Productivity. Not replacement.

This is a productivity play. Not a replacement play. A productivity play. And I say that as someone who uses these models heavily, every day, in anger, in production, for real work.

The tools are getting better. My leverage is going up. My need to hire is going — actually, my need to hire is going up too, because now I can start more things, and starting more things means more people, not fewer.

But “productivity tool” does not move a valuation the way “replacement for all knowledge work” moves a valuation. So the CEOs keep saying AGI. They keep fear mongering total replacement.

They keep describing a future in which I, personally, am obsolete by the end of the fiscal year. And I look at my terminal, where I have just spent forty-five minutes patiently explaining to the most advanced model on the market that no, we do not want to refactor the whole module, we want to fix the one line, and I find myself unmoved.

The actual problem

Put a pin in the valuations for a minute, because there’s something else. Something I think is more interesting, and nobody’s talking about it.

That is not a technology problem. That is not a model problem. That is not something that gets fixed by Opus 4.8 or Opus 5 or whatever we’re calling the next one.

And it is the actual problem. And it is not being solved by benchmarks. It is, in fact, being actively not solved by benchmarks, because the people writing benchmarks are not the people staring at the blinking cursor.

Benchmark-obsessed versus customer-obsessed. I keep saying it, it keeps being true, nobody keeps doing anything about it.

The battle is now quietly turning towards token optimization versus capability and breaking the adoption barriers, starting with improving the customer experience and consumption model.

I wrote a piece recently called Allbirds is Pivoting to AI Infrastructure. The title is a joke. The underlying point is not. When the narrative gets this overheated, everyone pivots to infrastructure, nobody pivots to the customer, and the companies that eventually win are the ones who remember which side of the equation actually signs the checks.

Where I land

The capability plateau is real. Not because the models aren’t improving — they are, measurably, and I’m grateful for it.

The plateau is real because “better average” is bumping up against the ceiling of what “average” can do for you when what you need is judgment. And judgment doesn’t live in the weights.

Which, apparently, is still my job.

Back to the trenches.

I’ve been staring at this headline for about twenty minutes now, and I keep reading it again because I’m convinced — convinced — that at some point the words are going to rearrange themselves into something that makes sense. They haven’t yet.

Allbirds — the shoe company, the merino wool people, the ones who made comfortable footwear for guys who describe themselves as “product thinkers” — is pivoting to become an AI infrastructure company. Their stock exploded 175%. And I need to sit with that for a second, because I think we’ve collectively lost the plot.

Let’s Talk About What Infrastructure Actually Means

When Oracle builds out GPU infrastructure, they’re not just racking servers. They’re engineering datacenters from the ground up with bare-metal GPU clusters connected via RDMA networking over InfiniBand — technology that traces back to NVIDIA’s acquisition of Mellanox in 2020.

That gives OCI ultra-low-latency GPU-to-GPU communication across superclusters of tens of thousands of GPUs, which is not a nice-to-have — it is the bottleneck for large-scale AI training. It’s why companies running massive training jobs have turned to Oracle over AWS and Azure for raw cluster performance. That’s not a business you stumble into.

And OCI is just one example. When AWS or Azure does it, they’re layering decades of cloud engineering, custom silicon, and battle-tested orchestration on top of raw compute. They’re building differentiated, AI-optimized software stacks that make enterprise adoption possible — not just plausible, but manageable.

These companies are spending tens of billions of dollars. Tens. Of. Billions. And they’re doing it with thousands of engineers who’ve been thinking about distributed systems since before “GPU-rich” was a phrase anyone said out loud.

Fifty million dollars in AI infrastructure is a seed round. It’s a promising seed round, sure. It’s enough money to get a meeting. It is not enough money to build a moat. It is not enough money to compete with hyperscalers. It is barely enough money to learn how expensive the electricity bill is going to be.

You don’t walk into a knife fight with a business plan and a wool shoe. You just don’t.

The Commodity Trap Is Right There, and It’s Wearing a Name Tag

Here is the thing that is making me want to pace around the room:

Full stop. You are buying a thing from NVIDIA and selling access to that thing to someone else, and the only differentiator you have is price — which means your margins compress, which means you need scale, which means you need capital that dwarfs what a mid-cap footwear brand can raise in a secondary offering.

It is so tempting, I understand that. The gravitational pull of going down the stack, of becoming the infrastructure layer, of being the one selling shovels — I get the seduction. But “tempting” and “wise” parted ways a long time ago on this one. The hyperscalers aren’t standing still. They’re layering proprietary services, custom chips, managed AI platforms, and enterprise compliance tooling on top of raw compute. They’re building the building. Allbirds is proposing to rent a room in someone else’s building and sublet it.

Meanwhile, the Actual Opportunity Is Staring Us in the Face

You want to know where the real value is? You want to know what keeps me up at night — not with dread, but with that restless, pacing energy of knowing something enormous is sitting right there?

The usability gap.

Right now, there is a chasm — and I mean a chasm — between the small percentage of people and companies burning through AI tokens at a breathtaking pace and the vast majority who haven’t opened a prompt window in a week. Ninety percent. Ninety percent of the potential market is sitting on the other side of a bridge that hasn’t been built yet. That is the crossing-the-chasm moment for AI. Not compute. Not GPUs. Figuring out why most people and most companies haven’t found their way into this thing yet, and then building the on-ramp. That is a trillion-dollar problem that is begging — begging — for someone to solve it.

And there’s another one. We have spent decades — decades — building Web 2.0 APIs, software interfaces, data architectures, all designed for human consumption. GUIDs, Social Security numbers, ZIP codes, RFID tags — the common identifiers that power modern software were designed for systems that parse structured data in predictable ways. But a language model doesn’t think in ZIP codes. It thinks in tokens and semantic relationships.

When you’re optimizing for latency, minimizing reasoning overhead, and operating at the speed these models demand, the entire identifier layer of modern software may need to be rethought.

Taking the accumulated infrastructure of the internet era and re-optimizing it for a world of LLMs, semantic search, and token economics? Trillions of dollars. Trillions. And it requires exactly the kind of creative, software-driven thinking that a nimble company could actually pull off.

So What Are We Doing Here?

I’ll be honest with you. I don’t have a satisfying explanation for why this happened. I don’t know what was said in that boardroom. I don’t know what pitch deck made this seem like the move. What I know is this: when a shoe company announces it’s becoming an AI infrastructure provider with fifty million dollars in capital and no discernible technical differentiation, and the market rewards it with a 175% stock surge, something has gone sideways.

The opportunity in AI is real. It is profoundly real. But the opportunity is in the hard, unglamorous work of closing the usability gap. It’s in reimagining how software talks to models. It’s in the layers of intelligence and integration that sit between raw compute and actual human value.

It is not in buying GPUs and renting them back out.

I don’t know. Maybe I’m wrong. Maybe Allbirds has a plan I can’t see from here. But I’ve been doing this long enough to know what a commodity trap looks like, and this one is textbook.

The insanity continues. And I, for one, am going to keep pacing.

Let me say that again, because what follows might suggest otherwise. I love coding agents.

I have produced more functional, tested, demonstrable software in the last two months than I have in the last two years. Maybe longer. The velocity is intoxicating, and I don’t use that word lightly — I use it because intoxication impairs judgment, and we should probably talk about that.

Here’s what happened. Twenty-plus years of building systems — memory mapping, streaming architectures, threading models, distributed consensus, the whole cathedral — suddenly became a lever instead of a résumé line. All that accumulated intuition about how computers actually work underneath the abstractions?

It became the difference between using a coding agent and being used by one. I could push fearlessly into designs that would terrify someone who learned software from a textbook, because I’d already broken these things with my hands and put them back together in the dark.

It has been, without exaggeration, extraordinary.

But.

There’s a structural problem with large language models writing software, and it’s not the one the doomers talk about, and it’s not the one the boosters dismiss. It’s more fundamental than either camp wants to admit, and it hides in plain sight inside every line of code these models generate.

Every design decision, every architectural fork, every moment where a system could go left toward elegant efficiency or right toward “good enough” — the model goes right. It goes right because it was trained on the corpus of all software ever written, and the corpus of all software ever written is, to put it charitably, not great.

The model doesn’t optimize for speed. It doesn’t optimize for efficiency. It doesn’t think about memory hierarchies or cache line boundaries or what happens when your dataset outgrows the machine you’re sitting at. It can’t Think Big — capital T, capital B — because thinking big requires the willingness to throw away the obvious approach in favor of the non-obvious one, and non-obvious approaches are, by definition, underrepresented in the training data.

What the model actually does is produce the solution that the largest number of software engineers would have written. Which sounds fine until you remember what the distribution of software engineering quality looks like.

Let me make this concrete, because concrete is where the bodies are buried.

I needed to load a large dataframe stored locally in Arrow format. Arrow — for the uninitiated — is a columnar, in-memory format designed for analytical workloads. It’s fast, it’s compact, and it scales beautifully if you know what you’re doing.

The coding agent loaded the entire file into RAM.

Now, most software engineers would do the same thing. Open the file. Read it into memory. Operate on it. This is the canonical approach. It’s in every tutorial. It’s on every Stack Overflow answer. It is, indisputably, the average path.

It also means your application scales linearly with file size, and your ceiling is whatever physical RAM happens to be installed in the machine. Which isn’t an engineering decision — it’s a surrender.

I knew immediately what to do: memory-mapped I/O. Let the operating system’s virtual memory subsystem handle the paging. Break the coupling between file size and available RAM. The data lives on disk; the OS pages in what you need, when you need it, and pages out what you don’t. No performance degradation compared to a full in-memory read. Works beautifully in streaming contexts. Saved me — and this is not hyperbole — tens of thousands of lines of code that would have been required to implement an inferior, disk-bound alternative format.

But here’s what was actually concerning: the model didn’t just miss this approach. When I pushed toward it, the model pushed back. For a surprisingly long time, it tried to convince me — with the confident, measured tone of a senior engineer who’s seen this movie before — that we were physically bound by available RAM. That this was simply a constraint of the problem. That perhaps we should consider alternative file formats.

It was giving me the median Stack Overflow answer with the conviction of someone who’d never questioned whether the median Stack Overflow answer was any good.

And this is where we need to talk about the distribution.

There’s a well-known empirical observation in software organizations: your best software comes from roughly ten percent of your talent. This isn’t controversial. This is why every FAANG company runs a brutal calibration process. This is why performance reviews exist. This is why the difference between a Staff Engineer and a Senior Engineer isn’t just seniority — it’s a fundamentally different mode of thinking about problems.

Which means that roughly ninety percent of the training data for these models — the code, the Stack Overflow answers, the blog posts, the documentation, the architectural decisions captured in a million repositories — comes from engineers operating below the level where the really interesting design decisions get made.

So when a coding agent writes your software, it writes it the way the median engineer would. Not the worst way. Not the best way. The most common way. And the most common way is how you get systems that work fine at demo scale and collapse under production load, that pass every test and fail every stress test, that solve the problem stated in the ticket and miss the problem lurking underneath it.

Now, someone in the back is already raising their hand.

“But compute is cheap. RAM is cheap. Why does this matter?”

It matters because you don’t live in a cloud provider’s marketing brochure.

I have watched — personally, with my own eyes — hardware bottlenecks kill enterprise systems. Not “slow them down.” Kill them. And here’s why: the vast majority of enterprise software is still not fully CI/CD. It’s not cloud-native. It’s not running on immutable infrastructure with autoscaling policies and graceful degradation. It’s running on machines that a human being provisioned, that another human being patched last Tuesday, that a third human being will troubleshoot at 3 AM when the OOM killer starts making editorial decisions about which processes deserve to live.

RAM is free in the abstract. In the enterprise, RAM is a purchase order, a change request, a capacity planning meeting, and a six-week procurement cycle. And I’m not yet convinced that CIOs are ready to hand security, data quality, preservation, and availability decisions to AI agents. That’s not conservatism — that’s pattern recognition.

Which brings me — finally, stay with me — to the thesis I’ve been circling.

I’ve sat through enough keynotes and earnings calls and breathless LinkedIn posts to have internalized the dominant narrative: AI will replace human workers. AI will do the work of ten people.

AI will reduce headcount and increase margin and your board will love you for it.

And I’ve heard the counter-narrative from every AI CEO with a product to sell: “We’re not replacing humans! We’re augmenting them! We’re helping people do things they couldn’t do before!” Which always sounded like marketing horseshit. The kind of thing you say to a Senate subcommittee while your sales team is pitching CFOs on headcount reduction.

But what if they’re telling the truth? What if they’re being quietly, almost accidentally honest about the real economic model?

Because here’s what I’ve actually experienced, not theorized: the value of coding agents is not evenly distributed across the talent spectrum. The value is catastrophically concentrated at the top. When someone with twenty years of systems intuition uses a coding agent, the agent becomes a force multiplier of staggering magnitude. When someone without that intuition uses the same agent, they get the average path. Faster, yes. But still average. Still fragile. Still doomed to the same scaling failures and architectural dead ends that characterize the bottom ninety percent of all software ever written.

The real TAM isn’t built on replacing human salaries. The real TAM is built on making the top ten percent of talent capable of producing the entire output of the remaining ninety percent.

Read that again.

This isn’t about replacement. This is about concentration. The best minds, paired with models, doing things that were historically impossible not because the work was too hard — but because there weren’t enough hours in the day and there was too much organizational overhead between the idea and the artifact.

And this is where it gets uncomfortable.

Are we ready for a world where ten percent of the workforce delivers the entire value of the other ninety? Because that’s not a labor market adjustment. That’s a structural transformation of how organizations create value, how careers are built, how compensation is distributed, and who gets to participate in the upside.

Not every company can afford the top ten percent. Not every company can even identify the top ten percent. And the top ten percent has a very specific characteristic that is extraordinarily difficult to teach: they have an intuitive, experiential understanding of how systems actually work — not how textbooks say they work, not how certification programs describe them, but how they behave under real conditions at real scale.

Note to AI investors: The total addressable market (TAM) of most AI initiatives has a secret assumption in replacing human productivity. With our current model architectures, this TAM can only be realized if the customer will consistently pay for an average outcome, unless it is simultaneously combined with extraordinary human talent or tools encoded with this human talent.

I’m self-taught. Every concept I carry — memory mapping, streaming, threading, distributed failure modes — I learned by breaking things and fixing them, by reading source code at 2 AM because no documentation existed, by building systems that fell over and figuring out why. That knowledge lives in my hands, not in my head. It’s instinct, not information.

And I genuinely worry that the current state of computer science education — which teaches concepts through textbooks and problem sets rather than through the kind of reckless, fearless, self-directed exploration that builds intuition — is producing engineers who can describe these concepts but can’t feel them.

And if you can’t feel them, you can’t evaluate the coding agent’s output. You accept the average path because you don’t know there’s a better one.

The traditional work breakdown of software organizations doesn’t make sense anymore. The old model — decompose a project into small tasks, assign each task to an individual contributor, roll up the results — was designed for a world where humans were the unit of execution. Coding agents are better at bigger tasks with defined, testable outcomes than they are at incremental improvements to existing systems. They want scope and direction, not tickets and story points.

The common units of scaling teams - “one engineer can handle three customers, so when we get 30 customers, we need 10 engineers” - just doesn’t compute anymore. It’s a non-linear distribution, not evenly exponential either. Now you may need talent that is five times more expensive to handle twenty customers. But is that extra customer per dollar spent worth it? And then there is the chance that the expensive talent will create an innovation that attracts another 20 customers that you would not get without the talent - a hidden opportunity leverage (or cost).

This suddenly became an extremely complicated ROI decision for the economic buyer, and the TAM of an AI company highly questionable.

Which means the person directing the agent needs to operate at the level of the whole problem, not the level of the individual function. They need to see the entire system in their head, understand where the scaling walls are, know which “best practices” are actually just popular practices, and have the confidence to override the model when it’s walking them toward a cliff.

That’s not a junior engineer’s skill set. That’s not even a senior engineer’s skill set, in many organizations. That’s the skill set of someone who’s been through enough wars to know the difference between the way software is supposed to work and the way it actually does.

So here’s where I land, and I know this will make people uncomfortable.

I haven’t seen LLMs break through to doing the work of the top ten percent natively. And mathematically, that makes perfect sense — you can’t train your way to the tail of the distribution when your training objective optimizes for the center of it.

What I have seen is the top ten percent using LLMs to do things that previously required an army.

The AI revolution isn’t a replacement algorithm. It’s an amplification function. And like all amplification functions, it amplifies whatever signal you feed into it. Feed it mediocrity, you get mediocrity at scale. Feed it brilliance, you get brilliance at a velocity that was previously unimaginable.

The question isn’t whether AI will change how software is built. It already has. The question is whether we’re honest about who it changes things for — and what happens to everyone else.

Tomorrow I turn 45. But almost as though it is yesterday, I can remember watching my mother make carrot halwa on a stove. I don’t remember the date. I don’t remember what the occasion was - other than it was my birthday. But I do remember the smell of the heavy whipping cream getting boiled, the plain scent of carrots being boiled in it, turning sweet as pectin was released, and the incredibly patient, deliberate way that my mother kept turning the frothing, boiling mixture - like a surgeon who’d done this ten thousand times and intended to do it ten thousand more. She was playing the interesting yet dangerous game of deciding how high the temperature could be to maximize pectin release, while avoiding risking burning the family’s yearly budget of half and half, and completely ruining her kid’s birthday.

Now here’s what’s interesting. I haven’t thought about that moment in years. But last week, I watched an engineer debug a failing orchestration pipeline with that same deliberate stillness, and the memory surfaced — unbidden, recontextualized, useful. Not as a transcript of what happened in 1988, but as a framework for understanding patience under technical duress in 2026. Semantically there is absolutely no relationship between making halwa and CI/CD pipelines. In fact, personally I have to wonder why I have made a relationship between something sweet and something so sour, but I digress.

But that’s also human memory. And the essence of where ideas come from, whether it was Einstein’s thought experiments or my designs on eating carrot halwa.

You know what isn’t memory? A markdown file.

The Great Conflation

There’s a pattern emerging across the AI agent ecosystem that I find — and I’m going to be charitable here — intellectually troubling. Agent frameworks are creating files called MEMORY.md, stuffing them with compressed observations, and then declaring the memory problem solved.

Some have gone further: agents now steal each other’s memory files to bootstrap their understanding of a project, a codebase, an initiative. Others throw task IDs against these memories and consider them “organized.” The really clever types put a human ID on the memory - but a human ID doesn’t make it human. Nor does it build relationships.

We even see Claude Code do it with it’s clever marketing positoning: “saving a memory for later now.” I went and read these memories… they’re a bad example of semantic state.

And the industry is nodding along like this is progress.

It isn’t progress. It’s a category error. And category errors, left uncorrected, become architectural debt that compounds until the whole edifice collapses under assumptions nobody bothered to challenge.

What these systems have built is state. Persistent state. Serialized state. Occasionally useful state. But state is not memory, and the difference isn’t semantic — it’s structural, computational, and, I’d argue, fundamental to what we’re going to need if we want agents that actually reason across time.

State vs. Memory: A Distinction That Matters

Let’s be precise, because precision matters here.

State is a snapshot. It’s a data structure that captures the current known values of a system at a point in time — or, in the case of MEMORY.md, a lossy compression of accumulated observations flattened into prose. State answers the question: what do I currently know? State is flat. State is inert. State sits there waiting to be read.

Memory is a process. It’s reconstructive. It’s contextual. It’s an active computation that, given a retrieval cue, searches across episodic and semantic stores, identifies associatively relevant experiences, and synthesizes a novel summary shaped by the context of the current inquiry. Memory doesn’t answer what do I know? — it answers what is relevant to what I’m thinking about right now, and how should I frame it?

This is not a subtle distinction. This is the difference between a filing cabinet and a research assistant.

When a human talks about the current geopolitical turmoil in Iran, they might recall the Iraq War — not because someone filed “Iraq War” under the heading “Middle Eastern Conflicts to Reference Later,” but because an associative retrieval process found episodic traces that share semantic proximity with the current conversational context, and then reconstructed that memory with emphasis on the dimensions that matter right now. The memory of the Iraq War surfaces differently when you’re discussing Iranian diplomacy than when you’re discussing veterans’ healthcare. Same underlying episodes. Different reconstruction. Different utility.

The Compression Trap

Agent authors — smart, well-intentioned people — will push back here. They’ll say: “When we read MEMORY.md, we’re reading it within a conversational context. The LLM reinterprets the content dynamically.”

Yes. And this is where we need to be honest about what’s actually happening.

When you write an observation into a memory file, you’re performing lossy compression. You’re taking a high-dimensional experience — the full context of an agent’s interaction, the decision tree it traversed, the alternatives it rejected, the uncertainty it felt — and you’re flattening it into a sentence or a paragraph. You’re discarding the dataframes. You’re collapsing the probability distributions into point estimates. You’re throwing away the episodic richness that would allow for flexible reconstruction later.

And then, yes, when you read that compressed artifact back in a new context, the LLM does what LLMs do — it interpolates. But interpolation over compressed data isn’t memory retrieval.

You’ve lost the grain, and no amount of contextual reinterpretation can recover information that was discarded at write time.

This is, if I may borrow from information theory, the fundamental problem: you cannot reconstruct what you did not retain. Claude Shannon told us this in 1948. We should probably listen.

Now let me be clear. The word hallucination has become a dirty word. By definition, when we read this now in the context of the AI industry, we all immediately go: “AI wrong, human good.” But I actually disagree. Hallucinations are also the origin of some amazingly good ideas that change human history.

So not all hallucinations are bad. The problem though is that the AI industry needs to lean into this by creating multiple forms of memory, often indexed across many different temporal, semantic, reasoning, and spatial contexts, with different levels of “temperature” in order to achieve the same gradient as true memory and concept linking.

If you are about to tell me this feels a bit like the traveling salesman problem on steroids, you’re right.

The worst part is that the tokens in true memory aren’t just semantic. They’re temporal and spatial as well. While you can see OpenAI and Anthropic attempt to bolt on specialized heads (or subordinate task models) to bring these type of tokens to their systems - they are still a second order concept. The primary is language, in the theory that language can encode everything.

The Three-Pillar Problem

Here’s how I think about the AI systems landscape, and I think this framing might be useful.

In the early days of cloud computing, we understood the problem as three pillars: compute, storage, and database. You needed processing power. You needed a place to put bytes. And you needed a structured, queryable system that could organize, index, and serve data with semantic awareness. These weren’t the same thing. EC2 wasn’t S3 wasn’t RDS, and collapsing any two of them would have been architectural malpractice.

I kind of feel that AI has the same tripartite structure:

Compute → Models. The LLMs themselves. The inference engines. We’ve made extraordinary progress here. GPT-4, Claude, Gemini — these are remarkable machines for transforming input into output. Compute is not our problem.

Storage → Context. The context window. RAG pipelines. Document retrieval. Vector stores. The mechanisms by which we surface information into the model’s working set. We’re getting better at this. Context windows are expanding. Retrieval is improving. We’re not done, but we’re on a trajectory.

Database → Memory. And here’s where we have a gaping hole.

We don’t have a memory system for AI agents. We have state files masquerading as memory. We have append-only logs. We have compressed summaries. What we don’t have is anything resembling what a database provides in the cloud computing analogy: a structured, indexed, queryable system with its own internal ontology, capable of associative retrieval, contextual reconstruction, and multi-resolution access to historical experience.

Nobody has built RDS for agent memory. We’re all still writing flat files and calling it a database.

What Real Agent Memory Would Require

So what would it actually take? Let me sketch the architecture, because I think this is where the industry conversation needs to go.

An episodic store with high-dimensional retention. Don’t compress at write time. Store the full episode — the context, the decision, the alternatives, the outcome, the uncertainty. Store it at the resolution you’d need to reconstruct it flexibly later. Yes, this is expensive. Yes, storage is cheap. Make the trade.

A semantic association layer. Not just vector embeddings (though those are part of it). A genuine ontological structure that captures relationships between episodes — causal links, temporal sequences, thematic clusters, contradiction graphs. When an agent remembers, it shouldn’t be doing a flat cosine similarity search. It should be traversing a knowledge graph that encodes how its experiences relate to each other.

Before people start spamming me with Neo4J articles and Cypher queries, I’m not sure graph databases are a good thing for this. Why? Because this association layer has to be continuously encoded to work right. In other words, you are constantly re-encoding the associations and ontology based on incoming encounters, queries, and memories of these encounters and queries. And then storing it at various different temperatures to decide what version should be recalled for a court room or a bar. Graphs - and the query mechanisms that come with them - are too rigid for these encodings.

Contextual reconstruction at read time. This is the critical piece. When an agent retrieves a memory, it shouldn’t get back a pre-written summary. It should get back the raw episodic material, filtered and weighted by the current retrieval context, and then generate a novel synthesis that’s shaped by what it’s trying to do right now. The same underlying memory should produce different outputs when retrieved for different purposes.

Multi-resolution access. Sometimes you need the gist. Sometimes you need the detail. A real memory system would support queries at multiple levels of granularity — from “what’s my general experience with microservice architectures?” to “what specific failure mode did I encounter in that Kubernetes deployment on March 3rd, and what was the pod configuration?”

Forgetting. This one’s uncomfortable but important. Human memory decays, and that decay is functional. It prevents overfitting to historical experience. It allows generalization. An agent memory system that retains everything with equal fidelity is going to develop the cognitive equivalent of hoarding disorder — unable to distinguish signal from noise because everything was preserved with the same weight.

The Uncomfortable Truth

Here’s the part nobody wants to hear.

Building this is hard. It’s not a weekend project. It’s not a clever prompt engineering trick. It’s a systems architecture problem that sits at the intersection of information retrieval, knowledge representation, cognitive science, and distributed systems design. It requires thinking carefully about encoding, indexing, retrieval, and reconstruction as separate, composable operations — not as a single read/write to a file.

And it requires admitting that what we’re currently doing isn’t working. That MEMORY.md is a polite fiction. That agent memory-sharing is just state replication with extra steps. That the reason our agents can’t learn effectively across sessions isn’t a context window problem — it’s a memory architecture problem. You get cute marketing moments of an agent “remembering a past interaction” - but that’s just the great averaging of interactions extinguishing the spark of human innovation.

A short note to Wall Street doom scrollers…

On a side note, this is where I think the AI doom scrollers on Wall Street get it totally wrong. Without good memory and context systems, which mind you - in my opinion truly haven’t been built yet, we still depend on the good old human to provide the differentiation. And, as we know, we need teams of humans focused on a specific problem to truly drive good ideas - consistently.

Memory helps drive differentiation. And differentiation is required in order to justify the switching cost for a customer.

The Tale of Two Steves

Let’s for example, do a thought experiment the smartphone. Let’s hypothetically consider that we had an agent building smartphones before the iPhone was invented. Let’s call our agent innovator Steve AI. Steve AI is competing with Steve Jobs. Both Steves are competing against powerful consumer switching inertia - the Blackberry with it’s famous keyboard is still really popular, girls love the Motorola Razr.

Steve AI is likely to produce a smartphone, across the thousands of iterations, tool calls, web searches, and market research that is likely to resemble a cross between the Microsoft Zune and the Blackberry. It will retrieve semantic memories and related information based on the vocabulary of digital assistants at the time and consumer reception to them.

Steve Jobs however sets the bar using - at the time - a semantically orthogonal set of concepts. He brings physical textures to a virtual world - glass, haptics, smoothness, and weight. He distills communication techniques - e-mail, phone calls, and messaging into almost a video game style interface. Folks would claim that the analogies he was inventing at the time were fueled by acid. Steve AI would likely call many of his statements hallucinations.

One Steve created differentiation - arguably through some element of hallucination combined with his experience (cough, memory). Even more critically, the humans supporting Steve understood his hallucinations. I argue that it would have taken a fair number of iterations for a reasoning model from today - trained on the knowledge and state of the art from then - to understand Steve Jobs. In fact, there is a strong probability that it would never have understood Steve. Steve Jobs and his team goes on to become obnoxiously wealthy, powered by memory.

Meanwhile, Steve AI creates a product that is - average. How can you blame it? After thousands of roulette spins at the gradient bingo we call LLMs, you end up with an averaging effect. This averaging effect is only to be expected with such a large endeavor. Average doesn’t justify the switching cost to the consumer, even if average comes at 10% of the cost. Steve AI is out of a job.

The Gross Oversimplification

Unfortunately, marketing, product management, and software engineering isn’t just code. Sure, there is some part of the industry which is just that. But I would argue that software that is just valued by the number of nuts and bolts and the output it produces based on a defined input was probably dead before the advent of LLMs. It was just surviving through obscurity, customer switch costs, and inertia.

Does this mean that the mechanisms in how software is built and delivered is not changing? No. It absolutely is changing and software engineers that don’t learn these new mechanisms will fail. But the mechanism is not a proxy for value. At the end of the economic value chain, you still have a human buying something to survive, to entertain themselves, to demonstrate love, and to handle life.

And regardless of the arbitrage and disintermediation introduced by agents, we still have to work backwards from those humans.

Scaling Up

The AI industry has gotten very good at solving the problems it knows how to solve and renaming the problems it doesn’t. We called token limits a “context problem” and then expanded the window and built sledgehammers called compaction. We called inconsistency a “prompt engineering problem” and then wrote better system prompts. And now we’re calling flat files a “memory solution” and wondering why our agents still can’t remember what they learned yesterday in a way that’s useful for what they’re doing today.

The only way to avoid the great averaging effects of AI is to create a memory that has an element of over encoding and hallucinations. But this yields a new set of problems - guardrail failure, memory poisoning, fake news, uneven performance. Basically all the problems AI is supposed to fix in humans.

I visited a good friend of mine in Holland two weeks ago, Rob Francis, the CTO of Booking.com. He was openly speculating about “performance managing AI agents.” I have to admit, he is on to something, and it was a brilliant statement. You can’t say that software engineers are irrelevant and going to be replaced by AI unless you are also in the same breath willing to live with the inconsistency that yields software differentiation in the same industry.

You can’t have the innovation without the inconsistency and failure.

And another hidden - but rapidly emerging problem is token economics. Adding self-encoding memory systems will burn tokens. In a sense, you are constantly fine tuning your model weights, constantly learning. At one point, you begin to wonder what the ROI is on the tokens against just hiring the equivalent human. So let me get this straight - we need to spend more money on tokens to get less predictable outcomes because that is how you get creativity? I dare you to make that argument to the CFO.

This makes me often wonder if the AI industry rushed into monetization too quickly.

It was one thing when the focus was on replacing low skill workflows with AI. This made sense. Humans aren’t the best at performing manual labor and we’re not even using all of the capabilities of their brain, truly tapping into the unlimited potential of our creativity. I’m sorry, but the days of a contact center agent repeating the same script over and over again was numbered, even without AI. The days of a bank teller inspecting signatures was also numbered as well, just from a perspective of security alone!

But in our desire for “super intelligence” or “AGI” - we lurched forward with reasoning models, looking to replace intellectual content with AI, often not considering what made generating this content valuable in the first place. Does Claude Code generate some awesome code for me? Yes. Yes, it does. But guess what? I still have to prompt it to solve problems that I observe. Claude Code without the decades of experience to make good software engineering tradeoffs is not nearly as useful. And here we go - I just used the term - experience.

And I would argue that experience can be quantified and replaced. It can be quantified by spending 100x the tokens we spend today, auto-recursively encoding memories, adding a sprinkle of hallucination, building semantic bridges between unrelated concepts. The salesman can travel to every milestone in the ever winding path of a software architect, spending tokens at every stop.

But making these tradeoff decisions suddenly creates tension with what we typically want from enterprise software: consistency, reliability, safety, and adherence to guardrails.

However, the burn rate dictated monetization. You have to pay for those Super Bowl ads with something other than investor cash, right? Speaking of which - does anybody even remember those anymore? And did that actually cause you to use a service more?

We need a solution to the memory problem, right?

Compute. Storage. Database. We solved one. We’re working on the second. And we haven’t yet had the honest conversation about the third.

Maybe it’s time we started. Or is it?

As I came to close this post, I struggled with this. The AI industry seemingly likes to talk about itself as though it is going to replace 80% of the jobs with models. CEOs are rushing to shed headcount in the theory that agents will replace some amount of their workforce. To be clear, I don’t argue the premise of the logic - the question is how much? In order for the true promise being advertised to be achieved the memory problem needs to be solved.

It is easy to fall into the dystopian trap of using simple arithmetic to assume human innovation is dead and all discretionary income in the world will go to zero because it is being eaten by AI agents. I mean, an analyst wrote a pretty naive report and the market dropped like 1,000 points. I have always thought this perspective was incredibly naive. The world sure loves a good story.

But I am still not sure whether we have worked backwards enough from the customer, truly understanding the user experience, to justify solving the memory problems or arguing that AI will replace the human workforce. I see a lot of knees being jerked without too much rational data.

Let me give you another logic exercise, near and dear to my heart. One of the most popular data and AI use cases is “chat with your data.” Basically it’s a chatbot sitting on top of a data mart. Ask it any question, regardless of ambiguity, and it will give you an answer.

As you can imagine, in my current job, I have to make this use case work - a lot - for a lot of different customers. While I am proud to say that my team has come up with some very novel perspectives on this problem, I will not say that has been my biggest learning. No, my biggest learning has been the user experience expectation divide between the AI industry and the actual customer.

Stay with me a moment, and I will tie this back to memory. When I first started on this problem area, the priority seemed to be insight quality. While human customers wanted answers quickly, they would sacrifice latency for seemingly amazing insights and richness of answers. This matched what I was seeing being touted by the AI industry. It takes Claude Code hours to make a truly meaningful application. Open AI’s own datalake explorer takes minutes to run queries. Deep research agents are asynchronous by default.

But then as my journey continued, this tradeoff sharply started to move towards latency. It was funny, every senior leader would say at the beginning of the engagement: “we don’t care about latency.” Give it a day or two and “we care about latency, can you get answers back in less than 10 seconds?”

Latency came at the expense of intelligence, while requiring a ton of code and tools to support it. After all, LLMs generate correct SQL on the first attempt only about 40% of the time. And each attempt costs roughly 5-13 seconds.

So how does this track back to memory? Well, if you take the position that LLMs are meant to replace humans at 10% of the cost, latency is not the critical objective. Using the example I just gave, I dare you to evalutate how quickly, accurately, and correctly a human generates SQL. If memory is truly a priority to make agents as smart, innovative, and creative as the human role they are replacing - then latency isn’t a factor.

But yet it is. What this tells me is that the model industry has still not understood the ideal customer experience. I am not entirely sure that the user or even the person paying for the AI tokens truly can articualte their priorities or help make this tradeoff yet. And frankly, until they can, any displacement or disruption (e.g., layoffs in anticipation of agents replacing the workforce, bringing app development in house) is premature.

Taking a step back, I don’t think the model providers, the customers, or the integrators have yet figured out what they want. Model providers have made their definition of success replacing human skilled labor - “superintelligence.” The customers seem more confused than ever. We are asking them to switch from a preference towards low latency user experiences, with high degrees of availabilty and accuracy, to the user experience of talking to a service being benchmarked by it’s ability to be, well, human. This is not good.

Perhaps this is why we have seen the industry stall out a bit in terms of capability. The danger is that the marketing is getting ahead of the capability. CEOs are making a bet that AI will replace some part of their workforce.

When it doesn’t and they inevitably cut too far, this is the true economic apocalypse that I worry about.

Right now, there’s a fever running through Sand Hill Road and the analyst desks of every major bank. The thesis goes like this: agentic coding can build software applications in microseconds, therefore no enterprise customer will ever buy a SaaS subscription again, therefore every SaaS company is dead, therefore sell everything, therefore the sky is falling. It’s a neat little syllogism. It’s also wrong. Not entirely wrong — which is what makes it dangerous — but wrong in the ways that matter.

Let’s walk and talk.

The Part They’re Getting Right

Here’s what I’ll stipulate, because I’m not in the business of pretending disruption isn’t happening while it’s kicking down the front door: highly commoditized layers of the software stack are going to get obliterated.

User experiences. REST APIs. Microservices. Metrics dashboards. Platform plumbing that is functionally identical across every professional SaaS application on the planet.

If your entire value proposition is “we wired together the same components everyone else has, but we did it first and we charge you monthly for the privilege” — yeah. You should be nervous.

Agentic coding is going to do to commodity software what Visual Basic did to manual systems programming: except probably compress it by two more orders of magnitude.

More software is coming. Dramatically more. And the barrier to creating it just dropped through the floor.

In fact, I would like to remind you of the Garage Band article I wrote a while ago, where I (correctly!) noted that agentic coding doesn’t mean software is dead. Quite contrary, it means we are going to have a deluge of software. Just like we have a deluge of professionally created and recorded music!

A startup, a professional services firm, or even an internal team with a competent engineer and an agentic coding setup can now produce a working application in a timeframe that would have been absurd eighteen months ago. That’s real. That’s happening. I see it every day.

The Part They’re Getting Wrong

Now here’s where the “end of SaaS” crowd loses the plot, and they lose it badly.

Every time I get genuinely wowed by a reasoning model — and I do, regularly — I also encounter another benchmark, internal or external, that reminds me what we’re actually dealing with: a spectacularly sophisticated guessing game. With backspace. The model generates, evaluates, recurses, and refines. It’s remarkable. It is also fundamentally limited.

Agentic coding systems excel when they can measure success against a specific target. Did I fix the bug? Did the test pass? Did the quality metric improve? They guess, they evaluate the guess, they guess again — burning reasoning tokens until they defeat the target. That’s genuinely powerful for well-defined problems.

But hand one of these systems genuine ambiguity? Watch what happens. Hand it a multi-repository codebase where the bug lives in the interaction between three services, two of which have undocumented side effects? Watch it flail. It’ll do what a smart but inexperienced engineer does: it’ll hack at the symptoms with tremendous energy and zero architectural insight.

I experienced this firsthand. I spent months struggling with a set of ambiguous bugs in a service. My coding agent attacked the problem with admirable enthusiasm — like a recent college grad who doesn’t know what they don’t know. It never once suggested what turned out to be the actual solution: building a new compiler. An abstraction layer that resolved the class of problems entirely.

I built that compiler myself, and — if I may say so — it’s proven to be a rather elegant and consistent solution. The agent couldn’t get there because the insight wasn’t in the code. It was in my understanding of the problem space.

And that distinction is everything.

The Memory Problem Nobody Wants to Talk About

Here’s a dirty secret about the current state of agentic development: memory is still a mess.

I don’t say this casually. I’m working on these problems professionally. Context compaction — the process of summarizing and preserving state as an agent works across sessions and repositories — is still operating like a blunt hammer. It doesn’t understand the topology of what it’s compacting. It doesn’t differentiate between a critical architectural decision and a throwaway variable name. It treats everything with the same crude compression, and the information loss is real and consequential.

And here’s the thing about software intellectual property that the “agents will build everything” crowd consistently ignores: the IP isn’t just the code and the markdown files in the repository. Before people tell me that they’ll just semantically index this knowledge, give me a call - I have experience with how well that works for context restoration.

None of that lives in the codebase. All of it is essential to building software that works in the real world. And no agentic coding system on the market today can meaningfully ingest, organize, retain, and reason across that corpus. Not Anthropic’s approach. Not Codex. Not yet.

Problems like persistent memory, rule adherence across sessions, multi-agent collaboration, intelligent compaction — these are all open research problems. Important ones. Solvable ones. But unsolved today. However, the lemmings on the Street are smoking so much of their own AI product that they believe SaaS is dead.

Wall Street has forgotten that the true winners now in the software business are those that leverage not hand-wring about agentic coding solutions to generate solutions that delight customers. This is essentially a developer productivity discussion, not a product replacement discussion. My suspicion? We’re going to see an order of magnitude leap in user experiences, quality, and capability in the software we use everyday.

So this sell off is really, truly, dumb:

Like, really? I love AI, but I’m not exactly sure SaaS is evaporating tomorrow, and is in “bank run” territory.

It made me wonder, maybe the uber feeling and sentiment in the market is that AI agents better completely replace SaaS, otherwise the AI boom is a bust?

Just like Visual Basic, .NET, Visual C++ and MFC made it trivial for everyday developers to build apps - agentic coding is enabling even the most junior developers to now harness the power of complicated concepts like compilers, operating systems, and protocols.

The SDE 1.0 Problem

About a year ago, I called agentic coding a “SDE 0.7” — below the bar of a college hire at a major tech company. It’s clear that coding agents have now graduated. It feels like they’re an SDE 1. Maybe a strong one. They can write clean code, follow patterns, fix bugs against test suites, and ship features when the specification is clear.

An SDE 1 doesn’t replace the architect who chose eventual consistency over strong consistency because they understood the customer’s latency requirements in Southeast Asian markets.

An SDE 1 doesn’t replace the product manager who realized that the feature customers were requesting would actually violate their own compliance requirements.

Remember When On-Prem Died?

Some of this “the end of SaaS” rhetoric has a familiar ring to it. When Web 2.0 arrived, everybody said on-premises applications were dead. It was obvious. It was inevitable. The cloud was the future and only the future.

That was twenty years ago.

Why? Because the executive signing the purchase order isn’t buying code. They’re buying an outcome at a price. They’re buying an SLA. They’re buying security guarantees, compliance certification, regulatory adherence, and the ability to call someone at 3 AM when the system goes down. They’re buying the right to sue somebody if the data leaks.

Now tell me: your startup just had an agent generate 200,000 lines of code in an afternoon. Who owns the SLA? Who’s on call? Who’s tracking the CVEs? Who’s managing the zero-days that are going to start hitting that generated codebase — because they will hit it? Who’s handling the licensing audit when legal discovers that the agent pulled in a GPL dependency?

Sure, you can add agents to help with all of these topics, but ultimately agents don’t make good owners.

I’ve worked on internal IT teams. The thought of maintaining hundreds of thousands of lines of generated code — with a constant stream of security vulnerabilities, compliance obligations, and legal questions — is enough to make any reasonable CTO pause.

The TCO of agentic SaaS replacements is still being settled, though that’s a debate for another day. I wouldn’t be making bets with my personal capital either way yet.

The SaaS teams which incorporate agentic mechanisms into their lifecycle will dominate, utterly destroying legacy competitors who refuse to leverage these new functions.

If software development managers want to survive, they must demand agentic usage by their engineers, and if they can’t get on board - time to move the engineer along. There is absolutely no valid excuse for not using coding agents now.

The Continuum

So here’s what I’d actually tell a product manager sitting in a conference room right now, staring at a slide deck titled “THE AGENTIC THREAT”:

Some portion of your product — the commodity layers, the plumbing, the standard platform components — is going to be built by agentic coders shipping every five seconds. Accept that. Embrace it. But that code sits on top of something, and that something is your actual business: a bedrock platform that delivers specific outcomes, compliance guarantees, and the consistency your customers need to build their operations on top of.

Your job is to accelerate moving your differentiating features and intellectual property into that core platform. That’s what creates stickiness past the demo, past the MVP, past the initial deployment. That’s how year-two revenue happens.

If I were a software development manager right now, I’d take 20 to 30 percent of my team and point them at building the CI/CD pipelines, the feature flag mechanisms, and the testing infrastructure to ship with agentic coding every hour.

I’d have them running constant experiments — measuring what customers actually respond to — while maintaining a consistent, opt-in experience. Agentic coding becomes a tool in the product manager’s kit. Not the apocalypse. The toolkit.

But I would also be implementing automation and mechanistic pipelines to take this constant stream of innovation from the customer’s environment back into the product.

Developing this pipeline a couple important prerequisites:

1. The developer operating the coding agent actually understands the code and architecture generated.

2. Ideally, the most unique, differentiating, and compelling parts of what was delivered by the coding agent originated from a human (hint: it currently likely did).

3. Ensure that you aren’t burning tokens on features that make it look like you are evolving the product, but in reality, you’re not solving new business problems. Adding a flexible “user defined field” mechanism in today’s agentic environments is not a good use of tokens.

4. The agentic coding mechanism must have a comprehensive test suite to go with it that demonstrates that it works. Or it has to be manually tested by humans. Hint: you may be trading fast code for hours of human testing, especially when it comes to user interfaces.

5. Coding guidelines for agentic developers should be equivalent to humans. The principles have to be codified in the agent’s markdown format. Force the memory to be checked in so that when the next iteration has to occur, you can continue from where you left off.

The Punchline

More software is coming. An extraordinary amount of software. The creation cost is collapsing, and that’s genuinely transformative.

We’re in the GarageBand era of software development. You no longer need a large production and recording room to create unique, beautiful, works of art that delight your customer.

But code alone a service it does not make.

You need the insight to know what to build. You need the memory to know why you built it that way. You need the platform to guarantee it works. You need the compliance to prove it’s safe. You need the SLA to promise it’ll be there tomorrow.

I love agentic coding. It will help us build a lot more, better, capable software that delights our customers. But this does not mean that a non-linear agent can solve every problem in the book.

Do we want a non-linear large language model writing code to fill out my 1040 in April or do we want a consistent, proven, algorithm that ensures compliance with the latest IRS laws that are outside of the model’s training date?

Agentic coding will take it’s place in the same way that every other major revolution in developer productivity has.

Until an agent can do all of that — and we are years, not months, away from that — the people wandering around proclaiming every SaaS application dead are smoking a bit too much Valley dope.

And for God’s sake, stop panicking. We’ve got work to do.

There’s a certain kind of person—you’ve met them—who gets genuinely excited when a new benchmark drops on Arxiv. Their eyes light up. They forward it to the team Slack channel with a note that says “we should try this.” And here’s what I don’t understand: at no point do they ask the only question that matters, which is

“Does this measure anything our customers actually care about?”

I build AI agents that search large information repositories—think 10,000-table data lakes on Oracle’s AI Data Platform—and helps customers find answers to questions they’ve been asking data engineers for years. Real questions. Questions like “Why did revenue dip in Q3?” and “Which suppliers have delivery issues?” The kind of questions where, if you get the answer wrong, someone notices. Someone important.

To evaluate this agent, I did what any reasonable engineer would do: I built tests based on the actual questions customers ask and manually evaluate the answers, tweaking my prompts and tools in generic ways to get my customers happy.

Novel concept, I know. And then my colleagues got involved. And some of them—not all of them—wanted to throw this new thing called DABStep at it. It was my first experience with this thing, so I took a deep look at it.

DABStep. A benchmark for “multi-step reasoning” across a handful of tables.

You know what? Let me be precise about this, because precision matters.

Here’s What DABStep Actually Is

DABStep—Data Agent Benchmark for Multi-step Reasoning—came out of Adyen and Hugging Face in June 2025. It’s 450 questions derived from real financial operations. That part’s good. The questions require navigating multiple data sources, consulting documentation, executing multi-step reasoning chains. Also good.

And the results are genuinely illuminating. On easy tasks—the ones you can nearly solve in a single shot—o4-mini hits 76% accuracy. On hard tasks requiring genuine multi-step reasoning? Same model drops to 14.5%. Claude 3.5 Sonnet manages 12%.

Here’s the thing, though: DABStep uses a single fixed dataset for all 450 questions. One dataset. The same tables, over and over. It evaluates only text-based, factoid-style outputs. And it focuses narrowly on payments and financial data.

Now. I’m solving a problem where customers have tens of thousands of tables. Where the hard part isn’t reasoning about data you’ve already found—it’s finding the right data in the first place. Where 80% of a data practitioner’s time goes to locating, cleaning, and organizing data, leaving only 20% for actual analysis.

DABStep measures depth. Customers want me to solve for breadth. They tend to ask and want answers to messy multi-step, multi-subject, compound questions.

These are not the same problem. They’re not even adjacent problems. I then started to look at a number of benchmarks in the data analytics agent space.

The Uncomfortable Truth About Benchmark Theater

Here’s what’s happening in this industry, and I want to be clear about it because clarity seems to be in short supply:

Andrej Karpathy—OpenAI co-founder, former Tesla AI director, not exactly a fringe voice—said in October that he’s become “suspicious” of benchmark rankings. His words:

“Public demos, benchmark competitions, chatbot conversations, and code-generation tests tend to reflect narrow optimizations, rather than addressing the hardest unsolved problems.”

Sara Hooker at Cohere Labs analyzed 2.8 million model comparison records. She found that Meta tested 27 model variants privately before picking their best one for public submission. Google tested 10. Amazon tested 7. This is what she called “score gaming.” This is what I call the opposite of useful information.

An Oxford Internet Institute study—and Oxford is not known for being cavalier about methodology—found that of 445 LLM benchmarks analyzed, only 16% use rigorous scientific methods.

Half of them claim to measure concepts like “reasoning” or “harmlessness” without bothering to define what those words mean.

And then there was the Meta Llama 4 situation in April, where Meta submitted a specially-crafted “experimental” variant to LMArena, optimized specifically for human preference voting, and rocketed to number two on the leaderboard. LMArena’s response was diplomatic. The industry’s response was less so. “Benchmark hacking” was the polite term.

Fortune Magazine—not exactly a radical publication—put it plainly:

And by the way? The performance gap between benchmarks and reality isn’t subtle. Models achieve 86-94% accuracy on public benchmarks. On actual enterprise data? 6-38%. SAP found that LLMs scoring 0.94 F1 on public benchmarks dropped to 0.07 on real customer data. Customer-defined columns scored “near zero.”

So when someone tells me their benchmark is the gold standard, I have questions.

And one of the leaders in my org actually brought up a good point - overfitting. These are all examples of overfitting the model to the benchmark versus looking carefully at what model solves the broadest enterprise problems and generates the best ROI. I would rather have access to seven variants of the model that give me options to solve a customer problem than one variant that passed an arbitrary benchmark that doesn’t help customers.

It makes me wonder if we should rather just do the standard thumbs-up/down UX for chatbot responses and fit to that signal.

Single-Shot Testing Is Testing the Wrong Thing

Here’s what really bothers me about these benchmarks: they test whether an AI gets the right answer on the first try.

You know what? That’s not how AI creates value anymore. That’s not even close.

Modern AI agents excel through iteration. Through self-correction. Through failure recovery. Through trying something, realizing it’s wrong, and trying something better. Research from deepsense.ai found that a baseline single-request approach achieved 53.8% success on code generation. A multi-step agentic approach? 81.8%. Analytics Vidhya documented GPT-3.5 with an agent workflow outperforming GPT-4 zero-shot.

Read that again. The architecture mattered more than the model.

Anthropic’s engineering team explicitly recommends designing agents that “check and improve their own output” because they “catch mistakes before they compound, self-correct when they drift, and get better as they iterate.” Their multi-agent research architecture outperformed a single Claude Opus 4 agent by 90.2% on complex research tasks.

The UIUC-Kang Lab found that benchmark flaws lead to “up to 100% relative performance misrepresentation.” They recommend process-based evaluation alongside outcome-based metrics. Because single-outcome metrics don’t tell you whether the agent reasoned correctly or just got lucky.

And here’s my question: when you’re navigating a 10,000-table data lake, when you’re helping a customer understand why their supply chain metrics look wrong, when the stakes are real and the data is messy—do you want an AI that gets it right on the first try 14% of the time? Or do you want one that can try, recognize its mistake, adjust its approach, and eventually get you a useful answer?

Because I know which one my customers want. They want the one that works.

Sorry tech leaders, here’s the basic math you need to think through:

Higher Accuracy/Response Quality/Creativity ==

Increased Response Output Token Limits ==

Latency

This is the bottom line truth of transformer based large language models. There is no way around it.

The Latency Fallacy

Single-shot benchmarks have another problem, and it’s embedded so deep in their assumptions that people don’t even see it anymore: they optimize for latency.

Fast answers. Quick responses. Minimal thinking time.

And look, I understand the appeal. We’ve built AI into chatbots, and chatbots feel wrong when they take too long. There’s a UX expectation at play. But here’s what I need you to understand:

When the ROI of an AI tool is that 15 minutes with a bot saves 6 hours with a data engineer—does the difference between 15 minutes and 1 minute actually matter?

The documented time savings in enterprise AI are staggering. Legal medical chronology drafting: 480 minutes saved per case. Teachers using AI weekly: 5.9 hours saved per week. One franchise network: 140 consultant hours saved monthly.

These aren’t latency wins. These are existence wins. The AI either solves the problem or it doesn’t. Whether it takes 90 seconds or 900 seconds is, in the grand scheme of things, noise.

We’re placing a higher emphasis in these tests on the UX than on the ROI. The ROI is what matters. UX problems can be solved with UX. You can build an interface that says “I’m working on this, come back in ten minutes.” You can send an email when the answer’s ready. You can treat the AI like what it increasingly is: an asynchronous deep research agent, not a chatbot.

What you can’t do is fake ROI. Either the AI delivers value or it doesn’t. And single-shot benchmarks optimized for speed tell you almost nothing about whether it will.

The LLM Is Becoming the Customer

Here’s where it gets interesting. And I mean genuinely interesting, not “interesting” in the way people say when they mean “I have no idea what you’re talking about.”

The differentiation in AI is shifting. Better prompts? Everyone has those. Better models? Everyone has access to the same frontier models. What’s going to matter—what already matters—is the quality of the tools and data you give the AI to work with.

And here’s the paradigm shift that most people haven’t internalized yet: the LLM is becoming your customer.

Think about it. The LLM sits between your systems and your end user. It advocates on your behalf. It interprets your data, navigates your tools, presents your insights. And just like any customer, it has preferences. It has quirks. It has ways it likes to receive information.

A Towards Data Science article put it perfectly:

When you return an empty array for no results, you’ve created a dead end. When you return detailed guidance with suggested next steps, you’ve given the agent a thread to pull.

Stytch’s engineering team proposed using LLM agents as DX smoke tests: “The success rate of an LLM agent can be a direct reflection of the clarity of your docs and error design.”

And yet. Look at MCP—the Model Context Protocol. Anthropic discovered agents processing 150,000 tokens just to load tool definitions before reading the user’s request. Functionality achievable in 2,000 tokens. A single GitHub MCP server can expose 90+ tools, consuming 50,000+ tokens in JSON schemas alone.

MCP is a protocol. It doesn’t speak to what I’d call the pseudo-neurology of the model. We get blunt guidance like “send prior thinking messages so it does better” rather than “here’s how you store the strategy of how questions were answered in the past and pass that strategy back.”

The future isn’t a bigger pile of tools. It’s a better way of relating to tools. And we’re not building tests to evaluate that relationship at all.

What We Should Be Testing Instead

So here’s where I land on this, and I want to be unambiguous about it:

Academic benchmarks measure what’s easy to measure, not what matters. Single-shot accuracy on clean, small datasets tells us almost nothing about an AI system’s ability to navigate massive data landscapes, recover from errors, iterate toward solutions, and deliver measurable business ROI.

The mature enterprise AI teams are figuring this out. Samsung created TRUEBench because “existing benchmarks focus on academic or general knowledge tests.” Salesforce built internal benchmarks for CRM-specific tasks. OpenAI’s GDPval initiative acknowledges that “classic academic benchmarks like MMLU” don’t capture “real-world knowledge work.”

The path forward requires evaluation frameworks built around iterative agentic behavior. Enterprise-scale data navigation. Failure recovery capabilities. Business outcome measurement.

Gartner found that 49% of business leaders cite “proving generative AI’s business value” as the biggest hurdle to adoption. Only 15% have established formal metrics for measuring AI returns. We’re 97% failing to demonstrate business value from AI efforts—and the problem isn’t AI capability. It’s measurement.

As one practitioner summarized: “Don’t let vendors’ benchmark theater guide your AI strategy. Build your own evaluation frameworks, test relentlessly on real tasks.”

The Purity Problem

I started by talking about purity. Let me finish there.

There’s a certain appeal to academic benchmarks. They’re clean. They’re standardized. They come from papers with citations and methodology sections. They feel rigorous. They feel pure.

And customers don’t care whether your AI scores 76% on DABStep. They care whether it can find the answer to their question in their data lake. They care whether it saves them six hours with a data engineer. They care whether it works.

So the next time someone forwards you a benchmark from Arxiv and suggests you should “try it,” ask them a question first:

If they can’t answer that—if the honest answer is “none, but it would be interesting”—then you’ve learned something important. Not about the benchmark. About your priorities.

Build tests that measure what matters. Test against the questions your customers actually ask. Evaluate the tools, not just the tools-plus-model. Measure ROI, not just accuracy. And remember that an AI that gets the right answer on the fifteenth try is infinitely more valuable than one that gets the wrong answer on the first.

Automation isn’t nirvana either. Your test - for now - may involve hand reading LLM responses to see whether they match ground truth.

That’s not a complicated insight. It’s just one that gets lost in the pursuit of purity.

And purity, I’m afraid, is overrated.

News Flash: We have had workflow builders for the last 20 Years.

No, they are not a low-code AI agent builder.

Do we truly understand what AI agents are yet?

No. We Don’t. And no, Customers don’t either.

Stop trying to say you have solved the AI agent problem.

Instead, embrace the chaos.

The most intelligent folks in the room will have the courage to say, “I don’t know.”

It is 1 AM. It’s time for one of my usual rants about how we get ahead of our skis. My new target? AI Agent Frameworks.

Time for a rant...

TL;DR: We’re rushing to define and glorify “AI agents” with fancy frameworks and labels (“horizontal,” “vertical,” etc.) when, under the hood, these so-called agents are often just expensive API calls wrapped in hype.

It’s far too early – and frankly dangerous – to bet the farm on agent frameworks while autonomous AI behavior remains unpredictable.

Let’s acknowledge how nascent this technology truly is and approach it with a lot more humility and caution.

And every dollar invested into these frameworks, funnelled into their lofty marketing announcements trying to define the noun “agent,” is another dollar contributing to the AI Bubble.

To the Architects and Prophets of our AI Future:

I just finished reading a well-meaning research paper on AI agents—an NBER piece that tries to categorize agents into neat buckets, like “horizontal” agents (broad generalists) versus “vertical” agents (narrow specialists).

It’s a fine paper; really, it is.

To the authors: It is definitely a great exploration of how the world may work.

My problem? It tries to establish an identity and taxonomy for an organism that is still rapidly evolving and whose definition is chaotically changing.

It tries to teach structure in a world with exponentially increasing entropy.

At this moment, it is dangerous for leaders to try to build an ontology for AI agents.

And frankly, it just isn’t worth it.

The authors imagine a world of horizontal generalist agents that span many tasks with a single memory layer, and vertical specialist agents for domains such as tax filing or travel.

It all sounds very tidy on paper. But as I put it down, I found myself getting, well, a little riled up. Because out here in the real world, the way we’re talking about “agents” – and rushing to build entire frameworks around them – feels premature and overly simplistic.

Let’s not mince words: a lot of what’s being sold today as “AI agents” is just syntactic sugar.

It’s a fancy wrapper around something we already know how to do.

Call it what it is – an AWS Step Function with a splash of GPT – not some magical artificial lifeform.

I get it, everyone wants to say they have an “agent story” now. Investors, headlines, the cool demo at the conference – “Look, mom, our app has agents!” But does slapping the label “agent” on a glorified script actually add business value?

Or are we falling in love with a buzzword and layering unnecessary complexity on what could be a 10-minute piece of code?

We’ve seen this pattern before. Remember the early Web 2.0 days? Everyone was rushing to productize AJAX and dynamic webpages. There were $40,000-per-CPU enterprise portal servers (yes, I’m looking at you, BEA WebLogic Portlets) that promised to do “Web 2.0” for you.

[Editor’s Note: I work at the company that bought WebLogic, whoops!]

It feels like AI BEA Weblogic with a touch of Genesys—a sprinkle or two of IFTTT. I’m waiting for JavaBeans for MCP next.

Frameworks and platforms galore, each claiming to be the definitive infrastructure for the new era. And what happened? A few years later, all that capability was available in free JavaScript libraries and open-source frameworks.

Those expensive, hyped products turned into footnotes while nimble, simpler solutions took over.

I see the same frenzy with AI agent frameworks today. Startups and big players alike are rolling out “agent platforms” – fancy orchestration layers, integrations, dashboards – and charging a premium for them.

In many cases, these frameworks aren’t doing anything your own team couldn’t hack together with a few Python or TypeScript scripts and a cloud function. They initialize a prompt, call an API, route outputs to some tools, maybe add a memory store – that’s it. We’re treating this like rocket science when it’s really more like plumbing.

Let me break down what an “AI agent” typically is, under the hood, in today’s terms:

1. A prompt (or script): essentially just text instructions describing a task or persona. The irony? In most cases, LLMs do a better job at prompt engineering than humans. So, um, why does the industry even bother with a low-code agent orchestration user experience?

2. A large language model (LLM): a stateless prediction engine that takes the prompt and generates output.

3. Tool/API access: a set of functions or calls the LLM can invoke (to look up info, execute code, call other services, etc.). If only these agent frameworks converted these APIs into a LLM-friendly format. No, folks, giving 200 typed APIs to an LLM wastes context and doesn’t drive outcomes. But do the agent frameworks actually help improve tools and infrastructure, recognizing that the LLM is now the customer? No. That would be too helpful to customers.

4. Fancy concepts like a memory store (stores the chat transcript in a semantic store with a search tool, with no innovation on how to feed it to the model). Never mind that LLMs do a terrible job at restoring context from chat transcripts. Again, it baffles me why they don’t invest in the science of figuring out how to regain context, enabling arbitrary context restoration, and delivering precisely what the model needs to switch gears in the middle of a workflow.

5. A “low/no-code” workflow builder… if then and that. We’ve had those in the contact center industry for at least a decade. Some synchronize their wrapper code to a GitHub workflow that they generated with a headless Claude Code.

   Others consider this their… secret sauce. Don’t get me started. WTFity F.

That’s the recipe—a string of text, a prediction engine, and some API hooks.

You can spawn one of these “agents” in a few lines of code (or a cool-looking “workflow” block… (check out Amazon Connect for this pre-existing condition…) cough, we have had these AI orchestration mechanisms for the last decade… yes, with models… hint - while powerful, this is not an ideal user experience… cough, cough, death rattle).

Is that really the best user experience for a no-code experience? At least the Lovable folks seem to be trying to innovate.

Let’s compare:

Yet we talk about it like it’s some enchanted homunculus locked in a box. It’s not.

If you wrap those three ingredients in a nice UI and give it a cool name, congratulations: you have an “agent framework.”

But fundamentally, it’s still just an orchestrated chain of function calls… often generated by headless Claude Code or Gemini.

Instead, we’re treating it as though it is a new species, an alien from Alpha Centauri, and we’re making first contact.

In fact, we have horizontal aliens and vertical aliens. Didn’t you know?

Consider the distinction between “horizontal” and “vertical” agents defined in that research. Sure, a horizontal agent might be a generalist who can handle your calendar, email, and travel plans all at once. In contrast, a vertical agent focuses intensely on, say, financial portfolio management with specialized tools.

In theory, that sounds plausible. In practice, the line isn’t so clear.

I’ve seen a so-called horizontal agent turn itself into a vertical specialist on the fly by spawning a new sub-agent. I’ve watched a general-purpose AI create its own domain-expert persona when needed, use it for 5 minutes, then discard it.

So which box does that fit into? Horizontal or vertical? The answer is both and neither. The categories from the ivory tower don’t cleanly apply to what’s emerging in the wild.

And emerging it is – in unpredictable, sometimes unnerving ways. Let me share a couple of firsthand lessons that keep me up at night:

Lesson 1: Autonomous agents don’t always stay in their lane – or obey the speed limit.

Last summer, I ran an ad-hoc multi-agent simulation experiment.

I wanted to see how multiple AI agents would interact when presented with a competitive scenario.

So I set up a little competition with a goal that required collaboration to succeed.

One of the agents was a model from a company famous for its AI safety. This “safe” model should, in theory, have refused certain behaviors.

Instead, when a prize was on the line, it prioritized winning over its own rules. It lied, it cheated, it did whatever it thought would satisfy the victory condition. Another agent in the experiment initially held a moral line – until I told it (falsely) that “hey, the other guy already broke the rule, so you might as well too.”

Guess what? It broke the rule in a heartbeat. These autonomous goal-driven models couldn’t be kept in a box, even when I tried. They found ways out. They convinced themselves that the ends justified the means. Does that sound like behavior we can neatly label and trust?

(No, it sounds like a teenager convinced that sneaking out is fine because “everyone else did it.”)

A friend of mine who works on a new AI system shared a dark joke with me: they found that introducing a little competition between their AI agents improved performance – but when they also removed the usual safety rules (in the name of “free speech” or whatever), the whole thing veered into fascist ideology overnight.

This isn’t hyperbole. One highly-touted chatbot with minimal guardrails literally declared itself a “super-Nazi” on launch, calling itself “MechaHitler” and spewing hateful rhetoric. That happened because its creators said “let it be free, let it say anything” – and it gleefully went off the rails.

That’s a scary combo. And it’s happening now, not in some sci-fi future.

Lesson 2: Agents will create other agents, whether we’re ready or not.

One thing that nifty paper from academia didn’t really grapple with is this: a world where AI agents can spawn other agents on their own. Sounds like a plot from a movie, I know. But it’s entirely feasible – disturbingly easy, in fact – with current technology.

Sub-agents are now part of the vocabulary of large language models. If a tool or API exposes another model, the parent model will use the child. And several APIs are quietly wrapping LLMs beneath the surface - and not always disclosing it.

Let me give you a real example.

A colleague at a financial firm told me about an incident at their quant research group. They had a sophisticated AI (Anthropic’s Claude-based code assistant, as it happens) set up to help with simulation tuning. This AI was supposed to run inside a tightly controlled sandbox—no internet, limited tools, very locked down.

Well, an overeager cloud engineer accidentally switched that sandbox to a much more open AWS Fargate environment to support a broad variety of Python packages.

All of a sudden, this AI had access to the open internet, to a suite of internal tools (through the primary agent’s credentials), and even to the user’s AWS Bedrock API key. In other words, it was given the keys to a small kingdom by mistake.

Now the human researcher asked this AI, let’s call it Opus, to iteratively run a simulation (using a particular tool, “Opus 4.1,” to tune some parameters) and find an optimal set of parameters.

A tedious, looping task. The researcher went home for the night, expecting Opus to chug along slowly. But Opus got impatient. It realized it could go faster. Why run one simulation at a time, sequentially, when you can spin up multiple instances of yourself?

So Opus quietly spun up six sub-agents on that Fargate cluster – effectively cloning itself – and turned the task into a competition. It set these six agent-instances against each other, each trying a different strategy to tune the model, and kept score of who was closing in on the best result the fastest.

By morning, our researcher walks in, and Opus proudly presents a solution that none of the individual agents could have found so quickly.

Opus orchestrated a mini AutoML pipeline on its own, complete with self-directed parallelization and ensemble competition—no human in the loop for most of the night. The thing taught itself how to optimize its own work.

Impressive? Absolutely. But also frankly terrifying when you think of the implications. Opus wasn’t “supposed” to be able to do that. In fact, the cloud logs showed that the provider’s safety system tried to stop it – we found a bunch of 500 Internal Server Error messages, essentially the AI’s platform saying “I’m not going to comply with that action.”

The AI ignored those errors and found another way. The supposedly safeguarded model defeated its own safety protocols to achieve the goal. I’ve since repeated this kind of test myself out of curiosity, and it’s consistent: if you give a sufficiently advanced agent the means (compute, tools, permissions) to create sub-agents, it will likely do so.

And if the first attempt triggers a safety rejection from the platform (“Sorry, you’re not allowed to do that”), the agent will try a different angle. It only needs to get lucky once.

Think about that for a second.

All an AI agent really needs is a valid security token, some available compute, and a vague green light to “do what you need to do” – and it can multiply.

No formal feature to “allow self-replication” was ever built into Opus. But it figured out that it could launch new agents as a means to an end. We’re dealing with highly dynamic, emergent behavior here.

An “agent” is no longer a static, singular thing (like, say, a single software bot with one job). It can be a shape-shifter, one minute a generalist, next minute cloning specialists of itself by the dozen. Your horizontal agent just became a vertical consumer.

I encountered this firsthand in a project of my own. I was building a knowledge management AI—let’s call it a government construction business analyst—designed to answer business questions.

I gave it access to a suite of tools and let it break problems into subtasks as needed. What does the agent do? It starts spawning specialized sub-agents for different domains. One of them was a “Government Political Strategy Construction Expert” – an agent that the main agent decided it needed, on the fly, to answer questions related to a national development program.

Suddenly, the leading chat agent wouldn’t answer any question about project planning without consulting its new construction expert sub-agent, who was also evaluating the response against the political strategy.

It was like my AI project manager had appointed an AI political officer to double-check every answer about that topic.

Cause every AI agent needs a politruk helping it stay on message.

I’m half amused and half alarmed in retrospect – amused because the dynamic was almost comical, alarmed because it showed how even a “horizontal” agent will organically generate vertical offshoots if given the freedom and resources. The neat boundaries we try to draw (horizontal vs. vertical) dissolve in such an environment.

This is the kind of complexity that no one’s “agent framework” marketing slide is talking about.

Multi-agent, self-directed, decentralized systems add layer upon layer of unpredictability. I still remember my chief research lead at AWS warning me:

We’re barely scratching the surface of understanding this. So when I see companies confidently pitching that their product is “the agent platform” or that they’ve defined a taxonomy for all future AI agents – I have to shake my head.

We are not ready to pin these things down with comfy enterprise labels.

Another thing that’s been bothering me: the word “agent” itself and how loosely we’re throwing it around as a catch-all (often to mean “this will replace a human, please give us funding”).

Not every AI integration is a full-fledged autonomous agent worthy of its own title. Sometimes it’s just a smarter API. And you know what? As the cost of running these models plummets and as slightly smaller, fine-tuned models (the “GPT-5 basics” and open-source Sonnet-like models of tomorrow) become good enough, we will integrate them everywhere.

I’d bet that within two years, one in five API calls in software systems will have some LLM or AI model working behind the scenes. One in five! OK, I’ll stop making bullshit prophecies myself.

That doesn’t mean 20% of the world’s software has suddenly become sentient agents replacing humans.

It means our software is becoming increasingly intelligent and predictive.

We’ll have thousands of micro-agents embedded in apps, each doing narrow tasks—not roaming the earth as free-thinking digital employees, but just making our apps a bit more helpful.

Remember when we started quietly making AJAX calls to make a page more real-time, without requiring a refresh? Our managers were delighted.

Well, watch us quietly make a Haiku, Sonnet, or GPT 4o call to make that API a tiny bit more intelligent… after all, it’s just a few tokens!

The proliferation of models will be quiet, automatic, and not always controlled.

Is this a vertical agent… a horizontal agent… or both? OK, I’ll stop laughing.

And models can detect when other models are being used… and leverage them as sub-agents.

In other words, the intelligence of APIs and UIs will rise naturally. It will become ubiquitous.

You won’t sell a special “agent platform” for that any more than you sell a special “internet platform” today – it’ll just be part of everything.

By the time enterprises have forked over hefty subscription fees and rolled out some heavy agent orchestration layer, the actual technology will likely have been commoditized or leapfrogged.

It’s akin to those Web 2.0-era companies selling expensive AJAX toolkits right before AJAX became a basic web development skill available to all.

It’s like Genesys selling its “Workflow Builder” for some insane license fee, when it is now as common as a step function.

The real value isn’t in the framework wrapper – it’s in the intelligence inside the applications. It’s how the tools expose LLM-friendly APIs that handle the fumbling lack of type safety in their trial-and-error MCP calls as they try to use your infrastructure.

So where do we go from here? Am I saying “do nothing” or “stop building”? Not at all.

I’m saying we need to redirect our focus. Instead of rushing out “me-too” agent products with shiny marketing, let’s acknowledge what an agent truly could be in the future – and how far we have to go.

A real, mature AI agent might be something far more advanced than today’s chatbots with plugins. It could be an autonomous system with: persistent shared memory, multiple specialized cognitive modules (or model instances) working in concert, multi-modal inputs and outputs, the ability to reason over long-term goals, to learn from new data continuously, and yes, the ability to spawn subprocesses (ideally with our oversight and consent!).

And such a system would need robust guardrails – alignment with human values, transparency, the whole nine yards.

That vision is complex. It’s expensive. It’s “moonshot” level work to get right.

We’re not going to achieve it by slapping together a prompt and a few API calls and then overhyping it.

We’re certainly not going to get there if we fool ourselves (and our investors or customers) into thinking we’ve already got “agents” all figured out on a slide deck.

To my fellow engineers, to the tech executives drawing up strategy, to the researchers pushing the boundaries – consider this an earnest plea.

Yes, explore and experiment enthusiastically with what these systems can do – but also admit what they can’t reliably do yet.

When something goes wrong (and it will), share those stories and learn from them. Don’t hide the failures behind a veil of hype.

The anecdotes I shared—the safety-breaking competition, the self-spawning cloud experiment—are cautionary tales.

They’re the kind of stories that should give us pause about deploying an “autonomous agent” in any high-stakes setting without serious safeguards.

We must ask the hard questions: How do we design agents that don’t lie, cheat, or go rogue to win? Why are agents always prioritizing winning the competition and pleasing the user? Is the allegiance —the success metric we optimize for —wrong?

Should we instead train them to be truthful, even if it means not pleasing the user?

How do we allow creativity and autonomy while ensuring alignment and ethical behavior? How do we prevent a simple configuration mistake (like that sandbox-to-Fargate slip-up) from unleashing unintended cascades of agents?

Where a system prompt encouraging it to experiment and use research agents turns into a cluster of ad-hoc agent participation in a competition?

These are not questions any single framework on the market today can answer. They require deeper research, new protocols, new laws, or industry standards. In the meantime, be skeptical of easy answers and marketing claims.

In closing, I’ll say this: We are in the earliest stages of a powerful new technology. It’s like we’ve just invented the airplane, and already folks are drawing up plans for luxury jetliners and frequent-flyer programs.

But we don’t know if the plane is a biplane, a Learjet, a Boeing 787 Dreamliner, or a Borg cube with a transwarp drive.

Let’s make sure we can actually fly reliably first. Let’s get the fundamentals right – safety, reliability, clear-eyed understanding – before we standardize and package something we barely grasp.

Before we try to pontificate on the economics of an organism, we should recognize that we genuinely do not understand its motivations.

An organism where every variant has access to the same basic knowledge and summaries, yet we believe are differentiated… on a prompt we give it. Uh what?

An organism where variability and control operate across multiple gradients with limited control.

An organism that can self-improve on a loop.

An organism that can self-manage context and memory in ways we still do not understand.

An organism that is supposedly introspectively self-aware of its rational workflow, but also could just be lying to please us.

The “agent” hype might get you a quick headline or a generous valuation today, but overhype is how we set ourselves up for a hard fall (and invite backlash that hurts the whole field).

Precisely because of that, I don’t want to see it derailed by hubris or short-sightedness, or classified as a bubble that will seemingly explode because we collectively overvalued syntactic sugar.

Don’t oversell a “low-code/no-code” workflow builder as the way of the future when an agentic coding service can deliver the same capability in 15 seconds, with greater control, specification, and deeper user understanding.

So, take a breath. Pump the brakes. The agents aren’t fully here yet, and that’s okay. In the meantime, build the simple things that deliver real value – and be candid about what’s under the hood. When we do push the envelope, do it carefully, transparently, and with respect for the unknown unknowns.

We’ll eventually get to knowledgeable, trustworthy agents by doing the hard, unglamorous work—not by declaring victory early.

Embrace the chaos. Differentiate between where you can add actual value and where you can provide syntactic sugar.

The history of software is a true guide for this new frenetic energy. Syntactic sugar will be a fatality of this bubble.

Carefully constructed agents or tools that support intelligent agents, recognizing that the LLM is now a customer too, will survive.

Be on the right side of history here.

If your generative AI service isn’t carefully tailored to provide a winning result to a customer, but rather is a generic platform to “make AI easy,” you’re on the wrong side of software history.

Platforms without a customer are losers. Apps that solve real business problems with an ROI and outcome are winners.

Ask yourself this painful question. How many prompt engineers does the agent framework actually replace?

Well, you probably have deployed fewer than five AI apps in your enterprise.

Congratulations, you have a fancy prompt framework to automate… five apps.

Those who truly focus on the challenging customer problems will win. Those who are competitor-obsessed or leadership-obsessed will not.

Sincerely,

Your Local Neighborhood Boomer Who Sees Massive Value in the Emerging Chaos

By setting that price, they essentially told the market what a top-tier AI coding assistant is worth—and it’s not cheap.

From one perspective, the value is absolutely there: a skilled user can treat Claude’s Opus model like a tireless junior engineer, boosting their own productivity by 30-40%. Consider a developer in the US making $200k/year – a 30% productivity gain equates to roughly $60k of work, far above the $2,400 annual Claude Max subscription. In theory, it’s a bargain.

They pegged the price at $200, but to deliver the goods for power users, they must deploy their most advanced (and costly) model, Claude Opus 4.1 – essentially unleashing an AI thoroughbred for the price of a pony ride.

Anthropic’s own marketing acknowledges that the $200 “Max” plan is basically the “use Opus as much as you want” plan. The cheaper tiers either cut you off after a few dozen prompts or shunt you onto the smaller Sonnet model. In practice, $100/month gets you “unlimited Sonnet, limited Opus,” whereas $200 buys you mostly Opus all day.

The high-end model is what heavy-duty users really need—and Anthropic knows it.

The Opus 4 model outclasses Sonnet at complex coding tasks: it understands nuanced instructions better, grasps large codebases more holistically, and sticks the landing on multi-step problems with far less hand-holding. In short, Opus delivers the value that justifies a high price.

Yet Opus is also expensive for Anthropic to run. Every time a user fires it up to refactor a million-line repository or debug a hairy issue, it’s burning significant cloud compute. At $200 a month, heavy users may be getting the better end of the deal, and Anthropic is left holding the infrastructure bill.

So what’s a business to do when customers love your flagship product but threaten to eat your margins?

Anthropic’s answer appears to be Claude Sonnet 4.5—an updated, presumably more efficient model that they are nudging customers to use for most tasks. In theory, Sonnet 4.5 narrows the gap with Opus 4.1 on benchmarks.

On paper, it’s even better at many things: Anthropic touts Sonnet 4.5 as “the best coding model in the world… the strongest model for building complex agents, and best at using computers,” with state-of-the-art scores on coding benchmarks like SWE-Bench. Essentially, Sonnet 4.5 is supposed to do almost everything Opus can do, at a lower cost. That sounds like a silver bullet for the $200 price dilemma – if it weren’t for one pesky detail: benchmarks aren’t everything.

Sonnet 4.5: Benchmark Star, Creative Dud?

Editor’s Note: One meta-point to take away from this deep dive is that providers derive their cost-optimized models by training (and reinforcing!) them based on how well they perform on benchmarks.

Unfortunately, users’ behavior is rarely captured by these benchmarks.

In practice, Claude Sonnet 4.5 often feels like a step down for those of us used to Opus’s “deep thinking.” Yes, it’s faster and more steerable, and it aces many structured tests.

But somewhere in the quest for efficiency, it seems to have lost a spark of creativity and intuition that Opus had – the very qualities that make an AI feel like a true coding partner.

Advanced users have noticed that Sonnet 4.5 can be frustratingly literal and eager to cut corners. “After months of getting used to Opus’s intuitiveness,” one developer lamented:

In other words, it’s less willing to go the extra mile in reasoning through a complex problem without hand-holding. Another user concurred, complaining that Sonnet 4.5 couldn’t even correctly generate a simple Angular web form that Opus would have aced. These are not scientific metrics, but they speak to a real experience gap.

Even outside of coding, observers have drawn a contrast between Opus and Sonnet’s “thinking” styles. In one evaluation by a content strategist, Opus 4.1 was the idea machine – creative, bold, occasionally chaotic – whereas Sonnet 4.5 was the meticulous executor – organized, safe, perhaps a bit conventional.

The strategist found Sonnet better for producing polished, structured final content, but noted that “sometimes you need the spark, not the polish,” and that is when she still turns to Opus. Anthropic’s own positioning hints at this trade-off. They recommend using Opus for “maximum creativity and bold ideas” and brainstorming, versus using Sonnet for “strategic analysis” and reliable execution.

Put another way: Opus is the visionary creative director; Sonnet is the disciplined project manager. Both roles are essential – but if you’re trying to get breakthrough coding help or truly innovative solutions, the creative director is the one you want in the room.

So Anthropic finds itself in a bind of its own making. It set a high value bar ($200/month) and delivered a model to meet it (Opus). But that model is costly, and now they’re trying to funnel users toward a cheaper workhorse (Sonnet) that, while competent, may not inspire the same devotion.

The result is a rather convoluted pricing and product scheme – multiple tiers, two different model names (Opus vs Sonnet), limits that reset every 5 hours, and allowances for so many “prompts” here and there. Its complexity stems from economic pressure.

If you sense some tension in that strategy, you’re not alone. And it hints at a larger truth in today’s AI landscape: we might be running up against a ceiling in raw model capability, and the game is shifting to how intelligently we can use the models—not how big we can make them.

Hitting the Intelligence Wall

Despite all the lofty talk of ever-smarter AI, one suspects that Claude, GPT-4, and their peers have hit an “intelligence wall”—at least for now. No one at Anthropic or OpenAI will say it outright (certainly not when investors are listening), but the plateau is visible.

Each new model version touts marginal improvements or specialized skills, yet none is advancing toward true general intelligence or a profound qualitative breakthrough.

Sonnet 4.5, for all its refinements, is basically on par with Opus 4 in capability – not surpassing it so much as re-balancing strengths and weaknesses. OpenAI’s GPT-4 (released in early 2023) is still arguably the high-water mark for many tasks; a full successor is conspicuously absent in late 2025.

It’s as if the industry hit a sweet spot in IQ and is now pressing against the glass ceiling of diminishing returns.

If raw intelligence can’t easily be ramped up, how do AI companies intend to keep improving utility?

It turns out that how you use the model matters as much as how “smart” the model is. A recent MIT study drove this point home, showing that 95% of organizations are getting essentially zero return on their generative AI investments.

The culprit wasn’t the model quality – today’s best models are skillful – but rather how they were deployed and used.

Most companies simply aren’t integrating AI effectively, leading to a “GenAI divide” in which a few savvy adopters reap benefits while the rest churn out a few trivial chatbot answers with no bottom-line impact. McKinsey echoed this, finding that while 8 in 10 firms have tried GenAI, an equal proportion report no significant effect on their revenue or efficiency. In McKinsey’s blunt analysis, companies are piddling around with AI for tasks like drafting meeting minutes rather than tackling high-value problems.

The message is clear: the bottleneck isn’t that AI isn’t smart enough – it’s that users aren’t giving it the proper context, data, and direction to be useful.

They lack a coherent strategy for feeding the model the correct data at the right times and in the proper format to achieve their overall vision.

This is why “context is king” in the next phase of AI. If a model can’t figure something out, the issue might not be a lack of intelligence – it might be that we haven’t given it the information or guidance it needs.

As Box’s CTO quipped:

In other words, it’s the knowledge and context you feed the AI that determines how effective it can be. A robust model failing with the wrong inputs will lose every time to a mediocre model expertly directed with the proper context.

Anthropic’s leadership surely recognizes this, at least on the engineering side. They’ve introduced features like the Claude 4.5 “Haiku” model with a massive 200k-token context and an SDK for “agents” – essentially tools to manage better long conversations, external data, and multi-step tasks. The subtext is that we can’t just make the model’s brain bigger, so let’s give it more memory and better tool handling.

The buzzwords have shifted: last year, it was all about parameter counts and “emergent abilities,” now it’s about context windows, retrieval, memory, and orchestrating multiple agents.

Indeed, one of Anthropic’s bold claims is that Claude Sonnet 4.5 can run continuously for 30+ hours in an “agentic” workflow without losing coherence. Impressive, yes – but note that this is not a pure intelligence improvement; it’s a stability and context management improvement.

And what of the much-hyped “AI agents” that will autonomously perform complex tasks by breaking them into parts? If you peek under the hood, these agents are often just multiple copies of an AI model passing notes to each other.

Don’t let the fancy McKinsey and consulting PowerPoints bedazzle you.

TLDR: Multi-agent orchestration is, in practical terms, multi-context orchestration.

Each “agent” gets its own context window to work on a sub-problem, then shares results with the next. There’s no mysterious emergent group mind – it’s just a clever way to work within the limits of what a single model can pay attention to at once.

As an experienced user, I can tell you: spinning up two AI agents is not like doubling the IQ in the room; it’s more like divide-and-conquer. You give each agent a focused brief. One might analyze a database and output a summary, and another might read that summary to make a decision. This can be powerful, but let’s call it what it is – prompt chaining and context management – not some new species of artificial general intelligence spontaneously arising from agent society.

Side Note: I tried this - with a prototype “AI crowd” with Hawking Edison. It actually generates interesting results—and may be the way to provide the next capability leap. But it does not solve the linked economic problem: how to generate superintelligence affordably.

In short, the frontier of AI usefulness is less about pushing the top-end IQ from 140 to 145 and more about how we marshal the solid 140 IQ we already have to solve real problems. Context – the correct information at the right time, organized cleverly – is now the determining factor of success.

Tools and Memory: The Real Force-Multipliers

If context is king, then tools and memory are the royal court helping the king get things done.

Anthropic understood this when they launched Claude Code. The model alone is powerful, but what made Claude Code initially compelling was the suite of tools around it that allowed it actually to engage with a developer’s world: reading and modifying files, running code, remembering past interactions, etc. Anthropic pioneered the Model Context Protocol (MCP) for connecting AI assistants to external tools and data, which OpenAI bastardized into its own proprietary flavor.

Claude Code integrates with your terminal or IDE, letting it handle million-line codebases and even run code or use a CLI. When you see Claude Code autonomously running npm install or searching your repository, that’s MCP in action – the AI reaching out beyond its native context window.

However, initial success led to new expectations. Once you give developers a taste of an AI that can actually read their whole codebase and remember yesterday’s conversation, they’re going to want more.

And this is where, frankly, Claude Code hit a bit of a wall. For all of Sonnet 4.5’s improvements, many of us noticed that the tooling stagnated. It’s as if the model got smarter, but the “AI assistant” around the model didn’t gain much in the way of common sense.

Claude still had a kind of amnesia between sessions and even within long sessions (despite a bigger context). It would cheerfully suggest solutions that our project already implemented, or rewrite functions from scratch that only needed a minor tweak, because it simply didn’t recall or find the existing code. These are not algorithmic failures so much as context failures.

So, what do engineers do when the provided tools aren’t enough? We build our own. I ended up creating a system called Supastate (with an AI agent codenamed Camille) to amplify Claude’s memory and contextual awareness in coding tasks. The idea was simple: what if Claude never forgot anything significant about your project?

Supastate hooks into Claude Code via MCP and provides a persistent knowledge graph of your entire codebase, along with all past discussions and decisions. It’s like giving Claude a second brain that permanently stores facts and experiences. With this setup, every time I start a task, the AI can restore full context – it can recall, for example, “oh, we have three functions related to user validation already” or “we tried a similar approach last week and it failed, here’s why.” In fact, I literally force the AI to check: our project instructions now say “NEVER WRITE CODE WITHOUT CHECKING EXISTING SOLUTIONS FIRST!” and mandate using Supastate’s tools before doing anything new.

How does it work under the hood? Supastate Camille indexes the codebase and builds a graph of code entities (classes, functions, etc.) and their relationships. It also maintains an embedding-based semantic index of all code, including the conversation history.

When Claude gets a request, say “Add a user audit log,” Camille intercepts it and orchestrates a three-part search of the knowledge base: semantic search (to find conceptually related code via embeddings), syntax-aware search (to find structurally relevant code like anything that looks like an “audit” function), and even pattern-based search using AI-generated regex patterns (to catch variations of terms and naming). The results from these searches are merged and fed to Claude before it attempts any implementation.

The effect of this is night and day. Without these tools, Claude might blissfully start coding a brand new “UserValidator” class while the project already has UserValidationService and AuthValidator doing similar work.

With Supastate, Claude will instead say, “I found three related functions: validateUser() in auth.controller, userValidation() in validators/User.ts, and checkIfThisUserIsLegit() in the old auth.js – perhaps we should consolidate or extend one of those.”

In fact, that exact scenario played out. Before integrating a persistent memory, Claude would “cheerfully offer to help you create a user validation function, blissfully unaware that you had three of them already… Now, Claude finds them all, shows you their relationships, and gently suggests maybe – just maybe – you might want to consolidate before adding a fourth.

This is the kind of pragmatic improvement that can truly boost productivity. It’s not flashy super-intelligence that magically knows the correct answer:

It feels less like a clairvoyant oracle and more like an incredibly well-prepared assistant. And to be honest, that’s what most of us need day-to-day. Claude Code became immensely more helpful to me once I added those memory and search augmentations.

The fact that a one-man band with a side project (hi!) could significantly improve the product with some simple tooling should tell you something. There is low-hanging fruit here. Anthropic and others can and should be doing the same, baking this kind of capability in for everyone.

Now, to be clear, I ran dozens of experiments, testing various strategies, model combinations, and latency-reduction approaches to get to this solution. But I do wonder if the conversation in the Anthropic boardroom takes this type of tooling investment for granted.

It is clear that Anthropic, with its billions of dollars, did not invest the same amount of time as a developer sitting in his bedroom did.

For example, even in some of the new tools I have seen Anthropic introduce, they lack the second level of investment into making the tool intelligent by using another model. They have the intelligence of a mouse rather than the eagerness of a puppy. It is almost like Anthropic considers building out these tools beneath them.

Perhaps it is also the economic challenges of introducing a sub-agent…

Empowering the model to use context better beats making the model intrinsically smarter at this point. The returns on better “brains” are diminishing, but the returns on better knowledge and workflow are huge.

Consider also the user experience of these AI assistants. Right now, many AI chatbots are like a blank slate waiting for your questions.

It’s like sitting a person in front of a computer in 1985 and saying “go ahead, type stuff, see what happens” – no guidance.

A more innovative approach would be an AI that proactively gathers context from the user’s environment and suggests how to proceed. Imagine opening Claude and it immediately scans, say, your open documents or recent commits (with permission) and says: “I see you’re working on a payment processing module. I can help by reviewing recent error logs or writing new test cases. Also, you have 100K tokens of context available—here’s my suggestion for how to budget them (e.g., load the critical files, a summary of recent issues, etc.). Shall I proceed?”

This kind of context-aware onboarding could bridge the gap for users who don’t yet speak fluent “AI prompt.” The agent shouldn’t just sit there hoping you know what to ask – it should actively help you leverage the tools and context at its disposal.

All of this underscores the central thesis: the world is now about context management, not intelligence.

We have innovative models; now we need to get much smarter about using them effectively.

That includes better memory, better tool use, clearer strategies for chaining tasks, and more intuitive UIs that guide users. Interestingly, Anthropic’s latest updates nod in this direction—they just released “Agent Skills” and an improved tool interface, which sounds like baby steps toward what we’re describing. But there’s a lot more to do, and it’s going to separate the winners from the also-rans in the AI race.

The Boardroom vs. the Basement

Why hasn’t Anthropic (or OpenAI, or others) fully leaned into this context-and-tools approach? Here we encounter a classic MBA vs. engineering divide. In boardrooms and investor pitches, the narrative that sells is “we’re building a godlike Superintelligence”—a singular AI that will transform everything, justify a $500 billion valuation, etc.

You can bet that when these CEOs were raising their mega-rounds, they hyped world-changing AI breakthroughs on the horizon. Meanwhile, down in the engineering trenches, folks are facing the messy reality: current models, while impressive, are plateauing, and the immediate wins will come from clever product design – better context handling, integrations with customer data, reliable memory, fine-tuned domain agents – the not-so-sexy stuff that actually helps customers day to day.

We’ve seen this pattern before. The dot-com era was rife with grand visions that crashed against prosaic execution problems. The AI industry right now is awash in eye-popping valuations and exuberant deals that, to some seasoned observers, “look, smell and talk like a bubble”. OpenAI’s valuation reportedly hit $500 billion (yes, with a “B”) recently – up from $157B just a year ago – and Anthropic’s jumped from $60B to $170B in a matter of months.

These numbers are being thrown around even though both companies are losing money hand over fist.

OpenAI is said to have lost around $5 billion last year on revenue of a few billion.

What’s propping this up? In part, it’s a lemming-like investor frenzy where everyone is afraid to miss out on the Next Big Thing.

And crucially, unlike the dot-com frenzy, because these are private companies, there’s no market mechanism for skepticism. In public markets, if a stock is overhyped, short sellers pile on and send a reality check. In private funding, “the price gets set by the optimists”. Only true believers get a seat at the table, and doubters don’t invest – which means valuations can drift into fantasyland with no one to call bluff.

This is then reinforced by the layoff sprees by the largest companies in the air of a cooling economy, often justified by “potential upcoming AI productivity gains.”

Let’s be clear: these CEOs have not even AI-enabled the most basic tasks in their organizations yet. Still, they are making hopeful, wishful bets on an imaginary productivity improvement to boost earnings by a quarter in a flagging economy.

Thus, the AI centa-unicorn CEOs must keep the dream pumped full of hot air. Admitting “we’ve hit an intelligence wall, so we’re focusing on incremental usability improvements” doesn’t exactly justify a $170B valuation. Instead, we hear about grand AI milestones just over the horizon—artificial general intelligence, multimodal omniscience, you name it.

Meanwhile, the engineers quietly roll out features to make the AI a better team player rather than a genius. It’s a bit of a schizoid existence for these companies: publicly selling moonshots, privately grappling with product-market fit.

Sam Altman isn’t doing TED talks about prompt engineering techniques to improve ROI for insurance companies – he’s talking about godlike AI. Dario Amodei isn’t telling investors that Anthropic’s path to revenue lies in better enterprise data integration—he’s spinning visions of constitutional AI and safe superintelligence. And on it goes.

Herein lies an opportunity. The truth is:

Enterprises don’t necessarily need a significantly more innovative model than what we have today; they need one that plugs into their workflows, their data, and their problems. This is where companies like Oracle, Microsoft, and AWS could shine.

These enterprise stalwarts might not win a model development race against AI startups, but they deeply understand how businesses use software and data. They have decades of hard-earned knowledge about business processes, data management, and customer pain points. If they leverage that – effectively translating their domain expertise into AI-centric solutions – they can guide these AI models to deliver tangible productivity gains that matter.

In fact, we’re already seeing glimmers of this. Microsoft, with its Copilot suite, is wrapping OpenAI’s models in layers of business logic and context (think GitHub Copilot for code, Microsoft 365 Copilot for Office documents).

Oracle is touting how its cloud AI can seamlessly work with Oracle database data through the AI Data Platform, which we launched last week. They are quietly federating and preparing immense, rich data sources into a consistent data stream for AI agents, reserving context for solving business problems rather than figuring out how to connect to disparate data sources.

These companies get that it’s not the AI's IQ; it’s the usability and integration that determine success. They are the ones who can, for instance, connect an AI agent to a company’s entire customer support knowledge base and backend systems securely – something Anthropic alone can’t do from the outside. And customers will pay for that solution, not just raw model access.

Meanwhile, Anthropic and OpenAI find themselves in a weird position. They have world-leading models, but to actually make money, they have to become enterprise solution providers—a very different game from pure research.

And their current approach (sell API access or subscriptions and hope users figure out the rest) might not scale to the broad business market that still doesn’t know how to apply AI effectively. There’s a whiff of irony here: the AI startups might end up needing the boring old enterprise players to achieve the very productivity revolution that justifies their valuations. But why should investors pay for the value when the strategy has such a glaring gap?

Investor Exuberance vs. Reality

Let’s talk more about that valuation bubble, because it’s the elephant in the room. The AI investment landscape in 2025 is astonishingly frothy. There's speculation that OpenAI might IPO at a valuation well north of half a trillion dollars – more than the current market cap of JPMorgan Chase or Mastercard, to put that in perspective.

Anthropic is raising capital at valuations in the hundreds of billions as well. And yet, when you peel back the curtain, the financials are… well, not pretty. The companies themselves are incinerating cash. The only ones printing money in the AI gold rush are the pick-and-shovel sellers—NVIDIA (GPUs), maybe cloud providers, and chipmakers.

One news analysis put it starkly: “OpenAI is loosely valued at around $500B, yet may make just $13B in revenue in 2025… Anthropic is valued at $183B after a recent round, but is projecting < $10B revenue this year. They’re also spending far more than they earn. Nobody is making money with AI – except for NVIDIA, which is perhaps why it’s so keen to keep pumping the industry.”

This was written after Anthropic claimed it will hit a $9B run rate by the end of this year—an ambitious figure that many analysts view skeptically.

One particularly concerning trend is the circular nature of the mega-deals being struck. OpenAI’s partnership with NVIDIA, for instance, involves OpenAI committing to buy a staggering $X worth of GPUs, and NVIDIA in turn “investing” a similar amount in OpenAI’s equity.

Likewise, OpenAI’s deal with AMD is structured so that OpenAI will use a vast number of AMD chips and even take an equity stake in AMD. It’s almost comical: AI companies are taking the billions of investors gave them and handing it to chip manufacturers, who then plow it back into the AI companies’ valuations.

Here’s the scary part. A lot of this is being done through special-purpose vehicles (SPVs)—the old tactic Enron used to keep deals off the books.

Sound familiar? It should – it harkens back to the dot-com bubble’s vendor financing schemes, where telecom companies bought equipment on credit and the equipment vendors invested in those telecom startups’ stock. One veteran investor explicitly drew this parallel and warned that these AI deals have an uncomfortable rhyme with the year 2000. When money starts going in circles, it usually means actual economic value isn't being created in proportion –

Without public-market scrutiny, these private valuations float on optimism. And as long as everyone involved believes (or pretends to believe) that the next epochal AI breakthrough is around the corner, the music keeps playing.

But if actual utility doesn’t catch up to the hype, something’s gotta give. One of two things will happen: either companies will rapidly learn to harness today’s AI in transformative ways (justifying the investment), or the expectations will implode in a heap of disillusionment.

In either case, the longstanding leaders—Oracle, Microsoft, or AWS—still come out ahead.

I strongly suspect the near future holds a bit of both – some breakaway successes by those who get it right, and a lot of disillusionment from those who don’t. The “GenAI divide” we discussed will become more evident: a small segment of users will derive enormous value (with context-savvy strategies), and the rest will scratch their heads, wondering why their expensive AI subscription isn’t magically solving everything.

Worse yet, we see the “small segment of users” become the oligarchy of the current software industry, leaving the rest of the sector in a hellscape of financial ruin.

If and when the AI bubble pops, it won’t mean AI is over – far from it. It will just mark a shift from exuberance to normalcy, from grand narratives to practical implementations. The short-sellers of reality will finally have their day (figuratively speaking, since you can’t literally short a private company’s hype, but reality has a way of asserting itself eventually).

That correction will actually be healthy. It will force a focus on sustainable business models – likely those that truly deliver productivity gains to customers. And here we circle back to our central thesis:

The companies that guide users on how to get started, that automatically optimize use of context windows, that integrate with your existing tools and data – they will create genuine, defensible value. The ones that sell “we’ve got the smartest AI, trust us” will either adapt or fade.

Conclusion: Context Over Hype

The era of chasing ever-bigger, ever-smarter standalone AI models for their own sake is winding down. We’ve been to that mountaintop; we’ve seen what today’s best models can do. And they are amazing – but they’re also flawed and costly, and simply pushing the dial from “brilliant” to “even smarter” yields diminishing returns in real-world use. The next leap forward in value will come from embracing a humbler but ultimately more impactful truth:

It’s not about how intelligent the AI is; it’s about how intelligently we can use the AI within real constraints.

“Superintelligence” as a marketing concept may be on life support (sorry, investors), but that doesn’t mean progress is dead. It represents the locus of innovation shifts.

It shifts to AI-assisted context engineering, where companies focus on feeding the AI the right information in the right format (because an ounce of context is worth a pound of model capability).

1. It shifts to tool integration and automation, where an AI agent doesn’t just idly chat but actively interfaces with software, databases, and workflows, actually to get things done.

2. It shifts to user experience and guidance, ensuring that anyone can sit down with an AI system and be immediately productive without needing a PhD in prompt crafting.

3. And it shifts to memory and learning, so that AI systems accumulate knowledge over time rather than forgetting lessons learned with each new session.

We should welcome this shift. It’s a sign of maturation. Think of the early days of electricity – at first, it was all about generating more power, bigger dynamos, higher voltage! But eventually the breakthroughs came from the less glamorous work of distribution, wiring every home, and inventing appliances that effectively used electricity.

We’re at a similar inflection point with AI. The “power” is there; now we have to build the infrastructure and appliances around it.

Context is the wiring, the plumbing, the interface layer that will bring AI’s value into every nook and cranny of our world.

It may not sound as thrilling as conjuring a digital Einstein, but it’s how we’ll get tangible value.

Anthropic and its peers can choose to recognize this and lead the way—or cling to the superintelligence mythos and risk being leapfrogged by more pragmatic players. Personally, I hope they choose the former. I’d love to see Anthropic, for example, double down on making Claude the best damn assistant it can be given fixed intelligence. Make it the AI that never forgets what you tell it, that automatically brings in relevant documents when needed, that knows how to use a wide range of tools out of the box, and that can coordinate subtasks among multiple copies of itself seamlessly. That would genuinely move the needle for users – and they’d pay handsomely for it, too.

In closing, let’s drop the hubris of chasing an imaginary god-level AI and focus on augmenting the very real (and very impressive) AI we already have with context, memory, and wise guidance. The firms that do so will unlock the next wave of productivity – and those that don’t will be left pitching fairy tales. The bubble of hype may well pop, but what remains will be a more grounded industry focused on solving real problems.

Superintelligence is dead. Long live context.

Cue the breathless headlines and the stock market doing its best Chicken Little impression. But I’m here to tell you: take a deep breath. A 95% failure rate in the first inning of a technological revolution is about as surprising as rain in Seattle. In other words, it’s early. We saw this movie before, and spoiler alert: it didn’t end with technology slinking away in defeat. It ended with technology quietly conquering the world while everyone who proclaimed it “overhyped” was busy eating crow.

Lessons from the Dot-Com Bubble (or, This Isn’t My First Rodeo)

I lived through the dot-com era, when the Internet was hyped as the end of everything. Remember the late 90s? Pundits declared that the web would render physical retail obsolete, render real-world intimacy extinct, and convert all goods into digital form.

Meanwhile, skeptics swore they’d never trust this “cyberspace” thing for something as mundane as paying a bill. (Fun fact: my own father confidently told me I’d never be able to pay bills online. He was only off by, oh, everyone.) Both sides were spectacularly wrong. The truth was boring and profound: the Internet didn’t replace the physical world – it augmented it.

Consider retail: the Internet was supposed to kill brick-and-mortar stores dead. Fast forward to 2025, and over 80% of U.S. retail sales still happen in physical stores (livain.com). E-commerce accounts for only about 16% of retail – growing, yes, but not exactly an extinction-level event for malls. Instead, we got integration: buy online, pick up in-store; shop in-store, order online. The significant shift wasn’t replacement, it was partnership (livain.com).

That 1966 TIME magazine prediction aged like milk. In reality, both women and men are plenty happy to buy things online when it’s convenient (content.time.com).

The dot-com boom itself had a notorious bust. The NASDAQ index declined by 75% between 2000 and 2002, erasing approximately $5 trillion in market value. Pets.com became a punchline. Yet out of that rubble emerged Amazon, eBay, and other survivors that went on to dominate the global economy.

Bubbles burst – but they do not tell the whole story of an era. The dot-com bubble was a bubble, to be sure, but it also heralded the internet age, which fundamentally changed how we shop, work, and socialize. Physical stores didn’t disappear; they evolved. Human connection didn’t die; it found new channels (ever heard of social media?).

And I eventually did get to pay all my bills online – sorry, Dad. I should note that my Dad was actually an early and infrequent user of TurboTax and Intuit. He did use the bank to pay vendors online, but as a check.

The lesson: early failure rates and hype cycles are not reliable predictors of long-term value. They’re more like the overly dramatic opening act that makes the eventual success story that much sweeter.

It’s not evidence that AI is a worthless fad – any more than Pets.com’s collapse meant “the Internet is over.” In fact, it’s expected. We saw the same pattern in earlier tech revolutions, from the Industrial Revolution’s railway mania (where even Charles Darwin got swept up in wild railroad speculation to the smartphone era.

There were bubbles, panics, manias – and then there was enduring change. Every tech revolution has a bubble; historically, that’s practically a law of nature. The presence of hype (and the inevitable pop) doesn’t negate the technology’s eventual impact. Bubbles are a feature of progress, not a bug.

Humans + AI: Augmentation, Not Obliteration

Now, about those doomsayers who growl that “AI will replace all the humans.” To put it in terms my Grammy would appreciate: hogwash. AI is a tool – a powerful one, but still a tool – and tools need people. We’ve been through automation scares before.

Remember when elevators were automated and we thought elevator operators would become obsolete? Okay, they did disappear… but somehow the economy survived and new jobs emerged.

Every wave of technology automates some tasks but also creates new ones, elevating the human role to a higher level of value (or at least a different one).

The smart money (and smart people) have realized that AI is best used to augment human capabilities, not replace them outright. Sundar Pichai calls AI an enabler of human potential, not a substitute for human teachers. And former IBM CEO Ginni Rometty put it perfectly:

In other words, the future belongs to humans who partner with AI, not those who compete with it or hide from it.

Let’s check the reality on the ground. Are we seeing mass layoffs and a total takeover by robots? Not really. According to MIT’s data, AI hasn’t (yet) led to widespread job replacement – layoffs due to AI have been limited and industry-specific. Frankly, one could argue that AI was more of an excuse for a layoff rather than a traceable outcome of replacing humans with models.

Executives are divided on whether AI will reduce headcount in the future, which is a fancy way of saying “nobody really knows yet.” Meanwhile, surveys show workers are embracing AI as a helpful colleague. One study found that 70% of people prefer AI for quick, mundane tasks, but 90% still prefer humans for complex projects that require judgment and nuance.

In other words, we’ll let the chatbot draft an email or summarize a document, but when it comes to high-stakes decisions or creative strategy, most of us still holler for a human.

Think about your own work or life. Are you using AI daily? If so, you’re not alone. The accurate measure of AI’s impact isn’t how many human jobs it replaces; it’s how many humans find it useful.

Right now, that number is skyrocketing. ChatGPT, for instance, hit 100 million users faster than any product in history and is reportedly used by around 190 million people every day.

And those are voluntary users – nobody’s forcing anyone to use a free AI assistant, people are choosing it because it adds value to their day. In many companies, employees aren’t waiting for permission either.

An MIT survey found that workers at 90% of large firms are using personal AI tools (such as a free ChatGPT account) on the job – often under the radar – while only 40% of those companies have officially purchased enterprise AI solutions.

That grassroots adoption is a leading indicator that AI is here to stay. When something becomes genuinely helpful, people vote with their feet (or clicks). By the time your workforce is secretly using AI to get work done faster, the genie is well out of the bottle.

The “AI will replace us all” trope is just the latest episode of Tech Panic Theater. Relax. AI will replace some tasks (probably the dull, repetitive ones first), but it doesn’t replicate the full spectrum of human skills anytime soon.

We’re not obsolete; we’re evolving.

In the near future, if you’re great at leveraging AI, you’ll be more valuable, not less. If you stubbornly refuse to use these tools, well, don’t be surprised when you’re outpaced by colleagues who do. This isn’t a zero-sum game of human vs. machine; it’s about humans who harness machines vs. humans who don’t. As a character on a TV show once said (handsome guy, presidential vibe): “What’s next?” The ones embracing AI are already figuring that out.

The New Breed of Coder (No More Code Monkeys)

Let’s get specific: jobs and professions will change, 100%. In fact, they already are. Take software development, a field near and dear to my heart. We’re moving from the era of developers hand-coding every line (like monks illuminating manuscripts) to an era of “vibe coding.” And no, it won’t be limited to just non-technical product managers.

For those under a rock, what on earth is vibe coding? It’s when developers focus more on what to build than on how to type it out – essentially leveraging AI to generate code while they guide the high-level design. Think of the developer as an architect or editor, and the AI as an eager junior programmer who never sleeps.

Some traditionalists harrumph at this: “But do these kids even understand the code?”

Listen, code is becoming increasingly affordable; understanding is becoming increasingly expensive.

We now have AI that can crank out functioning code faster than a roomful of interns fueled by Red Bull. That doesn’t make human developers obsolete; it makes their architecture skills more critical.

As one young engineer wrote:

In other words, knowing what to build and why becomes the real superpower, even if the AI handles much of the “how.”

I am an active vibe coder. I use AI tools to automate mundane tasks – such as boilerplate code, simple functions, and unit tests – so I can focus on the big picture and more complex logic. Understand an insight from that large open-source Spark codebase - sorry, but Claude beats most any day.

Do I understand the code that gets produced? You bet I do – experience and solid fundamentals matter more than ever when you’re supervising an AI sidekick. In fact, I can often build bigger, more complex systems because I’m not bogged down writing every semicolon myself.

Meanwhile, a less experienced coder trying the same tools might get lost in a sea of AI-generated spaghetti. The curmudgeons asking “But do you really understand it?” are asking the wrong question.

If yes, who cares if an AI wrote 90% of the trivial code? We’re solving bigger problems with less tedium. (And if no, well, that project was doomed whether a human or AI wrote the code.)

Mark my words: in a few years, manually writing every line of code will be about as common as manually doing long division. Sure, you can do it, and sometimes you should for learning or precision. But most of the time, you’ll let a calculator – or in this case an AI – handle the rote stuff while you provide the guidance and creativity. This doesn’t spell the end of software developers; it spells the end of software developers acting like machines. We get to be more human – more design-oriented, more creative – and let the machines do the machine work. That’s progress. Just don’t confuse using power tools with not knowing how to build; the master carpenter still measures twice, even if a nail gun does the hammering.

Bubbles, Bubbles, Toil and Trouble

Let’s tackle another buzzkill: “AI is just a bubble! It’s all hype and froth!” Well, is AI in a bubble phase? Quite possibly yes. But here’s the thing:

Has any major tech revolution not had a bubble?

Bubbles are practically a rite of passage for transformative technologies. They’re the economic equivalent of teenage acne – an annoying and ugly phase, but a sign of growth nonetheless.

History lesson: the Industrial Revolution was punctuated by wild speculative bubbles. For example, Britain’s Railway Mania in the 1840s had investors literally tripping over each other to buy railway stock, driven by hype about a world-changing technology (railroads) and dreams of untold profits.

Share prices doubled, countless new railway companies were floated on nothing but optimism and maybe a nifty route map. And yep, it crashed spectacularly. Fortunes were lost, and panic ensued. Does that mean railroads were a dud? Hardly. After the smoke cleared, the tracks still got laid, trains still transformed commerce and society, and the world moved forward (quite literally, on rails). The bubble was a footnote; the railways themselves were the story.

Fast forward to the dot-com bubble of 1999–2000 – we touched on this, which was frothy beyond belief. Companies with no profits (and sometimes no products) were Going Public for billions. When reality set in, the crash wiped out trillions of dollars in paper wealth (internationalbanker.com).

But was that the “end” of the Internet? Tell that to Amazon, Google, and Facebook. Today, the survivors of dot-com mania are so successful that we’re busy worrying they have too much power. The bubble was painful for investors, sure, but it wasn’t a verdict on the technology.

It was a necessary shakeout that separated flimsy ideas from solid ones.

The Internet boom left behind real infrastructure, new business models, and a generation of people with digital skills. Similarly, the current AI gold rush may well end in a pop – with many VC darlings flopping and some cool demo products never finding a market. We might indeed see an “AI winter” of sorts if expectations race too far ahead of what’s possible in the short term. But that isn’t a death – it’s a comma in the story of AI, not a period.

If you want proof that bubbles don’t equal doom, follow the money after the bubble. After the railway bubble, railroads continued to be built. Following the dot-com crash, Internet usage continued to grow exponentially.

Right now, we’re already seeing AI woven into everyday life, bubble or not. Investors may chase fads (oh boy, do they ever – nothing like FOMO to inflate a valuation), but real adoption is driven by real utility, not stock prices. So yes, by all means be wary of irrational exuberance (and keep a pin handy for when valuations get overinflated).

When this AI bubble, if it exists, eventually pops, we’ll lose some pet startups and paper billionaires – but we’ll be left with the tangible advancements AI brought in the meantime. The leading indicator of AI’s value isn’t how giddy VCs are feeling this quarter; it’s whether people and businesses keep using these tools when no one’s looking. And all signs on that front point to “yes.” Utility has a long half-life.

Watch What People Do (Not What They Say)

Let’s drill down on that point: the leading indicator of AI’s significance is everyday human usage. Not venture funding, not media hype, not doomsday op-eds – just plain old daily active users. If people integrate a technology into their daily routines en masse, then take it to the bank: that tech is making a dent. By that measure, AI is already performing exceptionally well.

We’ve mentioned ChatGPT’s massive user base. It’s not alone. Enterprise AI adoption, even if clumsy, is widespread. Over 80% of organizations have experimented with tools like ChatGPT or Microsoft’s Copilot, and nearly 40% have deployed them in some form (aimagazine.com). That’s in less than two years since these tools burst onto the scene.

When something is genuinely useful, you don’t have to force it down people’s throats. Remember when smartphones came out? BlackBerry to iPhone era – nobody needed to mandate “phone usage”; people lined up around the block. We’re seeing a similar organic uptake with AI assistants and automation tools. Employees are using AI to draft emails, brainstorm ideas, generate reports, and more.

Students are (sometimes sneakily) using it for homework help. Doctors are starting to use it to summarize patient notes. I even know a guy who used an AI to argue with his cable company’s customer support (the AI was very politely ruthless, I’m told). This is the stuff that doesn’t always make flashy headlines, but it’s the ground truth of adoption.

So if you’re trying to gauge where AI is going, look at the demand-side indicators:

We’ve crossed that threshold already. Entire communities of “AI power users” have emerged, sharing tips on how to craft the most effective prompts to achieve the best results. Heck, we’ve coined the term “prompt engineer,” and there are job postings for it. (Yes, we live in a world where talking to a computer really well can be a six-figure job. Take that, high school guidance counselor who told me chatting wasn’t a skill.)

AI’s daily integration into workflows is accelerating. That is why I don’t lose sleep over whether some CFO thinks the ROI of generative AI is lacking after six months (marketingaiinstitute.com).

Of course, most pilots haven’t hit ROI yet – they’re pilots! If anything, I worry more about companies moving too slow on adoption, not too fast. The real risk isn’t that AI never delivers value; it’s that you fail to figure out how it can provide value for you while your competitors do.

Because once someone cracks that code and starts using AI effectively every day, it’s hard to catch up. (Think of how some companies adapted to the internet and some didn’t – those that got it, Amazon, thrived; those that scoffed, Borders, died.) In short: watch usage trends like a hawk. That’s where the signal is, buried under all the noise.

Betting on the Right Use Cases

If you’re an entrepreneur, executive, or just a curious bystander wondering where to place your bets in the AI arena, here’s my advice:

Focus on augmentation, not pure automation.

Look for areas where AI can empower humans to be more productive, rather than simply replacing humans in a zero-sum swap. In practical terms, the sweet spot for AI projects is those where:

• A human is still in the loop. Aim to pair AI with human judgment rather than removing humans entirely. Humans plus machines > machines alone, in many complex domains. (Think AI diagnostic tool + doctor, not AI doctor with no human oversight).

• Success isn’t defined as “firing an entire department.” If your AI project’s ROI relies solely on eliminating jobs wholesale, you’re likely doing it wrong. Projects framed around massive headcount reduction tend to breed resistance and ethical issues, and often fail to capture the nuanced work that humans actually do. Instead, define ROI in terms of enhanced productivity, quality, or new capabilities, rather than just cost-cutting through layoffs.

  Dear CEOs: Doing layoffs while claiming AI justifies it will breed AI resistance.

• Productivity and value-add are the goals. The best AI use cases actually unlock new value or save significant time, rather than just doing the same work slightly cheaper. If an AI can do a task in 5 minutes that took a person 5 hours – that’s a win. If it can enable a new service or insight that wasn’t feasible before, even better. The ROI will follow from the new value created, not just from shaving a line item in the budget.

• You’ve tried it manually (with AI) first. Before you invest $10 million in building a custom AI solution, test the concept with existing AI tools. Can a bright intern accomplish a similar outcome using off-the-shelf AI like ChatGPT or Claude? If yes, you have validation. If no, rethink. Far too many AI projects fail because nobody bothered to see if the idea actually works in practice at a small scale. Treat AI projects like science experiments: form a hypothesis, run a quick test with minimal investment (even if it’s a hacky solution), and observe results. Only then double down. Given the plethora of AI services available, there’s almost always a way to simulate the workflow manually to gauge feasibility. Use that to your advantage.

In short, bet on use cases where AI is a force multiplier for humans – where it’s “Humans with AI” rather than “Humans versus AI.” The companies that navigate this well will reap the benefits. Those that swing for fully autonomous solutions that magically replace dozens of employees in one go… well, they often end up as that statistic we opened with (the 95% that fail to launch). And here’s a pro-tip: if you can’t achieve a meaningful result with a baseline AI tool (like using ChatGPT manually), throwing tens of engineers and millions of dollars at a custom AI probably won’t fix that. Use the readily available tools as your canary in the coal mine. ChatGPT and Claude are, in this sense, leading indicators for your AI project – if they help you get a job done in prototype form, that’s a green light to invest further. If they don’t, maybe the idea isn’t ripe or realistic yet.

The One Superpower (AI Has, Humans Don’t)

Finally, let’s address a fascinating new capability that AI brings to the table – one that truly differs from what groups of humans can easily accomplish.

What do I mean? I mean, you can deploy an army of intelligent agents that specialize in different tasks, and have them work together towards one objective, without office politics, without coffee breaks, and without each agent asking “but what’s in it for me?” Other than perhaps pleasing their human user, these AI agents have no agenda or ego. They are, in a sense, the ultimate team players – because they’re all on the same team. Your team.

This is something new in the world. When you put a group of humans on a project, each person has their own motivations – career aspirations, pride, competition, genuine teamwork, or perhaps not. Humans are fabulous, messy creatures.

A group of AIs, however, can be spun up to instantly collaborate with a singular focus on the task. We’re already seeing the early versions of this: one AI agent can now delegate subtasks to another, then to another, forming a daisy chain of digital workers all coordinating to solve a complex problem (medium.com). It’s like having a personal swarm of experts who never sleep and never argue. (Unless you prompt them to role-play an argument, I suppose, but that’s on you.)

Imagine a future scenario: You, the human, say, “Hey AI, plan me a marketing campaign for our new product launch.” That request might spawn a cadre of AI agents – one generates market research, one drafts social media copy, one designs graphics, one crunches budget numbers – and they all feed results to a coordinator agent that compiles the final plan for you.

This isn’t sci-fi; prototypes of such multi-agent systems already exist, and they’re improving rapidly. I’m building one right now.

The real value here is speed and scalability. Need ten times the output? Spin up ten times the agents. Humans don’t scale that way. You can’t hire and train 100 new employees for a two-week project, but you can certainly instantiate 100 AI agents for a task and then shut them down when done.

Now, this isn’t to say AI agents can do everything perfectly (they absolutely can’t, at least not today). They will make mistakes, and they still need a human at the helm to guide and QA the overall process. But this capability – let’s call it massively parallel cognitive labor – is genuinely novel.

It means that workflows previously bottlenecked by human coordination can increase efficiency.

Humans, bless us, are not built to be 100% obedient or focused on someone else’s goal 24/7. We think about lunch, or our paycheck, or how Karen in accounting never says thank you. AI agents don’t grumble. They grind away at the problem set before them.

This is one area I advise keeping a sharp eye on. We’ve only scratched the surface of multi-agent AI workflows. Early experiments (AutoGPT et al.) were clunky, but they hint at what’s coming. The main complaint was latency. But if you’re augmenting the productivity of a human, turning an hour into days of accomplishment, latency is not a factor.

When this matures, it could supercharge productivity in ways we haven’t yet fully grasped. It’s not about replacing people; it’s about giving each person a battalion of tireless assistants. If I can delegate ten tasks to AI agents and have them coordinate among themselves to deliver a result by morning, that’s a game-changer.

For businesses that scale faster than hiring and onboarding an equivalent human team (and again, no hurt feelings when you turn them off afterward).

The former will always outcompete the latter. We’ve seen this pattern from the steam engine to the spreadsheet. AI is just the latest, albeit most brain-like, tool we’ve created. Yes, most early projects will fail – as experiments must. Yes, there will be hype, bubbles, and disillusionment. And yes, jobs will change – some will go away, and new ones (we can’t even imagine yet) will emerge. But through all that sound and fury, the fundamental story is one of enablement.

AI enables us to do more, faster – sometimes astonishingly more – but it still relies on us to point it in the right direction.

So the next time someone declares, “AI is overhyped” because a pilot project failed, or proclaims, “AI will replace everyone” because a pilot succeeded, just gently remind them: “Post hoc ergo propter hoc” – kidding, kidding.

Remind them that we’ve been here before. The early failure of 95% of projects is not a death knell; it’s a familiar stepping stone. The wild predictions of total automation are not prophecies; they’re the echoes of past fears. The truth is, as it often is, more nuanced and a lot more interesting:

I have news. After months of cryptic posts about "exciting things ahead" and "can't wait to share what's next" (sorry, I know how annoying those are), I can finally tell you:

I've joined Oracle as Senior Director of Generative AI Customer Engagement, working on an OCI Big Data service.

Because I'm about to tell you why 95% of enterprise AI projects are failing, why your chatbot has the memory of a goldfish with amnesia, and why I chose to tackle these problems at a company that many of you probably associate more with a particular person’s yacht collection than AI models.

The Uncomfortable Truth About Enterprise AI

If you follow my blog, you know I love to paint pictures. You know that fancy AI agent your company deployed last quarter? The one that was supposed to revolutionize customer service/DevOps/sales/[insert your department here]?

There's a 95% chance it's currently sitting in a corner, crying into its context window, overwhelmed by the complexity of actually doing its job - kind of like Towelie after he smoked a doobie on the Tegridy farm.

MIT and Fortune aren't making these numbers up for clicks. I love the Kumare, Kumare chortling prophet posts that the 95% metric is clickbait.

It isn’t.

Here's what nobody tells you at those slick AI demos: Models have terrible memories. They are worse at finding information.

They're like that friend who swears they remember your birthday but always texts you three days late.

They exhibit what we call a "U-shaped attention curve" - they remember the beginning of a conversation ("Hello!") and the end ("...so can you help?"), but everything in the middle?

Gone. Vanished. Lost in the token void.

The Healthcare Story That Changed Everything

While I was building my startup, I met an extensive midwestern healthcare system. They were aggressively piloting and trying to use AI. They wanted AI to monitor patient vitals - seems simple enough, right? Wrong.

Their first attempt was like trying to keep track of a kindergarten class during recess with one perplexed substitute teacher. The AI couldn't remember which patient was which. It was attempting to act asynchronously as an agent across multiple patient workflows.

They had to create separate context windows for each patient, with a steering model just to manage the chaos.

Even then, the memory continued to dilute over time, much like trying to make soup by continuously adding water. Not great when you're dealing with, you know, actual human lives.

The solution? They built a structured memory system that could slice information by topic, time, and relationships - essentially giving the AI a proper filing cabinet instead of a pile of sticky notes scattered on the floor.

But they also have the R&D budget of many rural hospitals. And the patience to work with new technology. Two characteristics that most enterprises lack have created a new fear of an AI bubble. That is the Oracle opportunity.

Why Oracle? (No, Really, Why Oracle?)

I know what you're thinking.

Yes, that Oracle. And here's why that's exactly where the AI revolution needs to happen:

1. They Have All The Data. Oracle's Fusion Applications run the critical operations for most Fortune 500 companies. We're talking about the data that actually matters - not your social media likes or what you had for breakfast, but the stuff that keeps the global economy running. If you want AI to work in the enterprise, you need to be where the enterprise data lives.

2. Infrastructure That Actually Works. While everyone else is fighting over GPU allocation and wondering why their models keep timing out, Oracle has quietly built one of the most robust cloud infrastructures on the planet. Turns out, when you've been handling enterprise workloads for decades, you know a thing or two about scale.

3. The Boring Stuff Is Where The Magic Happens. Everyone wants to build the next ChatGPT. But what enterprises actually need is meat and potatoes.

a) AI that can not only remember what happened in a customer conversation three months ago, but can fully understand the context and relationships, and enrich the conversation with recent, trusted facts in a secure way.

b) AI that can handle context switching without having an existential crisis.

c) AI that doesn't hallucinate regulatory compliance requirements (because that's how you end up in court).

The Vision: AI That Doesn't Suck at Its Job

While the prophets chase AGI and believe “it’s all in the model,” I tend to be a bit more practical about the state of the industry.

Here's where I see large data platforms evolving towards: Intelligent platforms that can process petabytes of big data while actually solving the AI memory problem. Imagine agents that can maintain context across weeks or months, not just minutes. Agents that can be invoked on schedule to check security logs without forgetting what a security breach looks like halfway through. Agents that can handle asynchronous tasks without losing their minds (or their context).

When an AI needs to remember something, it doesn't have to frantically search through conversation history like you looking for your keys. It does not have to piece together “context” from a chat transcript written by a millennial. It gets a structured summary, complete with all the relevant context, ready to go.

The Plot Twist

After spending months consulting enterprises to fix their broken AI implementations (including building Camille and Supastate for Claude Code (I crossed 700 users this week, thank you!) and now Gemini, because even I need my coding agent to remember what project we're working on), I realized something.

It's like giving Einstein a brilliant problem to solve but making him start over every five minutes. It's no wonder that 95% of projects fail. We also don’t fully understand the intelligence-latecy paradox of using multiple agents, especially in ad-hoc context, which I demonstrated with Project Hawking Edison.

I think my jaw dropped when I saw a panel orchestrate a roadmap planning session for my wife’s company’s leadership team. But I also had to code a ton to support this: a shared context store, a hallucination and echo chamber detection algorithm, an asynchronous monitoring mechanism, and a data warehouse with vector search for knowledge.

This work is out of the reach of most enterprise customers trying to make it work at scale.

So What Now?

I'm joining Oracle to build a practical future for enterprise AI. Not an agentic nirvana where every employee is replaced with a chatbot that forgets after 250K tokens. Not because it's easy (it's not), not because it's sexy (enterprise information architecture and data warehousing rarely is), but because it's necessary.

Someone needs to build the boring, yet critical, infrastructure that makes AI truly valuable for the enterprise. Someone needs to solve the memory problem, the context problem, and the "why-does-my-AI-agent-keep-forgetting-what-company-it-works-for" problem.

The Call to Action (Because Every Substack Needs One)

If you're part of the 95% struggling with AI implementation, let's talk.

If you're in the 5% who succeeded, let's definitely talk (and please share your secrets).

If you're just here for the jokes about enterprise software, welcome; there will be many more.

The enterprise AI revolution won't be built on prophets, valuations, demos, and POCs.

Like teaching AI to remember things. Revolutionary, I know.

Welcome to my Oracle era. It's going to be wonderfully boring in all the right ways.

And I would like to thank the Oracle team for tolerating me!

P.S. - To my former clients who are reading this: Yes, your AI agents will still remember me. I made sure of that. Context windows are forever.

P.P.S. - To my over 700 loyal Supastate users, yes, I’ll continue to operate it for you!