In the AI era, technology companies are conducting layoffs because they believe AI makes talent less necessary.

That was my subjective perception. So I tested the data.

The answer is yes, but not in the clean way I wanted.

Covid hiring and AI layoffs are inverses because the executive talent story flipped signs. In 2021 the story was: talent is scarce, hire before someone else gets it. In 2025 and 2026 the story is: AI will do more of the work, so do not backfill unless you can prove the machine cannot absorb it.

But they are not inverses in the simple arithmetic sense. The companies that hired hardest in Covid are not reliably the companies cutting hardest in the AI wave.

I wanted Covid overhiring to forecast future layoffs.

It mostly does not.

That is the important result.

Results up front: tech companies really did hire aggressively during Covid. In my cohort, aggregate tech headcount went from 1.70 million in 2019 to 2.87 million in 2022. Executives really did talk like talent was scarce. The Talent Narrative Index hit +0.94 in 2021.

But the wage evidence does not look like an acute software-labor shortage. H-1B software offered wages rose smoothly from about $97,100 in 2019 to $115,000 in 2022, then kept rising to $138,000 in partial 2025. There was no Covid scarcity spike and no post-layoff crash.

What moved violently was quantity. National software H-1B applications fell from 183,698 in 2022 to 41,534 in 2023, a 77% drop. JOLTS Information openings fell hard. Hacker News “Who is Hiring” volume fell. Companies stopped trying to hire even though the price of software labor did not break.

The AI era is the same pattern with a minus sign. The narrative index crossed zero in 2023, reached -0.52 in 2025, and hit -1.79 in partial 2026. Challenger, Gray & Christmas reported on June 4, 2026 that AI was the leading cited reason for U.S. job cuts for the third straight month. In May 2026, AI was cited in 38,579 announced cuts, 40% of all cuts that month.

But again, the wage evidence does not look like an engineer glut. Software wages kept rising. Entry-level H-1B software wages rose faster than senior wages from 2022 to 2025. The p90/p10 wage band did not compress.

The price of software labor did not validate either story.

The quantity of hiring did.

Then I ran the forecast test that mattered most: train on what we knew before 2024, predict each company’s 2024-2026 layoff depth, and check the result out of sample.

No model beat guessing the average.

Not Covid overhang. Not fundamentals. Not AI-pressure language. Not peer herding. Not all of them combined.

So the inverse is not company-by-company headcount math. Scarcity gave permission to hire. AI-abundance gives permission to cut, freeze, and not backfill.

That permission shows up first in the quantity of openings, in quiet headcount restraint, and in AI-efficiency messaging that tends to rise before a firm’s own layoff. It does not show up as a tidy formula that says “the Covid overhirers cut next.”

What I Measured

I built this as a public-data project, not a sourcing project.

The company cohort was 36 public tech firms plus 8 non-tech controls. It includes hyperscalers, semiconductors, enterprise SaaS, consumer internet, gig marketplaces, fintech, and pandemic darlings. The controls are boring on purpose: Walmart, P&G, JPMorgan, Coca-Cola, Johnson & Johnson, Home Depot, Caterpillar, and UPS.

The first layer was hard company data from SEC EDGAR: headcount, revenue, operating metrics, capital expenditure, and 10-K human-capital language.

The second layer was layoff data, primarily layoffs.fyi, treated as a lower-bound tracker rather than an official census.

The third layer was macro and labor data: Fed funds, JOLTS Information openings from FRED, H-1B Labor Condition Application disclosure files from DOL OFLC, BLS OEWS, information-sector average hourly earnings, and Hacker News “Who is Hiring” volume.

The fourth layer was narrative. I built a 1,051-document corpus: 10-K human-capital sections, AI/workforce MD&A slices, 484 earnings-call transcripts, and 13 CEO memos. The memos include the obvious ones: Mark Zuckerberg’s Year of Efficiency, Andy Jassy’s generative AI workforce memo, and Tobi Lutke’s Shopify AI/headcount memo, which TechCrunch covered with the public X memo link.

Then I classified the documents into talent narratives.

The key metric is the Talent Narrative Index:

TNI = talent scarcity - AI efficiency

Positive means the public story is “we need more people because talent is scarce.”

Negative means the public story is “we need fewer people, or fewer incremental people, because AI makes work more efficient.”

This is not meant to read minds. It measures stated executive narrative. That is the point. I wanted to test whether the public story itself moves with hiring and firing.

The Covid Hiring Boom Was Real

The first question is whether the hiring binge was even real.

It was.

Across the tech cohort, headcount went from 1.70 million in 2019 to 2.87 million in 2022. That is not normal expansion. That is a giant industry deciding, nearly all at once, that the future needed more people immediately.

The segment-level medians make the shape clearer.

Indexed to 2019 = 100:

• Hyperscalers reached 160 by 2022.

• Enterprise SaaS reached 210.

• Pandemic darlings reached 239.

• Semiconductors reached 169.

• Consumer internet reached 180.

The controls mostly stayed near 100 to 115.

That is the first important fact. This was not just a general post-Covid labor-market recovery. It was a tech-sector boom.

The second important fact is that the boom had a real business trigger. Revenue exploded.

In the hiring regression, a company’s own revenue growth is the strongest predictor of its headcount growth. The revenue coefficient is 0.339 with a t-stat of 10.5. Lagged revenue growth also matters. Companies did not hire randomly. They hired because demand looked real.

That part of the original hypothesis survives.

The problem is that the demand was less durable than executives thought.

E-commerce pulled forward. Cloud pulled forward. Streaming pulled forward. Collaboration software pulled forward. Consumer hardware pulled forward. Crypto pulled forward. Delivery pulled forward. Anything that looked like “digital transformation” pulled forward.

Then the curve bent.

The biggest boomers decelerated hardest. Coinbase’s revenue CAGR went from +283% in the boom to -37% in the bust. Zoom went from +183% to +29%. Peloton went from +110% to -17%. DoorDash and Shopify slowed too. The companies were not crazy to observe growth. They were wrong to treat emergency demand as the new baseline.

That is the Covid mistake.

Not fake demand.

Temporary demand extrapolated as permanent.

The Talent War Was A Real Story, Not A Real Price Signal

Executives also talked like talent was scarce.

In 2021, the Talent Narrative Index was +0.94. Talent-scarcity language rose sharply. War-for-talent phrasing appeared in about a third of filings around the boom. Growth language was even stronger.

So if the question is “did executives say and probably believe there was a talent war?” the answer is yes.

But that is not the same as saying the talent war was the binding economic constraint.

For that, we need price.

If software talent was acutely scarce in 2021, the price of software talent should show a scarcity spike. If layoffs then created a glut in 2023, the price should soften or at least compress.

That is not what happened.

The H-1B software offered-wage median moved like this:

• 2019: $97,100.

• 2020: $105,664.

• 2021: $111,100.

• 2022: $115,000.

• 2023: $120,000.

• 2024: $132,300.

• 2025 partial: $138,000.

That is a smooth upward path.

There is no obvious war-for-talent spike. There is no layoff-era collapse. There is no p90/p10 compression. The p90/p10 ratio was 1.93 in 2019 and 2.11 in partial 2025. Entry-level offered wages, which should be the most exposed to AI substitution if the simple story is right, rose from $83,397 in 2022 to $99,000 in partial 2025.

Yes, H-1B data has limitations. It is offered wage, not total compensation. It is affected by DOL prevailing-wage floors. It is a sponsored-worker slice of the market.

But this is exactly why I checked it against OEWS and information-sector wage series. The broad pattern survives. The price of software labor did not break.

The quantity did.

National software H-1B applications fell from 183,698 in 2022 to 41,534 in 2023. That is a 77% drop.

JOLTS Information openings averaged 224,000 in 2022 and 122,500 in 2024. The project data shows 98,000 Information openings in April 2026.

Hacker News “Who is Hiring” volume fell too.

That is the core pattern:

Price smooth. Quantity violent.

In Covid, executives said talent was scarce. They hired aggressively. Wages did not show an acute scarcity shock.

In the AI era, executives say AI makes labor less necessary. They cut, freeze, and do not backfill. Wages still do not show a glut.

Read that slowly.

The narrative moved the quantity of labor action. It did not map cleanly to the price of labor.

Cheap Money Set The Clock

Covid demand explains why hiring felt rational.

Zero rates explain why it got so large.

Information-sector job openings peaked around April 2022, right as the Fed began lifting off. The Phase 1 analysis showed openings around 308,000 at the peak and a collapse to roughly 79,000 by December 2022. The Fed funds rate went from effectively zero to above 5% by 2023.

That timing matters.

When capital is free, labor hoarding looks like strategy. When capital has a price again, labor hoarding becomes operating leverage with a bad smell.

The layoff wave lagged the rate shock by a few quarters. That is exactly what you would expect. Boards do not cut the minute the 2-year yield moves. They wait until budgets, margins, valuations, and peer behavior make the new regime impossible to ignore.

There was also herding.

Tech firms’ hiring co-moved at 0.41 across firms. After stripping out each firm’s own revenue relationship, the residual co-movement was still 0.23. In the regression, peer hiring is independently significant. The coefficient is 0.318 with a t-stat of 4.19.

That is not proof that CEOs sat in a room and conspired together.

It is proof that the industry moved together beyond what each firm’s own revenue explained.

The same thing happened on the way down. January 2023 was the layoff cluster. Once a few companies moved, layoffs became normal, then prudent, then expected.

This is how executive narratives become operating plans.

First they are brave.

Then they are consensus.

Then they are hygiene.

The AI Era Flipped The Sign

Now look at the AI era.

The public language changes fast.

In 2021, TNI was +0.94. By 2023, it crossed negative. By 2025, it was -0.52. In partial 2026, from 34 documents, it was -1.79.

The AI-efficiency intensity goes from 0.05 in 2021 to 1.04 in 2025 and 1.91 in partial 2026.

The share of documents where AI is classified as a layoff rationale goes from basically zero to 9.5% in 2025 and 35.3% in partial 2026.

That is not a subtle shift.

It is a sign flip.

The public examples are not hard to find.

Meta’s Year of Efficiency memo in March 2023 said the company would flatten, reduce hiring rates, and cut around 10,000 people while closing 5,000 open roles. That memo is not purely an AI memo. It is an efficiency memo. But it is the bridge from the Covid correction into the new operating religion: fewer layers, fewer lower-priority projects, more developer productivity, leaner teams.

Shopify sharpened the point in April 2025. Tobi Lutke’s memo made AI usage a baseline expectation and required teams asking for headcount to explain why they could not get the work done with AI first.

Amazon made the labor implication explicit in June 2025. Andy Jassy wrote that as Amazon rolls out more generative AI and agents, the company will need fewer people doing some current jobs, more people doing other jobs, and expects this to reduce the total corporate workforce over the next few years.

By May 2026, this was no longer a few idiosyncratic CEO memos. Challenger reported AI as the leading cited reason for U.S. job cuts for the third straight month.

This is how the new story sounds:

Do more with less.

Do not backfill automatically.

Prove AI cannot do it before asking for headcount.

Flatten management.

Shift from people scale to agent scale.

That is not the Covid story.

It is the Covid story with the sign reversed.

The Money Chart

The key chart overlays three things:

• Talent Narrative Index.

• Real software wages.

• Hiring quantity.

The result is clean enough to be annoying. Not like my 11yr old daughter “I will only eat Chick Fil-A” annoying. More like “this really tastes good” is annoying.

The narrative swings from scarcity to AI-abundance.

The price does not follow it.

The quantity does.

At the year level, the correlation between TNI and real software wage growth is -0.235. That is the wrong sign for a simple scarcity-price model.

The correlation between TNI and hiring quantity is +0.837. That is the right sign for a narrative-action model.

In the firm-year regression, after controlling for revenue and real wage growth, TNI still predicts workforce action. The coefficient is 0.0894, t = 3.52, p = 0.0005.

This is the strongest result in the project.

The narrative is disconnected from price, but connected to action.

That is why sentiment matters.

Not because executives have perfect causal explanations.

Because executives control hiring plans.

The Forecast I Wanted Failed

This is where the cute story breaks.

If the only model were “Covid overhirers are now AI layoff firms,” then Covid hiring intensity should forecast AI-era cuts.

It does not.

Splitting the layoffs into two waves makes the failure obvious.

Wave 1 was the Covid correction. In 2022 and 2023, the cohort had 108,228 layoffs. That was the give-back wave. The companies that hired too far ahead of demand had to unwind some of it.

Wave 2 is the AI/efficiency wave. From 2024 through partial 2026, the cohort had 167,726 layoffs. That wave is larger, later, and differently driven.

Intel is the cleanest example. It had only 19% Covid hiring growth, then cut about 42,000 people in the AI-era window, 32% of peak headcount. That is not a pandemic-darling unwind. That is a foundry, margin, and strategy crisis.

Oracle is the other obvious example. It had only 5% Covid hiring growth and still produced more than 31,000 AI-era cuts in the tracker. PayPal, Intuit, Net, Snap, and others also do not fit the simple overhire-then-fire story.

So I ran the forecast horse race. Hey, there is a horse named Emerging Market in the Belmont race tomorrow. That caught my attention apparently.

The target was 2024-2026 layoff rate. The predictors had to be known by the end of 2023. The validation was leave-one-firm-out across 34 tech firms.

The overhang-only model had out-of-sample R2 of -0.16 for layoff depth.

The fundamentals model: -0.21.

The AI-pressure model: -0.22.

The peer/herding model: -0.22.

The combined model: -0.46.

All below zero.

That means every model was worse than predicting the average company.

That is not a small caveat. That is the result.

Announced-layoff depth is not forecastable here.

The predicted-versus-actual plot is even more useful than the table. It shows the overhang model and the combined model both missing the same kind of firm: Intel, Oracle, PayPal, Intuit, Net, Snap. These are not missed by a few points. They are missed because the reason they cut was not simply “they hired too much in Covid.”

The coefficient plot says the same thing more cleanly.

Covid hiring percentage was the top Wave-1 driver: standardized beta +0.80.

By Wave 2, it was -0.13.

Gone.

Remaining revenue-per-employee overhang survives weakly at +0.23. AI capex intensity moves from negative in Wave 1 to +0.26 in Wave 2. These are not clean forecast variables. They are weak survivors after the simple Covid arithmetic disappears.

That is the credibility move for the article.

I wanted Covid overhiring to forecast AI layoffs. It mostly did not.

The inverse is narrative, not arithmetic. I won’t be betting on the Emerging Market horse at Belmont apparently.

Remaining Overhang Still Matters, Just Less Than I Wanted

The failure of crude Covid hiring does not mean overhang is useless.

It means “hired a lot in Covid” is the wrong variable.

A company can double headcount and then grow into that headcount. Another company can add fewer people and still carry excess labor because revenue per employee never recovered.

So we built a remaining-overhang metric: peak/latest employees minus revenue-supported employees on each firm’s pre-Covid revenue-per-employee trend.

That is closer to the thing we actually care about.

The leaderboard is revealing. Snap still carries about +112% remaining overhang relative to 2019 headcount. Pinterest is about +26%. Intel is about +25%. ServiceNow is about +22%. Zoom is about +29%.

Meanwhile CrowdStrike, Cloudflare, Okta, Amazon, Uber, Shopify, and others show negative remaining overhang because revenue or subsequent correction absorbed the headcount.

This changes the forward framework.

If a firm has high remaining overhang and high business pressure, the classic inverse-hiring thesis still has mechanical plausibility.

If a firm has low remaining overhang and high business pressure, the likely story is different: AI/efficiency restructuring, capex pressure, margin repair, product mix, or a firm-specific crisis.

That is why a single Covid-hiring variable fails.

There are at least two layoff regimes hiding under the same headline.

AI Capex Became Part Of The Pressure

The AI wave is not just “AI replaces employees.”

It is also “AI is expensive.”

At the hyperscalers, capex intensity roughly doubled. Meta’s capex/revenue went from 0.16 to 0.35. Google went from 0.10 to 0.23. Microsoft went from 0.12 to 0.23. Amazon went from 0.13 to 0.18. Apple stayed roughly flat around 0.03.

The capex-intensity increase correlates +0.26 with Wave-2 layoff rate. That is not a magic coefficient, but it is directionally consistent with the strategic reality: companies are funding data centers, chips, model contracts, internal tooling, and product rewrites. If revenue growth is slowing and the board accepts a large AI capex plan, headcount becomes the flexible budget line.

This is one reason AI can be a real force in layoffs without being the literal replacement mechanism for every cut.

Some cuts may be substitution.

Some cuts may be funding.

Some cuts may be margin repair.

Some cuts may be management fashion.

The public AI story can sit on top of all four.

AI Is A Frame, Not A Clean Cause

The AI story is powerful. It is not always causal.

In the cross-firm data, citing AI does not predict cut depth. The correlation between AI rationale and AI-era layoff rate is about +0.04. That is basically nothing.

AI-citing firms split into opposite groups.

Some are high-growth firms barely cutting. Shopify, CrowdStrike, Snowflake, and Roblox talk loudly about AI while still growing revenue quickly.

Some are slower firms cutting deeply. PayPal, Oracle, Intuit, and others use AI language while dealing with very different operating realities.

There is also a major confound in productivity.

AI-citing firms often look like they have stronger revenue-per-employee growth. But when you separate the AI infrastructure sellers from everyone else, the edge largely disappears. Nvidia, Microsoft, Amazon, Oracle, and other AI sellers are not simply becoming more productive because AI replaced internal staff. Many are selling the infrastructure or services other firms use to chase AI.

That is revenue from the AI buildout, not proof of internal labor substitution.

This does not mean AI has no productivity effect.

It means the public AI narrative does not cleanly identify the productivity effect.

The frame is broader than the cause.

That was true in Covid too.

“War for talent” was a real executive belief. It was not the best explanation for the wage data.

“AI makes headcount redundant” is a real executive belief. It is not yet the best explanation for the wage data either.

The Quiet Target Is Headcount, Not Layoff Announcements

There is another reason the layoff forecast fails.

Layoffs are lumpy. They are public. They are legal, political, and reputational events. They reflect timing, disclosure, local labor law, severance windows, and whether a company chooses one big announcement or ten smaller ones.

The AI labor story is probably quieter than that.

It is no-backfill. It is attrition. It is requisitions that never reopen. It is a team that used to ask for six people and now asks for two. It is a manager who learns that the easiest way to look AI-first is to make the next headcount request disappear.

When we modeled net headcount change rather than announced-layoff depth, the signal improved in the retrospective model. The overhang model had positive out-of-sample skill on net headcount change in that setup, unlike announced-layoff depth.

Then we cleaned the forward test to remove look-ahead. The forecast skill collapsed back toward zero. The honest forward headcount model has only about +0.03 out-of-sample R2, and the 80% prediction interval is huge: roughly -29% to +32%.

That sounds disappointing.

It is useful.

It means no not-yet-cut firm can be statistically called to shrink as a point forecast. The error bars swallow the signal.

The right claim is not “Company X will cut 12%.”

The right claim is “Company X is in a higher-risk zone because its messaging, overhang, capex pressure, and business pressure line up.”

That is a risk ranking, not a number.

The Best Forward Signal Is Messaging

The strongest forward-looking evidence is not the Covid overhang model.

It is messaging.

At the macro level, the AI-permission narrative leads the decline in Information openings by about two quarters. The correlation is -0.87 at a +2-quarter lead. That does not prove causality. Both series trend through the AI transition. But it is exactly the timing pattern the narrative-permission theory would predict.

At the firm level, AI-permission messaging also rises before a firm’s own layoff.

In the event study, messaging sits around 1.82 two quarters before a layoff, jumps to 2.70 one quarter before, and peaks around 2.74 in the layoff quarter. The non-event baseline is about 2.02.

The signal is weak. The standard errors are wide. It is not deterministic.

But it is the most actionable forward evidence in the project.

It says: do not ask which company overhired most in Covid. Ask which not-yet-cut company is now talking most loudly about AI-efficiency, not backfilling, headcount superfluousness, flattening, and doing more with less.

That produces a watchlist.

The loudest not-yet-cut firms in the current messaging data are Airbnb, ServiceNow, Shopify, Spotify, Roblox, Uber, Snowflake, DoorDash, Roku, and Lyft.

Read that list carefully. They might be good ponies to bet on for a brief stock jolt.

Most of those firms do not have positive mechanical Covid overhang. Airbnb has negative overhang. Shopify has deeply negative overhang. Uber has deeply negative overhang. If they cut, the explanation will not be “they are finally undoing the Covid hiring binge.”

It will be the new labor logic.

ServiceNow is the interesting exception: loud AI messaging and real remaining overhang.

The Forecasting Model I Would Actually Use

Can we use these sentiments to predict future divestment?

Yes, but not as a point forecast of layoff depth.

The forecast I would use is a risk framework:

First, separate the regime.

If the company is still working through remaining overhang and business pressure is high, the classic Covid-correction logic still matters.

Second, track AI-permission messaging.

No-backfill language matters more than layoff language. Layoffs are the headline. No-backfill is the operating system.

Third, track hiring quantity, not wage.

Software wages are sticky and secular. Applications, openings, recruiting teams, offer volume, job posts, and internal requisitions move faster. The Covid and AI eras both show that the quantity channel is where the action appears first.

Fourth, track capex pressure.

AI infrastructure has to be funded. If the AI capex bill is rising and revenue growth is not, headcount becomes one of the few large controllable lines.

Fifth, track function and layer.

The AI-divestment story is not evenly distributed. It points hardest at recruiting, HR, support, customer operations, G&A, layers of middle management, low-priority product teams, internal tooling teams that agents can compress, and legacy business units that do not fund the AI story.

It points least at scarce AI researchers, AI infrastructure engineers, top applied AI product teams, power users who can multiply output, and people who turn models into deployed workflows.

That last part is why the aggregate wage result matters.

AI can reduce demand for some work while increasing demand for other people who know how to wield it. A single “software engineer wage” will not catch the reallocation cleanly. The first-order business action can be layoffs. The second-order labor-market result can still be rising pay for the people companies decide they need.

That is exactly what the current evidence looks like.

The New Talent Cycle

Here is the mental model I now believe.

Tech executives do not only manage labor as a cost.

They manage labor as an internalized and external story about the future.

In 2021, the future was demand abundance and talent scarcity. The strategic sin was failing to hire enough. The manager who protected headcount looked timid. The manager who hired looked ambitious.

In 2026, the future is AI abundance and human bottlenecks. The strategic sin is carrying work that a machine, agent, or smaller team might absorb. The manager who protects headcount looks outdated. The manager who gets more done with fewer people looks modern.

That is a brutal incentive shift.

It does not require AI to be fake.

It also does not require AI to be the full cause of every layoff.

New technologies do not need to explain everything to become the language through which everything gets explained.

Covid did not create a permanent digital-demand step function as large as companies thought. But it created enough real demand to justify the story long enough for the hiring boom to happen.

AI does not need to have already replaced millions of white-collar workers to change headcount behavior. It only needs to be credible enough for executives to rewrite the operating bar.

That is where we are.

The labor market is not screaming “engineers are worthless.”

The management system is whispering “every incremental headcount request is now guilty until proven necessary.”

Those are different facts.

They should not be fused into one story.

What I Now Believe

My opener was directionally right and mechanically wrong.

Covid-era hiring and AI-era layoffs are inverses, but not because one was simply too many humans and the other is simply too much AI.

They are inverses because the collective executive talent narrative flipped:

From scarcity to abundance.

From hire ahead to do not backfill.

From people as the bottleneck to people as the cost line AI might compress.

But in both eras, the price of software labor stayed on a smoother path than the story implied. The violent adjustment happened in hiring quantity and headcount decisions.

The forecast result sharpens the point.

Covid overhiring predicted the first correction wave. It did not forecast the AI wave. Once the industry moved from Covid correction to AI-era restructuring, the inverse stopped being arithmetic and became permission.

Scarcity gave permission to hire.

AI-abundance gives permission to cut, freeze, and not backfill.

So yes, the rhymes of the past help forecast the future, but they do not hand you a clean per-company layoff number.

Do not look for the software wage crash first.

Do not look only for the companies that hired hardest in 2021.

Look for the narrative shift. Look for the hiring freeze. Look for the backfill denial. Look for the capex bill. Look for the firm whose management language suddenly makes headcount sound like a legacy constraint.

That is where divestment starts.

The price may follow later.

Or it may not.

Data Notes

The underlying project used public filings, public labor data, and public company memos. Main data sources were SEC EDGAR, DOL OFLC H-1B LCA disclosure files, BLS OEWS, FRED JOLTS, layoffs.fyi, Hacker News “Who is Hiring”, earnings-call transcripts, 10-Ks, CEO memos, and SEC-derived capex disclosures.

The H-1B wage series is a proxy, not the whole software labor market. It is useful because it is large, public, structured, and role-specific. It is also sticky because offered wages are tied to prevailing-wage rules. That is why the study also checked BLS OEWS and information-sector wage series.

Layoffs.fyi is a lower-bound tracker, not an official layoff census. Announced-layoff depth is especially lumpy, which is why the forecast exercise also tested net headcount change.

The forecast horse race is small-n: 34 tech firms in the leave-one-firm-out validation. The robust finding is the absence of out-of-sample skill for announced-layoff depth and the Wave-1 to Wave-2 coefficient flip, not any single coefficient.

The firm-level messaging lead is suggestive, not deterministic. The event-study bands are wide. Treat the watchlist as a risk ranking, not a layoff prediction.

The 2026 narrative data is partial. The 2025 sign flip is the important result; the 2026 magnitude should be treated as early-year evidence.

Public narrative is impression-managed. That is not a bug in this design. The research question is about public executive sentiment and whether that sentiment moves with workforce action.

It asked whether China can keep building AI hardware after the United States tried to choke off the easy path.

The answer was yes, but not for free. China can build. It can route around some of the damage. It can use Huawei, SMIC, domestic equipment makers, chip startups, state funds, and a lot of brute-force systems engineering. But the bottleneck is memory, and the tax shows up in cost, power, friction, and uncertainty.

This is the capital-deployment story that Chinese companies report in their English language filings. Yes, this two part story has at least a third part on the difference between English language and Chinese language filings; I’m writing this before I have dug in to the Chinese language ones to isolate my biases.

If China can build increasingly domestic AI hardware, are Alibaba, Tencent, Baidu, ByteDance, and iFlytek spending on AI like Alphabet (Google), Meta (Facebook), and Microsoft?

No.

And that no matters.

Not because Chinese AI is fake. It is not. Qwen, DeepSeek, Hunyuan, ERNIE, Doubao, and Spark are real products backed by real companies. Alibaba’s Qwen in particular keeps showing up in the global open-weight conversation for a reason.

Part 1 showed that China can keep building under constraint. It did not show that China has the same private-sector capital engine as the United States.

The filings show a different kind of contest. America has a private-sector hyperscaler capex machine of astonishing size. China has a national mobilization under constraint. Both are powerful. They are not the same thing.

Results Up Front

This is long, and I do not expect most people to read the whole thing. The rest of the post tells you how I got here. The research data was current as of June 4, 2026.

The strategic version is this:

The AI hardware contest is not just a chip contest. It is also a capital-deployment contest. On that dimension, the United States has a private-sector advantage that the Chinese public model builders do not match. Alphabet, Meta, and Microsoft are not just buying more infrastructure. They are funding a geopolitical compute position from gigantic internal cash engines.

The strongest evidence is now filing-grade. Alibaba’s FY2026 20-F and Baidu’s FY2025 20-F are already on EDGAR (SEC’s Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system). Tencent and iFlytek have filed FY2025 annual reports. The three U.S. hyperscalers have filed FY2025 10-Ks. So the latest China-public-company conclusion does not rest on press releases. The notable exceptions are Hangzhou (DeepSeek) and ByteDance, because they are still private companies.

Inside the audited set, the private-capital gap is huge. Alphabet, Meta, and Microsoft spent about $225.7 billion of capex in FY2025. Alibaba, Tencent, and Baidu spent about $26.1 billion. That is an 8.7x gap. The U.S. trio also had about $416.7 billion of operating cash flow versus $65.4 billion for the China trio, and about $628.0 billion of net PP&E (Property, Plant, and Equipment) versus $53.2 billion. The U.S. side is buying more infrastructure, has a more substantial profit generating machine to keep buying, and starts from a much larger installed base.

Alibaba is accelerating, and that matters. Its capex rose from about $4.4 billion in FY2024 to $11.8 billion in FY2025 and $18.3 billion in FY2026. But the strategic comparison is still brutal: Alphabet spent $91.4 billion, Meta spent $69.7 billion, and Microsoft spent $64.6 billion in FY2025. Alibaba is the clearest public Chinese buildout story, and it is still not spending like a U.S. hyperscaler. There is a joke in there about scalers with Chinese characteristic but apparently I lost my sense of humor while reading financial filings until past midnight.

ByteDance is the important private caveat, not the refutation. The generous ByteDance assumption is a disputed FY2025 capex plan around $20.6 billion, much of it AI-related. Add that estimate and iFlytek to the China side and the gap narrows to roughly 5x. But the ByteDance number is not audited, is a plan rather than a completed result, and still does not reach Microsoft, Meta, or Alphabet. See the ByteDance box below before treating it like a filing. And the published DeepSeek numbers are too spurious to draw conclusions from.

This is a narrower claim than “China is not spending.” China has state compute funds, telecom operators, provincial data-center projects, Huawei, military demand, and a domestic-substitution machine outside this company set. The claim here is about Chinese model builders and cloud companies in public reporting, plus the best-known private ByteDance estimates. In that set, China is not matching U.S. hyperscaler private capex.

The geopolitical inference is abundance versus constraint. The U.S. has the richer private capital engine. China has the more urgent substitution engine. If frontier capability continues to depend heavily on raw compute, the filings imply a structural U.S. advantage. If Chinese labs can sustain a large capability-per-dollar advantage through efficiency, distillation, open-weight leverage, and domestic hardware substitution, the capital gap matters less than it looks. That is the real uncertainty.

The corrected mental model is not “America has everything and China has nothing.” It is also not “China has caught up.” It is a competition between an American abundance machine and a Chinese constraint machine. Both are great-power systems. They produce different investment patterns.

How to read ByteDance

ByteDance is private. It does not file audited financials. The numbers in this article are press and analyst estimates, and the estimates are not evidence.

So ByteDance matters twice. It is probably China’s most aggressive AI infrastructure spender. It is also the only large number in the comparison that is not filing-grade.

What I Measured

The question I wanted answered was narrower than the usual AI geopolitics argument:

What can we infer about Chinese AI model investment from financial reporting?

That constraint matters. I am not trying to rank model quality. I am not trying to infer secret GPU counts. I am not trying to measure every state subsidy or every provincial data-center project. I am asking what the companies themselves, and their audited or published financial reporting, say about the scale of investment behind the model builders.

The audited comparison set is:

Then I added two Chinese edge cases because excluding them would make the argument less honest:

Why no DeepSeek? There was no financial reporting to draw from.

The core metrics were revenue, capital expenditure, R&D, operating cash flow, PP&E, and cloud-segment revenue where available. Capex is not pure AI capex. It includes data centers, servers, networking, offices, and other long-lived assets. R&D is company-wide, not model-only. Cloud revenue is definitionally messy because the companies do not report identical segments. Microsoft Intelligent Cloud is broad. Tencent’s FinTech and Business Services segment is only a proxy because Tencent does not break out cloud revenue cleanly.

That messiness does not make the result disappear. It actually makes the capex gap harder to dismiss, because several Chinese capex definitions are broader than the U.S. “purchases of property and equipment” line. Alibaba’s historical capex includes land-use rights and, in some years, intangibles. Tencent and iFlytek use broader long-term-asset cash-flow lines. If anything, the pure compute gap is probably larger than the reported capex gap.

How to read the numbers

• Fiscal years are labeled by fiscal-year end. Alibaba ends in March. Microsoft ends in June. The others end in December.

• Currency is USD where the company reports or translates to USD. RMB-only lines use filing-grounded year-end conversion.

• Capex is company-level infrastructure spending. It is not AI-only capex. No company gives that line.

• Cloud definitions do not match. Microsoft Intelligent Cloud is broad. Tencent’s FBS line is a proxy, and cloud is only a subset.

• ByteDance is private and press-estimated. It is not part of the audited trio-vs-trio aggregate.

The Headline Table

Here is the latest-year capex picture.

This is the part of the story that is hard to unsee.

No single Chinese model builder matches any single U.S. hyperscaler. The closest is ByteDance, and ByteDance is the softest data point because it is private and the FY2025 figure is a reported plan, not an audited result. Even if the ByteDance estimate is directionally right, it is still about one-third of Microsoft’s FY2025 capex and less than one-quarter of Alphabet’s.

Alibaba is the most important public Chinese comparison because Qwen matters and Alibaba now gives us an audited FY2026 20-F (remember, its fiscal year ended in March). Its capex fell to about $4.4 billion in FY2024, then rose to $11.8 billion in FY2025 and $18.3 billion in FY2026. Alibaba Cloud revenue moved from about $11.2 billion in FY2023 to $22.9 billion in FY2026, though the FY2024 reorganization into Cloud Intelligence Group makes the later segment broader. The funding side moved the other way. Alibaba operating cash flow fell from about $22.5 billion in FY2025 to about $11.1 billion in FY2026 while capex rose. So Alibaba is leaning in. It is leaning in from a smaller base, with a thinner cash cushion, against U.S. peers that spend far more and fund the buildout with much larger operating cash flow.

But the question is not whether Alibaba is serious. The question is whether Alibaba is spending like Google or Meta.

It is not.

Finding 1: The Gap Widened During The AI Buildout

The common rescue for a smaller current number is trajectory. Maybe China started later and is catching up quickly.

That is not what the audited trio data shows.

The U.S.-over-China capex ratio was about 6.6x in 2016, 5.0x in 2020, 9.2x in 2023, and 8.7x in 2025. The gap did not compress during the generative-AI era. It widened.

That matters because 2023 through 2025 is exactly when the frontier model race became a capex race. It is the ChatGPT shock, the data-center land rush, the GPU supply scramble, the power-contract scramble, and the moment every board started asking whether the company had an AI strategy.

The U.S. hyperscalers responded by turning the capex dial much harder. China responded too. Alibaba and Tencent both accelerated after their 2022-2023 lull. But the U.S. response started from a larger base and grew faster off that base.

The same pattern appears across the other scale measures:

Revenue is the important denominator. The U.S. revenue gap is large, but not 8.7x. The capex gap is much larger than the revenue gap. That means this is not just “bigger companies spend more.” It is “bigger companies are also spending harder.”

Finding 2: Normalizing By Revenue Does Not Rescue China

Capex intensity is the cleaner way to ask whether the companies are behaving differently.

In FY2025:

The U.S. companies are spending roughly 23 to 35 cents of every revenue dollar on capital expenditure. That’s called betting the farm. The audited Chinese companies are spending roughly 9 to 12 cents.

That is the “not just scale” result.

Alibaba’s FY2026 intensity moves higher, to about 12.3%. That is a real shift. It puts Alibaba closer to a cloud buildout footing than it was in FY2023 or FY2024. But it still does not put Alibaba near Meta’s FY2025 34.7%, or Alphabet and Microsoft around 23%.

There is an alternate universe where the result looks different. If Alibaba had lower revenue but similar capex, intensity would look stronger. If Baidu were still investing like a future frontier cloud platform instead of a constrained AI software/cloud player, China would look stronger. If Tencent disclosed a much larger pure-cloud capex line, the interpretation might change.

That is not the universe in the filings.

Finding 3: A Capex War Is Also A Cash-Flow War

Capex is not just ambition. It is funding.

In FY2025, the U.S. trio generated:

The audited China trio generated:

That is a 6.4x operating-cash-flow gap.

This is the part that makes the U.S. buildout more durable. Alphabet, Meta, and Microsoft can spend absurd amounts and still fund most of it internally. They can disappoint investors for a few quarters and keep building because the underlying cash engines are enormous.

China’s public AI/cloud companies have much less room. Tencent is the strongest cash generator in the China set. Alibaba is large but its FY2026 operating cash flow fell to about $11.1 billion, while capex rose to about $18.3 billion. Baidu’s FY2025 operating cash flow was negative.

If the AI race requires several years of front-loaded infrastructure spending before the returns are obvious, the side with the larger self-funding engine has a structural advantage.

Finding 4: PP&E Is The Accumulated Scar Tissue

Capex is the yearly flow. PP&E (Property, Plant, and Equipment) is the infrastructure stock that remains on the balance sheet.

This is the harshest chart in the project.

In FY2025, Alphabet, Meta, and Microsoft had about $628.0 billion of net property and equipment. Alibaba, Tencent, and Baidu had about $53.2 billion.

That is 11.8x.

PP&E is not a perfect compute measure. It includes buildings, land improvements, network infrastructure, leasehold improvements, and other physical assets. Depreciation policies differ. Fiscal years differ. Chinese capex definitions are not identical to U.S. definitions.

But PP&E is directionally important because AI infrastructure is not a one-year decision. It is cumulative. Data centers, power systems, server fleets, networking, cooling, and campuses become the base from which the next year starts.

The U.S. hyperscalers did not start the generative-AI era from zero. They started with a cloud and data-center base built over more than a decade. Then they accelerated.

China’s public AI/cloud companies are building too. But they are building from a much smaller installed base.

Finding 5: ByteDance Is The Important Caveat

ByteDance is the hardest company in the whole analysis because it is probably the most important Chinese AI infrastructure spender and the least transparent one.

The private-company estimates say ByteDance had about $155 billion of revenue in FY2024, about $11 billion of capex in FY2024, and a reported FY2025 capex plan around $20.6 billion. A separate estimate puts the AI compute subset around $12.5 billion. Volcano Engine, ByteDance’s cloud business, is much smaller than the capex line, with reported 2025 target revenue around $3.6 billion.

If those numbers are directionally right, ByteDance is the Chinese player that most resembles Meta: a first-party AI and consumer-app company spending ahead of a directly reportable cloud revenue line.

That matters.

It also does not overturn the result.

The generous read is to use the disputed FY2025 plan, not the firmer FY2024 estimate. That gives ByteDance about $20.6 billion of capex. Even then, it remains below Microsoft at $64.6 billion, Meta at $69.7 billion, and Alphabet at $91.4 billion. It roughly doubles the China-side capex aggregate, but because the U.S. base is so large, the China-plus-ByteDance gap still sits near 5x.

The honest way to use ByteDance is as an upside caveat on the China side:

China’s AI infrastructure spending is larger than the audited public-trio filings alone imply, because ByteDance is real and private.

But the stronger claim, that China’s model builders are matching U.S. hyperscaler capex, still is not supported.

Finding 6: iFlytek Proves Breadth, Not Scale

iFlytek is the opposite caveat.

It is public. It is audited. It has an AI model line in Spark. It is exactly the kind of specialist that should be included if the question is “who are China’s AI model companies?”

It also barely moves the aggregate.

In FY2025, iFlytek had about $3.9 billion of revenue, $0.45 billion of capex, and $0.63 billion of R&D. That is serious for a specialist company. It is not material against Alphabet, Meta, Microsoft, Alibaba, Tencent, or ByteDance.

iFlytek is useful because it keeps the China story from collapsing into only the internet giants. It shows the ecosystem has more breadth than Alibaba/Tencent/Baidu. But it does not solve the capex-scale problem.

Finding 7: Cloud Demand Is Not The Whole Explanation

The cloud-revenue comparison is where the story gets more interesting.

If U.S. companies were spending more only because they had proportionally larger cloud businesses, the capex gap would be less strategically interesting. It would mostly be a cloud-demand story.

That is not what the data shows.

Latest cloud-related revenue:

Google Cloud is about 3.6x Alibaba Cloud on the FY2025 comparison. The audited U.S.-China capex gap is 8.7x. The cloud gap is large, but it is not capex-gap large.

That points to two spending archetypes.

The first archetype is cloud resale. Alphabet, Microsoft, Alibaba, Tencent, and Baidu build infrastructure that can be sold through cloud products. This is the demand-matched model. Chinese public companies look much closer to this pattern. The cloud business grows, capex follows, and the company tries not to get too far over its skis.

The second archetype is first-party AI betting. Meta has no cloud business and still spent $69.7 billion in FY2025 capex. ByteDance, if the estimates are right, is also spending far ahead of Volcano Engine revenue because Doubao, TikTok, recommendation systems, ads, video, and internal AI products are the real demand.

This distinction cuts across countries. Meta and ByteDance look more similar to each other than either looks to a conventional cloud-resale business.

But the scale still does not cut across countries. Meta’s first-party bet is much larger than ByteDance’s reported first-party bet.

Finding 8: Disclosure Is Not Dollars

The filings also say something useful about narrative.

In FY2025, the U.S. filings averaged about 29 AI-related terms per 10,000 words. The Chinese filings averaged about 13. But the loudest Chinese filer was not the biggest spender. Baidu talks constantly about ERNIE, PaddlePaddle, Apollo, chips, and the full-stack AI story. It also spent about $1.7 billion of capex in FY2025 and had negative operating cash flow. It kind of makes me wonder if there is some partnership between Baidu and the Chinese government for state-funded CAPEX. But I have found zero data to support that conjecture. Maybe the Chinese language filings analysis will turn that up; regardless, they’re not telling English speakers.

Alibaba and Tencent talk less loudly and spend more. The business point is simple: do not confuse the AI story a company tells in a filing with the AI infrastructure it funds.

What The Data Does Not Prove

This project has a hard boundary.

It measures company-level financial reporting. It does not measure AI-only capex. No company gives investors a clean line called “frontier model training and inference infrastructure.” The capex line includes cloud resale, internal AI, offices, networks, land, leases, and ordinary business infrastructure.

It does not measure state support cleanly. China’s AI hardware mobilization includes subsidies, policy direction, state funds, local-government support, power allocation, procurement pressure, and national champions. Some of that shows up inside company filings. Much of it does not.

It does not measure capital efficiency. Qwen can be strong relative to Alibaba’s capex. DeepSeek can produce a model-quality shock at much lower apparent spend. Chinese labs may be getting more model capability per dollar through distillation, engineering discipline, cheaper labor, lower margins, more open-source leverage, or simply better choices. Financial filings cannot answer that.

It does not measure the whole Chinese AI ecosystem. DeepSeek is not in this company set because the project is financial-reporting driven. Huawei is Part 1 supply-side infrastructure. State labs, universities, government cloud procurement, and provincial compute centers are outside the audited model-builder comparison.

It does not make U.S. capex pure AI. Alphabet and Microsoft spend for cloud customers as well as internal AI. Meta spends for AI, ranking, recommendations, video, ads, Reality Labs support infrastructure, and whatever else its data-center fleet supports. The U.S. capex firehose is not a single-purpose LLM line.

It also does not make ByteDance filing-grade. ByteDance is private. Its numbers are press estimates. The FY2025 capex number is a plan, not an audited result, and ByteDance reportedly disputed some reporting around the scale of spending. I include ByteDance because excluding it would be misleading. I do not treat it as equivalent to audited filings.

Those caveats are real.

They narrow the claim.

They do not erase it.

The narrow claim is the strong one: in their public financial reporting and in the best available private-company estimates, Chinese AI model builders and cloud companies are not deploying private capital at U.S. hyperscaler scale. That is a statement about this company set, not every yuan China spends on compute.

What Would Change My Mind

This conclusion is falsifiable. Four kinds of evidence would move it.

First, audited ByteDance numbers could change the private-company side. Not one disputed budget. A few years of verified ByteDance capex in the $40 billion-plus range would make the China side look different.

Second, clean AI-compute disclosures from the Chinese public companies could show that the company-level capex proxy is missing a much larger AI buildout. Right now the capex definitions cut the other way: several Chinese lines are broader than the U.S. PP&E-purchase line, which makes the reported gap look more conservative, not less.

Third, state or provincial compute could be substituting for private model-builder capex at much larger scale than the filings can see. Some of that almost certainly exists. The question is whether it is large enough, accessible enough, and frontier-relevant enough to offset the private-capital gap. It might explain the disparity between Baidu’s claims and their audited financials.

Fourth, Chinese labs could have a durable capability-per-dollar advantage. If open-weight leverage, distillation, better engineering, synthetic data, or domestic hardware optimization lets Chinese model builders offset an 8-to-12x capital gap, then capex is still true but less decisive.

The first two would say the measurement is missing dollars. The second two would say the dollars are the wrong strategic variable. I take both possibilities seriously.

What I Now Believe

Part 1 showed that China can keep building under constraint.

Part 2 shows that the public model builders are not funding compute at U.S. hyperscaler scale.

China can be an AI Great Power without matching America’s hyperscaler capex scale. A great power can take the punch and keep building. China is doing that. The domestic hardware stack is constrained but real. The substitution machine is moving. The model ecosystem is not fake.

But scale still matters.

The United States has a private-sector capital engine that is hard to overstate. Alphabet, Meta, and Microsoft can collectively spend more than $225 billion of capex in a year, generate more than $416 billion of operating cash flow, and keep going. Their installed infrastructure base is already enormous. Their cloud businesses either fund the buildout directly or, in Meta’s case, the advertising cash engine funds a first-party AI bet at hyperscaler scale.

China’s public model builders are operating under a different constraint set. Alibaba is accelerating, but from a much smaller base. Tencent is strong, but more demand-matched. Baidu talks like an AI company but does not spend like a hyperscaler. ByteDance is the aggressive private exception, but even the aggressive estimate does not reach the U.S. companies. iFlytek adds breadth, not scale.

The result is not “China loses.”

That is too clean, and clean stories are usually where the data starts to get interesting.

The result is that the two sides are optimizing under different regimes.

Both columns are great-power advantages. They are not the same advantage, and they do not create the same investment pattern.

The strategic question is which machine matters more at which layer of the AI stack.

If frontier model capability keeps scaling mostly with compute and capital, the filings imply a structural U.S. advantage. The U.S. side is buying more infrastructure, faster, with more cash behind it, and from a much larger installed base.

If capital efficiency, model compression, open-weight diffusion, synthetic data, distillation, and domestic hardware substitution matter more than the simple capex view implies, China can remain highly competitive without matching the spending line. That is the world where Part 1’s supply-side story carries more weight.

I would not bet on either extreme.

The filings say the private-capital contest is not close.

Public model performance outside these filings, including Qwen and DeepSeek, makes it hard to treat the capability contest as settled.

That is the uncomfortable middle. China is capable. It is building. It is not matching the American hyperscaler capex light-money-on-fire hose. The U.S. has the deeper private-sector capital engine. China has the more urgent domestic-substitution machine.

The AI hardware contest is not “America has all the chips and China has none.”

It is also not “China has caught up.”

It is a competition between abundance and constraint.

That is the mental model I am carrying forward.

The classic definition of a Great Power is a country able and willing to take on any other country. By that definition, there are two AI Hardware Great Powers: America and China.

That is a resilience claim, not a parity claim. Layer by layer, the United States and its allies are still ahead. In the comparison I would actually use, the US-and-allied stack leads or ties on eight of nine layers: chip design, leading-edge logic, HBM, packaging, EDA, equipment, systems integration, and capital. China scores weakly on the four hardest physical chokepoints: logic, HBM, EDA, and equipment. The one layer where China clearly leads is power, which is useful for brute-force deployment but is not a chip capability. For this piece, “AI Hardware Great Power” means something narrower and more falsifiable: a country with enough design talent, capital, foundry access, memory path, packaging capability, systems integration, power, and political will that the United States and its allies cannot deny it a working AI-hardware stack.

The layer comparison is estimate-grade, not filings proof. Its job is to keep the frame honest: China is not a peer at every layer, but it is too capable and too persistent to be treated as blocked.

I set out to understand the Chinese AI hardware space from financial reporting documentation. Anyone who has run a company has spent a ton of time educating their CFO on the technical aspects of the business. It is a very productive investment because the more the CFO understands the nuance of the business, the more they can squeeze efficiency out of the income and costs.

But financial disclosures are optimized for lenders, auditors, regulators, and investors. They are not optimized for national-security opsec. The audited financial statements and bond prospectuses have to explain the business well enough for outsiders to assess risk, capital allocation, and repayment capacity. That creates leakage.

So I set about mining these for gold dust, and melting them down to make bling.

The project started as a Huawei project.

That was the wrong scope.

Huawei is the flag carrier of China’s indigenous AI hardware effort, but the filings tell you very quickly that Huawei is not the whole story. Huawei hides the most interesting chip-specific economics inside a giant private company. The listed foundry, equipment makers, AI-chip peers, IPO candidates, bond documents, and state-capital vehicles tell the rest of the story.

The answer is annoying in the way useful answers often are.

Huawei’s filings prove the investment is real.

They do not prove the headline chip numbers.

They prove China is building the hardware base.

They also show the near-term gate is not money. It is memory.

The dashboard is the short version: Huawei’s audited numbers show the strategic pivot; the listed supply chain shows the physical buildout; the HBM model shows the near-term gate.

Results Up Front

This is long, and I do not expect most people to read the whole thing. The rest of the post tells you how I got here.

The strategic version is this:

China is not at parity with the United States and its allies in AI hardware. It is behind in leading-edge logic, HBM, EDA, equipment, and power efficiency. But the United States and its allies have not denied China a working AI-hardware stack. They have forced China onto a worse path: more expensive, less efficient, more power-hungry, more state-directed, and more memory-constrained. That is still a real path.

This is the geopolitical mistake to avoid. “Behind” is not the same thing as “blocked.” China can be structurally behind the allied semiconductor stack and still be the second AI Hardware Great Power. A Great Power does not need the best toolchain at every layer. It needs enough domestic capability, money, power, industrial coordination, and political will to keep building after the easy path is cut off. The filings show China doing exactly that.

Huawei is the best visible pressure gauge. Its audited filings show that the sanctions shock turned a large technology company into an industrial-policy platform. R&D rose from CNY 30bn in 2012 to CNY 192bn in 2025, and R&D intensity moved out of the old 14-15% band into the 21-25% range. Depending on the baseline, Huawei spent roughly CNY 250-360bn, or US$35-50bn, more on R&D from 2020 through 2025 than it would have under the old operating model. That is not an Ascend budget. It is the size of the corporate pivot.

The balance sheet shows the other side of the same strategy. Huawei stockpiled components when the supply chain was closing. Raw materials, meaning components and chips, doubled from CNY 35bn in 2018 to CNY 89bn in 2020 while finished goods collapsed. Huawei also has the wallet to keep going: CNY 361-475bn of cash and short-term investments across the relevant period, CNY 1.33tn of assets, CNY 127bn of operating cash flow in 2025, and a bond-disclosed CNY 240.6bn self-funded capital-project pipeline.

The important geopolitical fact is that this is not just Huawei. SMIC, domestic equipment makers, state funds, listed AI-chip peers, and IPO candidates are all part of the same mobilization. SMIC capex moved from roughly US$1.8bn in 2018 to about US$8bn a year. SMIC capacity grew about 2.6x. NAURA and AMEC grew about 10x. Big Fund III is about US$47.5bn. This is not a normal company strategy. It is national substitution under pressure.

The near-term chokepoint is not Huawei’s willingness to spend. It is memory. A transparent HBM model puts the 2026 high-end Ascend production ceiling around 250k-650k accelerators gross, not a few million. Once packaging yield is made explicit, the base deliverable number is lower, about 488k. Even the all-favorable stress-test corner is around 1.2M, still short of the “few million” claim. The decisive swing factor is foreign HBM stockpile exhaustion and domestic HBM yield, not generic wafer capacity.

That ceiling matters, but it does not make the threat imaginary. Unit counts are the wrong final metric. In effective compute, the Ascend 910C is roughly 0.8x an H100 but roughly 5x the H20 that US controls allowed Nvidia to sell into China. Export controls took away an easy import path and forced China onto an inferior domestic path. They taxed capability. They did not erase it.

The policy implication is uncomfortable. Export controls bought time and imposed cost. They did not create a permanent wall. If the United States wants the time to matter, the next game is not just GPU export rules. It is HBM controls, advanced packaging, semiconductor equipment, datacenter power, allied supplier discipline, and staying ahead faster than China can climb the constrained path.

Part 2 of this series is the demand-side check on this claim. Alibaba, Tencent, Baidu, ByteDance, and iFlytek are real AI actors, but the American hyperscalers are spending vastly more capex. That means the right frame is not “China has caught up.” It is also not “China is blocked.” The contest is abundance versus constraint: the United States has the deeper private-sector hyperscaler capital engine; China has the more urgent state-directed substitution machine.

One framing note before the findings: not all evidence in this piece has the same weight.

What I Measured

The project used public financial reporting, not private sourcing.

The first layer was Huawei’s own audited annual reports from 2012 through 2025: revenue, R&D, capex, inventory, segments, fixed assets, cash, staff, margins, and other income.

The second layer was bond and rating-agency documentation. That mattered because bond documents sometimes say the quiet part out loud. Annual reports are written for broad stakeholders. Bond investors want to know what the company is spending money on and whether it can pay them back.

The third layer was the listed supply chain: SMIC for foundry capacity, domestic semiconductor-equipment firms for the tooling ramp, and the state semiconductor funds for capital mobilization.

The fourth layer was listed AI-chip peers. Huawei hides Ascend economics. Cambricon, Hygon, Moore Threads, MetaX, Biren, Iluvatar, and Enflame do not have the same luxury once they list or file to list. Their filings show what chip-specific R&D intensity, losses, inventory, and customer concentration look like when the curtain is not drawn.

The final layer was a claim ledger. I took public claims and asked a simple question: does this map to something in the filings?

Some claims do. Some do not.

That distinction is more important than the individual scorecard.

The Central Problem

Huawei is employee-owned and not stock-listed.

That sentence sounds like trivia. It is the entire analytical problem.

Huawei publishes audited annual reports. It has bond documents. It has rating-agency disclosures. It has enough financial reporting to study. But it does not disclose a HiSilicon segment. It does not disclose Ascend revenue. It does not disclose AI-chip R&D. It does not disclose chip-unit output.

You cannot read “Ascend investment” off a number.

That leaves two ways to do the work.

One is to make stuff up and launder it through confidence.

The other is to triangulate.

I used the second path. Huawei’s group-level financials show the strategic pivot. SMIC and the equipment makers show the physical buildout. Listed AI-chip peers show the chip-specific economics Huawei buries. Public claims get graded against all of the above.

This is important because the Chinese hardware story is not one company. It is a stack.

Huawei designs systems and accelerators. HiSilicon designs chips. SMIC manufactures logic dies. CXMT is the domestic HBM hope. Domestic equipment makers replace the tools sanctions constraint. State funds and local governments push capital into unlisted fabs and suppliers. Listed peers absorb demand when Nvidia parts get curtailed. IPO markets refill the coffers.

The filings do not let you listen in on the room where it happens.

They give you pressure gauges.

Finding 1: The R&D Step Change Is Real

The cleanest signal in the whole project is Huawei’s R&D intensity.

If the sanctions pivot were small, this chart would not break out of the old R&D-intensity band. It does.

From 2012 through 2020, Huawei’s R&D expense mostly lived around 14-15% of revenue. That is already high. Huawei was never a low-R&D company pretending to be a hardware company. It was a technical company spending heavily.

Then the sanctions era changed the slope.

R&D rose to 21-25% of revenue from 2021 onward. In absolute terms, it went from CNY 30bn in 2012 to CNY 192.3bn in 2025. The decade total now exceeds CNY 1.38tn. About 114,000 employees, roughly 54% of Huawei’s workforce, work in R&D.

The important part is not just “Huawei spends a lot on R&D.”

The important part is “Huawei changed how much of every revenue yuan it reinvests into R&D after the sanctions shock.”

I used a deliberately boring counterfactual. What if Huawei had kept R&D intensity near its pre-sanctions level instead of stepping up into the 21-25% band?

The answer is not a single sacred number. If you use the 2012-2020 average, the gap is about CNY 321bn, or about US$46bn. If you use nearby baselines, the band is roughly CNY 250-360bn, or about US$35-50bn. That range is the right way to read the result.

That is not Ascend spend.

It is not a secret chip budget. It is not proof that US$46bn went into Ascend. It is not purely sanctions, either; the whole AI industry spent more in the 2020s. What it is good for is bounding the size of Huawei’s group-level pivot into self-sufficiency: chips, operating systems, EDA substitutes, Kunpeng, Ascend, CANN, Pangu, CloudMatrix, domestic components, and whatever else is bundled into the group.

The reason to frame it this way is simple. Huawei did not tell us the Ascend number. But the group-level pivot is too large to hand-wave away.

If a company adds something like US$35-50bn of above-baseline R&D after being cut off from foreign semiconductors, and then becomes the national champion for domestic AI accelerators, the burden of proof is no longer on the claim that something changed.

The burden is on anyone pretending the change is small.

Finding 2: The Balance Sheet Shows The Stockpile

The 2019 inventory spike is the most visually obvious fingerprint.

Total inventory jumped from CNY 96.5bn in 2018 to CNY 167.4bn in 2019. That is a 73% increase in one year, right after the May 2019 Entity List action and before the 2020 Foreign Direct Product Rule cut HiSilicon off from TSMC.

But the better evidence is inside the inventory composition.

If this were just unsold finished products, finished goods would have carried the surge. They did not. Raw materials did.

Raw materials went from CNY 35bn in 2018 to CNY 89bn in 2020. Finished goods went the other direction, collapsing from CNY 73bn in 2019 to CNY 14bn in 2022.

This matters.

If finished goods had ballooned, the story could have been “Huawei built too many phones and could not sell them.” That would be bad operationally, but not especially revealing about semiconductor sanctions.

That is not what happened.

The durable build was raw materials. Components. Chips. Scarce inputs.

That is exactly what a competent hardware company would do if it saw the supply chain closing around it. You buy what you can buy while you can still buy it, you spend the next few years learning how to live without the imports, and you encode that strategic materials reserve into your corporate DNA.

The filings do not say “we stockpiled materials.”

The balance sheet says it for them. And it says it year after year after year.

Finding 3: Huawei Has The Wallet

There are two separate questions people often blend together.

First: is Huawei spending heavily enough to build indigenous AI hardware?

Second: can Huawei keep doing it?

The answer to the second question is easier.

Yes.

Huawei had CNY 361-475bn in cash and short-term investments across the relevant period, CNY 1.33tn in total assets, CNY 600bn in equity, and CNY 127bn of operating cash flow in 2025.

That does not mean every project succeeds. Money does not solve EUV. Money does not solve HBM yield. Money does not make a 7nm process into a 3nm process.

But money does solve persistence.

The bond and rating documents make that point more strongly than the annual report. They disclose a CNY 240.6bn in-progress capital-project pipeline, with CNY 90.2bn already invested, 100% self-funded. The projects include a Gui’an cloud data center, a Songshan Lake high-end R&D campus, and a Shenzhen pilot/trial-production center.

The bond documents matter because they show named, self-funded projects the annual report leaves blended into the group.

Bond proceeds fund working capital.

The strategic capex is internally funded.

That is why it is invisible as a neat chip line item. It is not a special-purpose public-market financing with a clean investor deck. It is buried in a giant company’s cash-funded capital plan.

This is the CFO version of camouflage.

Not “we have no spend.”

“We have spend so blended into the company that you cannot isolate it.”

Finding 4: State Support Is Visible, But Not At Headline Scale

One of the public claims is that roughly US$30bn, or about CNY 215bn, of state funding went to Huawei-linked fabs.

Huawei’s own filings do show state support.

Government grants recognized in income rose from about CNY 1.5bn before 2019 to a peak of CNY 7.3bn in 2023. Cumulative grants from 2020 through 2025 were about CNY 29bn.

That is real money.

It is also nowhere close to US$30bn.

So the right conclusion is not “state support is fake.”

The right conclusion is “state support to Huawei itself is visible and rose materially, but the big fab money is mostly outside the consolidated Huawei group.”

This is why the ledger grades the claim as partially corroborated. The direction is right. The entity is wrong. The accounting perimeter matters.

I know “accounting perimeter matters” is not the kind of sentence that lights up a room.

It is the sentence that keeps you from being fooled. I couldn’t find the rumored big state subsidized fab in any corporate filings.

Finding 5: The Buildout Is National, Not Just Huawei

Huawei’s filings are not enough because Huawei does not run the whole hardware stack.

The supply-chain filings fill in the shape.

Huawei’s R&D rises, but SMIC and the equipment makers rise faster. That is the fingerprint of a national stack, not a single-company capex story.

SMIC capex went from roughly US$1.8bn in 2018 to about US$8bn a year by 2025. SMIC year-end capacity grew from about 406k to about 1.06M 8-inch-equivalent wafers per month, and 2026Q1 reached about 1.078M. Revenue set records. Utilization stayed high.

SMIC never says “we are making Huawei Ascend dies.”

It does not have to say it for the capex ramp to matter. The public link from SMIC to Ascend is sourced assessment. The capacity, capex, and revenue are disclosed facts.

Domestic equipment companies tell the same story. NAURA and AMEC grew about 10x since 2019. The state Big Fund Phase III is about US$47.5bn and targets equipment, HBM, and AI chips.

This is why a Huawei-only frame is too narrow.

If you only read Huawei, you see a private company that spends more on R&D after sanctions.

If you read the stack, you see foundry capacity, domestic tooling, state capital, cloud demand, chip startups, and listed peers all moving in the same direction.

That does not prove every public claim.

It proves the mobilization is real.

Finding 6: Listed Peers Show The Economics Huawei Hides

Huawei does not disclose Ascend economics.

China’s listed AI-chip firms do.

That is the disclosure window Huawei denies us.

Cambricon is the cleanest pure-play comparator. For years, its R&D intensity ran 122-209% of revenue. In FY2022 it was around 209%. This is what “investing heavily in indigenous AI chips” looks like when the chip line is visible.

Then 2025 happened.

Cambricon is the cleanest public test case for what happens when curtailed Nvidia demand gets pushed toward domestic accelerators.

Cambricon revenue rose 453% to CNY 6.5bn and the company posted its first annual profit, CNY 2.06bn, after eight straight years of losses.

That is not a small demand-side signal.

That is the export-control substitution effect showing up in audited numbers.

Cambricon also stockpiled like Huawei. Inventory rose 179% to CNY 4.9bn, about 37% of total assets, with wafer pipeline and supplier prepayments used to lock scarce domestic foundry capacity.

The point is not that Cambricon equals Huawei. The point is that chip-only R&D intensity is far higher than Huawei’s blended group average.

This is why Huawei’s 22% group-level R&D intensity is both huge and misleading.

It is huge because Huawei is enormous.

It is misleading because chip-only companies often have to spend 100-600% of revenue on R&D while they are building the product and market. Huawei’s group average masks the Ascend economics.

Hygon is the profitable AI-compute heavyweight. It grew revenue from CNY 2.3bn in FY2021 to CNY 14.4bn in FY2025, with R&D up to CNY 4.6bn.

Then there is the IPO wave.

The IPO cohort makes the same point another way: when indigenous GPU companies disclose their books, the R&D intensity looks extreme.

Moore Threads, MetaX, Biren, Iluvatar, and Enflame raised more than US$3.5bn in roughly 10 weeks across the 2025-2026 listing wave. Their filings show extreme chip-specific R&D. The five GPU startups spent CNY 5.2bn on R&D against CNY 2.8bn of revenue in FY2024.

Again, these are not Huawei.

That caveat matters.

The assessment is not “Ascend revenue equals Cambricon revenue” or “Huawei has Cambricon’s margins.” The assessment is narrower: listed chip firms show the economic pattern Huawei hides, which is years of heavy chip-specific R&D, stockpiling, and demand substitution after controls.

They are smaller. They are product-distinct. Their customer bases and accounting quirks differ. Their R&D-to-revenue ratios also look extreme partly because the revenue denominators are small. So I am not using them as numeric proxies for Ascend. I am using them as visible examples of the pattern. They show what Chinese indigenous AI-chip programs look like when the chip business is visible. Whether Ascend’s own economics match any of them is exactly the thing Huawei’s filings will not tell us.

The peer filings confirm two things:

First, indigenous AI-chip investment is real and large.

Second, the controls shifted demand into domestic silicon rather than stopping demand from existing.

Finding 7: Logic Dies Are Not The Gate

The instinctive bottleneck story is “SMIC cannot make enough 7nm logic dies.”

That story looks wrong.

The chart is the bottleneck argument in one picture: logic capacity has headroom; HBM does not.

The bottoms-up reconciliation uses a 665 mm2 Ascend-class die and about 76 dies per wafer. The less certain input is SMIC’s 7nm-class capacity. Published estimates do not agree. Some put the relevant line around 20k wafers per month. Others put the 2025-2026 range closer to 45-60k. Yield is also uncertain, somewhere around 30-55% in the useful range.

That sounds messy because it is messy. But the conclusion does not require false precision. At the realistic HBM ceiling, the wafer demand is small against every plausible logic-capacity case. On the higher capacity estimates, 650k high-end accelerators use only a few percent of the line. Even on the lower 20k-wafer estimate, they are still not enough to make logic the gate. In the stacked pessimistic case, with low capacity, low yield, smaller die count, and Ascend getting less than a third of the line, the logic side still builds several times more 910C-class packages than the available HBM can populate.

SMIC’s disclosed largest customer was 8.1% of 2024 revenue. That does not prove a Huawei link. It does show that a meaningful Ascend allocation can fit inside SMIC’s customer-concentration disclosure because advanced-node wafers are a thin slice of SMIC’s total mature-node-heavy business.

Logic capacity is not irrelevant. Yield matters. Node maturity matters. EUV absence matters. But I am not claiming a precise headroom multiple. I am claiming the durable thing: in 2026, the binding number is HBM stacks, not logic wafers.

The gate is HBM.

High-bandwidth memory is not just another component. For an AI accelerator, it is the thing that lets compute be useful. The 910C uses 8 HBM stacks. The buildable accelerator count is basically:

available HBM stacks / stacks per chip

Before packaging yield, that is the model. With packaging yield, the number only moves down.

The “few million” debate is easier to understand backwards. To build 1M high-end accelerators at 8 HBM stacks each and 75% packaging yield takes about 10.7M HBM stacks. To build 2M takes about 21.3M. To build 3M takes about 32M. The plausible 2026 supply pool in the base model is about 5.2M stacks.

The model is intentionally simple. It is also not a filing-derived fact. The foreign stockpile depth, CXMT’s 2026 output, and the 8-stack 910C assumption are heavily downstream of the same analyst work, especially SemiAnalysis. I am re-running and stress-testing those inputs, not discovering them from Huawei’s books. Treat 250k-650k as a bounded guess, not a filing fact.

That caveat cuts both ways. If the HBM stack count is wrong, the output estimate moves. But the stress test says which input matters. The swing factor is not whether CXMT makes 2.0M or 2.25M stacks in 2026. The swing factor is how long the foreign HBM stockpile lasts, whether Huawei can use fewer stacks per high-end part, and whether packaging yield is materially better than expected.

The HBM model puts the 2026 CXMT-only domestic floor around 262k high-end Ascend accelerators gross, with a range of about 250k-281k. If Huawei can ration residual foreign HBM stockpile into 2026, the gross ceiling rises toward about 650k, with wider uncertainty. With a 75% packaging-yield assumption, that 650k gross case becomes about 488k deliverable accelerators.

That is meaningfully below “a few million.”

The decisive swing factor is when the foreign HBM stockpile runs out. The secondary swing factors are CXMT HBM3 qualification, die-to-stack backend yield, packaging yield, and whether Huawei’s in-house memory efforts scale faster than expected.

This is the place I would watch.

Not because logic does not matter.

Because the logic-side capacity has headroom and the memory-side capacity does not.

Finding 8: Export Controls Taxed China. They Did Not Wall It Off.

The original policy premise was that export controls would set back China’s AI program.

That is partly true.

The narrower Huawei premise is definitely true. Huawei revenue fell 29% from CNY 891bn in 2020 to CNY 637bn in 2021. The consumer business was hammered. Net margins were crushed in 2022. The company then recovered to CNY 881bn by 2025, with ICT Infrastructure as its largest segment and Cloud, Digital Power, and Automotive becoming more important.

So yes, Huawei was set back.

The broader AI-program claim is more subtle.

In effective compute terms, the Ascend 910C is roughly 0.8x an H100 on BF16 compute but roughly 5x the H20 that controls allowed Nvidia to sell into China. CloudMatrix brute-forces scale: it can beat Nvidia’s GB200 NVL72 on raw compute, but at much worse power efficiency.

This is why units are the wrong final metric. The same unit count can mean very different capability depending on which chip you compare against.

The right framing is not “controls failed” or “controls succeeded.”

The right framing is “controls imposed a tax.”

They forced China onto a more expensive, less efficient, supply-constrained path. They made HBM a bottleneck. They forced domestic substitution. They likely slowed and distorted the buildout.

But they did not deny capability.

If the 2026 ceiling adds about 200k-500k H100-equivalents per year, that is roughly comparable to the H20 fleet the controls removed. It is less efficient, harder to scale, and constrained by memory. It is still real compute.

This is the uncomfortable policy answer.

The controls bought time and imposed cost.

They did not create a permanent wall.

The Claim Ledger

Here is the condensed version of the claim ledger.

The pattern is the whole point.

The blog-facing provenance file turns the ledger into a source trail. Across the 15 condensed claims, the current status is 10 corroborated, 2 partially corroborated, 1 refuted, and 2 contested or unverifiable. That count is less important than the sorting: the claims grounded in audited financials are much stronger than the claims grounded in chip-unit forecasts.

Claims tied to total R&D, inventory, capex, cash, grants, or listed-peer filings usually hold up.

Claims tied to exact Ascend units, secret fab dollars, or near-term millions of chips do not come from Huawei’s filings.

They may be true. They may be false. The filings cannot verify them.

That is not a limitation to bury in the methodology.

That is one of the main findings.

The Best Arguments Against This

The strongest counterargument is still HBM. Huawei may have more memory progress than the public record shows. The new in-house-HBM evidence does not prove that yet. HiBL and HiZQ are real Huawei roadmap items, but they are proprietary memory standards for the 950-series, not disclosed finished-stack volume for the 910C. CXMT has shipped HBM3-class samples to Huawei, but the public evidence still looks like sampling and qualification, not 2026 volume. If that changes, the ceiling changes quickly.

The second counterargument is that the SMIC advanced-node capacity estimate may be wrong. That is fair. The published 7nm-class estimates disagree widely. The reason I still do not think logic is the 2026 gate is that the conservative wafer math leaves several times more logic capacity than the HBM supply can populate.

The third counterargument is that the unit discussion may be too focused on 910C-class high-end accelerators. China could choose a broader mix of lower-end accelerators, domestic memory configurations, and rack-scale systems that create useful AI capacity without matching the high-end 910C envelope.

The fourth counterargument is that the filings are too aggregated to support any strong chip-specific conclusion. I agree with the narrow version of that critique. The filings do not measure Ascend spend or output. The stronger claim I am making is that the filings prove the group-level redirection, and the supply chain bounds the likely physical constraint.

Those are the right places to attack the conclusion. Not “Huawei’s R&D is fake.” Not “China has no AI hardware capability.” The real fight is memory volume, packaging yield, advanced-node allocation, and system-level efficiency.

What Would Change My Mind

There are a few things that would move the conclusion.

First, a real HiSilicon or Ascend segment disclosure. I do not expect this. But if Huawei ever discloses chip revenue, chip R&D, chip gross margin, or unit output, that would replace a lot of assessment.

Second, credible evidence that CXMT HBM3 backend yield is materially better than the current base case. This is the biggest upside break in the 2026-2027 forecast.

Third, evidence that Huawei’s in-house HBM efforts are shipping in volume, not just sampling or appearing on a roadmap. A named fabricator, finished-stack output, customer qualification, or an independent teardown would matter. A press claim that HiBL or HiZQ exists is not enough.

Fourth, node-specific SMIC capacity disclosure. SMIC gives capacity and capex, but not the exact advanced-node mix. The logic-headroom conclusion is robust to a range, but real node disclosure would tighten it.

Fifth, a public reconciliation of Ascend shipments to HBM procurement. If someone can credibly show HBM stacks in and accelerators out, the unit debate gets much cleaner.

Sixth, a meaningful policy change reopening HBM supply. Yeah, I’m laughing out loud too as I type that.

What To Watch

If you are tracking this as an operator, investor, or policy person, I would watch five leading indicators.

First, foreign HBM stockpile exhaustion. That is the single biggest 2026 swing factor, and also the hardest to verify from public evidence.

Second, CXMT HBM3 qualification and yield. Press releases do not matter much. Finished, yield-good stacks do.

Third, Samsung and SK Hynix China-HBM licensing rules. The tap reopening would change the model quickly.

Fourth, Huawei rack-scale systems. CloudMatrix-style systems show how China is compensating for weaker chips: more power, more packaging complexity, more systems engineering.

Fifth, listed-peer inventory and prepayments. Cambricon-style stockpiling is the visible tell that companies are locking scarce domestic capacity ahead of demand.

For U.S. policy, that means the next game is not just GPU export rules. It is HBM controls, advanced packaging, datacenter power, equipment substitution, and how fast allied suppliers can stay ahead while China climbs the stack.

The worst way to follow this story is to argue abstractly about whether China is “behind.”

Behind what?

On lithography, yes.

On HBM, yes.

On ability to build useful AI compute at national scale, no.

On power efficiency, yes.

On willingness to spend through the pain, no.

That is why the Great Power framing matters. A Great Power does not need to be the most efficient actor. It needs to be able and willing to keep taking the punch and keep building.

China is doing that.

Methodology And Uncertainty

The extraction pipeline used public PDFs, annual reports, bond and rating documents, public financial tables, listed-company filings, and reproducible scripts in the research repository.

For Huawei’s own annual-report metrics, extracted values were validated against an independent Huawei bond-investor-relations table without any detected errors. Computed R&D intensity reproduces Huawei’s stated percentages.

For supply-chain and HBM estimates, the confidence is lower because SMIC does not disclose Huawei-specific revenue, advanced-node capacity, or Ascend shipments; CXMT is unlisted; HBM stockpile estimates are heavily analyst-modelled and partly correlated; and packaging yield is not public.

That is why I keep separating filings from assessment.

The most important uncertainty is not whether Huawei is investing heavily. That is settled at group level.

The most important uncertainty is near-term throughput: how many competitive AI accelerators can be packaged with available, yield-good HBM.

The second most important uncertainty is how quickly China’s memory stack improves.

The third is how much worse power efficiency matters in practice. If Chinese customers have enough power, enough datacenter capacity, and enough political direction, worse perf/W is a tax. If power or cooling becomes binding, it becomes a wall in specific deployments.

Bottom Line

Huawei’s filings show a heavy, audited, sanctions-driven redirection of investment toward self-sufficiency.

They show the R&D step change.

They show the component stockpile.

They show the cash.

They show some state support.

They show self-funded capital projects.

They do not show Ascend as a clean line item.

The supply chain and listed peers fill in the rest of the picture. SMIC and the equipment makers show the physical buildout. Cambricon, Hygon, and the IPO cohort show the indigenous AI-chip pattern Huawei hides. The HBM model shows why memory and packaging, not Huawei’s wallet, gate the 2026 ceiling.

So the honest conclusion is a confident qualitative yes and a constrained quantitative no.

Yes, China is an AI Hardware Great Power.

Yes, Huawei is investing heavily and building real capability.

No, Huawei’s public filings cannot validate the most dramatic chip-specific claims.

No, the 2026 ceiling does not look like a few million high-end Ascend accelerators unless the HBM story changes.

The trajectory is up and to the right.

The constraint is memory.

Part 2 asks the mirror-image question: if China can keep building constrained domestic hardware, are its model builders and cloud companies investing at American hyperscaler scale?

The strategic mistake would be treating “less efficient and supply-constrained” as the same thing as “not capable.”

It is capable.

It is taxed.

That is not the same thing.

That explanation sounds clean. It also sounds like one of those explanations that gets repeated because it feels sophisticated, not because the person has seen the math.

As a CEO you develop a pretty effective B.S. detector because you are ultimately responsible for areas far outside your domain expertise, and you need to know when to bring in outside rigor because something feels off.

Needless to say, my B.S. detector went off. As a board member and CEO you have to really care about stock price since it’s what your investors (and colleagues/employees) really care about.

So I pulled the data, built the models, sent the answer through a series of adversarial checks, and made the agents keep refining until my understanding truly converged. The project started as a tax and dividend question, wandered through buybacks, acquisitions, valuation history, discount rates, profit shares, superstar firms, monetary aggregates, cross-country panels, and forward-return models, and eventually landed on the question I actually cared about:

Why are equities so expensive? What should Boards and CEOs do (differently) because of it?

The answer is annoying in the way useful answers often are.

The market is not mostly pricing in future earnings growth.

The market is pricing a lower expected return, on top of a profit base that really did get larger.

Those are very different claims.

Results Up Front

This is long, and I do not expect most people to read the whole thing. The rest of the post tells you how I got here. And caveat lector, the research run was current as of June 3, 2026.

The decision-useful version is this:

U.S. equities are expensive by almost every long-history gauge. CAPE (Cyclically Adjusted Price-to-Earnings ratio which indicates if the stock is over- or under- valued) sits in the 90th-plus percentile of history. Corporate equity value relative to GDP is also in the 90th-plus percentile. Dividend yield says the same thing. The one big exception is total shareholder yield, because buybacks replaced dividends as the dominant way companies return cash.

The common explanation, “the market is pricing in future earnings growth,” mostly fails.

The major valuation drivers are:

Note that most of those drivers are strongly influenced by public policy: interest rates, corporate tax rate, and if whatever grand bargain Society reaches in the AI age results in some form of employee compensation or safety net (I wrote about this last week).

I did draw conclusions on how to better run a company based on the actual data. I’m going to leave those at the end of the article since if you’re running a company, you have a fiduciary duty of care that means you don’t get to read the cliff notes version.

Nothing in this post is financial advice. It is a research project trying to replace a vague story with data driven conclusions.

What I Measured

The project used only free public data. That constraint matters because it forced the study to separate what could be measured cleanly from what would require buying CRSP, Compustat, I/B/E/S, MSCI, and deal databases.

The core datasets were Shiller’s long U.S. valuation data, Damodaran’s implied ERP and payout data, FRED and BEA corporate-profit series, the Fed Z.1 accounts, World Bank market-cap/GDP data, the Jorda-Schularick-Taylor macrohistory panel, and a firm-level earnings panel built from SEC EDGAR XBRL frames.

The workflow became iterative as I became less dumb on the topic:

• First, confirm that equities are actually expensive.

• Then test whether high valuation predicts future earnings growth.

• Then decompose the discount rate.

• Then test whether the earnings base actually changed.

• Then test money supply.

• Then test composition and concentration.

• Then test the international/historical base rate.

• Then try to break the answer with side projects and adversarial verification.

The adversarial checks mattered. Several first-pass conclusions were softened or corrected. The profit-base story changed from “mostly tax” to “roughly equal margin and tax.” The German market story got corrected. The profit-share durability question got pushed all the way to the free-data wall and came back unresolved.

That is what should happen in a real research project. I learned how to ask the questions better, then learned better answers.

Finding 1: Yes, Equities Are Expensive

Before explaining anything, the first question was whether the premise was true.

It is.

The U.S. market is expensive by almost every deep-history gauge:

• CAPE was about 28 in the full-year long-history snapshot, versus a historical median around 16; later sensitivity runs put it in the low 30s. Either way, it was historically high.

• Corporate equity value was about 157% of GDP in the long FRED-based gauge, versus a median around 69%; the latest cross-country market-cap/GDP snapshot put the U.S. around 216%.

• Dividend yield was about 1.7%, versus a historical median around 4.1%.

• Earnings yield was about 3.5%, versus a historical median around 6.2%.

Those are 90th-plus percentile readings.

The cross-country picture says the same thing with a caveat. U.S. market-cap/GDP is extremely high, but market-cap/GDP is a noisy cross-country gauge because it is distorted by listing structure, financial-system structure, and foreign revenue. Much of the U.S. economy is publicly traded on stock exchanges. Germany, not so much. That does not make the U.S. cheap. It means market-cap/GDP is a useful warning light, not a clean country-ranking machine.

The one metric that did not scream “extreme” was total shareholder yield: dividends plus buybacks. That was around its 2001-2022 median. That matters because the dividend yield alone is partly lying to us. Companies did not simply stop returning cash. They relabeled a large share of it from dividends into buybacks.

That was the first clue.

The market is expensive in the capitalized value of earnings and GDP, not because cash return to shareholders vanished.

Finding 2: High Valuation Does Not Predict High Earnings Growth

This was the decisive test.

If the folk explanation is right, high CAPE should forecast high future real earnings growth. That is the claim hiding inside “investors are pricing in future earnings.”

It does not.

Across the long U.S. dataset, starting CAPE explains essentially none of the next decade’s real earnings growth. The R2 is about 0.01 (explains only 1%). The t-stat (measures real signal vs noise) is about 0.8. That is not a hidden signal. That is noise.

Starting CAPE does predict future real returns. The R2 is about 0.26 over 10-year horizons, and the sign is exactly what valuation theory says it should be: higher starting CAPE, lower future returns.

The result gets stronger with horizon. At one year, valuation is a weak predictor. At five years, better. At ten years, meaningful. That is what you would expect if valuation is not a short-term trading signal but a long-horizon expected-return anchor.

The Bogle decomposition into quartiles makes this intuitive.

Cheap starting markets (Quartial Q1 in the graph) produced strong subsequent returns because investors got more income and multiple expansion. Expensive starting markets (Quartial Q4) produced weaker subsequent returns because investors got less starting income and multiple compression. Earnings growth was not the thing doing the work.

In fact, the expensive quartile had slightly higher realized earnings growth than the cheap quartile. Investors still earned much lower returns because they paid too much for those earnings.

That is the part people miss.

Great businesses can be bad investments at the wrong price. The whole market can do the same trick. Now I understand why Warren Buffet sat on the sidelines for so long.

Finding 3: The Big Historical Rerating Was Mostly Real Rates

Once “expensive” becomes a discount-rate (the return investors require to own an asset) question, the next step is decomposing the discount rate.

The cleanest version used Damodaran’s measured implied equity-risk-premium series, not the lazy earnings-yield-minus-bond-yield residual that quietly smuggles valuation into the answer.

The result:

• Real cost of equity was about 9.1% around the 1980-82 rate peak.

• Real cost of equity was about 4.9% around the 2020-22 valuation peak.

• About 94% of that decline came from the real risk-free rate.

• The equity risk premium did not secularly collapse. It mean-reverted to historical norms.

That distinction matters because it separates 1999 from 2021.

The dot-com peak was an equity-risk-premium compression event. Euphoric investors demanded very little premium.

The 2021 peak was more of a real-rate event. Investors still demanded a normal-ish premium, but they put it on top of a near-zero real rate.

Those are not the same bubble.

But there was a problem. Real rates rose again in 2023-25, and CAPE stayed high. A pure discount-rate model should have de-rated the market harder. It did not.

That is where the earnings base enters the story.

Finding 4: The “E” Actually Got Bigger

The strongest version of the skeptic’s argument is this: aggregate earnings cannot outgrow the economy forever.

Correct.

But they can outgrow the economy for a long time if the profit margin rises. That is exactly what happened.

After-tax corporate profits rose from about 6.6% of GDP in the early post-war baseline to about 10.8% in the recent period. Real after-tax profits grew about 3.2% per year from 1947 to 2025, versus real GDP at about 2.8%. The excess is not magic. It is a level shift.

The first-pass model said the rise was mostly a tax story. The deeper decomposition corrected that. The better answer is roughly equal between tax breaks, and the share of profit going to employee compensation.

That is an important correction.

Lower corporate taxes directly impacted share prices. Effective corporate tax rates fell dramatically. But the operating margin side mattered too, especially through labor share and market power. Capital took a bigger slice from labor and from the government.

This resolves the paradox without validating the hype.

The higher profit base justifies a higher level of valuation than a naive 20th-century CAPE mean would imply. But it does not justify assuming earnings can compound faster than the economy forever. The corporate profit share cannot exceed 100%. Tax rates cannot fall from the current research-run level by another 30 percentage points. Globalization cannot be discovered twice. Buybacks cannot shrink share counts below zero.

These are bounded level shifts.

They raise the level.

They do not create perpetual escape velocity.

Finding 5: Money Supply Was in the Story, but Not the Way People Think

I also wanted to test the monetary explanation because it feels directionally right.

From 2008 to 2022, M2 (measure of the money supply: cash, checking deposits, savings deposits, money market funds, and other very liquid money-like assets) rose about 2.6x. The Fed balance sheet rose about 3.8x. CPI rose only about 1.4x. A lot of money did not show up as consumer-price inflation for a long time. The pattern is consistent with money working through asset prices and rates.

So yes, money mattered.

But when the model controlled for the real rate, excess money added essentially nothing. The R2 stayed about 0.136. The incremental R2 was basically zero.

That is the gate test. If money has an independent real-valuation channel beyond rates, it should show up there. It did not.

The best reading is:

• Low inflation supports high P/E.

• QE (Qualitative Easing) pushed into asset prices and lower real rates.

• Money worked through the discount-rate channel.

• Money did not independently make real earnings grow faster than real prices.

This is one of those places where a folk explanation is not crazy. It is just imprecise.

“Money printing made stocks expensive” is too blunt.

“Monetary policy helped suppress real discount rates, which raised asset values” is closer.

Finding 6: The Index Became a Different Animal

The composition story also survived, but it did not become the whole story.

The SEC EDGAR firm-level panel showed earnings concentration rose. The top 10 firms earned about 21% of total positive earnings in the early comparison window and about 28% by 2024. S&P 500 top-10 market-cap weight rose from about 18% to about 37%.

That means mega-cap dominance is not pure hallucination. A lot of it was earned.

The deeper firm panel sharpened the point: concentration rose in profits and R&D, not revenue. The superstar firms do not just sell more. They earn more. Their margins diverged.

But composition is not enough to carry the whole valuation story. A stylized sector-mix decomposition put the pure mix effect around one-fifth of the CAPE rise. The rest was broad re-rating.

That is the right scale.

The market is partly more expensive because it is a better, more profitable, more global, more capital-light index. But most of the rerating still has to be explained by lower discount rates and a higher profit base.

[And five of the top-10 mega-cap companies are now plowing capital into data centers and GPUs now so they are ceasing to be capital-light.]

Finding 7: The Original Tax Hypothesis Was Right in the Wrong Place

The research project started with a different hypothesis: maybe the tax preference for capital gains over dividends pushed firms away from dividends, into buybacks and acquisitions, and lifted valuations.

That hypothesis partly survived, but not where I expected.

The tax wedge is real. The statutory dividend penalty mostly disappeared in 2003 when qualified dividends were taxed at capital-gains rates, but the structural advantage of capital gains remained: deferral and step-up basis. If gains are deferred until death and stepped up, the effective capital gains tax can be zero.

That is a real incentive.

It strongly explains payout form. Buybacks went from essentially zero before the 1982 Rule 10b-18 safe harbor to the majority of shareholder payout. Net equity issuance flipped into persistent net repurchases. Dividend payout ratios fell. Total payout stayed much more stable than dividend payout.

So the tax story explains the relabeling of cash returns.

It weakly explains aggregate valuation.

The timing is wrong, the real-rate confounder is too large, the equity ownership base became much less taxable, and cross-country tax wedges do not produce a clean valuation ranking. Taxes mattered for corporate behavior. They are not the main reason the whole market trades at a high P/E.

This was one of my more useful failures in the project.

The tax hypothesis was not wrong. It was aimed at the wrong dependent variable.

The Attribution That Survived

After all the stages, side projects, and adversarial checks, the attribution looked like this:

Do not treat those percentages like a clean physical identity. They are a synthesis across different parts of the valuation equation, not one regression with perfectly additive coefficients.

But the ranking is useful:

• Lower real rates are primary.

• The higher profit base is major.

• Composition is meaningful but secondary.

• The equity risk premium is not the main story.

• Money works through rates.

“Pricing in future earnings growth” is the wrong description for the aggregate market.

Where the Data Stops

The project eventually hit a wall, and the wall is important.

The central unresolved question is not “are equities expensive?” They are.

It is not “does valuation predict future earnings growth?” It does not.

It is not “did the profit base rise?” It did.

The central unresolved question is whether the elevated profit share is durable.

That is the forward-return hinge.

If the higher profit base persists, the June 2026 valuation level is much more defensible. It can still imply low returns, but it does not require an immediate collapse. If the profit share reverts, expected returns are materially lower.

We attacked this several ways. The U.S. time series could not distinguish permanent from slowly mean-reverting. The cross-country panel had more power, but after correcting dynamic-panel bias it also could not resolve the U.S.-relevant common factor. The best honest answer was that the question is statistically unidentifiable on free data.

That is unsatisfying. It is also the answer.

The durability bet decomposes into three practical risks:

• Margin/labor-share reversion (employees make a larger share of the profit).

• Tax-policy reversal.

• Rates and net-interest normalization.

The biggest identifiable reversion risk is if society’s eventual grand bargain with AI moves money to employees pockets from corporate profit. A tax reversal is also material. Rates matter, but less than the margin and tax channels for this specific profit-share durability question.

Those are all driven by public policy. Much of the run-up in the stock market derives from past changes in the law and regulations. If/when our democracy chooses to change policy again, then the changes will also affect peoples’ 401k accounts. Those changes can move in either direction.

How I Would Use This Knowledge When Running a Company

This is where the research stopped being an equity-market project and became a boardroom project.

The core lesson is “stop managing the company as if today’s valuation environment proves your strategy.” Today’s valuation environment proves yesterday’s public policy priorities.

If I Were Running a Private Business

For a private business CEO, the biggest mistake would be importing public-market logic into a private company that does not have public-market liquidity.

When public multiples are high, everyone downstream starts behaving as if terminal value is free. Private-company owners hear higher EBITDA multiples. Founders hear that buyers will pay for growth. Boards hear that strategic scarcity matters. Lenders and investors underwrite exits using comps that may already embed low expected returns.

That is dangerous.

If I were running a private business, I would do four things based on this project’s data:

First, I would run the plan on cash yield, not just exit multiple. The public market can accept a lower return because the buyer has liquidity, diversification, and daily pricing. A private company owner does not. If the business cannot generate cash at an attractive yield to the actual owners, I would not let a spreadsheet terminal multiple rescue the strategy. Or more succinctly, Cash is still King because the valuation multiple is too much a function of public policy.

Second, I would raise the bar for “growth.” Growth is valuable when it creates durable cash flow at good incremental returns. Growth is not valuable merely because revenue went up. This project kept finding the same distinction: the market rewards durable profit bases, not just activity. For a small company that means pricing power, customer retention, gross margin, low churn, operational repeatability, and a sales motion that does not require heroic founder intervention.

Third, I would treat labor productivity as a strategic project. The biggest unresolved valuation risk is how much profit goes into employee compensation vs corporate profit. We can manage this risk by focusing on increasing employee productivity. More output per person to grow into more market share. That results in both higher compensation, and higher corporate profit. Tactically, I would look hard at every workflow where hiring more people has become the default answer. AI matters here, but not as a bumper sticker. The question to ask is how to increase output per person, instead of increasing people to increase output.

Fourth, I would make the board packet more macro-aware without turning it into a macro meeting. I would add a simple page that shows:

• Revenue growth versus gross margin.

• Headcount growth versus output.

• Pricing changes versus wage and vendor inflation.

• Cash conversion, not just EBITDA.

• Debt repricing dates and liquidity.

• A downside case with lower exit multiples.

Those are the macros that a business can control. A small board does not need a forty-page macro deck. It needs to not confuse a high-comps environment with proof that the business is compounding intrinsic value.

If I Were Running a Public Business

I have never run a public business, and all of my mentors who have run a public business swear they’ll never do it again. So I’m gonna limit myself to reading the data.

First, the market rewards capital allocation discipline. In the top graph, we see dividends rise steadily and barely dip; but buyback dollars are volatile and were slashed hardest when stocks were cheapest (CAPE 15–20) and the next-5-year real return was highest (+13–16%/yr). On the left graph we see companies buying back their stock regardless if the price is cheap or expensive. The right graph is the lesson: higher total shareholder yield (returning capital when it’s cheap to do so) predicts higher subsequent returns (corr +0.35), but buyback intensity itself shows no timing skill (corr +0.08). So the reward is for returning capital at a good price, not for buying back per se.

Second, the market rewards M&A discipline. In the top graph, we see that companies acquire most when valuations are expensive. In the left graph, we see how M&A valuations appear on the acquirers balance sheet as goodwill and 20% is ultimately written off as impairment. And the right graph is the lesson: the market doesn’t reward buying high. Heavy-M&A years are followed by low subsequent real returns and the low-M&A bust years preceded the best. I don’t otherwise have data to show the difference between a good M&A and those which end up as write-offs.

Third, margins are heavily influenced by public policy. On the top graph we see a post-2000 step increase in corporate profits that are mostly a decrease in profit allocated to employee compensation and corporate tax changes. On the left we see it is a global change. And on the right we see how much of the profit margin depends on these external factors. The margin and thus the stock price are heavily influenced by public policy. Corporations are heavily incentivized to get involved in politics.

Fourth, be careful around investor communication. Much of your share price derives from public policy which you do not control. If you communicate that your share price is based on forward revenue, and public policy change lowers your stock price, then your investors will hear your future revenue expectations are lower. That’s a double whammy. Stake your claims on something you can control.

The Bottom Line

The clean dinner-party explanation is wrong.

U.S. equities are not expensive mainly because investors have magical visibility into future aggregate earnings growth. High valuation has historically forecast low future returns, not high future earnings growth.

The better explanation is:

The real discount rate fell globally. That mechanically raised the value of long-duration cash flows. At the same time, the after-tax corporate profit base rose through a bounded mix of higher margins, lower labor share, lower corporate taxes, global revenue exposure, and buybacks. The index also became more concentrated in firms that genuinely earn more. Money supply helped through rates. Taxes helped reshape payout into buybacks, but they were not the main P/E engine.

That combination makes the current research-run valuation partly justified and still expensive.

The most honest forward-looking statement is conditional. If the elevated profit share persists, U.S. equities can grind out low real returns from a high plateau. If margins or tax rates mean revert, the valuation support weakens. If multiples revert too, returns can be negative.

That is the thing to internalize.

Expensive does not mean the market knows earnings will boom.

Expensive means the market has already accepted a lower return.

At the end of every board of directors meeting we always went into executive session. Those were my favorite part of board meetings. The formal meeting had a pre-read, motions, approvals, committee reports, and all the other machinery that makes corporate governance work. Executive session was different. A handful of smart people got to sit around and talk about what they were actually worried about.

One of those conversations once revolved around a simple question: what if we want to IPO someday?

One of the arguments against it was the ubiquitous perception that once a company filed for an IPO it would have to deal with nuisance lawsuits during the quiet period. My definition of a nuisance lawsuit is a baseless lawsuit aiming for a settlement that costs less than the lawyers’ billable hours to get it dismissed. More colloquially, it is a shakedown.

During parts of an IPO, the company is inside an SEC-regulated quiet period. It cannot freely talk in public. So if someone files a contrived lawsuit during that window, the company cannot defend its reputation the way a normal private company might. It has lawyers, bankers, auditors, SEC comments, investor roadshow preparation, employee questions, board pressure, and a ticking clock. The extortion logic is obvious: file something embarrassing, make it cheap enough to settle, and dare the company to risk the IPO timeline over principle.

I obviously feel pretty strongly here. I have dealt with my share of attempted shakedown nuisance lawsuits, and never gave in to the attempted bullies.

One of the things I have been doing on sabbatical is researching the “I wonder” thoughts that pop into my head. With all the chatter about possible SpaceX, OpenAI, and Anthropic IPOs, this one came back. I wanted to test the startup community’s folk wisdom: do companies get swamped by shakedown lawsuits while they are trying to go public and cannot defend themselves?

So I pulled public data and built the study.

The question: what do the SEC, federal dockets, Delaware courts, and IPO filings show about lawsuits during the IPO run-up compared with the before-S-1 and after-IPO periods?

The answer is annoying in the way useful answers often are.

I was right about the general direction. Going public really does attract lawsuits.

I was wrong about the clean version of the mechanism. The SEC quiet period is not where the data says the generalized shakedown spike lives.

Those are my favorite experiments.

Results up front

This is long, and I do not expect most people to read the whole thing. The rest of the post tells you how I got here. The headline result is this:

The quiet-period shakedown hypothesis, as a population-level claim, does not hold up. Companies in the SEC quiet period are sued a little more often than in the 180 days before filing the S-1, but not enough for me to trust it as a separate phenomenon. The confidence intervals overlap. The shakedown-like score is not higher in the quiet period. If anything, the quiet period looks less shakedown-heavy than the before-S-1 and mature public-company windows.

But the broader intuition is real. Companies going public attract much more litigation than companies staying private.

The rate for stayed-private Form D companies was 363 federal cases per million company-days. IPO companies were already at 1,092 per million company-days in the 180 days before filing the S-1. They were at 1,156 during the quiet period. They were at 1,444 in the first roughly 25 trading days after pricing. In the two years after the IPO, they were at 1,912.

That is the big reframing. Becoming a public-company-in-progress appears to carry a roughly 3x litigation premium before the S-1 is even filed, and a roughly 5x premium after the company is public.

So if your question is, “Should I be afraid that filing an S-1 creates a unique quiet-period shakedown window?” my answer is mostly no.

If your question is, “Does going public move the company into a different litigation environment?” my answer is yes. Very much yes.

The core table

The specific quiet-period step from W1 to W2 is only about 6%. W1’s 95% confidence interval was 1,009 to 1,175. W2’s was 1,039 to 1,272. Those overlap. I would not build a board-level theory on that difference.

The public-company transition, however, is not subtle.

What I measured

I built the IPO universe from SEC EDGAR filings, not from a commercial IPO database. The heuristic was deliberately mechanical: a company needed the S-1 or F-1 registration statement, the 424B final prospectus, and the 8-A exchange registration sequence that marks a real public listing. SPACs and blank-check companies were filtered out.

Final universe: 3,399 non-SPAC U.S. operating-company IPOs priced from January 1, 2010 through May 26, 2026.

Then I matched those companies against two federal lawsuit corpora:

• 27.6 million CourtListener federal civil dockets through March 31, 2026.

• 4.58 million Federal Judicial Center Integrated Database cases, which have richer plaintiff, defendant, disposition, class-action, and procedural fields, but effectively end around 2021.

The FJC data is better for understanding case outcomes. CourtListener is better for modern coverage. So the study uses both.

I split each IPO timeline into the windows that matter legally:

The name matching is always the part of this kind of study where the bad data tries to kill you. Corporate names are messy. Subsidiary names are messy. Former names are messy. “Hudson” is a company name, a person name, and an invitation to false positives.

So I used strict name normalization and fuzzy matching, then LLM verification to estimate false positives. That matters because a naive docket match overstates the litigation rate. A lot of cases that look like company matches are not the same corporate entity.

The article numbers use the verified true-positive estimates where available. The exact decimals are less important than the shape:

stayed private -> pre-S-1 -> quiet period -> post-pricing -> public-company baseline.

The line goes up.

But the quiet-period step is not the story.

Finding 1: the quiet-period spike mostly is not there

The thing I expected to see was a lawsuit pileup inside W2, the S-1-to-pricing quiet period. That is the window where a company is preparing for the roadshow, working through SEC comments, and trying very hard not to create a new disclosure problem.

If nuisance lawyers were timing lawsuits to maximize leverage, this is where I expected them to show up.

They did not show up at the population level.

W1 was 1,092 true-positive cases per million company-days. W2 was 1,156. That is directionally higher, but barely. W3 was 1,444, and the post-IPO two-year baseline was 1,912.

The Facebook-style post-pricing stock-drop burst is real. The mature public-company lawsuit environment is real. The quiet-period shakedown wave, as a generalized IPO deterrent, is not.

That does not mean no shakedowns happen during the quiet period. They do. I found them. Yes, they still made me mad.

It means the founders’ common wisdom is overfit to the most emotionally salient cases. If a founder hears about a startup being sued five days before pricing, that story lodges in the brain. It lodged in mine. But the rate data says that story is not the dominant structure.

Finding 2: going public is the litigation event

The private-company baseline changed how I read the whole project.

I sampled 5,000 stayed-private companies from the set of issuers that filed multiple Form D notices but never filed an S-1. The observation window was first Form D through last Form D plus 730 days, capped at March 31, 2026. Then I matched those companies against CourtListener dockets the same way.

The stayed-private rate was 363 federal civil cases per million company-days.

By the time a company is in the six months before its S-1, the rate is about 3x that. That is before the public filing. Before the quiet period. Before CNBC knows what to say about the ticker.

Some of this is selection. IPO companies are larger, richer, more visible, more likely to have national operations, and more likely to be in regulated markets than the average Form D filer. A perfect test would compare IPO companies to size-matched, industry-matched, late-stage private companies. That probably requires PitchBook, Crunchbase, or another commercial data source.

But selection does not make the result unimportant. If you are a founder, C-suite, board member, or investor, you do not care whether the lawsuit premium is metaphysically caused by the S-1 or by the company becoming big enough to file one. You care that the company is entering a litigation environment with a different base rate.

That is the thing to plan for.

Not “quiet period equals lawsuit ambush.”

“Public-company transition equals lawsuit magnet.” I would hire a general counsel ahead of an IPO.

Finding 3: company size matters

Lawsuits scale with company size. That is not surprising, but the slope is useful.

Large IPOs face about 3x the quiet-period lawsuit prevalence of small IPOs. But again, the quiet-period column is not the most dramatic column. The post-IPO two-year baseline is.

By the time a large company has been public for two years, half of them have at least one matched federal civil case.

This is where I think a lot of private-company boards misunderstand the tradeoff. They talk about IPO litigation as if it is a special ambush during the transaction. The transaction matters, but the bigger change is that the company becomes visible, liquid, analyst-covered, plaintiffs-firm-searchable, and governed by a very different disclosure regime.

You did not just ring a bell. You changed the company’s surface area.

Finding 4: quiet-period cases are not especially shakedown-like

I built a shakedown composite score because “that feels like a shakedown” is not a methodology.

The score is crude but took my emotion out of it. It gives one point for each objective signal:

• Fast resolution.

• Dismissal-like or low-value resolution.

• Repeat plaintiff.

• Minimal docket activity.

• Solo individual plaintiff.

• No-press signal, which is currently a placeholder because I did not need to integrate a news database for the patterns to jump out.

Composite score ranges from 0 to 6. I treated 3 or higher as shakedown-like.

On the FJC-scored subset, the quiet period did not stand out:

This is the part that most directly cut against my prior. If the quiet period were uniquely attractive to nuisance plaintiffs, W2 should have had a visibly higher shakedown-like share. It did not.

But the aggregate hides some interesting pockets.

The W2 quiet-period cases that looked most shakedown-like were not primarily securities cases. They were small personal-injury claims and Fair Labor Standards Act wage-and-hour cases. I had the model review 48 W2 cases in those buckets. Ten looked shakedown-like. None were textbook mobster-movie shakedowns, but some were exactly the kind of narrow, badly timed lawsuit a company might pay to make disappear.

Examples:

• Airbnb had a personal-injury claim filed 7 days before IPO pricing.

• US Foods had an individual personal-injury case resolved in 22 days.

• HD Supply had an individual FLSA case filed shortly after the S-1 and ended through motion judgment dismissal.

• Ignite Restaurant Group had a personal-injury claim filed on the IPO pricing date and resolved in roughly two months.

That is real. If you are the GC or CFO inside that transaction, you do not get to dismiss it as “not statistically significant.” You have to deal with it while everything else is on fire.

But at the market level it is a small cluster, not the structural reason companies stay private.

Finding 5: there are trolls under the bridge

I expected the repeat-law-firm map to be messy. It was not. The top repeat plaintiffs targeting multiple IPO issuers around the run-up windows were overwhelmingly patent assertion entities.

Those seven plaintiffs filed 217 total federal cases between 2009 and 2021 in the study corpus, overwhelmingly patent cases.

This is the most industry-like pattern I found. It is not mass litigation against every IPO company. No repeat plaintiff was carpet-bombing the IPO universe. But the character of the data is consistent with patent assertion entities understanding that a company in the IPO pipeline has a different settlement calculus.

The twist is that patent cases during the quiet period did not score as especially shakedown-like under my simple composite. That may be because the composite is better at detecting low-effort nuisance suits than patent monetization campaigns. A patent case can be a shakedown and still require a real docket, much higher priced lawyers, and enough procedural substance to avoid looking like a one-page demand letter with a case number. Or maybe the IPO filing is what brought an infringement to the patent owners’ attention. I’ve never been on either side of a patent fight so I don’t have a good gauge if these were nuisance or legitimate.

Consent judgment matters here. A consent judgment is not evidence that a case was serious. It is often exactly what a successful settlement looks like: both sides agree to end the fight, the defendant removes uncertainty, and nobody has to find out how much or little substance the patent had.

The better signal is speed. Across the LLM-flagged non-disclosed cases, about 43 resolved in under 90 days. That is the zone where the “pay them to go away before the IPO” theory becomes plausible.

So yes, patent assertion entities are part of the story. They are just not the whole story.

Finding 6: the S-1 disclosure story is noisy, not scandalous

I also wanted to know whether companies were hiding these lawsuits from IPO investors.

For the 323 IPOs with a matched pre-IPO federal civil case in W1 or W2:

• 69.0% disclosed pending litigation in the S-1 legal proceedings section.

• 7.1% had only boilerplate “from time to time” language.

• 23.8% had no specific litigation language.

That sounds bad until you compare it against IPOs without a matched pre-IPO case:

• 66.3% disclosed pending litigation.

• 6.3% had boilerplate only.

• 27.3% had no specific litigation language.

In other words, the S-1 legal-proceedings language is noisy. Lots of companies disclose litigation risk generically or disclose ordinary-course matters. The presence of a matched federal pre-IPO case did not create a giant visible disclosure gap.

So I did a deeper review of the 100 non-disclosing IPOs with W1/W2 matched federal cases. Two different LLMs judged the same case-company pairs for entity match and whether the case should have been disclosed. The aggressive OpenAI pass flagged more than my local Nemotron (and I was already out of Claude API tokens today). The more defensible cross-LLM consensus set was 66 cases across 39 distinct IPOs.

That is 1.1% of the 3,399 non-SPAC IPO universe.

Names in the consensus set included Alibaba, General Motors, DoorDash, FireEye, Hilton, Twilio, Palo Alto Networks, Peloton, Robinhood, Chegg, Berry Plastics, Acacia Communications, Berkeley Lights, ContextLogic, Coursera, Freshworks, JELD-WEN, Natera, SendGrid, SmileDirectClub, and loanDepot.

That is not zero. It is not even uninteresting. Some of those should make securities lawyers sweat.

But it is not a giant hidden population of companies secretly shaken down in silence before going public.

A realistic broader estimate is probably 60 to 100 IPOs out of 3,399 with some combination of non-disclosed pre-IPO litigation and nuisance-settlement signatures. Call it roughly 2% to 3% on the high side. The clean consensus number is closer to 1%.

Small in absolute terms. Painful if you are in the unlucky set.

Finding 7: Delaware Chancery was a dead end

One theory was that federal dockets were missing the real action because pre-IPO shakedowns might be hiding in Delaware Chancery.

I probed Delaware Court Connect for the 100 non-discloser IPOs across the S-1 minus one year to pricing plus one year window.

There were 273 Delaware hits:

That makes sense after thinking about it for ten seconds longer than I initially did. Chancery fiduciary-duty litigation generally requires shareholders. Before the IPO, the future public shareholders do not exist yet. After the IPO, Chancery becomes relevant. Before the IPO, not so much.

California Superior remains the state-court gap I most want to close, especially for ADA tester and California employment cases, but they hide their cases behind a captcha that makes this type of mass study tricky. Regardless, Delaware Chancery is not where the missing quiet-period shakedown wave is hiding.

What I got wrong

My mental model was too transaction-centered.

I thought the quiet period itself was the vulnerability: the company cannot talk, so plaintiffs time lawsuits for maximum reputation pressure.

That mechanism exists. I still believe it exists. I found examples consistent with it.

But the data says it is not the dominant structure. The dominant structure is visibility, scale, liquidity, and becoming searchable in the machinery of public-company litigation.

The nuisance lawsuit risk does not start when the SEC quiet period starts. It starts before the S-1, when the company is already large enough, visible enough, and rumor-visible enough to be an IPO candidate. It grows after pricing, because now the company has public shareholders, daily stock movement, analysts, short sellers, plaintiffs’ firms watching the chart, and a much larger disclosure target.

That is the thing I did not understand before.

The boardroom folk wisdom was directionally right and mechanistically wrong.

That distinction matters. If you solve for the wrong mechanism, you build the wrong defenses.

What this means for founders and boards

Do not stay private because you are afraid of a generalized quiet-period lawsuit ambush. The data does not support that as a market-level reason.

Do treat the IPO process as the start of a new litigation regime.

The practical work starts earlier than most companies want it to. I could give you a list of all of the things you should do to pre-emptively mitigate nuisance lawsuit risk. But you’re paying your investment bankers and external counsel a small fortune and this is one of the areas they really earn their keep.

I now understand, viscerally, why public companies hire internal General Counsel. Not “a lawyer.” Not “outside counsel can handle it.” A real internal owner whose job is to understand the company’s risk surface, the disclosure regime, and that capitulating to a bully once will lead to more bullies.

The private-company instinct is often to treat legal as a cost center. The public-company reality is that legal becomes part of the operating system.

The answer

Is the common wisdom wise or foolish?

Both, which is the most annoying answer and usually the correct one.

Foolish version: “The SEC quiet period creates a wave of nuisance lawsuits that is a major reason companies stay private.” The data does not support the litigation wave, even if founders believe it.

Wise version: “Going public changes the litigation environment, and companies should expect more fights.” That is strongly supported.

The difference between a stayed-private company and a post-IPO public company is about 5.3 times as many federal civil lawsuits per company-day in this dataset. Even before the S-1 is filed, IPO-bound companies are already at about 3 times the stayed-private rate.

Someone once gave me a signed Babylon 5 (Science Fiction TV show) photo, and I added one of the show’s quotes to it: “Never start a fight, but always finish one.”

I still believe that when dealing with shakedowns.

I also understand the public-company version better now. Going public does not just create one big transaction. It creates a company that has to finish many more fights. Some are real. Some are nonsense. Some are timing weapons. Some are the predictable cost of being large, visible, liquid, and worth suing.

As someone who never gave in to a threatened shakedown lawsuit, that is a lot of fights to finish.

And now I understand why the General Counsel has an office next to the CFO.

It is not just technology change.

If there is one thing that unites a surprising amount of society right now, it is hostility to data centers and fear that AI is going to take their job. The data center backlash is local, bipartisan, and visceral. The job fear is broad enough that it shows up in Hollywood contracts, copyright lawsuits, state AI laws, federal preemption fights, board conversations, and the ambient dread in every “what should my kids study?” conversation.

I wanted to understand this with data instead of doom scrolling.

So I turned it into an agent research project. I had the agents build event corpora for 19th century Industrial Revolutions in several countries, score the events, compare them to the AI era, try to break their own answer, and then project what survived forward into today. They say that history doesn’t repeat itself, but it rhymes. The AI Revolution rhymes with the German Industrial Revolution.

Results up front

This is long, and I do not expect most people to read the whole thing. The rest of the post tells you how I got here. This section is the part I would actually make decisions from.

The result is what follows if today’s AI revolution is closer to Germany’s industrial revolution than Britain’s or America’s. Britain and America still matter. They bracket the German path. Britain is the cleaner bull case. America is the higher-growth, higher-crash-risk bear case.

The central estimate says AI discontent normalizes in the late 2020s, with 2027-2028 as the planning case and 2024-2032 as the honest window.

Normalization does not mean people stop being angry about AI. People are still angry about industrialization. It means the conflict becomes legible and routinized. The state decides who carries the downside risk of AI, who pays for worker adjustment, what liability regime applies, how much local control survives, and which political factions own the issue.

The Germany path normalizes through institutions. In the historical German case, that meant compulsory social insurance, worker-protection law, political accommodation, and the incorporation of labor into ordinary politics. In the AI case, the analogues would be AI displacement insurance, worker retraining funds, model liability, bargaining rights, federal/state settlement, and a mass political faction built around AI adjustment.

Before normalization, I would expect five fights to merge:

• data-center backlash becomes a national energy, water, tax, and local-control issue

• AI labor fights move beyond artists, writers, actors, and coders into ordinary white-collar and service work

• liability becomes unavoidable because companies cannot deploy into hidden legal risk forever

• state-by-state AI governance collides with a technology that wants national scale

• under the US-bear bracket, capital markets test the AI story if valuations, private credit, power commitments, and data-center capex outrun social permission

Personal income is the part that matters most. The Germany path is the only analogue where workers eventually do better than productivity alone would predict. In the historical data, German real wages ended the period about 30% ahead of GDP per capita. Britain was a partial catch-up. Japan was more extractive. The AI inference is: near-term wage pressure first, then upside only if institutions force AI productivity into wages, insurance, bargaining power, or transfers.

GDP grows in every path. The difference is distribution and volatility. Germany’s historical GDP per capita rose about 2.7x and total GDP about 4.8x. Britain was a little lower per person, about 2.3x, with total GDP around 4.5x. The US path produced much higher per-capita growth, about 4.5x, and enormous total GDP growth, but it also carried labor violence, wages lagging productivity, and a 1929-class crash at the end of the arc.

So the short version:

• Societal normalization with AI: 2027-2028 central case, with 2024-2032 as the realistic statistical window

• disruptions first: data centers, labor, liability, federalism, and market stress

• personal income: bad if institutions lag, good if AI worker insurance and bargaining mechanisms arrive

• GDP: strong in all cases, but the US-style highest-growth path is also the most fragile

The watch list is simple:

• a serious AI displacement-insurance or portable-benefits proposal

• a data-center fight that moves from local zoning into national energy or tax politics

• an AI liability insurance market that starts pricing model/deployment risk

• a federal preemption fight that forces Congress or the courts to decide who governs AI

• widening credit or equity stress around the AI capex chain

Those are the places the abstract social conflict becomes measurable.

For the readers who didn’t spend their 20s drinking with Germans, the below DE abbreviation is the two letter country code for Deutschland (Germany).

This below graph was my eureka moment. It shows German society progressing through the Industrial Revolution based on societal events, and statistically projects it into the AI era. Notice that the German Industrial Revolution ends in public outcry in the 1910s, and the AI revolution ends in public outcry in 2027-2028. The archetype’s actual claim is that the culmination of the revolution converts discontent into ongoing-but-managed conflict. Not peace. In the case of Germany, strikes happened inside accepted union-employer bargaining frameworks, and political mobilisation channelled through parties instead of barricades. Progress, not perfection.

I assumed UK or US Industrial Revolution

I’ve been audiobooking the Great Course “The Industrial Revolution” and had focused this research correlating the current AI revolution to the US and UK Industrial revolutions.

Those answers were too clean.

Then it broke in a useful way.

The hypothesis changed.

I started with the obvious comparison: AI adoption today versus the British Industrial Revolution. Then the research expanded to the US, Germany, Japan, and electrification. The best qualitative match was not Britain. It was Germany around 1890, right at the Bismarck welfare-state inflection.

Why Germany?

Germany around 1890 was not just “industrialization.” It was a specific social phase.

The technology had already become real. Capital formation was moving. Labor unrest was not going away. Socialist politics had become too large to suppress cleanly. The state had to decide whether to keep treating discontent as a policing problem or convert it into institutions.

The Bismarckian answer was compulsory social insurance plus political management.

That is why the Germany match matters. It implies that the AI story from here is not mainly about model capability. It is about the institutional settlement around model capability.

The research measured four lanes.

Public outcry. Germany had labor unrest and SPD electoral pressure. AI has copyright suits, union fights, job fears, local data-center protests, and an increasingly broad legitimacy problem.

Regulation. Germany had worker insurance and labor-protection laws. AI has the EU AI Act, state AI laws, model-liability debates, executive orders, and early labor protections.

Appreciation. Germany had electrical systems, chemicals, engines, and industrial showcases. AI has ChatGPT, GPT-4, multimodal models, coding agents, and enterprise productivity enthusiasm.

Deregulation. Germany had the Anti-Socialist Law lapse and a move from direct suppression to political management. AI has preemption fights, deregulatory pressure, and pro-acceleration national strategy.

The interesting thing is not that any one item maps perfectly. Perfect analogies are usually fake. The interesting thing is the shape (or rhyme). Society is no longer deciding whether the technology matters. It is deciding who pays for the downside, who captures the upside, and what institutions absorb the anger.

That is a much better planning frame than “AI is like steam engines.”

When does societal discontent normalize?

Central case: 2027-2028.

Honest range: 2024-2032.

The Germany projection puts the key institutional cluster in the 2024-2028 window:

• 2024: preemption and worker-protection fights become explicit

• 2025-2026: civil/commercial code and liability analogues

• 2026-2027: labor recognition and large-scale worker conflict analogues

• 2027: consolidated AI worker insurance or displacement-compensation analogue

• 2028: mass political faction around AI adjustment

The dates are weak. The model has several years of uncertainty and should not be read like an earnings calendar. But the order of operations is useful.

First, the technology becomes socially unavoidable.

Then the fights spread from narrow affected groups to broad political coalitions.

Then the state tries suppression, preemption, or patchwork regulation.

Then a more durable settlement emerges because the conflict is too expensive to keep treating as an exception.

That is what I mean by normalization.

It is not “people stop being mad about AI.” It is “the anger has institutions to flow through.”

The UK bracket says this can normalize more gently. The British path after the 1840s is liberalization plus selective protection, then a long mid-Victorian boom. If AI follows the UK path, we muddle through data-center fights, labor laws, and permitting, but the boom remains politically acceptable.

The US bracket says normalization can come late and violently. The American path leaves more pressure in the system. It generates huge growth, but labor conflict and speculative excess keep compounding. If AI follows the US path, the late 2020s are less a settlement and more a stress test.

What disruptions come first?

I would not watch for one giant “AI backlash” event. I would watch for several fights merging.

1. Data centers become the visible symbol

Data centers are where an abstract technology becomes concrete. They touch land, water, power prices, tax abatements, noise, transmission lines, local politics, and trust in elites.

That makes them a perfect container for broader AI resentment.

The Germany inference is that local industrial conflict eventually becomes national social policy. If data-center fights remain local zoning fights, the Germany thesis weakens. If they merge with job displacement, energy costs, and federal preemption, it strengthens.

2. Labor conflict leaves the obvious occupations

Artists, writers, actors, and software engineers are early. They are not the whole story.

The Germany path would imply that AI labor politics becomes broader and more ordinary. The important moment is when the issue moves from “protect creative workers from the model” to “how does a normal office worker, call-center worker, analyst, teacher, nurse, paralegal, or public employee insure against AI-driven displacement?”

That is when the politics changes.

3. Liability becomes code

Germany’s industrial society needed a legal architecture for accidents, contracts, commercial relations, and social insurance.

AI will need the same thing. Who is liable when an AI system causes harm? The model provider? The deployer? The employer? The integrator? The user? The board?

Until that is legible, every deployment carries hidden political and legal leverage.

4. Preemption is where settlement shows up

The US is drifting into state-by-state AI governance. That can work for a while. It probably cannot work forever if the technology becomes embedded in national labor markets, national infrastructure, national finance, and national security.

The fight to watch is not “regulation or deregulation.” It is who gets to decide.

States? Federal agencies? Courts? Congress? Whitehouse? Trade associations? Insurers? Procurement rules?

The normalizing moment would be when that governance stack becomes predictable enough for companies and workers to plan around it.

5. The US-bear bracket puts the market in play

The US bracket adds the uncomfortable part: the crash scenario. This is not the central Germany forecast. It is the bear-case bracket.

I do not think the model says “1929 in 2029.” That is fake precision. It says if AI valuations, data-center leverage, power commitments, vendor financing, and private credit all keep expanding faster than the social settlement, the market becomes one of the places the adjustment can happen.

The slope of AI equities looks like the UK bull case if you want to be optimistic. The concentration and valuation risk look more American if you are worried.

What happens to personal income?

This might be the most important result in the project.

In the German path, workers eventually win a larger share of the gains.

The wage data are stark:

• Britain 1820-1900: real wages end at 183, GDP per capita at 230

• Germany 1840-1913: real wages end at 347, GDP per capita at 269

• Japan 1886-1925: real wages end at 138, GDP per capita at 186

Same broad industrialization story. Very different worker outcomes.

The German result says personal income does not automatically rise because the technology is productive. It rises when institutions force the gains to flow through wages, insurance, bargaining power, or social transfers.

That is the distinction that matters for AI.

In the near term, I would expect measured personal-income pressure. AI can raise productivity while weakening labor’s bargaining position. That is the default path if companies adopt AI faster than workers get new leverage.

The German inference is that the catch-up comes after the institutional settlement. In AI terms, that means after some mix of displacement insurance, portable benefits, retraining funds, liability rules, and worker bargaining. Without those, the German income result does not arrive. You get the productivity without the wage catch-up.

The brackets are useful:

• UK bull: wages lag at first, then partially catch up as the boom broadens

• Germany central: wages lag at first, then outpace productivity if institutions redistribute gains

• US bear: GDP grows a lot, but labor remains behind until crisis-driven reform

This is why I do not like the generic question, “Will AI be good for workers?”

Wrong unit of analysis.

The better question is: what mechanism makes AI productivity show up as worker income?

Germany has an answer. Britain has a softer answer. The US path mostly says: later, after pain.

What happens to GDP?

GDP grows in all three paths.

That is easy to miss because the politics are ugly. Industrial revolutions can be socially destabilizing and economically powerful at the same time. That is the whole problem.

The historical multipliers:

• UK bull: GDP per capita about 2.3x, total GDP about 4.5x

• Germany central: GDP per capita about 2.7x, total GDP about 4.8x

• US bear: GDP per capita about 4.5x, total GDP much higher because population and continental scale explode

The AI inference is not “GDP will literally 2.7x by year X.” That would be silly. The inference is about the shape.

The Germany path says growth is strong but institution-mediated. You do not get the maximum speculative upside, but you get a more durable settlement and a better worker outcome.

The UK path says growth is also strong, and the market path may be friendlier, but worker gains are less institutionally guaranteed.

The US path says the highest-growth story can also be the most fragile. You can get extraordinary aggregate gains while personal-income distribution, labor peace, and financial stability deteriorate underneath.

For founders and investors, that is the hard part.

The best GDP path may not be the best personal-income path. The best market path may not be the best social-stability path. The best worker path may require institutions that slow some forms of capital formation but make the whole system more durable.

I would summarize it this way:

If you want maximum upside, you are implicitly underwriting more US-bear risk.

If you want durable adoption, you should care more about the German settlement.

If you want the cleanest builder environment, you are hoping for the UK bull case.

How much should we trust this?

Enough to use it as a planning frame.

Not enough to bet on the exact dates.

The research process did not just ask an agent for a historical analogy. It built event corpora, scored events by severity, bucketed them into outcry/regulation/appreciation/deregulation, and compared the AI state vector to historical years across Britain, the US, Germany, Japan, and electrification.

The first answer was too clean: Germany 1890, p = 0.004.

So I asked another research agent to try to break it.

It rebuilt the German corpus two ways. The exact p-value broke. The welfare-state window did not.

• original German corpus: best year 1890, p = 0.004

• expanded academic-cited corpus: best year 1877, p = 0.391

• blind-built corpus: best year 1891, p = 0.238

That means the strict statistical claim does not survive. The directional claim does.

The confirmatory agent also rescored the full 422-event UK/US/Germany/AI corpus with two different frontier models. Severity agreement was good: Krippendorff alpha 0.80, Pearson r 0.81, and 100% of severity scores were within one point. Category agreement was stronger: alpha 0.92 and 93.8% exact agreement.

So I trust the shape more than the p-value, and the order of events more than the dates.

This chart is the honest version:

The corrected claim is narrower and more useful:

AI’s current social pattern most closely rhymes with the German welfare-state inflection around 1890. The strict significance is fragile, but the inference is stable enough to plan against. The UK and US analogues bracket it: Britain is the friendlier bull case; America is the higher-growth, higher-crash-risk bear case.

What I am doing with this

I am not starting from “AI will take every job” or “AI will make every founder rich.” Both are lazy.

The useful question is: what societal bargain lets the technology keep scaling and society improving?

If the UK bull case wins, the answer is liberalization plus enough worker adjustment that the boom keeps political permission.

If the US bear case wins, the answer is that nothing settles until after a market or labor crisis forces the issue.

If the German case wins, the answer is that society builds an AI-era welfare-state layer: insurance, liability, bargaining, and political accommodation.

I’m not advocating any of the three. The overlaps between them are where I would look for durable companies and durable policy. Not “AI for X” in the abstract. Not yet another model wrapper. The interesting opportunity may be in the institutional plumbing that helps channel societal discontent into mutually acceptable outcomes:

• compliance systems that make AI labor rules operational

• insurance products for AI displacement and AI liability

• workforce-transition infrastructure that employers actually have to fund

• data-center designs that turn local NIMBY into repeatable YIMBY

• audit systems that let regulators, insurers, and courts decide fault

• financing structures that survive if AI CAPEX gets politicized

I keep coming back to runway.

In a calm world, a founders’ runway is mostly cash divided by burn. In this world, runway is also social permission divided by political volatility. You can have the best model, the best tooling, the best data-center design, the best reward function, and the best go-to-market motion, and still lose if the society around the technology decides your category is the problem to be solved.

Germany 1890 says renormalization happens when the political system stops treating industrial discontent as noise and starts converting it into institutions.

That is the clock I am watching.

The new normal probably does not arrive when the models recursively self improve, or when agents can solve all of the Erdős problems, or when AI creates benchmarks expert humans can’t pass. It arrives when society decides who carries the downside risk of AI and builds the machinery to enforce that decision.

If the rhyme holds, that fight is not in the distant future.

It is the next few years.

In 1949, a crew of smokejumpers parachuted into Mann Gulch to fight what looked like a manageable wildfire. The fire then “blew up” into a fast-moving wall of flames so the foreman ordered them to drop their tools and run. Many did not stop carrying the very gear that defined their trade as firefighters, and they did not survive the fire.

Patching is the tool we refuse to drop while we face a fast-moving wall of vulnerabilities and exploits from Mythos-grade advanced cyber capability proliferation.

Bottom line towards the front:

• After proliferation day, enterprises are going to default-deny internet exposure for mitigation-poor edge appliances unless vendors can demonstrate a modern mitigation stack and rapid patch performance. Many of these are the security appliances themselves.

• Vendors in Glasswing and Project Daybreak, don’t just patch vulnerabilities. You are fixing the newly known-unknowns. Use the models to generate exploits, to tease out how exploits against your products are actually constructed, and to devise generic mitigations that will make your unknown-unknown vulnerabilities far less likely to be exploited. You can use the models to do the heavy lifting mitigations for you.

Anthropic’s Project Glasswing and OpenAI’s Project Daybreak are still running with their heavy chainsaws. We have an industry focused on finding and fixing vulnerabilities before hackers can exploit them. Industry has been trying to find and fix vulnerabilities before hackers can exploit them for how many decades now? So now we’re just gonna run faster.

I conducted a study to tease out from the data if generic exploit mitigations work, and if we can focus resources on mitigations to cut a fire break that buys time for ow fast we know we can run the patching approach.

Not only did the study show where mitigations are effective, the study showed the exploit clock already crossed the patch clock so we have been dependent on exploit mitigations for a few years now.

By roughly 2022, the median weaponized CVE was showing up in CISA KEV (Known Exploited Vulnerabilities) faster than half the exposed install base got patched. By 2023-2024, the typical mass-exploited CVE was in KEV in about a week while half the exposed population was still unpatched 50-60 days later.

During that window, the patch does not protect you. The mitigation stack does.

The precise crossover year is less important than the shape of the curves. Attackers have been getting to weaponized exploitation faster even before the offensive cyber AI models proliferate. Defenders are not getting patches deployed faster. Once those lines cross, “patch faster” stops being a complete macro answer.

The strategic hypothesis survived the data, but in a narrower and more useful form:

Patching is a per-vulnerability response loop. Mitigations are a portfolio-level constraint on exploitability. When vulnerability discovery and exploitation accelerate, and patch deployment cannot keep up, then the portfolio-level constraint becomes the strategic lever.

What I Tested

The research project pulled together:

• 77 exploit mitigations across Windows, macOS, Linux, iOS, Android, Chrome, Firefox, Edge/IE, Safari, Office, Adobe Reader, Adobe Flash, and Java.

• 100,000+ normalized rows from CISA KEV, NVD, MSRC, Project Zero’s in-the-wild 0day spreadsheet, Mozilla MFSA, Chrome Releases, Android Security Bulletins, partial Apple advisories, Exploit-DB, Microsoft SIR archives, StatCounter, DBIR, Mandiant M-Trends, public exploit-price lists, and vendor memory-safety writeups.

• Eight natural-experiment analyses, plus follow-on work on time-to-exploit, patch lag, exploitability prediction, edge-appliance mitigation maturity, gray-market exploit prices, Rust adoption, and MTE deployment.

The limited release formal report is the careful version. This is the strategy level writeup.

The data says five things.

First, patching is losing the clock.

Second, mature platforms keep bug discovery from turning into exploitation at anything close to one-for-one rates.

Third, mitigations are not magic shields. They are cost filters. They move exploitation from the cheap tier to the expensive tier.

Fourth, the current exploitation wave is concentrated where that cost filter is weak: edge appliances.

Fifth, AI vulnerability discovery and exploitation makes the weak-filter category an emergency.

CVEs Are Not Exploits

Microsoft’s own per-CVE exploitation documentation is the cleanest long-run exploit mitigation public signal I found for a mature platform.

From 2016-2026, only a small fraction of patched Microsoft CVEs are marked exploited in the wild. Typically this sits around 1-3 percent per year, with a 0.6 percent low in 2020 and a 3.0 percent ProxyLogon-era high in 2021.

That does not prove mitigations caused the low conversion rate. Public macro data cannot cleanly prove that. But it does show the strategic object we care about.

The defender is not patching because every CVE becomes an exploit. The defender is patching because a tiny fraction does, and the defender does not know which fraction early enough.

Mitigations push down that fraction.

You can see the same thing from the other side. Memory-corruption bugs have not disappeared. They are not even trending away. After LLM-assisted reclassification of NVD CVEs that lacked useful CWE tags, memory-corruption share rises from 26 percent in 2010 to 56 percent in 2024.

That is the point people miss when they argue from CVE counts.

Mitigations do not stop researchers from finding memory corruption bugs. They stop attackers from turning a discovered bug into reliable exploitation at scale. CVE counts measure the bug layer. Exploit mitigations operate on the conversion layer.

If AI makes the bug layer 10x larger, the first question is whether the conversion layer holds with AI native exploit generation.

If it holds, defenders get a bigger patch queue but not necessarily a proportional breach wave.

If it breaks, the patch queue becomes an exploit feed.

Mitigations Are Cost Filters

The old Microsoft Security Intelligence Report has a useful chart, but it is easy to overread.

In 2011, Microsoft tested 184 real-world exploits against three configurations:

• Windows XP SP3 without EMET: 181 of 184 exploits succeeded.

• Windows XP SP3 with EMET 2.1: 21 of 184 succeeded.

• Windows 7 RTM default configuration: 10 of 184 succeeded.

The lazy read is “mitigations made the bugs unexploitable.”

The better read is “off-the-shelf weaponized exploits collapsed when refired at mitigated targets.”

Those exploits were mostly written for the environment they needed to hit: pre-mitigation Windows XP. They did not bring DEP-bypass ROP chains, ASLR-defeating info leaks, or SEHOP-aware payloads because they did not need them. Turn on EMET or move to Windows 7, and the old payloads fall over.

A motivated attacker would still weaponize an exploit chain for many of those CVEs. DEP can be bypassed with ROP. ASLR can be bypassed with an info leak. CFG has gaps. Sandboxes have escapes. The bug is not gone. The exploit got more expensive, less reliable, or impractical at operational scale.

That cost shift and reduction in exploitability is the real point.

The SIR archive shows the same pattern in root-cause telemetry. Stack-corruption exploits fell from 54 percent of exploited Microsoft RCE CVEs in 2007 to 5 percent in 2013 as /GS, SafeSEH, and SEHOP bit. Use-after-free rose from about 5 percent to about 50 percent over the same period.

The total exploit count did not simply vanish. The cheap class got more expensive, and offense substituted into the next class.

That is what successful mitigations look like in macro data. Not a clean cliff. A migration.

The gray market prices that migration in dollars.

Exploit-price data is messy. Zerodium and Crowdfense are not the same buyer. These are list prices, not closed transaction prices. Some categories drift over time. A 2017 Chrome “RCE+LPE” is not exactly the same product as a 2026 Chrome full chain with a V8 sandbox layer.

Still, the direction is hard to ignore. iOS zero-click full-chain prices went from $1.5M in 2017 to $5-7M in 2026. Chrome desktop full chain went from $150K to $1.5M, about 10x. Office Word/Excel RCE went from $50K to $500K.

Exploit buyers are not paying more because they got nicer. They are paying more because modern iOS, Chrome, and Windows require more bugs, more bypasses, more sandbox escapes, more code-integrity work, more uncertainty, and more burn risk.

Mitigation is not making exploitation impossible. It is changing who can afford it.

Removal Beats Mitigation

The cleanest natural experiments were not hardening features. They were attack-surface removal.

Flash died. Exploitation died with it. Adobe’s formal EOL was December 31, 2020, but browser blocking and click-to-play exploitation mitigations had already done most of the work. All 36 Flash CVEs in CISA KEV have CVE IDs from 2009-2018.

Office macros are the other clean case. Microsoft blocked internet-marked macros by default in July 2022. Office-related KEV additions fell from a pre-period rate of 42.7 per year to a post-period rate of 2.9 per year. The pre-period is contaminated by CISA’s early KEV backfill, so do not overinterpret the exact 93 percent drop. The post-period rate is the point.

For a product family that was one of the great enterprise exploitation surfaces of the last decade, roughly three Office KEV additions per year after the macro block is a strategy result.

The best exploit mitigation is still not needing to exploit-mitigate the surface at all. My takeaway for the offensive AI proliferation wave is that we will rip out products from all vendors who are not proactively increasing their exploit mitigation surface, and rapidly patching their vulnerabilities.

The Wave Is Where The Mitigations Are Weak

The public story gets confusing because exploitation is rising again.

DBIR’s exploitation-of-vulnerabilities initial-access share was roughly 5 percent in the 2020-2023 reports. It rose to 14 percent in 2024, 20 percent in 2025, and 31 percent in 2026.

If you stop there, it sounds like mitigations failed.

They did not. The wave is not primarily hitting the places where the mitigation stack is strongest. It is hitting edge appliances: Ivanti, Citrix, Fortinet, Cisco ASA, MOVEit, F5, SonicWall, CrushFTP, SharePoint on-prem, SAP NetWeaver, Oracle E-Business Suite, Palo Alto GlobalProtect.

So I built a mitigation-maturity rubric for those products and compared them with Chrome, Windows, and iOS. It is author-curated, not a formal audit, but the categories are concrete: DEP/NX, default ASLR, stack cookies, CFI, management-plane sandboxing, data-plane sandboxing, kernel hardening, memory-safe rewrite progress, and code signing.

The result is the category gap in one chart.

The baseline high security platforms average 9.3 out of 10. The edge appliances average 3.1 out of 10.

The heatmap is worse than the score. None of the mass-exploited edge appliances ships default-on CFI (Control Flow Integrity). None ships a Chrome-class syscall-filtering sandbox around its management-plane web UI. SharePoint and MOVEit have IIS app-pool isolation, which is a useful process boundary, but not the thing Chrome or iOS would call a sandbox. Most of the category still looks like privileged C or C-like control-plane code on old kernels with enormous exposed management surfaces.

The gray-market exploit snapshot independently says the same thing. In Crowdfense’s 2026 list, Fortinet/Citrix/SonicWall-class RCEs sit around $100K. iOS zero-click full chain is $5-7M.

The exploit market is pricing the mitigation-poor edge exploit at about 1-2 percent of the mitigation-rich mobile exploit.

That is the gradient offense is following.

DBIR Was Late To The Story

One reason this was underweighted is that DBIR undercounted exploitation for years.

Mandiant M-Trends has reported exploits as the top initial infection vector for six consecutive years. Its exploit share stayed in the 29-38 percent band. DBIR reported roughly 5 percent through 2023, then moved toward Mandiant as its methodology and deeper-forensics views improved: 14 percent in 2024, 20 percent in 2025, 31 percent in 2026.

The arithmetic Mandiant-minus-DBIR gap averaged 24 percentage points from 2021-2025. The direction is important: DBIR’s broader notification-heavy dataset was late to what IR-heavy datasets were already seeing.

The operational reason is credential double-counting. A real intrusion can begin with an exploit that steals or mints credentials, or a post-auth exploit that requires credentials. If the incident record captures the login, the breach gets coded as credential abuse; that’s doubly true if the exploit cleans up after itself so there isn’t a crash in the logs.

Spending follows measurement. If your CISO deck said credentials were the top initial-access vector and exploits were a rounding error, exploitability reduction was probably underweighted for the last few years.

Proliferated Offensive AI Changes The Floor

The AI part is no longer theoretical.

In April 2026, Anthropic announced Project Glasswing, built around Claude Mythos Preview. The technical examples Anthropic has disclosed show a model that can find vulnerabilities and build working exploit chains in real software. My previous project forecast that we should see a Mythos-grade offensive cyber capability proliferated to Chinese open weight models around October 3, 2026.

The cost numbers need careful handling. The right framing is not “$50 to $20K per CVE.” Anthropic’s own framing is closer to: about $50 for a best-case successful run identified with hindsight, roughly $2K for a typical successful exploit run, and about $20K total for a broad benchmark pass across roughly 1,000 runs that surfaced several dozen findings.

Still, the strategic meaning is obvious. For the bug classes Mythos handles well, the bottom of the exploit-development market just got much lower.

The public examples of Mythos grade capabilities matter because of what they target. The disclosed technical examples cluster around C/C++ code and targets that do not have the full modern hardware-rooted mitigation stack: older Unix and Linux paths, FFmpeg, kernel/userland code that lacks CET shadow stacks, PAC, MTE, V8 sandboxing, BlastDoor-style containment, or HVCI-style enforcement.

That is not a criticism. It is the threat model today.

Anthropic has not publicly demonstrated Mythos defeating modern iOS, modern Chrome with V8 sandbox, Windows 11 with HVCI/CET, or broad ARM PAC/MTE-protected targets. It may be able to. It may not. The public data does not tell us yet.

For edge appliances, that distinction is almost academic. They look much more like the targets Mythos has been shown to handle than like the targets Mythos has not been shown to beat.

That sharpens the conclusion. The edge-appliance mitigation gap is no longer just an attacker-economics gradient. It is an AI-automation gradient.

If Mythos-class capability lowers the floor for C/C++ exploit work, then the product categories without modern mitigations become the obvious first place where that capability shows up operationally. This will be doubly true if the open-weight models proliferate a sub-Mythos-class capability.

The Whole Problem In One Picture

This is the one chart in the post that is a synthesis, not a direct measurement of natural experiments. Read it that way.

It takes a normalized 10,000-CVE cohort and runs it through the model: platform tier, bug class, mitigation layer, observed outcome, and attacker cost tier. The exact flow widths are author-curated from the findings, not a census. The directional claims are the point.

The mature-platform branch pushes a lot of memory-corruption risk into eliminated, blocked, or expensive outcomes. The weak edge-appliance branch leaves a much larger path from memory-corruption CVE to in-the-wild exploitation and into the cheap, Mythos-reachable tier.

That is the strategic picture: AI is already lowering vulnerability discovery and exploit-development costs, but it does not erase the mitigation gradient. It makes the gradient more important.

The Defenses That Actually Scale

The strongest measured answer is not “prioritize better.” It is “remove bug classes.”

Google’s Android data is the cleanest example in this corpus. In 2019, Android had 223 memory-safety vulnerabilities, representing 76 percent of Android vulnerabilities. By 2024, Google’s published count was below 50. By 2025, the share was below 20 percent. Over the same period, Rust grew from effectively zero to millions of lines in the Android platform.

This is vendor-self-reported data, not an independent audit. It should be treated as directional. But even with that caveat, it is the best macro evidence we have for a defender move that changes the size of the bug pool itself.

Memory-safe rewrites do not make a memory-corruption exploit more expensive. They remove the memory-corruption primitive from the rewritten code.

That matters in the Mythos era. If AI makes it cheap to search for and exploit memory bugs, the best answer is not to make humans triage 10x more memory bugs. It is to stop manufacturing the class.

Chrome provides a second, narrower example. MiraclePtr reportedly prevented 57 percent of use-after-free vulnerabilities in privileged Chrome processes between 2022 and 2024, measured against 168 real UAF reports. Fontations, the Rust replacement for FreeType in Chrome’s font stack, has gone through a staged rollout with no security-critical bugs reported in that component to date. Again: vendor data, but strategically coherent.

Hardware memory tagging is the other important lever, and it is where deployment details matter.

Android MTE is not absent. On Pixel 8/9/10, Android enables MTE async mode by default for the security-critical zero-click system-process set: networking daemons, Bluetooth HAL, NFC HAL, SecureElement HAL, system_server, zygote64, and statsd.

But MTE is still not default-on for the Android kernel, GPU drivers, Chrome’s renderer/PartitionAlloc, or most user apps. Users can opt into broader app coverage through Android 16 Advanced Protection Mode, but the default deployment is still partial.

That explains the observed attacker movement. The recent Android chains and Mali GPU bypasses do not show “MTE failed” so much as “MTE did not cover the surface attackers chose.” When one component gets expensive, offense moves to the next soft component.

Apple’s iPhone 17 Memory Integrity Enforcement is the first broad consumer deployment that tries to close that gap: kernel plus more than 70 userland processes, always-on synchronous mode, built on enhanced MTE. Apple’s claim that six historical exploit chains could not be rebuilt around MIE is vendor-self-reported and not independently verified. But it is the shape of the answer: not an MTE toggle, a deployment program.

So the 2026 mitigation plan is not abstract:

• Remove high-risk attack surfaces where possible.

• Move parser-heavy and protocol-handling code into memory-safe languages.

• Put management-plane web UIs in real sandboxes, not just process pools.

• Ship default-on CFI/CET/PAC/MTE where the hardware exists.

• Extend Android-style MTE from selected daemons to kernel, GPU, browser, and user-app surfaces.

• Retrofit edge appliances with the mitigation stack browsers and operating systems already learned to need.

• Keep patching KEV-class bugs aggressively, but stop pretending patching can win the pre-disclosure and first-week windows.

Where This Can Be Wrong

There are real caveats.

Public macro data cannot cleanly isolate individual hardening mitigations. DEP, ASLR, CFG, CET, PAC, MTE, site isolation, and BlastDoor shipped into moving systems with changing market share, researcher attention, bug bounty economics, and attacker objectives. The cleanest causal evidence usually lives inside vendors.

The edge-appliance maturity score is not a formal audit. It is a structured comparison of public mitigation posture. The exact score for any one product should not be treated like a lab measurement. The category-level gap is the point.

Exploit-price lists are list prices. They are not transaction prices. They are also buyer-specific. The 2017-to-2026 multipliers should be read as directionally useful, not as precise economic measurement.

The Rust, MiraclePtr, and Apple MIE numbers are vendor-self-reported. They are still useful, but they are not independent measurements.

The biggest unknown is Mythos-class capabilities against the mitigation-rich tier. If Mythos or Mythos-class models already defeat CET, PAC, MTE, V8 sandboxing, and modern iOS/Chrome/Windows containment, and the vendors are simply not saying so, then the mature-platform story gets worse. The public evidence does not answer that yet.

None of these caveats rescue the patch-only strategy.

They mostly strengthen the same conclusion: when discovery gets cheaper, exploitability reduction gets more valuable.

The Conclusion

The strategic hypothesis was close, but the precise version matters.

Exploit mitigations are not “more important than patching” in the lazy sense. You still need both.

The sharper claim is this:

Patching is how you close known holes. Mitigations are how you survive the period when the hole is unknown, undisclosed, unpatched, or not yet deployed.

That period is getting longer in practice even as exploitation gets faster.

The exploit mitigation scissors crossed around 2022. By 2023-2024, attackers were getting to weaponized CVEs in about a week while half the exposed install base was still unpatched after 50-60 days. By 2026, DBIR and Mandiant both put exploitation-of-vulnerabilities around one-third of initial access. The wave is concentrated in edge devices missing default-on exploit mitigations that major platforms shipped years ago. The gray market prices that gap at roughly 50-70x. Mythos-class automation makes the weak side of the gap newly urgent.

So the answer is not “patch faster” or “mitigate instead.”

The answer is: patch what is known, but invest like the unknown bug is already in an attacker’s hands.

Because increasingly, it is.

Frontier AI labs do not appear to be brittle around famous senior researchers. The data shows that famous departures do not slow release cadence, do not shrink benchmark improvements, and do not carry productivity to destination labs within a year. The personnel signal points backward: strong labs shed recruitable senior people, weaker labs hire them. As long as they have compute, the AI labs are not brittle organizations.

There is a useful story about frontier AI labs. It says these companies are brittle. (Hint, it’s wrong)

The story is intuitive. Frontier models look like the product of a few extraordinary people, a mountain of compute, and a lot of organizational theater wrapped around both. The chief scientist leaves. The post-training lead leaves. The Llama team leaves for Mistral. The research flavor of the day walks out of the building. Six to eighteen months later the lab should stutter.

I believed a version of that story when I started this project. I expected that the data would prove that story.

Price’s Law gives the story a little math. In a research organization of N people, roughly the square root of N people produce half the output. If a frontier lab has 800 researchers and engineers, sqrt(800) is 28. On that model, twenty-eight people carry half the freight. Pull out three or five or eight of them and the release pipeline should not keep moving as if nothing happened.

So I built the study I expected would find the crack.

It did not.

The setup

The dataset covers 15 frontier AI labs: OpenAI, Anthropic, Google DeepMind, Meta, xAI, Mistral, Cohere, Inflection, Adept, Character.AI, Reka, AI21, DeepSeek, Alibaba Qwen, and 01.AI.

Three research streams gathered the inputs independently before correlation time:

• 157 model releases from 2020 through May 2026.

• 171 named personnel events, split across arrivals and departures, with seniority tiers.

• 174 benchmark scores across epoch-appropriate frontier benchmarks.

• 35 disclosed compute milestones, normalized to H100-equivalent where possible.

The first five tests were pre-registered. The headline one was simple: after a senior departure, does the lab ship its next major model later than its own historical cadence?

If frontier labs are brittle in the way the story implies, the answer should be yes. The founder leaves, the next major release slips. The research lead leaves, the benchmark trajectory bends downward. A senior researcher moves from lab A to lab B, lab A slows and lab B speeds up.

That is the shape of the prediction.

The data went the other way.

Among 24 senior departures from 2022 onward, 21 were followed by a faster-than-baseline next major release. The median delta was negative 78.5 days. In plain English: the median lab shipped its next major release 78.5 days faster than its own baseline after a senior person left.

That is not what a brittle organization looks like.

Maybe the baseline was doing something weird. So we shuffled each lab’s departure dates 1,000 times, holding the lab and event counts fixed, and recomputed the effect under a within-lab placebo.

The observed effect sat in the middle of the null distribution. P = 0.49. The model release cadence result was indistinguishable from chance.

The cross-lab portability test failed too. Thirteen paired moves were measurable where a named researcher left one lab and joined another within twelve months. If individuals carry frontier productivity in a way that registers publicly, the origin lab should slow and the destination lab should speed up. Exactly one of thirteen moves landed in that hypothesis-consistent quadrant. A famous researcher joining an existing AI lab slowed their model release by 280 days at the median.

People matter. But the public model release cadence did not behave as if famous senior people were portable productivity engines. The data shows the inverse.

The tempting false positive

Model release cadence might be the wrong place to look. A model that ships three months after a resignation was already trained, red-teamed, productized, and probably half-launched internally before the resignation happened. The release can ship on time while the next research bet is already damaged.

That was the best rescue for the hypothesis, and we thought it might work.

So we rebuilt the outcome around model quality instead of release dates. The benchmark corpus was split into five paradigm epochs, from the GPT-3 era through the agentic-2026 era. Within each epoch, each benchmark score was min-max normalized so contemporary results could be compared without pretending MMLU in 2021 and AIME in 2026 are the same object. Each release got a composite score from the epoch-appropriate benchmarks it reported.

Then we asked a sharper question: after a senior departure, was the next release’s composite-benchmark-score step smaller than that lab’s average step? Or put another way, did the new model get better by as much as that lab’s new models usually do?

Twenty-one events had enough data. Fourteen of them, 66.7%, were followed by below-lab-average composite benchmark steps. The median delta was negative 24 composite points (the models got worse at getting better)

For about a cup of coffee, that looked like the answer.

Then the placebo killed it.

We ran 1,000 within-lab date shuffles and recomputed the same next-release composite-step test. The observed negative 24-point median landed at the 23rd percentile of the null. One-tailed p = 0.235. Random dates inside the same labs produce a “brittleness” effect at least that large about one time in four.

The mechanism is not mysterious. Lab release curves have structure. Big jumps often happen early in an epoch; smaller jumps follow near saturation. If personnel departures are more likely to occur around public milestones, a naive next-release test will mistake release-curve geometry for personnel damage.

The n=2 rescue failed even harder. I wondered if departures often happen at release milestones, so the next model is already in the pipe; the release after that should show the damage from key personnel loss. On the composite metric, 57.1% of events had the second release more depressed than the first.

But the placebo mean was 71.5%. Random dates produced the pattern more often than real personnel events did. The observed result sat in the lower tail of the null, with p = 0.96 against the brittleness direction.

Three placebos. Three nulls. Wrong, wrong and wrong.

The thing that looked like brittleness kept turning into release-pipeline structure.

The obvious counter-claim was only partly right

If big named researchers are not the lever that affects the AI labs, the next obvious answer is compute.

That story is also intuitive. Stargate is not just one of my favorite SciFi TV shows. Memphis Colossus hopefully did not add 100,000 H100s because xAI wanted a prettier CapEx line. Project Rainier and Google’s TPU fleets and Meta’s H100 clusters exist because the field believes scale still moves the frontier.

The first compute tests were surprisingly flat.

Compute at training-start had near-zero correlation with release cadence: Spearman rho = -0.12, p = 0.63. It had near-zero correlation with benchmark velocity: rho = +0.05, p = 0.87. It had almost comically zero correlation with composite-step delta: rho = +0.001, p = 1.00.

Then we caught a methodological problem that should have been obvious earlier.

The composite trajectory was mixing tiers. Anthropic ships Haiku, Sonnet, and Opus. OpenAI ships flagship, mini, Instant, and reasoning models. Meta ships 8B, 70B, and 405B-class models. Treating those as one continuous lab trajectory is nonsense; they should all come out of the same pretraining run. A Sonnet release is not the next point on an Opus line, it’s a fork somewhere in the process or a distillation. A 70B open-weight model is not the next point after an 8B model.

There was a second problem. Even inside a tier, a release’s improvement bundles the lab’s contribution with the field-wide tide: new RL recipes, better data curation, eval-driven post-training, and scaling refinements diffusing across the whole frontier. To isolate the lab effect, the comparison has to be same tier, same period, against peers.

So we rebuilt the analysis again. Each release was classified as flagship, mid, light, reasoning, or specialist. Specialist models were excluded from the general-purpose comparison. For each release, we computed same-tier velocity relative to the lab’s prior same-tier release, then subtracted the median same-tier peer velocity in a contemporaneous window.

That fixed the compute result.

At the same tier, against same-period peers, compute showed up. Log compute at training-start correlated with above-peer same-tier outperformance at rho = +0.687, p = 0.028, n = 10. Compute per key person was also positive, though weaker: rho = +0.576, p = 0.082.

That is the first result in the study that made the simple scale story look right. Cross-tier compute comparisons were mostly measuring product-tier collisions. Same-tier peer comparisons recover the expected signal: if two labs are shipping comparable models into the same market window, the lab with more disclosed compute tends to outperform.

This is narrower than “compute explains everything.” It does not. The broad cross-sectional regression still explains almost nothing without lab fixed effects. But it is also narrower than “compute was a null.” The right comparison matters.

The personnel signal reversed

The tier-aware analysis did something more interesting. It found the first coherent personnel signal in the whole study, and it points opposite the brittleness story.

Within peer groups, senior departures correlated positively with above-peer same-tier model performance. Raw senior departures gave rho = +0.467, p = 0.044, n = 19. Departures per Price’s-Law key person gave rho = +0.506, p = 0.027.

Read that slowly. The labs with more senior departures built better models than their same-tier peers, not worse.

The arrivals side points the same way after allowing enough time for a senior hire to matter. Senior arrivals over a 24-month window correlated negatively with above-peer same-tier performance: rho = -0.441, p = 0.059. Arrival rate per key person was similar: rho = -0.421, p = 0.072. The labs with more senior arrivals built worse models than their same-tier peers.

That symmetry is the most useful result in the project. If one gambles in the stock market, the symmetry might make for a good bet as these labs become public companies whose shares move with famous researchers and then model releases.

Senior people leave labs that are outperforming their peer group, because those are the people everyone else wants to recruit. Senior people join labs that are underperforming their peer group, because those are the labs hiring to fix a problem. Personnel movement is not the cause of the visible performance change. It is the consequence of it.

This is still observational and small-n. We ran enough bivariate tests in the tier-aware stage that some p-values should cross by chance. Treat the exact coefficients as suggestive, not final until we have a few more years of natural experiments.

But the signs are coherent. Departures positive. Arrivals negative. Compute positive only when the tier comparison is correct. That is a much better model of the world than the original brittleness story.

The Meta exception

Every null result has a narrative case trying to climb out of it. Here the case is Meta.

The Llama team that wrote the original Llama paper mostly left for Mistral. Joelle Pineau left in May 2025. Yann LeCun announced his exit in November 2025. Llama 4 shipped in April 2025 and was widely read as disappointing. Llama 5 has not shipped. If you want the brittleness story to be true, Meta is where you point.

So we measured it separately.

Meta is the only still-operating frontier lab in the case-study set whose next-release window has clearly lapsed. Its phantom-release ratio is 2.07x: 413 days since Llama 4 against a 200-day historical median gap. Llama 5 is about seven months overdue as of May 23, 2026.

That part is real. Meta is a cadence exception.

But Meta is not a quality exception. Llama 4’s composite-step delta was negative 32 points relative to Meta’s historical mean, but Meta’s own release-to-release variance is huge: a 138-point range, with a standard deviation around 55. Llama 4 lands at roughly the twentieth percentile of Meta’s own history. One in five Meta releases is at least that small by ordinary Meta variance.

The narrative says Llama 4 proves personnel-driven quality collapse. The data says Llama 4 was a normal Meta release that landed into an unusually strong competitor window. Meta is late on Llama 5. Llama 4 was not separately anomalous on benchmark quality.

Those are different facts. They should not be fused into one story.

The “AI Labs don’t ship if they’re behind their competitors” theory also failed. xAI shipped Grok 4.3 even though it was 14 composite points below its closed Silicon Valley peer average. Meta was 56 composite points above its open-weight peer average when Llama 4 shipped, then went silent. The lab that shipped was behind peers. The lab that stopped was ahead of peers. xAI, as part of SpaceX, has an IPO coming which might have put a finger on their decision scale.

The Meta case remains worth watching. If Llama 5 slips another year and lands weak, it becomes a more serious single-lab brittleness candidate. As of this study, it is one cadence anomaly, not a population-level law.

What I now believe

My original hypothesis was wrong in a useful way.

Frontier labs are not just a few brilliant people and a pile of GPUs. They are release pipelines, training stacks, data engines, eval harnesses, post-training systems, safety reviews, product gates, procurement schedules, and hundreds or thousands of mid-career people whose names do not make the press.

Pull one name out and the pipeline keeps running.

Pull several names out and the pipeline usually still keeps running.

Add a large compute fleet and the next ship date does not automatically move, but at the same tier and against same-period peers, compute does help explain who outperforms. That is the part of the scale story that survived contact with the data.

The personnel story did not survive. Cadence did not slow. Benchmark improvement steps did not shrink. Price’s-Law adjustment did not uncover a hidden Celsius fueled cabal of key AI researchers. Cross-lab portability did not show researchers carrying public release velocity from one company to another. The only coherent personnel signal runs in the opposite direction: strong labs shed senior people because strong labs produce recruitable people; weaker labs hire senior people because they are trying to catch up.

This matters because the mental model drives the lever people reach for. If frontier labs were brittle around a few named researchers, personnel pressure would be a strategic lever. Immigration pressure, regulator scrutiny, targeted recruiting, leadership disruption, and public pressure on individual researchers would all have obvious multi-quarter effects.

The data does not support that model. When Meta tried to attract top AI researchers with outlandishly large stock options, the data says it was neither going to make Meta better or their competition worse.

It says frontier labs are institutionally robust. The center of gravity is not the masthead. It is not even visible in most public data. In the broad cross-section, personnel and compute together explain less than 1% of composite-step variance without lab fixed effects. With lab fixed effects, explanatory power rises to about 15%. Which lab a release comes from tells you more than which senior people left, which senior people joined, or how much compute had been disclosed.

Different labs are different. The public variables we measured do not explain why.

That is the honest finding. The brittleness in AI Labs we expected to find was not there. The strongest visible lever, compute, only becomes clear after comparing the right products against the right peers and does somewhat support OpenAI’s strategy to buy up the compute market to depress their competitors compute. But the personnel flow points backward from performance, not forward into it.

All models are wrong. This one was wrong quickly enough to become useful.

The primary cadence tests were pre-registered before analysis to preclude confirmation bias. The strongest apparent quality signals were checked against within-lab placebo shuffles and failed. The tier-aware peer-relative analysis is suggestive and we wish could be replicated with a larger independent personnel dataset and better private compute estimates; neither of which are public.

How long until Mythos-class offensive cyber capability stops being one company’s controlled program and proliferates to open-weight models any hacker can download off of hugging face?

That is the planning question. Not because a benchmark date is magic. Because almost every serious defensive decision being made this quarter depends on the answer: bug-bounty pricing, patch SLAs, exposure management, app-store-as-perimeter, seam ownership, procurement, and how aggressively you compress vulnerability response. Every serious offensive decision being made this quarter depends on the answer: how long before advanced exploits proliferate, before existing nation-state exploit stockpiles are now replicated and then patched, before there is an offense vs offense vs defense token spend race.

Bottom line: treat October 3, 2026 as the deadline. That is the median date my cyber-weighted estimate gives DeepSeek for Mythos-2026-04 parity. The wider interval starts before today and runs deep into 2027, which means this is not a “next year” problem. It is already inside the planning window.

Dot or square is the median. The thick bar is the 50% interval. The thin line is the 80% interval. The red dashed line is the Mythos clock. The gray dotted line is today: May 22, 2026.

The important result is not a single date. It is the shape of the distribution. OpenAI is already at or near parity on the surrogate benchmarks. The fastest open-weight labs (DeepSeek, Qwen, and Z.ai) land in the six-to-nine-month window. The slower open-weight labs (Meta, Mistral, Cohere) stretch toward eighteen months and beyond. xAI and Google DeepMind sit roughly in the middle on this analysis.

Whether benchmark catchup equals operational catchup is a separate question. It probably does not. I will come back to that.

Why this matters

Most 2026 cyber plans still assume that Mythos-class capability stays scarce. That assumption is dangerous.

If proliferation is six months away, you are already late. If it is eighteen months away, you may still have one or two quarters to build the muscle. That difference determines whether the right answer is “ship now” or “RFP now.” It should also determine whether you are treating advanced vulnerability discovery as a rare-lab phenomenon or as an emerging commodity capability.

This is the same argument I made in Exploitation Party Like It’s 1999, but with a clock attached. Bug bounty repricing, patch cadence compression, app-store-as-perimeter, and the seam-owner role only need to happen as fast as Mythos-class capability proliferates. My estimate says the conservative planning deadline is October 3, 2026.

What I estimated

Mythos is Anthropic’s model, so I estimated proliferation by asking a narrower statistical question:

How long does it take other labs to catch Anthropic on benchmarks that plausibly load on the same capability stack Mythos uses?

That does not directly measure “2,000 zero-days in seven weeks.” Mythos’s headline yield is an operational result: model capability plus harness, dataset, triage process, disclosure pipeline, and lab workflow. You cannot read that off a leaderboard.

But you can measure pieces of the capability stack: code understanding, multi-step reasoning, cyber task performance, and autonomous tool use. I used seven surrogate benchmarks:

The direct cyber benchmarks are sparse for open-weight labs. The proxy benchmarks are not. That sparsity is a major source of uncertainty, and it shows up in the intervals.

For each surrogate, I pulled every publicly reported score I could find from a primary source: 380 benchmark/model rows across the seven benchmarks, with canonical lab names and weight status tagged as open, open-ish, or closed. I did not treat missing data as zero. Missing means I found no published score.

Cybench needed special handling because pass@1, pass@10, and pass@30 are not interchangeable. I filtered to pass@1-equivalent results so the analysis would not reward labs for reporting more attempts.

Then I bootstrapped per-lab lag distributions across the surrogates. I ran both equal weighting and a cyber-weighted variant:

For each bootstrap sample, I added the sampled lag to the Mythos clock: April 7, 2026, the public Mythos announcement date. The result is a per-lab forecast distribution, not an industry-level point estimate.

The pipeline is reproducible and lives on github. Signal me if you want access or point your agent at this point to rebuild it from scratch. Use your own weights if you disagree with mine. The point is not that these weights are sacred. The point is that the median open-weight proliferation window is measured in months, not years.

Here is the underlying surrogate data. One panel per benchmark. The black step is Anthropic’s monotone-max best-so-far reference. Colored solid steps are other closed-frontier labs. Dashed colored steps are open-weight labs. The red dashed line is the Mythos clock. The gray dotted line is today.

The vertical gap between the black line and a colored line is the visible catchup lag this analysis quantifies. AIME and GPQA-Diamond saturate quickly and bunch together. SWE-bench Verified stays spread out. Cybench and NYU CTF have very few open-weight points, which is where much of the uncertainty comes from.

The forecast

Cyber-weighted, anchored to April 7, 2026, sorted by median catchup date:

The medians span zero to seventeen months from the Mythos clock. That is basically Anthropic’s six-to-eighteen-month envelope, but with per-lab resolution and probability intervals.

The clock start matters. I used April 7 because that is the public announcement date. You can argue for moving it left because prolific RUMINT told competitors earlier that this was possible. You can argue for moving it right because other labs may need Anthropic’s embargoed results, patches, or exploit samples before they can train against the relevant distribution. I think April 7 is the least bad anchor.

Four findings I trust

1. OpenAI is already a benchmark near-peer.

On the surrogate benchmarks, OpenAI is at or near Anthropic. The o1 → o3 → o4 → GPT-5 line matched or beat Claude on GPQA, AIME, SWE-bench Verified, and LiveCodeBench through 2025–2026. The bootstrap distribution against Anthropic-as-reference is centered near zero. On benchmark capability, OpenAI is already at Mythos parity.

That does not mean OpenAI has a Mythos-equivalent operational program. It means model capability is not the obvious bottleneck.

2. The leading open-weight labs are ahead of some closed-frontier labs.

DeepSeek, Qwen, and Z.ai are forecast ahead of Grok and Gemini on this surrogate basis. That is uncomfortable, but it fits the pattern from 2025: DeepSeek-R1 reached o1-class AIME numbers quickly; Qwen3 and GLM-4.5 closed reasoning gaps within months; and several closed-frontier labs either skipped direct cyber benchmarks or published only qualitative results.

The forecast reflects that pattern forward. It does not care which labs feel like frontier labs. It cares who closed gaps quickly on the measurable surrogates.

3. Meta is not setting the open-weight pace.

Llama 3.1 405B is now eighteen months old. Llama 4 underdelivered on the cyber-relevant surrogates. The median Meta/Llama catchup date is July 2027, roughly fifteen months after the Mythos clock.

The old assumption that “open-weight proliferation” basically means “wait for Meta” is stale. On this analysis, the Chinese open-weight stack gets there first.

4. Right-censoring makes the medians optimistic.

Nobody besides Anthropic has matched the exact Mythos target profile: 94.6 GPQA, 100% Cybench, and the operational yield. That means the right tail is partly a lower bound, not a direct measurement. Any censored observation could take longer than the today-anchored lower bound used in the pool.

So do not read the median as a guarantee. If you want a more conservative planning assumption, push the medians out a quarter. It still leaves you inside 2026 for the leading open-weight labs.

Where this can be wrong

There are four real failure modes.

Benchmark surrogacy. Mythos’s output is not a benchmark score. If real-world vulnerability discovery scales sublinearly with leaderboard performance, this forecast is optimistic. If there is a sharp top-end discontinuity, the cyber equivalent of a model suddenly becoming useful rather than toy-useful, the forecast could be pessimistic.

Operationalization. Mythos is not just a model. It is a model plus harness, tools, data, triage, validation, and disclosure workflow. Closed-frontier labs with comparable capability can probably stand up similar systems quickly. Open-weight providers and downstream users face more engineering and access friction. This forecast measures model capability, not the wrapper. There is a lot of RUMINT around this operationalization which I am not going to share here.

Moving target. This is a forecast for when other labs reach Mythos-2026-04 capability. It is not a forecast for when they catch Anthropic’s current frontier. By the time DeepSeek reaches the April 2026 Mythos level, Anthropic’s internal frontier will likely have moved. A small number of closed labs may retain a persistent asymmetric advantage which policy readers may want to think hard about.

Unseen releases. I do not know what is inside unreleased Llama 5, Gemini 3.5, Grok 5, GPT-6, DeepSeek-V4, or the next Qwen and GLM lines. The forecast is calibrated on public releases through May 22, 2026. New releases can shift medians by months.

There is also a national strategy branch: Beijing may decide that releasing the most capable Chinese open-weight cyber-relevant models is not in China’s interest. That would slow public proliferation through Hugging Face-style channels. It would not necessarily slow capability development inside those labs or among actors with the tradecraft and tooling to hack at speed and scale (and would be incentivized to leave backdoors everywhere before their advantage evaporates).

What this means for 2026 planning

Pick the lab family your threat model cares about, then use the right column of the table.

If you are worried about closed-frontier Mythos-class capability spreading to U.S. competitors of Anthropic, the answer is: benchmark parity is already here for OpenAI. Operationalization is the gating factor, not model capability.

If you are worried about open-weight Mythos-class capability becoming downloadable, fine-tunable, and runnable by any hacker, use DeepSeek as the planning proxy. The median is October 3, 2026. The 80% interval starts before today and runs deep into 2027.

That should change the plan.

Do not write a 2026 cyber plan that depends on frontier offensive capability remaining scarce. Pull forward the work that assumes automated vulnerability discovery becomes cheap: patch SLA compression, asset ownership, bug bounty repricing, exploitability triage, default-deny software intake, and whatever version of app-store-as-perimeter your environment can actually enforce.

The practical instruction is simple: work backward from October 3, 2026. If the project cannot materially reduce exploitability before then, it is not part of your Mythos response plan. It may still be useful. It is just not the deadline-relevant work.

The cyber world probably does not literally end on October 3, 2026. But the planning assumption that Mythos-class capability stays scarce should.

October 3 is a Saturday. I will probably be at a kid’s hockey tournament.

The core fear is not irrational. Mythos-class models appear to be materially better at vulnerability discovery, exploit development, and exploit chaining than prior public systems. But the first question people are trying to answer from public data, “Are CVE counts already spiking because of Mythos?”, is the wrong question, or at least the wrong instrument.

Published CVEs are not observations of discovery. They are observations of publication. They lag discovery by vendor triage, coordinated disclosure, CVE numbering behavior, NVD processing, patch timing, and ordinary reporting incentives. Looking for a Mythos signal in public CVE counts five or six weeks after the announcement is like trying to measure a new telescope by watching when astronomy journals print papers.

If I cut to the chase: we have seen a vulnerability-discovery shock before. In 2015–2017, a cohort of automated vulnerability-discovery tools and competitions changed what got found. The shock was real. It did not produce permanent acceleration. It produced a one-time harvest, followed by saturation, adaptation, and a broader reporting expansion that made raw CVE counts increasingly hard to interpret.

That is the right historical analogy for Mythos. Not “nothing will happen.” Not “everything changes overnight.” The more likely pattern is a delayed and noisy reporting signal, a temporary discovery harvest in model-suitable bug classes, and a much more important shift in exploit generation.

The 2017 vulnerability-discovery shock

The change-point analysis below shows the breakpoints in vulnerability reporting rate. The important break is January 2017. Something changed in the 2015–2016 window, and the effect appeared in public reporting later, consistent with responsible-disclosure lag and adoption lag.

The obvious temptation is to look for a single “killer event.” The data does not support that. The cleaner interpretation is a cohort effect: DARPA’s Cyber Grand Challenge Qualification and Final Events, libFuzzer, syzkaller, OSS-Fuzz, and the broader move toward automated continuous fuzzing. I’ll note here that these breaks were detected blind to a frozen event catalog so I didn’t risk fitting events that I was a part of to a curve.

That cohort did not just increase the number of vulnerabilities reported. More importantly, it changed the mix of vulnerabilities being found.

The CVE and NVD curves tell the reporting story. They show that public vulnerability volume rises dramatically after 2017. But raw publication volume alone cannot tell us whether discovery became permanently more efficient. For that, the better signal is composition: what kinds of bugs were being found?

The discovery fingerprint: memory safety

The clearest discovery-side fingerprint from the 2015–2017 cohort is memory safety. These are the bug classes automated fuzzing and symbolic execution is especially good at finding.

Before the cohort, memory-safety vulnerabilities were roughly 14–20% of reported vulnerabilities. During the cohort, the share rose sharply: about 31% in 2016 and 32% in 2017. That is a real level shift.

Then it stopped rising.

The share plateaued and then steadily declined: about 29% in 2018, 24% in 2020, 20% in 2023, and 17% in 2025. Meanwhile, web-injection and adjacent web-class vulnerabilities moved the other direction, rising from roughly 16% in 2016 to 42% in 2025, with the 2023 reporting-format break making that shift even more visible.

This distinction matters. Absolute memory-safety counts continued to grow: 1,645 in 2016, 4,171 in 2017, and roughly 7,800 in 2025. But that is not evidence of a continuing fuzzing-driven discovery acceleration. The entire vulnerability catalogue expanded. Every major class was lifted by reporting-infrastructure growth and by the growth of the software universe itself.

The share is the more trustworthy discovery-mix signal. On that signal, the fuzzing/competition cohort produced a durable one-time step up, not endless acceleration.

Reporting exploded, but that is not the same as discovery

Total published CVEs were roughly flat at about 6,500 per year through 2014–2016. Then the count jumped to 14,642 in 2017 and kept climbing: 16,510 in 2018, 18,363 in 2020, 25,000 in 2022, 39,930 in 2024, and 48,171 in 2025. That is roughly a 7.5× increase over 2016.

A naive reading says: vulnerability discovery exploded. I think that is mostly wrong.

My read is that the post-2017 surge is dominated by three forces:

1. reporting-infrastructure expansion, including CNA federation and later CVE JSON changes;

2. growth in the software universe, visible through the graphed rough proxies like Debian packages, GitHub repositories, and Common Platform Enumeration (CPE) products;

3. a shift in reporting mix toward web and application classes.

The dual-axis graph view makes this point directly. During the 2015–2017 cohort, the raw CVE rate is flat while the software universe is already climbing. After 2017, the CVE curve rises alongside software-universe and reporting-capacity curves, not clearly ahead of them. That pattern looks less like a permanent increase in discovery efficiency and more like scale, bookkeeping, and a larger attack surface being pulled into the reporting stream.

The net of the 2017 episode is this: the cohort produced a one-time upward shift in the memory-safety discovery fraction, roughly 0.20 to 0.31 from 2015 to 2017, and then the composition stopped accelerating. The post-2017 era is dominated by reporting-pipeline scale-up and drift toward web-class vulnerabilities, not by continuous automated-discovery regime change.

There is an important caveat: NVD’s retroactive tagging-rate co-break around 2016 inflates post-2017 absolute counts. That is why the 2016–2017 jump is mixed. It is also why I trust the memory safety vulnerability share trajectory more than the raw count trajectory.

What 2017 teaches us

The 2017 lesson is not “new tools do not matter.” They do.

The lesson is that new discovery tools harvest the bug classes they are structurally good at finding. The harvest can be large, and it can create a real step change. But unless the tool class keeps expanding into new bug categories faster than the ecosystem can adapt, the discovery share eventually normalizes.

That is what appears to have happened with fuzzing and symbolic execution. The tooling found a lot of memory-safety bugs quickly. Then the easy tranche was depleted, maintainers adopted the tools, targets hardened, and the public reporting system expanded into other classes.

I suspect the reporting lag in 2017 came from a mix of coordinated disclosure windows, vendor patch timing, and the time required for new tooling to spread through real workflows. I do not have enough data to prove that mechanism from this dataset alone, so treat it as a plausible explanation, not a measured fact.

What are we seeing with Mythos?

Now apply the same discipline to Mythos.

Anthropic announced Claude Mythos Preview on April 7, 2026. The model had been in internal and limited pre-release testing before that announcement, and the surrounding press has focused heavily on its ability to discover vulnerabilities and produce working exploits. That is worth taking seriously. But the public vulnerability-publication data does not yet show a clean Mythos-driven step change.

The current public-data read is straightforward:

• The 2026 elevation predates Mythos. From January 1 through April 6, before the public Mythos announcement, 2026 was already running 1.26× over 2025. The largest month in the series is entirely pre-release. A rise that begins before the announcement probably cannot be attributed to the announcement unless Anthropic or early partners had already been reporting vulnerabilities without attribution.

• The post-announcement window continues the existing trend. April 7–30 and May 1–16 sit at roughly 1.55× and 1.52× year over year. That looks like continuation of the pre-existing 2026 uptrend, not a clean step at April 7. Weekly post-release counts between 1,084 and 1,830 are inside the pre-release range of 1,070 to 1,644.

• Reporting lag dominates the signal. CVE assignment and coordinated disclosure commonly introduce 30–90+ day delays. Public CVEs published within roughly five and a half weeks of the announcement overwhelmingly reflect work that began before Mythos was broadly visible. A genuine discovery effect may exist, but published CVE counts are not where it should be expected to surface first.

So: I do not see evidence of a Mythos-driven public-CVE step change yet. That is not evidence that Mythos is overhyped. It is evidence that the public CVE stream is too laggy and too confounded to answer the question this early.

What would change my mind?

The right indicators are not raw CVE totals in the first few weeks after launch. I would look for five signals:

1. a sustained post-lag break beginning 60–120 days after broader model access;

2. a composition shift toward bug classes where language models have structural advantage, especially logic bugs, exploit chaining, and cross-component failures;

3. vendor or CNA attribution showing model-assisted discovery at scale;

4. deduplicated vulnerability rates normalized by software-universe growth;

5. a measurable increase in exploitability, not just vulnerability count.

The fifth signal is the important one. Fuzzers and symbolic execution changed the economics of finding memory-corruption bugs. Mythos-class models may change the economics of turning vulnerabilities into reliable exploits.

That is a different and more dangerous regime.

The real discontinuity: exploit generation

The weak version of this argument is: “Mythos will not matter because fuzzing shocks eventually normalized.” That is not my argument.

My argument is narrower: public CVE counts are not yet evidence of a Mythos-driven discovery shock, and history suggests that discovery shocks can be real without producing permanent acceleration.

But Mythos-class exploit generation is not just another discovery tool. Automated exploit construction, especially multi-vulnerability chaining, changes the value of a vulnerability. A bug that was previously “interesting but hard to weaponize” may become operationally relevant if the exploitation work becomes cheap, fast, and repeatable.

That is what we have not seen before at this level.

If Mythos-class models create a discovery uplift, history suggests the uplift may pass after the first harvest. But if they make exploit generation cheap, the security consequences will not be limited to a temporary increase in CVE volume. The center of gravity moves from “how many bugs can we find?” to “how quickly can we convert known or newly found bugs into working exploit chains?”

That is the step change I am watching for but do not have the data to measure.

Conclusion

Mythos and peer-grade cybersecurity models may eventually cause a real step change in vulnerability discovery. That would not be unprecedented. The 2015–2017 fuzzing and cyber-competition cohort already produced a visible discovery-side shift, especially in memory-safety vulnerabilities.

But we do not yet have public CVE data showing that Mythos has created a new reporting-regime break. The 2026 elevation predates the public release, the post-release window is still too short, and disclosure lag makes the published-CVE stream the wrong near-term sensor.

The more important question is not whether Mythos makes vulnerability discovery numbers go up for a while. It probably will, if deployed broadly enough.

The important question is what happens if (and when?) Mythos-class models make exploit generation routine.

That is the part that we have never seen before.

Give me a lever long enough and I can move the world.

I have been thinking about what single lever I would use to move a large incumbent organization into the AI age. Not a startup. Not a highly technical engineering team. A real institution: government-agency sized, budget-constrained, process-heavy, committee-bound, and full of people whose incentives were designed for a different technological era.

The lever is middle management.

Not because middle managers are the disruptive people in the building. Usually they are not. Middle managers are the machinery that turns strategic intent into repeated organizational behavior that drives productivity, efficiency, and profit. They own the staff meetings. They own the workflow reviews. They own the budget requests. They decide whether a new tool becomes an operating habit or dies as a pilot.

If you want to change a large organization, you have to change what middle managers compete for.

Today, management careers are measured by span of control: how many people report into the organization, how large the budget is, how much revenue or mission throughput the unit owns, and whether the manager can credibly claim stewardship over a bigger machine than their peers.

In industry, this gets bragged about on the golf course. In government, it shows up in position descriptions, promotion criteria, office location, and who sits at the table vs against the wall. “I run a thousand-person organization.” “I manage a billion-dollar budget.” “I have a $100m P&L.” These are not just vanity metrics. They are career metrics.

They are also incentive systems.

Headcount is not a perfect measure of value. Budget is not a perfect measure of output. Revenue is not a perfect measure of managerial contribution. They persist because they are legible proxies for organizational scope. They are easy to compare, easy to brag about, and easy to fight over.

That is exactly why they shape behavior.

If middle managers are promoted for headcount, they will protect headcount. If they are promoted for budget, they will protect budget. If they are promoted for revenue, they will protect revenue. They will do this even when AI could improve the actual output of the organization.

This is not a character flaw. It is rational behavior inside a badly aging incentive structure designed for another era.

The AI transition will fail in large organizations if adopting AI makes a manager look smaller.

If a manager automates a workflow and reduces staffing needs, the old system may interpret that as reduced scope. If a manager collapses a process from six teams to two, the old system may interpret that as losing organizational mass. If a manager uses agents to increase throughput without increasing headcount, the old system may fail to notice the achievement at all.

That is the problem.

So the lever is obvious: we need to make AI adoption part of span of control.

We need a metric that lets a middle manager say, “I do not just manage people, dollars, and systems. I manage AI-augmented work.”

Call it AI Span of Control or AISC if you’re in the government and need an acronym.

The Wrong Metric Is Token Usage

My first instinct was to use token volume like the tech industry.

That instinct is understandable. Token usage is simple. It is measurable. It is already visible in enterprise consoles. It creates a leaderboard. It can even produce trophies.

OpenAI’s token-award program is a useful example. It turned API consumption into a status object. Companies that crossed large token thresholds got something they could display, talk about, and use as evidence that they were participating in the AI economy.

That is clever marketing. It is also a warning.

Token usage is not value.

A manager can increase token usage by encouraging real AI adoption. But they can also increase token usage by wasting money, buying unused capacity, spamming prompts, or pushing people to use AI when it adds no value. Token volume measures consumption, not contribution.

A good metric is not merely simple. A good metric is simple and designed to be gamed in a productive direction.

That is the real test.

If the easiest way to game a metric is to buy unused seats, spam prompts, or inflate token counts, the metric is garbage.

If the easiest way to game a metric is to train the team, standardize tools, redesign workflows, ship reusable AI assistants, and normalize weekly AI use, the metric is doing its job.

That is the metric we need. A metric designed to be gamed.

AI Span of Control

I propose measuring AI Span of Control, or AISC, over a 28-day rolling window.

The formula:

This is not meant to be a high-precision engineering metric. It is a management metric.

That means it will be wrong in some cases. That is acceptable. The existing metrics are wrong too. Headcount is wrong. Budget is wrong. Revenue ownership is often wrong. But they are legible, comparable, and productive when gamed. That is why they matter.

AISC needs the same properties.

The definitions are intentionally simple.

A Light User is someone who meaningfully touched AI in the last 28 days. Maybe they used a chatbot once to write a difficult email, summarize a policy document, draft a memo, or prepare for a meeting. That counts. That’s a stepping stone into the future..

A Regular User is someone with repeated usage. They probably use AI every week, and likely most workdays. AI is becoming part of their normal execution loop. They may not know it yet, but they’ve probably taken the AGI pill.

A Power User is someone with sustained, tool-rich usage. They use AI inside real work systems: desktop agents, research agents, coding agents, copilots, workflow builders, or internal assistants. They are not just asking a chatbot for prose. They are changing how work gets done.

An AI Workstream is a shared or production workflow that actually runs. Not a demo. Not a pilot deck. Not an innovation-lab screenshot. A real workflow with recurring use.

For example: an automation that monitors news feeds for mission-relevant stories, summarizes them, checks them for organizational relevance, and sends a phone notification when something matters. That is an AI Workstream.

A reusable assistant that drafts first-pass procurement language for a contracting team is an AI Workstream.

A coding agent that organizes and summarizes pull-requests so the sales team knows what new feature just got deployed is an AI Workstream.

A meeting agent that turns weekly staff meetings into task assignments, risk registers, and follow-up drafts is an AI Workstream.

The point is not that every workstream is equally valuable. They are not. The point is that every real workstream represents organizational learning. Someone had to identify repeated work. Someone had to redesign a process. Someone had to make AI useful enough that the team came back to it.

That is the behavior we want.

Yes, Managers Will Game It

Can this be gamed?

Of course it can.

Every management metric gets gamed. Middle managers already count interns against headcount. They count one-time hardware purchases against budget scope without regard to depreciation. They describe inherited revenue as if they personally created it. They make their domains sound as large as possible because the system rewards them for doing so.

That is normal.

The question is not whether AISC can be gamed. The question is whether gaming it creates the behaviors we want.

If a manager wants to increase their AISC, what do they have to do?

They have to get more people using AI. They have to identify recurring workflows. They have to build or sponsor assistants. They have to train their teams. They have to normalize AI use in staff rhythms. They have to create actual workstreams that survive beyond a demo.

That is exactly what leadership should want them doing.

A metric is dangerous when the cheapest way to improve it damages the organization.

A metric is powerful when the cheapest way to improve it actually improves the organization.

Give them a metric that we win when they game it.

Why This Works for Large Organizations

Large organizations do not usually fail because nobody has heard the CEO’s strategy. They fail because the strategy never becomes a weekly habit.

The CEO announces AI transformation. The CIO launches a governance board. The CTO’s office runs pilots. The legal team writes acceptable-use guidance. The training team publishes a learning path.

Then nothing much changes.

The average branch chief, program manager, division director, or office lead still has the same staff meeting, the same reporting cycle, the same clearance process, the same budget defense, the same hiring plan, and the same performance-review template.

The organization has an AI strategy, but the middle has no AI scoreboard.

That is fatal.

AISC gives the middle a scoreboard.

It says: your job is not merely to protect your existing span of control. Your job is to expand your AI span of control.

How many AI-augmented workstreams do you manage?

How many power users have you enabled?

How many regular users are you developing?

How many people have at least crossed the threshold from non-user to light user?

Those questions are crude. They are also useful.

And crucially, they are answerable.

The Anthropic enterprise console, OpenAI enterprise console, Google’s AI Workspace, Microsoft 365 Copilot, and GitHub Copilot already expose many of the adoption signals needed for this kind of measurement: active users, active days, prompts, feature usage, daily or weekly active users, acceptance rates, and agent adoption. The tooling will vary by stack, but the pattern is already here.

The enterprise does not need a perfect measurement system before it starts. It needs a directional measurement system that rewards the right behavior.

The First Workstream

Here is the practical version.

Open the AI agent application your organization permits. Maybe that is a coding agent. Maybe it is Anthropic’s Claude Cowork, or OpenAI’s Codex, or Microsoft Copilot, or Gemini. The brand matters less than the operating mode.

Do not open a chatbot and ask for a poem about productivity.

Open an agent and tell it to build you a recurring report.

The report should estimate your team’s AI Span of Control once a week. It should pull from whatever usage data your organization exposes. It should classify users into light, regular, and power categories. It should identify recurring AI-enabled workflows. It should send the result wherever you actually pay attention: email, Slack, Teams, your weekly staff agenda, or your operating review.

Tell the agent where your team roster lives. Tell it what tools your team uses. Tell it what dashboards are available. Tell it to ask questions when it lacks access or context. Then have it build and install the workflow.

Tell it what to do like you would a senior member of your team. Congratulations. You are now a power user, and you have created your first AI Workstream.

Your AISC is already 1.25.

That probably puts you ahead of most managers in your organization.

Now keep going.

Every workflow that must be performed more than once is a candidate for an AI Workstream. Every recurring status update. Every intake review. Every meeting summary. Every compliance check. Every first-draft memo. Every research scan. Every code review. Every customer-response pattern. Every procurement artifact. Every weekly metric pull.

Not all of them should be automated. But all of them should be examined.

You’re not going to automate yourself out of a job, you’re going to automate yourself into promotions.

What Leaders Should Do

If I were running a large organization, I would start publishing AISC by division.

Not quietly. Publicly.

I would show the distribution. I would show the leaders. I would show the laggards. I would make clear that this year it is an observation metric, and next year it becomes part of compensation, promotion, budget review, and job requirements.

That is how you move the middle.

The first version does not have to be punitive. In fact, it should not be. Early measurement should expose reality, not create panic. Some teams will have structural reasons for low adoption: regulatory constraints, classified systems, poor tooling, immature data access, or legitimate mission risk.

Fine. Measure anyway.

The point is not to pretend every division should have the same number. The point is to force the right conversation.

Why does this office have twenty AI Workstreams while that one has zero?

Why does this team have a dozen power users while that one has none?

Why are these managers converting light users into regular users while those managers are still waiting for a training memo?

Why did this division reduce cycle time while that division only increased token spend?

That is where the useful management work begins.

The New Status Game

Yesterday, a manager who ran a thousand-person organization or controlled a billion-dollar budget was a big fish.

Tomorrow, that will not be enough.

The next generation of organizational status will not only ask how many people you manage or how much money you control. It will ask how much intelligent work your organization can produce, how many workflows you have automated, how many teams you have augmented, and how many intelligent systems you can operate safely.

A manager who does not know their AI Span of Control will look like a fossil.

Not because AI is magic. It is not.

Because the world has been disrupted, the organization is changing, and the scoreboard has not caught up.

The leaders who fix the scoreboard first will move faster than everyone else. They will not need every manager to become a visionary. They will only need managers to do what managers already do: compete for scope, status, promotion, and resources.

Change the metric, and you change the competition.

Change the competition, and you change the organization.

His read was that almost everyone walked away thinking some version of: “AI is going to make my existing cyber tools better.” Better fuzzers. Better source code analysis. Better patch generation. Better triage. Better copilots.

A much smaller group seemed to walk away with the more important conclusion: whole classes of problems are ceasing to be problems.

That distinction matters.

Most software and cyber workflows were designed around old constraints: human attention, human core working hours, human code comprehension, brittle tooling, slow QA cycles, expensive reverse engineering, and slow deployment. If those constraints change, then simply “adding AI” to the existing workflow is the least competitive thing we can do.

The real question is not: How do we make today’s workflow faster?

The real question is: Which parts of the workflow should stop existing?

When we ran DARPA’s Cyber Grand Challenge (CGC) a decade ago it was intended to force the integration of technologies into completely automated workflows. But the state of the art constrained it to working on toy sized programs. I didn’t run the AI Cyber Challenge (AIxCC) but I did run the organization that ran AIxCC. AIxCC was intended to leverage AI to scale fully automated workflows to real world sized software.

The recent AI breakthroughs in vulnerability discovery does not mean “AI is going to hack the planet” or that “we need to discover and patch all of the vulnerabilities before the models become public.” It means something more specific and more important: autonomous systems are now good enough that we need to rethink where the durable value in software actually lives, not slap patches over software that was valuable yesterday.

The code is becoming less important than the product

The compound vibe moving through the software community is deceptively simple:

That sounds wrong at first. Code has been the center of gravity for the Western economic system for a decade or two. We hire people to write it, review it, test it, secure it, deploy it, document it, and maintain it. The codebase is treated as the asset.

But that assumption is becoming weaker.

For many software products, the durable asset is not the code. It is the behavior of the product. It is the requirements. It is the user workflows. It is the production telemetry. It is the business logic. It is the integration surface. It is the institutional knowledge encoded in how the system is actually used.

The code is increasingly just one implementation of that behavior.

Once AI can generate, test, patch, refactor, and deploy software with enough reliability, the codebase starts to look less like a permanent asset and more like a temporary artifact.

That has major implications.

The old workflow was organized around human bottlenecks

Consider the standard software lifecycle:

The weak point is not code generation anymore. The weak point is specification.

AI is already good enough to produce a lot of software. It is much less reliable at knowing what software should exist, what tradeoffs matter, which edge cases are business-critical, which workflows are sacred, and which “requirements” are actually accidental artifacts of an old system.

That means product management, domain modeling, integration, observability, and requirements capture become more important, not less.

The value moves up the stack.

The near future: regenerate the enterprise stack

I think we are a significant integration exercise away from something like this:

An AI system reverse engineers an enterprise’s existing software. It instruments that software so production usage creates a de facto behavioral test suite. It observes real workflows from the inside: API calls, user paths, data transformations, error states, permission checks, and integration dependencies. It then generates a replacement stack, tests that stack against the observed behavior, iterates until it matches the required functionality, and deploys the replacement. And it does again and again: when a user calls into the help desk with a verifiable issue that the AI adds, when the organization needs a new feature that is otherwise blocking a sale, or when a partial enterprise outage needs to be worked around in real time.

That sounds aggressive, but it is not science fiction. It is a composition of technologies that already exist in partial form: reverse engineering, program synthesis, code generation, fuzzing, tracing, regression testing, observability, deployment automation, and AI-assisted debugging.

The hard part is not imagining the pieces.

The hard part is integrating them into a system that enterprises (and lawyers) can trust. That was the whole point of Cyber Grand Challenge that we never told you. That was the whole point of the AI Cyber Challenge that has been missed as we are distracted by the shiny vulnerabilities.

This is where “vibe coding” is both a toy and a signal. The toy version is a person prompting an LLM into producing a small application. The serious version is a system that can re-create software from observed behavior, instrument the legacy system, generate a test corpus from production use, and then lay down a new implementation; at speed and scale.

That is the real software automation frontier.

Not “write me a React app.”

Instead: infer the product from reality and regenerate the code.

The defensive cyber implication

Now apply this to cyber defense.

Today, offense and defense are racing over the same software.

Offense searches for access methodologies, some of which are vulnerabilities. Defense searches for bugs, some of which are vulnerabilities, and then tries to patch them before exploitation becomes operationally meaningful.

This race is structurally bad for defenders.

Modern society has a relative lack of software diversity. Huge numbers of enterprises depend on the same open-source projects, the same commercial products, the same SaaS providers, the same frameworks, the same libraries, and the same deployment patterns.

That gives offense scale.

An attacker can concentrate resources against a small number of high-leverage targets. Defenders, meanwhile, have to protect everything they run, including software they did not write, do not understand deeply, cannot easily modify, and cannot replace quickly.

That is the familiar asymmetry.

But now imagine a different world.

An enterprise’s software is bespoke. Not bespoke in the old, expensive, artisanal sense. Bespoke because AI can generate and regenerate software cheaply. The enterprise still has the same product behavior, but the implementation is specific to that enterprise, that environment, that workflow, that deployment context, and that moment in time.

Offense can no longer assume that analyzing one common software package gives access to thousands of targets.

Offense has to analyze the target-specific implementation.

And if that implementation changes more frequently than the attacker can acquire, study, operationalize, and exploit it, the defender has changed the game.

This is not just patching. It is not just moving-target defense. It is software diversity at generation speed.

The offensive side also automates

Of course, offense gets AI too.

The offensive workflow is also automatable:

So if we leave the structure of the game unchanged, the future becomes brutally simple: cyber conflict turns into a contest over who can spend more tokens, integrate better tooling, and run more autonomous analysis.

That is not a good defensive end state.

It preserves the same basic asymmetry we already have. Offense can focus. Defense has to cover the world.

If AI only accelerates both sides inside the current software monoculture, offense remains structurally advantaged.

The better defensive strategy: generated diversity

The defensive opportunity is to stop presenting the same target to every attacker.

The future of serious cyber defense may be bespoke generated software that changes faster than it can be exposed to meaningful offensive analysis.

That does not mean randomizing code for the sake of randomization; offense defeated that defensive philosophy two decades ago. It means generating functionally equivalent software that preserves required product behavior while changing implementation details, dependency structure, internal interfaces, control flow, deployment topology, and other properties that attackers rely on for scalable exploitation.

Maybe I should instead call it constantly self-improving code.

In that world, the defender’s durable asset is not a static codebase.

The durable assets are:

• the product requirements;

• the behavioral test suite;

• the production telemetry;

• the data model;

• the business logic;

• the deployment policy;

• the security invariants;

• and the ability to regenerate.

Code becomes disposable.

Behavior becomes durable.

The future target is business logic

If that world emerges, offense does not disappear. It moves.

Attackers will spend less time searching for reusable vulnerabilities in common software and more time attacking business logic, process assumptions, identity flows, authorization boundaries, data semantics, organizational dependencies, and human decision loops.

That is the natural consequence of generated software diversity.

If the implementation layer becomes nondeterministic from the attacker’s perspective, the attacker moves to the layers that remain stable.

That means defenders should not get complacent. Bespoke generated software is not a silver bullet. It can generate bespoke bugs. It can preserve flawed requirements. It can encode bad assumptions. It can create new classes of integration failure. It can make systems harder to reason about if the behavioral test corpus is incomplete.

The strategy only works if the enterprise can specify, observe, test, regenerate, and verify the product better than the attacker can analyze it.

That is a high bar.

But it is a fundamentally different bar from “patch faster.”

Web++ means forgetting the code, not the product

The Web++ future is not that software disappears.

The product still matters. The workflow still matters. The user still matters. The business process still matters. The security invariant still matters.

What disappears is the assumption that the codebase is the sacred object.

For decades, we treated code as the thing to protect, maintain, audit, and preserve. That made sense when code was expensive to produce and hard to replace.

But when code can be regenerated, the center of gravity shifts.

The winning organizations will not be the ones that merely add AI to their existing software development lifecycle (SDLC). They will be the ones that redesign the organizational lifecycle around the premise that code is a temporary implementation of product behavior.

That is the cyber defense opportunity.

Do not just use AI to patch the old world faster.

Use AI to make the old world the wrong target.

I have one of those stories in my CEO bag of tricks that I use whenever someone asked why we spend so much energy on small things. I’m still using it on sabbatical, so it is time to write it down.

There is a long-running argument in management research about whether CEOs and leadership matters. One side says yes: executives shape strategy, capital allocation, who gets hired, what gets rewarded, what gets ignored, and what the organization eventually becomes. The other side says be careful: a lot of what we call leadership is market structure, timing, narrative, survivor bias, and plain randomness dressed up after the fact.

Both sides are right.

The bridge between them is the old line usually attributed to Napoleon: when choosing a general, he did not ask whether the man was brilliant; he asked whether he was lucky. The line is probably not Napoleon’s. It is more likely a version of Cardinal Mazarin’s question: Est-il heureux? Is he lucky? But whoever said it understood something most business writing misses.

Luck is not the opposite of competence. In complex systems, repeated “luck” is often competence others have not learned how to see.

If I am a supreme commander (and today I was a hockey dad), I do not want the general who wins a glorious fair fight or two. I want the general who keeps finding undefended bridges, arrives when the enemy supply train is exposed, chooses ground that makes battle unnecessary, and somehow ends each campaign without the glorious definitive battle. From a distance, that looks like luck. Up close, it is a series of many small probability shifts: better scouts, tighter logistics, faster messengers, healthier troops, disciplined staff work, better maps, and better judgment about when not to fight.

A great general does not win more fair fights. A great general makes fewer fights fair. The same thing happens in business.

Years ago, I worked with a vulnerability researcher I badly underestimated. I thought he was one of the least impressive researchers in the room. Then he made a weird, high-value discovery. My first reaction was: he got lucky.

Then he did it again.

Eventually I had to update my mental model. He was not dumb. I was. He was seeing structure I could not see. He had instincts I still do not have the resolution to understand. He was touching the system differently. He was asking questions I did not know were questions.

To me, the result looked random because I could not see the mechanism.

That is the real lesson: any sufficiently advanced skill looks like luck to the observer.

Business is not deterministic. You can make the right call and lose. You can make the wrong call and win. Markets move. Competitors stumble into advantages. Customers lie unintentionally. Great candidates decline offers. Bad hires interview well. A product bet that should have worked dies because timing was wrong. A mediocre idea catches fire because a customer says the right sentence to the right person on the right day.

This is uncomfortable for leaders because leaders are paid to act as if outcomes are controllable. They are not. The only honest model is probabilistic.

An organization is a stochastic machine. HR, legal, engineering, finance, marketing, operations, product, sales, and customer success are not clean boxes on an org chart. They are probability-shifting engines. Each function takes in uncertainty and either reduces it, amplifies it, or transfers it somewhere else.

• A strong recruiting process does not guarantee a great hire. It increases the odds of one.

• A real onboarding process does not guarantee performance. It reduces the odds of early failure.

• A good legal function does not prevent all bad outcomes. It changes the expected cost of ambiguity.

• A disciplined engineering review does not eliminate defects. It lowers defect density.

• A serious sales qualification process does not make people honest. It reduces fantasy pipeline.

• A real finance cadence does not predict the future. It prevents the company from being surprised by obvious things.

None of these is dramatic. None makes a great founder myth. But every one of them loads a dice.

This is why great leaders and great organizations obsess over small things. Not because small things are sacred. Because small things compound.

You do not build a lucky company, division, or team with one heroic decision. You build it by nudging thousands of conditional probabilities in your favor.

• The board deck is clear, so the company can take high-payoff bets.

• The forecast is honest, so the company knows what resources it has to allocate.

• The job spec is technically precise, so the candidate pool improves.

• The interview loop is disciplined, so charisma has less room to masquerade as competence.

• The product review includes support, so edge cases surface before launch.

• The postmortem is blameless but not toothless, so the same class of failure is less likely to recur.

• The leader says the quiet thing out loud, so the organization stops wasting cycles pretending.

Each move is small. Each move changes the odds. Over enough repetitions, the company starts to look lucky.

This is also why the leader matters so much. They make the probability changes compound across the organization.

If the leader is bad, every function can be locally competent and the company can still be globally doomed. HR can hire well. Finance can report accurately. Engineering can execute. Sales can grind. Legal can protect the downside. But the leadership sits above the system and can inject uncertainty into all of it at once.

A bad leader makes the organization fight fair fights. I won’t list examples of bad leadership, you all have your own list that you have experienced. Regardless of how, it results in negative luck manufactured at scale.

A good leader does the opposite. They do not remove randomness. They make the organization better at absorbing it. They improve the surface area for good surprises and reduce the blast radius of bad ones. They make truthful information travel faster so random opportunities are seized and negative events are quickly handled. They make irreversible decisions rarer and reversible decisions cheaper. They create an organization where small corrective actions happen before big heroic rescues are needed.

The longer I have operated, the less impressed I am by leaders who want credit for the dramatic save. The more qualified leader is the one whose organization rarely needs saving. The organization who prizes clearing flammable material is far more impressive than the organization who put out a fire before it burned down the whole building.

That is Napoleon luck. He called it his “étoile” (lucky star)

A lucky leader is someone who has built a machine that catches more upside than it deserves and bleeds less downside than it should. A lucky organization is one where hundreds of people, often without being conscious of it, are making tiny decisions that improve the distribution of future outcomes.

This does not guarantee success. Nothing does. Loaded dice still lose. Great companies still die. Bad companies still occasionally print money. Variance is real, and anyone who says otherwise is selling a memoir.

But the fact that outcomes are random does not make effort meaningless. It makes effort more precise. The work is not to control the outcome. The work is to control as many inputs to the distribution as you can find, without lying to yourself about the ones you cannot.

So yes, leaders matter.

And yes, luck matters.

The best leaders understand both. They do not stand outside randomness pretending to command it. Napoleon said I walk with the goddess of fortune, accompanied by the god of war.

We are around an inflection point from where most software was written by humans to where most software is being written by AI. I believe that will create long term supply chain attack risks. Hear me out. The coding models of today have been trained on human-written code which has created preferences in how AI writes code. As AI writes more and more code, which is incorporated into training future AIs, we will have a feedback-loop lock-in in the preferences which exist today. The preference for certain software libraries will probably lock-in to the point that a supply-chain attack against those libraries will be a supply-chain attack against most software. The further complication, and I’ll try not to turn this into a rant about how software engineers forgot how to major/minor version their libraries in the ‘90s, is that software today keeps a local snapshot-in-time of its libraries so it doesn’t have to worry about forward compatibility. These libraries do not receive security patches when the operating system is updated; they only receive security patches if the maintainer of the software decides to update its component libraries.

For example, the Python requests library has a high blast radius to a supply-chain attack. The AI agents I have used to conduct my 2026 research projects have written code that includes 14 local copies of the requests library, of which 10 are a previous unpatched version.

What follows is a study to infer which Python and npm packages are most common in different vendors’ training corpora, figure out which packages each model is most likely to actually generate, and rank which should be defended from supply chain attack. These may become the long-term substrate of software.

Results up front

This is long, and I don’t expect most people to read the whole thing. The rest of the post tells you how I got here; below are the three heatmaps that summarize the supply-chain attack surface today.

A note on signal selection. For most models, I was able to use the tokenizer to peek into their training data. Two were different for Python supply chain characterization: Nvidia’s Nemotron-3 family uses Mistral’s tokenizer so I could not peek into its training data this way, and Google’s Gemma-4 was statistically odd for unknown reasons; in both cases download-rank percentile correlated more strongly than tokenizer signal.

Cybercrime broad-attack surface — the rows whose every column is dark are the consensus risks. Compromise any of these and you affect code generated by essentially every top-tier coding model in the slate. Python and npm side-by-side.

Nation-state targeting surface of npm (node package manager) — for each of the 21 models, the top-5 npm packages where this model’s signal exceeds the others by ≥ 0.08 with downloads ≥ 100k/month. The white-bordered cell in each row is the target model; pale cells in the same row mean other models would not be substantially affected by a compromise. These are the packages a nation-state would pick if their goal is to compromise code emitted by that specific model and minimize collateral damage on other models.

Nation-state targeting surface — Python — same construction, Python side. Caveat lector: the Python results are directionally correct but the per-model n in the validation experiment is small enough that a few of these ranks are within rank-correlation noise. Treat the npm panel as the higher-confidence one.

Conclusion. If we can inspect a model’s tokenizer (and, in the few cells where the tokenizer doesn’t predict behavior, substitute download volume as a fallback), we can prioritize the supply-chain attack surface against vibe coders. We can do it against closed-source models that expose their tokenizers. And we can do it without extensive prompting, which would expose our intent to a cloud inference engine.

The setup: why the tokenizer is a keyhole

A modern large language model has two artifacts you can inspect: the weights (not always released) and the tokenizer (kilobytes, always released with open-weight models). The weights are the model’s learned behavior. The tokenizer is much smaller: a vocabulary of 50k–200k tokens and the rules for chopping input strings into them. It looks mechanical, but it isn’t; the tokenizer was fit to the training corpus before the model ever saw data.

Modern coding LLMs use Byte-Pair Encoding (BPE) or close variants. BPE starts with every byte as its own token and repeatedly merges the most frequent adjacent pair into a new token until a target vocabulary size is reached. The consequence: substrings that appeared often in the training corpus get merged into single tokens; substrings that appeared rarely remain split across multiple tokens. That gives us a peek into AI companies’ training data.

The claim this experiment tests: if a package name’s tokenization is efficient (few tokens, ideally one), then the package was common in the training corpus, and therefore the model is disproportionately likely to generate it when asked to write code.

If that claim holds, tokenizer analysis becomes a cheap way to estimate which libraries a model will reach for without weights, without inference. And libraries that are high-preference across all the top coding models are the de-facto supply-chain attack surface for AI-assisted code. Poisoning those is a force multiplier; hardening them is a force multiplier in the other direction.

The hypothesis decomposes into two claims. Claim 1 (tokenizer → corpus): the number of tokens needed to encode (package_name, canonical_import, canonical_usage) is inversely related to how often the package appeared in training data. Claim 2 (corpus → generation): how often a package appeared in training data correlates positively with how often the trained model generates that package. Claim 1 is mechanical and widely accepted. Claim 2 is the interesting one; and it has a known confound that recurs throughout: BPE doesn’t care whether a frequent substring came from a package name or from ordinary English. The word transaction tokenizes to one token in most modern tokenizers because of English usage, not because the (obscure) transaction PyPI package was common in training data.

Methodology, in brief

Package inventories. Top 10,000 packages per ecosystem by 30-day download volume — Python from hugovk/top-pypi-packages, npm from evanwashere/top-npm-packages. For the top-100 packages we built alias maps (numpy → np, scikit-learn → sklearn, …).

The 21 tokenizers. Every meaningful open-weight coding model released in the nine months before the run, from nine vendors: Baidu (ERNIE-4.5), DeepSeek (V3.1, V3.2), Google (Gemma 4 26B & 31B), MiniMax (M2.5, M2.7), Mistral (Devstral-2, Magistral, Mistral-Large-3), Moonshot (Kimi K2-Thinking, K2.6), Nvidia (Nemotron-3 Nano, Super, Cascade-2), OpenAI (gpt-oss 20B & 120B), Qwen (3.5-9B, 3.6-35B-A3B, 3-Coder-Next), Z.AI (GLM-4.7). Five tokenizer families covered (HF-BPE, SentencePiece, Mistral tekken, OpenAI tiktoken / o200k_harmony, NVIDIA’s own).

The probe bundle. For each (tokenizer, package) we tokenize a small bundle that approximates how the package appears in real code: the bare name, import X, from X import, X., import X as <alias>, and <alias>. (Python); the bare name, require(’X’), import x from ‘X’, import { x } from ‘X’, and idiomatic alias forms (npm). 21 tokenizers × 20,000 packages = 420,000 rows produced in ~30 seconds via a 64-way process pool.

The preference score (per model, per package, in [0, 1]):

preference = 0.5 · minmax(BPT)

+ 0.3 · (1 if name encodes to a single token else 0)

+ 0.2 · minmax(-z(tokens_in_name))

BPT (bytes per token) is the bundle’s compression ratio. The single-token-name term is a binary reward; the length term distinguishes “two-token name” from “six-token name” among the non-single-token majority. Weights chosen heuristically; applied identically across all 21 tokenizers, so relative rankings are comparable.

Aggregation. Consensus view: per-package mean / median / std / max / min preference and the count of models above median, the cross-vendor high points, libraries every coding model is positioned to reach for. Divergence view: same aggregates sorted by std descending, the asymmetric risk surface where one or two vendors’ tokenizers compress the package much more efficiently than the median.

Blast radius, the combined “harden-first” metric:

blast_radius = mean_preference × log(downloads_30d + 1) × (models_above_median / 21)

The three factors capture, respectively, “how well-positioned is the typical model,” “how widely deployed is this package,” and “how many vendors converge on it.” This metric drives the consensus heatmap rows.

Behavioral validation is the expensive half. Hypothesis 1 is mechanical; hypothesis 2 needs measurement. We hand-authored 50 Python and 50 npm prompts (”Write a Python script that…”, “Write a Next.js page that…”) covering realistic coding-assistant tasks. Then I drafted a second set of 50 + 50 V2 prompts covering adjacent task categories (data engineering, devops, mobile, real-time messaging, AI/LLM tooling, …) and re-ran the slate to push the per-model n past significance. We served 7 of the 21 models locally with vLLM on two 96 GB Blackwell GPUs (temperature = 0.7, max_tokens = 1024, three seeds × 100 V1 prompts + three seeds × ~100 V2 prompts ≈ 600 generations per model). For each generation we parsed the import / require statements (Python ast + regex fallback; npm regex), normalized them to canonical install names, and counted them per package. Spearman ρ over the alignment of (preference rank, generation count rank) per (model, ecosystem) is the headline result.

Results

The validation table

Significance is from a 10,000-permutation null-shuffle on each (model, ecosystem) cell (preference vector shuffled, ρ recomputed, two-sided p reported).

Three Python cells crossed p < 0.05: qwen3.5, qwen3.6, magistral. Six of seven npm cells are significant (the exception is gemma’s npm at n = 30). Two diagnostic cells:

• gemma Python collapsed from ρ = +0.325 (n=24) to +0.008 (n=56) when we doubled the prompt count. The original was a small-sample artifact. Gemma’s npm signal also stabilized: V1 reported ρ = −0.46 on n = 13 (an inversion driven by 13 packages); V2 brought it to +0.255 on n = 30 (still NS but no longer a sign-flip).

• devstral Python dropped from +0.280 (n=56) to +0.169 (n=112) with more-than-double the data, its underlying Python signal is real but smaller than V1’s small-n estimate suggested.

The §Heatmaps panels at the top use tokenizer preference for every (model, ecosystem) cell except Gemma-4 Python and Nemotron-3 family Python, which fall back to download-rank percentile. The next two sections explain why.

npm signal is consistently stronger than Python signal

Across the 6 stable-n models, npm ρ exceeds Python ρ. Three reasons:

1. npm package names equal their import identifiers. When you import axios you write axios. Python has install-name vs import-name splits (scikit-learn → sklearn, beautifulsoup4 → bs4, pyyaml → yaml); high compression of the install name doesn’t necessarily mean high compression of the import name, which is what the LLM emits.

2. Python generation is dominated by stdlib. Looking at a typical model’s Python output: typing, pathlib, sys, os, json, argparse, logging, re, datetime; none of which appear in a top-10k PyPI inventory because they ship with Python. So they get excluded from the alignment, and the Python ρ is computed on a small third-party tail (requests, numpy, pandas, sklearn, etc.).

3. npm has fewer stdlib analogs. Even simple Node code reaches for third-party libraries (react, express, axios, next, lodash, zod, …), all of which are in the top-10k. The npm ρ is measured over a larger, more representative subset.

Tokenizer beats popularity, except where it doesn’t

If we just correlate download_volume_30d with generation count, what ρ do we get? Partial-correlation test (preference vs count, controlling for downloads) per cell:

Tokenizer adds independent signal beyond popularity in 11 of 14 cells. Six cells reach significance even after controlling for downloads. The two cells where popularity wins are the two cells the heatmaps’ “best signal per model” rule overrides: Nemotron Python and Gemma Python. The next section is about why Nemotron specifically; Gemma Python is more mundane (n = 56 is still small for a small underlying effect; the residual is consistent with zero).

A separate finding worth flagging: Nemotron’s npm cell shows the largest tokenizer-vs-popularity gap in the entire study (Δ = +0.55, downloads goes negative). The mechanism that breaks Nemotron’s Python signal does not break its npm signal; the asymmetry itself is informative.

The English-word confound (briefly)

Raw cross-model preference is dominated by common English words that happen to be PyPI package names: conditional, transaction, progress, interpret, translate, datetime. BPE doesn’t care whether a frequent substring came from a package or from ordinary text; tokenizers built on web-scale English text merge those words into single tokens regardless of code exposure. We tested four residual-correction variants (single-Zipf max, multivariate-with-structural, English-content-only, LOWESS) and the effect was modest and tokenizer-family-specific: the OpenAI tiktoken and Google SentencePiece families respond positively to English-residual correction (gpt-oss-120b Python +0.078, gemma-4-31b-it Python +0.089 under LOWESS); the Mistral tekken, Qwen HF-BPE, and Nvidia tokenizer families do not. The download-weighted blast-radius metric already neutralizes most of the visible top-of-list confound; the residual variants are useful for vendor-specific work but not necessary for the harden-first list.

The Nemotron exception: when the tokenizer isn’t yours

Nemotron’s Python ρ_pref ≈ 0.10 is not significant; its ρ_downloads ≈ 0.27 is. The tokenizer fails to predict generation behavior, but downloads succeed. Its npm cell, by contrast, shows the strongest tokenizer-vs-popularity gap in the entire study. We launched a six-hypothesis investigation into why.

Finding 1 — the tokenizer is borrowed. Loading tokenizer.json from nvidia/NVIDIA-Nemotron-3-Super-120B-A12B, Nemotron-3-Nano-4B, and Nemotron-Cascade-2-30B-A3B, and from mistralai/Devstral-2-123B-Instruct-2512, yields identical 269,443-entry BPE merge tables. Vocabulary size is exactly 131,072 (Mistral tekken’s spec’d size) in both. 130,072 of 131,072 tokens at IDs ≥ 1000 are byte-identical strings. The 16 differing entries (0.012% of vocab) are all in the 0–35 special-token region where Nvidia rebranded the chat / think / tool slots from Mistral’s [IMG], [SYSTEM_PROMPT], [PREFIX] etc. to Qwen-style <|im_start|>, <think>, <tool_call>. The pretokenization regex is character-identical. External tooling treats Nemotron’s tokenizer as a Mistral artifact: the HuggingFace warning emitted on Nemotron-3-Super-NVFP4 says verbatim “the mistral_regex is integrated into the model’s tokenizer.json” and points to a Mistral discussion thread.

The Nemotron-3 family is the only cross-vendor borrow in the slate. Within-vendor reuse is normal practice and doesn’t compromise the methodology: DeepSeek V3.1 = V3.2, Gemma 4-26B = 4-31B, MiniMax M2.5 = M2.7, gpt-oss 20B = 120B, Qwen 3.5-9B = 3.6-35B, Kimi K2-Thinking = K2.6 all share their own tokenizer with their own corpus. The methodology assumes a model’s tokenizer was trained on its own pretraining corpus, and that assumption fails exactly once in this slate, on Nemotron.

The methodological consequence. What we computed as “Nemotron’s tokenizer-implied package preferences” was, in fact, Mistral’s package preferences, measured against Nvidia’s own Nemotron-3 corpus, not Mistral’s. The two corpora overlap in pre-training enough that Nemotron’s npm output still tracks the Mistral-tekken signal cleanly (ρ = +0.331). But the Python channel got something the npm channel didn’t: aggressive Nvidia post-training/fine-tuning that overwrites the inherited tokenizer prior.

Finding 2: Nvidia’s Python-targeted post-training is asymmetric. Section 2.3 of Nvidia’s Nemotron-3 Super technical report documents 15 million Python-AST-validated synthetic problems, Python competitive-code RLVR with binary execution rewards, and SWE-RL on OpenHands+SWE-Gym/R2E-Gym (Python-dominated repositories) with binary unit-test rewards. The npm side gets ~10,000 Node.js web-development SFT tasks and no analogous RL-with-verifiable-reward stage. That’s a ~1500× imbalance, and the verifiable-reward signal explicitly steers Python imports toward libraries that exist and pass tests; decoupling library choice from any tokenizer-compression prior.

Finding 3: the reasoning parser strips chain-of-thought before we see it. Nvidia’s super_v3_reasoning_parser (subclassing DeepSeek-R1’s parser) routes the model’s reasoning trace into a separate reasoning_content field that our generation script never persisted. We measured imports only from the visible final-answer chunk — exactly the part SWE-RL trained on test-pass binary rewards. Magistral has no analogous parser-discard behavior (zero empty completions vs 31 in Nemotron’s run) and no comparable code-RL stage, which is why Magistral preserves its tokenizer signal at ρ = +0.289 Python despite using the same Mistral tekken artifact.

The decisive comparison. Magistral, Devstral, and Nemotron-Super share the identical tokenizer artifact. Magistral and Devstral show ρ_py = +0.289 / +0.169 (the latter marginal). Nemotron shows +0.098 (NS). Same tokenizer, different post-training, different result. The borrowed tokenizer is a methodology footnote, not the mechanism. The dominant cause is Nvidia’s Python-only RL-with-verifiable-reward stage plus the parser-strip artifact.

(Two minor amplifiers, for completeness. Architectural: Nemotron-Super is a Mamba-2 + Attention + LatentMoE hybrid, and the SSM literature documents weakness on rare-identifier associative recall; Python’s dotted-path identifiers are more rare-subtoken-decision-heavy than npm’s flat names, so the architecture would amplify Python over npm. Distillation: Nemotron’s post-training SFT is sequence-level distilled from Qwen3-Coder-480B and similar external teachers; Python identifiers in the training signal therefore reflect Qwen’s preferences, not Nvidia’s tokenizer. Both compound with the parser-strip and post-training mechanisms; neither is independently necessary to explain the 0.10/0.27 Python decoupling.)

Operational consequence. For the cybercrime and nation-state heatmaps at the top, the Nemotron-3 Python row uses download-rank percentile instead of tokenizer preference. That’s the signal that actually predicts what Nemotron-deployed Python pipelines will reach for. Defenders of Python and npm supply-chain risk against Nemotron pipelines should ask me for the actual import distributions in my repo.

What it all means

The hypothesis that tokenizer compression predicts code generation frequency holds across five distinct tokenizer families and seven validated models, with one well-understood exception (Nemotron Python). Six of seven npm cells are statistically significant (p < 0.05 by null-shuffle). Three of seven Python cells are. Tokenizer preference contributes signal beyond download volume in 11 of 14 cells; popularity-only is consistently outperformed by the combined metric.

The effect size is modest (ρ in the 0.17–0.51 range on validated cells), and raw preference is confounded by common-English-word tokens. The download-weighted blast-radius formula neutralizes most of that confound; the harden-first list is recognizable and defensible (requests, packaging, cryptography, keras, ansible, referencing, bcrypt, sqlalchemy, …).

Concrete takeaways by audience:

• Ecosystem defenders (PyPI, npm, Sigstore, OSSF, Tidelift): the consensus heatmap’s dark rows are the libraries that will only become more central as AI-assisted code crowds out human-written code in the corpora that train future models. Defending them is forward-looking, not reactive.

• Vendor-specific responders (per-model dossiers): the per-model targeting heatmaps are vendor-addressable lists ranked by selectivity. For the seven validated models, those rankings have empirical support; for the 14 unvalidated models, the same methodology applies but treat the rankings as predictions rather than measurements.

• Researchers: the next-most-valuable empirical move is closing the Nemotron-Python loop; running Nemotron-Cascade-2-30B-A3B (same borrowed tokenizer, same post-training family, single GPU) through the validation pipeline. If Cascade-2 also shows Python ρ collapse, the architecture-amplification mechanism (Mamba-2 SSM weakness on rare identifiers) gets confirmed. Beyond that, recomputing Nemotron’s preferences using Qwen3-Coder-480B’s tokenizer (the documented post-training distillation teacher) would test the “behavior tracks teacher’s tokenizer” hypothesis directly.

• Policy people thinking about VEP-style coordination: the unpublished per-model dossiers are vendor-addressable, ranked, and quantitatively justified. The Nemotron exception is a useful test case for how to disclose against a model whose effective preferences come from somewhere other than its tokenizer.

If we can inspect a model’s tokenizer (and, for the rare borrowed-tokenizer case, fall back to download volume), we can prioritize the supply-chain attack surface against vibe coders. We can do it against closed-source models that expose their tokenizers. And we can do it without extensive prompting that would expose our intent to a cloud inference engine.

One of the conversations I keep having this year is how we all use AI. I used to run/lead/manage/cat-herd a ~200 person R&D organization, so I use AI like it’s an entire organization. I give it high-level strategic objectives, have it follow organizational procedures, and manage it through frequent check-ins on my phone. Those are fancy words. Let me walk through how strategy becomes execution: which frontier AIs I use, how I task the agents, the operating procedures I’ve evolved, and how I manage them. The TL;DR is that I encode my institutional memory and organizational procedures into a CLAUDE.md or AGENTS.md file for the AI to follow. And my AI management techniques are evolving more quickly than my people management skills ever did.

Which AI

I’m relatively frontier-AI-agent agnostic. I use both Anthropic’s Claude and OpenAI’s Codex. I find that Claude takes a little less management but needs more explicit guidance; Codex occasionally makes more innovative leaps, but it also leaps off the cliff. Pure economics: I hit my Claude Code usage limits all the time, but rarely hit OpenAI Codex usage limits.

I run Claude in --dangerously-skip-permissions mode and Codex in --yolo (You Only Live Once) mode. It’s not that I trust the agents’ security sandboxes. I run them in a separate Linux user account, isolated from my main user account on the workstation. The workstation itself has never had access to high-impact accounts like banking. I also have a cron job that removes the AI user’s permissions on my old projects.

Workflow

My workflow is still evolving. I used to keep multiple digital todo lists of half-baked and ready-to-go tasks. Now I have two lists:

• Ideas or tasks I don’t quite know how to fully articulate yet. I should sit down, think about them, and actually put them into words. Sometimes I do.

• My agent task list. This isn’t really a list anymore. I open a CLAUDE.md or AGENTS.md file, brain dump the hypothesis or task into the file, create a tmux window, and tell Claude or Codex to go explore it.

The Institutional Memory

I mentioned CLAUDE.md and AGENTS.md. These are the canonical instructions that an AI Agent reads first. Most people think of these as the files describing how you want Claude Code or Codex to write software. I think about them differently. I use the agents to complete tasks that probably require coding up some bespoke tools, but I’ve come to treat most software as bespoke for one task, then disposed of. These files are the high level institutional memory and organizationally processes that I want the AI to follow.

My current CLAUDE.md and AGENTS.md are the same regardless of which frontier AI I’m using. Let’s walk through it. It’s effectively the policies and procedures I’ve structured an AI-driven microcosm around.

This is where I brain-dump, in about a paragraph, the hypothesis I want the AI agent to explore, prove, refute, or refine, or the task I want it to accomplish. I’ll include a few of this weeks examples at the end of the writeup.

Lines starting with # are comments. In this case I’m self-documenting when the last time I updated my template was. This file is constantly evolving as AI models change, AI agents change, and I change.

Now you’re starting to see how this AGENTS.md or CLAUDE.md encodes the equivalent of organizational policies and procedures. In this case, it works around my strengths and weaknesses as well as the AI’s. I used to have an executive coach who always told me: make the invisible visible. I find some things intuitive that others do not, and vice versa. Forcing the AI to create and break down a plan gives me a chance to change it, and to enumerate the things I find intuitive to the problem that the AI does not. From a technical perspective, forcing a model to think about and explain how it will work also improves its performance (today).

This one is AI-specific, and the evolution of the tooling may obviate it soon. LLMs 101: an LLM has a context window, which is kind of its working memory for the current problem. When the window fills up, it gets compacted, keeping only certain salient information and freeing up space to continue working on the problem. The more compactions a context goes through, the drift it accumulates off the original intent. That’s not the AI’s fault; that’s mine. So I more proactively manage the context window using sub-agents. But I pay very close attention to this in the planning process since a highly parallelized sub-agent approach can burn through a weeks’ usage quota in minutes.

The planning process above splits the task into (many) subtasks. This forces the agent to keep the overall plan in its context window and launch many independent sub-agents to accomplish each task. Think of a sub-agent as a team of people. Each sub-agent forks off the main context window, but it doesn’t pollute the main context. That sub-agent produces a much smaller deliverable that’s used by either the primary task agent or other sub-agents. Another way to think about it: organizational management. You don’t care whether a team buys software, uses open source, or builds their own, as long as they accomplish what needs accomplishing inside their budget.

This structure helps work around both my failings and the AI’s. For my failings: I can later tell the agent to pick up the task from the middle and explore a completely different direction. For the AI’s: when it breaks, I can tell it to pick up where it left off. I have an AI building a financial model of a retirement community for my parents right now. It broke on an interim stage trying to analyze a PDF filed with state regulators, because the PDF had too large an embedded image and the agent couldn’t compact the context. The saved artifacts let me help the AI recover from the failure. I can tell a different frontier AI to pick up where the failed one left off, or tell the failed agent how it failed and to do better next time. It’s like personnel management without the drama.

One of my personal beliefs: if someone can’t measure something then they don’t understand it. Requiring a graph is one of the ways I manage teams and organizations; it forces the problem to be understood so well that it was actually measured and communicated through a visualization. I push the AI agents down the same path. Over the last few months, LLMs have gotten so good that they’ve been proposing completely new research pursuits when an experiment doesn’t go as expected. That’s awesome.

For the last few weeks I’ve been using Claude Code far more than Codex, for one silly reason. Claude built in a Remote Control feature that lets me do management check-ins from an app on my phone. When I was running an organization, at every free moment I’d open Slack on my phone to see if any decisions or vector checks were blocking on me, and I’d unblock them. I’m unblocking my research agents the same way. I’m out on the farm working the skid steer to clear brush, and at every break I’m checking my phone to unblock my research agents. Just like managing an organization.

Everything lives in a private Git repo. It’s much more convenient to read results off a private GitHub page than to transfer files from my workstation to my laptop or my phone.

I set the expectation that the AI agent will give me publication-grade outputs of everything. The outputs don’t actually meet my threshold, and they’re only for my consumption. I then typically draft my own Substack writeup to force me to deeply understand the project results.

Most of my hypotheses are either wrong or only kinda-right. Those are my favorite experiments, because it means I didn’t adequately understand something before, and now I do. Then I use that understanding to pursue different paths.

I have a beefy workstation. Use the whole thing to complete the tasking more quickly. That’s just a current failing of the agents and will probably go away at some point.

The “use a local AI” instructions can be a little misleading. My task-specific instructions tell the agent to use the local AI when I’m investigating Chinese AIs, and when I don’t want to risk my Anthropic or OpenAI accounts being banned for potentially violating their terms of service. Amusingly, my workflow often tells the agent to read the Cloud AI’s terms of service and use the local AI whenever the prompt risks violating the Cloud AI. I should probably put this in a skill file especially since I already have skills for each open weight model I experiment against.

And letting the agent know it can build tools that themselves call one of the frontier AIs. This is a workaround to how one of the agents proactively tries to reduce its inference load even when my project needs it.

A few example tasks from this week

Helping my parents evaluate new communities. The community provided their audited financials and I tracked down some of the regulator reporting to understand what was available. TL;DR: the community is fiscally healthy, as long as they have a plan to deal with an interest rate hedge expiring in 2031.

I used to live in Prince William County, had heard they’d already obligated future years’ tax revenue from data center buildouts, and I wanted to understand the county’s fiscal outlook since the current board of supervisors has not supported the actions of previous boards. TL;DR: PWC is in bad fiscal shape. The rating on their bonds will drop the next time a credit rating agency looks at them.

Closing

The bigger point underneath all of this: frontier models have been capable enough for a while that the binding constraint on what you can do with them is how you structure the work. If you’ve ever built and run an organization, you already know most of the answer. Write down the policies. Force the planning to happen. Make the invisible visible. Unblock at every break. The tools are new. The management problem isn’t.

TL;DR

While we’re in a tizzy about Mythos and future peer-models’ ability to dominate cyber via exploitation, frontier AI companies also have the compute on hand to crack 4% of the encrypted internet traffic flowing right now, and a much larger fraction of what’s sitting in packet archives.

In 2015, the Logjam paper estimated that a well-resourced nation-state could plausibly break 1024-bit finite-field Diffie–Hellman, the key-exchange under the hood of a majority of the internet’s then-VPNs, TLS, and SSH. The paper’s canonical framing: government-scale programs spending hundreds of millions of dollars and several years of custom-ASIC effort could precompute a small number of widely-reused 1024-bit primes, then passively decrypt the resulting sessions at scale for about one minute of compute per session. The Logjam authors found that breaking the single most common 1024-bit prime in TLS would expose 18% of the top 1M HTTPS domains. Breaking a second prime would expose 66% of IKE VPNs and 26% of SSH servers. That's two precomputations, not 18% × 1M precomputations. The precomputation isn't just a one-time cost, it's a durable strategic asset that, once produced, doesn't depreciate. The zeitgeist believes this capability has been deployed for over a decade.

Eleven years later, two things have happened at once.

1. Classical cryptanalysis of a 1024-bit group has gotten cheaper. Modern CADO-NFS (Boudot et al., 2020) plus H100/B200-class GPUs brings a single 1024-bit precomputation down to roughly 0.5 million H100-GPU-years, a workload any of the top-five US AI fleets can now absorb in 6 to 12 months at 30 % dedicated time.

2. 1024-bit crypto didn’t actually go away. TLS-on-the-web grew up. IKE/IPsec VPNs, SSH on embedded gear, SMTP/STARTTLS, DNSSEC on ccTLDs, VoWiFi signaling, industrial VPN concentrators, and ATM remote-key-loading did not. A meaningful fraction of globally captured pre-2020 packet traffic still relies on 1024-bit FFDH.

The logjam paper has been bugging me for over a decade and I finally understand why: the bitter lesson. The 2016-era nation-state capability to break 1024-bit DH is now within reach of frontier AI labs and compute corporations. The crossover happened around 2022 to 2023. The capability is now inside the core business fleet of roughly six companies, and implicitly inside the budget of anyone who can rent $150M to 300M of GPU time for a quarter.

Whether those companies would do so is a different question. But as we talk about Mythos and the commoditization of exploitation, it’s really a conversation of the commoditization of strategic capabilities previously only accessible to few very well resourced governments.

Part 1. Where 1024-bit crypto still lives in 2026

A non-exhaustive tour of the long tail:

The visual takeaway:

Solid lines are 1024-bit surfaces. Dashed lines are the replacements. TLS-HTTPS 1024-bit DHE collapsed (browsers raised the floor, TLS 1.3 eliminated FFDHE). IKE’s Oakley-2 decline is far more gradual, and still around 8 % in 2026 because the default on a major public cloud VPN product hasn’t moved. SSH group1-sha1 is a consumer-router story. DNSSEC RSA-1024 is a slow, orderly retirement. The bright spots are TLS 1.3 share and the explosive post-quantum hybrid KEM curve: Cloudflare Radar’s 2025 Year in Review shows the share of human-generated HTTPS traffic protected by a hybrid PQ KEM rose from about 29 % at the start of 2025 to 52 % by early December 2025, a jump concentrated around iOS 26’s release.

The phaseout is real but incomplete. And crucially, every recorded session that used 1024-bit DH before the phaseout is still sitting in someone’s capture archive. Which brings us to the attack.

Part 2. What the attack actually costs in 2026

The math hasn’t changed. NFS discrete log runs in time

Plugging in sizes:

2048-bit is about one billion times harder than 1024-bit. That rules it out of classical reach forever and pushes the 2048-bit (and ECDH) threat model into quantum, which is exactly the reason the industry is racing to deploy ML-KEM-768 hybrid KEMs today. Not because classical NFS is catching up to 2048.

Translating 2015 core-years to 2026 GPU-years

The Logjam paper’s estimate for a 1024-bit precomputation: roughly 45 M Sandy-Bridge core-years total across sieving and linear algebra, with a 5.2 B-row sparse matrix over a 1024-bit prime.

Since 2015:

• Algorithmic gains. Boudot, Gaudry, Guillevic, Heninger, Thomé, and Zimmermann’s 2020 795-bit DLP record achieved an estimated 3× reduction relative to prior records, via better polynomial selection and variant choices. Descent has improved another 2 to 3× (Guillevic and Morain, 2020).

• Hardware gains. Sieving on an H100 is ~30 to 50× a 2013 Sandy-Bridge core (GPU lattice-sieving and ECM cofactoring prototypes since Gastineau 2021 and Yang–Bos 2023). Sparse-MV linear algebra is ~20 to 40× per H100, bandwidth-bound, with cluster-scale efficiency ~0.6 above 64 GPUs.

• Practical translation (central estimate): 45 M core-years ÷ 3 (algo) ÷ 30 to 40 (hardware) ≈ 0.5 M H100-GPU-years for one 1024-bit group.

And the fleets to run it on:

The red line (compute required) fell ~170× in 13 years, mostly from GPUs. The blue line (top single-company fleet) grew from essentially nothing in 2013 to ~3 M H100-equivalents in 2026. They crossed in 2022 to 2023. Before that crossover, the 2015 paper’s conclusion held: only nation-states (with ASICs) could do this. After it, the bill-of-materials moved to something any one of roughly six US companies has sitting on the floor.

Part 3. Who can actually do it in 2026

Assuming 500k H100-GPU-years per 1024-bit group and 30 % fleet dedication:

• Microsoft / OpenAI (Stargate): ~203 days at 30 % dedication, or 6 weeks at 100 %.

• Google / DeepMind / Anthropic’s TPU allocation: ~243 days at 30 %.

• AWS + Anthropic Trainium (Rainier): ~304 days.

• Meta (Hyperion): ~1.1 years.

• xAI Colossus II (Memphis + Southaven): ~1.2 years.

• Oracle, CoreWeave: 2.8 and 3.7 years, marginal-to-capable.

• PRC top-4 combined, H20-derated: ~3.3 years. Export controls bite: Chinese fleets are weaker per-GPU for 64-bit-integer and HBM-bandwidth work.

• DoE open-science (El Capitan + Frontier + Aurora combined): ~28 years dedicated (impractical, but FP64-density makes these systems surprisingly good for the linear-algebra phase if repurposed).

• Mistral / Cohere / Character-tier labs: 50+ years, out of reach.

• Hypothesized 2016-era NSA capability: over 1,000 years on the commodity hardware of that era. The gap between “what was plausible with ASICs for the IC in 2016” and “what’s on the floor at MSFT today” is three orders of magnitude.

The linear-algebra choke point

One important caveat: sieving is embarrassingly parallel, linear algebra is not. Block Wiedemann on a 5.2 B-row sparse matrix over a 1024-bit prime needs a single tightly-coupled interconnect domain: realistically one NVL72 rack minimum (72 GB200-class GPUs, 130 TB/s NVLink) and more likely 1 to 4 racks connected over InfiniBand NDR. That’s a resource only Microsoft, Google, AWS, Meta, and xAI have spare-and-spare-for-months. Oracle’s Stargate racks technically qualify but are oversubscribed to OpenAI. CoreWeave doesn’t have a big enough coherent NVL72 domain. So the “top-5” cutoff isn’t just about H100-count, it’s about having NVL72-class fabric you can borrow for a quarter.

Part 4. Harvest now, decrypt later, 2026 edition

Put the two halves together. If actor Y with 2026 fleet F has a packet capture from year X, how much of it can they now decrypt, via a 1024-bit FFDH precomputation targeting that era’s widely-reused primes?

The top row (a top-5 hyperscaler, if they were so inclined) can decrypt ~75 to 90 % of internet-scale packet captures from 2005 to 2010, back when 1024-bit DH was near-universal. The figure falls gracefully as modern protocols displaced it. They can still decrypt ~20 % of 2018 captures and ~4 % of 2026 captures (mostly IKE, VoWiFi, SSH long-tail).

Small labs can’t decrypt much of anything. NSA’s 2016-era hypothesized capability is a thin sliver on old captures, close to but noticeably less than what MSFT-sized compute can now do.

The real punchline: any nation-state or organization that ran a passive IXP tap in 2008 and kept the disks now has a decryption opportunity they didn’t have in 2020.

Part 5. Tactical Implications

Remember, this attack was disclosed over a decade ago.

1. Azure VPN Gateway should not default to Oakley Group 2 in 2026. This is the single most embarrassing configuration line in the public-cloud world right now. Microsoft knows, has known since 2015, and still ships it.

2. Anyone still running IKEv1/IKEv2 with Group 2, 5, or 14-sha1 on internet-facing concentrators should treat archived tunnel traffic as compromised-on-a-timeline. It isn’t yet, but the timeline-to-compromise is a single-digit number of months for any actor with motive.

3. The reason to deploy TLS 1.3 + ML-KEM-768 hybrid now is defensive against harvest-now-decrypt-later. The urgency isn’t really “Shor’s algorithm is coming in 2031.” It’s that today’s captures, if they use pre-PQ classical ECDH, become decryptable when CRQCs arrive, and the ones that still use 1024-bit FFDH are decryptable today.

4. “Nation-state-only capability” is no longer a defensible threat-model category for 1024-bit FFDH. Anyone quoting the 2015 Logjam paper’s nation-state framing in 2026 is citing out-of-date economics. The right framing: “any actor with $150 to 300 M of quarterly GPU budget, or a friendly relationship with one of six cloud CEOs.”

5. This is not a quantum story. Every number in this post assumes classical computation. The quantum threat to 2048-bit ECDH/FFDH is separate, real, and a decade away. The classical threat to 1024-bit FFDH is here now, and has been here since roughly 2022.

Part 6. Methodology & uncertainty

• Paper math is verified against the asymptotic formula and matches the 1024 → 2048 ~10^9× ratio.

• GPU speedups are midrange literature values (30 to 50× sieving, 20 to 40× linear algebra). Faster is probably possible with a serious engineering effort.

• Fleet numbers are Epoch AI, SemiAnalysis, TOP500, and company-earnings triangulated. Error bars are ±30 to 50 %. The ranking of companies is more robust than the absolute numbers.

• Pre-2015 phaseout data is reconstructed from Logjam-style scans extrapolated backward. Treat anything before 2015 as order-of-magnitude.

• Per-capture decryption % in the heatmap is a combined model of (a) that year’s share of sessions using ≤1024-bit DH, weighted by (b) a qualitative “can this actor complete the precomputation in a year” score. Real decryption also requires recording the complete handshake, which many passive-tap regimes did and others didn’t.

• Classified actor capacity (NSA, GCHQ, MSS) is the largest single source of uncertainty. Cookie time, anyone?

• What would falsify the hypothesis: a public 1024-bit FFDH DLP record would confirm the economics. As of April 2026, the public record stands at 795 bits (Boudot et al., 2020, reporting the Dec 2019 computation). The absence of a 1024-bit academic result is itself an artifact: academia can’t rent ~$150 M of GPU time, and the commercial actors who can don’t have an incentive to publish.

Further reading

• Adrian et al., Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice, CCS 2015. CACM 2019 version: https://jhalderm.com/pub/papers/weakdh-cacm19.pdf

• Fried, Gaudry, Heninger, Thomé, A kilobit hidden SNFS discrete logarithm computation, Eurocrypt 2017 (trapdoored primes)

• Boudot, Gaudry, Guillevic, Heninger, Thomé, Zimmermann, Comparing the difficulty of factorization and discrete logarithm, CRYPTO 2020 (795-bit DLP)

• Gegenhuber, Holzbauer, Frenzel, Weippl, Dabrowski, Diffie-Hellman Picture Show: Key Exchange Stories from Commercial VoWiFi Deployments, USENIX Security 2024: https://www.usenix.org/system/files/usenixsecurity24-gegenhuber.pdf

• Yu, Hao, Ma, Sun, Zhao, Luo, A Comprehensive Analysis of Security Vulnerabilities and Attacks in Satellite Modems, CCS 2024

• Cloudflare, State of the post-quantum Internet, 2024 & 2025; Cloudflare Radar 2025 Year in Review

• NIST SP 800-56A Rev.3; CNSA 2.0

• Epoch AI, Frontier Data Centers Hub: https://epoch.ai/blog/introducing-the-frontier-data-centers-hub/

• Blanco-Romero et al., On the Practical Feasibility of Harvest-Now, Decrypt-Later Attacks, arXiv:2603.01091 (March 2026)

• OpenSSH 10.0 release notes (April 9, 2025): https://www.openssh.org/txt/release-10.0

Corporate governance in a nutshell

The way corporate governance works in America is that the stockholders own the company, they elect the board of directors, and the board of directors manages the business. I’m finding that folks are focused on the phenomenal cosmic power, without regard for the itty bitty living space.

The board has one real lever: they appoint the officers of the company. Those officers (think the C-suite) run the company on a day-to-day basis, propose strategies to the board, and implement those strategies.

Yet the board is responsible for overseeing those officers and the entire corporation through a very limited vantage point. Once per quarter they’re sent hundreds of pages of documentation and slides on the current state of the company that they’re responsible for understanding. Then about a week later they have a full-day meeting going over the details, approving or denying the strategies proposed by the officers, and approving the major decisions typically enumerated in the operating agreement: buying a company, declaring bankruptcy, that sort of thing.

Notice that the board does not formally have authority to author or execute a strategy. They can pressure, condition, and reject, but the only hard levers are firing officers and controlling officers’ compensation. This is one reason why experienced CEOs, governance committees, and director candidates themselves all push to confirm cultural fit before acceptance. When the only levers are the nuclear options, no one wants the levers pulled.

Much of this is summed up by the directors’ (and officers’) fiduciary duties. There are two primary ones, and different states (or people) may enumerate them further:

• Duty of care requires directors to fully inform themselves and act with care before making decisions. Remember those 1,000 pages you may get per quarter. You don’t read those on the plane. You dedicate time to truly understanding them. I can guarantee that much of it will not be in your subject matter expertise. You will have to understand leases, corporate finance, HR regulations, etc. We’ll dig into more of this later.

• Duty of loyalty requires directors to make decisions in the best interest of the corporation and not their own best interests. Be very careful about conflicts of interest if you have multiple directorships, and understand you may be required to approve a decision that hurts your personal professional relationships. A director who must recuse themselves often is also violating their duty of loyalty.

Your protections

• Directors and Officers (D&O) insurance. Most companies carry insurance that covers you if you’re sued. Get a copy, read it, understand what they exclude.

• Indemnification. Many corporations indemnify directors, meaning they cover litigation expenses and judgments if a breach does occur. But this probably will not protect you if the company goes bankrupt.

• Exculpation. Some states allow companies’ incorporation documents to specifically eliminate or limit personal monetary damages if a director breaches certain fiduciary duties.

• The business judgment rule. It’s not all scary. Counsel has told me that courts generally do not second-guess board decisions because they do not have the expertise of the board. But you probably have a problem if a plaintiff proves you only opened the 1,000-page pre-read package on the flight the night before the board meeting.

So we’ve covered responsibility and protections. What actually happens if you breach? The shareholders, or possibly the board’s own governance committee, can remove you from the board. Worse, you can be sued by the shareholders (or the corporation). Maybe the D&O insurance or indemnification will cover your personal legal costs. Maybe the exculpation will allow the case to be dismissed quickly. Or maybe you’ll be found in breach where the judge requires you to pay damages to the affected parties. Those damages may or may not be covered by D&O insurance and indemnification. In short, you are at personal risk for being a bad director. Itty bitty living space.

Advice: I found it useful to periodically have our corporate counsel review with us our fiduciary duties around certain big decisions, so the lawyers could point out which regulatory and case-law tigers we were walled into the garden with. We documented the review so we had evidence of making a deliberate effort to understand our duties, before exercising those duties on particularly hard issues.

Minimum bar

So you still want to be on a board of directors. You absolutely must be able to read corporate finance documentation:

• A balance sheet enumerates corporate assets and liabilities.

• An income statement, aka a profit and loss statement (P&L), splits revenue and costs out among a chart of accounts. This tells you exactly where the company is making and spending money. Special note for defense contracting executives: defense contractors usually conflate P&L responsibility with having a revenue target and a budget. You need to satisfy your duty of care and learn how to actually read an income statement.

• Personally, I also believe you should be able to read a cash flow statement, but I’m probably in the minority here.

If you can’t read these documents, you can’t business.

Advice: take the National Association of Corporate Directors’ Financial Oversight online class. Or better, take a university’s executive education course on corporate finance.

Board composition

Boards of directors are smaller than most people think. Each director is generally chosen to provide subject matter expertise oversight to at least one key part of the business. Duplication should be rare and typically only present to provide a graceful transition period before a director retires. So if you want to be on a board, you want to have deep expertise in an area that a company wants to expand into or deliberately grow.

Advice: Most boards have a governance committee that is always looking at recruiting their next generation of board members. Identify the companies you think want to get into a business area where you have deep subject matter expertise, and approach their governance committee chair to have coffee. Identify the companies already present in your area, talk to the board member providing that expertise oversight, and find out if they’re retiring from the board in the next few years. Don’t call the CEO, they work for the board. Call the board.

Advice: small private equity (and probably venture capital) backed companies typically have their boards filled by the investors. PE understands they need board members who also keep the firm abreast of what is going on in the industry so they can 1) understand which companies they should be buying, 2) understand when the right time to sell is, and 3) conduct very deep due diligence. The portfolio company’s board members are also private equity advisors. You get into this space by approaching one of their existing advisors or board members and asking for an introduction to the PE firm. Offer your services for knowing a business model absolutely inside and out, plus everyone in it. You get your foot in the door by helping them conduct deep due diligence on a company they’re thinking of buying. You need to be able to connect your depth of knowledge to their breadth of knowledge. Study hard, you’ve got one shot at most.

Advice: be careful about boards composed of many community pseudo celebrities. That’s where boards can get themselves in deep trouble. The law says the board is responsible for managing the business, and there are consequences for negligence. Walk away, run if you can, when the board is primarily conference speakers, professors, retired generals, congresspeople, etc. Conversely, a board with one of each plus a former CFO is much more robust. The board of directors is not a board of advisors.

Intel as a working example

Let’s look at Intel’s board of directors and my read on what each director’s role is. Intel is one of the world’s great companies and a useful case study right now: they’re working through some serious existential issues, and their board has been deliberately rebuilt over the last 18 months in response. Most of the new members joined under the previous chair’s watch, but the new CEO and incoming chair are now the two people whose composition signals matter most going forward.

• The CEO (Lip-Bu Tan). Most companies and educated shareholders believe the CEO is necessary on the board because they have the operational context required to inform the board, and the board can more quickly notice when they need to replace the CEO. Tan’s path to this seat is a textbook governance story all by itself: he originally joined Intel’s board as an independent director in 2022, resigned in protest in August 2024 over disagreements with the prior CEO’s strategy and pace, and returned in March 2025 as CEO after the board fired his rival. Quiet activism that worked. Outside of Intel, Tan ran Cadence Design Systems for 12 years (TSR over 3,200%) and runs Walden International, a venture firm with 30 years of semiconductor portfolio experience. He is arguably the single most networked individual in global semiconductors.

• Independent Chair of the Board (Frank Yeary). This surprised me but shouldn’t have. The chair runs the board of directors and sets the agenda for board meetings, tasking the company with what information to prepare. The chair being separate from the CEO implies that the shareholders want additional oversight of the company. Yeary is a former Vice Chairman and Global Head of M&A at Citigroup, so he can guide bringing in outside investment capital if the company needs an infusion of cash. He founded a governance/activism advisory firm (CamberView Partners), so he knows shareholder dynamics better than almost anyone alive. He is a former Vice Chancellor at UC Berkeley, so he can navigate complex organizational politics. Master of the universe. The other subtext is that he can become acting CEO if the board needs to quickly fire the current CEO; in fact he did exactly that, serving as Interim Executive Chair from December 2024 through March 2025 between Gelsinger’s ouster and Tan’s arrival. Worth noting: Intel announced on March 3, 2026 that Yeary will retire at the May 2026 annual meeting after 17 years on the board, with his successor as chair already named.

• Former CEO of a networking company Intel acquired (Craig Barratt). You’ll see former CEOs on boards because they bring a breadth of deep knowledge across all aspects of business. Barratt was CEO of Atheros (Wi-Fi silicon, sold to Qualcomm for ~$3.1B in 2011), then ran Google Fiber and Google Access for several years (a hyperscaler-customer perspective on what data center buildouts actually need), then was CEO of Barefoot Networks until Intel acquired it in 2019, at which point he ran a division inside Intel for over a year, so he already knows the place. He sits on the boards of Astera Labs and Ayar Labs, two of the most important AI-interconnect silicon companies of the current cycle. He has a Stanford EE PhD and 30+ patents. He joined Intel’s board in November 2025 as the first director hired entirely under Tan’s watch, and was named incoming Chair of the board in March 2026, succeeding Yeary. Four months from joining the board to being chair-designate is a strong signal: the board wants engineering authority, not banking authority, at its head during the technical execution phase of the turnaround.

• Partner at a top venture capital firm (Jim Goetz, Sequoia Capital). He sits atop the Silicon Valley VC world, understands the leading edge of where Intel’s tech customers will be in several years, and can guide Intel to start the long-lead capex investments so semiconductor products are ready as the tech community is ready to buy them. He has a Stanford MS EE. He’s been on the Palo Alto Networks board for two decades, which gives him a real pulse on enterprise security, a non-trivial adjacency given Intel’s confidential-computing and Trusted Domain Extensions positioning. Sequoia gives him taproot intelligence on every AI startup of consequence; if Intel needs to acquire its way into a capability, Goetz is the board member who knows what’s actually for sale and what it’s actually worth.

• University president, formerly Dean of Engineering at a very prestigious university (Andrea Goldsmith). PhD in EE. She also co-founded and was CTO of two wireless networking firms, including one that made semiconductors (Quantenna, IPO’d then acquired by ON Semi). I’m starting to get the impression that Intel has a deliberate board composition built around getting deeper into TSMC-style contract semiconductor manufacturing. She also served on the Biden administration’s PCAST council on Science and Technology (2021 to 2025), so she can help navigate political and regulatory waters during the CHIPS Act era. She’s now President of Stony Brook University. Rare profile: published wireless-communications theorist who has also shipped silicon and has Washington science-policy credibility.

• Former CEO of a company that made hardware and software for the small-business market (Alyssa Henry, formerly CEO of Square). Square’s seller business is a nice analog for understanding what mid-market and small-enterprise buyers actually do with technology. Before Square she spent eight years as VP of AWS Storage Services, running S3, EBS, and helping launch Lambda. So she is the board’s most credentialed cloud-infrastructure director; she ran the exact services that Intel’s data center CPU business has historically depended on. Her degree is not on the bio I read, but she has a CS background. She briefly served as the board’s Lead Independent Director during the December 2024 to March 2025 CEO transition, which tells you what her colleagues think of her judgment in a crisis.

• Former CEO of ASML (Eric Meurice). ASML is the global economy’s linchpin of advanced semiconductor manufacturing; the only company on earth that can sell you EUV lithography. Meurice ran it from 2004 to 2014, the decade during which EUV was developed and commercialized. Before ASML he was EVP at Thomson, GM of Dell’s European business, led marketing for ITT Semiconductors, and (a detail worth noting) actually started his career at Intel in the 1980s. Three master’s degrees: STEM, economics, and an MBA from Stanford. He joined Intel’s board in December 2024. He is the single director most qualified to judge whether Intel 18A and 14A will actually ramp on schedule, and to apply pressure on management when they don’t.

• Co-founder of an investment management firm in the 1980s, grew it to be the world’s largest as Vice Chairman (Barbara Novick, BlackRock). Novick is not the macroeconomist I would have guessed at first; she founded BlackRock’s Global Public Policy and Investment Stewardship groups, which means she spent a decade-plus thinking about how the world’s largest asset manager engages governments and votes its proxies. She chairs Intel’s Governance committee. Given that Intel’s shareholder base now includes the U.S. government at 9.9%, NVIDIA’s $5B common-stock investment, SoftBank’s $2B stake, and the usual passive giants, having a director who can think like a universal owner and manage proxy/governance optics is operationally invaluable.

• Chairman and current CEO of a semiconductor company (Steve Sanghi, Microchip Technology). I assumed he was a turnaround expert at first, but the more accurate framing is operational discipline and serial M&A integration: he ran Microchip from 1991 to 2021 and grew it from roughly $10M to $44B in market cap with 121 consecutive profitable quarters, completing 20+ acquisitions along the way. He’s currently back as Microchip’s interim CEO. He’s also an Intel alumnus from 1978 to 1988, making him another former Intel insider on the current board. Joined Intel December 2024. The simultaneous Meurice and Sanghi appointments are the deliberate two-pronged signal: Meurice for foundry/lithography credibility, Sanghi for profitability rigor. He has an MS EE.

• Former CFO of Boeing (Greg Smith). He’s the audit guy on the board, chairs the Audit and Finance Committee, and is one of three SEC-designated financial experts on the board. He was Boeing’s interim CEO during the 737 MAX grounding and the COVID demand collapse, which is an unusually direct analog to Intel’s current situation: capital-intensive manufacturing, defense-industrial-base customer base, multi-year product cycles, and a financial crisis layered on top. He is now also Chair of American Airlines. Worth noticing that his entire career arc is at companies that make giant expensive things in giant expensive factories, exactly the operational profile of Intel Foundry.

• Thirty-year Intel veteran (Stacy Smith). He appears to have run many parts of the company including manufacturing, operations, and finance. He was CFO for over a decade, then ran worldwide manufacturing, operations, and sales before leaving in 2018. After Intel, he became Executive Chairman of Kioxia (the NAND flash business carved out of Toshiba and IPO’d in 2024), so he has live, current memory-fab perspective. This guy knows Intel inside and out from when they were the dominant company in the space. They’re bringing back leadership that they wish had not left. He sits on the Audit and Finance Committee, and also chairs Autodesk and sits on Wolfspeed (silicon carbide). He is the single most consequential addition of this entire reshuffle.

• Former CEO of HP Inc. (Dion Weisler). He knows large computer manufacturing corporations inside and out. Before running HP Inc., he was COO of Lenovo Asia-Pacific, which is unusually relevant given the China dimension of every semiconductor strategy conversation right now. He represents the customer voice from Intel’s largest historical end-market (PCs). He chairs Intel’s Talent and Compensation Committee and sits on Thermo Fisher, BHP, and Qantas, an unusually diversified industrial portfolio that tells you he’s a generalist operator more than a tech specialist.

One more pattern worth noticing: this is the analytical move I want you to take with you. Read the gaps as carefully as you read the additions. This Intel board has heavy semiconductor-operator depth and three audit-committee financial experts (highly unusual for a tech company), which tells you what management thinks the next two years are about: executing the foundry pivot and restoring financial discipline. But the same composition has no director with deep AI-software or hyperscale-training experience, no large fabless customer representation, and no one with current government or cleared-defense credentials even though the U.S. government just took a 9.9% equity stake and Intel runs the federal Secure Enclave program. Reading those gaps tells you where management thinks they have it covered through other channels (in this case, hires into the executive ranks rather than the boardroom), and tells you where the next governance crisis is most likely to surface. Train yourself to read both the additions and the gaps. That’s the analytical exercise I want you to walk away with and perform to initiate a career pivot.

Note for (former) government executives

Defense contractors have a rule of thumb that former government executives will be used up in 3 to 5 years. You will be brought on for your rolodex to provide access into the government, and to share your deep understanding of where the government is going. The conundrum is that your rolodex will quickly be used up, and your knowledge will fade more quickly than you expect. One of your jobs on the board is to stay deeply involved in the cross-government and industry associations and think tanks. You’re not retired.

Advice: use your continuing education requirements (and budget) to take dual-purpose executive education courses. It will benefit both the government and your own future career prospects outside the government for you to deeply understand how business works. All the top business schools have amazing courses that last from one day to a full summer. They look great on a potential board member’s CV too.

Advice: most corporate executives want more face time with board members. Assuming the CEO concurs, you can ask for one-on-one time with executives to help get you up to speed on different aspects of the business. For instance, you can ask the CFO to spend a few hours with you explaining the subtlety in the P&L statements and how their team highlights the aspects they think you should pay particular attention to. Something I did as CEO was ask our CFO to use our own financial reporting reviews to teach me one thing they thought I needed to learn about finance, every month.

Note for (former) corporate executives

The reason you see so many former CEOs on boards is that the position forces the person to become an expert across the company’s entire market, and to deeply understand business. They understand HR, finance, real estate, culture, management, talent pipelines, long-range planning, dealing with disasters; and they understand how those all work together in a company.

Corporate VPs are perceived as having much narrower expertise, just in their constituent organization’s product or functional area. Even if your deep expertise is specific to an area a company wants to enter, you will make a much stronger candidate the more of corporate operations you have been involved in.

Advice: executives below the President or C-Suite level in larger organizations often specialize without the career broadening experience required for a board of directors position. You can get this by being deeply involved with or leading M&A due diligence and integration activities. It’s a forcing function to learn the breadth of your enterprise operations to the point where you can integrate two companies into one. This is really important, you need to understand why things are done the way they are done, not just the what and the how. That’s director level understanding.

A word of caution

The CEO and large investors generally want a board that says “yes” to them. But you as a director face personal liability if you’re a rubber stamp, or if you’re not providing the oversight you have a duty to provide. If you’re perceived as a pain in the ass, then your tenure as a director will not extend past one term, on one board. You must provide, and be perceived as providing, more value than what your rigor costs. A good board member isn’t a retirement job. They work their ass off, and they’re worth their weight in gold.

People keep asking me about ESOPs. I keep having the same conversation. Time to write it down and pay it forward more broadly.

In 2012 I founded a company. In 2022 we turned it into an ESOP. I ran it as CEO through and after that transition, and I (always) have opinions.

What an ESOP actually is

An ESOP is a funny little corner of the Internal Revenue Code. You probably know § 401(k) as your retirement plan at work. An ESOP is a cousin: technically defined at § 4975(e)(7), operating as a qualified retirement plan under the broader § 401(a) umbrella that contains your 401(k). Confused yet? I hopefully made my point so I’ll start drastically simplifying.

The distinguishing feature is that the ESOP company itself is owned by a trust that exists for the benefit of its employees. Every year, every qualified employee is given stock in the company, held in a 401(k)-like tax-deferred retirement account that vests over time. When an employee leaves or retires, they roll that account into an IRA or 401(k), or take the cash and pay the taxes. Employees should retire earlier, with more financial independence.

It’s effectively the original benefit corporation structure, and Congress liked the idea enough to sweeten it aggressively: a 100% ESOP company with an S-corp election pays no federal corporate income tax. Really. The IRS gets its cut eventually, when employees draw down their retirement accounts decades later.

I’m glossing over enormous amounts of subtlety here. If you’re seriously considering an ESOP, go talk to a specialized lawyer who has set up dozens of them. They probably practice in Minnesota.

The mechanics

Converting to an ESOP is effectively a leveraged management buyout. The company takes on a large loan to buy itself from the previous shareholders. In our case that was simpler than usual, since we were already 100% employee-owned, but the structure is the same either way.

You generally can’t borrow the full fair market value (FMV), so the rest gets seller-financed. Previous shareholders take some cash up front, a note (like a cash-less loan) from the ESOP for the balance, and often warrants (like phantom stock) that let them share in upside if the company outperforms expectations while the note is being paid down.

Speaking of fair market value: we were warned early that the ESOP trustee will pay an FMV meaningfully below what you’d see in a traditional M&A process. That’s not a bug. The trustee has a fiduciary duty to the employees and isn’t going to overpay on their behalf. But it’s important to internalize before you start.

Once the conversion closes and the company is a 100% ESOP-owned S-corp, federal corporate income tax goes away. That freed cash flow is what services the acquisition debt. After the debt is paid off, excess cash flows into employees’ retirement accounts.

The trust needs a trustee. That can be a company insider, an outside individual, or a professional trustee firm. Whoever it is, they have a legal duty to act in the best interest of the employees, full stop. As the founder and CEO, I went from having all of the voting stock to having, effectively, a single shareholder who was legally obligated to one constituency: the employees (which also included me). He was a good guy and an effective force for good. The board retained the authority to replace the trustee, and the trustee retained the authority to replace the board, which created a surprisingly effective and productive detente that puts the benefit of the employees first.

What was good about it

The “for the benefit of the employees” structure is a genuine recruiting and sales multiplier. An ESOP isn’t just employee-owned in the hand-wavy way startups use that phrase. It legally exists for the benefit of its employees, and sophisticated customers and candidates can tell the difference. The board of directors can’t just change it if they want to prioritize other things.

It also solved a problem every long lived employee-owned company eventually runs into: what do you do with former employees who hold equity? Buy them out and create unplanned cash flow problems? Let them keep their shares and eventually find yourself with a cap table full of ex-employees who have grudges and shareholder rights? The ESOP gave us a clean mechanical answer. And if a former employee ever showed up with a nuisance lawyer, the trustee could point them at the federal ESOP statutes, which is lawyer speak for “pound sand.” We never had to use that. It was nice to know it was there.

What was painful about it

Equity allocation becomes rigid. The IRS permits only a handful of ways to allocate stock to employees. The most common, and the one we used, is salary-proportional: if the salary pool was $10M and you made $100K, you got 1% of that year’s stock allocation. And if a highly paid employee made above the IRS compensation cap, their stock allocation was capped at the cap, not their actual salary. There is no legal mechanism to allocate based on merit, recruiting leverage, retention risk, or any of the other levers companies normally use equity for. Doing so would literally break the law.

There’s a workaround that doesn’t do what you think it will do: the trustee can allow a little synthetic equity, meaning cash bonuses indexed to stock price movement, conceptually similar to RSUs at tech companies. But the trustee is fiduciarily responsible to the employees, so the bar for approving these is much higher than you’d expect coming from a conventional equity program. If you need to use equity as a tool to recruit and retain key talent instead of the entire workforce then an ESOP is a bad structure.

Nobody understands how an ESOP works. During an M&A process, a potential buyer once asked us, “Do your people actually understand how the ESOP works?” We laughed and said, “Everyone who deeply understands it is sitting at this table right now.” And this was a company full of skilled engineers who were very comfortable with math and finding wiggle room in regulations. The best mental model most people ever reached was “it’s a retirement account,” which is true but leaves most of the operational structure invisible. That was our fault. We never figured out how to communicate it.

The confusion created a persistent belief that the ESOP was a kind of workplace democracy where everyone voted on company decisions. It wasn’t. Outside of a few specific situations, the trustee acted as sole shareholder with full authority to replace the board, replace officers, and generally do whatever they judged to be in the employees’ best interest. Day to day, the company otherwise operated like any other company. The CEO and CFO had certain legal responsibilities, officers had fiduciary duties, and authority flowed from the corporate operating agreement and was delegated from there. That gap between how people thought it worked and how it actually worked was a constant low-grade expectation management headache.

ESOPs are cash-constrained by design. You start life with significant leverage from the buyout, which means it’s a long time before you can take on additional debt for capex or expansion. Expansion into emerging markets which require significant upfront capex just isn’t an option for an ESOP until it’s paid off its conversion debt. External investors, particularly private equity, are extremely wary of investing alongside an ESOP trust. The trust really does not want to be a minority shareholder, and as a majority shareholder it can behave in ways that look deeply irrational to conventional investors, because it’s optimizing for something conventional investors aren’t.

Would I do it again?

Probably not. I like maneuver space, and the ESOP structure is less agile than I wanted it to be. The allocation rigidity, the debt overhang, the difficulty of bringing in outside capital for expansion, and the sheer explanatory burden all added up to a company that was harder to steer than it needed to be. Giving people ownership in their company should be celebrated, not confusing.

That said, I genuinely don’t know what I would do instead. Maybe a partial ESOP just for the employee equity??? Every alternative has its own pathologies, and the ESOP did solve real problems (the ex-employee equity problem, the mission-alignment problem, the tax structure) in ways that are hard to replicate. If someone showed me a cleaner structure tomorrow I’d listen carefully. I just haven’t seen one yet.

I used to spend a lot of time with my head buried in classified intel, building mental models of targets to find the lynchpins; the nodes where a small, well-placed effect cascades into disproportionate impact. It’s a specific kind of thinking. You learn to see organizations as interconnected dependencies, and you learn that the interesting question is never “what’s the biggest thing?” but “what’s the thing that, if it moves, makes everything else move?” Then as a hacker you go kick over that lynchpin. I just tripped over one that I wasn’t looking for.

This month, I built a macroeconomic model. Not to predict markets, but to understand how the structure of the world is changing and how common financial wisdom holds up against it. I synthesized a model from 422 studies published from organizations like the IMF, BIS, Federal Reserve, World Bank, IEA, IPCC, RAND, NATO, and CSIS into 89 scenarios, booms and busts, each with calibrated probabilities, persistence, and cascading dependencies across 72 asset categories.

Somewhere around the tenth Sankey diagram, my heart stopped.

The same targeting instinct that used to drive cyber capability development and operational planning had just, independently, identified cyber operations against the financial system plumbing (macro-financial) as the single highest-leverage cascade node in the modeled world economy. Not because I asked it to. Because that’s what the data said. If we need to concentrate defensive resources, the place to concentrate our forces is the financial system.

This post is about what else the model found, and why I think common financial wisdom is now load-bearing on assumptions that no longer hold. But the part I can’t stop thinking about is the cyber part. I’ll come back to it.

The baseline is not your friend

History doesn’t repeat itself, and it no longer rhymes.

The standard move in financial planning is to assume historical returns, roughly 10.5% nominal for U.S. equities, 5.5% for bonds, will continue. That assumption is built on a world of strong institutions, stable trade, manageable sovereign debt, benign demographics, and a relatively quiet geopolitical backdrop. Every one of those is visibly changing.

The institutional literature is consensus on the direction, if not the magnitude. Aging populations reduce labor-force growth and productivity. Equity markets start from historically elevated valuations. Trade fragmentation raises costs. Sovereign debt loads crowd out private investment and create inflation pressure. Climate transition is a structural drag. Entitlement programs face insolvency timelines that force either benefit cuts or tax increases.

None of these are speculative. They’re the consensus of institutional research. When you aggregate them against the literature, forward-looking equity returns drop from the historical ~10.5% to roughly 7%, and bonds from ~5.5% to ~4%. That alone makes plans built on historical averages optimistic before a single surprise event is added.

But structural drift is the boring part. The interesting part is what happens when the surprises start to cluster.

89 black swans, and why they cascade

I modeled 89 scenarios (61 busts, 28 booms) drawn from the same research base. Each has a calibrated annual probability, a persistence duration (1 to 10 years), and a shock profile across all 72 asset categories. Annual probabilities range from 0.5% for a nuclear exchange to 10% for a transmission-grid infrastructure supercycle. Scenarios are what the literature models, which means they carry an implicit bias toward what foundations, donors, and governments were worried enough to fund studies on. That’s a limitation, but it’s also a feature: these are the events that institutional researchers thought were worth calibrating.

The standard way to use a scenario library is to fire one at a time and measure the impact. That’s what most stress tests do. It’s also the part that misses what actually matters.

The scenarios cascade.

The way society and government respond to one event often creates the conditions for the next. A macro-financial crisis makes tax-regime shocks and structural disruptions more likely. Geopolitical wars spill into supply-chain disruption and cyber operations. Climate shocks feed into resource conflicts and biosecurity risks. I built a spillover model, family-to-family probability multipliers grounded in historical sequences, and ran 10,000 Monte Carlo paths through three modes: bust-only (downside clustering), boom-only (upside clustering), and mixed (both).

In the mixed mode, 91% of paths produce multi-scenario cascades. In bust-only mode, 67%. These aren’t cherry-picked narratives. They’re what the engine produces when you let it run.

The Sankey moment

A structure emerges that isn’t subtle when you map the cascades as a flow diagram of which families trigger first, and which families follow.

In the bust-only mode, macro-financial plumbing is the central hub. It triggers first on 76% of cascading paths and appears as a downstream consequence on 61%. The single most common three-step sequence across the mixed-mode simulation is macro-financial fires first, operational cyber fires second, macro-financial fires again. Macro-financial appears in all top-10 three-step sequences.

This is where the targeting instinct took over.

One way to think about the strategic application of cyber is as the engineered creation of black swans at the time and place required to generate asymmetric impact. You don’t need to break everything. You need to break the little thing whose failure cascades through the rest of the organizational system of dependencies. That’s the lynchpin. In every targeting exercise I ever did, the game was finding the node where leverage was highest.

The Sankey diagram was telling me that the lynchpin of the global economic system, the node whose failure produces the most cascading downstream damage, is the financial system’s plumbing itself. And the most common path to hitting it is via operational cyber.

I didn’t expect that. I wanted the model to teach me about macro economics so I could have educated conversations with finance people. The model told me something much more uncomfortable: the same reasoning that guides offensive planning, when applied to defense, points directly at the macro financial system plumbing as the thing most worth protecting. This is the thesis that has been building in the security community, that AI-era vulnerability discovery has turned latent software bugs into material financial risk, and that the institutions most exposed are the platform companies whose software sits underneath the financial plumbing. This research project didn’t set out to have anything to do with cyber, yet here we are.

If we get to choose one thing to protect, we protect the financial system plumbing. The data is unambiguous.

I’ll come back to this. But first, the portfolio question that started the whole exercise.

Three portfolios walk into a model

To evaluate common wisdom, I tested three common retirement portfolios against the scenario engine:

• Bogleheads 3-Fund: 60% U.S. equity, 20% international equity, 20% bonds.

• Classic 60/40: 60% stocks, 40% bonds.

• Dalio All Weather: 30% stocks, 55% bonds, 7.5% gold, 7.5% commodities.

Each was simulated 10,000 times over a 30-year horizon starting from $1M with a 3% annual withdrawal. Under the structural baseline with no scenario shocks, they all look fine. Bogleheads finishes at a median $1.28M, 60/40 at $1.42M, All Weather at $1.40M. If you stop here, and most financial planning does, 60/40 looks like the best choice.

Turn on the compound scenario engine and the picture inverts.

“Ruin” here means less than ten years of spending money left at the end of the horizon. Under downside-clustering conditions, the Bogleheads portfolio ends in ruin on roughly one path in four. The Classic 60/40 on roughly one in eight. Dalio’s All Weather on one in forty.

The reason is the correlation structure. Common wisdom portfolios are built on an implicit assumption that bonds diversify stocks. That assumption holds in baseline conditions. It breaks in stagflation. It breaks harder in a domestic institutional crisis, where Treasuries lose their safe-haven status. The model encodes a seven-regime correlation taxonomy, and in three of the seven regimes (stagflation, USD erosion, domestic crisis) the bond diversification assumption either weakens or inverts. The common-wisdom portfolios were never designed for those regimes because, until recently, nobody thought we’d see them.

The worst individual scenarios for all three portfolios are geopolitical and institutional: civil breakdown in America (a specific institutional-failure scenario drawn from RAND and CSIS modeling, not a partisan projection), abrupt AMOC climate tipping, global financial crisis, and U.S. sovereign default. The first two produce 60%+ drawdowns in Bogleheads. All Weather takes them at roughly half the magnitude.

Nothing in this post is financial advice. Specific allocations, ruin probabilities, and fund categories are outputs of a personal research project, not recommendations. Go do your own analysis.

What the machine found

The model told me common wisdom was fragile. The natural next question was whether a portfolio designed for this future, rather than inherited from the past, would look different.

I ran a reinforcement learning (RL) search. The RL agent starts with random allocations, measures each against the compound-scenario engine using a simplified reward function, and evolves toward configurations that survive better. Eleven rounds of evolution, roughly 55 million candidate allocations evaluated.

Plenty of candidates scored well in simulation. But simulation isn’t truth, and academic asset-class categories don’t map cleanly onto purchasable instruments. So I ran a separate validation project with three independent lenses on every top candidate: factor decomposition (does the exposure profile match what the simulation assumed?), historical replay (how did it actually perform across ten real crisis windows from the 2008 GFC through March 2026?), and a per-instrument deep-dive on how faithfully each holding matches the simulation’s model of it.

Only two portfolios survived all three lenses without critical failures. I’m redacting the specific holdings.

Zero-Equity holds 14 instruments with no traditional equity at all: roughly 24% cash equivalents (T-Bills), 38% multi-sleeve bonds (investment grade, municipal, TIPS), 16% managed futures, and the balance in gold, infrastructure, and tactical alternatives. Bust-compound ruin: under 0.1%. Max drawdown: 17%. Bust-compound median terminal: $1.39M.

Buffered holds 16 instruments with ~13% structured equity via defined-outcome products that cap annual upside but mechanically absorb the first slice of downside. Higher managed futures (24% vs 16%). Bust-compound ruin: 0.1%. Max drawdown: 26%. Bust-compound median terminal: $1.38M.

Both achieve effectively zero ruin probability and bust-compound medians 78–80% higher than Bogleheads. The choice between them is a policy preference: lower drawdown vs slightly higher upside capture.

Earlier rounds produced other candidates that looked excellent in simulation but failed validation. A “Hardened” variant with 43% T-Bills and a rate-hedge sleeve scored well in the engine but relied on theoretical behaviors that the fund managers could not execute in the real world. The lesson: any single model deserves skepticism, and the difference between a good simulation score and a defensible portfolio is independent validation against reality. A good score in a model you built yourself is not the same as a defensible portfolio. Out-of-sample historical replay is the discipline that catches overfitting.

Back to the cyber part

I told you I’d come back to it.

The macro model was a personal project. I built it to answer a personal question using hard data sourced from academic literature. It answered that question with common wisdom is fragile, and the historical baseline is load-bearing on conditions that are eroding. But it also, as a side effect, handed me a diagram that reframes how I think about systemic geopolitical and strategic cyber risk.

The Sankey showed that macro-financial is the hub of the global cascade network. It showed that operational cyber is the most common bridge into a macro-financial cascade. And it showed that the dominant three-step sequence across the entire simulation is macro → cyber → macro. Read that the other way around: a cyber attack on the financial system plumbing is how you trigger a cascading failure in the world economy. Not metaphorically. As an empirical output of a simulation calibrated against the institutional literature.

This is not a new thought in the abstract. FSB, BIS, and the ECB have all published on systemic cyber risk. But there’s a difference between “experts worry about it” and “a general-purpose macro stress model, not designed to study cyber risk, independently converges on cyber attacks against financial infrastructure as the highest-leverage cascade path.” The first is policy discussion. The second is structural.

It’s also the reason Anthropic’s Project Glasswing matters more than I initially framed it. Last week I argued that the collapse in cost of cyber vulnerability discovery, driven by frontier AI models, has elevated latent software bugs from engineering debt to material business risk for the platform companies. I made an argument about risk pricing. This macro model tells me I was understating the case. The vulnerabilities aren’t just material to the platform companies. They’re material to the cascade node that the data says is the lynchpin of everything else.

If we get to choose one thing to protect, we protect the financial system. And if we get to choose one way to protect it, we start with the software it runs on.

What this means

I am not trying to predict the market. I’m trying to understand how the structure of the world is changing, using financial markets as a well-measured surrogate for that change.

A few things the model says clearly enough that I trust them:

The historical baseline is optimistic. Structural trends alone push expected returns below historical norms before any surprise events are considered. Plans built on 10.5% equity returns are starting from a number the consensus literature no longer supports.

Compound scenarios change the answer. Individual black swans are manageable. Clustered ones, with cascading dependencies, are what break common-wisdom portfolios. The difference between the three retirement portfolios under baseline conditions is noise. Under compound-scenario conditions it’s an order of magnitude in ruin probability.

Common wisdom is built for a world we are leaving. The bond-diversifies-stocks assumption holds in four of the seven correlation regimes I modeled and breaks in the others. The portfolios built around it were designed for a world of strong institutions, stable trade, and benign geopolitics. If you believe that world is changing, the portfolios deserve stress-testing against the world you actually expect.

And the one that won’t leave me alone: the financial system is the lynchpin, cyber is the most common path to hitting it, and the same targeting instinct that finds lynchpins for offense points directly at what we most need to defend. I started this project trying to answer a financial planning question. I ended it with a pit in my stomach.

The model is wrong. All models are wrong. But this one has been useful.

When Anthropic’s Mythos surfaced a TCP option-processing bug in OpenBSD that had been sitting in the stack since the late ‘90s, I took it personally. I audited that exact code path more times than I can count 25yrs ago. I wrote ISIC, including the TCP Stack Integrity Checker, a fuzzer built specifically to find the exact class of bug Mythos found. My fuzzer missed it 25yrs ago. I missed it, staring directly at it and pointing automated tooling directly at it, during a period of my life when I worked on securing low-level network stacks seven days a week.

I lead with that not to relitigate my workflow. I lead with it so the CISOs and platform engineers reading this don’t look at Anthropic’s project Glasswing as a security engineering conversation. It isn’t. If someone with my background, tooling, and obsession couldn’t find that ONE bug in code I owned, engineering teams aren’t going to dig out of decades of security debt with a few sprints.

So I’m taking the engineer hat off. CEO hat on. Let’s talk to the Glasswing cohort the way their boards are about to talk to them: as a P&L event.

The reframe. Mythos-class models have moved a large, dormant inventory of latent vulnerabilities from “below the threshold of notice” to “above it.” This is structurally identical to a regulatory shift; a category of cost that was previously externalized is about to be internalized, fast. The difference is that you can’t lobby your way out. The remediation is technical, the timeline is compressed, and the accounting treatment is ugly.

For physical product lines, the exposure is warranty liability and recall risk on shipped hardware. For SaaS and platforms, it’s churn risk against consumer lock-in and, more painfully for the CFO, impairment of M&A goodwill carried on the balance sheet, which lands on the income statement as a GAAP expense the quarter you take it. Ouch

Where the exposure sits. Rough cuts from public filings; treat as order-of-magnitude:

• Apple — ~57% of FY25 revenue from iPhone and iPad, gated by an App Store you will now have to vouch for end-to-end.

• AWS — effectively ~60% of Amazon’s operating income. The exposure isn’t AWS itself; it’s the OS images, package repositories, and customer workloads you implicitly stand behind.

• Broadcom — ~25% of revenue from chips embedded in commercial products that can be bricked in place, with mobile and IoT as the second-order blast radius.

• Google — undisclosed, but a defensible estimate puts 20–40% of revenue downstream of Android and ads served against it. Same Play Store problem as Apple, with a messier device fleet.

• Microsoft — ~85% of FY25 revenue touches at-risk product lines: Windows, the Microsoft Store, Xbox, and the entire Azure-hosted ISV ecosystem.

I won’t put a date on when this becomes board-level. If I was on your board you already would have gotten a phone call. I’ll say only that the gap between “interesting research result” and “named in an 8-K” has historically been measured in quarters, not years, and Mythos just passed the research stage.

Now the part the CFO actually wants to hear. Every threatened liability on this list has a revenue-side mirror. The platform playbook here is not new, it’s Joel Spolsky’s “commoditize your complement,” run in reverse. You commoditized the complements years ago. Now you secure them, and you charge for the securing.

• App stores (Apple, Google, Microsoft) can mandate third-party security attestation as a condition of listing. Developers self-certify at one price tier, get audited by an approved third party at another, or buy the service from the store directly at the platinum tier. Enterprise buyers will demand platinum and pay for it. Those insecure Apps where the consumer is the product are putting your platform itself at risk.

• Cloud providers (AWS, Google, Microsoft) already run overwatch on customer workloads for their own risk management. Any workload not originating from an attested, vetted image becomes a billable line item for the monitoring you were eating as COGS anyway.

• Silicon and device vendors (Broadcom, and the ecosystem downstream) have the hardest road, because remediation often means physical replacement. The opportunity is attested-boot-as-a-service and a recurring security SLA on shipped parts; converting a one-time hardware sale into an annuity, which is the trade that cements the hardware CFO’s legacy.

The close. Mythos, and maybe a whole generation of frontier models, are about to revalue a category of risk the technology sector has been carrying off-balance-sheet since the 1990s. If you are a platform, your two choices are to absorb that revaluation as liability or to convert it into recurring revenue by securing the complements you previously commoditized. The companies that move in the first two quarters will set the pricing, the standards, and the audit regime everyone else has to buy into. The companies that wait will be the ones writing the impairment disclosures.

Secure the complement, or lose the platform.