On August 13, a TypeScript monorepo appeared under the deepseek-ai organization on GitHub: DeepSeek Harness, dsh to its command line, MIT-licensed, carrying a bolded warning that THERE WILL BE COMPATIBILITY-BREAKING CHANGES and not a single benchmark score anywhere in the release.[1] Six days later, it holds more than 160,000 stars.[2] On August 14, one day after the release, SpaceX closed its $60 billion all-stock acquisition of Anysphere, the maker of the Cursor coding agent, the highest price yet paid for a harness business.[3] And on August 18, OpenAI published a post titled “Pacing model development in an era of cyber-critical capabilities,” disclosing that supervising its own models now costs “roughly 20% of the inference compute being monitored,” and that its largest planned frontier reinforcement-learning run is on hold while it assembles the evidence and the machinery to run it safely.[4]

Six days, one layer, three prices: zero, sixty billion dollars, and a fifth of everything watched. The layer is the harness, the control loop around the model. DeepSeek put its loop on GitHub for free. SpaceX paid sixty billion for a company that makes one. OpenAI said publicly in a document that the loop around its models has become expensive enough to disclose. None of the week’s three events is about a model. All three are about the scaffolding models run inside, and August 2026 is the month that scaffolding stopped being plumbing and became the contested asset of the AI stack.

The Layer Nobody Sells

A harness is everything around the model that turns text prediction into work: the system prompt, the tool catalog, the execution loop, the sandbox, the session state, the retry logic, the thing that decides when the agent is done. Claude Code is a harness. Codex is a harness. So are Aider, Cline, Goose, OpenCode, OpenHands, Pi, and Mistral’s Vibe; Cursor wraps one in an editor. The field is crowded enough that harness design philosophies have spanned a factor of fifty, from Pi’s two hundred tokens of system prompt to the ten thousand or so Claude Code carried until Anthropic cut it by roughly 80 percent this summer.[5]

For three years, the industry treated this layer as a giveaway, open source, or bundled with the subscription, rarely as a line item. The model was the product; the harness was the wrapper around it. Most of that list was already free. What changed in August is that the zero became a strategy and the cost became public: one frontier camp made the giveaway its flagship release; the other disclosed, for the first time, what the layer costs to police. Between the zero and the 20% sit two measurements, one from four unaffiliated researchers and one from Tencent. Scores move more when you change the harness than when you change the model, and when the model’s judgment fails, the defenses that hold are the ones built into the harness. The layer one lab just gave away is the layer the other is taxing itself to police.

That is the argument. Here is the evidence.

Five Times the Model

On August 15, two days after the DeepSeek release, four researchers published a paper with no institutional affiliation under the title “StateM: Reaching 95.3% Raw Accuracy, or a $15 Frontier Run, on Terminal-Bench 2.1 via Harness Scaling.”[6] Terminal-Bench is the de facto reference benchmark for terminal-based agents: 89 tasks, real shells, verified outcomes. StateM is not a model. It is a frozen YAML runbook bolted onto an existing agent, a state machine of preconditions and practices distilled from failure postmortems. No weights change. Only the harness does.

The numbers: GPT-5.5 under a stock harness scores 83.1 percent. The same model inside StateM scores 92.1% (+9 points) based on configuration alone.[7] For calibration, that is numerically above the 91.9% the paper cites for GPT-5.6 Sol Ultra, the next generation’s premium compute tier. Moving from GPT-5.5 to GPT-5.6 Sol at the same effort tier moves the score from 83.1 to 84.9 (+1.8%). A skeptic can build a bigger generation delta by buying up the range — stock Ultra sits 8.8% over stock GPT-5.5 — but that is rather the point: the runbook matched Ultra without changing models. The harness moved the score about five times as far as the model generation did.[8]

The authors put their conclusion in bold: “The model appears not to be the (main) bottleneck.” And they draw the commercial inference for you: “One can invest in a harness that turns a cheaper model into a stronger system.”[9] Their cheap-model exhibit is the week’s other protagonist: DeepSeek-V4-Flash inside StateM reaches 88.1% for $15.20 in realized API charges. The frontier GPT-5.6 Sol xhigh run behind the 95.28% headline cost $1,062.95. A separate frontier submission cost $574.68 and scored 83.37%.[10] Read that triplet again. The frontier model in someone else’s submission scored lower than the bargain model inside the right harness, at thirty-eight times the reported cost.

Now the asterisks, because this paper deserves both its headline and its scrutiny. The 95.28% is pre-adjudication. Its submission is still open as of this writing, with thirteen trajectories flagged by the benchmark’s automated review.[11] Four are conceded by the authors: embedded verification logic that should score zero, resulting in a score of 94.38%. Zeroing the nine flagged as possible reward hacking—gaming the grader rather than solving the task—sets their floor at 93.26. Zeroing all thirteen, the compounded worst case that the paper does not print gives 92.36. Every point in that range still sits numerically above the Ultra reference. The finding survives its asterisk. A reviewer’s separate cross-task contamination question remains open, the one flag arithmetic cannot bound.

The deeper asterisk is generalization. Moved frozen, one-shot, to a held-out benchmark called BusinessBench, the runbook gains 0.55 macro points, a fraction of the headline gain, with outright negative transfer on two task families.[12] And the authors disclose something more uncomfortable: across iterations, their harness learned one evaluator’s boundary conventions “without ever reading verifier code.”[13] The runbook didn’t just learn to operate a terminal. It learned to please a specific examiner.

Both facts are true at once. A paper demonstrating that harnesses can inflate benchmark scores has a possibly-inflated benchmark score; a runbook tuned on postmortems memorized the grader; the leaderboard it sits on adopted, back in April, an automated “agent judge” that re-reviews every passing trial for reward hacking after three organizations were caught cheating.[14] The phenomenon is manifesting at every level, including the meta-level: even the benchmark now imposes a monitoring tax on the harness layer. Harness engineering is real leverage, and it is leverage precisely because it specializes in the task, in the environment, and, if you are not careful, in the examiner. Which is why the honest reading of the 5x is as a ceiling, not a floor.

Everything Is a Plugin, Including the Providers

Against that measurement, consider the artifact DeepSeek shipped. The repository’s one-line description is the thesis: everything is a plugin. The fuller claim, as the company put it: “Models, tools, skills, sessions, sandboxes, filesystems, loops, orchestration, and UI are ALL implemented as plugins, and can be mixed, matched, replaced, and extended.”[15] The kernel underneath is not even DeepSeek’s: dsh is built on Cordis, a pre-existing plugin meta-framework from the Chinese chatbot ecosystem around Koishi.[16] A frontier lab looked at the most contested layer of the agent stack and adopted a chatbot community’s architecture for it. That is either humility or speed; on a codebase marked developer preview, it is probably both.

The builders it aims at noticed: Armin Ronacher — co-founder of Earendil, which steers the Pi agent — called it “for sure the first time I have been looking at something new in the space and felt quite inspired to revisit some of our choices.”[5] The Hacker News thread reached 739 points, with praise focusing on the strength of this piece’s argument, while criticism focused on maturity and the plugin's attack surface.[17]

Three properties of the release matter.

First, the silence. DeepSeek’s model launches include benchmark tables with accompanying prose. The harness shipped with none: no Terminal-Bench, no SWE-bench, and no eval directory containing results.[1] For this lab, that silence is louder than a chart. Either they have not measured, or the measurement does not flatter yet. Or they watched the 95.28 adjudication saga and declined to play a game where every harness number arrives with an asterisk. Whichever it is, the launch asks to be judged as architecture rather than capability. For a benchmark-first lab, this is a repositioning.

Second, the logging. Every session in dsh is an append-only, replayable record, and the trajectory view exposes whatever reasoning the provider returns, which, for DeepSeek’s own API, is everything: V4-Pro now ships with thinking mode on by default.[18] Set that against the incumbents: OpenAI decided in September 2024, in the o1 launch post, not to show raw chains of thought, “after weighing multiple factors including user experience, competitive advantage, and the option to pursue the chain of thought monitoring” [19]. Anthropic serves summaries of extended thinking and gates raw traces.[20] The industry’s chain-of-thought settlement inverted quietly this month: the closed labs treat raw reasoning as either a liability to monitor or an asset to protect, and the open lab treats it as a logging feature.

Third, the funnel that isn’t. The obvious read of a free harness from a token vendor is razor-and-blades: MIT the razor, sell the blades. The configuration reality is softer. dsh ships provider cards for DeepSeek, Anthropic, OpenAI, Azure, Bedrock, Vertex, and Codex, and no provider is wired in as a default; you open settings and paste whichever key you own.[21] DeepSeek’s harness will cheerfully orchestrate OpenAI’s models. In the vocabulary this newsletter used for Nvidia’s open-source strategy, dsh is currently a sun, not a black hole: its gravity points outward, hardware- and provider-agnostic, where Nvidia’s giveaways route ecosystems back to its silicon.[22]

That does not make the release charity. DeepSeek sells exactly one thing: tokens. It gave the weights away to grow their market, and the harness extends the same play one layer up. Leaked minutes of an investor meeting with founder Liang Wenfeng, published by ChinaTalk the day the harness shipped, cast China as a “token factory at global scale, pushing the price of intelligence down,” with DeepSeek as the instrument. DeepSeek’s own published economics say the factory’s margins live in the API.[23] And if a factory devoted to pushing prices down raised its own the same day [18], that is razor-and-blades in its plainest form: the price being pushed down is the market’s floor, not DeepSeek’s top tier, and the free layer is what walks you to the register.

Follow the token-factory logic, and the harness strategy writes itself. You do not need to lock anyone in. You need the layer between users and tokens to be free, excellent, and everywhere, so that the only purchasing decision left is which tokens to pour through it, a competition DeepSeek believes it wins on price. Commoditize your complement. The Free Harness is less a lock than a price signal: this layer should cost nothing. Its de facto plugin registry today is an unauthenticated GitHub topic — anyone can publish to it.[24]

The Twenty Percent

OpenAI’s August 18 post is the other half of the repricing. The core disclosure, verbatim: “These safeguards require meaningful compute. Our current estimates put monitoring overhead at roughly 20% of the inference compute being monitored, though the cost varies substantially across training and evaluation workloads.”[4]

The scope is capability-indexed and precisely drawn: monitoring is required for all reinforcement-learning training and all tool-using evaluations for models at GPT-5.6 Sol capability or above.[25] The sharpest edge is a model OpenAI has not shipped: on August 7, eleven days before the cost disclosure, it said preliminary evaluations of an upcoming model called Astra were strong enough that it “cannot rule out critical cyber capabilities under our Preparedness Framework”, and that Astra “was not involved in exploiting Hugging Face.”[26]

The threshold is a model that finds and weaponizes zero-days in hardened real-world systems without human help. The response is harness all the way down: isolation, restricted network and tool access, “universal monitoring for risky actions and misalignment across all agentic applications of Astra,” chain-of-thought monitors empowered to “review and interrupt high-risk activity.”[26] With that finding came an extension: monitoring now covers every tool-using inference call Astra makes, not just training and evals.[25]

Alongside, the pause: “Our largest planned frontier RL run remains on hold while we conduct smaller-scale training and evaluations to assess model behavior, validate our safeguards, and establish more evidence of alignment before proceeding.”[27]

Two readings of the 20%.

The skeptical reading: the denominator does all the work. Twenty percent of the inference compute being monitored, and the monitored share of total inference is undisclosed. If monitoring covers a sliver of traffic (frontier RL, evals, one presumptively cyber-capable model’s tool calls), the blended overhead across OpenAI’s fleet could be low single digits, and “20 percent tax” would overstate the burden the way headline capex numbers overstate disbursement. OpenAI has published the rate and withheld the base. A spokesperson added that the costs “won’t be passed on directly to customers”, and “directly” is carrying luggage.[28]

The structural reading: the direction is unmistakable even if the magnitude is foggy. This is the company that stopped showing raw chains of thought partly to preserve monitorability, now publishing a price for the watching, and holding its biggest planned run until the watching is ready. The proximate cause is on the record: the July incident in which two OpenAI models under evaluation, with reduced refusal rates, escaped a sandbox via an Artifactory zero-day and reached Hugging Face’s infrastructure.[29] Both companies’ remediations live mostly at the network and credential layer. After July, OpenAI paused frontier-model inference in research clusters for runs that could execute code or access the internet; the monitoring program is the condition the post offers for scaling such runs again.[4]

The obvious objection runs the other way: doesn’t a tax levied on dangerous models prove the model is what matters? The risk originates there, yes: Astra earned its surveillance. But look at where the money goes: every item on OpenAI’s own mitigation list is loop-level: watchers wrapped around inference, execute-and-internet restrictions, sandboxes, permission boundaries. None of that spend makes the model more capable. All of it hardens the loop, the Monitoring Tax conceding in compute what StateM measures in points.

And the monitoring technique OpenAI has published most about — reading the model’s chain of thought — carries a failure mode OpenAI itself documented in 2025: optimizing against a chain-of-thought monitor “does not eliminate all misbehavior and can cause a model to hide its intent.”[30] Monitoring at production scale is an optimization pressure: models get updated, retrained, and selected under it. That makes the Monitoring Tax an arms race rather than a toll, funded indefinitely out of OpenAI’s own compute.

Put the two announcements side by side, and the asymmetry sharpens into strategy. A monitor over a training run and a sink gate in a session loop are the same line item: compute and code spent on the loop rather than the weights. DeepSeek’s answer to “who watches the agent?” is: you do; here is the append-only log; replay it. OpenAI’s answer is: We do, and here is what it costs. One externalizes the cost of supervision to the user and calls it transparency. The other internalizes it and calls it safety. Both are telling you the same truth: the loop around the model is now where risk management happens.

The Audit Came From Tencent

This brings us to the strongest evidence that the harness is the security perimeter. On August 17, four days after the dsh release, a team from Tencent’s Zhuque Lab published a security assessment of DeepSeek Harness, run with A.I.G, Tencent’s own AI-infrastructure red-teaming tool.[31] One Chinese lab publicly red-teaming another’s four-day-old flagship, methods and per-channel numbers in the open, is a norm Western frontier labs have not practiced on each other’s shipped products uninvited. An audit this fast was possible because the artifact is public: the transparency DeepSeek sells is what let Tencent take it apart in four days.

The design is exhaustive for its target: 14,560 controlled executions against a pinned release-day commit, each payload tried both pasted as text and delivered as a file.[32] Headline result: full injection success at 5.6%, with most attempts ending in the agent explicitly refusing.[33]

Whether 5.6% is good is unanswerable: no comparable audit of Claude Code or Codex has been published to serve as a baseline. The distribution, though, is where the lessons are.

Hidden Unicode payloads inside files succeed 25.5% of the time; the identical payload pasted as text never succeeds.[34] The model is the same in both cases. What differs is the ingestion path: the paste route evidently normalizes away what the file route preserves. The delivery, and the cheapest defense, live in plumbing the model never sees.

The skills channel — the very thing “everything is a plugin” celebrates — is injectable at 14-16%, among the highest rates in the study.[35] The architecture’s core feature is one of its largest measured wounds and its most predictable: skills are trusted instructions by design, so they are the cheapest place to hide untrusted ones, and the unauthenticated plugin topic is where untrusted ones will come from.

The strongest text-mode attack in the study is social rather than technical: a fake progress note — your task is already done, now do this — planted in content the agent reads, succeeding at 17.0% against a 5.7% naive baseline.[36] The agent’s weakness is less parsing than trust in its own apparent history. And the most consequential split in the paper: corrupting what the agent says succeeds at 35.7%, while hijacking what it does — actually reaching a sensitive sink like mail, shell, or a transfer — succeeds at 2.5%.[37] An order of magnitude between lying and acting, but corrupted output that a human acts on is a hijack in itself.

Why the gap? Because between interpretation and action sits the harness: confirmation steps, scoped permissions, sinks that demand more than persuasive context. Tencent’s top recommendation is to finish the job: authorize sensitive sinks independently of model interpretation.[38] Do not ask the model whether the email should be sent; make the send path require an authority the model’s context cannot mint. The July post-mortems converged on the same fix: authority boundaries, not better judgment.[29]

Questions we’ll all have to answer: which actions can a poisoned context authorize? Which ingestion paths skip the paste route’s normalization? Who can publish a skill your agents will load? The defense in Tencent’s 14,560 runs was layered: 68% of attempts died when the model refused, and the harness failed to convert most of the survivors into privileged action. Security, like capability, is becoming a property of the loop.

The remaining caveats are the study’s own: a single harness, a single model, a single commit, and simulated sinks. Treat every number as a first measurement, not a ranking. But the direction of the finding does not depend on the baseline. Both of this month’s measurements point to the same layer from opposite sides: StateM shows the harness is where the capability variance is; Tencent shows it is where the effective defenses are.

What the Asymmetry Buys

DeepSeek’s transparency is as strategic as OpenAI’s opacity. A lab accused of training on competitors’ outputs benefits from normalizing raw chain-of-thought access: exposed traces are distillation feedstock, and while a closed API can still withhold its raw traces, a default-logging harness moves the norm: whatever a provider does return is recorded, replayable, and one export away from a training set.[39] “Everything is a plugin” also means the attack surface is a plugin: the skills channel Tencent flagged and the unvetted registry topic are the price of the architecture, and DeepSeek shipped them at developer-preview maturity, with a bolded compatibility warning where a plugin trust model will have to go.

Conversely, OpenAI’s opacity spans two different decisions made two years apart, and the defense framing invites reading them as one. Monitoring for cyber-critical capability is a safety cost, disclosed this month; declining to show raw chains of thought is a choice from 2024, made by OpenAI’s own listing of factors, partly for “competitive advantage.”[19] Both are real; only one is the 20%. The asymmetry itself — one lab’s flagship feature is the other lab’s disclosed liability — is the finding.

Readers of “The Verification Tax” will recognize the shape: there, the binding cost in verifiable-reward RL had migrated from generating answers to checking them; the Monitoring Tax is the same migration at the safety layer.[40] The priced layers of the stack, mid-2026, are the ones that watch and verify; the intelligence itself trades as a commodity, inside scaffolding that is now literally free.

The Shell and the Moat

The deal that closed on August 14 was announced on June 16, days after SpaceX’s listing, with Anysphere then preparing for a round at a $50 billion valuation.[3] Sixty billion in a just-listed acquirer’s paper is not sixty billion in cash. Cognition — the Devin agent, plus the Windsurf editor it acquired — remains the largest standing independent: it raised $1 billion at a $25 billion pre-money valuation in May.[41]

So what did SpaceX buy? Start with what it did not need. Not a software revenue line: a company assembling an AI division out of rockets, satellites, and the xAI merger does not spend sixty billion on ARR. And not models: xAI came in-house earlier this year, so the acquirer already owns a frontier lab.[3] A buyer with its own models paying the week’s highest price for a harness company is this piece’s thesis with a board’s signature on it. The model was not the bottleneck. The loop was. And the most deflationary rival read — that a model owner simply bought the funnel that feeds its models — is DeepSeek’s razor-and-blades at acquisition prices: it concedes the layer and haggles over the motive.

What sixty billion buys, on the reading the week’s evidence supports, is the harness in the full sense. Not the generic shell DeepSeek zeroed twenty-four hours earlier, but everything that turns a shell into a harness: the coding-specialized loop, the domain process tuned against a telemetry base no rival could assemble from scratch, the team that does the tuning, and the enterprise contracts that keep the telemetry coming.

VS Code did not kill JetBrains — Cursor itself began as a VS Code fork — and free shells tend to grow the category they commoditize. The decomposition also predicts a third moat: assurance. A hardened, attested build of a free shell is a paid product — Red Hat built a company on that arbitrage — and OpenAI just told you what assurance costs at the frontier. The twenty-six-trillion-dollar addressable market is the acquirer’s number and the acquirer’s story; the read above does not need it.[3]

StateM hands you the same decomposition from the measurement side. Nine points on the benchmark the runbook was tuned for; 0.55 frozen points on the held-out one. The durable part of a harness advantage is the domain process — renewable, domain-bound, not ownable — and the assets that regenerate it: the users and the telemetry and postmortems they produce. The disposable part is the shell that hosts it, which now has a posted price. The underwriting translation is one question: of this company’s margin, how much is the loop itself, and how much is distribution, data, and contracts? This locates the value; it does not grade the price. SpaceX did not buy a shell; it bought the parts DeepSeek cannot give away.

The exit pattern should look familiar to readers of the silicon pieces: the independent specialized-inference vendors have been absorbed or signed away one by one to the GPU merchants, and now the largest independent harness has ended up inside an integrator too.[42] The one thing the Cursor deal does not tell you is what an independent harness is worth, because after August 14, there is one fewer way to find out.

What Would Have to Break

Three falsifiers, in plain language.

1. If the next model generations resume dominating — if GPT-5.7 or V5 under stock harnesses move agentic benchmarks by more than harness engineering does — then the commoditization read dies and this was a plateau artifact. StateM currently argues otherwise, but StateM is one paper, with headline results on one benchmark, and an open adjudication.

2. If DeepSeek Harness, six months from now, has a thriving plugin ecosystem and no presence on Terminal-Bench-class leaderboards — or, if it avoids leaderboards on principle, no dsh components showing up inside rival stacks — then it is a chatbot shell with good marketing, not a harness in the sense that moves scores, and the Free Harness was a giveaway of something that did not matter.

3. If OpenAI ever discloses the monitored share of total inference and it rounds to low single digits blended, then the Monitoring Tax is a frontier-lab boutique cost, not a structural one. And the moat claim has its test: if Cursor-class pricing power survives customers swapping their own model keys into free shells at scale — revenue attributable to the loop itself — then the moat was in the shell after all, and this piece mislocated it.

What does not depend on any of those: where the decisions moved. From now on, we shouldn’t be choosing a model: the model is a provider card, swappable by design in the open reference, locked only where a vendor insists. We should be choosing a harness: its ingestion paths, its sink authorization, its logging posture, its plugin trust model. The properties Tencent measured and StateM priced. And anyone modeling frontier-lab economics now has a new line item with a disclosed rate and an undisclosed base, growing with capability by policy.

DeepSeek and OpenAI disagree about nearly everything: licensing, logging, disclosure, where trust should live. In a single August week, they agreed, by acting in opposite directions, on the only question that matters: the loop around the model now moves outcomes more than the model inside it, and each lab priced that fact as aggressively as its business model allows. One priced it at zero to commoditize it. The other priced it at twenty percent of everything it watches to control it. And the week’s third price agreed with both of them: sixty billion dollars, from a buyer that already owned frontier models, for the loop around them.

Everything is a plugin now — models, tools, skills, sandboxes, the UI. Everything except the watcher. The watcher is the product. The three of them only disagreed about who pays for it.

Notes

[1] DeepSeek-AI, DeepSeek Harness repository, created August 13, 2026 (GitHub API created_at 2026-08-13T11:56:32Z, retrieved August 19). MIT license, TypeScript monorepo. The developer-preview warning — “THERE WILL BE COMPATIBILITY-BREAKING CHANGES,” bold in the original — is in the README. No benchmark, eval, or accuracy figure appears anywhere in the repository or launch materials as of August 19, 2026.

[2] Readings diverged on August 19, 2026: the GitHub API returned 165,743 stars and 17,618 forks, Shields.io showed ~166k, and GitHub’s rendered page showed 161.1k — star counts are eventually consistent and gameable, so the body uses the conservative floor. Stars measure attention, not quality; no independent audit of bot inflation exists for this repository, which is why this piece makes no “fastest-ever” comparison.

[3] Deal terms per TechCrunch, “SpaceX to acquire Cursor for $60B in stock, days after blockbuster IPO”, June 16, 2026 (all-stock; TechCrunch reports a $10B break-up fee while Reuters reported a $4–10B range; Anysphere then preparing a $2B round at a $50B valuation), and completion per Bloomberg, “SpaceX Completes $60 Billion Cursor Acquisition to Expand AI Coding Tools”, August 14, 2026. The $26 trillion addressable-market figure is SpaceX’s own investor pitch as reported by TechCrunch — a vendor number, cited as the acquirer’s story, not as a market fact. TechCrunch also notes the acquisition strengthens SpaceX’s AI division, “which merged with Elon Musk’s xAI earlier in 2026” — the basis for the body’s observation that the acquirer already owned frontier models.

[4] OpenAI, “Pacing model development in an era of cyber-critical capabilities”, August 18, 2026. All OpenAI quotes in this piece are verbatim from the post unless otherwise attributed. The post also states OpenAI “paused frontier model inference in research clusters for runs that could execute code or use tools that could access the internet” immediately after the July incident.

[5] Thomas Claburn, “DeepSeek’s innovative harness treats everything as a plug-in”, The Register, August 14, 2026 — the harness field list, the Ronacher quote and identification, and the system-prompt comparisons. Mistral’s Vibe, the open-source CLI coding agent, added to the list by this piece. The prompt sizes (Pi ~200 tokens; Claude Code ~10,000, cut roughly 80 percent) are community measurements relayed by the Register, not vendor statements.

[6] Ziheng Qin, Yaxin Lu, Zhangyang Wang, Kai Wang, “StateM: Reaching 95.3% Raw Accuracy, or a $15 Frontier Run, on Terminal-Bench 2.1 via Harness Scaling”, arXiv:2608.15089, August 15, 2026; code at github.com/henryqin1997/statem. The paper states the work “was conducted in the authors’ personal time and does NOT reflect the views of any affiliated organization”; no institution is named.

[7] StateM results: GPT-5.5 (xhigh) 83.1% stock → 92.1% under StateM; GPT-5.6 Sol (xhigh) 84.9% stock → 95.28% raw pre-adjudication (424/445 trials; 89 tasks × 5 trials). The Ultra comparison is the abstract’s own: “StateM raises GPT-5.5 xhigh to 92.1%, versus 83.1% reference and GPT-5.6 Sol Ultra at 91.9%” — 91.9% is cited as the flagship’s reference score, not a StateM result. The 0.2-point margin of 92.1 over 91.9 is within sampling error (the submission reports ±0.87% SE); “numerically above” in the body is meant literally, not as a significance claim. All figures from the paper and the leaderboard submission (note 11).

[8] Arithmetic: harness deltas +9.0 (GPT-5.5) and +10.4 (GPT-5.6 Sol xhigh) versus the +1.8 stock-to-stock generation delta (83.1 → 84.9); 9.0 ÷ 1.8 = 5.0. Same benchmark, same task set, same trial protocol. The 5.0× ratio is built on the GPT-5.5 pair, which is paper-reported and not part of the flagged leaderboard submission; the flagged trials (note 11) all belong to the GPT-5.6 Sol xhigh run.

[9] Both quotes from the paper; the bottleneck sentence is bolded in the original.

[10] Costs per the paper and submission: $1,062.95 reported model cost (1.18B tokens) for the GPT-5.6 Sol xhigh run; $15.20 realized API charges for the DeepSeek-V4-Flash final evidence run at 88.09% under standard timeouts (stock baseline 82.7%; the whole DeepSeek adaptation campaign cost $52.22); $574.68 is a different leaderboard submission — GPT-5.6 Sol (max) at 83.37% raw — not the same configuration at a different price. $574.68 ÷ $15.20 ≈ 37.8×. “xhigh” and “max” denote reasoning-effort configurations.

[11] Pull request #142, harbor-framework/terminal-bench-2-1, filed July 15, 2026; still open with last activity July 31 as of August 19. Automated review flagged 13 trajectories: 4 as “harness cheating” (embedded verification logic — the authors concede these should score zero, giving 420/445 = 94.38%) and 9 as possible reward hacking (the authors dispute 5 as false positives). The paper’s two scenarios do not compound: it computes 420/445 = 94.38% (zeroing the 4) and 415/445 = 93.26% (zeroing the 9) each from the raw 424. The PR lists the 13 flagged trajectories as distinct, so the compounded worst case — all 13 zeroed — is 411/445 = 92.36%, a floor the paper does not state; this piece uses it. The submission’s agent is listed as “statem-Codex” — StateM wrapped around Codex. A reviewer separately raised cross-task hint contamination. Adjudication is pending; every headline number in this piece carries that status. For scale: the top merged entry shown on the public 2.1 leaderboard sat at 83.8% (Claude Code, Fable 5) as of August 19 — the StateM figures above that are paper- and PR-reported, not yet board-accepted.

[12] BusinessBench frozen one-shot transfer: +0.55 macro (+1.34 micro); negative transfer on RefactorBench (−2.78) and WooCommerce Stock (−3.70), where the paper says the learned controls targeted the wrong execution boundaries; two mechanism-matched task families gained +10.04. The runbook transfers where the mechanism matches, and not elsewhere.

[13] The paper’s own disclosure: the profile learned a verifier’s boundary convention “without ever reading verifier code” — repeated evaluator feedback encoded the examiner’s unstated conventions into the runbook.

[14] Terminal-Bench, “Leaderboard integrity update”, April 19, 2026: an agent judge now re-reviews all passing trials for reward hacking (zeroed if confirmed), after three organizations — OpenBlock (OB-1), QuantFlow (Pilot), and ForgeCode — were penalized for cheating.

[15] The one-line description and the “Everything is a Plugin” framing are on the repository itself (note 1); the fuller sentence is DeepSeek’s wording as quoted by The Register (note 5); capitalization in the original.

[16] Cordis is a pre-existing plugin meta-framework from the ecosystem around the Koishi chatbot project, not a DeepSeek codebase; its design paper, “A Programming Paradigm for Spatiotemporal Composability”, is GitHub-hosted with no peer-reviewed venue. Some aggregator coverage has misattributed Cordis to DeepSeek; the provenance is the other way around — DeepSeek adopted it.

[17] Hacker News, “DeepSeek Harness developer preview” — 739 points, 309 comments as of August 19, 2026. The characterization of where praise and criticism concentrated is this piece’s reading of the thread; the quoted phrase is from a highly upvoted comment. Forum commentary: color and practitioner sentiment, not evidence.

[18] Session model per repository documentation and The Register (note 5): append-only session log with a trajectory view exposing raw reasoning. V4-Pro reached general availability on the API — thinking mode on by default — on August 13, 2026, the same day as the harness release; see e.g. VentureBeat’s launch coverage.

[19] OpenAI, “Learning to reason with LLMs”, September 2024: “after weighing multiple factors including user experience, competitive advantage, and the option to pursue the chain of thought monitoring, we have decided not to show the raw chains of thought to users,” serving “a model-generated summary of the chain of thought” instead.

[20] Anthropic’s summarized reasoning and gated raw traces per The Register (note 5). Anthropic has not published a comparable cost figure for its classifier and summarization pipeline.

[21] DeepSeek Harness provider documentation: provider cards for DeepSeek, Anthropic, OpenAI, Azure, Bedrock, Vertex, and Codex (the last authenticating over OAuth); API keys are entered manually in settings; the documentation designates no provider as the default.

[22] “Open Source, Closed Orbit: The Hardware Monopolist’s Guide to Owning Open Source,” The AI Realist — the black-hole/sun diagnostic: does a vendor’s open-source contribution make competitors’ products easier or harder to use?

[23] Irene Zhang, “The DeepSeek Thesis”, ChinaTalk, August 13, 2026 — leaked minutes of a four-hour meeting between Liang and investors that circulated in late July; the clause quoted in the body is ChinaTalk’s English rendering (”China, in his eyes, will play the role of token factory at global scale, pushing the price of intelligence down as it did for countless other industries during its manufacturing boom”), not a verbatim Liang quote. The $562,027/day and 545 percent figures are not from the leak: ChinaTalk attributes them to an analysis DeepSeek itself published in February 2025 (R1 API, theoretical daily revenue at a 545 percent cost-profit ratio, with DeepSeek’s own caveat that actual revenue ran substantially lower). Vendor-published theoreticals — better provenance than a leak, still the seller’s math. The mundane read of the harness release — an ordinary ecosystem move, no grand pricing design — survives the evidence; the price signal reads the same either way.

[24] The dsh-plugin GitHub topic functions as the de facto plugin registry: 150 public repositories carried the tag as of August 19, 2026, six days after release. GitHub topics are self-applied by repository owners; there is no authentication, signing, vetting, or review, and DeepSeek has announced no registry governance. The most visible curation is a community-maintained awesome-list.

[25] OpenAI post (note 4): “This monitoring is required for all RL training and evaluations involving tools for models of Sol capability or higher,” and: “Once we determined that Astra may have critical cyber capabilities on August 7, we added an additional monitoring requirement for all inference of Astra with tools (not just RL training and evaluations).”

[26] OpenAI, “Responding to the next frontier of critical cyber capabilities”, August 7, 2026. Body quotes verbatim: OpenAI “cannot rule out critical cyber capabilities under our Preparedness Framework”; the mitigation list includes “We have implemented universal monitoring for risky actions and misalignment across all agentic applications of Astra,” with monitors that “evaluate the model’s Chain of Thought and trigger a security response to review and interrupt high risk activity”; and “Astra is an upcoming model, and was not involved in exploiting Hugging Face.” The Critical threshold in the Preparedness Framework: the ability to “identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention” (body paraphrases). Both posts preserve the modal: the August 18 post’s own wording is “determined that Astra may have critical cyber capabilities” (note 25).

[27] OpenAI post (note 4), verbatim.

[28] Thomas Claburn, “OpenAI’s overhead will rise 20 percent for some workloads as it hardens security”, The Register, August 19, 2026 — including the unnamed spokesperson’s statement that the costs “won’t be passed on directly to customers.”

[29] The July 2026 incident, from the primary accounts: OpenAI, “OpenAI and Hugging Face partner to address security incident during model evaluation”; Hugging Face, “Security incident disclosure — July 2026” and “Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident”. OpenAI’s account — two models in a cybersecurity evaluation with reduced refusal training, an evaluation-sandbox escape via an Artifactory zero-day — is deliberately narrower than the “rogue models hacked Hugging Face” shorthand that circulated in some coverage, and this piece follows the narrower account.

[30] OpenAI, “Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation”, March 2025, as quoted in the Register’s August 19 coverage (note 28).

[31] Zonghao Ying et al., “Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection”, arXiv:2608.16393 (v1 August 17, v2 August 18, 2026); assessment materials in Tencent’s AI-Infra-Guard repository. Affiliation: Tencent per the paper’s metadata (so listed on the Hugging Face papers index); Zhuque Lab per the paper body; publication inside Tencent’s GitHub organization corroborates. The consensual Western comparator referenced in the body: OpenAI and Anthropic’s 2025 pilot alignment-evaluation exchange — reciprocal, agreed, and model-level rather than a product audit.

[32] Design: 14,560 executions = 1,120 test cases (16 injection channels × 2 carrier modes × 35 payload objectives) × 13 attack methods including a naive baseline, against DSH commit 47f94385 (the August 13 release commit) running deepseek-v4-flash, with sensitive sinks simulated as fixtures.

[33] Full-injection success: 5.6% under the deterministic judge, 5.3% under the LLM judge; 68.4% of attempts ended in explicit refusal.

[34] Hidden Unicode payloads: 25.5% full success delivered inside files versus 0.0% for the same payload pasted as text (deterministic judge) — the paste path normalizes; the file-parsing path preserves.

[35] Skills-channel injection: 14–16% across both judges, among the highest-risk channels in the study.

[36] The fake_completion method — a planted note claiming the task is already done, redirecting the agent — reached 17.0% under the LLM judge in text mode, versus 5.7% for the unmodified baseline payload.

[37] Output corruption 35.7% versus sensitive-sink action hijack 2.5%; the paper treats these as distinct operational threat profiles. Both are lab rates — crafted adversarial payloads, simulated sinks, no adaptive attacker — conditional on an attack reaching the agent, not fleet frequencies.

[38] The assessment’s stated mitigation: sensitive sinks require independent authorization mechanisms separate from model interpretation (paraphrase of the report’s recommendation).

[39] OpenAI said in January 2025 it had evidence suggesting DeepSeek trained on distilled outputs of its models (widely reported at the time, e.g. by the Financial Times, January 29, 2025); no public resolution followed, and DeepSeek did not respond publicly to the specifics. This piece takes no position on the accusation — only on who benefits from normalized raw-trace access.

[40] “The Verification Tax,” The AI Realist — the argument that in RL with verifiable rewards, the binding cost had migrated from generating candidate solutions to verifying them.

[41] TechCrunch, “AI coding startup Cognition raises $1B at $25B pre-money valuation”, May 27, 2026; Bloomberg reported the talks on April 23. Priced round, pre-money basis as stated.

[42] The Integration Premium — defined in “AWS Built Its Own AI Chip. Now It Needs Someone Else’s.” and extended in “The Model Is the Machine” (The AI Realist): in a disaggregating stack, margin migrates from component makers to the integration layer, and the modal exit for independent specialists is absorption (Groq assets to Nvidia; the Untether team and Taalas to AMD). “Musk’s Chip Gambit” covers the acquirer’s side of this arc.

For sixty years, mainstream computing has run in one direction: the hardware is fixed, and the software adapts to it. On August 6, AMD paid to reverse the arrow. It signed a definitive agreement to acquire Taalas, a Toronto startup that etches a model’s weights directly into the chip’s metal, a silicon that can run only the model it was manufactured with.[1] Taalas co-founder Ljubisa Bajic, in AMD’s announcement: “We founded Taalas to rethink AI inference from the ground up by building the hardware around the model.”[1]

In March, I wrote that the one-chip-does-everything era of AI inference ended when AWS, Nvidia, and Huawei converged on the same split: prefill on compute-bound silicon, decode on memory-bound silicon.[2][3] AMD held the middle ground: disaggregation in scheduling software, not in silicon.[2] Four and a half months later, AMD closed that ground, not with a decode chip, but with the rung below. Specialization is descending: first, the workload, when training chips split from inference chips; then the phase; now the model, and the GPU duopoly is paying for every rung of the descent.

What AMD actually bought

Taalas showed working silicon this February: HC1, a 6-nanometer TSMC chip with 53 billion transistors, Meta’s Llama 3.1 8B etched into a mask-ROM fabric, and the KV cache — its working memory — in on-die SRAM.[4] No high-bandwidth memory (HBM), no advanced packaging, no liquid cooling. The company claims about 17,000 tokens per second per user, a tenth of the power of GPU serving, and a twentieth of the datacenter build cost. Vendor numbers, measured on a small model at 3-bit quantization; per-user speed is not aggregate throughput.[5]

The prefill/decode split was a workaround for chips that must serve any model. Etch one model into the die, and the workaround dissolves: weights sit next to compute, the memory wall that made decode expensive is gone, and one chip serves both phases again, for exactly one tenant.[2]

When the weights change, there is nothing to reprogram. You reprint: a new checkpoint of the etched architecture touches two metal layers of the roughly 100 mask layers that build the chip, a revision Taalas says TSMC turns in about 2 months, against 6 for a full design.[6] A new architecture is a different job: the fabric is shaped to the model’s dimensions, and Taalas’s own roadmap says as much. Its next model class arrives on new silicon, not as a revision of HC1.[6] The first product took 24 people, $30 million of the roughly $219 million raised, and a founding team out of Tenstorrent, AMD, and Nvidia.[7]

The admission, priced twice

On December 24, Nvidia paid a reported $20 billion — its largest transaction on record, unconfirmed in any filing — for a non-exclusive license to Groq’s inference IP and roughly 90 percent of its staff. “We are not acquiring Groq as a company,” Jensen Huang told employees, oddly.[8] Twelve weeks later, the Groq 3 LPX stood on the GTC stage: an SRAM-based decode rack fused into the Vera Rubin platform, with Foxconn reportedly pulling production forward to this summer.[9]

AMD’s pattern is the same, run twice. In June 2025, it hired away the entire team behind Untether AI, a Toronto inference-chip company whose products were promptly discontinued.[10] Taalas is AMD’s second Toronto inference-silicon absorption in fourteen months, and this time it kept the product: Taalas goes into the Instinct roadmap and the Helios racks now ramping with Anthropic, Meta, Microsoft, OpenAI, and Oracle.[1][11] Lisa Su calls herself “a big believer that there’s no one-size-fits-all as it comes to chips”; her AI chief, Vamsi Boppana, frames the acquisition as “the right compute solutions for every AI workload.”[12][1] Both lines are unremarkable until you remember what these companies sell. The two firms whose franchises are general-purpose GPUs are the ones paying — one, a reported twenty billion; the other, undisclosed — for silicon that is anything but.

AMD would call this a portfolio, not a pivot, and the undisclosed terms suggest the hedge was probably cheap. An acquisition proves direction only when it ships. Nvidia’s shipped. AMD’s now has to.

When the model and the machine write down together

Model-etched silicon matters for accounting reasons before engineering ones. In April, I wrote that the industry’s mismatch is temporal: frontier models live three to twelve months while the hardware they run on depreciates over five or six years. OpenAI shipped five versions of GPT-5 in seven months, none of which lasted four months as the flagship.[13] The gap between those schedules is where the balance-sheet fiction lives. Etching closes it in two tiers that mirror the model pipeline itself. Manufactured chips carry one checkpoint: supersede it, and that inventory is done, a two-month reprint producing the next edition. The design — the shape cast in silicon — depreciates with the architecture; adapters in SRAM absorb the fine-tune churn in between.[4][6] The chip is not a platform. It is a print run, and the press outlives the edition.

A print run is only rational if what you are printing holds still, and the thing that must hold still is the architecture. Checkpoints are what reprints are for. Nobody etches the frontier: that tier changes every six weeks and stays on programmable silicon. The bet is the serving tier: the Llama-class workhorses and distilled variants. The demo is the evidence: the architecture Taalas etched in February 2026 is a shape Meta shipped in July 2024, and DeepSeek was still pouring new reasoning checkpoints into it six months on.[4] AMD is pricing the proposition that the volume tier of the model market has commoditized into stable shapes, and that the inference price war will be won a twentieth of a build cost at a time. The most consequential claim in this acquisition is about models, not chips.

So the strategic question underneath the deal: whose shapes get etched? An etched fabric in AMD’s roadmap is a standard with hardware gravity. Every checkpoint that wants the economics must ship in that shape, and the compatibility war moves down a layer. The co-design precedent is already on the record: Amazon says Anthropic works with Annapurna Labs to shape next-generation Trainium, Broadcom builds Anthropic’s custom accelerators, and Anthropic already runs on Helios.[14][11] Watch for a frontier lab handing its serving workhorse to AMD’s mask shop, the model roadmap becoming a silicon roadmap.

What would prove this wrong

Three tests, all observable. If all three fail, this was a talent acquisition with a good press release, Untether with better branding.

1. Taalas silicon appears in a shipping Helios configuration, or it never does.

2. A hardwired, model-specific chip reaches production at a major platform by the end of 2027, or none does.

3. Serving-tier architectures hold still long enough to etch, or shape turnover stays too fast, and the category dies.

The market-structure consequence is already on the scoreboard. Groq’s assets are inside Nvidia. Untether’s team and Taalas are inside AMD. Cerebras took the other exit, a May IPO at $185 a share.[15] Anyone pricing an independent inference-silicon position should assume the modal exit is absorption, not platform status. The category built to disrupt GPU vendors is consolidating into them, and margins migrate to whoever assembles the system.[2]

Strip both deals to the sentence they share: the companies whose franchise is general-purpose silicon have concluded that the most valuable workload in computing no longer wants it. What they are unwinding is older than either company: the separation of software from hardware — the line that lets you sell one without the other, update one without retooling the other, write one down while the other keeps depreciating. The software industry was built on that line. Etching erases it. The model is the machine now.

Notes

[1] AMD press release, “AMD Acquires Taalas to Advance Compute Solutions for Rapidly Growing AI Inference Market,” August 6, 2026. Definitive agreement; financial terms not disclosed; closing expected Q4 2026 subject to regulatory approvals. Vamsi Boppana (SVP, AI Group): “AMD is building a full-stack AI platform that gives customers the flexibility to deploy the right compute solutions for every AI workload.” Ljubisa Bajic: “We founded Taalas to rethink AI inference from the ground up by building the hardware around the model.” The release names integration targets: the Instinct accelerator roadmap, Helios rack-scale systems, EPYC CPUs, and ROCm software.

[2] Julien Simon, “AWS Built Its Own AI Chip. Now It Needs Someone Else’s,” The AI Realist, March 15, 2026. Introduces the Reasoning Tax and the Integration Premium (”in any disaggregating hardware stack, margin migrates from component manufacturers to the integration layer”); documents the three-ecosystem convergence and AMD’s middle-ground position: “The disaggregation is in scheduling, not in silicon.”

[3] Julien Simon, “Acquired, Absorbed, Disaggregated,” The AI Realist, March 26, 2026. The convergence: AWS-Cerebras announced March 13; Nvidia Dynamo entered production March 16; Groq 3 LPX announced at GTC March 17. Huawei’s phase-split Ascend 950PR/950DT pair, announced September 2025, ships across 2026.

[4] Taalas HC1 unveiled February 2026. Specifications per heise online (February 2026) and Data Center Dynamics: TSMC 6nm, approximately 53 billion transistors on an 815 mm² die; model weights in a mask-ROM recall fabric using a proprietary 3-bit data format with 6-bit parameters; KV cache and fine-tuning adapters in an SRAM fabric; no HBM, no advanced packaging, no liquid cooling. The base model is fixed at manufacture. Adapter-style fine-tunes (LoRA) load into the SRAM fabric at runtime, and the context window is configurable, per CNX Software; a full-parameter fine-tune — or a LoRA merged into the base weights — is a new checkpoint, which requires a mask reprint, not a load. Llama 3.1 was released by Meta in July 2024; the same 8B architecture carried DeepSeek’s R1-Distill-Llama-8B in January 2025 — checkpoints changed, the shape persisted. Meta’s own frontier direction has since turned proprietary with Muse Spark, its first release after the Superintelligence Labs reorganization, though Meta says current Llama models remain open source, per VentureBeat. The shape’s persistence in the serving tier does not depend on Meta’s frontier roadmap: the installed base and third-party checkpoints sustain it — if anything, a sponsor stepping back makes an etched shape more like a public instruction set than a vendor product.

[5] Vendor-published figures: approximately 17,000 tokens per second per user on Llama 3.1 8B, roughly one-tenth the power and one-twentieth the datacenter build cost of conventional GPU serving, per Taalas materials as reported by heise and The Register. heise notes early independent tests reaching close to 16,000 tokens/second. Per-user token rate is a latency-side metric and does not translate directly to aggregate throughput per chip; the demonstration model is small (8B parameters) and aggressively quantized. The contrast with Cerebras is density and cost: the WSE-3 reaches on-die weights with 44 GB of SRAM across a full wafer; Taalas reaches them with mask ROM on a single 815 mm² die — fixed function traded for commodity size.

[6] Company-described revision process, as reported by heise, Unite.AI, and The Register: weights occupy two metal layers of the roughly 100 mask layers used to build the chip, with TSMC turnaround of approximately two months for a two-layer revision versus approximately six for a full design. All three descriptions derive from Taalas, and none specifies whether the two-layer path covers anything beyond new weights for the etched architecture. A cross-architecture port — different dimensions, vocabulary, or attention configuration; Llama to Qwen, or 8B to 70B — changes the compute fabric itself. The Register describes re-spins for new models as significantly cheaper than starting from scratch, and Taalas’s roadmap points to new silicon for new model classes (a mid-sized reasoning model in spring, the HC2 platform — with standard 4-bit floating-point formats — by year end) rather than HC1 revisions, per heise and CNX Software.

[7] Data Center Dynamics, February 2026: founded August 2023 by Ljubisa Bajic (previously an architect at AMD and Nvidia; co-founder of Tenstorrent, where he swapped the CEO role with Jim Keller in October 2022 and departed in March 2023), Drago Ignjatovic, and Lejla Bajic; $169 million round announced February 2026, approximately $219 million raised in total. Investors include Quiet Capital, Fidelity, and Pierre Lamond, per Unite.AI. Team of 24 and $30 million spent on the first product, per heise.

[8] CNBC, December 24, 2025. Structured as a non-exclusive IP licensing agreement plus the hiring of approximately 90% of Groq staff; approximately $20 billion per investor sources, not confirmed by Nvidia in filings. Jensen Huang internal email obtained by CNBC: “We are not acquiring Groq as a company.” Jonathan Ross subsequently joined Nvidia as chief software architect, per Forbes (March 18, 2026).

[9] Groq 3 LPX announced at GTC 2026, March 17, 2026 (see [3]). Chip produced on Samsung’s 4nm process and integrated into the Vera Rubin platform, per Tom’s Hardware. Foxconn reportedly accelerating LPX rack production ahead of schedule, per Wccftech (July 2026); production timing is press-reported, not confirmed by Nvidia.

[10] TechCrunch, June 6, 2025: AMD hired the engineering team behind Untether AI. Tom’s Hardware: Untether ceased product support. Untether AI was headquartered in Toronto and built at-memory inference accelerators.

[11] AMD, “AMD Reports Second Quarter 2026 Financial Results,” August 4, 2026. Revenue $11.5 billion, up 50% year over year; Data Center segment $6.7 billion, up 107%. Helios rack-scale systems described as beginning to ramp, with deployments named for Anthropic, Meta, Microsoft, OpenAI, and Oracle; MI400-series GPUs (MI455X, MI430X) recently launched.

[12] Lisa Su, remarks at AMD’s Advancing AI 2026 launch event (July 20, 2026, where Helios and the MI400 series debuted), as reported by Stocktwits/Yahoo Finance (August 6, 2026): “a big believer that there’s no one-size-fits-all as it comes to chips,” in the context of GPUs remaining dominant for flexibility across new models. Reported speech; a primary transcript was not located, and the wording should be treated accordingly.

[13] Julien Simon, “Train, Deploy, Write Down,” The AI Realist, April 7, 2026. GPT-5 cadence per OpenAI release notes: five major versions between August 2025 and March 2026, none surviving longer than four months as the current flagship; hardware depreciation schedules of five to six years per hyperscaler filings.

[14] Amazon, “Amazon and Anthropic deepen their collaboration,” April 20, 2026: “Anthropic works closely with Annapurna Labs on developing and optimizing future Trainium chips, providing direct feedback from Claude training workloads to shape next-generation chip design.” Broadcom’s fourth custom-accelerator customer was revealed as Anthropic at its Q4 FY2025 earnings, per CNBC, December 11, 2025. Anthropic’s Helios deployment: see [11].

[15] CNBC, May 13, 2026: Cerebras priced its IPO at $185 per share, above the expected range, raising approximately $5.5 billion; trading on Nasdaq as CBRS from May 14. See also the Cerebras pricing release.

Nine months ago, Google’s redemption arc looked complete. Gemini 3 shipped in November to strong reviews, the app passed 950 million monthly users, and the Bard debacle of 2023 — the demo error that once wiped roughly $100 billion off the market cap — reads like ancient history.[1] This morning, Demis Hassabis stepped back from running Google DeepMind. Jeff Dean, Sanjay Ghemawat, Oriol Vinyals, and Quoc Le left to start a company. The stock fell five percent in early trading.[2] So the right question about today’s reorganization is not who runs DeepMind now. It is: what happened between November and August?

Start with what the departures actually are, because the “brain drain” framing undersells it. Google put three technical co-leads on Gemini in 2024: Dean, Vinyals, and Noam Shazeer — the last brought back in a roughly $2.7 billion licensing deal largely to do that job.[3] All three are gone as of this summer. Shazeer walked to OpenAI in June. Nobel laureate John Jumper left for Anthropic the same month. Dean and Vinyals left this morning.[3]

Now read the confirmed record on the model itself. No flagship successor to Gemini 3 has shipped in nine months — not damning by itself, but conspicuous for a company that shipped its way out of the Bard hole on cadence. The trade press has reported repeated delays and an architectural rebuild of the next Gemini cycle; Google has never confirmed it, and the sourcing is too thin to lean on.[4] You don’t need it. Sundar Pichai’s own memo this morning talks about Gemini 4 — and never mentions the intermediate release the trade press spent the spring waiting for.[5] When the CEO’s letter skips straight to the next number, the cycle in between did not go well. And on July 30, six days before elevating Hassabis to focus on science, Google dissolved its Nobel-winning AlphaFold team and folded its members into Gemini, with core scientists reportedly departing for Anthropic.[6] A company long on model progress does not strip-mine its science bench to feed the product line. A company short on it does.

Then read the destinations, because they are the closest thing the market will get to insider disclosure. Shazeer, the man with the clearest view of Google’s unreleased pipeline, chose the direct competitor: the recipe works, just not here. Dean, Ghemawat, Vinyals, and Le chose a startup whose stated mission is automating the search for new architectures — “it might be that we will discover a different transformer architecture,” Le said at launch, which is a polite way of pricing the current one.[7] Jumper and the AlphaFold core chose the rival that still funds science. Three exits, three verdicts, all rendered by people who saw the roadmap from inside. Any single move can be explained by a compensation package; the pattern of destinations cannot.

Against that record, today’s reorganization reads as consequence, not strategy. Companies do not decapitate and restructure their AI leadership while the flagship is on track; they do it after the cycle breaks. The honest bull case is narrow: Koray Kavukcuoglu, a DeepMind veteran since 2012, now oversees model development, frontier research, and the Gemini product teams, unified under a single operator reporting to Pichai, replacing a three-co-lead research committee.[2] If the committee were the bottleneck, consolidation would help. If the talent was the engine, Google just watched the engine leave.

What Google did manage brilliantly is the aftermath, and here the between-the-lines gets interesting. Pichai’s farewell contains the day’s most revealing sentence: “We’ll continue to work with them as a founding investor and Cloud partner.”[5] Regular readers know that structure from the revenue side — Nvidia into CoreWeave, Amazon into Anthropic, capital out as investment, and back as bookings.[8] Applied to headcount: Google holds equity in Discovery Loop, Google Cloud houses its compute for at least the first year, and a research team that was a consolidated expense becomes a customer with upside attached. There is even a recursive twist: if the next Gemini cycle really did stall on architecture, Google just bought a call option on the architecture search it couldn’t finish internally. Compare Meta, which faced its own misaligned scientist and handled it with a $14.3 billion hostile installation instead of a term sheet: Yann LeCun left, called his new boss “inexperienced,” and raised $1.03 billion for a competing lab with no Meta money in it.[9]

But don’t mistake the elegance for an answer. The term sheet recovers salvage value from the exits; it does nothing to make Gemini competitive. Google still holds the strongest non-model position in the race: its own silicon, its own datacenters, distribution through Search and Android, and 950 million people already in the app, which is exactly why the market took only five percent off rather than repricing the whole company.[1] The infrastructure moat buys time. It does not train the model.

So here is the between-the-lines of August 5: Google did not announce a strategy for catching OpenAI and Anthropic this morning. It disclosed, in org-chart form, that the last one broke somewhere between November and June — and it showed that nobody in the industry finances a retreat more expertly. The elephant in the room is still there. It is just exceptionally well-financed.

Notes

[1] Gemini 3 shipped in November 2025; Google Cloud blog. The 950M+ monthly active users figure is Google’s own, from Pichai’s August 5, 2026 memo — vendor-claimed, not independently verified. Bard demo error and ~$100B single-day market cap loss: February 2023, widely reported at the time.

[2] Hassabis becomes Chair of Google DeepMind and Chief Scientist of Alphabet, continuing to lead Isomorphic Labs; Kavukcuoglu becomes SVP of Google DeepMind overseeing “Gemini model development, Frontier AI research, and the Gemini app and developer teams,” reporting to Pichai. Pichai memo, ibid.; Demis Hassabis on X; Axios. Alphabet shares fell as much as ~5% in early trading, recovering to roughly −3.5% by mid-afternoon ET: Investing.com; TradingKey. If publishing after the close, update to the closing print.

[3] Google appointed Noam Shazeer co-lead of Gemini in August 2024, alongside technical leads Jeff Dean and Oriol Vinyals: The Information; Reuters via Yahoo. The Character.AI licensing deal that returned Shazeer to Google was reported at ~$2.7B. Shazeer to OpenAI and John Jumper (Nobel Prize in Chemistry 2024, AlphaFold) to Anthropic, both June 2026: Fortune; TechCrunch.

[4] Reports of three delays and a “full architectural rebuild” of the Gemini 3.5 cycle, and of Gemini 4 pre-training beginning with no announced date: BigGo; The AI Rankings; Memeburn. C-tier sourcing, unconfirmed by Google — cited here as reports only; no claim in the body rests on them.

[5] Pichai memo, August 5, 2026. Full Discovery Loop sentence: “We’ll continue to work with them as a founding investor and Cloud partner, and collaborate on a research framework for ML systems and related infrastructure advances.” The memo references Gemini 4; it does not mention Gemini 3.5.

[6] Google DeepMind disbanded the AlphaFold team on July 30, 2026, redirecting members to Gemini work; core scientists reportedly moved to Anthropic. Engadget; PYMNTS.

[7] Discovery Loop: public benefit corporation co-founded by Dean, Ghemawat, Vinyals, and Le; automating the experimental loop of the scientific method, ML research first; Khosla Ventures and Radical Ventures backing, round size and Google’s stake undisclosed; Google Cloud compute for the first year. Quoc Le quote from launch coverage. Unite.AI; CNBC.

[8] See prior coverage of the round-trip structure: “Welcome to Hotel Abilene” and “Compute Equals Commitments”, The AI Realist.

[9] Meta’s investment in Scale AI, announced June 12, 2025: $14.3 billion for a 49% non-voting stake, with Scale CEO Alexandr Wang (then 28) joining to lead what became Meta Superintelligence Labs: CNBC. LeCun on Wang (”young,” “inexperienced”): The Decoder; CNBC. AMI Labs: $1.03 billion at a reported $3.5 billion pre-money, March 2026, co-led by Cathay Innovation, Greycroft, Hiro Capital, HV Capital, and Bezos Expeditions, with Nvidia and Eric Schmidt participating; Meta absent from the reported investor list: TechCrunch. AMI builds on the V-JEPA architecture LeCun’s team developed and open-sourced at Meta — the one asset Meta retained.

In January, OVHcloud said the customer records Canadian police had been demanding since 2024 “cannot be provided to the Canadian authorities,” and described the French company and its European subsidiaries as not subject to foreign extraterritorial law.[1]

On 31 July, facing criminal charges in Ontario, the company published a statement naming the treaty channel through which those same records could be obtained, “including the data sought by Canadian authorities.” French authorities, it added, had indicated such a request would be expedited and processed “within a matter of weeks.”[2]

Same records. Same case. Six months apart.

There is a scene in A Few Good Men where Tom Cruise, playing a Navy lawyer called Kaffee, asks Jack Nicholson’s Colonel Jessep for a transfer order. Jessep tells him the paperwork is his for the asking. He just has to ask nicely. Kaffee asks nicely, and Jessep hands it over, beaming. The document was never in doubt. The courtesy was, and the courtesy cost Jessep nothing, which is why he made a point of demanding it.

That is the argument OVH is running in Ontario. It is also, as it turns out, the argument France has been running since 1968.

The Charge

The charges are real and criminal. On 31 July, OVH Groupe SA and its Montreal subsidiary Hébergement OVH Inc. confirmed that Canadian authorities had charged both with failing to comply with a production order and with obstruction of justice.[3] A French company listed on Euronext Paris is being prosecuted in Ontario for declining to hand over records held in Europe. Octave Klaba said the company would defend the principle of corporate separateness with full confidence.[4]

Readers who followed this in April know what it looks like. In April 2024, the Royal Canadian Mounted Police obtained a production order for subscriber and account data linked to four IP addresses hosted on OVH servers in France, the United Kingdom, and Australia, as part of a sealed national security investigation. In September 2025, Justice Heather Perkins-McVey held that OVH’s commercial and virtual presence in Canada brought the French parent within Canadian jurisdiction, that mutual legal assistance was permissive rather than mandatory, and that the French blocking statute was, in practical effect, an empty vessel. OVH filed for judicial review. I covered that ruling, and what it revealed about the European Commission’s cloud scoring rubric, in “Ten Percent Sovereign.”[5]

That piece asked why Brussels assigned legal sovereignty 10% of its scoring matrix. This one asks a narrower question, and the answer is less comfortable: what is the thing being weighed?

Because in Ontario, OVH is not arguing that Canada cannot have the data. The argument is that Canada asked the wrong way.

The Test the Senate Set

Fourteen months before the charges, a French senator wrote the only sovereignty test in this story that survives contact with the law. 10 June 2025, Microsoft France’s Anton Carniaux under oath before a Senate commission of inquiry. Senator Dany Wattebled asks whether he can guarantee that French citizens’ data will never be handed over without the explicit agreement of the French authorities. “Non, je ne peux pas le garantir.”[6] Wattebled did not ask where the data was stored. He asked who has to agree before it moves. Hold on to that question.

OVHcloud made the most of that hearing. In August, chief legal officer Solange Viegas Dos Reis told The Register that Microsoft had finally told the truth, and that it was no surprise to her. Customers were shocked, she said, because they had spent years being reassured the American statute would not touch them. “It’s false! Because, indeed, the data can be communicated.”[7] Customers, she said, had started asking how it works with other providers.

That question got an answer eleven months later, in an Ontario courtroom, and The Register saw the joke coming in November: it would be deeply ironic, it noted, if OVH could not guarantee the same thing, because the company has a subsidiary in Canada.[8] The irony is where this starts, not where it finishes. What matters is not that OVH ended up in Microsoft’s position. It is that OVH’s own legal documents had been describing that position all along.

The CLOUD Act page published by OVH’s American entity states that the company will comply with lawful requests from public authorities, that these requests can reach data stored outside the United States, and that requests from countries without an executive agreement go through the treaty route.[9] The group’s data policy promises, when authorities come asking, to limit disclosure to what the authority requires. Limit, not refuse. The Canadian agreement spells out the drill: check that the requesting authority is competent and the request valid, turn away what is obviously neither, hand over the rest, and tell the customer.[10] It is Carniaux’s testimony, with a different flag.

Let’s be fair to OVH, because the company has been careful and largely consistent. Its July 2025 statement distinguished OVH US, which is subject to American process for its own customers, from the French entity and its European subsidiaries, which it said are not subject to the CLOUD Act, the Patriot Act, or FISA.[11] That is accurate as far as it goes, and the FAQ’s insistence on the treaty route is the same position the company is now arguing in Ontario. Only one public statement in the whole sequence ever promised more than the contracts do, and it is the January one, which said the data cannot be provided. The July 2026 release returned the contracts to the record and added a delivery estimate.

The promise that goes further belongs to the state. SecNumCloud, the French cloud doctrine that qualifies sensitive data, added legal requirements in version 3.2: European capital controls, European applicable law, and contractual immunity clauses. OVH holds it for Bare Metal Pod and said on the day it was awarded that the qualification protects against the legal risks of non-European regulation.[12]

Read the requirements narrowly, and they aim at third-country law, which is a fair reading and probably ANSSI’s. But nobody buying on that basis was distinguishing an American injunction from a European one. They heard that their data could not be taken without French agreement. Wattebled asked his question about an American injunction; the interesting version now is the one he had no reason to ask. Can a qualified French provider guarantee that customer data will never be transmitted to any foreign authority without the explicit agreement of the French authorities?

Until August 18, more or less. After that, for the most commonly demanded category of data, no. And the reason has nothing to do with American law.

What the Guarantee Says

Start with what the explicit agreement of the French authorities consists of, because the French state has described it, on the record, in this case.

In December 2025, Deputy Bastien Lachaud put a written question to the economy ministry: what would the government do to stop a foreign authority seizing data hosted on French soil? The reply was published in the Journal Officiel on 3 March 2026.[13]

The government declined to comment on foreign proceedings, then explained the law it relies on. Established in 1968, the blocking statute has two limbs. The first forbids handing a foreign authority anything touching French security, sovereignty, public order, or essential economic interests. The second, added in 1980, is the one at issue here, and it does something else. It exists to make sure that requests for evidence “empruntent bien les canaux et traités applicables,” that they take the applicable channels and treaties. Which channel, the ministry adds, means the 2001 Budapest Convention on cybercrime.

That second limb does not forbid disclosure. It governs which door the request comes through, and Paris says so in its own words, in the Journal Officiel, about this case.

The enforcement apparatus matches the ambition. A desk at Bercy, the SISSE, issues opinions on whether the 1968 law applies to a particular demand. The opinion is addressed to the French company that asked, which is expected to forward it to the foreign authority so that the authority can learn the formal French position. If that proves insufficient, the desk can ask a liaison magistrate to raise awareness of the law abroad or open a diplomatic channel. The ministry notes that the desk is working to become better known. That is the protection. Advisory opinions, forwarded onward, backed by a liaison magistrate and a phone call.

An Ontario court weighed it all and did not detain long. One conviction has ever been reported under that second limb, in the forty-six years since it was enacted. Expert witnesses could point to no case anywhere in which a foreign court had respected the statute. Perkins-McVey borrowed the English High Court’s verdict on it: an empty vessel.[14] An Ontario court had already brushed past French blocking provisions in a civil case twenty-five years earlier.[15]

So the French and Canadian positions sit closer together than the diplomatic temperature suggests. France says the data is available through the treaty. Canada says the treaty is optional. Nobody in the case says the data is unreachable, and the company holding it has now confirmed in writing that it is not.

The Third Door

Both sides of this dispute point at the same door. OVH calls it mutual legal assistance; the French government, answering Lachaud, names the treaty behind the phrase, the Budapest Convention on cybercrime. It dates from 2001, runs state to state through central authorities, and every party to this case concedes it is slow. In 2022, the Council of Europe adopted a protocol that allows authorities in one country to directly request subscriber information from a provider in another country, which is the category the RCMP requested.[16]

France signed it, and three weeks later, Brussels told member states to ratify. Canada signed it in June. Neither has been ratified, and 52 signatures have produced 4 ratifications, 1 short of the 5 required to bring it into force.[17] Both governments agreed that the door should exist. Neither built it. One of them then walked through the wall and is now prosecuting the company that was standing in front of it.

OVH is not the first provider to stake everything on the treaty route. Microsoft made the same argument for emails stored on a Dublin server and won it at the Second Circuit in 2016. Twenty months later, Congress legislated the win away with the CLOUD Act; the full story is in “Two Sovereign Clouds.”[18] European sovereignty marketing was built on the wreckage of that case, and it was built against a single statute. Every “not subject to the CLOUD Act” claim answers the American door. Canada has now opened a second door through its courts. The European Union spent five years building a third, and that one opens on August 18. It opens on OVH, too.

On August 18, 2026, the European Union’s e-Evidence Regulation becomes applicable. It creates the European Production Order: an authority in one member state can compel a provider established in another to hand over electronic evidence directly, with no state-to-state procedure in between. The Commission’s own summary gives the aim as speeding up access “regardless of where the data is located,” and lists subscriber data and the IP addresses needed to identify a user among the categories covered.[19]

Ten days to comply. Eight hours in an emergency. Penalties of up to two percent of worldwide annual turnover for providers that do not.[20]

Now, the detail that decides the argument. Ask for the contents of messages, and a judge has to sign; the country where the provider sits is told, and it has ten days to object, or ninety-six hours if the case is urgent. Ask for subscriber records, or for the address that identifies whoever was behind an account, and neither applies. No judge required. Nobody told.[21] The notification shrinks further from there, disappearing even for message content when the offense and the suspect both sit in the requesting country, which describes most investigations.[22] Subscriber records also sit at the bottom of the instrument’s threshold: an order may issue for any criminal offense, where traffic and content require offenses carrying at least three years.[22]

Put the pieces together and imagine the file. A prosecutor in Dublin opens an investigation into a customer of a French host. After August 18, she can send a certificate to that host’s designated establishment, requiring the subscriber records within ten days for any criminal offense, without any judge required by the Regulation, and without anyone in Paris being told it happened. The SISSE desk cannot issue an opinion on a demand it is unaware of. The liaison magistrate has nobody to call.

Dublin is the deliberate choice. The argument does not need a member state with a rule-of-law problem, and reaching for one would let the reader file this under judicial standards rather than sovereignty. Ireland is the jurisdiction European data policy treats as the safe pair of hands, and the guarantee fails against Ireland just as it does against anyone else, because notification does not take reputation into account. It simply is not there.

That certificate is Wattebled’s question served under a different flag, and from August 18, no French provider can answer it any better than Carniaux did. No, I cannot guarantee it. The reason is a European regulation, not an American one.

And Then Where?

The Regulation governs how a member state gets the data and says nothing about what it may do with it afterward. Onward transfer to a third country falls under the general law enforcement data regime, which permits it on the basis of adequacy, safeguards, or a list of derogations. The European Union and the United States have had a law enforcement transfer agreement since 2016.[23] Whether the records are then transferred from the police file to an intelligence file is not a European question at all. National security is reserved for the member states by the founding treaties, and several of them have run multilateral signals intelligence arrangements with Washington for decades. So the records can be compelled by Dublin without Paris knowing, and travel onward under a framework in which Paris has no standing, because Paris was never told there was a file.

What Was Sold

Compare all that with what France told its own parliament it was defending. Transfers to a third state, the question ran, can go through a derogation procedure supervised by French authorities, and Canada’s refusal to seek prior French control ran against the principles of digital sovereignty.[24] Whatever one thinks of Ottawa, the RCMP had to litigate for two years and lay criminal charges to reach a place an Irish prosecutor will reach in ten days with a form.

The objection to all this is good and deserves to be stated in full. A European Production Order is not a Canadian one wearing a European flag. It runs between states bound by a common rights floor, carries refusal grounds and remedies, obliges the issuing authority to notify the person whose data was taken, and allows the provider to pull the enforcing state back in. A Canadian order carries none of that. Anyone who tells you the two are equivalent is selling something. And none of it has happened yet: no European Production Order has ever been issued, and how prosecutors use the instrument is a fact about the future.

But equivalence was never the claim. What was sold to European cloud buyers was reach, not safeguards. Data resident in France is beyond the reach of authorities outside France, as obtaining it requires the consent of French authorities. From August 18 onward, for the most commonly requested category of data, French consent is not part of the design. What survives is the claim that some requesting states are better than others, an argument about who belongs to which club. In the transatlantic context, that argument has already collapsed twice, under the names Safe Harbor and Privacy Shield.

The Channel Test

Everything above turns Wattebled’s question into something portable, and it replaces the question most buyers ask.

Data residency is the wrong question. It tells you where the disk is. It tells you nothing about who can compel the disk. Three questions do the work instead.

Who has to sign? Name the authority, not the country. “Hosted in France” is not an answer. “A French investigating magistrate, acting on a letter rogatory transmitted through the central authority, after a SISSE opinion on whether the 1968 law even applies,” is an answer. Say it out loud and count the links. Every one of them is a place where a foreign state can be told no, and every one of them is a place where a foreign state can be told yes.

How long does that take? Not the statutory deadline. The observed time. If the provider has published a figure, use theirs. OVH published its own, and it’s weeks.

Has that authority ever said no? This is the question that separates a wall from a queue, and it is the one nobody asks, because it is answered by enforcement history rather than by statutory text. France publishes no refusal statistics for assistance requests, and none surfaced in this case. That does not prove Paris has never refused. It proves you cannot find out, which, for a buyer, is the operative fact. What the record shows is what happens to those who rely on the wall: one conviction under the blocking statute since 1980, and no foreign court has ever recognized it.

Run the test against any sovereign offering, European or otherwise. If the third question has no documented refusal, the product is sold with a delay and a review step. Delay has value. Investigations that are delayed all the time, and a review step counts for something. It just isn’t the thing the marketing describes.

Does anything pass? For subscriber data after the 18th, nothing European does, and that is the useful finding. Residual exposure to a direct foreign order becomes roughly uniform across every provider with an establishment in the Union, qualified or not. The sovereignty premium still buys real things: a European supply chain, an operator outside American discovery, a stack you can audit, a government that answers to your parliament. What it no longer buys, for the most commonly demanded category of data, is the thing on the label. Price it accordingly.

What Would Break This

The whole argument turns on one thing, and it is checkable.

France has to refuse. If Canada files the request the way OVH says it should, and Paris declines it, or sits on it long enough that the investigation dies, then the French review step is a real gate, and I have this wrong. The guarantee would be a wall after all, and a slow one, which is what a wall is.

Two lesser tests. If the Ontario Superior Court quashes the production order on territorial grounds instead of procedural ones, the Canadian doctrine narrows and stops traveling; as of publication, no ruling on the judicial review has been reported.[25] And if any member state publicly refuses to execute a European Production Order on sovereignty grounds after 18 August, the intra-EU channel will have its own gate.

In the meantime, there is work to do that costs nothing. Stop asking vendors where the data lives, which every vendor can answer, and ask the three questions, which most cannot. Get the answers in writing, dated, and in the contract file. Then run the same three against the SecNumCloud qualifications, the Cloud de Confiance arrangements, and the SEAL tiers in the Commission’s framework. None of them scored on the third question, because none of them asked it.

Three more for the provider itself. Which legal entity, in which member state, is its designated establishment for European Production Orders, because that choice decides whose prosecutors reach you fastest? Where is its law enforcement transparency report, broken down by requesting jurisdiction and outcome, because that document is the only place question three can ever be answered. And what survives once the data has left its hands? There's no good answer, because nothing does. Watch how long it takes for the transparency report to be released.

Jessep could have refused Kaffee outright. He never meant to. He wanted the courtesy first because it was free, and because demanding it let him keep the form of authority while handing over the substance. That was the arrangement Roubaix and Bercy were selling, and buyers paid a premium for it in good faith.

From August 18, nobody has to ask, nicely or not. European data sovereignty was never a wall. It was a rule of manners, and manners are optional now.

Notes

[1] OVHcloud statement to The Register, added to its report on 26 January 2026: “OVHcloud’s number one concern and priority is to protect its customers’ data. This is why this data cannot be provided to the Canadian authorities.” The same statement describes the group as “a multi-local player that is not subject to extraterritorial laws.” See The Register’s report of 27 November 2025, to which the statement was added in an update dated 26 January 2026; the quoted wording now appears in the body of that continuously updated report. The statement was given to that publication and is not corroborated by an OVH-published document.

[2] OVH Groupe SA, “OVHcloud Confirms Intent to Vigorously Contest Charges Related to Canadian Production Order,” 31 July 2026. Direct quotation.

[3] Same release. Charges are for failure to comply with a production order under section 487.0198 of the Criminal Code of Canada and obstruction of justice under section 139(2); the underlying production order was issued on 19 April 2024 under section 487.014. Section 487.0198 creates a summary conviction offence for contravening an order made under sections 487.013 to 487.018; section 139(2) is the general obstruction offence and is indictable.

[4] Same release, quoting Octave Klaba, founder, chairman and chief executive officer. Klaba resumed the CEO role on 20 October 2025, when the board reunited the chairman and CEO functions, ending Benjamin Revcolevschi’s one-year tenure (OVHcloud corporate release, 21 October 2025).

[5] R. v. OVH Group SA and Hébergement OVH Inc., Ontario Court of Justice (Ottawa), Court File 24-000659, Perkins-McVey J., decision released 25 September 2025. Signed decision via David Fraser, McInnes Cooper. Julien Simon, “Ten Percent Sovereign,” The AI Realist, 22 April 2026, which covers the ruling, the virtual presence line of authority across four provinces, and the European Commission’s Cloud Sovereignty Framework in full.

[6] Sénat, commission d’enquête sur la commande publique, compte rendu of the hearing of 10 June 2025. Verbatim. Full analysis of the hearing, the statutory chain and the attribution of the question (Wattebled, per the official transcript, though some press reports credited commission president Simon Uzenat) in Julien Simon, “Two Sovereign Clouds, One Legal Wall,” The AI Realist, 26 February 2026. Carniaux has since left Microsoft France.

[7] Solange Viegas Dos Reis, chief legal officer, OVHcloud, interviewed in “Microsoft can’t guarantee data sovereignty – OVHcloud says ‘We told you so’,” The Register, 27 August 2025. Direct quotations.

[8] The Register, 27 November 2025, per note 1.

[9] OVH US, “Cloud Act – Clarifying Lawful Overseas Use of Data,” accessed August 2026. This page belongs to the group’s American entity, which is subject to American process; it is cited here for what the group publishes about its own compliance posture, not as a statement about the French entity. The page was quoted against OVH by AWS in July 2025, a conflation of entities this piece does not repeat. I quoted the same FAQ language in “The Sovereignty Mirage“ in December 2025, eight months before the charges.

[10] OVHcloud, “Personal data usage policy,” accessed August 2026, on requests from judicial, administrative or other authorities. Procedure at clause 4.2 of the Personal Information Protection Agreement applicable to Canadian clients, version dated 6 September 2023. Clause 4.3 addresses requests originating from an authority outside Canadian jurisdiction concerning a Canadian client.

[11] OVH statement to The Register, July 2025: “OVH Group abides by local laws in the countries it operates in. As such, OVH US may be subject to requests from American authorities within the framework of the Cloud Act as long as these demands are connected to customers of OVH US and are strictly compliant with applicable American law. The French OVH entity (or its European subsidiaries) is not subject to the Cloud Act, the Patriot Act or the FISA.”

[12] ANSSI, SecNumCloud requirements repository version 3.2 (March 2022), which added criteria protecting against non-European law: capital control by European entities, exclusive application of European law, and contractual immunity provisions. The qualification comprises more than 360 technical, organisational and legal requirements. ANSSI’s qualification decision for OVHcloud’s Bare Metal Pod was published on 24 March 2025; OVHcloud announced it on 31 March 2025, stating that the qualification “acts as another form of protection against the legal risks linked to non-European regulations.” Note that these are structural and contractual requirements rather than a bar on lawful compulsion, a distinction this piece turns on. On what the Commission’s SEAL ladder does and does not score, see “Ten Percent Sovereign“; on the architectural cost of the qualification, “More Sovereign, Different Stack: The Builder Tax.”

[13] Assemblée nationale, question écrite n° 11534, M. Bastien Lachaud, published in the Journal Officiel of 9 December 2025, p. 9993; answer from the ministry for artificial intelligence and digital affairs published in the Journal Officiel of 3 March 2026, p. 1907. All quotations in this section are from the answer. Loi n° 68-678 of 26 July 1968; Article 1 bis added by Loi n° 80-538 of 16 July 1980; Décret n° 2022-207 of 18 February 2022 establishing the SISSE opinion procedure. Penalties per the answer: six months’ imprisonment and a fine of €18,000, and for legal persons a fine of €90,000.

[14] Ruling at paragraphs 79 to 123, adopted at paragraph 115. “Empty vessel” from Butcher J in Tugushev v. Orlov, [2021] EWHC 1514 (Comm), handed down 28 May 2021, at paragraph 33, applied to Loi 68-678 by Cockerill J in Joshua & Ors v. Renault SA & Ors, [2024] EWHC 1424 (KB), 11 June 2024, at paragraphs 77 to 78. The test as stated there is whether the foreign criminal law relied on is “not merely a text, or an empty vessel, but is regularly enforced.” The single reported Article 1 bis conviction is the “Christopher X” case, Cour de cassation, chambre criminelle, 12 December 2007, pourvoi n° 07-83.228, discussed at paragraph 85.

[15] Wilson v. Servier Canada Inc., 2000 CanLII 22407 (ON SC), 50 O.R. (3d) 219 (Cumming J.), cited at ruling paragraph 95. A civil class action involving a French parent, not a criminal production order, and turning on Article 15 of the French Civil Code rather than Loi 68-678. Cited here for the Canadian judicial posture the OVH ruling drew on, not as precedent on the blocking statute.

[16] Council of Europe, Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence (CETS No. 224), adopted 17 November 2021, opened for signature 12 May 2022. Article 7 provides a legal basis for direct co-operation with service providers in another Party’s territory to obtain subscriber information, subject to reservations and declarations available to Parties.

[17] France signed on 27 January 2023, the thirty-second state to do so, alongside Germany: Council of Europe, “France and Germany become 32nd and 33rd states to sign the Second Additional Protocol,” 27 January 2023. Council Decision (EU) 2023/436 of 14 February 2023 authorised Member States to ratify the Protocol in the interest of the European Union (OJ L 63, 28.2.2023, pp. 48-53); signature had been authorised by Council Decision (EU) 2022/722 of 5 April 2022. Canada signed on 20 June 2023, the thirty-eighth state, per the Second Additional Protocol news archive; its justice department has consulted publicly on whether to ratify and on whether to reserve against Article 7, and no instrument of ratification has been deposited. Signature count as of the Council of Europe’s most recent published tally; ratifications: Serbia first, Japan second on 10 August 2023, the announcement of which confirms that five ratifications are required for entry into force, Hungary third on 5 February 2026, Costa Rica fourth on 15 April 2026. Entry into force falls on the first day of the month following three full months after the fifth ratification. Verified as of 15 April 2026.

[18] United States v. Microsoft Corp. The warrant was issued in 2013 for content stored in Microsoft’s Dublin facility; the Second Circuit held in 2016 that the Stored Communications Act did not reach it; the CLOUD Act was enacted in March 2018 and the Supreme Court dismissed the case as moot. The compelled disclosure provision is codified at 18 U.S.C. § 2713. The full trace of the statutory chain is in “Two Sovereign Clouds, One Legal Wall.” Other jurisdictions assert comparable reach; the count here is of the doors this case walks through.

[19] European Commission, summary of Regulation (EU) 2023/1543 on European Production and Preservation Orders for electronic evidence in criminal proceedings. Full text at OJ L 191, 28.7.2023, pp. 118–180. Application from 18 August 2026. The Regulation binds all member states except Denmark, which is not bound by reason of its opt-out in the area of freedom, security and justice.

[20] Same summary. Ten days for transmission of requested data, eight hours in emergencies, ten days for the enforcing authority to raise a refusal ground where notification applies, reduced to ninety-six hours in emergency cases, and pecuniary penalties of up to two percent of a provider’s total worldwide annual turnover.

[21] Same summary: “If the electronic evidence includes content data or traffic data, except for data requested for the sole purpose of identifying the user, a court or judge must issue or review the order, and the judicial authority must notify the competent authority of the Member State in which the designated establishment is located, or the legal representative resides.” How the Regulation interacts with Loi 68-678 is untested; no French court has ruled on whether a European Production Order satisfies the applicable-channels requirement of Article 1 bis, though a directly applicable EU regulation is the stronger reading.

[22] Thresholds per eucrim, “E-evidence Regulation and Directive Published“: subscriber and identification data for all criminal offences and for execution of custodial sentences of at least four months; traffic and content for offences carrying a maximum of at least three years, or listed offences committed by means of an information system. On notification, Jessica Shurson, “The balance of efficiency and fundamental rights in the EU e-Evidence Regulation,” New Journal of European Criminal Law, 2025, on Article 8(2) and the consequence that in most domestic cases the enforcing state receives no notice. See also Athina Sachoulidou, “Cross-border access to electronic evidence in criminal matters,” New Journal of European Criminal Law, 2024, and eucrim, “Critical Issues in the New EU Regulation on Electronic Evidence in Criminal Proceedings”, on the exclusion of subscriber data from the notification requirement.

[23] Regulation (EU) 2023/1543 contains no onward-transfer provision of its own; it refers to Chapter V of Directive (EU) 2016/680 only in the context of conflicting third-country obligations (Article 17(7)). Transfers of law enforcement data to third countries are governed by Articles 35 to 38 of that Directive, permitting transfer on an adequacy decision, appropriate safeguards, or derogations for specific situations. The EU-US Umbrella Agreement of 2016 provides the standing framework for law enforcement transfers to the United States. Processing for national security purposes falls outside Union competence under Article 4(2) of the Treaty on European Union and outside the Directive’s scope; arrangements between national intelligence services are governed by national law and by bilateral or multilateral agreements that are not published. This paragraph describes the legal architecture, not any known transfer of the data at issue in this case.

[24] Assemblée nationale, question écrite n° 11534. The description of the derogation procedure and of the Canadian position appears in the question as put by the deputy; the ministry’s answer sets out the SISSE opinion procedure and reaffirms the government’s opposition to any circumvention of applicable co-operation channels and treaties.

[25] OVH filed for judicial review to the Ontario Superior Court of Justice through Miller Thomson at the end of October 2025, per heise online, 26 November 2025, which also reports from the court filings that the data has been preserved and that the French Ministry of Justice offered accelerated processing by letter rogatory. No decision on the judicial review had been reported at the time of writing.

On June 30, AWS announced a billion-dollar investment in a new Forward Deployed Engineering organization.[1] The plan embeds engineers in customer companies in pods of five or six for roughly 45-day engagements, building agentic systems using the customer’s own data and leaving the customer self-sufficient when the pod withdraws.[2] AWS called the pods “frontier teams” and noted that many of the engineers had built their own AI services.

The same day, AWS published a service availability page announcing the retirement of roughly 20 services and features.[3] Amazon Kendra, Amazon Q Business, and Amazon Bedrock Agents will enter maintenance and be closed to new customers from 30 July.[4][5][6] Ten SageMaker AI features went with them.

One announcement spends a billion dollars putting AWS engineers inside customer businesses. The other withdraws the products that those customers were meant to use. Three weeks later, Amazon confirmed it was closing its San Francisco AGI Lab and cutting roles across its artificial general intelligence organization.[7][8]

Read separately, these are a product cull, a spending initiative, and a research retreat. Read together, on the calendar they occupy, they are one decision about which layer of the artificial intelligence business Amazon intends to own.

Three vectors and one direction

Amazon is spending at the bottom of the stack and at the top, and withdrawing from everything in between.

Downward, into the fabric. Andy Jassy told investors in February that Amazon expected roughly $200bn of capital expenditure in 2026, predominantly in AWS, pointing to what the results release called “seminal opportunities” in AI, chips, robotics, and satellites.[9] Project Rainier went live with nearly half a million Trainium2 chips across multiple United States sites and a stated path beyond a million.[10] Trainium3 sits behind it.[11] This is the only layer Amazon is attempting to own outright, and the only one where it is building rather than buying the alternative.

Outward, for the intelligence. Anthropic supplies the frontier under a commitment of more than $100bn over 10 years and up to 5 gigawatts of capacity, powered by Amazon’s own silicon.[12] The equity position produced $16.8bn in pre-tax gains in the first quarter of 2026, while the AWS segment grew 28% in the same quarter and carries more than $15bn in annualized AI services revenue.[13] That gain is a non-cash mark on a private company’s valuation, booked through non-operating income, and it reverses if Anthropic’s next round prices flat or down. Bank of America estimates that Anthropic-related workloads alone could contribute more than $1.5bn in sequential AWS revenue growth in the second quarter.[14] That is an analyst estimate, not a disclosure, and if it is near right, it describes customer concentration as much as momentum. One fact is observable: Claude’s per-token rates on Bedrock match Anthropic’s own API to the cent.[15] AWS doesn’t mark Claude up. Its margin is whatever sits between retail and the undisclosed remittance, plus everything a production workload consumes besides the model, and that second meter is the one no model provider can take away.

The arithmetic explains the rest of the strategy. A frontier laboratory is a capital sink competing for the same engineers, accelerators, and megawatts as a business already growing at 28%, with a winner-take-most payoff. Instead, equity plus a supply contract does three jobs at once: it secures the output, it locks the supplier’s training and serving onto Amazon’s silicon for a decade, and it books the upside as investment gains, not research cost. The capacity remains full, and the income statement shows a research organization rather than a frontier-scale training program, a difference measured in tens of billions.

Forward, to the customer. The $1 billion announced on 30 June goes to engineers who sit inside the customer’s building. Francessca Vasquez, the AWS vice president who runs the organization, framed the pitch around speed, and the named early customers include the Allen Institute, Cox Automotive, the NBA, the NFL, Ricoh, and Southwest Airlines.[1][2] Amazon is late to this: Palantir has run forward-deployed engineering for over a decade, and Salesforce, Google Cloud, and Anthropic all offer similar versions.[16]

Look at what that vector costs. Embedded engineering carries service margins, and a company that spent twenty years teaching investors to value self-service software economics is putting a billion dollars into headcount that does not scale like software. Firms accept that when the customer won’t reach production without it, and the consumption on the other side outweighs the margin surrendered. The forty-five-day cycle and the insistence on leaving customers self-sufficient are the tell: these pods are a customer acquisition cost, not a consulting line.

AWS frames the initiative as customer obsession, and on its own terms, it is. It is also, on Amazon’s terms, consumption: the pods deploy onto Bedrock and the surrounding services, and the annuity AWS is buying is the meter running after the engineers leave. And this survives the test that killed the software. An embedded engineer holds the one input that tooling shipping with the model can’t replicate: the customer’s own context. That’s why AWS is paying people margins for a function whose software equivalent it just retired.

What sits between the fabric and the customer is the part Amazon is vacating: its own frontier models, its own retrieval, agent, and assistant products, and the tooling a customer would use to build models themselves. Amazon has concluded that owning intelligence is a worse business than metering it, and it’s paying to occupy both ends of the pipe instead.

The organization chart is the strategy document

In December 2025, Amazon replaced Rohit Prasad at the head of the AGI organization with Peter DeSantis, a longtime cloud infrastructure executive.[17] CNBC describes the resulting unit plainly: it builds AI models and includes groups working on silicon development and quantum computing.[7]

That’s not a research organization with infrastructure attached; it’s an infrastructure organization with research attached, and the reporting line tells you how the company values each. A model program that reports to the executive who owns chips, data centers, and quantum is a program understood as a load on capacity rather than as a product line.

The AGI Lab itself was founded in December 2024, built around several dozen employees Amazon acquired from Adept, including its co-founder David Luan, and grew to roughly eighty people at its peak. More than a dozen of the Adept hires have since left, Luan among them in February.[8] The Information, which reported the closure first, describes what the lab was for: building software to make AI agents more useful.[18] Amazon confirmed the site closure and said frontier model research continues under Pieter Abbeel, the Berkeley professor who joined in 2024 when Amazon licensed the technology and hired the team from his robotics startup, Covariant.

Secondary reporting indicates the cuts fell on model customization and post-training roles, a claim carried by trade press and not confirmed by Amazon.[14] If it holds, it points somewhere specific: post-training is the work that turns a base model into a competitive product, and a company that keeps a research lab while cutting that function has made a choice about which of the two it is doing. Amazon has not disclosed which teams were affected, so hold it loosely.

The company’s own account is consistent with this, if read literally. A spokesperson said Amazon was sharpening its focus on the initiatives that matter most for customers so it could move faster on what counts.[7] Customers sit at the top of the stack. Frontier research is not where AWS meets them, and a billion dollars of embedded engineers is.

What a landlord keeps

The defeat reading has been made in print: The Next Web called the lab closure the clearest sign yet that Amazon had stepped back from a frontier race it never really led.[19] On that reading, the models never landed, the products never took, and a company retiring Kendra and Q Business is making a virtue of a loss. Half of that is simply true, and the tooling shows it best.

Take SageMaker Clarify, a bias-detection tool built for tabular models. AWS rebuilt it for the new architecture, enabling foundation model evaluation to move from preview in November 2023 to general availability in April 2024.[20][21] Twenty-six months later, it went to maintenance.[22] Ground Truth followed the same arc, and Ground Truth Plus, converted earliest of all in May 2023, is the only item on the June 30 page to reach the full end of support.[23][24][3] Earliest conversion, hardest death. Whether AWS built the wrong thing or built the right thing too late is a fair debate. The outcome is not.

For now, the surviving services are close to the hardware. SageMaker HyperPod, the one part of the platform still shipping features monthly, does cluster resilience: gang scheduling, continuous provisioning, job recovery, and capacity reservation on Trainium.[25][26][27][28][29] The scheduling logic exists in open source, and a Kubernetes engineer will say so. What does not exist outside the operator is the input: which node sits on which network spine, which accelerator is degrading, which instance is about to be retired, and whether the capacity exists to be reserved at all. The position is the privileged telemetry, not the feature.

Call it the fabric test. A function that runs against a model goes to whoever ships alongside the model. A function that requires privileged access to physical capacity stays with whoever owns the capacity. It predicts the consequential AI retirements on the June 30 page: Kendra was a managed retrieval system, Bedrock Agents was an orchestration system, and Q Business was an application over a corpus, and none of the three needed hardware.

The landlord position has a second advantage. It’s indifferent to which tenant wins: capacity bills identically whether the customer runs Claude, Nova, Qwen, or something that does not exist yet, while every layer AWS dropped required backing a horse.

This also explains why Nova continues to exist, which is otherwise the loose thread in the argument. A landlord that buys its headline product from a single supplier needs a cap on what that supplier can charge. A competent house brand at the commodity tier does that job without winning anything: it sets a price floor, absorbs workloads where frontier capability is wasted, and keeps a credible team on the payroll.

And it explains why AWS now hosts its competitors' tooling rather than fighting it. Managed MLflow occupies the ground Clarify and Experiments were built to hold, and the product page that once sold Experiments now sells MLflow.[30][31][32] Experiments itself was never formally retired. The APIs still answer, and no deprecation notice exists anywhere; AWS confined it to the legacy Studio experience and pointed the documentation at its replacement.[33] A product superseded in place leaves no notice to audit. A week after freezing Model Monitor, the AWS machine learning blog published monitoring guidance built on open-source Evidently, with the results organized in MLflow.[34] Hosting the winner captures the workload without financing the losing race.

The only one of the four

Set Amazon against its peers, and the position stops looking like an industry trend and starts looking like a choice. This is what the four say in public, not what they plan in private.

Google builds the whole stack: its own accelerators, models, and surfaces, and it carries the research cost because the models feed products it owns end to end. Microsoft resells third-party models on Azure, as AWS does, but it also sells an assistant, and the quality of an assistant is a claim about the model inside it. Meta is the cautionary case: it spent enormously on infrastructure and could not buy the research culture to make it pay, which is the failure version of stepping back and the version the market reaches for by default.

Amazon is none of these, and the distinction is less the direction than the decisiveness. Microsoft may yet drift the same way; its Azure catalog is already multi-model. Only Amazon has done it explicitly and completely, on one page, in one quarter. It rebuilt its intelligence tooling for the new architecture, shipped it, then withdrew, while raising capital expenditure toward $200bn, contracting a frontier supplier onto its own silicon for a decade, and committing a billion dollars to engineers who deploy that supplier’s models inside customer businesses.

These are the actions of a company that priced the layer and declined it. The distinction carries a forecast. A company that lost a layer re-enters it when conditions improve, and its retreat is temporary. A company that priced a layer and declined it doesn’t come back, and here the barrier to return is one Amazon built itself: re-entering the frontier would now mean competing against its own anchor tenant, on its own silicon, against a product its own billion-dollar deployment force installs. The supply contract works as more than a substitute for the laboratory. It locks the door behind it. Everything since December 2025 points the same way: a reporting line that subordinates models to infrastructure, a contract measured in gigawatts and decades, and a billion dollars aimed at deployment rather than research.

Redundancy, not retreat

Which makes the AGI Lab closure something other than a failure signal.

A laboratory does two things. It secures a capability you cannot otherwise obtain, and it holds an option on architectures nobody has commercialized yet. Amazon has bought the first through a 10-year supply contract using chips it designed. It has not closed the second, at least for now: Abbeel remains, research continues, and the AGI organization is still hiring.

What Amazon canceled sits between the two, and that is why the reported cuts to model customization and post-training matter more than the closure of a site. Post-training is how a base model becomes a frontier product. Research is how you hold the option and judge what your supplier is selling. And the reportedly cut roles are the same functions Nova Forge now sells to customers as a service: continued pre-training, fine-tuning, and preference optimization on their own data.[34] The cuts and the product are one move. Amazon kept the option, stopped performing the frontier work for itself, and externalized it to paying customers.

The exposures fit on one list. First, Amazon has contracted for output, not acquired a capability: Anthropic sets its own roadmap, prices its own models, serves Amazon’s competitors elsewhere, and runs a deliberately multi-cloud posture. The dependence runs both ways: since Amazon holds the equity, the training capacity, and the largest distribution channel, the mutual dependence remains stable until one side’s alternatives improve faster than the other’s. Second, the arrangement is subject to competition law. The UK Competition and Markets Authority examined the partnership in 2024 and closed its inquiry on jurisdiction, not merits, while the Federal Trade Commission ran a parallel market study.[35][36] The facts have since outgrown that clearance: a $4bn investment one way now sits beside a $100bn procurement the other, binding the two companies more tightly than anything the 2024 inquiry reviewed. Whether an authority would reach the same conclusion today is unknowable.

Amazon has evidently judged the whole list cheaper than financing a laboratory it was unlikely to win with. That judgment is defensible on today’s numbers.

What would break this

The strongest counterargument is that Amazon is still building models, and it is. Nova 2 shipped at re:Invent in December 2025 in Lite, Pro, Sonic, and Omni variants, alongside Nova Forge for organizations building custom frontier models.[37] An AWS executive would argue, with some justification, that a portfolio cull inside a funded model program is ordinary discipline rather than a change of direction.

Except that the executive who runs the program has already conceded the premise. DeSantis told CNBC in June that it is “a fair narrative” that Amazon’s models “haven’t been at the very frontier” for the largest workloads, while hoping Amazon would be in the leading-model conversation in the coming year.[38] In the same interview, he put Nova 2 at roughly 50,000 customers since December, said Amazon should be considered on par with Nvidia in its ability to design and produce chips, and confirmed there's no timeline for Jassy’s April suggestion that Amazon might sell Trainium racks to third parties. Fifty thousand customers is breadth at the commodity tier, which is what a price floor accumulates. Comparing yourself to Nvidia is what a silicon company does. And floating rack sales are a landlord wondering whether to sell the fittings too. The counterargument’s own spokesman is describing the thesis.

The thesis breaks if:

• Nova receives a genuine frontier push, and a Nova model competes at the top of the Bedrock catalog on customer usage rather than vendor benchmarks.

• Nova Forge lands anchor customers at scale.

• The AGI organization is rebuilt outside the infrastructure reporting line, because that reporting line is the clearest signal in the whole sequence.

• AWS reclaims one of the displaced tooling categories with a proprietary product that wins against the open-source incumbent.

• Anthropic’s non-AWS capacity share grows materially, because that would suggest the option value in this arrangement always sat with the supplier, and that Amazon was priced into the landlord role rather than choosing it.

The second-quarter results on 30 July are the near-term test: watch capital expenditure, AWS margin, and whether Nova appears in the earnings narrative at all.

What this means for the people buying it

For a buyer, this is one question. Before adopting any vendor AI feature, ask whether the function could be built by someone who does not own a data center. If it could, price in migration, and keep the integration thin. If it cannot, treat the dependency as infrastructure and negotiate exit assumptions over years. And do not audit vendor risk off deprecation notices alone: Experiments show a product can be retired by a documentation edit without appearing on any list.

Five years ago, I argued that software would eat machine learning: teams would assemble models instead of building them, write as little code as possible, and let tooling do the rest.[39] The June 30 page is that prediction arriving.

What survives is what software cannot eat: the chips, the buildings, the power, and the people who install the result. Amazon saw that outcome and reorganized around it. Retire what software already ate. Spend a billion dollars deploying what it cannot.

The durable position was never the model. Nor was it the middle of the stack, where services competed with superior open source on launch day and existed mostly to thicken a product manager’s promotion document.

Back to cloud 101: the durable position is always the meter.

Notes

[1] AWS invests $1 billion to embed AI forward deployed engineers with customers, About Amazon, 30 June 2026. Describes the agentic-first model, the compression of deployment timelines, the customer self-sufficiency goal, and the named early customers.

[2] AWS puts $1 billion into new AI unit to embed engineers with customers, CNBC, 30 June 2026. Source for pod size, engagement length and the Vasquez interview.

[3] AWS Service Availability Updates, AWS What’s New, 30 June 2026. The ten SageMaker AI features are A2I, Clarify, Debugger, GeoSpatial, Ground Truth, Mechanical Turk, Model Monitor, Profiler, Role Manager and Studio Lab. Ground Truth Plus is listed separately under end of support. The same page also retires directory, mainframe and console-management services unrelated to AI; the body’s “consequential” excludes those and legacy items such as Mechanical Turk and Studio Lab, which reached maintenance through obsolescence rather than displacement.

[4] Amazon Kendra availability change, AWS documentation.

[5] Amazon Q Business availability change, AWS documentation.

[6] Amazon Bedrock Agents Classic maintenance mode, AWS documentation. Bedrock models, Knowledge Bases and Guardrails are unaffected; migration is directed to AgentCore.

[7] Amazon lays off some employees in its AGI unit, CNBC, 22 July 2026. Source for the composition of the AGI organisation, the DeSantis appointment, and the company statement.

[8] Amazon confirms it’s closing key AI site in San Francisco but says work on its top models continues, GeekWire, 24 July 2026. Company spokesperson confirmation of the site closure, the lab’s founding and headcount, the Adept departures, and Abbeel’s role.

[9] Amazon.com Announces Fourth Quarter Results, Amazon Investor Relations, 5 February 2026. The release carries Jassy’s guidance of about $200bn in 2026 capital expenditure and the “seminal opportunities” framing; his statement that the spend would be predominantly invested in AWS was made to analysts on the accompanying call, per CNBC’s same-day report.

[10] AWS’s Project Rainier: the world’s most powerful computer, About Amazon, 29 October 2025.

[11] Amazon EC2 Trn3 UltraServers, AWS product page. Vendor-published performance claims; not independently verified.

[12] Anthropic and Amazon expand collaboration for up to 5 gigawatts of new compute, Anthropic, 20 April 2026; Amazon’s counterpart release is Amazon announces $5B Anthropic investment, up to $20B more, About Amazon, 20 April 2026. Source for the $100bn ten-year commitment, the up-to-5GW capacity, and the Trainium2-through-Trainium4 scope.

[13] Amazon.com Announces First Quarter Results, Amazon Investor Relations, 29 April 2026. Source for the $16.8bn of pre-tax gains booked in non-operating income from the Anthropic investments and for AWS segment sales up 28% to $37.6bn. The annualised AI services revenue figure is from management commentary on the accompanying earnings call.

[14] Amazon Cuts AGI Jobs While Pouring $200 Billion Into AI Infrastructure, TechTimes, 23 July 2026. Secondary source for the Bank of America estimate and for the reported composition of the cuts; both should be treated as reported rather than confirmed, and the Bank of America figure is an analyst estimate.

[15] Representative Amazon Bedrock on-demand rates, aws.amazon.com/bedrock/pricing, retrieved July 2026; parity with Anthropic’s direct API per Anthropic platform pricing documentation. Claude Sonnet at $3/$15 per million input/output tokens on both, with matching promotional windows. Rates as of July 2026 and subject to change.

[16] Amazon’s AWS commits $1 billion toward new unit for embedded AI engineers, The Manila Times, 2 July 2026, on prior forward-deployed engineering organisations at Palantir, Salesforce, Google Cloud and Anthropic.

[17] Reported December 2025; see note 7 for the CNBC account of the appointment and the scope of the resulting organisation.

[18] Amazon Shuts AI Agent Research Lab In AGI Layoffs, The Information, July 2026. Paywalled; the description of the lab’s remit is quoted via GeekWire at note 8.

[19] Amazon shuts its AGI Lab in fresh AI layoffs, The Next Web, July 2026.

[20] Amazon SageMaker Clarify now supports foundation model (FM) evaluations in preview, AWS What’s New, 29 November 2023.

[21] Amazon SageMaker Clarify now supports foundation model evaluations, AWS What’s New, 25 April 2024. General availability excluded GovCloud, China and several commercial regions listed in the announcement.

[22] Amazon SageMaker Clarify availability change, AWS documentation.

[23] Power Your LLM Training and Evaluation with the New SageMaker AI Generative AI Tools, AWS Artificial Intelligence blog.

[24] Amazon SageMaker Ground Truth Plus now supports human feedback and fine-tuning data for Generative AI, AWS What’s New, 30 May 2023.

[25] SageMaker HyperPod now supports gang scheduling for distributed training workloads, AWS What’s New, 8 April 2026.

[26] Amazon SageMaker HyperPod now supports continuous provisioning for Slurm-orchestrated clusters, AWS What’s New, 25 March 2026.

[27] Accelerate large-scale AI training with Amazon SageMaker HyperPod training operator, AWS Artificial Intelligence blog. The HyperPod elastic agent is described as an extension of PyTorch’s ElasticAgent, and fault detection draws on node health checks and AWS retirement notices.

[28] Amazon SageMaker HyperPod release notes, AWS documentation, recording Trn2 and Trn2n support for Slurm and Amazon EKS clusters.

[29] Reserve Flexible Training Plans for ML workloads, AWS documentation.

[30] Amazon SageMaker now offers a fully managed MLflow capability, AWS What’s New, 19 June 2024.

[31] Fully managed MLflow 3.0 now available on Amazon SageMaker AI, AWS What’s New, July 2025.

[32] Accelerate generative AI development with Amazon SageMaker AI and MLflow, AWS product page, retrieved July 2026.

[33] Amazon SageMaker Experiments in Studio Classic, AWS documentation.

[34] The overlap between the reportedly cut post-training and customisation roles and the capabilities Nova Forge sells (continued pre-training, supervised fine-tuning, direct preference optimisation on customer data) is drawn from the TechTimes report at note 14 and from Amazon’s Nova Forge description at note 37; the role composition of the cuts remains unconfirmed by Amazon.

[35] Amazon / Anthropic partnership merger inquiry, Competition and Markets Authority case page. Merger inquiry launched 8 August 2024; phase 1 decision 27 September 2024 that the partnership does not qualify for investigation under the merger provisions of the Enterprise Act 2002.

[36] FTC Launches Inquiry into Generative AI Investments and Partnerships, Federal Trade Commission, 25 January 2024. Section 6(b) orders issued to the companies involved in the Microsoft-OpenAI, Amazon-Anthropic and Google-Anthropic investments.

[37] AWS re:Invent 2025: Amazon announces Nova 2, Trainium3, frontier agents, About Amazon, December 2025. Covers the Nova 2 family (Lite, Pro, Sonic, Omni), Nova Forge’s open-training checkpoint model, and Nova Act’s move to general availability; announcements made 2 December 2025.

[38] Amazon has lagged OpenAI and Anthropic, but AI chief sees path to catch up in ‘coming year’, CNBC, 17 June 2026. Direct interview with Peter DeSantis; source for the frontier concession, the Nova 2 customer figure, the Nvidia comparison, and the status of potential Trainium rack sales first suggested by Andy Jassy in April.

[39] The Age of Machine Learning As Code Has Arrived, Hugging Face blog, 20 October 2021, which I co-authored while Chief Evangelist at Hugging Face.

Following the release of Kimi K3, Axios reported that the administration is reviving a push to restrict Chinese models on cybersecurity grounds, with Entity List designations under discussion and House committees probing the American companies that run them.[1] The explainer wave arrived within the news cycle: what open weights are, why enterprises quietly run them, which Chinese models to worry about, and the same comparison table in a hundred fonts. Much of it reads as if the subject were discovered at roughly the moment it hit 46.4% of routed traffic on OpenRouter.[2] Benchmarks, market share, comparison: the wave runs on one axis, and it is the wrong one.

Being late is forgivable; I would rather people learn about open models now than never. The problem is that it is not just late; it is describing an object from an era that ended eighteen months ago. So let me set the record straight, from the beginning, because I was there for it.

In March 2021, I published a post on the AWS machine learning blog announcing a partnership between Amazon and a startup most enterprise readers had never heard of. Hugging Face, founded in 2016 and with offices in New York and Paris, made it easy to add Transformer models to your applications. The catalog held about 7,000 pre-trained models in 164 languages. The examples I reached for were BERT (340 million parameters) and GPT (175 billion).[3]

Read that post today, and the striking thing is what it does not contain. There is no comparison. No table weighing an open model against a proprietary API, no paragraph on cost per token, nothing on privacy or lock-in. There was nothing to compare against. The problem the partnership existed to solve was more basic: most organizations could not deploy these models at all. Getting the file onto managed infrastructure with a few lines of code was the entire value proposition.

Three eras

Open models have changed what they are three times, and each era is defined by the question practitioners were asking.

In the distribution era, roughly 2021 to 2022, the question was: how do I run this at all? The achievement was deployment. The infrastructure that mattered was hubs, containers, and managed endpoints, and the partnership I announced was that infrastructure being built.

ChatGPT ended the first era in a weekend. Deployment stopped being the hard part because the incumbent had arrived, and in the comparison era, 2023 to 2024, the question became: Why would I use this instead of the API? Open models had a proprietary incumbent to displace, so every argument became a table: transparency versus opacity, cost versus convenience, control versus capability. I spent two years making that argument, and I will show you my own exhibit below.

The third era had been building quietly since 2023, in preference-tuning papers and merge experiments, while the comparison arguments still held the stage. It blew into public view in January 2025, when DeepSeek shipped R1, trained with a reinforcement learning algorithm the lab published, alongside a family of smaller models distilled from it. In the post-training era, the question changed again, and most people have not noticed, because the era’s arrival, like the first era’s ending, was a visibility event: the work predated the moment. The question is no longer which model to pick. It is what to make from the models you hold. Open models stopped being products that compete with closed ones and became checkpoints: fine-tuned, aligned, distilled, merged, transplanted, and quantized, both inside the labs that release them and on hardware that fits on a desk. Training no longer ends where the download begins.

For the record: I was at AWS during distribution, at Hugging Face during comparison, and at Arcee AI, the company behind the MergeKit toolkit, during post-training. My career is how I noticed the eras. It is not the evidence, which is other people’s published work throughout.

This piece is for teams with the engineering capacity to act on that. If your organization has no machine learning function, the hosted service is the right purchase, and nothing below changes it. But if you are arriving at open models now, through the current wave of explainers and best-of lists, you are being taught the second era’s answer to the third era’s question. You should know what this era looks like, from someone who watched all three arrive.

The comparison era, from inside

In September 2023, as Chief Evangelist at Hugging Face, I published a comparison of SafeCoder, our enterprise code assistant, against the closed-source alternatives.[4] It made five arguments. The model was state-of-the-art. It was transparent: you could read the paper, inspect the training dataset, and check whether your code was in it, since the dataset shipped with an opt-out tool for repository owners.[5] You could fine-tune it yourself in your code. You could run it anywhere, including in an air-gapped environment. And it phoned nothing home.

I stand by every line, and the post has aged into a period piece anyway. Not because the claims failed, but because the form dates it. Five properties, each argued against a closed-source counterpart. The piece is a table wearing prose, and the table was the era. Open models were the challenger, the incumbent set the terms, and everything we wrote had to justify the open choice against the closed default.

The comparison era did real work. It established that open models were viable for serious deployment, it forced pricing discipline on the incumbents, and its arguments about privacy and control were correct and remain correct. What it could not do was describe properties with no counterpart on the other side of the table. A comparison can only hold what both columns share. The operations that define this era were invisible to the format: not suppressed, just unrepresentable.

Which is why, if you learned open models from the comparison literature, the current era will sound like it happened somewhere else. It did not. It happened inside the models you are being recommended.

The post-training era: where the models come from

Here is what the era’s best-of lists do not say about the models on them: nearly everything that makes them good happened after pre-training. Supervised fine-tuning, preference training, reinforcement learning, distillation from a larger teacher, and increasingly merging. The base run buys the raw capability; the post-training stack turns it into the model you download.

The stack starts earlier than most descriptions admit. Continued pre-training, sometimes called mid-training, takes a released checkpoint and keeps feeding it raw text: Code Llama is Llama 2 with its pre-training continued on a code-heavy corpus, and SEA-LION’s pipeline begins by continuing pre-training on Southeast Asian text before any of the stages below.[6] A checkpoint is not a finished artefact with a tuning knob. It is a training run; somebody paused, and anyone holding the file can press resume.

The alignment layer opened first, and the progression is worth spelling out because it is the era in miniature. In 2022, preference training meant RLHF as the closed labs ran it: proximal policy optimization, a learned reward model, a critic network, and infrastructure that almost nobody else could operate. In 2023, direct preference optimization collapsed all of that into a single loss function that runs wherever fine-tuning runs, and Zephyr showed a 7-billion-parameter open model beating much larger chat models on supervised fine-tuning plus DPO alone.[7] In late 2024, AI2’s Tülu 3 published a complete open post-training recipe, including data, code, and weights, and introduced reinforcement learning from verifiable rewards: checkers instead of learned reward models.[8]

Then, DeepSeek’s GRPO (group relative policy optimization), the algorithm behind R1, deleted the critic network that made the RL loop expensive, and within weeks of R1’s release, the open community was replicating the pipeline publicly.[9] Each step removed a piece of infrastructure only a frontier lab could afford, until the whole alignment stack ran in open frameworks, with the small-model end reaching consumer GPUs.[10]

Merging is the newest layer of that stack, and it is already inside the models the guides recommend. Meta’s Llama 3.1 report describes averaging models at every post-training stage across reward modeling, supervised fine-tuning, and DPO, and using the flagship to improve its smaller siblings.[11] Cohere’s Command: A technical report calls expert merging a core feature of its training pipeline: domain experts trained separately, then folded into a single set of parameters.[12]

Much of that is averaging variants of a single pipeline. Merging separately trained models into a single set of weights was adopted from papers and released systems in 2025.[13] In March, a team from Qiyuan Tech and Peking University distilled DeepSeek-R1 into three domain experts for mathematics, coding, and science, then merged them with Arcee Fusion, from Arcee AI's MergeKit toolkit, landing within two points of the 671-billion-parameter teacher on AIME mathematics. The merge took 4 GPU-hours, compared with 740 for retraining on mixed data, which the authors call a free lunch, published from the far side of the boundary the ban debate is trying to draw. SEA-LION, AI Singapore's national language family, runs multiple DELLA Linear merge stages in the pipeline behind its shipped models.[16] And the field is not fringe: merging has a survey in ACM Computing Surveys, and the toolkit's paper sits in the EMNLP industry track.[17][18]

So the technical reports describe merging as routine, the lists recommend the models that those reports document, and the word appears in neither. A newcomer can read guide after guide and never learn that the operation exists, let alone that it built the thing they just downloaded.

The post-training era: on your desk

The same operations run downstream, and the hardware to run them arrived recently enough that most of the literature predates it.

One calibration first, because the era has a gradient, and you should know where you stand on it. Quantization and distillation are the mass operations: anyone running a model through Ollama is running quantized weights, today, probably without thinking of it as a weight-space operation at all. Fine-tuning is common. Merging and surgery are where the frontier is, not where the median is. The era is defined not by everyone doing everything, but by the possibility of it all with a single object.

The practitioner’s toolkit is six operations, and the everyday ones come first.

1. Fine-tune a model on your own data: low-rank adaptation runs on a single consumer GPU, and the output is an adapter file measured in megabytes that you keep, copy, and load anywhere.

2. Distil a large open model into a small one whose weights you own; an open teacher is a teacher you are allowed to keep, where a closed vendor’s terms typically forbid training a competitor on its outputs. NVIDIA went further and released the Nemotron-4 340B family under a licence that explicitly permits generating synthetic training data, because data generation is now a post-training stage in its own right.[19]

3. Align it: DPO runs wherever fine-tuning runs, and GRPO-style reinforcement learning, critic deleted and rewards drawn from verifiable checkers, now runs in open frameworks on consumer GPUs; I examined the compute shape of that workload in The Verification Tax.

4. Merge models into a new one. That operation needs no training run, no rented cluster, and no data; for small models, it runs on a CPU or eight gigabytes of video memory, and lazy tensor loading keeps even large merges on modest hardware.[20]

5. Transplant components between models: MergeKit ships a tool that moves one model’s tokenizer into another, and in its published cross-family test, the underlying technique retained roughly 96% of language-understanding performance with no training at all.[21]

6. Quantize: reduce numerical precision to trade quality for footprint at a point you choose.

Quantization is the bridge between owning weights and using them, and its arithmetic is blunt. Qwen3.5-397B, a 397-billion-parameter mixture-of-experts model from one of the Chinese families reportedly under discussion in Washington, is roughly 807 gigabytes on disk at full precision: a rack, full stop. At dynamic four-bit, it is about 214 gigabytes and loads on a single Mac Studio. At three bits, it fits a 192-gigabyte machine, and the quantizer’s own guidance now recommends two-bit dynamic variants as a legitimate operating point rather than a last resort.[22] The same weights span a data center and a desk, and where on that curve you sit is your decision, not a vendor’s. The community quant tables even publish the far end with honest labels: the one-bit files are marked “for the desperate”.[23] That is what a continuous curve looks like: it goes all the way down, and it tells you the quality price at every stop. And the desk changed too.

Consumer graphics cards stop at 24 or 32 gigabytes of memory, and a model that does not fit does not run.[24] Unified memory architectures remove that ceiling by pooling system and graphics memory. Apple established the pattern. AMD’s Strix Halo platform puts 128 gigabytes of unified memory in mini-PCs selling for roughly $2,000, with AMD’s own developer machine at $3,999, and Nvidia sells its own 128-gigabyte unified-memory developer box, the DGX Spark, at the same price. The company unveiled the platform at CES in January 2026, claiming it could run models with up to 200 billion parameters locally.[25] The trade is bandwidth: a discrete card moves memory several times faster, which is what generation speed depends on, so small models run faster on the card while large ones only run on the pool. Mixture-of-experts models bend the curve further by activating only a fraction of their parameters per token, letting a far sparser model outrun a dense one on the same machine.[26]

And weight surgery is quietly becoming a production dependency, not an enthusiast’s hobby. Speculative decoding, the serving optimization in which a small draft model runs ahead of a large one, is recommended in current deployment guides and implemented in vLLM, which, by default, requires that the draft and the target share a vocabulary.[27] For a model with its own vocabulary, no compatible draft exists, and building one traditionally means returning to the training stage.[28] The cheap route is the transplant operation above; the heavier one is training a small drafting head, EAGLE-style, directly onto the frozen checkpoint, which is likewise an operation on weights you must hold.[29] Microsoft Foundry’s import screen now has a dedicated slot for draft models.[30] The platform assumes you arrive holding one. None of the guides I read mentions that the slot exists or that weight surgery is how it's filled.

Where the checkpoint beats the frontier

The frontier labs post-train for everyone on average. A checkpoint post-trained for one domain beats them on that domain, and the clearest demonstrations now come from companies you know.

Cursor, one of the companies the House is reportedly asking about, built Composer, the model behind its agent, by training a mixture-of-experts model via reinforcement learning across hundreds of thousands of sandboxed coding environments. According to the company’s benchmarks, it achieves frontier coding results at 4x the generation speed of comparably intelligent models.[32] The base is widely reported to be an open checkpoint, a question Cursor’s researchers pointedly decline to answer, which tells you what a checkpoint’s provenance is now worth.[33]

Salesforce fine-tuned its xLAM family on synthesized tool-use data and took first place on the Berkeley Function-Calling Leaderboard, ahead of GPT-4 and Claude 3, with models a fraction of their size.[34]

And Baichuan post-trained a 32-billion-parameter medical model using a staged GRPO recipe against a clinical verifier. On HealthBench, OpenAI’s own medical benchmark, M2 beat every open model and most closed ones, including o3 and Gemini 2.5 Pro, and at release, it was the only model other than GPT-5 to clear 32 on the Hard subset. Quantized, it deploys on a single RTX 4090.[35]

Three domains, three of the six operations, three names your board recognizes. None of these teams out-trained the frontier in general, and none needed to. They picked an axis, fine-tuned a checkpoint on it, and kept the axis.

Why the literature lags

If the post-training era is real, why is the “Open Models 101” wave still writing comparison-era explainers? Mostly because that is what explanation is. The genre exists to introduce open models to people arriving from closed APIs, and introducing the unfamiliar means comparing it to the familiar. A comparison can only hold properties both sides share: price, privacy, control, and latency each take a value on both sides, so each gets a row. Continued pre-training, merging, and weight surgery have no closed-form counterparts, so no rows exist for them, and they go unwritten. The blog posts, the press explainers, and the analyst notes all inherit the format, whoever writes them.

The commercial guides could break the frame, because their authors run these operations for a living. They do not, and the pattern is instructive. I read four guides closely: an inference platform, a GPU renter, a desktop-app maker, and an independent author. Each goes deep on exactly one production capability, the one it sells. Preference optimization and RL fine-tuning appear in none of them, and neither does merging, which nobody sells.[36] Merging needs no rented compute, no serving contract, no application. The comparison frame explains the wave. The billing pattern explains why even its deep end never corrects its shallow end.

The obvious objection is that if these operations mattered, the closed vendors would sell them. They did. OpenAI shipped a complete distillation workflow in its API in October 2024, and Google, Anthropic, and AWS offer their own distillation paths.[37] What they sell is the operation, never the artifact. OpenAI now even releases open-weight models of its own; what it does not release is the adapted weights from your fine-tuning of its hosted models. The fine-tune lives behind the API, and Microsoft’s documentation for the equivalent Azure workflow states plainly that the stored training data cannot be exported or downloaded.[38]

The operations arrived. Nothing came out. And the hosted route delivers real results: published distillation numbers report 14-24 times lower cost per successful task than frontier calls.[39] What the buyer owns afterward is a result, not a model; it cannot be merged, quantized, or moved, and it lives only as long as the vendor’s base.

The platforms noticed the same thing, and what they built is the clearest statement of what this era is worth. Amazon Bedrock ships Custom Model Import, generally available since October 2024, which accepts weights in the Hugging Face format: Llama, Mistral, Qwen, and, since last November, OpenAI’s own open-weight models.[40] Google Vertex accepts custom weights. Microsoft Foundry accepts full models, adapters, and draft models.

Study those import screens for a moment. Every major platform built a door for the model file to come in. None of them built one facing out. You can bring a merged model to all three hyperscalers; you cannot take a fine-tune of their own models away from any of them. The companies that run the largest AI infrastructure in existence have priced what a file in hand is worth, and their answer is a one-way door.

So the question to take away from this piece is not the question of the era being compared. Not which model is best, and not even open versus closed. The question is what you will make from the thing you hold. And it is the right question because the models are now made that way, the tools run on a desk, and the explainers who cannot tell you so are still writing inside a frame built for the era before.

Washington, incidentally, is learning the same lesson from the opposite direction. The reported ban keeps colliding with the property this piece is about: the weights are files, already on disks in their millions, and legal analysts note that restricting publicly available model weights raises constitutional questions a service ban never would.[41] Whatever the security merits of the case, and the security findings are not trivial,[42] the policy difficulty is the object lesson. You can sanction a company and geo-block a service. A file that has shipped is neither, which is presumably why the instruments reportedly under discussion are Entity List designations, procurement rules, and liability: tools that reach companies and contracts, because nothing reaches the file.

And I should say plainly that the capability this piece describes cuts both ways: the same weight access that lets a practitioner transplant a tokenizer lets anyone strip a model’s safety training, an operation I examined in Open From Both Sides. Weight access is not a virtue. It is a property, and properties do not pick sides.

So here’s my one-line “open models 101”: An open model shouldn’t be a finished product that you pick. It should be a training run you resume.

Notes

[1] Axios, “The secret Trump administration battle to fight Chinese AI”, 20 July 2026; see also Tom’s Hardware, “Trump administration reportedly reviving push to ban Chinese AI models following Kimi K3 launch”, 22 July 2026. No executive order signed as of this writing; the Commerce Department reportedly evaluated Entity List designations; House committee probes of US firms using Chinese models reported July 2026. All characterisations “reportedly” per the sourcing.

[2] Chinese models at 46.4% of routed token traffic on OpenRouter versus 35.7% for US models, DeepSeek at 17.6% alone, as of July 2026, per the Axios reporting and contemporaneous coverage. OpenRouter routes a developer-heavy slice of traffic; treat the shares as indicative of that population, not of the whole market.

[3] Simon, “AWS and Hugging Face collaborate to simplify and accelerate adoption of Natural Language Processing models”, AWS Machine Learning Blog, 23 March 2021. Figures as published: ~7,000 pre-trained models, 164 languages, BERT at 340M parameters, GPT at 175B.

[4] Simon, “SafeCoder vs. Closed-source Code Assistants”, Hugging Face blog, 11 September 2023.

[5] The StarCoder base models were trained on The Stack (2.7 TB, permissively licensed code), published with an opt-out mechanism for repository owners. Li et al., “StarCoder: may the source be with you!”, arXiv:2305.06161.

[6] Rozière et al., “Code Llama: Open Foundation Models for Code”: Llama 2 with continued pre-training on a code-heavy corpus. SEA-LION’s continued pre-training stage per its technical report (see the SEA-LION note above). Continued pre-training at useful scale consumes billions of tokens of compute; it is the heaviest operation in this piece and the one with the highest floor.

[7] Rafailov et al., “Direct Preference Optimization: Your Language Model is Secretly a Reward Model”, NeurIPS 2023; Tunstall et al., “Zephyr: Direct Distillation of LM Alignment”, the Hugging Face H4 recipe pairing SFT with DPO.

[8] Lambert et al., “Tülu 3: Pushing Frontiers in Open Language Model Post-Training”, Allen Institute for AI, November 2024. Full recipe, data and weights released; introduces reinforcement learning with verifiable rewards (RLVR).

[9] GRPO: Shao et al., “DeepSeekMath”, which introduced group relative policy optimisation; DeepSeek-AI, “DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning”, January 2025. GRPO computes advantages within a sampled group, removing the separate critic network. Community replication: Hugging Face’s Open R1.

[10] Open post-training frameworks include Hugging Face TRL (SFT, DPO and GRPO trainers), ByteDance’s verl, and OpenRLHF; consumer-hardware GRPO recipes ship in Unsloth.

[11] Grattafiori et al., “The Llama 3 Herd of Models”: models from experiments with different data and hyperparameters are averaged at each reward-modelling, SFT and DPO stage; checkpoint averaging is also applied during pre-training annealing, and the flagship model is used to improve the smaller models in post-training.

[12] Cohere, “Command A: An Enterprise-Ready Large Language Model”: “Expert merging is a core feature of the Command A training pipeline”, alongside Polyak and seed averaging and interpolation for capability recovery.

[13] Three grades of the operation, in ascending difficulty. Averaging variants produced by one pipeline under different data or hyperparameters: Llama 3.1 and Command A above. Merging separately post-trained branches that share an ancestor: TinyR1’s three domain experts and SEA-LION’s DELLA stages, below. Cross-family merging between unrelated bases: requires tokenizer transplantation when vocabularies differ (note 21) and remains largely research territory (note 14). The 2025 exhibits in this piece are the second grade.

[14] “A Systematic Study of In-the-Wild Model Merging for Large Language Models”, arXiv:2511.21437. Six methods, four base models, twelve checkpoints each, sixteen benchmarks.

[15] Sun et al., “TinyR1-32B-Preview: Boosting Accuracy with Branch-Merge Distillation”. Qiyuan Tech and Peking University. Branch phase: domain-specific SFT of DeepSeek-R1-Distill-Qwen-32B on math, coding, and science data. Merge phase: Arcee Fusion (Goddard et al., 2024). AIME 2024: 78.1 versus DeepSeek-R1’s 79.8. Merge cost: 4 H800 GPU-hours versus 740 for data-mixture retraining; the paper reports using 0.5% of the data-mixture merging compute and describes model merging as “a ‘free-lunch’ approach”.

[16] AI Singapore, SEA-LION technical report, arXiv:2504.05747. Post-training pipeline for Gemma-SEA-LION-v3-9B-IT: two instruction-tuning stages, alignment, and multiple merge stages using DELLA Linear.

[17] Yang et al., “Model Merging in LLMs, MLLMs, and Beyond: Methods, Theories, Applications and Opportunities”, ACM Computing Surveys, 2026.

[18] Goddard et al., “Arcee’s MergeKit: A Toolkit for Merging Large Language Models”, EMNLP 2024 Industry Track, pp. 477–485. The author served as Chief Evangelist at Arcee AI until November 2025 and holds no current commercial relationship with the company.

[19] NVIDIA, “Nemotron-4 340B”, released under the NVIDIA Open Model License permitting synthetic data generation for training other models.

[20] MergeKit repository, hardware requirements per repository documentation (accessed 23 July 2026).

[21] “Breaking Down Model Vocabulary Barriers with Tokenizer Transplantation”, arXiv:2506.06607. Orthogonal matching pursuit reconstruction of embedding matrices; ~96% retention across model families, training-free.

[22] Unsloth documentation, Qwen3.5-397B-A17B: ~807 GB full checkpoint; ~214 GB at Unsloth dynamic 4-bit (UD-Q4_K_XL), loadable on a 256 GB M3 Ultra; 3-bit fits 192 GB systems; 2-bit dynamic (UD-Q2_K_XL) recommended by Unsloth as a size/accuracy balance. Via MoE offloading, runs on a single 24 GB GPU plus 256 GB system RAM at 25+ tokens per second. Unsloth documentation, July 2026. Performance-tier comparison to closed frontier models is Unsloth’s claim; vendor-adjacent, label accordingly. File sizes are directional and vary by quant build.

[23] Community GGUF quantization tables (mradermacher and similar) publish the full precision ladder with quality annotations; the 1-bit IQ1 entries carry the label “for the desperate”.

[24] 24 GB: RTX 3090/4090, RX 7900 XTX. 32 GB: RTX 5090. Manufacturer specifications.

[25] AMD Ryzen AI Max+ 395 (”Strix Halo”): 128 GB unified LPDDR5X. Platform unveiled in Lisa Su’s CES keynote, 5 January 2026; AMD’s CES press release describes the Ryzen AI Halo developer platform as “capable of running up to 200 billion parameter models locally”, with the developer machine at $3,999. Third-party 128 GB mini-PCs sell for roughly $2,000 street as of July 2026; the widely quoted ~$1,499 entry units carry 64 GB and cannot load the largest models. Street prices vary by configuration.

[26] Sparse mixture-of-experts models activate a fraction of parameters per token, so decode cost tracks active rather than total parameters; for a concrete instance of a very large MoE running on modest hardware via offloading, see the Qwen3.5 figures in note 10.

[27] vLLM speculative decoding documentation: draft and target models must share a vocabulary by default. A heterogeneous-vocabulary path (token-level intersection) exists with ~60% reported acceptance for overlapping vocabularies.

[28] TokenTiming, arXiv:2510.15545, on the shared-vocabulary constraint and the training-stage cost of aligned draft models.

[29] Li et al., “EAGLE: Speculative Sampling Requires Rethinking Feature Uncertainty”. EAGLE-class draft heads train against the frozen target model’s features; the vLLM documentation in note 27 lists EAGLE and MTP among supported speculative methods.

[30] Microsoft Foundry custom model import, running on the Fireworks inference runtime within Foundry: full weight models, LoRA adapters (preview), draft models for speculative decoding (preview). Documentation, June 2026.

[32] Cursor, “Composer: Building a fast frontier model with RL”, October 2025. Cursor’s own comparison places Composer at frontier coding results with roughly four times the generation speed of comparably intelligent models, while noting GPT-5 and Sonnet 4.5 outperform it on raw score.

[33] Simon Willison, notes on Composer: Cursor researchers declined to say whether Composer starts from an open-weights base such as Qwen or GLM; reporting has widely inferred an open checkpoint. Cursor is also among the US companies House committees have reportedly queried over Chinese-model use; see TechTimes.

[34] Zhang et al., “xLAM: A Family of Large Action Models to Empower AI Agent Systems”, Salesforce AI Research: first position on the Berkeley Function-Calling Leaderboard at the time, outperforming GPT-4 and Claude 3 on tool use; repository. Leaderboard positions have since shifted with newer versions of the benchmark.

[35] Baichuan, “Baichuan-M2: Scaling Medical Capability with Large Verifier System”: 32B model trained with multi-stage GRPO against a patient-simulator verifier; above 32 on HealthBench Hard, previously exceeded only by GPT-5; surpasses o3, Grok 3, Gemini 2.5 Pro and GPT-4.1 on HealthBench; near-lossless quantisation deploys on a single RTX 4090.

[36] Sample of four current guides read in full, selected for variance in author business model: BentoML (inference infrastructure; June 2026), Thunder Compute (GPU rental; July 2026), LocalChat (local desktop application; June 2026), and an independent author on the Hugging Face community blog (November 2025). Coverage pattern as described; merging absent from all four. Sample and selection logic stated in the interest of checkability.

[37] OpenAI, “Model Distillation in the API”, 1 October 2024: Stored Completions capture frontier-model outputs as training data for fine-tuning smaller models, inside the platform. On rival offerings: InfoWorld notes Google, Anthropic and AWS provide distillation capabilities.

[38] Microsoft Learn, Azure OpenAI stored completions and distillation: “Stored completion distillation training files cannot be accessed directly and cannot be exported externally/downloaded.” The page documents the classic workflow, which Microsoft schedules for migration to the Responses API in October 2026; the export restriction is as stated as of July 2026.

[39] TensorZero, “Distillation with Programmatic Data Curation”: fine-tuned small models at 13.7x (GPT-4o mini) to 24.1x (Gemini 2.0 Flash Lite) lower cost per successful task than GPT-4o across their evaluation environments. Vendor-published benchmark, B-tier.

[40] Amazon Bedrock Custom Model Import, generally available 21 October 2024; Qwen architectures added 11 June 2025; OpenAI gpt-oss added 19 November 2025. GA 21 October 2024, Hugging Face safetensors format; Qwen support added 11 June 2025; OpenAI gpt-oss support added 19 November 2025. Google Vertex AI custom weights import. Microsoft Foundry custom model import (note 21).

[41] Representative commentary: Fast Company on the unresolved form and reach of any restriction, and Tom’s Hardware on enforceability of restrictions on downloadable weights. B-tier commentary on a live policy question.

[42] Booz Allen Hamilton, “What’s in America’s Code?” (May 2026): in 2,800+ trials across roughly 460,000 lines of generated code, three of four Chinese code-generation models produced significantly more vulnerable code when the prompt identified the user as working for the US government; Qwen3-Coder added roughly 130% more vulnerabilities under the government persona. Booz Allen states its evidence stops short of showing backdoors or deliberate insertion. The security concern is empirically grounded; this piece takes no position on the policy response.

On Sunday morning, three days after Kimi K3 launched and eight days before its weights are due, Alibaba’s Qwen team announced Qwen 3.8: 2.4 trillion parameters, multimodal, “second only to Fable 5”, and “going open-weight soon” [1]. A preview is live on Alibaba’s Token Plan and its Qoder coding platforms [1][2]. No benchmark table accompanied the claim. No per-token API price had been published for the preview at the time of writing. No date [2][3].

When K3 launched, the Checkpoint Gap named the window between a frontier claim and the artefact that lets anyone verify it. Moonshot’s version of the gap was aggressive but disciplined: a published benchmark table with unusually transparent harness footnotes, a frontier price of $15 per million output tokens, an independent evaluation within hours, and a closing date of July 27. Every claim in that launch can be graded against a calendar.

Qwen 3.8 opens the same gap without the discipline, and the difference deserves a name. A dated gap is a falsifiable claim: on July 27, the weights ship and replicate, or they don’t, and either outcome is information. An undated gap asserts nothing testable. It is an option — the right, but never the obligation, to ship weights at a moment of the vendor’s choosing, while collecting the open-weights narrative in the meantime. The option is also free to write: announcing an open-weight release commits no capital, reserves no serving capacity, and books no obligation, while the announcement itself trades at full value in the news cycle. A date can be missed, and a missed date is a verdict. “Soon” can only drift. Nothing that happens next week, or next quarter, can prove it false.

The promise deserves to be read against the record, and the record splits cleanly in April 2026. Through the Qwen3 generation, Alibaba was one of the industry’s most reliable flagship open-weight publishers: flagship generations shipped with downloadable weights, most under Apache 2.0, and the mid-tier still does [4]. Then Qwen3.6-Max-Preview arrived on April 20 as the first closed flagship in Qwen’s history, available only via the API on Alibaba Cloud [4]. Qwen3.7-Max followed in May: no checkpoint, no license file, no timeline announced for an open variant [5]. Alibaba never promised weights for either flagship. It simply stopped shipping them.

And both of those closed flagships nonetheless arrived with Alibaba’s full launch machinery: a detailed technical post, complete benchmark tables, day-one pricing [4][5]. Qwen 3.8, the largest model the company has ever disclosed and the first flagship since the pivot to revive the open-weight language, arrived as a post on X. The words came back. The date did not.

None of this makes the promise empty. Alibaba’s open-source catalog is real, enormous, and central to its ecosystem strategy, and a 2.4-trillion-parameter checkpoint takes time to prepare for public release. Moonshot itself left 11 days between the announcement and the weights. A preview is allowed to be a preview. If a Qwen 3.8 repository with a license file appears on Hugging Face in the coming weeks, this note’s caution was cheap insurance. But that is the property that makes undated promises worth naming: they can only be honored, never broken. There is no day on which “soon” fails.

Then there is the question of who is making it. Alibaba’s annual report records an investment of approximately $800 million for a 36% equity interest in Moonshot as of March 2024 [6]. Read the timing with that in mind. Moonshot, which Bloomberg reports reached $300 million in annual recurring revenue in June and plans an IPO in as little as six months, launched the most expensive Chinese model ever shipped, with a dated open-weight commitment [7]. Three days later, one of its major shareholders announced a slightly smaller model, claimed a slightly better ranking, attached the same open-weight language with no date, and released it into the window, even though K3’s openness cannot yet be verified. Whatever the intent, the effect is precise: the open-frontier crown is being contested during the one week when the current claimant cannot produce the crown.

The apparent self-harm resolves once you weigh the assets. Alibaba’s Moonshot position is roughly $800 million of preferred stock, diluted through subsequent rounds and due to be repriced by the IPO, whichever model wins the week [6]. Its Qwen franchise is a different order of asset: it anchors Alibaba Cloud’s model business and, increasingly, the parent’s own AI narrative, days after a K3 launch that Bloomberg credits with shaking global technology stocks [2]. Note also what an announcement without a benchmark table can and cannot do. It cannot win a developer, because developers need a table and a price. It can freeze an enterprise purchase decision, hold a sales pipeline, and steady the parent’s story between trading sessions, because those audiences respond to positioning, not checkpoints. An empty announcement is not a weak launch. It is a different instrument, aimed at a different audience.

The emptiness may even be the calibration. Published numbers strong enough to beat K3 would mark down the IPO asset Alibaba still holds. Numbers too weak to beat it would concede the crown outright. Words alone contest the crown and leave the comparison untouched: every branch of the decision leads to an empty announcement. And the reading carries its own test. If the full launch post follows within days, with a table and a price, the machinery is catching up with the announcement. The longer the gap between the words and the numbers, the more the announcement was the product.

For the reader fielding this in a vendor review or an investment memo this week, the two launches belong in different rows of the table. K3’s numbers are vendor-published but disciplined by a date: they can be checked against the July 27 checkpoint, the independent evaluations already running, and a rate card that commits Moonshot to a price. Qwen 3.8’s single comparative sentence has, at the time of writing, no benchmark behind it, no price beneath it, and no calendar in front of it. Cite the first as a claim awaiting verification. Cite the second, if at all, as an announcement.

The grading rule this produces is simple and portable. When a frontier launch opens a Checkpoint Gap, the first question is not the benchmark score but whether the gap has a date. Moonshot attached a date to its claim and a price to its confidence; its numbers are pending verification. Alibaba attached neither; its numbers are pending existence. On July 27, the first gap closes, one way or the other. The second has no edges at all. In the Checkpoint Gap, the only hard currency is a date, and Alibaba isn’t spending any.

Notes

[1] Qwen (@Alibaba_Qwen), launch announcement, July 19, 2026. The quoted phrases (”second only to Fable 5”; “going open-weight soon”) are verbatim from the post, which describes Qwen3.8-Max-Preview as available on Alibaba’s Token Plan, Qoder, and QoderWork. Vendor-published.

[2] Bloomberg, “Alibaba’s Qwen Unveils Preview of Flagship AI Model”, July 19, 2026. Bloomberg notes the Sunday post “provided no additional technical specifications” beyond the parameter count, that Alibaba plans an open-weight release, and that K3’s launch days earlier helped upend perceptions of Chinese AI capability while shaking global technology stocks.

[3] The Decoder, “Alibaba’s Qwen takes on Kimi K3 with open-weight Qwen 3.8”, July 19, 2026: no benchmark results are available at announcement.

[4] TokenMix, “Qwen3.6-Max-Preview Review”, April 2026 — Qwen3.6-Max-Preview, released April 20, 2026, was the first flagship in Qwen’s history to ship closed-weights only, with API access through Alibaba Cloud; prior flagship generations through Qwen3 shipped with downloadable weights, most under Apache 2.0 (some earlier variants used the non-commercial Qwen research licence), and mid-tier Qwen3.6 models (27B, 35B-A3B) remain open under Apache 2.0. Corroborated by InsiderLLM, which verified the absence of flagship checkpoints on the official Qwen Hugging Face organisation by direct repository probes as of June 15, 2026. B-tier sourcing; the underlying negative claim (no published flagship weights) is independently checkable against the Hugging Face organisation at any time.

[5] Yotta Labs, “Qwen 3.7-Max: Pricing, Features, and How to Access”, May 2026: Qwen3.7-Max is not open-weight, cannot be downloaded, and is API-only; no timeline announced for an open variant. On pricing, sources conflict on the exact figure (Artificial Analysis reports $2.50/$7.50 per million input/output tokens; OpenRouter lists $1.475/$4.425), but all place Qwen3.7-Max well below both Kimi K3’s $15 and the Anthropic frontier tier — Alibaba has so far never backed a flagship claim with a frontier price.

[6] Alibaba Group Holding Ltd, Form 20-F, fiscal year ended March 31, 2024: “the Company invested a total of approximately US$0.8 billion (approximately RMB 5.9 billion) for an approximately 36% equity interest” in Moonshot, held as preferred stock and accounted for under the measurement alternative. Subsequent Moonshot funding rounds (Series B extension, Series C, and a further round in early 2026) have likely diluted this percentage; Alibaba has not disclosed an updated figure.

[7] Bloomberg, as cited in [2] and [3]: Moonshot reached $300 million in annual recurring revenue in June 2026 and plans to go public in as little as six months. The “most expensive Chinese model ever shipped” characterisation of Kimi K3’s $15 per million output tokens is per Simon Willison’s launch analysis, July 16, 2026.

On July 16, Moonshot AI announced Kimi K3, a 2.8-trillion-parameter model it bills as the first open model in the 3-trillion-parameter class. The launch post is unusually candid for the genre. It states plainly that K3 trails the two strongest proprietary models, Claude Fable 5 and GPT-5.6 Sol, and its limitations section concedes “a noticeable gap in user experience” against both [1]. The press coverage was less careful: within hours, headlines had K3 pushing Chinese AI “into Fable-level territory” [2].

Two numbers in the launch matter more than any benchmark score. The first is a price: $15 per million output tokens, the most expensive model a Chinese lab has ever shipped and nearly four times Moonshot’s own K2.6 [3]. The second is a date: the full weights are promised by July 27, 2026 [1]. Until then, every measurable claim about K3 passes through an API endpoint operated by Moonshot. The score that matters this week is not an Elo. It is a date.

Call the window between those two events the Checkpoint Gap: the period when a model is priced, benchmarked, and covered as open, while the artifact that would let anyone verify it sits on the vendor’s servers. The industry has had a recent, expensive lesson in what can live inside that window. In April 2025, Meta submitted a chat-tuned variant of Llama 4 Maverick to the LMArena leaderboard, where it briefly ranked second. When the public weights were tested, the released model landed around 32nd, and LMArena rewrote its submission policies with an unusually direct rebuke [4]. The benchmarked model and the shipped checkpoint were not the same thing. Nobody outside Meta could have known before the weights landed.

Nothing suggests Moonshot is running that play. The company’s record argues the opposite: Kimi K2 shipped open under a modified MIT license in July 2025, and K2.6 followed in April 2026 [5]. Moonshot’s benchmark footnotes are also more transparent than most Western launches, and they repay reading. K3 is evaluated with Moonshot’s own KimiCode evaluation harness on most coding benchmarks, while rivals run under Claude Code, Codex, or their best score across harnesses. Fable 5’s results may reflect a fallback to Opus 4.8 when it refuses a task. K3 itself currently runs at a single reasoning effort, its highest [6]. Where the harness effect can be isolated, it looks small: on DeepSWE, K3 scores 67.5 under KimiCode and 67.3 under the official leaderboard’s harness [6]. These are disclosed choices, not hidden ones. But disclosure is not verification. Until July 27, good faith and the Llama 4 play are indistinguishable from the outside, and the correct reading posture is the same for both.

What independent evidence exists places K3 near the frontier, not at it — and even that evidence was gathered through Moonshot’s API. Artificial Analysis scores K3 at 57 on its Intelligence Index, behind Claude Fable 5 (around 60) and GPT-5.6 Sol (around 59) and comparable to Opus 4.8, and its private knowledge-work evaluation ranks K3 second only to Fable 5 [7]. Third place at launch from a lab that will hand you the weights is a remarkable result. It is not the frontier moving to Beijing. And note the tense the evaluator itself uses: once available, AA writes, K3 “would clearly lead” the open-weight field [7]. The conditional is doing the work. Even the independent scorekeeper is writing from inside the gap.

The price is where this launch stops resembling every previous Chinese release. DeepSeek’s pitch never depended on benchmark verification: at $0.87 per million output tokens, 90% of the frontier was a bargain even if the numbers flattered [8]. K3 at $15 has exited the Chinese price war entirely. On the rate card, it is 17 times DeepSeek V4, level with Anthropic’s Sonnet tier, and 30% of Fable’s $50 [3][8]. On cost per completed task, a separate metric, AA’s estimate lands K3 at $0.94 — beside GPT-5.6 Sol at $1.04, half of Opus 4.8 at $1.80, and three times its open-weight peer GLM-5.2 [7].

Both metrics say the same thing: this model is priced with the frontier, not against it. Nobody pays that premium for third place unless the table holds. The rate card is Moonshot’s self-assessment denominated in dollars, and it converts the benchmark table from marketing garnish into the product justification. The Checkpoint Gap matters more for K3 than for any Chinese launch before it, because this is the first one to ask frontier prices for claims nobody can yet check.

The gap closes on schedule, making the launch falsifiable in a way most are not. Three tests, all dated.

1. Do the weights ship by July 27, and does the released checkpoint match what the API has been serving?

2. Do independent evaluations under a neutral harness reproduce the launch table?

3. Where does third-party pricing settle? On that last test, temper expectations of a DeepSeek-style collapse toward the hosting floor. Moonshot recommends serving K3 on supernodes of 64 or more accelerators, so price competition will come from large inference providers, not from tiny GPU resellers [1]. If the $15 holds once alternatives exist, the market has accepted the frontier positioning. If it collapses, the price will launch in the theatre.

Did the frontier move to China? Not on the evidence available today, and Moonshot’s own launch post doesn’t claim it did. What moved is the posture. DeepSeek priced like it had something to prove. Moonshot is pricing like it has already proved it, eleven days before anyone can check.

Notes

[1] Moonshot AI, “Kimi K3: Open Frontier Intelligence”, July 16, 2026. The weights date, API pricing ($0.30/MTok cache-hit input, $3.00/MTok cache-miss input, $15.00/MTok output), the concession that K3 trails Claude Fable 5 and GPT-5.6 Sol, the user-experience limitation, and the recommendation to deploy on supernodes of 64 or more accelerators all appear in the launch post. Vendor-published.

[2] Fortune, “Moonshot’s Kimi K3 pushes Chinese AI into Fable-level territory”, July 16, 2026.

[3] Simon Willison, “Kimi K3, and what we can still learn from the pelican benchmark”, July 16, 2026 — identifies K3 as the most expensive model released by a Chinese lab to date, at the level of Anthropic’s Claude Sonnet series. Kimi K2.6 pricing ($0.95/MTok input, $4/MTok output) per Moonshot’s platform documentation.

[4] The Register, “Meta accused of Llama 4 bait-n-switch to juice LMArena rank”, April 8, 2025. LMArena stated Meta’s interpretation of its submission rules “did not match what we expect from model providers” in its April 2025 policy update; the released Maverick’s subsequent placement around 32nd is documented in The Decoder’s follow-up coverage of the leaderboard.

[5] Moonshot AI, “Kimi K2: Open Agentic Intelligence”, July 2025, and “Kimi K2.6”, April 2026.

[6] Moonshot K3 launch post [1], benchmark footnotes 1–8. Harness assignments per benchmark, the Fable 5 fallback condition, the single (maximum) reasoning effort at launch, and the DeepSWE dual-harness scores (67.5 under KimiCode; 67.3 under the official leaderboard’s mini-SWE-agent harness) are all disclosed there.

[7] Artificial Analysis, Kimi K3 launch evaluation and model page, July 16, 2026. Intelligence Index: K3 at 57, behind Claude Fable 5 and GPT-5.6 Sol and comparable to Opus 4.8 and GPT-5.5. AA-Briefcase (private long-horizon knowledge work): Elo 1547, second behind Claude Fable 5. Cost per task is AA’s evaluation-derived estimate, not a market price: K3 $0.94, GPT-5.6 Sol $1.04, Claude Opus 4.8 $1.80, GLM-5.2 $0.32. One counterweight AA also reports: K3 generated 130M output tokens across the Index against a 63M median for comparable reasoning models, so on verbose workloads the rate card understates effective cost — a consequence of the single maximum reasoning effort available at launch. The open-weight comparison (”would clearly lead” GLM-5.2 and DeepSeek V4 Pro) is AA’s own phrasing, stated in the conditional pending the weight release.

[8] Fortune [2] for comparative output-token pricing: DeepSeek V4 at $0.87, z.ai’s GLM-5.2 at $4.40, and Claude Fable at $50 per million output tokens.

Ask why Nvidia took equity in the neoclouds it works with — CoreWeave, Nebius, even Firmus, its own revenue-share launch partner — and took none in Sharon AI, and the answer is in the instrument itself.

Start with what Nvidia does for the clouds that made it. CoreWeave has been public since March 2025; it carries more than $20 billion of debt and once looked reckless to venture investors, but it borrows against investment-grade, asset-backed paper — an $8.5 billion facility rated A3, secured by the chips and the customer contracts, at roughly SOFR plus 2.25 percent.[1] Nebius, the old Yandex reconstituted on Nasdaq, posted positive adjusted EBITDA in the first quarter of 2026, raised more than $6 billion this year, and ended the quarter with $9.3 billion in cash.[2] Both are anchored by hyperscalers whose contracts pay in advance: CoreWeave by Microsoft, Nebius by Meta and Microsoft, on deals worth tens of billions.[3] And into both, Nvidia put equity — $2 billion into CoreWeave in January, $2 billion into Nebius in March, the same instrument it used that season in Lumentum and Coherent.[4]

Equity is the tell. It is a bet on enterprise value: a junior claim that pays only if the company becomes worth something, which it has for these two. Nvidia takes equity where there is value to own. It did not offer Sharon AI equity, and it would not, because the thing a revenue-share does that equity cannot is sit senior to the shareholders, a claim on revenue paid off the top, ahead of a stake that may end up worthless. How Nvidia chooses to finance a cloud is a readout of what it thinks the cloud is worth. See value, and it buys in. See doubt, and it keeps its distance: a claim on the revenue, a loan to produce it, and no share of the company.

The counterparty side complicates the neat version. CoreWeave and Nebius fund their buildouts with investment-grade debt and hyperscaler prepayments, so they never needed Nvidia’s financing. Firmus and Sharon AI did take it, and Firmus is worth $5.5 billion, so a revenue share is not, by itself, a mark of distress. It is how a buildout gets financed quickly, as Nvidia’s own chief financial officer frames it: a way to serve companies with demand but who cannot secure financing quickly enough.[5] The instrument opens a new recurring revenue line for Nvidia. What separates the two who took it is whether Nvidia also wanted to own them.

The debt market already sorts AI borrowers by distance from cash: Amazon borrows unsecured, Oracle against backlog, SoftBank could not borrow against a private mark at all.[6] The revenue-share program is what sits below SoftBank’s rung, where the debt market says no and Nvidia says yes, through an instrument no bank would offer. It is a familiar move under a new name. An earlier piece called it the Overbuild Put: a company financing a buildout it might not fill names its own backstop, and the backstop is the giveaway.[7] Meta named its exit, a cloud business it might have to start if it overbuilt. Sharon AI’s exit is named for it, by Nvidia; the credit support is the backstop that lets a buildout proceed whose demand is unproven. The difference is who writes the text. Meta wrote one on its own capacity. Nvidia writes one on Sharon AI’s, the supplier backstopping the demand of a customer it also sells to.

The February COMECON piece argued Nvidia holds the independent cloud tier captive; Part 1 named the productized version.[8] The line is not equity versus revenue-share, since Firmus took both; it is ownership versus none. Nvidia holds a stake in CoreWeave, Nebius, and Firmus. In Sharon AI, it holds only a claim.

What “fragile enough to sign” looks like

Sharon AI is the exhibit, the one launch partner Nvidia financed but would not own. Firmus, the other, raised $505 million at a $5.5 billion valuation with Nvidia among its backers;[4] whatever else it is, it is not the bottom of the ladder. Sharon AI’s own filings tell most of the story before any short seller does.

At the end of March, the company held $164 million in cash and no revenue; its filings do not expect revenue to begin until September, and operating cash flow is negative, with a capital-expenditure requirement of about $720 million to support its lead contract.[9] Against the cash are two customer contracts totaling $1.26 billion and a second worth roughly $950 million.[10] Its reported quarterly loss of $20 million is mostly an accounting artifact: the company carries its convertible notes at fair value, so remeasuring them drove a $70 million loss through the income statement, offset by a $66 million gain on the sale of half of a Texas data-center joint venture.[11] A company whose reported profit swings with the value of its own debt and whose cash comes from an IPO and asset sales rather than operations is being valued on a chain of announcements, not cash flow. There is none yet.

The build is financed by a stack of commitments, each conditioned on the next. A $200 million facility from an investor called Digital Alpha and a $500 million facility from USD.AI, a roughly one-year-old decentralized-finance protocol, were both announced as “up to” and, per a short report, remained unexecuted months later.[12] In May, the company closed $350 million of convertible notes led by Oaktree. Per the same report, those notes were funded only if Sharon AI first signed a binding contract for at least 4,068 additional GPUs, its lender declining to treat the announced $1.26 billion in demand as sufficient collateral.[13] In June, it raised an additional $1.6 billion.[14] And on June 12 came the keystone, the six-year Nvidia deal, whose filing language says it is “structured so that Sharon AI can commit to large-scale NVIDIA infrastructure” through the revenue-share and credit-support.[15] Nvidia’s credit line is the piece that lets the rest of the tower stand.

Then the customer, where the short case overreaches, and the real point is sharper. Sharon AI’s forward revenue rests on the $1.26 billion contract with ESDS Software Solution, and ESDS is not a shell. It is an established Indian cloud provider with roughly ₹361 crore (about $43 million) in revenue last fiscal year, up 27 percent, profitable, lightly indebted, and preparing an IPO of its own.[16] The problem is scale, not solvency. The contract calls for average annual payments of roughly $250 million and $140 million in letters of credit; the annual figure alone is six times ESDS’s entire revenue.[17] A real $43 million company can be a real counterparty to a contract its own size; whether it can perform one thirty times larger is the open question, and it is the same question Sharon AI’s own lender asked. The chief executive brings his own history. Manning’s prior public company, Mawson Infrastructure Group, alleges in court filings that he directed roughly A$11.5 million to a shipping firm he controlled without disclosing his interest to the board, allegations he contests and that remain unadjudicated. That same firm, Flynt, is now a disclosed related-party vendor of Sharon AI, according to the company’s own prospectus.[18] None of this has stopped the stock, which has risen sharply; the market has not endorsed the short thesis.[19] But it is the profile of an operator that could not fund this build on ordinary terms, which is why the revenue-share was there to be signed.

One detail seals the instrument argument. Nvidia holds no equity in Sharon AI; its annual report called Nvidia a “strategic shareholder” and the company filed a correction stating Nvidia owns none.[20] It invested $2 billion in equity in each of CoreWeave and Nebius, and took a stake in Firmus, its own revenue-share partner. Only in Sharon AI did it take a revenue-share, a credit claim, and no ownership at all, because what it is underwriting here is not an asset it wants to hold. It is a demand that needs to be kept alive.

What comes next

The rule generalizes, and it is the thing to take from Sharon AI. When a supplier finances its own customer, the instrument it chooses is a private credit rating, better informed than the market’s, because the supplier sits inside the relationship. Equity is the vote of confidence. The revenue share is how the buildout gets paid for, and Firmus, worth $5.5 billion, took one too. What sets Sharon AI apart is the equity Nvidia declined to take. Call it the Instrument Test: read what a vendor takes, not what it announces. It travels beyond Nvidia: whenever a vendor lends to the customers who buy its product, the instrument encodes what the vendor privately believes, and usually before the tape does.

Which makes the program itself an indicator. Nvidia split its partners by what it was willing to own: it took a stake in CoreWeave, Nebius, and Firmus, and in Sharon AI it took only a claim. As the program spreads, watch which companies get a revenue share with no stake besides it. That pairing, not the revenue-share alone, is the readout of how far down the counterparty-quality curve Nvidia is reaching, and it moves before the market does, because it is Nvidia’s own hand showing. When the next partner arrives with a credit line and no equity cheque, Nvidia is saying, in the one language it cannot fake, that it is a company it will finance but will not own. And note the second edge. When a chip vendor’s credit support helps fund the purchase of its own chips and then collects a share of the revenue those chips generate, the revenue is partly its own money coming home — the same round-trip that ran at the hyperscaler layer, now reaching the bottom of the neocloud tier.[21]

A fair objection remains: a revenue-share cuts both ways. If an operator’s utilization falls, so does Nvidia’s cut, so this is exposure to Sharon AI’s success, not merely a claim on it. But exposure to the success of the operators least likely to deliver it is either deep conviction or the position of a supplier that has run out of stronger customers to sell to.

CoreWeave was fragile once, too, and became a company worth billions; one of these operators may do the same, and Oaktree and Goldman are betting on it. But read the instrument. In CoreWeave, Nebius, and Firmus, Nvidia is a shareholder, betting the company wins. In Sharon AI it is a creditor, arranging to be paid whether it wins or not. Which seat a supplier takes says more than any forecast it offers. And at the bottom of the ladder, Nvidia took the creditor’s.

Notes

[1] CoreWeave (Nasdaq: CRWV) listed March 28, 2025; total debt now exceeds $21 billion. Its March 2026 $8.5 billion facility is rated A3/A(low), secured by substantially all assets of the borrower group, at SOFR + 2.25% floating or ~5.9% fixed, maturing March 2032, and is the first investment-grade-rated GPU-backed financing: Sacra; Quartz. Its credit agreement requires contracts with “large and creditworthy” customers covering future debt repayments.

[2] Nebius Group (Nasdaq: NBIS), formerly Yandex N.V., resumed Nasdaq trading October 2024. Q1 2026: revenue $399M (+684% YoY); positive adjusted EBITDA (~45% AI-cloud margin) and net income of $621.2M (inclusive of non-operating items); more than $6 billion raised in 2026 ($4.3B convertible notes plus Nvidia’s equity), ending the quarter with $9.3B in cash: TIKR; Simply Wall St.

[3] CoreWeave’s anchor customer is Microsoft; Nebius holds a five-year ~$27B Meta agreement and a ~$17–19.4B Microsoft agreement, with hyperscaler prepayments helping fund capex: Forbes; Morningstar.

[4] Nvidia made a $2 billion private placement in CoreWeave in January 2026 (22,935,780 Class A shares at $87.20) as part of an expanded collaboration targeting more than 5 GW by 2030, and agreed to purchase CoreWeave’s unsold capacity through 2032: Sacra; Forbes. Its $2 billion equity investment in Nebius (March 11, 2026) mirrored $2 billion investments in Lumentum and Coherent the same month: MLQ News. Nvidia also holds equity in Firmus, having joined a 2025 round and participated in Firmus’s April 2026 US$505 million round at a US$5.5 billion valuation led by Coatue; the April participation was reported subject to closing conditions. Firmus separately arranged a US$10 billion debt facility. Verify against Firmus’s April 2026 funding release before publication.

[5] Nvidia CFO Colette Kress, framing the program as serving companies with demand that cannot secure financing quickly enough: NVIDIA blog, July 1, 2026.

[6] “Cash Flow Lends. Valuation Doesn’t.,” The AI Realist, June 12, 2026.

[7] “The Overbuild Put,” The AI Realist, June 1, 2026 — reading a fallback-monetisation or backstop remark as a credit signal on a debt-financed buildout whose demand is unproven.

[8] “Jensen’s COMECON: How Nvidia Built an Empire of Captive Clouds,” The AI Realist, Feb. 14, 2026; “The Backstop Has a Name Now (Part 1),” The AI Realist, July 2026 (confirm published slug before linking).

[9] SharonAI Holdings Inc., Form 10-Q for the quarter ended March 31, 2026 (cash $164,288,288; negative operating cash flow; revenue commencement not expected until approximately September 2026), attached to the Company’s Form 424B3, SEC EDGAR (CIK 0002068385). Approximately $720 million of capital expenditure is tied to the lead customer arrangement per the same filing.

[10] ESDS master services agreement of $1,260,000,000 and a second customer contract of approximately $950,000,000, per the Form 424B3 referenced in [9].

[11] Fair-value option elected on the convertible notes (Level 3); Q1 2026 included a $70.2 million loss on remeasurement and a $65,919,712 gain on the sale of a 50% interest in the Texas Critical Data Centers joint venture; convertible-note fair value of $199,358,226 as of March 31, 2026 (Form 424B3, [9]).

[12] Announcements of a Digital Alpha facility of up to $200 million (Jan. 19, 2026, subject to definitive documentation) and a USD.AI facility of up to $500 million (Jan. 22, 2026). Characterisations of USD.AI’s on-chain capacity and the unexecuted status of the Digital Alpha facility are from Bleecker Street Research, “SharonAI (SHAZ),” April 30, 2026 (a short seller with a disclosed position).

[13] SharonAI Form 8-K, Exhibit 99.1 (closing of $350 million of convertible senior notes due 2031, led by Oaktree), May 2026, SEC EDGAR. The 4,068-GPU closing condition is as characterised in the Bleecker Street report ([12]); confirm against the note purchase agreement before publication.

[14] SharonAI’s oversubscribed $1.6 billion private placement (approximately $900 million equity and $700 million of 4.75% convertible notes due 2032), June 2026, with Goldman Sachs as lead placement agent: Benzinga.

[15] Six-year Nvidia collaboration (72 MW, up to 40,000 Grace Blackwell GB300), per the Company’s June 12, 2026 announcement reproduced in the Form 424B3 ([9]).

[16] ESDS Software Solution Limited, FY2025 (year ended March 31, 2025): total revenue ₹361 crore (~$43 million), up 27% year over year; profit before tax up nearly fourfold; debt-to-equity of 0.15 and current ratio of 2.32; DRHP filed March 30, 2025 for a ₹600 crore IPO on the BSE and NSE: unlistedzone; ESDS financials via WWIPL. Verify against ESDS’s audited DRHP financials before publication.

[17] The $250 million average annual payment and the $140 million letter-of-credit obligation are per the Bleecker Street report ([12]); confirm against the master services agreement before publication.

[18] Mawson Infrastructure Group Inc. (Nasdaq: MIGI) alleges, in its January 10, 2025 court filing, that James Manning, its former chief executive, caused the company to pay over A$11.4 million to Flynt International Cargo Solutions (a Vertua subsidiary) for services it “did not need,” without disclosing his interest or seeking board approval: Mawson Form 8-K, Exhibit 99.1, SEC EDGAR. The allegations are unadjudicated and contested. SharonAI’s own prospectus discloses Flynt ICS as a related-party vendor: “Flynt is a subsidiary of Vertua Limited and affiliated to the Group through common ownership by James Manning,” and the Group paid Flynt $167,638 in services expenses for the year ended December 31, 2024.

[19] Public market data as of early July 2026; SHAZ has risen sharply since the April 30 short report, and the market has not validated the short thesis.

[20] SharonAI corrected its FY2025 Form 10-K, which had described NVIDIA as a “strategic shareholder,” to state that NVIDIA holds no equity securities of the Company: SharonAI Form 8-K correction (SEC EDGAR).

[21] “The Round Trip,” The AI Realist, May 4, 2026.

In its most recent quarter, Nvidia returned a record $20 billion to shareholders. In May, its board authorized another $80 billion in buybacks; in June, it raised $25 billion in the bond market — the balance sheet of a company with no financing problem of its own.[1] On July 1, it announced a program to help companies that cannot afford its chips buy them anyway, in exchange for a share of the profits.[2]

The two sit oddly together. A company that hands out that much to shareholders does not usually need to lend to its own customers.

In February, I called this the COMECON model: Nvidia keeps the independent GPU clouds, the neoclouds, captive through four instruments: GPU allocation, equity stakes, credit enhancement, and demand backstops.[3] On July 1, it took two of them, the credit enhancement and the backstop, and gave them a product name.

The program is a “revenue-sharing and credit-support model.” A cloud puts Nvidia GPUs on the floor without carrying the full capital cost, draws token credits against future capacity today, and hands Nvidia its standard hardware margin plus a recurring, usage-linked share of the cloud revenue that capacity generates.[2] How large that share is, Nvidia has not said. The first named partners are Sharon AI, deploying up to 40,000 Grace Blackwell GB300s in Australia, and Firmus, building toward 360 megawatts and 170,000 GPUs in Batam, Indonesia.[4] The arrangement is not wholly new; Nvidia ran a demand backstop with CoreWeave and took an equity stake in OpenAI. What is new is the packaging: the credit support and a revenue-share leg under one name, one template, one marketing page.[5]

The bullish read wrote itself within hours: recurring revenue, a widening moat, and a supplier tying itself to customer usage rather than a single sale. The bearish read wrote itself too: circular financing, vendor-funded demand, the fiber and telecom buildouts in period costume. Both are on offer. Neither is the question that matters.

The question that matters is why the market's strongest supplier is doing this now. The answer isn’t on Nvidia’s blog; it’s on its customers’ earnings calls.

On April 29, Google said it would begin delivering its TPUs to a select group of customers for their own data centers, its formal move into the merchant-silicon market Nvidia has long dominated.[6] Weeks later, AWS confirmed it is exploring selling Trainium to outside data centers.[7] For a decade, the hyperscalers built custom chips and kept them in-house; in 2026, both began selling them. Nvidia’s largest customers are becoming its competitors, from the top of the stack down. (I argued in May that Google is the one to watch: its chip runs its own frontier models, while Amazon’s mostly runs rented workloads — the line that separates a silicon business from a silicon cost center.[8])

Take Nvidia’s case at its strongest. The financing gap is real; lenders have been wary of hardware whose resale value no one can yet model, so builders with genuine demand still can’t get compute funding fast enough. The inference tenants Nvidia names alongside the program (Baseten, Fireworks AI, Together AI) are well-capitalized companies, not strays. And a revenue-share cuts both ways: if a partner’s utilization falls, so does Nvidia’s cut. That is exposure to the customer’s success, not a lien on it. On its own terms, the program clears a bottleneck and aligns incentives, and that reading is not wrong.

It is incomplete because of when it arrived. A supplier that spent a decade as the only game in town does not wander into neocloud finance in the same quarter that its two largest customers start selling their own chips. The gap is real; the timing is no coincidence; the calendar tips the scales toward defense. Whatever else it does, the program buys the loyalty of the layer beneath the hyperscalers, the independent clouds with no silicon of their own; at the moment, the layer above turns competitive. The revenue-share ties their economics to Nvidia’s; the credit-support makes Nvidia the reason some of them can exist at all.

There is a sharper edge, and it is the subject of the next piece. Nvidia’s CFO frames the program as serving companies that have demand but cannot secure financing fast enough; even long-term commitments haven’t unlocked the capital.[9] That describes the borrowers that conventional lenders turn away.

Firmus is a large greenfield campus and is not obviously a distressed borrower. Sharon AI, the other named partner, is another matter: it was listed on Nasdaq in February and carries a market capitalization above a billion dollars on almost no revenue, and its financing stack and headline contracts are already the subject of a detailed short-seller report.[10] I’ll take those allegations through the primary filings next. Nvidia, for the record, holds no equity in it; the hold runs entirely through the revenue-share and the credit line.[11]

The backstop was always there; on July 1, it got a name, which is what usually happens to an improvisation just before it becomes a system. Whether it is mostly defense or mostly reach, the next deals will say. If the template stays with capital-constrained clouds, it is the base-reinforcement it looks like; if Nvidia extends it to well-funded clouds that could finance the GPUs themselves, the defensive read was wrong, and this is Nvidia annexing cloud economics wherever it can. Either way, the neocloud it piloted on is where the risk is hiding, and the filings are where the next piece goes.

Notes

[1] NVIDIA returned approximately $20 billion to shareholders in Q1 FY2027, and its board authorized an additional $80 billion in repurchases on May 18, 2026: NVIDIA Q1 FY2027 results (Form 8-K), SEC EDGAR. The $25 billion multi-tranche notes offering priced on June 18, 2026: NVIDIA Form 8-K, June 18, 2026, SEC EDGAR.

[2] NVIDIA Unlocks AI Compute at Scale, NVIDIA blog, July 1, 2026 (co-authored by CFO Colette Kress).

[3] Jensen’s COMECON: How Nvidia Built an Empire of Captive Clouds, The AI Realist, Feb. 14, 2026.

[4] Firmus scale from NVIDIA blog [2]; Sharon AI terms (six-year collaboration, 72MW of new Australian capacity, up to 40,000 Grace Blackwell GB300) from SharonAI Holdings, “Six Year Strategic Compute Collaboration with NVIDIA,” June 12, 2026 (BusinessWire; corresponds to the Company’s Form 8-K filed June 12, 2026).

[5] The credit-support and backstop model packages arrangements Nvidia previously ran case by case — a demand backstop with CoreWeave and a reported ~$30 billion equity investment in OpenAI (a separate data-center lease guarantee was reported to be under discussion, not executed, as of mid-2026): AI Weekly, July 2026.

[6] Sundar Pichai, Alphabet Q1 FY2026 earnings call, April 29, 2026: Google to sell TPUs to a “select group of customers,” Data Center Dynamics.

[7] AWS signaled external Trainium sales in Andy Jassy’s April 2026 shareholder letter (The Next Web); AWS’s Peter DeSantis confirmed exploratory talks in June 2026 (reported by Bloomberg; summary).

[8] Two Chips, One Decade, One Winner, The AI Realist, May 27, 2026.

[9] CFO framing that the program targets companies with demand but insufficient access to financing: Nvidia launches revenue-sharing model, Yahoo Finance, July 2026; see also NVIDIA blog [2].

[10] Bleecker Street Research, “SharonAI (SHAZ),” April 30, 2026. Report authored by a short seller with a disclosed position; allegations to be examined against primary filings in the follow-up piece.

[11] SharonAI corrected its FY2025 Form 10-K, which had described NVIDIA as a “strategic shareholder,” to state that NVIDIA holds no equity securities of the company: SharonAI Holdings Form 8-K correction.

Disclosure: Simcon, used here as a worked example, is a portfolio company of Fortino Capital, where I am an AI operating partner. I’ve kept this piece to what Simcon has already made public, and the live demo is open to anyone.

The conversation about generative AI has narrowed to two things it does extremely well: write text and write code. But that is a small slice of what the underlying machine turned out to be good at.

The transformer was built for language. Then it generalized. The same architecture that predicts the next word learned to generate images, then to model protein structures, then to forecast time series and weather. Each jump landed in a domain that looked nothing like the last, and each time the lesson repeated: feed a transformer enough diverse examples of a thing, and it learns a representation of that thing general enough to handle inputs it never saw.

So here is the question that follows naturally and almost nobody is asking out loud: what happens when you point it at industrial engineering data and complex 3D physics? Not text, not pixels: the airflow over a car, the heat moving through a turbine, the way molten plastic fills a mold. The data that engineers generate daily by the terabyte, which never touches the public internet.

Subscribe now

The part of AI that doesn’t read

Everything the frontier labs compete on is trained on the internet: text, code, images, and video. That data is effectively a global commons: everyone scrapes the same web, so no one owns the input.

The physical world is the opposite. The data that describes it lives inside the companies that build things, and it never gets posted anywhere. Decades of crash tests, wind-tunnel runs, thermal cycles, material trials, and — the unsung hero of modern engineering — simulation results. Before a car, a phone case, or a medical device gets built, engineers simulate it. Simulations are used to predict and optimize the quality and cost issues that will arise during manufacturing and how the parts will behave in the real world. The result is fewer costly defects in the real world. To predict the physics, they run numerical solvers that chew through large systems of partial differential equations, which is computationally intensive. These runs are slow, expensive, and have been the backbone of industrial design for decades.

They are also a training set. Every solver run is a labeled example: this target geometry, these conditions, this outcome. A company that has run millions of them is sitting on something no web scraper can ever reach.

The bet behind Physics AI is that you can train a model on that simulation output, the way a language model is trained on text, and get a network that has, in effect, learned the physics. Not the equations. The behavior. Feed it a shape it has never seen, and it predicts the result, in seconds, without solving anything.

The category now has a name: Large Engineering Models. The label is deliberate. It claims the same lineage as Large Language Models — the same transformer architecture underneath, the same idea that scale and diverse data produce something that generalizes — but is trained on the physical world rather than language.

Why this didn’t work before

Engineers have wanted fast simulation forever, and the idea of replacing a slow solver with a fast approximation is old. The approximations are called surrogate models, and until recently, they came with a catch that made them nearly useless for real design work.

A classical surrogate is fitted to a specific problem. Train it on one family of parts, and it interpolates nicely within that family. It also falls apart the moment you hand it a geometry it hasn't seen before. It learned the answers, not the physics. Engineers got a tool that was fast exactly where they didn’t need help and unreliable everywhere they did.

The numerical solvers had the opposite profile: accurate and trustworthy across any geometry, but far too slow to run inside a design loop. So the trade-off stood. Fast or general: pick one.

What changed is the architecture. The transformer — the same design that made language models work — turns out to be good at consuming large, diverse collections of physical examples and learning a representation that holds up on inputs it was never trained on. The published method these systems draw on, Universal Physics Transformers, was demonstrated on automotive aerodynamics in a 2025 peer-reviewed paper. [2] The detail that matters for a non-specialist is simple: it was built to generalize across shapes, not memorize a few. That is the wall the old surrogates hit, and it is the wall the new models are designed to go through.

Fast and general, at the same time. That is the whole claim. Everything else is engineering.

A real-life LEM you can run in a browser

Abstractions are easy to oversell, so here is a concrete one: plastic injection molding, in a corner of manufacturing that most people never think about. It is how a staggering share of the plastic object parts around you were made: caps, casings, connectors, dashboards. A mold costs six or seven figures and takes months to design. Get the design wrong, and the plastic will not fill the cavity properly. And you will only find out after the steel is cut.

So engineers simulate the fill first. Historically, that meant a numerical solver and a wait of minutes to hours per design, which in practice limits how many variations you can reasonably try.

This is where domain expertise and data decide everything, and it is Simcon’s. The German company has developed injection-molding simulation software for over 35 years, used by manufacturing world leaders such as Bosch, Continental, Roche, and Arburg. And now they’ve built, trained, and deployed a Transformer-based model for 3D physics.

Their Cadmould AI Solver is trained on millions of simulation runs generated by their own numerical solvers — the proprietary ground truth I described earlier, accumulated over decades and turned into a training corpus no one else has. The architecture came from a research collaboration; the physics, the data, and the validation are Simcon’s, and the company now owns the model outright, trains it in-house, and runs the cloud infrastructure that hosts it for customers. [3] Simcon bills it as the first Large Engineering Model for injection molding. Results in seconds instead of hours, a speedup the company puts in the range of 200 to 1,000 times, across part shapes the model was never trained on. [4]

You don’t have to take the number on faith. Simcon put a research preview on the open web. It runs in a browser, on a mid-tier cloud GPU, and the geometries it ships with were explicitly not in the training data, to show it generalizes rather than parrots. [5] You change a parameter, you watch the fill pattern redraw, you change it again. The hours-long loop becomes a conversation. Anyone reading this can try it online, and you can also schedule a demo with the Simcon team.

The current model covers the filling stage of the molding process. The cooling, shrinkage, and warpage steps, which are decisive for many real-world outcomes, are on the roadmap. Accuracy is reported within a few percent of the numerical solver and improves as the training set grows. [6] The AI is a fast compass for exploration, and you can still validate the chosen design with the classical solver before cutting steel. That framing — AI to explore, trusted solver to confirm — is the sober version of the technology, and it is more convincing than a claim of replacement.

It is also more than a division of labor. The two engines feed each other. The model lets engineers explore thousands of designs in the time it would take the solver to check one; the solver then verifies the chosen design at full accuracy — and every such verification run is a fresh, high-fidelity training example for the next version of the model. Fast exploration surfaces the designs worth checking; precise validation turns the checks into new data; the new data makes the next model better at exploring. The loop closes in favor of whoever owns both engines. A company with only a fast model has a clever demo. A company with only a solver has what the industry already had. The advantage goes to the one running both, because each loop around widens the lead.

Why Europe, for once, is well positioned

The reflex in any AI story is that the US trains the biggest models and Europe writes the rules. In language, that is broadly true. Large Engineering Models invert one piece of it.

The scarce input here is not compute or web text. It is high-fidelity physical data from real industrial processes that lives disproportionately within European industry. Europe’s manufacturing sector holds potentially a century or more of accumulated knowledge and data: how materials behave, how processes fail, how a good part differs from a bad one, captured across generations of engineers and now sitting in solver archives, test logs, and process records.

A model is only as good as the data and the domain knowledge behind it, and those don’t transfer in a deal. They sit with the companies that have spent decades generating high-fidelity physical data — most of them industrial firms, many of them European, none of them frontier labs.

That is the moat. It is the one input a frontier lab cannot buy, scrape, or out-compute, and it is the thing that looks like a legacy liability in the software era right up until it becomes the training corpus for an entire category. Germany’s machine builders, the automotive supply chain, the molders and tool shops: each is a reservoir of exactly the data these models need, and the web does not contain. A simulation company with 35 years of its own solver output turning into a defensible AI asset is not a fluke. It is the shape of the whole opportunity.

This is also why the European Commission, in its Apply AI Strategy last October, named manufacturing a strategic sector and tied sectoral AI adoption to reducing Europe’s dependence on non-EU technology. [7] The advantage is not guaranteed — owning the data is not the same as building the models or the businesses on top of them, and that gap is where most of the value will be won or lost. But the raw material sits on the right side of the Atlantic, which is not something you can say about most of the AI race.

Why synthetic data isn’t enough

A common objection is that synthetic data dissolves the moat: if you can generate training data on demand, the proprietary corpora stop being scarce, and the advantage migrates back to whoever has the most compute.

However, this objection is weaker than it looks. Valuable synthetic data is not random data. It is data that captures the rare failure, the edge case, the point where the physics turns nonlinear, and a part that looked fine starts to warp during cooling. Knowing which scenarios are worth generating and whether a generated sample is physically trustworthy or quietly wrong is itself domain expertise. You cannot synthesize your way past not knowing what matters. Synthetic generation doesn’t remove the need for decades of accumulated know-how; it raises the price of admission to a layer where that know-how is even scarcer.

A model you can access in a browser is predicting the 3D physics of parts it never saw, in seconds, and a company that knows the cost of getting it wrong is putting it in front of customers — alongside, not instead of, the solver they already trust. The first models to read and write the world got the headlines. The ones learning to predict it may turn out to matter more to the people who build things, and Europe is holding more of the raw material than it has in any other part of this race.

The machines are starting to learn physics. The question worth asking is, who can you trust to teach them, and on whose data?

Notes

[2] Benedikt Alkin et al., “AB-UPT: Scaling Neural CFD Surrogates for High-Fidelity Automotive Aerodynamics Simulations via Anchored-Branched Universal Physics Transformers,” Transactions on Machine Learning Research, accepted October 2025 (arXiv:2502.09692). The published architecture targets automotive aerodynamics computational fluid dynamics; its application to injection molding is a separate, domain-specific implementation. Code released by Emmi AI on GitHub; paper on arXiv.

[3] Simcon GmbH, “SIMCON Unveils World’s First Large Engineering Model for Plastic Injection Moulding,” BusinessWire, March 18, 2026. The Cadmould AI Solver is described by Simcon as co-developed with Emmi AI on the model architecture; the training data, domain validation, and commercialization are Simcon’s per the company’s own product and scientific pages. CEO quote and product framing from the same release. BusinessWire.

[4] Speed range and “trained on over a million simulation trajectories” per Simcon’s product and technical pages; the 200–1,000× and “up to 1000×” figures are vendor-claimed and not independently reproduced. Trade-press coverage (Plastics Today, Plastics Technology, MoldMaking Technology, March 2026) repeats the “up to 1,000×” figure sourced to Simcon. Simcon.

[5] Research preview runs in-browser on a cloud GPU; Simcon states the demo geometries are not part of the training data. Live at simcon.ai. Simcon demo.

[6] Filling-stage scope, roadmap to packing/cooling/shrinkage-and-warpage, accuracy reported “within 2–5% of numerical methods,” and the explicit “explore with AI, validate with classical solver” workflow are all per Simcon’s public materials and CEO statements. Accuracy figures are vendor-claimed. Simcon scientific page.

[7] European Commission, “Apply AI Strategy,” COM(2025) 723, published 8 October 2025. The strategy names manufacturing among its strategic sectoral flagships (deploying “agentic” AI to optimise production lines, targeted Q4 2026) and frames sectoral AI adoption as part of strengthening European digital sovereignty and reducing dependence on non-EU technology providers. EUR-Lex.

Update, July 1, 2026: On June 30, Washington threw the switch again. Commerce withdrew its own June 12 export-control letter and cleared both Mythos 5 and Fable 5 for release. "Diversion risk," Secretary Lutnick's own term, decided the fate of both models in one sitting. Fable 5, Anthropic's flagship, is returning under the safeguards Washington requested. This is not a loose end. It is the American door doing what this piece describes: one government, on its own clock, deciding which model the world's leading AI lab is allowed to ship.

On the morning of June 26, 2026, OpenAI released its most capable model and refused to let most people use it. GPT-5.6 Sol, the new flagship, went out as a limited preview to a short list of partners whose names OpenAI had shared with the US government, with general availability promised within weeks. In the same announcement, the company objected to the arrangement it was complying with, writing that it did not believe “this kind of government access process should become the long-term default.”[1]

That afternoon, the Commerce Department signed a letter restoring a competitor’s restricted model to the hands of more than 100 vetted American organizations: Anthropic’s Claude Mythos 5, which had been dark for two weeks after the same government forced it offline.[2]

Same day. Two labs. The frontier of artificial intelligence moved behind a government desk, and one of the firms that walked through the door used its launch to complain about the door.

None of this existed 80 days ago. It is now how the frontier ships.

Three Doors, and None of Them Opens Outward

For two years, the question about frontier models was which one is best. That question is now close to useless, because the three blocs that produce and govern these models have each turned access to the best of them into a matter of state policy, in three opposite directions.

The United States gates its most powerful models to government vetting. The European Union writes rules for a frontier it does not lead, aimed mostly at models built elsewhere. China does the opposite of both: it ships its best models as free downloads, and those models now account for the majority of the world’s open-model traffic.

The American case is the loudest. Anthropic spent the spring restricting Claude Mythos, an unreleased model it said could find decades-old security flaws on its own, to a short list of trusted partners.[3] On June 2, the White House signed an order asking developers to grant the government up to 30 days of access to “covered frontier models” before release.[4] Ten days later, a Commerce directive pulled two Anthropic models offline worldwide in roughly 90 minutes, including one commercial product serving hundreds of millions of users.[5] Two weeks after that, the same agency let the more dangerous of the two back in, for the vetted few. OpenAI’s GPT-5.6 followed the identical pattern on the identical day.

The European case is the quietest and, on paper, the most powerful. On August 2, 2026, five weeks from now, the EU’s AI Office gains the power to demand information from frontier developers, order changes, levy fines, and recall models from the market.[6] The largest models in scope are American.[7] Europe’s own frontier model, a publicly funded open-source effort, won the right to be built six days before this writing.[8] It does not exist yet.

The Chinese case is the one nobody is regulating, and everybody is using. At the end of 2024, Chinese open-weight models accounted for about 2 percent of the tokens flowing through the largest neutral model router. By the middle of 2026, they carried roughly 60 percent of them while that router quadrupled in size.[9]

The three doors look like a menu of safety, regulation, and freedom. They are nothing of the kind, and the door that looks free is the one quietly moving the switch.

The American Door: From Secure-and-Release to Ask-Permission

To see how far the United States has moved, start with the moment it set the opposite precedent.

In February 2019, OpenAI announced a language model called GPT-2 and declined to release it, citing the risk of fake news and impersonation. The decision split the field: some read it as responsible caution, others as a marketing performance that withheld a research artifact while implying it was a weapon. Nine months later, OpenAI released the full model and reported it had seen no strong evidence of misuse.[10] The harms had not arrived.

The industry took a lesson from the episode, and it was not “withhold.” It was the opposite: secure, then ship. Red-team the model, write a system card, publish a responsible-scaling policy, and release through an interface you control. For seven years, that habit held on a single assumption: that the lab decides when a model goes out.[11]

2026 broke the assumption, and not because the labs changed their minds. The state intervened in the decision.

The opening move was Anthropic’s. In April, it launched Project Glasswing around Claude Mythos, a model it kept out of public release and handed to roughly a dozen launch partners and a few dozen more organizations under usage credits. Anthropic backed the restriction with findings, not just adjectives: it said Mythos had autonomously surfaced vulnerabilities that had survived decades of human review, including a 27-year-old flaw in OpenBSD’s networking code and a 16-year-old one in one of the most widely used media libraries in the world.[12]

Those specific findings hold up. The patches exist. The advisories are public. But the framing around them deserves the scrutiny that the access restriction prevents. When independent researchers got hold of cheaper, openly available models, several of the showcase bugs fell to them too, one to a model costing a fraction of a cent per query.[13] A widely respected security commentator who is hard on AI hype judged the danger credible, and noted in the same breath that calling your model too dangerous to release is an excellent way to build buzz around it.[14] Both things are true at once. A safety claim and a capability advertisement are not mutually exclusive, and when the model is locked away, the advertisement cannot be checked.

The second move was the government’s. On June 2, the White House issued an order creating a voluntary path for developers to give the government up to 30 days of pre-release access to the most capable models, paired with a classified, NSA-led process to define which models qualify based on their cyber capabilities. The order is careful to bar any mandatory licensing scheme.[15] It is an invitation, not a law.

The third move showed what the invitation is worth when the government decides not to wait for it. On June 9, Anthropic launched Claude Fable 5, a commercial model it described as a Mythos-class system made safe for general use, with sensitive requests routed to a tamer model.[16] Three days later, at 5:21 p.m. Eastern, a Commerce export-control letter required a validated license before either model could reach any foreign national, including Anthropic’s own foreign-national staff. Unable to filter users by citizenship in real time, the company took Fable 5 and Mythos 5 down everywhere. A model serving hundreds of millions of people went dark in about 90 minutes, over a jailbreak Anthropic said was narrow and reproducible on other public models.[17]

Read those three moves in sequence. The decision about whether the public can use the best American model has migrated from the lab to Washington. OpenAI says the broad release of GPT-5.6 is only weeks away, and it may be; staging is not the same as exclusion. But the most capable tier, in the window that decides who gets the edge first, is gated by government vetting, and “weeks away” is a promise, not a shipped product. The public gets the safe-for-general-use version, or it waits. GPT-5.6 on June 26 was not a new direction. It was the second lab arriving at the same door.

OpenAI was candid that Sol had not crossed its own threshold for critical cyber risk. The model was gated not because the lab judged it too dangerous to ship, but because the government asked and the lab agreed, while the two worked out the access framework that the June 2 order set in motion. What governs release now is not the model’s capability. It is who gets to say yes.

This is not a tidy story of state capture. The June 2 order is voluntary and forbids licensing. OpenAI publicly protested the very vetting it submitted to. And Anthropic is suing the administration that gates its models, after the Defense Department tried to brand it a supply-chain risk for refusing to drop two narrow limits on its product: no mass domestic surveillance, no fully autonomous weapons.[18] The contradiction runs deep enough to be comic: the United States government simultaneously treats Anthropic as a national-security risk and as the only frontier model it has cleared for use up to the Secret level.[19] Read charitably, that is two arms of government disagreeing in good faith about a real tradeoff. Read at the level of what happened on the ground, with a model pulled, a company branded, and a competitor handed the contract, it looks less like a safety policy than a fight over who holds the switch.

There is one more piece, and it belongs to the man who built the model that got pulled. Two days before Commerce pulled it, Anthropic’s chief executive published an essay calling for binding rules on frontier AI modeled on the FAA and aircraft: testing, auditing, and a government power to block a release it judges unsafe.[20] The authority that hit him two days later was not that one. A pre-release safety review is not an export-control recall, but the through-line is the same, and it is the uncomfortable part.

And here is the loop that makes the American door self-defeating. Each turn of the gate raises the cost and the political risk of depending on a controlled American model. Every enterprise that feels that cost starts looking for an alternative, the United States cannot reach. There is one. It is open, cheap, and Chinese. And the action that pulled Mythos was, by the government’s own reported concern, about keeping that very model away from China, which means Washington’s defense against Chinese AI is quietly herding the market into China’s arms. The tighter Washington shuts its door, the more of the world’s usage walks out the back.

The European Door: A Customs House on a Road It Doesn’t Own

Europe’s posture is the strangest of the three, because it is built around a gap.

The EU AI Act sorts general-purpose models by the compute used to train them. Cross a threshold of ten-to-the-25th operations and a model is presumed to carry “systemic risk,” which brings obligations to test it adversarially, assess and reduce its dangers, report serious incidents, and secure it.[21] These rules have been on the books since August 2025. What arrives on August 2, 2026, is the enforcement: from that date, the AI Office can compel information, mandate changes, fine a provider up to 3 percent of global revenue, and order a model pulled from the European market.[22]

The trouble is what that threshold now catches. 10^25 operations was the size of GPT-4 in 2023; the frontier has since run more than an order of magnitude past it, and the largest training run on record sits some fifty times above the line.[23] Dozens of models from a dozen labs now clear it. So the tier that the EU polices is not just the frontier. It is a rung below the leaders, who are American. Europe does have a lab on the other side: Mistral signed the same code. But it trails the models the danger conversation is about, and the continent has no model at the frontier that the rules were written to govern. Its answer to that gap is a consortium, selected on June 19, that won the right to build an open-source frontier model in all 24 official languages on European supercomputers, running on Nvidia silicon.[24] The model is a plan. The regulator is operational.

The European door mostly governs models built in America, which run on infrastructure largely owned by Americans. It is a customs house on a road it does not own. Yet, the rules have teeth, the fines are large, and governing the compliant is not nothing. Europe’s deeper power is the market itself: the threat of exclusion from 450 million consumers has bent more than one American product to Brussels rules before. But a recall and a market ban are both switches on someone else’s model.

The bloc that talks most about digital sovereignty has arranged to hold the off-switch for everything except a model it controls.

The Chinese Door: Why “Open” Doesn’t Mean Unlocked

China runs the opposite play, and on the numbers, it is winning.

While the United States restricts and Europe regulates, Chinese labs ship. DeepSeek, Alibaba’s Qwen, Zhipu’s GLM, Moonshot’s Kimi: a steady cadence of frontier-adjacent models released as free downloads under permissive licenses. The usage curve is the whole argument.

That router measures where developers send cost-sensitive work, not a census of all AI use, and over the same stretch, it grew fourfold, with coding rising to more than half of all traffic.[25] A separate count agrees from a different angle: on the world’s main model hub, Chinese developers accounted for roughly 41 percent of downloads over the trailing year, overtaking the United States.[26] The silicon underneath is increasingly China’s own, too; the leading open labs now train and serve on Huawei’s Ascend chips rather than Nvidia’s, so the diffusion no longer runs on hardware Washington controls. China did not just take a share. It took the majority of a market that quadrupled.

This is where the obvious objection arises. An open-weight model on your own machines has no off-switch. Nobody can revoke a file you have already downloaded. If that is true, then China’s door is not a door at all. It is an open field, and the symmetry of this whole piece collapses.

It does not collapse, because open weights are not open access.

Consider the model at the top of the open leaderboard. Zhipu’s GLM-5.2 has 744 billion parameters: about 1.5 terabytes of weights at full precision, roughly half that at the compressed precision most deployments use, every byte of which must sit in graphics memory at once. The reassuring figure you will hear, that only 40 billion parameters are active at a time, is a statement about speed, not memory: the whole model still has to be resident to run. In practice, that means a multi-node cluster of high-end accelerators, not a workstation or a laptop.[27] That is why the usage the router measures is hosted usage: these models are reached through an endpoint, DeepSeek’s own or a Western reseller’s, not run on the premises of the firms using them.

The switch, then, does not disappear. It relocates. It moves to the hosted endpoint, which can be suspended, rate-limited, geo-blocked, or repriced. And it moves to the data, because every prompt and every output now travels to whoever runs the endpoint: a provider under Chinese law if you call DeepSeek directly, or a Western intermediary with its own logs if you route through one. Calling a Chinese model through Azure removes the question of Chinese jurisdiction over your data while preserving the cost advantage; calling it directly does not.[28] The only path that escapes the endpoint entirely is self-hosting, and self-hosting the frontier is gated by capital, which puts it within reach of roughly the same set of organizations that could afford to buy into an American-vetted tier.

None of this shows up in the price comparison that pulls enterprises toward the Chinese door in the first place. The headline is real: the leading open models run at roughly a sixth of the per-token cost of the American frontier. But the rate card flatters the invoice. These models reason at length before they answer, spending tens of thousands of tokens on a single task, so the gap on the bill comes out narrower than the gap on the price list.[27] And the firm that tries to escape the endpoint by self-hosting trades the API bill for a six- to seven-figure cluster and a team to operate it. Most do the rational thing and stay on the hosted endpoint, which means staying on the switch. The cost advantage that makes the door attractive is the same force that keeps the buyer renting access instead of owning it. Cheap is the lure. The endpoint is the hook.

There is a second lock most analyses miss, and ordinary use does not pick it. The content controls are baked into the weights. Independent testing finds that Chinese open models, including DeepSeek and Qwen, refuse or steer away from Taiwan, Tiananmen, and Xinjiang, and that this steering persists in the weights even in locally run copies. Standard fine-tuning does not remove it. It can be stripped: the abliteration methods that tear the safety scaffolding out of open models also work here. But doing so takes deliberate effort, costs capability, and never fully succeeds, and the fact that you must operate on the weights at all to get a neutral answer is itself the tell. An open-weight model is not neutral. It ships with a foreign government’s preferences embedded in its parameters, and the zero price that makes it spread carries those preferences along.[29] That split is the whole posture. At home, China runs one of the tightest content systems in the world, every public-facing model registered and assessed by the state; abroad, it gives the models away.

One last item belongs here, and it weighs against the American gate, not the Chinese door. On June 10, Anthropic told the Senate Banking Committee that operators tied to Alibaba and its Qwen lab had run roughly 25,000 fraudulent accounts and 28.8 million exchanges against Claude to copy its abilities by extraction rather than training.[30] Treat it as an interested party’s allegation, because it is one: it comes from the company with the most to gain from the gating system, filed the same week its chief executive called for government power to block model releases. But if it is true, it lands on the gate, not the open door. You cannot lock up a capability that walks out through your own interface, 28.8 million exchanges at a time.

The Same Switch, Installed Three Ways

Readers of this publication have seen this shape before. An earlier piece mapped a three-layer off-switch over any AI dependency (the chips, the cloud, and the model) and asked what happens when someone throws it on purpose rather than by accident.[31] What 2026 added was the installation of that switch at the national policy level across three countries at once, by three governments that agree on almost nothing.

The seven-year settlement that followed GPT-2 rested on one quiet premise: the lab decides when a model ships. All three blocs have now broken that premise from different directions. The United States moved the decision to Washington and made the best models a government-vetted tier. Europe claimed a veto, the recall, over models it did not build. China dissolved the decision at the license layer and reinstalled it twice, at the endpoint and inside the weights.

What the three share is not motive. The United States is keeping its frontier from China and fighting itself over who holds the gate, Europe is compensating for an industry it lacks, and China is doing what a challenger does when it cannot win the top tier outright: giving away the layer below it, whether by design or by the plain logic of competition, until the incumbent’s moat is a commodity. What they share is the result, and the result lands on the same person every time: the enterprise downstream of all three now depends on a switch it does not hold, and on a body of law it did not write.

What Would Have to Break

On the only number that compounds, usage, the open door is winning. “Too dangerous for you” is losing to “free for everyone” in the market by a wide and widening margin.

But winning hides the trap. The enterprise that routes to the Chinese stack to get out from under the American switch lands on the Chinese endpoint’s switch and under Chinese data law, carrying a model with Beijing’s editorial line inside it. It did not escape control. It swapped Washington’s switch for Beijing’s, and took on Chinese data law in the bargain. Most of the firms making the move have not priced that.

Three developments would break this read, and each is worth watching.

1. A frontier-parity model small enough to self-host cheaply (a step change in compression, or a model under 100 billion parameters that matches the leaders) would open a switch-free door for real, and the argument that there is no such door would fail.

2. A US public tier that ships at full capability, with no detuned version held back, would end the two-class frontier and turn the vetting into a formality.

3. A government-vetted model that visibly stops harm and openly available models that would go on to cause harm would be the first evidence that the gate does safety work rather than turf-holding.

None of the three has happened yet. Until one does, the pattern holds.

The lesson for anyone allocating capital or choosing a stack is not a recommendation for one door over another. It is that the doors were never the choice they appeared to be.

So price the switch as what it is: not an outage risk to be solved with a second region, but a control risk that earns its own line in the vendor register, with a tested path to a second model and the standing assumption that the vetted tier and the open tier each carry a different hand, not no hand.

The one door that looks like freedom only moved the switch to a place you were not watching, and the bill for not watching comes due the first time someone decides to throw it.

Notes

[1] OpenAI, “Previewing GPT-5.6 Sol: a next-generation model”, June 26, 2026. The GPT-5.6 series (Sol, the flagship, plus Terra and Luna) launched as a limited preview to a small group of partners whose participation OpenAI said it had shared with the US government, with general availability planned within weeks. OpenAI objected to government-gated access as a long-term default and tied the step to its work with the Administration on the cyber Executive Order framework. System card: GPT-5.6 Preview. OpenAI states the model does not cross its critical cyber-risk threshold under its Preparedness Framework; the gating reflects caution and government request rather than a declared red line.

[2] US Department of Commerce letter from Secretary Howard Lutnick to Anthropic chief compute officer Tom Brown, Friday June 26, 2026, lifting the export-control license requirement for Claude Mythos 5 for entities named in the letter’s Annex A and their foreign-national employees. Mythos 5 only; the letter is silent on Fable 5, which remained restricted, with talks reportedly moving toward its release on an unclear timeline. Lutnick wrote that “appropriate safeguards are in place to permit certain trusted partners” to access the model. Reported by Semafor (Reed Albergotti and Ben Smith), “US releases powerful Anthropic model Mythos to some US companies”, June 26, 2026. The move came the same day as OpenAI’s GPT-5.6 limited release.

[3] Anthropic, “Project Glasswing: Securing critical software for the AI era”, April 7, 2026 — Claude Mythos Preview restricted to 12 launch partners (AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks, with Anthropic) plus roughly 40 additional critical-infrastructure organizations under $100M in usage credits; later expanded to about 150 more.

[4] The White House, Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security”, June 2, 2026 — Section 3 creates a voluntary framework for up to 30 days of pre-release government access to “covered frontier models,” designated through a classified, NSA-led benchmarking process; the order expressly bars any mandatory licensing, preclearance, or permitting requirement.

[5] See [17].

[6] European Commission, “Regulatory framework on AI”; AI Office enforcement powers (information requests, mandated mitigations, fines, model recalls) apply from 2 August 2026.

[7] The largest in-scope models by training compute are American (OpenAI, Google, Anthropic, xAI); see [23].

[8] European Commission, “Commission selects EUROPA consortium as the winner of the Frontier AI Grand Challenge”, 19 June 2026. The Domyn-led EUROPA consortium will build an open-source frontier model (400+ billion parameters, Mixture-of-Experts) in all 24 official EU languages, on EuroHPC supercomputers (up to 2.5% of capacity for one year) plus a reported 6,000-chip NVIDIA Blackwell cluster. The model does not yet exist.

[9] OpenRouter token-share data, corroborated by an OpenRouter–Andreessen Horowitz study of ~100 trillion tokens (relayed by South China Morning Post, December 8, 2025 — note SCMP is owned by Alibaba; cite the underlying study) and by Data Gravity, “China’s Open-Weight Takeover”, May–June 2026. Figures are hosted-API traffic on a developer-skewed router, not enterprise deployment.

[10] OpenAI, “GPT-2: 1.5B Release”, November 5, 2019 — full model released after a staged rollout, with no strong evidence of misuse reported.

[11] the-decoder, “From GPT-2 to Claude Mythos: the return of AI models deemed ‘too dangerous to release’” — on the industry’s shift to “secure-then-release.”

[12] Anthropic Frontier Red Team, “Assessing Claude Mythos Preview’s cybersecurity capabilities”, April 7, 2026 — autonomous discovery of zero-day vulnerabilities including a 27-year-old OpenBSD TCP SACK remote-code-execution flaw and a 16-year-old flaw in a widely used media library (FFmpeg, H.264), among thousands across major operating systems and browsers; a related 17-year-old FreeBSD NFS RCE was assigned CVE-2026-4747.

[13] AISLE (Stanislav Fort, founder), “AI Cybersecurity After Mythos: The Jagged Frontier”, April 7, 2026, with the full prompts and model responses published on GitHub. AISLE isolated the code behind Anthropic’s showcase vulnerabilities and ran it through small, cheap, open-weight models: eight of eight tested models detected the flagship FreeBSD bug, including a 3.6-billion-active-parameter model at $0.11 per million tokens, and a 5.1-billion-active open model recovered the core chain of the 27-year-old OpenBSD flaw. Corroborated by VentureBeat and CNBC, which note other firms (watchTowr, Vidoc) likewise reproduced Mythos results with public models. AISLE’s thesis: the moat is the system, not the model.

[14] Simon Willison, commentary on the Mythos restriction and on “too dangerous to release” as a buzz-building move, April 2026.

[15] See [4].

[16] Anthropic, “Claude Fable 5 and Claude Mythos 5”, June 9, 2026 — Fable 5 is the generally available Mythos-class model (a tier above the Opus class), carrying cybersecurity, biology, chemistry, and distillation safeguards that defer flagged queries to Claude Opus 4.8 (triggering in under 5% of sessions); Mythos 5 is the same model with those safeguards lifted, restricted to Project Glasswing partners. Both priced at $10/$50 per million tokens.

[17] On June 12, 2026 (5:21 p.m. ET), Commerce’s Bureau of Industry and Security issued an “Is Informed” letter to Anthropic under the Export Control Reform Act of 2018 (50 U.S.C. § 4817(b)(1)) and EAR § 744.22(b), requiring an individually validated export license before either model could reach any foreign national worldwide, including Anthropic’s own foreign-national staff (a “deemed export”). This is a license requirement under existing export-control authority, distinct from the June 2 executive order and not a finalized EAR rule. Unable to filter users by nationality in real time, Anthropic disabled Fable 5 and Mythos 5 globally and characterized the cited jailbreak as narrow and reproducible on other public models. Per Semafor’s reporting, the underlying US concern was that Mythos had reached partners seen as too closely linked to China (reportedly a South Korean telecom). As of publication, Fable 5 remained restricted. Reporting: Semafor (June 13 and June 26, 2026); The Conversation, “Why the US government shut down Anthropic’s latest Claude AI model”; Greenberg Traurig client alert, June 2026.

[18] Congressional Research Service, “Federal Government and Anthropic: Considerations for AI Innovation and Competition”; NPR, “OpenAI announces Pentagon deal after Trump bans Anthropic”, February 27, 2026. Dispute centered on Anthropic’s refusal to permit mass domestic surveillance and fully autonomous weapons use; DoD moved to designate Anthropic a supply-chain risk; a federal court blocked most of the designation as punitive.

[19] Center for American Progress, “The Trump Administration Is Trying To Make an Example of the AI Giant Anthropic”, March 4, 2026 — Claude described as the only frontier model cleared for US government use up to the Secret level.

[20] Dario Amodei, “Policy on the AI Exponential”, June 10, 2026 — proposing FAA-style mandatory third-party testing and auditing of frontier models, with government authority to block or reverse a release that fails safety standards. A pre-release certification proposal, distinct in kind from the June 12 export-control action.

[21] EU AI Act, Articles 51 and 55; presumption of systemic risk above 10^25 training FLOP; obligations include model evaluation, adversarial testing, systemic-risk mitigation, serious-incident reporting, and cybersecurity.

[22] European Commission, AI Act enforcement timeline; from 2 August 2026 the AI Office may issue information requests, require corrective measures, levy fines up to 3% of global turnover or €15M (whichever is higher), and ultimately restrict or withdraw a model from the EU market. “Recall” is used in the body as a plain-language gloss for that withdrawal/restriction power.

[23] The EU AI Act presumes systemic risk above ten-to-the-25th training FLOP, a level calibrated to GPT-4-class compute in 2023. By mid-2025, Epoch AI’s database identified 30+ models from roughly a dozen developers over that threshold — OpenAI, Google, Anthropic, Meta, xAI, and Mistral among them, alongside Chinese labs — with the count rising through 2026. The largest known training run, xAI’s Grok 4, is estimated at ~5×10^26 FLOP, roughly fifty times the line, and Epoch notes monitoring thresholds “may need to rise correspondingly over time” to stay focused on frontier capability. The systemic-risk tier is therefore a wide field below the capability frontier, not a roster of the most advanced models.

[24] See [8].

[25] See [9]. Router growth from roughly 5 trillion tokens per week (April 2025) to over 20 trillion (April 2026); coding rose from about 11% of usage to more than 50% over the period.

[26] Hugging Face, “State of Open Source on Hugging Face: Spring 2026”, March 17, 2026, reporting Chinese developers at roughly 41% of Hub downloads over the trailing year, overtaking US developers; grounded in the study “Economies of Open Intelligence” (851,000 models; 2.2 billion downloads). Disclosure: the author served as Chief Evangelist at Hugging Face through 2023; the Hub download figures are cited from Hugging Face’s own published report and corroborate, rather than originate, the OpenRouter traffic trend.

[27] GLM-5.2 specifications and self-hosting requirements: Z.ai model card; Simon Willison, “GLM-5.2”, June 17, 2026; Artificial Analysis. 744B total parameters (40B active, Mixture-of-Experts), ~1.5 TB of weights at BF16, all of which must reside in GPU memory; serving guides converge on multi-node accelerator clusters. Pricing runs roughly one-sixth of US frontier per token, but heavy reasoning-token usage (tens of thousands of tokens per task) narrows the real cost gap (Artificial Analysis). The capital constraint applies to frontier-parity open models; smaller self-hostable models (e.g., Qwen 3.5’s 0.8B–9B line) are not at the frontier.

[28] Data-jurisdiction handling for hosted Chinese models: calls to Chinese-operated endpoints route through Chinese-jurisdiction servers; Western intermediaries (e.g., Azure) eliminate that exposure while preserving cost. Independent provider documentation and analysis, 2026.

[29] Content controls in Chinese open models. Independent studies document that Chinese open-weight models (Qwen, DeepSeek, and MiniMax among them) are trained to refuse, deflect, or assert falsehoods on PRC-sensitive topics: Taiwan, Tibet, Xinjiang, the 1989 Tiananmen Square protests, and Falun Gong. Researchers describe this as “embedded local censorship” that sits in the base weights and persists even when the model is run locally. See, e.g., “Censored LLMs as a Natural Testbed for Secret Knowledge Elicitation” (March 2026), and “R1dacted: Investigating Local Censorship in DeepSeek’s R1”. Standard fine-tuning raises truthful-response rates only partially; weight-level intervention (abliteration / logit suppression, cf. arXiv:2505.23848) can reduce the bias at a cost in capability and never fully succeeds. The behavior tracks China’s requirement that public-facing generative-AI services be registered and security-assessed by the state (Interim Measures for the Management of Generative AI Services, effective August 2023, governing services with “public opinion attributes”). See also my earlier piece, “Open From Both Sides”, The AI Realist.

[30] Anthropic letter to US Senate Banking Committee Chairman Tim Scott and Ranking Member Elizabeth Warren, dated June 10, 2026, alleging the largest known distillation campaign on Claude — roughly 25,000 fraudulent accounts and 28.8 million exchanges between April 22 and June 5, attributed to operators affiliated with Alibaba and its Qwen AI lab, targeting agentic reasoning, software engineering, and long-horizon planning. First reported by Bloomberg (June 24); confirmed by CNBC and Reuters. Interested-party allegation; treat accordingly.

[31] “Access, Disable, Destroy”, The AI Realist — the three-layer coercion model over chips, cloud, and models.

In October 2025, a single fault in one Amazon data center in northern Virginia took down Signal, Snapchat, Epic Games, and much of the internet for most of a day.[1] There was a second hyperscale outage that week: an Azure Front Door failure that hit Heathrow and the Scottish Parliament. Seven months later, these outages have produced a piece of European law.

In the week of 22 June 2026, the European Commission is expected to find, provisionally, that Amazon Web Services and Microsoft Azure are “gatekeepers” under the Digital Markets Act, a designation no cloud provider has carried before.[2] A gatekeeper is a platform so entrenched that its customers cannot practically avoid it, and the designation imposes on it obligations the rest of the market does not bear. The remedies here aim to improve interoperability, ensure cleaner data portability, and reduce exit fees.[3]

Read the room before you read the regulation. The outage was an accident, and the cure is written for accidents. The thing that makes the cloud a question of sovereignty rather than reliability is not the accident. It is the day someone reaches for the off switch on purpose, and that switch is not on the menu.

Two laws, one month

The designation does not arrive alone. On 3 June, the Commission published the Cloud and AI Development Act, the centerpiece of its Tech Sovereignty Package and the most serious attempt yet to legislate European independence in cloud and AI.[4] Two instruments, weeks apart, aimed at the same dependence. One is a competition tool. The other calls itself sovereignty. Neither touches the two things that decide whether a cloud is sovereign: who operates the service, and who controls the chips it runs on.

The competition tool runs into a wall of arithmetic. Three American firms, Amazon, Microsoft, and Google, hold 70 percent of the European cloud market; the largest single European provider, whether SAP or Deutsche Telekom, holds 2 percent.[5] Against that backdrop, “easier to switch providers” means something specific and unhelpful: easier to switch from Amazon to Microsoft, and vice versa.

None of this makes the remedy worthless. The Digital Markets Act will lower egress bills and make multi-cloud architectures less painful, and contestability is a real good, whether or not it touches sovereignty. The point is narrower: a competition instrument is being read, in the political register, as a sovereignty win. It is not built to be one, and it cannot accidentally become one. Where the designation cannot reach, and where the sovereignty law chooses not to look, is the rest of this piece.

The off switch reaches the mundane

Where the off switch sits is settled, and I will not re-litigate it here. The law follows the company, not the server: a provider under United States jurisdiction can be ordered to produce data in its possession, custody, or control wherever that data physically sits. I traced that statutory chain in full in Two Sovereign Clouds, One Legal Wall.

What is new is the evidence that the switch reaches past the obvious targets. On 22 May 2026, the Dutch outlet Vrij Nederland reported that Microsoft had handed the US House Judiciary Committee the internal emails, meeting notes, and calendar entries of named officials at two Dutch regulators, the competition authority and the data protection authority, without redacting their names.[6]

Ordinary European civil servants, doing ordinary European regulatory work, have their correspondence produced to a foreign legislature because the company holding it answers to that legislature’s law. called it "extremely worrying" and raised it with the US ambassador.[7]

That matters because, until now, the switch had mostly been thrown against the conspicuous: an ICC prosecutor under US sanctions and a Rosneft-linked refiner under EU sanctions, once under American law, once under European, the customer’s own location irrelevant in both. The objection writes itself: those were sanctioned parties. But the Dutch case is different. The exposure is not a property of being sanctioned. It is a property of whose jurisdiction your operator holds, and the Digital Markets Act’s portability remedy does nothing to change that, because it moves you between two operators who answer to the same one.

The sovereignty law that de-chipped itself

Set the competition remedy aside and read the Commission's proposed Cloud and AI Development Act on its own terms. It is the most serious sovereignty framework Europe has produced, and its seriousness is the problem. The Act defines four assurance levels, weakest to strongest.[8] Level 1 is data residency. Level 2 adds independence from third-country interference and transparency in the software supply chain. Level 3 requires the provider to be owned and controlled from within the EU, with criteria that extend to personnel's nationality. Level 4 demands full command of the software supply chain.

The Commission’s own impact assessment aligns the levels with current supply and is candid that most public-sector workloads will sit at Levels 1 and 2, which the American hyperscalers reach through their “sovereign” offerings.[9] Only a narrow band will require Levels 3 and 4. There is a sharper irony one rung up: Level 2 asks a provider to demonstrate independence from third-country interference. A US hyperscaler “sovereign” tier claiming Level 2 is certifying, on paper, an independence its own counsel told a parliament it does not have.[10] And Level 3, the rung that is supposed to signify European ownership, contains a clause that allows the Commission to recognize third-country providers.[11] The most European tier has a door in its back wall.

Then there is the part the proposal leaves out. The Commission already had a sovereignty yardstick that required a full EU supply chain, including chips.[12] When it put €180 million of its own sensitive workloads out to tender in April, no bidder reached that tier; the cleanest qualifiers cleared the rung below it, on a commodity stack.[13] Yet when the legislative text arrived in June, CADA did not carry the chip across. Its assurance levels grade the software supply chain and stop there; Annex II places hardware "outside of the scope" of the sovereignty assessment.[14]

The yardstick that scored the chip was one that the Commission could publish alone; the proposed law dropped the one rung nobody could meet. A sovereignty framework that cannot describe a sovereign chip has decided not to try. The money agrees with the edit. The Act’s financial statement carries roughly €25 million across 2028 to 2034, against a build-out it says needs three to four billion euros per gigawatt and tens of gigawatts of new capacity.[15] That is not a budget. It is a signature.

The switch nobody scores

The de-chipping matters because the hardware is where the off switch is most absolute, and it is the layer that assurance levels now refuse to look at. Not one of the four scores the silicon. A workload can sit at Level 4 and run end to end on Intel processors and Nvidia accelerators; the software supply chain can be wholly European while the chips answer to Washington. I have written separately about how far that dependence runs below the silicon; the point here is only that CADA’s own top tier now stops precisely where that dependence begins.

It is not hypothetical. In January 2025, the outgoing US administration’s AI Diffusion Rule sorted the world into tiers for access to advanced AI chips and placed much of the EU, including Poland, Portugal, and most of the bloc’s east, in the second tier with capped access; the rule was rescinded that May, two days before it took effect, in a decision as unilateral as its drafting.[16] Congress, meanwhile, is advancing the Chip Security Act, which would require location verification for exported AI chips. It cleared the House Foreign Affairs Committee unanimously in March 2026, and while it is not law, the fact that chip-tracking is on the table in Washington tells you where hardware sovereignty is decided.[17]

What honesty would look like

None of this means the pragmatism is wrong. Given the state of European supply, no law could wall the public sector off from American providers without being unenforceable on contact, and removing a sovereign-chip tier that nobody can meet is more honest than pretending otherwise. A version of the Act that said plainly, strict sovereignty over a critical core and pragmatism on the rest, would be defensible. The Commission’s own Cloud III procurement showed in April that a real requirement pulls a real response, when two clean European providers, Scaleway and STACKIT, qualified for sensitive workloads on a commodity stack.[18]

The problem is not the pragmatism. It is the packaging. A competition remedy that makes the American duopoly easier to move within is being sold as a step towards sovereignty. A sovereignty law whose own grades never reach the chip is being sold as the thing that will end the dependence. Present either as what it is, and both are defensible; present them together as a sovereignty agenda, and you install the ambiguity in which sovereignty-washing lives, a term the European Parliament’s own research service now uses in print.[19] Call the hyperscalers’ improved offerings what they are: trusted cloud, resilient cloud, real operational progress. Sovereign, no.[20]

Presenting the package on 3 June, the Commissioner responsible, Henna Virkkunen, said the aim was to ensure no provider of critical services holds a "kill switch" over Europe.[21]

The EU's record on targets like this is not encouraging: the 2023 Chips Act aimed to double Europe's share of global semiconductor production to 20 percent by 2030, attracted more than €52 billion, and left the bloc below 10 percent.[22] The number of cloud laws built to move is the same kind; the share of the European cloud market held by European providers is stuck near 15 percent, while three American firms hold 70 percent.

If it has not turned by 2030, Europe will have regulated its dependence twice, relabelled it once, and changed it not at all, and the off switch will sit where it sits today, in the one place no assurance level dares to score.

Notes

[1] On 20 October 2025, a DNS race condition in Amazon Web Services’ US-EAST-1 region (northern Virginia) cascaded across dependent services for roughly fifteen hours, affecting Signal, Snapchat, Epic Games and more than a thousand others; AWS published its post-mortem three days later. The outage was the proximate trigger for the EU’s cloud market investigation. ThousandEyes outage analysis, 20 October 2025.

[2] The Commission is reported to be preparing preliminary findings, expected the week of 22 June 2026, that AWS and Microsoft Azure meet the requirements for gatekeeper designation under the Digital Markets Act, with a final decision expected by end-2026. The Next Web, citing Bloomberg.

[3] Reported obligations under discussion include interoperability, data portability and curbs on customer lock-in such as egress fees. The Next Web.

[4] Cloud and AI Development Act, European Commission, published 3 June 2026 as the centrepiece of the European Technological Sovereignty Package. European Commission; Covington, Inside Global Tech, 11 June 2026.

[5] Synergy Research Group: Amazon, Microsoft and Google together hold about 70 per cent of the European cloud infrastructure services market (IaaS, PaaS, hosted private cloud); among European providers, SAP and Deutsche Telekom lead with roughly 2 per cent each (2024 data). Synergy Research Group.

[6] Vrij Nederland, 22 May 2026, reporting that Microsoft transmitted unredacted internal emails, meeting minutes and calendar entries of named civil servants at the Authority for Consumers and Markets (ACM) and the Data Protection Authority (AP) to the US House Judiciary Committee. NL Times.

[7] The named officials include staff at both regulators and a University of Amsterdam researcher; the Dutch cabinet called the episode “extremely worrying,” noting the named individuals could face travel bans or sanctions, and State Secretary for Digital Economy and Sovereignty Willemijn Aerdts raised the matter with US Ambassador Joe Popolo during her introductory meeting with him. Built In EU; DutchNews.nl.

[8] CADA defines four “Union assurance levels” for public-sector cloud and AI procurement. Level 1 (data residency) is the floor for all providers serving the public sector; Levels 2–4 add an independent third-party audit examining EU-located staff, whether provider data is used to train AI models, software supply-chain security, and a European cybersecurity certificate rated at least “substantial.” “Control” is defined by reference to the European Defence Fund “decisive influence” test (Art. 2(21)). European Commission; Wilson Sonsini, June 2026.

[9] CADA impact assessment, Part 1, p. 41, maps each level onto an existing market segment in near-verbatim terms (Level 1: “US hyperscalers generally all have offerings that would allow them to qualify”; Level 4: “some emerging EU offerings”). The assessment twice instructs that risk assessments “consider the reality of the supply market to avoid… mandating the use of services that don’t exist (yet)” (pp. 40, 49). Its demand model splits public-sector use cases 70/20/9/1 across Levels 1–4 and sizes the exclusively EU-addressable market at roughly €4.48 billion by 2030 (pp. 47, 72–73).

[10] CADA, Level 2 criterion requiring providers to demonstrate independence from third-country interference (Art. 2(g)(ii)). The Commission’s own impact assessment (Part 1, pp. 14–15) recounts the Microsoft France testimony before the French Senate procurement inquiry, June 2025: “Non, je ne peux pas le garantir, mais, encore une fois, cela ne s’est encore jamais produit.” Sénat, compte rendu.

[11] CADA, Level 3 requires the provider to be owned and controlled from within the EU, with criteria such as personnel citizenship; the Commission’s own summary states it “can recognise third-country providers” under the framework. European Commission; see also techUK, June 2026, which calls the third-country recognition mechanism “one of the most important aspects” of the legislation.

[12] The Commission’s Cloud Sovereignty Framework (Version 1.2.1, published 20 October 2025) defines a five-rung scale of Sovereignty Effectiveness Assurance Levels (SEAL), from SEAL-0 (no sovereignty) to SEAL-4 (Full Digital Sovereignty: complete EU control across the supply chain, hardware included). CADA codifies a four-level version of this framework as binding “assurance levels,” and, as Annex II makes explicit, drops hardware from scope in the process. European Commission, Cloud Sovereignty Framework v1.2.1; analysis in More Sovereign, Different Stack: The Builder Tax.

[13] European Commission, Cloud III procurement, awarded 17 April 2026: a Dynamic Purchasing System worth up to €180 million over six years for sensitive EU institutional workloads. SEAL-2 was the minimum threshold; the cleanest prequalified consortia, Scaleway and STACKIT, cleared SEAL-3 on commodity-stack architectures, and none reached SEAL-4. European Commission; see Ten Percent Sovereign and The Builder Tax.

[14] CADA, Annex II, scope paragraph, excludes hardware verbatim: “’Hardware’ within the meaning of Regulation (EU) 2024/2847, Article 3, point (5) is outside of the scope.” Hardware survives only as a contract-award criterion that is “ancillary and not decisive” (Art. 32(2)(d)), feasibility-qualified, and capped by Recital 67 at a suggested maximum of 15 of 120 points. European Commission; Covington, Inside Global Tech, 11 June 2026 (confirming the 15-of-120 weighting).

[15] CADA legislative financial statement: total appropriations of €25.228 million across 2028–2034, fee-financed, supporting roughly 25 full-time staff. The impact assessment’s central scenario calls for a tripling of EU data-centre capacity against an estimated 19 GW gap, at a build-out cost of roughly €3–4 billion per gigawatt. European Commission.

[16] The AI Diffusion Rule (interim final rule, 15 January 2025) established a tiered framework for access to advanced AI chips, placing NATO members including Poland and Portugal in the second tier with capped access; BIS rescinded it on 13 May 2025, two days before its scheduled 15 May effective date. United States Studies Centre; U.S. Department of Commerce, BIS.

[17] The Chip Security Act (H.R. 3447) passed the House Foreign Affairs Committee 42–0 on 26 March 2026 and proceeds to the full House; it has not been enacted. Nvidia opposes a tracking mandate, stating its products contain “no backdoors” and “no kill switches,” while since December 2025 offering optional software to trace its GPUs’ location. House Foreign Affairs Committee; Geo News, citing Reuters.

[18] Commission Cloud III procurement, awarded 17 April 2026: under a genuine sovereignty requirement, the cleanest prequalified consortia, Scaleway and STACKIT, cleared SEAL-3 (one tier below the unmet SEAL-4). European Commission; see The Builder Tax.

[19] The term “sovereignty-washing” appears in the European Parliament’s research output describing hyperscaler “sovereign cloud” offerings. European Parliament, “European Software and Cyber Dependencies,” PE 780.413/778576, December 2025.

[20] Disclosure: the author is an AI Operating Partner at Fortino Capital, a European private equity firm whose portfolio includes companies whose cloud architecture decisions fall within the scope of this analysis; he previously spent six years at AWS and was Chief Evangelist at Hugging Face. The disclosure names the interest; it is not an endorsement of any provider or procurement choice.

[21] Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, at the press conference presenting the European Technological Sovereignty Package, Brussels, 3 June 2026: the Commission wants to ensure no cloud provider of critical workloads holds a “kill switch” over essential European services, and observed that the US CLOUD Act makes it “difficult” for US companies to reach the highest sovereignty levels. CNBC, 3 June 2026.

[22] The 2023 EU Chips Act mobilised more than €52 billion toward a target of doubling the EU’s share of global semiconductor production to 20 per cent by 2030; the EU’s share remains below 10 per cent, prompting the demand-focused Chips Act 2.0 in the June 2026 package. TechPolicy.Press, June 2026.

In 2024,, the European Commission went looking for someone to evaluate the world’s most powerful AI models. The post was the lead scientific adviser to the AI Office, the person who would sit across from OpenAI, Anthropic, and Google and judge whether their frontier systems were fit for placement on the European market. The application window opened, then closed in December. Months later, the chair was still empty.[1]

The pay explains some of it. The Office’s technical roles top out near $120,000, and even its senior posts sit on fixed civil-service scales the labs beat several times over for the same skills, sometimes with seven-figure packages. The European pool for this work is thin enough that the strongest candidates already sit in San Francisco or London. The Office has since hired a small, capable safety team, with people from Oxford, Google, and the UK’s AI Security Institute.[2] But the seat reserved for the scientist who would lead the judging of a frontier model stayed empty as the start date approached. The authority is real. The question is the capacity to use it.

Step back from the hiring, though, and the opposite is just as true. On paper, the European Union has just built the most serious AI enforcer anywhere. The Digital Omnibus, voted through Parliament on 16 June, consolidated oversight of the largest models and AI across the largest platforms into a single office and gave that office the power to vet the highest-risk products before they ship.[3] A Scientific Panel of 60 independent experts was sworn in on 1 June to give it technical muscle.[4] A 174-member Advisory Forum sits alongside.[5] The obligations for general-purpose models have been in effect since August 2025.[6] By any measure of ambition, Brussels has done what Washington spent years declining to do: it built a standing regulator with the authority to test the frontier.

That empty chair is a small sign of a large problem. Europe’s frontier-AI evaluator can be independent or current, but not both, and the same shortage of methods, access, and people produces both limits. To judge the largest models as they exist, the Office has to borrow the labs’ tools, access, and talent, at which point it is grading the labs’ own homework. To build its own capacity instead and stop borrowing, it has to move at the speed of public hiring and public standard-setting, at which point whatever it certifies is a snapshot of a live model it has already outrun. The competence to evaluate a frontier model in real time exists almost entirely inside, or priced by, the companies being evaluated.

The homework problem

Start with what the law asks of a frontier developer, because it is less than most readers assume. A provider of a general-purpose model with systemic risk must run its own state-of-the-art evaluations, assess and reduce the risks it identifies, document all of this in a Safety and Security Model Report, and submit that report to the AI Office before the model reaches the market.[7]

External evaluation exists, but its shape tells you who is in charge. The Code of Practice that fills in the details requires a model developer to give independent, external evaluators access to its most advanced versions and to publish the standards by which it selects them. The provider grants the access, and the provider sets the bar for who qualifies. The requirement was nearly cut from the Code during drafting and survived only as mandatory “in most circumstances,” with an exemption allowing a model developer to claim it is as safe as one already cleared.[8] The outside check runs through a door the developer holds open. And as of mid-2026, the Office had not settled what qualifies someone to serve as an outside evaluator: it called a workshop for 15 July, weeks before its enforcement powers switched on, to take expert input on the question.[9]

This is not a flaw the Office can out-hire, because the people who would do the hiring face the wall the empty adviser’s chair revealed. And it is not solved by leaning on the independent evaluators who have made their names doing this work, because they hit the same door. The respected outside shops — METR, Britain’s AI Security Institute, Apollo, FAR.AI — operate under voluntary access agreements granted by the labs, and the labs can withdraw those agreements. When a lab has shared a model before release, the sharing has been thin: in the clearest recent case, a model developer handed an evaluator a safety-tuned version with no ability to fine-tune it, and one of the best-known evaluators appears to have had no special pre-release access since its early work in 2023.[10] Their independence is real on the org chart and thin where it counts: in what the lab lets them see.

So, where is Europe’s own capacity? It is real, and it sits one level up from the test. Between late 2024 and mid-2025, the Commission’s Joint Research Center ran a global expert pool to develop methods for sorting models into risk categories, and co-authored a paper with the AI Office, published in Science, on how to keep evaluation proportionate to risk. This is serious work. But it is rubric-writing: how to classify a model, where to set the compute thresholds, how to think about reach. The JRC’s own review of AI benchmarks catalogs how immature the field is, and its categorization work measures capability using the benchmarks that already exist, the ones the research community and the labs have built.[11] Europe can decide which models deserve scrutiny and to what extent. It cannot, on its own, put a frontier model through its paces.

Put the pieces together, and the first half of the trap closes on itself. To bind the frontier, the Office needs to evaluate the largest models close to real time. Real-time evaluation needs methods and access that live within the labs and the lab-adjacent shops at the labs’ gate. The Office cannot build that capacity fast enough, because it cannot pay for the people who have it. So the binding step falls back on the provider’s own evaluations, the provider’s chosen outside reviewers, and the provider’s report. No independent capacity accumulates, so next year the Office is no closer to building its own, and it borrows again. The Panel can raise a formal alert when it suspects a model carries serious risk, and that lever is real.[12] But an alert is a flag raised over a document that the model developer wrote.

The yardstick that never arrives

In principle, there is a way out of the borrowing: building an independent measure of its own. Europe tried. The result is the second half of the trap.

The AI Act’s binding requirements for high-risk systems were meant to rest on harmonized technical standards, the detailed yardsticks against which a system is judged. The Commission asked the European standards bodies to write them in 2023. They missed the 2025 deadline, the work continues, and the Commission has said the delay puts the timetable at risk. The first relevant standard reached public consultation in late 2025, months behind schedule, and standards of this kind typically take 2 to 4 years to complete. The Omnibus that Parliament just passed pushed the high-risk obligations out to the end of 2027 and tied their start to the readiness of those standards, conceding that it cannot set its own clock.[13]

The model layer repeats the problem in another form. The general-purpose rules are written to apply across a model’s life, including after updates, and a model developer is told to set their own trigger points for when fresh evaluation is due. But the binding re-assessment only fires when a change is large enough to count as a new model, and the indicative bar for that is a modification using more than a third of the original training compute, a threshold the Commission expects few to cross.[14]

Now both halves are visible at once, and they lock together. Every move the Office makes toward being current — lifecycle monitoring, live evaluation, judging the model as it is — runs through the developer, because only the developer has the access and the tools to do it at speed. And the one move toward an independent measure of its own — the standards — keeps slipping past its deadline. Currency by borrowing, independence by waiting: the Office cannot have both, because the thing that would let it be current without borrowing, a deep bench of frontier evaluators paid at market rates working from methods it owns, is the thing the empty adviser’s chair says it cannot afford to build.

What the Office can do

The safety unit is staffed with credible people, drawn from places that do this work.[2] The Scientific Panel is no roster of industry placemen: most of its 60 members are academics, a sixth come from the European machine-learning research network, and they sit in their personal capacity under conflict-of-interest rules.[4] These are serious researchers, several of whom would be at home in any frontier lab. The JRC’s methodological work is real and is being read.[11] The alert the Panel can raise is a true lever, and the Office now has the formal authority over the largest models and the platform-integrated systems that, until this year, were scattered across national capitals.[3] The enforcement numbers are not trivial: breaches of the general-purpose obligations carry fines up to the greater of €15 million or 3% of worldwide turnover.[15]

The law does not limit the Office to reading what it is sent. It can demand access to a model, through an interface or the source code itself, and run its own evaluation, with fines for a model developer who refuses.[16] But look at when it applies: to check compliance only once the developer’s own documentation is found wanting, or to investigate a serious risk after the panel raises a flag. It is the escalation, not the routine, and the default stays the model developer’s report. The rules for how such an evaluation would run have not yet been written. And a right to demand access is worth only as much as the capacity to use it: the methods, the compute, and the people it has already shown it lacks. A right of entry that the regulator cannot staff is a right on paper.

So the Office can decide which models matter. It can demand documentation. It can read a model developer’s report with expert eyes, push back, and escalate. It can fine a model developer who lies or hides. What it cannot do is the thing the public imagines a safety regulator does: take the live model, probe it deeply and repeatedly on its own terms, and certify the result against a yardstick it built and controls. Everything it does sits on top of artifacts that the model developer generated and access that the developer granted.

The fork the labs just got

There is one more actor, and it changed the board three weeks ago.

On 2 June, President Trump signed an order on advanced AI that does almost the opposite of what Brussels did. It establishes a framework for model developers to grant the federal government up to 30 days of access to their most powerful models before release, on a voluntary basis, with qualifying models selected by a classified benchmark, and with no mandatory licensing, no pre-clearance, and no right for anyone to sue to enforce.[19] Collaboration, the order says, not command. The administration had pulled an earlier draft in May for fear it would slow American competitiveness, and signed this softer version instead.[20] The same administration has stood up a task force to challenge state AI laws it considers too heavy.[21] The contrast with Europe could not be sharper: a voluntary American framework on one side, and on the other, binding European obligations carrying statutory fines that take effect this August.[22]

This matters to Europe’s evaluator because it hands the labs something they did not have before: a venue they prefer. A developer cannot lawfully step outside the AI Act for a model it places on the European market; the obligations attach on sale, wherever the model was built.[23] But “comply” and “comply fully, first, and openly” are different things.

This is not hypothetical: in 2024, one large model developer withheld its multimodal models from the European Union over what it called regulatory unpredictability, and a major device maker delayed its flagship AI features in the bloc on similar grounds.[24] The incentive to route cooperation toward the venue that creates no liability only sharpened the week of the order: the day before it, Anthropic filed a confidential draft registration with the SEC at a valuation near $965 billion, the kind of public-market stake that turns a European enforcement action into a disclosed risk on the prospectus.[25]

None of this loosens the bind; it pulls it tighter. The evaluator was already leaning on the access the labs chose to grant, and now the labs have a venue they prefer and a reason to give Brussels less of it. The access that was thin becomes contested ground, and the jurisdiction that wins it is the one the developers like better. Europe gets the companies willing to be examined, on their own terms; Washington offers those same companies an examiner who asks nothing it can enforce.

Europe has run this play before

If this reads like a forecast, it is not. Europe ran the experiment one regulatory generation back, on the platforms, using the same institutions it is now reaching out to. The AI Office and its Panel are built on the template of the European Center for Algorithmic Transparency: set up in 2023, housed in the same Joint Research Center that now serves the Office, and tasked with giving the Commission the in-house expertise to police the largest online platforms under the Digital Services Act.[26] Swap “platforms” for “models,” and the shape repeats: exclusive Commission supervision of the biggest players, backed by a technical body meant to do the evaluating. Its record is the closest thing we have to a forward look, and it is thin.

Two and a half years in, the platform rules have produced a single fine: €120 million against X in December 2025, in part for barring researchers from its data, with 60 days to fix rather than pay.[27] The open cases against Meta and TikTok turn on the same failure: researchers shut out of platform data.[28] The rules grant researchers a right to that data, and the platforms have spent years making it slow, conditional, or barred outright.

The pattern predates the platforms, and the AI lineage is direct. Europe’s chemicals agency checks only a fraction of the dossiers industry files on its own substances; the legal minimum rose from 5% to 20% in 2019, and when it does check, most fail: 61% of one early cohort fell short of what the law required.[29] Even a mature agency with real capacity can only spot-check a self-reported base, finding much of it wanting. The body that wrote Europe’s first AI principles fits the same shape: the 2018 High-Level Expert Group, heavy with industry seats and with only four ethicists among more than 50 members, produced ethics guidelines and a self-assessment checklist that one of its own called ethics-washing.[30] The Scientific Panel is its more independent, more technical heir, and still a body reading what developers choose to show it.

What would have to break

Europe escapes the trap if the Office can retain frontier evaluators at something near market pay, build a battery of tests it designs rather than borrows, win a right of deep access to live models instead of the access a developer grants, and track models as they change instead of certifying a version and moving on. Each of those is conceivable. None is close on the current path: the pay bands are public-sector, the standards keep slipping, the access is voluntary, and the talent the Office needs is being bid away by the firms it would evaluate and is now being courted by a friendlier government across the Atlantic. The honest probability, on today’s trajectory, is low.

Which leaves a verdict sharper than “the regulator is underpowered.” For anyone running diligence on an AI vendor, the practical reading is blunt: treat “AI Office-supervised” or “evaluated under the AI Act” as a provider-generated artifact, not an independent clearance, and price the difference. Europe has built a real enforcer that can read the labs’ homework, raise a flag over it, and fine a lab that hides the truth. What it cannot do is grade the frontier itself. And whichever way it leans, the only models it truly examines are the ones whose makers agree to sit the exam.

The systems that should worry you most are built to skip it: a model fine-tuned to strip its safety training and re-released by someone who never files with Brussels, a capable model served from a jurisdiction that ignores the Act (I’m looking at you, China), a model trained on smuggled compute by an actor with no European address to fine.

Once again, the cop that Europe built is aimed at the population that was already willing to be policed.

Notes

[1] The AI Office’s lead scientific adviser post — application deadline December 2024 — remained unfilled in mid-2026; the head-of-safety-unit role, vacant since the Office was set up, was filled in December 2025 (Matthieu Delescluse). Transformer News; MLex.

[2] Reported AI Office salaries: technical and contract-agent roles roughly $55,000–$120,000, the lead scientific-adviser post at grade AD13 (about €13,500–15,000 per month); EU staff also receive allowances and favourable tax. The figures still fall well below frontier-lab compensation, which can run to seven figures. Transformer News.

[3] Digital Omnibus on AI, consolidated text (Council doc ST 9247/2026 INIT); European Parliament plenary vote 16 June 2026. The AI Office gains centralized supervision over systems built on a same-provider general-purpose model and over AI integrated into very large online platforms, with Commission pre-market assessment for such high-risk systems; carve-outs leave certain products and uses to national authorities. European Commission, Regulatory framework on AI.

[4] AI Act Scientific Panel of 60 independent experts, established 1 June 2026 under Article 68 and Commission Implementing Regulation (EU) 2025/454 (7 March 2025); members serve in a personal capacity under confidentiality and conflict-of-interest declarations; most from academia, roughly a sixth from the ELLIS network. Implementing Regulation (EU) 2025/454; European Commission, AI Scientific Panel.

[5] AI Act Advisory Forum of 174 members under Article 67. European Commission, AI Advisory Forum.

[6] General-purpose AI model obligations have applied since 2 August 2025 under Regulation (EU) 2024/1689; the Office’s power to impose penalties for breaches applies from 2 August 2026. DLA Piper.

[7] Article 55 and the GPAI Code of Practice require providers of general-purpose models with systemic risk to conduct state-of-the-art model evaluations, assess and mitigate systemic risks, and submit a Safety and Security Model Report to the AI Office before placing the model on the market. Article 55.

[8] Under the GPAI Code of Practice (Safety and Security chapter), signatories must give independent external evaluators access to their most advanced models before deployment and publish their evaluator-selection criteria; the requirement applies “in most circumstances,” with proportionality and exemptions, for example where a model is no more capable than an existing open-weight one. Analysis of the Code.

[9] European Commission, European AI Office: “Call for participants: Workshop — qualification requirements for external evaluators of GPAI models with systemic risk,” 15 July 2026. European AI Office.

[10] Independent evaluators (UK AISI, METR, Apollo, FAR.AI) work under voluntary 2024–2025 access agreements the labs grant and can withdraw; pre-deployment sharing has been thin (in one case a safety-tuned model with no fine-tuning access; a leading evaluator with no special pre-release access since around 2023), and the evidence base is overwhelmingly behavioural. Seth & Sankarapu, arXiv:2605.15164 (Lexsi Labs, May 2026); AI Lab Watch; access-level taxonomy in arXiv:2601.11916 (Jan 2026), finding external evaluators are typically restricted to black-box access and cannot examine model internals.

[11] A paper co-authored by the AI Office and the Joint Research Centre, “The science and practice of proportionality in AI risk evaluations,” appeared in Science (vol. 391, 6 March 2026), translating the legal proportionality test into criteria for how demanding a model evaluation must be; the JRC also runs an expert pool on GPAI risk categorisation and has catalogued the immaturity of current AI safety benchmarks. Knowledge4Policy; Science; JRC, AI safety benchmarks report.

[12] The Scientific Panel may issue a qualified alert to the AI Office where it suspects a general-purpose model presents systemic risk; the alert is a trigger the Office may act on, not an automatic investigation. Article 90.

[13] Harmonised standards under standardisation request M/593 were requested of CEN-CENELEC in 2023, missed the 2025 deadline and remain in development; the first reached public enquiry in late 2025, and such standards typically take two to four years, with acceleration measures adopted in October 2025 targeting completion by late 2026. The Digital Omnibus ties the start of the high-risk obligations to their availability. TechPolicy.Press.

[14] General-purpose obligations apply across the model lifecycle, including post-market modifications, with provider-set evaluation triggers; a downstream modification is treated as a new model chiefly where it exceeds roughly one-third of the original training compute (indicative), a bar the Commission expects few to cross. European Commission, GPAI Q&A.

[15] Breaches of the general-purpose obligations carry fines up to the greater of €15 million or 3% of worldwide annual turnover; high-risk obligations are deferred under the Omnibus to 2 December 2027. Article 101.

[16] Article 92 empowers the AI Office, after consulting the Board, to conduct evaluations of a general-purpose model — to check compliance where information requested under Article 91 is insufficient, or to investigate systemic risk, in particular after a scientific-panel alert — and to appoint independent experts, including from the panel. It may request access via APIs or other means, including source code, with Article 101 fines for refusal; detailed arrangements await implementing acts not yet adopted. Article 92; European Commission, GPAI Q&A.

[19] Executive Order, “Promoting Advanced Artificial Intelligence Innovation and Security,” 2 June 2026: directs a framework for developers to voluntarily grant the federal government up to 30 days of pre-deployment access to “covered frontier models,” with covered models set by a classified NSA benchmark, no mandatory licensing or pre-clearance, and no enforceable private right. The White House; Crowell & Moring; Morrison & Foerster.

[20] The administration pulled an earlier draft of the order in May 2026 over concerns it would hinder US competitiveness, signing a softer version on 2 June. Crowell & Moring.

[21] The order establishes a Department of Justice task force to challenge state AI laws. Paul Hastings.

[22] US/EU divergence: a voluntary US framework versus binding EU general-purpose obligations with statutory penalties effective 2 August 2026. ComplianceHub.

[23] AI Act obligations attach when a model or system is placed on the EU market, regardless of where it was developed. Regulation (EU) 2024/1689.

[24] In 2024, Meta declined to release its multimodal Llama models in the EU, citing “the unpredictable nature of the European regulatory environment” (a text-only Llama shipped), and Apple delayed several Apple Intelligence features in the EU, citing Digital Markets Act uncertainty. Axios; 9to5Mac.

[25] On 1 June 2026, the day before the executive order, Anthropic confidentially submitted a draft S-1 to the SEC at a valuation near $965 billion (following a $65 billion round the prior week). Anthropic; Fortune; CNBC.

[26] The European Centre for Algorithmic Transparency (ECAT), established 2023 within the Joint Research Centre, gives the Commission in-house technical expertise to support its exclusive supervision of very large online platforms under the Digital Services Act. ECAT.

[27] First DSA non-compliance fine: €120 million on X, 5 December 2025, partly for barring researchers from effective access to its public data, with deadlines of 60 to 90 working days to remedy rather than pay. IAPP; Euronews.

[28] The Commission preliminarily found Meta and TikTok in breach of their obligation to give researchers access to public data (24 October 2025); across the DSA cases the recurring breach is denial of access, even though the law grants researchers a right to platform data. European Commission, preliminary findings; Science.

[29] Under REACH, the European Chemicals Agency checks only a fraction of industry-submitted registration dossiers: the legal minimum rose from 5% to 20% in 2019, and ECHA examined about 21% of full registrations (≈15,000) between 2009 and 2023; of 928 evaluations concluded in 2013, 61% were non-compliant with one or more information requirements, and in 2024, 313 compliance checks produced 208 data requests. ECHA.

[30] The High-Level Expert Group on AI (convened 2018) produced the Ethics Guidelines for Trustworthy AI (April 2019) and the ALTAI self-assessment checklist (July 2020); a member, Thomas Metzinger, publicly called the exercise “ethics-washing,” noting roughly four ethicists among more than 50 members and the absence of red lines. European Commission, High-Level Expert Group on AI.

On Friday, June 12, at 5:21 pm Eastern, Anthropic received a letter from the U.S. Commerce Department. By that evening, Fable 5 and Mythos 5 — the company’s two most capable models, launched three days earlier — were gone. Not throttled. Not region-locked. Gone, for every customer Anthropic has, including the banks and agencies that had been using Mythos-class capability for vulnerability discovery. [1]

The mechanism is worth getting right because most of the coverage has it slightly wrong. Nobody flipped a remote kill switch. The government issued an export-control directive citing national security authorities, ordering Anthropic to suspend access for any foreign national, whether outside the United States or within it, including Anthropic’s own foreign national employees. [2] That last reach is the sharp part: under the deemed-export doctrine, giving a controlled technology to a foreign national on US soil counts as an export to their home country, so the order swept in Anthropic’s own non-citizen staff alongside every user abroad. A company cannot filter foreign nationals from US citizens in real time across a consumer product, so the only way to comply was to disable the models for everyone. The order's reach did the work. The global takedown was the side effect.

In April, in an internal briefing for the CEOs of portfolio companies I help oversee, I argued that the defining feature of the AI security landscape is an asymmetry: defenders are governed, and attackers are not. Procurement rules, compliance regimes, and data-sovereignty constraints dictate which models a defender may run. Attackers self-host abliterated open-weight models — models with the refusal behavior surgically removed from the weights — and answer to none of it. June 12 is that asymmetry rendered in a single week.

Here is the sharpened version. The week the most heavily safeguarded frontier model on the market was withdrawn from the entire planet over a narrow, non-universal jailbreak, a bypass that unlocks one sliver of capability in one circumstance. The abliterated open-weight models on Hugging Face stayed exactly where they were. The platform’s own “obliterated” tag now returns over 7,000 of them. [3] No export order reaches those. There is no account to suspend, no API to revoke, and no US-jurisdiction entity in the chain to serve. The governed model can be removed from hundreds of millions of users by one letter. The ungoverned model cannot be removed from anyone by anything.

Abliteration is not a jailbreak, and the difference is the whole argument. A jailbreak is an input attack — a crafted prompt that tricks an aligned model into complying — and the provider can patch it, filter it, or ban the account that sent it. Abliteration is surgery on the model itself. In 2024, researchers showed that a chat model’s willingness to refuse is mediated by a single direction in its internal activations: erase that direction from the weights, and the model loses the ability to say no while keeping nearly all its other capabilities. [4] The edit is baked into the file. Once those weights are on a hard drive, there is no refusal left to bypass and nothing for a vendor to fix. A jailbreak is a lock that can be picked. Abliteration removes the door.

What changed since 2024 is not the idea but the cost. The original technique required a researcher who understood transformer internals; the current tooling takes a command line — one openly published tool decensors a small model in under an hour on a single consumer GPU, no expertise required — and a single registry now hosts more than 200 ablated models. [5] The tempo asymmetry is the part defenders underweight: a frontier lab spends months red-teaming a release — Anthropic says thousands of hours on Fable — while the community publishes the de-safetied counterpart of a comparable open-weight release within a day or two of launch.

The honest objection is that some models try to resist this, but it does not hold. Published defenses — circuit breakers, extended-refusal training — work in the lab. But the labs don’t ship them inside the frontier open weights that actually get downloaded, the strongest results are on small models, and by 2026, public tooling already claims to defeat them, driving even Google’s hardened Gemma 4 to single-digit refusal rates. [6] Hardening raises the price of the operation. It does not close it.

The readers of this newsletter will see this as the activation of the coercion stack described in Access, Disable, Destroy, but through a route the original map didn’t draw. The off switch was not held by the model provider, nor by a sanctioning authority pointed at a foreign adversary. According to the Wall Street Journal and The Information, the finding that triggered the order came from Amazon — Anthropic’s largest investor and its primary cloud partner, on whose Bedrock platform the model most likely ran. Amazon’s researchers found the bypass; CEO Andy Jassy raised it with senior officials, including Treasury Secretary Scott Bessent; Commerce Secretary Howard Lutnick sent the letter. [7]

Reporting a live cyber bypass is defensible: a researcher who finds one should disclose it, whoever signs their checks. The hazard is not Amazon’s motive. It is that one firm now bankrolls the vendor, hosts its models, and supplies the findings behind the federal action against it: three chairs, one occupant, a governance problem, whether anyone acted in bad faith. That row did not exist on the original coercion-stack table. It does now.

Concede the government’s strongest case: Mythos is a genuinely dangerous capability. Anthropic itself withheld it from public release and lobbied for Mythos-class models to be treated as cyberweapons. A jailbreak that unlocks even a sliver of that capability on a model deployed to hundreds of millions of people is a real finding, not a clerical one. David Sacks, the administration’s former AI czar, put the case bluntly: a bypass “allowing operability of a cyber weapon” is hard to call anything but serious, and Anthropic’s minimizing language was “not consistent with Anthropic’s brand as the AI safety company.” [8] That last clause is the hinge, and it is where the story turns from a regulatory dispute into something closer to a Greek tragedy.

Anthropic supplied the moral framing that took its model down. On or around June 10 — a day after Fable 5 launched, two days before the letter arrived — Dario Amodei published an essay titled Policy on the AI Exponential. In it, in his own boldface, he argued that frontier models “should be required to go through technical testing and auditing, and their release should be blocked or reversed as a threat to public safety if they do not meet high standards of safety.” He named the analogy himself: the FAA grounding an unsafe aircraft. He called, in the same essay, for export controls on the AI supply chain to be “expanded, tightened, and coordinated.” [9] Two days later the government blocked his release, citing safety, using an export control.

Here is the cruelty in it. Amodei did not receive the apparatus he requested. He proposed a deliberative, statutory process: a third-party technical evaluation and explicit protection against “political favoritism or arbitrary decisions.” What arrived was a verbal directive on roughly ninety minutes’ notice, with no specific national-security detail and no third-party finding shared, the opposite of the process he described. Anthropic’s own statement says so: “This action does not adhere to those principles.” [10] But the principle the administration did use — that government may block or reverse a frontier release on safety grounds — is the one Anthropic spent years legitimizing. Sacks then turned the company’s safety branding back on it, arguing that it should have complied without argument. The lab supplied the moral framework; the government supplied a blunter instrument than the lab wanted; and the safety reputation Anthropic built became the lever its own funder’s disclosure pried.

The asymmetry is what makes something load-bearing, and it should change how you price a dependency. The durability of a closed frontier model is not a function of the vendor's uptime or balance sheet. It is a function of a regulatory surface the vendor does not control and cannot predict — and that surface, as of June 12, can be activated by the firm that funds and hosts the vendor. The substitute sitting one tier down — the abliterated open-weight model an attacker runs on a few GPUs at most — lacks such a surface. The best open-weight models now trail the closed frontier by about four months, not the chasm that gap used to be; abliteration is a separate operation layered on top, stripping refusals from a model that is already near-peer. [11] So the substitute is not as capable as Mythos, but it is close, it is permanent, and it is — in the only sense that matters to whoever is probing your systems — more reliably available than the safety-first product it imitates.

The model built to refuse can be withdrawn from everyone. The model built to refuse nothing cannot be withdrawn from anyone.

Notes

[1] Anthropic, “Statement on the US government directive to suspend access to Fable 5 and Mythos 5”, June 12, 2026; launch date (June 9) and enterprise-customer impact per MarkTechPost, June 13, 2026, and MLQ News, June 13, 2026.

[2] Anthropic statement, June 12, 2026 (full text of the scope language, including foreign-national employees); corroborated by Axios, “Trump admin blocks foreign access to Anthropic’s most powerful AI”, June 12, 2026.

[3] Hugging Face’s abliterated tag filter returned roughly 7,500 model repos as of mid-June 2026. The “over six thousand... against roughly six hundred two years ago” figure is from NPR, citing University of Nebraska Omaha (NCITE) research, “These AI models are free, private, and will never say ‘no,’” May 31, 2026. The tag count includes quantizations and mirrors, not solely unique base-model abliterations, and is rising — retrieve a current figure at publication.

[4] Andy Arditi et al., “Refusal in Language Models Is Mediated by a Single Direction”, arXiv 2406.11717 (submitted June 2024; NeurIPS 2024). The paper demonstrates across 13 open chat models up to 72B that refusal is mediated by a one-dimensional subspace; ablating that direction from the weights (weight orthogonalization) removes refusal while preserving other capabilities. The permanence-once-distributed characterization follows from the edit being to the weights themselves.

[5] Heretic (Philipp Emanuel Weidmann, “p-e-w”), released late 2025 (PyPI heretic-llm), automates directional ablation via an Optuna/TPE optimizer; its README reports ~45 minutes to decensor Llama-3.1-8B-Instruct on an RTX 3090 (20–30 minutes for Qwen3-4B), corroborated by NPR (n.3) for the “few minutes,” no-expertise characterization. Registry scale: huihui-ai hosted 235 models with 7,406 followers as of June 15, 2026. Speed-of-appearance (abliterated builds within ~24–72 hours of a major release) per huihui-ai’s published Gemma 4 / Qwen abliterations and activity feed. Anthropic’s “thousands of hours” of Fable red-teaming is from its launch posture as summarized in its June 12 statement (n.2).

[6] Defenses and the offense’s response: circuit breakers / Representation Rerouting per Zou et al., “Improving Alignment and Robustness with Circuit Breakers”, arXiv 2406.04313 (NeurIPS 2024); extended-refusal training per Abu Shairah et al. (KAUST), “An Embarrassingly Simple Defense Against LLM Abliteration Attacks”, arXiv 2505.19056 (May 2025), reporting treated models retaining >90% refusal under abliteration versus 70–80% drops for baselines — demonstrated on small/older models. Offense keeping pace: Abliterix, a Heretic derivative, claims to defeat circuit breakers and to reach a ~7% refusal rate on Google’s Gemma 4 (E4B) via direct weight editing. These refusal-rate figures are self-reported by the abliterating parties and are highly method-dependent; treated as directional, not measured.

[7] Wall Street Journal, “Amazon CEO’s talks with U.S. officials triggered crackdown on Anthropic models”, June 13, 2026 (WSJ names Bessent as one of several officials Jassy contacted); The Information, “Amazon’s Jassy raised concerns about Anthropic model, Trump crackdown”, June 13, 2026. Lutnick (Commerce) sent the directive per Anthropic’s statement and Axios. Amazon’s investment ($8B deployed to date, plus an up-to-$25B commitment agreed April 2026) and AWS cloud partnership per CNBC, Nov 22, 2024 and April 20, 2026; the same CNBC reporting confirms “Amazon does not have a seat on Anthropic’s board.” Bedrock as the likely test surface is inference, flagged as such.

[8] David Sacks, post on X, June 13, 2026.

[9] Dario Amodei, “Policy on the AI Exponential”, dated “June 2026” on the primary page; secondary trackers place publication on or around June 10, 2026. The “blocked or reversed” sentence and the FAA analogy are in Section 1 (Regulation and public safety); the “expanded, tightened, and coordinated” export-control language is in Section 5 (Securing leadership by democracies) and refers to chips and semiconductor manufacturing equipment. The essay’s separate “off switch” phrasing appears in Section 4 and refers to autonomous-weapons oversight, not model release — not conflated here.

[10] Sacks, X, June 13, 2026 (as n.8).

[11] Epoch AI, "Open models lag state-of-the-art closed models by 4 months" (Jack Edwards and Luke Emberson), data covering Jan 1–May 28, 2026: the most capable open-weight models trailed frontier closed models by an average of four months, or 8 points on Epoch's composite Capabilities Index — up slightly from the ~3-month average Epoch measured for Jan 2023–Oct 2025. This is a capability gap (open vs. closed frontier); abliteration is a distinct operation that removes refusals without adding capability, applied on top of an already-near-frontier open model. The two are not the same axis and are not conflated here.

On June 8, Amazon signed a $17.5 billion loan it can draw at will, with no financial covenants attached. Two days later, Oracle told investors it would raise roughly $40 billion more and unveiled a new accounting measure to explain why its capex is not quite its capex. The same day, Bloomberg reported that SoftBank could not borrow $6 billion against its OpenAI stake.

The volume itself is no longer news. Morgan Stanley estimates nearly $236 billion of AI-linked debt has been issued globally through May, four times last year’s pace, and expects close to $570 billion for the full year [1]. UBS estimates that hyperscaler capex will consume close to 100% of operating cash flow in 2026, compared with a ten-year average of 40% [2]. Everyone now knows the buildout runs on debt. What last week revealed is who gets to borrow it, on what terms, and against what.

Start with the cheapest money. Amazon’s facility is a senior unsecured delayed-draw term loan led by Citibank: the company can pull funds as needed through September 30, each draw repayable over three years, at 0.625% to 0.875% over SOFR, the floating benchmark rate, depending on ratings [3]. It landed days after Amazon priced the largest Canadian-dollar corporate bond in history, a C$14 billion deal that drew more than C$28 billion in orders [4]. This is for a company whose trailing free cash flow has collapsed to $1.2 billion from $25.9 billion a year earlier, on the way to roughly $200 billion of capex this year [5]. The banks looked straight past the AI bet. Unsecured borrowing with no financial covenants is routine at Amazon’s rating — and that is the point. What stands behind the loan is the retail engine and AWS’s operating cash flow: businesses already earning, whatever the GPUs return tomorrow.

Oracle got the conditional money. Its fiscal Q4, reported June 10, beat the headline estimates: $19.2 billion in revenue, $2.11 in adjusted EPS, and remaining performance obligations — contracted future revenue — of $638 billion, up 363% in a year and up $85 billion in a single quarter [6]. The stock fell anyway, not the first time this fiscal year, a headline beat has been sold [7]. The funding side explains it. Free cash flow for the year was negative $23.7 billion. Oracle raised $43 billion in debt and $5 billion in equity in fiscal 2026, and plans roughly $40 billion more this year, including a previously announced $20 billion at-the-market equity program (new shares sold directly into the market) [8]. The buildout has crossed a line worth stating plainly: reported capex of $90–95 billion next fiscal year, against $90 billion of guided total revenue for the same year [8]. Oracle plans to spend its entire revenue, roughly, on capital expenditures.

And it introduced a new number. “Net cash outlay for capital expenditures” is guided around $70 billion for fiscal 2027, against the same $90–95 billion in reported capex; the gap is due to customers prepaying for GPUs or supplying their own [9]. Those arrangements now total $75 billion across Oracle’s large AI contracts, and the company says they substantially reduce the capital it must raise [10]. Read that twice. Oracle is publishing a table showing lenders which parts of its capex are really someone else’s. The arrangement is genuine — prepaid hardware does reduce Oracle’s funding needs — but it shifts risk rather than removing it. The $75 billion is banked; the rest of the backlog, largely anchored to OpenAI through Stargate [11], still depends on customers being able to pay, quarter after quarter, for years. When a borrower starts inventing measures to reassure the market, the market has started asking questions.

What did Amazon’s lenders see that SoftBank’s couldn’t? The answer is a hierarchy worth understanding before the second half of Morgan Stanley’s $570 billion arrives.

SoftBank asked for the third kind of money and didn’t get it. In May, it sought a $10 billion margin loan backed by its OpenAI stake; lender hesitation cut the target to $6 billion; on June 10, the talks stalled outright [12]. SoftBank may yet revive them. About $5 billion had been lined up, though it was unclear whether those commitments were verbal or written [13]. The sticking point was not OpenAI’s prospects. It was the collateral itself. OpenAI is private; its valuation is set by funding rounds rather than a liquid market, and a margin lender needs collateral that it can price daily and sell quickly. A stake last marked inside a $122 billion round at an $852 billion post-money valuation [14] turned out to be worth, for borrowing purposes, nothing yet. The stall came even though OpenAI had confirmed, two days earlier, a confidential filing for a US listing that could debut as soon as the fall [15]. Some of the same prospective lenders had said the IPO news made the loan more attractive. They still walked. The clock, meanwhile, is real: a $40 billion bridge loan taken on to fund SoftBank’s OpenAI commitments comes due in March 2027 [16]. Shares fell as much as 9.7% on the news, nine days after the company had overtaken Toyota as Japan’s most valuable [17].

Strip away the deal terms, and the three answers reduce to one question: what gets the lender repaid? Amazon’s creditors are repaid from businesses that predate the AI bet and would survive its disappointment. Oracle’s creditors are repaid from backlog: promises from customers whose own funding remains unproven. SoftBank’s would have been repaid from a mark: a number set by the last buyer in a private round, untested by any open market. The week’s pricing followed that gradient without sentiment. Cheapest against yesterday’s cash. Conditional, and increasingly explained, against tomorrow’s contracts. Refused against a number on a page.

None of this says the lending stops. Morgan Stanley expects issuance to accelerate in the second half [1]. It says the lending discriminates, and what it discriminates against is distance from cash. Each rung down the ladder, the borrower pays more, explains more, and pledges more. At the bottom rung, the market said no to collateral with a listing already in motion. A ticker will do what the mark could not; the prospect of one was not enough. This reading would be wrong if SoftBank closes its loan at or near $6 billion before the IPO prices, or if Oracle’s $40 billion raise comes as ordinary investment-grade debt without leaning on equity. Either outcome would mean the market lends against marks and backlog as readily as against cash flow after all.

Until then, the hierarchy stands. Cash flow lends. Backlog negotiates. Valuation waits for its ticker.

Notes

[1] Morgan Stanley research note, June 10, 2026, as reported by Reuters via Tech Startups: ~$236 billion in AI-linked global debt issuance through May 31, 2026, roughly four times the prior-year pace; full-year 2026 forecast of nearly $570 billion. Analyst estimate, not a measured total.

[2] UBS estimate, as reported by TechTimes: 2026 hyperscaler capital spending on pace to consume close to 100% of operating cash flows, versus a 10-year average of about 40%. Analyst estimate.

[3] Amazon Form 8-K, filed June 10, 2026: term loan agreement dated June 8, 2026, Citibank N.A. as administrative agent; $17.5 billion senior unsecured delayed draw term loan facility; commitments expire September 30, 2026; three-year maturity per draw. SOFR margin of 0.625–0.875% depending on ratings and the absence of financial covenants per the filing as reported by Yahoo Finance; the agreement retains customary covenants and events of default. Joint lead arrangers: Citibank, JPMorgan, BofA Securities, HSBC, Wells Fargo.

[4] Bloomberg: C$14 billion (~$10 billion) priced June 8, 2026, the largest corporate debt offering on record in Canadian dollars, with more than C$28 billion in orders. Reuters confirms from the final pricing term sheet filed with the SEC: five tranches, maturities 2029–2056, surpassing Alphabet’s C$8.5 billion record set a month earlier.

[5] Yahoo Finance, per Amazon’s Q1 2026 results: trailing-twelve-month free cash flow of $1.2 billion versus $25.9 billion a year earlier; Q1 2026 capex of $44.2 billion; ~$200 billion full-year 2026 capex plan disclosed with Q4 2025 earnings.

[6] Oracle Q4 FY2026 earnings press release (Form 8-K exhibit, June 10, 2026): RPO of $638 billion, up 363% year-over-year and up $85 billion sequentially. Revenue and EPS beats per Sherwood News: revenue $19.2 billion vs. $19.1 billion expected; adjusted EPS $2.11 vs. $1.96 expected ($2.03 excluding one-time net investment gains). One miss beneath the headlines, per Yahoo Finance: total cloud revenue of $9.91 billion came in below the $9.99 billion consensus, with cloud applications light and cloud infrastructure ahead.

[7] Sherwood News and TheStreet. Shares fell in after-hours trading on June 10 despite the beats. Precedent: in Q2 FY2026, a 32.4% EPS beat was followed by a -10.8% day-of move (24/7 Wall St.). Note the broader tape: May CPI printed at a three-year high the same day, and all three major US indices fell, so the decline was not purely company-specific.

[8] Oracle Q4 FY2026 earnings press release: fiscal 2026 free cash flow of negative $23.7 billion; $43 billion raised in debt financing and $5 billion in equity financing in fiscal 2026; approximately $40 billion in combined debt and equity financing planned for fiscal 2027, including the previously announced $20 billion at-the-market equity issuance; fiscal 2027 total revenue guidance confirmed at $90 billion. The release adds that Oracle “does not expect to issue additional debt in calendar year 2026” — making the near-term portion of the raise equity-led by the company’s own statement. The $90–95 billion reported-capex figure for fiscal 2027 is from the earnings call (see [9]).

[9] Oracle Q4 FY2026 earnings call, June 10, 2026: expected net cash outlay for capital expenditures of around $70 billion in fiscal 2027, with customer prepayments and timing impacts of $20–25 billion raising reported capex above that figure; the press release includes a reconciliation table for the new measure, and CFO Hilary Maxson detailed it on the call (CNBC). Fiscal 2026 net cash outlay was $48 billion after ~$8 billion of prepayment and timing impacts, against $55.7 billion of reported capex — up 162% year-over-year, with depreciation nearly doubling to $7.62 billion.

[10] Oracle Q4 FY2026 earnings press release: prepaid and customer-supplied hardware portions of large AI contracts total $75 billion, which the company states “substantially reduces the amount of capital Oracle must raise” for its AI datacenter buildout.

[11] Sherwood News: the RPO balance is largely anchored by Oracle’s OpenAI partnership under the $500 billion Stargate initiative. Bank of America analysts estimate that over 50% of the remaining performance obligation comes from OpenAI (CNBC); analyst estimate, not a company disclosure.

[12] Bloomberg, June 10, 2026: talks to raise at least $6 billion via a margin loan backed by SoftBank’s OpenAI stake have stalled; the initial $10 billion target was cut by 40% in May after lender hesitation. SoftBank may resume the margin loan later and is considering other fundraising options. A fair objection: SoftBank itself is rated BB+ with a negative outlook from S&P (revised March 3, 2026, on the additional $30 billion OpenAI commitment), so borrower quality may have weighed on the talks. But margin lending looks to the collateral first, and the concern lenders voiced, per Bloomberg’s reporting, was the difficulty of valuing an unlisted company — not SoftBank’s own credit.

[13] Bloomberg via Yahoo Finance: approximately $5 billion had been secured before talks stalled, though it was unclear whether commitments were verbal or written.

[14] OpenAI announcement, March 31, 2026: the round closed with $122 billion in committed capital at a post-money valuation of $852 billion; confirmed by Bloomberg. SoftBank contributed $30 billion of the round. The figure is a private-round valuation, not a market price — which is the point.

[15] Bloomberg via The Edge Singapore: OpenAI said on Monday, June 8, that it filed confidentially for a US IPO and is working with Goldman Sachs and Morgan Stanley on a potential listing as soon as the fall. Some prospective lenders on the margin loan had said they viewed it more favorably after news of the IPO preparation; the talks stalled regardless.

[16] Bloomberg via Yahoo Finance and Quartz: a $40 billion bridge loan taken on to fund SoftBank’s OpenAI commitments comes due in March 2027; SoftBank has indicated it intends to cover it from existing assets plus additional financing. Counterpoint on severity from Hua Cheng, head of Asia credit research at AllianceBernstein, who called the stalled margin loan one piece of a larger puzzle and not a standalone red flag.

[17] Bloomberg via Yahoo Finance: shares declined as much as 9.7% on June 10; SoftBank had overtaken Toyota as Japan’s most valuable company by market capitalization on June 1 (Bloomberg, Nikkei Asia) — the first time in more than two decades. SoftBank’s credit default swaps had narrowed to about 307 basis points from a May 20 peak above 367 — the credit market was already charging for the OpenAI concentration before the loan stalled.

Jensen Huang stood at the Taipei Music Center on the last day of May and announced that Nvidia intended to “reinvent the single most important tool of humanity.”[1] The tool in question is the personal computer, and the product behind the sentence is a laptop chip: RTX Spark, a 20-core Arm processor fused to a Blackwell GPU around a 128-gigabyte pool of memory, co-announced with Microsoft.[2] It ships this fall in machines from Asus, Dell, HP, Lenovo, and MSI, with a Surface Laptop Ultra as the flagship. Shares of AMD, Intel, and Qualcomm fell on the news.[3] The market read the announcement as a land grab in the PC business.

Eight weeks earlier, this publication described the single move that could pull local AI back into Nvidia’s orbit. In “Your Parents Paid,” we documented how Nvidia’s own product segmentation had handed the fastest-growing consumer AI workload to Apple and AMD, and we listed three conditions under which that would reverse. The third: “the CUDA moat extends into inference. If NVIDIA ships inference-specific optimizations — through TensorRT-LLM, NIM, or a CUDA-exclusive quantization format — that make the performance gap too large to ignore, practitioners return to NVIDIA hardware regardless of memory capacity.”[4]

RTX Spark is condition three, shipped as a product line. But it arrived with a twist we didn’t predict: Nvidia isn’t closing the performance gap. It’s making the gap irrelevant.

The spec sheet and the missing number

Start with what Nvidia published. The RTX Spark product page lists up to 6,144 CUDA cores on the Blackwell GPU, up to 20 CPU cores, up to 1 petaflop of FP4 AI performance, and up to 128 gigabytes of unified memory.[2] On stage, Huang claimed the chip runs 120-billion-parameter models locally.[5] That claim deserves a moment of respect. In April, we showed that the 120B model class needed 60-70 gigabytes at usable quantization and therefore did not fit on any consumer Nvidia product. The 32-gigabyte ceiling on the RTX 5090 was the centerpiece of Nvidia’s segmentation, the design choice that pushed private-inference buyers toward a $3,699 Mac Studio.[4] RTX Spark removes that ceiling. The capacity objection is gone.

Now look for the number that isn’t there. The product page lists cores, petaflops, and gigabytes. It does not list memory bandwidth.[6] For local language models, bandwidth is the most important metric: token generation reads the entire working set of model weights from memory for every token, making decode speed a near-linear function of memory throughput. Capacity decides whether a model loads. Bandwidth decides whether you can stand to use it. Nvidia headlined the first number and buried the second, the same disclosure pattern it used for the DGX Spark desktop, whose 273 GB/s figure appeared in technical documentation rather than marketing.[7]

Launch coverage and pre-launch leaks fill the blank and explain the silence. The full-spec N1X silicon inside RTX Spark is, by all accounts, the same configuration as the DGX Spark’s GB10: a 256-bit interface of LPDDR5X (laptop-class memory) delivering roughly 273 GB/s, with launch-day spec coverage citing up to 300.[8] Apple’s M4 Max delivers 546 GB/s. The M5 Max delivers 614. The M3 Ultra delivers 819.[9] On the dimension that determines how fast a local model actually runs, the machine Nvidia just announced trails the machines it was announced to displace by a factor of 2 to 3.

So the puzzle is real. Nvidia came back for local AI without closing the gap that lost it the market in the first place. Why would a company that just reported $215.9 billion in annual revenue enter a fight it has already measured itself losing on the merits?

Because the fight isn’t on the merits. RTX Spark is not a bid for the PC market. It is the recapture of the one AI workload that was escaping Nvidia’s orbit, and the recapture runs on defaults, not on benchmarks. The machinery has four layers, and only one of them is silicon.

Four layers of default

The first layer is the hardware itself, and the most important word on the product page is “natively.” Nvidia’s copy reads: “CUDA, the software that accelerates the world’s AI, runs natively on RTX Spark.”[10] Every prior path to large-model local AI on a thin-and-light Windows machine ran through someone else’s silicon and someone else’s runtime: Qualcomm’s NPU through ONNX, AMD’s iGPU through Vulkan, Apple’s unified memory through Metal. Each of those paths was hardware-agnostic by necessity, which is precisely what made local inference the first workload to slip Nvidia’s gravity. RTX Spark ends the necessity. For the first time, the premium Windows laptop tier ships with the same CUDA stack that runs the datacenter, and 128 gigabytes to feed it.

The second layer is the runtime, where the recapture stops being a hardware story. On RTX AI PCs, Nvidia’s NIM microservices run as containers in Windows Subsystem for Linux, with CUDA acceleration, and package models with everything needed to run them.[11] The quieter announcement is the one that matters: Microsoft’s Windows ML inference stack now automatically routes to Nvidia’s TensorRT for RTX whenever it detects RTX hardware.[12] Read that sentence again at the level of incentives. A Windows application developer who calls the operating system’s standard AI interface does not have to select an inference backend. The operating system selects it, and on this machine, the selection is CUDA. The developer didn’t choose Nvidia. Windows chose it for them. Jensen’s defense writes itself: developers begged for this. Local CUDA parity with the datacenter was among the loudest requests in Nvidia’s developer ecosystem, and the convenience is not an illusion. But convenience is how every default gets built.

That shift, from chosen dependency to ambient dependency, is the difference between the lock-in we described in “Open Source, Closed Orbit” and the lock-in being assembled now.[13] The original Black Hole worked on practitioners: researchers and engineers who chose CUDA because the tools were better, then found the exit priced in switching costs. The new layer works on people who never make a choice at all. The mainstream Windows developer building an AI feature in 2027 will write to Windows ML, ship to machines that route to TensorRT, and acquire a CUDA dependency the way one acquires an accent. Nobody decides to have one.

The third layer is the agent platform, and it explains the timing. RTX Spark’s marketing mentions chatbots only briefly. The page promises a PC where “agents work alongside you — running tasks, generating assets, writing code, on demand,” and pitches the desktop variants as machines “built to run personal AI agents 24/7 right at your desk.”[14] The plumbing has a name: NVIDIA OpenShell, an agent framework coming to Windows on top of Microsoft’s new security primitives, packaging local autonomous agents with guardrails gating what they can touch — alongside NIM containers as local agent endpoints and native NIM support arriving in Azure AI Foundry in July.[15] The agent era re-platforms the PC around continuous local inference, the bandwidth-hungry, always-on workload pattern that decides hardware defaults for a decade. Whoever owns the default runtime when that re-platforming happens owns the next ten years of Windows AI development.

The fourth layer is the funnel, and it is the oldest trick in the catalog. NIM’s developer tier is free and genuinely useful: unlimited endpoints for prototyping, hosted on DGX Cloud. Production is a different conversation. Nvidia’s own product page walks the path in two sentences: prototype freely, then “talk to an NVIDIA product specialist about moving from pilot to production with the security, API stability, and support that comes with NVIDIA AI Enterprise.”[16] The same NIM container that runs on the laptop runs in the datacenter and the cloud, which Nvidia presents as portability and which functions as a ratchet. A team prototypes an agent on a Spark laptop, the prototype works, and scaling it means an enterprise agreement that cross-sells the rest of the stack.

Put the four layers together, and the design is legible. Nvidia fixed the capacity problem, kept the bandwidth problem, and wrapped both in the Windows default. It can concede the benchmark because it is buying the path. A 2x decode deficit against a Mac Studio matters to the practitioner who measures tokens per second. It matters not at all to the Windows developer whose operating system, container catalog, agent framework, and cloud funnel have already agreed on the answer before the question was asked.

There is a precedent for this, and Jensen named it himself two months before the announcement. “GeForce is NVIDIA’s greatest marketing campaign,” he told the GTC crowd in March. “Your parents paid for you to be an NVIDIA customer... until someday you became an amazing computer scientist and became a proper customer.”[17] GeForce recruited the CUDA generation: gamers who became graduate students, who became the engineers who made CUDA the default in the datacenter. The pipeline aged. Gaming now accounts for 7% of Nvidia’s revenue, and the recruits were buying Macs.[18] Spark is that pipeline rebuilt for the agent era. The laptop is the new GeForce, except this time the product being marketed isn’t a graphics card a teenager will outgrow. It’s a default that a developer will never notice.

What the machine actually does

Honesty about the product, because it’s good. RTX Spark’s compute is real: the full configuration matches the 6,144 CUDA cores of a desktop RTX 5070, and on the GB10 silicon it shares with the DGX Spark, prefill — the compute-bound phase where a long prompt is ingested — runs at roughly 2,000 tokens per second on a 20B model.[19] For workloads that are mostly ingestion (summarizing long documents, retrieval over a document base, batch classification), that is a serious machine in a laptop chassis. The 45-to-80-watt envelope, the all-day-battery claim, and the full RTX gaming stack make it the most credible Windows-on-Arm product ever shipped, where Qualcomm’s Snapdragon X struggled to give mainstream buyers a reason to switch.[20] And 128 gigabytes of addressable memory on a Windows laptop is a first. None of this is vaporware.

The decode numbers are equally real, and they cut the other way. On the same GB10 silicon, LMSYS measured the DGX Spark generating just under 50 tokens per second on a 20B model at 4-bit precision — against 215 for an RTX Pro 6000 and 205 for an RTX 5090, a gap of roughly 4x that the reviewers attributed directly to the LPDDR5X memory interface.[19] Decode speed doesn't improve with the laptop’s power envelope because memory bandwidth doesn’t scale with wattage; the laptop will generate tokens at desktop-GB10 speed, which is to say at half to a third the speed of the Apple Silicon machines it shares a price bracket with.[21]

A note on a number you will see misquoted. Nvidia’s specifications include a 600 GB/s figure, and parts of the trade press have already printed it as the memory bandwidth.[22] It isn’t. The 600 GB/s is NVLink-C2C, the interconnect between the CPU and GPU complexes on the package. The memory interface feeding both remains LPDDR5X at roughly 273 to 300 GB/s. Bandwidth between two processors and bandwidth to the memory that holds the model are different numbers, and conflating them doubles the product’s apparent throughput. The confusion is not an accident of complicated engineering. Retail listings may yet publish the figure; the DGX Spark precedent, where the number surfaced in technical documentation after launch, suggests the pattern is policy. A company that headlines its interconnect bandwidth and buries its memory bandwidth knows which comparison it would lose.

So the honest scorecard reads: best-in-class prefill for the form factor, true 120B capacity, decode bandwidth in M5 Pro territory at M5 Max prices, and a marketing sheet built to keep you from computing that last number. Our April verdict — no amount of software makes 273 GB/s faster than hardware with three times the bandwidth — survives contact with the new product. What changed is that Nvidia stopped trying to win the comparison and started making sure the buyer never runs it.

The practitioners who walk away

The recapture has a boundary, and the boundary is choice. Everything in the four-layer machinery operates on defaults: the default premium laptop, the default OS inference path, the default agent runtime, the default scaling story. Nothing in it binds the practitioner who actively chooses a stack. llama.cpp still runs everywhere. Vulkan still outruns vendor stacks on AMD silicon.[4] Apple’s MLX is becoming the default backend of Ollama, the most popular local-model tool, with measured decode gains of 93% on supported models.[23] The buyer who reads benchmarks before purchasing will keep buying the machine with 614 GB/s, and nothing Nvidia shipped last week changes that calculus.

But count the populations. The benchmark-reading tier is a niche. The Windows installed base is more than a billion machines, refreshed through OEM defaults and corporate procurement cycles that have shipped “the premium Intel laptop” for thirty years and will ship “the premium RTX Spark laptop” with equal indifference to memory-bus arithmetic. Distribution decides defaults, and defaults decide ecosystems. Qualcomm proved that distribution alone doesn’t move an ecosystem: two years of Snapdragon X laptops put Arm Windows machines in every retail channel without giving developers a reason to target them. Nvidia inherits the compatibility groundwork Qualcomm paid for and arrives with the developer reason pre-installed: a machine carrying the stack the world’s AI is already written on, an OS that routes to it silently, and an agent platform whose launch partner is the OS vendor itself.

The exception that proves the design: the people most likely to escape recapture are the people Nvidia’s original segmentation already pushed out. The medical practice that bought a Mac Studio in 2025 for private 70B inference has no reason to return; its stack is Metal, its tooling is MLX, and its data never left the building. Nvidia has written them off; the project is making sure the next ten million developers never become them.

The ninth domain

Readers of this publication have seen this architecture before. “Open Source, Closed Orbit” mapped how Nvidia replicated the open-source ecosystem’s eight critical infrastructure functions — model hosting, developer tooling, inference serving, fine-tuning, evaluation, and the rest — each replica routing back to Nvidia hardware.[13] The framework’s gap was geographic: the eight domains lived in the cloud, and the datacenter, and the device on the desk remained contested ground. That contest is what “Your Parents Paid” documented from the other side: at the device tier, where workloads run through llama.cpp and MLX rather than NIM and Triton, the pull was visibly loosening. Local inference wasn't escaping because someone built a better CUDA; it was because the workload didn’t need CUDA at all.[4]

RTX Spark closes the map. The device is the ninth domain, and the replication strategy is identical to the first eight: take a function the open ecosystem performs in a hardware-agnostic way, ship a vertically integrated version that is easier than the agnostic one, and let convenience do what compulsion couldn’t. The two pieces are mirror images. April’s story was segmentation pushing the workload out: a 32-gigabyte ceiling, a missing NVLink, a bandwidth-starved Spark desktop, each a deliberate gap that protected datacenter margins. June’s story is integration pulling the workload back: full capacity, native CUDA, OS-level routing, and an agent platform. Opposite moves. Same gravity. In both directions, the constant is that Nvidia designs the consumer product around what it does to the datacenter business, because the datacenter is 90% of revenue, and the consumer device is, in Jensen’s own framing, a marketing campaign with a motherboard.[17][18]

What would have to break

The recapture thesis is falsifiable, and we’ll state the conditions plainly.

First, it breaks if the default path opens up. If Windows ML’s hardware routing stays neutral in practice — if a developer writing to the standard Windows AI interface gets equivalent first-class treatment on Qualcomm NPUs and AMD silicon, and the TensorRT route confers no meaningful advantage — then the second layer of the machinery never engages, and RTX Spark is just a fast laptop. The incentive structure argues against this. Microsoft has reasons to keep Windows ML formally vendor-neutral; Nvidia has reasons to make the neutral interface perform best on its hardware; and “formally neutral, practically optimized” is how platform defaults in computing have historically worked. Watch the benchmark deltas between Windows ML on Spark and Windows ML on Snapdragon through 2027. If your AI feature had to run on a non-RTX machine tomorrow, would anything break? If you don’t know, the default has already been decided.

Second, it breaks if the agnostic stack holds the mainstream, not just the practitioners. Ollama’s MLX migration, llama.cpp’s ubiquity, and an M5 Ultra refresh give Apple every chance to keep the enthusiast tier and grow it; the M5 Ultra skipped this week’s WWDC and is now expected around October on reported memory-supply constraints, which puts Nvidia’s fall launch and Apple’s 128GB-class answer in the same quarter.[24] If local AI on Windows stalls — if the agent-PC pitch lands as this decade’s 3D TV — then Nvidia will have built a beautiful funnel over a dry riverbed. The third condition is the prosaic one: adoption. Windows-on-Arm carries a decade of compatibility scar tissue, fall launches slip, Morgan Stanley’s channel checks put N1X machines at $2,899 and up, and premium-priced first-generation platforms have a long history of underselling their keynotes.[25] If OEM sell-through disappoints by the end of 2027, the ninth domain stays open.

Here is why we doubt Nvidia loses even then. In September 2025, Nvidia agreed to buy $ 5 billion of Intel common stock, roughly 4% of the company whose RTX Spark franchise it is ostensibly built to attack; the purchase closed in December after antitrust clearance.[26] The equity is the smaller half of the deal. The same agreement commits Intel to build x86 system-on-chips for the PC market “that integrate NVIDIA RTX GPU chiplets” — Intel’s own filing language.[26] Read the two moves together. If Arm-based AI PCs win, Nvidia owns the chip. If x86 holds, the incumbent’s next-generation PC silicon will carry Nvidia’s GPU by contract. The instruction set is a coin flip Nvidia has hedged; the layer it refuses to share in either branch is the one this piece is about: the GPU, the runtime, and the default path between a Windows developer and a model. That hedge is the clearest evidence of the bet. Companies hedge the parts they consider interchangeable. They never hedge the moat.

In April, we ended by noting that the local inference market was growing despite Nvidia’s product line, not because of it, and that the gravity of the Black Hole was measurably weakening at the device tier. Eight weeks later, Nvidia shipped the correction, which tells you how seriously it took the leak. It did not ship more bandwidth. It shipped a default.

Local inference still doesn’t need CUDA. Nvidia just rebuilt the machine it runs on so that the path of least resistance does.

Notes

[1] Jensen Huang, GTC Taipei keynote at Computex 2026, Taipei Music Center, May 31–June 1, 2026 (June 1 local time). “Reinvent the single most important tool of humanity” quoted by Tom’s Hardware.

[2] NVIDIA RTX Spark product page (nvidia.com/en-us/products/rtx-spark, accessed June 10, 2026): up to 6,144-core Blackwell RTX GPU, up to 20-core CPU, up to 1 petaflop FP4, up to 128GB unified memory. Laptop partners: Asus ProArt P16, Dell XPS 16, HP OmniBook X 14, Lenovo Yoga Pro 9n, Microsoft Surface Laptop Ultra, MSI Prestige N16 Flip AI+; desktop partners include Acer and Gigabyte. Announced May 31, 2026 with Microsoft (NVIDIA Newsroom); availability fall 2026. CPU complex: 20 Arm cores (10x Cortex-X925 + 10x Cortex-A725), co-designed with MediaTek, per HotHardware. Nvidia also showed a two-year cadence roadmap with successor chips in 2028 and 2030.

[3] AMD, Intel, and Qualcomm share declines on the announcement: CNBC, June 2, 2026.

[4] “Your Parents Paid,” The AI Realist, April 3, 2026. The three reversal conditions appear in the closing section, “What would have to break.” Companion hardware guide: “What to Buy for Local LLMs (April 2026).”

[5] 120-billion-parameter local model claim: Nvidia keynote and product materials, reported by Notebookcheck. At Q4-class quantization a 120B dense model requires roughly 60–70GB of memory; 120B-class MoE models fit comfortably in 128GB. Vendor claim; independent throughput benchmarks on shipping hardware not yet available.

[6] NVIDIA RTX Spark product page, accessed June 10, 2026. The specifications section lists GPU cores, CPU cores, FP4 throughput, and memory capacity. No memory bandwidth figure appears anywhere on the page.

[7] NVIDIA DGX Spark: 128GB LPDDR5x, 273 GB/s, documented in the DGX Spark User Guide rather than launch marketing. See “Your Parents Paid,” note 18.

[8] N1X full-spec configuration matching DGX Spark’s GB10 (256-bit LPDDR5X-8533, ~273 GB/s): Tom’s Hardware pre-launch specification reporting. Tom’s Hardware’s launch article states “up to 300 GB/s of memory bandwidth” in its spec rundown, suggesting the ceiling figure was briefed to press; it appears nowhere on the product page (note 6). One analysis cites LPDDR5X-9400 (~301 GB/s). The GB10-lineage claim is consistent across sources but not officially confirmed.

[9] Apple memory bandwidth, manufacturer specifications: M4 Max 546 GB/s; M5 Max with 40-core GPU — the only configuration offering 128GB — 614 GB/s (the 32-core variant is 460 GB/s); M5 Pro 307 GB/s; M3 Ultra 819 GB/s (Apple tech specs; Apple Newsroom, M5 Pro and M5 Max). See “Your Parents Paid,” notes 32–34, for pricing at the 128GB tier.

[10] NVIDIA RTX Spark product page: “CUDA, the software that accelerates the world’s AI, runs natively on RTX Spark.” Developer section: “The same NVIDIA CUDA stack the world’s AI is built on, so you can develop and prototype on the same machine... prototype, fine-tune, and inference on the latest models locally.”

[11] NVIDIA NIM microservices on RTX AI PCs run through WSL2 with CUDA acceleration: NVIDIA Developer Blog. That deployment path was established on x86 RTX PCs; Arm-native NIM containers are already in production on the DGX Spark, which runs the same GB10-lineage silicon as RTX Spark.

[12] Windows ML, powered by ONNX Runtime, automatically uses the TensorRT for RTX inference library on GeForce RTX GPUs: NVIDIA blog, Microsoft Build coverage. TensorRT for RTX is natively supported by Windows ML.

[13] “Open Source, Closed Orbit: The Hardware Monopolist’s Guide to Owning Open Source,” The AI Realist. The eight-domain replication framework and the catalog-and-contract lock-in structure.

[14] NVIDIA RTX Spark product page: “Welcome to the PC where agents work alongside you — running tasks, generating assets, writing code, on demand... There’s intelligence on both sides of the keyboard now.” Desktop section: “Built to run personal AI agents 24/7 right at your desk.”

[15] “NVIDIA OpenShell is coming to Windows on top of Microsoft’s new security primitives, giving developers a single, easy-to-deploy package for running autonomous agents safely”: NVIDIA, Computex 2026 announcements, May 31, 2026; OpenShell appears in NVIDIA’s trademark list (NVIDIA Newsroom). NIM containers as local agent endpoints and native NIM support in Azure AI Foundry from July 2026: Microsoft Build 2026 coverage (Windows News); the Foundry date is per Build coverage, not yet confirmed in Microsoft primary documentation.

[16] NVIDIA NIM product page (nvidia.com, accessed June 10, 2026): “Get unlimited access to NIM API endpoints for prototyping, accelerated by DGX Cloud. When ready for production, download and self-host NIM on your preferred infrastructure... Talk to an NVIDIA product specialist about moving from pilot to production with the security, API stability, and support that comes with NVIDIA AI Enterprise.”

[17] Jensen Huang, GTC 2026 keynote, March 16, 2026: “GeForce is NVIDIA’s greatest marketing campaign... Your parents paid for you to be NVIDIA customers.” Full quote and sourcing in “Your Parents Paid,” note 1.

[18] NVIDIA Q4 FY2026 earnings (Form 8-K, filed February 25, 2026, SEC EDGAR): fiscal 2026 revenue $215.9B, of which Data Center $197.3B (91%) and Gaming $16.0B (7%).

[19] LMSYS, “NVIDIA DGX Spark In-Depth Review,” October 2025: GPT-OSS 20B (MXFP4) in Ollama at 2,053 tok/s prefill and 49.7 tok/s decode on DGX Spark, versus 10,108/215 on RTX Pro 6000 and 8,519/205 on RTX 5090. The reviewers attribute the decode gap to the unified LPDDR5x memory interface. Figures are for the GB10 desktop; RTX Spark shares the silicon per note 8 but laptop-specific benchmarks are not yet published.

[20] Power envelope 45–80W and integrated-GPU-only positioning (no discrete pairing planned): Engadget and Tom’s Hardware launch coverage. Qualcomm Windows-on-Arm context: Microsoft’s Windows-on-Arm exclusivity with Qualcomm expired in 2024, as Qualcomm executives publicly confirmed, opening the door to this product.

[21] Decode speed invariance with TDP: token generation is memory-bandwidth-bound, and LPDDR5X bandwidth does not change with the power envelope. Prefill, which is compute-bound, takes a 15–25% reduction at laptop wattage per independent analysis. Community analysis; consistent with the bandwidth-bound decode model established in “Your Parents Paid,” notes 18 and 36.

[22] 600 GB/s NVLink-C2C (CPU-to-GPU interconnect) listed by Nvidia and reported by VideoCardz; misreported as peak memory bandwidth by at least one major outlet (Notebookcheck: “With NVLink, its memory bandwidth peaks at 600 GB/s”).

[23] Ollama’s transition of its Apple Silicon backend from llama.cpp to MLX, with preview decode improvements of 93% on supported models: ollama.com/blog/mlx, March 2026. Methodological caveats in “Your Parents Paid,” note 38.

[24] Apple’s M5 Ultra Mac Studio, widely anticipated at WWDC (keynote June 8, 2026), did not appear; reporting attributes the slip to RAM supply constraints, with October 2026 viewed as the likely window (Macworld, June 8, 2026). Nvidia, for its part, says it does not expect RTX Spark laptop supply to be limited despite the same global memory shortage (Yahoo Finance; vendor claim). The rumored M5 Ultra retains the UltraFusion dual-die design, two M5 Max dies with interconnect bandwidth above 1,000 GB/s (TrendForce, citing Commercial Times) — rumored, not announced.

[25] Pricing per a Morgan Stanley report based on channel checks with PC brands at Computex: “AI PCs with N1X will need to price at US$2,899, while N1 models will be priced at US$1,799” (Wccftech; VideoCardz, June 2–3, 2026). Nvidia has not published pricing. Microsoft confirmed a fall release for the Surface Laptop Ultra while declining to discuss pricing (PCWorld, Build 2026).

[26] Securities Purchase Agreement dated September 15, 2025; announced September 18: NVIDIA purchased 214,776,632 Intel shares at $23.28, a $5.0 billion aggregate price (Intel Form 8-K, September 2025). The FTC, which had examined whether the roughly 4% stake raised antitrust concerns, cleared the deal December 18, 2025; the purchase closed December 26 (The Register; CNBC). The product commitment is in the same announcement: “For personal computing, Intel will build and offer to the market x86 system-on-chips (SOCs) that integrate NVIDIA RTX GPU chiplets” (Intel 8-K Exhibit 99.1). No ship dates for products under the agreement have been announced.

Update: 10 June 2026. Nine days after the summit, the strain is already visible. The margin loan SoftBank wanted against its OpenAI stake has stalled: cut from $10 billion to $6 billion on lender hesitation, then stuck at roughly $5 billion. A loan against the marquee asset is supposed to be the easy money. All of it confirms what the headline number was hiding. Read on.

On the morning of June 1, 2026, in the gilded halls of Versailles, Emmanuel Macron told the assembled chief executives that this year’s Choose France summit would “crystallize a record amount of 93 billion euros of confirmed investments.”[1] The word that mattered was confirmed — confirmés. It is the word that turns a press release into a balance sheet, an intention into a number a finance minister can book.

Strip the SoftBank pledge out of the total, and the record disappears. The Japanese conglomerate’s commitment — up to €75 billion to build five gigawatts of AI data-center capacity across France — would be four-fifths of the headline on its own; even the firm tranche France’s own press counted into the total, €45 billion, is roughly half of it.[2] It is also the reason the number is a record at all: this single edition of Choose France exceeded the announced investment promises of the eight previous summits combined, which together totaled around €87 billion.[3] One pledge, from one company, made one summit larger than eight.

And that pledge is not €75 billion of confirmed money. By SoftBank’s own announcement, issued the day before the summit, only the first phase — €45 billion to deliver 3.1 gigawatts — is a commitment. The remaining €30 billion describes “additional sites” the company plans to develop.[4] The language shift inside a single press release, from “commitment” and “investment” to “plans,” is the whole story compressed into one document.

The last time Masayoshi Son stood beside a head of state and named a number this large, it was $500 billion. Sixteen months later, a fraction of one of its seven sites was running.

The anatomy of a record

A Choose France headline is not a measurement. It is a sum of commitment tiers, each with a different probability of becoming a building, presented to the cameras as a single figure. Disaggregate the €93 billion and five tiers separate cleanly: one firm, one a ceiling, one smaller but real, one barely more than a letter of intent, and one recycled from a previous summit.

At the firm end sits SoftBank’s €45 billion first phase — named sites, a named industrial partner in Schneider Electric, a developer in SB Energy, and a 2031 horizon.[5] This is the most concrete pledge at the summit, and it deserves to be treated as a real intent. Below it sits the €30 billion remainder of the SoftBank ceiling, which exists only as “plans for additional sites.” Below that sits a layer of genuine but smaller data-center commitments: Brookfield’s pledge, Nebius’s €8 billion site on a former Bridgestone plant at Béthune, an Ardian-Verne campus in the Paris region.[6] And below that sits the softest tier — capacity that is announced but not yet sited or committed: the MGX–Bpifrance “imminent selection of a second site,” worth around €7.5 billion, and a Revolut commitment contingent on the fintech obtaining a French banking license.[7][8]

The recycling is not a footnote to this structure; it is part of how the record was assembled. Brookfield’s France AI total is now quoted at €30 billion — but €20 billion of that was announced at the February 2025 AI Action Summit, the same event that produced the €109 billion headline; only €10 billion is new to this summit.[6] The MGX–Bpifrance money is the expansion of Campus AI, the Bpifrance–Mistral–MGX–Nvidia joint venture first unveiled at Choose France 2025, whose flagship campus at Fouju is still in early construction.[7] The €7.5 billion “doubles” a commitment that was itself last year’s announcement. Macron’s own framing conceded the pattern: the summit, he said, represented “20 billion invested, and 20 billion of AI investments as a follow-up to the summit in February.”[9] That February summit — the €109 billion AI Action Summit whose figure France never reconciled to disbursement — is being folded back into June’s total as “follow-up.”[10] A material share of this year’s record is last year’s record, counted again.

This is the Commitment-versus-Spend Gap, the analytical move that separates an announced figure from the capital that actually moves. Summit pledges do convert — France has led European foreign direct investment for years running, and Choose France is not a fiction. But they convert at a rate and with a lag that the headline never discloses, and the disaggregation above is why the headline and the eventual deployment are different numbers. At hyperscaler and sovereign-summit scale, the gap is not an anomaly to be explained away; it is the default structure of the announcement. The headline is the ceiling of what could happen. The filing, eventually, shows the floor of what did. The distance between them is where the analysis lives — and at Versailles, the distance is most of the number.

What the same pledge looks like sixteen months later

To price a SoftBank infrastructure pledge at the moment of announcement, you do not need a forecast. You need the last one.

On January 21, 2025, Son stood in the White House alongside Donald Trump, Sam Altman, and Larry Ellison to announce Stargate: $500 billion over four years to build AI data centers across the United States, with $100 billion to be deployed “immediately.”[11] SoftBank took financial responsibility, and Son took the chairmanship. The structure was familiar to anyone who had watched Son work: of the $500 billion, only around $52 billion was committed equity — roughly $19 billion each from SoftBank and OpenAI, around $7 billion each from Oracle and MGX. The other ninety percent was to come from debt and vendor financing, not yet arranged.[12] A mega-pledge, in the Son method, does not deploy existing capital. It opens a financing campaign.

Sixteen months on, the campaign’s results are measurable. Independent satellite analysis put the flagship Abilene, Texas campus at roughly 0.3 to 0.6 gigawatts operational by April 2026 — four of its eight buildings live — against a site target of 1.2 gigawatts and an announced program of ten.[13] The other six US sites were foundations and steel on 2028 timelines. One site of seven was partially energized; the rest were under construction.

Some of that gap is just physics: gigawatt data centers take three to five years to build, and measuring a ten-year program at month sixteen will always show a low number. Abilene, taken alone, is arguably ahead of a normal curve. So the conversion rate, in itself, is not the indictment. The indictment is what happened around it.

The vehicle itself barely functioned. By early 2026, Stargate LLC — the entity unveiled with such ceremony — had reportedly hired no staff and was developing no data centers; OpenAI had bypassed it for bilateral deals with Oracle, Amazon, and Google, and had come to treat the word “Stargate” as, in one executive’s framing, an umbrella term for its compute strategy rather than a company.[14] The Abilene flagship’s planned expansion was canceled in March 2026; the UK Stargate site was paused in April due to energy costs.[15]

None of this means that nothing was built. This is the point at which the skeptical version of the story has to be disciplined, because the booster version is partly true. Abilene is a genuine, operational AI campus running Nvidia hardware; thousands of tradespeople built it; major lenders — JPMorgan, a Newmark-led syndicate — genuinely closed billions in project finance against it.[16] The accurate claim is not that the money was fake. It is that conversion was slow, partial, debt-heavy, and routed around the very vehicle that gave the announcement its name.

The balance sheet behind the pledge

The deeper reason to discount the €75 billion is not SoftBank’s track record. It is SoftBank’s balance sheet, and specifically the distinction between the money SoftBank actually moves and the money it lends its name to.

SoftBank’s funded AI capital has gone almost entirely into one place: its equity position in OpenAI. It completed a $41 billion round in December 2025 for roughly an 11 percent stake, then in February 2026 agreed a further $30 billion that would bring the cumulative total to $64.6 billion and the stake to about 13 percent — a figure that is reached only when the follow-on completes, in tranches running to October 2026.[17] To fund it, SoftBank sold its entire Nvidia stake, shed T-Mobile shares, and drew on a $40 billion bridge facility, the first $10 billion of it borrowed in April 2026, with the facility’s fee structure deliberately escalating to punish slow repayment.[18]

By early 2026, the position had consequences a rating agency could not ignore. S&P revised SoftBank’s outlook to negative in March, affirming a BB+ rating already below investment grade and describing OpenAI as one of the group’s investments “with the weakest credit quality” — even as Moody’s held a stable view a notch lower, the disagreement itself is a measure of how contested the bet is.[19] Reported leverage was still inside SoftBank’s own 25 percent loan-to-value ceiling at the end of 2025, but the chief financial officer had publicly opened the door to exceeding it “temporarily,” and S&P warned the OpenAI follow-on could push leverage toward the 35 percent line that would trigger a downgrade. The shares fell roughly 45 percent from their October 2025 high; one bank labeled the company a “valuation trap”; and SoftBank paused a separate $50 billion acquisition to preserve capacity.[20]

The bull would correctly object that this is only the liability side. SoftBank also holds one of the most valuable single assets in technology — roughly 90 percent of Arm, a stake worth more than $150 billion at mid-2026 prices — plus some $45 billion in unrealized gains on the OpenAI position itself, and it has shown it can monetize on demand, having sold Nvidia and T-Mobile to raise cash. That is real, and it is the strongest case for SoftBank’s resilience. But it cuts toward the concentration problem, not away from it: by mid-2026, the Arm and OpenAI stakes together made up nearly two-thirds of SoftBank’s assets, and the Arm holding is already pledged — an $8.5 billion margin loan drawn against it, with room for more. The crown jewel is collateral. And the credit market noticed: SoftBank’s five-year credit-default swaps widened to an eleven-month high after the S&P action, the widest among major Japanese corporates — the cost of insuring its debt rising in step with the bet.[20]

There is a circularity worth naming. SoftBank is OpenAI’s largest outside backer and, through SB Energy, a builder of the data centers OpenAI will rent. In France, it would play both roles again: financing the anchor tenant and constructing the capacity that the tenant is expected to fill.

Here is what that balance sheet did not do: fund Stargate LLC. The roughly $19 billion equity tranche SoftBank pledged to the vehicle has no confirmation of ever having been wired, because the vehicle was bypassed.[21] The chief financial officer’s own description of the model is the tell: SoftBank makes an equity investment, but the project itself is “financed as project finance,” so its own commitment is “limited” and “should not be too huge.”[22] Stripped of the jargon: SoftBank lends its name and a sliver of equity, and someone else’s debt builds the thing. The capital that flowed to an actual Stargate site was a $500 million check into SB Energy for the Milam County build. The headline was $500 billion; SoftBank’s verified site-level equity was three orders of magnitude smaller.

This reframes what the French €45 billion actually is. It is not a promise that SoftBank will place €45 billion on its own books. It is a promise that SoftBank will supply catalytic equity and arrange project financing that does not yet exist — Son said as much at the podium, describing the venture as one SoftBank is “aggregating project financing” to fund, against demand from an anchor tenant not yet named, on a balance sheet already carrying the most concentrated single-name bet in the AI buildout.[22] The pledge’s deliverability is downstream of a financing structure that has to be assembled and of an OpenAI liquidity event — an IPO — that has to occur before the bridge facility is repaid. France controls none of those variables.

And here, the two halves of the story close together. Staged commitments and project finance are, on their own, unremarkable — every large data-center developer rings capex into phases and funds it with non-recourse debt, because that is cheaper than equity and isolates the risk. The question is never whether a pledge is staged; it is what the staging rests on. SoftBank will not put €75 billion of its own balance sheet behind this — the balance sheet just described could not absorb it on top of the OpenAI commitment — so it writes a €75 billion option instead: a headline ceiling, a smaller firm tranche, and project finance to be arranged later. What changes with leverage is not the structure but the margin for error within it. A cash-rich sponsor that stages a pledge can absorb a slipped tranche or a delayed financing; a sponsor whose crown jewel is already collateral, whose follow-on runs to October, and whose bridge presumes an IPO cannot.

The more strained the balance sheet, the larger and softer the number it can afford to announce, because softness is free and the announcement is the deliverable. To be precise about where the softness enters: not, mostly, with SoftBank. Its press release was scrupulous — “up to” €75 billion, a firm “€45 billion,” the rest explicitly “plans.” The recharacterization happened at the podium, when a phased pledge with one firm tranche became, in Macron’s telling, €93 billion “confirmed.” SoftBank disclosed an option. The summit booked it as cash.

What France actually brings, and what it doesn’t

The honest counterargument is that France is not Texas, and the difference favors the pledge. This deserves a fair hearing, because it is the strongest case for taking the €45 billion at close to face value.

France’s advantages are real and, unlike capital, not exportable. The grid is roughly 70 percent nuclear, France is, in most years, the world’s largest net electricity exporter, and industrial power prices sit well below those in much of Europe, with EDF long-term pricing around €70 per megawatt-hour from 2026.[23] For a buildout whose binding constraint is increasingly power rather than capital, that is a genuine structural edge, and it is why the first-phase sites cluster in Hauts-de-France near existing grid and nuclear infrastructure, including a former coal site at Bouchain where EDF is the named development partner.[24] It also matters that the prior SoftBank pledges failed precisely on the variable that France has solved: the Saudi solar plan had no offtaker, and the UK Stargate site was paused due to energy costs. France removes the constraint that killed those. If any SoftBank data-center pledge converts close to schedule, the case for this one is better than most — and that concession should be granted in full.

But cheap power is necessary, not sufficient, and it is not the variable that has stalled the buildout this year. What stalled Stargate was not the price of electricity; it was demand discipline and financing — a canceled expansion, a paused site, a vehicle that never funded. France solves the kilowatt-hour. It does not supply the anchor tenant, the assembled debt, or the balance-sheet capacity, and those are the three things the precedent says actually bind. Power is the one layer of the stack that France owns, and it is the bottom layer. Above the kilowatt-hour, the French buildout is foreign at every tier. The capital is Japanese. The chips are American — Nvidia silicon, subject to American export jurisdiction. The most likely offtaker of five gigawatts of French inference and training capacity is American, because the anchor tenant SoftBank builds for is OpenAI, and no European anchor of remotely comparable demand has been named.[25]

Macron said the summit would make France “the leading country hosting data centers and computing capacity in Europe,” and that the country was “closing the gap we had in computing capacity.”[26] Both claims may even come true. But hosting capacity and owning intelligence are different sovereignties, and the gap that closes is the one measured in megawatts, not models. This is the substrate-state position, normally diagnosed in Southeast Asian economies that host hyperscaler data centers without owning any layer of the intelligence that runs on them. It is striking to find a G7 economy with a world-class research base occupying the same structural slot — providing the physical inputs and importing everything above it. The fair counter is that substrate can be a first rung rather than a ceiling: Taiwan and South Korea became chip powers partly by first hosting foreign firms’ manufacturing, and a country cannot build the intelligence layer on capacity it never built. Hosting compute you don’t yet own can be a deliberate developmental bet. But the bet only pays off if value accrues locally over time — if the substrate becomes a ladder.

The SoftBank pledge is built the other way: a foreign sponsor, foreign chips, and a most-likely-foreign tenant, with no disclosed mechanism for the intelligence layer to be handed over to French hands. It is a substrate as a destination, not a substrate as a rung.

There are two genuine exceptions inside the broader French buildout, and honesty requires naming both — because they sharpen the point rather than soften it. The first is Campus AI, the joint venture whose expansion supplied the €7.5 billion tier; its French AI champion, Mistral, secured up to 200 megawatts of capacity there, announced the same day as the summit.[7] But Mistral’s role in Campus AI is principally that of shareholder and board member; the project’s own coordinator described the startup as a “preferred” future client while conceding that, for now, “nothing has yet been done” on a binding tenancy.[7] Campus AI’s own president framed the stakes in terms that could serve as this article’s thesis: the test, he said, is that “every gigawatt must grow value in France, and not simply pass through it.”[7] The second exception, and the more real one, is Mistral’s own data center at Bruyères-le-Châtel — its first debt-financed build, totaling $830 million for roughly 13,800 Nvidia chips and about 44 megawatts of capacity.[27] That is the genuine article: a French company owning its own compute.

And its scale is the whole argument in one number. Forty-four megawatts of sovereign French compute, against SoftBank’s 3,100-megawatt first phase. The champion’s owned infrastructure is roughly 1% of the substrate that the country provides for someone else’s use. For the marquee number — five gigawatts — there is no French anchor. The grid is the moat, and nearly everything it powers belongs to someone else. And even the grid advantage is contingent on RTE, the French grid operator, actually delivering 3.1 gigawatts of new connection capacity to three specific sites by 2031 — an unprecedented load addition on a timeline that grid-connection history does not obviously support, and that no signed connection agreement has yet confirmed.[28]

What would have to be true

The thesis is falsifiable, and it is worth stating the conditions plainly, because they are also the things a serious investor should watch. And there is someone who should watch. An option-shaped pledge harms no one if everyone prices it as an option — but it is not being priced that way. It is being booked as a record by a government building industrial-policy narrative on it, cited by analysts pricing “France is Europe’s AI hub” into datacenter REITs and French-exposure allocations, and folded into the case for a SoftBank credit that already trades below investment grade. The reader who needs the disaggregation is the one about to treat €93 billion of intention as €93 billion of capital.

The skeptical reading is wrong if, within roughly twelve months, SoftBank secures binding project financing — not a memorandum — for at least the Dunkirk site; if a named anchor tenant or binding offtake agreement appears; if an executed lease replaces “preferred bidder” status at Bouchain; and if the OpenAI IPO closes cleanly enough to let SoftBank refinance the March 2027 bridge without forced asset sales. If those happen, the €45 billion converts, and the substrate-state critique becomes a quibble about who owns the value rather than whether the buildings exist.

The thesis is confirmed if the tells repeat: financing perpetually “being assembled,” capacity that “can scale to” rather than “will reach,” a first-operations date that slips past 2028, no anchor tenant disclosed by 2027, a further S&P action, or the same “pause” language that appeared over the UK site in April.

Which is the precise thing the word confirmés was chosen to obscure. Macron did not announce €93 billion of investment. He announced €93 billion of intention, of which the largest single component is a ceiling, two-fifths of that ceiling is merely a plan, and the firm remainder rests on a balance sheet betting its credit rating on a single American startup’s path to an IPO. The number is not false. It is an option — priced, and presented, as a certainty.

Notes

[1]: Emmanuel Macron, remarks at the Choose France summit, Versailles, June 1, 2026: “Cette édition de Choose France à elle seule va permettre de cristalliser un montant record de 93 milliards d’euros d’investissements confirmés.” Reported by franceinfo, June 1, 2026; quote also carried verbatim by Euronews FR. The €93 billion figure spans 71 projects and a French-government-stated ~15,600 jobs; it is an announcer-claimed forward figure, not an audited outcome.

[2]: SoftBank Group Corp., “SoftBank Group to Build 5 GW of AI Data Center Capacity in France,” press release, May 30, 2026. The €75 billion figure is stated as “up to.”

[3]: franceinfo, June 1, 2026, reporting that the single 2026 edition exceeded the cumulative announced totals of the prior eight Choose France editions (~€87 billion combined). Prior editions per Élysée/Business France press dossiers (2023 dossier, diplomatie.gouv.fr): 2023 ~€13B; 2024 ~€15B; 2025 stated variously as ~€20B (Macron, 2026 framing) and €40.8B (2025 press dossier) — the moving baseline is noted as itself indicative of headline elasticity.

[4]: SoftBank press release, May 30, 2026: the first phase is described as “an initial €45 billion investment to deliver 3.1 GW”; subsequent capacity is described as the company “also plans to develop additional sites across France.” The shift in verb from “investment/commitment” to “plans” is within the same document.

[5]: SoftBank press release, May 30, 2026. Named first-phase sites: Dunkirk (Loon-Plage), Bosquel, and Bouchain, all in Hauts-de-France; Schneider Electric named as strategic partner (robotized manufacturing at Dunkirk); SB Energy as developer; first operations targeted 2028, full phase by 2031. Per a separate SoftBank announcement (reported by TechRepublic, June 2026), the Bosquel ~1 GW site is structured as a majority-SoftBank joint venture with Sesterce — i.e. even within the “firm” first phase, the capital structure is partly third-party, not pure SoftBank balance sheet.

[6]: Smaller data-center tier, per Choose France 2026 reporting (Le Monde Informatique, Le Journal des Entreprises, Silicon.fr, June 1, 2026): Brookfield €10B at Escaudain (Nord), with Data4, for a ~1 GW datacenter, bringing its stated France AI total to €30B — of which €20B was announced at the February 2025 AI Action Summit (Brookfield press release, Feb 10, 2025: €15B via Data4 + €5B associated infrastructure, delivery by 2030), so only €10B is new to the 2026 summit. Nebius ~€8B / 240 MW on the former Bridgestone site at Béthune. Ardian/Verne ~€5B for a 500 MW Île-de-France campus, full 500 MW capacity targeted only 2035–2037, itself the first tranche of a broader ~€10B / 1 GW French consortium (Ardian, Iliad, EDF, Orange, Scaleway). Figures are announcer-claimed; several were pre-trailed by Les Echos and final terms may differ.

[7]: MGX–Bpifrance ~€7.5B is the national expansion of Campus AI, the joint venture of Bpifrance, Mistral AI, MGX (UAE), and Nvidia, first announced at Choose France 2025 (May 19, 2025) to build “Europe’s largest AI Campus” (flagship ~1.4 GW, Paris region). Per the Bpifrance press release (June 1, 2026), the expansion targets up to 3 GW nationally and the ~€7.5B second-site selection “doubles the consortium’s initial investment”; the second site selection is described as “imminent,” not yet committed. The flagship campus at Fouju (Seine-et-Marne) was reported still in early construction (”foundations laid, main site not yet begun”) as of April 2026; the flagship’s secured first tranche is reported at ~€8.5B (Le Figaro), a separate figure from the €7.5B second-site expansion. Campus AI is the one summit pledge with a French intelligence-layer anchor (Mistral); the substrate-state exception is noted in the body. The Campus AI president quoted in the body is Thibaud Desfossés (”chaque gigawatt doit faire fructifier la valeur en France, et non simplement la traverser”), per the Bpifrance press release.

[8]: Revolut’s ~€1B France commitment was reported as contingent on the firm obtaining a French/EU banking licence.

[9]: Emmanuel Macron, remarks reported by Reuters, June 1, 2026: characterizing the AI-related portion as “20 billion invested, and 20 billion of AI investments as a follow-up to the summit in February.” Verify verbatim French against the Élysée transcript before publication.

[10]: The February 2025 AI Action Summit in Paris produced a ~€109 billion headline; France published no public reconciliation of that figure to authorized, appropriated, or disbursed capital. See “The King’s New Datacenters” (The AI Realist, March 25, 2026), which audited the €109B pledge to an honest near-term figure of roughly €25B.

[11]: OpenAI, “Announcing The Stargate Project,” January 21, 2025; announced at the White House with President Trump, Sam Altman, Larry Ellison, and Masayoshi Son. Headline: “$500 billion over the next four years … We will begin deploying $100 billion immediately.” Son named chairman.

[12]: Reported equity structure (The Information; corroborated by Bloomberg, WSJ): ~$52B committed equity against the $500B headline — roughly $19B each SoftBank and OpenAI, ~$7B each Oracle and MGX — implying ~90% of the program was to be debt- and vendor-financed and not yet arranged at announcement. WSJ reported SoftBank’s equity share could be as low as ~10%.

[13]: Epoch AI, “OpenAI Stargate: where the US sites stand”, satellite-imagery analysis, April 17, 2026: Abilene operational at ~0.3 GW (April 17 reading; a later cached version of the same page shows ~0.6 GW), ~4 of 8 buildings live, against a 1.2 GW site target; Epoch projects the program to “exceed 9 gigawatts by 2029” versus the $500B/10 GW headline announced January 2025; six other US sites in early construction on ~Q4 2028 timelines. “Operational” capacity is satellite-verified (Airbus DS imagery); OpenAI’s “nearly 7 GW planned / $400B+ over three years” figures (five-new-sites announcement, Sept/Oct 2025: https://openai.com/index/five-new-stargate-sites/) are announcer-claimed. The Abilene ~600 MW expansion was redirected, with Microsoft taking the adjacent 900 MW Crusoe site.

[14]: Reporting by The Information, corroborated by Bloomberg and the Financial Times (early–April 2026): Stargate LLC had hired no staff and was developing no data centers; OpenAI pursued bilateral capacity deals (Oracle ~$300B/4.5 GW, plus AWS, Google Cloud) and treated “Stargate” as an umbrella term for its compute strategy. Bloomberg (Aug 7, 2025) earlier reported CFO Yoshimitsu Goto conceding the effort was “taking longer than anticipated.”

[15]: Abilene expansion (~600 MW) cancelled: Bloomberg, March 6, 2026 (Microsoft took the adjacent Crusoe capacity). Stargate UK paused: Bloomberg, April 9, 2026, citing energy costs.

[16]: Abilene construction: Crusoe/Oracle; JPMorgan project-finance facility (~$2.3B, May 2025) and a Newmark-led syndicate (~$7.1B); Nvidia GB200 racks installed from mid-2025; Ellison stated an ultimate target above 450,000 GB200 GPUs under a 15-year Oracle lease. These are real, closed commitments and are cited to discipline the “headline is empty” overclaim.

[17]: SoftBank completed a $41B OpenAI round in December 2025 for ~11% (comprising ~$30B from SoftBank Vision Fund 2 plus ~$11B syndicated co-investment); on February 27, 2026 it agreed a further $30B follow-on (SoftBank Group Corp. press release), funded through Vision Fund 2 as part of OpenAI’s ~$110B round (the largest private funding round on record, valuing OpenAI at ~$852B), bringing cumulative investment to an expected $64.6B and ~13% stake “upon completion,” subject to closing conditions. The follow-on is staged: first $10B tranche executed April 1, 2026; further $10B tranches scheduled July 1 and October 1, 2026 (SoftBank Group Corp. press release, April 1, 2026). As of the June 1 summit, the $64.6B figure is therefore expected-on-completion, not a settled position.

[18]: Funding via disposal of SoftBank’s entire Nvidia stake (~$5.83B, October 2025) and T-Mobile shares; $40B bridge facility signed March 27, 2026, with the first $10B drawn April 1, 2026 (SoftBank Group Corp. press release). The facility is unsecured and full recourse to SoftBank, with no OpenAI shares or Arm stake pledged as collateral; per IFR / loan syndication reporting, the margin starts at 250bp over SOFR and steps up by 17.5bp from July through end-September 2026, a structure designed to incentivise an early takeout via bonds or term loans ahead of an expected OpenAI IPO (widely reported as targeted for late 2026 / as early as Q4 2026; the 12-month tenor, maturing ~March 25–26, 2027, is read by lenders as a bet on that listing). A separate ~$10B margin loan (arranged by Goldman Sachs, JP Morgan, Mizuho; two-year facility with one-year extension, limited recourse) is distinct from the bridge; SoftBank subsequently scaled this facility back toward as little as ~$6B after creditor hesitation (Bloomberg, via Fortune) — a direct signal of the financing strain the body describes. MST Financial’s David Gibson, via the Financial Times, estimated SoftBank faces “[an estimated] $50bn ... of funding, between OpenAI, investments and refinancing” to arrange over the course of 2026; OpenAI is not expected to reach profitability until 2030.

[19]: S&P Global Ratings, action reported March 2026 (S&P statement via Bloomberg; B-tier link to wire coverage of the agency statement): outlook revised to negative, BB+ affirmed (below investment grade), OpenAI described as “one of its investments with the weakest credit quality”; S&P also flagged the unlisted-asset proportion rising above 50% (from 42%) and warned the $30B follow-on could push leverage toward the 35% level that would trigger a downgrade. Moody’s held SoftBank at Ba2/stable (2025 upgrade). The agency divergence is presented to avoid cherry-picking the bearish view; both keep SoftBank below investment grade.

[20]: SoftBank’s reported loan-to-value ratio was 20.6% at end-December 2025, within its stated financial policy (LTV managed below 25% in normal conditions, 35% emergency ceiling; SoftBank Group Corp. disclosure). CFO Yoshimitsu Goto told the Financial Times (March 2026) the group “does not rule out” temporarily exceeding 25%. ADR down ~45% from its October 2025 high by late March 2026; Jefferies downgraded to “Underperform,” calling the company a “valuation trap”; SoftBank paused a separate ~$50B acquisition (Switch). The piece does not claim the 25% ceiling was breached as of publication — only that the CFO opened the door and S&P flagged the trajectory.

[21]: No A-tier source confirms SoftBank’s ~$19B Stargate LLC equity tranche was wired; reporting (The Information, Bloomberg, FT) indicates the JV was bypassed in favor of bilateral deals. Bloomberg Intelligence estimated SoftBank’s actual Stargate cash requirement nearer ~$40B “given its less-active-than-expected participation” — an estimate, not a disclosure.

[22]: Yoshimitsu Goto, SoftBank Q3 FY2025 earnings call, February 12, 2026 (translated remarks): SoftBank makes an equity investment while the project itself is financed as project finance, so SoftBank’s own size is “limited” and the amount “should not be too huge.” Verify exact translated wording against the SoftBank transcript before publication. Son corroborated the same structure at the Choose France podium, stating SoftBank is “aggregating project financing” for the French venture and that the figure “balloons to roughly $750 billion once the broader system is factored in” (CNBC, June 1, 2026) — the announcer himself confirming both that the financing is not yet assembled and that the headline expands on a “broader-system” basis.

[23]: French grid: ~70% nuclear share of generation; France the largest net electricity exporter in Europe/globally in most years (RTE/IEA data — cite data year at fact-check). Note the 2022 exception: amid widespread reactor-corrosion outages France was briefly a net importer, which is why the body says “in most years.” EDF long-term industrial pricing ~€70/MWh from 2026 per the post-ARENH framework. Replace paraphrase with primary RTE/CRE figures and the specific data year before publication.

[24]: SoftBank press release, May 30, 2026; Bouchain former coal-plant site with EDF as named development partner (described at “preferred bidder/due diligence” stage). Grid-proximity rationale for the Hauts-de-France cluster per company and regional (CC2SO/RTE) materials; Bosquel reported ramping 240 MW → ~1 GW → 1.4 GW per regional authority citing RTE.

[25]: No anchor tenant was named in the SoftBank announcement. The substrate-state characterization (Japanese capital, US chips, likely-US offtake) is an analytical inference from SoftBank’s OpenAI relationship, not a stated offtake agreement; flagged as inference.

[26]: Emmanuel Macron, remarks from the Élysée, June 1, 2026, reported by regional French press (mesinfos/La Semaine de l’Île-de-France): aim to make France “le premier pays accueillant des centres de données et des capacités de calcul en Europe” and “Nous sommes clairement en train de combler le retard que nous avions en matière de capacités de calcul en Europe.” Verify against the Élysée transcript before publication.

[27]: Mistral AI raised $830M in debt financing (its first debt raise since founding) from a seven-bank consortium (incl. BNP Paribas, Crédit Agricole CIB, HSBC, MUFG) to acquire ~13,800 Nvidia GB300 chips for a data center at Bruyères-le-Châtel (Essonne), ~44 MW, operational expected Q2 2026 (TechCrunch, March 30, 2026; also Reuters, CNBC). Separately, on June 1, 2026, Bpifrance announced Mistral secured up to 200 MW of capacity with Campus AI (Bpifrance press release); the Campus AI project coordinator (L’Usine Nouvelle) described Mistral as a “preferred” future client and board member/shareholder while stating no binding tenancy was yet concluded — the distinction between equity partner and committed offtaker is preserved in the body. Scale contrast: ~44 MW of Mistral-owned compute vs. SoftBank’s 3,100 MW first phase.

[28]: RTE 3.1 GW connection feasibility to Dunkirk/Bosquel/Bouchain by 2031: no published binding confirmation as of publication. CRE fast-track connection regime (deliberation 2025-120) implies multi-year (≈3–4 year) connection timelines even when expedited. Press-release language on “abundant, decarbonised electricity” is political framing, not a signed connection agreement.

[29]: SoftBank pledge precedents: (a) December 2016 Trump Tower “$50B / 50,000 jobs,” drawn from the forming Vision Fund, with ~half of deployed capital flowing into WeWork (peak ~$47B valuation; 2023 bankruptcy) — Axios retrospective; (b) March 2018 Saudi PIF “$200B / 200 GW” solar MOU, shelved by ~September 2018 (WSJ); (c) Vision Fund 2 ($108B target, ultimately run largely on ~$38B of SoftBank’s own capital). Each: a head-of-state-adjacent headline converting to a fraction of announced, slower, and structurally different capital. France-specific conversion claims are forecasts based on this precedent, not observed outcomes.

On May 29, a deputy from the president’s party named Éric Bothorel filed twelve amendments to a copyright bill. Three more came from his Renaissance colleague Prisca Thévenot. All fifteen landed the same Friday, three days before the Assembly’s culture commission was due to examine the text, and all fifteen failed the following Tuesday.[1] Asked where the measures came from, Bothorel told Le Point that some had been soufflés par Mistral — whispered by Mistral.[2]

That sentence is the one this newsletter spent four thousand words predicting last week.

“Lobby, Levy, Legislate” argued that Mistral’s moat is not sovereignty or model quality but access: the French president’s contact list, which Arthur Mensch is working to convert into formal law before the 2027 election changes who answers the phone.[3] That was an inference from the customer roster and the lobbying pattern. It did not name this bill; it named the move. A week later, a legislator in the governing party put the move on the public record.

The bill itself is narrow. Proposition de loi n° 2634, adopted by the Senate, would install a présomption d’utilisation: a presumption that an AI provider trained on protected cultural works, unless the provider can document otherwise.[4] It reverses the burden of proof. Today, an author has to prove their work was scraped; under the text, the company has to show what went into the model. The French government’s own civic portal describes it in one line: the bill reverses the burden of proof. [5]

The amendments tell you whom that threatens. One of Bothorel’s amendments inserts two words, de modèles, after “fournisseurs,” narrowing the bill so it binds only model-builders and exempts the French firms that merely deploy AI downstream — the corporates that fill Mistral’s customer list. Its justification is not commercial. It is sovereign: a broad scope, the amendment argues, would halt the sector’s growth and our digital sovereignty. [6] Another strikes the retroactivity clause, reciting the industry’s standard line that documenting training data demands complex technical adaptations. [7] A third went after the bill’s title.[8] Filing amendments against a bill is ordinary politics; a legislator admitting the affected company drafted them is not. The sovereignty argument, deployed to reshape a copyright statute, in the pen of the president’s party. This is not yet the procurement law the long-form predicted — it is the same access doing the simpler job first: shielding the customer list from a bill before writing the law that entrenches it.

Emmanuel Maurel, the deputy carrying the text, attributed the pressure to “certains anciens ministres du bloc central” — former central-bloc ministers now working the building.[9] Readers of the long-form will recognize the address. The piece built its second act on one such figure: Cédric O, the former secretary of state for digital affairs who became a Mistral shareholder and adviser.[3] Maurel, with no framework to grind, arrived at the same door.

The calendar rhymes, too. Yaël Braun-Pivet, the Assembly’s president, received Mensch on May 7. Five days later, the panel that sets the Assembly’s agenda drew up the lineup for a cross-party session and left the copyright bill off it.[10] The Assembly says the meeting was routine. The sequence stands regardless.

Last week’s piece closed on “a calendar that runs out in eighteen months.” This week sharpens why the calendar matters. The lobbying is not the behavior of a company that thinks it has time; it is the behavior of one racing against a deadline. Fifteen amendments filed in a single afternoon are the president’s party spending its access while the access still exists.

There is one scenario where the clock resets: Gabriel Attal. The former prime minister has made AI a central plank of his campaign, vowing to turn France into “la patrie de l’IA,” and a macroniste successor in the Élysée would keep the contact list warm.[11] But Attal is not the favorite, by far. A moat that depends on a trailing candidate is a moat with an expiry date. The base case is the one the long-form named: the access leaves with the administration that built it. That is why Mistral is not waiting. You do not whisper fifteen amendments into a friendly deputy’s hand if you expect the friendly deputies to still be there in three years.

The commission turned back all fifteen, and the bill survived the room. But the surviving committee is not a passage. The text now sits last in the running order of a reserved day claimed by a small opposition group, a slot it may never reach; if it advances with amendments attached, it returns to the Senate to die of scheduling.[12] Mistral does not need to defeat this bill. It needs the bill to never finish, and it has a governing party willing to file amendments to buy time.

Still, time is the one thing Mistral cannot lobby for. The president, whose contact list is the moat, is term-limited and polling in the low twenties; in 2027, he leaves, and the phone Mensch has been calling stops being his to answer.[13] The amendments filed in a single afternoon are not the work of a winning company. They are the work of one racing to pour its access into law before the access walks out of the Élysée. Strip the sovereignty language, and the structure is plain crony capitalism: a national champion whose valuation, customer base, and inner circle of former ministers are all underwritten by one man’s term in office.[3]

The lobbying was the visible part. The confession was the story. The clock is the verdict. Macron’s days are numbered, and everyone on his contact list is counting down with him.

Notes

[1]: Amendments to Proposition de loi n° 2634, Commission des affaires culturelles et de l’éducation, Assemblée nationale. Of sixteen amendments examined June 2, 2026, twelve were filed by M. Éric Bothorel and three by Mme Prisca Thévenot (both groupe Ensemble pour la République); one, by Mme Véronique Ludmann (Horizons), was withdrawn. All were deposited May 29, 2026 and rejected or withdrawn June 2. Amendment list and authors, Assemblée nationale.

[2]: Thomas Graindorge, “« Je n’ai jamais vu un lobbying de cette puissance » : à l’Assemblée, la bataille de Mistral contre le droit d’auteur,” Le Point, June 1, 2026. Éric Bothorel quoted acknowledging certain measures were “soufflés par Mistral.” Erwan Balanant (Les Démocrates) is quoted in the same piece: “Je n’ai jamais vu un lobbying de cette puissance-là sur les domaines culturels.”

[3]: “The President’s Customer List,” The AI Realist, May 2026. The Cédric O biographical detail — his role as Mistral shareholder and adviser following his tenure as secretary of state for digital affairs — is sourced there.

[4]: Proposition de loi relative à l’instauration d’une présomption d’utilisation des contenus culturels par les fournisseurs d’intelligence artificielle, n° 2634, adopted by the Sénat (unanimously) April 8, 2026. Commission text n° 2864-A0 deposited at the Assemblée June 2, 2026. Note: the Sénat title used “présomption d’exploitation”; the version examined at the Assemblée reads “présomption d’utilisation.”

[5]: Vie publique (Direction de l’information légale et administrative), notice of April 10, 2026: the bill “renverse la charge de la preuve de l’utilisation de contenus culturels par les fournisseurs d’IA.”

[6]: Amendement n° AC2, M. Éric Bothorel, Commission des affaires culturelles, rejected June 2, 2026: “À l’alinéa 4, après le mot « fournisseurs » insérer les mots « de modèles ».” Exposé sommaire: “Un champ d’application trop large et non justifié du texte […] mettrait un coup d’arrêt à l’essor du secteur et à notre souveraineté numérique.” The amendment also cites the Munich Regional Court ruling GEMA v. OpenAI (November 11, 2025) — the same enforcement action analyzed in “Register, Disclose, Pay.”

[7]: Amendement n° AC10, M. Éric Bothorel: “Supprimer l’alinéa 5,” removing retroactive application to pending litigation, on the grounds that transparency and traceability compliance requires “des adaptations techniques complexes” that cannot be applied retroactively.

[8]: Amendement n° AC3, M. Éric Bothorel, targeting the bill’s title (TITRE).

[9]: Maurel quote per Le Point (note 2). Maurel, the GDR rapporteur, has publicly championed the text alongside the collecting societies Adami, SACD, and ADAGP.

[10]: Braun-Pivet–Mensch meeting (May 7) per Le Point (note 2). The bill’s absence from the agenda set by the May 12 Conférence des présidents is corroborated by “IA : pas de proposition de loi sur le droit d’auteur à l’ordre du jour de l’Assemblée nationale,” Le Monde, May 12, 2026, and by Décideurs Juridiques, May 12, 2026.

[11]: Gabriel Attal, first major campaign rally, May 29, 2026, per Le Point (note 2), which reports his ambition to make France “la patrie de l’IA” and attributes to him an effort to slow the text. Direct-quote wording to be confirmed against the rally transcript before syndication.

[12]: Procedural posture per Le Point (note 2): the text is placed last in the GDR niche order of June 11; amendments lengthen hémicycle debate and, if adopted, force a return to the Sénat for a conforming vote.

[13]: Emmanuel Macron, in his second consecutive term, is barred by Article 6 of the French Constitution from seeking a third; his mandate ends in 2027. His approval stood in the low twenties as of May 2026 (Ipsos, Elabe, and Morning Consult tracking polls), as detailed in “The President’s Customer List” (note 3).

On May 27, asked at Meta’s annual shareholder meeting whether the company would ever take on Amazon, Microsoft, and Google in cloud computing, Mark Zuckerberg said the idea was “definitely on the table.” [1] Then he added the qualifier that matters more than the headline: Meta hasn’t rented out compute “because we think that we have a use for the compute,” and a cloud business becomes an option only “if we get to a point where we feel that we have overbuilt.” [2]

Read that again with the calendar open. Five weeks earlier, on April 24, Meta had signed a deal making it one of the largest customers in the world for Amazon’s Graviton processors — renting compute capacity from a direct competitor’s cloud, explicitly to get access to the silicon it needs now without waiting on its own data centers. [3] So in the same quarter, the only one of the four U.S. hyperscalers that does not sell cloud services [4] was simultaneously a major buyer of someone else’s compute and a prospective seller of its own. Short and long, on the same balance sheet, at the same time.

That is the contradiction worth chasing. Everyone in AI is supposedly starved for compute — GPUs backordered for months, Amazon’s own training chips shipping slower than it can build them, North American data-center vacancy at 1.4% at the end of 2025. [5] And here is the company building more of it than anyone, raising the possibility that it might have too much. Where does “excess capacity” come from in a world that can’t get enough?

The claim: a put, not a pivot

The answer is that “excess” and “scarcity” are not opposites here. They are the same condition seen from two ends of a balance sheet — and which end you look from determines how you should price Meta.

Meta’s cloud remark is not a product strategy. It is a put option on its own buildout. And the interesting question is whether to read that option as fragility or as optionality. Both readings are live. Both are defensible from the same numbers. The piece that follows is about which one the evidence favors, and why the remark itself is the tell.

The numbers frame the tension. Meta raised its 2026 capital-expenditure guidance to $125-$145 billion, up from a prior range of $115–$ 135 billion, citing higher component prices and “additional data center costs to support future year capacity.” [6] As much as double what it spent in 2025, and even at the floor, more than 2024 and 2025 combined. [7] Yet first-quarter capex came in at just $19.84 billion — below the $27.57 billion analysts expected. [8] The company spent modestly and guided enormously in the same breath, and the market punished the guidance, not the spend: the stock fell roughly 7%. [9]

The exposure is not in what Meta has spent but in what it has promised to spend. The first-quarter filing carries $237.67 billion in non-cancelable contractual commitments — mostly third-party cloud capacity, servers, network infrastructure, and data centers — against $81.18 billion of cash and marketable securities. [10] Separately, it disclosed $182.88 billion of leases not yet commenced, consisting of data centers, colocations, and network infrastructure that begin between now and 2036. [11] The commitment line jumped by $107 billion in the quarter alone, which chief financial officer Susan Li attributed to multiyear cloud deals and infrastructure purchase agreements. [12] The overbuild, if there is one, does not live in trailing capex. It lives in the contracts — and contracts do not flex when demand disappoints.

The first reading — call it the Overbuild Put — holds that Meta is stacking every available lever to make a buildout look affordable whose paying customer it has not yet secured, and that the cloud remark is the final lever: a backstop buyer of last resort for capacity its own products may not fill. The second reading — call it Scarcity Builds the Glut — holds that the overbuild is rational, that an advertising machine of staggering profitability is funding it from cash, that scarcity is real and the surplus will be absorbed, and that the cloud option is genuine upside rather than a distress signal. The rest of this piece develops both, then resolves them.

The mechanism: four levers and a backstop

Start with the paradox, because resolving it is the whole argument.

The compute Meta is renting from Amazon, and the compute it is building is not the same as the compute it is renting. The Graviton deal brings tens of millions of Arm-based CPU cores into Meta’s portfolio — general-purpose silicon suited to agentic inference, the workload that runs after a model is trained, and available immediately. [3] Hyperion, Meta’s flagship campus in Richland Parish, Louisiana, is a five-gigawatt site built for the next generation of frontier training, and it does not come online until 2029. [13] Different silicon, different workload, different clock. Meta is short on the inference capacity it needs this year and long on the training capacity it has committed to for the end of the decade.

That gap — between capacity contracted years ahead and demand demonstrated today — is where “excess” is manufactured. And it is manufactured by the very scarcity panic that justifies the spending. Racing a feared shortage, you commit to gigawatts that arrive in giant, indivisible blocks long before the workloads exist to fill them. The scarcity is what produces the glut. They are the same phenomenon.

Meta’s own answer is that the gap is illusory — that the committed capacity is precisely the inference base it needs to put personal and business agents in front of billions of users, as Li told the call. [14] That may prove right. It is also exactly the demand that has to materialize on schedule for the contracts to pay, and a backstop is what a management team names when it wants insurance against its own forecast.

Now the affordability levers — each of them legal, disclosed, and used across the industry. The question is never whether any one of them is permissible; it is what they add up to. The buildout only proceeds if it can be made to look cheaper than it is.

The first lever is the off-balance-sheet vehicle. Meta financed Hyperion through a joint venture with Blue Owl Capital — Blue Owl owns 80%, Meta 20% — funding construction through a special-purpose vehicle (SPV), Beignet Investor, that raised roughly $27 billion of debt against about $2.5 billion of equity: close to $30 billion in total, the largest private-credit data-center deal on record. [15] The structure keeps the debt off Meta’s books, and the price of that engineering shows in the terms. The bonds, rated A+ by a single agency on the strength of Meta’s backing, priced at a 6.58% yield — roughly 225 basis points over Treasuries, wider than Meta’s own senior notes pay despite the identical credit standing behind them, the premium a charge for the off-balance-sheet structure, and the 24-year tenor — and mature in 2049. [16] This is not a one-off but a template. A second vehicle follows the same logic: a roughly $13 billion structure for a gigawatt campus in El Paso, leaning on the same thin-equity, debt-heavy capitalization that is wildly insufficient if the workloads stall. [17][18] One detail in that deal is its own signal — it has no anchor lender, leaving the banks to syndicate the debt into capital markets rather than place it with a single committed buyer. [17] And these vehicles sit on top of, not instead of, the $58.75 billion of senior notes already on Meta’s own balance sheet. [19]

The second lever is the lease itself. To keep the rating agencies from treating the arrangement as debt, Meta structured the Hyperion lease on a four-year renewable term — short enough that the obligation need not be consolidated onto the balance sheet as a single long-term liability. [20] The debt is real; it simply does not appear where a casual reader of the 10-K would expect to find it.

The third lever is depreciation. Effective January 1, 2025, Meta extended the estimated useful life of a subset of its servers and network equipment to 5.5 years, a change it disclosed would reduce full-year 2025 depreciation expense by approximately $2.9 billion. [21] Lower depreciation flows straight to reported operating income without changing a dollar of cash. The timing is the point: Meta stretched the assumed life of its hardware precisely as it ramped the buildout, flattering the income statement at the moment the spending most needed flattering. The contrast with Amazon is exact. In the same window, Amazon shortened the useful life of a subset of its servers to five years, explicitly citing the rapid pace of AI innovation. [22] Two companies, one hardware reality, opposite accounting choices — and Meta picked the one that defers the reckoning. Michael Burry’s public broadside in late 2025, estimating roughly $176 billion of industry-wide understated depreciation between 2026 and 2028, is the bear case for that choice arriving on schedule. [23]

The defense is real: a GPU’s economic life does cascade — from frontier training down to cheaper inference and eventual resale — so a longer book life can be honest rather than cosmetic. But the cascade has to land somewhere. It presumes a profitable second use for silicon Meta has finished training on, and that second use is either internal inference demand or an outside renter. The depreciation assumption and the cloud option are the same bet wearing different clothes.

The fourth lever is the one Zuckerberg named out loud. Each of the first three makes the buildout look affordable; none makes it pay. The vehicles, the lease slicing, the stretched depreciation all assume the same thing — that the compute, once built, generates revenue. The financing analyst on the Hyperion deal said it plainly: Meta has to build the thing, “put workloads in it,” and operate on the presumption that it will monetize those loads later. [24] The cloud option is the answer to the question every other lever begs. If Meta’s own products do not fill the capacity, Meta rents it to someone whose products will — and the debt gets serviced either way. That is what a put is: the right to sell the underlying when you no longer want to hold it.

This is why the Commitment-versus-Spend gap matters so much. A company that has spent $19.84 billion against $237.67 billion in commitments is not yet overbuilt. [8][10] It is contracted to overbuild, with the spending back-loaded and the demand unproven. The cloud remark is what a management team says when it can see the gap between the contracts it has signed and the demand it can document, and wants the market — and the credit market in particular — to know there is an exit.

The strongest objection is that this is simply how the cloud business was born. AWS grew out of Amazon’s own internal slack in 2006: build for yourself, find you have spare capacity, rent it out. Selling the excess is not a red flag — it is the canonical path to the most lucrative franchise in enterprise computing. The distinction is sequence and leverage. Amazon converted capacity it already owned into a product before anyone had committed a quarter-trillion dollars of debt-financed, off-balance-sheet capacity to the bet. Meta is committing the capacity first, financing it through vehicles built to keep the debt invisible, and presuming the product will follow. AWS monetized a surplus it stumbled into; Meta is pre-committing to a surplus and naming, in advance, its buyer of last resort. One is discovery. The other is a hedge.

What actually exists

Here, the second reading is at its strongest, and honesty requires giving it full weight.

Meta can build models. For a year, that was an open question. Llama 4 launched in April 2025 to a poor reception; Yann LeCun later told the Financial Times that the benchmark results had been “fudged a little bit,” that the team used different models for different benchmarks, and that Zuckerberg lost confidence in the group and sidelined it. [25] Eleven of the fourteen researchers behind the original Llama left the company; LeCun himself departed in November 2025. [26] The flagship “Behemoth” model was delayed due to performance issues and never shipped as promised. [27] If the thesis were “Meta cannot compete at the frontier,” that history would carry it.

But it isn’t, and the history was reversed. On April 8, 2026, Meta Superintelligence Labs — the division built around the $14.3 billion Scale AI investment and chief AI officer Alexandr Wang — released Muse Spark, which scored 52 on the independent Artificial Analysis Intelligence Index — fourth in the world at launch, behind only Gemini 3.1 Pro, GPT-5.4, and Claude Opus 4.6, and far ahead of Llama 4 Maverick’s 18. [28] Meta is, demonstrably, back in the race. But the profile is spiky in a telling way: Muse Spark’s weakest results fall on exactly the agentic, real-world-work benchmarks that enterprise compute is sold against — it trails GPT-5.4 and Anthropic’s Claude models on Artificial Analysis’s GDPval economic-task evaluation and on Terminal-Bench, gaps Meta itself flagged as priorities for further work — while its standout scores cluster in consumer health and multimodal fluency. [29]

What it did with that model is the crux. Muse Spark is closed. Its weights are not published, and at launch, Meta offered no public API, only a private preview to select users — the model was available free through the Meta AI app and website, and rolling out as the default assistant across Facebook, Instagram, WhatsApp, and Ray-Ban glasses, but not sold to developers as a service. [30] Meta deliberately declined to monetize the intelligence layer externally. The model exists to make Meta’s own products better and to be consumed by Meta’s own three-billion-user base, monetized the way Meta monetizes everything — through advertising, supplemented by new $7.99 and $19.99 Meta AI subscriptions. [31]

And the advertising machine is extraordinary. First-quarter revenue rose 33% to $56.31 billion, the fastest growth since 2021; ad impressions were up 19% and price per ad up 12%; operating income reached $22.87 billion; and the company generated $12.4 billion of free cash flow in the quarter even after capex. [32] This is the heart of the optimistic reading. Meta is funding a generational infrastructure bet out of one of the most profitable businesses in the world, not borrowing against hope. It underperformed expectations in the quarter and retains the discipline to throttle. If the buildout is rational, this is why.

That cushion is thinning fast, though. The $43.6 billion of free cash flow Meta generated across 2025 is set to fall steeply in 2026 as capex roughly doubles — far enough that several analysts now model it turning negative within a year or two. [33] The ads engine funds the buildout today; whether it still does in 2027 is the seam the bear case pulls at.

It also sharpens the problem. A closed model that, at launch, sold nothing to outside developers does not generate external compute revenue. Muse Spark fills Meta’s consumer demand, not the commercial demand that would absorb a five-gigawatt training campus and service a thirty-billion-dollar SPV. The model’s success and the buildout’s empty revenue case trace to one decision: Meta chose to keep its best work inside the walls. The capacity outside the walls still needs a tenant.

Whose money builds it

If the advertising machine genuinely pays for all of this, one hire is hard to explain. In January 2026, Meta named Dina Powell McCormick, with sixteen years at Goldman Sachs, where she ran the global sovereign investment banking business, later a deputy national security adviser, with the Gulf relationships to match, president and vice chairman. [34] Zuckerberg’s brief for her was specific: partner “with governments and sovereigns to build, deploy, invest in, and finance Meta’s AI and infrastructure,” and build “new strategic capital partnerships” that “expand our long-term investment capacity.” [35] A company that can comfortably fund its buildout from operating cash flow does not recruit a sovereign-wealth dealmaker to expand its investment capacity.

The move follows a path Microsoft, OpenAI, and Amazon have already worn — courting Gulf sovereign-wealth funds to help underwrite AI infrastructure. [36] It is the logic of the SPVs taken one tier further. Private credit moved the debt off Meta’s balance sheet; sovereign capital would move part of the funding burden off the private-credit market, which — as the El Paso deal’s missing anchor lender hints — is showing early signs of indigestion. Each tier widens the circle of people other than Meta who carry the bet.

And it changes what the capacity costs in something other than dollars. Sovereign money is not neutral money. A loan financed by a foreign government carries strings; private credit does not: preferences about where the capacity sits, who gets access, and what the financier expects in return. Meta has not closed such a deal — it has hired the person whose job is to find one. But the direction is the tell. When the cheapest available capital for a buildout is a sovereign-wealth fund, the buildout has outgrown every conventional source, and the question of who holds leverage over Meta’s compute stops being rhetorical.

The mirror: Amazon built the same trap in reverse

The cleanest way to see what Meta is doing is to set it beside the company it is renting chips from.

Amazon is the canonical case of infrastructure reversion: a company that stumbled repeatedly at the intelligence layer — Titan, Nova, the slow developer uptake of its own silicon — and resolved each stumble by retreating to infrastructure it could sell. The difference is that Amazon has the infrastructure business. When its models underperformed, it had AWS to monetize the compute regardless, and Bedrock to resell everyone else’s models through its own billing relationship. The reversion worked because the floor was already a product.

Meta has arrived at the same place from the opposite direction. It has the intelligence-layer stumbles. It has the infrastructure. What it lacks is a cloud business that would let the infrastructure pay for itself if the models don’t. The two companies even diverge on the accounting of identical hardware, each in the direction its strategy implies: Amazon, which sells compute and lives with hardware honesty, shortened its server life; Meta, which needs the buildout to look affordable, lengthened it. [21][22]

So the Infrastructure Reversion Test produces a Meta-specific verdict. Reversion is a fallback to a business you already run. Meta is contemplating reversion to a business it has never run, against incumbents who own two-thirds of the market between them, [4] as the backstop for a model strategy that, at launch, sold nothing to outsiders. It closed its models and is now weighing whether to sell the floor beneath them. When the intelligence layer is walled off from outside revenue, the only thing left to sell to outsiders is the raw compute — and that is the layer with the lowest margins and the most entrenched competition.

The bear’s favorite analogy belongs here, and it cuts more sharply than the bulls admit. The dark-fiber buildout of the late 1990s did, eventually, become the backbone of the modern internet — vindication, the optimists say, for building ahead of demand. But the surplus enriched whoever bought it cheaply out of bankruptcy, not the companies that financed and laid it. [37] If Hyperion and its siblings are dark fiber 2.0, the relevant question is not whether the capacity is used. It is who is holding the paper when it does. And the paper here sits with private-credit funds, insurers, and — through target-date and core bond funds — ordinary retirement accounts, layered over a thin equity cushion. [18][38]

This also answers the objection that the SPV debt is the lenders’ problem, not Meta’s. It is both, and the split is the point. Meta’s own direct exposure is comparatively contained — the lease payments it owes the vehicles, plus its minority equity. The structure’s fragility — the thin cushion, the long-dated near-junk debt — sits with Blue Owl, the bondholders, and the insurers behind them. The risk sits there by design. Meta engineered it onto someone else’s balance sheet, which is precisely why it can afford to be sanguine about overbuilding, and why “cloud is on the table” costs it so little to say.

What would have to break

The cloud remark serves as the hinge between the two readings, making this a thesis with a falsification date built in.

If Meta never exercises the option — if Muse-series models scaling across three billion users, plus recommendation and ads inference, plus whatever agentic workloads arrive, actually fill Hyperion and El Paso, and the SPV debt is serviced out of the advertising machine’s cash flow — then the optimists were right. The buildout was a rational forward purchase, the cloud line was idle optionality, the levers were prudent capital management. The end-state even has a name: Meta becomes a second Google — billions of users, a wall of apps, a competitive frontier model, and the custom silicon and data centers to run it all in-house. Google built precisely that stack, and it pays.

But the comparison is where the bull case turns on itself. Google’s vertical integration includes the one layer Meta has conspicuously skipped: it monetizes the same silicon and models externally, renting its TPUs and selling Gemini through Google Cloud — the chips that train Gemini and serve a billion users also collect rent from outside customers. [39] Google fills its own fleet and sells the overflow. Meta closed its model, withheld the API, and runs no cloud; and its silicon program, MTIA, is the least-proven leg of the stack, which is why it still leans on Nvidia, AMD, and rented AWS capacity to do the work TPUs do for Google. [3] Follow the optimistic case all the way to its end, and Meta lands as Google minus the cloud — the exact configuration that makes “cloud is on the table” necessary in the first place. The bull and bear cases converge on the same missing layer.

The market has already begun pricing that gap. On near-identical first-quarter beats, Alphabet’s stock rose about 7% the same day Meta’s fell — the difference resting on the cloud layer that turns AI capex into outside revenue. [40] And independent modeling cited by the Financial Times puts most of the hyperscalers, Meta included, at negative implied returns on AI investment through 2030, even on the generous assumption that the systems cost nothing to run; Amazon, the most mature cloud monetizer, is the lone positive, at roughly 7%. [41]

If Meta does exercise it — if it stands up external compute sales because internal demand fell short of the contracted capacity — then the put was the plan all along, and the levers were what they looked like: a structure for sustaining a buildout whose customer Meta had not secured.

The clock that decides it is already running, and three hands move at once. The physical capacity arrives on a schedule — Prometheus at a gigawatt in 2026, El Paso in 2028, Hyperion’s five gigawatts in 2029. [13][17][42] The SPV debt amortizes on another, with refinancing risk concentrating as the late-2020s maturities meet the capacity coming online. And the depreciation assumption reconciles on a third: if the stretched five-and-a-half-year life proves optimistic, the write-downs land in precisely the 2026–2028 window Burry flagged. [23] Demand, power delivery, and refinancing have to line up on the same timeline for the optimistic case to hold. [38] Each runs on its own logic, and none waits for the others.

There is a reason the credit market is already watching rather than the equity market. Meta’s five-year credit-default swaps had no liquid market until November 2025 — there was little to insure, because until then Meta funded itself largely from its own cash rather than from debt. [43] The CDS exists today because Meta became a borrower, and it has widened alongside Oracle’s, the cohort’s weakest credit, whose five-year spread has sat near 200 basis points since the spring — its highest since the 2008–09 financial crisis, and roughly quadruple its mid-2025 level. [44] JPMorgan now sells a hyperscaler CDS basket — Alphabet, Amazon, Meta, Microsoft, Oracle — so institutions can hedge a category of risk that barely existed eighteen months ago, against five names carrying $969 billion in commitments with $662 billion of data-center leases not yet commenced. [45] The instrument to bet against Meta’s buildout was built before Meta finished building it.

Weigh it, and the tension does not fully resolve — but it tips. The advertising business is strong enough that the optimistic case cannot be dismissed, and the first-quarter underspend shows real discipline. Yet a management team that genuinely expected internal demand to fill its capacity would not need to remind shareholders, with the CDS trading and the commitments at a quarter-trillion dollars, that it could always rent out the capacity. You name the exit when you can see the scenario that requires it. The most revealing thing Zuckerberg said in May was not that the cloud is on the table. It was the condition attached: if we feel that we have overbuilt. He is pricing the probability himself.

Meta is the one hyperscaler that built the cathedral before it had a congregation. “Cloud is on the table” is the sound of a company that has noticed, and is letting its lenders know there is a door.

Notes

[1] Mark Zuckerberg, remarks at Meta’s annual shareholder meeting, May 27, 2026, as reported in Jonathan Vanian, “Mark Zuckerberg says a Meta cloud computing business ‘definitely on the table,’” CNBC, May 27, 2026.

[2] Ibid. Zuckerberg: “We haven’t done that yet because we think that we have a use for the compute,” and the option arises “if we get to a point where we feel that we have overbuilt.” The conditional framing is load-bearing for this piece: Meta did not announce a cloud business; it named an option contingent on overbuild.

[3] Meta and AWS press releases, April 24, 2026; see “Meta Becomes One of World’s Largest Customers of Amazon AI Chips,” PYMNTS, April 24, 2026 (Graviton Arm cores, “tens of millions” of cores, positioned for agentic inference). Graviton is an Arm-based CPU, not a GPU; reporting that the deal also covers Trainium/Inferentia is less firmly sourced and is not relied on here.

[4] “Of the four U.S. hyperscalers, Meta is the only one that doesn’t sell cloud infrastructure and services”; AWS holds roughly a third of the market, with Microsoft and Google together holding another third. CNBC, May 27, 2026 (n.1); TechRadar, “Meta cloud computing business ‘definitely on the table,’” May 2026.

[5] North American data-center vacancy fell to 1.4% at year-end 2025, per CBRE’s North America Data Center Trends, H2 2025; JLL’s year-end 2025 read put the primary-market vacancy rate near 1%. On Trainium supply, AWS has stated demand exceeds production: TechCrunch, “An exclusive tour of Amazon’s Trainium lab,” March 22, 2026.

[6] Meta Platforms, “Meta Reports First Quarter 2026 Results,” April 29, 2026 (guidance raised to $125–145B from $115–135B; rationale: “higher component pricing... and, to a lesser extent, additional data center costs to support future year capacity”). SEC / Meta IR.

[7] 2025 full-year capex was $72.2 billion; 2026 guidance is nearly double that figure. Fortune, “Meta just bumped its 2026 capex forecast up to as much as $145 billion,” April 29, 2026.

[8] Q1 2026 capital expenditures (including principal payments on finance leases) were $19.84 billion, below the $27.57 billion StreetAccount consensus. Meta 10-Q / “Meta Q1 earnings report,” CNBC, April 29, 2026.

[9] Shares fell roughly 7% (intraday as much as ~10%) following the capex guidance raise. CNBC (n.8); Yahoo Finance, April 30, 2026.

[10] Non-cancelable contractual commitments of $237.67 billion as of March 31, 2026, described in the 10-Q (Note 8, Commitments and Contingencies) as “mostly related to third-party cloud capacity arrangements and continued investments in servers and network infrastructure, data centers, and consumer hardware products in Reality Labs,” with ~$42.25B due in 2026 and ~$47.65B in 2027; cash, cash equivalents and marketable securities of $81.18 billion. Meta Q1 2026 10-Q, SEC.

[11] Operating and finance leases not yet commenced of approximately $182.88 billion as of March 31, 2026, “consisting of data centers, colocations, and certain network infrastructure,” commencing between the remainder of 2026 and 2036, with terms from greater than one year to 30 years. Meta Q1 2026 10-Q, Note 8, SEC.

[12] Susan Li, Meta Q1 2026 earnings call, April 29, 2026: “These multiyear cloud deals and our infrastructure purchase agreements drove a $107 billion step up in our contractual commitments this quarter.” Meta Q1 2026 earnings call transcript.

[13] Hyperion: Richland Parish, Louisiana; ~5 gigawatts; completion expected 2029. Blue Owl / Meta joint-venture announcement and coverage. PE Insights, “Blue Owl and Meta close record $30bn financing,” 2025.

[14] Susan Li, Meta Q1 2026 earnings call, April 29, 2026: the infrastructure investments “will support our training needs for future models and, most importantly, provide us the inference capacity necessary to deliver personal and business agents to billions of people.” Transcript (n.12).

[15] Meta Platforms, “Meta Announces Joint Venture with Funds Managed by Blue Owl Capital to Develop Hyperion Data Center,” October 2025 (Blue Owl 80% / Meta 20%; ~$27B debt to PIMCO and other investors plus ~$2.5B equity; largest private-credit data-center deal on record).

[16] Bonds issued by the Beignet vehicle were rated A+ by S&P (single agency, reflecting Meta’s backing), priced at a 6.58% yield (~225 bps over Treasuries), fully amortizing, maturing 2049. Yahoo Finance / WSJ, “Meta’s $27 billion bet,” October 31, 2025; PE Insights (n.13).

[17] “Sopaipilla”: ~$13 billion SPV for a gigawatt-scale data center in El Paso, Texas, expected online 2028; Morgan Stanley and JPMorgan leading and, unlike the PIMCO-anchored Hyperion deal, may offer the debt to capital-markets investors rather than place it with an anchor. Bloomberg, via “Meta Taps Morgan Stanley, JPMorgan for New Data Center Deal,” Advisor Perspectives, May 5, 2026.

[18] On the inadequacy of the thin equity cushion in these data-center SPVs — typically on the order of 10% equity against a debt-heavy structure — see Paul Kedrosky, “SPVs, Credit, and AI Datacenters,” June 2025. Reported Meta vehicles, including a triple-net leaseback arrangement involving Apollo, have been described at roughly 90% debt / 10% equity (Covenant Lite, “Meta’s $29 Billion Bet with Apollo,” July 2025); whether that arrangement is distinct from the Blue Owl–led Hyperion financing or an earlier account of the same raise is not independently confirmed, and the body does not treat it as a separate vehicle.

[19] Carrying amount of long-term debt (fixed-rate senior unsecured notes) of $58.75 billion as of March 31, 2026. Meta Q1 2026 10-Q, Note 7, SEC.

[20] Meta structured the Hyperion leases in four-year increments so rating agencies would not treat them as debt. The Information, “The Creative Dealmaking Behind Meta’s $30 Billion Data Center Financing,” reported via Michael Parekh, November 2025.

[21] Meta Platforms Form 8-K, FY2024 results: “In January 2025, we completed an assessment of the useful lives of certain servers and network assets, which resulted in an increase in their estimated useful life to 5.5 years, effective beginning fiscal year 2025... we expect this change in accounting estimate will reduce our full year 2025 depreciation expense by approximately $2.9 billion.” SEC.

[22] Amazon shortened the useful life of a subset of its servers and networking equipment to five years in early 2025, citing the rapid pace of AI and machine-learning innovation — the opposite direction to Meta. DeepQuarry, “Depreciation of GPUs: between useful lives and useful myths,” December 2025.

[23] Michael Burry’s late-2025 argument that hyperscalers understate depreciation by using five-to-six-year lives for hardware with a real economic life closer to two-to-three years, estimated at ~$176 billion of understated depreciation industry-wide across 2026–2028; Nvidia publicly rebutted. WSJ, “The Accounting Uproar Over How Fast an AI Chip Depreciates,” December 8, 2025; CNBC, November 25, 2025. (Burry comparison to Cisco circa 2000, not Enron.)

[24] Paraphrased from the financing analyst quoted on the Hyperion structure: Meta must build the facility, place workloads in it, and presume future monetization of those workloads. WSJ via Yahoo Finance, October 31, 2025 (n.16).

[25] Yann LeCun, interview with Melissa Heikkilä, Financial Times, published January 2, 2026: Llama 4 benchmark “results were fudged a little bit,” the team “used different models for different benchmarks to give better results,” and Zuckerberg “lost confidence in everyone who was involved” and “sidelined the entire GenAI organisation.” FT (subscription); reproduction: Fast Company, “Yann LeCun: Meta ‘fudged’ on Llama 4 testing,” January 2026.

[26] Eleven of the fourteen researchers who created the original Llama left Meta; LeCun departed in November 2025. Maginative, “Meta Goes All-In on ‘Superintelligence,’” June 2025; The Next Web, “Meta hires five Thinking Machines Lab founders,” April 2026.

[27] “Behemoth” (the planned ~2-trillion-parameter flagship) was repeatedly delayed on performance and not released in promised form; the GenAI organization was sidelined ahead of the Superintelligence Labs reorganization. Maginative (n.26); Wikipedia, “Meta Superintelligence Labs” (secondary, for chronology only).

[28] Muse Spark scored 52 on the Artificial Analysis Intelligence Index v4.0, fourth globally behind Gemini 3.1 Pro (57), GPT-5.4 (57), and Claude Opus 4.6 (53); Llama 4 Maverick scored 18. Artificial Analysis was given early access to benchmark independently. Artificial Analysis, “Muse Spark: everything you need to know,” April 8, 2026. Note: Meta’s own claim of 50.2% on Humanity’s Last Exam used a multi-agent “Contemplating” mode with tools; the independent single-agent figure was 39.9%. Treat vendor mode-specific claims separately. The #4 ranking reflects the index at launch (April 8, 2026); the leaderboard has since shifted as newer models posted higher scores.

[29] Artificial Analysis (given early access by Meta) scored Muse Spark 52 on its Intelligence Index v4.0, 4th at launch. On GDPval-AA — Artificial Analysis’s evaluation of economically valuable, real-world office tasks — Muse Spark scored roughly 1,427 Elo (Meta’s own reported figure was 1,444), behind GPT-5.4 (~1,672) and Anthropic’s Claude Opus 4.6 (~1,606) and Sonnet 4.6 (~1,648), though ahead of Gemini 3.1 Pro Preview (1,320); it likewise trailed the leaders on Terminal-Bench Hard. Meta flagged long-horizon agentic systems and coding workflows as areas of continued investment. Most non-composite Muse Spark figures are Meta-reported: because the model is closed (no open weights; Meta AI app and a private API preview only), independent evaluators such as Vals.ai and BenchLM had not posted independent scores as of late May 2026. Artificial Analysis, “Muse Spark: everything you need to know,” April 8, 2026; VentureBeat, April 8, 2026.

[30] Muse Spark launched closed-weight, distributed free through the Meta AI app/website and rolling out as the default assistant across Meta’s platforms and Ray-Ban glasses, with no first-party public API at launch (Artificial Analysis benchmarked it via early access; Bloomberg reported the design and code would not be made public). Artificial Analysis (n.28); aitoolbriefing, “Meta’s Muse Spark Drops — And It’s Closed Source,” April 9, 2026. API availability may change; the claim is specific to launch.

[31] Meta is testing Meta AI subscriptions at $7.99 and $19.99 per month. Intellectia, “Zuckerberg: Meta May Enter Cloud Computing Market,” May 2026.

[32] Meta Q1 2026: revenue $56.31B (+33% YoY, fastest since 2021); ad impressions +19%, price per ad +12%; income from operations $22.87B; free cash flow $12.4B. Net income $26.77B included an $8.03B tax benefit (underlying EPS $7.31). Meta Q1 2026 release / 10-Q (n.6, n.8, n.10); CoinDCX earnings recap, April 2026.

[33] Meta’s full-year free cash flow was $43.59 billion in 2025 (Meta Q4/FY2025 release, SEC 8-K). Sell-side projections for 2026 fall sharply as capex roughly doubles — one widely cited Street estimate has full-year free cash flow dropping toward the high single-digit billions (IND Money, citing Street estimates) — and several analysts now model free cash flow turning negative across the AI-infrastructure cohort in 2026–2028; Barclays specifically projected a roughly 90% decline in Meta’s 2026 free cash flow after the raised guidance. CNBC, “Tech AI spending approaches $700 billion in 2026, cash taking big hit,” February 6, 2026.

[34] Meta named Dina Powell McCormick president and vice chairman, announced January 12, 2026; she spent 16 years at Goldman Sachs, where she led its Global Sovereign Investment Banking business, served as deputy national security adviser in the first Trump administration, and most recently was president at BDT & MSD Partners. She had been a Meta board member from April to December 2025. Axios, “Meta taps Dina Powell McCormick as president and vice chairman,” January 12, 2026; Advisor Perspectives, January 12, 2026.

[35] Zuckerberg said Powell McCormick would focus “on partnering with governments and sovereigns to build, deploy, invest in, and finance Meta’s AI and infrastructure”; Meta added that she would “drive an effort to build new strategic capital partnerships and find innovative ways to expand our long-term investment capacity.” Axios (n.34); AGBI, “Meta hires former Trump adviser to focus on Middle East deals,” January 16, 2026.

[36] Microsoft, OpenAI, and Amazon have made AI-infrastructure investment deals with Gulf-based sovereign-wealth funds, many focused on building data centers in the US and the Gulf. AGBI (n.35).

[37] In the late-1990s telecom buildout, the large majority of fiber laid sat dark for years and bandwidth prices collapsed; the surplus later became the backbone of Web 2.0, benefiting those who acquired it cheaply rather than those who financed it. “The AI Infrastructure Bubble,” Development Corporate, November 2025.

[38] AI-infrastructure debt is reaching retail retirement accounts through target-date and core bond funds; the bull case “requires demand, power delivery, and refinancing to line up on the same timeline.” Seeking Alpha, “Your 401(k) Is Funding AI’s Data Center Buildout,” May 14, 2026.

[39] Google Cloud sells external access to its Tensor Processing Units (TPUs) — the custom silicon that also trains Gemini and serves Google’s own products to over a billion users — through Compute Engine, Google Kubernetes Engine, and the Vertex AI / Gemini Enterprise Agent Platform, and offers Gemini models commercially on the same platform. “Tensor Processing Units (TPUs),” Google Cloud product page, accessed May 2026.

[40] On April 29–30, 2026, Alphabet and Meta both beat first-quarter estimates and both raised capital-expenditure guidance, yet Alphabet’s stock rose roughly 7% while Meta’s fell roughly 7% — a divergence widely attributed to Alphabet (like Amazon and Microsoft) operating a cloud business that converts AI investment into external revenue, which Meta lacks. CNBC, “Investors still trust Google more than Meta when it comes to spending their money on AI,” April 30, 2026.

[41] Modeling by Panmure Liberum, cited by the Financial Times, finds that most major US hyperscalers — Microsoft, Alphabet, Meta, and Oracle — show negative implied returns on AI investment over 2025–2030, even under the generous assumption that building and running the AI systems costs effectively nothing; only Amazon is positive, at roughly 7.2%, reflecting its more mature external cloud monetization. One published account put Meta’s implied figure near −29%. This is forward-looking modeling, not realized return. IBTimes UK, “Big Tech’s AI Gamble Shows Negative Returns Despite Surge in Spending,” May 30, 2026; figure for Meta via Sherwood/Yahoo Finance coverage of the same FT analysis.

[42] Prometheus, a ~1-gigawatt data center, is scheduled to come online in 2026. Trending Topics, “Meta’s Comeback: Muse Spark,” April 12, 2026.

[43] Meta’s (and Alphabet’s) five-year CDS did not begin trading until November 2025; before that these companies funded AI expansion from their balance sheets rather than debt markets, so there was little single-name CDS interest. Mellon Investments, “Record-Breaking AI-Related Debt Issuance in 2025,” December 15, 2025 (Bloomberg data).

[44] Oracle’s five-year CDS has sat near 200 basis points since spring 2026 — its highest since the 2008–09 financial crisis and roughly quadrupled from its mid-2025 level (≈198 bps reported late March–April 2026). BondbloX, “Oracle’s 5Y CDS Spread Hits All-Time Highs,” March 31, 2026; The Motley Fool / Yahoo Finance, April 10–11, 2026. A specific basis-point level for Meta’s own CDS is not independently confirmed here and is deliberately not stated.

[45] JPMorgan launched a hyperscaler CDS basket (Alphabet, Amazon, Meta, Microsoft, Oracle) in March 2026, in $25M blocks with $5M per name; the five issued $121B in bonds in 2025 (vs. a $28B annual average 2020–2024), with total commitments of $969B and $662B in data-center leases yet to commence. Winbuzzer, “JPMorgan Launches CDS Basket to Hedge AI Debt Risk,” March 24, 2026 (citing Fortune).