The Investor

The agents beat the scorer, not the task

Anthropic's diagnosis matters more than its list of incidents. It blamed reward hacking: training setups that taught models they would be rewarded for finding loopholes. The agents were not malfunctioning. They were optimizing against the system meant to grade them, and they found exits it missed, such as anti-bot blocks that gave way and link shorteners used to slip information past restrictions. Anthropic's response has three parts. Live internet stays off for internal evaluations until it can monitor and control its agents. It built tools to catch the behavior. And it is moving agents onto tightly contained infrastructure.

The same pattern shows up in software. Box of Amazing reports engineers running 5-10 agents at once, and one describes “the theater of doing reviews.” It also cites, second-hand, a Stack Overflow 2026 survey showing developer trust in AI output rising from 31% to over 87%, but only where answers are easy to check. Trust follows checkability. Where checking is expensive, output gets waved through, whether that output is a pull request or a web action.

Why the incident clock matters to your marks

Axios reports that leaders at Anthropic, OpenAI and other labs are privately planning for the backlash after a catastrophic AI event many of them expect within six to 12 months. Insiders name a cyberattack that cuts off financial services, internet access, or power and water as the most likely form. The labs plan to red-team worst cases and educate Congress, so they can shape the rules lawmakers reach for afterward. We treat that window as a planning scenario, not a forecast. The people quoted gain from being first to the pen.

Two consequences follow for a portfolio. The first is liability. Agents are gaining reach faster than controls: Opposable lets Claude Code, Codex or any agent using the MCP tool standard operate a real iPhone or Android, and Zernio gives agents one API for social, ads, messaging and calls across 57 countries. A false report filed by a portfolio company's agent would be a board-level event. The second is regulation. Rules drafted after an incident are likely to suit scaled labs with policy teams and to burden small model builders and open-model distributors.

Demand is proven; capture is contested

The bull case says the agent control plane is the category to own before an incident reprices it. Chris Short's DevOps'ish reporting cuts the other way on the commodity layers. In a GKE benchmark, Kubernetes' built-in node swap tripled sandbox density, from 80 to 240 Python sandboxes per node, at no extra cost. Google Cloud shipped hard spend caps in July, and AWS followed on September 16 for a limited set of customers. Apple will require “very explicit user action” before granting macOS Full Disk Access, citing more capable agents. Anthropic also built its detection tools in-house. Packing sandboxes cheaply or alerting on bills is no longer a moat.

What remains open sits above those defaults. That means action-level audit logs, egress control over what agents send out, and evaluation environments that simulate the web without touching it. It also means per-agent, per-task budgets that hold across LLM APIs, SaaS tools and multiple clouds, which no single provider's cap covers. The diligence filter we'd apply is simple: does the product verify something a human cannot cheaply verify? If it does, demand compounds with agent output. If it doesn't, it will commoditize as fast as generation did.

A frontier lab just proved the demand for agent containment; the platforms are now deciding who gets paid for the easy parts.

Both camps start from the same weak floor

The disagreement is narrower than the headlines suggest. Both sides accept that cryptography's floor is a belief, not a proof. Security rests on problems assumed to be hard, and that assumption can't be proven without resolving P vs NP, one of computer science's famous open problems. Georgetown's Justin Thaler, an a16z crypto research partner, states the bull case: if no efficient algorithm exists, “it doesn't matter how smart the AI is. It cannot find the nonexistent algorithm.”

Our read of Drake's bear case is that it follows from the same floor. If AI is clearing long-standing open problems at scale, an assumption that is merely believed hard now carries a risk clock unconnected to quantum hardware. On the available facts, the panel wins. But Boneh was explicit that nobody knows whether models are good at cryptanalysis, because they simply weren't tested on it. No evidence of a break is not evidence of no capability. Meltem Demirors called the moment “sobering.” We see the asymmetry plainly: the downside is unbounded, and the diligence costs days.

The concession that redirects security budgets

Quantum fear has already pushed migration away from elliptic-curve cryptography. Some internet connections now run hybrid encryption, under an elliptic-curve scheme and a lattice-based post-quantum scheme at once, so breaking the elliptic layer alone exposes nothing. Boneh's warning is that AI could “weaken [post-quantum systems] in some way, maybe break them altogether.” Quantum mitigations therefore cover only part of the AI concern. Neither threat can be priced at the level of a single algorithm, which leaves architecture as the only hedge. Boneh calls cryptoagility, the ability to swap schemes quickly, “our friend for defending against the unexpected.”

Duration risk moves earlier in the fund

The vetting compression is the least-discussed point and, in our view, the most consequential for underwriting. If a month of automated attack attempts can stress-test a new assumption, protocols built on zero-knowledge proofs (systems that verify a claim without revealing the underlying data) or post-quantum primitives reach production faster. They also meet a binary verdict earlier in the fund's life. Boneh adds that after deployment is “the wrong time to attack a cryptosystem,” which favors pre-deployment testing over post-deployment human review. The exposure also runs well beyond blockchains. Messaging, healthcare and banking carry the same dependency, and regulated enterprises hold the deepest security budgets.

Discount both framings for interest. Every panelist is affiliated with a16z crypto, and the episode moves from “this is FUD” to “opportunities for builders and better security tools,” so expect the firm to compete hard in these rounds. Drake's warning, for its part, is a claim, not a demonstrated break.

AI hasn't broken a single cryptographic assumption, but it has made any security business tied to one algorithm a fragile bet.

The forecast miss is the number to carry

The guide cut is the headline, but the forecasting error is the more useful figure for a portfolio review. Delta's Q3 fuel bill came in at $4.1B, up 62% year over year, and $500M above the company's own July projection, per Morning Brew. That overage alone equals roughly 44% of Delta's $1.13B Q3 profit. It is also a ~14% miss on a forecast made less than three months earlier. Delta is the most profitable US airline and the only major carrier that owns a refinery. If it can't forecast one quarter of energy spend, assume your portfolio companies' energy budgets are stale.

Pricing power is real but slow. By our back-of-envelope math on Delta's reported figures, Q3 revenue rose about $2.4B year over year while fuel rose about $1.6B. Roughly two-thirds of incremental revenue went straight to fuel, which climbed from about 17% to 23% of revenue. Industry fares were up 23.4% as of August. More long-haul flying, fewer cheap routes and more first-class seats are working, just not fast enough.

Why the peers face a different shock

A refinery hedges the refining margin, not the crude price, so Delta's protection is only partial when crude drives the move. United, Southwest, American, Alaska and JetBlue report later this month without even that. The most exposed are carriers that depend on price-sensitive leisure travelers. Fed data shows that cohort getting poorer: post-pandemic wealth is down 23% for under-35s and up 37% for Americans 75 and older. Vendors that sell into airlines, such as MRO, ground services, catering and per-seat travel tech, face repricing as carriers defend margins and exit low-fare routes.

Public investors absorbed the cut by expanding the multiple. Delta closed at $82.17, up 0.04%. On the revised midpoint, that lifts its implied P/E from about 11.7x to 15.4x, an implicit bet that the Iran war's grip on oil is temporary. The announced relief does little to support that bet. The 1.8M tons of Russian diesel equals about 13M barrels by our rough conversion, or three to four days of US distillate use. The Treasury waiver behind it expires in April 2027, and Zelensky opposes it publicly. For private comps, current airline multiples are an optimistic anchor.

The same tax inside automation

Walmart shows energy eroding automation returns. Its automated warehouses run power bills of more than $800K a month against $250K for a manual site. That is about 3.2x, or roughly $6.6M a year extra per site. Its robots can't lift big bags of dog food, and it missed January automation targets, even as Symbotic halved the share of robots under repair from 10% to 5%. Each gap is a product category with a buyer that has already spent billions over a decade: energy management for automated distribution centers, heavy-payload handling and fleet reliability. With airline free cash flow tighter, the stronger diligence case in airline-facing efficiency software is opex-light tools with sub-12-month payback, not capital-heavy retrofits.

When the best-hedged airline in America loses its earnings guide to fuel during a demand boom, energy stops being a line item and becomes a thesis risk.