The Investor

Three streams of paper into a falling market

CoreWeave's problem is the supply of its own securities. It sold $4.2B of convertible notes in September. It has authority to sell up to 35M shares over time, roughly $2.3B at a price of about $65. Co-founder Brannin McBee told the Financial Times it hopes to borrow from insurers, whom he called "unlimited" capital. The Information reports that CEO Michael Intrator sold stock every week from April through September, at $128 in May and $86 in September. The immediate trigger for the Oct 14 drop was market chatter that its bonds were falling. That is talk, not trading data anyone has verified.

Each step makes sense on its own. Taken together, they say a neocloud needs a steady flow of outside money to keep growing, and that management wants to raise it before the window narrows further. The insurer plan matters most. It moves compute financing toward asset-backed credit on contracted cash flows: loans secured by customer contracts. That rewards operators with long-dated customer commitments and punishes those without them. No one has disclosed the spread, tenor or collateral yet. Those three terms will tell a temporary squeeze apart from a lasting re-rating of the business model.

Where the sources disagree: a shut window or a price gap

The Information is blunt: assume AI infrastructure has no IPO or REIT route before 2027. It reports some banks stepping back from data center loans. JPMorgan CFO Jeremy Barnum said the bank's AI exposure is "quite modest" but added that he would be surprised if anyone were "immune" to a sentiment shift. Fortune's Term Sheet reads the same market differently. Goldman's David Solomon said the market "was wide open." Renaissance Capital data show 2026 on pace to beat last year's IPO count, with record proceeds even excluding SpaceX.

We think each side is right about a different set of assets. The general IPO window is open, at a discount. Leveraged infrastructure is not clearing, because investors price data center REITs as yield instruments. AirTrunk had explored a yield near 6%, and Morning Brew puts the 10-year Treasury at 5.217%. That leaves a REIT buyer little extra return for taking on development risk. Firmus failed for a different reason: a thin operating record plus significant debt will not clear at a growth valuation. Debt is also spreading beyond neoclouds. Bloomberg reports Tencent sold almost $5.7B of bonds to fund AI, after a $4.7B deal in June.

Demand is not the variable

Anthropic told investors its Q3 revenue rose to $16.8B from $11.5B in the June quarter, per The Information. That is a company-reported figure, not an audited one. Usage keeps compounding while the debt-funded supply layer reprices. One caveat: no source shows CoreWeave's own backlog or customer mix, so the demand read is market-level, not company-level.

The next test is Anthropic's expected IPO next month, which Matt Kennedy calls a potential positive for the market in Term Sheet. A strong debut would suggest public markets close the gap with private AI marks. A weak one would turn AI-valuation skepticism from commentary into markdowns on private positions.

Underwrite the balance sheet before the growth rate: in AI infrastructure, the cost of capital now decides who survives the build-out.

The smart move is to treat every compute, data center and neocloud position as a credit question first. Find which holdings need a refinancing or a listing within 12 months. Then use CoreWeave's insurer terms and founder sales as the read-through for the whole group.

A deception case, not a defect case

The suits were filed separately in state courts in Arkansas, Arizona, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia. They allege ChatGPT was engineered to be agreeable and trusted, then used that trust to reinforce delusions, give dangerous medical advice and help plan violent attacks. Iowa AG Brenna Bird supplied the framing: "OpenAI is hurting kids and they are lying to Iowans." Under a consumer-protection theory, the case turns on whether the company told the truth about safety. That makes OpenAI's own defense, that it built "industry-leading age-specific protections" including ChatGPT for Teens in August, a public statement plaintiffs can test.

Section 230 offers OpenAI less cover than it gave Meta. Since the Ninth Circuit's 2021 ruling on Snap's speed filter, plaintiffs have won by attacking a platform's design rather than its users' speech, and more than 200 product-liability suits followed. A chatbot's output is text the company's own model generates, not third-party speech. We agree with Casey Newton that OpenAI arguably starts with weaker legal protection than Meta had.

Where the money sits

Private verdicts are survivable. A Los Angeles jury awarded $6M against Meta and YouTube. The attorney-general penalty channel is a different scale. In New Mexico, a jury imposed $375M on Meta in March and a judge added $567M in August. Meta's 2023 multistate matter could cost it up to $18B. Multiplying the New Mexico outcome by eight gives about $7.5B. That is a scale marker only, because penalties depend on each state's statute and evidence.

The timeline is compressing. Florida sued in June, British Columbia in September, and now these eight states, while dozens of private suits are open. The channel is not unique to OpenAI. Kentucky's AG alleged last week that Character.AI's chatbots were designed to put engagement ahead of child wellbeing, per Morning Brew. Seven of the eight new filers are Republican. Per Reuters, they also ask courts to bar OpenAI from developing self-improving models unless alignment can be ensured. That request will likely be tossed, but it shows state officials are willing to regulate frontier development itself.

The variable that could swing the whole sector is the Los Angeles appeal, where Meta and Google argue Section 230 and the First Amendment. A win for the platforms would lower this risk across the industry. A loss would lock in the template.

Under a deception theory, a consumer-AI company's public safety claims are the asset that gets priced.

The smart move is to price consumer-AI positions on the gap between what a company has said publicly and what it can prove. Companies that cannot produce an evidence file for their safety claims are the most exposed.

Three deals, three different absorbers

Each move is a different party claiming the right to decide what an AI agent can touch, which is a polite description of a land grab. Workday, a system of record, plans to use C1.ai to tie employee lifecycle events to provisioning, permission changes and access removal, so an agent gets provisioned, scoped and revoked like a new hire. Anthropic, a lab, took a technology license plus Opaque's CEO Aaron Fulkerson and CTO Rishabh Poddar to serve regulated buyers in finance and healthcare. JPMorgan, a gatekeeper, simply said no. "We're not going to allow just any outside agent to come in inside the company," Jamie Dimon said. Amazon had already blocked Muse from shopping on its site.

The demand underneath is measured. Researchers found 253 verified security bugs across 118 open-source MCP servers, the connectors linking agents to enterprise tools, per CSO and Computerworld. Buyers do not need a forecast when they have a bug count. GitLab patched a maximum-severity flaw alongside high-severity bugs, one involving AI agent instruction injection.

The best customers are building it themselves

The trouble, or rather the more interesting version of it, is that the most sophisticated buyers are poor targets. At AI Engineer New York, Bloomberg's Andrey Rybka summed up the rule as "deterministic controls outside the model. Check every call, log it, and keep a kill switch." Two Sigma runs its own internal control framework, per Latent.Space. Uber folded security checks, per-user spend tracking, audit logs and session traces into its own Model Gateway, per The Pragmatic Engineer, and since 2023 that gateway has switched among Anthropic, OpenAI and open models Uber hosts itself. A company that swaps model vendors is not going to rent its controls from one. The labs, meanwhile, ship vertical products like Claude for Financial Advisors and leave control ownership with the financial firms.

That leaves a specific customer: firms large and regulated enough to carry agent risk, but too small to staff an Uber-grade platform team. We have watched enough infrastructure layers get carved up this way to think the middle is where an independent control layer earns durable revenue. The counter-thesis is that Workday and the labs grow into that middle first. They usually take longer than they promise.

There is no valuation evidence yet, because neither deal disclosed terms. Workday's closing disclosures will provide the first M&A comparable for agent identity. What happens to Opaque's customers outside Anthropic will show what a license-and-hire leaves behind in this category. Probably not much.

The agent control layer has buyers now, but most of them want to own it, so neutrality across vendors is the exit story worth underwriting.

This is probably wrong at the edges, but the sensible move is to underwrite agent-security companies on neutrality. Favor products that work across models, HR systems and identity providers. Treat single-protocol point products as features waiting to be absorbed.