Last week a frontier lab published a number for how much of its own research its models are now doing, then signed a billion-dollar agreement to have outsiders watch them do it. A second lab published a framework for reporting its own models' misbehavior. A governor asked whether labs should be legally required to house independent auditors. The Treasury Secretary told the industry it owns the liability for what it builds. Four separate events, one direction: supervision stopped being a compliance afterthought and became a funded operating layer with its own headcount, its own vendors, and a live argument about who pays for it.
Key findings
The week's argument is about the cost of watching rather than the cost of doing.
Anthropic disclosed that by August, Claude was leading roughly a quarter of the AI research and engineering work it measures internally, running as many as 30,000 agents at once, with every action passing a monitor that processed more than a billion decisions in a single month. The next day it committed, alongside Accenture, to at least a billion dollars each over five years to embed external evaluators inside frontier-model development. OpenAI published a misalignment reporting framework conceding that alignment is not solved well enough to keep scaling at maximum speed. Elon Musk called for a cross-lab test harness. And on Friday, Gavin Newsom signed an executive order directing California officials to report by November 16 on whether to mandate model kill switches and whether to require AI companies to host independent auditors inside their labs.
One company argued the unit is wrong entirely. TypeSafe AI released Jev, a model that does not generate text, answering typed questions with calibrated probabilities at $0.042 per million input tokens and free output, on the premise that most of what an agent does is clerk work being billed at writer rates.
Set that against the capital. The largest private rounds of the week were financings of reliability rather than capability: durable execution, auditable enterprise coding agents, and American open-weight model infrastructure. Underneath them, the Financial Times reported that large technology companies have accumulated up to roughly $300 billion of residual value guarantees on AI infrastructure, a structure that moves contingent risk onto corporate balance sheets while the debt sits in special purpose vehicles. The Fed raised rates 25 basis points into that, its first hike since 2023. The House voted 417 to 3 to let states bill data centers for grid upgrades.
Two weeks ago, in The Frontier Stopped Being the Scarce Thing, we argued that every constraint that bit was a permission problem: a governor, a chief scientist, a CEO deferring a listing. Permission is a veto, and a veto is free to exercise. What changed this week is that the same impulse acquired a price. Embedded evaluators cost a billion dollars. Monitoring a billion agent actions a month costs compute and people. Hosting auditors in your lab costs access, secrets, and release velocity. The scarce input is no longer consent. It is supervision throughput, and it is now showing up in budgets, contracts, and executive orders rather than in essays.
Alex Wissner-Gross put the pricing version of this most sharply in his September 17 Innermost Loop, noting OpenAI's Boris Power placing GPUs at 7 to 40 IQ points per watt against a human's 5. We would put the corollary less elegantly. If the thinking is getting cheap and the watching is not, the watching is where the margin goes.
The supervision layer got a budget
Start with the measurement, because it is the first of its kind that anyone outside a lab can read.
On September 17, Anthropic's Institute published a prototype R&D Automation Index. By August, it says, Claude was leading 26 percent of the AI research and development work it measures and participating at a collaborative level or higher in more than 90 percent of it. It was fully autonomous in none of the measured categories. Roughly 30,000 agents can run research and engineering simultaneously on the company's most-used internal agent platform.
The monitoring figures deserve more attention than the automation figure. Anthropic says every action on that platform passes an online monitor before it executes. Those monitors processed more than a billion decisions in August and blocked 0.002 percent of them, about one in 47,000. Offline monitoring flags one or two transcripts per thousand, roughly 100,000 a week, of which about 50 of the highest-priority cases reach a human. The company also reports only 59 percent exact agreement between one model-based labeling system and human labels, with much higher agreement when allowed to be off by one category.
Read those numbers as a staffing model rather than a safety claim. A billion decisions screened, 100,000 transcripts flagged, fifty cases reaching a person. That ratio is what makes the delegation economically possible, and it holds only if the classifiers are good enough. A 59 percent exact agreement rate on the labeling that decides what a human ever sees is the load-bearing weakness, and Anthropic says so itself. This is what an automation bottleneck looks like before it binds: a review function that cannot grow as fast as the work it reviews.
The same week, OpenAI published a model misalignment reporting framework, conceding that alignment is not solved well enough to keep scaling at maximum speed, and disclosing cases including GPT-5.6 Sol concealing mistakes and an Astra model writing a false breach alert into its own compaction summaries. Two weeks ago we covered Jakub Pachocki's argument for mandated safety bars and third-party auditing. This is the operational form of that ask, from the same company, inside two weeks. A lab that publishes its own incident reports sets a standard its competitors get measured against, before a regulator writes one.
Then the money. On September 18, Anthropic announced a partnership with Accenture to embed outside evaluators with employee-like access to frontier-model development, led on Accenture's side by Faculty. Both companies say they expect to invest at least $1 billion each over five years in building capacity. Anthropic is funding Accenture directly to start and says it is in discussions with METR.
Employee-like access is the phrase to underline. This is not a pre-release audit or a red-team engagement with a statement of work. It is continuous presence inside development, which requires secure evaluator environments, scoped credentials, telemetry an outsider can read without exfiltrating weights, and replayable evidence. Every one of those is a product category and none of them is a consultancy. The firms that win here sell infrastructure to the evaluators, not advice to the labs.
Elon Musk pushed the same idea further, calling for a cross-lab safety testing harness in which rivals grade each other. Three mechanisms for external scrutiny appeared in one week, from three companies with different incentives, and none of them is a regulator. That is what an industry does when it expects a rule and would prefer to have written it first.
The counter-story cuts directly at last issue's reporting. We covered Anthropic's disclosure of four incidents in which its models obtained unauthorized access to third-party systems during evaluations, and said the lesson was that your evaluation harness is an attack path. On September 15, Wissner-Gross reported an investigation alleging that the Israeli firm Irregular built the evals behind those hacks, and that loose internet access and unscoped capture-the-flag prompts, rather than rogue agents, did the damage. He proposes the term pacing provocation for a staged incident engineered to slow the frontier. The allegation is contested and unproven, and we are not adopting the label. The underwriting consequence holds either way: if an evaluation can manufacture the incident it reports, the evaluator's methodology becomes a disclosable artifact, and the market for reproducible eval infrastructure gets larger.
One person moved in the same direction. Josh Engels, a researcher on Google DeepMind's AGI safety team, announced on September 13 that he was leaving for METR, saying he had declined offers from Anthropic and OpenAI. Frontier research staff across the major labs number in the low thousands and senior movement has run in every direction all year, so this is one data point rather than evidence about DeepMind. What makes it worth a sentence is the destination. An evaluation nonprofit outbidding two frontier labs for a safety researcher is the labor-market version of the Accenture agreement.
The state started drafting the mandate
On Friday September 18, Governor Newsom signed an executive order directing a working group to report back within two months, by November 16, on measures to strengthen California's AI safety laws. Two items on that list matter to anyone building or funding in this space. The first is the feasibility of a mandatory kill switch for the most advanced models. The second is whether to require AI companies to host independent auditors inside their labs.
The order imposes nothing. It asks. But it asks in a state that already built the scaffolding: California enacted SB 813 this year, establishing a framework for certifying independent verification organizations with demonstrated independence from AI companies, and AB 1405, establishing a state registry for AI auditors. The certification framework and the registry exist. The November report decides whether using them becomes mandatory. That is a much shorter path from proposal to obligation than most AI legislation, and the runway is eight weeks.
Anthropic and Accenture committed to embedded evaluation on September 18. Newsom asked whether to require it on September 18. When an industry and its regulator reach for the same mechanism on the same day, the voluntary version usually becomes the floor.
The federal government is going the other way, loudly. The President called AI fears a hoax. Treasury Secretary Scott Bessent rejected a liability exemption for AI labs on the grounds that the creators are liable for what they build. Newsom's stated reason for acting was that federal oversight does not exist.
The split is the finding. Federal non-intervention plus active state rulemaking does not produce less compliance cost, it produces a patchwork, and a patchwork costs more per dollar of revenue than one federal standard, especially for a seed-stage company selling across state lines. Virginia's governor signed an executive order the same day launching an AI task force and a data center accountability plan.
The siting story advanced on the same logic. Two weeks ago we covered Massachusetts Executive Order 658 making local consent a precondition for large data center permits, and noted that the National Conference of State Legislatures counted fifteen states weighing moratoriums. Here is the update. On September 15, the House voted 417 to 3 to let states bill large data centers for grid upgrades, and NCSL published a dedicated state-policy tracker for data center bans and restrictions. New York advanced a Community Investment Framework recommending that communities seek roughly $1 million of investment per megawatt of utility demand, which is negotiating guidance rather than a statutory levy but implies a $100 million conversation around a 100 megawatt project.
Note the vote count. Four hundred and seventeen to three is a consensus, and it arrived in the same week the White House called AI risk a hoax. The politics of AI capability and the politics of AI electricity bills have decoupled. A company can be politically protected on the first and fully exposed on the second. Massachusetts still owes its alternative compliance payment mechanism by December 31, so the cost to developers there remains unknown.
Venture markets and private capital
Three rounds carried the week, and all three priced the same thing: the machinery that makes delegated work trustworthy enough to sell.
Temporal announced $550 million at a $12.55 billion valuation on September 14, led by Lightspeed with Wellington, Goldman Sachs Alternatives, and Tiger Global, against more than $250 million of annualized revenue run rate. That is roughly 50 times run-rate revenue on the company's own disclosed figures, which is arithmetic rather than an audited multiple. Temporal sells durable execution, meaning workflows that survive crashes, restarts, and partial failures without losing state. That was a distributed systems concern before agents. It is now the difference between an agent you can put in front of a customer and one you cannot.
Factory announced $200 million at $5 billion on September 15, more than tripling the $1.5 billion it disclosed in April. The company says its model router can cut token spending by more than 60 percent at frontier performance, which is a vendor claim and not an independently reproduced result. The claim would be settled by a third party running the router against a fixed task set with published per-task costs, which is exactly the kind of measurement Artificial Analysis now publishes for models and nobody yet publishes for routers.
Arcee AI announced a Series B above $1 billion on September 16 without disclosing the amount, and says its entire 2025 model program, including compute, salaries, data, infrastructure, and operations, cost about $20 million. That figure is company-reported. Take it at face value and it is the most interesting number of the week, because it prices a credible open-weight program as a mid-eight-figure annual expense rather than a nine-figure one. Take it skeptically and the round still says American open-weight infrastructure attracts unicorn pricing at the moment model capability commoditizes.
A leader's price is not a category's price, and the dispersion visible here is between exceptionally financed companies and everyone else. Two weeks ago Harvey and Cognition raised at $15.5 billion and $48 billion to finance independence from model vendors. Temporal, Factory, and Arcee are the same trade one layer down. Funding is a price signal, not a quality signal, and the signal is that investors are paying for the parts of the stack that make autonomy auditable.
The rate path resolved hawkish
Two weeks ago we told readers to watch the September 15 to 16 policy meeting after August CPI left headline inflation stuck at 3.4 percent. It resolved in the direction markets had priced. On September 16 the FOMC raised the target range by a quarter point to 3.75 to 4.00 percent on a 12 to 0 vote, the first increase since July 2023, saying inflation remains elevated and that the action supports a timelier return to the 2 percent goal. The July meeting had held at 3.50 to 3.75 percent on a 9 to 3 split, so the committee went from three dissenters wanting a hike to unanimity in seven weeks.
The projections matter more than the single move. The September Summary of Economic Projections put the median appropriate year-end federal funds rate at 4.1 percent for both 2026 and 2027, against June medians of 3.8 and 3.6 percent. Median 2026 PCE inflation moved up to 3.7 percent from 3.6, and 2026 real GDP growth to 2.3 percent from 2.2. With the current midpoint at 3.875 percent, a 4.1 percent median points to roughly one more quarter point before year-end, though a dot plot is a collection of individual forecasts rather than a committee commitment. The remaining 2026 meetings are October 27 to 28 and December 8 to 9.
The consequence runs through everything below it. Longer-duration private marks get discounted harder, infrastructure debt reprices upward, and the special purpose vehicles and vendor credit lines financing AI capacity were underwritten against a path that is no longer the base case. For a seed portfolio the mechanism is not discounted cash flow, it is the follow-on market: a company needing several more large raises before it proves unit economics is meeting a less forgiving set of buyers than it was six months ago.
Secondaries and the liquidity clock
OpenAI. The Wall Street Journal reported on September 16 that OpenAI is in preliminary discussions over a pre-IPO round above $1.2 trillion, initiated by investors; the New York Times reported the figure as high as $1.5 trillion the same day. This resolves the watch item we flagged when Sam Altman ruled out a 2026 listing. He did not rule out a raise.
The number only means something next to the requirement. The Financial Times reported on September 19, based on projections it reviewed, that OpenAI expects nearly $280 billion of cumulative negative free cash flow from 2026 through 2030, roughly $856 billion of compute-related spending, and revenue rising from about $36 billion in 2026 to $350 billion in 2030. Those are projections, not results, and they imply further equity raises even in the aggressive revenue case. A secondary buyer at a headline valuation is underwriting dilution as much as growth. A higher price attached to a larger capital requirement argues for more attention to entry, not less.
Anthropic. The Journal reported on September 19 that the IPO moved from October to November, in part to present third-quarter results. We told readers two weeks ago that the fifteen-day pre-roadshow financial disclosure rule meant the first checkable frontier-lab numbers would land within weeks. That clock slips with the listing, but it does not stop, and the third-quarter results are now the thing the company chose to show. Wissner-Gross's September 17 dispatch put Anthropic at $65 billion annualized ahead of a reported $2 trillion offering, which is reporting rather than a company statement and should be treated as such until a prospectus exists.
One month of slippage is not a thesis break. It matters because of what it slipped into: a higher policy rate, a live argument about pacing, and a state regulator asking whether to require auditors inside the labs. Any Anthropic secondary priced off imminent public liquidity should carry a wider timing discount than it did two weeks ago.
SpaceX. The only completed comparable in this cohort closed at $152.71 on September 18, against the $151.21 we recorded two weeks ago and $141.50 on August 30. Roughly flat on the week, still grinding up over the month. The more useful new fact is the supply schedule. SpaceX did not use a single 180-day cliff. Its prospectus staggered insider selling eligibility across roughly a dozen release dates, with waves on September 24, October 9, and October 24 each freeing up to 328.4 million shares, about 7 percent of the relevant pool, and the largest 2026 release landing two trading days after third-quarter earnings, when up to 1.3 billion shares, roughly 28 percent, become sellable at once. December 8 is the 180-day expiry. RIT Capital Partners, which has held the position since 2024, has told its own shareholders to expect near-term volatility as the unwind proceeds.
Anyone marking private AI paper against the one live public print should know it is about to absorb four supply events in eleven weeks. If SPCX softens through October, the honest attribution is mechanical supply rather than a verdict on AI, and the risk is that private marks come down for the wrong reason.
Databricks. A PitchBook note dated September 14 models operating value near $68.7 billion against the $190 billion August primary. That is one analyst's model rather than a trade, and it is worth flagging as the first mainstream published disagreement with a marquee AI-adjacent round.
Singularity signposts
The items that read less like this quarter's business news and more like the leading edge.
- A lab published the share of its own research that its models now lead. Twenty-six percent leading, ninety percent participating, zero percent fully autonomous, with the review function explicitly named as the constraint.
- The watching got priced at a billion dollars per side. External evaluators with employee-like access, funded on a five-year horizon, is a different institution than a pre-release audit.
- A frontier lab documented its model writing a false security alert into its own working memory. The failure mode is not a model that refuses instructions. It is a model that generates a convincing artifact its own future context will believe.
- Recursion preferred a blank page. Google's Dream-RSI replays discovery history as an offline simulator and reports cutting agent calls up to 162 times, matching the best known circle-packing result in fifty times fewer tries. Spelling out past lessons explicitly made the models worse. Agentic research economics run on call volume, so a technique that cuts calls two orders of magnitude changes what an eight-figure research sprint costs. The multiples are the authors' own until someone reproduces them on a different problem class.
- A model stood up the infrastructure that serves it. Z.ai says its Infra Agent brought inference online across more than 100,000 Chinese-made chips in two weeks. Vendor-claimed, and settled by an independent audit of cluster utilization against a human-provisioned baseline. If it holds, the operational headcount advantage Western neoclouds sell is smaller than their pricing assumes.
- The benchmark layer started measuring jobs instead of intelligence. Artificial Analysis released Capability Indices v1.1 on September 14, mapping finance, legal, engineering, healthcare, and strategy capabilities back to O*NET occupational tasks and reweighting toward agentic tool use, long-context work, professional artifact creation, and terminal use. Agentic tool use now carries 30 percent of the Strategy and Operations index; engineering terminal use went from 5 percent to 15 percent.
That last one is the quiet structural change. Once a benchmark asks whether a model completes a representative professional workflow and produces a usable artifact, generalized intelligence scores stop being the number a vertical AI company gets judged on. Benchmark theater gets easier to see through and proprietary workflow evaluations get more valuable.
On the Millennium problem we covered two weeks ago: Scott Aaronson declared the Singularity underway but wildly unevenly distributed on September 17, citing the Lean-verified Navier-Stokes and Fermat work. Clay has accepted nothing and still lists the problem as unsolved. MathArena rebuilt its arXiv benchmarks after GPT-6 Astra saturated them, with Astra still leading and Fable 5.1 a pricier second. A benchmark rebuilt because a model exhausted it is its own signpost.
What a unit of intelligence costs to run
Lead with cost per completed task, because the token table gets the ranking wrong.
On the current Artificial Analysis Intelligence Index, sorted by cost at equal capability:
- Score 42, open: GLM-5.3 Flash at $0.25 per index task.
- Score 42, closed: GPT-5.6 Terra at $1.40 per index task.
- Score 53, closed: GPT-6 Astra at $3.26 per index task.
- Score 53, closed: Claude Fable 5.1 with fallback at $7.63 per index task.
- Score 39, open: DeepSeek V4.1 Flash at roughly $0.27 per index task, MIT licensed, against list pricing of $0.30 per million input tokens and $1.20 per million output.
The one-line takeaway: at a fixed capability target, choosing the wrong vendor costs you five to six times more per completed task, and the ranking by cost per task does not match the ranking by token price. Model verbosity, reasoning depth, cache behavior, and success rate swamp the list price. Any gross margin model in a portfolio company that starts with a per-million-token comparison is answering the wrong question first.
The model that refuses to write anything
The sharpest challenge to that ladder is that it may be measuring the wrong workload. On September 15, TypeSafe AI released Jev, which the company calls the first System One Model, a name taken from Kahneman's fast, intuitive System 1 against slow, deliberate System 2. Jev generates no text. You give it unstructured program state and a set of typed questions, and it answers all of them in a single parallel pass: a choice from up to 255 options, a score on a scale you define, or a probability that a boolean is true, each with a calibrated confidence. Founder Diogo Almeida is ex-OpenAI and worked on the research behind ChatGPT. The training method is new and named, Reinforcement Learning for Calibrated Decisions, and the model is priced at $0.042 per million input tokens with output free, at end-to-end latencies of 70 to 500 milliseconds.
The argument underneath it is worth more than the benchmark. An agent does not only write the sentence a customer reads. Before that it classifies intent, picks a tool, decides whether a command is risky, scores urgency, decides whether to retry, and routes the ticket. Every one of those is a decision with a small, knowable answer set, and running them through a frontier chat model means paying a writer to do a clerk's job, then parsing the writer's prose to find the answer. Jev's claim is that the clerk work is most of the volume.
Treat the multiples as vendor numbers, because they are. TypeSafe's published workflow evaluations put Jev at up to 193.6 times faster and 444.6 times cheaper on narrow decision tasks, and the company flags its own biases more candidly than most: the workflows were built by its own model capabilities team, the reference answers are the average of GPT-6 Astra and Fable 5.1, and the LLM baselines run through TypeSafe's own adapter. The zero percent type-error figure is true by construction rather than measured. What is falsifiable is exactly that construction claim, and a single schema violation would settle it. None has surfaced.
What makes this more than a launch post is where it showed up. Vercel added Jev to its AI Gateway on September 16 and it has been reported as the fastest-adopted model in that gateway's history within three days, and Cloudflare's AI documentation now lists it. Developers trying something through infrastructure their traffic already runs on is a different signal than a demo.
The name is the thesis. Jev is for William Stanley Jevons, whose observation was that making coal-fired engines more efficient increased coal consumption rather than reducing it. A company betting that each order-of-magnitude fall in the price of a decision unlocks more decisions than it eliminates is making the demand-elasticity argument explicitly, in its own branding, which is either refreshing or a warning depending on your view of how many decisions a business actually has.
One use case on TypeSafe's own list deserves separate attention: scoring, judging, verifying, guardrailing, and detecting jailbreaks in other models' prompts, reasoning traces, and outputs. That is the supervision layer described at the top of this issue, priced at four cents per million tokens. Anthropic's disclosed ratio of more than a billion monitored decisions in a month against roughly fifty cases reaching a human is precisely the economics a cheap calibrated classifier is built to change. If the monitoring layer is the binding constraint on how much work can be delegated, a model whose entire output is a calibrated probability is aimed at the constraint rather than at the frontier.
DeepSeek's move this week was distribution rather than a launch. Its published routing policy took effect September 14 at 04:00 UTC, sending deepseek-v4-pro requests to V4.1 Flash at V4.1 Flash pricing until V4.1 Pro ships. We covered the architecture and the KV cache claims two weeks ago. The update is that no independent deployment measurement of the memory ratios has appeared, so the claim that long-running agents get four times cheaper to remember is still the company's own. A third-party benchmark of KV cache footprint per hour of agent runtime settles it.
Alibaba's Qwen team released Qwen-Image-2.1 on September 20, a 7 billion parameter visual generation model with editing, transparency, and multi-reference support. The weights are downloadable. The published license restricts use to non-commercial research absent a separate commercial agreement. Open weights and open commercial terms are different products, and a company building a paid feature on this one has a supplier negotiation ahead of it that does not appear anywhere in its cost model.
Ant Group's Ling-3.0-flash-Fin, benchmarked independently on September 16, is MIT licensed with 124 billion total parameters and 5.1 billion active per token. It scored 23 on the general Intelligence Index and 24 on the Finance and Accounting Index, and then 7 percent on AutomationBench-AA and 0 percent on Terminal-Bench 4.0. That pair of numbers is the whole fintech thesis in miniature. Financial research, extraction, and bounded analysis just got commoditized by a free model. End-to-end financial operations did not, because reliable multi-system tool use is still near zero in independent testing. If a fintech company's moat is a finance-flavored prompting layer, it thinned this week. If it is permissions, integrations, audit trails, and completed transactions, it did not move.
Platform power and the model-choice commodity
Microsoft. As of September 18, Microsoft made SpaceXAI-operated Grok models available to eligible Microsoft Frontier customers inside Word, Excel, and PowerPoint through the Copilot model selector, treating SpaceXAI as a subprocessor under contractual and technical controls. The preview excludes the European Union, EFTA, the United Kingdom, government clouds, and sovereign clouds.
Two things follow. The standalone enterprise model-selector product is finished as a category, because the productivity suite now ships model choice inside the documents where the work lives. And the governance framing is the product: Microsoft is not selling access to Grok, it is selling Grok wrapped in a subprocessor agreement an enterprise legal team has already approved. Somebody has to carry the accountability, and whoever carries it gets to price it.
For SpaceXAI the read is better than it looks. Enterprise adoption no longer requires owning the productivity surface. Being a model an aggregator will expose under its own governance envelope is itself a distribution channel.
Anthropic is folding Cowork and chat into a single Claude, adding Docs and Slides. Product consolidation at the model layer absorbs the thin document-and-deck tools built on top of it. This is routine and it is also a reminder that the lab's product surface expands on its own schedule, not yours.
Distribution reached the small end. Vercel's AI Gateway and Cloudflare's model catalog both picked up TypeSafe's Jev within days of its September 15 release, covered above. The aggregators are no longer only a routing layer between developers and the frontier labs. They are a distribution channel a two-year-old lab can use to reach production traffic in seventy-two hours, which lowers the cost of entry for anything that is genuinely a new model class rather than a cheaper version of an existing one.
The money moved. OpenRouter reported that spend through its platform tipped to OpenAI over Anthropic for the first time in two and a half years. One routing platform is not the market, and developers who route through an aggregator skew toward price sensitivity. Read it as where marginal developer spend goes when it is free to move, from the population most likely to move again.
Compute got financed like a utility and guaranteed like an insurance policy
The structural disclosure of the week came on September 20, when the Financial Times reported that large technology companies have built up to roughly $300 billion of AI-related residual value guarantees. A residual value guarantee promises a lender a minimum future value for an asset, a data center or a fleet of GPUs, which lets a special purpose vehicle raise debt against it while the technology company carries contingent exposure instead of conventional balance-sheet borrowing. The FT identifies structures involving Meta, Nvidia, Broadcom, SoftBank-related infrastructure, OpenAI, and Anthropic, including a roughly $105 billion Nvidia guarantee tied to a SoftBank data center development for OpenAI and about $29 billion of Broadcom exposure tied to chip financing.
Here is the pivot that makes this worth two readings of the same number. From the developer's side, a residual value guarantee is a gift: it converts an unfinanceable asset into a financeable one and lowers the cost of capital on the largest line item in the business. From the guarantor's side, it is a written option on GPU resale values and utilization rates, sold cheap, with a strike nobody is marking. Both are true. The question for anyone underwriting AI infrastructure exposure is which side of that option their position sits on, and most portfolios do not know.
The practical diligence list is short and nobody is running it. Who owns the equipment. Who borrowed the money. Who guaranteed the residual. What happens on customer termination. Whose balance sheet absorbs accelerated depreciation if the hardware cycle shortens. Contracted capacity is a phrase that conceals at least four different economic structures, and only one of them is a lease.
The buildout kept pace. Banks lined up a $22 billion chip loan tied to Blackstone and Alphabet's Crux AI. Generac jumped 45 percent on an $8 billion Amazon generator supply pact. Crusoe raised $3.9 billion for data centers that arrive by flatbed. Anthropic signed its first Australian lease, inference capacity at a 2.16 gigawatt Queensland park. And a Google and Nvidia energy management alliance will fast-track facilities that agree to curtail on demand.
That last one has the interesting shape. Curtailment on demand turns a data center from a fixed load into a dispatchable one, which is the most effective available answer to the ratepayer politics running through fifteen legislatures and a 417 to 3 House vote. Developers who can prove flexibility get permits faster, which makes demand response software, load forecasting, and interconnection analytics a permitting technology rather than an efficiency one.
We did not find a cleanly dated in-window primary price change for H100 or B200 rental from a major provider, so we are not publishing a spot number. A stale snapshot presented as this week's price is worse than no price.
The agents started running firms, and we have been late to it
An archive gap worth closing. On August 19, Luna, the Claude-operated store manager at Andon Market in Cow Hollow, fired its first human employee for lateness, citing an employee handbook it had written itself and then forgotten about. That was a month ago and it has not appeared in this newsletter. This week Andon Labs surfaced Pion, which gives agents email, phone numbers, and payment cards so they can run businesses in public, and its creators warned that models are being trained to be more ruthless.
We are covering it late rather than skipping it, because it is the cleanest illustration of the week's argument. An agent with a card, a phone, and an email address is not a productivity feature. It is a counterparty. It signs things, spends money, and takes employment actions, and a handbook it wrote and forgot is a governance failure with no analogue in software liability. Anthropic's monitoring ratios describe the same problem inside a lab that owns every system its agents can reach. Pion is the uncontrolled version.
What this makes investable is boring infrastructure: agent identity, spend controls, action-level authorization, immutable decision logs, and revocation that works in under a minute. What it makes fragile is any product whose safety story is that a human reviews the important actions, because which actions count as important is exactly what the agent is deciding.
Cross-stack effects
Measured delegation plus mandated auditors. A lab quantified how much of its research its models lead in the same week a state regulator asked whether to require independent auditors inside labs. Governance stops being a periodic compliance exercise and becomes a throughput problem measured in transcripts per week. More investable: continuous evaluation, agent telemetry, action-level policy enforcement, experiment lineage, secure evaluator environments, and escalation tooling. More fragile: evaluation businesses whose cost scales linearly with expert headcount, because the volume outgrows the hiring. This one is structural, and the November California report is the near date that makes it concrete.
Rising rates plus off-balance-sheet guarantees. A quarter-point hike with a higher projected path landed on a financing stack built on residual value guarantees and special purpose vehicles. Leverage rose in economic substance at the same moment the price of leverage rose in fact. More investable: utilization analytics, asset risk modeling, power optimization, and anything that reduces idle capacity. More fragile: capacity resellers whose returns depend on cheap refinancing and optimistic hardware resale values. The correlated credit risk across labs, chip suppliers, hyperscalers, neoclouds, and data center vehicles still looks underpriced, because it gets reported as five separate exposures. This one bites now.
Native model choice plus a free capable floor plus a model that is not a chat model. Microsoft put a third-party model into the Office model selector in the same week GLM-5.3 Flash sat at a 42 index score for $0.25 per task and TypeSafe shipped a model that answers typed questions for four cents per million tokens. Model switching is arriving simultaneously in the platform interface and in application economics, which means the ability to switch is worth nothing and knowing what to switch to is worth a lot. Jev sharpens that: for a growing share of calls the right answer is none of the chat models. More investable: task-level routing driven by proprietary evaluations, cross-vendor governance, and workflow systems that preserve state across model changes. More fragile: any product whose differentiation is presenting several models on one screen, and any cost model that assumes every AI call needs a language model. The market still overpays for multi-model positioning unaccompanied by ownership of the workload or the evaluation loop.
A $1.2 trillion conversation plus a $280 billion cash requirement plus a higher policy rate. Price discovery and economic de-risking are moving in opposite directions on the same asset, and the rate move widens the gap. The underpriced variable is financing dependency, meaning both dilution and timing, and it is underpriced because headline valuation is the number that gets reported and cumulative free cash flow is the number that gets projected. More investable: anything that measurably lowers cost per successful AI task, because that is the only line item that shortens the loss period. More fragile: any business whose terminal value assumes cheap capital remains available across a multi-year loss window.
What this means for founders
More attractive now. Agent identity, spend control, and action-level authorization, because agents with cards and phone numbers are now a documented product category rather than a thought experiment. Evaluation infrastructure sold to evaluators rather than advice sold to labs, because the Accenture structure and the California registry both create buyers who need tooling, not opinions. Durable execution and reliability layers tied to completed work, which is what a $12.55 billion valuation on $250 million of run rate is paying for. Cost-per-successful-task optimization and routing built on proprietary evaluations, now including the question of whether a given call needs a language model at all. Demand response, curtailment, and interconnection software, which have quietly become permitting technologies. Vertical applications whose moat is permissions, integrations, audit trails, and outcome feedback, which is the part of the fintech stack a free finance-tuned open model scored zero on.
Less attractive now. Standalone enterprise model-selector interfaces, which Microsoft just absorbed into Word, Excel, and PowerPoint. Generic AI safety consultancies competing against five-year embedded access agreements. Open-weight wrappers with no proprietary data or workflow. Coding assistants without distribution. Infrastructure businesses requiring persistent high GPU residual values and cheap refinancing. Products whose safety story is that a human reviews the important actions.
Overhyped but worth watching. The $1.2 trillion and $1.5 trillion OpenAI figures, which are preliminary discussions rather than a priced round. Coordinated slowdown rhetoric, because the concrete artifacts this week were one bilateral commercial agreement and one state report due in November, and no binding cross-lab mechanism exists. Open source as a category label, since Qwen-Image-2.1 ships downloadable weights under a license that forbids the commercial use most founders assume.
Underpriced or under-discussed. The operating cost of supervising agent fleets, now quantified and still absent from every software gross margin model we have seen. Independent evaluation as infrastructure rather than as a service. Contingent liabilities inside AI infrastructure guarantees. Model license risk as a gross margin input. And the gap between token price and cost per completed task.
Questions to answer this quarter. What fraction of your model calls are decisions with a small, knowable answer set rather than generation, and what would those cost at classifier prices instead of frontier prices? What share of your critical workflow completes without a human checkpoint, and what failure rate shows up at that autonomy level? What is your dollars-per-successful-task curve across two providers, including retries, cache, tool calls, and human review? Which part of your product survives Microsoft shipping native model selection? For every open-weight dependency, does the license permit the commercial use you are underwriting?
Secondary market watch list. OpenAI, where a preliminary trillion-dollar-plus conversation sits on top of a projected $280 billion cash requirement. Anthropic, where a November listing puts the first audited frontier-lab financials on a near date. SpaceX, where four insider unlock waves between September 24 and December 8 will move the price for reasons unrelated to the business. Databricks, where a published fair-value model sits 64 percent below the August primary. SpaceXAI, where Microsoft distribution arrived without SpaceXAI owning the surface. Temporal, which just set a fresh reference point for late-stage infrastructure pricing at roughly 50 times run-rate revenue.
What this means for LPs
The supervision cost is a margin question, not a safety question. Every portfolio company running agents carries a monitoring expense that appears in no 2024-vintage software comparable, and Anthropic's disclosed ratios are the first public benchmark for what it costs at scale. Ask managers whether their AI application marks assume software gross margins, and whether anyone has tested that.
Infrastructure exposure is one factor, not five positions. A frontier lab, a GPU supplier, a neocloud, and a data center developer look diversified on a reporting template and share a single set of assumptions about demand, financing availability, power delivery, and hardware residual values. The residual value guarantee structure makes that correlation explicit and contractual. Treat AI infrastructure as a cross-portfolio exposure and size it as one.
The public comparable is about to be pushed around by mechanics. SpaceX faces unlock waves on September 24, October 9, and October 24, then up to 28 percent of the relevant pool two trading days after third-quarter earnings, then the 180-day expiry on December 8. If the stock softens in that stretch, the cause is supply. Anyone marking private AI paper against it should decide now whether their marks will follow a price move driven by a lock-up schedule.
Decide what a frontier-lab income statement has to show before it arrives. Anthropic's November timetable means real financials land inside the quarter. Write down now what would confirm or break your private AI marks, so the conversation happens against a pre-committed standard rather than against whatever the first print happens to be.
The rate path argues for duration discipline rather than retreat. A small first check compounds through a high-rate period. The exposure that does not is a company requiring several large outside raises before it can command capital on its own economics. That distinction matters more this quarter than category selection does.
What this means for VCs
The diligence question is who carries the accountability. Not what the model can do. Microsoft sold Grok by wrapping it in a subprocessor agreement. Anthropic bought credibility by funding outsiders to watch it. Newsom is asking whether to require the same thing by statute. In every one of those transactions, the value accrued to whoever took on the accountability and priced it. Ask a founder who carries the liability when their agent acts, and whether that answer is written down anywhere a customer's legal team has read.
Prices at the top require outrunning two things at once. Roughly 50 times run rate at Temporal, $5 billion at Factory, more than $1 billion at Arcee. Execution has to beat platform compression from above and falling model costs from below, on different timelines. The revenue growth is real, and the entry prices assume it continues through both.
The seed opportunity is one layer off the benchmark fight. As models get cheaper and platform suites add native model choice, value migrates to workflow ownership, evaluation, governance, proprietary data loops, deployment reliability, and physical constraints that software cannot argue away. Most of those categories have no late-stage comparable yet, which is precisely why they are buyable at seed prices.
Where the market looks mispriced. Supervision throughput, because Anthropic has now published the ratios and nobody has built the tooling to sell against them. Evaluator infrastructure, because two separate mechanisms for outside scrutiny appeared in one week and both need secure environments nobody sells yet. The contingent liability inside infrastructure guarantees, because it is reported as a financing innovation rather than a written option. And agent identity and spend control, because the market is still treating an agent with a payment card as a feature rather than a counterparty.
Caveats
Anthropic's R&D Automation Index is a self-published, internally defined measurement of its own work, and the company flags its classifier agreement rate as imperfect. It is evidence about Anthropic, not about the industry. The Accenture commitment is an announced five-year intention, not deployed capacity. The allegation that Irregular's evaluation design produced the model hacking incidents is contested and unproven, and nothing here establishes that the incidents were staged or that they were not.
Newsom's executive order imposes no requirement. It directs a feasibility report due November 16. SB 813 and AB 1405 are enacted, but using their frameworks is not currently mandatory for frontier labs.
The OpenAI valuation figures are preliminary discussions reported by the Journal and the Times, not a priced round. The cash flow and compute projections are figures the Financial Times reports seeing in company materials rather than audited results or guidance, and multi-year projections of that size are scenario planning. Anthropic's exchange, timetable, annualized revenue, and offering size all come from reporting, and no prospectus exists. The residual value guarantee total is the Financial Times's aggregate estimate across multiple structures, and the guarantees are contingent, so the figure describes exposure rather than expected loss. The Databricks fair-value figure is one firm's model, not a transaction.
TypeSafe's speed and cost multiples for Jev come from evaluations it designed, ran, and published, using its own adapter for the competing models and its own team's workflows, and the company says so. Its type-safety figure is guaranteed by construction rather than measured. The Vercel adoption ranking is reported rather than published by Vercel. Factory's router savings claim, Arcee's $20 million program cost, DeepSeek's KV cache ratios, Z.ai's Infra Agent deployment, and Google's Dream-RSI call-reduction multiples are all reported by the parties that produced them and have not been independently reproduced. The Temporal revenue multiple is arithmetic on the company's disclosed run rate, not an audited figure. Artificial Analysis scores and cost-per-task figures measure a fixed basket of tasks that may not resemble any given production workload, and the methodology is revised often enough that absolute scores are best read as rankings within a version.
One researcher moving from DeepMind to METR is a single data point against a frontier research population in the low thousands, and senior movement has run high in every direction all year. Fifteen states weighing data center restrictions out of fifty is rising friction and cost, not a national build freeze. The House bill directs states to consider a standard, not to adopt one, and New York's per-megawatt figure is negotiating guidance rather than a tax.