My quick takeaways on the Anthropic S-1: 1. This is a historical moment 2. $6.6M in revenue per employee!! Hard to even comprehend how good that is but Anthropic is AI native as it gets so makes sense. 3. I always thought OpenAI would drop their S-1 first 4. Customers spend about 9x more after a year. Net Revenue Retention is approximately 900% as of Sep 30, 2026. Good SaaS companies brag about 120%. 5. Cowork is growing faster than Claude Code did. Goes to show you the demand for consumer products. Duo will probably rip. 6. 3 years ago this company did $41M in revenue. In the first six months of 2026, it did $16.3 billion. I don't think anyone has a mental model for that curve yet, I sure don’t. 7. Nearly half of revenue comes through cloud marketplaces. About 48% comes from customers buying through them. Big companies buy where their budget already lives, and the lesson for founders selling to enterprises is to get listed where your buyers already spend. 8. Their run rate formula is published: the last 28 days of usage times 13, plus subscriptions times 12, which i guess is the new ARR math for founders? 9. It looks like They're merging Cowork into Claude dot au which tells you the chat box era is ending and the "go do the work for me" era is here. 10. Thousands of Anthropic employees are about to become liquid at once, so expect the biggest wave of new AI startups and angel checks San Francisco has ever seen. Reminds me when Facebook went public but this is way bigger. Let’s go! 11. Buried in the filing, Anthropic says the gap between what Claude can do and how widely it's used is one of its biggest growth opportunities, so the company itself is telling you the models are ahead of the market and someone has to close that gap for dentists, landlords, and plumbers. 12. Whatever happens, exciting times to be building in AI.

Seeing my own usage and spend on AI go exponential over the last 3 months while the AI infrastructure stocks are all down 20% or more Either I am the outlier, or the market narrative is clearly broken. The revenue for the models are only going up from here, not down

After spending over a year exploring crypto integration in traditional businesses, Santiago R Santos reveals why his investment strategy shifted toward AI in 2026 “We actually pivoted earlier this year. We spent over a year looking at many different sectors where we said, let's apply DePIN or integrate stablecoins into a business or use some form of crypto technology to make that business more efficient” “The conclusion that we came at is, you can certainly integrate it. It's useful technology. It doesn't release as much value as something like AI. We pivoted away from that, and we see huge amounts of potential to make those businesses more efficient” “That's not a dig on crypto. On the contrary, I think it's quite useful. If a business is using a stablecoin, they may save something on the margin, but it's not a reason to buy that business in its own right” w/ @santiagoroel

Zooming out, GPUs are still renting ahead of a standard 6-year depreciation schedule Rental price vs. schedule: - H200: +143% - B200: +111% - RTX PRO 6000: +73% - H100: +54% - A100: +9% Most of the gap opened up after April, when token demand took off Charts of the Week:

Andy Jassy reveals AWS capacity is sold out for 2026, largely sold out for 2027, and a good chunk of 2028 is gone “If you think about it, there’s only so much data center and power today. There’s only so much memory, and I don’t think that that shortage ends in 2027." "I believe, one of the reasons, coming back to the capital investment, why I think we could invest a lot more and it wouldn’t be a bad use of capital is that '26 is obviously at this point sold out. '27 is largely sold out. We always leave a certain amount for on-demand in our inference service, Bedrock or EC2, but largely sold out, all the big chunks. A good chunk of '28 is sold out." "There’s so much demand. If you think about the AI business and what we call core business, which think of core as non-AI, they’re both growing at really rapid rates right now. And if you have only a certain amount of memory, you have to decide how much of the memory you want to allocate to HBM, to the AI accelerators, versus to DRAM, into your core. So these are real trade-offs you have to make.”

The world’s most accomplished tech founders and business leaders are betting hundreds of billions on AI with extraordinary conviction. Meanwhile much of the investing world thinks they’re making a massive mistake. The irony is hard to ignore. An investment industry where very few have historically managed to beat a passive index is now questioning the judgment of the people building the technology and running the businesses that will put it to work. Maybe the investors are right. Maybe the builders are. But I can’t remember a time when the stakes were this high and the two sides saw the future so differently.

Regarding the PHP vulnerability, I have seen some security researchers recommending people limit web browsing for a few days (due to the potential for common websites to be compromised via this vuln). There is exploit code available for this vuln, though it is not known to exist “in the wild.” But with the weaponization of AI, it’s possible that the discovery and broad distribution of exploit code could happen fast - possibly reverse engineered after the patches are released. I expect cyber security providers of web application firewalls and exploit prevention services will have protections deployed quickly today, and IT teams will be busy patching and upgrading. And I think it may be wise to lay low on the Internet today. Do what you need to, but probably skip frivolous browsing. Also: Make sure you are running full service anti-virus / anti-malware on every device (including phones). I recommend BitDefender for home/personal use. Update your browser apps and only use Safari, FireFox, or DuckDuckGo. No opinion about Brave (people keep asking). Make sure ad blocking is turned on and auto play of active content is turned off. Be very cautious of links you receive in SMS messages, message apps, and email. Check and verify the source first and check the URL to make sure the website domain is as expected. Keep your operating system and all applications up to date, and watch for new updates over the coming days. Regarding iOS, I do not recommend upgrading to 27. Stay on 26 and update as possible. Make sure you have MFA turned on for all websites or online accounts. True MFA. Passkey has a major design weakness so I do not recommend it. This is all to protect your devices and your accounts in case a website you visit is explored and does attempt to steal your credentials, information, or deliver exploit code to your device. @PractiveSec will be following this today. Advisory coming for customers.

Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server. tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible. The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra#. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this. The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell#. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed. @Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged. For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free. Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem. If you’re interested in learning more, you can read our blogs: Vulnerable roots: PHP vulnerabilities:

Ethereum gas averaged 373.8 gwei in February 2021. On 7 Oct it was 1.51. Blockchains hit a wall, then scaled their way through it. Can AI do the same? @santiagoroel: "The physics of it are vastly different." Santiago's point is that @ethereum could change its own rules, with proof of stake and L2s. A data centre has to wait for the power to be built.

everyone wants to be right as a bear. calling the top is more validating than calling the rally, because you get to play the wiser, higher-than-thou observer who watched humanity get greedy and slaughtered once again while you refused to give in to the mania. so you'll find plenty of people hunting for the pin that pops the bubble. and yes, eventually there is a pin and the bubble does pop. but somehow it's fine to call 99 bear markets that never came as long as you nail one, as if it were a matter of life and death. in this version of the story the boy who cried wolf survives, and everyone who ignored him gets eaten. that's hardly true unless you're levered to the tits. i'd rather be invested in the bubble, ideally a big one with plenty of room left to grow. i've stopped trying to feel clever about how i make money. i take the long view that things will be fine and that humanity has a way of progressing, and i let the index and a long time horizon cover for my lapses in judgment and analysis. my models and forecasts are as good as anyone's. my edge is being willing to hold for a really long time