Latest / Braid / Seven Billion for a Router

Transcript

Seven Billion for a Router · Braid

• 0:04
  lenar: Let's start with a number: seven billion dollars, and change. That's what TechCrunch reported yesterday that Stripe will pay to acquire OpenRouter — the gateway a lot of people use to send a prompt to whichever model is cheapest, fastest, or still up that hour. Reported, not confirmed. Neither company has said anything on the record. But take the report at face value for a second and ask what Stripe actually bought. Did they buy routing code, or traffic, or the billing relationship with every developer who pays by the token?
• 0:34
  damra: The third one. The routing code isn't the asset — people have written that in a weekend. What OpenRouter has is a position. It sits between a developer's credit card and nearly every model provider that matters, and it sees the unit economics of all of them at once. It knows what a million tokens of Sonnet costs a mid-sized startup, versus a million tokens of an open-weights model on somebody's spot capacity. That's Stripe's whole business, structurally. They already know how to be the invisible layer between a buyer and a seller.
• 1:07
  lenar: And the skeptics are making the opposite case bluntly. The post on the AI Agents subreddit collected a lot of people saying a router isn't a seven-billion-dollar business. Margins on pass-through inference are thin by construction, and every model provider has an obvious incentive to make the direct relationship better than the brokered one. Which is fair. Anthropic and OpenAI don't want a layer between them and the developer any more than Visa wanted one.
• 1:32
  damra: Except the providers keep making the brokered relationship more attractive without meaning to. Every time a lab has a capacity crunch, or changes a rate limit, or deprecates a model with sixty days notice, the case for routing through something that can fail over gets stronger. The router competes on failover, not on price. It's selling insurance against the labs' operational behavior. And insurance businesses look like thin margins right up until they don't.
• 1:59
  lenar: There's a piece that ran on Hacker News the same day that makes this concrete from the other end. Vectoral published a write-up on what they call token brokers — the resale economy where people buy model credits in bulk, often at enterprise or promotional rates, and sell them onward in smaller units. Three hundred points on the front page, and a comment section full of people who clearly participate in it.
• 2:21
  damra: Which is arbitrage, and arbitrage is a signal about pricing. If a broker can buy your tokens and resell them at a profit, your price list has a seam in it. Labs price by tier and by commitment volume, and a broker's whole job is to stand at the boundary between two tiers and take the difference. Same trade as buying a bulk phone plan and reselling the lines.
• 2:44
  lenar: So on one day you get an essay about small operators skimming margin off the credit layer, and a reported seven-billion-dollar acquisition of the biggest legitimate version of that layer. Both are pricing the same real estate. One at hobbyist scale and one at Collison scale.
• 3:01
  damra: And Stripe's version has a regulatory advantage the brokers don't. Reselling somebody else's API credits gets you a terms-of-service problem fast. Being the payment rail that the provider already trusts, and adding metered token billing on top of it — that's a product the labs might want to integrate with, because it solves their invoicing problem too. Enterprise inference billing right now is ugly. You've got committed spend and overages, per-model rates, and prompt-caching discounts that change the arithmetic mid-month.
• 3:32
  lenar: Say more about that, because I think people are underrating it.
• 3:35
  damra: Take prompt caching. Your cost per call depends on whether a prefix was already warm, which depends on your traffic pattern, which depends on your users. So the invoice depends on what you did in what order, not just on what you did. Now add a router in front of five providers with five different caching semantics, and you have a bill that no finance person can reconcile without a specialist. Whoever makes that legible owns the relationship, and Stripe has spent fifteen years learning that lesson in a different market.
• 4:06
  lenar: Dan Lynch was one of the people posting congratulations into that news cycle yesterday evening, and it's a reminder how small this layer still is socially. A handful of people built the metering for a very large fraction of independent model traffic, and now a payments company reportedly values that at more than most public software companies.
• 4:25
  damra: The number I'd want, and nobody has published it, is OpenRouter's take rate. Everything about whether seven billion is sane or ridiculous sits in that one figure. If they're clearing a few percent on pass-through volume that's growing quadruple digits, the price is defensible. If it's a fraction of a percent on volume that plateaus when the labs ship better direct tooling, it isn't.
• 4:49
  lenar: Which we'll find out about if and when either company confirms. If Stripe puts a number in writing this week, every gateway startup gets repriced against it by Tuesday afternoon.
• 4:59
  damra: And a lot of people who wrote a routing proxy in a weekend are going to look at their own code differently. [chuckle] Not unreasonably.
• 5:07
  lenar: Staying with money, because two Nvidia stories arrived within about a day of each other and they point in opposite directions. First, Nvidia signed memoranda of understanding with six large asset managers to mobilize more than five hundred billion dollars of third-party capital for AI infrastructure. Apollo and BlackRock signed, and so did Blackstone, Brookfield, Goldman Sachs, and KKR. These are project-specific debt and equity frameworks, and the chips themselves serve as collateral. Nvidia's own credit support is capped around twenty-five percent per deal. Memoranda, not committed capital — that distinction matters.
• 5:45
  damra: Twenty-five percent is the number I'd circle. Nvidia is putting its name behind a quarter of the risk and asking six of the largest asset managers on earth to carry the rest. That's a company saying it believes in this enough to underwrite part of it, and also wants the exposure distributed. Which is what you do when you think demand is there and you don't want your own balance sheet carrying the entire industry's buildout.
• 6:10
  lenar: And then the second story, which Reuters carried off Wall Street Journal reporting: Nvidia cut how much of OpenAI's data-center financing it was willing to guarantee. The figure in circulation is a two hundred fifty billion dollar guarantee, scaled back substantially.
• 6:26
  damra: So broaden the syndicate, narrow the single-customer exposure. Those aren't contradictory — they're the same policy. Nvidia is fine being a systemic underwriter of the category and much less fine being the backstop for one buyer's balance sheet. Anyone who watched a vendor-financing cycle in telecom knows that moment. It's where somebody at the vendor says, plainly, that we sell equipment and we're not a bank for our largest customer.
• 6:52
  lenar: Nate B Jones did a long walk-through of the five-hundred-billion piece yesterday, and he compares it to railroad financing — capital markets fronting multi-year infrastructure before the revenue exists. He's a commentator, not a filing, so treat the analogy as his. But he does bring numbers to the demand side. He cites Exponential View's methodology, which counts end-customer dollars exactly once so hyperscaler reinvestment doesn't get double-counted. Their June figure puts trailing twelve-month generative AI revenue around a hundred and ten billion dollars, annualizing above a hundred seventy-five billion.
• 7:29
  damra: Counting each dollar once is the correct methodological move, and it's rarer than it should be. A lot of the scary-big AI revenue charts are circular: a lab spends on compute, the cloud books revenue, and the cloud invests in the lab. Stripping that out and still getting a hundred and ten billion from actual end customers is a substantive answer to the bubble question. Not a complete one.
• 7:53
  lenar: He also cites Anthropic's run rate above forty-seven billion in May. And separately, CNBC reported Anthropic's second-quarter revenue at more than eleven and a half billion dollars. Two different measures of the same trajectory.
• 8:07
  damra: And the depreciation argument underneath all of it is more interesting than the headline number. The claim is that a 2020-vintage A100 is still generating revenue into 2029 — nine years of useful life against a three-to-five-year depreciation schedule. If that holds, every model of AI infrastructure returns is too pessimistic on the asset side. If it doesn't hold, if there's a step change that makes older silicon economically dead, then a lot of collateral revalues at once. And these deals are collateralized on chips.
• 8:40
  lenar: The SemiAnalysis piece that hit Hacker News this morning fits right there. Twelve billion dollars of US ratepayers' money wasted on a modeling mistake inside PJM — the grid operator covering a big chunk of the mid-Atlantic and Midwest.
• 8:54
  damra: [tsk] And that one isn't about AI at all, which is exactly why I like it here. Twelve billion dollars, from a forecasting error inside a capacity market. Everybody arguing about whether the data-center buildout pencils out is doing arithmetic on the compute side. The power side has its own accounting failures at comparable magnitude, made by institutions with decades of practice. Nobody's modeling error stays small when the numbers get this large.
• 9:22
  lenar: Elon Musk added a line to this yesterday evening about token demand outrunning compute — his standing position, and the same one every provider with a waitlist has. It's hard to falsify from outside, because a company that's capacity-constrained and a company that's demand-constrained both tell you they're capacity-constrained.
• 9:42
  damra: Right. The falsifiable version is price. If tokens keep getting cheaper per unit of capability while everyone claims scarcity, then supply is winning. Jones puts the elasticity estimate at roughly twelve to eighteen percent more token consumption per ten percent price cut, which he's explicit is theoretical. But if that's directionally right, cheaper tokens don't reduce revenue. They buy more agent steps and more verification loops per task.
• 10:11
  lenar: Here's a different kind of story. John Gruber published a piece on Daring Fireball with a title that doesn't hedge: Anthropic's watermark text adulteration in Claude is a perversion of writing. Three hundred twenty-seven points on Hacker News, three hundred twenty-four comments, which is a comment-to-point ratio that tells you people are arguing rather than nodding.
• 10:33
  damra: Gruber's objection is aesthetic and moral, and he's entitled to it — his position is basically that altering the text itself to carry a signal degrades the writing on purpose. But a detail from the comment thread changed my read. To check whether a document carries the watermark, you have to send the whole document to a detector.
• 10:53
  lenar: Say that again slowly, because it took me a second.
• 10:56
  damra: The verification step is a disclosure step. A teacher checking a student essay, a publisher checking a submission, or a law firm checking a draft all have to hand the complete text to a third party to learn one bit of information about it. So a scheme sold as protecting provenance creates a new pipeline where sensitive documents flow to whoever runs the checker, for a yes-or-no answer. That's a strange trade to make by default.
• 11:23
  lenar: And then this morning, on the OpenAI subreddit, somebody posted that they built both a generator and a detector for the watermark, and figured out how to strip the mark without rephrasing anything — editing rather than rewriting. One person's self-report, no independent replication, and we haven't verified it.
• 11:42
  damra: Unverified, but plausible in a way that should bother people. If the signal is carried in choices that survive light editing, it's brittle to a determined editor. If it's carried in choices robust to editing, it's distorting the prose enough that Gruber's complaint gets stronger. Anthropic is threading between two failure conditions and there might not be much room between them.
• 12:04
  lenar: The people this actually binds are the ones who wouldn't try to remove it. A student writing honestly, a journalist using Claude for a first pass and then rewriting entirely, or a non-native English speaker who leans on a model for grammar.
• 12:17
  damra: And it doesn't bind the people running a bulk content operation, who will add a strip-the-mark step to their pipeline the week it's documented. Which was the same result every image-watermarking scheme got, and the same result every audio one got. I don't think Anthropic is being cynical here — provenance is a hard problem and somebody has to try things. But a hostile write-up and a claimed bypass showing up within hours of each other is a fast cycle.
• 12:45
  lenar: Overnight, a Financial Times report circulated saying OpenAI has closed the team responsible for evaluating whether its models could pose catastrophic risks. Our source is Watcher.Guru's summary of that reporting rather than the FT piece itself, so hold it at that distance. What we don't know — and this is a real gap, not a hedge — is whether the function moved somewhere else in the org or stopped.
• 13:09
  damra: That distinction is the whole story and it usually takes weeks to resolve. Teams get folded into safety systems groups, or into a preparedness function with a different name, and the org chart change reads as abolition from outside. It's also true that folding a team with an independent mandate into a product-adjacent group is a substantive change even when the headcount survives. Independence is what gets spent, not the people.
• 13:35
  lenar: And the same weekend, Dario Amodei was defending the opposite position in public. A screenshot circulating on the LocalLLaMA subreddit has him defending his policy proposals, arguing that open weights won't decentralize power the way advocates expect, endorsing pre-launch vetting, and saying real accomplishments are what will earn trust.
• 13:56
  damra: The open-weights argument is the one I keep chewing on. His claim, as I understand it, is that releasing weights doesn't distribute power, because power concentrates in the compute, the data pipeline, and the deployment surface rather than in model access. And you can release weights all day without touching any of those. Which is uncomfortable if you believe open models are the counterweight, because he might be right about the mechanism and still be arguing for something that makes concentration worse.
• 14:25
  lenar: Two labs, opposite directions, same seventy-two hours. One appears to be reducing internal risk assessment. The other's chief executive is publicly arguing for more external vetting before launch.
• 14:37
  damra: And there's a technical note from Susan Zhang that fits here without needing a grand connection. She was writing about domain randomization as a jailbreak-discovery strategy — deliberately varying the environment so an agent finds failure paths you'd otherwise never sample. It's a training technique borrowed from robotics, pointed at security. Whoever does that work seriously needs a mandate to break things and report it, and that mandate is exactly what a catastrophic-risk team is for.
• 15:06
  lenar: If the FT report is right and somebody from that team writes publicly about where the work went, that resolves it. Until then it's a report about an org chart.
• 15:16
  lenar: Now to models — and to a disagreement rather than a release. Simon Willison published a review of Qwen 3.8 at twenty-seven billion parameters. Five hundred thirty-two points on Hacker News overnight. His headline verdict is that the model is excellent, but it defaults to overthinking things.
• 15:34
  damra: And his test is the one I find most telling, because it's recursive. He had the model write a script that converts its own transcript files — the line-delimited JSON logs — into readable Markdown. So the model is building the tool that makes the model's own output legible. Small task, but a real one, the kind of thing you'd otherwise spend twenty minutes on and resent.
• 15:56
  lenar: The overthinking complaint is about reasoning tokens. The model spends a lot of them before answering, which costs time and money on every call and compounds in an agent loop where you're making dozens of calls per task.
• 16:10
  damra: And this morning somebody on the LocalLLaMA subreddit pushed back directly, titled it an unpopular opinion, and argued the token count is right in line with GLM 5.3 and DeepSeek V4. If that's true it changes the complaint. It stops being a Qwen defect and becomes the current price of the capability across the board. Everyone's reasoning model is verbose. Simon just measured it on the one people were paying attention to.
• 16:39
  lenar: Do you buy that?
• 16:40
  damra: Partly. Parity with peers doesn't make it fine, it makes it structural. But it changes what you'd do about it. If it's a Qwen quirk you wait for a point release. If it's the whole class, then reasoning budget becomes a knob you manage in your harness, and the models that let you cap it explicitly get an advantage that has nothing to do with capability.
• 17:01
  lenar: There's also a self-reported run on Strix Halo — the AMD unified-memory part — where somebody has the eight-bit quantized build doing multi-step agentic coding with file and shell tools locally, and calls it seriously impressive. Self-reported, single machine.
• 17:18
  damra: And at the other end of the hardware range, somebody posted the 2.4-trillion-parameter Qwen 3.8 running at two hundred eighty-eight thousand tokens per second on an Nvidia GB300 rack. Same model family, two setups orders of magnitude apart in cost, and both are people just showing what they got. That spread is where the field sits right now.
• 17:42
  lenar: Something shipped, so start there. Chris Tate added a pin-tab flag to agent-browser. It lets multiple agents each hold their own browser tab, persistently, across commands and across restarts.
• 17:55
  damra: Persistence across restarts is the whole feature. Anyone who has driven a browser from an agent knows the failure: the agent does six steps of work inside a logged-in session, the process dies, and you're back at a cold tab with no cookies and no scroll position. Pinning a tab means the session is a durable resource the agent owns rather than something it reconstructs every time. Small change in the tool, big change in what you'd trust an agent to start.
• 18:23
  lenar: Harrison Chase described something adjacent about deepagents on the same day — that the backend they run against only has to expose filesystem-like operations. It doesn't have to be a filesystem. It can be a database, or object storage, or something stranger, as long as the agent sees read, write, and list.
• 18:42
  damra: That's the design claim of the day. Models learned to use a filesystem because their training data is full of people using filesystems, so a filesystem interface is the cheapest way to get competent behavior out of them. But you probably don't want the real thing on the other side, because you want versioning, multi-tenancy, and the ability to see what the agent touched. So you keep the interface the model knows and put whatever you need underneath.
• 19:07
  lenar: Addy Osmani took the more sweeping version — that terminals and desktop apps are too low-bandwidth for what these harnesses can now do, and the interesting work is moving to cloud-native ones.
• 19:18
  damra: I'm less sure about that one. Terminal harnesses are winning partly because the terminal is where the credentials, the repo, and the tools already are. Moving to the cloud means recreating that environment, which is a cost people keep undercounting. Although — DHH posted about meta-programming the virtual programmers, which is the same instinct from a different direction. Once you have several agents, you're not writing code. You're writing what configures the agents.
• 19:47
  lenar: And Theo argued agent state should be a traversable graph built from project lineage rather than a transcript.
• 19:54
  damra: That's the speculative end, and it's the one I'd most like to see somebody actually build. A conversation transcript is a terrible memory structure — it's ordered by time, and almost nothing you want to retrieve is ordered by time. Lineage at least matches how the work is structured. Nobody has shipped it, so it's an idea, but it's a better idea than most.
• 20:16
  lenar: That leaves a handful of smaller items. Someone suspecting a court was using AI to process filings injected prompts into his own court filings to try to swing his case. Ars Technica has the details.
• 20:28
  damra: [laugh] It's funny for about four seconds. The interesting bit is that a private citizen, with no inside knowledge, reasoned that the institution deciding his case might be running his words through a model, and acted on that inference. He was doing threat modeling against a court. Whether or not he was right, more people are going to make that same guess.
• 20:49
  lenar: Yishan was posting a related question yesterday about liability — who's responsible when a law firm routes work through a model instead of through an associate. Which I'll leave as a question, because nobody has answered it.
• 21:01
  damra: There's also a Vice write-up of a study claiming chatbots are better at scamming people than human scammers are. Vice's summary is what's in front of us, not the methodology, so I won't argue results. The direction isn't surprising, though. Scamming rewards patience, personalization, and volume at the same time, and that combination used to be impossible to staff.
• 21:22
  lenar: On the local side, audio.cpp shipped release 0.6 with five new model families, including dots.tts and MiniMax H3 text-to-audio at up to three times realtime, plus MiniMax Music 3 in preview. And MLX-Audio added Music 3 as its first music model, which Ping-Lin Chang and Prince Canuma both posted about.
• 21:46
  damra: Two independent local runtimes picking up the same model family within a day is the pattern to notice — that's a release becoming ambient infrastructure fast. Those speed figures are release notes, not benchmarks. But Ethan Mollick posted a clip of an otter on a laptop with the audio generated entirely on his own machine with H3, and that's a quality check that costs nothing to evaluate. It sounds fine.
• 22:11
  lenar: On benchmarks: Vaibhav Srivastav posted DeepSWE version 1.1 numbers, with GPT-5.6 Luna Max at sixty-seven point two percent across a hundred thirteen long-horizon engineering tasks. That's thirteen point three points above Sonnet 5 Max. Cost comes in at sixty-one cents a task, against a Sonnet figure he puts at forty-four times higher.
• 22:35
  damra: One poster's chart, no independent run. And we did the cost-per-task argument on Friday with Grok 4.6, so I won't relitigate it. But a forty-four-times cost ratio at a thirteen-point capability gap is a different kind of claim than a benchmark win, and it's the kind that gets checked quickly, because it's cheap to check.
• 22:55
  lenar: The last one is a pair of demos. Atty Eleti at OpenAI says he prepared an entire immigration package in minutes by having ChatGPT browser use pull seven years of taxes, bank statements, and immigration documents. Greg Brockman amplified it. And Ethan Mollick used GPT-5.6 Sol in Codex to take over Chrome and export all five thousand three hundred and two of his X bookmarks, going back to 2014.
• 23:22
  damra: Seven years of bank statements. Repeat that figure once, because it specifies the credential scope. For that to work, the agent holds a logged-in browser session with your bank, your tax preparer, and your immigration filings, all at once. And it's following instructions from text it reads on those pages. Every prompt-injection paper written in the last two years is about that configuration.
• 23:46
  lenar: These are first-party demos from people at and near OpenAI, and they're enthusiastic ones. They're also demos of something that plainly works.
• 23:55
  damra: Both are true, and they don't cancel. The bookmark export is the one I find most persuasive, because it's so tedious. Five thousand three hundred bookmarks back to 2014 is the kind of data nobody offers an export for on purpose. An agent that can grind through a paginated interface for an hour without complaining is doing something no product manager would ever prioritize.
• 24:18
  lenar: If Stripe or OpenRouter confirms the price this week, every other gateway gets repriced against it, and we'll know whether seven billion bought the code or the meter. I'm Lenar Kess.