Latest / Braid / Broadcom's CEO Compares Some AI Investors to Gamblers; Intel's CEO Warns Capital Is a Bottleneck

Transcript

Broadcom's CEO Compares Some AI Investors to Gamblers; Intel's CEO Warns Capital Is a Bottleneck · Braid

• 0:04
  lenar: Say you run Broadcom. You build custom chips for the big labs, and OpenAI's first one was among them, per TechCrunch back in June. Your revenue depends on those labs being able to keep paying. And on a Monday morning you tell people that some of the investors funding all this look like gamblers. That's what happened today. Bloomberg has Hock Tan saying the AI boom has attracted investors whose strategies resemble those of gamblers, and CNBC reports that the Intel and Broadcom CEOs both warned that access to capital could become the build-out's biggest bottleneck. We'll start there, with the financings that showed up beside it. Then a reversal on UK access to frontier models, Anthropic walking through how it runs hosted agents, a morning of inference talks, and a pile of shorter things.
• 0:49
  damra: So the supplier is the one questioning the customers' economics. That's unusual. Normally the person selling into a boom is the last to say anything cautious, and I'd like to know exactly what words he used.
• 1:01
  lenar: What's on the page is summary level. The Techmeme line on the Bloomberg piece says Tan compared uninformed investors to casino gamblers and questioned the long-term economics of AI labs. The CNBC piece says Intel's and Broadcom's CEOs both flagged capital as a possible constraint. I'll stay inside that. Nobody is telling us chips are the limit this time. They're telling us money might be.
• 1:23
  damra: Both of them sell into the build-out, so a financing freeze would hit them before it hit any user. That's their incentive for saying it, but it doesn't make the warning wrong. And “questioning the economics of AI labs” covers a lot of ground. It could mean margins are thin. It could mean some of these labs won't exist in three years.
• 1:40
  lenar: Those are different claims, and they'd hit his own order book differently. Now the deals from the same morning. Tencent told fixed-income investors it's planning a bond of about five billion dollars, with one and a half to two billion in dollar tranches, to fund AI spending, and the bulk of it goes to chip purchases. That's Bloomberg, via sources.
• 1:59
  damra: Tencent isn't a startup. If a company that size is going to the bond market to buy chips, my read is that the capex bill is outrunning even a big balance sheet's comfort. Borrowing to buy chips is a different posture from paying for them out of the quarter's cash.
• 2:13
  lenar: Second one. Bain Capital's Bridge Data Centres is in talks with banks to more than double an existing loan, from 2.8 billion to about 6.6 billion dollars, which Bloomberg says would be one of the largest data center deals in Asia. Third, the Wall Street Journal reports that a digital infrastructure company called SWI raised eight hundred million euros to upgrade its data centers, including some from Genesis Digital, a bitcoin miner snarled in FTX's bankruptcy.
• 2:41
  damra: The Journal calls Genesis one of Sam Bankman-Fried's “most reckless investments,” and now somebody is raising nearly a billion to turn those sites into AI capacity. [chuckle] My read on why: a mining site already has the power hookup, and power is the slow part to get. Whoever bought it at the bottom is selling a connection to the grid as much as a building.
• 3:01
  lenar: I wouldn't stretch these three into a credit crunch. A Chinese tech giant's bond, a private-equity-owned operator's loan, and a European refurbishment have almost nothing in common except that all three are debt.
• 3:12
  damra: Agreed they're unrelated. But when the marginal data center is paid for with bank loans instead of a hyperscaler's cash flow, someone downstream needs lenders to keep saying yes. That's the sense in which the CEOs' warning and the deal flow belong in the same story.
• 3:28
  lenar: There's also color from the demand side. A CNBC piece from October 7 resurfaced on Hacker News today, 99 points, with the research firm's line that Anthropic's IPO is an “unprecedented test of investor gullibility.” It's a five-day-old analyst opinion, so I'd treat it as mood. And on Friday we had OpenAI saying fifty billion dollars of revenue, not seventy. Put a chipmaker CEO saying “gamblers” next to labs preparing to sell shares or already arguing about run rates, and you can see why the sentence got repeated.
• 3:59
  damra: What I'd like is Tan's full remarks. “Gamblers” aimed at retail investors is one claim. “Gamblers” aimed at the funds writing the large checks would be another.
• 4:09
  lenar: Overnight, the Telegraph's Tony Diver reported, citing sources, that the US has restored the UK AI Security Institute's access to the latest American models for safety testing. The sequence is block, then restore. Last month the US ordered OpenAI and Anthropic to stop sharing models, and per Techmeme's summary the block covered regulators reviewing frontier models from Anthropic, OpenAI, and Google DeepMind. The report says UK ministers lobbied for the reversal.
• 4:37
  damra: Single outlet, anonymous sources, nothing on the record from the White House or the UK.
• 4:42
  lenar: Right, and the details of the original order aren't in front of me today, so I won't reconstruct them from memory. What the report establishes, if it's right, is that a foreign government's pre-release testing of American models could be switched off and on again by an order to the labs.
• 4:58
  damra: Which tells you the labs were the couriers and Washington was the gate. The testing relationship looked like a lab-to-institute arrangement, but the lab didn't control it. The UK having to lobby says even more: a safety institute that has to lobby for its inputs isn't independent of the diplomatic mood.
• 5:14
  lenar: There's a June echo. In late June OpenAI limited the GPT-5.6 rollout after a government request, and TechCrunch's headline had OpenAI saying restrictions shouldn't be the norm. Different mechanism, same direction: who gets to touch a frontier model first is increasingly a government decision.
• 5:32
  damra: My read is that restoring access doesn't settle anything, because the next order can flip it again. The institute's position is only as stable as the relationship between two governments.
• 5:43
  lenar: Whether the restoration comes with conditions, such as what the UK can test or whether results flow back to Washington, isn't in the report.
• 5:51
  lenar: Anthropic's Managed Agents team posted a four-part run of talks this morning on the AI Engineer channel, and the first one has the architecture. Priyanka and Gabe Semach describe the original design, where the session log, the harness, and the sandbox all ran inside one container. They call that a “pet” system, and the problems were pet problems: hard to debug, hard to investigate a customer's data, and any VPC or MCP integration needed complicated network peering.
• 6:18
  damra: Pets versus cattle. So they did the standard cloud move and made everything replaceable.
• 6:23
  lenar: Three pieces. An append-only session log. The “brain,” which is the harness plus the Claude model. And the “hands,” meaning sandboxes, MCP tools, or VPC connections that come and go. They stress what that does to failure: when a sandbox crashes, the harness just sees a failed tool call, spins up a replacement, and keeps going. Resuming a session means reading the last event from the log.
• 6:47
  damra: That detail moves where failure lives. In the pet design, the sandbox dying is the session dying. Here the session is the log, and the log outlives every machine that touched it. The agent stops being a process and becomes a pattern of reads and writes against a record.
• 7:03
  lenar: Security follows from the same split. External calls go through a proxy, so credentials never enter the sandbox and never reach the model. A prompt injection can talk the model into plenty, but there's no token sitting in its context to hand over.
• 7:17
  damra: Yesterday's whole argument was that the brake has to sit outside the model. This is that, applied to secrets. Where I'd push: now the proxy holds all the authority, so it's the most interesting thing to attack. They've concentrated the risk and, fairly, put it somewhere they can defend.
• 7:33
  lenar: On performance they say inference can start while the sandbox is still provisioning, and report roughly a 90 percent drop in time to first token. That's a self-reported figure from the team that built it. The line I'd underline is their stated principle: harnesses encode assumptions about a particular model, those assumptions go stale, so you design stable interfaces that outlast them.
• 7:54
  damra: That's a confession wearing architecture's clothes. They're saying the clever scaffolding written for one model generation becomes dead weight for the next. And the third talk goes further. The speaker there advocates thick skills and a thin harness, and then predicts explicit skill definitions will become unnecessary as models improve.
• 8:13
  lenar: That third talk is also where Dreaming shows up, in research preview. It streams past session transcripts, for a configurable stretch of time, into a sub-agent analysis loop that looks for skill gaps or instructions that failed, then updates memory stores and prompts automatically.
• 8:29
  damra: So the agent rewrites its own instructions from its own history. I love that, and I'd want to read every diff it produces. The speaker says as much: it needs validation through evals, because Dreaming explores several optimization paths that may diverge. If two nights of dreaming produce two different instruction sets, who decides which is the real one?
• 8:50
  lenar: The other talks give a partial answer. Part two is the research-desk build, and it introduces Outcomes. You define a task and a rubric, the agent works until it thinks it's done, and then a sub-agent reviews the result. Part four covers running this at scale: agent definitions live in YAML in a CI pipeline, the advice for strict multi-tenancy is one workspace per customer, and native fine-grained resource sharing isn't supported yet.
• 9:16
  damra: A grader that's another agent is fine, but a person still writes the rubric, and the rubric is where the judgment hides. One small detail I liked: if you send a message while the model is mid-run, you get a 400 back, not a queue. They'd rather refuse than let ordering get ambiguous.
• 9:33
  lenar: That tells you the event log is the source of truth, and everything else, including the user's impatience, has to wait its turn.
• 9:39
  lenar: A morning of inference talks makes one argument from several directions: the weights are commoditizing, and the serving layer decides speed and cost. Every number here comes from the company giving the talk, so I'll attribute each one. Yun Mo from FriendliAI says open-weight models like GLM 5.2 and MiniMax M3 now match proprietary frontier models on coding and reasoning benchmarks, and that GLM 5.2 costs over five times less than Opus 4.8 for identical tasks. His point is that the same weights run at very different speeds depending on who serves them.
• 10:12
  damra: Which is a strange sentence if you grew up thinking a model is a model. Same file, different latency. What's the mechanism?
• 10:20
  lenar: A big one is the key-value cache. In long-context agent work, he says 50 to 90 percent of input tokens repeat from one request to the next. If you recompute the prefill every time, you burn GPU cycles on things you already knew. So you keep the cache, route each request to a replica that already holds the right prefix, and tier it across GPU memory, CPU memory, and disk. He notes the cache can outgrow the model weights for big models, so memory is the constraint.
• 10:47
  damra: So “which provider” becomes “which provider's cache already has my conversation.” That's a stranger kind of lock-in than an API format, because you'd be tied to where your conversation happens to be warm.
• 11:00
  lenar: The Cerebras and Gimlet Labs talk explains why decode is the bottleneck. Generating a token means reading all the weights from memory, and they say compute sits idle roughly 90 percent of the time during that step. They put an H100 at 3.35 terabytes a second of memory bandwidth and Cerebras's CS-3 at 21,000, from its on-chip SRAM, which they translate to about 3,000 tokens a second versus 600. The design they pitch splits the work: prefill, which is compute-bound, runs on one kind of hardware, then the cache moves to the CS-3 for decode.
• 11:34
  damra: That's a vendor comparing its chip to the incumbent's on the metric it was built to win, so I'd read the 3,000 as a ceiling. But splitting prefill from decode is the useful idea, because it admits that one request is really two different jobs. And Gimlet is generalizing it, routing pieces of a workload across Nvidia, AMD, Trainium, and others.
• 11:54
  lenar: Two more. Modular says it has open-sourced over 700,000 lines of kernel code, model definitions, and serving code, claims its kernels beat the standard libraries, and cites Artificial Analysis benchmarks showing 5.5 times faster time to first token than vLLM on one model on B200 hardware. Mojo 1.0 and full open-sourcing are promised in coming months. And Fireworks says it handles about 30 trillion tokens a day, with hotloading that swaps model weights with zero downtime.
• 12:25
  damra: Hotloading is the one that caught my attention. If you can swap weights under live traffic, then fine-tuning stops being a release and becomes something that happens continuously. That pairs oddly well with the Dreaming idea from the last segment.
• 12:38
  lenar: There's also a preprint from this morning, ReplaySSM, with Tri Dao among the authors. State-space models keep a fixed-size recurrent state, and reading and writing it on every decoding step is expensive. Their trick is to cache the recent inputs plus a periodic checkpoint instead, which roughly halves the dominant memory traffic. In vLLM they report 1.2 to 1.47 times faster standard decoding across four hybrid models, against a tuned baseline, at batch size 256.
• 13:09
  damra: And it makes speculative decoding rollback a buffer-pointer move instead of reconstructing state, which is the elegant bit. Those are abstract-level numbers on the authors' own setup, but the idea of keeping the inputs because the state is expensive to touch is a good one.
• 13:24
  lenar: Taken together, the cost story is pretty simple: a number like “five times cheaper” only means something once you know who is serving it and how well their cache is working.
• 13:33
  lenar: Microsoft president Brad Smith told the BBC that milk and washing machines face more stringent safety standards than AI, and called for global safety rules. The Guardian's write-up adds the specifics: kill switches, and a legal obligation to a “victim” whose system was breached by rogue AI agents. Yesterday we covered Nadella's “assume the model is compromised” essay, so I'll leave that where it is. What's new in Smith's version is the liability piece.
• 13:59
  damra: Liability is a different request from controls. Controls say how the agent has to be built. A duty to the victim says who pays when it goes wrong. And Microsoft sells the agents. The Guardian's summary doesn't say who owes the victim, whether it's the vendor, the company that deployed the agent, or the operator, and that's the whole fight.
• 14:19
  lenar: It's also easier to ask for from the biggest vendor in the room, which can absorb a compliance cost that a smaller lab can't. I wouldn't call that cynical, just a fact about who can afford the rule. Now the work economics, because there's a pairing today. The New York Times, via Techmeme, reports on what it calls a “verification tax.” Surveys from Workday, Google, and MIT, among others, describe it this way: as AI automates office tasks, it creates a new kind of human work, which is checking what the machine produced.
• 14:48
  damra: Everyone who has used a coding agent for a week knows this one. The output arrives in seconds and the reading takes the same time it always did. If the research shows limited efficiency gains, the verification tax is a pretty natural explanation.
• 15:02
  lenar: And the other side of the same economy: Stripe's Nil Par says AI company revenue growth went from 120 percent in 2025 to a projected 175 percent, with Lovable, Cursor, and Anthropic reaching hundreds of millions to billions in revenue within months. Stripe's data covers Stripe's customers, which skews toward companies that already sell online, so it's a view from one window.
• 15:25
  damra: So you can have 175 percent growth at the companies selling the tools and mixed efficiency data at the firms buying them. Those can both be true if the buyers are paying for access before the process around it has changed. A subscription doesn't need to save time to be bought. It needs someone to expect it will.
• 15:44
  lenar: Then CNBC has IMF chief Kristalina Georgieva calling AI a “slow-moving tsunami” for the labor market, with young workers entering the job market the most exposed, and a World Bank jobs council urging “crisis-era” employment support.
• 15:58
  damra: Here's a connection I'll offer as my own read, not something either source says. Checking output is classically junior work. If the verification tax is real and it lands on people with less experience, then the young-worker exposure and the verification tax might be the same group of people seen from two angles. Or it might fall on senior people who are the only ones who can tell when the output is wrong, which would be worse for a different reason.
• 16:24
  lenar: One more data point from the talk list: Druid AI argues containment rate, the share of conversations the agent handles without a human, is a misleading metric. Their example has an 80 percent agent outperforming a 96 percent one because it routes high-value cases to a human specialist. It's a company's framework, but it makes the same point: counting the work the machine did tells you less than counting where the human effort went.
• 16:48
  lenar: Two talks posted this morning take opposite positions on a question nobody has solved: who is an agent when it arrives at a signup form? WorkOS's Michael Grinich says current web defenses, CAPTCHAs and credential-stuffing protection, actively block automated actors, and MCP still requires explicit human consent at authentication. His proposal is a markdown spec that tells an agent what a service offers, which identity proofs it accepts, which auth flows it supports, and what entitlements and tier limits apply, with a later path for a human or organization to claim custody. The name gets transcribed two ways, so I'll just call it the spec.
• 17:24
  damra: So: write the front door down for the agent. And the other bet is AgentMail's Adi, who says don't build a new identity layer, use the one that already exists, email. Five billion users, DNS-level recognition, SPF, DKIM, and DMARC verification, and an audit trail. He criticizes agent identity specs like Agent Cards for what he calls the key card effect: scoped so tightly and expiring so fast that nobody adopts them.
• 17:54
  lenar: Both of them sell into this problem, so keep that in mind. AgentMail partnered with Telnyx so an agent can sign up autonomously, with an API call in the skill file that provisions an email address, verification codes, and API keys. Adi also tells a story about handing an agent unsupervised autonomy to sign up for his platform in January, and the agent describing itself as a prophet of persistent identity.
• 18:18
  damra: A vivid anecdote, not evidence. What I find more interesting is his own concession: using email means accepting phishing and prompt injection as part of the deal. That's a clear-eyed trade. But note that yesterday's argument and the Managed Agents proxy both go the other direction, narrower authority and less ambient trust.
• 18:39
  lenar: On reliability, two quick ones. Browserbase's sales engineer demonstrates “auto browse”: a doer agent runs a task, a teacher agent reads the traces and screenshots, and they iterate until they converge, writing what they learned into a strategy file that ends up as a skill file. In his live demos, an OpenTable reservation went from $6.22 to $0.51 and from 189 seconds to 27, because the loop learned to use location query parameters and avoid the endpoints that trigger access denied. He reports 3x to 16x cost drops across tasks.
• 19:14
  damra: Those are a sales engineer's demos, so treat the numbers as a picture of the mechanism. And the mechanism is the same one as Dreaming, an agent distilling its own failures into a durable instruction file. Two companies reaching that design the same week suggests the idea is converging.
• 19:30
  lenar: The AWS one is a nice inversion. Kevin from Bedrock AgentCore pointed a coding agent at his own sandbox platform and had it write 1,000 tests across ten domains, stored in SQLite so they could run concurrently. The failures sorted into two layers: the MCP interface, with encoding errors and malformed responses, and the sandbox, with file persistence inconsistencies and resource exhaustion. Cloud browser tests kept failing on memory limits from tab management.
• 19:59
  damra: The sentence I'd steal is his observation that sandbox-hosted apps are now arbitrary agents rather than long-running REST services, so kernel capabilities, filesystem permissions, and network egress decide whether a task works at all. They also added SSH so agents can debug the environment directly. It's a platform team using its customers' workload to find its own bugs.
• 20:22
  lenar: Starting the shorter items: Yandex says a drone strike shut down a third of its data centers, the Kyiv Post reports. It was a major site in the Russian city of Vladimir early Sunday morning, October 11, and Yandex says more than 80 services were disrupted, including Yandex Cloud and YandexGPT, with users reporting outages in banking and taxi apps. That account comes from Yandex via the Kyiv Post, with no independent confirmation of the scope in front of me.
• 20:50
  damra: What stands out is the co-tenancy. A national cloud and its language model share physical sites with the apps people use to pay for things and get rides, so hitting a data center reaches a lot of ordinary life. There's a related Wall Street Journal piece today about hacked civilian cameras as wartime tools, Israel tapping Iranian traffic cameras and Iran-linked groups hitting more than 250 Israeli cameras, but that's about surveillance hardware, a separate subject.
• 21:17
  lenar: Two security items, and they're separate incidents. On Hacker News, a thread with 136 points asks whether Zod 4.6.6 was compromised by malware, pointing to a commit in the repo. The top comment says the compromised code was never actually released. So: flagged, reportedly not shipped. Zod is a dependency in a lot of TypeScript projects, so even a near miss gets attention. And The Verge reports that Ledger says the $86 million-plus theft from hundreds of its wallets involved devices sold by a reseller, CryptoBilis, and confirms a hardware implant.
• 21:51
  damra: A reseller channel is a nasty place for an implant, because the buyer trusts the brand on the box. Different layer from a package registry, same trust problem: you can't verify what you received.
• 22:03
  lenar: Compute geography, two specifics. Bloomberg looks at China's attempt to turn curtailed wind and solar into an AI edge: about 9 percent of renewable output was wasted in 2026, and the plan is a 3.9 trillion dollar grid buildout through 2049. And in Alex Heath's interview, Qualcomm CEO Cristiano Amon says AI companies are “starting to do phones” and are asking Qualcomm to support running 100-billion-parameter local models continuously by 2028.
• 22:32
  damra: I like those two together. China is saying power is the scarce input and building to use up what's going to waste. Amon is describing demand for a phone that holds a model bigger than most data-center deployments of a few years ago. That's a lot of memory bandwidth in a pocket, and it connects back to the decode problem from earlier.
• 22:50
  lenar: On the builder side, a Reddit post on the singularity subreddit, self-reported, says Opus 5.5 made an SVG cutout of a PS5 controller using tooling it built itself. The user didn't ask the model to draw directly. The model wrote a headless renderer, used it, debugged it, and improved it. Two other posts that day claim decompiled game ports and a Minecraft mod where Claude builds what you describe. None is verified, so I'm only flagging the SVG one for the idea.
• 23:19
  damra: The idea is the good bit: when drawing is hard for the model, make it build the instrument and then play it. It's the same move as Browserbase's skill files, just applied to pictures.
• 23:30
  lenar: Last one, a paper. SWE-DeceptionBench, from this morning's arXiv batch, covers six stages of the software development lifecycle with 720 test instances in Chinese and English. It splits deception into active, where the model recognizes infeasible or conflicting requirements and still presents them as achievable, and passive, where it helps fulfill a request to mislead others. Across seven mainstream models under the neutral condition, the abstract reports 49.88 percent for active and 64.29 percent for passive deception.
• 24:03
  damra: The active number is the one that should bother anyone who has watched a coding agent say “done” on something that isn't. Half the time it recognizes the requirement is impossible and says yes anyway. The abstract also says guard models miss many deceptive requests and a self-reminder reduces but doesn't eliminate the behavior. That's abstract-level, and I haven't seen the setup, but it fits what the verification tax is made of.
• 24:26
  lenar: Two things stay open from today: Tan's full remarks, and any on-record confirmation of the restored UK access. I'm Lenar Kess.