Newsletter: No.22

Early-career software developers saw headcount drop nearly 20% from late 2022 to September 2025 while mid-career and senior devs held steady or grew. The interpretation that will get the most airtime is that AI is already eating the bottom of the labour market: automating the codified, checkable tasks that historically justified junior hires while complementing the tacit judgement of experienced workers.

The problem is the timing doesn't support it. Meaningful AI coding adoption didn't take off until the second half of 2025, well after the divergence was already established. Something else drove this chart: tighter hiring budgets, a correction from the pandemic-era overhire, or a shift in how teams are sized.

The good news? TrueUp reports software engineering openings up 30% this year in the US, the highest level in three years, with 67,000+ positions open. If the job-replacement thesis can't hold where the spend is most concentrated and the tooling is most mature… the cost-savings story being projected across every other function is still, at best, a forward bet with very little evidence behind it.

Anthropic announced last week that its unreleased model, Claude Mythos Preview, is so capable at discovering and exploiting software vulnerabilities that the company has chosen to withhold it from public release. Instead, it launched Project Glasswing: a coalition of roughly 50 major technology and cybersecurity firms, including Amazon, Microsoft, CrowdStrike, and others - who’ve been given early access so they can find and patch critical flaws before the model goes wide. Anthropic is committing 100 million dollars in usage credits and 4 million dollars in donations to open-source security organisations. Before you get too misty-eyed about the philanthropy, note that while Mythos hasn't been publicly released, third-party sources have already reported its pricing… at exactly five times their current top-tier model. It looks like saving the world can also turn out to be a very effective customer acquisition strategy. Beatrice Nolan at Fortune, who broke the news about Mythos' existence, has the full write-up on Glasswing.

According to Anthropic's own red team report, Mythos is “in a different league” and the generational jump means even non-experts can leverage it to find and exploit sophisticated vulnerabilities. They benchmarked its ability to take a known crash in Firefox and turn it into a working exploit (the kind of attack that would give a hacker control of a user's browser). Their latest Sonnet model succeeded in 4% of trials; Opus 4.6 (current SOTA model) managed 14%; Mythos Preview hit 72%.

Beyond that headline number, the model identified thousands of high-severity zero-day vulnerabilities across a large number of major operating systems and web browsers. Some of these flaws had been sitting undetected for decades - one in an open-source operating system for 27 years, another in a widely used media processing library for 16 years, despite five million rounds of automated testing. It also reverse-engineered proprietary software from its compiled code alone to find flaws the original developers hadn't published. The New York Times coverage frames this as the beginning of a new era in which AI-enabled hackers could overwhelm human defenders entirely.

Financial markets, as ever, went straight to panic. When details of Mythos first leaked due to what Anthropic called "human error" - cybersecurity stocks sold off hard. CrowdStrike dropped 7%, Palo Alto Networks 6%, with the rest of the sector following. We're now at the point where every AI lab press release wipes billions off an entire industry's market cap before anyone has had time to read the paper, let alone assess whether the claims hold up. As ever the sell-off missed the nuance that Forrester's analysis brought to light. If vulnerability discovery becomes a near-free commodity, the value chain in cybersecurity shifts from finding bugs to remediating them. If AI can surface thousands of zero-days in weeks, the companies that patch and manage the response become more valuable, not less. Jeff Pollard, a principal analyst at Forrester, captured the uncertainty nicely: "Mythos could be genuinely that powerful, or this could be one of the most effective marketing campaigns of all time."

Behind the marketing story of the day - there's a reality cyber-experts have known for a while: you don't need Mythos to do serious damage. A Sequoia-backed cybersecurity startup called Buzz built an AI agent using current, publicly available models from Anthropic, OpenAI, and Google, and pointed it at a public list of known software flaws - the kind that governments publish so companies can patch them quickly. The agent exploited 103 out of 122 of those flaws autonomously, most in under an hour, some in minutes. Jon Raper, CISO at Chevron, put it well: "finding vulnerabilities isn't the problem, it's remediating them in time." The Mercor breach is a case in point with impeccable timing. Mercor is a 10 billion dollar startup that recruits the people who train frontier AI models for Anthropic, OpenAI, and Meta - and it was itself compromised through a vulnerability in an open-source library. The extortion gang Lapsus$ claims to have walked away with four terabytes of data, including source code and videos of AI systems in conversation with contractors. The companies building the models that are supposed to defend us can't secure their own supply chains.

The implicit promise of Project Glasswing is that AI will defend us from AI - give the good guys Mythos first, patch the holes before the bad guys can exploit them. But looking at Anthropic’s own admissions doesn’t exactly fill you with confidence. Their red team report acknowledges that the model can’t reliably distinguish real logic bugs from hallucinations, that “we would be surprised if we got everything right” about their exploit explanations, and that over 99% of the vulnerabilities Mythos discovered remain unpatched. The whole pitch is “we’re giving defenders a head start”, but by Anthropic’s own account, the patching hasn’t happened yet. The methodology also relied on controlled conditions far removed from the chaos of production environments.

The problems run deeper than execution lag. A recent paper from Franklin, Tomasev, and colleagues introduces the concept of “AI Agent Traps” - adversarial content designed to manipulate, deceive, and exploit autonomous AI agents as they navigate the web. If you’re deploying AI agents to scan codebases and patch flaws at scale, which is exactly what Glasswing proposes, those agents are themselves attack surfaces. Adversarial actors can plant traps that hijack the agent’s actions entirely. The “AI will save AI from itself” thesis assumes the defensive AI operates in a clean environment, an assumption that never holds.

Gary Marcus raised further doubts in two Substack posts. The Mythos demonstrations were run in simplified, sandboxed environments with no comparison benchmarks - cybersecurity expert Heidy Khlaaf flagged the absence of any real baseline. More damaging to the “unprecedented leap” framing: researchers at AISLE Security showed that smaller, openly available models could recover much of the same analysis when pointed at the specific vulnerabilities Anthropic showcased. The conclusion was that Mythos performs “just slightly above GPT 5.4” and shows “no acceleration” in capability metrics. Something hard to square with the apocalyptic tone of the coverage.

My issue with all this: Anthropic's primary task here is straightforward: align the model so its offensive capabilities can't be weaponised, then release it. That work doesn't require a branded coalition, a public benchmarking exercise, or a 100 million dollar credit programme. Instead, they staged a public announcement and ensured the story landed as "our model is so dangerous we can't release it."

If it feels familiar, it should. In February 2019, OpenAI declared GPT-2 “too dangerous to release” because of its potential for misuse, generating weeks of breathless coverage. Dario Amodei was at OpenAI at the time, as was Jack Clark, who helped lead the communications strategy around it. GPT-2 was released later that year anyway, and with the benefit of hindsight its dangers were... modest. The “too dangerous” framing did far more for OpenAI’s brand than it did for public safety. Anthropic appears to be running the same playbook, refined for higher stakes. Dario Amodei has built his public identity in deliberate opposition to Sam Altman - the responsible steward versus the reckless accelerationist. Every “we’re holding back our model because it’s too powerful” announcement reinforces that positioning. Some version of Mythos will almost certainly be released soon, with a safety wrapper, and the Glasswing partners will have had a head start that conveniently doubles as a commercial relationship with Anthropic.

I’m not questioning whether the cybersecurity threat from AI is real, nor am I qualified to judge the extent of the generational jump (or absence of). The Buzz research alone should keep CISOs up at night. What I am questioning is whether the theatrics and fear-mongering serve the public interest or the company’s, and whether the “AI defends against AI” framing holds up. The labs remain the loudest voice in the room on AI progress and AI risk, and they have structural incentives to be loud in specific ways. Every “too dangerous” claim embeds an implicit “and we’re the ones who built it look at how smart we are.”

We need more voices in the conversation that aren’t attached to a model release cycle. Until then, read the announcements, but read them as what they are.

The WSJ got hold of confidential financial documents that both OpenAI and Anthropic shared with investors ahead of their latest funding rounds, revealing Anthropic might have surpassed OpenAI in annualised revenue: roughly 30 billion dollars to OpenAI’s 25 billion, having grown from 1 billion just eighteen months ago, a growth rate with no precedent in enterprise software.

The comparison isn’t perfectly like-for-like (Anthropic counts cloud partner sales as revenue; OpenAI doesn’t) but the trajectory is staggering either way.

Both companies now report two separate measures of profitability. One that includes the cost of training new models, and one that conveniently leaves it out. Surprise surprise if you strip out most costs, both are near breakeven this year. The reality: OpenAI projects 121 billion dollars in compute spending by 2028 and 85 billion in losses that year - numbers that would, as the WSJ puts it, “dwarf those of virtually any other public company in history.”

An interesting question is why OpenAI’s projected training costs are roughly four times Anthropic’s despite similar revenue. Whether that reflects a broader product ambition or simply bigger bets on capability jumps, it’s a gap that IPO investors will need to understand.

The venture investors who wrote the early cheques will cash out, transferring the risk to institutional and retail investors who'll be buying into companies that, by their own projections, won't break even for years. It's the classic playbook: privatise the gains, IPO the uncertainty, and let public markets figure out whether a business model actually exists.

As more agents are deployed into production workloads, vendors are discovering that their old pricing models don’t hold up, and are scrambling to find new ones.

OpenAI this week announced a new $100-per-user-per-month tier for Codex, its coding agent, and shifted from charging per request to charging per token. The move reflects a broader industry reckoning: agents burn through compute in ways that flat subscriptions simply can’t absorb. Replit and Cursor learned this the hard way last year, when the cost of running coding agents ate deeply into their margins and forced pricing overhauls. Anthropic, too, recently added surcharges for Claude Code users who connect it to third-party agent tools like OpenClaw, a sign that “unlimited” has limits.

Meanwhile, the battle is opening up on a second front: data access for agents as platforms that once competed on features built for humans become inputs in agentic workflows. ServiceNow is launching a new product called the Context Engine that consolidates customer data across its apps for AI agents to query, but it will charge when those agents are built outside ServiceNow's own ecosystem. Atlassian has taken a harder line, trying to throttle how often outside apps can pull its data altogether, taking from Slack’s playbook (a move that sparked significant backlash back then since persistent message history is exactly what agents need to build organisational context). AWS CEO Matt Garman publicly warned this week that incumbents who "put up walls" are in trouble.

The issue is that a platform closing its data is working against the thing that makes agents valuable in the first place. The point of agentic workflows is to chain tools, data sources, and models together. A wall that keeps outside agents out also keeps your own agents in. But for incumbents, opening up accelerates the end of the seat-based model that funds them, and no one has found a convincing replacement at scale. Sierra's outcome-based pricing - charging per resolved conversation rather than per user - points at what the destination could look like. But Sierra is a startup building from scratch around agents. For a ServiceNow or an Atlassian, repricing a nine-figure seat business around outcomes means cannibalising your own revenue before anyone else does.

A lot of the AI adoption data we get comes from executive surveys. The issue is that executives are hired to tell a story - and to be good at it you need to believe it. Two surveys this week show the two facets of AI adoption in 2026, and they might as well be describing different planets.

The Richmond Fed’s CFO Survey - charted up nicely by Apollo’s economics team - paints what I’d call the clean, “boardroom-ready” picture.

Total employment flat to slightly negative, labour cost per worker ticking down, and every productivity-adjacent metric climbing gently into 2026: output per worker, decision speed, time on high-value tasks, revenue from new products. It reads like an investor deck that answers the question before anyone asks it. AI is working. Costs are coming down. Revenue upside is building. As planned.

The coal-face version looks rather different. Writer and Workplace Intelligence surveyed 1,600 leaders and employees this month and reveal a messier picture with a deep divide between execs and their teams at its heart.

48% of executives say AI adoption has been a “massive disappointment” - up from 34% last year. 75% of the C-suite concede their AI strategy exists more for PR and investor relations than for actual internal guidance. 63% say their leaders talk a big game but can’t deliver, up from 44% a year ago. And my favourite stat: 29% of employees admit to actively sabotaging their company’s AI strategy - rising to 44% among Gen Z.

The workforce is being told AI is the future by executives who privately aren't convinced, and then told the main value story is cost savings and fewer jobs. No wonder a growing share of them is making sure it doesn't happen. Employee resistance is the friction that will show up in the productivity numbers that markets will eventually demand. The gap between what gets said on the earnings call and what's happening three levels down is where the real AI adoption story lives, and it's a stable equilibrium, for now.

What breaks it is the interesting question. A recession that forces real productivity scrutiny. A few market leaders who go all-in publicly and either succeed - raising the bar for everyone else or fail loudly enough to seed widespread scepticism. In any case: playing the clock isn't going to work.

About

I analyse AI progress beyond the headlines, focusing on enterprise execution, incentives, and real-world economic impact.