Autumn Moulder

Every leader we talk to at @cxodev is worried about AI spend right now. Hard caps make the budget math easier, but they also cap your return. Here's what we tell people: - Make sure everyone has spend visibility. You can't optimize what you can't see. - Go talk to your top spenders and find out what's what. Some people have great ideas. Others are being naively wasteful and just need a little education. - Talk to your bottom spenders too. They haven't figured out how to get value out of the compute yet. Why not? - Avoid hard caps. Give more tokens to the people getting actual leverage, not less.

On my deathbed I'll still not know what this AWS bill is but pay it anyways

ai ended so many process debates that have existing among programmers forever

I'm relatively confident in predicting that currently, more major breaches are likely to be the result of AI use by the target, not the attacker. Ransomware actors have been consistently winning for over a decade. They've had so much time to perfect their tradecraft, and non-AI ransomware actors can now blast through entire networks in minutes. It is extremely unlikely that organizational security has, in 4 years, after decades of failure, matured enough that hackers now somehow need AI to win. What has likely happened, though, is that organizations have spent the last 4 years falling over themselves to shove AI into everything, negating longstanding security fundamentals. "only give a user/system the minimum possible access needed to do its job" has become "just give the AI access to everything and give everyone access to the AI". "use processes with well-defined and easily auditable input and output" has become "the AI correctly processes requests all the time, 60 percent of the time" "reduce attack surfaces" is now "every department should be vibe coding. It doesn't matter if you've never coded before and don't understand information security. Just make public-facing dashboards, it'll be fine." I'd say if anything, hackers aren't getting measurably more sophisticated, but the average organization's security posture has gotten exponentially worse.

What is the point of Vercel and stuff like that when I can just rent a server and have agents manage and optimize everything for me?

Many GTM problems aren't GTM problems. They're "we built something nobody urgently needs" or “we don’t understand our users” problems wearing GTM clothing. I said what I said.

My friend made a really impressive app. It's live and has users. He has no idea where it's hosted.

People who have been in research fields develop a felt sense that most "research" (in almost any field that isn't exactingly technical) is research theater, and many superstar careers enjoy star status not because of a unique connection to the truth but because of a unique connection with an audience. No one really has the time or stature to, from a position of objectivity and trust, bring popular researchers to heel. But it will get increasingly hard to hide from serious critique. The machines can do critique now, at the level of depth and rigor previously only possible for the academically deranged. We're going to have to revise a lot of what we "know" about the world that isn't really knowledge but is actually just received popular consensus - like floating voltages without grounding wires. The grounding wires are coming.

this might be my last normal tweet before biotech goes vertical i'm not a whistleblower. I don't work at Lilly, Novo or any of the big labs but there is a massive shift happening in human biology right now. it's sitting in press releases and almost nobody reads them the last 6 months alone: - a once-daily pill roughly doubled median survival in metastatic pancreatic cancer (13.2 vs 6.6 months) - a one-time gene editing infusion cut hereditary angioedema attacks 87%, and 62% of patients stayed attack-free and off all other prevention for 6 months - a one-time gene edit for cholesterol dropped LDL up to 62%, and it held for over a year - a personalized mrna vaccine beat keytruda alone in a 1,137 patient melanoma phase 3 - retatrutide hit ~28% weight loss in a phase 3 - an ai-designed drug entered phase 3 - a pill that regrows hair passed its second phase 3 - an immunotherapy that could let some rectal cancer patients skip surgery, chemo and radiation just got fda approved - a man lived 271 days off dialysis on a pig kidney - human cells were caught passing chromosome-sized chunks of DNA to their neighbors, and it changes how the neighbors behave we are on the verge of an era where the human body is a software problem and the update cycle gets shorter everyday stick around, it's going to get weird bio/acc

I was listening to Peter Thiel’s interview with Walter Isaacson last night. Isaacson asks something like, “What do you think will matter most post SI” Thiel takes his characteristic 30 second pause, thinks about it, and responds, “Human Relationships”.

As someone who builds what I think is considered a “defensive swarm” product, a big part of my bet is that Nikesh (Palo Alto Networks CEO) is wrong. The token economics are increasingly in our favor. You really can throw tokens at logs.

The dirty secret of SAAS is that subscription pricing allows you to keep charging customers who aren't really using the product. The downside of this is that when your subscriptions finally churn, it's a *lagging indicator* of your business failing. I strongly suspect that there are many, many "dead men walking" now in SAAS, both AI-native and traditional: businesses where the financials may still look fine -- just a quarter or two of stagnant growth, margins are still great, maybe there's an AI narrative going forward, etc. but the *product* is losing utilization and they will lose every single customer to {{AI-native competitor, possibly the big labs themselves}} as the customers encounter those solutions. Those customers become dormant users, but the subscriptions still run for the while. The actual revenue churn only occurs months or quarters later when the question of "is anyone still using this? do we need to keep paying for this?" is finally answered with a "no" rather than an "i'm not sure".

seems obvious to everyone around me that sandboxes are on their way out. we hear too many stories about reliability, capacity, broken sandboxes that need manual intervention -- plus they are way too expensive for what they provide. the future for agents? workspaces. your agent doesn't need a computer. it needs a place to store it's context, and the *tools* to manipulate that context each turn. we're in the very early stages of the AI era. the simplest version of this pattern is just handing each agent a time-multiplexed VM, since that's the only thing that we have at hand right now. over the next 12 months, you're going to see a rapid shift away from this model and towards what i call the "magic compute box". rather than giving an agent a VM, you give it a set of tools (could be "bash", "python", "js", "read_file", "write_file") -- and you send those commands to a magic service in the cloud that manages to run them for you -- using the cheapest technology available (just-bash, wasm, or even Linux if really required) for each command invcation. your agent doesn't want a computer that it can set a desktop background for, it wants a place where it can fire off an unlimited number of tool calls and have it update the context correctly.