The Product Desk

The Framework That Should Rewrite Your Roadmap Priorities

Christian Catalini's March 2026 paper 'Some Simple Economics of AGI' — analyzed by a16z crypto's CTO Eddy Lazzarin — introduces a framework every PM needs to internalize: the automation-verification gap. Anything measurable is being automated rapidly and cheaply. But verifying AI output — checking correctness, judging quality, catching drift — remains expensive and stubbornly human. This gap is widening, not closing.

If your product roadmap prioritizes AI generation features, you're investing in the commodity layer. The defensible, high-margin layer is verification UX.

The implication is structural: confidence scores, diff views, escalation workflows, audit trails, and human-in-the-loop checkpoints are where margins live. Companies shipping only generation will compete on price against every LLM provider. Companies that nail the verification experience will own the AI-augmented workflow.

Grammarly Just Proved What Happens Without Verification

The Verge discovered that Grammarly's 'expert review' feature used real journalists' names and likenesses without consent — including The Verge's own Nilay Patel, David Pierce, Sean Hollister, and Tom Warren — attributed AI-generated advice to specific humans (including deceased scholars), and linked to spammy or unrelated sources. The AI advice attributed to one person was likely based on someone else's work entirely.

This isn't just a Grammarly problem — it's a design pattern failure. Any AI feature that creates an implied endorsement, citation, or attribution to real people without consent and verification infrastructure is one investigation away from the same crisis. The damage is asymmetric: years of trust destroyed by a single exposé. Catalini's framework explains exactly why: Grammarly automated content generation (cheap) but skipped content verification (expensive). They paid the difference in reputation.

Marketplace Moats Are Dissolving — But Failure Data Creates New Ones

Catalini explicitly warns that AI agents are 'very good at breaking down moats that have made two-sided marketplaces defensible' by cheaply bootstrapping both sides. Companies like Hyperliquid and Uniswap are achieving massive valuations with fewer than 20 employees. But there's a counter-signal: incumbents with proprietary 'databases of failure' — years of edge cases, fraud patterns, error data — become more defensible, not less.

The emerging category Catalini calls 'liability as software' validates this: as AI agents produce unverified output at scale, insurance and liability quantification become critical infrastructure. Every user override of your AI suggestion, every error report, every edge case is training data for verification — and it's the new moat. The same week, AI-generated content is approaching indistinguishability from human content, and 'human-made' is emerging as a premium scarcity label. Your data strategy should pivot from capturing volume to capturing quality signals, especially failure modes.

Three Paradigms, Zero Overlap

As of March 2026, the three major AI platforms have made fundamentally incompatible architectural bets on how memory works. This divergence — not model benchmarks — is now the primary decision axis for any PM evaluating LLM integrations.

ChatGPT's automatic cross-session profiling makes it sticky for individual power users — but it's an opt-out system building user dossiers, which is a compliance concern for enterprise and GDPR-regulated deployments. Gemini's 1M-token context is unmatched for document-heavy single sessions but offers zero persistence — users get incredible depth per session with no continuity. Claude's Projects feature uniquely offers scoped, isolated memory containers without cross-contamination, the strongest play for regulated verticals.

The Custom GPT Memory Bug Is a Showstopper

A confirmed memory isolation bug means Custom GPTs don't reliably inherit main ChatGPT memory across sessions. If you've built internal tools or customer-facing agents on Custom GPTs that depend on persistent context, this undermines the core value proposition. Test across 20+ sessions before shipping anything that depends on this behavior.

The Market Gap Is Clear

Nobody offers massive context + persistent memory + privacy-first design in a single platform. That's either your next feature or your next competitive threat.

Users are already multi-homing across platforms based on task type — legal analysis on Gemini for context depth, ongoing projects on ChatGPT for continuity, sensitive work on Claude for isolation. For PMs building AI features, this means designing a provider-agnostic abstraction layer is no longer optional. The fragmentation will accelerate, and your product needs to route different task types to the optimal memory paradigm without exposing users to the complexity. The PM who previously asked 'which model is best?' now needs to ask: does this feature need depth, persistence, or isolation?

Bing AI Served Malware for 8 Days — AI Search Poisoning Is No Longer Theoretical

Between February 2-10, 2026, Bing AI promoted malicious GitHub repositories as its top result for 'OpenClaw Windows,' distributing GhostSocks proxy malware and infostealers. Huntress discovered the attack; GitHub removed the repos within 8 hours of notification, but the 8-day exposure window was significant. The repos contained legitimate code copied from the moltworker Cloudflare project with malicious payloads hidden in release archives — meaning naive content scanning wouldn't catch it.

If your product has any 'AI finds it for you' feature — search, recommendations, code suggestions, plugin discovery — your AI recommendation engine is now a documented attack surface.

This is the first high-profile case of an AI search system being trivially poisoned to distribute malware at scale through a major provider. For PMs building any feature that surfaces third-party content via AI, adversarial search poisoning must be in your acceptance criteria before your next major release. This converges with the broader security trend: OpenAI launched Codex Security as a research preview (free for one month for Enterprise/Business/Edu tiers, permanently free for open-source), and Claude Opus 4.6 found 22 Firefox vulnerabilities in two weeks — 14 high-severity, representing ~20% of Mozilla's high-severity 2025 fixes.

Chrome 153 Goes Biweekly September 8 — Your QA Cadence Must Double

Google announced Chrome 153 ships September 8, 2026 on a 14-day stable release cadence, halving the current 4-week cycle. Extended Stable stays at 8 weeks. For PMs shipping web apps, browser extensions, or Chrome API-dependent products, this creates two problems: doubled regression testing frequency and a version matrix split where enterprise users (Extended Stable) run different Chrome versions than consumer users. Retooling CI/CD pipelines takes more than one sprint — start planning now. Google's rationale: faster patching works. Browser zero-days dropped below 10% of the total in 2025.

The Zero-Day Composition Shift Gives You Budget Ammunition

GTIG's March 2026 report tracked 90 zero-days exploited in 2025 (up from 78 in 2024). The critical shift: 48% targeted enterprise technology — a new record — while browsers dropped below 10%. Microsoft led all vendors with 25 zero-days, followed by Google (11) and Apple (8). Of attributable zero-days, 39% came from commercial surveillance vendors and 28% from state-sponsored espionage. If you're justifying security feature investment to leadership, these are the authoritative numbers that move budget conversations. Enterprise software is now the primary target, not consumer endpoints.