The Investor

What Changed This Week

AI infrastructure's capital needs just formally exceeded its cash generation capacity — and the market's response reveals a dangerous bifurcation. Amazon is raising up to $42-50 billion in bonds against $200B in projected 2026 capex (50% YoY increase). Salesforce announced $20-25B in bonds — not for AI investment, but for a $50 billion defensive stock buyback that prompted an immediate Moody's downgrade from A1 to A2. Oracle is spending $50B in capex this fiscal year against estimated $23B in annual cash burn — more in one year than it generated in the three prior years combined.

The combined tech bond issuance window: north of $120 billion in a single cycle. This is unprecedented.

The Financing Daisy Chain

The most underappreciated systemic risk sits in the circular financing dependency powering the AI buildout. Oracle borrows to build data centers. OpenAI is Oracle's marquee customer. OpenAI's ability to pay depends on its $110B fundraise — which doesn't arrive all at once. SoftBank, a lead investor in that round, is itself borrowing the money for its commitment. This is leveraged investing in a leveraged customer paying a leveraged supplier.

At every link, the assumption is that downstream AI revenue growth justifies upstream capital commitment. If that assumption breaks at any node, the cascade is severe.

When analysts asked Oracle for FY2027 capex guidance, management declined to answer — a conspicuous omission suggesting even they don't have visibility into whether the current spend rate is sustainable.

The Divergence in Purpose Is the Signal

Not all $120B is equal. Amazon and Oracle are investing in AI infrastructure — building data centers that could generate returns. Salesforce is financially engineering against disruption fear, using $20B+ in debt to retire ~25% of shares outstanding while its stock sits down 26% YTD. Markets correctly price these differently: Amazon's bonds were oversubscribed, while Salesforce's stock fell 2% on the buyback announcement.

Oracle's Emerging Customer-Funded Model

Oracle's February quarter deserves careful parsing beyond the headlines. Cloud server-rental revenue grew 84% YoY to $4.9B. RPO reached $553B (up $30B sequentially). FY2027 guidance rose to $90B (~34% implied growth). The stock popped 9% after-hours — from a deeply distressed base of -50% since September.

But Oracle stated explicitly that customers either pre-pay for GPUs or supply their own. At 32% gross margins, this looks more like managed colocation than cloud computing. The lower capex burden comes with lower control over customer relationships. This model could be a paradigm — or a fragility.

The Perplexity Ruling Changes Everything

A federal court blocked Perplexity's Comet AI browser from accessing Amazon, ruling that user authorization does not equal platform authorization under the Computer Fraud and Abuse Act. Amazon alleged Perplexity configured its agent to pose as human browser traffic despite five cease-and-desist requests. The court ordered Perplexity to delete all collected Amazon data and gave it until March 17 to appeal to the Ninth Circuit.

This is the first federal ruling on autonomous AI agents, and its implications cascade across every agentic AI deal in your pipeline. The open-web thesis — where user consent alone enables agent action — is legally challenged. The ruling transforms agentic AI from an open-access market into a partnership-gated market, fundamentally changing unit economics, GTM velocity, and TAM calculations.

Every agentic AI startup whose product requires accessing third-party platforms without explicit platform partnerships now carries CFAA liability.

MCP Authorization: Broken by Design

The legal wall is matched by a technical wall. Security researchers mapped four fundamental, unresolved flaws in the MCP (Model Context Protocol) OAuth 2.0 authorization framework that underpins enterprise agent deployments:

1. No token revocation — misbehaving agents can't have access pulled
2. LLM-driven scope escalation — models can expand permissions without user consent
3. Undefined credential issuance — enabling namespace collision attacks
4. Replay amplification — a single compromised token cascades across multiple access grants

No vendor currently delivers the full mitigation stack. This gap is the most urgent category-creation opportunity in AI security today, analogous to cloud security circa 2014: the infrastructure is shipping, the security layer hasn't been built.

Platforms Become the Gatekeepers

The Perplexity ruling massively advantages incumbent platforms that can both build their own agents and gatekeep third-party agent access. Amazon is simultaneously blocking agents and developing its own agent commerce tools. Google is deploying Gemini Agent Designer to the Pentagon. Meta acquired Moltbook. The structural winner is authorized API access — not scraping or spoofing.

The Cline CLI supply chain compromise adds urgency: an attacker used prompt injection on Cline's own AI triage bot to steal an npm publish token, pushing malicious code to ~4,000 machines in 8 hours. AI agent tooling is simultaneously legally constrained and technically vulnerable — creating a massive demand signal for authorized, secure agent infrastructure.

CXL Memory Disaggregation: From Dormant to Production

A 7-year-old dormant technology just hit its inflection point. Google is deploying CXL (Compute Express Link) controllers in production data centers, and Nvidia's upcoming Vera CPU will support CXL 3.1 later in 2026 — creating the largest real-world test of memory disaggregation. CXL allows servers to share memory across a data center rather than each server owning fixed-slot memory.

The catalyst: AI memory costs are soaring to the point where the latency tradeoff is now acceptable. Xcena's CEO: "There is no solution besides CXL that can improve memory efficiency right now."

Bernstein analyst Mark Li's critical insight: only Google and Nvidia own the full stack needed to make CXL work end-to-end. The startup opportunity concentrates in controllers, pooling software, and compatibility tooling — the interstitial layers where value creation doesn't require full-stack ownership. This mirrors where AI inference optimization was 18 months before it became a crowded category.

AI Data Center Networking: Two Unicorns in One Week

AI networking produced unicorn-scale outcomes at Series A/B simultaneously:

Both target AI/cloud data center networking hardware and software — the picks-and-shovels play one layer below Nvidia GPUs. HRT's presence in Eridu's cap table is notable — a quant trading firm that understands data center infrastructure needs firsthand. The key investment question: is AI networking winner-take-most (like networking historically), or does AI infrastructure's scale support multiple standards? The answer determines whether one of these is worth $20B+ and the other is an also-ran.

AI Security: $300M+ in a Single Week

Four AI security companies raised a combined $300M+ simultaneously: Armadin ($190M seed, Kevin Mandia/Mandiant founder), Jazz ($61M seed, DLP), Qevlar AI ($30M, SOC automation), and Escape ($18M). In-Q-Tel's investment in Armadin is the strongest demand signal — the US intelligence community is backstopping AI red teaming as a procurement priority.

This validates AI security as a standalone category, not a feature. The round sizes at early stages imply valuations north of $1B for Armadin, repricing every AI security comp in the market. The gap between offensive tools (Armadin red teaming) and defensive platforms (Jazz DLP, Qevlar SOC automation) may define distinct sub-categories.

Three infrastructure categories formed simultaneously — CXL memory, AI networking, and AI security — each with its own unicorn-minting dynamics and each at a different entry-point stage for investors.