The Investor

A New Liability Category Is Born

Florida's attorney general launched what appears to be the first-ever criminal investigation into an AI company. Court documents show a mass shooter at Florida State University exchanged more than 200 messages with ChatGPT about firearms, ammunition, campus logistics, and strategies for maximizing media attention. AG Uthmeier's subpoenas demand OpenAI's internal policies dating back to March 2024 — suggesting prosecutors are building a pattern-of-negligence case, not reacting to a single incident. OpenAI has until May 1, 2026 to respond.

Criminal liability for AI companies just crossed from theoretical to active investigation — and the standard of care will be measured retroactively against internal documentation that already exists.

The Pre-IPO Metrics Reveal

The same week, OpenAI disclosed a full metrics suite that reads unmistakably like an S-1 preview: 900M+ weekly active users (larger than Instagram at IPO), 50M+ subscribers (~$12B implied consumer ARR at $20/mo blended), 9M paying business users, and 4M active Codex users. Greg Brockman's framing of a "super app" merging ChatGPT, Codex, and an AI browser is the Microsoft Office bundling playbook for AI.

Multiple sources independently confirm OpenAI triggered an internal 'code red' after Anthropic's Mythos launch, pivoting aggressively away from consumer projects (Sora deprioritized) toward enterprise. The release cadence — GPT-5.4 to GPT-5.5 in under two months — signals a company racing to establish platform lock-in before the IPO window.

Cross-Source Tension: Growth vs. Risk

The contradiction is stark. OpenAI's metrics justify a $300-500B IPO valuation. The criminal probe could compress that multiple by 20-40% or delay the offering entirely. Multiple sources agree that criminal exposure transforms AI safety from a cost center to an existential requirement — but none have yet quantified the insurance, compliance, and legal cost implications.

For the broader AI sector, this creates a bifurcation: companies that invested in safety infrastructure before being forced to, and companies that didn't. The market hasn't repriced this difference yet. The GSA's proposed procurement clause — which would actually prohibit vendors from maintaining safety restrictions on government AI systems — adds a direct collision between revenue and responsible deployment that makes the compliance calculus even harder.

Portfolio Implications

Every consumer-facing AI company in your portfolio now needs a documented content moderation policy, law enforcement cooperation protocol, and threat detection system. The Florida subpoenas target exactly these policies retroactively — establishing that the duty of care will be judged against what companies knew and did, not what they promised. AI safety/compliance infrastructure startups — the "Palo Alto Networks of generative AI" — just saw their demand thesis validated by the most powerful possible catalyst: a state AG with criminal subpoena power.

The Adoption Curve Nobody Modeled

Google disclosed that 75% of its new code is now AI-generated, up from 25% just 18 months ago — with mandatory quarterly adoption targets for engineering teams. Snap is at ~65%. Meta targets 75%+. Microsoft, despite owning GitHub Copilot, lags at 20-30%. The gap between Google (internal Gemini integration) and Microsoft (external tool distribution) suggests that vertically integrated AI coding strategies are 3x more effective than standalone tool adoption.

The implication: the next wave of value creation isn't in more coding assistants — it's in the infrastructure that makes AI-generated code trustworthy at scale.

When 75% of code is machine-generated and the trajectory points to 95%, the bottleneck isn't generation — it's validation. That's where the next billion-dollar category lives.

The Security Crisis Is Already Here

A rigorous study of 4,783 AI-generated applications surfaced 727 critical vulnerabilities with real production data leaks. The numbers are damning: 7% of Lovable and Bolt apps publicly exposed databases versus 0% from a Y Combinator human-coded control group. Root causes include Supabase RLS left disabled, client-exposed API keys, IDOR bugs, and AI code referencing nonexistent security checks. Real therapy billing records, patient data, and college enrollment records leaked in production.

This isn't a bug to be patched — it's a structural property of how current AI code generation works. A separate signal from a 100K-LOC open-source project (6,000+ GitHub stars in under a week, zero human-written code) confirms the pattern: production-viable AI code requires a three-gate quality model — high test coverage, code health scoring (CodeScene), and architectural review — enforced in both agent configs and CI pipelines, because AI agents still forget or ignore instructions even when explicitly told.

The Category Map

Three agentic security tools launched simultaneously this week — RedAI, Copperhelm, and Trailmark — signaling a category shift from scanning to autonomous validation and remediation. The defensible positions will be in proprietary agent orchestration layers and unique data feedback loops, not thin wrappers around LLM APIs.

Revolut Sets the Neobank Valuation Ceiling

Revolut is targeting a $150-200B IPO valuation on $6B revenue and $1.7B net profit — implying 25-33x revenue and 88-118x P/E. Whether this prices or gets haircut to $100B, it becomes the definitive comp for global neobanks for years. The critical question: can public markets stomach these multiples?

The linchpin is PRAGMA, Revolut's proprietary foundation model trained on 24 billion banking events. Performance numbers are genuinely striking: 130% improvement in credit scoring and 65% improvement in fraud recall versus traditional ML, while consolidating six separate production models into one. This isn't incremental — it's a structural cost advantage that compounds with every new customer. If the market buys the narrative that proprietary AI on massive transaction datasets creates durable operating leverage, the multiples are defensible. If growth decelerates or PRAGMA's edge proves replicable, a 40-50% haircut is on the table.

Adyen Declares the End of Pure-Play Payments

Adyen's €750M acquisition of Talon.One is a thesis statement, not just a deal. By embedding real-time promotions and pricing directly into its payments stack, Adyen is building "unified commerce" — the merger of transaction data with merchant decisioning. This moves Adyen from a processing utility to a commerce platform, fundamentally changing its take rate ceiling.

The implication is severe for the competitive landscape. Pure-play payments processors that don't own loyalty, promotions, or personalization now face a build-or-acquire imperative. Standalone loyalty/promotions platforms are in a binary position: acquisition targets at premium multiples in the short term, or orphaned point solutions in the medium term. This creates a 12-18 month exit window for portfolio companies in adjacent categories.

The Banking AI Moat Thesis

Revolut's PRAGMA proves a broader thesis: proprietary transaction data + custom foundation models = durable competitive moats. The investable layer is companies with 100M+ transaction records, in-house ML teams, and the data rights to train domain-specific models. The 4,000+ banks that can't build PRAGMA internally represent the vendor opportunity — startups offering pre-trained banking models with fine-tuning on institution-specific data.

Ramp's fee-free USDT integration confirms stablecoins have crossed from crypto novelty to corporate finance table stakes. The pricing war is already at zero — any fintech charging for FX or cross-border treasury conversion is on borrowed time.

The $126B Valuation Gap You Should Be Mapping

Applied Intuition — the $15B physical AI infrastructure company you've probably underweighted — broke its near-decade of stealth this week. The headline: it has secured 18 of the top 20 non-Chinese global automakers as customers while providing the OS, simulation, and autonomy stack across automotive, defense, trucking, mining, and agriculture. With Waymo valued at $126B as a single-vertical robotaxi operator, the horizontal platform provider at $15B implies either massive undervaluation or significant execution risk on the horizontal strategy.

CEO Qasar Younis (ex-COO of Y Combinator) and CTO Peter Ludwig (ex-Android at Google) have spent nearly 10 years building 30+ products with ~1,000 engineers (83% of workforce). They're running driverless L4 trucks in Japan and hiring aggressively with hundreds of open roles. The Android analogy is deliberate: fragmented physical machine software today mirrors the pre-Android phone market of ~50 different operating systems.

Physical AI's picks-and-shovels company is hiding in plain sight at $15B with 18/20 OEM penetration; the demo-to-production gap is the single most valuable diligence filter for every robotics and autonomy deal in your pipeline.

The Demo-to-Production Gap as Investment Filter

Peter Ludwig's claim — that after 10 years they can look at any robotics demo and predict the next 20 problems — is either arrogance or the most valuable pattern recognition in physical AI. The humanoid robotics bubble, with its overheating actuators and fundamental brittleness, is particularly exposed. China's humanoid marathon competition exists precisely because demos don't translate to reliability.

In the same vertical, Genki Robotics (co-founded by Android creator Andy Rubin) jumped from ~$50M seed to ~$1B Series A — a 20x markup in roughly one year. The category is entering the same institutional venture phase that foundation models occupied in 2022-2023. The question isn't whether it's real — it's whether current entry prices leave enough upside.

Adjacent Opportunities

Applied Intuition's dominance of the platform layer clarifies where remaining opportunities sit:

• Edge AI silicon — Applied Intuition explicitly does NOT do chips; they build across multiple architectures. The embedded inference layer remains open.
• Safety validation and certification — The shift from binary pass/fail to statistical reliability measurement creates a new category of testing tools. Applied Intuition is proactively educating regulators, positioning to shape standards.
• Domain-specific verticals — Defense (infrared-only sensing), maritime, and agricultural robotics each have constraints supporting specialized players atop the platform.

A critical aside: both founders emphasized that Cruise's collapse was driven by regulatory communication failures, not technology. Qasar Younis states there is "a version where Cruise still exists" with different regulatory handling. For any portfolio company in regulated autonomy: the quality of your government relations team is as important as your engineering team. This is existential risk management.