The Investor

The Institutional Failure

GitHub dismissed vulnerability reports from the researcher Deep Specter. The dismissed reports describe, with uncomfortable precision, the attack surface that Shai-Hulud — an active supply-chain worm, hundreds of packages and developer accounts compromised — is now working through. That is not a public-relations problem. The dominant code-hosting platform on the planet declined to acknowledge the weakness a named attacker is now exploiting at scale. Names change the conversation, and this one has one.

Every CISO who pushed a Socket, Snyk, Chainguard, or Mendral purchase to next quarter just lost the argument for doing so. There is a worm with a name, and names change conversations.

Why This Is Different From Prior AI Security Signals

Earlier this week the file covered the Miasma worm hitting 73 Microsoft GitHub repos and an unnamed startup's AI agent surfacing 21 FFmpeg zero-days. Those were capability signals, or rather, proofs that the attack surface exists. Shai-Hulud is an exploitation signal: proof the surface is being worked while the platform owner looks past the reports describing it. The dismissed-reports-to-active-exploitation chain hands procurement at regulated buyers the line they have wanted for years, which is require a second source on developer infrastructure.

The Trade

The supply-chain security category — Socket, Snyk, Chainguard, Endor Labs, and Mendral-style PR-time dependency reviewers — should re-rate 3-5 turns of ARR within 4-6 weeks as the incident lands in board decks. The counter-thesis is the familiar one: CISOs say they will buy after a breach and then do not, and that pattern has been right more often than wrong. This is probably wrong, but named worms with an institutional-negligence backstory have historically broken that pattern. SolarWinds did. Log4j did.

Cross-Source Convergence

Both sources this week point at AI-native security as an investable category forming in public. One frames it through the supply-chain lens (Shai-Hulud); the other through code-gen as dual-use offensive cyber, with AI writing exploits rather than only finding them. They land on the same budget line, which is the FY27 CISO allocation for AI-era security tooling. The Series A entry window is open now, before enterprise budgets settle on the category and price it accordingly.

Portfolio Exposure Check

Two questions worth answering today. First, which portcos shipped Shai-Hulud-affected packages, because disclosure clocks may already be counting. Second, which portcos run GitHub as their sole VCS/CI surface with no supply-chain security overlay. Those portcos are on a one-week clock, not a quarterly one.

Epic's 'lore' Changes the Assumption, Not the Market

Epic Games shipped lore this week, an MIT-licensed next-generation version control system aimed at large-binary, monorepo-heavy workloads. It will not kill Git, and that is not really the point. The point, or rather the more interesting version of the point, is that for the first time in several years the protocol layer underneath GitHub looks contestable. That changes how anyone should underwrite a business built on the assumption that Git is permanent infrastructure.

The MIT license is the tell. Epic wants adoption rather than control, which is the right posture for a challenger and a poor one for building a durable business on top of the thing itself. The optionality sits with the tooling above lore, not with lore.

The platform-neutral layer is where durable value accrues. Intel releasing agent skills supporting Claude Code, Copilot, Codex, and Gemini CLI is the same pattern at a different layer.

The Procurement Wedge

The more interesting version of this story is the procurement angle. Officers at regulated buyers have wanted an excuse to require a second source on developer infrastructure for years, and GitHub's Shai-Hulud trust failure handed them one. Whether lore is that second source or simply the existence proof that one could exist is a question about institutional inertia. Inertia usually wins. When it loses, it loses quickly.

The Counter-Thesis

There is a perfectly defensible scenario in which GitHub's trust crater closes inside two quarters, lore stays a curiosity used by the people who already disliked Microsoft, and DevSecOps spend keeps flowing to the same four vendors it has been flowing to. That version has been right most times it has been tested. This is probably wrong, but the honest answer is we will know inside two earnings cycles, not two weeks.

Portfolio Implication

Hedge GitHub and GitLab platform concentration by overweighting code review, CI, and AI coding agents that work across VCS systems. The agent fragmentation data points the same direction: six different AI coding and productivity agents cited by a single user, none tied exclusively to GitHub. The abstraction layer between the model and the repository is the defensible seat.

The Fragmentation Signal

One reasonably sophisticated user is now running six different AI agents for six narrow tasks — Jamie for notes, Wispr Flow for dictation, Prompt Cowboy for prompts, Manus as the generalist, Chat Hub as the multi-model router, and Claude Cowork for complex task delegation. The optimistic read is that this is a thriving ecosystem with room for everyone. The less optimistic read, and the one that matches every prior software cycle anyone reading this has lived through, is that pre-consolidation fragmentation looks exactly like this right before the platforms absorb it.

The tell, or rather the part of the tell that is hardest to argue with, is that Claude Cowork is already handling complex task delegation inside the same workflow as the five point solutions. Anthropic is already in the room. Every layer sitting above the model without proprietary data, distribution, or workflow lock-in is renting space from a landlord who has noticed.

Six tools, six jobs, zero defensibility narrative for any of them. Foundation labs will eat most of these in 12-18 months.

Where the Alpha Is — and Isn't

The stack breaks into four investable layers, and the risk profiles are not remotely the same.

The Consumer Delegation Signal

A related data point worth holding next to the first one. Jesse Genet's household is now running AI agents — Claire, Sylvie, and Clark — that own the groceries and the homeschool curriculum outright. That is consumer AI moving from copilot to delegate, which is a different product and a different willingness to pay. The family ops and personal CFO categories do not have names yet. That is usually when the seed checks get written.

The Discipline Play

This is probably wrong in one or two cases, but the working rule is straightforward. Do not chase thin agent wrappers because the category is hot. Do not chase Anthropic or OpenAI secondaries on narrative alone. Do take the IPO comps now forming around MANGOS-tier names and use them to renegotiate entry multiples on every AI deal in the pipe above $100M. The compression is the opportunity. The counter-thesis is that the comps re-rate up before the privates re-rate down, and we have been wrong on that timing before.