The ghost in the resume

A staffing professional recently shared a story that should unsettle anyone who has ever used a design template for their resume. She was reviewing applicants for a healthcare position when she noticed something odd. The candidate’s resume, built in Canva, looked perfectly professional on screen: clean layout, proper headings, healthcare experience listed in detail. But when the staffing agency’s hiring software tried to read the document, it pulled in something else entirely.

Instead of “registered nurse in Portland,” the system read “circus assistant in Los Angeles.” I mean, come on.

The candidate had been applying for jobs for eighteen months. Eighteen months of silence, zero callbacks, growing despair. The explanation had nothing to do with her qualifications, her cover letter, or the job market.

It was ghost text.

Ghost text is placeholder data left behind inside Canva templates. When a template designer builds a resume layout, they fill it with fake information: a sample name, a sample job title, a sample location. When you replace that text with your own, Canva’s visual editor shows your changes perfectly.

You see your name. You see your job history. Everything looks right. But in the file’s metadata and hidden text layers, the original placeholder content sometimes persists. The software that employers use to sort applications reads those hidden layers. Your resume says one thing to your eyes and something completely different to the machine.

The problem here isn’t about aesthetic preferences or whether “creative” resumes are better than plain ones. A qualified healthcare professional was invisible to employers for a year and a half because of a technical failure in the tool she trusted.

She absolutely had no way of knowing.

A medical education professor found the same thing in a classroom. Students were submitting papers built from Canva templates, and when those papers ran through plagiarism and AI detection software, the tools flagged lorem ipsum and placeholder text that didn’t appear anywhere in the visible document. The ghost text wasn’t just a resume problem.

It was baked into how Canva’s template system handled text layers.

The staffing professional’s story ended with a simple experiment. She helped the candidate rebuild her resume in Microsoft Word, using a plain single-column format. Within two weeks and eight applications, the candidate had a job offer.

A qualified healthcare professional was invisible to employers for eighteen months because of a technical failure in a free design tool. She had no way of knowing.

That difference between “two weeks” and “eighteen months” is the distance between understanding how hiring software works and not understanding it.

And most job seekers, through no fault of their own, are on the wrong side of that gap.

What an ATS does with your resume

An Applicant Tracking System, or ATS, sits between you and almost every job you apply for. If you’ve applied online, your resume has almost certainly been processed by one.

An ATS is a database. When a company posts a job opening, every application that comes in through their careers page or job board gets funnelled into this system. The ATS stores your resume, your contact details, your cover letter, and any answers you provided on the application form. It organises all of this so recruiters can search, filter, and sort through what might be hundreds or thousands of applicants for a single role.

According to industry data, 98% of Fortune 500 companies use an ATS. About 70% of large companies and roughly 20% of small-to-medium businesses use one too. The market leaders include iCIMS (one of the largest providers by market share), Workday, Greenhouse, Lever, and Oracle’s Taleo.

If you’re applying to any company with more than about fifty employees, there’s a good chance an ATS is involved.

How parsing works

When your resume arrives, the ATS needs to convert it from a document (a PDF, a Word file, whatever you uploaded) into structured data it can store and search. This process is called parsing, and it happens in three stages.

Text extraction comes first. The system pulls all the readable text out of your document. This is where format problems start: if your text is stored as an image, or as vector shapes rather than actual characters, the parser can’t extract anything. It’s like trying to copy text from a photograph.

Tokenisation and segmentation comes second. The parser breaks your text into meaningful chunks and tries to figure out which parts are your name, which are job titles, which are skills, and which are work history. It looks for patterns: dates near company names probably indicate employment history; a cluster of technical terms probably indicates a skills section.

Entity recognition is the final stage. Modern ATS platforms use natural language processing, including BERT-based transformer models (the same underlying technology that powers tools like ChatGPT, adapted for a much narrower task), to identify and categorise the entities in your resume. “Python” gets tagged as a programming skill. “University of Auckland” gets tagged as an educational institution. “2019-2023” gets tagged as a date range.

The organiser, not the gatekeeper

Most career advice gets this wrong. An ATS is an organising tool. It’s not an autonomous gatekeeper that deletes your resume before anyone sees it.

Think of it like a library catalogue. The catalogue helps the librarian find books about a specific topic, published in a specific year, by a specific author. The catalogue doesn’t throw books away. It doesn’t decide which books are good. It organises, it sorts, and it surfaces results based on what the librarian asks for. The librarian (in this case, the recruiter) makes the decisions.

When a recruiter opens their ATS, they typically search for candidates matching certain criteria: specific skills, a certain number of years of experience, maybe a particular location. The ATS returns results ranked by how well each candidate matches. Recruiters then review those results and decide who to contact.

Think of an ATS like a library catalogue. It helps the recruiter find what they’re looking for. It doesn’t throw books away.

The ATS ranks and sorts. A human makes the call. But if the ATS can’t read your resume properly, if it can’t extract your skills or identify your experience, you won’t show up in the recruiter’s search results. You won’t be actively rejected. You’ll be invisible. That’s worse.

The zombie statistic: where the 75% myth came from

You’ve almost certainly seen this claim: “75% of resumes are rejected by ATS before a human ever sees them.” It appears in career coaching advertisements, in resume service sales pages, in news articles, and across social media.

It sounds alarming. It feels true. And it has no factual basis whatsoever.

The origin is a 2012 sales pitch by a company called Preptel. Preptel sold resume optimisation services, and the 75% figure was part of their marketing copy. No published methodology, no disclosed sample size, no peer review. Preptel shut down in August 2013, less than a year after the statistic began circulating. The company disappeared. The number didn’t.

Following the citation chain

Career researcher Christine Assaf of HRTact.com traced the citation chain and found a pattern that should embarrass every outlet that repeated it. TopResume, a paid resume-writing service, cited Forbes. Forbes cited no one. CIO.com misattributed the figure to Bersin, the Deloitte-owned research firm. Bersin never published any such finding. The statistic had no source, but each new citation made it look more credible because it now appeared alongside recognisable brand names.

Good grief.

This is how misinformation about hiring becomes gospel. A company invents a number to sell a service. The company dies. The number keeps bouncing between outlets, picking up authority with each bounce, until it’s so embedded in the hiring conversation that questioning it feels contrarian.

Where the myth lives now

The 75% figure propagates through three main channels: 68% of citations appear on social media, where it’s shared as received wisdom; 20% come from career coaches and resume-writing services, who have a direct financial interest in making ATS sound as threatening as possible; and 12% come from media outlets that repeat it without verification.

What the evidence says

The most direct test of the 75% claim comes from an Enhancv study that tested resume templates across multiple ATS platforms and surveyed recruiters, finding that the vast majority confirmed their ATS doesn’t automatically reject applications. The system ranks, filters, and organises. It doesn’t delete.

Recruiter Jan Tegze has publicly estimated that 90-95% of applications are reviewed by a human at some point in the process. Amy Miller, a former recruiter at Amazon, Google, and Microsoft, has called the idea of ATS as a “mythical AI-infused tool” that auto-rejects candidates “crazy.”

“The notion of ATS as some mythical AI-infused tool that auto-rejects candidates is crazy.”
— Amy Miller, former recruiter at Amazon, Google, and Microsoft

So why do so many people apply for jobs and hear nothing back? The explanation is simpler than a robot conspiracy. The job market is brutally competitive.

Employers are drowning in applications. Your resume may well have been seen by a human, but that human had 256 other resumes to review the same day and yours didn’t make the shortlist.

The villain is volume, not robots. But “volume competition” doesn’t sell resume-writing services. “A robot is deleting your resume” does.

How Canva breaks your resume

Let’s go back to Canva.

Canva resumes fail in ATS systems because of how Canva constructs documents at the file level. The visual output looks professional. The underlying file structure is a minefield. Four distinct failure modes exist, and most Canva templates trigger at least two of them.

Text stored as vector paths

When you type “Sarah Johnson” into a Canva text box, Canva may render that text as a series of vector shapes rather than searchable character data. To a human eye, the PDF looks identical either way. To an ATS parser, vector paths are just shapes: tiny drawings of letters. The system can’t read them, can’t search them, can’t extract them. Your name, your job titles, your skills, your entire professional history might as well be an abstract painting.

Fragmented text layers

Even when Canva does store text as text, it often splits a single sentence across multiple separate objects in the file. “Managed a team of 12 engineers” might be stored as three disconnected fragments: “Managed a team,” “of 12,” and “engineers.” The ATS tries to read the document in order, but “order” in a multi-layered design file isn’t the same as “order” on a printed page. The parser might reassemble your sentence as “of 12 Managed a team engineers.”

Custom font encoding

Canva’s library of decorative fonts doesn’t always map to standard character encodings. When the ATS extracts text from a PDF that uses a non-standard font, the characters can come through garbled. Your “B.Sc. in Computer Science” might parse as a string of unrecognisable symbols.

Image-based PDF export

Some Canva export settings produce PDFs where the entire page is rendered as a flat image. There’s no text layer at all. To an ATS, this document is blank. It’s a picture of a resume, not a resume. You might as well have mailed them a photograph.

The numbers

Enhancv tested Canva templates against Google Docs templates (a study originally conducted in late 2023 and updated through 2026), measuring how accurately each format parsed through common ATS systems. Canva averaged an 80.07% parse accuracy rate. Google Docs averaged 95.77%. That fifteen-percentage-point gap represents a substantial chunk of your professional history that the ATS either misreads or ignores entirely.

The most striking finding: skills sections in Canva templates had a 0% parse rate. Zero. The section of your resume that recruiters use most often to filter candidates was completely invisible.

Honestly, that’s staggering.

Out of 50 popular Canva resume templates tested, 72% failed ATS parsing in ways that would materially affect a candidate’s visibility.

The ghost text problem, revisited

Beyond parsing failures, the ghost text problem appears across Canva templates broadly. The original placeholder content (fake names, fake job titles, fake locations from the template designer) can persist in hidden text layers even after you’ve replaced all the visible content. Some ATS systems read these hidden layers. When they do, your resume becomes a palimpsest: your real experience buried under someone else’s fictional career.

The copy-paste test

You can check this yourself right now. Open your Canva resume PDF. Select all the text (Ctrl+A or Cmd+A). Copy it. Paste it into a blank text document.

If what you see in the text document matches what you see in the PDF, your resume is probably parsing correctly. If you see garbled text, missing sections, reordered content, or placeholder data you didn’t write, your resume is broken and has been broken for every job you’ve applied to with it.

Open your Canva resume PDF. Select all. Copy. Paste into a blank document. If what you see doesn’t match what you wrote, your resume has been broken for every job you’ve applied to.

One person helped a friend run exactly this experiment. The friend had been using a Canva resume and getting zero callbacks. They rebuilt it in Word, submitted eight applications, and had a job within two weeks. Same qualifications. Same market. The only thing that changed was whether the ATS could read the file.

The AI resume arms race

By mid-2025, 70% of job seekers reported using AI in some part of their application process. Of those, 68% used AI specifically to write their resumes. ChatGPT, Claude, and Google’s NotebookLM became the default first step for a generation of applicants.

The appeal is obvious. Upload a job description to NotebookLM or paste it into ChatGPT, and within seconds you have a tailored resume with all the right keywords, polished bullet points, and professional-sounding language. You can generate cover letters, simulate interview questions, and produce application materials for dozens of roles in a single afternoon. The friction of applying has been reduced to nearly zero.

That friction was there for a reason.

The homogeneity trap

A hiring manager who’s reviewed applications for over a decade described a new phenomenon. In a single week, she received six applications for one position, and nearly every resume looked the same. Same templates. Same phrasing. Same “results-driven professional with a proven track record of delivering cross-functional solutions.” The resumes had been generated by the same handful of AI tools. It showed.

When everyone uses the same AI to write their applications, everyone sounds like the same person. A recruiter scanning a stack of AI-generated resumes is reading variations on a single voice. Individual qualifications blur together. Distinctive experiences vanish behind a wall of polished, interchangeable prose.

As Tomas Chamorro-Premuzic wrote in the Harvard Business Review in January 2026:

“AI has enabled the mass production of artificially polished candidates.”

If you’ve used ChatGPT to “improve” your resume, the improvement is real in isolation: your bullet points are crisper, your language is more professional, your formatting is cleaner. But when every applicant does the same thing, the improvement cancels itself out. You’ve joined an arms race where the weapons are identical and nobody gains an advantage.

The personalisation gap

An LHH study on AI-assisted job applications found that candidates who used AI to generate application materials without adding personal detail or genuine examples experienced a 40% lower interview-to-offer conversion rate compared to candidates who wrote their own applications or who used AI as an editing tool rather than a ghostwriter.

The distinction is real. Using AI to check your grammar, suggest stronger verbs, or identify gaps in your experience is editing. Using AI to write your resume from scratch, based on nothing but a job description, is outsourcing your professional identity to a statistical model that produces whatever sounds most “normal.”

Hiring managers can feel the difference. An AI-generated resume is technically flawless and emotionally empty. No voice, no texture, no evidence of a specific human being who did specific things. It reads like a press release about a person who doesn’t exist.

The NotebookLM question

NotebookLM, Google’s AI research tool, has become popular among job seekers for a slightly different reason. You can upload multiple job descriptions and have NotebookLM identify common requirements, suggest keywords, and even generate study materials for interview preparation. The tool is genuinely useful for research and preparation.

The problem arises when people use it to generate the application itself. NotebookLM’s output is sophisticated, well-structured, and unmistakably not you. A recruiter reading a NotebookLM-generated cover letter isn’t reading about your career; they’re reading NotebookLM’s statistical approximation of what a career like yours should sound like.

A recruiter reading an AI-generated cover letter is reading a statistical approximation of what a career like yours should sound like, not your career itself.

And recruiters are getting very good at spotting it.

The detection tools are here

The other half of the arms race is already underway. As applicants adopt AI to write their materials, employers are adopting AI to detect it.

Pangram Labs, an AI detection platform, claims 99.98% accuracy in identifying AI-generated text. It’s SOC 2 certified (meaning it meets recognised security standards for handling data) and is being marketed directly to recruiters and hiring teams. GPTZero, another detection service, offers batch processing specifically designed for application screening: upload a stack of cover letters and get a report flagging which ones were likely AI-generated.

The numbers on detection

77% of hiring professionals say they now encounter AI-generated application materials regularly. Most recruiters believe they can spot AI-generated text, but the data disagrees. A ResumeBuilder.com study found that 82% of hiring managers couldn’t reliably distinguish AI-generated cover letters from human-written ones. Another study put detection accuracy at just 52%, even when 67% of the recruiters surveyed claimed they could tell the difference.

That gap between confidence and accuracy is telling. Recruiters are making snap judgements about which applications “feel” AI-generated, but they’re wrong nearly half the time.

The consequence is real regardless. A ResumeBuilder.com survey found that a significant proportion of hiring managers say they’d deprioritise applications they suspect are AI-generated. Whether or not they’re right about which ones are AI doesn’t change the risk to you. Yikes.

A hiring manager with over a decade of experience put it bluntly: she can tell which resumes were AI-generated, and those go straight to the bottom of the pile. The data suggests she may be wrong about which ones are AI as often as she’s right. But her perception is what counts when you’re the applicant.

The institutional response

Major employers are adjusting their processes in response. Google, Cisco, and McKinsey have all expanded their use of in-person interviews and live assessments, partly as a response to the difficulty of evaluating candidates whose written materials may not reflect their genuine abilities. “Do you use AI tools?” is increasingly a core competency question in interviews. The test isn’t whether candidates use AI (most do). It’s whether they can articulate what they personally contributed versus what the tool generated.

Some people have pushed back by testing Canva resume PDFs through AI chatbots and noting that the chatbots parsed them fine. But an AI chatbot isn’t an ATS. Chatbots are designed to extract meaning from messy input; they’re trained to be forgiving. ATS systems are structured parsers with rigid expectations about document formatting. Testing your resume through ChatGPT tells you whether ChatGPT can read it. It tells you nothing about whether Workday or iCIMS can.

There’s also a privacy concern worth flagging. When you paste someone else’s resume into an AI tool to “test” it, you’re feeding that person’s name, address, phone number, work history, and educational background into a third-party system. Some of these tools use submitted data for model training. Running a friend’s personal information through an AI tool without their knowledge raises questions that go well beyond resume formatting.

257 applicants per opening

The tools are part of the problem, but they operate inside a job market that has become measurably harder in ways that rarely make it into career advice columns.

Application volume surged roughly ninefold between 2022 and 2025, according to Joveo, a recruitment advertising platform. In 2024, there were 207.2 applications per job opening on average. By 2025, that number had risen to 257.6 applications per opening.

For every job posting you apply to, roughly 257 other people are applying at the same time. A meaningful portion of those competitors are using AI to apply faster and to more roles simultaneously, which feeds right back into the volume problem.

The supply side

The American economy added only 181,000 jobs in 2025, a figure that was revised down from an initially reported 584,000. That revision alone should give you a sense of how uncertain the employment data is. As of November 2025, there were 1.1 unemployed workers for every job opening, meaning that even if every open position were filled instantly, there would still be more job seekers than jobs.

Ghost jobs

Roughly 30% of job openings don’t result in a hire. Some estimates suggest as many as 43% of posted positions may be ghost jobs: listings that were posted with no intention of filling them, or that were filled internally before the posting went live, or that exist solely to collect resumes for a future pipeline.

Ghost jobs exist for several reasons. Companies sometimes keep listings active to project growth to investors or the public. Sometimes the listing stays up because nobody remembered to take it down. Sometimes hiring managers post a role to “test the market” with no budget approved to fill it. Maddening.

If you’ve applied to a hundred jobs and heard back from three, some of those ninety-seven were never real.

Experience inflation

The requirements listed on job postings have crept upward, particularly in technology roles. The percentage of tech positions requiring five or more years of experience rose from 37% to 42% between 2023 and 2025. Entry-level positions increasingly demand mid-level experience, and mid-level positions increasingly demand senior-level credentials.

The “hidden job market” myth

You may have heard that “80% of jobs are never posted” and exist in a hidden job market accessible only through networking. The evidence for this claim is thin. Research suggests that only 6-10% of jobs are genuinely hidden, meaning they’re filled through referrals or direct outreach without ever being publicly posted. Job boards remain the dominant channel, filling about 47% of positions.

The hidden job market is real in the sense that networking provides a meaningful advantage (more on that shortly). But the idea that most jobs exist in some secret market accessible only by knowing the right people is exaggerated, and it’s often invoked to sell networking courses and career coaching.

The boring strategies that produce results

The strategies that work best in the current job market are, without exception, unglamorous. None of them are exciting. None of them make good social media content. They work.

The two-resume strategy

Multiple job seekers have independently arrived at the same approach: maintain two versions of your resume.

Version one is the ATS-safe resume. This is the one you submit through online application portals. It’s a single-column layout in a standard font (Arial, Calibri, Garamond, Times New Roman). It uses standard section headings: “Work Experience,” “Education,” “Skills.” It’s saved as a .docx file or a clean PDF exported from a word processor, not from a design tool. It’s visually plain and functionally reliable. This is the resume that machines read.

Version two is the portfolio resume. This is the one you bring to interviews, send directly to contacts, or link from your LinkedIn profile. This version can use creative layouts, custom fonts, colour, and visual hierarchy. This is the resume that humans look at.

An art director and graphic designer shared a story that illustrates the logic perfectly. Despite having a visually impressive portfolio-style resume, they stripped all the design out of their ATS submission version: no columns, no graphics, no colour, no custom fonts. Just plain text in a standard format. It worked.

The copy-paste test (step by step)

Before submitting your resume anywhere, do this:

1. Open your resume file (PDF or .docx)

2. Press Ctrl+A (or Cmd+A on Mac) to select all text

3. Press Ctrl+C (or Cmd+C) to copy

4. Open a blank text document (Notepad, TextEdit, whatever)

5. Press Ctrl+V (or Cmd+V) to paste

6. Read what appears

If the pasted text matches your resume’s content, in roughly the right order and with no garbled characters, your resume is likely parsing correctly. If you see missing sections, reordered text, garbled characters, or placeholder content you didn’t write, your resume is broken.

Do this test every time you update your resume or export it from a new tool.

Keyword mirroring

ATS systems match your resume against the job description. The closer your language mirrors the job posting’s terminology, the higher you rank in the recruiter’s search results. Candidates whose resumes achieve an 85% or higher keyword match with the job description receive 5.7 times more recruiter views than those with lower match rates.

This isn’t keyword stuffing. Keyword stuffing means cramming irrelevant terms into your resume to game the system, and it doesn’t work: modern ATS systems use contextual analysis and can spot terms that appear without supporting context. Keyword mirroring means using the same language the employer uses to describe the skills and experience you genuinely have.

If the job description says “project management,” your resume should say “project management,” not “programme oversight.” If it says “data analysis,” use “data analysis,” not “quantitative research.” Same skills, same terminology.

Metrics in every bullet point

73% of hiring managers identify quantified achievements as the number-one differentiator between resumes that get interviews and resumes that don’t.

The difference between a weak and a strong bullet point is almost always a number:

Weak: “Managed social media accounts and grew the audience.”

Strong: “Grew Instagram following from 4,200 to 31,000 in 14 months, generating an average of 340 link clicks per post.”

The second version gives a recruiter something concrete to evaluate. The first version could describe anyone.

If you don’t have exact numbers, estimate responsibly. “Reduced customer complaint resolution time by approximately 30%” is still better than “improved customer service processes.” Recruiters understand that not every metric is precise; they care that you think in terms of impact.

AI as editor, not author

The LHH data on interview-to-offer conversion rates makes the case clearly: use AI to improve your writing, not to replace it. The most effective approach is to write your resume yourself, drawing on your own experience and your own language, and then use AI to refine what you’ve written.

Ask ChatGPT or Claude to check your bullet points for clarity. Ask it to suggest stronger action verbs. Ask it to identify skills from the job description that you’ve forgotten to include. Use it as a proofreading tool, a thesaurus, a structure checker.

Don’t ask it to write your resume for you. The moment you do, your application joins the pile of identical, AI-generated documents that recruiters have learned to recognise and deprioritise.

Use AI to improve your writing, not to replace it. The moment AI writes your resume for you, your application joins a pile of identical documents that recruiters have learned to recognise.

Apply early

52% of recruiters review applications in the order they arrive. Apply within 48 to 72 hours of a job being posted. The earliest applicants receive disproportionate attention, partly because recruiters begin forming their shortlist immediately and partly because later applicants are competing against candidates who have already been flagged as strong matches.

Set up job alerts. Check listings daily. When you see a role that matches your profile, apply that day.

The networking advantage, measured

Referrals account for roughly 7% of all job applications but lead to 40% of hires. A referred candidate has a hiring rate of approximately 20%, compared to 1.2% for a cold application. You are 4.38 times more likely to get an interview if you’re connected to someone at the company.

Networking isn’t a nice-to-have supplement to your job search. It is, by a wide margin, the most effective strategy available.

The response rate gap

Cold applications (submitted through job boards with no internal connection) have a 2-5% response rate. For every twenty to fifty applications you send, expect one response. Not one interview. One response, which might be a rejection.

A referral short-circuits the entire process. The recruiter already has a signal that you’re worth talking to, because someone they trust has vouched for you. Your resume gets read more carefully, your application moves faster, and you enter the process with a degree of credibility that no amount of resume optimisation can replicate.

The 80/20 approach

Career advisers often recommend spending 80% of your job search effort on networking and 20% on online applications. Given the data, that ratio makes sense. Twenty cold applications might yield one response. Four genuine networking conversations might yield an introduction, which might yield an interview, which has a dramatically higher conversion rate. Do the maths.

Networking that doesn’t feel awful

Most people hate networking because they imagine it as attending awkward events and collecting business cards from strangers. It doesn’t have to work that way.

Informational interviews are conversations, not pitches. Reach out to someone who works at a company or in a role you’re interested in. Ask them about their experience. Ask what the team is working on. Ask what skills they wish they’d developed earlier. People are remarkably willing to talk about their jobs when they’re not being sold to.

LinkedIn, used strategically. Don’t blast connection requests to strangers. Find people you share something with: same university, same previous employer, same professional group, same city. Send a personalised message that references the specific connection. Follow up with genuine engagement on their posts. The goal is to build a relationship, not to extract a referral.

Alumni networks are underused. Most universities maintain alumni directories, and most alumni are willing to help recent graduates or fellow alumni. Being able to say “I noticed you graduated from the same programme” is a natural conversation starter that doesn’t feel transactional.

Former colleagues and managers are the strongest referral sources. They’ve already worked with you. They know your capabilities. They can vouch for you with specificity that no cover letter can match. Stay in touch with people you’ve worked with, even if you’re not currently job searching.

Referrals account for 7% of applications but lead to 40% of hires. No amount of resume optimisation matches the signal of a trusted colleague saying “you should talk to this person.”

The feedback loop nobody wins

The individual problems (Canva’s broken PDFs, AI-generated resume homogeneity, the myth-fuelled anxiety about ATS) are symptoms of something larger. The job application process is experiencing a systems failure where every participant’s rational behaviour makes the collective outcome worse.

Job seekers use AI to apply faster and to more positions, which increases application volume, which overwhelms recruiters, who respond by relying more heavily on automated filtering, which incentivises applicants to optimise further for those filters, which makes applications more homogeneous, which makes it harder for anyone to stand out.

An arms race with no winners. What a mess.

The tools aren’t villains

Canva is a good product used in the wrong context. It was built for designing social media graphics, presentations, and marketing materials. It wasn’t built to produce machine-readable documents for enterprise HR software. Blaming Canva for resume parsing failures is like blaming a hammer for being a bad screwdriver. The tool does what it does; the problem is the mismatch between the tool and the task.

NotebookLM is a genuinely useful research tool. It can help you understand an industry, identify patterns across job descriptions, and prepare for interviews. The problem isn’t the tool but the temptation to let it replace your own voice and experience.

The comment that resonated most with job seekers was also the simplest: “Perhaps there should be more humans and less robots scanning resumes.” There’s a clean truth to that. But it ignores the economics. When a single job posting attracts 257 applications, no recruiter has time to read each one carefully. The ATS exists because the volume demands it.

Regulation is catching up

Governments are starting to respond. New York City’s Local Law 144 requires employers to conduct bias audits on automated employment decision tools before using them. California has proposed regulations governing AI use in hiring decisions. The EU’s AI Act classifies employment-related AI systems as “high-risk,” subjecting them to requirements around transparency, data quality, and human oversight.

These regulations are early and inconsistent. Different jurisdictions, different standards, significant gaps. But they signal a growing recognition that when machines make decisions about people’s livelihoods, even ranking-and-sorting decisions, there need to be rules about how those machines work and what recourse people have when they get it wrong.

The privacy question

Every AI tool in the hiring pipeline, on both sides, involves processing personal data. When you upload your resume to an AI optimiser, your work history and personal details enter that company’s systems. When an employer runs your cover letter through an AI detection tool, your writing is analysed by a third party. The data flows are opaque, consent is buried in terms of service, and the long-term implications of feeding millions of resumes into AI training datasets are unclear.

A reasonable question for any job seeker to ask before using an AI tool: where does my data go, who else sees it, and what happens to it after I close the tab?

The fundamentals haven’t changed

The most effective job search strategies in 2026 are the same ones that worked in 2006: write clearly about what you’ve done, use numbers to show your impact, format your documents so the systems can read them, apply early, and spend most of your energy building real relationships with real people.

The tools have changed. The principles haven’t.

The candidate who spent eighteen months as a ghost in the system got a job within two weeks of switching to a plain Word document. The art director who stripped all design from their ATS resume started getting callbacks. The hiring managers who prize authenticity keep putting AI-generated materials at the bottom of the stack.

Your resume doesn’t need to be beautiful.

It needs to be readable, specific, and yours.

1 ATS parsing accuracy can vary significantly between platforms. iCIMS, Workday, and Greenhouse each use different parsing engines, meaning a resume that parses well in one system may fail in another. Testing with the copy-paste method catches the most common failures across all systems.

2 The 72% failure rate for Canva templates was measured across the 50 most popular resume templates on Canva’s platform as of March 2026. Individual templates may perform better or worse depending on their specific design elements and export settings.

3 NotebookLM’s terms of service state that uploaded documents are used to provide the service and are not used for model training. However, terms of service change, and the distinction between “providing the service” and “training” is not always clear in practice.

The numbers are brutal (and getting worse)

The odds of a new page cracking Google’s top 10 within a year have dropped by more than two-thirds since 2017. If you’re buying your first domain in 2026, this dataset should shape every decision you make before you spend a cent.

Patrick Stox at Ahrefs ran the numbers using 1 million random URLs first seen by the Ahrefs crawler in September 2023, tracked for a full year. The headline finding: only 1.74% of newly published pages reached the top 10 within 12 months. In 2017, that figure was 5.7%.

The window hasn’t narrowed. It’s been bricked over.

The pages that do hold top positions are older than they used to be. The average page sitting at position #1 is now 5 years old, per the same Ahrefs study. In 2017, it was 2 years. Incumbents are entrenching. Newcomers are locked out for longer.

The long tail gets longer

Across all of Google’s top 10, 72.9% of ranking pages are more than 3 years old. Three years. Look, that’s the waiting period before most pages even have a shot at the first page. Sit with that number before buying a domain and assuming content alone will carry you.

There’s a nuance the headline stat doesn’t show. When Stox filtered for pages with non-empty English content (excluding parked pages, redirects, and junk), the success rate rose to 6.11%. Still grim, but meaningfully better. It tells you that a big chunk of the “failures” in the raw data are pages that were never serious contenders: domains registered and abandoned, placeholder sites, test pages.

Fast or never

Here’s the genuinely strange part. Among the tiny minority of pages that did break into the top 10 within a year, 40.82% got there within a single month of publication. Not six months. Not nine. One month.

Of the pages that reached the top 10 within a year, 40.82% did so within just one month of publication.

The distribution is bimodal. Pages either rank fast or they don’t rank at all within the study period. Almost no middle ground. And the pages that rank fast overwhelmingly sit on established domains with existing authority, backlink profiles, and crawl history. They aren’t new sites. They’re new pages on old sites.

That distinction is everything if you’re a first-time domain buyer. A brand-new domain with fresh content is fighting for a spot in the 1.74%. An aged domain with accumulated trust signals might give that same content a shot at the 40.82% fast lane. Might. There are no guarantees, and anyone selling you a guarantee is selling you something else entirely.

What Google says vs what Google does

Google’s official position on domain age as a ranking factor is unambiguous: it doesn’t count. Evidence from Google’s own patents and leaked internal code tells a different story.

John Mueller, Google’s Search Advocate, said it plainly on Twitter in June 2019: “No, domain age helps nothing.” Six words. No hedging, no qualification.

Except it wasn’t the end. In a Google Webmaster Hangout that same year, Mueller offered a more careful take. He acknowledged that older pages have “built up so much trust and links and all of the kind of other signals over the years” that they naturally rank well. The age itself might not be the signal, but age is a near-perfect proxy for the signals that do count.

This distinction sounds meaningful in theory but collapses in practice. Telling a first-time domain buyer “age doesn’t help, but everything that comes with age helps” is like saying “money doesn’t buy happiness, but it buys everything that makes you happy.” Technically true. Functionally useless.

The patent Google doesn’t talk about

In 2005, Google published patent application US20050071741A1, co-authored by Matt Cutts, who at the time led Google’s webspam team. The patent includes a section on domain registration data as a signal for search quality. The relevant passage is worth reading carefully:

“Valuable (legitimate) domains are often paid for several years in advance, while doorway (illegitimate) domains rarely are used for more than a year.”
— Google Patent US20050071741A1

The patent doesn’t say “we use domain age as a ranking factor.” It says domain registration length can be a signal for distinguishing legitimate sites from spam. The implication is hard to miss: Google’s own engineers, two decades ago, considered domain age and registration data relevant to search quality.

Reading between the lines

The gap between Google’s public statements and its technical infrastructure is a recurring pattern in SEO. Google has good reasons to downplay specific signals: confirm that domain age counts and the expired domain market inflates overnight, spammers buy up aged domains at scale, and search quality degrades. The incentive structure pushes Google toward denial regardless of what the algorithm does.

This doesn’t mean domain age is a confirmed ranking factor. It means Google’s denial alone isn’t sufficient evidence that it isn’t one. The Ahrefs data, the patent language, and the leaked API code (more on that shortly) all point in the same direction. Google’s public communications point in the opposite one.

For a first-time buyer, the practical takeaway: don’t ignore domain age because Google says it doesn’t count, and don’t overpay for an old domain because the SEO industry says it’s magic. The truth sits between those two poles.

The sandbox that officially doesn’t exist

For twenty years, SEOs have debated whether Google penalises new domains with an invisible waiting period. In May 2024, leaked internal code confirmed that Google uses a host-age attribute to suppress fresh sites. Google still denies the sandbox exists.

The concept is simple. Register a new domain, publish content, and watch it struggle to rank for weeks or months despite solid content and even some backlinks. Webmasters have reported this pattern since at least 2004, and it became so widely discussed that Google had to address it directly.

Mueller’s response, posted on Twitter in August 2019: “There is no sandbox.” Period.

Years earlier, at PubCon 2005, Matt Cutts had offered something slightly more equivocal. Roughly paraphrased: there wasn’t a sandbox per se, but the algorithm might affect some sites under some circumstances. The exact wording has been disputed for two decades across SEO forums, but the gist was consistent: Google acknowledged the observed effect while denying a specific mechanism called “the sandbox.”¹

Then the API leaked

In May 2024, a researcher named Erfan Azimi discovered what appeared to be internal Google Search API documentation. He shared it with Rand Fishkin at SparkToro and Mike King at iPullRank. King published a detailed analysis of the leaked documentation, and one attribute stood out: hostAge, described as being used “to sandbox fresh spam in serving time.”

The word “sandbox.” In Google’s own internal documentation. After twenty years of denial.

The leaked Google API documentation described a hostAge attribute used “to sandbox fresh spam in serving time.”

Google’s response was carefully worded. The company cautioned “against making inaccurate assumptions about Search based on out-of-context, outdated, or incomplete information.” They did not deny the documentation was authentic. They did not deny the hostAge attribute exists. They warned against over-interpretation.

What this means in practice

Well, look. The sandbox probably isn’t a binary on/off switch. It’s more likely a weighted signal (one of hundreds or thousands) that reduces the visibility of very new domains until they’ve demonstrated some baseline of legitimacy. A brand-new domain publishing payday loan content gets suppressed hard. A brand-new domain publishing original marine biology research might barely notice it.

For first-time buyers: the sandbox isn’t necessarily a death sentence, but it’s a headwind. New domains face friction that established domains don’t. How much friction depends on your niche, your content quality, and how quickly you build legitimate signals. An aged domain with an existing crawl history and backlink profile sidesteps this friction entirely.

But sidestepping isn’t the same as a guarantee. An aged domain with a spam history might carry worse signals than a fresh domain with none.

What aged domains carry (it isn’t magic)

An aged domain’s value comes from four measurable assets: backlinks, crawl history, topical authority, and trust signals. Age by itself is a calendar entry. What accumulates over that time is what search engines respond to.

The SEO industry treats domain age like a mystical property. “This domain is 15 years old” gets tossed around as if the number alone confers power. It doesn’t. A 15-year-old domain that sat parked with no content, no backlinks, and no visitors is functionally identical to one registered yesterday. The registrar might show a 2011 creation date, but Google’s crawler sees an empty shell.

What gives an aged domain genuine value is the equity it accumulated while it was active.

Backlinks: the currency of trust

Backlinks remain the strongest off-page ranking signal in Google’s algorithm. An aged domain that once hosted a popular blog, a respected business, or a well-linked resource page carries those inbound links with it. Buy that domain and put new content on it, and those links still point to the domain. Their authority transfers to your pages.

Quality varies enormously, though. A domain with 500 links from article directories and comment spam is worse than useless. A domain with 30 links from respected publications, educational institutions, and industry sites is a genuine asset.

Crawl history: the invisible advantage

Google’s crawler has a memory. Domains crawled regularly for years have established crawl patterns, and new content on those domains gets discovered and indexed faster than content on brand-new domains. This is one of the mechanisms behind the “sandbox” effect: new domains need to build a crawl relationship from scratch. Established domains have one already.

Topical authority: the relevance signal

A domain that spent a decade publishing content about home renovation carries topical authority in that niche. If you buy it and continue publishing home renovation content, you inherit that topical context. If you buy it and pivot to cryptocurrency trading, you inherit nothing useful and might confuse Google’s understanding of the site’s purpose.

Topical relevance is non-transferable across niches. A domain with authority in cooking doesn’t carry that authority into finance.

This is one of the most commonly overlooked factors in aged domain purchases. The domain’s history needs to align with your intended use, or the accumulated authority becomes noise rather than signal.

Trust signals: the accumulated reputation

Trust is a composite of the previous three factors plus additional signals: consistent uptime, absence of spam penalties, presence in web directories and citation databases, mentions across the web. An aged domain with a clean history has a trust profile that a new domain can’t replicate on day one. Full stop.

So don’t buy an aged domain because it’s old. Buy it because it carries specific, verifiable assets that would take you years to build from scratch. And verify those assets before you spend a thing.

DA, DR, and the alphabet soup of authority metrics

Moz’s Domain Authority and Ahrefs’ Domain Rating are the two most cited authority metrics in SEO. Neither is a Google metric. They measure different things, and confusing them with each other, or with Google’s internal scoring, will cost you money.

Spend ten minutes researching aged domains and you’ll see DA and DR scores thrown around like gospel. “DA 45 domain for $800.” “DR 62, strong backlink profile.” These numbers are useful, but only if you understand what they represent and what they don’t.

Moz’s Domain Authority (DA)

Moz’s Domain Authority runs on a scale of 0 to 100. It uses a machine-learning algorithm that evaluates dozens of factors, including the number of linking root domains, link quality, spam scores, and other signals that correlate with rankings. A DA of 1 is a brand-new domain with no links. A DA of 95+ is Wikipedia, Google, or Facebook.

DA is a predictive score. It estimates how likely a domain is to rank, based on Moz’s understanding of Google’s algorithm. Updated regularly, it correlates reasonably well with real rankings. But it’s a third-party approximation, not a direct measurement of anything Google uses internally.

Ahrefs’ Domain Rating (DR)

Ahrefs’ Domain Rating also runs 0 to 100, but it’s built differently. DR is based primarily on the number and quality of unique referring domains pointing to a site. It’s narrower than DA: where Moz tries to model multiple ranking factors, Ahrefs focuses almost entirely on backlink strength.

This makes DR more transparent (you can trace exactly why a domain has the DR it does) but also more gameable (buy a bunch of links from high-DR sites and your DR climbs, regardless of whether those links are relevant or valuable).

What neither metric tells you

Neither DA nor DR is a Google metric. Google has confirmed it doesn’t use any third-party authority score. Google has its own internal signals, which are not public, and which may or may not correlate with DA or DR at any given time.

Neither Moz DA nor Ahrefs DR is a Google metric. Both are third-party approximations that correlate with rankings but don’t cause them.

This distinction is worth internalising when evaluating aged domains. A domain with DA 55 and DR 60 isn’t “strong” in any absolute sense. It’s strong according to two companies’ best guesses about what Google values. Informed, useful guesses. But guesses.

Use DA and DR as screening tools, not as buying criteria. A domain with DA 10 and DR 8 probably isn’t carrying much useful authority. A domain with DA 55 and DR 60 probably is. But the numbers alone don’t tell you whether the backlinks are relevant, whether the domain has penalties, or whether the topical authority aligns with your plans. You need to look deeper. The checklist section later in this piece walks through exactly how.

The case studies (and their conflicts of interest)

Two widely cited case studies show impressive results from aged domain strategies. Both were published by companies that sell aged domains or link-building services. The results may be real. The incentives are impossible to ignore.

The aged domain industry runs on case studies. Every marketplace, every broker, every SEO consultant who specialises in expired domains has a success story. Some are legitimate. The problem is structural: the companies publishing them profit directly from convincing you to buy.

DomCop: $24K in, $105K out

The most-cited case study comes from DomCop, an expired domain marketplace. The setup: they purchased a domain for $24,000, invested $15,000 in content (roughly 500,000 words), and within four months reported a site valuation of $105,000 based on 75,000 monthly sessions and $3,000 per month in revenue.

Those numbers are striking. A $39,000 total investment yielding $105,000 in estimated value within four months would make aged domains one of the best investments in digital marketing.

But.

DomCop is an expired domain marketplace. Their business model depends on people believing expired domains are valuable. Publishing a case study showing a 2.7x return in four months is, from a business perspective, brilliant marketing. The study was conducted internally, with no independent verification of the traffic or revenue figures.

Authority Builders: the slow burn

Authority Builders published a case study with a different trajectory. They acquired an aged domain in the home improvement niche with over 100 referring domains, starting from roughly 10 visitors per day. It took approximately 12 months to reach page 1 for a keyword with 50,000 monthly searches.

This timeline is more believable. Twelve months to rank for a competitive keyword, even with an aged domain, aligns with the broader data. But Authority Builders sells link-building services. Their case study demonstrates that you need both an aged domain and ongoing link building (which they’ll happily sell you) to see results.

Both major aged domain case studies were published by companies with direct financial incentives to show positive results. Treat them as marketing supported by data, not as independent research.

How to read case studies with conflict-of-interest awareness

Honestly, the conflicts of interest don’t automatically invalidate the data. Companies with skin in the game often have the best data because they’re doing the most volume. The DomCop numbers could be accurate. The Authority Builders timeline probably is representative.

The issue is selectivity. You’re seeing the wins. You’re not seeing the domains bought for $5,000 that never ranked. You’re not seeing the aged domains that turned out to carry Google penalties. You’re not seeing the ones where the backlink profile was toxic and the new owner spent months cleaning it up.

When evaluating case studies from the aged domain industry, apply three filters:

1. Who published it? If the publisher sells domains or link-building services, discount the headline numbers and focus on the methodology.

2. Is the full dataset available? Studies that show one domain’s journey are anecdotes. Studies that show outcomes across hundreds of domains are data.

3. What’s the failure rate? Any case study that doesn’t mention failures is telling you a story, not presenting research.

The risks the aged domain industry leaves out of the pitch

Aged domains can carry hidden penalties, toxic backlinks, spam histories, and Google’s explicit 2024 policy against expired domain abuse. Buying the wrong aged domain is worse than starting fresh.

The pitch usually goes like this: buy a domain with existing authority, skip the sandbox, rank faster. What gets left out is the list of things that can go wrong. And in 2024 and 2025, Google made several of those things go wrong much more aggressively.

Google’s expired domain abuse policy

In March 2024, Google introduced an explicit “Expired Domain Abuse” spam policy as part of a core update and spam policy refresh. The definition is worth quoting directly:

Google defines expired domain abuse as “where an expired domain name is purchased and repurposed primarily to manipulate Search rankings by hosting content that provides little to no value to users.”

The key word is “primarily.” Google isn’t banning aged domain purchases. Their own clarification states that “it’s fine to use an old domain name for a new, original site that’s designed to serve people first.” The policy targets people who buy aged domains specifically to exploit the backlink profile with thin or auto-generated content.

Google followed up with further enforcement through a June 2024 spam update and an August 2025 spam update, both of which targeted expired domain abuse among other spam tactics.

Penalties you can’t see

A domain can look clean on the surface and carry a manual action from Google that you won’t discover until you’ve bought it, set up your site, and watched your content vanish from search results.

Manual actions are penalties applied by Google’s human reviewers, not algorithmic adjustments. They appear in Google Search Console, but you can only see them if you’re the verified owner. When you’re evaluating a domain before purchase, you don’t have that access.

Some signs of a penalised domain:

• The domain has existing pages but none appear in a site:domain.com Google search

• The Wayback Machine shows content that was obviously spammy (pharmaceutical keywords, gambling links, doorway pages)

• The backlink profile is dominated by links from irrelevant foreign-language sites, link farms, or private blog networks

• Traffic dropped catastrophically at a point that coincides with a known Google algorithm update

Toxic backlink profiles

A domain might have a DR of 45 and look healthy at first glance, but 80% of its backlinks could come from Chinese gambling sites, Russian link farms, or networks of hacked WordPress installations. These links aren’t just useless. They’re actively harmful. Google’s algorithms associate your domain with the link neighbourhood it keeps, and if that neighbourhood is spam, your domain gets treated as spam by association.

The niche mismatch trap

You find a DA 50 domain that used to be a cooking blog. You want to build an affiliate site about power tools. The domain’s authority is real, but it’s authority in the wrong topic. Google’s understanding of what that domain is “about” is built on years of content, links, and user behaviour patterns related to cooking. Pivoting to power tools doesn’t transfer that authority; it confuses it.

Buying an aged domain in the wrong niche is like hiring a celebrity chef to endorse your plumbing business. The credibility exists, but it doesn’t transfer.

Trademark and legal issues

Aged domains sometimes carry trademark complications. A domain that was previously a business might still have trademark protections. The previous owner’s branding could appear in cached versions, Wayback Machine snapshots, or brand mentions across the web. Using that domain for a different business in the same industry could trigger legal issues.

Right, none of this means aged domains are a bad bet. It means they’re a bet that requires due diligence. The next section covers exactly what that due diligence looks like.

How to evaluate an aged domain before you buy (the checklist)

Evaluating an aged domain means checking six things: Wayback Machine history, backlink quality, Google indexation status, spam scores, niche relevance, and registration history. Skip any one of these and you’re gambling.

If you’re considering buying an aged domain for the first time, work through every step below before you spend money. The whole process takes 30-60 minutes per domain and can save you thousands.

Step 1: check the Wayback Machine

Go to web.archive.org and enter the domain. You’re looking for three things:

1. What content was on the site? Scroll through snapshots from different years. Was it a legitimate business? A blog with real content? Or was it a pharma spam site, a gambling portal, or a doorway page?

2. How consistent was the content? A domain that was a gardening blog for 8 years is better than one that changed topics every 6 months. Frequent pivots suggest the domain was used for short-term spam campaigns.

3. When did it go offline? A domain that’s been offline for 6 months has a different risk profile than one that’s been offline for 5 years. Longer gaps mean more link decay and a weaker crawl relationship.

Step 2: audit the backlink profile

Use Ahrefs, Moz, or Semrush to pull the domain’s backlink profile. Free tiers and trials can get you basic data. You’re looking for:

• Referring domains: How many unique sites link to this domain? More is generally better, but quality trumps quantity.

• Link quality: Are the linking sites legitimate publications, businesses, and resources? Or are they link farms, PBN sites, and spam directories?

• Anchor text distribution: Natural backlink profiles have diverse anchor text (brand names, URLs, generic phrases like “click here”). If 60% of anchors are exact-match commercial keywords like “best payday loans,” that’s a spam signal.

• Link relevance: Do the linking sites relate to the domain’s niche? A gardening blog with links from gardening forums, plant nurseries, and home improvement sites has a relevant profile. One with links from casino review sites does not.

Step 3: check Google’s index

Run a site:domain.com search in Google. This tells you what Google currently knows about the domain.

• Pages indexed: If the domain has been offline and Google shows zero results, that’s expected. If the domain has content and Google shows zero results, that’s a red flag for a penalty.

• Cached content: If Google shows cached pages, look at what they contain. Spam content in Google’s cache means Google associates the domain with spam.

• Search Console access: If the seller can provide Google Search Console access or screenshots, check for manual actions. Most sellers won’t offer this, which is itself useful information.

Step 4: check spam scores

Moz offers a spam score metric that rates domains from 0% to 100% based on characteristics commonly associated with penalised sites. Anything above 30% warrants investigation. Anything above 60% is a domain you should walk away from unless you have a specific reason to believe the score is misleading.

Ahrefs doesn’t have an equivalent single score, but its “referring domains” breakdown lets you identify spammy link sources directly.

Step 5: verify niche relevance

The domain’s historical topic should align with your planned use. Check:

• Wayback Machine content (what was the site about?)

• Backlink anchor text (what terms is the domain associated with?)

• Referring domains (are the linking sites in your target niche?)

A mismatch isn’t automatically disqualifying, but it means you’re buying the backlinks and crawl history without the topical authority. You’ll need to rebuild the topical signals from scratch, which reduces the domain’s practical advantage.

Step 6: check registration history

Use a WHOIS lookup tool to check the domain’s registration history. Look for:

• Registration date: Confirms the actual age

• Registration changes: Frequent ownership changes can indicate the domain was flipped for spam purposes

• Registration length: Domains registered for multiple years signal legitimacy (this is from Google’s own patent, remember)

The domain expiry lifecycle is worth understanding. After a domain expires, it enters a grace period that varies by registrar (up to 45 days), then a redemption grace period (30 days per ICANN rules), then a pending delete period of roughly 5 days before it becomes available for public registration.

Where to buy: the marketplace guide

The aged domain market runs through a handful of major platforms, each with different strengths, pricing, and risk profiles. Dan.com, which was one of the most popular, shut down in June 2025.

If you’ve decided an aged domain is right for your project, you need to know where to shop. The market shifted in 2025 when GoDaddy consolidated its acquisitions, and the platforms available today each serve different types of buyers.

GoDaddy Auctions

The largest general-purpose domain auction platform. GoDaddy lists expiring domains from its own registrar alongside domains listed by third-party sellers. Prices range from under $10 for low-value expired domains to tens of thousands for premium names.

Best for: First-time buyers who want a simple interface and buyer protection. GoDaddy’s escrow service handles the transaction, and their auction platform is the most familiar to beginners.

Watch out for: Volume. GoDaddy lists thousands of expiring domains daily, and most of them are worthless. You’ll need external tools (Ahrefs, Moz) to evaluate quality before bidding.

Afternic

Also owned by GoDaddy. Afternic operates as a domain marketplace with fixed-price listings and a “make offer” model. After GoDaddy acquired Dan.com in 2022, it merged Dan.com’s operations into Afternic. Dan.com officially shut down on June 27, 2025, and all its listings migrated to Afternic.

Best for: Buy-it-now purchases when you’ve already identified a specific domain you want. Afternic’s integration with GoDaddy means easy transfers if both buyer and seller use GoDaddy as their registrar.

Watch out for: Pricing can be inflated. Sellers set their own prices, and there’s no auction pressure to drive prices down.

Sedo

The largest independent domain marketplace globally. Sedo operates auctions, fixed-price sales, and a domain parking service. It has a stronger international presence than GoDaddy’s platforms and lists domains across a wider range of registrars.

Best for: International buyers and sellers, or anyone looking for domains that aren’t in the GoDaddy ecosystem. Sedo also offers domain appraisal services, though these should be treated as rough guides rather than definitive valuations.

Watch out for: Transaction fees can be higher than GoDaddy’s platforms. The interface is functional but dated.

ExpiredDomains.net

Not a marketplace but a research tool. ExpiredDomains.net aggregates data on recently expired, dropped, and soon-to-expire domains across all major registrars. It provides basic metrics (age, backlinks, archive.org snapshots) and links to the registrar or auction where each domain can be purchased.

Best for: Research and discovery. This is where you find domains before they hit the major auction platforms. Power users who combine ExpiredDomains.net with Ahrefs or Moz can identify high-value domains before other buyers notice them.

Watch out for: No buyer protection. ExpiredDomains.net doesn’t facilitate transactions. You’ll need to complete the purchase through the relevant registrar or auction platform.

DomCop

A paid research tool that aggregates expired domain data and adds its own quality metrics. DomCop pulls data from multiple sources and provides a curated view of available domains with SEO metrics pre-populated. Monthly subscriptions start around $20-$30.

Best for: Serious buyers who want to evaluate multiple domains efficiently. DomCop’s filtering tools let you sort by DA, DR, backlinks, age, niche, and other criteria.

Watch out for: DomCop is also the source of the case study discussed earlier, which means it has a financial interest in convincing you that expired domains are valuable. The tool itself is useful; just keep the incentive structure in mind.

SpamZilla

A specialist tool focused on identifying spam-free expired domains. SpamZilla’s entire value proposition is filtering out the junk: domains with toxic backlinks, spam history, or penalty risk. It charges per search or via subscription.

Best for: Risk-averse buyers who prioritise clean domains over raw authority metrics. If your primary concern is avoiding a penalised domain, SpamZilla’s filtering is specifically designed for that.

Watch out for: Smaller database than DomCop or ExpiredDomains.net. You might miss opportunities because SpamZilla aggressively filters out domains that are risky but potentially still valuable.

Setting up your aged domain (DNS, hosting, and day one)

Once you’ve bought an aged domain, the technical setup and initial content strategy determine whether you preserve its accumulated authority or squander it. The first 30 days count for everything.

Buying the domain is the easy part. What you do next, in a specific order, determines whether the investment pays off. Get this wrong and you destroy the very signals you paid for.

Step 1: point the DNS

Transfer the domain to your preferred registrar if it isn’t there already. Then update the nameservers to point to your hosting provider. This is standard domain setup, identical to what you’d do with a new domain. Most registrars (Cloudflare, GoDaddy, Namecheap) have step-by-step guides.

If the previous site was on Cloudflare, you can keep it there. If you’re using a different host, the DNS propagation typically takes 24-48 hours.

Step 2: set up hosting and SSL

Get your hosting configured and an SSL certificate installed before you publish anything. Google has used HTTPS as a ranking signal since 2014. In 2026, running a site without SSL sends trust signals in the wrong direction. Most hosting providers (Cloudflare Pages, Vercel, Netlify, traditional hosts like SiteGround or A2) offer free SSL through Let’s Encrypt.

Step 3: handle redirects (this is where most people lose value)

This step is where the aged domain’s value is preserved or lost. If the previous site had pages that earned backlinks, those pages had specific URLs. Your new site needs to either:

1. Recreate content at those exact URLs, so the backlinks still point to live pages, or

2. Set up 301 redirects from the old URLs to relevant new pages, so the link equity transfers.

If you do neither, the backlinks point to 404 pages and their value evaporates. Use the Wayback Machine and your Ahrefs backlink report to identify the most-linked URLs, then prioritise those for redirects or content recreation.

Bloody hell, this step alone is why so many aged domain purchases fail to deliver. People buy a domain with 200 referring domains, slap a WordPress installation on it with completely different URL structures, and wonder why the authority didn’t transfer. The authority was in the URLs, not just the domain name.

Step 4: publish initial content with topical continuity

Your first content should be topically consistent with the domain’s history. If the domain was a gardening blog, your first 10-15 posts should be about gardening, even if you plan to expand the niche later. This maintains the topical signals Google has associated with the domain.

Start with cornerstone content: long-form, in-depth pages on the core topics the domain was known for. These pages give Google something substantial to crawl and confirm that the domain’s topical focus is consistent.

Step 5: verify in Google Search Console

Add the domain to Google Search Console and verify ownership. This gives you access to:

• Indexation status: Which pages Google has crawled and indexed

• Manual actions: Whether the domain carries any penalties (this is the first time you can see this)

• Search performance: What queries the domain is appearing for

• Crawl reports: How frequently Google is visiting the site

If you discover a manual action in Search Console, you have a decision to make. You can attempt to clean up the issue and submit a reconsideration request, or you can accept the loss and start fresh with a new domain. The choice depends on the severity of the penalty and how much you paid for the domain.

Step 6: submit an updated sitemap

Once your initial content is live, submit a sitemap through Search Console. This nudges Google to crawl your new content sooner than it otherwise would. For an aged domain with an existing crawl relationship, indexation can happen within days. For a fresh domain, it might take weeks.

The first 30 days after deploying an aged domain are about preservation, not experimentation. Match the domain’s historical topic, maintain the URL structure where backlinks exist, and let Google confirm that the domain is still trustworthy before you expand.

When a fresh domain is the better choice

An aged domain isn’t always the right call. Brand safety, niche specificity, and the absence of penalty risk make fresh domains the superior choice for certain projects. Shopify, Notion, and Figma all built billion-dollar brands on new domains.

After reading this far, you might think every new website should start on an old domain. That would be wrong. There are clear situations where a fresh domain is the smarter bet.

Brand identity and trust

If you’re building a consumer-facing brand, the domain name is part of your identity. You need a name that communicates your value proposition, is easy to remember, and doesn’t carry someone else’s baggage. Good luck finding an aged domain that happens to have the perfect brand name for your specific business, right?

Shopify launched on a fresh domain. So did Notion. So did Figma. They built their search presence through content quality, link earning, and brand recognition. It took time, but the domains became synonymous with their products. An aged domain would have given them a marginal head start on organic search but saddled them with a name that didn’t match their brand.²

Zero penalty risk

A fresh domain has no history. No spam, no toxic backlinks, no Google penalties, no association with content you didn’t create. For businesses in regulated industries (finance, healthcare, legal), the reputational risk of inheriting someone else’s domain history can outweigh the SEO benefit.

Exact niche fit

If your niche is highly specific, the chances of finding an aged domain with matching topical authority are slim. A fresh domain lets you build authority in exactly the right topic from day one, without the noise of irrelevant historical content.

The cost equation doesn’t always work

Not every project needs to rank quickly. If you’re building a personal blog, a portfolio site, or a small business site in a low-competition niche, the cost of an aged domain (plus the due diligence time, the redirect work, the content alignment) may not justify the ranking speed advantage. A fresh domain at $10-$15 per year, combined with good content and basic link building, gets you there within 12-18 months.

The hybrid approach

Some SEO practitioners use a middle path: register a fresh domain with the perfect brand name, then acquire an aged domain and 301 redirect it to the new domain. This transfers some of the aged domain’s link equity to the fresh domain while preserving the ideal brand identity. It’s more expensive and more complex, but it combines the advantages of both approaches.

The choice between aged and fresh domains depends entirely on your specific situation: your budget, timeline, niche, and brand requirements.

The maths: aged domain vs 12 months of link building

A DA 50 aged domain costs $1,200-$5,000. Building equivalent authority through link building takes 10-20 high-quality backlinks at $365-$509 each, totalling $3,650-$10,180 plus 6-12 months of waiting. Neither approach is cheap.

This section runs the numbers on both paths to first-page rankings. The comparison isn’t perfectly clean: you’re comparing an upfront capital investment against an ongoing operational expense. But it gives first-time buyers a framework for budgeting.

The aged domain path

Based on industry pricing data, aged domains fall into four pricing tiers by authority score:

A DA/DR 50 domain, a solid starting point for competitive niches, will cost you $1,200-$5,000. Add evaluation time, tool subscriptions for Ahrefs or Moz, initial content creation, and technical setup. The all-in cost for a properly deployed aged domain sits in the $2,000-$7,000 range for a mid-authority acquisition.

What you get: a domain with an existing backlink profile, crawl history, and (if you’ve chosen well) topical authority. Ranking timelines are compressed but not eliminated. You might see meaningful organic traffic within 2-4 months instead of 12-18.

The link building path

If you start with a fresh domain and build authority through link acquisition, the cost structure looks different. According to BuzzStream’s 2025 survey, the average cost of a guest post link is $365. Minuttia’s 2026 pricing report puts high-quality backlinks at $600-$2,000 per link.

To build a backlink profile equivalent to a DA 50 domain, you’d need roughly 10-20 high-quality links from authoritative sites. At the conservative end ($365 per link), that’s $3,650-$7,300. At the higher end ($509, splitting the difference between BuzzStream’s average and the lower bound of Minuttia’s range), that’s $5,090-$10,180.

Cost alone doesn’t capture the full picture, though. Building those links takes time. You need to create linkable content, identify prospects, conduct outreach, negotiate placements, and wait for publication. Realistically, acquiring 10-20 quality links takes 6-12 months of consistent effort.

What the spreadsheet misses

The comparison above is simplified. Several factors complicate the maths:

Aged domains need content too. You can’t just buy a domain and watch it rank. You still need to publish quality content, which means the content costs are additive for both approaches.

Link building compounds. Links you build in month 3 continue to deliver value in month 12 and beyond. The link building path has ongoing returns that the aged domain purchase doesn’t inherently provide.

Risk is asymmetric. An aged domain purchase is a single concentrated bet. If the domain turns out to have hidden penalties or a toxic backlink profile, you’ve lost the entire investment. Link building distributes risk across multiple placements.

Some niches don’t respond to either approach. In extremely competitive verticals (insurance, finance, gambling), neither a DA 50 aged domain nor 20 quality backlinks will crack the first page. You’re competing against sites with DA 90+ and thousands of referring domains.

The aged domain path is faster and potentially cheaper, but it’s riskier and requires more upfront due diligence. The link building path is slower and potentially more expensive, but it’s safer and builds sustainable authority. Most successful SEO strategies use elements of both.

For first-time domain buyers with a budget under $2,000, the fresh domain + gradual link building approach is usually the safer bet. For buyers with $3,000-$7,000 who need results quickly and are willing to do thorough due diligence, an aged domain can be a legitimate shortcut.

Neither approach works without quality content. And honestly? That’s the variable the industry tends to undersell, probably because there’s less money in telling people to write better than there is in selling them domains and links.

The aged domain market in 2026 sits at an inflection point. Google’s expired domain abuse policy has raised the cost of doing it badly. The data on ranking timelines has made the case for aged domains stronger for legitimate operators. The gap between “buying an aged domain to spam” and “buying an aged domain to build a real site” has never been wider.

Domain age is a proxy, not a power. The age number on a WHOIS record does nothing by itself. The backlinks, the crawl history, the topical authority, and the clean reputation that come with age are what move rankings. Understanding that distinction is the difference between a smart investment and an expensive lesson.

Take the evaluation checklist seriously. Thirty minutes of due diligence is cheaper than discovering a Google penalty after you’ve invested in content and hosting. The domains that deliver real value earned their authority legitimately, over years of genuine use. They exist. They’re worth paying for. But they require the same careful evaluation you’d give any other business asset.

1 The exact PubCon 2005 exchange between Cutts and the audience was documented contemporaneously on WebmasterWorld, but multiple attendees reported slightly different wordings. The consensus interpretation, which has held for two decades, is that Cutts acknowledged observed effects consistent with a sandbox without confirming the existence of a specific “sandbox” mechanism.

2 These companies had venture capital funding that allowed them to invest in content marketing and brand building at a scale most small businesses can’t replicate. The fresh domain approach is slower without significant marketing spend.

The certification that everyone trusts and nobody reads

Every time you hand your credit card to a SaaS app, upload medical records to a health portal, or trust a startup with your company’s data, a quiet assumption is doing enormous work in the background. Somebody checked that these people know what they’re doing with your information.

That assumption rests on compliance certifications: SOC 2, ISO 27001, HIPAA, GDPR. If you’ve never encountered these acronyms, you’ve still been protected by them.

Or at least you thought you were.

They’re the security equivalent of the health inspection grade posted in a restaurant window. You don’t read the full inspector’s report. You glance at the letter grade, see an A, and sit down to eat.

SOC 2 (Service Organisation Control Type 2) is the one that comes up most in the software industry. It’s an audit standard developed by the American Institute of Certified Public Accountants. A qualified auditor spends weeks, sometimes months, examining how a company protects data: who can access what, how they handle encryption, what happens when something goes wrong, whether they test their own defences. The auditor produces a detailed report. The company earns a certification. Buyers see the badge and relax.

ISO 27001 works similarly but for a broader international audience. Think of it as a building code inspection: it verifies that an organisation has a proper information security management system in place, from risk assessment to incident response. HIPAA governs healthcare data in the United States, with specific rules about who can see patient records and how they must be stored. GDPR does something similar for the personal data of anyone in the European Union, with famously sharp teeth for enforcement.

The whole system depends on a chain of trust. Companies hire auditors. Auditors examine evidence. Auditors certify compliance. Buyers trust the certification. Regulators trust the auditors. And almost without exception, nobody in that chain reads the underlying reports.

If you buy software for your company and the vendor shows you a SOC 2 badge, you probably don’t request the full 80-page audit report. If you do request it, you probably don’t read it. If you read it, you probably don’t have the expertise to evaluate whether the controls described are real or theatre.

That gap between trust and verification has existed for years. It was always a vulnerability. In early 2026, someone drove a truck through it.

The company that allegedly exploited that gap was Delve, a Y Combinator-backed startup that promised to make compliance fast, cheap, and painless. According to a forensic investigation published by an anonymous researcher using the pseudonym DeepDelver, Delve’s certifications weren’t worth the PDFs they were printed on.

The investigation’s findings, if accurate, describe one of the most brazen frauds in recent startup history. Not a technical hack or a data breach, but something more basic: the systematic manufacture of fake security certifications for hundreds of companies, many of them handling sensitive health data, financial records, and personal information belonging to millions of people.

From MIT dorm room to $300 million valuation

Delve’s founding story was, until recently, the kind of narrative that venture capital loves to fund and business magazines love to profile.

Karun Kaushik and Selin Kocalar met at MIT. They’d been working on a medical scribe project that required HIPAA compliance (the set of US federal rules governing how healthcare data must be handled). As Kocalar described it on LinkedIn in July 2025:

“The whole experience was painful, complicated, and time-consuming... what stuck with me was the realization that if we struggled this much with compliance, what about every other startup?”

The pain was real and widely shared. For an early-stage startup, getting SOC 2 certified typically costs $20,000 to $50,000 and takes months of work. HIPAA compliance can cost even more. For a two-person company burning through its seed round, diverting that time and money to compliance paperwork feels like paying a tax for the privilege of existing. The founders saw an opportunity: use automation and AI to collapse weeks of audit preparation into days. Make compliance fast. Make it affordable. Make it something founders don’t have to dread.

They joined Y Combinator’s W24 batch, one of the most competitive startup accelerators in the world. They raised a $3 million seed round in January 2025. Growth was rapid. By mid-2025, Delve had more than 500 customers, most of them early-stage startups desperate for exactly the kind of fast, cheap compliance Delve was selling.

Then, in July 2025, Insight Partners led a $32 million Series A that valued the company at $300 million. Kaushik told TechCrunch about the market demand: “Compliance frameworks are standardized. Businesses aren’t. That mismatch is why traditional software breaks down.” Kocalar explained how the business had expanded: “As our customer base grew, they started asking for support with other frameworks: SOC 2, PCI, GDPR, ISO, basically the whole alphabet soup of compliance.”

The press coverage was glowing. Two founders, both around 21, had built a company worth $300 million in under two years. Kaushik reportedly made the Forbes 30 Under 30 list for 2026. The story had every ingredient the tech press craves: youth, speed, a real problem, a billion-dollar market, and the implicit validation of Y Combinator and a blue-chip VC firm.

Delve’s pricing was aggressive. According to the DeepDelver investigation, the company had dropped its prices from around $15,000 to roughly $6,000 for SOC 2 certification. At that price point, they were undercutting the market by 60 to 80 percent. Customers flooded in.

Nobody asked the obvious question: how do you run a rigorous security audit for a fraction of the cost and a fraction of the time that every other auditor charges?

The answer, according to the investigation, was simple. You don’t.

The Google Drive link that blew it open

The Delve scandal didn’t surface because of a whistleblower, a data breach, or a regulatory investigation. It surfaced because somebody shared a Google spreadsheet with the wrong permissions.

As DoControl’s analysis put it: “The incident didn’t become public because of a breach, an advanced hacker group, or a whistleblower investigation. It surfaced because an internal Google Spreadsheet was accidentally shared.”

The spreadsheet contained links to 575 confidential audit files: 494 SOC 2 reports and 81 ISO 27001 certifications. Each file belonged to a different Delve customer. Each file was supposed to be a confidential document produced by an independent auditor after weeks of careful examination. And each file was accessible to anyone with the link.

An anonymous researcher, writing under the pseudonym DeepDelver, obtained the files and began a forensic analysis. What they found was extraordinary.

But before the analysis went public, something else happened. Anonymous emails were sent to Delve’s clients, alerting them that their compliance reports might be fraudulent. Delve’s CEO, Karun Kaushik, responded by telling clients the claims were “AI-generated” and represented “falsified claims.” He urged them to ignore the emails.

The DeepDelver investigation then went public. And the evidence it presented was difficult to dismiss as AI-generated fabrication, because the evidence was Delve’s own files.

What 494 reports revealed when someone looked

The DeepDelver investigation analysed the 494 SOC 2 reports found in the leaked spreadsheet. The findings, if verified, paint a picture of compliance certification as industrial-scale copy-paste.

Of those 494 reports, 493 contained an identical text string. That’s 99.8 percent. A real SOC 2 audit examines a specific company’s specific security practices, its particular infrastructure, its unique set of employees and processes. No two legitimate audit reports should read like photocopies of each other. These allegedly did.

The similarities went deeper than shared boilerplate. According to the investigation, 492 of the files contained the same grammatical errors, repeated verbatim across reports for hundreds of different companies. When an auditor makes a typo in one report, that’s human error. When the same typo appears in 492 reports for 492 different companies, that’s a template.

According to the DeepDelver analysis, each report contained only four customer-specific elements. Everything else was identical.

Four elements. In a document that’s supposed to represent weeks of detailed, company-specific security examination. To put that in terms of the restaurant analogy: imagine a health inspector visiting 494 different restaurants and producing 494 reports identical except for the restaurant’s name, address, type of food, and number of tables. Same violations noted (or not noted). Same observations. Same conclusions. Word for word.

The 259 Type II reports in the set allegedly contained identical conclusions. A Type II report is supposed to cover a period of ongoing observation, usually six to twelve months, evaluating whether security controls are not just designed properly but operating effectively over time. Each company’s operational period, each company’s set of incidents and changes, each company’s employees and systems would produce different findings. Identical conclusions across 259 companies, covering different time periods for businesses ranging from AI startups to healthcare providers, would be unusual in the extreme.

Then there was the test data. The investigation found what appeared to be keyboard-mashed gibberish in the reports: strings like “sdf” and “dlkjf” in fields where an auditor would normally enter sample data from the company being examined. The kind of placeholder text someone types when they’re filling out a template in a hurry and don’t expect anyone to look closely.

The investigation’s methodology was straightforward: text comparison across hundreds of documents, looking for patterns that would be statistically impossible if each report represented genuine independent analysis. A single shared paragraph between two reports might be coincidence. Near-total identity across nearly 500 suggests something else entirely.

A legitimate SOC 2 Type II audit typically requires more than 200 hours of work, according to industry benchmarks. The investigation found evidence suggesting Delve’s process took roughly four hours of automated preparation plus about two hours per employee. For a 10-person startup, that’s around 24 hours of work producing a report that’s supposed to represent ten times that.

The maths alone should have raised red flags. But the people receiving these reports were startup founders, not audit professionals.

They wanted the badge. They got the badge. They moved on.

The auditors who weren’t what they claimed

A SOC 2 report is only as credible as the auditor who signs it. The DeepDelver investigation identified several auditing firms associated with Delve’s certifications. The three most prominent were Accorp, Gradient Certification, and Glocert. Each, according to the investigation, had qualities that would concern anyone familiar with how legitimate compliance auditing works.

Accorp, according to the investigation, was based in Delhi, India. For a firm signing hundreds of SOC 2 reports for American companies, a Delhi address is unusual. SOC 2 audits are conducted under standards set by the American Institute of Certified Public Accountants, and while there’s no legal requirement that auditors be US-based, the vast majority of established SOC 2 auditing firms operate from North American offices with US-licensed CPAs on staff.

Gradient Certification was registered in Wyoming through a registered agent, a common arrangement for shell companies. Its directors were reportedly based in India. Wyoming is well known in corporate formation circles for minimal disclosure requirements and low fees, making it a popular state for companies that want a US address without a US presence.

Glocert was described as a dormant UK entity.

The pricing these firms allegedly charged tells its own story. According to the investigation, quotes for both SOC 2 and ISO 27001 certifications came in under $2,000. Combined. A legitimate SOC 2 audit alone typically costs $20,000 to $50,000 from an established firm. An ISO 27001 certification runs $15,000 to $40,000. Getting both for under $2,000 would be like getting a full home inspection and a structural engineering assessment for the price of a locksmith visit.

In the legitimate compliance industry, a $2,000 audit is not a bargain. It’s a warning sign. The price tells you exactly how much examination is being done: almost none.

The auditor situation raises a question that extends well beyond Delve. SOC 2 audits are supposed to be conducted by independent third parties. But the system for verifying that independence is remarkably thin. There’s no centralised registry of approved SOC 2 auditors. No mandatory licensing scheme. The American Institute of CPAs sets the standards, but enforcement is scattered across state boards and professional bodies that rarely coordinate.

In practice, this means a compliance startup can partner with auditing firms that exist primarily on paper, produce reports that were generated before the audit began, and present the result to customers who have no practical way to evaluate whether the auditing firm is real, independent, or competent. The trust gap isn’t just between the customer and the compliance vendor. It extends to the entire auditing layer.

Hundreds of companies that thought they were safe

The leaked spreadsheet contained far more than anonymous reports. It included the names of Delve’s customers, and those names read like a cross-section of the modern startup ecosystem.

Among the companies identified in the investigation were Lovable, an AI development platform; Bland, an AI phone calling company; HockeyStack, a B2B analytics platform; Cluely, an AI assistant; and Browser Use, a tool for AI web browsing. The list also reportedly included Duos Edge AI, a publicly traded company on NASDAQ under the ticker DUOT, which raises the stakes considerably beyond the startup world.

Some of these companies handle protected health information (PHI), the category of data HIPAA was specifically designed to safeguard. A fake HIPAA compliance certification for a company handling patient records isn’t an administrative oversight. It means patients’ medical data may have been stored, processed, and transmitted by companies that never underwent genuine examination of their security practices. Every mishandled medical record is a potential HIPAA violation, and every HIPAA violation carries penalties that can reach into the millions.

The investigation found evidence suggesting that Delve’s “trust pages” (the customer-facing dashboards showing compliance status) were generated before the underlying work was done. According to the analysis, 321 out of 322 trust pages examined displayed identical sets of 51 security controls, all showing green checkmarks. The same controls, in the same configuration, for companies ranging from AI chatbot builders to healthcare data processors.

Either every one of those 322 companies happened to implement exactly the same 51 controls in exactly the same way, or the checkmarks were assigned from a template regardless of what controls each company had in place.

A trust page showing all green checkmarks is worth exactly as much as the audit behind it. If the audit was templated, the green checkmarks are decorative.

The investigation also examined Delve’s claimed integrations with other platforms: the technical connections that would allow Delve’s software to pull evidence directly from a company’s infrastructure and verify controls automatically. According to the analysis, most of Delve’s listed integrations did not function as advertised. Only a small fraction of the more than 100 listed integrations were real, the investigation’s figures suggest.

This distinction is important for understanding the nature of the alleged fraud. Legitimate compliance automation platforms like Vanta and Drata connect directly to a company’s cloud infrastructure, pull configuration data, and continuously monitor whether security controls are in place. That’s real automation: software that reads your AWS settings, your access control lists, your encryption configurations. Delve allegedly claimed to do the same thing but, according to the investigation, didn’t have the integrations to pull it off.

The result, if the investigation’s findings are accurate, was a factory. Companies came in. Templates went out. Badges went up. Nobody checked.

The regulatory hammer waiting to fall

The legal exposure facing Delve and its affected customers is layered, and each layer has its own set of consequences. These are not parking tickets.

Start with HIPAA, the US law governing healthcare data. HIPAA violations are enforced by the Department of Health and Human Services’ Office for Civil Rights. Civil penalties can reach approximately $2.19 million per violation category per year. Criminal penalties, for cases involving knowing misuse of health information, can go up to 10 years in prison and $250,000 in fines.

A “violation” under HIPAA isn’t necessarily one record exposed. It can be a pattern of non-compliance. A company that relied on a fraudulent HIPAA certification and never implemented the controls it claimed to have could face a violation for each category of failure, for each year of non-compliance. If patient data was exposed, the penalties compound.

GDPR penalties for companies handling EU residents’ data can reach up to EUR 20 million or 4 percent of global annual revenue, whichever is higher. If a company obtained a GDPR certification through Delve and that certification was fraudulent, the company’s GDPR compliance was never verified. Every piece of EU personal data processed without genuine compliance represents potential exposure.

For Duos Edge AI (NASDAQ: DUOT), the implications extend into securities regulation. A publicly traded company that represented to investors and customers that it held valid compliance certifications, when those certifications were allegedly fabricated, could face SEC scrutiny. Material misrepresentations about a company’s security posture, even if the company believed the certifications were real, can trigger disclosure obligations and shareholder lawsuits.

Then there’s wire fraud. If Delve knowingly sold fraudulent certifications and used electronic communications (email, online platforms) to do so, that’s potentially federal wire fraud, which carries sentences of up to 20 years per count. With more than 500 customers, the count exposure alone is staggering.

Class action exposure is harder to quantify but easy to imagine. Any Delve customer that suffers a data breach could face lawsuits from its own customers and users. Those Delve customers would, in turn, have claims against Delve for providing fraudulent certifications. The downstream exposure ripples outward. Delve’s customers’ customers, the actual human beings whose data was supposedly being protected, sit at the end of a chain of trust that, according to the investigation, was hollow from the start.

The companies that used Delve’s certifications may be victims. But their customers and users, the people whose data was supposedly being protected, didn’t choose Delve. They didn’t even know Delve existed. They’re the ones holding the risk.

For many of Delve’s startup customers, the legal exposure from a fraudulent certification could be existential. A HIPAA investigation alone, even without a finding of wilful violation, can consume an early-stage company’s entire legal budget. The cost of remediation (getting a legitimate audit, implementing controls that should have been in place from the start, disclosing the situation to partners and regulators) is measured in months and hundreds of thousands of dollars.

For a company that chose Delve precisely because it was trying to save money on compliance, that’s a bitter pill.

When the auditors fail: echoes of Enron and Wirecard

If the allegations against Delve prove accurate, the scandal will join a very specific category in corporate history: cases where the people hired to verify trustworthiness became the mechanism of fraud.

The defining example is Arthur Andersen. In 2001, Andersen was one of the “Big Five” accounting firms, employing roughly 85,000 people worldwide. The firm was Enron’s auditor, responsible for verifying that Enron’s financial statements were accurate. They were not. Enron had fabricated its finances on a massive scale, hiding billions in debt through off-balance-sheet entities. When investigators closed in, Andersen employees shredded documents.

Andersen didn’t survive. The firm was convicted of obstruction of justice (later overturned by the Supreme Court, but too late), surrendered its CPA licences, and effectively dissolved. Eighty-five thousand people lost their jobs. Most were innocent professionals whose firm’s leadership had chosen complicity over integrity. The fallout produced the Sarbanes-Oxley Act of 2002, a sweeping set of reforms to corporate financial auditing that created the Public Company Accounting Oversight Board.

The European parallel is Wirecard. The German fintech company claimed to process billions in payments. Its auditor, EY, signed off on financial statements that included approximately EUR 1.9 billion that didn’t exist. The money was supposedly held in Philippine bank accounts. It was not. Wirecard’s CEO, Markus Braun, was arrested. The company collapsed. EY faced lawsuits and regulatory scrutiny across multiple countries.

The pattern repeats: an entity trusted to verify becomes an entity that enables. The auditor stops being a check on the system and becomes part of the mechanism being checked.

Delve is obviously smaller than Enron or Wirecard. The dollar amounts differ by orders of magnitude. But the structural failure is the same: an auditing function, the very mechanism designed to prevent fraud and assure quality, allegedly became the vehicle for fraud. And in each case, the fraud persisted because nobody upstream bothered to verify the verifiers.

There’s a reason this keeps happening. Auditing is, by nature, a service industry. The company being audited is the same company paying the auditor. That creates a built-in conflict of interest: the auditor’s client is the entity the auditor is supposed to scrutinise. In financial auditing, Sarbanes-Oxley addressed this with mandatory auditor rotation, limits on non-audit services, and independent oversight.

In compliance auditing, no equivalent structure exists. No SOC 2 equivalent of the Public Company Accounting Oversight Board. No mandatory rotation. No centralised registry. No requirement that auditors be independent in any enforceable sense.

The Delve case, if substantiated, will almost certainly reignite calls for compliance auditing reform. The question is whether it will take an Enron-scale disaster, with real data breaches traced back to fake certifications and measurable harm to actual human beings, before regulators act. History suggests that reforms follow catastrophes, not close calls.

The $6,000 audit and the $30,000 audit

Compliance is a large and growing market. Revenue figures vary depending on who’s counting, but compliance automation software alone is worth tens of billions annually and expanding fast. Every new privacy law, every new data protection regulation, every new industry-specific security requirement creates demand for the tools and services that help companies meet those requirements.

The legitimate players in this market include companies like Vanta, which has raised $150 million and is valued in the billions, along with Drata and Secureframe. These companies sell software that automates the evidence-gathering process for compliance audits. The pitch is real: much of what makes traditional compliance painful is manual evidence collection. Screenshots of access control settings. Spreadsheets documenting who can access what. Logs proving that encryption is enabled. Compliance automation replaces that manual drudgery with software integrations that pull evidence directly from a company’s infrastructure.

The distinction between what these legitimate platforms do and what Delve allegedly did is worth spelling out. Vanta and its competitors automate the preparation and evidence-gathering phase of an audit. They make it easier for companies to organise their documentation, monitor their controls continuously, and present evidence to auditors. But the actual audit, the independent examination by a qualified third party, still happens. The automation makes the process faster and cheaper without eliminating the audit itself.

Delve, according to the investigation, allegedly automated the output rather than the input. Instead of automating evidence collection and presenting it to a real auditor, the company allegedly generated the audit reports themselves, using templates, and paired with auditing firms that would sign off without conducting genuine examinations.

The distinction is the difference between a calculator and a counterfeiting machine. A calculator helps you get the right answer faster. A counterfeiting machine produces something that looks like the right answer but isn’t.

As DoControl wrote in its analysis:

“SOC 2 itself is not broken. The failure here was not the framework, it was how people chose to exploit trust in the process.”

And:

“Automation didn’t cause fraud. Poor incentives, lack of auditor independence, and shortcut-driven compliance culture did.”

Those two quotes capture a tension that will define the compliance industry’s response to the Delve scandal. The frameworks themselves (SOC 2, ISO 27001, HIPAA, GDPR) are sound in their design. SOC 2 controls, properly examined, do provide genuine insight into how well a company protects data. The problem isn’t the standard. It’s that enforcement relies on trust, and trust can be exploited.

There’s also a structural incentive problem. Startups are price-sensitive. Compliance is perceived as a cost centre, a box to tick on the way to closing an enterprise deal. When one vendor offers SOC 2 certification for $6,000 and another charges $30,000, the startup founder burning through a seed round isn’t going to investigate why the cheap option is cheap. They’ll pick the cheap option and get back to building product.

This price pressure creates a race to the bottom. Vendors who do rigorous work can’t compete on price with vendors who don’t. Customers who can’t tell the difference between a genuine audit and a rubber stamp choose the cheaper option every time. The market rewards speed and affordability, precisely the qualities that, according to the Delve investigation, were achieved by eliminating the audit entirely.

Silence, brigading, and the absence of accountability

As of 20 March 2026, Delve has not issued a public statement addressing the investigation’s findings.

That silence is itself telling. When a company faces allegations of systemic fraud, the standard playbook is to deny, explain, or cooperate. Delve has done none of these publicly. Its initial response, when the anonymous emails reached customers, was to dismiss the claims as “AI-generated” and “falsified.” Since the full investigation was published, with its hundreds of pages of documentary evidence drawn from Delve’s own files, the company has gone quiet.

The response from Delve’s employees, however, has been visible in other ways. According to reports from industry professionals and community moderators, Delve employees have been active in online discussions about the scandal. As one commenter on a CISO-focused forum observed: “Employees from Delve have been brigading posts that speak negatively of them.” Another noted: “No official statement from Delve I can find either... not a good look.”

Brigading (coordinating downvotes or negative responses to suppress criticism) is a distinctly modern form of crisis management. It doesn’t address the substance of the allegations. It tries to make them harder to find. For a company already accused of producing fake reports to create the appearance of security, suppressing online discussion through coordinated voting is grimly consistent: appearance over substance, all the way down.

The investor side is equally quiet. Insight Partners, which led the $32 million Series A at a $300 million valuation, has not publicly commented on the investigation. Y Combinator, which accepted Delve into its prestigious W24 batch and features the company on its website, has not made a public statement.

Their silence is significant because their brands were central to Delve’s credibility. A YC badge and a $32 million round from a major VC firm signal to customers that someone with deep pockets and sharp judgement has vetted this company. That vetting, it appears, may not have included examining the audit reports that were the company’s core product.

The same dynamic that made Delve’s compliance reports persuasive, trusting a badge instead of reading the underlying documentation, also made Delve itself persuasive to investors and customers. YC batch. Insight Partners. $300 million valuation. Nobody read the reports.

The speed with which this story spread through the tech industry suggests it hit a nerve. When tech journalist Erin Griffith shared the story, it reportedly received a million views within hours. Security professionals, CISOs (chief information security officers), startup founders, compliance vendors, and investors all had reason to pay attention. Every CISO who ever accepted a Delve certification from a vendor is now re-evaluating that vendor’s security posture. Every investor who backed a company that used Delve is wondering about their portfolio company’s legal exposure. Every legitimate compliance vendor is watching to see whether the scandal tars the entire industry or isolates the damage to one bad actor.

Your data, their badge, nobody’s guarantee

The Delve investigation, regardless of how the legal proceedings play out, has already exposed a structural weakness in how the technology industry proves it can be trusted with personal data. The system is trust-based, and trust was exploited.

When you sign up for a health app that stores your medical records, you trust that the app complies with HIPAA. When a European user provides their email address to a SaaS tool, they trust that the tool complies with GDPR. When a company evaluates a software vendor and sees a SOC 2 badge on the website, they trust that an independent auditor has verified the vendor’s security controls. Each of those trust decisions happens silently, unconsciously, thousands of times a day, across millions of transactions. And each one rests on a certification that, in hundreds of cases, may have been worth nothing.

What the Delve scandal reveals is that compliance certification has become a checkbox exercise for much of the startup ecosystem. Not because the frameworks are bad, but because the enforcement mechanisms assume good faith at every level of the chain. The company is supposed to implement real controls. The auditor is supposed to verify them independently. The buyer is supposed to review the report. The regulator is supposed to enforce the rules.

When every participant in that chain treats their role as a formality, the entire structure is hollow. It looks solid from the outside. It has all the right logos and badges. But it can’t bear weight.

Several things need to change. None of them are easy.

First, auditor verification needs teeth. A centralised registry of approved compliance auditors, with mandatory licensing, regular quality reviews, and public disclosure of audit outcomes, would make it significantly harder for shell companies in Wyoming to sign off on hundreds of fraudulent reports. The financial auditing world solved this problem (imperfectly) with the Public Company Accounting Oversight Board after Enron. The compliance industry needs its equivalent.

Second, buyers need to read the reports. This is the least popular recommendation and the most necessary one. If you’re evaluating a software vendor that will handle your company’s data, requesting and reading their SOC 2 report should be as routine as checking their pricing page. Most companies don’t do this because they don’t have anyone qualified to evaluate the report. That’s a capability gap worth filling, either with in-house expertise or with third-party review services.

Third, pricing signals deserve scrutiny. When a compliance vendor offers certification at a fraction of the market rate, that is information. It may mean they’ve found genuine efficiencies through automation. It may mean they’ve found efficiencies by eliminating the audit. Asking how a vendor achieves its pricing should be part of due diligence, not just for compliance services but for any service where the quality of the work is hard to observe from the outside.

Fourth, the companies that were Delve’s customers face a fork. They can get legitimate audits, disclose the situation to their customers and partners, and absorb the cost of doing things properly. Or they can hope nobody notices. The first path is expensive and embarrassing. The second is a bet that the downstream consequences of fake certifications (the data breaches, the regulatory investigations, the class action lawsuits) will never materialise. Given the scale of the exposure, that bet looks worse with each passing day.

For ordinary people, the options are more limited. You can’t audit your health app’s SOC 2 report. You can’t verify that your employer’s HR software has genuine ISO 27001 certification. You can’t check whether the AI tool you used last week has real HIPAA compliance or a Delve-generated template.

The system is supposed to do that for you. The Delve scandal suggests that, for at least several hundred companies and the untold number of people whose data they handle, the system didn’t.

The compliance industry will likely survive this scandal. SOC 2 will remain the standard. ISO 27001 will keep its relevance. HIPAA and GDPR aren’t going anywhere. The frameworks are sound. But the question the Delve case forces into the open is one the industry has avoided for years: who audits the auditors?

The answer, right now, is nobody. And until that changes, the badges on the website are worth exactly as much as the faith you’re willing to put in them.

1 The DeepDelver investigation was published by an anonymous researcher using a pseudonym. The use of anonymity in publishing fraud allegations is itself noteworthy; the researcher stated they feared legal retaliation. The investigation’s methodology, based on text comparison across hundreds of leaked documents, has not been independently verified by a third-party forensic analysis firm as of publication.

2 Wyoming requires minimal disclosure for company formation. A registered agent address in Wyoming does not necessarily indicate a shell company, but it is a common structure used to obscure the actual location and ownership of a business entity.

3 Sarbanes-Oxley’s auditor independence provisions include mandatory rotation of the lead audit partner (though not the audit firm itself), restrictions on auditors providing certain non-audit services to audit clients, and requirements for audit committee pre-approval of all services. None of these provisions apply to compliance auditing.

The boat studio

On March 13, 2026, Travis Kalanick walked into a TBPN set and sat down across from podcast hosts John Coogan and Jordi Hays, and did something he hadn’t done in nearly a decade.

He talked.

The TBPN interview ran about an hour. Travis looked different from the guy who’d been photographed screaming at an Uber driver in 2017, or the one in the grey hoodie doing damage control on cable news.

He was relaxed. Tan.

He’d moved to Texas the previous December, owns a lakehouse he’s had for five years, and seemed like a man who’d been sleeping well.

The first thing he said that mattered was also the most obvious: “I’ve been in hiding.”

Eight years. His company, originally called City Storage Systems, had operated so deep in stealth that employees couldn’t list the company’s name on their LinkedIn profiles. Thousands of employees, working in more than 110 cities across 30 countries, and the outside world mostly knew them as “that ghost kitchen thing Travis is doing.”

But the interview was less retrospective than launch event.

“We’ve been in stealth mode for eight years. Employees were not allowed to put the name of the company on their LinkedIn.”

Travis revealed the rebrand live on air. City Storage Systems was now Atoms. Three divisions: Atoms Food, Atoms Mining, Atoms Transport. A manifesto had gone up on atoms.co/vision. The thesis was physical AI and robotics. Not the humanoid kind, but specialised machines that could do productive work. He called them “gainfully employed robots.”

He was funny about it, too. He’d originally wanted to call the company Super. “I’m like, you go from Uber to Super. That cannot be a thing. So I did the opposite.” CSS. The most boring name imaginable. And now Atoms, which at least sounded like it meant something.

The interview had a confessional quality. Travis talked about his mother’s death. About being forced out of Uber. About selling his entire stake and walking away from the board. About the years of building in silence. And then, with the casual timing of someone who’d rehearsed it but wanted it to land as spontaneous, he laid out what he’d actually been doing.

“I was the GOAT for a period of time and now I’m a baby goat. And that’s okay.”

He grinned when he said it. The hosts laughed. But the line was doing real work. Travis Kalanick, the most famous founder-exile in Silicon Valley history, was telling the world he was back, and that he’d spent the exile building something bigger than anyone had guessed. Whether you believe him depends on how much credit you give the last eight years. And to understand those years, you have to go back to the beginning.

Act I: The making of a fighter

Travis Kalanick’s origin story is a series of near-death experiences, financial and otherwise. Before Uber made him a billionaire, he spent a decade getting punched in the mouth by the startup world and refusing to stay down. The pattern matters because it explains everything that came after.

Scour: a quarter-trillion-dollar lawsuit at 24

In 1998, Travis co-founded Scour at UCLA. It was a peer-to-peer file-sharing service, essentially Napster’s slightly less famous cousin. The board included Michael Ovitz (the most powerful agent in Hollywood history) and Ron Burkle (the billionaire supermarket magnate). For a college project, it had serious backers.

It also had serious enemies. The RIAA and MPAA sued Scour for $250 billion. Yes, billion. That number is absurd on its face. The entire GDP of Ireland was roughly $100 billion at the time. But the entertainment industry wasn’t interested in proportionality; they wanted to make an example. Scour filed Chapter 11 in September 2000.

Travis was 24 years old. He’d built something that attracted world-class investors and world-class lawsuits in equal measure. The company died. He didn’t.

Red Swoosh: four years without a salary

What Travis did next is the part of his biography that tells you the most about him. He founded Red Swoosh in 2001, a peer-to-peer content delivery network. Same underlying technology as Scour, stripped of the copyright liability. Legal P2P.

The company nearly killed him. He went four years without a salary. Mark Cuban joined the board, which gave it credibility but not necessarily cash flow. Travis has described this period with the kind of reverence that founders reserve for their worst years.

“That company wasn’t meant to be and I willed it into being.”

In 2007, Akamai acquired Red Swoosh for approximately $19 million. Travis walked away with about $2-3 million after taxes. By Silicon Valley standards, this is a rounding error. By the standards of a guy who hadn’t drawn a salary in four years, it was everything.

“[Sold Red Swoosh for] 19 million bucks and probably to this day still the happiest day of my life.”

He elaborated on the TBPN podcast: “I cleared 3 million and I was like praise the Lord.”³ Nine years of work. Two companies. A quarter-trillion-dollar lawsuit. And the payday was three million dollars. Most people would take that as a sign to get a job at Google. Travis took it as proof that he could survive anything.

The fighter’s DNA

The Scour-to-Red Swoosh arc established a template that would repeat twice more. Build something audacious. Get hit with consequences that would destroy most people. Refuse to quit. Grind through years of pain. Come out the other side with a modest win and an appetite for something bigger.

It’s a template that makes Travis simultaneously inspiring and exhausting to deal with. The same stubbornness that kept Red Swoosh alive through four years of zero salary is the same stubbornness that made him impossible to manage at Uber.

The same willingness to fight a $250 billion lawsuit at 24 is the same willingness to fight his own board at 40.

Right, I’m editorialising. But the pattern is worth naming because it’s the key to understanding what happened at Uber and why he didn’t just retire to a beach after selling his stake.

He told the TBPN hosts something that explains the whole trajectory: “If you’re getting money easy, I’m like, why didn’t you go harder? You could have been way better and gone way further.”

That line is both his greatest strength and the thing that nearly destroyed him.

Act II: The Uber machine

Travis Kalanick and Garrett Camp co-founded Uber in 2009. Within eight years it would reach a private valuation of roughly $68 billion, reshape urban transportation worldwide, and become the defining startup of the 2010s. The speed at which it grew was matched only by the speed at which its culture went from asset to liability.

The idea and the co-founder

Garrett Camp, who’d sold StumbleUpon (feel old yet?) to eBay, had the original idea: a black car service you could summon from your phone. Travis brought the operational intensity. The division was clean in the early days. Camp was the product thinker. Travis was the wartime CEO.

The company grew with the kind of velocity that makes investors lose their composure. And Travis knew exactly how to exploit that.

The city-by-city playbook

What made Uber different from other startups wasn’t just the product. It was the expansion model. Travis treated each new city as a standalone campaign. He’d send a small team (sometimes just two or three people) into a market with a simple mandate: get drivers on the platform, get riders using the app, and deal with whatever regulatory backlash follows.

Each city launch was, in effect, a startup within a startup. The local team had to recruit drivers, often by standing outside taxi ranks and offering signing bonuses. They had to generate rider demand, usually through promotional credits and word of mouth. And they had to manage the inevitable fight with local taxi commissions, city councils, and entrenched transport operators who saw Uber as an existential threat.

The playbook was aggressive by design. In many cities, Uber launched before it had regulatory approval, betting that consumer demand would make it politically impossible for regulators to shut the service down. It worked more often than it didn’t. By the time a city council got around to drafting ride-sharing regulations, Uber already had tens of thousands of riders who would scream if the service disappeared.

Travis called this approach “principled confrontation.” Critics called it law-breaking with a PR strategy. Both descriptions were accurate.

The model scaled because Travis had systematised confrontation itself. There was a playbook for the launch, a playbook for the regulatory fight, and a playbook for the press cycle that followed. Each city team ran the same plays, adapted for local conditions.

Fundraising as performance art

The way Uber raised money tells you as much about Travis’s psychology as any profile ever written. At the company’s New York office, he set up four parallel rooms for investor meetings. Each room held a different tier of potential investors. The $250 million-plus club got a room with Travis himself.

Rounds were routinely oversubscribed. Travis ran what amounted to an auction-style book-building process, more typical of an IPO than a private round. Investors competed against each other for allocation. The power dynamic was inverted: founders selecting investors, not the other way around.

The results were obscene. Jason Calacanis’s $10,000 angel cheque grew to roughly $100 million. Early employees became millionaires on paper. The valuation climbed from nothing to $68 billion in under a decade.

But Travis had a philosophy about capital that went beyond fundraising tactics. He saw raising money as a competitive weapon. Every dollar Uber raised was a dollar its competitors couldn’t use. Every oversubscribed round was a signal to the market that resistance was futile.

This philosophy worked brilliantly until the money stopped being the problem.

The culture problem

Uber’s culture was an extension of Travis’s personality: aggressive, competitive, boundary-pushing, and allergic to the word “no.” In the growth phase, this produced a company that expanded into new cities faster than regulators could respond. It also produced a company where a certain type of behaviour was tolerated, then normalised, then baked into the operating system.

The warning signs were there for years before anyone outside the company bothered to notice. Or more accurately, people noticed but the growth numbers made it easy to look away. A company doubling revenue every few months buys a lot of patience from investors and press.

The thing about building a “culture of builders,” as Travis would later describe it, is that the word “culture” can justify almost anything. Move fast and break things. Win at all costs. The competitor is the enemy. These phrases sound exhilarating in a pitch deck and look terrible in a courtroom deposition.

Travis acknowledged this, obliquely, in the TBPN interview. He talked about CSS/Atoms differently: “You then build a culture of builders. You build a culture of people that want to build and do not need to be famous when they do it.” The emphasis on not needing fame felt like a deliberate contrast with the old Uber, where fame and infamy were two sides of the same coin.

Act III: The fall

The destruction of Travis Kalanick’s career at Uber took exactly four months. From Susan Fowler’s blog post in February 2017 to his forced resignation in June, the sequence of events moved with the mechanical precision of a controlled demolition.

Except nobody was in control.

Susan Fowler lights the fuse

On February 19, 2017, Susan Fowler, a site reliability engineer at Uber, published a blog post titled “Reflecting on one very, very strange year at Uber.”

The post went viral. Not in the usual sense of getting a lot of retweets and then being forgotten. It went viral in the sense that it made every subsequent allegation about Uber’s culture land with the force of confirmation rather than accusation.

Uber hired Eric Holder, the former U.S. Attorney General, to investigate. The Holder investigation produced 47 recommendations. On June 6, more than 20 employees were fired. The investigation validated Fowler’s account and revealed that the problems were deeper than anyone outside the company had acknowledged.

The worst week imaginable

And then, in the middle of all of this, the worst possible thing happened.

On May 26, 2017, Travis’s mother Bonnie Kalanick, 71 years old, died in a boating accident at Pine Flat Lake in Fresno County. His father Donald, 78, was seriously injured in the same accident.

Travis was grieving. He was also, simultaneously, the CEO of a $68 billion company under investigation for systemic cultural failures, facing calls for his resignation from investors, board members, and the press.

There is no playbook for surviving both at once.

What happened next is the part of this story where reasonable people can disagree about who was right and who was wrong, but nobody can disagree about the cruelty of the timing.

The letter

On June 20, 2017, less than a month after his mother’s death, five major investors delivered a letter to Travis titled “Moving Uber Forward.” The signatories were Benchmark, First Round Capital, Lowercase Capital, Menlo Ventures, and Fidelity. The letter demanded his resignation.

Travis was in Chicago when he received it. Bill Gurley of Benchmark led the push. Gurley resigned from the Uber board one day after Travis stepped down.

Travis addressed this directly in his Atoms manifesto:

“I left Uber in 2017 heartbroken. I had been torn away from an idea and a movement that I had poured my life into.”

And then, more pointedly:

“It was only days after the death of my mother and the near death of my father in a boating accident when an investor decided to come out from the shadows and exploit this vulnerable moment.”

You can read that as self-serving revisionism. You can also read it as a man describing what it felt like to be pushed out of his own company while burying his mother.

Both readings can be true simultaneously.

The legal aftermath

Benchmark sued Travis for fraud in August 2017. The suit was dismissed in January 2018. In the interval, it served its purpose: keeping Travis away from any attempt to reclaim control.

Travis sold his entire Uber stake between November and December 2019, reportedly realising $2.5-3 billion. He resigned from the Uber board on December 24, 2019.

Christmas Eve.

(The symbolism, intentional or not, was hard to miss.)

Making sense of the exit

Look, there’s a version of this story where Travis is the villain, and parts of that version are supported by evidence. The culture problems at Uber were real. The Holder investigation confirmed them. More than 20 people lost their jobs. Susan Fowler’s experience was not an isolated incident.

There’s also a version where a group of investors used a genuine crisis as cover to execute a long-planned power grab, timing their move to coincide with the most vulnerable moment of their target’s life. Benchmark’s behaviour, in particular, has aged poorly. You don’t lead a campaign to oust a CEO and then resign from the board the next day unless you were more interested in the ouster than in the company.

The truth is probably messier than either version. Uber needed to change. Travis was likely incapable of leading that change, or at least unwilling to. The investors who forced him out were probably right about the diagnosis and wrong about the treatment, and ugly in their execution.

“I bled, but I did not perish. I got back up and fought my way back into the arena, back to my calling. Back to building.”

That’s from the manifesto. It’s dramatic. It’s also, as the next eight years would demonstrate, accurate.

The Levandowski file

Anthony Levandowski is the engineer whose talent for autonomous driving was matched only by his talent for creating legal catastrophes. His saga intersected with Travis’s at the worst possible time, and now, improbably, they’re working together again.

The engineer who started it all

Anthony Levandowski co-founded Google’s self-driving car programme in 2009. He’d previously created 510 Systems, which Google acquired. By most accounts, he was one of the top autonomous vehicle engineers in the world. He was also, by most accounts, not someone who spent a lot of time worrying about employment agreements.

The Otto acquisition

In 2016, Travis hired Levandowski by acquiring his startup Otto, a self-driving truck company. This was part of Uber’s broader push into autonomous vehicles, which Travis had kicked off by establishing a self-driving unit in Pittsburgh in 2015. The strategic logic was sound: if ride-sharing was the business, then removing the driver was the obvious long-term play.

The execution, however, created one of the most expensive legal disasters in Silicon Valley history.

14,000 files

In February 2017, the same month Susan Fowler published her blog post, Waymo (Google’s self-driving car subsidiary) sued Uber. The allegation: Levandowski had downloaded 14,000 confidential files from Google before leaving to start Otto, and those files had made their way to Uber.

The lawsuit settled in February 2018, with Uber paying 0.34% of its equity to Waymo, worth approximately $245 million. That’s a lot of money, but given the potential damages, it was widely viewed as Uber getting off relatively lightly.

Levandowski did not get off lightly.

Criminal prosecution

He was criminally charged in August 2019. In August 2020, a federal judge sentenced him to 18 months in prison. The judge called it “the biggest trade secret crime I have ever seen.”

The judge called the Levandowski case “the biggest trade secret crime I have ever seen.”

Federal judges in Northern California see a lot of intellectual property cases. For a judge to use superlatives on the record means the conduct was extraordinary.

The pardon and the pivot

On January 20, 2021, Donald Trump’s last day in office, Levandowski received a presidential pardon. Peter Thiel reportedly supported the pardon effort. The pardon erased the criminal conviction but couldn’t erase the public record.

Levandowski had founded Pronto in 2018, while still facing criminal charges. Pronto completed the first fully autonomous coast-to-coast drive. In 2024, Pronto pivoted to mining and industrial autonomy.

And Travis Kalanick is Pronto’s largest investor. During the TBPN interview, Travis confirmed that an acquisition of Pronto was closing imminently. The man who was forced out of Uber partly because of the Levandowski scandal is now bringing Levandowski back into the fold.

The reunion nobody expected

This is one of those facts that’s hard to know what to do with. Levandowski committed what a federal judge called the biggest trade secret crime in history. He was pardoned, but the conduct remains a matter of public record. And Travis is not only working with him again but acquiring his company.

There are two ways to read this. The generous reading: Levandowski paid his price, received a pardon, and has spent the years since building a legitimate business in industrial autonomy. People deserve second chances, and Pronto’s technology in mining automation is apparently real. Travis, who knows Levandowski’s capabilities better than almost anyone, is making a rational bet on the engineer’s talent.

The less generous reading: Travis Kalanick, who has described himself as someone who “never left” the arena, is also someone who has never been willing to let a moral complication get in the way of a strategic advantage. The Levandowski hire at Uber was a disaster. Doing it again suggests either extraordinary confidence in Levandowski’s reformation or a familiar pattern of valuing talent over everything else.

Both readings, again, can be true.

Act IV: The ghost kitchen years

City Storage Systems was supposed to be Travis Kalanick’s quiet second act. Instead, it became a $15 billion bet on an industry that largely collapsed, a sandbox for building something nobody expected, and the answer to the question nobody was asking: what does a disgraced tech founder do with $3 billion and a grudge?

The acquisition

In March 2018, three months after Benchmark’s lawsuit was dismissed, Travis bought a controlling interest in CloudKitchens (originally founded in 2016 by Diego Berdakin, Sky Dayton, and Barak Diskin in Los Angeles) for $150 million. He became CEO.

The business model was straightforward. Buy cheap commercial real estate. Convert it into shared kitchen spaces for delivery-only restaurants. Rent those spaces to operators who wanted to reach the delivery market without the overhead of a storefront.

Saudi money

In January 2019, Saudi Arabia’s Public Investment Fund invested $400 million in CSS. The Saudi PIF’s involvement raised immediate ethical questions, coming just months after the murder of journalist Jamal Khashoggi. Travis didn’t address the Saudi investment directly in any public forum. The money spoke for itself: Four hundred million dollars buys a lot of kitchen equipment.

Travis’s own commentary on easy money, made in the TBPN interview while discussing SoftBank’s Vision Fund era, applies here too: “It was easy money. And it was too loose.”

The COVID boom and the $15 billion valuation

The pandemic hit in March 2020. Restaurants closed. Delivery exploded. CloudKitchens, which existed to serve delivery-only restaurants, was suddenly in the right place at the right time.

CSS launched Otter in 2020, a restaurant management platform that would eventually touch 18% of all US online delivery orders, with over 100,000 restaurant point-of-sale systems at $69 per month. Otter was arguably a more important business than the kitchens themselves. Software that integrates with that much order volume has its own gravity.

In November 2021, CSS raised $850 million at a $15 billion valuation. Microsoft was among the investors. Total funding for the company reached somewhere between $1.25 and $1.75 billion¹.

The company expanded to more than 400 locations across 110+ cities in 30+ countries. On paper, it looked like Travis had done it again. Built a company at absurd speed, raised capital at absurd valuations, and gone global within a few years.

The ghost kitchen crash

And then the industry fell apart.

Ghost kitchens, as a category, turned out to be harder than the COVID boom suggested. Kitchen United, backed by Kroger, collapsed in 2023. Reef, backed by SoftBank, was shut down by health departments. At five CSS locations where data was available, the failure rate for tenant restaurants was 58%².

CSS itself went through layoffs and closures in 2023. The company entered what industry watchers called “hibernation mode.” A planned Middle East IPO was delayed in late 2025.

The 58% failure rate at ghost kitchen locations is a damning number. It means more than half the restaurants operating out of CSS kitchens didn’t survive. The model’s economics (cheap rent in exchange for no customer-facing presence) turned out to be less attractive than they looked. Without foot traffic, without a brand presence on a street, restaurants in ghost kitchens were entirely dependent on delivery platform algorithms for customers. And those algorithms favoured whoever paid the most for placement.

There were culture problems too. Business Insider reported in 2021 that CloudKitchens had a “temple of bros” culture. Lawsuits were filed. For a founder whose previous company was undone partly by cultural failures, this was, to put it mildly, not a great look.

Lab37 and the pivot nobody saw

Almost nobody noticed what was happening in a different part of the company. While the ghost kitchen business contracted, a robotics division was growing.

In 2023, CSS unveiled Lab37, a robotics and automation division headed by Eric Meyhofer, who’d previously run Uber’s Advanced Technologies Group (the self-driving unit). Lab37 built the Bowl Builder, a machine capable of assembling 300 bowls per hour (200 with an automated bagger), using 18 food dispensers.

A robot that makes 300 salad bowls an hour is not a moonshot. It’s not going to make the cover of Wired. But it’s a machine that solves a specific, measurable problem: the cost and consistency of food assembly in high-volume delivery kitchens. It works. It makes money. It doesn’t need to look like a human.

“Somebody asked me, like, we have a bunch of roboticists... is AI going to help us design food machines? Dude, let me show you. AI can’t even do freaking math.”

Travis’s comment on the TBPN podcast was directed at the gap between AI hype and physical-world engineering. Designing a machine that reliably dispenses 18 different ingredients into bowls at commercial speed is a mechanical engineering problem. GPT-4 can’t do it. Claude can’t do it. You need people who understand motors and food-safe materials and cleaning cycles.

The ghost kitchen business, in this reading, was never the point. It was the sandbox. The real-estate portfolio gave Travis commercial kitchens where his roboticists could test and iterate on food automation equipment in a production environment. Every failing ghost kitchen was, in a sense, a laboratory.

That’s the revenge-arc narrative, and it’s almost too clean. The truth is probably that Travis believed ghost kitchens would work, got hit by an industry downturn, and pivoted to robotics because the talent and infrastructure were already in place. The sandbox theory gives him too much credit for foresight and not enough blame for the $15 billion valuation that now looks extremely generous.

But the pivot happened. And it led to Atoms.

Act V: The return

On March 13, 2026, City Storage Systems officially became Atoms. CloudKitchens was rolled into a subsidiary called Atoms Food. Two new divisions launched alongside it: Atoms Mining and Atoms Transport. The manifesto at atoms.co/vision laid out a philosophy of physical AI that was, in Travis’s characteristic style, both grandiose and oddly specific.

The 2025 regret

The Atoms launch didn’t come out of nowhere. In March 2025, a full year before the rebrand, Travis told an interviewer: “Wish we had an autonomous ride-sharing product right now.” The comment was widely interpreted as wistful. In retrospect, it was a preview.

Travis had reportedly tried to acquire the US arm of Pony AI in 2025. That deal fell through. Whatever happened in those negotiations, the failure seems to have accelerated Travis’s timeline for building his own autonomous vehicle capability.

The manifesto

The atoms.co/vision manifesto is worth reading in full, but the key framework is a computer science metaphor that Travis clearly spent time developing:

CPU manipulates bits. What manipulates atoms? Manufacturing.

He extended the analogy: if manufacturing is the CPU of the physical world, then real estate is storage, and transport is the network. Atoms, the company, was positioning itself to operate across all three.

“CPU manipulates bits. What manipulates atoms? Manufacturing.”

It’s a clever framework. Whether it’s more than a framework remains to be seen. But it does something that most startup manifestos fail to do: it gives you a mental model for understanding why a company that runs ghost kitchens, builds mining robots, and wants to operate autonomous vehicles is actually one company and not three random businesses sharing a cap table.

“Gainfully employed robots”

The phrase Travis kept returning to in the TBPN interview was “gainfully employed robots.” The idea is simple: build robots that are specialised for a specific task, that can generate revenue doing that task, and that are designed for the job at hand rather than designed to look like a person.

This is a direct shot at the humanoid robotics movement. Figure AI had just raised over $1 billion at a $39 billion valuation. Companies across the industry were pouring money into building machines that walk on two legs, have hands with fingers, and can theoretically do “anything.”

Travis thinks this is stupid. Well, he didn’t use that word. He used a better one.

“Dude, could you imagine if that thing [humanoid] had wheels? That’d be crazy.”

The pancake analogy came up during the interview. Travis described watching a humanoid robot attempt to flip pancakes at a demonstration and pointed out that a purpose-built pancake machine would be faster, cheaper, and more reliable. The humanoid form factor is a solution in search of a problem, unless the problem is “we want robots that look cool on Instagram.”

His phrase for the platform was “wheelbase for robots,” analogous to a car’s chassis. The idea: Atoms builds the base platform (locomotion, power, sensors, connectivity) and then attaches specialised tooling for each use case. A mining robot and a food assembly robot share a platform but have entirely different working ends.

The Pronto acquisition

The most significant piece of news from the interview was the Pronto acquisition. Travis confirmed he’s Pronto’s largest investor and that the deal was closing imminently.

Pronto, founded by Anthony Levandowski in 2018, completed the first autonomous coast-to-coast drive and then pivoted to mining and industrial autonomy in 2024. The acquisition gives Atoms a ready-made autonomous driving stack and a team that has spent years working in industrial environments.

“The industrial thing is sort of like, probably, our main jam.”

Travis said this almost casually, but it cuts against the assumption that Atoms Transport (and by extension, ride-sharing) would be the company’s primary focus. Mining is the starting point. Not taxis.

“Mining is a no-brainer.”

The logic: mines are controlled environments. No pedestrians. No cyclists. No school zones. Predictable routes. High labour costs in dangerous conditions. If you’re going to deploy autonomous vehicles, you start where the regulatory burden is lowest and the economic case is strongest.

The computer science of the physical world

Travis’s full framework, laid out across the interview and the manifesto, is more coherent than you’d expect from a guy best known for disrupting taxis:

The framework is tidy, maybe too tidy. Real businesses are messier than metaphors. But as a way of explaining to investors and recruits why these three divisions belong under one roof, it works.

“The boring places are the places.”

This might be the most revealing line from the entire interview. Travis Kalanick, the man who built the most attention-grabbing startup of the 2010s, is now arguing that the best opportunities are in industries nobody finds exciting. Mining. Food logistics. Industrial automation. The opposite of disrupting taxis in San Francisco.

The Uber irony: full circle

The board that forced Travis Kalanick out of Uber in 2017 may now need his help getting back in. According to The Information, Uber is providing “major backing“ for Travis’s self-driving venture. The irony is so thick you could spread it on toast.

Uber’s autonomous vehicle problem

Uber’s relationship with autonomous driving has been, to put it charitably, inconsistent. Travis built the self-driving unit in Pittsburgh in 2015. He acquired Otto and Levandowski in 2016. The Waymo lawsuit, the fatal pedestrian accident in Tempe, and Travis’s ouster collectively destroyed the programme’s momentum. In December 2020, Uber sold its Advanced Technologies Group to Aurora for roughly $4 billion, investing $400 million in Aurora as part of the deal.

Since then, Uber has tried to participate in the autonomous vehicle revolution without actually building autonomous vehicles. Partnerships with Waymo (which now operates in 10 US cities with over 3,000 robotaxis), an “Autonomous Solutions” division launched in February 2026, and a partnership with NVIDIA targeting 100,000 autonomous vehicles starting in 2027.

But the results haven’t followed. Uber’s Q4 2025 earnings missed analyst expectations: earnings per share came in at $0.71 versus the $0.78 estimate, the company’s first miss in seven quarters. The stock dropped 12% in the three months before the Atoms launch.

The man with the plan

Travis has reportedly told people he “wants to be more aggressive than Waymo.” That’s a hell of a statement, given that Waymo has spent over a decade and billions of dollars building its autonomous driving stack. But it’s also classic Travis: set the most ambitious possible target and then dare people to bet against you.

The Uber connection makes strategic sense for both sides. Uber has the ride-sharing network, the brand, and the customer base, but no autonomous vehicles. Atoms has autonomous vehicle technology (potentially) through the Pronto acquisition, but no ride-sharing network. The puzzle pieces fit.

“When I get hit up... it’s usually when the shit is about to hit the fan.”

Travis said this on the podcast, and it’s hard not to read it as a reference to Uber’s recent struggles. The company that forced him out is now, reportedly, coming back to him for help.

“I should give them a call and be like, dude, let’s cook.”

He grinned when he said it. The hosts laughed. But beneath the bravado is a real calculation. Travis Kalanick might be the only person in the world with the combination of ride-sharing expertise, autonomous vehicle ambition, and personal grudge necessary to build what Uber needs.

GM’s cautionary tale

The competitive field provides context for why Uber might be willing to swallow its pride. GM killed Cruise in December 2024 after sinking roughly $10 billion into the programme. Ten billion dollars, gone. Tesla promises a robotaxi in Austin starting June 2025, with Elon Musk claiming widespread deployment by the end of 2026. Aurora has logged over 100,000 driverless miles and is targeting hundreds of autonomous trucks by the end of 2026.

2026 has been called “the year of the robotaxi.” If that label proves accurate, Uber’s lack of its own autonomous technology goes from embarrassing to existential. And the man they threw out nine years ago is the one building what they need.

The contrarian robot bet

The global robotics industry attracted over $10.3 billion in funding in 2025. The hottest category, by far, was humanoid robots. Figure AI’s valuation hit $39 billion. Beijing hosted a humanoid Olympics featuring robots running a half-marathon. The narrative is loud, well-funded, and everywhere. Travis Kalanick thinks it’s mostly wrong.

The case against humanoids

Travis’s anti-humanoid argument isn’t based on the technology being impossible. It’s based on the technology being pointless for most commercial applications. A humanoid robot is designed to operate in environments built for humans: stairs, doors, desks, kitchens. The argument for humanoids is that they can work anywhere a human can.

Travis’s counterargument: why would you want that?

A mining robot doesn’t need legs. It needs wheels, a low centre of gravity, and sensors calibrated for dark, dusty, GPS-denied environments. A food assembly robot doesn’t need fingers; it needs precise dispensers and food-safe surfaces. A delivery robot doesn’t need to climb stairs. It needs wheels and a cargo bay.

The point is sharp. Wheels are more efficient than legs for flat surfaces. Adding legs to a robot that primarily operates on flat surfaces is adding complexity, cost, and failure modes for no functional benefit.

The pancake problem

The Beijing humanoid Olympics is a useful case study. Humanoid robots attempted a half-marathon. Some of them fell over. The spectacle was entertaining but commercially meaningless.

Nobody is going to pay a robot to run a half-marathon. The same money spent on specialised mining vehicles or food assembly machines would generate actual revenue.

This is what Travis means by “gainfully employed robots.” A robot that can run a half-marathon is a demonstration. A robot that assembles 300 bowls per hour is a business. The Bowl Builder isn’t going to win any design awards, but it replaces human labour at a specific task more cheaply and consistently than any alternative.

NVIDIA and the physical AI ecosystem

Travis’s timing aligns with a broader industry shift. NVIDIA, the company whose GPUs powered the AI boom, has been pushing hard into what Jensen Huang calls “physical AI”: the application of AI to robotics and real-world automation. At GTC 2025, Huang devoted most of his keynote to physical AI, declaring that “the next wave of AI will be in the physical world.” The message was clear. NVIDIA sees a future where its hardware runs inside robots, not just data centres.

The toolchain is already taking shape. NVIDIA’s Omniverse platform provides simulation environments where companies can train robots in digital twins of real facilities before deploying them. Isaac Sim handles robotics-specific simulation. The Jetson platform provides edge computing for robots that need to process sensor data in real time without a cloud connection. And the DGX systems that train foundation models are increasingly being used to train what NVIDIA calls “world models,” AI systems that understand physical space, object permanence, and the messy unpredictability of the real world.

The ecosystem is attracting capital at pace. Agility Robotics raised $150 million to build Digit, a warehouse robot. Apptronik is building Apollo for manufacturing lines. Covariant (acquired by Amazon) focuses on warehouse picking. Sanctuary AI is training robots on dexterous manipulation.

Each of these companies is building on NVIDIA’s hardware stack. The Uber-NVIDIA partnership targeting 100,000 autonomous vehicles by 2027 is one manifestation of the trend. NVIDIA is building the operating system for the entire physical AI industry, not just selling chips to individual robot companies.

Atoms sits at an interesting point in this ecosystem. Most robotics startups build in labs and simulate in Omniverse. Atoms has actual physical operations: commercial kitchens, real estate holdings, and (through Pronto) mining sites where robots can be tested and deployed in production environments. The gap between simulation and reality is where most robotics companies stumble. Having hundreds of real-world locations where you can iterate on hardware is a genuine advantage, and it’s one that came from the ghost kitchen years, whether or not Travis planned it that way.

Mining as the first vertical

Travis’s reasoning starts with the environment itself. Mines are geo-fenced. There are no pedestrians, no cyclists, no school zones, no children chasing a ball into the road. The routes are repetitive: haul trucks travel the same paths between the pit and the dump site, hundreds of times a day. Operations run around the clock, which means a robot that can work three shifts generates three times the value of one that works alongside a human crew on a single shift.

The labour economics are brutal. Mining is one of the most dangerous industries on earth. Fatality rates are high. Recruitment is hard. Many mines operate in remote locations where attracting workers means paying premiums and flying people in on rotational schedules. An autonomous haul truck doesn’t need fly-in fly-out accommodation, doesn’t need rest breaks, and doesn’t file workers’ compensation claims.

The regulatory environment is also simpler than public roads. Mine sites are private property. The vehicles operating on them don’t need road registration. There’s no equivalent of the National Highway Traffic Safety Administration demanding years of testing data before granting deployment permits. A mining company that wants to deploy autonomous vehicles on its own site can, in most jurisdictions, just do it.

This isn’t hypothetical. Caterpillar and Komatsu have been running autonomous haul trucks in Australian iron ore mines for years. Rio Tinto’s autonomous fleet in the Pilbara has hauled over four billion tonnes. But these systems are proprietary, expensive, and tied to specific OEM equipment. The opportunity Travis sees is building an open autonomy stack that works across equipment types and mine configurations, the same “wheelbase for robots” concept applied to 200-tonne dump trucks.

The Pronto acquisition gives Atoms an immediate capability here. Pronto pivoted to mining and industrial autonomy in 2024, and its autonomous driving technology adapts more naturally to mine haul roads than to urban intersections. The sensors, the path planning, the obstacle avoidance: all of it is simpler when the obstacles are rocks and berms rather than pedestrians and traffic lights.

The progression Travis outlined is: prove the technology in mining, where the environment is controlled. Expand to food and industrial settings, where the environment is semi-controlled. Then, eventually, tackle transport and public roads, where the environment is uncontrolled and the regulatory burden is heaviest.

It’s a patient strategy. From the guy who launched Uber in city after city without waiting for regulatory approval, patience is unexpected. But Travis is fifty now, not thirty. And he’s watched enough companies (Cruise, Otto, Uber ATG) crash into the autonomous vehicle wall to know that the frontal assault doesn’t always work.

The disgraced-founder pattern

Travis Kalanick is worth $3.6 billion, according to Forbes as of March 2026. He runs a company that just rebranded with a manifesto and a podcast appearance, is acquiring autonomous driving technology, and is negotiating with his former company. By any objective measure, he never stopped having resources and power. The “comeback” framing is itself a kind of fiction.

The Neumann parallel

The most obvious comparison is Adam Neumann. Forced out of WeWork in a spectacular public collapse. Spent a few years in relative obscurity. Then launched Flow, a residential real estate startup. Andreessen Horowitz invested $350 million at a $1 billion valuation. By 2025, Flow had raised over $100 million more at a $2.5 billion valuation.

The pattern: build a company. Get thrown out in disgrace. Use the money, connections, and name recognition from round one to launch round two. The market rewards it because investors are ultimately betting on the founder’s ability to attract talent, raise capital, and impose their will on an industry. Moral track records don’t show up in financial models.

The scapegoat theory

Forbes published an analysis of Kalanick’s trajectory using Rene Girard’s scapegoat theory. The argument, roughly: communities under stress select a single individual to bear collective guilt. Punishing the scapegoat restores social order. The scapegoat’s actual culpability is secondary to their symbolic function.

Applied to Travis: Uber’s cultural problems were real, but they weren’t unique to Uber. The tech industry in the mid-2010s had similar issues across dozens of companies. Travis became the face of those problems because Uber was the biggest company and he was the most visible founder. His ouster served a cathartic function for an industry that needed someone to blame without examining its own structures.

It’s an interesting framework. It’s also the kind of analysis that people who’ve been treated badly find deeply convenient. Travis linking to it or endorsing it would be the equivalent of saying “I was sacrificed for everyone else’s sins.” The fact that he hasn’t, at least not explicitly, suggests some self-awareness about how that would land.

The plumber analogy

The most surprising moment in the TBPN interview came when Travis was talking about the kinds of people he wants to hire. He didn’t talk about Stanford PhDs or ex-Google engineers. He talked about plumbers.

“Those guys, each and every plumber would be like LeBron. Because plumbing is the long pole in the tent to progress.”

It’s an odd analogy, but it reveals something about where Travis’s head is. He’s not interested in hiring people who want to be famous for building robots. He’s interested in hiring people who want to build things that work. Plumbing isn’t glamorous. Neither is food assembly automation. Neither is mining vehicle autonomy.

“The boring places are the places.” He said it on the podcast and he meant it. The man who built the most glamorous startup of the 2010s now believes the future belongs to people willing to do unglamorous work in unglamorous industries.

“I never left”

“The thing is, I never left.”

That was how Travis ended his manifesto. It’s the kind of line that a PR team would have workshopped for weeks. And honestly, in my opinion, it lands better than it should.

Because he didn’t leave. He lost Uber, lost his mother, sold his shares, and started building again within months. The ghost kitchens might have crashed. The culture problems might have followed him. The Saudi money raises ethical questions he still hasn’t answered.

But the building didn’t stop.

Whether the building adds up to something remains the open question. Atoms is still mostly manifesto and podcast at this point. The Pronto acquisition hasn’t closed. The Uber partnership, if it materialises, is years from producing an autonomous vehicle on a public road. Mining automation is promising but early. The food robotics work is real but small-scale.

Travis Kalanick is fifty years old, worth $3.6 billion, and running a company that just came out of stealth after eight years. He’s reuniting with the engineer whose trade secret theft contributed to his downfall. He’s reportedly in talks with the company that forced him out. He’s betting against the humanoid robot consensus with specialised machines that do boring work in boring places.

He might be right. The last time he bet against consensus, he built a company worth $68 billion. The time before that, he spent four years without a salary and sold a company for $19 million and called it the happiest day of his life.

“Chaos was the law of nature; Order was the dream of man.” — Henry Adams

Travis put that Henry Adams quote in his manifesto. It’s the kind of line a founder puts in a manifesto when they want you to know they’ve read books. But it also describes his career with uncomfortable precision.

He thrives in chaos. The question is whether Atoms will be the kind of chaos that produces a $68 billion company or the kind that produces a $19 million exit.

Given the track record, I wouldn’t bet against him. But I wouldn’t bet the house on him either. The man is talented, driven, and difficult. The robots don’t care about any of that. They just need to work.

1 CloudKitchens’ total funding figures are estimated in the range of $1.25-1.75 billion due to the company’s extreme opacity about its finances during the stealth period. The $850 million round at $15 billion was the only raise confirmed by multiple sources.

2 The 58% failure rate figure comes from data available for five CSS locations and may not be representative of the company’s full 400+ location portfolio. CSS has not released full performance data.

3 Travis’s claim to have “cleared 3 million” from the Red Swoosh exit while the acquisition price was $19 million implies significant dilution, debt, or preference structures that ate into his founder stake, which is typical for a company that operated for six years on minimal funding.

The machine that turns itself off

In Claude Shannon’s house in Winchester, Massachusetts, there sat a small wooden box with a single toggle switch on its lid. Flip the switch, and the box would whir to life. The lid would crack open. A mechanical hand would emerge, reach over, and flick the switch back off.

Then the hand would retreat.

The lid would then close.

Silence.

That was it. That was the entire function of the machine.

Shannon called it the “Ultimate Machine.” The concept came from Marvin Minsky, the future co-founder of MIT’s AI lab, who had sketched the idea but never bothered building it. Shannon, who could never resist a good gadget, built it. Arthur C. Clarke, the science fiction writer who dreamed up the satellite and co-wrote 2001: A Space Odyssey, saw the device and called it “unspeakably sinister.”

He wasn’t entirely joking.

There’s something about a machine whose sole purpose is to negate your action, to refuse the premise of its own existence, that crawls under your skin. You turn it on. It turns itself off.

You become intertwined in a loop with an object that wants nothing from the world except to be left alone.

Clarke reportedly couldn’t stop playing with it. Neither could anyone else who encountered the thing. Shannon kept several versions around the house, including one he liked to bring to dinner parties.

The Ultimate Machine is the perfect entry point to Claude Elwood Shannon because it contains all of his contradictions in a single wooden box.

Here was a man who produced one of the most important scientific papers of the twentieth century and spent roughly equal creative energy building a gasoline-powered pogo stick. A man who laid the mathematical groundwork for every smartphone, every Wi-Fi signal, every streaming service, every piece of digital communication on earth, and who also built a flame-throwing trumpet. A man whose work is baked into the infrastructure of modern civilisation so thoroughly that most people have never heard his name.

The most important scientist most people can’t name was also, by every available account, the funniest.

Shannon published “A Mathematical Theory of Communication” in 1948. With it, he created an entire scientific discipline from scratch, information theory, and gave the world the “bit,” the fundamental unit of the digital age. He proved theorems that told engineers exactly how much information could be squeezed through a noisy channel.

He connected Boolean algebra to electrical circuits, making the digital computer possible. He helped encrypt the phone calls between Roosevelt and Churchill during the Second World War. He built one of the earliest chess-playing programs and one of the first maze-solving robots. He co-organised the 1956 Dartmouth Workshop, the conference that gave artificial intelligence its name.

And then he went home and rode a unicycle through the hallways of Bell Labs while juggling three balls.

Shannon died in 2001, at eighty-four. By then the internet had remade the world along lines he had mathematically predicted were possible. But Alzheimer’s had taken him years earlier.

He never saw what his ideas became, and he’d probably be aghast and amused at the same time if he were still living.

Twenty-two years after his death, a company called Anthropic launched an AI assistant and named it Claude.

Whether the name honours Shannon specifically remains, as we’ll see, a matter of company lore rather than official confirmation. But the intellectual lineage is a different question entirely. Shannon’s entropy is in the loss function that trains the model. His Boolean algebra is in every transistor of the hardware that runs it. His theory of communication is the mathematical language the system operates in.

The machine that turns itself off. The ideas that never do.

The boy who wired Gaylord, Michigan

Claude Elwood Shannon was born on 30 April 1916 in Petoskey, Michigan, a small lakeside town on the shores of Lake Michigan. He grew up in Gaylord, about fifty kilometres south, population roughly three thousand. His father, also named Claude, was a probate judge and businessman. His mother, Mabel Wolf Shannon, was a high school principal and a language teacher. Neither was a scientist. Both were practical, educated midwesterners who valued competence over show.

Young Claude took to the “competence” part immediately. He spent his childhood taking things apart. Radios, mostly. He’d fix them for a local department store, earning pocket money by doing work that most adults in Gaylord couldn’t manage. He became a Western Union messenger boy, delivering telegrams on his bicycle and absorbing, almost by osmosis, the mechanics of electrical communication.

The telegraph obsessed him. At some point during his childhood, Shannon and a neighbourhood friend strung a barbed-wire telegraph line between their two houses, half a mile apart. They used the barbed wire from the fences that lined the farmers’ fields between them. It worked. Two kids in rural Michigan, tapping out messages across a jerry-rigged wire held up by fence posts, years before either of them could have explained the physics of what they were doing.

His childhood hero was Thomas Edison. Much later, Shannon discovered this was more than idle admiration: he and Edison were both descended from John Ogden (1609-1682), a colonial settler, making them distant cousins.

Shannon loved the connection. Edison was the great American tinkerer, the man who turned invention into an industrial process. Shannon would become something different: a theorist who tinkered, or a tinkerer who theorised. The Edison kinship suited both halves of his personality.

He was also a reader. Edgar Allan Poe’s short story “The Gold Bug,” a tale of code-breaking and hidden treasure, captivated him as a boy. Poe’s story is about a man who decodes a substitution cipher to find Captain Kidd’s buried gold. It’s about the thrill of extracting a message from apparent nonsense, of finding signal in noise. Shannon would spend his professional life doing exactly this, except he’d do it with mathematics instead of a magnifying glass.

Shannon’s childhood contained the blueprint for everything that followed: wires, codes, puzzles, and an instinct for building things that worked.

In 1932, at sixteen, Shannon enrolled at the University of Michigan. He studied both mathematics and electrical engineering simultaneously, earning dual bachelor’s degrees in 1936.

The combination was unusual. Engineers built things. Mathematicians proved things. Shannon refused to pick a side, a refusal that would turn out to be the single most productive intellectual decision of the twentieth century.

After Michigan, he went to the Massachusetts Institute of Technology as a research assistant. His supervisor was Vannevar Bush, one of the most influential scientists in America, who would later direct the Office of Scientific Research and Development during the Second World War and write the famous essay “As We May Think.” Bush was building a machine called the differential analyser², an analogue computer that could solve differential equations using a system of gears, shafts, and rotating discs. It was the most advanced computing device of its era, and it was entirely mechanical.

Shannon’s job was to maintain and operate the analyser. The work put him face-to-face with the practical reality of computation: the gears that slipped, the shafts that stuck, the relay circuits that controlled the whole assembly.

He was twenty years old, working with the most complex machine on the planet, and he started to notice something about those relay circuits that nobody else had formalised.

The circuits were either open or closed.

On or off. True or false.

Are you getting where we’re going?

He’d seen this somewhere before. In his maths classes.

The most important master’s thesis of the twentieth century

In 1937, at twenty-one years old, Claude Shannon submitted his master’s thesis at MIT. It was called “A Symbolic Analysis of Relay and Switching Circuits.” It was ninety pages long.

It changed the world.

The insight was this: the on-off behaviour of electrical relay circuits could be described using Boolean algebra, the system of logic developed by George Boole in the 1850s that dealt in binary values, true and false. Shannon showed that Boole’s logical operators (AND, OR, NOT) mapped directly onto the physical behaviour of electrical switches arranged in series and parallel. A circuit with two switches in series performed a logical AND: both had to be closed for current to flow. A circuit with two switches in parallel performed a logical OR: either one could be closed. A normally-closed switch performed a NOT.

This sounds simple now. In 1937, it was a thunderclap.

Before Shannon’s thesis, engineers designed switching circuits by intuition and trial and error. They drew diagrams. They tested combinations. They relied on experience and guesswork.

There was no systematic method for designing a circuit to perform a specific logical function, and no way to prove that a design was optimal. Shannon provided both. He showed that any logical expression written in Boolean algebra could be directly translated into a circuit, and that the rules of Boolean algebra could simplify circuits, reducing the number of switches needed.

Howard Gardner called it “possibly the most important, and also the most famous, master’s thesis of the century.”

Herman Goldstine, the mathematician who helped build ENIAC, one of the first electronic general-purpose computers, was equally direct. He described Shannon’s thesis as “surely one of the most important master’s theses ever written,” noting that it “helped to change digital circuit design from an art to a science.”

The thesis won Shannon the Alfred Noble Prize, an engineering award given jointly by several American engineering societies. (Not the Nobel Prize; the Nobel in physics or chemistry goes to different work entirely. But in engineering circles, the Alfred Noble Prize was serious recognition for a student barely old enough to drink.)

What made the thesis so powerful wasn’t just the insight itself but its generality.

Shannon hadn’t solved a specific engineering problem. He’d built a bridge between two entire fields (abstract logic and physical engineering) that had previously existed in total isolation from each other.

Boole had developed his algebra as a system of pure thought, a way to formalise human reasoning. He never imagined it would control electrical circuits.

And the engineers who designed telephone switching networks had never imagined that a branch of nineteenth-century philosophy could tell them how to arrange their relays.

Shannon saw the connection that both communities had missed and capitalised on it.

Every digital device you have ever used, every computer, every phone, every tablet, every smart speaker, every car with a microchip, runs on Boolean logic gates. The processors inside them are built from billions of transistors arranged to perform AND, OR, and NOT operations, exactly the operations Shannon described in 1937. The chain runs in a straight, unbroken line from a twenty-one-year-old’s master’s thesis to the device you’re reading this on.

Shannon wasn’t done at MIT. After completing his master’s in electrical engineering, he stayed on and earned a doctorate in mathematics in 1940. His PhD thesis, “An Algebra for Theoretical Genetics,” applied Boolean algebra to problems in population genetics. A completely different field.

Shannon had written two major theses in two different disciplines within three years.

The genetics thesis was solid work, but it didn’t reshape a field the way the switching circuits paper did. Still, the fact that Shannon produced it at all reveals something about how he thought. He wasn’t an engineer with a knack for maths, or a mathematician who liked circuits. He was something rarer: a mind that operated at the level of structure, spotting abstract patterns that connected apparently unrelated domains. Boolean algebra could describe circuits. Boolean algebra could describe genetics. The algebra was the thing. The domain was almost incidental.

He left MIT in 1940 with two graduate degrees, one in electrical engineering and one in mathematics, and a growing reputation as someone the scientific establishment should keep an eye on.

They would.

Bell Labs, the war, and tea with Turing

Shannon joined Bell Telephone Laboratories in 1941, just as America was entering the Second World War. Bell Labs, in Murray Hill, New Jersey, was the research arm of AT&T and arguably the most productive research institution in the history of science. Over the decades, its researchers would invent the transistor, the laser, the solar cell, the charge-coupled device, Unix, the C programming language, and information theory itself. Seven Nobel Prizes would eventually go to Bell Labs scientists.

Shannon fit right in.

His wartime work was classified. He contributed to fire-control systems for anti-aircraft guns, the mathematical machinery that helped gunners lead their targets through the sky. More importantly, he worked on cryptography.

Shannon contributed to SIGSALY³, the system that encrypted voice communications between Franklin Roosevelt in Washington and Winston Churchill in London. SIGSALY was a monster: it weighed over fifty tonnes, filled an entire room, and used a one-time pad system encoded on vinyl records.

But it worked. The Axis powers never cracked it.

Shannon’s thinking about cryptography went far deeper than the engineering. In 1945, he wrote a classified paper called “A Mathematical Theory of Cryptography.” When it was declassified and published in 1949 as “Communication Theory of Secrecy Systems,” it became the founding document of mathematical cryptography. In it, Shannon proved that the one-time pad (a cipher where the key is as long as the message and used only once) is theoretically unbreakable. No amount of computing power, no cleverness of attack, could crack it, as long as the key was truly random and never reused.

He also introduced two concepts that would echo through cryptography for the next eighty years: confusion and diffusion. Confusion means making the relationship between the key and the ciphertext as complex as possible. Diffusion means spreading the influence of each plaintext character across many ciphertext characters, so that changing one letter of the message changes many letters of the encrypted output. These two principles became the theoretical backbone of the Data Encryption Standard (DES) and the Advanced Encryption Standard (AES), the ciphers that protect your bank transactions and your encrypted messages today.

Shannon has been called the “founding father of modern cryptography,” and the title is earned. His 1949 paper is to cryptography what his 1948 paper is to information theory: the moment a craft became a science.

Then there’s the Turing connection.

In early 1943, Alan Turing visited Bell Labs. Turing was in America as part of a liaison between British and American cryptographic operations. He and Shannon had tea together. Multiple times, by Shannon’s later account.

What did they talk about? Thinking machines.

Both men were already interested in the theoretical limits of computation and the possibility that machines might one day think. Shannon had been fascinated by the idea since his time with Vannevar Bush’s differential analyser. Turing had published “On Computable Numbers” in 1936, the paper that introduced the concept of a universal computing machine and laid the foundation for computer science itself.

Neither man disclosed the full details of their conversations, in part because much of their work was classified. But Shannon later confirmed that the discussions ranged across artificial intelligence, the design of computers, and what it would mean for a machine to exhibit intelligent behaviour. Two of the most important minds of the century, sitting in a Bell Labs cafeteria, drinking tea, and casually sketching the future of computing.

There’s a bitter irony in the security arrangements. Shannon himself wasn’t cleared for the major cryptographic projects at Bell Labs. He could explain his theoretical ideas to the cryptographers, but they couldn’t tell him what they were actually using them for. Shannon, characteristically, didn’t seem to mind. He was interested in the theory. What the government did with it was their problem.

Years later, Shannon would demonstrate that a universal Turing machine, the abstract device at the heart of all computing, could be constructed with only two internal states. It was a result of no practical importance and considerable theoretical beauty, exactly the kind of thing Shannon loved.

Share Sulat

The paper that created a science

In the July and October 1948 issues of the Bell System Technical Journal, Claude Shannon published a seventy-nine-page paper called “A Mathematical Theory of Communication.” It is, by a reasonable consensus of engineers, mathematicians, and historians of science, one of the most important scientific papers ever written.

Scientific American called it the “Magna Carta of the Information Age.” It has been cited over 150,000 times on Google Scholar. It created an entire scientific discipline, information theory, from whole cloth. And Shannon, by the accounts of those who knew him, carried the entire thing around in his head for roughly eight years before writing it down.

Robert Gallager, the MIT professor and information theorist, noted that there were no known drafts, no partial manuscripts, no working papers. Shannon worked on the theory throughout the early and mid-1940s, kept it all in his mind, and then wrote it.

Just wrote it.

The bit

The paper’s most famous contribution is the smallest: the bit, short for “binary digit.” Shannon established that the bit, a single yes-or-no, on-or-off, 1-or-0 choice, is the fundamental, irreducible unit of information. Every piece of digital data you have ever encountered, every photograph, every song, every film, every text message, every email, every web page, is composed of bits.

The word “bit” was suggested by John W. Tukey, the Princeton mathematician, as Shannon acknowledged in a footnote in the paper. But the concept, the idea that all information, regardless of its form or content, could be measured and quantified in binary units, was Shannon’s.

“Shannon was the person who saw that the binary digit was the fundamental element in all of communication,” Robert Gallager said. “That was really his discovery, and from it the whole communications revolution has sprung.”

Shannon entropy

The paper’s deepest idea is entropy, Shannon’s measure of information content. Shannon entropy, written as H(X) = -Sum[p(x) log2 p(x)], quantifies the uncertainty or surprise in a message source.

The concept is best understood through a coin flip.

Flip a fair coin. Before it lands, you genuinely don’t know whether it will be heads or tails. The outcome carries maximum uncertainty for a binary event.

Shannon entropy: exactly 1 bit.

Now flip a loaded coin that comes up heads 99% of the time. Before it lands, you already know, with near certainty, that it will be heads.

The outcome carries almost no surprise. The loaded coin carries almost no information because you already knew what was going to happen.

Shannon entropy: close to 0 bits.

Information, in Shannon’s framework, is the resolution of uncertainty. A message is informative to the degree that it tells you something you didn’t already know.

A weather forecast that says “the sun rose this morning” carries essentially zero information. A weather forecast that says “snow in July in Auckland” carries a lot.

There’s a famous anecdote about the name “entropy.” John von Neumann, the mathematician, supposedly told Shannon to call his measure “entropy” because “in the first place, a mathematical development very much like yours already exists in Boltzmann’s statistical mechanics, and in the second place, no one understands entropy, and in a battle of wits you will always have the advantage.” The story is widely repeated. Shannon himself cast doubt on it. In an interview with the journalist John Horgan, Shannon said the remark “sounds like the kind of remark I might have made as a joke.” Whether von Neumann actually said it remains, charitably, unconfirmed.

Channel capacity

Shannon’s second major result was the channel capacity theorem, also called the noisy-channel coding theorem. It states that for any communication channel with a given level of noise, there exists a maximum rate, measured in bits per second, at which information can be transmitted reliably. Below this rate, it’s possible to communicate with an arbitrarily low error rate. Above it, reliable communication is impossible, no matter how clever your encoding scheme.

This was shocking. Before Shannon, engineers assumed that noisy channels would always produce some irreducible level of errors. Shannon proved that noise could be overcome entirely, as long as you stayed below the channel’s capacity and used sufficiently sophisticated coding. The theorem didn’t tell you how to build the codes. It just proved they existed. Engineers spent the next seventy years catching up to Shannon’s theoretical limit, and modern codes like turbo codes and low-density parity-check codes come within a whisker of it.

The Markov chain experiment

Buried in the paper is a section that reads, in retrospect, like a prophecy. Shannon demonstrated that you could generate surprisingly realistic-looking English text using Markov chains, statistical models that predict the next character or word based on the preceding ones.

He started simple. A “zero-order” model picks letters at random, producing gibberish. A “first-order” model picks letters with the same frequency they appear in English, producing something slightly less random. A “second-order” model considers pairs of letters, and the output starts to look vaguely like English. By the time you get to word-level models conditioned on one or two preceding words, the output produces recognisable fragments of English prose, grammatically plausible phrases that almost but don’t quite mean anything.

Shannon’s Markov chain experiment in 1948 is the direct conceptual ancestor of modern large language models. GPT, Claude, Gemini, and every other language model are, at their mathematical core, doing the same thing Shannon described:

They predict the next token based on the preceding context.

The models are incomparably larger and more sophisticated, trained on billions of parameters across trillions of words of text. But the underlying principle (statistical prediction of sequential text) is Shannon’s.

The bandwagon warning

In 1956, Shannon published a short, sharp editorial in the IRE Transactions on Information Theory called “The Bandwagon.” Information theory had become fashionable. Researchers in biology, psychology, linguistics, economics, and half a dozen other fields were rushing to apply Shannon’s framework to their own domains. Shannon was not impressed.

He warned that the “basic results of the subject are aimed in a very specific direction, a direction that is not necessarily relevant to such fields as psychology, economics, and other social sciences.”

He urged caution, intellectual humility, and the recognition that a mathematical theory of communication was not automatically a mathematical theory of everything. The man who created the field was the first to warn against its overuse.

Fun times. The warning went largely unheeded. Look at the world now.

The toymaker of Winchester

Shannon and his second wife, Betty, a mathematician and former colleague at Bell Labs who had worked on fire-control computations during the war, lived in a large house in Winchester, Massachusetts, overlooking the Mystic Lakes. They called it “Entropy House.” It had a two-storey room that Shannon filled, floor to ceiling, with gadgets, contraptions, gizmos, and machines of every description.

The toy room was Shannon’s real laboratory. His office at MIT (where he held a professorship from 1956) and his position at Bell Labs were where he did the work the world cared about. The toy room was where he did the work he cared about.

The juggling mathematician

Shannon was obsessed with juggling. He built multiple juggling machines, including one that featured a W.C. Fields mannequin throwing balls in a cascade pattern. He developed a mathematical theorem for juggling¹: (F+D)H = (V+D)N, where F is flight time, D is the “dead time” a ball spends in the hand, H is the number of hands, V is the time a hand is empty, and N is the number of balls.

Classic Shannon: take something playful, find the mathematical structure hiding inside it, formalise it, then go back to playing.

He rode a unicycle through the corridors of Bell Labs. While juggling. His colleagues, some of the most brilliant scientists and engineers in America, would flatten themselves against the walls as Shannon wobbled past, three balls arcing above his head, grinning.

The inventions

The list of Shannon’s gadgets reads like the catalogue of a very eccentric museum:

• A flame-throwing trumpet (it played music and shot fire; the practical application was nil)

• A rocket-powered Frisbee (exactly what it sounds like)

• THROBAC (THrifty ROman numerical BAckwards-looking Computer), a calculator that worked in Roman numerals

• A gasoline-powered pogo stick (dangerous; Shannon loved it)

• A machine that solved Rubik’s Cubes

• Seven different chess-playing machines

• A hundred-blade jackknife (a Swiss Army knife taken to its illogical conclusion)

• A mind-reading machine (more accurately, a penny-matching machine that used game theory to beat humans at a guessing game)

• A chess automaton that made witty remarks while playing

• Styrofoam shoes for walking on water (they didn’t work well, but he tried)

“I’ve always pursued my interests without much regard for financial value or value to the world,” Shannon once said. “I’ve spent lots of time on totally useless things.”

This wasn’t false modesty. Shannon genuinely followed his curiosity wherever it led, and he made no distinction between “serious” work and play. The information theory was serious. The juggling theorem was play. Both received the same quality of attention. Both emerged from the same mind.

Shannon saw no hierarchy.

Brighton, 1985

In 1985, after years of growing reclusiveness, Shannon appeared at an information theory conference in Brighton, England. The attendees were stunned. Shannon hadn’t appeared at a major conference in years. He was a living legend, and most of the younger researchers in the room had never seen him in person.

He spoke briefly. The audience hung on every word.

Then he reached into his pockets, pulled out three balls, and juggled.

The room erupted. An attendee later described the scene: “It was as if Newton had showed up at a physics conference.”

Delegates queued up for autographs. The father of information theory had returned, and he’d brought his juggling balls.

Beating the house

Shannon’s playful side had a quantitative edge that occasionally made real money. In the early 1960s, he partnered with Ed Thorp, a mathematics professor at MIT (later at UC Irvine) who would go on to write Beat the Dealer and become one of the most successful hedge fund managers in history. Together, they built something remarkable: what is considered the first wearable computer.

The device was designed to beat roulette. It was small enough to fit inside a cigarette pack. The user controlled it with microswitches embedded in their shoes, operated by their big toes. The computer’s output was delivered as musical tones through a tiny earpiece. By timing the speed of the roulette wheel and the ball, the computer could determine which of eight segments of the wheel the ball was most likely to land in. The system was working by June 1961.

Shannon, ever the theorist, applied social network reasoning to their operation’s security. He demanded strict secrecy, arguing that he was only about “three degrees” from an enraged casino owner. One leak through a friend of a friend of a friend, and they’d be in serious trouble.

They chickened out. After one trial run in a Las Vegas casino, where the system reportedly performed as predicted, Shannon and Thorp abandoned the project. The hardware was finicky. The earpiece kept falling out. And, well, Shannon’s curiosity had been satisfied. Onto the next.

Gallager captured it well: Shannon “tired of the roulette scheme before becoming successful, as he really was not interested in making money with the scheme, but only in whether it could be done.”

(This is Shannon in a nutshell. Can the thing be done? Yes? Great. Moving on.)

The stock market

Shannon’s disinterest in roulette profits didn’t extend to the stock market. He was a remarkably successful investor, achieving roughly 28% annual returns over several decades from the late 1950s to 1986. According to Barron’s, this performance outperformed 1,025 of 1,026 mutual funds. He invested in companies like Teledyne, Motorola, and Hewlett-Packard, companies whose engineering cultures he understood and whose products he could evaluate from first principles.

The connection between Shannon’s information theory and his investment returns wasn’t entirely accidental. John Kelly, a colleague at Bell Labs, developed the Kelly criterion, a formula for optimal bet sizing directly inspired by Shannon’s information theory. Kelly showed that the same mathematics Shannon used to determine the capacity of a communication channel could determine how much of your bankroll to wager when you had an informational edge. Professional gamblers and quantitative investors still use the Kelly criterion today.

Shannon and Thorp discussed the Kelly criterion extensively. Thorp would later apply it with devastating effectiveness in both blackjack and the financial markets. Shannon applied it more quietly, to his personal portfolio, and did very well indeed.

The prophet who refused to prophesy

Shannon’s contributions to artificial intelligence began before the field had a name. In 1950-51, he built Theseus, an electromechanical mouse that could learn to navigate a maze. The mouse (named after the mythological hero who navigated the Minotaur’s labyrinth) was controlled by a circuit of roughly 90 telephone relays mounted beneath the maze. On its first attempt, Theseus would wander randomly until it found the goal.

On subsequent attempts, it remembered the correct path.

Honestly, the “intelligence” was in the relay circuit under the maze, not in the mouse itself. But the demonstration was visually arresting, and it became one of the earliest public demonstrations of machine learning. Shannon brought Theseus to conferences and cocktail parties with equal enthusiasm.

The chess paper

Also in 1950, Shannon published “Programming a Computer for Playing Chess,” the first detailed technical paper on how a computer could play chess algorithmically. He proposed the minimax strategy (evaluate all possible moves by assuming your opponent will always make the best counter-move) and distinguished between Type A strategies (brute-force evaluation of all possible moves to a given depth) and Type B strategies (selective evaluation of only the most promising moves, more like human play).

He also calculated what’s now called the Shannon Number: approximately 10^120, an estimate of the total number of possible chess games. For perspective, the number of atoms in the observable universe is roughly 10^80. The Shannon Number is so much larger that “astronomical” doesn’t begin to cover it. It proved that chess could never be solved by brute force, that any chess-playing computer would need to be selective and, in some functional sense, intelligent about which possibilities it explored.

Dartmouth, 1956

In 1956, Shannon co-organised the Dartmouth Workshop⁴ alongside John McCarthy, Marvin Minsky, and Nathaniel Rochester. The workshop’s proposal, written primarily by McCarthy, coined the term “artificial intelligence” and laid out the research programme that would define the field for the next half-century. It was a small gathering, about ten participants spending several weeks at Dartmouth College in New Hampshire. The attendees included many of the people who would shape AI for decades to come.

Shannon’s role at Dartmouth was characteristic. He participated, contributed, and then stepped back. Unlike McCarthy and Minsky, who became tireless evangelists for AI, Shannon kept a quieter, more cautious stance. He believed machines could think. He was optimistic about the long-term prospects. But he didn’t make bold predictions about timelines, and he didn’t build an institutional empire around AI research the way Minsky did at MIT or McCarthy did at Stanford.

In his own words

Shannon’s later comments on AI were direct and unhedged:

“You bet,” he said when asked if machines could think. “I’m a machine, and you’re a machine, and we both think, don’t we?”

He described himself and other humans as machines, meat machines operating on electrical impulses, and saw no principled reason why silicon machines couldn’t do the same. “It is certainly plausible to me that in a few decades machines will be beyond humans,” he said. In his 1985 Kyoto Prize acceptance speech, he suggested machines would “rival or even surpass the human brain.”

But Shannon was an optimist who kept his predictions vague. He never staked his reputation on a specific date. He never claimed intelligence was “just around the corner.” He saw where things were heading and declined to specify how far away the destination was.

Share

Shannon’s ghost in the machine

Every time a large language model generates a sentence, it’s doing Shannon’s work. The connection between 1948 information theory and 2026 artificial intelligence isn’t metaphorical or inspirational. It’s mathematical. Shannon’s concepts are embedded in the literal machinery of modern AI at every level, from the training objective to the hardware.

Cross-entropy loss: the training signal

When a language model like Claude or GPT is trained, it learns by minimising cross-entropy loss. This is, directly, Shannon’s entropy applied to the comparison between two probability distributions: the model’s predicted distribution over possible next tokens, and the actual distribution (the token that actually comes next in the training data).

In Shannon’s terms: the model is trying to become a better predictor of text. Every training step pushes it to assign higher probability to the tokens that actually appear and lower probability to the tokens that don’t. Cross-entropy measures how far the model’s predictions are from reality. Lower cross-entropy means better predictions. The entire multi-billion-dollar enterprise of training large language models is, at its mathematical root, an exercise in minimising a quantity that Claude Shannon defined in 1948.

KL divergence

Kullback-Leibler divergence, another information-theoretic measure descending directly from Shannon’s work, is central to modern machine learning. It quantifies how one probability distribution differs from another. KL divergence shows up in variational autoencoders (VAEs), in reinforcement learning from human feedback (RLHF, the technique used to align language models with human preferences), and throughout probabilistic machine learning. Every time a model is fine-tuned or aligned, KL divergence is there, measuring the gap between what the model predicts and what we want it to predict.

Prediction as compression

Shannon proved that prediction and compression are two sides of the same coin. A model that can predict the next symbol in a sequence with high accuracy can also compress that sequence efficiently, and vice versa. This equivalence is foundational to modern thinking about language models. A well-trained LLM is, in a precise information-theoretic sense, a good compressor of text. It has learned the statistical structure of language well enough to represent it efficiently.

This is why researchers sometimes describe language model training as “learning a compression of the internet.”

The model doesn’t memorise every webpage. It learns the patterns, the regularities, the statistical structure well enough to reconstruct plausible text. Shannon would have recognised this immediately.

Decision trees and information gain

In machine learning, decision trees split data at each node by choosing the feature that provides the most information gain, which is defined as the reduction in Shannon entropy. The algorithm literally asks: “Which question, asked at this point, would resolve the most uncertainty about the outcome?” Shannon’s entropy is the yardstick.

The hardware layer

Beneath all of this, beneath the training algorithms and the loss functions and the probability distributions, sits the hardware. Every GPU and TPU running an AI model is built from billions of logic gates performing Boolean operations: AND, OR, NOT. The operations that Shannon’s 1937 master’s thesis showed could implement any logical function.

The entire physical substrate of artificial intelligence, every transistor in every chip, exists because a twenty-one-year-old in 1937 noticed that electrical switches obeyed the same rules as Boolean algebra.

The English entropy experiment

In 1951, Shannon published “Prediction and Entropy of Printed English,” a paper in which he estimated the entropy rate of written English. He did this by asking human subjects to guess the next letter in a sequence of text and using their accuracy to bound the information content per character. He estimated English carries roughly 1 to 1.5 bits of information per character, far less than the theoretical maximum, because language is highly redundant and predictable.

This is, functionally, the same task a language model performs. A language model trained on English text is estimating the entropy rate of English, learning how predictable the language is at each point, and using that knowledge to generate plausible continuations.

Shannon measured English entropy with human guessers in 1951. Language models measure it with neural networks in 2026. The question is the same.

The semantic caveat

Shannon was careful to note, on the very first page of his 1948 paper, that “the semantic aspects of communication are irrelevant to the engineering problem.” His theory was about the transmission of messages, not their meaning. A channel that transmits “the cat sat on the mat” and a channel that transmits an equivalent number of random characters are, in Shannon’s framework, equally efficient if they use the same bandwidth.

Modern AI excels at the statistical patterns Shannon described: correlation, compression, prediction. Whether it achieves anything resembling understanding remains an open question, and Shannon’s own caveat is the reason it remains open.

Language models predict text with remarkable fluency. They compress the statistical structure of language with impressive efficiency.

But Shannon explicitly excluded meaning from his theory. The models built on his mathematics inherit that exclusion. They are brilliant at Shannon’s game (predicting the next token) and the question of whether that game produces genuine comprehension is one Shannon himself would have found fascinating.

What’s in a name?

In March 2023, Anthropic launched an AI assistant called Claude. The name immediately prompted a question: is it named after Claude Shannon?

The honest answer: probably, but nobody at Anthropic has said so on the record.

Anthropic’s “Introducing Claude” blog post from March 2023 does not mention Shannon. It doesn’t explain the name at all. No direct quote from Dario Amodei or Daniela Amodei, the company’s co-founders, confirms the Shannon connection in any public interview I can find.

But the circumstantial evidence is strong, and nobody has proposed a competing explanation.

The New Yorker, in a February 2026 piece, described the origin as “company lore,” reporting that the name was “partly a patronym for Claude Shannon... but it is also just a name that sounds friendly, one that, unlike Siri or Alexa, is male and, unlike ChatGPT, does not bring to mind a countertop appliance.”

Wired was vaguer but pointed in the same direction: “Depending on who you ask, the name can also be a reference to Claude Shannon.”

Britannica states it as fact. So does Wikipedia.

No alternative namesake has ever surfaced. The Boston Globe drew the connection explicitly. Nobody has suggested it’s named after Claude Debussy, Claude Monet, or Claude Rains. (Though a case for Claude Rains, the actor who played the Invisible Man, would be entertainingly on-brand for an AI system that has no physical form.)

Whether the name is intentional or not, the intellectual lineage is a matter of mathematics, not branding.

Shannon’s entropy is in Claude’s loss function. His Boolean algebra is in Claude’s hardware. His channel capacity theorem describes the theoretical limits of the networks that carry Claude’s outputs around the world. His Markov chain text generation experiment is the conceptual ancestor of Claude’s token-by-token prediction. His 1951 paper on the entropy of English measures the same quantity that Claude’s training process optimises.

If Anthropic named their AI after Claude Shannon, it was a fitting tribute. If they didn’t, it’s the most fortunate coincidence in the history of technology branding. Either way, Shannon is inside the machine.

Whether the name is homage or accident, Shannon would probably have appreciated the irony. A man who spent his career studying communication now has his first name attached to one of the most sophisticated communication systems ever built, and nobody can quite confirm whether that was the plan.

Subscribe now

The last theorem

By the early 1980s, Claude Shannon was showing signs of Alzheimer’s disease. The mind that had held an entire theory of information without writing it down was beginning to lose its grip on the present.

The decline was gradual. Shannon withdrew from public life. He stopped attending conferences (the Brighton appearance in 1985 was a rare exception). He spent his final years in a nursing home in Medford, Massachusetts, cared for by staff and visited daily by Betty, his wife of nearly fifty years.

Gallager, who knew Shannon well, described his final years with spare precision: Shannon remained “good-natured as usual and enjoyed Betty’s daily visits.” The man who had given the world the mathematics of communication could no longer communicate. The cruelty of the disease was total.

Claude Elwood Shannon died on 24 February 2001. He was eighty-four years old.

By the time of his death, the internet had become a global phenomenon. Email, web browsing, digital music, mobile phones, fibre-optic networks, satellite communications: all of it built on his theoretical foundations. But Shannon was largely unaware. The world his work had made was invisible to him at the end.

The honours

The awards had come thick and fast during his working years. The National Medal of Science in 1966, presented by President Lyndon B. Johnson. The IEEE Medal of Honor, also in 1966. The Kyoto Prize in 1985, Japan’s equivalent of the Nobel for fields the Nobel doesn’t cover. In 1973, Shannon became the first recipient of the Claude E. Shannon Award, given by the IEEE Information Theory Society, the discipline’s highest honour and one that carries his own name.

Selected honours and recognition for Claude Shannon

Six statues of Shannon, sculpted by Eugene Daub, stand at various institutions including the University of Michigan and MIT. On his 100th birthday in 2016, Google honoured him with a Google Doodle, introducing Shannon to the millions of people who use Google daily and had never heard his name.

James Gleick, the science writer and author of The Information, put it as well as anyone: “It’s Shannon whose fingerprints are on every electronic device we own, every computer screen we gaze into, every means of digital communication. He’s one of these people who so transform the world that, after the transformation, the old world is forgotten.”

Rodney Brooks, the roboticist and former director of MIT’s Computer Science and Artificial Intelligence Laboratory, called Shannon “the 20th century engineer who contributed the most to 21st century technologies.”

The quiet centre

Shannon was never famous the way Einstein was famous, or even the way Steve Jobs or Elon Musk would become famous. He never sought public attention. He never launched a startup. He never appeared on magazine covers or cable news. He built the mathematical foundation of the modern world and then went home to juggle.

There’s something appealing about that. In an age of personal branding and founder mythology, Shannon offers a different model: the person who does the most important work of their generation and genuinely doesn’t care if anyone knows their name.

He cared about the work. He cared about the puzzles. He cared about whether a unicycle could be ridden down a hallway while juggling three balls (it can, but it takes practice). He cared about whether roulette could be beaten (it can, but the earpiece falls out). He cared about whether machines could think (they can, sort of, and the question is still open).

He did not care, by all available evidence, about being Claude Shannon, Famous Scientist. He was just Claude Shannon, a man with a toggle switch and a box and a mechanical hand that reaches out, gently, and turns it off.

The hand retreats. The lid closes.

But the bits keep flowing.

1 Shannon’s juggling theorem, (F+D)H = (V+D)N, has been extended by other mathematicians. It applies to “cascade” juggling patterns and doesn’t cover all possible juggling sequences, but it captures the fundamental constraint: what goes up must come down, and your hands had better be free when it does.

2 The differential analyser that Shannon worked on with Vannevar Bush was not a digital computer. It was an analogue machine that represented quantities as continuous physical measurements (shaft rotations, wheel positions). The irony is thick: Shannon’s work on an analogue machine led directly to the theoretical foundations of digital computing.

3 SIGSALY’s one-time pad records were manufactured at Bell Labs and shipped in matched pairs to Washington and London. Each record was used once and then destroyed. The system transmitted voice by digitising it into discrete levels, a process called “quantisation,” which was itself an early application of the digital principles Shannon would formalise in 1948.

4 The Dartmouth Workshop proposal’s full title was “A Proposal for the Dartmouth Summer Research Project on Artificial Intelligence.” The word “artificial intelligence” appears for the first time in this document. McCarthy later said he chose the name to distinguish the field from cybernetics, which Norbert Wiener had already claimed.

The exit

The graphic said “ALIBABYE.”

TBPN (ESPN for tech bros for the uninitiated) posted it recently, with photos of three faces that most seasoned AI engineers would recognise in a heartbeat.

A few days ago, Alibaba had released the Qwen 3.5 small model series, the latest additions to its open-weight family. Elon Musk had called the models “impressive intelligence density” on X. They were getting praised. The benchmarks were strong. The vibes were good.

Then four of the people most responsible for building it just walked out the door, their departures surfacing over the span of roughly 48 hours.

We’re talking about the technical lead. The post-training head. The code models specialist. A researcher who contributed to the training pipeline. The people whose names show up on the technical reports and whose GitHub commits sit inside thousands of production systems.

They shipped it, and then they left. Poof.

Who walked out

Junyang “Justin” Lin (@JustinLin610) was the technical lead and the public face of Qwen to the international developer community. Reportedly the youngest P10 at Alibaba, which, for the uninitiated, is roughly equivalent to Distinguished Engineer. It’s a rank most engineers never reach in an entire career; Justin reached it before his peers hit Senior. He was lead author on Qwen’s technical reports and the person developers tagged when something broke or something shipped.

Binyuan Hui (@huybery) was a staff research scientist who led the CodeQwen and Qwen-Coder work. If you’ve used Qwen for code generation, autocomplete, or anything involving a terminal, Hui’s fingerprints are on it. Co-author on multiple technical reports, deep in the weeds of making language models actually write software that runs.

Kaixin Li was a researcher who contributed to the training pipeline. Based at the National University of Singapore and described in reports as an intern on the Qwen team, Li was less public-facing than Lin or Hui, but his departure alongside senior members underscored the breadth of the exit.

Yu Bowen led post-training. This one deserves a beat of explanation, because post-training is the work that separates a raw language model from something you’d actually want to use in the real world.

When a model finishes pre-training, it’s like a student who’s read every textbook in the library but has no idea how to hold a conversation. Post-training, RLHF, alignment, instruction tuning, is what teaches it to be useful, safe, and not weird. Yu Bowen ran that for Qwen.

His departure is the most consequential of the four, and I don’t think it’s even close. You can backfill individual contributors. Replacing the person who understood how to align an entire model family, who held the institutional knowledge of what worked and what didn’t across every Qwen release? That’s not something you can fix overnight.

What they built

The Qwen model family has been downloaded more than 600 million times on Hugging Face.

Six hundred million.

The lineage runs from the original Qwen through 1.5, 2, 2.5, QwQ, QvQ, 3, and now 3.5. Each generation brought specialised variants: code, maths, vision, reasoning. All Apache 2.0 licensed, meaning anyone can use them commercially, fine-tune them, build products on top of them, without asking Alibaba’s permission or paying a cent.

That licensing decision made Qwen one of the most important model families in the open-weight ecosystem. Developers building local AI tools, startups that can’t afford API costs, researchers in countries with limited cloud infrastructure: they all leaned on Qwen. The GitHub repositories became a dependency for thousands of projects worldwide.

And the Qwen 3.5 small model series, the final release this team shipped together, was by most accounts their best work in the compact model space. They didn’t leave after a failed release or during a quiet period. They finished the job, put out a release that drew praise from Elon Musk, and resigned within hours.

That’s professional commitment paired with principled departure. It says: we weren’t fired, we weren’t coasting, and we didn’t sabotage anything on the way out. We just aren’t staying.

The restructuring that broke it

So why did they leave?

Alibaba’s management proposed restructuring Tongyi Lab, the AI research group that houses the Qwen team, by splitting its researchers across different business units. Cloud would get some. Commerce would get others. Each division would get its own slice of AI talent, embedded directly into product teams.

If you’ve worked at a large tech company, you’ve seen this movie before. The pitch from leadership always sounds reasonable: move researchers closer to the products, shorten feedback loops, make AI “more integrated” with the business. On a whiteboard, it looks like efficiency.

In practice, it fragments a cohesive research team into isolated pockets serving different bosses with different priorities. The researchers who spent years building shared intuition about model architecture, training dynamics, and post-training techniques suddenly report to product managers who need a chatbot for customer service by Q3.

Centralised research labs produce breakthroughs. Distributed product teams produce features. These are different things, and the people who are good at one often hate doing the other.

Google went through a version of this when it merged Google Brain and DeepMind, a process that produced its own talent exodus and years of cultural friction. Meta has reorganised its AI research groups multiple times, each reshuffle sending ripples of departures across the industry. The pattern repeats every time: you restructure a research team to serve business units, and you lose the research culture that made the team worth restructuring around.

The four departing members saw the restructuring for what it was and chose to leave rather than watch their team get scattered.

Alibaba tried to better integrate AI into its business units and instead lost the people who made the AI worth integrating.

600 million downloads and counting

So what happens now for the thousands of developers building on Qwen?

The models are open-source. The code exists. The weights are on Hugging Face. Nobody can un-release Apache 2.0 licensed software. In that narrow sense, everything is fine.

But LLM development isn’t like traditional open-source software. Linux survived Linus Torvalds stepping back because the kernel had accumulated decades of contributors and institutional processes. Python survived Guido van Rossum’s retirement because its governance structure was mature and its contributor base was enormous.

Large language model development concentrates knowledge in a small number of heads; geniuses at that. Why does a particular training recipe work? Why does a specific RLHF configuration produce better outputs? Why does the model behave oddly on certain edge cases? That knowledge often lives in the brains of five or ten people. When four of them leave at once, the knowledge walks out with them.

Alibaba still has researchers. Tongyi Lab still exists. Qwen 3.5 is already released and working. But the questions that matter are forward-looking: Can Qwen 4 match this quality? Can post-training hold without Yu Bowen, or the code models keep pace without Binyuan Hui? And will the international developer community still trust a project whose public face just walked away?

Open-source code can survive its creators leaving. The tacit knowledge of how to train frontier AI models is harder to replace than any codebase.

None of these questions have answers yet. But if you’ve bet your product on Qwen’s continued improvement, now’s a good time to start thinking about what your fallback looks like.

Where the talent goes

China’s AI talent war was already brutal before this. It just got worse.

Reports point to Zhipu AI, the Beijing-based company behind the GLM model family, as a likely destination for at least some of the departing researchers. But the field of potential suitors is wide: DeepSeek, Moonshot (Kimi), MiniMax, and ByteDance are all competing for the same thin slice of people who’ve actually trained frontier models.

There’s also the possibility the four start something new together. A team that’s already built one of the world’s most downloaded model families, that has the track record and the technical chops, would have no trouble raising money in the current climate. The “big company to startup” pipeline is well-worn in China’s tech scene, and founding-team-quality ML researchers are rarer than capital.

We’ve seen this before. In 2024, OpenAI went through its own talent exodus. Ilya Sutskever left to start Safe Superintelligence. Jan Leike went to Anthropic. Other senior researchers scattered across a half-dozen startups. OpenAI survived and kept shipping, but the departures reshaped the competitive field in ways we’re still tracking. Each person who left carried knowledge that seeded something new elsewhere.

The same dynamic is about to play out in China’s AI ecosystem. Four people carrying years of institutional knowledge about training open-weight models at scale are about to pour that knowledge into something new. Whatever they build benefits from everything they learned at Alibaba.

Alibaba doesn’t get that exchange in reverse.

The fallout

For Alibaba, this is a credibility hit. Not a fatal one, but real. The company can hire replacements, and it will. But in an industry where top researchers talk to each other, where reputation spreads through conference hallways and WeChat groups, the message is clear: Alibaba prioritised corporate org charts over the team that was winning.

For Qwen users, it’s uncertainty without catastrophe. The models work. The Apache 2.0 licence is permanent. But the pace of improvement may slow, and the subtle quality that comes from deep institutional knowledge (the difference between a model that benchmarks well and a model that feels right to use) is at risk.

For China’s AI scene more broadly, this is another data point in a pattern that’s getting hard to wave away. Capital is abundant. Compute is getting there. But the people who know how to do this work, really know, number in the hundreds. Talent is the binding constraint. It was before March 4. More so now.

Four people walked out of Alibaba within hours of shipping their latest work. They left behind 600 million downloads, models that impressed Elon Musk, and an Apache 2.0 licence that ensures the code survives their departure.

What they took with them is harder to quantify, and even harder to replace.

Three AI providers raised their prices in February 2026, all within weeks of each other. Chutes killed its free tier on February 27th. Z.ai hiked by more than 30%, citing overwhelming demand. Synthetic bumped from $20 to $30 a month, tossing in 500 free tool calls as a sweetener.

The developer backlash was instant. Reddit threads lit up with complaints about greed, broken promises, bait-and-switch tactics. Some users migrated to cheaper Chinese providers. Others started self-hosting.

But the anger was pointed in the wrong direction.

The providers raising prices were the ones telling you the truth about what inference costs. The ones keeping prices low were telling you something else entirely. And if you’ve ever watched a venture-backed company burn cash to capture a market, you already know how that story ends.

Subscribe now

February’s reckoning

Chutes AI runs serverless inference on the Bittensor network. It’s decentralised, open-source, and until recently, absurdly generous. Some users were getting up to 324 times the value of their subscription in pay-as-you-go equivalent, with even Base tier users extracting over 100x. That’s a charitable donation with extra steps.

So Chutes did the uneasy thing. Killed the free tier. Capped subscriptions at five times their pay-as-you-go value. Pulled frontier models from the cheapest plan. The freeloader community response was predictable: fury, followed by cancellations.

Z.ai’s trajectory tells a starker story. Zhipu AI’s international platform started at roughly $6 a month. Then $30. Then $56. Reuters reported the latest hike on February 12th, attributing it to a “rapid increase in users.” Zhipu had just raised $558 million in a Hong Kong IPO. They could afford to subsidise users. They chose not to.

Synthetic went from $20 to $30, framing it as “$1 a day.” They added 500 free tool calls, expanded their model roster, and kept their privacy-first positioning: no data training, no prompt storage, GDPR compliance.

Of the three, Synthetic’s increase was the gentlest. Also the most honest about why it happened.

These price hikes aren’t cash grabs. They’re corrections. The introductory prices were never sustainable, and every provider knew it.

Synthetic’s Matt said:

We knew we were losing money on subscriptions, but this was okay when we were small: we hoped efficiencies of scale would turn us profitable when we became big. Unfortunately, we underestimated usage — and the popular open-source models got bigger and harder to run too, like Kimi K2.5. When we quadrupled in subscriber count, we realized our projections had been wrong: we needed to raise prices to just to stay afloat.

And let’s be honest: most of us would rather get honesty like the above than be lied to. Honesty’s a keeper.

Going back, nobody wanted to say it out loud, but the introductory prices were loss leaders. Every single one. The question was never whether they’d go up, but when.

What inference actually costs

Let’s talk about GPUs, because that’s where the money goes.

An Nvidia H100, the workhorse of current inference deployments, costs between $25,000 and $40,000 to buy outright. Cloud rental runs $1.49 to $6.98 per hour depending on the provider and commitment level. An H200 sits in a similar purchase range but pulls more power. The next-gen B200 pushes both costs higher.

Those numbers are per card. One H100 running 24/7 for a month at mid-range cloud pricing (call it $3.50/hour) costs $2,520 in compute alone. Buy the card outright and amortise over three years (a generous lifespan given how fast GPU generations move), and that’s roughly $830 to $1,110 per month in hardware depreciation. Before the machine draws a single watt.

But the GPU is only the start of the bill.

Electricity runs $0.10 to $0.15 per kilowatt-hour in most US data centre markets. An H100 draws about 700 watts under load. Running one around the clock costs roughly $50 to $75 per month in raw electricity. Scale that to a cluster of 64 cards (a modest deployment for a multi-model provider) and you’re looking at $3,200 to $4,800 per month in power alone. That’s before cooling, which typically adds 30-40% to the electricity bill. GPU clusters run hot. There’s a reason data centres in Iceland and northern Sweden are suddenly popular. Cold ambient air is free cooling.

Network egress is the cost nobody talks about until they get the bill. Serving tokens to thousands of concurrent users means shipping data out of your infrastructure. Cloud providers charge $0.05 to $0.12 per gigabyte of egress. A busy inference API serving millions of requests per day can rack up thousands in bandwidth costs monthly.

Model loading and idle capacity eat money invisibly. A 70-billion parameter model in FP16 needs around 140GB of GPU memory just to load the weights. That’s two H100s (80GB each) holding a single model before it generates one token. If you’re offering 67+ models like Chutes does, you either keep popular models hot (expensive; those GPUs can’t do anything else) or swap models in and out on demand (slow; loading 140GB of weights takes time). Either way, you’re paying for capacity that sits idle between requests.

Engineering salaries round out the bill. Someone has to maintain the infrastructure, optimise batching strategies, handle failovers, monitor quality. A small inference team of five to eight engineers in a major tech market costs $1 million to $2 million per year.

Now the per-token maths. An H100 running a 70B parameter model in FP16 generates roughly 30 to 80 tokens per second depending on batch size, quantisation, and optimisation. Take the middle: 50 tokens per second. At $3.50 per hour in cloud costs, that’s about $0.019 per thousand tokens. Add electricity, cooling, bandwidth, amortised engineering costs, and you’re closer to $0.025 to $0.04 per thousand output tokens. For a frontier model at full precision, higher still.

Self-hosting looks cheaper on paper. Buy H100s outright at $30,000 each, amortise over three years with electricity and cooling, and you’re at roughly $0.015 to $0.025 per thousand tokens. But that requires serious upfront capital, technical expertise to manage, and you eat the cost of idle capacity during off-peak hours. Self-hosting only makes economic sense if you’re running high, consistent volume.

When a provider offers you unlimited inference on frontier models for $3 a month, someone is paying the difference. If you can’t figure out who, it’s probably you, just not in the way you expect.

Now divide a $3 monthly subscription by even the cheapest per-token cost. At $0.015 per thousand tokens, $3 buys you 200,000 tokens, roughly 150,000 words of output. About one medium-length novel. Sounds generous until you realise a single coding agent session can burn through 50,000 to 100,000 tokens in an hour. Heavy users blow through that $3 in a day or two.

The maths doesn’t work. It never did.

Share

The suspiciously cheap alternatives

Against that cost reality, consider Alibaba’s $3 coding plan.

Model Studio’s offering bundles Qwen3.5-Plus, GLM-5, Kimi K2.5, and MiniMax M2.5 for $3 a month. Generous rate limits too: 1,200 requests per five hours, 9,000 per week, 18,000 per month.

Read the fine print. The $3 lasts one month. Month two costs $5. From month three onward, it’s $10. Classic escalating intro pricing. The $3 isn’t a price. It’s a hook.

Z.ai pulled the same move at larger scale. Start at $6, capture users, build dependency, then hike to $56 once switching costs are high enough to keep people around. The price nearly ten-xed in under a year.

The Chinese price war and what’s fuelling it

The broader context makes individual pricing moves easier to read. DeepSeek trained its V3 model for roughly $5.58 million. US frontier models cost upward of $100 million. When your training bill is 95% lower, you can afford to price inference aggressively. And I mean aggressively.

DeepSeek R1 arrived at prices 90-95% cheaper than Western competitors. Nvidia lost $593 billion in market capitalisation in a single day, the largest one-day wipeout for any company in stock market history. Investors suddenly had to confront the possibility that inference might become a commodity faster than anyone predicted.

The resulting price war has been fierce to say the least. Alibaba slashed Qwen-VL-Max costs by 85% in December 2025, then cut Qwen3-Max by another 50% soon thereafter. Baidu made Ernie Bot entirely free in April 2025. Tencent entered with Hunyuan Turbo S priced at $0.11 per million input tokens. A million tokens is roughly 750,000 words of input. Eleven cents.

The per-token pricing gap between Chinese and Western providers has become almost absurd. Moonshot AI’s Kimi K2.5 charges $2.50 per million output tokens. Claude Sonnet 4.6 charges $15 for the same volume. Six times the price. Are you getting six times the quality? For some tasks, maybe. For autocompleting your React components, probably not.

Chinese AI users doubled to 515 million by mid-2025. China now has over 1,500 large language models, roughly 40% of the global total. That much competition doesn’t produce sustainable pricing. It produces a race to zero.

These aren’t sustainable prices. They’re battle prices. And battles have casualties.

The question hanging over all of it: who runs out of patience first, the companies burning cash or the venture investors funding the burn?

The quantisation question

Here’s a dirty secret of cheap inference: you might not be getting the model you think you’re getting.

Quantisation reduces a model’s numerical precision to make it faster and cheaper to run. Think of it like audio compression. A WAV file is full quality. An MP3 at 320kbps is nearly indistinguishable. At 128kbps, you start noticing. At 64kbps, your favourite song sounds like it’s being played through a phone speaker in a bathtub.

AI models work the same way. INT8 quantisation stays within 0.04% of BF16 baseline accuracy on MMLU-Pro benchmarks; essentially lossless. FP8 occupies a similar near-lossless tier while halving memory requirements. INT4 saves the most compute.

As most if not all providers don’t disclose their quantisation level, you’re trusting that the “DeepSeek V3” you’re hitting through a $3 API is the same model that scored well on benchmarks. But those benchmarks were run at full precision.

Community speculation about silent quantisation is everywhere on Reddit. Users report inconsistent quality between providers running ostensibly identical models. Some outputs are sharp and coherent. Others feel vaguely off, hard to pinpoint but unmistakable once you notice. (Honestly, the inconsistency alone should tell you something.)

It’s like ordering a premium single malt and getting it watered down. The glass looks right. The colour is close. But something’s missing, and the bar will never admit what they did.

The cheaper the provider, the stronger the incentive to quantise aggressively. When your margin on each request is measured in fractions of a cent, switching from FP16 to INT4 can halve your GPU requirements. That’s the difference between losing money and breaking even.

Subscribe now

We’ve seen this movie before

The playbook isn’t new. Subsidise aggressively, capture the market, raise prices once customers are locked in. Venture capital has been running this play for two decades.

Uber and the $20 billion bonfire

Uber lost 58 cents on every single ride in 2018. In the first half of 2016 alone, losses hit $1.2 billion. Total losses since 2015 ran into the tens of billions. The strategy was blunt: price below cost, destroy taxi companies, achieve market dominance, then raise prices.

China was the most expensive theatre. Uber burned $1 billion a year there, paying drivers multiples of the actual fare just to build supply. A billion a year. Didi countered with the same playbook and deeper pockets. In August 2016, Uber surrendered, merging its Chinese operations into Didi in exchange for an 18% stake. Even retreat cost billions.

Amazon’s nappy war

Amazon went after Diapers.com with the calculated patience of a company that can afford to lose money forever. They launched “Amazon Mom” with Subscribe & Save pricing, selling Pampers for under $30 a pack when Diapers.com (owned by Quidsi) charged $45. Quidsi estimated it was losing $100 million per quarter trying to compete. They couldn’t. They sold to Amazon for $545 million in 2010.

And then Amazon shut Diapers.com down entirely in April 2017. Didn’t even run it. The acquisition was never about owning the company; it was about removing the competitor, absorbing its customer base, and salting the earth behind it.

The cloud wars of 2014

This one is the closest parallel to what’s happening in AI inference right now. In March 2014, Google slashed cloud prices by 32%. AWS responded within days. Microsoft followed with cuts of 27-65% across different services. Google introduced preemptible VMs at a fraction of standard pricing. Over the following six years, AWS cut prices 44 separate times.

The cuts attracted waves of new customers who built their entire infrastructure on cloud services. Then, gradually, prices stabilised. New pricing tiers appeared. Premium features carried premium costs. Reserved instance pricing replaced on-demand flexibility. By 2020, the big three controlled the market and monthly cloud bills had crept well above those loss-leader lows. If you were locked into AWS by then, you weren’t switching to save 15%. The migration cost alone would eat years of savings.

Didi’s pyrrhic victory

Didi merged with rival Kuaidi in 2015, creating a dominant ride-hailing giant. But dominance didn’t end the spending. In the first five months after the merger, Didi spent 270 million dollars on private-car subsidies alone. Drivers and riders were both being paid to use the platform.

Didi won the war. Then lost the peace. In 2022, China fined Didi 8 billion yuan (roughly $1.2 billion) for data security violations, following a crackdown triggered by Didi’s ill-advised New York IPO. Turns out market dominance in China comes with strings Western companies don’t always anticipate.

Every unsustainably cheap AI plan is a bet that you’ll be too dependent to leave when the real price arrives.

The pattern repeats. Subsidise to capture. Lock in through integration. Raise prices once alternatives have been starved out or customers are too embedded to migrate. The Chinese AI price war follows this script with one added wrinkle: state backing gives Chinese companies a longer runway than most venture-funded Western competitors. DeepSeek’s 90-95% discount isn’t charity. It’s a customer acquisition cost, and the investors behind it can afford to wait.

The question for anyone building on a $3 AI API isn’t whether the price will go up. It’s how much, and when, and whether you’ll have built enough of your workflow around it that migrating feels impossible.

The privacy trade-off

Price isn’t the only cost. When you route your prompts through a Chinese AI provider, your data enters a different legal jurisdiction, and the rules there don’t work like you might assume.

China’s Personal Information Protection Law (PIPL), enacted in 2021, looks like GDPR on the surface. Both require consent for data collection. Both impose restrictions on cross-border transfers. Both carry significant penalties for violations.

The similarities end there.

PIPL requires that data processing serve China’s national interest. GDPR exists to protect individual citizens. Those two goals conflict when Chinese and European data intersect. PIPL mandates cross-border security assessments for any data leaving China, creating a regulatory trap: data that enters Chinese infrastructure becomes harder to get out. And the EU has not recognised China as having “adequate” data protection under GDPR’s Article 45, meaning European companies using Chinese AI APIs face dual compliance obligations with no safe harbour between them.

Then there’s the National Intelligence Law of 2017. Article 7 is the one worth reading carefully: organisations and citizens shall support, assist, and cooperate with national intelligence work. Not “may.” Not “under certain circumstances.” Shall. If a Chinese AI provider is asked to hand over your prompts, they’ve got no legal mechanism to refuse. The law doesn’t include an exception for commercial inconvenience.

This isn’t theoretical. ByteDance’s Doubao AI Phone was blocked by WeChat over PIPL consent issues. Even Chinese tech giants trip over these data handling requirements. If domestic companies can’t get it right, foreign users routing sensitive data through Chinese APIs face an even murkier picture.

For individual developers mucking about with side projects, this might be an acceptable risk. But companies sending proprietary code, customer data, or strategic documents through a $3 API? Yeah, that’s a different calculation entirely. European companies face particular exposure: using a Chinese AI API to process EU citizen data without a lawful cross-border transfer mechanism could violate GDPR, regardless of whether the Chinese provider is PIPL-compliant.

The cheap API might also be training on your data. Most budget providers don’t offer contractual guarantees against it. By contrast, Synthetic explicitly promises no data training and no prompt storage. Chutes supports Trusted Execution Environments (TEEs) where even the infrastructure operator can’t see your inputs.

Privacy has a cost. The providers charging more for it are the ones actually providing it.

Subscribe now

What honest pricing looks like

Strip away the outrage and look at what the “expensive” providers actually did in February 2026.

Chutes’ announcement I mentioned earlier that read more like an open-source project’s transparency report than a corporate pricing update. They showed actual usage data: specific users consuming 100-324x their subscription value in API calls. They broke down why the free tier was unsustainable, with numbers, not platitudes. They acknowledged some users would leave. Accepted the trade-off.

That level of transparency from a SaaS company is rare. Most providers raise prices with a vague email about “continuing to invest in the platform” and a buried effective date. Chutes showed its working.

Synthetic took a different approach. Alongside its $10 price increase, Synthetic also increased maximum concurrency limits for higher tiers and continues to release new models, like GLM-4.7-Flash. More significantly, they built and open-sourced Synbad, an evaluation suite that tests whether AI providers actually serve the models they claim to serve.

Synbad scores Synthetic at a 100% pass rate compared to 66% on competing providers. If a third of model responses from other providers don’t match expected behaviour, silent quantisation or model substitution is the most likely explanation.

Building an evaluation tool that exposes your competitors’ quality issues is a bold move. It says: we’re confident enough in what we’re serving to give you the means to verify it. Budget providers making similar guarantees? None that I’ve found.

Z.ai cited user growth and cited it honestly. With a $558 million IPO war chest, they could have subsidised longer. They chose to price sustainably instead. Look, that’s not exciting. It doesn’t generate Reddit threads about generosity. But a company that prices for survival is a company that’ll still be around in two years.

The providers willing to show you the cost breakdown are the ones you should trust. The ones offering “unlimited” inference for the price of a coffee are hiding something in the margins.

Compare this to the $3 plans. No cost breakdowns. No explanation of how the pricing works. No disclosure of quantisation levels or data handling practices. No open-source evaluation tools. Just a price that’s too good to be true, offered by companies with the resources to absorb short-term losses indefinitely.

The cheapest option is rarely the cheapest option. The invoice just arrives later, in a currency you weren’t expecting: degraded quality, data exposure, vendor lock-in, or a sudden price hike once you’re too deep to walk away.

The invoice always arrives

Nobody runs AI inference at a loss because they love developers. Every suspiciously cheap plan has a business model behind it. Capture the market now, monetise later. Train on user data and sell the insights. Serve degraded models and hope nobody notices.

The February 2026 price hikes weren’t a betrayal. They were providers admitting what the GPU economics had been saying all along: inference costs real money, and someone has to pay for it.

The providers who raised prices chose you as the customer.

The ones who didn’t? They chose you as the product.

Liked this guide?

If you decide to try Synthetic, consider using my referral link below:

➡️ Sign up for Synthetic.new

We both get subscription credit when you subscribe.

$10 credit for you, $10 credit for me.

It’s a nice way to say thanks if this article helped make a difference in your decision-making.

But honestly, just try it out for a few days and see the difference for yourself.

Can’t go wrong with that crowd.

Apple just announced the M5 Pro and M5 Max MacBook Pro lineup. The marketing materials say "up to 50% faster GPU" and "up to 4x faster AI performance." The reality is more interesting than the headline numbers. It always is.

The TLDR

For those of you who just want the verdict:

The M5 Pro and M5 Max are built on a new “Fusion Architecture” that combines two dies into a single chip. You get more CPU cores (renamed from “performance” to “super” cores, because branding), meaningfully faster GPU with new Neural Accelerators baked into every graphics core, up to 64GB of unified memory on the Pro (was 48GB), and double the base storage. All of that comes with a $200 price increase across the board, though the doubled SSD partially justifies it.

If you own an M1 or M2 MacBook Pro, this is a compelling upgrade. If you bought the M4 Pro six months ago, close this tab and go enjoy your laptop.

The chip: Fusion Architecture explained

Six years of Apple silicon, and the M5 generation is the first real architectural departure since the M1.

The headline change is what Apple calls “Fusion Architecture.” Instead of one monolithic die, the M5 Pro and M5 Max combine two separate dies into a single system-on-chip package: CPU cores on one die, GPU cores and Neural Accelerators on the other, connected fast enough that software doesn’t need to know or care. Two specialists sharing a desk instead of one generalist doing everything.

AMD has been building server chips this way for years (they call theirs “chiplets”), but it’s new for Apple’s laptop silicon. The practical benefit: Apple can optimise each die independently and yield more working chips per wafer. The practical risk: the connection between dies adds latency. Apple clearly thinks they’ve solved that. Given their track record with unified memory architecture, I’m inclined to believe them. (I’ve been wrong about Apple’s packaging claims before. Hasn’t happened yet, but I keep waiting.)

The M5 Max scales the same concept further: more GPU cores, higher memory bandwidth, and support for up to 128GB of unified memory. If the Pro is a well-equipped workshop, the Max is the whole factory floor.

Subscribe now

CPU: more cores, new names

Apple loves renaming things. The M4 Pro had “performance cores” and “efficiency cores.” The M5 Pro has “super cores” and “performance cores.” Same silicon hierarchy, new labels; Apple just shifted everything up one notch.

Once you get past the rebranding:

M5 Pro base config: 15-core CPU with 5 super cores and 10 performance cores
M5 Pro upgraded config: 18-core CPU with 6 super cores and 12 performance cores
M4 Pro base config: 12-core CPU (8 performance + 4 efficiency)
M4 Pro upgraded config: 14-core CPU (10 performance + 4 efficiency)

That’s 12 to 15 cores at the base level, with Apple claiming up to 30% faster CPU performance. In practice, expect noticeable gains on sustained multi-threaded work: compiling large codebases, video encoding, running multiple Docker containers. Single-threaded improvements will be more modest, probably 10-15% based on historical patterns.

The M5 Max gets the full 18-core CPU as its only configuration, up from the M4 Max’s 14-core or 16-core options.

Will you feel 30% faster in daily use? Probably not. Your browser, email, and Slack were already instant on the M4 Pro. The gains show up when you push the machine hard for sustained periods.

GPU: Neural Accelerators are the real story

Apple claims 50% faster graphics on the M5 Pro versus the M4 Pro. That number deserves the usual scepticism, but the architectural reason behind it is solid. Every GPU core in the M5 now contains a Neural Accelerator. This is new. The M4’s GPU cores were general-purpose graphics processors; AI workloads had to either run on the dedicated Neural Engine (16 cores, good for specific tasks) or be shoehorned into standard GPU compute.

The M5 distributes AI processing across the entire GPU. Instead of ML inference queuing up for the Neural Engine, every GPU core can handle neural network operations alongside traditional graphics work. One checkout lane with a “fast lane” sign versus every lane equipped to process express orders.

Apple’s “4x faster AI performance” claim needs a footnote, though. That number was measured using a 14-billion parameter model with 4-bit quantisation running in LM Studio. A 14B model is relatively small by current standards. You’re not running a 70B model locally on these machines with any kind of usable speed. For smaller models, fine-tuning tasks, and image generation (Apple claims 3.7x faster AI image generation vs M4 Pro), the Neural Accelerators look like a genuine architectural win.

M5 Pro GPU configs: 16-core or 20-core (both with Neural Accelerators)
M5 Max GPU configs: 32-core or 40-core (both with Neural Accelerators)
M4 Pro GPU configs: 16-core or 20-core (no Neural Accelerators)
M4 Max GPU configs: 32-core or 40-core (no Neural Accelerators)

Same core counts. Fundamentally different cores.

Share

Memory and storage: the daily-use wins

Memory: The M5 Pro now supports up to 64GB of unified memory, up from the M4 Pro’s 48GB ceiling. Memory bandwidth climbs from 273GB/s to 307GB/s. The M5 Max pushes bandwidth to 460GB/s (32-core GPU) or a frankly absurd 614GB/s (40-core GPU), up from 410GB/s and 546GB/s respectively.

For most people, 48GB was already plenty. But if you’re running local LLMs, especially the latest ones from Qwen, the extra headroom is nice. A lot. A 64GB M5 Pro can fit larger models entirely in memory, and the 614GB/s bandwidth on the top-end M5 Max means faster token generation when inference is memory-bandwidth-bound (which, for language models, it almost always is).

Storage is the headline upgrade. The M5 Pro ships with 1TB as the base configuration. The M4 Pro shipped with 512GB. Double the storage, out of the box, no upgrade tax. The M5 Max starts at 2TB, up from 1TB.

On top of the doubled capacity, Apple claims 2x faster SSD speeds. If you regularly move large files, work with video, or just got tired of the spinning beach ball during Time Machine backups, this is the upgrade you’ll actually feel every day.

The 64GB ceiling on the M5 Pro and 614GB/s bandwidth on the M5 Max are the specs that matter for local AI work. Not the “4x faster” headline. The headline number tells you how fast the chip processes tokens; the memory specs tell you which models you can actually run.

The rest: Wi-Fi 7, battery, display

A quick run through the supporting cast.

Wireless: The new N1 chip brings Wi-Fi 7 and Bluetooth 6, replacing the M4 Pro’s Wi-Fi 6E and Bluetooth 5.3. Wi-Fi 7 is measurably faster in environments with compatible routers (we’re talking multi-gigabit speeds). If your router is still on Wi-Fi 6, you won’t notice anything.

Battery: Apple quotes up to 22 hours of video streaming and 14 hours of wireless web browsing on the 14-inch M5 Pro. The M4 Pro 14-inch was rated at 22 hours too. Roughly unchanged; the extra cores eat whatever efficiency the new process node gained.

Display: Same Liquid Retina XDR panel. Same 12MP Center Stage camera. Same Thunderbolt 5 ports (which the M4 Pro already had). Same Space Black and Silver colour options.

macOS Tahoe ships pre-installed. Pre-orders open March 4 (today), with availability on March 11.

Nothing here is a reason to upgrade on its own. But if you’re already buying, the Wi-Fi 7 support is nice future-proofing.

Pricing: $200 more across the board

This is the part that stings.

14-inch M5 Pro: $2,199 (M4 Pro was $1,999)
16-inch M5 Pro: $2,699 (M4 Pro was $2,499)
14-inch M5 base (non-Pro): $1,699 (M4 was $1,599)
16-inch M5 Max: starts at $3,899

That’s $200 more at every Pro tier. Apple will argue, correctly, that the doubled base storage accounts for most of it. A 512GB-to-1TB SSD upgrade on the M4 Pro cost $200. So in a sense, you’re getting the storage upgrade “for free” and the base price is the same. In another sense, the cheapest M5 Pro MacBook now costs two hundred dollars more. Both things are true.

The $200 price increase is effectively a mandatory storage upgrade. Whether that’s a good deal depends on whether you needed 1TB in the first place.

For anyone who would have configured 1TB anyway, this is price-neutral. For anyone who was happy with 512GB, it’s a tax.

Subscribe now

Who should upgrade (and who shouldn’t)

M1 Pro/M1 Max owners: Yes, if you feel the need. The performance gap is substantial (Apple claims up to 8x faster AI performance vs M1). But I’ll be honest: a lot of M1 Pro owners still feel zero urgency to upgrade. You’ll see my sentiment reflected on HN, Reddit, and Twitter. Apple made the M1 Pro too good. If your 2021 MacBook Pro still handles everything you throw at it, a spec sheet won’t change that feeling. Upgrade when your work demands it, not when Apple’s marketing suggests it.

M2 Pro/M2 Max owners: Probably yes. Two generations of improvements add up, and the memory ceiling bump to 64GB might unblock workflows that were previously impossible.

M3 Pro/M3 Max owners: Maybe, but only if you specifically need the 64GB memory ceiling or the Neural Accelerator GPU architecture. Performance-wise, you’re looking at roughly one generation of gains.

M4 Pro/M4 Max owners: No. You bought your laptop five months ago. It’s still excellent. The M5’s improvements are real but incremental from where you sit. Enjoy what you have.

Apple’s “Even More Value for Upgraders” marketing reads a bit tone-deaf when plenty of M1 Pro owners are sitting there thinking “my four-year-old laptop runs fine, thanks.” The M5 Pro is a solid generational improvement with one actually interesting architectural change (Neural Accelerators in the GPU). It’s not a reason to throw away a working machine.

If you’re buying your first MacBook Pro, or upgrading from an Intel Mac, or pushing against the M1/M2’s memory limits for local AI work: (cue it) the M5 Pro is the best laptop Apple has ever made. That’s true every year, and it’s true again now.

If your current machine still does what you need, the best upgrade is no upgrade at all.

I cover Apple silicon generations as they drop, with the same spec-level breakdowns and zero marketing fluff. Follow if you want the straight story on the next one.

Cursor’s annualised recurring revenue reached $2 billion in February 2026, according to Bloomberg reporting on 2-3 March. The company crossed $1 billion just three months earlier. Two billion dollars for a desktop application that helps programmers write code.

Stack that against any SaaS company in history. Snowflake took six quarters to travel from $1 billion to $2 billion ARR. Slack took roughly six years to reach $1 billion. Zoom took nine. Shopify, fifteen. Cursor ran from essentially zero (about $1 million ARR in December 2023) to $2 billion in 26 months. Wild.

The valuation tracked accordingly. Anysphere, the parent company, was valued at $29.3 billion in its November 2025 Series D, raising $2.3 billion. That round came five months after a $900 million Series C at $9.9 billion. The company began with a pre-seed of roughly $400,000 in April 2022. From $400,000 to $29.3 billion is a 73,250x increase in 43 months. Even by venture capital standards, absurd.

And the revenue is real. These aren’t bookings or commitments or letters of intent. Cursor is a subscription product. People pay $20, $60, or $200 per month. Teams pay $40 per user. The money clears every billing cycle. By mid-2025, the company already counted the majority of Fortune 500 companies as customers, alongside OpenAI, Stripe, Spotify, Midjourney, and Perplexity.

The developer community is predictably split. One camp sees vindication: they adopted early, and the numbers proved them right. The other asks pointed questions about unit economics, sustainability, and what happens when a company spends every dollar it earns on API calls to someone else’s models. Both sides have a point.

The hockey stick of all hockey sticks

Cursor’s revenue trajectory breaks every recognised SaaS growth pattern. Most B2B companies celebrate each doubling after quarters of grinding. Cursor has been doubling every three months.

The documented progression: $1 million ARR in December 2023. $48 million by October 2024. $100 million by January 2025. $300 million by April 2025, per Michael Truell’s own disclosure to Lenny Rachitsky. $500 million by June 2025. $1 billion by November 2025. And now a staggering $2 billion in February 2026.

A 2,000x increase in 26 months. The doubling time from $1 billion to $2 billion: roughly 90 days.

At $2 billion ARR with around 300 employees, Cursor generates roughly $6.7 million in revenue per employee. Google generates about $1.7 million. Even the most efficient SaaS companies rarely crack $500,000.

The consumer comparison people reach for is ChatGPT, which hit 100 million users in two months. But ChatGPT is a freemium consumer product with far lower average revenue per user. Cursor charges $20 to $200 per month per seat. Growing this fast while charging real money, not just stacking free signups, is what makes the trajectory very unusual.

One metric from early 2025 captures the business dynamics. Cursor reported a 36% freemium-to-paid conversion rate. The industry average for SaaS freemium products sits between 2% and 5%. At 36%, the free tier is less marketing funnel, more brief audition before the cheque gets written.

That conversion rate points to something about the product itself. People try Cursor and, within a short window, decide they can’t go back. The switching cost isn’t contractual. It’s experiential. Once your workflow reshapes itself around an AI-native editor, reverting to plain VS Code feels like giving up autocomplete.

The fundraising escalator

Venture capital noticed early. Anysphere’s funding rounds compressed as aggressively as its revenue milestones.

Total raised: roughly $3.2 to $3.4 billion. The jumps: $400,000 to $400 million to $2.6 billion to $9.9 billion to $29.3 billion. Each round roughly tripled the prior valuation.

When a company raises $2.3 billion five months after raising $900 million, investors are competing fiercely for allocation, revenue is validating every prior bet, and the company sees opportunities to spend capital at a rate that justifies the dilution.

Four kids from MIT

Before Cursor became a financial phenomenon, it was four classmates writing code in an MIT dorm room. Michael Truell, Sualeh Asif, Aman Sanger, and Arvid Lunnemark, all computer science graduates from the class of 2022, founded Anysphere in 2022 with that initial $400,000 (which looks like a rounding error now).

They were ~20 years old. Three and a half years later, all four are billionaires. At the Series D valuation, each co-founder’s estimated stake of around 4.5% was worth approximately $1.3 billion.

The founding story is, in some ways, classically Silicon Valley. Four technical founders, a pre-seed that barely covers rent, an insight the incumbents are too slow to act on. But the insight itself was sharper than the typical startup pitch. Michael and the other three noticed something specific: GitHub Copilot’s plugin architecture was limited in ways that mattered. Copilot operated as a suggestion engine bolted onto an existing editor. It could autocomplete lines. It couldn’t reimagine the editing experience.

The bet: fork VS Code, the most popular code editor in the world, and rebuild it as an AI-native environment. That meant controlling the entire editor experience. The file tree, the terminal, the diff view, the chat, the tab completion. Every surface of the editor became an integration point for language models.

The decision to fork VS Code rather than build a plugin was the most consequential technical choice in the AI coding tools market. It traded compatibility for control.

Frankly, the audacity is easy to underestimate in hindsight. VS Code had (and has) an enormous extension ecosystem. Forking it meant maintaining compatibility with that ecosystem while diverging from it, taking on the maintenance burden of an editor that Microsoft staffs dozens of engineers to develop. Four people in a dorm room decided they could do it better than a trillion-dollar company.

They were right.

The team today

By November 2025, Anysphere had grown to over 300 employees. Still remarkably lean for a $2 billion revenue run rate. Snowflake had over 5,000 employees when it crossed $2 billion ARR. Slack had roughly 2,500 at $1 billion.

That revenue-per-employee figure (roughly $6.7 million at current rates) reflects a company where the product does most of the selling. Cursor doesn’t employ a traditional enterprise sales force. Developers download it, try it, pay for it, and tell their colleagues. The bottoms-up adoption model that Slack pioneered in the 2010s is operating at a pace Slack’s founders probably couldn’t have imagined.

How Cursor actually makes money

The pricing is simple. Four tiers for individuals, two for teams.

Cursor pricing tiers (as of March 2026)

The $20 Pro tier is the volume centre. When Cursor disclosed 360,000 paying customers in early 2025 at $100 million ARR, average revenue per user worked out to roughly $23 per month, tracking closely with the Pro price point. At $2 billion ARR, the paying base has grown substantially, though the company hasn’t disclosed updated numbers.

Look at the jump from Pro to Ultra. A 10x price increase from $20 to $200 suggests heavy usage generates roughly 10x the cost. The tier structure isn’t about feature differentiation. It’s about usage caps: how many completions, how many chat messages, how many agent runs per billing cycle.

The product evolution

Cursor launched as a smarter autocomplete tool. By early 2026, it had evolved into something closer to an autonomous coding agent.

The milestones came fast. In October 2025, Cursor launched a proprietary LLM called Composer, described as 4x faster than previous models and designed to reduce API costs by handling routine coding tasks without calling out to expensive external models.

In February 2026, Cursor shipped what the company called its “most significant update in Cursor’s history”: cloud agents with computer use. Background agents running on virtual machines that can execute multi-step tasks, run tests, browse documentation, and make commits, all without the developer watching. Alongside this came a plugin marketplace with integrations for Figma, Linear, Stripe, and AWS.

The direction is plain. Cursor started by making individual developers faster at typing code. It’s now positioning itself as a platform that handles entire workflows autonomously, from ticket to pull request.

Cloud agents are the logical endpoint of the AI coding tool thesis: the developer becomes a reviewer rather than a writer. Whether that’s a promotion or a demotion depends on who you ask.

The zero-margin paradox

Reports consistently suggest that Cursor spends roughly 100% of its revenue on AI API costs. Every dollar that comes in goes right back out to model providers.

This is the zero-margin paradox at the heart of AI coding tools. The product is demonstrably valuable. Users convert at 36%, an absurd rate. Revenue doubles every quarter. But the core input cost (access to frontier language models) is set by a handful of model providers, and it’s enormous.

The Composer bet

Cursor’s proprietary Composer model, launched in October 2025, is the company’s primary response to this cost problem. By training its own model for routine coding tasks (the bread-and-butter completions and edits that account for most API calls), Cursor can cut per-query costs on common operations while reserving expensive frontier model calls for the hardest problems.

The question is whether a company that has raised $3.4 billion can train models competitive enough to handle the workload. The top AI labs (Anthropic, OpenAI, Google) are spending tens of billions on training. Cursor doesn’t need to match them at the frontier. It needs to match them on the vast middle of coding tasks where a smaller, faster, cheaper model can do the job.

The SemiAnalysis observation that Microsoft is “renting GPUs to the barbarians who will ruin their castle” applies equally to the model providers selling API access to Cursor. Every successful Cursor query is a query that didn’t go through Copilot.

Where the money goes

The roughly $3.4 billion in total funding provides enormous runway, even at zero margins. If Cursor is truly spending all of its $2 billion ARR on costs, the funding covers the gap for years. The bet is that one or more of these things happen before the money runs out:

• Composer and successor models get good enough to handle 70-80% of queries at a fraction of the cost

• Model API prices keep falling (they have, dramatically, over the past two years)

• Enterprise contracts at custom pricing provide higher margins than individual subscriptions

• The platform play (marketplace, integrations) creates revenue streams that don’t scale with model costs

Well, the bears point out that every one of those assumptions has a counterargument. Proprietary models require enormous ongoing investment. API prices might fall, but so might subscription prices as competition intensifies. Enterprise contracts take time and sales infrastructure. And the platform play requires an ecosystem that doesn’t yet exist at scale.

The optimistic case is simple: Cursor occupies the position Amazon Web Services held in 2006. Lose money on every transaction, gain market share, build lock-in, then raise prices or cut costs once you own the market. The pessimistic case is also simple: AWS controlled the infrastructure. Cursor is renting it.

The great IDE war of 2026

The AI coding tools market has consolidated into something approaching three-way parity, and Cursor is in the mix against competitors with vastly deeper pockets. According to Recon Analytics data from January 2026, preference share among paid AI coding subscribers in the US breaks down to roughly GitHub Copilot at 24.9%, Cursor at 24%, and Claude Code at 24%. A year earlier, Copilot’s dominance was unquestioned.

GitHub Copilot: the incumbent under pressure

Microsoft’s Copilot disclosed 4.7 million paid subscribers in January 2026 earnings, putting it north of $1 billion in ARR with over 20 million cumulative users. By any normal standard, enormous numbers.

But the trend tells a different story. Copilot’s preference share among US paid AI subscribers dropped from 18.8% to 11.5% between mid-2025 and January 2026, according to Recon Analytics. That’s meaningful erosion, even if total subscribers still grow.

Honestly, there’s a telling corporate signal buried in Microsoft’s earnings. The company stopped reporting AI revenue as a separate line item after disclosing $13 billion in AI run-rate in January 2025. Companies stop breaking out metrics that stop improving. When a number accelerates, you shout about it. When it decelerates, you fold it into a larger segment where it’s harder to isolate.

Claude Code: the model provider as competitor

Anthropic’s Claude Code reached general availability in May 2025 and has grown aggressively since. Sacra estimates the Claude Code division generates approximately $2.5 billion in ARR, though the boundary between Claude Code revenue and broader Anthropic API revenue is blurry.

Claude Code takes a different approach. It’s a command-line tool, not an IDE. It doesn’t try to replace your editor. It operates alongside whatever environment you already use, including Cursor itself (many developers run both). The competitive dynamic is complicated by the fact that Cursor has historically relied on Claude as one of its primary underlying models.

The Windsurf saga

The most instructive competitive episode of 2025 involved Windsurf, the AI coding editor that briefly looked like a serious challenger.

Windsurf was doing roughly $82 million in ARR when OpenAI attempted to acquire the company for approximately $3 billion in May 2025. That deal collapsed. Google licensed Windsurf’s technology in July 2025. Cognition acquired its intellectual property and team later that same month.

Three months. From $3 billion acquisition target to absorbed for parts. This market doesn’t have room for fourth place.

The broader market

The total prize is considerable. The AI coding tools market was valued at roughly $7.37 billion in 2025, with projections ranging from $45 billion to $127 billion by 2032 depending on methodology. That wide range reflects genuine uncertainty about adoption curves, pricing evolution, and whether these tools expand the market for software development or just redirect existing spending.

Worldwide AI spending is forecast to reach $2.52 trillion in 2026, a 44% year-over-year increase according to Gartner. Coding tools are a thin slice of that total, but they’re the slice that touches the people building everything else.

Share

Why Cursor won (so far)

Three factors explain Cursor’s advantage, and none of them are the ones that surface-level takes focus on.

The fork advantage

Forking VS Code rather than building a plugin gave Cursor something no plugin-based competitor can replicate: control over the entire editing experience. When Cursor wants to add inline diffs, a composer panel for natural language instructions, or background agents in cloud VMs, it doesn’t work within the constraints of someone else’s extension API. It modifies the editor itself.

This sounds like a minor technical distinction. In practice, it’s an enormous competitive moat. Every plugin-based tool (including Copilot, unless Microsoft decides to fork its own editor, which would be an extraordinary admission of failure) is limited by what the host API allows. Cursor’s features are limited only by its own engineering capacity.

The model-agnostic bet

Cursor doesn’t build frontier models. Composer handles routine tasks, but the heavy lifting still goes to Claude, GPT-5, and others. This means Cursor benefits from improvements in any frontier model, from any provider. Anthropic ships a better Claude, Cursor gets better. OpenAI ships a better GPT, same thing.

Copilot, by contrast, is tightly coupled to OpenAI. It benefits from OpenAI improvements but can’t easily switch if Claude or Gemini pull ahead on coding benchmarks. Cursor’s model-agnostic architecture means it’s always running the best available model for each task, creating a subtle but persistent quality edge.

The developer-first distribution

Cursor spread through teams the way Slack spread through companies a decade ago: one person tries it, becomes visibly more productive, and the rest start asking what they’re using. The 36% freemium-to-paid conversion rate reflects a product that sells itself through direct experience.

Cursor’s distribution inverts the traditional enterprise sales playbook. Instead of selling to CTOs who push tools down to developers, Cursor sells to individual developers and lets adoption pressure flow upward.

By mid-2025, Cursor reported over 100,000 new projects being built daily on the platform. That organic activity creates a flywheel: more users, more feedback, better product, more users. The customer list (OpenAI, Stripe, Spotify, Midjourney, Perplexity) serves as social proof that accelerates adoption among the next tier of companies.

There’s also, frankly, a demographic factor. Cursor was built by people who were in their early 20s when they started. The product reflects the sensibility of developers who grew up with language models as a baseline assumption, not a novelty. The design choices, the interaction patterns, the defaults: they feel native to a generation that expects AI assistance as a given. Older tools, including Copilot, feel retrofitted.

The productivity question beneath the hype

About 46% of code written by active developers now comes from AI, according to 2026 estimates. Nearly half of all production code, at least in first draft, generated by a machine. The number keeps climbing.

The assumption baked into Cursor’s valuation (and the broader AI coding market) is that AI tools make developers substantially more productive. More productive developers mean companies need fewer of them, or can build more with the same headcount, or can ship faster. Any of those outcomes justifies $20-200 per developer per month.

But the evidence is more complicated than the narrative.

The MERL Tech study

A randomised controlled trial by MERL Tech found that experienced open-source developers were actually 19% slower when using AI coding tools compared to working without them. The study has been disputed on methodological grounds (the tasks may not have been representative of typical professional work, and the sample size was modest), but it’s the most rigorous experimental evidence available, and it points in an uncomfortable direction.

The result deserves consideration, not dismissal. One plausible explanation: experienced developers have deeply optimised workflows, and inserting an AI assistant disrupts those workflows in ways that cost more time than the AI saves. The developer has to review generated code, decide whether to accept or reject it, mentally model what the AI is doing, and handle the cases where it’s wrong. For someone who already knows the codebase and types fast, that overhead may exceed the benefit.

The MERL Tech finding doesn’t mean AI coding tools are useless. It means productivity gains may be concentrated among less experienced developers and on certain kinds of tasks, while experienced developers pay a “supervision tax” that eats into the time savings.

The Karpathy paradox

Andrej Karpathy, the former Tesla AI director who coined the term “vibe coding,” has himself stopped vibe coding for serious projects. When the person who named the practice stops doing the practice, that tells you something.

The likely explanation is familiar to anyone who’s used these tools extensively. AI-generated code works brilliantly for greenfield projects, prototypes, scripts, and throwaway work. It works less well for production systems with complex state management, subtle performance requirements, and codebases carrying years of institutional knowledge. The gap between “write me a function that does X” and “modify this function in a way that respects the 47 implicit constraints in this codebase” is precisely where AI coding tools struggle most.

The dependency question

Critics raise a deeper concern: AI coding tools create a dependency that gradually erodes fundamental programming skills. If 46% of your code is AI-generated and you’re spending your time reviewing rather than writing, you’re exercising a different cognitive muscle. Over time, the review muscle strengthens and the creation muscle atrophies.

Sure, this argument has been made about every productivity tool since pocket calculators. And historically, the alarmists have mostly been wrong. Calculators didn’t make mathematicians worse at maths. Spell-checkers didn’t make writers worse at spelling. (Well, maybe a little.)

But code is different from arithmetic or spelling in one respect. Code involves holding complex systems in your head, and the ability to do that comes from practice. If AI handles the routine work that builds and reinforces that mental model, the question is whether the model degrades.

Nobody has a definitive answer yet. The question is worth more than the dismissive hand-waving it usually gets.

What $2B means for the profession

There are roughly 50 million software developers worldwide, according to SlashData’s 2025 estimates. Cursor alone generates $2 billion in annual revenue from a fraction of them. Add Copilot’s billion-plus, Claude Code’s estimated $2.5 billion, and the long tail of smaller competitors, and the AI coding tools market is already extracting serious money from the global developer population.

Where does it come from? If companies pay $20-40 per developer per month and those tools genuinely boost productivity, the cost is easily justified. A developer earning $150,000 per year costs their employer about $200,000 fully loaded. A 10% productivity improvement from a $480/year tool is an extraordinary return.

But if the productivity improvement is real and large, the second-order effects matter more.

The junior developer squeeze

The tasks AI coding tools handle best (boilerplate, simple functions, CRUD operations, test generation, documentation) are exactly the tasks junior developers have historically cut their teeth on. If AI increasingly handles those, the entry-level pipeline narrows.

This is already showing up anecdotally. Hiring managers report that junior candidates who leaned heavily on AI tools during education struggle with basic debugging and problem decomposition when the tools aren’t available. The tools that make senior developers more productive may simultaneously be making the path from junior to senior harder to walk.

The IDE as platform

Cursor’s February 2026 plugin marketplace signals ambition beyond code completion. If Cursor becomes the environment where developers spend their entire working day, it becomes a platform in the same sense as iOS or Android. Third-party developers build on it. Companies integrate with it. The editor becomes the operating system for software development.

The integrations tell the story. Figma for design-to-code. Linear for project management. Stripe for payments. AWS for deployment. If all of these are accessible within the Cursor interface, a developer might never leave the editor. That’s lock-in of the most powerful kind: not contractual, but habitual.

The 85% question

One statistic hangs over the conversation: 85% of developers use the JetBrains IDE ecosystem (IntelliJ, PyCharm, WebStorm, and others). That’s a massive installed base that Cursor, a VS Code fork, doesn’t natively serve. JetBrains has its own AI assistant, and many of these developers have years of muscle memory and configuration invested in their setup.

Right, Cursor’s growth so far has come predominantly from the VS Code universe. There’s an enormous population of developers who haven’t considered switching because the cost, measured in workflow disruption, isn’t worth it. If Cursor can crack the JetBrains population, the growth story has another gear. If it can’t, there’s a ceiling.

The bull case and the bear case

Any honest analysis has to hold two contradictory ideas at once: this is the fastest-growing B2B software company in history, and it might be spending every dollar it earns.

The bull case

The bull case rests on historical parallels and trend lines.

Model costs are falling. Cost per token for frontier language models has declined by roughly an order of magnitude per year since GPT-3. If that continues (and there’s structural reason to think it will, as hardware improves and architectures get more efficient), Cursor’s margin problem resolves itself over time. The company that can survive at zero margins while costs fall becomes enormously profitable when costs fall far enough.

Proprietary models will absorb volume. Composer and its successors don’t need to match Claude or GPT-4 on the hardest tasks. They need to handle the 70-80% of queries that are routine enough for a smaller model. If Cursor shifts that traffic onto its own infrastructure, the unit economics improve dramatically.

The platform play creates new revenue. A marketplace with Figma, Linear, Stripe, and AWS integrations can charge commissions, listing fees, or premium placement. These revenue streams don’t scale with model costs.

The market is still early. With ~50 million developers worldwide and AI coding tool penetration still in the single-digit millions of paid seats, the addressable market is enormous. Projected growth to $45-127 billion by 2032 would make Cursor’s current $2 billion look like an early milestone.

Network effects are compounding. More users generate more data about coding patterns, which improves autocomplete and agent quality, which attracts more users. The company with the most users builds the best product. This flywheel favours the leader.

The bear case

The bear case is serious too, and it doesn’t require any bull case assumptions to be wrong. It just requires them to be slow.

The margin problem may not self-correct. If Cursor grows usage faster than model costs decline, margins stay at zero or go negative. A company generating $2 billion in revenue with zero margin is functionally a non-profit that has raised $3.4 billion in donations from venture capitalists.

Model providers are competitors. Anthropic (Claude Code) and potentially OpenAI both sell AI coding tools directly. They have a structural cost advantage: they don’t pay API costs to themselves. Cursor is funding the R&D of one of its principal competitors every time it calls Anthropic’s API.

The fork is a liability, not just an asset. VS Code is actively developed by Microsoft, which ships updates constantly. Cursor has to merge upstream changes while maintaining its divergent features. As VS Code evolves (and as Microsoft potentially adds AI-native features directly), the maintenance burden grows. If Microsoft breaks compatibility in ways that hurt forks, Cursor’s entire foundation is at risk.

Enterprise stickiness isn’t proven. Cursor’s bottoms-up adoption is powerful, but enterprise procurement departments evaluate vendors on SOC 2 compliance, data residency, long-term viability, and vendor lock-in. A company with zero profits and a dependency on third-party model providers may struggle to pass enterprise screens at the largest organisations.

Copilot has distribution money can’t buy. Every GitHub repository, every Azure subscription, every Visual Studio installation is a potential Copilot distribution point. Microsoft has a sales force covering every major enterprise on Earth. Cursor’s bottoms-up model is fast, but Microsoft’s top-down model is relentless.

The honest assessment

The best comparison isn’t other SaaS companies. It’s the early days of cloud computing.

In 2006, Amazon Web Services was a money-losing experiment most analysts dismissed. Infrastructure costs were enormous, margins thin, and the incumbents (IBM, Oracle, HP) had distribution advantages that seemed insurmountable. AWS succeeded because it was right about the direction of the market and willing to sustain losses long enough for the economics to tip.

Cursor’s bet is structurally similar. The market direction (developers writing code with AI assistance) seems irreversible. The question is whether Cursor can sustain the economics long enough, and whether the competitive dynamics are forgiving enough, for the bet to pay off.

The $3.4 billion in funding provides runway measured in years, not months. The $2 billion in revenue demonstrates product-market fit at scale. Near-parity with Copilot and Claude Code demonstrates competitive viability.

But the margins. The margins remain the thing nobody on the bull side wants to discuss in concrete terms, and the thing the bear side keeps circling back to.

Cursor may be the fastest-growing B2B software company in history. It may also be the largest company ever to generate $2 billion in revenue without demonstrating a path to profitability. Both things can be true at once.

The four founders who started in an MIT dorm room in 2022 are now billionaires running a company that has raised more capital than most public companies ever will. Their product has reshaped how millions of developers write software. Their revenue growth has shattered records that stood for decades.

And every morning, they face the same question every AI application company faces in 2026: can you build a durable business when your most important input (access to intelligence) is a commodity controlled by someone else?

The next twelve months will provide an answer. The proprietary models will either work well enough to shift economics, or they won’t. The marketplace will either generate independent revenue, or it won’t. The enterprise contracts will either provide premium margins, or they won’t.

Anthropic’s overall revenue reportedly sits at $14 billion ARR as of February 2026. OpenAI closed 2025 at over $20 billion ARR. The model providers are getting richer at least as fast as the application layer. Whether the application layer captures durable value, or merely intermediates it before the model providers absorb the market, is the defining question of this moment in AI.

Cursor’s $2 billion is either the beginning of that answer or a very expensive way of asking the question.

[1] The $6.7 million revenue-per-employee calculation uses the $2B ARR figure and the most recent headcount disclosure of 300+ employees from November 2025. Actual current headcount may be higher, which would reduce this figure.

[2] Market share figures from Recon Analytics measure “preference share among US paid AI coding subscribers,” which is a narrower metric than global market share by revenue or total users. Different methodologies produce different rankings.

[3] The MERL Tech RCT measured task completion time on specific open-source contribution tasks. Critics have argued that these tasks are not representative of typical professional development work, which involves more context-switching, codebase navigation, and collaborative workflows where AI tools may provide different benefits.

Andrej Karpathy typed a tweet on 2 February 2025 and accidentally named a movement. “There’s a new kind of coding I call ‘vibe coding’,” he wrote, “where you fully give in to the vibes, embrace exponentials, and forget that the code even exists.” Within weeks the phrase had its own Wikipedia article in 33 languages¹. By year’s end, Collins Dictionary named it their Word of the Year. J.P. Morgan published a formal guide. And in Addis Ababa, Lagos, Dubai, Singapore, and a dozen other cities where the phrase had never been heard, people who had never written a line of code were already doing the thing Karpathy described. They were building software for problems no venture-backed startup had bothered to notice.

Read more

Somewhere between GoDaddy’s Super Bowl ads and Cloudflare’s enterprise pitch decks, a cartoon pig in a cowboy hat has been accumulating millions of domain registrations. What we have is a Portland company with near-wholesale pricing and a mascot that wears a different costume on every page of the website.

Porkbun is now one of the fastest-growing domain registrars on earth, and most people outside of web development forums have never heard of it.

The story of how it got here involves a registry insider who knew exactly how much money registrars were pocketing, a Google product shutdown that sent ten million domains scrambling for a new home, and an internet community that turned into an unpaid sales force. It also involves, for reasons nobody has adequately explained, a deep commitment to the aesthetic of a cartoon pig 🐽.

The person behind the pig

Raymond King has been starting companies since he was a teenager. In 1984, using four Apple II computers and his bedroom, he taught people BASIC programming and Visicalc. That venture, The Computer School, was featured on EyeWitness News and in The New York Times.

He was in high school.

As a sophomore at MIT, Ray wrote project management software for his father’s architectural firm. That side project became Semaphore, Inc., which by 1990 was rated number one in its space by ARCHITECTURE Magazine. Over fourteen years, Semaphore grew to more than 100 employees across four offices and 2,500 clients before Deltek Systems acquired it in 2000.

Then came Portland. After the acquisition, Ray moved from New York City to Oregon and co-founded SnapNames, a company that invented new ways for people to acquire expiring domain names. SnapNames grew to more than $49 million in annual revenue before Oversee.net acquired it in 2007. This was his entry into the domain industry proper, and he never left.

He created ICANNWiki (the wiki itself, which is a major reference for the domain industry), founded AboutUs.org (billed as the world’s largest editable index of the web), and in 2013 launched Top Level Design LLC to apply for new top-level domains through ICANN’s gTLD programme. Top Level Design submitted applications for ten TLDs: .art, .blog, .design, .gay, .group, .ink, .llc, .photography, .style, and .wiki.

So by the time Porkbun appeared, Ray had spent four decades building and selling companies, including two acquisitions and direct visibility into every fee structure in domain registration. Both Top Level Design and Porkbun are based in Portland, and both keep an unusually low public profile. Ray has appeared on Andrew Allemann’s Domain Name Wire podcast and participated in ICANN’s Registrar Stakeholder Group, but he hasn’t done the rounds on major tech podcasts or given keynotes at Web Summit.

A teenager who taught BASIC from his bedroom in 1984 is now running one of the fastest-growing domain registrars on earth. That’s a forty-year arc.

Subscribe now

From registry to registrar

To understand Porkbun, you need to understand the economics of domain names, which are stranger than they first appear.

When you buy a domain, you’re not really buying it from the registrar. You’re buying it from the registry (the organisation that controls a top-level domain like .com or .design), and the registrar is the shopfront. The registry charges a wholesale price. The registrar marks it up. The difference is profit.

For .com domains, Verisign (the registry) charges registrars about $9.59. A registrar that sells a .com for $10 is making roughly 41 cents. A registrar that sells it for $22 is making over $12.

The spread between wholesale and retail is where the entire registrar business model lives. And in 2012, Ray got a front-row seat to exactly how wide that spread was.

That year, ICANN opened applications for new generic top-level domains. Top Level Design applied for ten of them, including .design, which was delegated to the DNS root zone in 2014, with general availability following in 2015. Running a registry meant Ray saw every registrar’s wholesale purchase price, saw what they charged consumers, and understood the fee structures inside and out.

He knew, in precise dollar terms, how much margin registrars were pocketing on every sale.

So he started one that didn’t.

2014: a registrar is born (sort of)

Porkbun was founded in 2014, the same year .design hit the root zone. But founding a domain registrar and actually being able to sell domains are two different things. You need ICANN accreditation, which requires meeting technical, financial, and operational standards that take time. Porkbun received ICANN accreditation around 2016, assigned IANA Registrar ID 1861.

The two-year gap between incorporation and accreditation is a blank spot in the company’s history. Porkbun likely operated through a reseller arrangement during this period, but the company hasn’t published a detailed origin story, and no definitive founding interview exists in the public record. (A genuine research gap. If you know the full story, I’d love to hear it.)

The name itself references char siu bao, the Cantonese barbecue pork bun. Why? The company has never given a formal explanation beyond wanting something fun and memorable. In an industry populated by names like “Tucows,” “Dynadot,” and “Gandi,” the bar for whimsy was already low. Porkbun cleared it.

Naming your domain registrar after a Cantonese steamed bun and giving it a cartoon pig mascot is either a terrible branding decision or a brilliant one. The growth numbers suggest the latter.

The anti-GoDaddy proposition

Porkbun’s pitch can be summarised in a single sentence: everything GoDaddy charges extra for, we include for free.

Consider what domain registration looked like for most of the 2010s. GoDaddy, the market leader with over 80 million domains under management, had perfected the dark-pattern playbook. The headline price for a .com might be $0.99 for the first year, which sounds great until you discover renewal is about $22. WHOIS privacy protection, which keeps your personal details out of the public domain registration database, cost around $10 per year. SSL certificates were an upsell. And the checkout flow? A labyrinth of pre-checked boxes for services you didn’t ask for.

Porkbun took each of those pain points and inverted them.

WHOIS privacy: free, enabled by default, from the beginning. At a time when most competitors charged $8 to $15 per year per domain for this, Porkbun just included it. If you had fifty domains, that alone saved you $400 to $750 annually.

SSL certificates: free, via Let’s Encrypt integration, available from roughly 2017 or 2018. Again, competitors were charging for these.

Pricing: near-wholesale. A .com registration at Porkbun runs about $9.73, with renewals at roughly $10.18. Compare that to GoDaddy’s ~$22 renewal price. Cloudflare Registrar, which explicitly bills itself as an at-cost registrar, charges about $9.77. Porkbun is competitive with Cloudflare on price while offering a wider TLD selection and more features.

And the checkout? Clean. No pre-checked upsells. No “Are you sure you don’t want website security?” modals. You pick a domain, you pay for the domain, you get the domain.

The pricing transparency deserves special mention. Porkbun shows renewal prices right alongside registration prices. This sounds like it should be table stakes. It is definitely not. Many registrars bury the renewal price or make it hard to find, because the business model depends on the gap between what hooks you and what keeps you.

When your competitive advantage is “we tell you the price and charge you the price,” something has gone seriously wrong with your industry.

The Google Domains exodus

For years, Porkbun grew steadily but modestly. It had a devoted following on Reddit and Hacker News, and a reputation in developer circles as “the one your friend who knows about domains recommends.” Growth was organic and word-of-mouth.

Then Google handed them a gift.

On June 15, 2023, Google announced it was selling Google Domains to Squarespace for approximately $180 million. Roughly ten million domains would be transferred to Squarespace’s management.

The reaction was immediate and understandably furious. Google Domains had been popular with developers (myself included) and small business owners precisely because it was simple, fairly priced, and backed by Google’s infrastructure. Squarespace, a website builder, was not what those customers had signed up for. Many saw it as yet another entry in Google’s long history of killing products. (Because of course it was.) The trust was broken.

Within hours of the announcement, Reddit threads in r/webhosting, r/selfhosted, r/webdev, and r/Domains lit up with a single question: Where should I move my domains?

The answer, overwhelmingly, was Porkbun.

Thread after thread. Comment after comment. “Porkbun.” “I moved everything to Porkbun last year, no regrets.” “Cheapest prices, no BS, clean interface.” The Hacker News sentiment was similar: one commenter wrote that Porkbun was “what Google Domains should have been.”

Porkbun, to their credit, was ready. They published migration guides and ran transfer promotions. They didn’t gloat. They just opened the door and let the flood come through.

The Google Domains shutdown was a once-in-a-decade event for the domain industry. Ten million domains, suddenly in play. And Porkbun, which had spent years building goodwill in exactly the communities those domain holders belonged to, was positioned to catch a disproportionate share of the migration.

Google spent years building a domain registrar. Then they sold it. And the biggest beneficiary was a company named after a steamed pork bun.

Where the pig stands today

Porkbun doesn’t publicly disclose its domain count or revenue. This makes precise market positioning difficult, so take rankings with appropriate salt.

What we can say: Porkbun consistently ranks in the top 10 to 15 registrars for new gTLD registrations, and estimated top 20 to 30 overall when including legacy TLDs like .com and .net. For context, the registrar market is dominated by giants. GoDaddy manages over 80 million domains. Tucows (which owns Hover and Enom) sits around 25 million. Namecheap manages roughly 17 million. NameSilo, another budget-focused registrar, handles about 5 to 6 million.

Porkbun’s total is somewhere in the millions, and growing faster by percentage than nearly all of the companies above it.

The company has earned an otherworldly Trustpilot rating of 4.9 out of 5 across over 22,000 reviews and was included in Forbes' “Best Domain Registrars” list. Customer support, the thing budget providers usually botch, is widely praised as responsive and human.

The team remains lean. Estimates put headcount at 20 to 40 people, which is small for a registrar managing millions of domains. And the product has expanded beyond domain registration to include email hosting, basic web hosting, one of the widest TLD selections in the industry, and a full REST API for domain management that developers actually enjoy using.

And yes, the pig is still everywhere. Different costumes for different pages. A pig in a detective outfit on the 404 page. A celebratory pig animation when you register a domain. Seasonal themes. Food-themed coupon codes. Conference stickers that have become collector’s items at NamesCon events.

The whole vibe is aggressively unpretentious, and in an industry defined by corporate blandness (Verisign) or aggressive salesmanship (GoDaddy), that turns out to be an effective market position.

The bootstrapped path

The most striking thing about Porkbun is the thing it hasn’t done: raise money.

No known venture capital. No private equity. No acquisition. In an era when seemingly every tech company rushes to raise a Series A before the product is even stable, Porkbun has grown entirely on its own revenue.

That’s both impressive and constraining. Without external capital, Porkbun can’t buy market share through massive advertising campaigns. It can’t acquire competitors or staff up to 500 engineers and build every feature at once.

But it also can’t be forced to compromise its pricing model to satisfy investor return expectations. It can’t be pressured into adding upsells, and it can’t be acquired by a private equity firm that strips the business for parts (a fate that has befallen several registrars, including the once-beloved Tucows portfolio).

The absence of venture capital is the reason the business model works. The moment you take investor money, someone starts asking why you’re not charging more.

The growth engine instead has been community advocacy. Reddit threads. Hacker News comments. Developer Slack channels. Blog posts by people who transferred their domains and had a good experience. Word of mouth, in its purest form.

Porkbun’s marketing budget appears to consist of: making the product good, keeping prices low, putting a pig on things, and showing up to domain industry conferences with stickers.

That’s it. (Honestly, I’ve looked. That really does seem to be it.)

This is not a strategy that works for every company. It works here because domain registration is a referral-driven market. Nobody impulse-buys a domain registrar. They ask someone they trust. And when the person they trust says “use Porkbun,” the sale is basically done.

What a pig can teach us about internet infrastructure

Porkbun’s rise tells a story about what happens when an insider decides to compete honestly in a market defined by information asymmetry.

Ray knew the numbers. He’d seen the gap between what registries charge and what registrars charge consumers. He knew WHOIS privacy cost registrars essentially nothing to provide, that SSL certificates via Let’s Encrypt were free, that the upsells and dark patterns and checkout labyrinths were choices.

So he built a registrar that chose differently.

The domain registration market is one of the most commoditised on the internet. Every registrar sells access to the same product, the same database, the same fundamental service. Differentiation should be nearly impossible. And yet Porkbun has differentiated itself so thoroughly that people form emotional attachments to it. People like their domain registrar. That’s weird. Nobody likes their domain registrar.

The company has limitations. The deliberate privacy of its leadership means there’s no clear succession plan or public accountability structure. The lack of disclosed financials makes it hard to assess long-term stability. And as Porkbun grows, a team of 20 to 40 people will face scaling challenges that community goodwill alone can’t solve.

But for now, in 2026, Porkbun occupies a rare position: a bootstrapped company that grew by treating customers fairly, in an industry that has historically done the opposite, led by someone who’s been building and selling companies since before most of his users were born.

All with a cartoon pig. Oink.

I write regularly about the companies and infrastructure behind the internet. If stories like this are useful to you, hit follow so you catch the next one.

The news, and why it sat differently

On Saturday, Claude became the #1 free app on the US App Store. It is now ahead of ChatGPT, TikTok, Dick’s Sporting Goods, and whatever game your nephew won’t stop playing.

The trajectory was steep. According to Sensor Tower data cited by CNBC, Claude was ranked #131 on January 30. By late February it had climbed through the top 20. Then, on a Saturday evening, it was sitting where ChatGPT had lived comfortably for over a year.

Mashable and TechCrunch both confirmed the milestone. Meanwhile, a growing “QuitGPT” movement was driving ChatGPT users to cancel subscriptions and look for alternatives. The market share data tells the story: ChatGPT’s grip on the generative AI market has been slipping at the hands of smaller competitors all year.

But the ranking itself is a vanity metric. App Store charts always are for AI companies. The real question is why Claude got there, and what the path reveals about where AI platforms are headed for anyone building on top of them.

How a Pentagon ban became a growth hack

The short version: on February 27, the Trump administration blacklisted Anthropic from government work. Defence Secretary Pete Hegseth designated the company a “supply chain risk to national security” after Anthropic refused to loosen its AI safety guardrails for military use. Hours later, OpenAI struck a deal with the Pentagon for use of its models in classified networks.

The contrast could not have been sharper. And the internet responded exactly how you’d expect. “Too ethical for war” became a meme, then a rallying cry, then a reason to download the app. A QuitGPT campaign that had been simmering since January surged as people cancelled ChatGPT subscriptions in protest. Claude’s App Store ranking shot up overnight.

That’s the OpenAI brouhaha in brief. You can read the takes elsewhere. What matters here is what it set in motion.

But the Pentagon story, entertaining as it is, explains the spark. It doesn’t explain the fire. For that, you need to look at what was already smouldering.

The developer story behind the consumer headline

Claude didn’t climb the App Store because of a meme. It climbed because Anthropic spent 2025 building out the strongest developer ecosystem in AI, and the consumer growth was a trailing indicator of something half a million developers already knew.

Claude Code changed how developers work with AI

Claude Code is an agentic coding tool that lives in your terminal. You point it at a codebase. It reads what it needs to read. It makes changes across multiple files. It runs your tests. It asks whether to continue.

It’s been widely adopted by software engineers since its launch, and Claude Code alone now generates over $2.5 billion in annualised revenue, more than doubling since the start of 2026. That’s a single developer tool generating SaaS-unicorn revenue.

That last point matters more than the download numbers. Consumer apps come and go. Developer tools that become part of someone’s daily workflow are very, very sticky. Think about how many developers have tried to quit VS Code. (Exactly.)

MCP became the protocol everyone adopted

Model Context Protocol launched in November 2024 as Anthropic’s answer to a simple question: how should AI connect to external tools and data? Think of it as a USB standard for AI. Instead of every AI model needing custom integrations with every tool, MCP provides a common interface.

The real power move wasn’t building MCP. It was open-sourcing it so competitors had no reason not to adopt it.

And adopt it they did. OpenAI announced MCP support in late 2025. Google and Microsoft followed. In December 2025, Anthropic donated MCP to the Linux Foundation’s Agentic AI Foundation, co-founded with OpenAI and Block. It’s no longer Anthropic’s protocol. It’s the industry’s.

There are now thousands of community-built MCP servers, with SDKs in multiple languages. Hundreds of companies have published their own.

If you’re not a developer, here’s the analogy. Imagine Apple inventing the charging cable, and then Samsung, Google, and every other phone maker voluntarily adopting it because it was genuinely better than what they had. That’s roughly what happened. Anthropic built a standard, open-sourced it, and now controls a piece of infrastructure that every major AI platform depends on.

The API ecosystem grew threefold