The Board Room

Deep dives

1. 01

   The AI Valuation Reckoning Is Now Being Called By Name — And the Smart Money Is Positioning

   Josh Wolfe of Lux Capital did something no major VC has done publicly since Sequoia's 2008 'RIP Good Times' memo: he stood up and told the industry that fewer than 10 AI startups actually matter, while everyone else is riding a bubble the industry is 'afraid to talk about.' What gives this credibility isn't contrarianism — it's the source. Lux backed Cognition, Hugging Face, Applied Intuition, and Runway, and just raised $1.5 billion in January 2026 to deploy into science and tech. When an investor with that level of commitment and fresh capital says the vast majority of the AI startup ecosystem is noise, it's informed triage, not nihilism.

   The Numbers That Justify the Warning

   The industry's 10.3:1 spend-to-revenue ratio — $443B in AI infrastructure investment versus $51B in AI revenue — is the structural foundation for Wolfe's call. Barclays calculates you'd need 12,000 ChatGPT-scale products to justify current capex. For context, this ratio is 4x worse than cloud computing at the equivalent stage of maturity. MIT's finding that 95% of enterprise AI initiatives deliver zero measurable P&L return confirms this isn't a revenue-timing problem — it's a value-realization crisis.

   The Market Is Already Pricing This In

   Three simultaneous signals confirm the correction is underway, not pending:

   • $57B+ in defensive buybacks: Salesforce ($50B), ServiceNow ($5B with a $2B accelerated tranche), and Pinterest ($2B backed by Elliott Management's $1B fresh position) all announced in weeks — management teams collectively betting their stock is cheaper than it should be because AI disruption fears overshot.
   • $2T in SaaS market cap destruction in 2026, as the market reprices the fundamental defensibility of seat-based software.
   • An IPO race: Anthropic and OpenAI are both taking steps to go public; Wolfe explicitly advised AI startups to 'rush to get public as fast as possible' while enthusiasm persists.

   When the industry's smartest capital allocators are simultaneously calling the bubble, engineering buyback floors, and racing for the IPO window — the correction isn't a risk to plan for. It's a reality to position around.

   The Contrarian Signal Inside the Bear Case

   Here's the tension: Anthropic more than doubled to ~$20B ARR in a single quarter. If the spend-to-revenue gap is closing that fast for the winners, the correction may be highly selective — devastating for the hundreds of undifferentiated AI startups while accelerating value concentration into the fewer-than-10 that matter. This isn't a 2000-style broad washout; it's a power law consolidation where the top players capture generational value while everyone else returns capital.

   What This Means For Your Portfolio

   Every AI vendor, partner, and investment in your ecosystem needs a survivability rating. The question isn't 'is AI real?' — it is. The question is whether your specific AI dependencies are among the 10 that matter or the hundreds that don't. The companies that prepared distressed acquisition lists and pre-negotiated term sheets during the 2022 crypto winter captured outsized value. The same window is opening now in AI.

   What to do

   1. →

      Conduct a survivability audit of every AI vendor and partner in your technology stack — stress-test each against a 50% funding reduction scenario

      This sprintWolfe's call will accelerate VC skepticism; your weakest-link AI dependency will be the first to feel the pressure
   2. →

      Build a distressed AI acquisition target list with pre-negotiated term sheet frameworks for 3-5 companies with defensible technology but weak capital positions

      This sprintThe 12-18 month window before failed AI startups liquidate is the optimal buying window — preparation now enables speed later
   3. →

      Stress-test your own capital plan against a recession scenario with restricted capital market access, specifically modeling $100/barrel oil overlay

      This quarterBond yields are flashing recession signals while equities hover near highs — the classic precursor pattern that compounds AI correction risk
   4. →

      Evaluate AI capex exposure across your investment portfolio and supply chain for a 30-50% correction in AI infrastructure spending

      This quarterAt 10.3:1, the spend-to-revenue correction is structurally inevitable — the only variable is timing
2. 02

   Coruna: The Leaked U.S. Exploit Kit That Just Killed the 'iOS Is Secure' Enterprise Assumption

   Google Threat Intelligence Group and iVerify have identified what they describe as the first mass-scale iOS attack — 42,000+ devices confirmed compromised, with likely many more undiscovered. The weapon: Coruna, an exploit kit that appears to have leaked from a U.S. government offensive cyber framework, now being wielded by Chinese cybercriminals, Russian state actors targeting Ukraine, and commercial spyware vendors simultaneously.

   This Is EternalBlue for Mobile

   The proliferation pattern is identical to the 2017 EternalBlue leak that produced WannaCry and NotPetya, causing billions in damage:

   1. Government develops offensive capability
   2. Capability leaks to the open market
   3. Multiple threat actors weaponize it independently
   4. Mass exploitation follows at scale

   Researchers are now describing a 'second-hand zero-day market' as a structural feature of the threat landscape. The implicit trust in iOS as an inherently secure platform — which has underpinned enterprise BYOD and executive device policies for a decade — is no longer defensible at the board level.

   Compounding Threat: Agentic AI Browsers Have an Unfixable Flaw

   Simultaneously, Zenity Labs discovered that prompt injection attacks can hijack agentic browsers through calendar invites — gaining access to local files, exfiltrating data, and taking over password managers without any malware. The critical finding: researchers assess these flaws 'may never be fully eliminated' because the autonomous inference that makes agentic browsers useful is the same property that makes them exploitable. Perplexity patched Comet's specific vulnerabilities, but the architectural problem persists across every agentic browser.

   Identity Is Now the Primary Attack Vector

   Palo Alto Networks reports that identity weaknesses appear in 89% of breach investigations. Microsoft disclosed attackers are exploiting legitimate OAuth redirection behavior to bypass phishing defenses. Cloudflare's first threat intelligence report advocates measuring 'effectiveness' over 'sophistication' — identity-based attacks now achieve outcomes equivalent to sophisticated malware at a fraction of the effort. The Salesloft/Drift attack impacting 700+ companies through trusted SaaS relationships is the proof point.

   The Coruna leak, agentic browser flaws, and identity-as-attack-vector are converging during a period of CISA leadership hollowing — Robert Costello, an 18-year DHS veteran, was reportedly forced out alongside other senior officials. Expect degraded government coordination precisely when you need it most.

   The Governance Vacuum

   This convergence hits during the widest AI governance gap in enterprise history: 94% of CIOs are increasing AI spend, but 62% are compromising on governance and only 44% claim to understand the risks — while 60% of organizations already have agents in production. The 40% citing security and compliance as their top scaling blocker aren't being cautious. They're being rational.

   What to do

   1. →

      Commission an immediate mobile threat posture review focused on iOS fleet exposure to Coruna-class exploits — evaluate iVerify, Lookout, and Zimperium for detection capabilities by end of week

      Now42K+ confirmed compromises from a still-proliferating exploit kit; your executive devices are high-value targets
   2. →

      Establish an agentic AI security governance framework before expanding enterprise-wide deployment of any agentic browser or autonomous AI tool

      This sprintThe architectural flaw may never be fully eliminated — governance must precede scale
   3. →

      Direct CISO to produce a detection gap assessment for legitimate cloud service C2 abuse (Google Drive, OneDrive, Slack) and present to the board within 30 days

      This sprintAPT41's Silver Dragon is operationally using Google Drive as C2; your network detection is almost certainly blind to this vector
   4. →

      Diversify threat intelligence sources to reduce dependency on CISA coordination — build redundancy with ISACs and commercial threat feeds

      This quarterCISA institutional destabilization means degraded advisory and coordination quality during the highest-threat environment in years
3. 03

   Strait of Hormuz Closure Escalates: Model for $100 Oil and Repriced Cost Structures

   What was a geopolitical disruption flag earlier this week has become the most consequential energy supply event since Russia's invasion of Ukraine. Iran's Strait of Hormuz blockade — through which one-fifth of global petroleum transits — has been compounded by Iraq shutting down 3 million barrels per day of production. Brent crude stands at $85, with analyst projections of $100 within weeks if the conflict widens along current trajectory. Diesel futures posted their largest single-day jump since the first Gulf War.

   This Is Structural, Not Transient

   Three factors distinguish this from a routine oil spike:

   • Supply removal is structural: Iraq's production shutdown removes supply at the source, not just the transit route
   • No SPR release signaled: The administration's decision not to tap the Strategic Petroleum Reserve's 415 million barrels suggests either confidence in military resolution or a desire to preserve that lever for escalation — either way, the market absorbs the pain
   • Conflict is widening: Signals point to expansion into Lebanon and Dubai, not containment

   Markets are pricing in conflict containment, not escalation — creating asymmetric downside risk. The executives who will navigate this best are modeling for escalation while hoping for containment, not the other way around.

   Cascading Business Impact

   The second-order effects hit technology companies harder than the headline suggests:

   Cost Line	Mechanism	Magnitude
   Cloud/data center energy	Direct electricity cost increase	5-15% at $100/bbl
   Supply chain logistics	Diesel is the backbone of commercial shipping	Largest single-day futures jump since Gulf War
   AI compute procurement	Energy-intensive training and inference	Compounds existing infrastructure constraint
   Middle East operations	Direct security exposure	AWS data centers physically destroyed by drone strikes

   The Administration's Response Posture

   Trump's offer of naval escorts and political risk insurance for Hormuz transit is creative but untested — and implicitly acknowledges the blockade will persist. The absence of an SPR release signals: absorb the pain for now. Combined with the administration's erratic enforcement patterns on other fronts (DOJ abandoned, then reversed course on law firm executive orders within 24 hours), the regulatory environment is in a state of maximum unpredictability — not just on energy but across government contracting, trade policy, and enforcement.

   What to do

   1. →

      Convene CFO and ops leadership this week to model $100/barrel oil scenarios across cloud energy costs, logistics, travel, and any supply chain with petroleum inputs

      NowDiesel futures suggest the cost pressure is arriving now, not in a hypothetical future — your current-quarter margin guidance may need revision
   2. →

      Evaluate hedging strategies for energy-exposed cost lines and consider locking in rates where feasible before prices climb further

      This sprintThe supply removal is structural (production shutdown, not just transit disruption) with no near-term resolution mechanism
   3. →

      Audit cloud workload geographic distribution for any deployments within drone/missile range of active conflicts — specifically Gulf region availability zones

      This sprintAWS data centers were physically destroyed by drone strikes; war risk exclusions in your cyber insurance almost certainly apply
   4. →

      Scenario-plan for sustained instability through the November midterms — layer energy costs, regulatory unpredictability, and geopolitical disruption into your 2026 H2 planning

      This quarterThe political calendar creates compounding uncertainty with no relief valve until at least Q4
4. 04

   Pentagon CTO Declares War on AI Vendor Lock-In — The Defense Market Just Opened to New Entrants

   Emil Michael, the Pentagon's Undersecretary of Defense for Research and Engineering, delivered a keynote at the a16z American Dynamism Summit that amounts to a market-making event for defense AI. The headline revelation: the Department of War discovered its most critical combat AI systems across CENTCOM, INDOPACOM, and SOUTHCOM were single-threaded on one vendor with contractual kill-switch provisions that could theoretically shut down AI systems mid-operation.

   The SpaceX Model for Defense Procurement

   Michael's response isn't just vendor diversification — it's a wholesale restructuring of defense acquisition modeled explicitly on SpaceX:

   • Fixed-price contracts replacing cost-plus (eliminating the margin guarantee that protected traditional primes)
   • Simple requirements and fast cycles (breaking the baroque RFP processes)
   • Risk-sharing between government and industry

   This represents the most significant change in defense procurement philosophy since Goldwater-Nichols. The structural barriers that kept venture-backed companies out — decades-long development cycles, compliance labyrinths, cost-plus economics — are being systematically dismantled.

   The Sovereignty Argument Changes Everything

   When a senior AI vendor executive questioned whether their software was used in the Maduro operation, Michael responded with a framework that will reshape the industry: AI is becoming substrate technology, as fundamental as telecommunications. Just as AT&T cannot refuse to carry military communications, AI companies that impose 'constitutions' restricting lawful military use will be sidelined by the world's largest institutional buyer. This framing — AI as infrastructure, not product — has enormous implications for regulation, contracting, and company valuations.

   The Talent Bottleneck

   Michael acknowledged a critical constraint: only ~1,000 researchers across 4 frontier companies control the AI capability frontier. This creates extreme concentration risk for the government's diversification strategy and signals likely policy moves: immigration reform for AI researchers, massive university funding, and potentially regulatory action to prevent talent hoarding. Anduril's $4B raise at $60B valuation (doubling in 9 months) confirms that top-tier capital is already positioning for this market restructuring.

   Google went from refusing Project Maven to being praised as the 'best government partner' — a trajectory Michael is explicitly weaponizing as both template and implicit threat to every AI company still debating its defense posture.

   What to do

   1. →

      Conduct a strategic assessment of your company's defense market positioning — determine whether your AI products or cloud capabilities can serve the DoW's multi-vendor diversification mandate without restrictive terms of service

      This quarterThe procurement reform creates a 2-3 quarter window where new entrants have structural advantage before incumbents adapt
   2. →

      If pursuing defense AI: begin FedRAMP/IL5+ compliance infrastructure and cleared personnel hiring immediately — these are 12-18 month lead time capabilities

      This quarterThe market entry window is open but compliance requirements cannot be compressed
   3. →

      Review AI model licensing terms for any restrictions on government/military use cases — understand that these restrictions are now a disqualifying factor for the largest AI buyer in the world

      This quarterMichael's sovereignty framing will become policy — companies that maintain military use restrictions will be excluded from a $100B+ market
   4. →

      Protect and invest in frontier AI research talent — the ~1,000 researcher pool Michael cited makes your top researchers strategic assets that the government and competitors will increasingly target

      WatchExpect aggressive government moves to expand this pool via immigration reform and university funding, but near-term supply is fixed