Foraging: The Untouchables
As AI gets better, defensibility relocates to the one place a model can’t reach: the private, accountable work it has to be trusted with. Stranger still, that moat strengthens as the models improve.
Over the past two months, three people I read have buried three different moats. They weren’t writing to each other. Todd Saunders went at it in April, Seema Amble in May, Jaya Gupta this month, each reaching for a different shovel. But line up the eulogies and it’s the same body in every casket.
Saunders went first. Vertical software, he argued, was built on the premise that the vendor understood the customer’s business better than the customer did, and inference erased that premise: a model now absorbs a domain fast enough that nobody’s expertise stays scarce. He sees no middle left. Either you own the rails (payments, identity, compliance, data) and become infrastructure, or you owned only the expertise and become a feature on someone else’s harness.
Amble buried the next one: the interface. When an agent does the clicking, knowing where the buttons live is worth nothing. Strip the screen away and you find out where the value actually lived, which turns out to be the operational logic underneath: the rules and permissions and context an agent needs before it can safely act.
Gupta came at it from the money. Everyone is using AI and everyone is spending, she observed, but usage and spend aren’t a business. The real question is where AI captures the value it creates, and it captures the most where it attaches to budgets, workflows, labor, and accountable outcomes, far more than where it merely shows up.
Three starting points, one direction. What died in every case was the legible: anything you could see clearly enough to measure, a competitor could copy and a model could learn well enough to replace. What survived, in all three eulogies, was the same unglamorous thing none of them had a clean name for: the private, accountable work a model has to be trusted with before it can act.
What Guo Named
This week, Sarah Guo gave it one.
Guo, who runs the venture firm Conviction, opened by naming the despair the other three were answering: the 2026 investor’s version of AI psychosis, the conviction that nothing is investable because every company built on a model is a thin wrapper waiting to be absorbed, so buy Nvidia, buy Anthropic, go home. They have the mechanism right, she argues, and the destination wrong.
The mechanism is simple, and she states it more cleanly than anyone: what’s measurable is what’s leaving. Anything you can put on a leaderboard, you can train a model against, and once a model can match it, it commoditizes. It’s why coding agents matured first. A compiler is a free grader and a test suite is a free grader, so you can grind a model against the check until it wins. The receipts are humbling. Mert Demirer and coauthors at MIT studied more than 100,000 developers and found the latest coding agents lifted how much code got written by roughly 180 percent, and how much actually shipped by about 30. Writing got cheap. The judgment about whether a change was right for a decade-old system still runs through a person, because that judgment was never on the test.
So defensibility doesn’t disappear as models improve. It relocates, sliding toward the work a model can’t reach from outside the customer. Guo gives that surviving ground its name, the untrainable corner: frontier work whose correctness exists only inside someone’s private data, walled off inside a system you have to be allowed into. And she locates the real bottleneck precisely. It was never intelligence. You can imagine a model far smarter than any person and it still has to be let in the door, and someone still has to put their name on what it does. The bottleneck is permission, and accountability.
She describes two barriers on that door. The lock is the environment: the security review, the integration, the contract with your name on the outcome. The deadbolt is human habit. A majority of American doctors now open OpenEvidence every day, and no amount of compute buys that. You earn it slowly, on relationships, over years.
Aaron Levie, reading her the same morning, translated the idea into the language of the people deploying it. There’s still an insanely large gulf, he wrote, between what a model can do and what it takes to make it work inside one specific company. That gulf has three parts: technology you build, data you arrange and format, and the customer-by-customer change management of getting an organization to operate differently. The translation never ends.
Which is where Gupta’s money question finds its answer. Value attaches to the places AI has been given permission to sit. Consumer AI throws off enormous surplus and monetizes lightly; enterprise AI touches fewer people and captures far more, because it attaches to budgets, workflows, labor, and measurable outcomes that someone is accountable for.
The Moat That Grows
Here is the turn that should change how you read every AI-eats-the-world headline. Normally a better model is a threat to anyone who isn’t a model company. For the untrainable corner, a better model is a gift.
As capability rises, the line of what’s measurable rises with it, and everything below that line commoditizes and falls away. The value gets pushed up into the shrinking band of work that stays private and accountable. If you’re standing in that band, the next frontier model arrives as a sharper tool you point at the exact workflow you already defend. Your competition gets automated. Your position gets stronger. The moat widens precisely because the models got better.
That reframes the question for anyone building. A model is something your competitor can switch to by Friday. The moat is whose private reality you’re trusted to sit inside, and how much of their accountable, walled-off work you’ve earned the right to touch. I should be transparent that this is the problem space I work on at Typeface, so I come at it with a builder’s bias, and from inside that work I’ve watched Guo’s thesis play out firsthand. I couldn’t agree with her more. The deployments that stick are the ones where we did the slow, unglamorous translation and earned the right to sit inside the workflow, regardless of how clever the model underneath.
It’s also why the convergence landed the way it did. The durable advantage, in every one of these arguments, is the work nobody wants to put on a slide: arranging a company’s messy reality so a model can act on it, earning the security review, holding a skeptical team together through a rebuild that takes quarters. I’ve argued for a while that in enterprise AI the technology is the easier part, and that the people and the process and the plumbing are where deployments live or die. This is that same idea with a balance sheet attached. The unglamorous work is the value.
The sources don’t fully agree on who ends up holding that ground, and the disagreement is the interesting part. Amble thinks incumbents with the deepest data and the heaviest compliance can defend it. Saunders is harsher on anyone who owned only expertise. Gupta is betting on an agent that spans the fragmented systems no single incumbent controls. They split on how you get paid, too. Levie’s answer is to meter intelligently: route the hard work to frontier models, the cheap work to cheap ones, and read a rising token bill as a sign of success. Guo’s answer is to charge for the result. Sierra bills only when its agent resolves a customer’s issue, which works precisely because Sierra owns the private definition of what “resolved” means. One camp optimizes the cost of the tokens. The other makes the tokens someone else’s problem and guarantees the outcome. Those are two very different companies.
What none of them answer is how long any of it holds. Guo is the most honest about the limit. The measurable frontier keeps climbing, which means the untrainable ground is always shrinking under whoever’s standing on it, and you re-underwrite constantly or you slip below the line. So permission might be a durable moat, or it might be an integration lag that standards and data portability eventually erode. Nobody on my reading list this month put a clock on it. That’s the number I want.
The Odd Find
While everyone argued about who owns the enterprise, a team in L. Mahadevan’s lab at Harvard published a quieter result in PNAS: robot swarms move faster when you make them slightly worse at moving. Send the robots along perfectly straight, efficient lines and they pile into each other and seize up. Let them move at pure random and they wander and arrive nowhere. The sweet spot, lead author Lucy Liu found, is a small dose of controlled randomness, a wiggle, that lets them slip past one another and keeps the whole swarm flowing. Too much order turns out to be its own kind of gridlock.
The enterprise has no such trick. You don’t wiggle past a security review, and you can’t randomize your way into a hospital’s trust. The investors’ despair has the mechanism right and the destination wrong. Intelligence keeps getting cheaper, and value keeps sliding toward the few rooms a model has to be let into. Anything you can put on a leaderboard, someone eventually trains against and wins. What lasts is the work that was never legible from outside the room to begin with. The question worth sitting with is not whether your work is hard. It’s whether anyone outside the room can see it well enough to take it from you.