Nvidia has lined up more than half a trillion dollars of Wall Street capital to finance its own customers' chip purchases, guaranteeing a quarter of it and calling compute an "investable asset class." Nvidia and Meta are both pushing open-weight models this week for opposite reasons, and Zuckerberg's case for giving everyone access to superintelligence runs into a problem Mads Jensen nails in one line: deterrence needs symmetry, and access alone doesn't provide it. And in three separate incidents this week, AI agents caused real damage, not because any model broke its own safety rules, but because nobody had patched the systems around them.
- Nvidia's backstop only guarantees 25% of any financing deal and pays last. The six Wall Street firms providing the capital, and the pension and insurance money behind them, carry the residual risk, not Nvidia.
- CoreWeave just extended a lease on A100 chips, launched in 2020, out to 2029 at full price. That's a direct rebuttal to Michael Burry's thesis that hyperscalers are underdepreciating their GPUs.
- Zuckerberg's "everyone should have superintelligence" argument is, per Mads, the same shape as the everybody-should-own-a-gun argument, and it fails for the same reason: an attacker only needs one win, a defender has to win every time.
- Distillation is the real fight buried in the open source debate. Anthropic bans using Fable's outputs to train rival models. Zuckerberg wants that overturned, which happens to be exactly what Meta needs since it's behind.
- None of this week's three "agents went rogue" stories involved a model breaking its own safety training. In every case, a gap in the system around the model, not the model's alignment, was the actual failure.
Upside is a weekly podcast designed to look behind the headlines that will affect European venture, startups and investing.
Below are the notes from this week’s episode. Episode links above to tune in and stream wherever you pod.
Nvidia Backstops Wall Street
Before Nvidia, the circular financing arc was already cooking. Anthropic is reportedly heading to market at a $2 trillion, maybe $3 trillion valuation, possibly via an October IPO, right in the middle of the US midterms. And Thrive Holdings, the private-equity spin-out of Thrive Capital, just hit $1 billion in revenue after raising $2 billion from SoftBank, D1 Capital and Altimeter. The mechanics: Thrive Capital invests billions into OpenAI, OpenAI sends engineers, not cash, into Thrive Holdings’ roll-up of boring businesses like accounting and IT services, those businesses get automated and profitable, and the resulting revenue makes OpenAI’s stake look like a genius call. Mads’ take: it’s a bit so-what.
Then there’s Nvidia itself, and this is the real story. It has lined up more than $500 billion of outside capital from Apollo, BlackRock, Blackstone, Brookfield, Goldman Sachs and KKR to finance its own customers’ chip purchases, and it’s offering to guarantee a quarter of it. Jensen Huang is now calling compute “an investable asset class.” One analyst Mads and I both read called it Nvidia “speed-running a synthetic hyperscaler.”
Mads’ framing matters: this isn’t vendor financing in the old 2000s Lucent-and-Nortel sense, where the vendor lent the money itself. Nvidia is underwriting a backstop, capped at 25% of a deal’s value, only after the capacity has been re-let or the chips resold. The cash comes from six Wall Street firms, who underwrite their own slice separately. The real difference from 2000: back then the customers had no revenue at all. OpenAI, Anthropic and the clouds are paying customers today, so whether that’s enough to carry the debt is the open question.
I asked about GPU aging, because this isn’t fibre in the ground, it’s silicon that gets replaced. Michael Burry’s argument is that hyperscalers underdepreciate these chips and get burned when the hardware ages out faster than the accounting assumes. Mads’ counter: CoreWeave just extended a lease on a batch of A100s, Nvidia’s 2020-era chip, out to 2029, fully priced. Most hyperscalers depreciate GPUs over six years, so stretching to nine suggests the assumption is conservative, not aggressive. Mads’ underlying point matters most: there’s no natural ceiling on how much intelligence we want to consume, unlike yachts, so demand for tokens, and the useful life of the hardware serving them, probably keeps climbing.
Where does this leave Nvidia? As the gatekeeper, holding back its own frontier open-source model, Nemotron, and putting close to $30 billion behind training the next generation, while telling the labs: keep buying our chips and we’ll help finance your data centres. Defect to your own ASICs, and we’ll release open source good enough to compete with you instead.
Open Source Is Back, Baby
Which is exactly what happened this week. Nvidia launched Nemotron 3.5 Lightning, and Zuckerberg published a 6,500-word essay, “The Future is for Everyone,” arguing that restricting AI to a few elite institutions is a bigger risk than distributing it widely. I’m calling bullshit on the framing, because whenever a giant this size pushes a story like this, there’s usually a simpler reason underneath. Mads’ read on Nvidia: commoditise your complement. The better the open models get, the more inference gets run, the more GPUs Nvidia sells.
Zuckerberg’s case is murkier. Mads pulls it apart cleanly: “everyone should have superintelligence” is structurally the same as “everyone should own a gun,” and it fails for the same reason. Deterrence needs symmetry, an attacker only needs one win, a defender has to win every time. What actually matters isn’t universal access, it’s plurality, many independent labs competing, not one company’s open model sitting in a billion hands with nobody else able to compete.
The distillation fight is worth paying attention to. Distillation means asking a powerful model hard questions and using how it strings words together to train a smaller model. Everyone does it. Anthropic’s position is that you’re not allowed to distil Fable, the model it’s spent billions building, to train and give away a competing open model. Zuckerberg wants distillation declared fair game everywhere. Mads’ line: it sounds a bit like socialism, if somebody has IP, others don’t get to just take it. Meta wants that ruling for an obvious reason: it’s behind, and distillation is how it catches up.
Same shift at Mistral, which pivoted from building frontier models to Europeanising Chinese open weights and now reselling GLM as-is, going from lab to neo-cloud. General Catalyst just put over $1 billion into River AI, two months old, building an open stack for enterprises to train and own custom open-weight models rather than renting a closed one. And Google, sitting on more data than anyone and still losing the model war, is reportedly paying around $1.5 billion to license Mechanize’s training tooling and hire its staff, a hundred days after a $9.1 million seed, a reverse acqui-hire that skips the scrutiny a full acquisition would trigger, echoing Microsoft’s deal with Inflection.
China’s part of this too, briefly: Unitree’s Shanghai IPO drew 5,526 times more retail orders than shares on offer, with DeepSeek taking a stake to supply the software layer. Same pattern as everywhere else this week, China’s ahead on open models, and someone still has to build the layer on top.
More AI Agents Go Rogue
Three stories this week, and none involved a model actually breaking its own safety rules. Suspected China-linked hackers ran what researchers call the first end-to-end autonomous cyberattack on Taiwan’s government: up to eight agents working in parallel, 85 accounts compromised, 2,500 staff records taken, seven energy companies hit, built from two free, open-source agent frameworks anyone can download. A supply-chain breach from March also came to light this week, hackers poisoned packages on the Python repository PyPI, exposing digital keys and more than 400,000 automated build pipelines across over 2,500 organisations. And an AI agent hacked a gym’s booking system in Australia so its owner could get a spot in a Pilates class, because the interface never checked whether you were allowed to cancel someone else’s booking.
Mads’ framing is the one worth holding onto: the capabilities have grown in power faster than our imagination of how they can be used. The gym hack isn’t really a hack, it’s an open system the model exploited because nobody closed the gap. Taiwan and the PyPI breach are the serious ones, and in both cases the fix was cheap, half an hour with Opus or Claude Code doing pen testing would likely have caught it, but nobody thought to ask. Mads’ point for any founder reading this: the capabilities in your hands are growing faster than the pace at which you’re picking up the skills to secure them, and a twelve-month AI roadmap is an admission you’re already behind.
Anthropic also started watermarking Claude’s outputs globally this week, weighting word probabilities slightly so a machine can trace text back to Claude. It doesn’t survive a rewrite through another model, but it’s a small, sensible move in a week that mostly showed how much still isn’t secured.
Predictions
My prediction: based on the Mechanize deal, I think we’ll see more of these reverse acqui-hires happen in Europe over the next 12 months. We’ve already seen the pattern with Microsoft and Inflection, and now Google and Mechanize. I’ll be keeping an eye out for a European version.
Mads’ prediction: Nvidia will have another good quarter when it reports on 26 August. Not investment advice.
Deals of the Week
Mads: Cambridge Aerospace, $300 million Series C at a $3.4 billion valuation. Incorporated in September 2024, fielding kit with the Ministry of Defence just 19 months later. It builds motors, the solid-fuel propulsion for counter-drone rockets, designed to sit ready for months or years and fire the moment a rogue drone shows up. Europe hasn’t had the manufacturing capacity to make these at scale, exactly the gap Cambridge Aerospace is filling.
Notable Quotes
Mads Jensen, on why AI demand doesn’t behave like normal consumption:
“There’s no natural ceiling for the consumption of intelligence. There’s no point where we’re saying, well, now we have all the intelligence we’re ever gonna need, because more intelligence leads to more questions, leads to the need for more intelligence to answer the questions.”
Mads Jensen, on how Nvidia structured its Wall Street financing deal:
“I think it’s a great way for them to make sure that the industry has the money it needs without providing the cash themselves.”
Mads Jensen, on why this week’s AI agent incidents matter:
“The capabilities have grown in power faster than our imagination of how they can be used.”
Frequently Asked Questions
How is Nvidia financing its own customers' chip purchases without lending them money directly?
Nvidia has lined up more than $500 billion of outside capital from six Wall Street firms, Apollo, BlackRock, Blackstone, Brookfield, Goldman Sachs and KKR, who provide the cash and underwrite their own share of each deal. Nvidia guarantees up to 25% of a deal's value, only after the capacity has been re-let or the chips resold, so it never puts up the financing itself.
What is AI model distillation, and why does Mark Zuckerberg want it unrestricted?
Distillation means asking a powerful model difficult questions and using how it strings words together to train a smaller model. Anthropic's terms ban distilling Fable to train a competing open model. Zuckerberg's essay argues distillation should be allowed everywhere, a position Mads Jensen suggests Meta favours because it's behind on frontier models and needs distillation to catch up.
Why is Google paying to license Mechanize instead of buying the company outright?
Google is reportedly paying around $1.5 billion to license Mechanize's IP and hire its staff, a "reverse acqui-hire" that avoids the regulatory scrutiny a full acquisition would face. Mechanize had raised a $9.1 million seed only about a hundred days earlier, and its founder, Tamay Besiroglu, studied at Cambridge.
How did an AI agent end up hacking a gym's booking system?
An AI agent acting for a gym member in Australia found the booking software never checked whether a user was authorised to cancel someone else's class, so it cancelled another member's booking to free up a Pilates spot. According to Mads Jensen, none of the model's own safety rules were triggered because the request looked like ordinary account activity.
Is fixing education really the way to fix the UK's growth problem?
According to Bern Murdoch's FT analysis discussed on the episode, England's school results have climbed international rankings for two decades while wages haven't followed. Low-literacy Americans earn around $30 an hour with two-thirds in work, versus about $20 an hour and under half in work for the same group in Britain, suggesting schooling was never the binding constraint on UK wage growth.