The Commoner

Wednesday, October 21, 2026

Sup, freaks.

SpaceX beat, Anthropic's loss is mostly paper, and the real question is the quality of AI revenue.

WHAT TO EXPECT IN THIS NEWSLETTER

• SpaceX blew past expectations and Anthropic's $80.7 billion loss is mostly paper. The real question is the quality of AI revenue.
• A poisoned LiteLLM release is stealing AI keys. PHP and Node.js shipped critical fixes. Patch now.
• Spiral's AI bug hunter has filed 20,000 reports, and two trusted third parties had a very bad week.
• Gerstner wants Trump Accounts for everyone under 40, and senior developers say they can't find work.
• Lightning Loop v0.35.1 makes the swap server prove its fee.

Marty's Bent

Real Revenue, Paper Losses

Yesterday I asked what kind of AI slowdown we might be heading into. Today I want to ask a simpler question. Who is actually paying for all of this? I'll be honest up front. After the last 24 hours, the answer is messier than either the doomers or the boosters want it to be.

Start with the numbers that dropped after the bell yesterday. SpaceX reported its third quarter and blew the doors off. Revenue came in at $14.6 billion, up 161% from a year ago, against the $12.86 billion analysts expected according to Visible Alpha consensus cited by Fortune. The AI business, which SpaceX now calls Super Intelligence, did $7.6 billion on its own. That's up 830% year over year and more than a billion dollars above what the Street was looking for. SpaceX says the growth came primarily from new cloud services agreements, the Cursor acquisition and more people using Grok. Starlink grew revenue 69% and nearly doubled its operating income. This isn't a company asking you to imagine a future business. These are real numbers.

Now look at the other side of the ledger. SpaceX spent $16.4 billion on capex for the AI segment in the quarter and about $20 billion overall. That's more than the company brought in. Operating income was $2.8 billion, and the $4.4 billion net income headline got help from interest income, other income and a tax benefit below the operating line. Fortune says analysts expect SpaceX's debt to go from $50.7 billion last year to $350 billion by 2029. And part of that AI revenue, per Fortune, comes from leasing compute to Anthropic, which agreed to use all of the capacity at SpaceX's Colossus 1 data center.

Which brings us to Anthropic. The Wall Street Journal got its hands on a draft of Anthropic's IPO prospectus, and the number that ripped across X yesterday was an $80.7 billion net loss for the first half of the year. A lot of people read that as proof the whole thing is a house of cards. I think that's a misreading. About $72 billion of that loss, per Quartz's writeup of the reporting, is an accounting charge tied to convertible notes, IOUs that holders can swap for Anthropic stock. As Anthropic's valuation went parabolic, those notes became more valuable, and accounting rules make the company book that increase as a loss. No cash left the building. Jack Farley put it well: "When a company issues convertible notes // warrants and the market cap 1000xes, the on paper loss from being short calls is massive. Not fundamental." PitchBook expects the charge to stop for notes that convert to shares at the IPO. That's not a loss that needs to recur every year.

One detail tells you how tangled this has gotten. PitchBook notes that Amazon, one of the noteholders, marked its Anthropic notes up from $42.2 billion at the end of March to $97.9 billion at the end of June. Anthropic's paper loss is, in part, Amazon's paper gain.

The real spending is still enormous. Anthropic put close to $9 billion into compute and infrastructure in the first half, up from $2.3 billion a year earlier, and has committed to at least $518 billion over ten years. It also told investors its third-quarter revenue hit $16.8 billion. Real revenue. Real spending. Real commitments.

So is it all fine? This is where Ramp comes back in. Ara Kharazian, Ramp's lead economist, posted yesterday that 80% of business spend on OpenAI and Anthropic comes from 1% of firms, and within that top 1%, 80% are venture-backed. His chart puts it at 80.4% of top AI spenders backed by venture capital, compared to 13.1% of median spenders. Ramp's customers skew toward startups, so this isn't a census of the economy. But these are exactly the companies paying for the tokens. Ara's warning is that if the trade doesn't work out, "we have a cascading effect of large customers simultaneously pulling back their AI spend."

Chamath framed this better than the people calling it circular. Last week he wrote that he suspects 70 to 80% of revenues at AI companies come from other AI companies that raised venture money. "This is not a circular revenue problem but it is a revenue quality problem." I think that's the right lens. The money is real. The tokens get used. The question is how durable the customer is. A dollar from a manufacturer that found a way to do more with fewer people is worth more than a dollar from a startup burning through its Series B. Same line on the income statement. Very different quality.

I also need to correct something I've been leaning on. It's easy to wave all of this away as cheap money. It isn't, at least not anymore. The Fed took rates from near zero in early 2022 to above 5% by the middle of 2023, and money has been expensive for regular people ever since. Ask anybody who has tried to buy a house. And yet, through September, AI companies captured about 83% of all U.S. venture funding, according to Social Capital. Capital got more expensive for everyone, and it still piled into one trade. That's conviction. It's also concentration. A handful of giants and the startups orbiting them are financing, supplying and buying from each other while the rest of the economy pays up to borrow.

Where does that leave us? Honestly, up in the air. SpaceX shows the demand is real and that some of these businesses can throw off serious profits. Anthropic's scary headline loss is mostly accounting. Ramp and Chamath show the revenue is concentrated in customers whose budgets depend on the next round. All of that can be true at the same time. What I'm watching is whether the customers paying the AI bill can keep paying it once the venture money stops being so easy to raise, especially with SpaceX alone expected to carry hundreds of billions in debt by the end of the decade.

Contrast this system with bitcoin. Nobody at a committee meeting gets to decide what it costs to borrow it. Nobody can print more of it to bail out a bad bet, and it doesn't care whose revenue is high quality. It keeps producing blocks, and it gives anyone who holds it a way to save that doesn't depend on any of this going right. Keep an eye on the quality of the revenue, freaks. Not just the size of it.

SIGNAL

Patch now: poisoned LiteLLM, plus PHP and Node.js fixes

If you run AI agents, check your Python environments today. This morning an attacker pushed a malicious version of LiteLLM, the popular open-source library that routes requests to OpenAI, Anthropic and other model providers, to PyPI and Docker. Wiz says version 1.107.0 drops files that run every time Python starts, then harvests browser passwords, cloud credentials, SSH keys, shell history and AI provider API keys, and ships them to a lookalike domain. It even queries the LiteLLM proxy's database for every stored provider key. The last safe version is 1.106.2. If you installed 1.107.0 or pulled a latest Docker tag today, treat that machine as burned and rotate every key it touched. Two more patches landed today. PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical bugs that allow unauthenticated remote code execution. Node.js released 22.23.4, 24.22.1 and 26.12.1, fixing four high-severity bugs, including a Brotli decoder flaw that permits remote code execution. Update everything.

Spiral's AI bug hunter has filed 20,000 reports

Spiral's Elias Rohrer gave an update on Project Loupe at bitcoin++ yesterday. Loupe is the free, opt-in AI scanner Spiral and Block launched this year for open-source bitcoin projects. One agent hunts for bugs, a second tries to prove each one with a working test, and Block pays for the compute. Elias said 43 repositories have signed up and Loupe has sent more than 20,000 findings, after its own verification step threw out about a quarter. He put roughly 5% at high severity and said they've found very few critical bugs, if any. He also said Bitcoin Core has fielded more than 1,000 reports from the scanning flood, none critical and very few high. The most important line of the talk was the humble one: "We need to actually step our game up with these more traditional security utilities like fuzzing, memory safety, code review for the critical parts." It's the same warning Niklas Gögge wrote last month. Scanners are the floor. Disclosure: Block sponsors this newsletter.

Trusted third parties had a bad week

Nick Szabo wrote that trusted third parties are security holes. This week served up two. On Saturday, a researcher proved he held the private keys for eight intermediate certificates issued by eMudhra, an Indian certificate authority trusted by every major browser. Anyone holding those keys could mint certificates to impersonate any website. The disclosure says eMudhra generated the keys so badly they could be recovered from the public certificates themselves, and that it had been that way since April 2025. Mozilla blocked them in Firefox in under three hours, and today's Node.js release updates its certificate bundle to handle them. Meanwhile PingCAP, which runs the TiDB Cloud managed database, disclosed that an attacker used stolen service account credentials to move through its systems from September 9 to October 7, copying customer contact details, contract terms, SQL editor text, encrypted API keys and source code. PingCAP says the attacker's claims about the credentials haven't been verified. Customers should rotate everything anyway.

Gerstner wants Trump Accounts for everyone under 40

Brad Gerstner, the Altimeter founder behind Trump Accounts, told the New York Post he's working on legislation to open the accounts to anyone under 40, with the money usable for retirement, education or starting a business, and permanent federal funding. Treasury says more than 60 million kids were automatically enrolled this month, and Gerstner thinks private contributions could reach $100 billion by the end of 2027. Some people online are already calling this the quiet privatization of Social Security. There's no bill text yet and nothing in the reporting touches Social Security, so I'll hold off on that. Here's what I can tell you. The law only lets this money go into low-fee, unleveraged funds tracking the S&P 500 or a similar broad index of U.S. stocks. No bitcoin. Expand that to everyone under 40 and Washington is steering a generation's savings into one asset class, and building an even bigger constituency that needs stock prices to keep going up.

Senior developers say they can't find work

Mo, a YouTuber who covers software and AI, posted a video yesterday reading comments from experienced software engineers who can't find jobs. One says he's been a developer for 20 years and got laid off in August. Another, who spent a decade at a big tech company and later served as CTO at two startups, says he's gone two years without work. Those are anecdotes, not data. The data is stranger. Indeed's index of U.S. software development postings was at 78.9 on October 16, up from 61.1 in May 2025 but still about 21% below February 2020. Indeed says 71% of the rebound came from senior roles and 37% from jobs with AI in the title. Companies are hiring again, just not for the same jobs. Mo's advice is to hold onto your job and cut costs to the bone. The people with low overhead and real savings get time to retool. The ones carrying debt and a lifestyle built around the last paycheck don't. Disclosure: Mo closes the video pitching his own AI product.

⚡ FREEDOM TECH CORNER

DATA SNAPSHOT

Spot price, block height and hashrate estimate: October 21, 2026, 7:58 a.m. ET. Bitcoin Lab daily series: October 20, 2026. U.S. spot ETF flows: October 20, 2026.

Sources: Kraken spot quote, mempool.space block height and hashrate, Bitcoin Lab daily metrics, and TFTC ETF flows. Daily metrics use the provider’s October 20 observation, not live intraday estimates.

Talk tomorrow, freaks.

Marty Bent · TFTC · Nostr

YouTube

Podcast