The Camera That Found Khamenei

00:00:04 On the twenty-eighth of February, Ayatollah Ali Khamenei sat down with his closest aides somewhere in Tehran. Israel knew where, and knew roughly when, because for weeks it had been watching him through Iran's own traffic cameras. Today the Financial Times reported the strangest downstream effect of that operation.

00:00:22 Russia's security service, the FSB, has shut down parts of a special surveillance system that protects Vladimir Putin and his inner circle. Engineers pulled it offline, combed through it, and only switched it back on after they had sealed it off from the open internet.

00:00:38 The trigger, according to the FT's sources, was the killing of Khamenei — and what it revealed about how artificial intelligence can be turned loose on closed-circuit camera footage to hunt a specific human being. Let me walk through what Israel actually did, because the mechanics are the whole story.

00:00:55 Iran, over the past decade, built a vast network of cameras across its cities. A lot of that network exists to control dissent — to watch protesters, to recognize faces at checkpoints, and to keep a population legible to the state. Israeli intelligence got into that footage and pointed modern AI at it.

00:01:13 Not to watch one feed, but to digest millions of hours from thousands of cameras at once: to map the geography of Tehran, to learn the movement patterns of senior officials' bodyguards, to spot the small repeated tells that mark a convoy or a safe house, and then to isolate one man from the noise.

00:01:30 American intelligence, according to earlier CNN reporting, fed into the same plot. The camera grid Iran built to surveil its own people became the sensor array used to kill its supreme leader. That's the part Moscow understood instantly. The director of the FSB, Alexander Bortnikov, warned regional security chiefs that Russia's own surveillance apparatus had flipped from an asset into a liability.

00:01:54 Remember the scale here — Moscow runs something like three hundred thousand cameras pointed at its citizens. The system protecting Putin is separate from that, more guarded, but the lesson cut across both. The tools an authoritarian state builds to watch everyone are also, it turns out, a high-resolution map of the watchers themselves.

00:02:13 Point a capable model at that map and the hunter becomes findable. Here's what I take from it, and I'll name it as opinion. We've spent years talking about AI surveillance as a problem for the surveilled — for the protester, the dissident, the ordinary person logged by a face-recognition camera at a train station.

00:02:32 That concern is legitimate, and it still holds. But this story flips the polarity. Every state, and increasingly every city, that has wired its streets to watch its citizens has also built a targeting database it doesn't fully control. The footage outlives the intent.

00:02:47 Iran collected those images to project power inward. With the right model and the right access, that same archive projects power right back at the people who own it. There's a sober second-order point under this. None of what Israel did required some exotic, classified super-weapon.

00:03:04 It required access to camera feeds and a model good enough to find structure in an ocean of video. Both of those are getting cheaper and more widespread every quarter. So when you hear a mayor or an interior ministry justify another ten thousand cameras on the grounds of safety, the full accounting now includes a line that didn't exist a few years ago: you're building infrastructure that a capable adversary can read better than you can.

00:03:30 Russia just priced that risk in real time, in the most direct way available — by turning the cameras off. That's where the rest of today's news sits, so let me keep going.

00:03:40 Stay with weapons for a moment, because Anthropic put hard numbers on a different edge of it today. The company shared research first with Axios's Sam Sabin showing that its Mythos Preview model can take a software vulnerability that has already been publicly disclosed and turn it into a working exploit in hours — sometimes in minutes.

00:04:00 The jargon for this is an N-day. A zero-day is a flaw nobody knows about yet. An N-day is a flaw that has been disclosed and usually patched, but where the patch hasn't yet reached every machine that needs it. Most real cyberattacks live in that gap. The fix exists, but a hospital or a utility or a bank can't just slam it in — they have to test it so the patch itself doesn't crash production, and many fixes require scheduled downtime.

00:04:28 The window between disclosure and full patching is where the damage happens, and it has historically taken human attackers days or weeks to weaponize a fresh disclosure. Anthropic's frontier red team ran Mythos against bugs it couldn't have memorized — vulnerabilities in Mozilla Firefox and the Microsoft Windows kernel that were disclosed in January and February, after the model's training cutoff.

00:04:52 Here are the numbers. Within thirty-one minutes, Mythos produced its first proof-of-concept exploit for a Windows kernel bug. Across twenty-one kernel vulnerabilities it tested, it managed to crash the system — the blue screen of death — in eighteen of them. It built eight distinct working exploits, the most complex of which took it about five hours and forty minutes.

00:05:15 On Firefox, across eighteen security patches, it built eight working code-execution exploits. And the cost is the part I keep returning to. Anthropic estimates it generated those Windows privilege-escalation exploits for around fifteen thousand seven hundred dollars in usage credits — roughly two thousand dollars per exploit.

00:05:36 That's not a state-actor budget. That's a number a mid-tier criminal crew can clear in an afternoon. Most of the attention on AI and security has gone to the glamorous side: can a model find a brand-new bug nobody has seen. Anthropic's finding points somewhere less flashy and more immediately dangerous.

00:05:54 The models don't need to discover anything. They can sit on the public disclosure feed — the same advisories defenders read — and weaponize each one faster than most organizations can deploy the fix. That shrinks the patch gap toward zero. And this isn't one company's problem to contain.

00:06:12 Anthropic notes that some open-weight models are already operating near this level, and so is OpenAI's GPT-5.5-Cyber. Once the capability is in open models, there's no recall. The defensive case is legitimate, and I don't want to skip it: the same model that writes the exploit can help a defender find and pre-patch the weakness first.

00:06:33 Anthropic is clearly positioning Mythos as a tool for the people wearing the white hats. But defense and offense don't move at the same speed here. The attacker needs one working exploit and a list of organizations that haven't patched. The defender needs every system fixed before anyone points a model at it.

00:06:52 Those aren't symmetric jobs, and the asymmetry just got more expensive for whoever has to patch. The Trump administration is starting to implement an AI security executive order meant to assess exactly this class of national-security risk. On today's evidence, the assessment is overdue.

00:07:10 While the models were busy weaponizing camera footage and patch notes, Washington spent the day drawing harder lines around China — and the single most powerful person in this entire industry decided he'd rather not talk about it under oath. Jensen Huang, the chief executive of Nvidia, declined an invitation from Senator Elizabeth Warren to testify this Thursday before the Senate Banking Committee.

00:07:33 The hearing has a title built for a campaign ad — "AI and the American Dream: Promoting Innovation, Affordability, and American Dominance" — and its real subject is Nvidia's business in China and where US export controls should sit. Huang wrote back that he would be, in his words, unable to attend, though he offered to host committee members at Nvidia's headquarters in Santa Clara to discuss American leadership in AI.

00:07:58 Warren wasn't satisfied, and she said so plainly. "I appreciate Mr. Huang's response, but the American people deserve answers in a public forum," she said. "Nvidia sits at the center of some of the most important questions facing our country about artificial intelligence, economic competition, and national security." Then the line that will travel: "If Mr.

00:08:19 Huang has time to attend a one-million-dollar-a-head dinner at Mar-a-Lago and fly across the world to meet with President Xi Jinping of China, he should be able to find time to answer questions from Congress." He sits on Trump's council of science and technology advisers.

00:08:41 He flew to Beijing with the president in May. He has argued, repeatedly and openly, that American companies should be allowed to sell their most competitive chips into the Chinese market, on the theory that if Nvidia doesn't, Huawei will, and American technology loses the standard-setting fight.

00:08:58 Warren's counter is that the same sales could, in her phrase, turbocharge China's military. Both of them are describing a real trade-off. The difference is that one of them was willing to make the case in public on Thursday, and one of them wasn't. Now set that refusal against the other China headline of the day.

00:09:16 The US Defense Department added Alibaba, Baidu, and BYD to its list of companies it says support the Chinese military. That's three of China's crown jewels in one stroke: its leading cloud and AI company, its dominant search and AI player, and the electric-vehicle maker that has been beating Tesla on volume.

00:09:34 Being on that Pentagon list doesn't flip an instant sanctions switch. What it does is mark these firms as off-limits for Defense Department business and stain them for any American investor or partner trying to gauge where the next financial restriction lands. It is a signal flare for the direction of decoupling, and it now points straight at China's flagship AI names.

00:09:56 Put the two together and you get the texture of this administration's posture, which is less a doctrine than a set of competing instincts. Restrict Chinese AI champions from the American system, yes. But also let America's own champion sell into China, because dominance is the higher goal.

00:10:12 Huang is lobbying the second instinct hard, in private rooms, while declining the public ones. Warren's hearing on Thursday is now the place where that tension gets a microphone. I flagged on Sunday that the real test of all this AI-and-money talk would be whether Washington ever holds a hearing it can't stage-manage.

00:10:31 This is that hearing — and the headliner just sent his regrets.

00:10:35 Here's a story that would have read as science fiction eighteen months ago. Google has placed an order with Intel to manufacture more than three million of its tensor processing units — Google's custom AI chips, the ones it uses to train and serve its own models — in 2028.

00:10:51 And Nvidia is testing Intel's technology for a new processor, running trials on Intel's 18A manufacturing process. The reporting comes from Qianer Liu at The Information, and the one-line summary is hard to improve on: TSMC's capacity problems are turning into Intel's opening.

00:11:08 To see why that matters, you have to understand how concentrated this chokepoint is. Almost every leading-edge AI chip on the planet — Nvidia's, Google's, Amazon's, the lot — is physically made by one company, Taiwan Semiconductor Manufacturing, in one place, Taiwan.

00:11:25 That's the single most strategically loaded sentence in the entire AI supply chain. It means the compute that the West's AI ambitions run on is manufactured a hundred-odd miles off the coast of China. Everyone has known this is a fragility for years. Almost nobody has been able to do anything about it, because Intel — the obvious American alternative — spent the better part of a decade failing to deliver competitive manufacturing.

00:11:51 So two things are happening at once in this order. The first is simple supply and demand: TSMC physically can't make enough chips to satisfy the AI buildout, so the overflow has to go somewhere, and Intel's factories are the only other game with leading-edge ambitions.

00:12:08 When your first choice is sold out, your second choice gets a real shot. The second thing is more deliberate. Google and Nvidia routing serious volume to Intel is exactly the validation Intel has needed and couldn't buy. If those chips come back from Intel's lines working, at yield, the American foundry that everybody had written off has a future.

00:12:29 There's a political layer here you can't ignore, and it ties back to the money stories this show has been tracking. The US government recently took an equity stake in Intel. So when Google orders three million chips from Intel, and Nvidia runs trials on Intel's process, they're not just diversifying a supply chain — they're pumping demand into a company Washington now partly owns.

00:12:52 The line between industrial strategy and national strategy has effectively dissolved. A purchasing decision by Google is now also, in a small way, a return on a federal investment. I'd keep the skepticism handy, because Intel has raised hopes before and missed.

00:13:08 A placed order in 2028 is a promise, not a shipped wafer, and 18A still has to prove it can hold yield at volume against a TSMC process that keeps improving. But the direction is the thing. For the first time in this cycle, the most important buyers in AI are voting with real orders for a second source — and that second source happens to be American, and happens to be on the government's books.

00:13:32 If it works, the geography of where AI compute physically comes from starts, slowly, to change. That's a bigger deal for the next decade than any single model release.

00:13:43 OpenAI confirmed today that it has submitted a confidential draft of an S-1 to the Securities and Exchange Commission. An S-1 is the registration document a company files before going public. This is the paperwork that turns a private mission into a publicly traded stock.

00:13:59 The numbers around it, from reporting rather than from OpenAI itself, are enormous and a little hard to hold in your head. The targeted valuation runs somewhere between eight hundred and fifty billion and a trillion dollars, with Goldman Sachs and Morgan Stanley advising, and a possible public debut as soon as September.

00:14:18 It comes days after Anthropic filed its own confidential S-1 at a reported valuation near nine hundred and sixty-five billion. The two leading labs are now racing each other onto the public markets within the same season. Somebody in the Hacker News thread put it better than any analyst could.

00:14:36 "This is the true definition of AGI," they wrote, "and will be achieved this year. The I in AGI has always stood for IPO." I laughed, and then I sat with it, because it's closer to the real dynamic than the joke admits. For years OpenAI has described its destination as artificial general intelligence — a capability milestone.

00:14:55 What's actually arriving on a hard calendar, with bankers and a filing date, is the financial event. The capability story is uncertain and contested. The liquidity story has a prospectus. Here's why this is a governance story and not just a finance one. OpenAI restructured itself into a public-benefit corporation with its nonprofit retaining control — that's the arrangement that made a listing possible at all.

00:15:20 So the thing about to ask public markets to price it is an entity that still claims a charitable mission sits above its shareholders. Public investors are very good at pricing growth and very bad at pricing a mission that can, in principle, override their returns.

00:15:36 The S-1 is where those two things have to be reconciled in writing, under penalty of securities law. I want to read how they word the risk factors, because that's the one document where a company has to tell the truth about its own contradictions. And lay this next to the other money story still developing in Washington.

00:15:55 The same day OpenAI moves toward selling shares to the public, Axios's Dan Primack reports that Trump is pursuing voluntary government equity stakes in AI companies, and may meet with tech firms about it as soon as this week. The math he lays out is stark: a two percent stake in a three-trillion-dollar company is sixty billion dollars.

00:16:15 Bernie Sanders wants something blunter — a one-time fifty-percent tax, paid in stock, into a public wealth fund. Trump said of Sanders, "we have certain things that aren't that far apart." When the socialist senator and the dealmaker president agree the public should own a slice of these companies, and the companies are simultaneously filing to sell slices to everyone else, you're watching the ownership of frontier AI get decided in real time, in two venues at once.

00:16:43 The IPO prices the upside. Washington wants to be holding some of it before the bell rings.

00:16:49 One more institution pushed back today, and this one bears directly on how the AI industry staffs itself. A federal judge in Boston, Leo Sorokin, struck down Trump's hundred-thousand-dollar fee on H-1B visa applications. The H-1B is the visa US tech companies lean on to bring in skilled workers from abroad — engineers, researchers, the people who fill a large share of the technical benches at the labs and the cloud providers.

00:17:15 The fee used to run between two and five thousand dollars per application. Last September, Trump raised it to a hundred thousand by presidential proclamation, arguing the program was undermining national security through what he called the large-scale replacement of American workers.

00:17:32 The practical effect was a wall. Walmart and others paused their participation. As of mid-February, only eighty-five companies had actually paid the hundred-thousand-dollar fee. The program normally runs sixty-five thousand visas a year, plus another twenty thousand for people with advanced US degrees.

00:17:51 So the fee didn't reform the pipeline. It mostly froze it. What I find sharp is the legal reasoning, because it's part of a pattern bigger than immigration. Sorokin ruled the fee was, in substance, a tax — and that Congress, not the president, holds the power to tax.

00:18:07 He leaned directly on a Supreme Court decision from February that struck down Trump's reciprocal tariffs on the same logic: the executive had reached for a taxing power the Constitution never handed him. Twenty states brought this suit. New York's attorney general, Letitia James, put it in human terms — H-1B holders, she said, serve as doctors, teachers, and skilled workers every day.

00:18:31 The administration says it will appeal, and notes a judge in Washington upheld a nearly identical order, so this fight isn't over. Step back and notice what stitches the H-1B ruling to the OpenAI filing to Huang's empty chair. Every one of today's stories is a different institution testing where the lines around AI power actually sit.

00:18:51 A court says the president can't tax talent into the country by decree. The SEC is about to become the venue where a nonprofit-controlled lab proves what it's really worth. A Senate committee is trying, and so far failing, to get the industry's most powerful executive to answer in public.

00:19:09 The Pentagon is redrawing the map of which Chinese firms count as adversaries. None of these is a model release. All of them decide who gets to build, who gets to hire, who gets to sell, and who gets to know. The capability keeps advancing on its own schedule. The institutions are scrambling to catch up to what it already enables.

00:19:29 Pull it together and the day has a spine. Israel proved that a country's own surveillance cameras can be turned into a targeting system, and Russia believed it enough to pull Putin's cameras offline. Anthropic proved that a disclosed bug can become a working weapon for two thousand dollars and thirty-one minutes of compute.

00:19:47 Those two facts are the same fact wearing different clothes: the capability to act on the physical and digital world is getting cheap, fast, and hard to keep on one side of a border. Then the institutions spent the day reacting. The Pentagon named China's AI champions as military risks.

00:20:04 Jensen Huang declined to defend his China sales under oath, three days before the hearing where Warren will press the question anyway. Google bet three million chips on Intel, and on the chance that American compute doesn't have to be made within sight of China forever.

00:20:19 OpenAI started the paperwork to sell itself to the public while Washington negotiates to own a piece first. And a judge reminded the president that importing talent isn't something he can tax shut by proclamation. The pattern I'll hold onto is the inversion from the top of the show.

00:20:35 For a decade we built systems to watch — citizens, networks, code, and borders — and we assumed the watcher held the advantage. AI is steadily redistributing that advantage to whoever has the better model and a way in. The camera that protects you is also a map of you.

00:20:50 The patch that secures you is also a recipe to break you. The institutions trying to govern this have teeth, and they're pushing back — in courtrooms, committee rooms, and purchasing departments. But they're governing a capability that has already left the building.

00:21:05 Thursday is the next marker. Warren holds her hearing with or without Huang, and either his absence becomes the story or someone speaks for Nvidia on the record about China. I'll be reading the witness list and the risk factors, in that order. Until then — watch the cameras you can't turn off.

00:21:22 Jonas.