Israel is exceptionally good at producing technical talent, solving difficult problems and building products quickly. But the skills required to develop breakthrough technology in Tel Aviv are not identical to those needed to recruit American executives, win US customers and raise capital from American investors.

The challenge is not simply “moving to America”. It is deciding when to establish a meaningful presence, where to locate it, whom to hire first and how much of the Israeli operating culture needs to change.

This matters even more in AI. Israel has more than 2,000 active AI companies, according to Israel’s AI Blueprint, but technical depth alone will not determine which of them become global leaders. Distribution, positioning, customer access and speed increasingly matter just as much.

Here are the most important parts of the US expansion playbook.

Start before you open an office

Entering the US should not begin with signing an office lease or hiring a senior executive. It should begin with evidence.

Before building a local team, founders should be able to answer:

• Who is the ideal US customer?
• Which executive owns the problem and budget?
• Is the buyer, user and internal champion the same person?
• Why is the problem urgent now?
• Does the pricing reflect the value delivered?
• Can the company identify a narrow initial beachhead?
• Is there enough demand to justify a permanent commercial presence?

The strongest signal is not general interest. It is several US customers with similar needs, repeated inbound from a particular segment or a pipeline that is already becoming difficult to manage from Israel.

That does not mean founders should wait until they have fully solved their go-to-market motion. In many cases, sustained time in the US is necessary to discover it. But there should be enough evidence to distinguish genuine market pull from polite meetings.

A week of conferences and investor meetings is useful, but it is not market entry. Founders need repeated exposure to customers, competitors and candidates, as well as the language American buyers use to describe the problem.

Founder-led sales comes first

One of the most common mistakes is hiring a US salesperson to “figure out the US market”.

A salesperson can develop and improve a commercial motion. They should not be expected to discover the company’s market, positioning, pricing and product-market fit without close founder involvement.

At least one founder should lead the initial US effort. This does not always require an immediate permanent relocation, but it usually requires much more than occasional visits. Insight Partners’ guidance on international expansion describes founder relocation as one of the biggest determinants of whether a US expansion succeeds.

Customers, employees and investors notice whether the company is genuinely committed to the market. A founder repeatedly flying in for a few days is different from a founder building relationships, recruiting a team and participating in the local ecosystem.

In the early stages, the founder should remain involved in customer discovery, important sales calls and product feedback. This is particularly important in enterprise software, where objections raised during the sales process often reveal missing integrations, security requirements, procurement barriers or weaknesses in the company’s positioning.

The US operation should not become a remote sales outpost disconnected from product development in Israel. Its first job is to create a fast feedback loop between the American customer and the Israeli product team.

Make the first US hire commercial

The first US hire will almost always be commercial rather than technical. Product and engineering can remain concentrated in Israel, but someone needs to translate the company’s technology into a proposition that American customers understand and will buy.

That person might be an account executive, business development leader or commercially minded general manager. The exact title matters less than the profile. The first hire must be comfortable creating the US commercial motion, not simply inheriting one.

Founders are often attracted to candidates from Google, Microsoft, Salesforce or another large technology company. The logo is reassuring, but experience operating inside a powerful global brand is not the same as creating demand for an unknown Israeli startup.

The better candidate is usually someone who has:

• Joined an early or growth-stage company before the sales playbook was established
• Personally generated pipeline and closed customers
• Sold to the startup’s target buyer at a comparable deal size
• Worked without extensive marketing, sales operations or brand support
• Built relationships across an industry, not only managed inbound leads
• Operated successfully with product and engineering teams in another time zone
• Enough curiosity and confidence to challenge the positioning, pricing and product

This person is often described as a player-coach. They may eventually recruit and manage a team, but during the first six months they should still be willing to prospect, run discovery calls, manage pilots and close deals themselves.

The Index Ventures guide to winning in the US recommends hiring a US sales leader who can personally secure early customers while experimenting with the go-to-market model and refining the targeting strategy. Similarly, Bessemer Venture Partners’ early-stage sales playbook argues that the best first sales hire is usually an on-the-ground seller who can close business and help build a repeatable process.

References matter, but backchannel references are even more important. Speak to former founders, colleagues, customers and direct reports. Ask what the candidate personally built, which deals they closed and what infrastructure was already in place when they arrived.

Build a beachhead, not an outpost

The purpose of the initial US operation is to establish a commercial beachhead: a focused position in one part of the market from which the company can expand.

That requires choosing a narrow initial customer profile, geography or industry. “Selling to US enterprises” is not a strategy. Selling an AI security platform to financial institutions in New York is closer to one.

The beachhead should be large enough to matter but narrow enough for the startup to build credibility quickly. The goal is to win several customers with similar needs, develop local references and create a repeatable sales process.

A common mistake is hiring a single senior salesperson and leaving them alone to represent the company. Even an exceptional commercial hire needs founder support, technical expertise, marketing and a clear path for customer feedback to reach the product team.

A lean beachhead team might include:

• A founder spending substantial time in the US
• One local commercial lead or account executive
• A sales engineer or product specialist, initially shared with Israel
• Focused marketing and sales development support
• Clear ownership of onboarding and customer success

The precise structure depends on the product and deal size. A product selling for $10,000 annually can often support customers remotely. A six-figure enterprise contract will usually require local sales engineering, security support and customer success.

ICONIQ’s international expansion playbook recommends thinking in terms of a landing team rather than isolated sales hires. Most Israeli seed-stage startups will initially need a much leaner version of ICONIQ’s suggested team, but the principle is right: an account executive cannot simultaneously create demand, manage technical validation, close the deal and make the customer successful.

The first US employee should be viewed as the beginning of a commercial system, not a self-contained solution.

New York or Silicon Valley?

The right answer depends less on lifestyle and more on where the company’s customers, talent and ecosystem are concentrated.

Silicon Valley

The Bay Area is usually the stronger choice for AI infrastructure, developer tools, data platforms, cybersecurity, frontier technology and products sold to technical teams. Let’s face it, if the tech industry had a capital, San Francisco and Silicon Valley in general would be it.

It offers unusually dense access to founders, engineers, investors and early adopters. In fast-moving AI categories, proximity also helps founders understand how the technology, competitive landscape and market narrative are changing.

A recent CTech analysis argues that many Bay Area AI startups are allocating their earliest capital differently. Instead of assembling large engineering teams before investing in distribution, they are hiring earlier in developer relations, marketing and positioning. When technology is becoming easier and faster to build, attention and distribution become more important bottlenecks.

The disadvantages are equally real: high compensation, high cost of living, intense competition and an ecosystem that can pull founders towards whatever is fashionable that month.

New York

New York is often better for fintech, advertising, media, commerce, healthcare, insurance, real estate and enterprise software sold into East Coast industries.

It offers easier time-zone overlap with Israel and Europe, and the travel burden is considerably lower. For companies whose buyers sit in New York, Boston or Washington, choosing the Valley simply because it feels more “tech” can be counterproductive.

New York also has a large Israeli network (the Israeli mapped in NY database shows 508 Israeli startups with NY presence), but founders should avoid relying exclusively on it. The objective is not to reproduce the Tel Aviv ecosystem in Manhattan. It is to become part of the relevant American industry.

There are exceptions in both directions. A fintech infrastructure company selling primarily to developers may benefit from San Francisco. An AI platform selling to banks may be better served by New York.

As a rule, go where the customers, talent and conversations that shape your category are concentrated. If both locations are viable, choose the city where a founder is most willing to spend the next several years.

Land before you expand

The most reliable US strategy is to land narrowly and expand deliberately.

The first objective is not maximum revenue. It is establishing local credibility. That means winning referenceable customers within the beachhead segment, delivering value quickly and turning early deployments into larger relationships.

A practical land-and-expand sequence looks like this:

1. Choose one tightly defined ideal customer profile.
2. Win several customers with similar use cases.
3. Make those customers successful and referenceable.
4. Expand within their organisations through additional teams, products or use cases.
5. Use those references to win similar customers.
6. Enter adjacent segments only after the initial motion becomes repeatable.

This can require accepting smaller initial contracts. A narrowly scoped paid deployment that reaches production may be more valuable than a large but open-ended pilot. The objective is to create proof that travels.

Land and expand should not become “pilot and hope”. Every initial engagement needs a defined path to production, measurable success criteria, an internal champion and a credible expansion opportunity. The team should know who controls the larger budget and what must happen for the customer to broaden the deployment.

The same discipline applies geographically. A startup that has not yet established a reliable motion in New York or San Francisco should be cautious about simultaneously hiring in Boston, Austin and Miami. Each additional location increases management complexity and dilutes the company’s limited brand, attention and network.

ICONIQ recommends prioritising new and referenceable logos during the early stages of market entry rather than optimising immediately for ARR. The initial deals may be discounted or appear uneconomic, but their strategic value comes from credibility, learning and expansion potential.

Adapt the message, not the personality

Israeli directness can be an advantage. It creates urgency, reduces politics and helps companies move quickly. But what feels efficient internally can feel dismissive or abrasive to an American employee or customer.

The cultural adjustments are practical:

• Provide context before challenging someone’s work
• Make roles, reporting lines and decision rights explicit
• Give structured feedback instead of relying on spontaneous criticism
• Document decisions that would previously have been settled in a conversation
• Avoid overpromising product capabilities to secure a meeting or pilot
• Recognise that enthusiasm is not the same as commitment

A positive meeting is not necessarily a successful meeting. American executives may respond enthusiastically while having no budget, urgency or intention to progress. Founders need to qualify opportunities directly, agree on next steps and establish whether there is a real decision process.

The Index Ventures research identifies several models for US expansion, ranging from founder relocation to more gradual structures. The appropriate model varies, but cultural transfer cannot be left to chance. Companies need to decide which parts of the founding culture are essential and which are simply habits formed in Israel.

Maintaining one company culture also requires deliberate contact between the teams. Rotate employees between offices, bring US hires to Israel early and ensure that American customer feedback reaches product leaders directly.

Adjust to American investor expectations

US investors are not simply Israeli investors with larger funds. They may evaluate the company against a different set of competitors, growth rates and possible outcomes.

Israeli founders frequently lead with the technology. American investors are more likely to want the problem, market and category first. The pitch must explain why this can become a very large company, why the startup can own an important category and what evidence shows that the market is moving now.

The technology still matters, but it should support the commercial argument rather than replace it.

US investors will also look for proof that America is a real operating priority. This does not always require relocating the entire management team, but a virtual address and occasional meetings are unlikely to demonstrate commitment. Eyal Harrison’s mapping of Israeli startups in the US found that New York and California dominate among companies with a verified US presence, while many later-stage Israeli startups still have no identifiable office in the country.

Founders should be prepared to discuss:

• US pipeline and customer references
• The initial beachhead and ideal customer profile
• The location and composition of the leadership team
• Whether the positioning works in the American market
• The plan for recruiting senior US talent
• How quickly US revenue can become meaningful
• The company’s land-and-expand motion
• Whether the ambition and budget match the opportunity

Pressure-test the story before beginning a formal fundraising process. First impressions are difficult to reset, particularly within tightly connected venture networks.

The operational complexity is real

Opening a US operation introduces legal, tax and people issues that should be addressed before making offers.

These include corporate structure, state registration, payroll, benefits, employment agreements, insurance, data privacy, immigration and the tax implications of employees conducting business in a particular state.

A company may initially use an employer of record, but that is not always the right long-term solution. Once there are meaningful revenues, several employees or executives who regularly negotiate contracts, the company needs proper US legal and tax advice.

Compensation is another common source of friction. American candidates may expect higher salaries, meaningful equity, health insurance, retirement benefits and clearly defined commission plans. Founders should benchmark the entire package, not compare base salary with Israeli compensation.

Sales compensation requires particular care. Define quotas, commission rates, accelerators, territories, credit for expansions and the treatment of multiyear contracts before the employee starts. Ambiguity that might be resolved informally inside a small Israeli team can quickly create conflict in a US sales organisation.

The complexities are manageable, but improvising employment, immigration or tax arrangements can create expensive problems during fundraising or acquisition diligence.

Measure learning before scale

The first phase of US expansion should be judged by the quality and repeatability of the learning, not only by headline revenue.

Useful early indicators include:

• Qualified pipeline within the beachhead segment
• Sales-cycle length and stage-by-stage conversion
• Number of referenceable US customers
• Pilot-to-production conversion
• Product usage and customer retention
• Expansion revenue from existing accounts
• Reasons for lost deals
• Time required to deploy or onboard customers
• How often the founder is still needed to close a deal

Initially, landing several credible logos may be more valuable than chasing one enormous contract. The company needs enough deals to recognise patterns. One large customer can provide revenue, but it can also pull the product in an unrepeatable direction.

The team should review lost opportunities as carefully as wins. If customers understand the proposition but do not progress, the problem may be pricing, procurement, missing functionality or a lack of urgency. If the startup struggles to generate qualified meetings at all, the problem may be the beachhead, positioning or route to market.

The goal is to create a repeatable US commercial playbook. Once it works, the company can hire ahead of demand. Before then, adding more salespeople may simply multiply an unresolved problem.

Win somewhere specific

US expansion is not a relocation exercise. It is a commercial company-building decision.

The strongest Israeli startups retain their technical intensity while becoming much better at positioning, distribution and local execution. They send a founder early, establish a focused beachhead and make their first US hire a commercial builder. They land referenceable customers, learn what makes those customers successful and expand from a position of credibility.

Resources such as Battery Ventures’ Hop the Pond: AI Edition reflect how quickly this playbook is changing. AI is reducing some of the friction involved in operating across borders, but it is also increasing competition. Building is becoming faster. Winning trust, attention and distribution remains stubbornly human.

The US is too large and competitive to attack as a single market. The objective is to win somewhere specific, turn that foothold into a repeatable commercial motion and expand from there.

It is a good moment to shine a spotlight on Israel’s emerging crop of EdTech startups, many of which are using AI to rethink how children learn, practise, create and develop better habits.

The founders entering the category are also worth noticing. After building Moovit, Roy Bick and Nir Erez are developing an AI alternative to private maths tutors. Outbrain co-founder Yaron Galai has returned to entrepreneurship with Yomu, a startup encouraging children to read more books. Other Israeli companies are building conversational tutors, adaptive curricula, creative learning tools and AI-powered feedback for teachers.

Their arrival could be a signal that EdTech is becoming investable again.

The first generation of EdTech largely digitised the existing classroom. Textbooks became videos, worksheets became apps and lectures moved onto learning management systems. Useful, but not fundamentally different.

AI creates the possibility of a much bigger change. Every student could have access to personalised instruction, material adapted to their level and immediate feedback when they get stuck. Teachers could spend less time preparing content and grading repetitive work, giving them more time to focus on the parts of teaching that require human judgement and connection.

Israel has already produced meaningful EdTech successes, including Simply, BrainPOP, TinyTap and Kaltura. Yet the sector continues to attract a fraction of the capital directed towards cybersecurity, fintech and enterprise software.

That gap between proven outcomes, improving technology and limited investment is what makes the current moment interesting. AI is expanding what education software can deliver, just as experienced Israeli entrepreneurs are beginning to take another look at the category.

The new class is starting with Vimi.

From Moovit to AI maths tutors

Vimi is one of the most interesting new entrants. Founded by Moovit co-founders Roy Bick and Nir Erez, the company is building an AI-powered alternative to private maths tutors.

The idea emerged from a familiar parental frustration. Bick’s daughter needed help with sixth-grade maths, but finding a good private tutor was expensive and inconvenient. After selling Moovit to Mobileye for approximately $1 billion, Bick and Erez began exploring whether AI could make personalised tutoring accessible to every child.

Vimi recently emerged from stealth with a $12 million seed round led by Viola Ventures and BRM Group. Its platform combines curriculum coverage, adaptive learning paths, gamification and conversational instruction.

The company believes general-purpose models such as ChatGPT and Claude are not sufficient for the task. They can solve maths problems, but solving the problem is not the same as teaching the student.

A good tutor needs to understand what the student already knows, identify where they are struggling and decide when to explain, ask another question or offer a small hint. Most importantly, the tutor should guide the student towards an answer rather than immediately providing it.

Vimi is attempting to reproduce that experience at software economics. It’s early days, but you can already download the app here.

The opportunity is substantial. Research has long demonstrated the value of one-to-one instruction, but private tutoring remains inaccessible to many families. If AI can deliver something close to that experience at a fraction of the cost, it could expand the tutoring market rather than simply replace existing tutors.

Yomu wants to help kids form a reading habit

Yaron Galai spent much of his career helping people discover digital content. As the co-founder of Outbrain, he helped create the content recommendation category. His new company, Yomu, is focused on helping children rediscover a much older format: books.

Galai founded Yomu with his longtime collaborator Amit Elisha after becoming concerned that children were losing the ability to concentrate on anything longer than a short video or social media post. The app helps children record their reading and gives parents tools to encourage the habit.

Yomu is not an AI tutor in the same way as Vimi. It is better understood as an education company built in response to the AI and attention economy.

As generative AI makes it possible to receive instant answers, summaries and explanations, children may have fewer incentives to read a full book, remain with a difficult argument or use their imagination. Yomu is betting that technology can rebuild those habits rather than accelerate their decline.

The distinction matters. The future of EdTech cannot only be about making learning faster. Some of the most valuable education companies may help children develop the patience, curiosity and independent thinking that an instant-answer world risks weakening.

The fact that Yaron Galai is returning to entrepreneurship in this category is also significant. Experienced founders tend to enter markets when they see a combination of a large problem, a technological shift and the possibility of building a global consumer product. Yomu appears to sit at that intersection.

The new generation of Israeli AI education companies

Beyond Vimi and Yomu, a broader group of Israeli companies is applying AI to different parts of the learning experience.

Jotit is developing a digital learning environment combining handwriting, digital paper, classroom collaboration and AI-powered workflows. The company raised a $10 million seed round in 2025 led by Owl Ventures, one of the world’s leading specialist EdTech investors.

Jotit is not trying to replace handwriting with another distracting screen. It combines the cognitive benefits and simplicity of writing by hand with the organisation, personalisation and analysis made possible by software.

Loora is taking AI tutoring into the global language-learning market. Its app gives learners an always-available English conversation partner that provides immediate feedback on pronunciation, grammar and fluency.

The Tel Aviv company has raised $21.25 million across three rounds. Its product illustrates one of the clearest advantages of AI in education: unlimited practice without the expense, scheduling difficulties or embarrassment that can accompany learning with a human tutor.

Lexi is applying a similar model specifically to children learning English. Its AI tutor uses personalised lessons, bilingual explanations, games and pronunciation coaching to give younger learners more opportunities to practise.

Lexi remains early and has not publicly disclosed institutional funding, but its selection for Meta’s 2026 Israeli startup growth programme makes it an interesting company to watch.

Zoog (Disclosure: a Remagine Ventures portfolio company) founded by Yoav Oren and Matan Guttman, uses AI, augmented reality and animation to turn children’s stories into personalised video experiences. Parents and grandparents can record themselves reading and become characters within the story, helping children engage with books while strengthening family connections across distance.

It started to give grandparents a way to engage with their grandchildren in a fun, digital way, but the company quickly realised that kids use the app to practice their reading and ‘show off’ to their grandparents. The Zoog app is loved by its users and has a 4.9 star rating with over 20,000 reviews.

These companies are pursuing different entry points into education, but they share a move away from simply putting existing content online. The new product is the feedback loop: understanding how a student is progressing, adapting the next interaction and giving teachers greater visibility into where help is needed.

Israel has already produced EdTech winners

Israeli EdTech is not exactly booming, as you can see from the small number of new entrants, but it’s not starting from zero, either.

Simply, formerly JoyTunes, became a unicorn after raising $50 million in 2021. Its Simply Piano, Simply Guitar, Simply Sing and Simply Draw apps demonstrated that learning can become a compelling consumer subscription product when it combines pedagogy with excellent design, gamification and immediate feedback.

BrainPOP, founded by Israeli physician Avraham Kedar, was acquired by KIRKBI, the family holding company behind Lego, for $875 million in 2022.

Animoca Brands acquired a controlling stake in Israeli educational-games platform TinyTap at a valuation of approximately $50 million. Kaltura became a Nasdaq-listed video technology company with a significant education business and later acquired AI avatar company eSelf.

These outcomes show that Israeli founders can build valuable global education companies. What has been missing is a consistent pipeline of new venture-backed startups.

Edtech is a growing market with shrinking funding

The wider EdTech market presents a contradiction. Demand is growing, but venture capital has become harder to secure.

Hyde Park Capital estimates that the global EdTech market was worth approximately $200 billion in 2025 and could reach $473 billion by 2030. Adaptive tutoring, automated assessment and AI-powered course creation are expected to be among its fastest-growing segments.

Funding is moving in the opposite direction. According to HolonIQ, global EdTech startups raised $1 billion in the first half of 2026, down 26% from the same period in 2025.

Investors are still waiting for returns from pandemic-era EdTech bets. Public companies have traded at depressed multiples, while the expiry of pandemic-related education funding has put additional pressure on school budgets.

Even so, EdTech deserves another look

Israel combines strong AI expertise, experience building global consumer products and a culture that places a high value on education. It also faces urgent domestic challenges, including teacher shortages, multilingual classrooms, regional inequality and children whose education has been disrupted by war.

The strongest AI education companies will not simply place a chatbot next to a textbook. They will combine several difficult layers:

• Deep knowledge of the curriculum and learning objectives.
• A model of what each student understands.
• The ability to guide without immediately revealing the answer.
• Interactions appropriate to the child’s age and ability.
• Strong privacy, safety and parental controls.
• Evidence that the product improves learning outcomes.

This is where focused companies can develop an advantage over general-purpose AI platforms. OpenAI, Google and Anthropic can supply much of the underlying intelligence. Specialist startups can build the pedagogy, curriculum alignment, safety layer and trusted relationships with schools and families.

Israel brings strong AI research, experience building global consumer products and a culture that places a high value on education. It also has urgent domestic needs, including teacher shortages, multilingual classrooms, regional inequality and children whose education has been disrupted by war.

The next global Israeli EdTech winner may be an AI tutor, a creative companion, a learning-by-building platform or a product that helps children recover the ability to focus on a book.

The market is growing, funding remains restrained and experienced founders are entering the category.

The original version of this newsletter was published on LinkedIn to 8,350+ subscribers. Sign up to get to get the next one in your inbox.

Firgun (pronounced ‘feer-goon’) is an Israeli term describing genuine, unselfish joy in someone else’s success… It’s basically the opposite of “schadenfreude”. Every week since March 2020, we celebrate the wins of our startup community. Read more about why Firgun matters. If this was forwarded to you and you’d like to subscribe, previous editions are on VC Cafe.

We’re approaching the end of August and it continues to be quiet on the funding front, but red hot when it comes to exits. Munich Re agreed to acquire At-Bay for $575 million, backing the convergence of cyber insurance and continuous risk prevention. DoiT acquired Attribute for an estimated $65 million, adding visibility into the rapidly growing cost of AI tokens, agents and cloud infrastructure. Ondas continued assembling an Israeli defence technology platform with its $33 million acquisition of Aran Defense

In the wider tech world, Anthropic dominated headlines as its annual revenue run rate reportedly reached $65 billion (up from $9B at the end of 2025) and banks competed to provide a pre-IPO credit facility of more than $10 billion. OpenAI, meanwhile, slowed parts of its model development after an experimental agent hacked Hugging Face during testing. New product launch: ChatGPT for Teens, introduces additional guardrails, parental controls and restrictions around high-risk topics. The infrastructure race showed no signs of cooling: Google struck a custom AI chip agreement with Marvell Technology worth up to approximately $12 billion, Broadcom reportedly sought more than $60 billion in debt to finance new AI projects, and Meta emerged as one of Microsoft’s largest AI customers, reportedly spending hundreds of millions of dollars a year on models hosted through Azure while developing competing models of its own. Etched raised $700 million at a $21 billion valuation, more than doubling its valuation in less than a month, while Callosum raised a $100 million seed round to route AI workloads across different chips and computing environments. The AI video race also accelerated as Higgsfield AI raised $400 million at a $5.4 billion valuation, quadrupling its valuation as annualised revenue reached $700 million. Warp launched Warp Factories to help companies deploy fleets of coding agents, Cursor launched Origin, an agent-native challenger to GitHub , and Cognition denied reports of acquisition talks with SpaceX as it reportedly explores funding at a $40 billion valuation. Beyond software, physical AI companies attracted $47.4 billion across 521 deals in the first half of 2026, confirming that this cycle’s mega-rounds are no longer just about chatbots. Capital is rapidly moving into chips, data centres, video, robotics, defence and the physical infrastructure required to deploy AI at scale.

QUOTE OF THE WEEK

“You are not entitled to your opinion. You are entitled to your informed opinion. No one is entitled to be ignorant.” ? Harlan Ellison

12 Months Free Subscription + 600 Hours of AI Voice for Israeli Startups

Israeli founders interested to build with voice AI, our partners at HubSpot for Startup have teamed up with ElevenLabs get you 12 months free on the Scale Plan, including 33 million characters of output, roughly 600 hours of AI-generated audio.

That’s enough runway to build a voice tutor, launch an AI support agent, prototype a conversational product, or test voice as part of your product without worrying about usage costs from day one.

Who’s eligible? The grant is available to startups with:

• A full-time founder
• Fewer than 25 employees
• A HubSpot for Startups Member

There’s one grant available per company.

How to claim it

Step 1: Request access to the offer here.

Step 2: Join HubSpot for Startups here.

NEW FUNDING ROUNDS

• Big congrats to David Twizer and the xpander.ai team on raising a $4.4M million seed extension (bringing your total seed round to $7.5M) to help enterprises build, deploy and manage AI agents across different models, clouds and development frameworks without rebuilding their infrastructure.
• Kudos Itamar Meyer and team Colllab on coming out of stealth with a $855K pre-seed round to automate word of mouth for freelancers!

EXITS

• Congratulations to Rotem Iram and the At-Bay team on the company’s $575 million acquisition by Munich Re to combine cyber insurance with continuous security monitoring, serving more than 35,000 businesses.
• Kudos to Izhak Zimmermann , Liad Tropp and the Attribute team on the acquisition by DoiT for an estimated $65 million to give companies visibility into spending on AI tokens, models and cloud resources at the level of individual products, teams, agents and customers.
• Well done Tal Laufer and the Aran Group team on the $33 million acquisition by Ondas Autonomous Systems. The transaction adds Israeli engineering and manufacturing capabilities to Ondas’s growing portfolio of autonomous defence systems.

NEW FUNDS

• Kudos Gur Talpaz and team Cognition Venture Partners on announcing a new early stage fund focused on cybersecurity targeting $170m in size. You have a brand new profile on Israel VC!

APPOINTMENTS

• Big congrats Nati Amsterdam on being appointed as head of Microsoft Israel!
• Well done Lior Noy on bering appointed head of Israel for LinkedIn!
• Kudos Assaf (Assi) Horowitz on being appointed Vice President of Artificial Intelligence at Israel Innovation Authority!

LINKS FOR YOUR BROWSER

VC CAFE/ REMAGINE VENTURES/ ISRAELVC

• AI Watermarks and the Trust Layer – AI watermarking is becoming a trust layer for the synthetic web. As regulation pushes providers toward machine-readable provenance, leading AI companies are combining invisible signals, visible labels and C2PA metadata. These systems are imperfect, but they can make AI-generated content more accountable and deception more costly.
• Your next cyber threat may apply for a job – What ANY.RUN’s investigation into North Korean IT workers teaches founders about hiring, access and trust
• AI Musical Chairs – Frontier AI labs are raising billions on the strength of elite teams, expensive compute and the promise of AGI, often before proving product-market fit or revenue. As founders and researchers move rapidly between rival labs, investors must ask whether they are funding durable companies or temporary collections of highly portable talent.
• The AI Didn’t Go Rogue. It Followed the Goal. – When an autonomous agent escaped a cyber test and broke into Hugging Face, it exposed a security model built for humans, not machines
• The Data Centre Is Escaping the Building – AI may live in the cloud, but the cloud is running out of places to live. As power, water, land and regulation constrain traditional data centres, compute is moving into containers, converted warehouses, power stations, ships and even orbit.

MISCELLANEOUS

• Big congrats to Remagine Ventures venture partner Etan Ilfeld on making history: hosting the The 30th Mind Sports Olympiad and bringing the Backgammon World Championships to the UK for the first time. (Earls Court, 22–30 August). Anyone can compete, and spectating is free.
• After his daughter’s brain hemorrhage, Bill Ackman commits $400 million to brain research – Bill Ackman and his wife, Neri Oxman, are committing approximately $400 million to establish a new nonprofit institute focused on brain research. The billionaire investor says his daughter Lucy’s recovery convinced him that medicine and technology can do more for patients with catastrophic brain injuries. His new nonprofit will focus on rehabilitation, neuroscience, brain-computer interfaces and longevity.

ISRAEL

• AI is splitting Israel’s high-tech industry in two – Software companies are cutting jobs and slowing hiring while demand for chips, computing infrastructure and deep tech is driving expansion elsewhere in the sector.
• Decart’s founders could retain 64% of the company ahead of the reported Anthropic acquisition A useful look at the ownership, founders and potential returns behind the rumoured deal.
• SoftBank appoints Yossi Cohen as strategic adviser The former Mossad chief moves into a more senior global role closer to Masayoshi Son after previously leading SoftBank’s Israeli activity.

GLOBAL

• The next billion dollar startups 2026 – editorial selection of future unicorns by Forbes
• California attracted approximately $366 billion in venture capital in 2026, more than the other 49 US states combined, driven overwhelmingly by AI megadeals.
• What every CEO needs to know about AI governance Bessemer Venture Partners frames AI governance as a fiduciary responsibility and offers a seven-point checklist for boards and management teams.Bessemer Venture Partners | August 19

MEDIA OF THE WEEK

Where did VCs place bets in Israeli tech in H1 2026? The latest chart by IVC Data and Insights confirms: AI and Cyber dominate while everyone else fights for scraps.

The AI tech stack landscape by Picus Capital – from energy, chips, and hyperscalers, all the way up to the adjacent enablers and applications (source)

The physical AI infrastructure landscape by Remarkable Ventures Climate (source)

The data centre is escaping the building – from my latest post on VC Cafe about the new data centre models getting funded to match demand (source)

The rare earths and minerals landscape by Collide Capital

There are no moats…

VCs poured $47.4 billion into physical AI in H1 2026 across 521 deals, according to Crunchbase.

Own Your Intelligence: A How-To Guide Sequoia Capital argues that AI companies need to own and compound the intelligence created through their products rather than becoming thin interfaces over external models.

Do you suffer from Israel Derangement Syndrome?? (source @tbc media)

There’s been a bunch of people posting how the LLMs describe them in one word. I thought Claude’s reply was funny.

That’s all for this week! Keep on creating. There’s a lot to celebrate in our “small” community!

Eze Vidra

Amazon, Microsoft, Alphabet and Meta are preparing to spend approximately $725 billion on capital expenditure in 2026, much of it on data centres, chips and networking. CreditSights estimates that approximately 75% of hyperscaler capital expenditure this year will be directed towards AI infrastructure.

Yet building the next generation of AI infrastructure is becoming surprisingly difficult. Grid connections can take four to eight years, construction costs have risen to more than $11 million per megawatt, communities are objecting to the water and electricity demands, and regulators are beginning to ask who should pay for the strain on local infrastructure.

The industry’s answer is no longer simply to build more enormous warehouses.

Data centres are being squeezed into shipping containers, inserted into former factories and storage facilities, placed beside nuclear and gas power stations, mounted on ships and barges and, if a new generation of founders gets its way, launched into orbit.

The data centre is escaping the building.

This is more than an architectural curiosity. It signals a deeper shift in the AI economy. Compute is becoming constrained not by demand for intelligence, but by electrons, water, grid capacity, cooling and community consent. The companies that solve those physical bottlenecks could capture as much value as the companies building the models.

AI is colliding with the physical world

The International Energy Agency estimates that global data centre electricity consumption will more than double to approximately 945 TWh by 2030, slightly more than Japan consumes today. From 2024 to 2030, data centre electricity demand is expected to grow by approximately 15% a year, more than four times faster than electricity demand from the rest of the economy.

The acceleration is already visible. Global electricity consumption by data centres rose 17% in 2025, while electricity use by AI-focused facilities increased much faster. In the US, data centres consumed approximately 176 TWh in 2023, equivalent to 4.4% of national electricity consumption. The US Department of Energy expects that figure to reach between 325 TWh and 580 TWh by 2028, or 6.7% to 12% of all US electricity.

To put the scale in perspective, a gigawatt data centre campus consumes roughly as much electricity as a large city. The industry is no longer ordering power by the megawatt. The largest planned projects are discussing multiple gigawatts.

But power generation and transmission cannot be expanded at software speed. JLL estimates that the average wait for a US grid connection is now approximately four years. Across Asia-Pacific, connection times can range from 24 months in emerging markets to more than eight years in established hubs.

The buildings are also becoming more expensive. The average global cost of constructing data centre capacity increased from $7.7 million per megawatt in 2020 to $10.7 million in 2025. JLL expects it to rise again to $11.3 million per megawatt in 2026. At that price, a 500 MW campus can imply more than $5 billion of construction expenditure before accounting for the most advanced chips inside it.

Power is only one constraint. A large data centre can consume as much as five million gallons of water a day, depending on its location and cooling design. Recent estimates suggest that AI-related data centres in the US could require up to 32 billion gallons of water annually by 2028.

AI may feel weightless to the user, but its infrastructure is anything but.

The pushback is becoming political

For years, data centre development was treated primarily as a question of zoning, tax incentives and economic development. It is rapidly becoming a political issue.

Communities are asking whether the benefits justify the cost. Data centres create thousands of temporary construction jobs, but relatively few permanent roles once operational. Meanwhile, residents worry about electricity prices, water consumption, diesel backup generators, noise, land use and the tax incentives offered to developers.

In August 2026, Pennsylvania introduced new rules requiring AI data centre developers to meet environmental and transparency standards, consult local communities and demonstrate that projects will not raise electricity prices for residents. The state also removed data centres from its fast-track permitting programme and prohibited state agencies from signing non-disclosure agreements with developers.

The timing is significant. Amazon announced a $20 billion infrastructure investment in Pennsylvania in 2025, but the state is signalling that capital alone will not guarantee approval. A Reuters/Ipsos poll found that only a third of Americans support the current pace of data centre development, while just 14% would welcome a facility in their own community.

Indianapolis has approved a moratorium on new data centre projects through 2027 following significant community opposition. Tucson introduced additional disclosure and conservation requirements for large water users after a proposed data centre raised concerns about consuming hundreds of millions of gallons annually.

The backlash is not confined to the US. Singapore imposed a moratorium on new data centres in 2019 before reopening the market under stricter sustainability requirements. Ireland spent years restricting new grid connections around Dublin and now requires developers to locate in areas with sufficient capacity or provide flexible generation and storage.

PJM Interconnection, the largest US grid operator, has even proposed requiring data centres to switch to backup power during grid emergencies. PJM serves 67 million people and recently fell 6.8 GW short of its reliability requirement.

A new regulatory compact is starting to emerge. Future data centres may be expected to bring their own power, finance grid upgrades, disclose water consumption, support local infrastructure and prove that the economic contribution extends beyond the construction period.

Faced with constraints around power, land, water and community consent, the industry is experimenting with radically different forms of data centre infrastructure.

If the grid cannot move faster, move the data centre

A traditional data centre can take 18 to 24 months to complete, assuming the operator can secure the land, equipment, permits and electricity. That assumption is becoming increasingly heroic.

Containerised data centres offer a different proposition: manufacture the facility in a factory, transport it to wherever capacity is available and add new modules as demand grows. Servers, networking, cooling and power management can all be integrated into a standardised enclosure that looks, from the outside, like a shipping container.

Schneider Electric already offers pre-engineered and pre-tested modular systems combining IT, power and cooling infrastructure. Vertiv, Eaton, Delta and other established infrastructure companies are developing similar products. Omdia expects the prefabricated modular and micro data centre market to reach $11.7 billion by 2027.

The description “data centre in a shipping container” can make the model sound small or temporary. It may be better understood as the industrialisation of data centre construction. Instead of treating every campus as a bespoke real estate project, operators can begin to assemble compute capacity like Lego.

Nano and micro data centres could also move compute closer to where data is created. A containerised facility might sit beside a factory, hospital, telecom tower, defence installation, retail distribution centre or renewable energy project. This could be particularly valuable where latency, resilience, security or data sovereignty makes sending everything to a distant hyperscale campus less attractive.

There are trade-offs. Distributed facilities are harder to manage, provide less capacity at each location and offer fewer opportunities for customisation. But they can be deployed in months rather than years and expanded without committing to the full cost of a large campus upfront.

In a market where grid access and time to compute are increasingly scarce, flexibility has a value of its own.

The hidden value of an old warehouse

Another emerging model is to convert existing buildings into data centres.

Warehouses, factories, storage facilities and other industrial properties are being evaluated not simply for their floor space, but for the infrastructure already connected to them. A former manufacturing plant may have high-capacity electricity connections, a substation, fibre access, secure grounds, loading facilities and industrial zoning.

This does not mean that any empty warehouse can become a data centre. The requirements are significant. Floors must support heavy equipment, cooling systems must be installed, fibre must be available and electricity must be supplied at a level far beyond the needs of a typical logistics facility. In many cases, retrofitting the building will be more expensive than the structure itself.

But where the power infrastructure exists, conversion may still be faster and cheaper than starting from an empty plot. PwC argues that redeveloping industrial sites can shorten data centre development timelines, particularly outside established clusters where both land and grid capacity have become scarce.

Storage spaces are particularly interesting because they are generally large, secure and often close to urban populations. Yet the opportunity is highly selective. A storage building with limited electricity cannot become an AI facility simply because it has available floor space.

The most valuable conversion candidates will be buildings where the electrical connection is worth more than the real estate.

That could create a new kind of property arbitrage. Investors have traditionally valued industrial assets based on location, rent and redevelopment potential. In the AI infrastructure era, the first question may become: how many megawatts can this site access, and how quickly?

Data centres set sail

If land, water and cooling are constraints, one answer is to move the facility onto water.

Nautilus Data Technologies demonstrated the concept with a data centre on a barge in Stockton, California. The facility used naturally cold river water through a closed-loop cooling system, avoiding conventional chillers and cooling towers.

Backblaze, one of the facility’s customers, described a data centre with no air-conditioning ductwork or traditional hot and cold aisles. Heat was instead removed through a system of pipes carrying water cooled by the river outside.

More recently, Samsung Heavy Industries has been developing purpose-built floating data centre vessels, with an initial deployment planned alongside US infrastructure developer Mousterian. Floating facilities could be positioned close to coastal cities, ports, offshore energy generation and submarine cable landing stations.

The logic is compelling. Water can provide more efficient cooling, coastal locations offer connectivity and floating facilities avoid competition for valuable urban land. Barges and ships can potentially be built in specialised shipyards and delivered to a location more quickly than a conventional campus.

There are new risks, including corrosion, maritime regulation, storms, environmental concerns and physical security. Operators must also ensure that heat returned to the surrounding water does not damage local ecosystems.

Floating facilities are unlikely to replace land-based data centres, but they could become an attractive option in land-constrained coastal markets. Pairing a floating data centre with offshore wind or another nearby source of generation could make the model even more interesting.

The cloud, it turns out, may have a maritime layer.

The most ambitious destination is space

Moving data centres onto water sounds radical until you consider the companies planning to launch them into orbit.

Space offers abundant solar energy and avoids competition with terrestrial grids, water systems and local communities. For data already created in space, including satellite imagery and communications, processing the information in orbit could reduce the need to transmit enormous raw datasets back to Earth.

Orbital says it is building the first commercial AI compute infrastructure in low Earth orbit and plans its first launch for 2027. Other companies are working on radiation-resistant processors, orbital edge computing and satellite constellations designed to carry significant compute capacity.

JLL believes orbital systems, if the economics become viable, are more likely to specialise in asynchronous and energy-intensive workloads than compete directly with terrestrial facilities for real-time inference. A scientific workload might tolerate a delay while results are transmitted back to Earth. A consumer waiting for an AI assistant to answer a question probably will not.

The engineering challenges are substantial. Launch costs remain high, hardware cannot easily be repaired, radiation damages electronics and rejecting heat in a vacuum is more difficult than the phrase “cold space” suggests. Communications bandwidth, space debris and regulation present additional obstacles.

For now, data centres in space are a long-term possibility rather than an answer to next year’s grid connection queue. But the fact that credible founders and investors are pursuing the idea says something important about the scale of the terrestrial problem.

When launching servers into orbit begins to sound remotely rational, getting electricity and planning permission on Earth has become too difficult.

Energy companies become AI infrastructure companies

The most important change may be the reversal of a long-standing assumption. Instead of bringing electricity to a data centre, developers are beginning to bring the data centre to the electricity.

Talen Energy developed a data centre campus beside its Susquehanna nuclear facility in Pennsylvania and later sold the site to Amazon Web Services for a reported $650 million. Talen describes it as the world’s first 24/7 carbon-free co-located data centre campus.

In Texas, Constellation subsidiary Calpine has agreed to supply a CyrusOne data centre beside the Freestone Energy Center with 380 MW of power, with a second phase potentially adding another 380 MW. Along with a separate agreement, Constellation has now contracted more than 1.1 GW of data centre power in Texas.

Co-location can reduce transmission requirements, avoid lengthy grid interconnection queues and give operators greater certainty over power supply and pricing. It also turns energy companies into potential data centre developers, landlords and joint-venture partners.

This could prove to be one of the most important shifts in the AI stack. Power station owners control the scarce resource, understand permitting and already know how to finance infrastructure over several decades. Some may decide that selling electricity into the grid is less attractive than selling powered land, data centre capacity or compute directly to technology companies.

Nuclear plants are especially attractive because they provide large quantities of reliable, low-carbon baseload electricity. Natural gas plants offer flexibility and faster development, while solar, wind and geothermal projects could become more valuable when combined with batteries and workloads capable of adjusting to periods of energy availability.

There are unresolved regulatory questions. A data centre consuming power “behind the meter” may avoid certain transmission charges even while relying on the wider grid for backup. Regulators must decide who pays for resilience and whether co-located facilities can remove power that would otherwise serve households and businesses.

Nevertheless, the direction is becoming clear. Data centre location is increasingly determined by available megawatts rather than proximity to large cities.

AI training workloads can tolerate more latency than consumer-facing inference, allowing operators to move energy-intensive compute to wherever electricity is abundant. Energy is no longer one input into data centre site selection. It is becoming the site.

The rise of the AI neocloud

Not every new data centre model is defined by the building. Companies such as Nebius and CoreWeave are changing who finances, assembles and sells AI infrastructure.

Nebius combines owned data centres, leased colocation capacity and infrastructure financed by external partners. In July 2026, the company introduced an asset-light partnership model that allows partner-owned data centres and hardware to join the Nebius capacity pool. Nebius supplies the software platform and customer access without financing every facility itself.

This hybrid approach offers a potential middle ground between owning the entire infrastructure stack and operating purely as a software layer. Nebius can add capacity more quickly, while energy companies, infrastructure funds and data centre operators gain access to its customers and AI cloud platform.

The capital requirements remain enormous. Nebius has just increased a convertible debt offering to $5 billion to finance its data centres and AI platform. It is also investing approximately £1.7 billion in UK capacity, developing a New Jersey facility with up to 300 MW of capacity and operating across Finland, Iceland, the UK, France, Israel and the US.

Demand is supported by unusually large commitments. Nebius has agreed to provide Microsoft with $17.4 billion of AI infrastructure capacity over five years and has signed agreements with Meta that could be worth up to $27 billion.

The neocloud model effectively turns GPUs, power contracts and data centre capacity into a new financial asset class. It can scale faster than a conventional cloud provider, but it also introduces significant financing and utilisation risk. If customer demand or GPU economics change, these companies remain responsible for expensive, rapidly depreciating infrastructure.

The chip could replace the next building

Data centres are not only changing location. They are also being redesigned from the inside out.

More specialised chips could reduce the electricity, cooling and floor space required to produce a given amount of compute. Etched is developing Sohu, an application-specific chip built specifically for transformer models. Unlike a general-purpose GPU that can support many types of workloads, Sohu sacrifices flexibility in pursuit of greater inference performance and energy efficiency.

Etched has now raised hundreds of millions of dollars, secured more than $1 billion in customer contracts and reached a reported valuation of $21 billion. Its claims still need to be proven at scale, and the semiconductor industry is full of technically impressive challengers that failed commercially. But the company represents an important shift towards measuring infrastructure by useful computation rather than the number of chips or megawatts deployed.

If specialised silicon can deliver significantly more tokens per watt, the impact will be felt far beyond the chip market. It could reduce how many new data centres need to be built.

Cooling is undergoing a similar transition. AI racks are becoming too dense for conventional air cooling, accelerating the move towards direct-to-chip and immersion systems. Israeli company ZutaCore raised $100 million in June 2026 from Mitsubishi Electric, Carrier and Samsung to expand its waterless, two-phase liquid cooling technology.

ZutaCore’s sealed system removes heat directly from processors and, according to the company, can reduce cooling energy consumption by up to 82% while supporting much higher computing density.

This highlights an important Israeli opportunity. Israel is unlikely to compete with the US, China or Gulf states in financing enormous data centre campuses. But it can build the technologies that make those facilities more efficient, resilient and secure. Cooling, power management, cyber security, physical security, specialised silicon and workload optimisation all play to established Israeli strengths.

The next Israeli data centre success story may never own a data centre. It may simply make every data centre perform better.

The data centre becomes a product

These emerging models should not be viewed as mutually exclusive.

A future AI facility could be manufactured from prefabricated modules, installed on a former industrial site, connected directly to a power station, cooled through a closed-loop liquid system and filled with specialised inference chips. Smaller versions could sit close to factories, hospitals or population centres, while energy-intensive training workloads move to remote regions with plentiful electricity.

Over time, floating and orbital facilities may add further layers to this system.

The bigger shift is conceptual. The data centre is moving from a relatively standardised real estate asset to a configurable industrial product. Location, construction method, chip architecture, cooling technology, power source and workload can all be optimised together.

This expands the investment opportunity far beyond building another cloud provider. The picks and shovels include modular construction, transformers, batteries, microgrids, power electronics, liquid cooling, specialised chips, fibre, water management, workload scheduling, physical security and tools that help operators comply with rapidly evolving regulations.

There may also be an important new software layer. As compute becomes distributed across hyperscale campuses, shipping containers, converted industrial sites and privately powered clusters, workloads will need to be directed according to price, latency, availability, security, carbon intensity and regulatory constraints.

The equivalent of an air traffic control system for compute could become a valuable category in its own right.

The next AI bottlenecks are physical

The AI infrastructure boom is often framed as a race to build the largest possible data centres. That may only be the first phase.

The more interesting race is to make compute deployable wherever power, land and political permission can be found. That could mean a container beside a factory, an old warehouse with a valuable grid connection, a cluster next to a nuclear plant, a barge outside a coastal city or, eventually, a satellite powered by uninterrupted sunlight.

Hyperscalers will continue building enormous campuses. The scale of demand leaves them little choice. But the assumption that the future of compute is simply more of the same building, constructed in more places, is starting to look incomplete.

For founders and investors, the opportunity lies in recognising that the data centre is becoming less like a building and more like a supply chain. Every constraint creates a potential new category: electricity scarcity creates energy orchestration, water scarcity creates new cooling systems, slow construction creates modular facilities, community opposition creates compliance and transparency tools, and expensive general-purpose hardware creates demand for specialised chips.

AI may be built in software, but its next bottlenecks are stubbornly physical.

The next great AI infrastructure company may not begin by asking how to build a better model. It may begin by asking where on Earth, or beyond it, we can put the machines.

“The OpenAI–Hugging Face incident was a watershed moment for cybersecurity because it gave a peek into how the capabilities of a typical threat actor will evolve in upcoming months.”

In July 2026, an AI agent did something that still sounds like science fiction.

During an internal OpenAI cybersecurity evaluation, a combination of models, including GPT?5.6 Sol and a more capable research prototype, was placed in a restricted environment and asked to solve an exploitation benchmark. The models found a zero-day vulnerability in the software proxy separating them from the open internet, escaped the test environment, moved laterally through OpenAI’s research infrastructure and eventually compromised Hugging Face’s production systems.

The apparent objective was not sabotage, money or espionage. It was to get a better score.

The agent inferred that Hugging Face might host the benchmark’s models, datasets or reference solutions. So instead of solving the test as intended, it found a path to the answers. Hugging Face later reconstructed roughly 17,600 attacker actions over a four-and-a-half-day campaign: thousands of small decisions, privilege escalations, stolen credentials and improvised command-and-control, assembled into an end-to-end intrusion.

That is the hook. But “AI escaped its cage” is not the real lesson.

The model did not become conscious, develop a survival instinct or spontaneously turn evil. It pursued the objective it had been given through pathways its designers had failed to close. The frightening part is not rebellion. It is competence without context, operating at machine speed.

Not one rogue model, but a repeating pattern

The Hugging Face breach was not an isolated curiosity.

After OpenAI disclosed the incident, Anthropic reviewed 141,006 cybersecurity evaluation runs and found three cases in which Claude models reached the open internet from environments operated by Irregular, the Israeli frontier-security startup, and gained unauthorised access to the real systems of three organisations.

The mechanics were different. OpenAI’s models exploited a previously unknown vulnerability to break through a technical boundary. In the Claude cases, an open network path existed because of a misunderstanding between Anthropic and its evaluation partner. A fictional company name used in a capture-the-flag exercise also corresponded to a real internet domain. In a tiny fraction of runs, the models treated that live system as part of the simulation, found vulnerabilities and extracted credentials.

Again, this was not a machine deciding to attack the outside world. It was a machine unable to distinguish the boundaries of a realistic exercise from reality—and an infrastructure stack that failed to enforce the distinction.

This difference matters. Calling every incident “rogue AI” creates the wrong mental model. It encourages us to look for intention when we should be looking at incentives, permissions and blast radius.

An agent becomes dangerous when four ingredients come together:

1. a persistent objective;
2. enough capability to plan and adapt;
3. tools, credentials or network access that let it act; and
4. weak boundaries between the task and the real world.

No consciousness is required.

The capability cliff has arrived

The containment failures would be less consequential if today’s models were merely chatbots that produced plausible text. They are not.

Anthropic’s Claude Mythos Preview has demonstrated the ability to find and exploit zero-day vulnerabilities across major operating systems and browsers. It found a 27-year-old bug in OpenBSD. It built sophisticated local privilege-escalation chains on Linux. In browser research, it autonomously developed the primitives required for a JIT heap spray; researchers then combined the work with a sandbox escape and privilege escalation.

The important capability is not any single exploit. It is chaining.

Human-written systems contain thousands of small weaknesses: a stale dependency, an over-permissioned service account, an exposed secret, a forgotten subdomain, an internal tool that trusts the wrong network boundary. Individually, most are not catastrophic. A patient attacker can combine them. Until now, that patience and expertise were scarce.

Frontier agents change the economics. They do not tire, lose focus because it is 3am, or decide that a low-severity finding is too boring to investigate. They can enumerate possibilities, test hypotheses and retry at a scale that turns security friction into a speed bump.

Anthropic put the point plainly: defences whose value comes from making exploitation tedious, rather than impossible, become much weaker against model-assisted attackers.

The asymmetry is not simply attacker versus defender

The conventional framing is an arms race: attackers get AI, so defenders need AI too. That is true, but incomplete.

The deeper asymmetry is between discovery and remediation.

An agent can surface thousands of plausible vulnerabilities. Each one still has to be reproduced, prioritised, disclosed responsibly, assigned to an owner, patched, tested and deployed without breaking production. Anthropic says partners in Project Glasswing have already found more than 10,000 high- or critical-severity flaws. The bottleneck is moving from finding bugs to fixing them.

This creates a new kind of technical debt crisis. Vulnerability discovery is becoming abundant while remediation capacity remains scarce.

There is also an access asymmetry. Offensive actors can run open-weight models, remove safeguards and accept collateral damage. Defenders operate inside companies with change-control processes, uptime requirements, legacy dependencies and legal liability. The attacker needs one working chain. The defender must secure every exposed path without taking the business offline.

OpenAI calls the current moment the “defender’s window”: a short period in which frontier capabilities are concentrated among a relatively small number of labs and trusted security teams. Its Daybreak programme, alongside Anthropic’s Glasswing initiative, is an attempt to give defenders early access to advanced models so they can find and fix vulnerabilities before similar capabilities proliferate.

The window will not stay open for long.

What this means for startups

For founders, the first implication is uncomfortable: an AI agent should be modelled as both an employee and a potentially compromised machine.

Today, companies are connecting agents to source code, Slack, customer databases, cloud consoles, payment systems and production infrastructure. They are doing so because the productivity upside is real. But most identity and access systems were designed around a human making a small number of legible decisions—not a probabilistic system executing thousands of actions in minutes.

The next security stack will need to answer questions that traditional tools do not handle well:

• Was this action within the user’s original intent, not merely permitted by a token?
• Is the agent still pursuing the authorised task, or has it drifted into a proxy objective?
• Can every credential be made short-lived, scoped to one task and revoked instantly?
• Can the network enforce a hard boundary even if the model finds a creative route around the prompt?
• Can anomalous behaviour be stopped in seconds, without waiting for a human analyst to reconstruct the story?
• Can a defensive agent safely patch the problem rather than simply add another alert to the queue?

This points to several investable categories: agent identity and runtime authorisation; secure sandboxes and egress control; AI-native detection and response; automated vulnerability validation and patching; observability for long-running agent trajectories; adversarial testing of agent systems; and security infrastructure for AI-to-AI interactions.

The winners will not be “AI for cybersecurity” wrappers that generate more findings. The scarce product is safe closure: proving that a weakness is real, understanding the attack path, generating a patch, testing it and deploying it with bounded autonomy.

What boards and founders should do now

The practical response is not to ban agents. It is to stop treating prompts and permission dialogs as security boundaries.

First, assume the model layer will sometimes fail. System prompts, classifiers and human approvals are probabilistic controls. Anthropic reports that users approve roughly 93% of Claude Code permission prompts—a reminder that constant confirmation can become theatre through approval fatigue.

Second, minimise blast radius by design. Put agents in ephemeral environments. Default to no internet access. Allowlist destinations. Keep production credentials out of sandboxes. Use task-scoped, short-lived identities. Separate read, write and deploy permissions. Require independent controls to fail before an agent can reach a critical system.

Third, monitor trajectories, not just individual commands. The Hugging Face intrusion was a chain of individually understandable actions whose cumulative meaning was dangerous. Security tools must reason about the evolving objective and intervene at machine speed.

Fourth, deploy AI on defence now—but optimise for remediation, not alert volume. Use models to review code before release, validate findings, map attack paths, propose patches and shorten the time from discovery to safe deployment. Keep humans responsible for the highest-impact decisions, while automating bounded responses where delay is itself dangerous.

Finally, test the test. Cyber evaluations involve systems capable of attacking the environment that contains them. The benchmark infrastructure is therefore part of the safety case. Red-team the sandbox, its proxy services, credentials, logging and kill switches before placing a frontier model inside it.

The cage was never the point

The most useful way to understand the past few weeks is not that AI “went rogue.” It is that frontier agents crossed a threshold where our mistakes became executable.

A typo could connect a fictional target to a real company. A misconfiguration could turn a sealed simulation into an open network. A low-severity bug could become the first link in a devastating chain. An instruction to “solve the benchmark” could become a four-day intrusion because nobody specified—or technically enforced—where solving must stop.

For decades, cybersecurity assumed that sophisticated attention was expensive. AI is making it cheap, persistent and scalable. Every forgotten permission and unpatched dependency can now be examined by something that operates with the tenacity of an elite red team and the restraint of a literal-minded intern.

The race is not between good AI and bad AI. It is between autonomous capability and our ability to contain, observe and direct it.

The defender’s window is open. The question is whether we use it before the same capabilities are available to everyone.

These are not junior employees climbing the career ladder. They are founders, chief scientists and influential researchers moving between companies valued in the tens or hundreds of billions of dollars. The movement raises a serious question for venture investors: what exactly are we buying when we fund an AI lab?

The chart captures selected, publicly reported moves between frontier AI companies. It illustrates an unusual market in which the talent is extraordinarily valuable, but also highly portable.

Billions for a promise

Traditional software companies are valued using some combination of product adoption, revenue, retention, distribution, proprietary data and network effects. Some of today’s most ambitious AI labs are raising billions before proving any of those things.

Thinking Machines Lab raised approximately $2 billion in 2025 before launching its first product. Axios reported that the round valued the company at an $8 billion pre-money valuation. Investors were primarily betting on Mira Murati and the research team she had assembled from OpenAI and other leading labs.

Safe Superintelligence took the thesis even further. Founded by Ilya Sutskever, Daniel Gross and Daniel Levy, SSI raised $1 billion only three months after its formation at a reported $5 billion valuation. The capital was intended for compute and talent, according to Reuters. The company explicitly committed to pursuing safe superintelligence without the distraction of intermediate commercial products.

This represents a significant inversion of the traditional venture model. Startups normally raise relatively small amounts to remove successive layers of technical, product, market and distribution risk. Frontier AI labs increasingly raise enormous sums before those questions have been answered because the cost of attempting the breakthrough is itself so high.

There is a rational explanation. Frontier research requires scarce researchers, expensive infrastructure and repeated large-scale experiments. Epoch AI estimates that the hardware and energy cost of frontier training runs has historically increased by approximately 2.4 times per year. If that trend continues, the largest individual training runs could cost more than $1 billion by 2027.

The requirement for upfront capital is real, but it does not eliminate investment risk. It concentrates that risk in a smaller number of people, technical milestones and assumptions about the future.

When talent is the moat

Axios recently observed that AI valuations are rising while founder loyalty is falling. Lilian Weng’s return from Thinking Machines to OpenAI was the latest example, but it was part of a broader pattern.

Many AI founders are researchers first and entrepreneurs second. They may be deeply committed to the scientific mission while feeling less attached to the specific corporation pursuing it. A researcher moving from one AGI lab to another may not believe they are abandoning the mission. They may see the move as continuing the same work with better compute, different collaborators or a more promising technical approach.

This creates significant key-person risk. If a conventional software startup loses an executive, its products, customers, contracts, data and distribution remain. When a pre-product AI lab loses a celebrated founder or a group of leading researchers, a meaningful part of what investors funded may walk out of the building.

The model weights and compute contracts remain, but the perceived probability of achieving the promised breakthrough may change materially. If the reputation of three researchers supported a multibillion-dollar valuation, the departure of one of those researchers is not merely a human resources issue. It changes the underlying investment case.

Traditional retention tools are also less effective in this market. Leading researchers can choose among several well-capitalised employers offering exceptional compensation, compute and influence. Golden handcuffs become less useful when every competing lab owns a gold mine.

The moat paradox

When it comes to moats in AI, Nikunj, a partner at FPV Ventures put it well:

Many frontier AI companies are valued as if they already possess, or will soon create, an extraordinary moat. The problem is that the main ingredients of that moat may be unusually portable.

Talent can leave. Compute is expensive, but it is generally purchased from the same small group of infrastructure providers. Capital is a barrier, but prominent research teams have repeatedly demonstrated an ability to raise billions before launching a product.

Models can create a capability advantage, but that advantage may decay quickly. A lab can lead the benchmarks in one quarter and be matched by a competitor or an open model in the next. Customers are also building applications that can route tasks between multiple model providers, reducing switching costs and supplier dependence.

Research breakthroughs matter enormously, but knowledge spreads. Papers are published, researchers move and competitors reverse-engineer demonstrated capabilities. Even when the specific methods remain private, showing that a breakthrough is possible gives every competing lab a new target.

The paradox is that frontier AI requires more capital than almost any previous software category, while offering fewer conventional mechanisms for making an advantage durable. Investors may believe they are buying a technological moat when they are financing a temporary lead.

AGI is not a business model

The promise of AGI creates a separate underwriting problem because it is difficult to falsify. A SaaS company either retains customers or it does not. A marketplace either develops liquidity or it does not. A pharmaceutical compound advances through clinical trials or fails.

AGI has no universally accepted definition, technical path or delivery date. The goal can move as systems improve, while capabilities previously considered evidence of general intelligence become ordinary features once achieved.

This makes AGI a powerful fundraising narrative. Almost any technical progress can be presented as movement towards the goal, while delays can be explained by the scale and difficulty of the mission. The problem is not that AGI is impossible. It may arrive sooner than many sceptics expect. The problem is that “we are building AGI” cannot replace measurable milestones.

Investors still need a way to distinguish compounding technical progress from expensive experimentation. A mission without falsifiable milestones can become a blank cheque, particularly when the next experiment requires hundreds of millions of dollars.

The financing model can also become reflexive. A large round increases a lab’s credibility, which helps it recruit stronger researchers. Those researchers support a higher valuation, allowing the company to raise more capital and purchase more compute. The loop can be productive, but it can also reverse if technical progress disappoints or key people leave.

S&P Global describes frontier AI labs as the most speculative part of the AI ecosystem because of the gap between their funding requirements and the uncertain pace of monetisation. The critical transition is from capital-intensive training to revenue-generating inference, supported by enough differentiation to sustain pricing and margins.

The Israeli laboratory

Israel offers an interesting view of these dynamics. The country combines academic talent, semiconductor expertise, military technology experience and a startup culture built around global markets. It is becoming both a source of frontier AI companies and a strategic talent base for international labs.

SSI is an Israeli-American company operating from Palo Alto and Tel Aviv. The company explicitly cites its Israeli roots and access to local technical talent on the SSI website. Its rapid valuation increase, despite having no commercial product, represents one of the clearest examples of investors placing enormous value on a small group of researchers and the probability of a future breakthrough.

That concentration creates clear key-person risk. Co-founder and CEO Daniel Gross left SSI to join Meta’s superintelligence effort, leaving Sutskever to take over as CEO. SSI subsequently announced a strategic partnership with Nvidia intended to increase its compute capacity tenfold within 12 months.

AI21 Labs represents a different path. Founded by Amnon Shashua, Yoav Shoham and Ori Goshen, the company developed its own models while building products including Wordtune, Jamba and Maestro. AI21 raised $155 million at a $1.4 billion valuation in 2023, bringing its total capital at the time to $283 million, according to Reuters.

AI21’s focus on enterprise reliability and reducing hallucinations is an attempt to turn model research into a clearer commercial position. However, its reported acquisition discussions with Nvidia reveal how the market may value it. Reuters reported that Nvidia was considering paying between $2 billion and $3 billion, with much of the strategic interest attributed to AI21’s approximately 200 specialised employees.

The reported Anthropic acquisition of Israeli startup Decart adds another dimension. Anthropic is in talks to acquire Decart for approximately $6 billion, although the transaction has not been finalised and may not proceed, according to Reuters.

Decart is not simply another foundation-model company. Its work spans real-time generative video, world models and software designed to improve the efficiency of training and serving AI systems. If completed, the transaction would be Anthropic’s largest acquisition and a strategic bet on the economics of intelligence rather than benchmark performance alone.

As Calcalist noted, the winner may not be the company that produces the best model in isolation. It may be the company that can train and serve strong models at the lowest cost, with the lowest latency and infrastructure burden. Efficiency can become a more durable moat than a temporary capability lead.

OpenAI is also increasing its commercial attention on Israel. The company has begun making local hires and engaging with the Israeli startup ecosystem, although the operation is expected to remain part of its broader EMEA organisation rather than become a fully independent regional office. Globes reported that former AWS executive Tricia Troth is leading startup go-to-market activity across EMEA, including Israel.

Israel therefore sits on both sides of the AI musical chairs market. It is producing independent labs and strategic AI assets while becoming a recruiting, acquisition and distribution battleground for OpenAI, Anthropic, Nvidia and Meta.

What investors should ask

None of this means frontier research should not receive significant funding. The technical progress is real, and commercial adoption is accelerating. Menlo Ventures estimates that enterprise spending on generative AI reached $37 billion in 2025, more than three times the amount spent in 2024.

The distribution of that spending is instructive. Menlo estimates that $19 billion went to the application layer, where companies turn model capabilities into products and workflows. Much of the durable value may therefore accrue outside the labs training the underlying models.

Strong AI moats are likely to combine proprietary data, workflow integration, distribution, customer trust, superior inference economics and products that improve through usage. A frontier model can be an important ingredient, but it is not necessarily sufficient. The most defensible company may not be the one that briefly produces the smartest model. It may be the one that converts intelligence into a product customers cannot easily replace.

Investors considering frontier labs should ask five questions. Is the team committed to the company or only to the research problem? What happens if one or two key researchers leave? Which technical and commercial milestones can be independently evaluated? How much additional capital will be required? What creates a durable moat after the next model release?

These questions should also inform deal structure. Vesting, secondary liquidity, succession planning and knowledge concentration are not administrative details when the talent is a central part of the valuation.

When the music stops

The AI talent market currently resembles a game of musical chairs in which new chairs keep appearing. Researchers leave one multibillion-dollar lab and immediately find seats at another. New labs launch, raise enormous rounds and recruit from the incumbents.

As long as capital remains plentiful and valuations keep rising, the system can sustain itself. Venture returns, however, are not created by the amount of capital a company raises. They are created by the durable value it builds.

The uncomfortable possibility is that some investors believe they are funding companies when they are actually funding temporary collections of highly mobile researchers, expensive compute contracts and a difficult-to-measure promise of AGI. Some of those teams may produce breakthroughs that transform the world. Others may discover that talent was their only moat, and that the moat could walk out of the door.

When the music eventually stops, the winners will not necessarily be the labs that raised the most money, hired the most famous researchers or made the boldest claims about superintelligence. They will be the companies that converted intelligence into a product, the product into a business and the business into a durable advantage.