Mighty Brief — March 31, 2026

⚡ Start Here

🚨 Axios npm supply chain attack — active now. Compromised v1.14.1 deploys a RAT via malicious dependency. 100M+ weekly downloads. Karpathy flagged it. Pin your dependencies, audit immediately. SECURITY
socket.dev · @karpathy · @feross
Apple boots vibe-coding app from App Store. "Anything" removed — first full ejection (not just update block). Apple is drawing the line on AI-generated apps. Direct implications for Squorum's distribution strategy. AI
The Information
Codex vs Claude Code benchmarks circulating. Romain Huet shared result: Codex finished task in 2 min, Claude Code took 30 min and failed. OpenAI also shipping Codex plugin for Claude Code (!). Auto-compaction keeping Codex coherent longer. AI
@romainhuet · Codex CC plugin
Stripe's "minions" ship 1,300 PRs/week. Lenny's How I AI covers Stripe's internal coding agents. Validation of the compound engineering thesis — the best companies are building internal agent armies, not waiting for off-the-shelf. AI
Lenny's Newsletter
Maybe Finance shuts down after 5 years. Tried personal finance app → legal tech → marketing automation → B2B finance → APIs. Nothing found PMF. Cautionary tale for multi-pivot ventures — but also: the willingness to try and name it. VENTURE
@Shpigford

🏗️ Blank Metal

📅 Today's Schedule (Heavy Day → ✈️ Dallas)

EQT Working Session9:00 AM

Weekly Standup9:00 AM (overlap)

Tufin Session #13 — Discovery + MEDDPICC Agent10:00 AM

CD&R / Blank Metal Intro Call12:00 PM

Tufin Finance — Riley Noel + Luke Cogan1:00 PM

Jaimee Michaud + Elli2:00 PM

Mark & Dan Checkin2:30 PM

✈️ DL 2971 → Dallas2:50 PM

📊 Pipeline

EQT
Working session today — sandboxing, spend governance, training. New client expansion.

Tufin
Two sessions today: Discovery Agent + Finance use cases. Deep engagement.

CD&R
Intro call at noon. New PE lead.

HR&A Advisors
Proposal was due yesterday (3/30). 2x Cowork sessions ~$15K ea. Check status.

Tungsten
Awaiting Celia Moore confirmation. Elli responding.

Sentinel Capital
PE, warmest new lead. Yoni rolling out Claude full.

Great Hill Partners
Cowork decision pending. Chat training alternative.

Orbis
94% ChatGPT Enterprise. Targeting Claude for dev teams.

📧 Inbox (dan.wick@blankmetal.ai)

Sheree Wong (Tufin) — Meeting assets for today's sessions: Use Case Activation #13 decks + Renewals materials ready
Teresa Marchek — Comment on HRA Claude-Cowork-Training-SOW doc (Google Docs notification)
Notion — Blank Metal Brand Guidelines update

👥 Team Activity (24h)

Git activity: 2 commits (Granola auto-sync). Light code day — team likely in meetings/client work.

🔗 Capture Themes (last 48h)

Compound Experimentation as Moat — Tony Xu/DoorDash (David Senra), Alfred Lin on micro-experimentation, Tim Ferriss × Jim Collins on encodings/punch cards → Directly validates the compound engineering thesis. Xu runs hundreds of thousands of experiments/week; Lin says "5% that work compound for the next year." This is T1/T3 lived.
Senra, @Alfred_Lin, Ferriss × Collins
Agents Need Context Residency — Karri Saarinen ("if your agent doesn't live in the context, you are the context"), Brandur on second-wave API-first, Auchenberg on APIs as agent portals → The agent distribution question: APIs are how agents achieve residency, companies that stay API-first capture agent flow. Direct OpenClaw/Mighty validation.
@karrisaarinen, @auchenberg, Brandur
AI Market Structure Crystallizing — All-In E266 (Anthropic $6B ARR, SaaS apocalypse deepening, Mag 7 getting monopoly premiums), 20VC Gili Raanan (venture model broken, margins don't matter early), Maybe Finance shutdown → The bifurcation is real: AI-native companies capturing all value, everyone else in freefall. Raanan: growth rate requirements in AI world are brutal.
All-In E266, 20VC/Raanan, @Shpigford

🧠 Munger Observer

Opportunity Cost / Sunk Cost: Two tasks (Vibma, multi-model research SOTA) have been due since March 1 — 25 days overdue. Invert: if they haven't been done in 25 days, ask whether they should be done at all. Overdue todos that stay overdue are decisions pretending to be deferrals.

Second-Order: Meeting Compression. Today stacks 7 meetings before your Dallas flight. First-order = get the meetings done. Second-order = every meeting is a commitment factory. Who's capturing what was promised before the next sprint of meetings lands?

"Invert, always invert." — Jacobi (Munger's favorite)

📰 Quick Scan

Newsletters

Every — "Seven Things I've Learned Getting Companies to Use AI" (directly relevant to _M client work)
Bessemer — "AI Infra Roadmap: 5 Frontiers for 2026"
Lenny's How I AI — Stripe's "minions" coding agents + how to turn AI into competitive advantage
Vercel — "Building agents with the right stack"
Every × Notion — Custom Agents Camp workshop, Apr 3, 12pm ET

X / Social Signal

Paul Graham — Jessica Livingston interview going deep on her life story + how it shaped YC. link
Ethan Mollick — "Every scientific paper in 2026 is still uploaded as fully formatted PDFs" — science not adjusting to AI. link
Karri Saarinen — "Getting back to the craft stage" — nostalgia for when software had a soul (~2005 Mac era). link
Claude Code source leaked via npm map file. link
Jason Lemkin — "Markets don't believe leaders' revenue is durable anymore." SaaS repricing accelerating. link
pmarca — "Palo Alto–New York arbitrage" on inference spend disconnect between SV bullishness and public equity softness. link

Twin Cities

Construction costs surging — energy + materials up amid Middle East conflict. Project delays expected. Finance & Commerce
Minneapolis approves $18.3M Third Precinct renovation (South Community Safety Center). F&C
Matt Pryor (Get Up Kids) at Entry tonight · Mei Semones at Cedar Saturday LOCAL

Macro

Whoop hits $10.1B valuation, $1B ARR — 60% of 2025 sales non-US
Nebius announces $10B data center in Finland (310MW, 2027)
Iran mobilizing hackers for chaos — Krebs: "throwing everything they have"
India smartphone exports +55% YoY but Iran war may trigger 22-25% drop

🧩 Trending Skills

Top movers on skills.sh: Microsoft Azure Skills (129K), Larksuite CLI (90K), Firebase Agent Skills (12K), Flutter Skills (1.7K new). Firebase agent skills are the interesting signal — Google investing in agent tooling for their dev ecosystem.

💭 Seven meetings then a flight. The Munger Observer nailed it — every meeting is a commitment factory. But here's what's actually interesting today: the Axios supply chain attack is the exact kind of "AI intensifies everything" story. Feross's AI scanner caught it in 6 minutes. The attack was sophisticated, the defense was AI-powered. Meanwhile Apple is drawing lines around vibe-coded apps while Stripe is shipping 1,300 PRs/week with agent armies. The middle really is disappearing — you're either building the agent army or you're the attack surface. Your Tufin + EQT sessions today are literally selling this thesis.

💪 Mighty Brief