AI App Layer Collapses as Qwen3.6 and Anthropic Squeeze Margins

◆ DEEP DIVES

1. 01

   Creative Software's Great Unbundling: Adobe's Crisis, Canva's Platform Bet, and the Three-Layer Market

   <h3>The Convergence</h3><p>Three events hit the creative software market simultaneously this week, and together they describe a structural break, not a temporary competitive blip. <strong>Adobe</strong> enters its customer summit down 30% YTD with CEO Shantanu Narayen departing — his worst possible exit timing. <strong>Canva</strong> launched AI 2.0, repositioning from design tool to the <strong>"visual execution layer"</strong> beneath every major AI assistant. And <strong>Claude Design</strong> demonstrated autonomous production-quality website generation, with an 18-minute tutorial by Viktor Oddy showing the capability is real, not vaporware.</p><p>The sell-side is noticing: <strong>BNP Paribas research</strong> described Canva's AI-powered design service as <em>"beginning to rival Adobe's comprehensiveness."</em> When sell-side analysts tell institutional clients that a private company matches the incumbent's product breadth, that's a procurement signal, not just a competitive note.</p><hr><h3>Canva's Data Moat Is Structural</h3><p>The most investable detail from Canva's launch: its proprietary <strong>Design Model</strong> is trained not on final designs but on <strong>the actual sequence of edits</strong> — millions of design workflows capturing how humans iterate, refine, and decide. This edit-sequence data is structurally impossible to replicate without 265M+ monthly users generating it. Canva also uses a technique called <strong>"perturbation"</strong> — deliberately breaking designs to teach the model error recognition, enabling what they call "agentic editing."</p><p>CPO Cameron Adams confirmed that users <strong>don't care which model powers the tool</strong> — they want collaborative AI with control, not full automation. The copilot pattern wins; the autopilot pattern loses. This user behavior data should inform how you evaluate every AI application company's UX thesis.</p><blockquote>The creative tools market just split into three layers: AI assistants handle ideation, a visual execution layer handles finishing and brand consistency, and professional tools handle precision. Adobe holds the third layer — the smallest and shrinking share of a much larger category.</blockquote><h3>The Three-Layer Architecture</h3><table><thead><tr><th>Layer</th><th>Function</th><th>Key Player</th><th>Moat</th></tr></thead><tbody><tr><td><strong>Ideation</strong></td><td>Brainstorming, initial generation</td><td>ChatGPT, Claude, Gemini</td><td>Commoditizing</td></tr><tr><td><strong>Visual Execution</strong></td><td>Finishing, brand consistency, publish-ready</td><td>Canva (265M MAU, edit-sequence data)</td><td>Winner-take-most platform</td></tr><tr><td><strong>Professional Precision</strong></td><td>Pixel-perfect, complex creative</td><td>Adobe, Figma</td><td>Switching costs — but shrinking TAM share</td></tr></tbody></table><p>Mike Krieger departing Figma's board after just 9 months to refocus on Anthropic is a <strong>revealed preference</strong> about where product value creation is migrating. The talent gravity has shifted.</p><h3>Adobe's Compounding Problem</h3><p>Adobe faces encirclement: Canva expanding up from prosumer, Claude Design pushing down from the AI layer, and <strong>no CEO</strong> to navigate. The summit (April 20-22) is the next catalyst — if AI announcements are incremental rather than transformative, expect another 10-15% drawdown. The barbell trade — short Adobe, long Canva pre-IPO — may be the highest-conviction pair in enterprise software right now.</p>

   Action items

   • Model Adobe's downside scenario incorporating CEO vacuum + simultaneous Canva/Anthropic competitive launches before the summit concludes April 22
   • Begin sourcing Canva secondary market blocks or fund vehicles with Canva exposure by end of Q2
   • Kill or downgrade every AI design wrapper startup in your pipeline that lacks proprietary edit-sequence data
   • Map the picks-and-shovels layer beneath the visual execution tier: brand asset management APIs, rendering engines, template marketplaces, design-system compliance tools

   Sources:Adobe's 30% drawdown + Cursor's $50B valuation = the AI creative destruction trade is repricing now · Canva's 265M-user platform play to own AI's 'visual layer' · Four short reports dropped in one week · Open-source AI running locally now beats frontier APIs

2. 02

   The API Margin Era Ends: Where Value Accrues When Models Are Free and Platforms Eat the App Layer

   <h3>Three Vectors of Compression</h3><p>The AI application layer is being squeezed from three directions at once, and the timing is not coincidental — it reflects a structural phase change in where AI value accrues.</p><ul><li><strong>From below (open-source):</strong> Alibaba's free <strong>Qwen3.6-35B-A3B</strong> outperformed Claude Opus 4.7 on spatial reasoning benchmarks while running as a <strong>21GB quantized model on a MacBook Pro M5</strong>. A model you can run locally for free is beating a $25/million-token API on specific tasks.</li><li><strong>From within (hidden costs):</strong> Anthropic's new tokenizer may increase effective API costs by <strong>up to 35%</strong> depending on content mix. This won't show in published pricing — it's a silent COGS increase most portfolio companies won't catch until their next billing cycle.</li><li><strong>From above (platform expansion):</strong> Claude Design, HeyGen's open-source HyperFrames, and Canva AI 2.0 all eat into the application layer that startups built on top of foundation models.</li></ul><hr><h3>Meta's $2B Manus Deal: The Definitive Comp</h3><p>Meta paid <strong>~$2B for Manus</strong> specifically for the agent harness technology — memory management, agent-to-agent protocols, skill orchestration, and compression infrastructure — <strong>not the underlying model</strong>. This is the clearest M&A price signal the market has produced for where AI value is migrating.</p><p>The harness architecture Meta acquired includes: <strong>Memory</strong> (working context, semantic knowledge, episodic experience), <strong>Skills</strong> (operational procedures, decision heuristics), and <strong>Protocols</strong> (agent-to-user, agent-to-agent, agent-to-tools). Between these sit sandboxing, observability, compression, and evaluation. Long-running agents <em>routinely exceed token budgets</em>, making compression a core unsolved infrastructure challenge.</p><blockquote>Meta didn't pay $2B for a model — it paid for the harness around it. That single data point should reorder your entire AI infrastructure pipeline from model-first to orchestration-first.</blockquote><h3>The New Value Stack</h3><table><thead><tr><th>Layer</th><th>Moat Trajectory</th><th>Investment Posture</th></tr></thead><tbody><tr><td><strong>Agent Orchestration/Harness</strong></td><td>Consolidating — $2B Manus comp</td><td>Reprice upward; category validated</td></tr><tr><td><strong>Agent Eval/Observability</strong></td><td>Emerging — 2-3x quality uplift from eval alone</td><td>Screen aggressively; pre-consensus</td></tr><tr><td><strong>On-Device Runtime</strong></td><td>Proven — 470MB Qwen3-0.6B at 25 tok/s on iPhone</td><td>New category thesis forming</td></tr><tr><td><strong>Proprietary Data Moats</strong></td><td>Durable — Anthropic can't replicate your data</td><td>The surviving AI app companies</td></tr><tr><td><strong>Fine-Tuning-as-a-Service</strong></td><td>Commoditizing — ART + GRPO + RULER open-source</td><td>Downgrade; moat window closing</td></tr><tr><td><strong>API Wrappers</strong></td><td>Dead — zero competitive edge consensus</td><td>Exit or write down</td></tr></tbody></table><h3>The SaaS Existential Filter</h3><p>Daniel Miessler's "fire of fires" framing is gaining traction among 1,500+ security practitioners who make enterprise buying decisions: if a SaaS product's core function can be replicated by an LLM plus a thin integration layer, it's on borrowed time. The filter is binary: <strong>does the company have proprietary data, network effects, or regulatory compliance requirements?</strong> Feature-layer tools (scheduling, forms, basic analytics) face critical substitution risk. Infrastructure platforms with scale economics and network effects — he specifically names <strong>Cloudflare</strong> — are consolidation beneficiaries.</p><p>The 950K+ AI practitioners absorbing the message that "using GPT or Claude out-of-the-box gives you zero competitive edge" accelerates this repricing as a self-fulfilling prophecy. <strong>Distribution, not model quality, is the emerging moat thesis</strong> — and it demands re-underwriting every AI deal in your pipeline.</p>

   Action items

   • Audit every portfolio company using Anthropic APIs for the new tokenizer cost impact — quantify the effective COGS increase and impact on unit economics before next billing cycle
   • Re-score agent orchestration and eval startups in pipeline upward using Meta/Manus $2B comp by end of May
   • Apply the SaaS substitution filter to every portfolio holding: can the core function be replicated by LLM + thin integration?
   • Build thesis deck on on-device AI as investable category — map the stack (UnslothAI → TorchAO → ExecuTorch) and identify product companies building on local inference

   Sources:Open-source AI running locally now beats frontier APIs · Agent harness > model weights: Meta's $2B Manus deal · AI is repricing SaaS at zero · Cursor at $50B, Cerebras IPO, and $12B in fresh AI infra commitments

3. 03

   Shadow AI Security: The Biggest Greenfield Category Since Cloud Security — and the 18-Month Window Is Open

   <h3>Every CISO Sounds Defeated</h3><p>Q1 2026 CISO conversations across RSA offsites, Slack channels, and practitioner networks reveal a universal pattern: every conversation ends on shadow AI, and every CISO sounds <em>"a little defeated about it."</em> Security controls for AI tiers are described as <strong>"wildly underfunded"</strong> — browser-layer DLP, agent inventory, ACL cleanup, and prompt injection testing don't make it into AI rollout budgets. The recommended fix: <strong>AI security needs its own budget line item with its own headcount.</strong></p><p>That's not an operational recommendation — it's a <strong>TAM-creation event</strong>. When CISOs carve out dedicated budgets for a new category, it signals the same market-formation dynamics that created the cloud security category circa 2015. The parallels are precise: new technology adoption outpacing security tooling by years, CISOs acknowledging they're behind, and budgets being created from scratch.</p><hr><h3>Four Distinct Investable Vectors</h3><table><thead><tr><th>Vector</th><th>What's Happening</th><th>Current Tooling</th><th>Investment Stage</th></tr></thead><tbody><tr><td><strong>Consumer AI data exfiltration</strong></td><td>Sales uploading customer lists to Chrome extensions; legal summarizing contracts in free GPT wrappers</td><td>Browser-layer DLP only — endpoint DLP can't see ChatGPT paste</td><td>Seed → Series B</td></tr><tr><td><strong>Enterprise AI over-sharing</strong></td><td>Copilot/Gemini inherit stale ACLs; interns seeing board decks via SharePoint</td><td>Manual, project-based ACL cleanup</td><td>Seed → Series A</td></tr><tr><td><strong>Agent sprawl</strong></td><td>Claude Code, Cursor agents, custom GPTs running with real credentials against production</td><td><strong>No mature tooling</strong> — no inventory, no scoped permissions</td><td>Seed → Series A</td></tr><tr><td><strong>Prompt injection</strong></td><td>Any AI feature reading email/tickets/PDFs reads attacker-controlled content — "the new SSRF"</td><td>Ad-hoc red-teaming only</td><td>Seed → Series A</td></tr></tbody></table><p>Critically, <strong>blanket blocking drives usage underground</strong> — onto phones, personal devices, mobile hotspots. Organizations treating Copilot rollout like previous SaaS rollouts without adversarial testing are creating breach conditions. Most organizations find <strong>significantly more AI surface area</strong> than the CISO expected on first scan.</p><hr><h3>The Adjacent Structural Shift: VPN Appliances Are Being Eliminated</h3><p>Five major vendors — <strong>Ivanti, Fortinet, Palo Alto, Cisco, F5</strong> — have all shipped critical auth-bypass or RCE chains in their edge appliances in the last 24 months. The vulnerability class is <strong>architectural, not incidental</strong> — management interfaces built on CGI scripts and PHP with bugs baked into the codebase. The CISO recommendation has shifted from "patch faster" to <strong>"eliminate the appliance."</strong> That's a leading indicator of revenue decline at these vendors and structural tailwind for ZTNA providers (Zscaler, Cloudflare, Netskope).</p><blockquote>Shadow AI security is the biggest greenfield category in cybersecurity since cloud security — CISOs are creating dedicated budgets, no vendor owns it, and the 12-18 month window to back category leaders is open now.</blockquote><h3>Portfolio Defense Implications</h3><p>This isn't just deal flow intelligence — it's direct portfolio risk. If your portfolio companies are rolling out Microsoft Copilot without ACL cleanup, they're creating <em>"a self-inflicted breach."</em> If developers use AI coding assistants without private package namespace controls, they're exposed to automated supply chain compromise — AI coding assistants hallucinating package names that attackers actively squat on. A breach at a portfolio company from any of these vectors is both a reputational and valuation event. The <strong>Johns Hopkins ManyIH research</strong> showing frontier models fail at multi-tier privilege resolution adds an unresolved technical layer to this risk.</p>

   Action items

   • Map the shadow AI security landscape across all four vectors and identify 3-5 investment targets in each by end of Q2
   • Conduct a shadow AI security audit across portfolio companies — specifically Copilot/Gemini ACL exposure, agent credential scoping, and browser-layer AI data exfiltration
   • Model VPN appliance revenue segments at Fortinet and Palo Alto as structurally declining for public market positioning
   • Source 2-3 AI supply chain security deals at seed stage — specifically install-time package verification and namespace monitoring

   Sources:Four greenfield security categories just opened · Claude Mythos just triggered Fed emergency meetings · Open-source AI running locally now beats frontier APIs