The Year Everything Gets Expensive and Insecure at Once

---

Microsoft just dropped an emergency patch for a macOS and Linux ASP.NET vulnerability. Not the headline most people noticed this week. But it’s the one that should’ve been.

Here’s the thing about emergency patches in 2025: they’re becoming the baseline. Not the exception. We’re not in crisis mode anymore because the baseline is crisis.

Photo by Leeloo The First / Pexels

The Security Debt Comes Due

The ASP.NET patch matters because it signals something I’ve been watching since I left Stripe’s infrastructure team: the tech industry built its current AI boom on foundations that were already creaking. We’re now bolting $25 billion capital expenditure plans onto systems that need emergency updates every quarter.

Microsoft’s patch isn’t some novel zero-day. It’s the sound of an aging platform struggling under load. And it’s happening while the company’s simultaneously pushing Copilot, Workspace Intelligence, and whatever other AI layer they can bolt onto existing infrastructure.

I don’t think this is coincidence.

Meanwhile, a US-sanctioned currency exchange disclosed a $15 million heist attributed to “unfriendly states.” Translation: nation-states are actively stealing from regulated financial infrastructure. This used to be theoretical. It’s now a quarterly reporting line item.

The post-quantum encryption conversation is doing something weird right now. There’s this superstition floating around that AES-128 won’t hold up once quantum computers get serious. A recent take pushed back hard: AES-128 is actually fine. The math checks out. But here’s my honest read—and I mean this genuinely—I don’t fully trust the confidence level on that one yet. The problem with post-quantum cryptography isn’t the encryption itself. It’s that we don’t know when “Q-Day” actually happens. And Big Tech is demonstrably getting closer to something dangerous.

Recent advances are pushing the timeline. That’s not speculation. That’s the actual news buried in the technical blogs nobody reads.

Photo by UMA media / Pexels

The Capex Paradox Is Starting to Crack

Tesla just committed to $25 billion in capital spending—three times their historical spend. The company’s CFO admitted this means negative free cash flow for the rest of 2025.

Read that again.

A company that built its brand on efficient production and vertical integration is now saying “we need to burn cash to stay competitive in AI.” That’s not a product bet. That’s a survival bet. And they’re losing cash doing it.

The interesting part? This isn’t unique to Tesla. Every major tech company that’s serious about AI is doing some version of this. Nvidia’s data center revenue is up because everyone’s desperately trying to outrun everyone else on compute. But the economics don’t pencil out yet. You spend billions on infrastructure for AI models that make money through ads, API calls, or speculative future licensing.

Google’s pushing Workspace Intelligence into every office product—Gmail, Docs, Sheets, Meet—all AI-driven automation. But there’s no separate revenue line. It’s bundled into subscriptions that haven’t moved in price. Where’s the ROI? The company’s betting that AI integration will prevent migration to competitors, not that it’ll generate new revenue.

My prediction: by Q3 2025, we’ll see the first major tech company either cut capex guidance or quietly reduce AI product rollout timelines. The math just doesn’t work if you’re spending like it’s 2012 and actually getting returns like it’s 2025.

The Trust Fracture Gets Worse

Elon Musk just admitted that millions of Tesla owners need hardware upgrades to actually get “Full Self-Driving.” This matters because Tesla spent years—years—telling customers one software update was all that stood between them and autonomous vehicles.

This opens Tesla to class-action litigation. Obviously. But that’s not the interesting part.

The interesting part is that this admission is becoming template across AI companies. ChatGPT’s limitations are now explicit. Claude’s caveats are longer than some instruction manuals. Google’s being more cautious about what Gemini actually does. The hype cycle is hitting reality, and companies are realizing that overpromising creates legal liability, not just credibility damage.

X’s AI-powered custom feeds are replacing Communities—a feature users actually wanted—with Grok-curated timelines and additional ad slots. This is what happens when you own a platform, build AI personalization, and need to monetize it. You optimize for engagement and ad inventory, not user satisfaction. The feed works better technically. Users hate it more.

Broadcom’s having a moment right now. Thousands of organizations are migrating away from VMware, and the reason given is “negative views” of Broadcom’s ownership. Translation: Broadcom owns VMware now, and nobody trusts that the product won’t become a tax on their infrastructure. They’re right. It will.

This is a trust fracture, not a technical problem.

Photo by Monstera Production / Pexels

What’s Actually Breaking

Here’s what I think is happening: the industry simultaneously overextended on AI infrastructure and underinvested in security. We’re running on systems that need emergency patches while diverting billions into speculative compute. Meanwhile, nation-states are actively stealing from regulated financial infrastructure, and nobody’s offering a coherent security strategy because it costs money that should go toward GPUs.

Shade landing $14 million for video search is notable because it’s addressing a real problem—creative teams can’t find anything in their libraries—and it’s doing it with a filesystem architecture that actually works. It’s not AI-first. It’s usefulness-first. The market’s rewarding that. Which tells you something about what’s actually valuable right now versus what’s funded.

The post-quantum clock is ticking and the exact timeline is opaque. Governments are working on it. Tech companies are mostly treating it as someone else’s problem. By the time it becomes obvious it’s urgent, it’ll be too late for a graceful migration.

I genuinely don’t know if we’re six months or six years from Q-Day. That uncertainty is the real threat.

The capex burn is unsustainable at current revenue trajectories. Someone’s going to reset expectations soon. I’d bet it happens at an earnings call, phrased as “optimization” or “efficiency focus,” and the stock’ll drop 5-8% before climbing back when the market realizes the capex cut was obvious.

Tesla’s admission about hardware unlocks the litigation door. Others will follow—not immediately, but through discovery when investors sue over misleading guidance.

X’s algorithmic timeline is brilliant infrastructure and terrible product. You’ll see other platforms copying it because it works for engagement and advertising. You’ll also see regulators finally getting specific about algorithmic amplification.

What I’m Watching

• Tesla’s Q2 earnings for capex guidance revision. If the $25B number gets walked back or reframed before June 30, the entire AI infrastructure spending boom enters credibility trouble. That’s the inflection point.

• The first patent or published research on practical post-quantum migration costs. When enterprises understand the actual compliance and upgrade burden, CISO budgets will shift. Watch for CISOs quietly adding “quantum-safe migration” to 2026 planning docs.

• Whether any major platform actually pays out a settlement related to Full Self-Driving or AI capabilities overstatement. That opens the litigation floodgates. Once the first check clears, lawyers move faster than product teams.

• Broadcom’s VMware revenue trends in Q2 and Q3. If migration acceleration continues at reported rates, you’ll see Wall Street reassess whether the Broadcom acquisition was actually a value play or a value destruction play wearing a platform coat.