Nobody Cares About the Model Now. It's About the Type of Moat
Open models now rival the frontier at a fraction of the price. Founders care about moats. But what kind of moats?
The Moat Is Everywhere Except the Model
For two years, the cruelest word in AI was “wrapper”: a thin coat of taste over somebody else’s model. The day a big lab noticed you, you were done. Serious founders walked away from good ideas over it.
They were wrong, and 2026 made that impossible to deny. Open weights caught up, prices cratered, and governments started switching models off at will. The model, the one thing everyone feared, turned out to be the least defensible part of the business.
What protects a company now lives everywhere except the model: the workflow it owns, and the context it compounds. The sharpest proof of that is a product you can open right now.
together with Granola:
I run every meeting through Granola, and it is this argument in one product.
The model it runs on is rented. The moat is everything around it:
▫️ An AI notepad that stays invisible in your meetings, with zero bots in the call, turning rough notes into polished summaries
▫️ A Brief before every external meeting, so you walk in grounded
▫️ Context that compounds and stays yours, linked to Claude, Attio, and Slack
code THEAICORNER for 1 month off
Granola is one moat made visible. Here are the 5 that actually hold, the ones that are mostly theater, and the uncomfortable part.
Table of Contents
Why the frontier stopped being the prize
The morning the model went dark
What a moat looks like when the model is rented
The five moats that actually hold
The moats that are mostly theater
The uncomfortable part
1. Why the frontier stopped being the prize
Here’s the most valuable lesson: Value flows toward whatever is scarce.
For a short window, the scarce thing in AI was, in fact, the model, because only a handful of labs could build one worth paying for. Well, not anymore.
Two pressures pulled it shut at the same time. And if you look at them side by side, the old story about model dominance falls apart.
Open weights erased the quality gap
Open models stopped being the budget option. They became the default.
By the middle of this year, families like GLM, Qwen, and MiniMax had pulled close enough to the closed frontier that, for most production work, the choice of model no longer decides the result.
The numbers carry the argument on their own. MiniMax’s M3 reached roughly 59% on SWE-Bench Pro, competitive with closed systems on real coding work, at a sliver of the cost and under a license you can run on your own hardware.
The closed labs still win the hardest reasoning problems, and that lead is real. But winning the top 10% of problems is a thin reed to build a company on when an open model handles the other ninety at a tenth of the price.
Buyers revolted against the bill
The second pressure came from finance, not engineering.
Routing every task through the most powerful model survived exactly as long as the invoices stayed hidden. Once the labs moved to token billing, the invoices stopped being hidden.
The correction was fast and public. Uber burned through its entire annual AI budget in roughly four months, then capped what any engineer could spend. Walmart, Cisco, Amazon, and Meta pulled in the reins the same quarter.
And thus, a new rule has been created:
Send each task to the cheapest model that clears the bar, and save the expensive ones for work that truly needs them.
Teams that route this way report cutting their bills sharply, with nobody noticing a drop in quality. Paying frontier rates for routine work now reads as carelessness rather than caution.
2. The morning the model went dark
A model reached through somebody else’s API is not infrastructure you own. It is access you are granted.
And anything you are granted can be taken back. Most of the industry treated that as a footnote until the morning it was not.
A dependency with an external switch
Owned dependencies fail in ways you can plan for. Granted ones fail in ways you cannot.
The difference stayed abstract right up until June 12, when the United States ordered Anthropic to cut off foreign access to its two strongest models. The company pulled both offline worldwide to comply.
The reaction across Europe said more than the order itself. Leaders who agree on almost nothing reached for the same image. That a country dependent on foreign technology can be unplugged without warning.
You can read the politics however you like, but the procurement lesson is hard to argue with.
A capability that can vanish on a Friday cannot sit on your critical path without a backup. Choosing that backup is a business decision long before it is a technical one.
Even the labs are tapping the brakes
The pressure runs uphill too, all the way to the companies building the frontier.
The thesis that whoever pours the most concrete wins is being quietly retired by the people who poured the most concrete.
Late last year, OpenAI was citing around $1.4 trillion in infrastructure commitments. By February, it was telling investors the real target sat closer to $600 billion, and it had started renting capacity from the same clouds it once planned to outbuild.
When the largest spender in the field halves its own ambition under the cold eye of the public markets, the belief that raw scale is a permanent advantage looks a good deal weaker than it did a year ago.
3. What a moat looks like when the model is rented
If the model is rented and replaceable, defensibility has to come from somewhere the rental cannot reach.
That somewhere is the work wrapped around the model: the orchestration, the memory, the accumulated context that turn a raw engine into something a business depends on.
The model answers the question. Everything that decides which question to ask, with what context, and what to do with the answer, is yours to own.
Three questions that separate moats from stories
Most things founders call a moat are not one.
A useful filter is to put any claimed advantage through three questions, and to distrust anything that fails even one.
1. Would it survive a model swap?
Replace the engine underneath with a competitor’s tomorrow, and a real moat holds while a fake one evaporates.
2. Does it compound, or merely accumulate?
A bigger pile of data or users is not automatically a stronger position. The test is whether scale makes the product itself better in a loop that feeds on itself.
3. Could a stranger rebuild it over a weekend?
Building software is nearly free now. If the hard part of the business is code, someone with a coding agent will copy it before the next board meeting.
What survives is whatever took years to gather and cannot be conjured on demand.
4. The five moats that actually hold
Run real companies through that filter, and a short list of durable positions appears.
They group into five families, sorted by the kind of scarcity each one captures.
Position and the things that compound
The first families are about where you sit and what gathers underneath you over time.
Distribution is the moat of already being inside the surface a customer lives in. When one tech giant moved engineers off a rival coding tool this year, the default destination was GitHub Copilot, not because the model underneath was better, but because it already lived in the editor and the billing those teams used.
Ecosystems work the same way at platform scale. Once tens of thousands of companies build on the OpenAI API, the moat is no longer the model. It is everyone else’s switching cost.
1. Accumulation Moat
Accumulation moats grow stronger the longer a single customer stays. Here are two excellent examples.
Granola, the note-taker that remembers every meeting, does not compete on model quality. It competes on the fact that leaving means walking away from your own memory.
Cursor turns ordinary use into private training signal. Every keystroke, and every accepted or rejected suggestion, is data no rival ever sees.
Both clear the swap test easily. The memory and the signal belong to the product, never to the model running behind it.
2. Depth Moat
The next families are about how deep you go and why a buyer believes you.
Depth is the difference between answering a support ticket and owning the entire resolution. It’s the triage, the policy, the action, the handoff to a human.
Sierra builds for that whole flow rather than a slice of it, which is why replacing it would mean rebuilding an operation, not switching a vendor.
Vertical depth is the same instinct aimed at one industry.
Harvey beats a general model on legal work because it has absorbed a domain a generalist never sees, and going deep in one field tends to manufacture the other moats, data and trust and switching cost, as a side effect.
3. Trust Moat
Trust is the scarce currency in a market drowning in identical pitches.
Glean wins inside large regulated companies on permissions, audit logs, and the unglamorous controls that let a tool survive a security review at all. None of that can be faked or rushed.
Hugging Face holds a different kind of trust, the sort owned by a community rather than a company. The reason developers reach for one place by reflex took years to earn and cannot be bought with a funding round.
The last family is pure engineering, and it earns its place precisely because the labs do not supply it.
4. Orchestration Moat
Orchestration is the work of turning a model into a system that finishes a long task without a human watching every step. Things like planning, calling tools, recovering from its own mistakes.
Cognition, maker of the Devin agent, competes here on reliability rather than on the model, to the point of guaranteeing the engineering value a customer can hold it to.
5. Cost Routing Moat
Cost routing belongs in the harness as well.
OpenRouter sends each task to the cheapest capable model and updates that judgment as the frontier moves. It is a business that earns its keep precisely because models have become interchangeable.
5. The moats that are mostly theater
Now the reality is that plenty of what gets called a moat is just wishful thinking wearing a strategy deck.
The favorite offender is the phrase “we have data.” While more data may sound like more defensibility, often it is the reverse.
The trap is that data tends to behave backwards. The first records you gather are cheap and cover the common cases.
The ones after grow more expensive to find and add less, because the easy ground is already taken and the long tail is rare by definition. In many domains the value flattens into a ceiling, and past it more data buys almost nothing while competitors race to the same line.
Data also rots. Patterns change, and a corpus you do not constantly refresh quietly turns into a liability.
So a pile of data is not a moat. It is raw material that becomes one only when more of it visibly improves the product in a way customers can feel.
The same caution applies to a freshly tuned model, which a single foundation release can flatten overnight, and to brand, which takes years to build and dies in one broken promise.
Calling something a moat has never once made it hold.
6. The uncomfortable part
The frontier model was never going to stay the prize, for the same reason raw electricity is not a business.
The instant a thing becomes abundant and standardized, the value walks straight to whoever does something distinctive with it. That walk is happening now, compressed into months instead of decades, and a single Friday shutdown made it real for everyone at once.
The labs will be fine. Better than fine.
But the years when the only question worth asking was which model is best are over. The question that takes its place is older, and far less comfortable. What do you have that does not disappear when the thing at the center gets cheap?
A company that can answer that is about to have a very good decade.
A company still polishing a layer over someone else’s revocable API is one directive away from learning it never owned a moat at all. Only a puddle, and a field that anyone can walk across.
Great piece - this is the framing I've been building against for the last 6 months.
One thing I'd add, because it changes the ending: nearly every example here (Granola, Cursor, Sierra) wraps a rented model and builds the moat around it -- memory, context, workflow. I've took it a step further and moved the model out of the critical path. Apps are produced by a deterministic compiler from a signed contract; the LLM only makes bounded decisions at the edges.
That does two useful things to your three-question test. It passes "would it survive a model swap?" structurally rather than as a promise -- we've run the whole pipeline (normally Opus 4.8 + Sonnet 5) end-to-end on NVIDIA Nemotron 3 Ultra. And it turns "we have data" from theater into a real flywheel: because every build is compiled and validated, every build is execution-verified training data -- the compounding kind, not a rotting pile -- and we can start moving away from proprietary frontier models.
When the model gets cheap and revocable, owning the compiler and an ownable model -- air-gapped where the customer needs it -- stops being a wrapper problem and becomes the moat.
Honestly not sure Granola passes your own second test. Two-year-old meeting notes look a lot like data that accumulates without compounding, and your rot point would seem to apply to them too. Maybe the real lock is that leaving feels like walking away from your own memory, like you say, but that's a switching cost living in the user's head, not sure it's a loop.