On October 7, a developer named Brandon Thomas posted seven open-source apps on GitHub: clean-room, from-scratch reimplementations of Photoshop, Illustrator, Premiere, Lightroom, Acrobat, After Effects, and InDesign — built in Rust, by pointing Claude Opus 5.5 at the problem of recreating Adobe's entire creative suite from public specs and observed behavior alone. PhotoCraft, the Photoshop clone, already opens, edits, and saves real layered PSD files, and has picked up 40,000+ GitHub stars in under two weeks. It's also strikingly small — about 80MB and no Electron, next to a Photoshop install that runs 6+GB on the same kind of machine — because a from-scratch rewrite doesn't have to carry thirty years of accumulated dependencies and backward-compatibility shims; it only has to be as complex as the feature it's reimplementing today. It's rough — Thomas calls it "not anywhere close to ready" — but he's publicly targeting feature parity within months, not years. "Software is over," he wrote on Hacker News. "I one-shotted Photoshop. The whole thing."
That's not a thought experiment. "AI clean-room rebuilds Adobe's software" is usually the hypothetical you reach for to make a point about where this is all headed. It happened the same week I started writing this.
It's not isolated to creative software, either. A few weeks earlier, a small team pointed a swarm of AI agents at a decade-old first-person shooter with no source code and told them to decompile the whole thing to readable C++. After the first month, the game launched, the menu rendered, maps loaded — about 80% decompiled, and it looked like a win. It wasn't: the code was semantically wrong, full of invented logic and unasked-for architectural rewrites, because nobody had actually defined what "correct" meant, so there was nothing for the agents to fail against. The fix wasn't more agents, it was an automated oracle that compiled each reconstructed function and byte-compared it against the original binary, pass or fail, no judgment call. Two more months of that discipline got the project to 99% of the game's functions present and 83% byte-exact, with the game now running, in the author's own words, "flawlessly." AI made reproduction cheap almost immediately. Making it correct still took three months and a verification system nobody had built yet. An open-source toolkit called Universal Modder shipped around the same time, teaching Claude Code or Codex to recon a game engine, reverse-engineer it with Ghidra and ILSpy, and ship a working mod. A separate project, SHAR, is doing the asset-extraction version of the same thing: decoding a user's own lawfully-owned copy of a different licensed game, converting its proprietary file formats, and rebuilding it natively in Unreal Engine 5 — not clean-room, since it works directly from the original game's files, but not piracy either, since nothing gets redistributed and the runtime itself is independently written.
These are two different techniques, not one. PhotoCraft never touches Adobe's code — it's built entirely from public specs and observed behavior, which is what makes "clean room" a specific legal term rather than marketing language. The FPS project did the opposite: it decompiled the actual proprietary binary directly, reconstructing the real internal logic byte for byte. Different technique, different legal footing. But functionally they're converging on the same result: an agent can now rebuild a complex piece of software from either direction — spec-first, without ever seeing the original, or binary-first, by reverse-engineering it directly — without the original company's cooperation or its source code. The question I can't stop turning over — not hypothetically, I sit inside a company that has to answer this for real — is: once the cost of reproducing something stops being a barrier, whichever direction you come at it from, what's actually left standing? And for how long?
Adobe isn't about to disappear, and neither is a decade-old shooter's publisher. PhotoCraft can't yet talk a single enterprise design team into migrating off Creative Cloud. What actually collapsed isn't Adobe's business — it's one of the costs that used to protect it. That's the more unsettling version of this story: a company can look commercially secure for years after the thing that used to defend it has already stopped working, because technical replicability and economic defensibility aren't the same clock. One can fail quietly while the other hasn't caught up yet.
#This Isn't Theoretical Anymore
The clearest signal isn't the decompilation stunts. It's what public companies are doing with their balance sheets.
HubSpot cut 660 jobs, about 7% of staff, on October 6, explicitly reorganizing around "delivering outcomes for customers with AI" instead of selling software seats — the thing investors have started calling the "SaaSpocalypse." The same week, FICO cut 15% of its positions, citing "integrating AI-driven product development" directly in its SEC filing. Monday.com cut 20% of its workforce in July to fund a pivot to agent-based workflows — and in the same filing, analysts cited a Gartner estimate that "agentic arbitrage" could put $234 billion in SaaS spending at risk by 2030 — that's spend Gartner sees as exposed to disruption, not a forecast of revenue actually lost, but exposure at that scale is still the thing a board plans around — because agents complete cross-system tasks directly instead of routing through individually licensed, seat-priced tools.
Whether each company's PR framing ("not cost-cutting," "not AI efficiencies") is honest is a different question, and a messier one — Challenger, Gray & Christmas has AI cited in about 21% of all announced U.S. job cuts year-to-date, and plenty of that is almost certainly layoffs-with-better-branding. But you don't need the motive to be pure for the underlying fact to be real: software that was priced on "this was hard and expensive to build" is getting repriced, in public, by the companies that sell it. None of this is proof that Adobe's moat, or HubSpot's, has already collapsed — a company can reorganize around anticipated disruption years before its margins show any damage, and "preparing for erosion" is a different claim from "erosion has already happened." What these moves actually show is that the people closest to the problem are betting real money that the old economics won't hold, well before the numbers force their hand.
#Which Moats Actually Erode
It's easy for me to fall into the trap of concluding nothing is defensible — that eventually it's just a handful of AI labs and whoever owns the data centers. I don't think that's right. But I also don't think the comfortable answer — "code was never the real moat, trust and distribution are" — survives contact with what's actually happening either. I said something close to that version a few months ago and I think I was too confident about it.
Moats aren't a binary. They're a decay rate. The real question for any given one is: does this buy two years, or twenty?
But decay rate is only half the equation, and it's the half that's easy to fixate on because it's the legible, scary one — SaaSpocalypse headlines, layoff counts, GitHub stars on a Photoshop clone. The harder, more useful question is construction rate: how fast can you actually stand up the next moat before the current one finishes eroding? That's not a universal constant, and it isn't mostly a technology question. It depends on whether you already have distribution to sell the next thing before you've finished building it, whether your organization can survive a structural pivot without losing the people who'd have to execute it, and whether the next moat is close enough to what you already do that you're not starting from zero. Decay rate tells you how much time you have. Construction rate tells you whether that's enough.
Fast decay — happening now. Anything priced on "we're the only ones who could afford to build this" is in trouble. Code complexity, UI sophistication, "it took 500 engineers a decade" — the labor-cost floor under that kind of moat just fell out. That's reproduction cost, not operating cost: PhotoCraft existing doesn't mean anyone's patching a zero-day at 2am or carrying a SOC 2 report a procurement team will actually accept, and that gap is real. But the specific thing that used to make software expensive to build in the first place is no longer the barrier it was, and that's the part that's decaying fast.
The same math is unwinding a decade-old compromise in mobile. Cross-platform frameworks like React Native existed because building the same app twice, once in Swift and once in Kotlin, cost too much to justify, so you accepted a slightly worse app on both platforms in exchange for one codebase. In September, Shopify, which bet its mobile org on React Native in 2020, announced it was going back to native, saying coding models had gotten good enough that building in Swift and Kotlin "no longer carries the cost it used to." One company isn't a trend, and a fintech app called Zar went the opposite direction the same year, porting from Flutter to React Native in two weeks with Claude Code. That's the point, though: once a rewrite is cheap, a compromise priced on "we can't afford to do this twice" stops being the default and becomes a choice you can make in either direction.
Medium decay — and this is the one I underrated. Trust and distribution hold up fine against a competitor. They don't hold up against disintermediation, and the distinction matters because a brand can keep every bit of a customer's loyalty and still lose its place in the transaction — those are two different economic assets, and most "trust survives" arguments quietly conflate them. Agentic commerce is where you can watch that exact mechanism play out in real time. OpenAI's original "Instant Checkout" let ChatGPT complete a purchase entirely inside the chat — no visit to the merchant's site, no click, no referrer — which is the version that actually breaks brand and affiliate attribution at the root. Tellingly, OpenAI itself walked it back starting in March 2026 — in its own words, the initial version "did not offer the level of flexibility that we aspire to provide" — shifting the default to discovery-and-redirect, where the shopper lands on the merchant's own site and tracking mostly survives. In-chat checkout hasn't vanished entirely; it still exists for a handful of approved partners and marketplaces. But the default path reversed from where it started. Amazon, meanwhile, has sued Perplexity over its Comet agent shopping on users' behalf without disclosing it was doing so. The mechanism that would kill this moat is real, understood, and already built. It's just that the platforms standing to get disintermediated are actively fighting it, which is exactly what medium decay looks like in practice — not a cliff, a fight you can watch playing out quarter by quarter. That's also the consumer version, where it moves fastest: a shopper switching which agent picks their sneakers costs nothing. The B2B version, where HubSpot and Monday.com actually live, is slower and stickier, because compliance, data residency, and switching cost are their own kind of moat — which is exactly why a public B2B company's answer to this pressure, below, isn't "ship a better feature," it's "make sure nobody can migrate away unsupervised."
Slow decay — and "capital" isn't one category. Legal and regulatory walls (licensing, anything enforced by a court rather than a competitor) decay on a political clock, not a technical one — though I'd soften "untouched by AI" to "touched indirectly": if AI collapses the cost of compliance paperwork and audit prep, it can erode the advantage of "only a well-funded incumbent could afford to stay licensed" even while the regulation itself never changes. Data that's a continuous flow off live activity, rather than a static dataset, regenerates itself daily, which is structurally different from "we have a big database" that AI can eventually approximate.
Capital-intensive infrastructure gets lumped in with these as "the safe one," and that's exactly where it needs sorting, because capital isn't a single mechanism. Installed hardware decays fast in moat terms: the cost per unit of compute capability has been in freefall, not holding steady. One recent analysis of 3,200+ models put the median price for a given level of LLM performance at roughly $30 per million tokens in early 2023 and under $0.50 by early 2026 — a 60x drop in three years, with economy-tier models on a price half-life of about 13 months, faster than Moore's Law. The data center you built this year is a sunk cost against what next year's architecture does with a fraction of the silicon. But control over the physically scarce inputs underneath that hardware — grid power, land in power-constrained regions, water for cooling, rights of way for interconnects — doesn't decay the same way, and AI demand for exactly those inputs is climbing, not falling. Capital moats decay slower than code moats on average, but "capital" is hiding at least two mechanisms moving in opposite directions, and the durable one was never about the chips.
There's a real counterargument here: what if cheaper reproduction doesn't erode certain moats but strengthens them? If building a functional Photoshop clone gets cheap enough that ten thousand of them exist, the hard problem stops being "can anyone build this" and becomes "which one do I trust with my files" — a search-and-certification problem that distribution and brand are specifically built to solve. Flooding a market with commodity options doesn't eliminate the need for a trusted filter; it usually increases it. Commoditizing the fast-decay layer doesn't destroy the medium- and slow-decay layers, it changes what job they're doing. Trust used to be a moat against a handful of credible competitors; in a flooded market, it becomes a moat against noise. Same asset, different job, arguably a more valuable one — and that's really just the construction-rate argument from a different angle. Commoditization at one layer is exactly what creates the opening to build the next moat on top of it.
#Watch What They Say the Moat Is Now
The clearest evidence for "sequence of moats, not one permanent moat" isn't analysis, it's company language. HubSpot's own September 17 Analyst Day transcript has the executive team saying, almost in passing: "Our partner ecosystem is our forward deployed moat... delivering outcomes with AI is not turnkey... our partners are a major advantage for HubSpot." Elsewhere in the same transcript: "They act as HubSpot's forward deployed team."
That's Palantir's forward-deployed-engineer playbook, named outright, grafted onto a company that used to sell marketing software by the seat. The tell isn't the strategy, it's the word "moat" showing up unprompted in an investor presentation about a CRM. That's not a company describing a feature. That's a company telling its own shareholders where it thinks defensibility actually lives now that the AI agents themselves are converging to parity across every competitor in the category. Whether embedding partners in a customer's workflow actually holds up as a moat is a separate, open question. That a public software company is reaching for "put humans in the loop, close to the customer" instead of "ship a better feature" is itself the data point — it's moat #2 going up in public, before moat #1 has finished eroding.
#The Self-Serving Version of This Essay
I should flag the obvious problem with my own argument: "the moat is judgment and architecture, not code" is exactly the thing a chief architect would want to be true. I'd love for the conclusion to be "people who decide what to build are fine, people who implement it are the ones repriced."
That's too convenient to trust at face value. The honest version has two complications. First, judgment isn't automatically scarce just because it's judgment — if a swarm of agents can take a shipped FPS from "looks done but is semantically broken" to 83% byte-exact and running flawlessly once someone builds the right verification harness, "I have good product taste" is not an unassailable position either, it's just a slower-decaying one. I've made this same argument about individual careers before — the barbell forming in software engineering, where a lot of senior compensation was paying for scarcity, not just difficulty, and that scarcity is what's eroding. Same half-life logic, just applied to a person instead of a company, and it's a lot less comfortable to sit with when the moat in question is your own. Second, the layoffs above aren't hitting judgment-poor roles specifically — HubSpot and Monday.com cut deep into customer success and sales, the human layer that used to compensate for product friction, which is a different kind of work than "writes code to spec." The thing getting repriced isn't "execution" neatly separated from "judgment." It's any function whose value depended on being expensive to replicate, and that cuts across org charts in ways that don't flatter any one seat, including mine.
#What I Actually Think Happens
Not the handful-of-AI-labs version, and not the comforting "architects and taste survive" version either. The pattern that's already visible: fewer companies whose entire value proposition was "we built something hard," and a lot more companies — smaller, thinner — that assemble now-commodity AI capability into something a buyer trusts enough to pay for. This has happened before. Open source commoditized databases, compilers, and web servers over two decades, and Oracle and Microsoft didn't evaporate — value moved up the stack into integration, support, and distribution, and the floor dropping out of what it cost to start a company meant a lot more companies got started, not fewer.
That's the optimistic read, and it has a real counter-force working against it: none of this works without the handful of labs that actually own the compute and the frontier models every clean-room clone and forward-deployed strategy is quietly built on top of. If the application layer keeps commoditizing while the foundation layer stays concentrated in three or four companies, "more companies, each thinner" could just as easily resolve into "more companies, each renting their entire value proposition from someone else's model" — which is a far less stable position than it sounds like at first, and the one place I'd actually point the doom instinct from the start of this piece.
The practical lesson isn't "find the permanent moat," because there isn't one anymore — there's a sequence of temporary ones, and the job is spending moat #1 fast enough to build moat #2 before #1 finishes decaying. Amazon did this three times (books → logistics → AWS). Google did it twice (search → ads → cloud). The company that dies isn't the one whose moat eroded. It's the one that believed its current moat was the last one it would ever need.