The AI "Super Bubble" Warning Is a Filter, Not a Funeral | Pentesty

Back to BlogResearchJun 27, 2026 · 8 min read<br>The AI “Super Bubble” Warning Is a Filter, Not a Funeral<br>Published by Pentesty · Market Analysis · AI Security

Two of China's most respected hedge fund managers just told their investors that the global AI rally has become a “super bubble” and that the collapse point may not be far away. One of them, Yang Dong of Wealspring, has credibility on this kind of call. He flagged the top of the market right before the 2007 crash. The other, Shanghai Banxia, went further and said the trigger for the bubble to burst has already appeared.<br>When people who called the last crash start using words like “super bubble,” it is worth listening. But not for the reason most headlines want you to read it.<br>This is not a story about AI being fake. It is a story about which AI was real all along.<br>What the Funds Are Actually Warning About<br>Read past the scary headline and the argument gets specific. Wealspring's complaint is that a huge slice of AI companies lack a durable competitive moat, run fairly ordinary business models, and need constant capital spending just to keep growing. Banxia pointed at slowing revenue growth at frontier model labs as the early crack.<br>That is not a critique of artificial intelligence. That is a critique of valuation without fundamentals. The funds are saying the same thing investors say at the top of every cycle. Too much money chased too many companies that had a buzzword and a burn rate but no defensible business underneath.<br>Notice what they did not say. They did not say AI does not work. They did not say the technology is a trick. They said the market priced a lot of companies as if continuous capital injection equals a real business, and that assumption is about to get tested.<br>Every bubble works this way. The dot-com crash did not kill the internet. It killed the companies that had a domain name and no revenue. Amazon and Google walked out the other side stronger because they were solving a real problem people paid for. The crash was a filter. It separated the businesses with actual cash flow from the ones running on narrative.<br>The same logic applies to AI capability warnings. When frontier models demonstrate real exploitation capabilities in Chromium and Firefox, the question is not whether the capability is genuine. It is whether the business built around it has genuine demand on the other side.<br>The Question Every AI Company Should Be Asking Right Now<br>If a correction is coming, the only thing that matters is which side of the filter you land on.<br>There are really two kinds of AI companies in this market. The first kind uses AI as the pitch. The product is “we have AI” and the value proposition lives in the demo and the funding round. When capital tightens, these companies have nothing to fall back on because the AI was the whole story.<br>The second kind uses AI as the engine for a job people already needed done and already paid for. The customer does not care that it is AI. They care that the problem got solved faster, cheaper, or better than the alternative. For these companies, an AI winter is not an extinction event. It is a clearing of the field.<br>The test is simple. If you stripped the words “AI powered” out of your pitch, would anyone still buy? If the answer is no, the bubble warning is about you. If the answer is yes, the warning is your opportunity.<br>Why Security Is on the Right Side of the Filter<br>Here is where cybersecurity sits in this picture, and it is not a coincidence that it sits where it does.<br>Nobody buys security because it has AI in it. They buy security because the cost of not having it is catastrophic and concrete. A breach has a number attached to it. Regulatory fines, customer churn, incident response, ransom payments, legal exposure, the deal that died in due diligence because the buyer's security review failed. The ROI of finding a vulnerability before an attacker does is not a projection on a pitch deck. It is the breach that did not happen.<br>That is the difference between spending that survives a downturn and spending that gets cut first. When budgets tighten, companies cut the speculative bets and the nice-to-haves. They do not cut the thing standing between them and a seven-figure incident. Security is one of the few line items where AI just makes an already-essential job faster and cheaper, instead of being the reason for the purchase in the first place.<br>AI in security is not a story about a future that might pay off. It is a tool that compresses work that used to take a senior researcher a week into an analysis that runs in minutes. The value is realized the moment the report lands, not three funding rounds from now. That is what real demand looks like. It does not need a bull market to justify itself.<br>This is also why the quality of security evidence matters more than ever in a tighter market. When boards start asking harder questions, a real vulnerability...