Sphinx

How did I end up with a photo shaking hands with Elizabeth Holmes on my way through l’Elysée in Paris? I didn’t. She’s still in jail, and we’ve never met. I just gave an AI one prompt and a real photo of me with President Macron. A few clicks later, it spits out something that looks real enough to fool the average human. And that’s exactly the point. If I can fake a handshake with Elizabeth Holmes in two minutes, imagine what someone with an actual motive (and a bit more sample size) can do. A few examples we already see in the wild: – Refund scams with “damaged goods” photos – Synthetic identities onboarding with generated documents – Impersonations that look indistinguishable from the real person You can forget about future threats because it’s already happening. AI makes it trivial to generate content that passes the eye test. And the moment it looks “real enough,” most compliance systems stop asking questions. This builds on our previous teardown where we used AI to generate fake passports and utility bills. How do you think compliance should adapt their defenses in a world where "seeing" is no longer "believing"?

There are 8 compliance nightmares coming for banks in the months to come... I just read through the compliance forecast from DataSnipper and it’s interesting to say the least. Most teams aren’t ready for what’s coming. Here's what's heading their way: – 𝐄𝐒𝐆 𝐫𝐞𝐩𝐨𝐫𝐭𝐢𝐧𝐠 isn’t just paperwork anymore. Miss one thing under the new EU rules and you’re in regulatory quicksand. – 𝐀𝐈-𝐠𝐞𝐧𝐞𝐫𝐚𝐭𝐞𝐝 𝐟𝐚𝐤𝐞𝐬 are slipping past human reviewers every single day — your analysts are outmatched and outnumbered. – 𝐀𝐌𝐋/𝐂𝐓𝐅 expectations are now real-time. “We’ll look into it next week” isn’t gonna fly anymore. – 𝐃𝐢𝐠𝐢𝐭𝐚𝐥 𝐛𝐚𝐧𝐤𝐢𝐧𝐠 𝐫𝐮𝐥𝐞𝐬 are changing faster than most teams can update their internal playbooks. – 𝐂𝐨𝐧𝐬𝐮𝐦𝐞𝐫 𝐩𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐨𝐧 is getting way more aggressive. Fair lending violations = fines + public backlash. – 𝐄𝐯𝐞𝐫𝐲𝐨𝐧𝐞’𝐬 𝐚𝐝𝐝𝐢𝐧𝐠 𝐀𝐈, but nobody’s talking about how messy the compliance risks are if you get it wrong. Classic catch-22 – 𝐎𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐫𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞 is suddenly a big deal. Regulators want to know if you can survive the next crisis before it happens. – 𝐆𝐥𝐨𝐛𝐚𝐥 𝐭𝐚𝐱 𝐫𝐮𝐥𝐞𝐬 are turning digital transactions into a reporting nightmare. What worries me isn’t just the list – it’s how many teams still think they’re on top of it, while all this stuff quietly slips through. That’s why we built Sphinx (YC F24) the way we did. Not as a “platform” or some fancy dashboard – just actual agents that do the manual work and flag the stuff legacy systems miss.

Hot take: JPMorgan can spend $100M+ on AI… and a smaller bank can still win on compliance. Everyone assumes banks like JPMorgan leads AI adoption because they’ve got the biggest team. But at Sphinx (YC F24), we keep seeing smaller banks move faster on the stuff that actually matters. Why? When you're a smaller bank, a regulatory fine could actually shut you down. So compliance isn't just a checkbox - it ensures survival. That urgency cuts through the bureaucracy fast. (Plus, you've got maybe 5 people making the decision instead of 5 committees!) Smaller banks are also more agile when it comes to policy - they can rewrite their compliance playbooks quickly to align with how AI agents operate. Think about it: they're opening new regions and customer segments constantly, so they're already used to adapting fast. I hate to be this guy, but it's the classic David vs Goliath tale. David didn't win by matching Goliath's size - he won by being faster and more focused. The same thing is happening in banking AI right now. The real strategic advantage is the ability to adopt AI that can operate on top of existing systems and work according to your SOPs. If you're at a smaller institution wondering how to compete with the massive AI investments, maybe stop trying to match their spend. Instead, start leveraging what they can't buy - speed and focus :)

Klarna IPO’d last week at a $17B valuation. It’s a big win for European fintech – and a reminder of how rare it is to see consumer finance companies at this scale actually go public. 111 million customers. $823M in revenue. Still posting a $53M loss – but the real story is how they got here. Klarna survived a brutal downround, fought its way out of the “BNPL is dead” narrative, and actually turned the corner. But scaling this big also means inheriting all the headaches of a regulated institution: onboarding, fraud, transaction monitoring, chargebacks, consumer protection. At that size, compliance stops being a checkbox and becomes a core part of the product. You don’t onboard 111M users without getting really good at screening, fast. And that’s what makes stories like Klarna’s interesting to me — not just the revenue multiple or IPO pop, but how you build the kind of infrastructure that can keep working at that scale, under that much scrutiny. That’s why we’re building Sphinx (YC F24), to help the next Klarnas move fast without getting buried in manual compliance work. It’s early, but we’re already seeing AI agents resolve up to 90% of compliance cases instantly, so human teams can focus on the stuff that actually matters. If you’re scaling and compliance is starting to feel like a bottleneck, ping me. I'm always happy to share what we’re seeing under the hood. And again, congrats to Klarna – few companies make it this far. Keep an eye out for the SPHX ticker next :)

Solving the Sphinx Challenge was… something else. We wanted a coding challenge that wasn’t just “paste this into an LLM and hope for the best.” So we ended up with 1000 Morties, a knock-off portal gun, three unstable planets, and a survival problem that looked like a multi-armed bandit but absolutely wasn’t. The engine was tiny (25 lines of code) fully deterministic, and driven by a single integer seed. No noise. No randomness. Just clean, sinusoidal chaos hidden under cute planet names. Most people assumed Planet 0 had a flat 0.5 survival rate. It wasn’t. That one fooled more engineers than anything else. The funny part? The winners didn’t win because of “better math.” They won because they out-deployed everyone else. People who ran locally plateaued. People who spun up infrastructure took off. Across the challenge, engineers fired: • 450M requests • 14M full games • 500+ participants • 34 countries It turned into a throughput competition disguised as a probability puzzle. People tried everything: • Bayesian inference • FFTs • UCB heuristics • Genetic algorithms • Visual pattern-spotting • Restarting “bad seeds” • And about 20 other approaches I never expected to see No single trick dominated – the best players paired reasonable heuristics with massive sampling. A Harvard postdoc took first place at 93.7%. Four people tied just below her at 93.3%, which led to the exact kind of 3 a.m. leaderboard chaos you'd expect from a challenge built on phase offsets and sinusoidal timing. Even the AI models joined the competition: Claude Code landed at 60.2%, GPT-5 variants in the high 50s. The challenge genuinely required intuition, debugging, and infrastructure. My favorite stat: 937 Morties made it to Planet Jessica. The other 63… well, that’s the cost of doing business with the Council of Ricks ¯\\_(ツ)_//¯

The CFPB quietly dropped its $870M Zelle fraud case overnight. 6 months ago, they were going after JPMorgan, BofA, and Wells for pushing Zelle live without proper fraud controls. People were getting scammed, losing money – and in some cases, told to just “call the fraudster” themselves. Total circus. Now the case has been closed like it never happened. I can’t be the only person worrying about the impact of this case being dropped. The $870M in fraud losses doesn’t disappear just because the case does. Customers have still been exposed. Fraudsters are still finding ways through what should be rigorous safeguards. Real damage has been done. This is what keeps me up at night. Because when enforcement drops off a cliff, compliance teams start optimizing for lawsuits – not protection. The energy shifts from building real defenses to just avoiding headlines. At Sphinx (YC F24), we’ve seen firsthand how fragile this kind of “surface-level compliance” can be. Fraud prevention isn’t a setting you toggle off when the regulator backs down. It’s a daily discipline ¯\(ツ)/¯