Your Moat Is Dead. Anyone Can Rebuild Your Product.

AI just made rewriting Photoshop a side project for a dozen engineers. That kills one kind of defensibility and makes every other kind more valuable.

Oct 07, 2026

Last week, a small team published an open-source reimplementation of Photoshop written in pure Rust. Within a week it had several thousand GitHub stars, sibling projects cloning Premiere, Lightroom, InDesign and Word, and a viral tweet from Eric S. Raymond declaring that “Adobe just got nuked. And closed source is dead, dead, dead.”

Raymond’s theory was that the team had decompiled Photoshop, turned the result into a spec, and fed that spec to an LLM with an instruction to generate Rust. A Community Note showed up underneath within hours pointing out that the project says the opposite. PhotoCraft’s README states that it is implemented from public specs and observed behaviour only, with no proprietary code, shaders or assets. The next morning Naval quote-tweeted the whole thing with his own take: “Models are the last moat in software.” Expect more software, he wrote, to retreat to the server and resist distillation.

I have read that exchange about ten times now, and I think everyone involved is half right. Something real happened, just not what Raymond thinks. Software is moving to the server, but models are not the last moat. And the question underneath all of it, the one a lot of founders have been asking me this year, deserves a better answer than a hot take. If anyone can rebuild your product, what is your company actually worth?

What actually happened

PhotoCraft is one of a family of “Craft” apps from the ArtCraft team, published under the storytold GitHub org since the end of September. They are all Rust, all MIT or Apache licensed, and all run natively on macOS, Windows and Linux as well as in the browser through WebAssembly. The PSD parser was written from Adobe’s public file specification and is tested against a corpus of real Photoshop files, with renders compared against Photoshop’s own composite output. Every command in the app is exposed over a CLI and an MCP server, so an agent can drive the editor as easily as a human. The repo even ships an AGENTS.md file for AI contributors, and Claude shows up as a co-author in the commit history.

Raymond’s decompilation story is speculation, and I would not repeat it as fact. Nothing public supports it.

It is also worth being honest about where the project stands. Reading the project’s own roadmap, WebProNews estimated Photoshop parity below 50 percent. Select Subject, content-aware fill and healing are missing. Generative features are absent by design. Adobe’s plugin format doesn’t run. No professional retoucher is switching this quarter.

So Adobe did not get nuked on Tuesday. What should worry every software company is not how good PhotoCraft is today. It is how little it cost to get this far.

Code just got cheap

When Phoenix Technologies cloned the IBM PC BIOS in 1984, the clean-room process needed two separated teams of engineers and months of careful work. One team studied the original and wrote a specification. A second team, which had never seen IBM’s code, built from that specification alone. That legal and engineering pattern created the entire PC clone industry, and for forty years it stayed expensive enough that only well-funded companies used it.

In 2026 the same pattern is a prompt. After Claude Code’s source leaked through an npm sourcemap in March, a project called Claurst appeared almost immediately. One agent wrote behavioral specs, a second agent implemented them in Rust without ever seeing the original, and the result was a working clean-room clone. Around the same time a satirical site called Malus offered “clean room as a service” and joked that AI could redo Phoenix’s BIOS work in minutes. It went viral because nobody could really argue with the joke.

The law mostly lets this happen. Copyright protects expression, not function. Sega v. Accolade said disassembly for compatibility can be fair use. Google v. Oracle said reimplementing an API can be fair use. In Europe the Software Directive explicitly allows decompilation for interoperability under certain conditions, and the CJEU held in SAS Institute v. World Programming that the functionality of a program and its file formats are not protected by copyright at all. There are still real risks for projects like PhotoCraft, mostly around patents and trademarks, and nobody has tested yet whether a clean room counts as clean when the model doing the work may have seen the original in training. Those are lawsuits, though. None of them gives an incumbent its moat back.

The practical consequence is simple. Anything a user can observe can now be specified, and anything that can be specified can be rebuilt by a small team with agents in weeks. Menus, shortcuts, workflows, behaviors, file formats. If the value of your product is visible on the screen, you should assume someone is already writing the spec.

What is leaking

The first thing to go is the feature moat. PhotoCraft has a build task that walks Photoshop’s entire menu tree and checks each item against its own command registry. Feature parity has become a CI job. For decades, software companies defended themselves by being the product with the most stuff, and that defense now has a known, automatable cost.

UX familiarity goes with it. “If you know Photoshop, you already know PhotoCraft” is a line straight from the project’s pitch. Muscle memory used to be one of the strongest switching costs in software. It turns out to be very easy to specify.

File formats were Adobe’s quieter moat. PSD has kept millions of designers inside Creative Cloud because nothing else opens a layered file reliably. PhotoCraft claims it round-trips almost all of its test corpus. Even if that number is generous, the direction is obvious. Proprietary formats leak once someone cares enough to document them, and AI has made caring cheap.

Integrations are the fourth. Michael Bloch of Quiet Capital put this well in Forbes earlier this year when he split defensibility into things that are hard to do and things that are hard to get. Integrations, connectors and workflow plumbing all belong to the first category, and the first category is exactly what AI is erasing. Work that used to take a team a quarter now takes an agent an afternoon.

The last leak is in the business model. Per-seat pricing assumes humans are the ones using the software. The public markets already repriced that assumption in February, when Anthropic launched Claude Cowork plugins and Thomson Reuters fell almost 18 percent in a single day, its worst on record. RELX had its biggest drop since 1988 the same day. By April, Atlassian was down more than half for the year. Adobe is down roughly 30 percent year to date while beating earnings every quarter.

Prateek Singh recently described 2026 as a year where five moats are leaking and one compounds. I think that framing is right, and the list above is my version of the five.

Where defensibility moved

The strongest moat I know of in 2026 is accountability. At Passbase we did identity verification, and I learned early that the code was never the hard part. Banks didn’t pay us for an SDK. They paid us to be the party they could rely on, contractually and with their regulators, when something went wrong. Licenses, audits, certifications, liability, insurance. None of that can be reconstructed from public specs, because none of it is code. An open-source Photoshop makes sense. An open-source “we take responsibility for your AML decisions” doesn’t exist, and can’t.

Right behind it is live proprietary data, and the word “live” matters. A static dataset is a snapshot that a competitor can approximate with enough scraping, synthetic data and patience. What holds is data that keeps getting generated by operations that are themselves hard to copy. Bloch’s example is Orchard Robotics, which tracks billions of individual pieces of fruit across millions of trees, season after season. Nobody gets that by reading a spec. If your data stops refreshing because customers stop using you, it starts decaying immediately.

Then there is distribution and trust, which is the cleanest example of “hard to get.” An agent can write the code, but it cannot get your product through a Fortune 500 security review or make a CFO comfortable betting their job on you. Microsoft has rarely won a category on features. It wins because it is already in the building, already approved, already the default. Relationships compound slowly and leak slowly, which is exactly what you want from a moat.

The physical world is the next layer. OMERS Ventures wrote in its 2026 outlook that moats in pure software have become much harder to find and even harder to keep, and that capital is moving toward robotics, energy and infrastructure. Atoms do not git clone. A company that runs warehouses, installs heat pumps or operates a fleet has a moat that has nothing to do with how cheap code has become.

Which brings me back to Naval. He is right that software is retreating to the server. Warp open-sourced its terminal this year and kept its cloud product closed. Adobe is doing the same with Firefly, where the generative features that PhotoCraft deliberately leaves out run on Adobe’s servers and get metered in credits. Keeping your most valuable logic behind an API is now the obvious default. I just don’t think models are the last moat. Open-weight models trail the frontier by months, not years, and distillation pressure never stops. The server is a good place to keep your secret sauce. It doesn’t guarantee the recipe stays secret.

Ecosystems and network effects still hold too, but they erode from the edges. PhotoCraft can’t run Photoshop plugins today, and that is a real gap. It is also the kind of gap an agent can start closing by porting the twenty most popular plugins first.

It is telling where acquirers have landed. Einar Vollset, who sells software companies in the low eight figures of ARR, said on Startups for the Rest of Us that some private equity buyers now refuse to look at a deal unless the company has at least one AI-resistant moat. His list was hardware coupling, two-sided network effects, embedded communication graphs, proprietary data with closed feedback loops, and operational switching costs. Good code didn’t make the list.

The moat that compounds

If I had to pick one moat to build a company on today, it would be owning the outcome.

By that I mean you stop selling a tool the customer operates and start selling the result, with you on the hook if it doesn’t happen. Once you are responsible for the outcome, most of the other moats follow on their own. You see whether the work succeeded, which is the beginning of a real data loop. You carry the liability, which is the accountability moat. You become the vendor nobody wants to rip out, which is distribution. And you are free to run the whole thing on your own servers, because the customer never cared what software you used in the first place.

A tool can be reimplemented over a weekend. A promise has to be kept, month after month, and every month you keep it you become harder to replace.

What I would tell founders

If I were starting a company this month, the first thing I would do is look at the product idea and ask how much of its value is visible in the UI. If the honest answer is “most of it,” I would assume a Discord full of engineers with agents can rebuild it before I finish raising a seed round. Dashboards, client-side apps and “Notion for X” products are now open-source fodder.

The second thing would be to pick a wedge that is hard to get rather than hard to do. Regulated niches, operations-heavy businesses, anything where you end up as the accountable party. Debt collection, payments, healthcare billing, compliance, field services. These markets look boring from the outside, and that is a feature. A clean-room clone can copy your interface, but it cannot copy your license or your track record with a regulator.

I would also stop treating my client code as a secret. If someone is going to clone it anyway, it can be smarter to open-source it first, build the community around your version, and keep the parts that matter on your side of the wire. The data, the models, the compliance work and the service are what customers pay for. The client is distribution.

Pricing deserves rethinking too. Seats are exactly what the market punished this year, and for a good reason. If agents end up doing the work your customer’s employees used to do, seat-based revenue shrinks alongside their headcount. Charging for work completed, risk removed or money recovered lines your revenue up with the thing the customer actually values.

Finally, I would build distribution before features. Feature parity is a CI job now. A year spent earning deep trust in a narrow market is worth more than a year spent chasing parity in a broad one. Speed still matters enormously, but only on top of something defensible. Shipping fast while sitting on nothing just means you get cloned faster.

What this means for Adobe and the other giants

Adobe’s numbers don’t look like a company in trouble. In its September quarter it reported $6.76 billion in revenue, up 13 percent, total ARR of $27.5 billion, and AI-first ARR above $650 million, growing more than 150 percent year over year. It raised full-year guidance. The stock is still down around 30 percent, Goldman has a Sell rating on it, and a new CEO starts in December. The market is not pricing this quarter. It is pricing the next ten years.

My read is that the exposed part of Adobe is the prosumer and small-business tier, the person paying $20 to $60 a month mostly for features, familiarity and PSD compatibility. All three of those just started leaking at once, and the pressure is coming from Canva, from AI-native tools and from free Rust clones simultaneously.

The enterprise business is a different story. Large customers buy procurement simplicity, indemnification on generated content, models trained on licensed material, compliance, support and the long tail of edge cases that takes a decade to get right. GIMP has existed since the nineties and never seriously threatened Photoshop, because professionals live in the last ten percent of polish. AI shrinks that gap. It doesn’t close it overnight.

If I were in Adobe’s position, I would move value onto the server on purpose. Custom models trained on a brand’s own assets, generative workflows, collaboration and asset management can’t be reconstructed from a public spec. Adobe already reports thousands of enterprise custom models, and that is where the company should point everything. I would sell indemnity and accountability as a product, because a large customer will pay real money for “we stand behind this output,” and an open-source clone can’t offer that. I would make every Adobe app the best possible tool for agents to drive, before PhotoCraft’s MCP server becomes the default way agents edit images. I would cut prosumer prices before the market does it for me, and treat the cheap tier as the funnel for the server-side upsell. And I would probably open up PSD further. If the format is leaking anyway, leading the standard buys goodwill instead of losing it slowly.

None of this is specific to Adobe. Salesforce, Atlassian, Autodesk and Microsoft are all in the same position. Whatever lives in the client and the interface can now be copied. The system of record, the compliance posture, the trusted relationship and the intelligence running on their servers can’t, at least not cheaply.

Closed source isn’t dead

Raymond is wrong about how PhotoCraft was built and wrong that Adobe got nuked. Naval is right about the direction software is heading and wrong that models are the last thing standing.

What actually died this year is the idea that code by itself is a moat. The cost of reproducing software you can observe is collapsing toward zero, and the law mostly allows it. But customers were never really paying for code. They pay for someone who is accountable, who learns from them, whom they already trust, and who keeps the promise when it matters.

Build that part. The rest you might as well open-source.