A new phase of the AI trade is starting to matter for markets.
The first phase was easy to see: semiconductors, data centers, model labs, power demand, and the companies selling the picks and shovels of AI. The next phase is less obvious, but potentially just as important: what happens when frontier AI starts changing the economics of software itself?
If advanced models can find vulnerabilities at scale, then software security debt becomes a market variable. Code quality, patch speed, observability, testing discipline, incident response, and access to defensive AI tools all start to matter more for valuation.
That creates a dispersion trade.
The winners are the companies that can use AI to harden their systems faster than attackers can exploit them. The losers are the companies and protocols that discover their codebases were carrying unpriced security debt.
This matters for software, because stronger AI can raise the cost of building, securing, operating, and proving software. It also matters for crypto, because the same vulnerability-discovery shock is more reflexive there: a bug in enterprise software can become a cost; a bug in DeFi can become an immediate asset drain.
So the market implication is not a broad anti-software or anti-crypto call. It is a quality and resilience trade: own the systems that can prove durability, and be careful with the systems that cannot.
The Software Setup
IGV is now the clean software ETF reference for this theme.
The data is interesting because software is not where the obvious crowding is. IGV is trading around 94, with about $14.4B in AUM. Relative to SPY, IGV is still low: around the 20th percentile on the local 10-year history and around the 25th percentile over the last year, but the path has turned up over the past month.
That is exactly the kind of setup I want for a rotation trade: not dead, not euphoric, and not already the most crowded sleeve.
The contrast with semiconductors matters. BoFA's latest crowded-trade data still has long global semiconductors as the obvious consensus trade, and tech/QQQ relative strength is already near extreme levels. So the trade is not "buy tech." It is more specific:
Own software that can benefit from the AI-security reset, while avoiding the most crowded AI hardware chase.
The Flow Context
The IGV data is now more complete than just a latest quote.
There is a 10-year local price and IGV/SPY relative-strength history. There is also an exact current iShares snapshot for NAV, shares outstanding, and AUM. On top of that, ETF Central / Trackinsight shows IGV with about $14.37B in AUM as of May 20, with roughly $871M of 1-month flows and $6.53B of YTD flows.
The longer flow picture is also not dead: ETF Central shows positive 1Y, 3Y, and 5Y flows. At the same time, performance is still negative YTD and negative over one year, which fits the "washed out but starting to recover" idea.
There is one important caveat: exact iShares daily historical AUM is not available from the current parser. We do have a historical shares-outstanding file from 2010 to 2023 and an AUM proxy built from those shares and IGV market price, but that proxy is not the same as exact issuer NAV/AUM history. For trading context, the combination is enough: current exact AUM, flow-horizon summary, and long relative-strength history.
Why Mythos Changes The Software Moat
Mythos-style models change the cost curve.
If frontier systems can find and exploit vulnerabilities at scale, then closed source, complexity, and old audit cycles stop being enough. The moat shifts toward operational speed: code visibility, automated testing, CI/CD, observability, incident response, security telemetry, and proof that vulnerabilities can be fixed before attackers can monetize them.
This makes software more expensive to build and maintain.
AI compute is not free. GPU rent is not free. More AI-generated code means more systems to review, integrate, secure, monitor, and own. Developer demand can rise because AI increases how much software can be attempted, while humans still need to manage architecture, workflows, security, deployment, and accountability.
That favors incumbents with distribution, cash flow, model access, security teams, and deep workflow lock-in.
It hurts thin SaaS, weak codebases, small vendors with poor telemetry, and software companies whose value depends on the old assumption that attackers and auditors are human-limited.
How I Would Express It
The broad version is long IGV as a software rebound vehicle.
The sharper expression is long hardened software and security infrastructure versus weak software-security debt.
The companies I would want are the ones with one or more of these traits:
Early access to frontier defensive models.
Control of cloud, identity, endpoint, developer, or security telemetry.
Deep enterprise workflow lock-in.
Ability to ship patches quickly without breaking production.
Ability to prove resilience to boards, regulators, insurers, and customers.
The companies I would avoid are the ones with old codebases, low test coverage, slow patch cycles, thin UI moats, and no realistic ability to absorb continuous security remediation.
This is why Mythos can be bullish for the right software names. It is bearish insecure software, but bullish economically hardened software.
Crypto Is The Same Story, But Faster
Crypto has the same security-debt problem, but the consequences are more immediate.
In normal enterprise software, a vulnerability can mean data theft, downtime, ransomware, procurement delays, or liability. In DeFi, a vulnerability can become instant money leaving the protocol.
That makes weak crypto more exposed than weak software.
The vulnerable zones are obvious: DeFi forks, bridges, oracles, restaking layers, upgrade keys, multisigs, wallets, custody, signing infrastructure, and anything with high TVL but weak security budgets.
The first-order Mythos reaction can therefore be bearish for crypto beta. If stronger models expose bugs before protocols have access to comparable defensive tools, long-tail DeFi and bridge-heavy ecosystems can sell off hard.
But Crypto Also Has A Bullish Second Step
The second-order crypto thesis is more interesting.
If major protocols eventually get access to frontier defensive agents, the market can start rewarding security credibility. Continuous AI red-teaming, formal verification, live monitoring, bridge/oracle hardening, emergency controls, and better key management become part of the valuation story.
That creates two scenarios:
No access or late access: weak DeFi and long-tail crypto sell off, BTC outperforms, and capital hides in safer base-layer exposure or stables.
Access and hardening: security-serious protocols rerate, BTC remains the quality anchor, and selected ETH/SOL/DeFi names recover after they prove resilience.
This is why I would not be blindly bearish crypto. I would just be selective.
Current Crypto Read
The current crypto setup is not a perfect buy signal.
Fear/greed is depressed, which is usually interesting. But the rest of the positioning is not washed out enough. ETH clients are still meaningfully long, broad crypto clients are still long, and BTC/ETH options are not showing a clean panic-volatility reset.
So the cleaner stance is cautious exposure, not zero exposure.
BTC is the better relative hold during AI-cyber stress because the base layer is simpler, public, transparent, heavily reviewed, and socially easier to trust than opaque systems. Long-tail DeFi and bridge-heavy beta should be treated with more suspicion until there is evidence of real hardening.
The strongest crypto trades are therefore relative:
Long BTC or high-quality base-layer exposure versus fragile DeFi and under-secured long-tail beta during AI-security panic windows.
Then rotate selectively into protocols that can prove security spend, continuous testing, strong governance, bridge/oracle discipline, and clean positioning.
Bottom Line
Mythos is not bearish software. It is bearish insecure software.
Mythos is not bearish crypto. It is bearish fragile, composable, under-secured crypto.
The software trade is long the companies that can turn AI into a security moat: hardened platforms, security infrastructure, and deeply embedded enterprise systems. IGV works as the broad software rebound vehicle because software is still low versus SPY while semiconductors are already crowded.
The crypto trade is quality first. BTC should hold up better than fragile long-tail beta during AI-cyber scares. DeFi and high-beta ecosystems become interesting only after the market sees real evidence of hardening.
The big idea is simple:
AI does not destroy software. It reprices trust.
Own the systems that can prove resilience. Avoid the systems that cannot.