The Wrapper Trap: When AI-Native Is Actually Defensible

A system prompt over a foundation-model API is not a moat, and in February 2026 a Google VP put a date on the death of the thin wrapper. The question is no longer whether AI wrappers are defensible in the abstract. It is whether yours owns anything the next model release cannot erase.

Here is the honest version, because the skeptic is mostly right. A wrapper is not doomed by being a wrapper. It is doomed by being thin. AI-native defensibility comes from owning at least one compounding asset a competitor with the same model and more money cannot copy by next quarter. At Avante Ventures we build for that asset from day one, because the model itself is no longer something you can own.

The thin-wrapper critique is correct

The people who sell the models now say the quiet part out loud. On February 21, 2026, TechCrunch reported that Darren Mowry, the VP running Google's global startup organization across Cloud, DeepMind, and Alphabet, warned that two kinds of AI startups may not survive. The first is the thin wrapper.

His words are worth quoting exactly. If you are counting on the back-end model to do all the work and you are almost white-labeling that model, the industry does not have a lot of patience for that anymore. Wrapping very thin intellectual property around Gemini or GPT-5 is the trap. The prescription was a phrase worth keeping. Startups need deep, wide moats. His second doomed category was the aggregator, because users want intellectual property built in, not a routing layer the model providers will absorb into their own enterprise features.

The economics behind the warning are margin compression rolling downhill. TechCrunch reported in September 2025 that application teams now treat foundation models as a commodity to swap in and out at will. That feels like leverage until you notice every competitor can swap in the same commodity. One founder called the endgame for undifferentiated players like selling coffee beans to Starbucks. Essential to the cup, paid almost nothing for it.

Thin versus thick, defined

Thinness has nothing to do with how much code you wrote. It is about what compounds while you sleep. A thick venture owns at least one asset that gets stronger with use and that a well-funded rival cannot rebuild by copying your interface. Everything else is decoration on a rented engine.

Start with why the engine cannot be the moat. Inference is deflating faster than almost any technology in history, a curve we trace for the region in the AI infrastructure cost curve. According to a16z, for an LLM of equivalent performance the cost is dropping 10x every year, a factor of 1,000 in three years. GPT-3-level quality went from about $60 per million tokens in late 2021 to roughly $0.06 by late 2024. A capability that gets 10x cheaper every year, available to everyone from multiple vendors, is a utility. You do not build a moat on a utility. You build it on what the utility is bolted to.

The three sources of thickness

Durable defensibility lives in three places, listed in ascending order of strength. Each one carries a failure test, and most founders quietly fail it.

The reason network effects matter most is the math. NFX, in its Network Effects Manual, credits network effects with roughly 70% of the value created by technology companies since 1994, and rates them the strongest of the four real defensibilities. A proprietary data flywheel is how an AI-native venture builds one, instead of merely claiming it has one.

• Proprietary data flywheel. A stock of data is not a moat, a flow is, which is the heart of how data network effects work in vertical AI. a16z's The Empty Promise of Data Moats shows there is generally no inherent network effect from merely holding more data, and that in a support-chatbot example past roughly 40% query coverage there is no advantage to collecting more. The moat is a loop where each use produces data that measurably improves the product faster than the pile decays.
• Domain-specific evaluations. The hardest asset to copy is a graded definition of what correct means in a regulated, judgment-heavy domain. A general model can draft a clause or price a risk. Knowing which output is right, wrong, or quietly dangerous in a specific Brazilian legal or insurance context is encoded judgment that took operators years to earn. The model vendor cannot ship your evals for you.
• Workflow lock-in. Hamilton Helmer's 7 Powers calls this Process Power and Switching Costs. Once an AI product becomes the system of record for a regulated process, leaving means re-validating a compliance trail, retraining staff, and re-integrating adjacent systems. The cost of leaving is the moat. This is why vertical AI beats horizontal. A general assistant has no workflow to anchor.

How the flywheel crosses the line

The flywheel is the machine that turns a thin entry wedge into a thick position over time. This is the copilot to data to fund flywheel. Ship an AI copilot that does real work inside one vertical. The work generates proprietary data no one else is sitting on. That data sharpens domain evaluations and improves the product, which deepens workflow lock-in, which produces more data. The copilot is the thin-looking wedge on day one. The loop is what makes it thick by year two.

The 2025 evidence that this is the real dividing line comes from emerging markets, not Silicon Valley. According to Insignia Ventures, AI has made building easier and defending exponentially harder, with software reaching $1 million ARR faster than ever before. Their case studies land on these exact mechanisms. A used-car platform compounds a data flywheel from 160-plus data points per vehicle. A lender that pairs a proprietary ERP with financing held a 3% non-performing-loan rate through COVID while the broader fintech industry ran 20 to 30%. Every one of them rented the same model. None of them rented the flywheel.

The story founders tell that is not true

The most common pitch in AI is a thick-moat story narrated over a thin product. Founders describe a data network effect they have not built, a flywheel that has not reached escape velocity, and a defensibility that lives entirely in the future tense. The honest failure mode has two parts, and they feed each other.

First, the data loop starves because the company has no distribution. A feedback loop only compounds if enough users feed it. Without a channel to acquire and keep them, a better-distributed competitor with a worse dataset wins, because their worse dataset is growing while yours sits still. Second, proprietary data with no way to keep collecting it is not a moat, it is a stock that decays. A dataset frozen at launch gets lapped by a product that improves with every use.

The swap test is the discipline that cuts through the story. If you replaced your model vendor tomorrow and your defensibility did not change, the model was never your moat. Find the loop or the workflow that survives the swap before a model release finds it for you.

How Avante builds thick from day one

Avante Ventures is a venture studio building AI-native companies in Brazil and Latin America, engineered to start thick rather than hope to grow thick later. The method is the copilot to data to fund flywheel run through a six-stage system. Research, Partner, Build, Traction, Revenue, Compound. Each venture is paired on day one with a domain operator carrying 10-plus years of Brazilian-market scar tissue, which is where the proprietary evaluations come from, and with $500K-1.5M of first-ticket capital, which buys the distribution that keeps the data loop fed. Because inference is cheap, that first ticket is often enough to reach revenue without a Series A. The full thesis is at /why-avante.

Brazil makes the math work. Services account for roughly 70% of Brazilian GDP per IBGE, the largest piece of the economy and long under-served by software, which is the exact surface where a vertical AI product can become the system of record. The portfolio shows the pattern by domain. Judicial assets, where the workflow data around precatorios and claims is genuinely proprietary. Insurance pricing, where risk-scoring accuracy feeds a usage loop. Real estate auction intelligence, where enriched and scored auction data compounds. In each one the model is the rented engine and the moat is the domain data flow bolted to it.

Studio-model returns are why we build this way at all, with GSSN data showing studio IRR of roughly 50% versus roughly 19% for traditional VC, about 2.5x, a benchmark for the model rather than a claim on any single fund's realized return. The wrapper critique is correct. That is exactly why a venture should be built so the next model release is a tailwind, not an obituary. See how we operate in /principles.