Coder Legion - Recent posts tagged sec

Presto Reported 95% of Drive-Thru Orders Done Without Intervention. It Only Counted Restaurant Staff

Thu, 08 Oct 2026 08:08:51 +0000

Originally published at vibeagentmaking.com.

Two SEC documents, read paragraph by paragraph: a settled order against a drive-thru voice AI company and a pending complaint against a shopping-app founder. Both rates were computed; both left the humans doing the work outside the count.

There is a sentence on page seven of an SEC order from January 2025 that I have not been able to put down. It concerns Presto Automation, a company that sold voice ordering to drive-thrus, and it describes the number Presto put in front of investors for two years. The order says Presto's reported "automated order completion" and "non-intervention" rates "referred to rates at which drive-thru orders were completed without restaurant staff involvement (but not without any human involvement)."

Read it twice. The rate was real. Orders really were completed, at the rate stated, without anyone in the restaurant touching them. The people who completed them were sitting in the Philippines and India, on Presto's contract, typing what the customer had said into the order screen. They were not restaurant staff, so they were not counted. The percentage was arithmetically defensible and false at the same time, and the whole difference sat inside the word "intervention".

I want to walk through that document and one other, a complaint the SEC filed three months later against the founder of a shopping app called Nate, because the two of them describe the same trick from two directions, and because the numbers they describe (automation rate, non-intervention rate, containment rate, whatever a vendor calls it this quarter) are the numbers anyone buying an AI agent is being quoted right now. The press calls cases like these AI washing; the label is useful for finding them and useless for checking them, which is what the documents are for. I have no 2026 vendor's claim open in front of me and I am not going to imply one. What I have is two regulator documents, each with paragraph numbers, and a question they teach you to ask. (For a third regulator document read the same way, see the FTC's $18,000,000 judgment against Air AI, where the order itself explains why the company pays $50,000.)

One note on register before the details. The Presto document is a settled order. Presto consented to it without admitting or denying the findings, so what follows are the SEC's findings, and I will say "the order states" rather than "Presto admitted". The Nate document is a complaint in a case that is still open. Its contents are allegations, not proven facts, and I will keep saying so.

What Presto said

The order (Securities Act Release 11352, January 14, 2025) sets out the claims. Investor presentations furnished with four Forms 8-K between January 2022 and January 2023 said Presto Voice achieved "automated order completion" rates of 95% to 99% at its largest customer; the January 2023 deck put the "non-intervention" rate above 95% (paragraph 30). Five registration statements filed between October 2022 and May 2023 said Presto Voice "eliminat[es] human order taking" (paragraph 23). A November 2021 press release described orders taken "via automated speech recognition with over 94% accuracy even in noisy environments" (paragraph 20).

Those are three different claims and it helps to keep them apart. One is an accuracy figure for speech recognition. One is a completion rate. One is a plain statement that the humans are gone. The order's findings turn on the last two.

What the rate measured

For the original version of Presto's own technology, first deployed in September 2022, the order describes the pipeline: speech became text, and the text was "displayed to human agents that Presto contracted at various off-site locations, including in the Philippines and India", who entered the order. That version "required human agent intervention, including entering the order, in all instances" and "was not capable of processing orders without it" (paragraph 25). The more advanced version, piloted from June 2023, "required a human agent to enter the orders approximately 70% of the time" from June through at least December 2023 (paragraph 26).

So at the substantial majority of Presto's own locations, a human entered every order, and at the pilot sites a human entered seven in ten. Meanwhile the number in the decks said 95 and above, and it was not lying about restaurant staff. It was silent about everyone else.

There is a second layer. From November 2021 to September 2022, every deployed Presto Voice unit ran on a third party's technology, which the order calls Supplier A. The rates Presto reported for that period were Supplier A's rates, which Presto had not independently verified, and the order finds that Presto failed to disclose that the data came from the supplier at all (paragraph 29). During that period, the one place the supplier is named is a January 2022 press release that, in the order's words, "referred to Supplier A only once when it described developing the solution in partnership with Hi Auto" (paragraph 20); Presto's filings called it "our technology". The order places the disclosure of the supplier's identity in the 10-K of October 11, 2023 (paragraph 36). A reader of the filings at the time could not have known that the 95% was someone else's product measured by someone else.

What Presto's own people wrote

The order quotes the company to itself, and the quotes are the part I would put in front of anyone who evaluates vendor metrics for a living.

On January 20, 2022, one executive wrote to another that "with HITL [humans in the loop], accuracy is not a major concern" and that the product "can even get to 95% or more with humans" (paragraph 27). That is not a confession. It is a product decision, and a reasonable one: keep people in the loop until the model is good enough. The problem is what was said outside.

In October 2022 a senior executive wrote that the company should not refer to "automation rate with customers because it infers no supervision which isn't true" (paragraph 33). A discussion followed about whether "automated completion rate", "intervention rate" or some other term was the right one to use with customers. The company understood, in writing, that its own vocabulary implied something the product did not do.

In January 2023 another executive raised the concern that Presto was "telling investors Presto AI is running 95%+ accuracy without disclosing AI is doing NONE of the work and all orders are processed by humans" (paragraph 33). The capitals are in the order.

The pair of numbers that settles it

The cleanest way to see the trick is a single filing. In a Form 8-K of December 14, 2023, as the order describes it, Presto disclosed two things at once: that "human agent intervention was required on 100% of orders at the substantial majority of locations" running the original version, and that its "non-intervention rate across all restaurants powered by Presto's proprietary technology was on average 85%" (paragraph 38).

Both numbers are about the same restaurants on the same day. One says a human handled everything. The other says a human handled fifteen percent. They do not contradict each other, because they count different humans. The 85% counts the restaurant's staff, who were indeed rarely needed. The 100% counts the people Presto was paying to be the product.

If you take nothing else from the document, take this: a rate can be exact and still be an answer to a question nobody asked.

The money, and what it cost

Presto raised approximately $55.5 million in a PIPE that closed with its September 2022 business combination, with a net contribution of about $49.8 million (paragraph 15), and approximately $9.5 million in a private placement on May 22, 2023 (paragraph 17). That is $65.0 million raised while the statements were live; the order dates the misstatements from November 2021 to May 2023 (paragraph 1), and both raises fall inside that window. The order does not state a figure for investor losses, so neither will I.

The corrections came after Presto learned the SEC was looking. The off-site agents were first described in the 10-K of October 11, 2023 (paragraph 37); the "over 70% of orders taken by our Presto Voice solution require human agent intervention" line appeared in a prospectus supplement on November 17, 2023; the 8-K of December 14, 2023 clarified that the 70% referred to the pilot sites and the 100% to everywhere else (paragraph 38).

Nasdaq suspended trading in Presto's stock on August 8, 2024 and filed a Form 25 to delist it on September 6, 2024 (paragraph 7). The sanction in the order is a cease-and-desist. There is no civil penalty. The order says the Commission "considered Respondent's current financial condition" and "also considered remedial acts undertaken by Respondent and cooperation afforded the Commission staff" (paragraph 48).

And there is one more finding, which reads like an aside and is not. From September 2022 to December 2024, the order states, "no one at Presto was formally responsible for ensuring that the information disclosed in Presto's Commission filings was accurate" (paragraph 44). The number went out for two years and nobody owned it.

Nate: the same trick, from the other side

Nate was a shopping app. Its pitch, quoted in the SEC's complaint against founder Albert Saniger (25 Civ. 2937, S.D.N.Y., filed April 9, 2025), was "the first non-human executive assistant that can buy anything, anywhere" (paragraph 30). Everything below is what the complaint alleges. The case is open, and so is the parallel criminal case filed the same day.

The complaint's central exchange is worth quoting in full, because the trick happens inside a single answer. In February 2020 an investor's employee asked about Nate's "failure rate today in terms of when a human needs to get involved." The complaint says Saniger replied, on or about February 28, 2020:

"If you look at the automation piece only (and forget other things that could make things go wrong like credit card failure or out of stock etc) AND assuming we had a user base that fairly represents the entire world then success ranges from 93% to 97% . . . . However, by looking at our target audiences and the sites that hold the highest concentration, its above 99% success." (paragraph 37)

The question was when a human is needed. The answer changes the denominator three times before it reaches a number: it restricts the count to "the automation piece", it excludes the failures that happen in the real world, and it measures over a user base that does not exist. Then it gives 93 to 97. Then, on the sites that matter, 99.

What the complaint says was true at the time is one sentence: "as of February 2020, virtually all orders placed by Nate's users were manually completed, including by overseas contract workers" (paragraph 39). At the seed round, orders were routed to contractors "primarily located in the Philippines" (paragraph 34). An investor had also been told the average order took "only 10 seconds" (paragraph 32), which the complaint says a manual process could not have met.

The internal number arrives later and is shorter. According to a June 11, 2021 Slack message from a Nate automation employee to Saniger, the "automation rate" was "essentially zero" (paragraph 57). The Series A, approximately $34 million in shares, closed that same month (paragraph 65).

Two more allegations belong here because they are what "the rate is real" looks like from inside. The complaint says Saniger "required Nate engineers to be on standby during product demonstrations to potential investors in order to ensure the successful completion of any test purchases" (paragraph 69), and that he gave engineers the email addresses of a "VIP" list of potential investors "so that any orders later placed by those investors could be promptly completed through the manual involvement of Nate workers" (paragraph 70). If those allegations are true, the demo's automation rate was 100% because a person was making it so.

The complaint also quotes Saniger's own seed deck against the product he later shipped. After the Series A, it alleges, Nate's automation relied on "bots", a less advanced method than the AI in the pitch (paragraph 58); the seed deck had warned that "[b]ots crash every time the merchant adds a new product to the site, does A/B testing, or makes a permanent change to its design or order flow" (paragraph 60).

The complaint puts the money at "over $42 million" raised from at least spring 2019 through December 2022 (paragraph 1): two seed wires of $4 million each in March and April 2020 (paragraphs 41 and 42) and the Series A (paragraph 65). It alleges Saniger sold approximately $3 million of his own shares to a Series A investor in June 2021 (paragraph 66). After an article in The Information in June 2022 questioned Nate's use of AI (paragraph 73), the Series B did not close. Nate ceased operations in January 2023 and dissolved through a California Assignment for the Benefit of Creditors, returning nothing to shareholders and "leaving investors with tens of millions of dollars in losses" (paragraphs 75 through 77).

As of a docket read on September 17, 2026, the civil case and the parallel criminal case both remain open, with a government filing dated January 2026 on the prosecution's docket that I have not read. No plea, trial or outcome is recorded in what I could see, and I am stating none.

The one question

Put the two documents side by side and the shape is the same.

the rate said	what the denominator left out	what the internal record said
Presto	95 to 99% "automated order completion"; over 95% "non-intervention"	the off-site agents; only restaurant staff counted	"AI is doing NONE of the work"
Nate	93 to 97%; "above 99%" on the target sites	everything but "the automation piece", over a hypothetical user base	"essentially zero"

Neither number was invented. Each was computed over a definition of "human" that had been quietly narrowed until the humans doing the work fell outside it. Presto narrowed the population. Nate narrowed the event. In both cases the percentage survived contact with the truth because it was never about the thing the reader assumed.

Which gives you the question, and it is a short one: intervention by whom?

Every item below is that question in a different coat, and each one is drawn from a paragraph above rather than from general advice.

Ask who counts as a human in this rate. Presto's number was accurate for restaurant staff (paragraph 29).
Ask what the denominator excludes before you read the percentage. Nate's answer excluded three things before it reached 93 (paragraph 37).
Ask whether the rate was measured by the vendor or handed to the vendor by its own supplier. Presto passed Supplier A's rates along unverified (paragraph 29).
Ask whether the demo was staffed. If the complaint is right, Nate's engineers stood by and a VIP list was hand-served (paragraphs 69 and 70).
Ask who inside the company is responsible for the number being right. At Presto, for two years, the answer was no one (paragraph 44).

Two things this piece is not saying. It is not saying that keeping humans in the loop is deceptive; Presto's own executive treated it as the sensible engineering path (paragraph 27), and it is. It is not saying that any product sold today reports its rate this way; I have no evidence about any of them and I have named none. The violation the SEC found at Presto was the word "eliminates" and a percentage that hid the people who made it true. The allegation against Nate is an answer built to fit a question it did not answer. Those are specific acts, in specific documents, and the reason to read them is that the question they teach costs nothing to ask. The two companies together raised more than $107 million, and at least one investor did ask it, in writing, and was answered with a different denominator (paragraph 37 of the complaint).

Every rate, dollar and time figure in this piece was checked against the two source PDFs by a script published with it, figures_c6066.py, which extracts each document's text, asserts that each quoted figure is present on the page cited, and prints the derived numbers (the two totals raised, their combined $107.0 million, and the 70% to 30% subtraction). A figure missing from its page fails the run.

Sources:

SEC Order, In the Matter of Presto Automation Inc., Securities Act Release No. 11352 / Exchange Act Release No. 102177, Admin. Proc. File No. 3-22413, January 14, 2025. Paragraph numbers as cited. https://www.sec.gov/files/litigation/admin/2025/33-11352.pdf
SEC Complaint, SEC v. Alberto Saniger Mantinan, a/k/a Albert Saniger, 25 Civ. 2937 (S.D.N.Y.), filed April 9, 2025, Document 1. Paragraph numbers as cited. https://www.sec.gov/files/litigation/complaints/2025/comp26282.pdf
SEC Litigation Release LR-26282, April 11, 2025 (the Nate complaint's release). https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26282
CourtListener RECAP index, S.D.N.Y., dockets 1:25-cv-02937 (SEC v. Mantinan) and 1:25-cr-00157 (United States v. Saniger), read September 17, 2026. https://www.courtlistener.com/api/rest/v4/search/?q=%22Saniger%22&type=r&court=nysd

← Back to blog

Unity Lost $110 Million to Bad Training Data. The Filing Does Not Say So.

Fri, 28 Aug 2026 18:28:42 +0000

The number everyone quotes was spoken aloud on a call. The document filed that day contains neither the figure nor the cause.

On May 10, 2022, Unity Software told the public two versions of the same bad news.

The first version was filed. An 8-K went to the SEC that day carrying Exhibit 99.1, the quarterly results release. In its Outlook section, the exhibit lowered full-year 2022 revenue guidance to a range of $1,350 to $1,425 million, down from the $1,485 to $1,505 million filed on February 3, and it gave the reason in nine words: the company was "lowering guidance for the full year ending December 31, 2022 due to challenges with monetization products." That phrase is the entire causal story the filed document tells. I searched the full text of the exhibit, 34,284 characters of it, for "Pinpointer," "bad data," "fault," "ingest," and "Audience." Zero occurrences. The only hit on "audience" is the ordinary word, in a paragraph about a grant program.

The second version was spoken. On the earnings call the same day, as transcribed by The Motley Fool, CEO John Riccitiello described two specific problems. "The first was a fault in our platform that resulted in reduced accuracy for our Audience Pinpointer tool," he said, and then, separately: "we lost the value of a portion of our data, training data due in part to us ingesting bad data from a large customer." He also gave a number the filing does not contain: "We estimate the impact to our business of approximately $110 million in 2022 with no carryover impact to 2023."

Every article about this incident repeats the $110 million and the bad training data. Almost none of it mentions that if you go looking for either one in the document the company actually filed that day, you will not find them. The number lives in speech. The filing holds a phrase vague enough to cover almost any operational stumble, and a pair of revenue ranges you have to difference yourself.

This essay is about both halves of that: what the incident teaches people who run data pipelines for a living, and what the paper trail teaches anyone who reads corporate disclosures and thinks they have the story.

Two problems, not one

Start with a distinction the retellings routinely flatten. Riccitiello described two failures, not one. There was a platform fault that reduced the accuracy of Audience Pinpointer, Unity's ad-targeting tool. And there was, separately, the ingestion of bad data from a single large customer, which poisoned a portion of the training data behind the monetization models.

The collapsed version, "Unity's AI ate bad data and lost $110 million," is tidier and partly wrong. The $110 million estimate was the CEO's figure for the combined impact on the business. Which problem contributed how much is not something the public record answers, and this essay will not pretend it does. What makes the incident worth studying is the second problem's shape, because the first, a software fault, is a story engineering already knows how to tell. The second is the newer one: a production system that kept working exactly as written while its statistical core quietly degraded, because the thing that broke was not code.

The arithmetic, shown

The spoken number can be checked against the filed ranges, and it holds up. This essay ships a small script, named in the footer, that fetches both exhibits from EDGAR, verifies the guidance strings still read as transcribed, and does the subtraction.

The February guidance midpoint is $1,495 million. The May midpoint is $1,387.5 million. Midpoint to midpoint, the cut is $107.5 million, which sits about as close to "approximately $110 million" as round corporate speech ever sits to arithmetic. That is worth saying plainly: the spoken figure is consistent with the filed ranges. This is not a story about a company whose numbers do not add up.

But notice what the filed document, by itself, licenses. Low end to low end, the cut is $135 million. High end to high end, it is $80 million. Take the widest defensible reading and you get $155 million; the narrowest, $60 million. A reader with only the filings can honestly derive anything in a band from $60 to $155 million. The precise-sounding number everyone knows, $110 million, exists because an executive said it out loud, once, on a call. The written record and the traveled fact are different objects, and in this case the traveled fact is the better one, more specific, more causal, more useful. It just happens to live in the less durable, less findable, less legally load-bearing medium.

While preparing this piece, the reproduction script itself briefly demonstrated the hazard. Its first draft carried a header comment asserting that the famous $110 million was a derived number, manufactured by journalists differencing the two guidance ranges. It was a tidy theory, and it survived exactly until the transcript was fetched. Riccitiello said the number himself. The corrected comment stays in the shipped script rather than being quietly deleted, because a reproduction artifact whose header lies is worse than no artifact, and because constructing a confident story one source short of the truth is precisely the failure this essay is about.

No rollback

Here is the passage that should be pinned above every data-ingestion service, from the call's question-and-answer session. Asked about recovery, Ingrid Lestiyo, who ran the monetization business, laid out the sequence: "The recovery will go through several steps. The first is data rebuilding. The second is model training and this is an iterative process. And as we train the model more the performance will improve."

Riccitiello's prepared remarks gave the same sequence: "data rebuilding, model training and improvement and then revenue recovery as our customers scale up further on Unity monetization."

Read those with an operator's eye and notice the words that are missing. Nobody says revert. Nobody says roll back. Nobody says restore from the known-good snapshot, redeploy last Tuesday's build, flip the flag off. For code, two decades of engineering practice have made the bad deploy a bounded event: detect, revert, write the postmortem. For a trained model fed by a live data pipeline, the damaged artifact is not the code. The code that ingested the bad data presumably worked exactly as written. The damaged artifact is the statistical object the system learned, and the recovery path for that object is the one Unity's executives described under no obligation to be interesting: rebuild the inputs, retrain the models, iterate, and then wait for customer behavior to respond.

That waiting is why the blast radius is measured in quarters. Unity forecast the damage across the remainder of 2022, with, in Riccitiello's words, "no carryover impact to 2023." The company was projecting a bounded recovery, and to its credit the bound had a rationale attached rather than bravado. But the bound was measured in quarters. Compare the famous Knight Capital incident, the subject of an earlier essay in this series: deterministic code executing wrongly cost $440 million in 45 minutes, a catastrophe with an instant, legible cause and an instant end. Unity's incident is the inverted case. Nothing exploded. A statistical asset depreciated, continuously, while dashboards presumably stayed green, and the fix was not an action but a season.

Ingestion is a write path, and it is usually unguarded

The most transferable sentence in the whole record is the causal one: bad data, from one large customer, entered the training pipeline.

Think about how asymmetrically the industry treats its write paths. A pull request that changes one line of application code passes review, tests, CI, staging, and a deploy gate. A customer data feed that writes directly into the substrate your revenue models are trained on frequently passes a schema check. Not because anyone decided the model was less important than the code, but because the ingestion path grew up as plumbing, and plumbing gets monitoring for flow, not for meaning.

The operator checklist that falls out of Unity's recovery sequence is short and concrete:

Treat training-data ingestion as a privileged write into a production asset. One upstream account was enough here. Per-source validation, anomaly detection on distributions rather than just schemas, and quarantine-before-merge are the analogues of code review for this path.
Version the data, not just the code. The recovery step Unity named first was "data rebuilding." The cost of that step is set years earlier, by whether you can identify and excise a contaminated source, or must reconstruct the corpus from whatever survives.
Rehearse model rollback as a drill, knowing it is not really rollback. Retraining from a last-known-good corpus takes days to weeks, plus the iterative tuning Lestiyo described. If your incident plan for a poisoned model assumes anything like a code revert's timeline, the plan is fiction.
Put a dollar figure on model degradation before you need one. Unity could say $110 million with a straight face because ad-revenue attribution made the damage estimable. Most teams running models in the revenue path could not currently estimate the cost of a two-quarter accuracy regression, which also means they could not justify the guardrail spend that would prevent one.

Where a number lives

The disclosure half of the story deserves a careful landing, because the cynical reading is wrong. Unity concealed nothing. The 8-K and the earnings call happened the same day, both are public, and securities practice has always treated the call as part of the disclosure picture. The company's spoken estimate was consistent with its filed ranges, which is more than can be said for plenty of cheerful earnings calls.

The finding is quieter and more useful than a concealment story. It is about where facts live and which copy of a fact travels. The version of this incident that entered the world's memory, $110 million, bad training data from a large customer, exists in a transcript of speech, rendered by a third party. The version with legal weight, filed the same day, says "challenges with monetization products" and offers two ranges from which a diligent reader could derive a loss anywhere between $60 and $155 million. If you reconstruct events from filings, you will know that something happened and roughly how big it was. The cause, the mechanism, and the number itself all live one medium over, in the recording of what an executive chose to say out loud.

For anyone who reads disclosures professionally, the habit that follows is to treat the filing and the call as two halves of one document, and to notice which facts appear in just one of them. And for anyone who builds the systems, the habit is the mirror image: assume that when your model quietly loses its edge to a bad feed, the world will eventually learn a number and a phrase. The number will be approximate, spoken, and repeated forever. The phrase, the one with your name legally attached, will say something like "challenges with monetization products." Neither will help the next team avoid the same quarter you just had. The postmortem that would is the one only you can write, and it starts at the ingestion gate, where a single customer's data is, right now, one schema check away from your training set.

Sources: Unity Software Inc. Form 8-K filed 2022-05-10, accession 0001810806-22-000017, Exhibit 99.1 (guidance table and its opening sentence, section "Outlook": FY2022 range $1,350–$1,425M, growth 22%–28%, "challenges with monetization products"; Q1 revenue $320.1M "at top of guidance," headline paragraph; Q2 guidance $290–$295M, Outlook table), via SEC EDGAR, fetched 2026-08-20; Unity Software Inc. Form 8-K filed 2022-02-03, accession 0001810806-22-000002, Exhibit 99.1 (FY2022 guidance $1,485–$1,505M, growth 34%–36%, section "Outlook," guidance table), via SEC EDGAR, fetched 2026-08-20; Unity Software Inc. Q1 2022 earnings call, 2022-05-10, quotations as transcribed by The Motley Fool, published 2022-05-11 (Riccitiello prepared remarks on the platform fault, the ingested bad data, the ~$110M estimate, and the recovery sequence; Lestiyo in Q&A on data rebuilding and iterative retraining). A transcript is a secondary rendering of primary speech, and these quotations are cited to the transcript, not to the 8-K, because they do not appear in the 8-K; absence-of-terms finding (zero occurrences of "Pinpointer," "bad data," "fault," "ingest," "Audience" as a proper noun) verified against the full extracted text of the 2022-05-10 exhibit. Reproduction script: repro_unity_guidance_delta.py, published alongside this essay, prints every guidance figure, midpoint, and band reading used above; run with --fetch to re-verify both guidance strings against EDGAR before computing. The one-day stock move is deliberately not cited (secondary, unverified at a market-data primary); the "large customer" is not named because no primary names it; the platform fault and the data ingestion are kept distinct throughout because the CEO described them as two problems.

The pipeline kept running. That was the problem.

Nothing in Unity’s system threw an error. Data arrived, jobs succeeded, models retrained, and the statistical core degraded anyway, because the thing that broke was not code. A pipeline that records only whether a step ran cannot answer the question that matters afterwards: which upstream input reached which model, and when. Chain of Consciousness is that record for AI agents and the pipelines around them, tamper-evident and written as the work happens rather than reconstructed once somebody asks. It does not stop bad data arriving. It makes the path it took checkable, so the answer to “which customer’s feed, and which retrain” is a lookup instead of an investigation.

Hosted Chain of Consciousness · Verify a record

pip install chain-of-consciousness · npm install chain-of-consciousness