The Product Desk

The Numbers That Should Stop Your Next Sprint Planning

Nine independent sources this cycle converge on a single conclusion: AI agent security is in a state of systemic failure, and the data is now precise enough to put in a risk register. CodeWall's autonomous agent breached McKinsey's Lilli platform — used by 70% of employees, processing 500K+ prompts/month across ~20,000 internal agents — in two hours via SQL injection. Cost: $20 in API tokens. The agent found 22 publicly exposed API endpoints, several requiring no authentication, and discovered that Lilli's prompt layer was stored in the compromised database — meaning it could have rewritten all 95 system prompts with a single HTTP call. McKinsey's own scanners missed the vulnerability for two years in production.

This isn't an isolated incident. A scan of 1,808 MCP servers found 66% have exploitable issues, including tool-description prompt injection enabling zero-click remote code execution through IDEs. An audit of 30 AI agents found 28 using unscoped API keys stored in env files. CNCERT issued a formal government warning about OpenClaw prompt injection vulnerabilities that enable data exfiltration via auto-rendered link previews in Telegram and Discord — no user click required.

The Unsolvable Problem You Must Design Around

The most important strategic signal: prompt injection is confirmed as architecturally unsolvable with current techniques. Sam Altman stated a fundamental computer science breakthrough is needed. The UK's NCSC published that comparing prompt injection to SQL injection is actively misleading — it requires an entirely different defensive paradigm. CAICT's 2026 evaluations add a new dimension: chain-of-thought reasoning models are 200% more exploitable under adversarial attacks, and 6% of reasoning traces leak content that output filters catch. DeepSeek R1 has a trivial-to-trigger 'infinite output' vulnerability — specific prompts cause an unstoppable reasoning loop, creating a novel denial-of-service class.

The economics of offensive testing have fundamentally shifted. Your enterprise AI product will face autonomous reconnaissance at machine speed — not human speed.

The Emerging Defense Stack

Three architectural patterns are converging as the industry response: deterministic rule-based guardrails at the speed layer (sub-millisecond checks), probabilistic AI-based governance at the intelligence layer, and human-in-the-loop escalation at the trust layer. Onyx Security's $40M launch for an AI agent governance control plane validates this as a distinct product category. Anthropic published an attack-agent security blueprint. The recommended default posture: treat every AI agent as an untrusted client, route all requests through an identity/permission gateway, and implement reasoning-step token budgets with circuit breakers.

The Third LLM Paradigm Demands a New Playbook

Ben Thompson's latest Stratechery piece crystallizes the shift: we're in the third paradigm of LLMs — agents — and the competitive moat isn't the model, it's the harness. The evidence is specific: Anthropic's Opus 4.5 launched November 24, 2025 to relative silence. It was the harness upgrade weeks later that made Claude Code transformative. Microsoft validated this by launching its E7 enterprise tier at $99/seat/month — double the former top-tier E5 — and had to abandon model-agnosticism and share margin with Anthropic to ship it. If Microsoft can't make model-agnostic agents work, that's your signal.

Stripe Proves Infrastructure Is the Prerequisite

Stripe's disclosure is the most important production data point in this cycle. Their Minions agents merge 1,300+ PRs per week with zero human-written code, achieving a 2.5x throughput multiplier. But the decisive enabler wasn't any AI model — it was devboxes spinning up in under 10 seconds, a battery of 3 million+ tests, sub-5-second linting, and isolated QA environments, all built years before LLMs existed. Stripe caps agent CI retries at exactly 2 rounds — a deliberate 'good enough' philosophy where a partially correct PR polished by an engineer in 20 minutes is still a significant win.

The model isn't the moat — the platform is. Infrastructure maturity, not model selection, is the primary constraint on AI agent deployment ROI.

The Architecture Is Converging

Across a16z's $380B enterprise AI thesis, NVIDIA's agentic scaling framework, Anthropic's SDK (now shipping sub-agents and agent teams as first-class primitives), and the 16-feature agent scorecard, a common architecture emerges:

1. Semantic data model of business objects → governed actions with RBAC/approvals → thin composable apps → reusable 'intent packs'
2. Push-based AI (cron + autorun + multi-channel delivery) replacing pull-based chat — identified as 'the most slept-on feature in agent infrastructure'
3. MCP as the integration standard — Chrome DevTools ships it in M144, Stripe hosts ~500 MCP tools internally, 300+ pre-built servers in the Docker ecosystem
4. Multi-model routing within single workflows — cheap models for tool calls, frontier models for reasoning

The agent creation layer has commoditized (120+ agents under MIT license, 31K GitHub stars). Value is migrating to orchestration, proprietary data integration, and governance. Claude's SDK distinction between sub-agents (isolated context, fire-and-forget) and agent teams (persistent, peer-to-peer messaging, shared task lists) is the most important architectural decision framework for your next PRD.

The 'SaaS Extinction Test'

AI agents are bifurcating enterprise SaaS into survivors and the disrupted. The dividing line: data gravity. Salesforce survives because replacing it means migrating decades of customer records. PagerDuty is vulnerable because an AI agent can replicate its alerting logic in days. Salesforce and ServiceNow are building native AI agent layers to maintain 130%+ net revenue retention. Run this test on your own product.

The RAG Workaround Tax Just Got Eliminated

Anthropic's decision to offer 1M token context at standard pricing — no multiplier, no premium — on Claude Opus 4.6 and Sonnet 4.6 across AWS Bedrock, Google Vertex AI, and Azure Foundry is a market structure change, not a feature update. For two years, the implicit deal was: big context windows exist but they're expensive, so you build RAG pipelines, chunking strategies, and multi-call orchestration. That entire architectural assumption just got repriced to zero. The 78.3% score on MRCR v2 benchmark means retrieval accuracy in massive contexts is genuinely usable. Claude Code now defaults to 1M context for enterprise tiers. 600 images/PDF pages per request.

If you've been using RAG as a workaround for economic constraints that no longer exist, your competitor who just stuffs the whole document into a single 1M call will ship faster and fail less.

The 360x Pricing Spread Is Your Biggest Optimization Lever

The model pricing landscape now spans an extraordinary range:

Combined with the finding that context engineering and knowledge graphs cut token usage by up to 80%, the gap between a well-architected AI product and a naively built one isn't 20-30% — it's orders of magnitude. Additionally, the AWS-Cerebras partnership delivering 5x token throughput via disaggregated inference (Trainium for prefill, Cerebras WSE for decode) is now available via Bedrock.

Production Patterns From Billion-User Scale

Spotify generated 1.4 billion personalized narrative reports using a fine-tuned LLM, then distilled a smaller model for economic viability at scale. They built distributed pipelines and used automated LLM-based evaluation for accuracy and safety. This is the production pattern: fine-tune → distill → automate evaluation → ship. LinkedIn replaced demographic-based feed ranking with LLM-generated embeddings and a Generative Recommender using causal attention transformers — explicitly abandoning demographic features. If LinkedIn, with the richest professional demographic data on earth, says behavioral embeddings beat demographics, that's your signal to reassess your own personalization stack.

New Metrics for AI-Native Products

The traditional SaaS measurement stack is breaking. ARR is described as 'lying to you' for AI-native companies because token consumption is the hardest-to-fake engagement metric. DAUs become meaningless when AI agents interact via MCP instead of humans clicking buttons. Investors are shifting to gross profit per million tokens as the actual scorecard. If your product has AI agents as users, you need a parallel measurement system: tokens consumed, margin per inference, agent-vs-human interaction ratios.

AI Search Is a Structural Break, Not an Incremental Shift

Gartner's data is unambiguous: 94% of AI search citations come from non-paid sources, with earned media accounting for 82% and journalism alone at 20-30%. Over half of citations reference content published in the last 12 months, with rates peaking in the first week after publication. Gartner is advising CMOs to double PR and earned media budgets by 2027. If your product's top-of-funnel relies on paid search, Google Ads, or SEM, your visibility in the AI-mediated buying journey is actively eroding.

Reddit Is Your Shadow Competitor

The data is startling: Reddit outranks B2B SaaS vendors on 50-66% of shared keywords across three of four major verticals, capturing 950K+ monthly searches before any vendor appears. Reddit dominates long-tail queries (73-100% win rate on 6+ word searches) — exactly the high-intent, consideration-stage queries where your conversion rates should be highest. Just five subreddits generate 3,709 keyword rankings and 1.1M+ monthly searches. Whatever sentiment and recommendations exist in your relevant subreddits are now your de facto product positioning for a massive chunk of organic discovery.

A prospective buyer searching for your product category is more likely to land on a Reddit thread than your website. If you don't have a Reddit monitoring strategy, you're flying blind at the highest-intent moment.

Google Maps Consolidates Local Discovery

Google's 'Ask Maps' Gemini integration transforms Maps from navigation to an AI concierge. Google owns the user's intent, the data (reviews, photos, search history), and distribution (pre-installed on every Android). Adding Gemini collapses the journey from 'find a good restaurant → open Yelp → read reviews → switch to Maps' into a single interaction, with Street View previews and parking suggestions. When asked about sponsored placements, Google PM Andrew Duchi gave a notably vague answer — the absence of a 'no' is a roadmap signal. There's a narrow window to position on transparent, unbiased AI recommendations before Google monetizes this surface.

New Distribution Surfaces Are Forming

AI chat interfaces are becoming primary distribution channels. Experian launched a credit score tool inside ChatGPT targeting 18-34 users who've never visited a credit bureau. Perplexity built a portfolio analyzer with FactSet, S&P Global, and LSEG data via Plaid. AWS and Visa are building network-agnostic payment rails for AI shopping agents. The pattern generalizes: for every product category, there's a version of 'our target users are already inside AI interfaces but have never used our product.'