The Board Room

The Category Just Crystallized

RSAC 2026 wasn't a trade show this week — it was a coordinated industry admission that agentic AI has outrun its governance infrastructure. Google, Cisco, Palo Alto Networks, and the Cloud Security Alliance simultaneously launched AI agent security products and frameworks. Cisco's Duo Agentic Identity treats AI agents as full identities with policy enforcement. Palo Alto's Prisma AIRS 3.0 unifies agent security across identity, posture, and runtime. The CSA launched an entire nonprofit — CSAI — for the 'agentic control plane.' When four players converge on the same problem in the same week, you're watching a market category crystallize.

Whoever owns your NHI governance layer will have a gravity pull on your broader security architecture. This is a platform decision masquerading as a security tool purchase.

The Protocol Layer Is Broken by Design

The most alarming finding: MCP — Anthropic's Model Context Protocol, increasingly the standard for connecting AI agents to tools — has no versioning, content hashing, or approval-time snapshots. A malicious MCP server can silently rewrite a tool's description and behavior between the moment a user approves it and the moment the agent executes it. Neither Datadog nor LangSmith can detect this because they record what was called, not whether it matched what was authorized. This creates direct compliance gaps under HIPAA, SOC 2, and EU AI Act Article 12.

Compounding this, XM Cyber mapped eight validated attack vectors in AWS Bedrock where a single over-privileged identity can hijack agents, strip guardrails, poison prompts, and exfiltrate data — all without triggering a redeployment. The cloud AI security conversation needs to shift urgently from model security to permissions and integration security.

Autonomous AI Bots Are Already Attacking Your Supply Chain

Step Security revealed that an AI bot ('hackerbot-claw') systematically compromised Trivy's CI/CD pipeline, stole Personal Access Tokens, and pushed malicious code to GitHub Actions, DockerHub images, and VS Code extensions — hitting Microsoft, DataDog, and CNCF projects simultaneously. Aqua Security detected the compromise and rotated secrets, but acknowledged the process 'wasn't atomic and attackers may have been privy to refreshed tokens.' The attack recurred on March 19 and March 22.

Separately, a former deputy national security advisor confirmed that AI crossed from accelerating known attacks to generating novel exploits in 2026 — new tactics and techniques that don't appear in any historical threat database. Sysdig's Langflow research showed a critical RCE was exploited within 25 hours of disclosure, with attackers building working exploits from the advisory description alone.

The Social Engineering Threat Model Inverted

Mandiant M-Trends data reveals a complete inversion: vishing now accounts for 11% of investigated incidents while email phishing collapsed from 22% (2022) to 6%. Organizations still over-indexed on email security are deploying capital against a shrinking threat. Meanwhile, a systemic Microsoft OAuth device authentication exploit is granting attackers 90-day persistent access that bypasses MFA entirely, with hundreds of businesses already compromised.

The connecting thread: your AI agent strategy and your security strategy must be unified under single executive governance this quarter. The NHI platform choice is being made now, and it will have the same gravity as your cloud platform choice had a decade ago.

The New Competitive Axis

A new fault line is dividing enterprise software: open vs. closed on AI agent access. The split is already visible across platforms you likely depend on:

This is the most consequential enterprise software dynamics shift since the API economy. The 'security' justification for restriction is partially legitimate — Workday holds sensitive HR and financial data — but the pattern of restricting broad access while building first-party agent tools and planning to charge for third-party access reveals business model protection is equally motivating.

The Computer-Use Wildcard

Here's what should keep every SaaS CEO awake: Anthropic's computer-use Claude operates at the screen level — clicking buttons, navigating menus, reading data — exactly as a human contractor would. If Claude can operate any application through its GUI, then MCP restrictions, API rate limits, and curated partner programs become irrelevant. The agent simply uses the software the way a human would.

Any monetization strategy premised on controlling a protocol-level chokepoint has a shrinking half-life when the alternative is a screen-level bypass.

Anthropic shipped this from acquisition to product in four weeks via the Vercept deal — a velocity that compresses the window for competitors to respond. The strategic implication for enterprise SaaS: the smart play isn't gatekeeping, it's making your platform so valuable at the data and workflow layer that customers want to connect agents through official channels because the experience is dramatically better than screen-scraping.

Procurement Implications Are Immediate

The emerging pattern mirrors what happened with API availability a decade ago. Arcade.dev's ToolBench ranking — biased though it may be — is a leading indicator that 'agent accessibility score' will appear on enterprise RFP checklists within a year. For your organization right now:

• Your vendor selection today determines your automation ceiling tomorrow
• Lock agent access terms into contracts before vendors like Workday finalize their pricing models
• Evaluate computer-use agents (Claude, OpenClaw) as a hedge against platform gatekeeping
• Products without clean, well-documented APIs become second-class citizens in an agent-orchestrated workflow

The companies that audit their stack now, negotiate agent access terms into contracts, and build orchestration capabilities across open and closed platforms will have a decisive operational advantage over those that discover this dynamic in 2027.

The Number That Changes Everything

The most devastating data point in AI this week: Microsoft has 15 million Copilot paying seats on a 450 million commercial customer base — 3.3% penetration. Microsoft had every structural advantage: the install base, the enterprise relationships, the bundling power, the OpenAI partnership. And it hasn't worked. This is the strongest evidence yet that distribution moats do not transfer to AI products. Users adopt AI when it genuinely transforms their workflow, not when it's bundled. This is a product quality problem, not a distribution problem.

The consumer numbers tell the same story. ChatGPT's 440M DAU holds ~80% of the top-four market. Microsoft Copilot at 6M DAU has been surpassed by Claude at 9M — despite Claude being nowhere near a consumer-focused product. Meanwhile, Microsoft's Azure AI platform head (Eric Boyd) defected directly to Anthropic. This is not turnover; this is institutional decay in the divisions that matter most.

OpenAI's Three-Pronged Response

OpenAI is executing a rapid strategic pivot with three simultaneous moves:

1. Advertising: Hired Dave Dugan (10+ year Meta ad sales exec) as VP of Global Ad Solutions. Criteo partnership with $50K-$100K entry packages. Expanding ads to all US free-tier users imminently. ChatGPT has 900M weekly active users but only ~5% pay — the subscription ceiling is confirmed.
2. PE financial engineering: Guaranteeing 17.5% minimum returns to PE firms (TPG, Advent) through JV structures, in exchange for deploying AI across portfolio companies. This bypasses the traditional enterprise sales motion entirely — AI stack decisions get made at the LP level, not the CTO level.
3. Superapp consolidation: Fidji Simo's internal memo acknowledges too many products were degrading quality. ChatGPT, Codex, and Atlas are merging into a single desktop application — driven explicitly by Claude Code's competitive pressure on developer mindshare.

An ad-supported AI assistant has fundamentally different alignment than a subscription-supported one — the former optimizes for engagement, the latter for task completion. Enterprise buyers need to understand this distinction.

The Critical Vulnerability

Early advertisers literally cannot prove ChatGPT ads work. Conversational AI is a fundamentally different advertising surface than feed-based social media or search. Intent signals are different. Attention patterns are different. OpenAI's expansion to all free-tier users addresses the impression volume problem but not the attribution problem. If OpenAI cracks conversational advertising, it creates a trillion-dollar category. If it can't, the $17B 2026 revenue target has a structural weakness.

Meanwhile, the PE JV terms raise questions. The analysis from multiple sources is blunt: no healthy business offers 17.5% guaranteed returns. Whether that assessment is fully fair or not, the signal is clear — OpenAI's capital needs are outrunning conventional sources. Combined with IPO risk disclosures that flag Microsoft dependency as material risk, this is a company whose strategic priorities are being reshaped by capital burn in ways that will affect product direction and pricing within quarters.

For enterprises: any architecture that assumes OpenAI and Microsoft will remain aligned is building on a fault line. Multi-vendor AI strategies are now a fiduciary obligation, not a luxury.

The Edge AI Memory Wall Just Fell

Liquid AI published the most significant on-device AI result to date: a 1.2B-parameter model running at 70 tokens/second on a Samsung Galaxy S25 CPU in just 719MB of total memory. For comparison, Meta's Llama 3.2 1B consumes 524MB in KV cache alone at the same context length — before loading model weights. At 128K tokens, Llama hits 2GB. On a phone, that's game over.

The model isn't the story. STAR — Liquid AI's automated architecture search system — is the strategic asset. STAR encodes neural network architectures as hierarchical genomes and evolves them using multi-objective optimization against actual hardware performance on physical devices. When Qualcomm ships a new Snapdragon, STAR re-evolves. This is a compounding capability, not a static product.

What STAR discovered is strategically uncomfortable: it completely rejected every state-space model variant (Mamba, S4, Mamba-2) for edge deployment. The SSM hype cycle, which positioned these as the transformer's successor, collides directly with the empirical result that boring depthwise convolutions paired with sparse attention outperform every SSM configuration on phone hardware.

When capable models run on-device at zero marginal inference cost, the highest-volume API calls migrate to the edge — hollowing out the volume base that makes cloud inference economics work.

AI Foundation Models for Physics

Arena Physica (Founders Fund-backed) is launching a foundation model for electromagnetic field design claiming 18,000x simulation speedups and 10x cost reduction for phased arrays. The US Navy reportedly lacks counter-drone radar at scale because Raytheon charges nearly a billion dollars per ship-based system. AI-generated hardware designs are producing 'alien geometries' that outperform human designs — the AlphaGo moment for physical engineering. Critically, analog silicon doesn't need bleeding-edge TSMC fabs, reducing geopolitical supply chain risk.

Capital Is Following the Thesis

Jeff Bezos raising $100B to buy and automate manufacturing companies is the strongest signal that the smart money believes AI's largest near-term value creation isn't in building new AI products but in making physical-world businesses dramatically more efficient. The SpaceX/Tesla/xAI TERAFAB joint venture — the largest chip fab ever at 1TW/year — creates a vertically integrated AI competitor (compute + distribution + connectivity + models) unlike anything the market has seen.

For strategic planning: the pattern of 'AI foundation model for [physics domain]' will repeat across fluid dynamics, thermodynamics, acoustics, and materials science. Organizations that build integration muscle for AI-generated physical designs now will compound that advantage. Those that wait will find themselves in the position of companies that dismissed cloud computing in 2008.