The Board Room

The Recursive Threshold Has Been Crossed

OpenAI's GPT-5.5 isn't just another model release — it's the first commercially visible instance of recursive self-improvement, where AI systems materially contributed to building their own successors. The 7-week gap between GPT-5.4 and GPT-5.5 is the hard evidence. Sam Altman's statement that OpenAI is 'increasingly an AI inference company' deserves the same strategic weight as Nadella's cloud-first pivot — it signals OpenAI sees model capability commoditizing and is capturing value at the infrastructure layer instead.

GPT-5.5 was co-designed for NVIDIA GB200/300 systems, reportedly optimized its own inference stack, and uses fewer tokens per task than its predecessor. Priced at $5/$30 per million input/output tokens, it's positioned as half the cost of competing frontier coding models. But pricing is only half the story.

DeepSeek's Same-Day MIT Counter Changes the Math

Within 24 hours, DeepSeek dropped V4 — a 1.6T parameter model under MIT license with 49B active parameters, novel hybrid attention yielding 4x compute efficiency, and Flash pricing at $0.14/$0.28 per million tokens. Day-zero vLLM and SGLang support means self-hosting is immediately viable. Separately, Z.ai's GLM-5.1 leads SWE-Bench Pro over GPT-5.4 and Claude Opus 4.6 at 72% lower input cost.

The capability gap between paid frontier and free open-source has narrowed to the point where vendor selection becomes a governance decision, not a capability decision.

Multiple independent analyses confirm that for production coding agents — the highest-value enterprise AI use case — open-weight models now match closed-source performance. DeepSeek V4-Pro scores 80.6% on SWE-Bench Verified. Its 90% reduction in KV cache usage makes million-token context economically viable for the first time.

What This Means for Your Strategy

Anthropic trading at $1T on secondary markets while OpenAI sits at $880B signals the market no longer treats frontier AI as winner-take-all. But both valuations rest on pricing power that free open-weight models are eroding daily. The Sophia optimizer, which cuts LLM training steps by 50%, will further accelerate commoditization if validated.

The strategic imperative: reframe model selection from a procurement decision to an architecture decision. Multi-model orchestration, self-hosting for cost-sensitive workloads, and provider-agnostic agent infrastructure aren't aspirational — they're table stakes. Companies treating this as model-picking will be structurally disadvantaged against those building inference engineering as a core capability.

Three Platforms Moved Simultaneously

April 24 was the most consequential single day in enterprise AI since ChatGPT's launch. Google absorbed Vertex AI — its entire ML platform — into the Gemini Enterprise Agent Platform, bundling low-code Agent Studio, governance infrastructure (Agent Identity, Registry, Gateway), and a persistent Memory Bank for multi-day workflows. Hours later, OpenAI released Workspace Agents in ChatGPT, offering Codex-powered team agents that integrate with Slack, Drive, Salesforce, and Notion — running even when users are offline. Anthropic shipped filesystem-based memory for Claude Managed Agents with auditable, permission-scoped, exportable state.

These aren't incremental updates — they're strategic repositionings. All three companies concluded the agent platform, not the model, is the defensible position.

Codex Is No Longer a Coding Tool — It's a Work OS

OpenAI transformed Codex from developer tool into a general-purpose work automation platform with browser control, document handling, OS-level dictation, and a 'guardian agent' pattern where secondary agents validate outputs before requiring human approval. The defunct Prism product was folded in. This is superapp consolidation — every SaaS workflow accessible via a web browser is now within Codex's automation surface.

When every major platform converges this aggressively, the prompt-response era is over, and every enterprise application architecture designed around it needs revision.

The Infrastructure Layer Is Crystallizing

Cloudflare launched Agent Memory (five-channel parallel retrieval) and Email Service (giving agents their own inboxes) while expanding its Agents SDK — positioning as a potential 'AWS for agents.' The SAP-Google Unified Data Foundation embeds Gemini into SAP's installed base with zero-copy BigQuery sharing and a claimed 54% TCO reduction. Band raised $17M for agent-to-agent orchestration. Anthropic's early enterprise results — Rakuten's 97% error reduction, Wisedocs' 30% speedup — are the first credible ROI data points for agentic AI in production.

The Lock-In Calculus

OpenAI's Workspace Agents are free until May 6, then shift to credit-based pricing — a classic land-grab tactic. As agents accumulate persistent memory, institutional context, and workflow-specific state, switching costs will dwarf anything seen in the SaaS era. The divergence between OpenAI (maximum autonomy, consumer focus), Anthropic (enterprise governability, auditable memory), and Google (data infrastructure integration, governance stack) is the defining axis. Smart enterprise buyers maintain positions in both OpenAI and Anthropic ecosystems while evaluating Google's data-layer play.

AI Vulnerability Discovery Just Leapt 12x in One Generation

Mozilla deployed Anthropic's Claude Mythos Preview against Firefox 150 and found 271 security issues, with 40+ warranting CVE designation. The previous-generation Opus 4.6 found 22 issues in Firefox 148. That's a 12x improvement in a single model generation. Mozilla's CTO: 'So far we've found no category or complexity of vulnerability that humans can find that this model can't.' If every major vendor runs AI audits and CVE volume increases 10-20x, your triage processes and patch management SLAs will break.

Autonomous Offense Is Now Production-Grade

Researchers demonstrated Zealot, a multi-agent AI system that autonomously executed a complete GCP penetration — from network recon through SSRF exploitation, service account token theft, privilege escalation via storage.objectAdmin, to BigQuery data exfiltration — with a supervisor coordinating three specialist agents. Separately, LMDeploy was weaponized in 12 hours 31 minutes without public exploit code, with attackers port-scanning AWS metadata services in an 8-minute recon session. The cost of sophisticated cloud attacks dropped by orders of magnitude.

Every IAM misconfiguration, every overly permissive service account, every unpatched SSRF is now discoverable and exploitable at machine speed.

The Supply Chain Is Targeting Your AI Tooling

The Bitwarden CLI npm hijack explicitly targets Claude and MCP configuration files alongside GitHub tokens and cloud secrets — the first clear signal that AI development infrastructure is on the standard exfiltration checklist. ConsentFix v3, originally a Russian APT29 technique, is now a fully productized criminal toolkit that bypasses MFA, passkeys, and device compliance checks. Meanwhile, Chinese APTs achieved firmware-level persistence on Cisco firewalls that survives both reboots and patches — CISA issued emergency reimaging directives.

Insurers Are Walking Away

QBE and Beazley are considering capping AI-related incident payouts to as low as 5% of total losses. When Berkshire Hathaway and Chubb also won approval to drop AI coverage, the message is clear: the world's most sophisticated risk underwriters have concluded AI risk is not insurable at commercially viable premiums. If your risk model assumes cyber insurance covers AI-related breaches at face value, you're carrying unpriced risk. Companies with balance sheets to self-insure gain structural deployment advantage.