ClarityBeta

Product & Strategy

The Product Desk

8 min read · 1,648 words · 4 moves to watch
The Signal

Kyle Poyar's survey of 230 enterprise software firms shows hybrid pricing (subscription +

It's whether your product can measure and attribute the outcomes your AI features produce well enough to defend an invoice by Q2. Instrument your top 3 outcome events before the full report drops May 14.

In Play

  1. Outcome-Based Pricing Requires Instrumentation This Sprint

    Hybrid pricing moved 25%→37%→47% projected. Pure outcome-based moves 5%→31%. Monday.com went from 20% headcount growth to flat in one quarter, shipping usage-based AI credits with per-user tracking. ServiceNow's COO says outcome measurement is 'contractually impossible' while FedEx's CDIO says vendors are already doing it. The gap: you can't price what you can't measure.

    Ask Clarity

  2. Sub-200ms Full-Duplex Kills Turn-Based Voice UX

    Thinking Machines shipped TML-Interaction-Small: 276B params (12B active MoE), sub-200ms continuous multimodal input/output, eliminating VAD-based turn detection entirely. Beats GPT-Realtime-2 and Gemini 3.1-Flash on benchmarks. John Schulman: tasks that needed special-purpose systems become zero-shot when the type signature is continuous audio+video+text. Any voice feature assuming turn-taking has a two-quarter shelf life.

    Ask Clarity

  3. Supply Chain Attacks Hit AI Development Stack Simultaneously

    Three concurrent supply chain attacks: 84 TanStack npm packages compromised (12M+ weekly downloads), Ollama CVE-2026-7482 exposing 300K servers' heap memory via 3 API calls, and a fake HuggingFace 'OpenAI Privacy Filter' repo hitting 244K downloads before detection. TeamPCP campaign has been working through CI/CD tools since February. Trusted publishing provided zero protection.

    Ask Clarity

  4. SDK/API Layer Becomes Contested Platform Territory

    Anthropic is acquiring Stainless for $300M+ — the SDK generator used by OpenAI and Google. Simultaneously, AI agents are becoming first-class API consumers alongside human developers. The layer between models and developers is no longer commodity plumbing — it's strategic infrastructure. A 4-year-old dev tools startup commanding $300M signals the spec layer is where leverage accrues.

    Ask Clarity

  5. AI Code Output ≠ Productivity — The Gap Is Quantified

    Pragmatic Engineer confirms: AI generates 100x more code output but ~1x actual productivity gain. Amazon mandated 80%+ AI tool adoption and staff gamed MeshClaw token leaderboards. A Kubernetes dashboard vibe-coded with AI required a full Rust rewrite. Shopify's River agent only works in public channels — optimizing for org learning, not individual velocity. The metric that matters: code still in main after 30 days.

    Ask Clarity

Deep Dives

Outcome-Based Pricing: The Measurement Sprint That Decides Your 2027 Revenue Model

The Market Moved. The Telemetry Didn't.

A pricing manager at a mid-market SaaS company opened her per-seat line item three times last week. The buyer on last month's call had asked her a question she couldn't answer: what happens to the seat count when the AI agent does the work instead of the human? She is not stuck. She is waiting for the first competitor to move. Kyle Poyar's survey of 230 enterprise software firms suggests that move is weeks away, not quarters.

Hybrid pricing moved from 25% adoption to 37% in a single year. Pure outcome-based is projected to jump from 5% to 31% by mid-2029. The full report drops May 14.

Two Executives, Two Different Problems

ServiceNow COO Amit Zavery says outcome measurement is "contractually impossible" because a contract cannot define what the outcome would have been. FedEx CDIO Vishal Talwar says vendors are already doing it, tied to business metrics FedEx wants to hit. Zavery is describing a product problem. Talwar is describing a sales problem a vendor already solved for him. The team that ships outcome attribution infrastructure in the next 18 months walks into CFO offices with "your AI completed 10,000 tasks worth $X each" while competitors defend flat fees.

Monday.com Is Showing the P&L Shape in Public

Monday.com moved from 20% planned headcount growth to flat in under 6 months, explicitly citing AI productivity gains. Revenue growth decelerated from 27%+ to 19-20%. Stock is down 48% YTD. The CRO announced customers can now see which employees consume AI credits. That is the metering, attribution, and billing substrate for usage-based AI pricing being built in production. A team shipping AI features without that instrumentation is not shipping a feature with a missing dashboard. They are shipping a feature they cannot reprice later without a migration.

The 2x2 for This Sprint

Buyer procurement asks for outcomesBuyer hasn't asked yet
Product measures outcomesPrice on outcomes NOW — charge more than feels comfortableMove to outcomes anyway — 37% becomes 50% next year
Product only measures activityShip subscription + cap, publish the cap publicly (FedEx buyers will ask)Instrument outcomes this quarter — you're building the pricing architecture for 2027

A third of software firms say outcome-based prices will be hard for customers to forecast. 20% worry it won't expand revenue fast enough. Those are real concerns. They are also engineering problems with known solutions, not structural blockers. The cell to avoid is the one most roadmaps drift into by default: shipping outcome pricing before the telemetry exists to defend the invoice. That conversation ends in a credit memo.

What to do

  1. Identify and instrument your top 3 outcome events (e.g., ticket resolved, contract generated, invoice approved) in the current sprint

  2. Model revenue impact of three pricing scenarios: current per-seat, hybrid subscription + usage cap, and pure outcome-based by end of May

  3. Interview 5 enterprise customers about which AI outcomes they'd pay for and how they'd measure them before Q3 planning

Three Simultaneous Supply Chain Attacks — Your AI Build Pipeline Is the Target

The Scope Is Not One Incident — It's Three

A developer pulled a routine dependency update last week. The build went green. Nothing looked wrong. Across the ecosystem this week, three simultaneous supply chain campaigns are harvesting credentials from AI development stacks specifically:

  1. TanStack npm compromise: 84 malicious package versions across 42 packages (12M+ weekly downloads). A Bun-based worm exploiting optionalDependencies + prepare hooks to steal GitHub tokens, npm tokens, CI credentials, and cloud secrets. Trusted publishing provided zero protection.
  2. Ollama CVE-2026-7482: 300,000 exposed servers leaking heap memory — user prompts, system prompts, API keys, and customer contracts — via just 3 API calls. No authentication required.
  3. Fake HuggingFace repo: "OpenAI Privacy Filter" hit #1 on the platform with 244K downloads before identification as an infostealer linked to the Silver Fox/ValleyRAT campaign.
The TeamPCP campaign has been systematically compromising CI/CD security tools for 3+ months — Trivy → GitHub Actions → OpenVSX → Jenkins — with each attack building on credentials stolen from the previous one.

Why This Hits AI Teams Harder

AI development stacks have uniquely broad attack surfaces: model weights pulled from registries without signing verification, CI/CD pipelines with production credentials running third-party plugins, and local inference servers (Ollama) that graduated from prototype to production without security review. The mental model "local equals secure" is now disproven in three API calls.

The Specific Checkmarx Jenkins Action

The Checkmarx Jenkins AST Scanner plugin version 2026.5.09 (published May 9) contains a confirmed backdoor. Roll back to 2.0.13-829.vc72453fa_1c16 from December 2025 immediately. SOCRadar confirmed the compromise. Auto-updating CI/CD plugins are a single point of failure for everything downstream.

The Fix Has Two Layers

Immediate (this week): Audit dependencies against TanStack affected versions. Check for Ollama instances anywhere in your stack. Verify HuggingFace model provenance. Rotate all CI/CD tokens and cloud secrets if any match is found.

Architectural (this quarter): Pin all CI/CD plugins to reviewed versions with hash verification. Treat model artifacts with the same rigor as code dependencies — provenance verification in the pipeline. Separate build-time from production credentials. GitHub Actions defaults systematically trade security for convenience — audit for injection paths and unnecessary trigger permissions.

What to do

  1. Run emergency dependency audit against TanStack packages and Ollama instances across all environments — rotate exposed credentials immediately

  2. Verify Checkmarx Jenkins AST Scanner is not at version 2026.5.09 — roll back to 2.0.13-829 if present and rotate all Jenkins runner secrets

  3. Add model provenance verification to your ML pipeline acceptance criteria — no HuggingFace model enters build without hash verification

  4. Pin all CI/CD plugins to reviewed versions with SHA verification and separate build-time from production credentials by end of quarter

Sub-200ms Full-Duplex: The Interaction Model That Makes Turn-Based AI Look Dated

What Shipped This Week

Thinking Machines released TML-Interaction-Small, a 276B parameter model (12B active via MoE) that handles images and audio in under 200ms using encoder-free early fusion, emitting "time-aligned microturns" instead of waiting for the user to finish a sentence. It beats GPT-Realtime-2 and Gemini 3.1-Flash on BigBench Audio, IFEval, and FD-bench. John Schulman put it plainly: tasks that previously needed special-purpose systems become zero-shot when the type signature is continuous audio+video+text → audio+text.

When round-trip latency was 800ms, a walkie-talkie model was the honest design. Under 200ms, the model listens while it speaks. The user interrupts without the system losing its place. That is a different product.

The Architecture Pattern Worth Stealing

Here is what users actually do with a voice assistant: they interrupt, they talk over it, they restart mid-sentence. Here is what product decks assume they do: wait politely through a 5-15 second response. The dual-model design closes that gap. A lightweight foreground model carries conversational presence at sub-second latency. An asynchronous background model handles the heavier reasoning. A single-model round-trip is now the thing that needs a justification, not the default shape to start from.

Simultaneously: OpenAI Realtime Translate

OpenAI shipped three Realtime models the same week: Realtime 2 (voice-to-voice), Realtime Translate (70 input → 13 output languages), and Realtime-Whisper for live STT. Real-time audio translation is now a commodity API call at $0.0X/minute. The roadmap question is no longer whether to build it. It is which markets that failed the localization business case six months ago clear the bar today.

Which Features Are Under Threat

Content-Driven ValueFlow-Driven Value
Turn-Based OKDictation, command, single-shot Q&A ✓⚠️ Tutoring, coaching, support — UNDER THREAT
Full-Duplex RequiredLive translation, meeting assistTherapy, sales calls, pair programming — NEXT WAVE

The pattern worth planning around: a continuous interaction layer for real-time exchange, paired with autonomous agents doing the slow work in the background. The metric has to change with the architecture. Session length goes up when the UX gets worse and down when it gets better. Time-to-first-useful-response and interruption recovery rate are the numbers to steer by.

What to do

  1. Audit your voice/multimodal features for turn-based assumptions — flag which features would be fundamentally different with continuous-time interaction

  2. Prototype the dual foreground/background model pattern for your highest-engagement AI feature this quarter

  3. Evaluate OpenAI Realtime Translate API for your highest-traffic multilingual segment — scope a prototype sprint

Anthropic Buys Stainless for $300M — The API Layer Is No Longer Neutral

What Was Acquired and Why It Matters

Anthropic is buying Stainless, a 4-year-old startup that generates typed SDKs for API products, for at least $300 million. Stainless also powers API access for OpenAI and Google. The thing being pitched is "developer experience." The thing being done is pulling a shared dependency out from under two direct competitors.

What a developer actually does with a model provider is generate a typed SDK in their language of choice, paste it into a service, and never look at it again. The model gets swapped every eighteen months. The SDK gets touched every day. Owning the part that gets touched every day is worth $300M.

The Agent-as-Consumer Shift

Agents like Claude Code and OpenClaw now write the calls humans used to write. They need fast, reliable programmatic access and they serve a second persona that operates at machine speed and switches providers the moment an error message is unclear. Anthropic decided owning that interface layer was worth $300M rather than renting it. Codex Skills (one-click installable agent capabilities) and Notion Skills (database-as-app-store with two-way agent sync) show the same pattern from a different angle. The agent skill registry is becoming a platform primitive.

What This Means for Your API Surface

For any product exposing an API, the useful question is whether an agent can discover, parse, and compose the capabilities without a human in the loop. The sub-10% non-programmer Skill setup rate that a16z's Olivia Moore flagged on Claude is the UX gap in plain sight. Teams that ship agent-consumable interfaces in the next 2-3 quarters will sit where mobile-first products sat in 2010: early to a surface most competitors are still treating as secondary.

The Dependency Audit

For teams currently using Stainless to generate SDKs, the vendor is now owned by one of the three model providers they support. The migration question is not theoretical. It is whether Anthropic will keep shipping neutral, high-quality SDK support for OpenAI and Google after close. The safe move is to make the OpenAPI spec good enough that any generator produces a client worth shipping. The spec is the product. The generator is replaceable.

What to do

  1. Audit your SDK/API dependency on Stainless or similar generators — document switching cost in engineer-hours and create contingency plan

  2. Add 'AI agent' as an explicit API consumer persona in your next API design review — audit for machine-readability, structured outputs, and webhook support

  3. Evaluate whether your product should ship as a Codex Skill or Notion Skill — assess net-new distribution vs. cannibalization of existing channels

The bottom line

Your AI features need to answer three questions this week that they couldn't dodge last week: Can you measure the outcome well enough to price it (37% of the market already can)? Can you prove your build pipeline wasn't compromised (300K Ollama servers and 84 TanStack packages say probably not without checking)? And is your voice/multimodal architecture ready for the moment a competitor ships sub-200ms full-duplex interaction against your turn-based features? The common thread: instrumentation is the new moat — teams that can measure outcomes, verify supply chains, and track interaction quality own the pricing conversation, the security conversation, and the product conversation simultaneously.