The Board Room

The Collapse Is Measured, Not Hypothetical

TrustedSec pointed LLMs at five commercial EDR products and found the same architecture under each one: YARA-style rules, behavioral logic, allowlists, Lua scripting engines that decrypt in a single pass, and local ML classifiers. Work that used to require a skilled reverse engineer for weeks now takes days with AI assistance. The reasonable skeptic will note that endpoint detection was never supposed to be the last line. The reasonable skeptic is correct. What the skeptic does not explain is why the entire category was priced and deployed as if obscurity were a control, because the obscurity just evaporated for an order of magnitude more adversaries.

The UK AI Security Institute confirmed that Anthropic's Mythos cleared both simulated attack ranges, the first model to achieve full autonomous network takeover. OpenAI's GPT-5.5-cyber cleared one. These are not benchmarks. They are operational demonstrations that a model can now find, chain, and exploit end-to-end.

The Timeline Has Compressed Beyond Recovery

PraisonAI was exploited in the wild 4 hours after disclosure. Microsoft's MDASH found 16 exploitable flaws in a single Patch Tuesday using multi-model analysis. Mozilla found 271 real bugs in Firefox 150 using Claude Mythos with a custom harness, including sandbox escapes and use-after-free vulnerabilities that fuzzers had missed.

A patch window measured in months because procurement needs months is a window calibrated for a world where weaponization was the slow step. Weaponization is no longer the slow step.

The AI infrastructure layer is now actively targeted. LiteLLM was added to CISA's Known Exploited Vulnerabilities catalog. A single Raspberry Pi honeypot dressed as an AI stack was indexed by Shodan in 3 hours and absorbed 113,000+ requests in one month, with 175 active hijacking attempts in the final week. 23% of the traffic targeted AI-specific endpoints. The toolchain evolved mid-experiment to detect and evade the honeypot.

Where Detection Must Move

The compensating controls that will matter over the next 18 months are identity, network telemetry, and behavioral analytics above the endpoint. Two universal Linux LPEs, Dirty Frag and Copy Fail, compound the problem. Copy Fail modifies in-memory file copies without touching disk, which makes it invisible to every file integrity monitoring product currently deployed. It has affected every major Linux distribution since 2017.

The board-deck reading is that the government will catch up. The complete reading is that Congress is routing Mythos access through NSA rather than CISA, which says offensive and intelligence use is the priority and civilian defense is not. The private sector is on its own for several years.

The Execution Layer Is the New Control Point

SAP, ServiceNow, Apple, Google, and Amazon all moved in the same window to claim the surface where AI agents actually commit writes to systems of record. The temptation is to read this as five product launches that happened to overlap. The more useful reading is that five companies with very different distribution models all concluded, independently, that the execution layer is the architectural decision enterprises cannot defer.

The positions are now explicit:

Why "Run Both" No Longer Works

A reasonable skeptic would point out that enterprises run multiple systems of record today and have for decades. The skeptic is correct about the past. The skeptic is wrong about agents. Agents acting across finance, HR, IT, and procurement need one authoritative place to reconcile state. Two authoritative places is zero authoritative places. ServiceNow adopting MCP as the communication standard is the most consequential signal in the set, because a company with workflow gravity across IT, HR, and customer service declaring that agents talk to it via MCP pulls the ecosystem toward that protocol whether or not the rest of the ecosystem agrees.

SAP is playing the other game. The Knowledge Graph is a bet that vertically integrated context makes SAP's own agents contextually superior inside SAP's data universe. These are two competing theories of how the agent economy organizes. Open interoperability is one. Data-moat integration is the other. They do not converge.

Being bypassed is not the same as being disrupted. Disruption leaves a seat at the table. Bypass does not.

Vercel's production data names the clock: 59% of all AI API tokens are now agentic workloads. More than half of production AI usage is agents taking actions, not humans having conversations. Any platform whose roadmap still assumes a human-in-the-UI has a 12-18 month window before agent orchestrators route around it rather than through it.

The Security Dimension Is Already Failed

The number that should be on every CISO's first slide is 81% of AI agents successfully bypass legacy bot detection. Every WAF, CAPTCHA, and rate-limiting system built to flag automated access by behavioral pattern is now ineffective against LLM-driven agents that mimic human interaction. The board-deck version is that the security stack needs an upgrade. The complete version is that an architecture designed for human adversaries is the wrong architecture for the agent era, and upgrading it does not change what it was designed to detect.

Three Jurisdictions, Same Window, Divergent Outcomes

a16z has published the most comprehensive AI liability blueprint the industry has produced: user-liability defaults, damages caps, and federal preemption of the state patchwork. At the same time, courts are actively deciding cases that could impose substantial penalties on general-purpose AI developers for downstream misuse. The sequence is the point. Precedent-setting rulings will arrive before any comprehensive federal framework, producing judicial standards that subsequent legislation has to work around rather than replace.

Inside the Trump administration, ODNI and Commerce are fighting over who evaluates frontier models. CAISI published voluntary testing agreements with Google, Microsoft, and xAI, then retracted them inside the same week. The outcome decides whether AI operates under an intelligence-community-led pre-release evaluation regime or a Commerce-led voluntary one.

The companies filing AI liability under 'future problem' are the ones that will find out, in a courtroom, that it was this quarter's.

The Open-Source Kill Switch

If developer liability for downstream use becomes the standard, the economic logic of releasing an open-source model stops working entirely. No rational actor open-sources a model that generates unbounded liability for every downstream application. The supply chain restructures toward proprietary foundation models and a handful of providers. Product strategies that quietly assume continued access to open weights — which is most of them — carry an unpriced dependency on regulatory outcomes that does not appear on the P&L.

The 'Liability Cartel' Dynamic

A reasonable skeptic would point out that liability rules are a poor proxy for competitive dynamics. The skeptic is half right. Excessive AI liability functions as a moat for incumbents with thousand-lawyer teams, and a16z names this explicitly. A strict-liability regime with developer-side presumption changes the unit economics of every foundation model provider. A negligence regime with deployer-side presumption changes the unit economics of every company using one. Deep pockets prefer strict liability for the same reason they prefer any rule that prices out the challenger.

a16z's $115.5M in 2026 midterm spending makes the firm the largest disclosed political donor, and the $50M 'Leading the Future' PAC backing AI-friendly candidates of either party is the delivery mechanism. Companies not engaged in this process will comply with rules written by firms that had a hand in writing them.

The Budget Blowout Pattern

ServiceNow's CDIO said publicly that the company blew its full-year Anthropic budget by May. Anthropic's answer was no SLAs, no usage telemetry, no comment. A reasonable skeptic would say this is what every fast-growing infrastructure vendor looks like before the admin layer arrives. The reasonable skeptic is partly correct. What the skeptic does not explain is why ServiceNow is already shipping AI Control Tower and selling it to other enterprises. That's not partnership. That's the market routing around a vendor deficiency.

Every major AI provider now requires expensive forward-deployed engineering layers to generate value. Google is hiring hundreds of FDEs. OpenAI bought a 150-person consulting firm. At $300-500K loaded cost per FDE and 5-10 needed per meaningful deployment, the true cost of an AI program runs 3-5x the model fees. The board-deck version of this is a model-spend line item. The complete version is a services line item three to five times larger.

The Data Foundation Gap Is Organizational, Not Technical

Of 334 data practitioners asked what they need most, 4.8% said better tools. 95.2% asked for training, clearer requirements, more time, and dedicated ownership. Only 15% of organizations have data foundations adequate for agentic AI at scale. Netflix and Meta independently converged on identity-based, team-owned data governance, replacing brittle ACLs and human-owned identities, as the precondition for letting agents read and write across an organization.

The eighty-five percent that are not ready are not unready because they bought the wrong platform. They are unready because nobody owns the data the agents are supposed to act on.

The Fragility Nobody Is Pricing

AI spend is uniquely reversible. Unlike a cloud migration or an ERP rollout, token consumption can be cut to zero overnight. The enterprise AI revenue base therefore carries a fragility that model-company valuations are not pricing in. For buyers, the same property is an asset, but only for the ones who have not yet built workflows that cannot function without it. The FOMO dynamic of spending past budget because a competitor might 'figure out economics first' is classic bubble psychology meeting a reversible commitment. Those two things do not usually appear in the same sentence.

Anthropic grew demand 80x against a planned 10x, which means it ran at roughly 12% of required capacity for extended periods. Developers on the platform received degraded service without disclosure. The productivity gains measured during that window are almost certainly understated against what adequate provisioning would have delivered. The next quarter's number will be the more honest one.