The Board Room

The capability threshold moved a step function this quarter

The defensive architecture most security programs are running on was invalidated this week, and the evidence arrived from independent directions at once. TrustedSec ran LLMs against five commercial EDR products and found all five share identical architectural patterns: YARA-style rules, behavioral logic, allowlists, prefilters, and local ML classifiers. Work that used to occupy a skilled reverse engineer for weeks now takes days. Anthropic's Mythos became the first model to clear both UK AISI simulated attack ranges, the benchmarks built specifically to test autonomous offensive cyber capability. OpenAI's GPT-5.5 cleared one of two. Both are outperforming an exponential trend line that was already doubling every few months.

Then the 4-hour exploitation window on PraisonAI: disclosure to active targeting in the time it takes to schedule a change-advisory meeting. An 18-year-old RCE in NGINX's rewrite module, present since 2007, surfaced alongside it, affecting nearly every modern web application.

The patch window used to be measured in months because attackers needed months. Now it is measured in months because procurement needs months; the attacker side moved while the defender side did not.

The AI infrastructure stack is under active exploitation

CISA added five AI tooling vulnerabilities to the Known Exploited Vulnerabilities catalog in a single week. LiteLLM (unauthenticated database queries), Ollama (GGUF model loader data exfiltration at CVSS 9.1), and OpenClaw (six simultaneous critical CVEs) are all being exploited in production. A Raspberry Pi honeypot dressed as an AI endpoint was indexed by Shodan in 3 hours and absorbed 113,000 requests in a month, with tooling that evolved mid-experiment to detect honeypots.

In the same window, Foxconn lost 8 terabytes of confidential designs from Apple, Intel, Google, and Nvidia to the Nitrogen ransomware group. The assumption that contract manufacturers held manageable supply-chain custody risk just proved aspirational.

The defender's response

Microsoft stood up MDASH (multi-model AI vulnerability discovery) and found 16 exploitable flaws in a single Patch Tuesday. Mozilla found 271 bugs in Firefox 150 using Claude Mythos with custom harnesses, against curl's 1 CVE from generic scanning. The variable is harness design, not model quality. The offensive application of these same capabilities by threat actors is a 12-18 month timeline, not a theoretical one.

Congress is routing Mythos access through NSA rather than CISA, which tells you which mission the government has prioritized. The private sector is on its own for the defensive application.

What this forces

A reasonable skeptic would point out that EDR vendors have weathered every prior architectural critique and shipped through it. The reasonable skeptic is correct about the past. What the skeptic does not explain is why a posture calibrated to an adversary that needed human researchers to chain exploits should hold against one that does not. The compensating controls, identity and network telemetry and behavioral analytics above the endpoint, are the ones that matter in the next eighteen months. The endpoint agent is no longer the load-bearing control.

xAI Leased Its Crown Jewels to a Competitor

The most revealing infrastructure signal this week is a leasing deal. Elon Musk agreed to lease 220,000 GPUs — 45% of xAI's Colossus cluster — to Anthropic, a company he has publicly called "misanthropic and evil." A reasonable skeptic would call this opportunistic capital management. The reasonable skeptic is partly correct. What the skeptic does not explain is why financial logic would overwhelm competitive logic this visibly unless Grok never achieved meaningful traction and the lease revenue exceeds what the GPUs could earn running xAI's own products. The frontier lab population is contracting in private before it contracts in headlines.

When the financial logic of renting your GPU cluster to a rival exceeds running your own model on it, the question of how many viable frontier labs exist has been answered — just not publicly.

The Bilateral Deal Era

Cerebras priced its IPO at $56 billion, sixteen percent above range, with a seventy percent first-day pop. The catalyst was a quiet $20 billion procurement commitment from OpenAI in December 2025. One anchor customer turned a regulatory cautionary tale into the most successful tech IPO in five years. Tiger Global entered at $89 a share in September 2025 and saw $311 on day one, a 249% return in eight months.

Fervo Energy debuted above $10 billion, surging thirty-three percent on day one, the largest clean energy IPO tied explicitly to AI datacenter demand. Google's option for 3 gigawatts from Fervo against only 658 MW currently contracted is the number that matters. That is sixty-plus data centers from a single power supplier.

These are not market signals about demand. They are contractual facts about supply allocation. Nebius reports 4+ customers competing for every GPU it brings online while growing revenue 684%. The marginal buyer arriving in 2027 will get compute. The marginal buyer will not get 2025 terms.

Microsoft's $100B Bet and What It Prices In

Court filings in the Musk lawsuit disclosed that Microsoft has spent over $100 billion on OpenAI infrastructure by June 2026, against roughly thirty billion in direct revenue. OpenAI has committed another $280 billion to Microsoft servers going forward. The closest historical analog is the fiber buildout of the late 1990s, with one critical difference. Cisco's AI orders moving from $5 billion to $9 billion in the same window suggests the demand is real this time, not yet, but real.

Fewer than five entities on earth can play at this scale: Microsoft/OpenAI, Google, Amazon, Meta, and the Nvidia ecosystem. That is not a procurement relationship. It is an alliance that sets long-run degrees of freedom for everyone else.

The Planning Consequence

The board-deck version of this story is that compute is getting expensive. The complete version is more useful. Infrastructure cost assumptions from six months ago are now likely 30-50% too optimistic, and the window for securing favorable multi-year compute terms is closing while most enterprise AI roadmaps remain scoped quarter to quarter. Power contracts signed in 2026 will determine competitive position in 2028 through 2030. The compute market is being divided through relationship-based bilateral commitments, not open market competition, and the firms that treat the next two quarters as a rehearsal for the next decade will find the decade already allocated.

The Collision Is Here

SAP and ServiceNow stopped talking past each other this week. Both are now explicitly pitching as the execution layer where AI agents touch systems of record and actually do things. SAP is building a vertically integrated Knowledge Graph that makes its own agents contextually superior inside SAP's data universe. ServiceNow adopted MCP (Model Context Protocol) servers as the communication standard for its headless Action Fabric, telling the ecosystem that agents reach ServiceNow through an open protocol.

These are incompatible theories of how the agent economy organizes: open interoperability versus data-moat integration. Both can win in different segments. The unresolved problem is that agents acting across finance, HR, IT, and procurement need one authoritative place to reconcile state. Two authoritative places is zero authoritative places.

Apple and Google Claim the Consumer Layer

Apple is inserting itself at the agent layer on iOS, specifically targeting agents that spin up smaller apps on the spot after Apple has already approved the parent app. The framing is safety. The mechanism is governance that prevents agents from routing around the 30% tax. For any company shipping AI agents on iOS, this is a new constraint layer that has to be priced into product economics before WWDC makes it fait accompli.

Google's Gemini Intelligence ships this summer on Galaxy S26 and Pixel 10, extending to watches, cars, glasses, and laptops. In markets where Android holds 97%+ share, like India, that converts an installed base of 3+ billion devices into an agent platform. The grocery-list demo, where the agent reads a screenshot and builds the cart, turns the app into infrastructure and the agent into the interface.

A product that is technically API-addressable but sits outside the default agent's routing table will be bypassed the same way sites outside the default search index were bypassed in 2005.

Amazon Moves to Own the Transaction

Amazon's Buy for Me enables AI-mediated purchases from competing retailers inside Amazon's agent surface. A reasonable skeptic would call it a feature. The reasonable skeptic is wrong. It is a claim on the transaction layer of the open web. Merchants who assumed Amazon competed for the listing now find it competing for the checkout while routing orders to their own fulfillment. The margin math deserves modeling before the next planning cycle.

Where Value Settles

a16z published research estimating $150 billion of GTM value migrating from CRM to the AI orchestration layer. The supporting data point is the one worth staring at: a single customer running twenty-plus agents saw 80% fewer human seats but 83% higher total spend. Seat-based pricing is breaking. Consumption-based agent pricing is forming. The CRM stops being where work happens and becomes where work is recorded.

The Vercel production data confirms it: 59% of all AI token volume is now agentic workloads. The interface layer of software is unbundling from the application layer faster than most roadmaps assume. The orchestration surface, where workflows, permissions, and institutional memory live, is where switching costs accumulate. A model can be swapped in an afternoon. An agent graph wired into twelve internal systems cannot.