The Board Room

The Convergence

The frame to use this week is architecture, not budget. The security operating model built over the past decade no longer describes the threat environment it was purchased to defend against, and the gap is now visible across endpoint detection, AI routing infrastructure, and offensive tooling at the same time.

The cost curve on reverse engineering a commercial endpoint agent has collapsed in a way the defensive stack's threat model never priced in.

Layer 1: Endpoint Detection Becomes Transparent

TrustedSec ran LLMs against five commercial EDR products and found the same internals across all five: YARA-style rules, behavioral logic, allowlists, prefilters, scripted engines (some readable as Lua after a single decryption pass), and local ML classifiers. Work that used to require a skilled reverser and weeks of effort now takes days with AI assistance. The category was running on security-through-obscurity, and the obscurity just left.

Layer 2: AI Infrastructure Under Active Exploitation

CISA added LiteLLM, Ollama, and OpenClaw to the Known Exploited Vulnerabilities catalog, which means adversaries are already targeting AI routing infrastructure in production. A Raspberry Pi honeypot dressed as an AI stack was indexed by Shodan in 3 hours and absorbed 113,000 attacks per month. The AI tooling layer went from experiment to production without the security review traditional enterprise software gets on the way in.

Layer 3: Offensive AI Crosses the Discontinuity

Anthropic's Mythos became the first model to clear both UK AISI simulated attack ranges, with full network takeover rather than mere persistence. Congress is holding closed-door demos and routing access through NSA rather than CISA, which signals offensive and intelligence priorities over civilian defense. Microsoft's MDASH found 16 exploitable flaws in a single Patch Tuesday using multi-model AI, and the PraisonAI framework was exploited 4 hours after disclosure.

The Compound Effect

Each layer compounds the others. An adversary with transparent EDR visibility, AI-speed exploit development, and access to unpatched AI infrastructure tools is operating against an attack surface measured in hours rather than months, not the one the current security posture was calibrated for. The NGINX 18-year RCE, present since 2008 and affecting nearly every modern web application, shows how long a latent defect waits for the discovery economics to reach it.

Defenders are still patching on a monthly cycle while attackers have compressed exploit development from months to hours, which means the window between disclosure and exploitation is now shorter than most enterprise change-control processes.

The Numbers That Changed This Week

The financial architecture of AI became legible this week through a court filing and a lease deal whose competitive logic does not survive scrutiny. The IPO print in between simply confirmed what the other two already implied:

• Microsoft → OpenAI: $100B committed by June 2026 (revealed via Musk lawsuit), with $30B in direct revenue against it. OpenAI committed another $280B to Microsoft servers going forward.
• Cerebras IPO: $56B fully diluted, priced 16% above the raised range, 70% first-day pop. Backstopped by a $20B procurement commitment from OpenAI.
• xAI → Anthropic: 220,000 GPUs (45% of Colossus 1) leased to a competitor Musk publicly called 'misanthropic and evil.' Financial logic overwhelmed competitive logic.
• Anthropic: $30B ARR, up from $9B roughly four months ago. Raising at $900B+ valuation.
• Fervo Energy: $10B+ IPO, shares jumped 33%. Google contracted option for 3GW (≈60 data centers).

When Elon Musk leases 45% of his compute to the competitor he publicly calls misanthropic and evil, financial logic has overwhelmed competitive logic. Compute now behaves like a financial instrument, not a strategic moat.

What This Means for Vendor Strategy

The xAI lease is the structurally significant signal of the week. It confirms that Grok never achieved meaningful traction, because lease revenue from Colossus almost certainly exceeds what Grok itself could generate from those GPUs. The population of viable frontier labs is contracting, and excess infrastructure is moving onto the lease market. That could meaningfully alter compute economics for enterprises over the next 12-18 months.

A reasonable skeptic would file Anthropic's capacity admission as an operations footnote. The skeptic would be wrong. 80x demand growth against 10x planning means Anthropic operated at roughly 12% of required capacity for extended periods, and developers received degraded service without disclosure. The productivity gains measured during that window are understated against what adequate provisioning would have produced.

The Concentration Paradox

Fewer than five entities can play at the $100B level: Microsoft/OpenAI, Google, Amazon, Meta, and the Nvidia ecosystem. But within that constraint, the vendor hierarchy is demonstrably unstable. Anthropic quadrupled enterprise share while OpenAI grew 0.3%. The window for extracting favorable multi-vendor terms is open now, while both sides are still competing for lock-in.

The Collision

The interesting question used to be which model an enterprise should standardize on. That question is settled. The question now is which platform agents call through when they act on a user's behalf, and four of the largest technology platforms answered it in the same week with architectures that do not compose.

Amazon moved the same direction with Buy for Me, an agent that completes purchases on third-party sites from inside Amazon's surface. A reasonable reading is that this is a convenience feature. The more useful reading is that it is a claim on the transaction layer of the open web.

Why This Forces a Decision

Vercel's production telemetry shows 59% of all AI API tokens are now agentic workloads. The interface layer of software is unbundling from the application layer underneath it. The a16z thesis puts $150B of GTM value migrating from CRM systems of record to the AI orchestration layer above them.

Agents that act across finance, HR, IT, and procurement need one authoritative place to reconcile state. Two authoritative places is zero authoritative places.

The SAP and ServiceNow collision is the one that forces the enterprise decision. SAP's claim is strongest where the process is the transaction: order to cash, record to report. ServiceNow's claim is strongest where the process is the workflow across systems, the connective tissue that was never going to live in an ERP. Most enterprises have both shapes today. The run-both instinct will not survive contact with agents that need to commit writes.

The Platform Tax Problem

Apple is not entering the AI game. It is setting the rules for the surface where consumer AI interactions happen, and framing agent sub-spawning as both a safety risk and a revenue leak. For any company shipping AI agents on iOS, that is a new constraint layer on product economics, not a footnote. Google's 97%+ Android share in markets like India means Gemini Intelligence ships as a default rather than a choice. Products that are technically API-addressable but sit outside the default agent's routing table will be bypassed without anyone noticing they were bypassed.

The Budget Problem

ServiceNow's CDIO disclosed that the company blew its full-year Anthropic budget by May. The cause is structural rather than accidental. Anthropic offers no SLAs, no usage telemetry, and no predictable pricing to enterprise customers, which is a deliberate choice: they are optimizing for model capability over enterprise readiness. ServiceNow's response was to build AI Control Tower internally and then sell it to other enterprises. That is not partnership. That is the market routing around a vendor deficiency.

The problem generalizes. Every major AI vendor — Google, OpenAI, Anthropic — now concedes they cannot deploy without expensive forward-deployed engineering teams at $300-500K loaded cost per FDE. If meaningful deployment takes 5-10 of them, the true cost of an AI program is 3-5x the model fees. Most board-approved investment envelopes do not reflect that math.

The Data Foundation Gap

Only 15% of organizations have adequate data foundations for agentic AI. The remaining 85% are spending millions to tens of millions building agents on data that was never governed for autonomous decision-making. A practitioner survey of 334 data professionals found that 95.2% cite organizational problems — training, ownership, requirements clarity — versus 4.8% citing tooling gaps. This is not a category of problem money solves.

A dashboard tolerates a dirty field. A human analyst routes around it. An agent executing a chain of decisions acts on it, then acts on what it just did, and the error compounds through the chain until someone notices the invoice went to the wrong entity.

The Liability Framework Forming Now

a16z published what is, on honest reading, the most comprehensive lobbying blueprint the AI industry has produced on liability. The core proposal is user-liability defaults with damages caps. A reasonable skeptic would point out that lobbying documents rarely become law on the lobbyist's terms. The reasonable skeptic is correct, but is answering the wrong question. Courts are already deciding cases that could impose strict liability on developers for downstream user misuse before any legislative framework exists. Precedent-setting rulings will arrive before comprehensive federal law, and a patchwork of judicial standards will set the ceiling the legislation eventually negotiates against.

If developer liability becomes the default, open-sourcing a model becomes an uninsurable risk. Product strategies that quietly assume continued access to open weights are carrying an unpriced dependency on regulatory outcomes the P&L does not show.

The Duolingo Warning

Duolingo quantified what others will not. At scale, AI-generated output runs ~20% unusable and requires human QC. Their blanket AI mandate produced performative adoption: the metrics climbed while the underlying work did not. The mandate was walked back.