The Board Room

The Capability Discontinuity

The week produced a convergence that calls for an architectural response rather than a budget one. Anthropic's Mythos became the first model to clear both UK AISI simulated attack ranges, achieving full autonomous network takeover rather than persistence or lateral movement alone. OpenAI's GPT-5.5-cyber cleared one of the two. Across multiple independent assessments, researcher consensus is now that frontier models can find, chain, and exploit vulnerabilities in something close to real time.

In the same week, TrustedSec ran LLMs against five commercial EDR products and found all five share identical architectural patterns: YARA-style rules, behavioral logic, allowlists, prefilters, scripted engines readable as Lua after a single decryption pass, and local ML classifiers. Work that took a skilled reverse engineer weeks now finishes in days. The EDR category's defensive moat was security-through-obscurity. The obscurity has left the building.

The security model was built on the premise that the cost of understanding the agent exceeded the value of bypassing it for most adversaries. That premise is no longer true for a growing share of the threat population.

The Evidence Stack

• Mythos: first model to clear both AISI end-to-end cyber ranges
• PraisonAI: exploited within 4 hours of disclosure, well below most patch SLAs
• LiteLLM, Ollama, OpenClaw: added to CISA KEV. AI infrastructure is being exploited in the wild now
• LLMjacking honeypot: 113,000+ attacks per month, tooling maturing mid-experiment
• NGINX: 18-year undetected RCE in the rewrite module, foundational infrastructure that "many eyes" missed
• Foxconn: 8TB of Apple, Google, Intel, and Nvidia designs exfiltrated via Nitrogen ransomware

Where Sources Disagree, And Why It Matters

A tension runs through today's intelligence. The research community sees a 12-18 month window before these capabilities proliferate to open-weight models and the long tail of threat actors. The policy signals suggest otherwise. Congress is routing Mythos access through NSA, not CISA, which prioritizes offensive and intelligence operations over civilian defense. The private sector is on its own for that window.

A reasonable skeptic would note that AI-powered defensive scanning is equally transformative. Mozilla found 271 bugs in Firefox; Microsoft's MDASH surfaced 16 exploitable flaws in a single patch cycle. The skeptic is correct, with one caveat: the key variable is harness design, not model selection. Mozilla's 271 bugs came from custom agentic harnesses, while generic scanning of curl produced one low-severity CVE. The moat is in orchestration.

The Architectural Consequence

Security architecture built around quarterly patching, annual pentests, and endpoint-as-load-bearing-control was calibrated for human-speed adversaries. That calibration is now wrong. The compensating controls that matter in the next eighteen months sit above the endpoint: identity, network telemetry, behavioral analytics. Patch SLAs written for a 30-day window need rewriting for a 7-day window on the exposures that actually matter.

The New Market Structure

The recent IPO cluster and the Anthropic court disclosure landing inside the same window point to one conclusion: AI infrastructure is being allocated through relationship-based bilateral commitments, not open market competition. The data:

The xAI Signal: Compute as a Financial Instrument

Elon Musk, who publicly called Anthropic "misanthropic and evil," agreed to lease 220,000 GPUs (45% of Colossus 1) to them. When financial logic overwhelms competitive logic this visibly, the signal is hard to miss: GPU supply has become a financial instrument first and a strategic moat second. Grok never achieved meaningful traction. Lease revenue from Colossus exceeds what Grok could generate from those same GPUs.

A plan that assumed three viable compute suppliers in eighteen months may now have one and a half. The optionality most infrastructure plans were quietly relying on is the line item being deleted.

Anthropic's 80x Capacity Miss

Anthropic disclosed it grew 80x against a planned 10x, operating at roughly 12% of required capacity for extended stretches. Paying customers inside that window received degraded service without disclosure. The 80x figure, combined with the leap from $9B to $30B in ARR over roughly four months, explains why Anthropic is now raising at $900B+, above OpenAI's $854B March mark.

The planning implication: demand forecasting inside the labs is not a solved problem. Capacity-driven degradation will recur across vendors for at least four more quarters. Google's option for 3 gigawatts from Fervo, roughly sixty-plus data centers from a single supplier, says the hyperscalers see the constraint lasting through decade-end.

What This Means for Non-Hyperscalers

Fewer than five companies worldwide can sustain $100B+ rolling infrastructure investment. Every other AI strategy has to be built on partnership terms. Those terms are materially better today than they will be in eighteen months, because the counterparties have not yet finished sorting their own priorities. Firms shipping AI product on schedule right now locked capacity twelve to eighteen months ago. Firms still planning to scale are competing for what remains after the $20B blocks have been claimed.

The Collision

Four platform moves landed in the same window, and all four target the layer where AI agents commit writes to enterprise systems. The timing is not coincidence. It is the opening of a multi-year contest over write authority into systems of record:

• SAP: €100M fund plus Knowledge Graph — vertically integrated, making its own agents contextually superior inside SAP's data universe
• ServiceNow: Headless Action Fabric exposed via MCP (Model Context Protocol) — open interoperability, any agent can call
• Apple: App Store agent framework gating AI agent distribution on iOS — inserting approval gates and a 30% tax on agent sub-spawning
• Google: Gemini Intelligence shipping on Android this summer — converting 97%+ market share into an agent platform moat

Agents acting across finance, HR, IT, and procurement need one authoritative place to reconcile state. Enterprises cannot run two reconciliation authorities for the same writes.

Two Competing Theories

SAP and ServiceNow are placing incompatible architectural bets on where the execution layer lives. SAP bets that a vertically integrated data moat makes its agents superior within its ecosystem. ServiceNow bets that open MCP interoperability makes it the universal fabric any agent can call. Both can win, in different segments, at the same time. The enterprise running both still faces a forced choice about which vendor owns the execution layer for processes that cannot stop.

a16z sharpens the frame with data: more than $150B of GTM value is migrating from CRM systems of record toward the AI orchestration layer. Lemkin's signal from a single customer is the concrete version of that claim, with 80% fewer human seats, 83% higher total spend, 20+ agents running, and the implication is that consumption-based AI pricing is accretive against seat-based models rather than cannibalizing them.

The Platform Gatekeeping Dimension

Apple's move is different in kind. The company is specifically addressing agents that "spin up smaller apps on the spot after Apple has already approved the parent app." This is both a safety argument and a revenue argument, and the revenue half is the one to take seriously: it prevents agents from routing around the 30% tax. For any company whose AI roadmap includes consumer-facing agents on iOS, this is a constraint layer that has to be priced into product economics before WWDC.

Google's Gemini Intelligence converts default OS position into agent intermediation. The grocery-list demo looks like a party trick. What it actually does is turn the app into infrastructure and the agent into the interface. The summer rollout on Galaxy S26 and Pixel 10 puts it on billions of devices within months.

The Decision Framework

The question is no longer which model to use. It is which execution surface the business sits on: builder of the orchestration layer that others pass through, or commodity infrastructure underneath someone else's agent collecting thinner margins each cycle. SAP's claim is strongest where the process is the transaction. ServiceNow's claim is strongest where the process is the workflow across systems. Most enterprises have both shapes of work, and the agents that commit writes are what forces the choice.

The Three Fronts

The AI liability regime is being decided in three venues at once, and the firms most exposed are largely absent from all of them:

1. Courts: Active cases could impose substantial penalties on general-purpose AI developers for downstream user misuse, well before any legislative framework exists to mediate the question.
2. Congress: a16z has published the industry's most comprehensive lobbying blueprint, built around user-liability defaults, damages caps, and federal preemption. They are deploying $115.5M into the 2026 midterms to back it.
3. White House: ODNI and Commerce are fighting over who evaluates AI models pre-release. An IC-led regime looks like release gating with classified compliance. A Commerce-led regime looks like voluntary disclosure with no teeth.

Why the Regime Determines Market Structure

This is not an abstract policy exercise. The liability framework that wins decides two concrete things: who is on the hook when a model is misused, and what kinds of models get released at all.

If developer liability for downstream use becomes the standard, the economic logic of releasing an open-source model stops working. No rational actor open-sources a model that generates unbounded liability for every downstream application.

The Open-Source Dependency You Haven't Priced

A reasonable skeptic would point out that product strategies have weathered regulatory ambiguity before, and most of the time the worst case does not arrive. The reasonable skeptic is correct on the base rate. What the skeptic does not address is that most current product strategies quietly assume continued access to open-weight models, which means they carry unpriced dependency on regulatory outcomes the P&L does not show. A strict-liability outcome restructures the supply chain toward proprietary foundation models and a handful of providers. Every build-vs-buy decision currently relying on open-source model access has this variable underneath it, whether the decision-maker has named it or not.

The Timing Problem

Courts are deciding cases now. The likely sequence is precedent-setting rulings arriving before any comprehensive federal framework, producing a patchwork of judicial standards that subsequent legislation has to work around rather than design from scratch. The guardrail bypass ecosystem has industrialized into middleware, proxy relays, and automated pipelines, which hands national security hawks exactly the evidence that shortens legislative timelines. Evidence of that sort does not get unseen once it is in the briefing.