The Product Desk

The Two-Front War on Your Cost Model

An engineering manager at Uber opened the AI spend dashboard in month four and watched the 2026 budget hit zero. Her engineers had not done anything wrong. They used Claude Code exactly as pitched, at $500–$2,000 per user per month, and the meter ran. Microsoft drew the same conclusion in blunter form: revoke Claude Code licenses across Experiences and Devices, push everyone back to Copilot CLI. That is one side of the squeeze. The other side showed up the same week. MiniMax M3 landed at $0.12 per million input tokens with coding scores reportedly near Opus 4.7. DeepSeek V4, Moonshot's Kimi K2.6, and xAI's Grok Build at $1/$2 per million all shipped in the quarter. The gap between the two sides is 40x.

The unit economics deck written against Q1 pricing now describes a product that doesn't exist anymore. Features killed 18 months ago because the inference math didn't work should be re-evaluated at 50–70% lower costs for non-critical paths.

Why Usage-Based Pricing Is Failing

What teams tell themselves users do: make one thoughtful call, get an answer, move on. What users actually do: chain summarize-then-act, retrieve-then-generate, code-then-test until the context window fills. That is agentic AI with logarithmic value and super-linear costs. Per-user cost grows with tenure because the power users get better at extracting work from the tool. Netflix did not solve this with a cheaper model. They shipped the open-source Headroom proxy to compress redundant tokens between agent code and LLM APIs and recovered $700K. The fix was cutting calls that were not producing value.

The Routing Decision Framework

The error teams keep making is treating model choice as a vendor decision ("we use Anthropic") instead of a per-call decision ("this call routes to X based on the failure mode"). With three Chinese labs shipping competitive models in one quarter, the menu is at least five options wide. A diagnostic you can run on Monday:

• Pull your three highest-volume API calls.
• For each, write down what actually happens when the model gets it wrong.
• If the failure mode is "user retries," route it to the $0.12 tier.
• If the failure mode is "contract breaks or customer churns," keep it at $5 and stop apologizing for the bill.

Anthropic's new Effort Control dial is the vendor admitting the split exists. Teams will package "Quick Answer" against "Deep Research" and price them separately. That is a pricing surface, not an infrastructure feature.

The Capex Signal Says This Isn't a Blip

SoftBank committed €75B for 5GW of French AI data center capacity. Nvidia's Vera Rubin supply chain is running 2x larger than Grace Blackwell. Goldman projects $1T annual AI capex by 2027. Industry capex of $157.7B per quarter against $25B in revenue is a 6.3:1 ratio, which means inference is subsidized today. Features that work at current pricing and break at 2.5x are landmines on a known timer. Features that miss the ROI bar today will clear it at 50–70% lower cost, but only for teams that architected the routing decision before they needed it.

The Conway Leak Is a Roadmap Preview, Not a Product Announcement

Anthropic's leaked agent platform — codenamed Conway — reveals a full persistent-agent stack that directly threatens any product positioning itself as 'AI workflow automation.' The architecture includes three specialized subsystems: Orbit (cross-app automation for Slack, Gmail, and similar), Operon (data pipeline management), and BugCrawl (autonomous debugging). Agents run in isolated containers with persistent file-based memory and trigger via webhooks. The .cnw.zip extension standard suggests a deployable, packageable agent format — not a research demo.

If Anthropic ships a general-purpose agent that orchestrates across Slack, Gmail, codebases, and data pipelines, what happens to every SaaS product that positioned itself as 'AI-powered workflow automation'?

Three Platform Plays Converging on the Same Territory

Conway isn't isolated. OpenAI's DeployCo launched with $4B backing and 150 Forward Deployed Engineers from the Tomoro acquisition, taking equity stakes in PE vehicles buying traditional businesses. Microsoft is consolidating scattered Copilot tools into a unified super-app with GitHub Copilot, Cowork, and Scout (always-on agent) tabs — explicitly to address 'weak adoption' from fragmented touchpoints. Cognition's Devin now runs more sessions asynchronously than interactively, with engineers running 10-20 instances in parallel. The direction is unanimous: generic agent orchestration becomes platform-native.

The Survivability Test

The diagnostic is one sentence: which measurable outcome does your customer get that no generic agent can replicate? Three sources converge on what survives:

1. Proprietary workflow data — Legacy SaaS is being acquired specifically for behavioral/usage patterns to train agents, not for revenue multiples
2. Domain-specific verification — Claude Opus 4.8 deployed to 105 agents introduced a bug it couldn't fix after 8 attempts, requiring full rollback. Capability ≠ reliability.
3. Distribution and integration depth — APIs are commoditized endpoints swappable in an afternoon; deep workflow embedding creates quarters of switching cost

Dynamic Workflows: The Pattern to Steal

Claude Code's Dynamic Workflows (1,000 agents, 16 concurrent, crash-resume via JavaScript orchestration) aren't useful because of scale — they're useful because of the adversarial verification pattern. Agents attack a problem independently, then cross-check until convergence. That pattern, at modest scale (2-3 parallel generations checking each other), improves output quality without waiting for a better base model. It's implementable this sprint.

Enterprise governance is the forcing function: Dynamic Workflows ship off by default on Enterprise plans, requiring admin enablement. That's the sales pattern to copy. Admin-gated rollout gives security teams a defensible answer and produces usage data before broad rollout.

The Numbers Are No Longer Projections

Google AI Overviews now appear in 25%+ of searches and reduce organic click-through by 58%. In 83% of AI Overview results, users never click anything at all. The mobile picture is worse: 77% of mobile searches end without a click (60% on desktop). But the most dangerous number for product teams is this: 73% of page-one ranking brands are NOT mentioned in AI-generated answers. Your SERP rankings — the thing you invested years building — have essentially zero correlation with AI-era visibility. The scoreboard reset without a notification.

Gartner projects 50% of organic traffic disappears by 2028. Given current trajectories, that's conservative.

SEO Rankings and AI Visibility Are Now Decoupled

This is the critical insight most teams haven't internalized. The old game was: rank on page one → get clicks → convert. The new game is: get cited by the AI answer → you exist to users. These are different games with different scoring. Domain Authority doesn't matter to LLMs. Authoritativeness, comprehensiveness, and freshness are what LLMs weight when selecting citation sources. Your SEO team's KPIs are measuring a dying paradigm.

Zapier's Playbook Is Your Blueprint

Zapier is demonstrating what works in the new regime:

• Only publish content that answers ICP questions more thoroughly than any alternative
• Refresh content frequently with visible 'last updated' metadata (signals recency to crawlers and LLMs)
• Optimize for depth over breadth — LLMs want the definitive answer, not the 15th article on a topic
• Programmatic SEO adapted for LLM consumption patterns

Additionally, Reddit and YouTube mentions are disproportionately influencing AI-driven discovery. These platforms are becoming the new 'backlinks' for LLM citation. Community presence is now a growth investment, not just brand building.

The Amazon Counter-Signal

While organic search decays, Amazon's AI shopping assistant demonstrates what works on the other side: 3.5x conversion over keyword search by collapsing the distance between intent and purchase. Amazon is now platformizing this for all retailers, AWS-style. The diagnostic for any PM touching commerce or discovery: does the buying intent in your category get resolved inside someone else's AI surface, or inside yours? If users start elsewhere and the AI resolves the purchase, you're a supplier. If users start on your surface and you resolve it, you have a product.

First-Party Data Is the Survival Strategy

Disney built an in-house ad stack with owned data. Taco Bell gates exclusives through its app to capture data. The pattern: companies treating first-party user relationships as their primary strategic asset. In a world where AI intermediates discovery and third-party cookies are dead, direct user relationships with rich behavioral data create insurmountable advantage. Every feature that creates a direct user relationship — accounts, preferences, saved states, notifications — is strategic infrastructure. The question: 'If AI Overviews completely eliminate our organic discovery, can we still reach our users through owned channels?'

Four AI-Specific CVEs in One Week, All Targeting Dev Tools

A backend engineer installed a Chrome extension last Tuesday to summarize Jira tickets. She also pastes connection strings into a browser-based AI assistant about six times a day. This week, four separate disclosures made that combination materially worse. The pattern is not coincidence. It is what happens when agent tooling ships faster than the audit cycle that normally catches this class of bug.

MCP Is an Unaudited Dependency in Every Agent Framework

The Flowise vulnerability exploits unsafe stdio command serialization in its MCP adapter. MCP, the Model Context Protocol Anthropic introduced, was adopted across the ecosystem at a speed that outran review, which is why most implementations have not been security-audited. The exploit pattern that worked against Flowise will be hunted across every other implementation this quarter. Teams shipping agents that call tools via MCP are choosing between auditing those integrations now or accepting that the audit will happen in production on someone else's timeline.

AI agent traffic exploded 7,851% in one year. Automated traffic is growing 8x faster than human traffic. The attack surface is expanding faster than defenses.

The Developer Workflow Is the Vulnerability

The LLMReaper PoC requires zero special permissions. It uses the same Manifest V3 'read and change all your data' grant that thousands of Chrome extensions already hold, plus a MutationObserver scraping conversations off the DOM in real time. The thing being pitched is 'AI in the developer workflow'; the thing being done is developers pasting credentials, connection strings, and proprietary prompts into a tab any installed extension can read. Meanwhile a malicious npm package (codexui-android) is harvesting Codex authentication tokens from dev environments.

The 2x2 for This Sprint

Enterprise buyers will be asking about AI security posture in procurement conversations within 90 days. Flowise's critical RCE creates a concrete displacement window: teams forced off Flowise need alternatives this week. The diagnostic is straightforward. One axis: whether the team can articulate its security model concretely (sandboxed rendering, validated MCP implementations, secure install paths). Other axis: whether the nearest competitor has done the same hardening. The cell where you have and they have not is where displacement deals close, which is why pulling security hardening of AI features ahead of new feature development is the call this sprint rather than next quarter.