The Board Room

The Paradox No One Modeled

Start with the number that was supposed to settle the cost question. Token prices fell 100x in three years, from $60 to $0.60 per million. Enterprise AI spend went up anyway. The reason is architectural. Agents re-read context, spawn sub-agents, verify their own outputs, and retry failed attempts, and that pattern consumes 60-140x more tokens per task than a simple query. This is not a temporary inefficiency. It is how autonomous agents work. Every cost model built on per-token pricing is measuring the wrong thing.

Token prices fell while per-task consumption rose. Cheaper tokens did not lower the bills.

What the Bills Show

Uber spent its entire 2026 AI budget by April, four months into the fiscal year. A four-person startup is carrying $113K monthly AI bills. Tesla, a company with serious AI infrastructure of its own, is capping employee AI spend at $200/week, with a carve-out for Grok that tells you something about internal product politics. At the AI Engineer World's Fair, 76% of teams said cost constraints were limiting their ambitions.

The market is pricing this. Salesforce took Agentforce to $1.2B ARR, its fastest-growing product ever, and hit a 52-week stock low in the same stretch. AI revenue growth at seat-based incumbents doesn't translate to durable value when cost structures are unsustainable. That is the market's read, and it is not obviously wrong.

Why This Gets Worse Before It Gets Better

The skeptic will say the 60-140x multiplier is an artifact of immature engineering that the next model generation optimizes away. The skeptic is half right. Some of it will come down. But the multiplier is not a bug. Agents re-read context windows, spawn sub-agents, verify their own work, and retry what fails, and each degree of added autonomy piles on more of that overhead. With GPT-5.6 Sol now operating 270+ hours unsupervised, consumption rises faster than the task count does. A roadmap that models today's consumption without modeling that ramp is planning for the wrong bill.

The New Unit Economics

The Strategic Response

The firms holding margin are doing three things. They route work by difficulty, sending simple tasks to cheap models and reserving the frontier for the hard ones through intelligent model routing. They lean on aggressive caching and distillation. And they move to outcome-based pricing that hands cost variability back to the customer. Meta has conceded agents are progressing slower than expected, which buys some time. The tradeoff is whether that time goes into cost-aware architecture now or into discovering the ramp later, when today's bills look small.

The Market Just Told You Where the Next Platform Layer Gets Built

The AI Engineer World's Fair closing survey delivered a number that should reshape your investment thesis: 95% of AI engineers now use agents, with 89% of those agents capable of writing data to production systems. Write-capable agents nearly doubled year-over-year. And here's the punchline: nobody has settled the control layer. Human approvals remain the primary safeguard.

Every computing paradigm produces a dominant control plane — VMware for virtualization, Kubernetes for containers. The agent control layer is the unclaimed platform of this cycle, and the window to capture it is measured in quarters.

Even the Best Are Drowning

Anthropic's Mike Krieger — leading one of the most AI-sophisticated engineering organizations on Earth — admitted his team is 'bottlenecked on reviews' and struggling with 'human ability to fully conceptualize what we're doing.' If Anthropic can't keep up with agent oversight, your organization certainly can't either. The binding constraint in an AI-native engineering org isn't coding capability — it's architectural comprehension and review capacity.

The Infrastructure Is Crystallizing Now

Three signals show the governance layer moving from concept to product:

• HashiCorp Boundary 1.0 — explicitly targets AI agents and nonhuman identities as first-class principals alongside humans
• ContextForge — federates MCP servers, A2A agents, and APIs behind governed endpoints with auth, discovery, and observability
• Werner Vogels publicly advocating for agent-enabled two-pizza teams — signaling Amazon is already restructuring internally

The Organizational Design Consequence

The 680x AI spending gap (top 1% at 40% of engineering salary vs. median at $137/year) creates a two-tier industry. But Google's internal data shows infrastructure breaks catastrophically at 10x velocity — build times, test compute (growing quadratically), code review all fail. This means the top spenders who haven't invested in governance infrastructure are accelerating toward collapse, not dominance.

Understanding Debt: The New Risk Category

59% of engineers fear AI-generated code creates long-term liabilities. Kubernetes now requires disclosure and human accountability for AI contributions. The gap between what your systems do and what your humans understand is widening with every agent deployment. This 'understanding debt' will surface as inability to respond to novel failures, pass security audits, or make architectural pivots.

The Strategic Opportunity

Whoever owns the agent control plane — identity, permissions, observability, verification — owns the next infrastructure layer. This is your signal to either build it (if you're a platform company), invest in it (if you're allocating capital), or establish governance frameworks now (if you're deploying agents) before the dominant standard emerges and you're consuming someone else's control plane on their terms.

Not One Failure — A Systemic Collapse of Assumptions

This week's disclosures share a single failure mode: the control you assumed was holding wasn't. This isn't the usual 'bad patch cycle.' It's four foundational security assumptions breaking at once, for the same structural reason: single-control dependency in a world that moves faster than human validation.

Your AI Dev Tools Are Now an RCE Class

Cursor's 9.8 CVSS zero-click RCE isn't a product bug — it's proof that AI coding agents represent a fundamentally new attack surface. The attack vector: prompt injection via untrusted MCP server escalates through sandbox escape to full system compromise. When Cursor initially rejected the vulnerability report claiming MCP server misuse was 'outside scope,' they revealed an industry-wide blind spot.

Every AI agent with system-level access — Cursor, Copilot, internal coding assistants — inherits this architectural risk. The fix isn't a patch. It's rethinking the trust boundary between language models and execution environments.

Your MFA Is Theater for Millions of Accounts

Azure CLI's legacy OAuth ROPC flow walks straight past MFA enforcement. Huntress documented tens of millions of login attempts exploiting this, with dozens of confirmed compromises at organizations that believed their MFA coverage was complete. This isn't a Microsoft bug — it's a design decision from the pre-zero-trust era, now exploited at scale. The fix isn't a patch either — it's a Conditional Access Policy audit for legacy authentication flows that most teams have never run.

Time-to-Exploit Has Collapsed

NetScaler exploited within 24 hours of disclosure. SharePoint RCE requires only basic authenticated access. Cato Networks reveals 9.8-severity sandbox escape in Cursor. When exploitation consistently beats your patch cycle by 13+ days, the implication is architectural, not operational. You cannot solve a sub-24-hour threat with a two-week change management process.

The AI Creates Its Own Attack Surface

The Board Conversation

Perimeter appliances, MFA-gated identity, and patch-when-available management are losing to adversaries who operate at machine speed. The spend that follows should: assume breach and verify continuously, match attacker velocity with automated detection, move identity past MFA into behavioral context, and diversify away from vendors showing recurring vulnerability patterns (Fortinet's third catastrophic flaw in 18 months).