The Product Desk

The spread is the instruction, not the discount

A platform PM opened the new rate card and backed out the pre-cut numbers. The decision was already sitting there. Luna and Terra used to sit roughly 2.5x apart ($1.00/$6.00 against $2.50/$15.00). They now sit exactly 10x apart on input and output both, per The Information's reporting. That is not a discount. It is a routing instruction. Anything left on the mid tier that a user cannot tell apart from the low tier is paid capability nobody sees.

An agent session consuming 50k input and 5k output tokens runs $0.16 on Terra against $0.016 on Luna. A million sessions a month is $160k versus $16k. Free-tier limits rationed on inference cost may not need the ration anymore.

Where the saving leaks back out

Then two numbers say unit price is the smallest term in the cost equation. Amazon burned $1.8M on a single routine coding task, 860% over budget, and found out only afterward through internal AI usage metrics. Stripe named the mechanism when describing Kai, the internal knowledge platform most of its employees use: most Kai sessions require many turns. Turns-to-resolution sets cost per resolved task. Price per token does not.

DeepSeek's rate card makes the point from the other side. V4-Flash 0731 charges $0.14 per million uncached input tokens and $0.0028 cached. No model choice repairs a 50x delta. An agent that serializes a fresh tool schema or a session ID into the top of its prompt pays the uncached rate on every request, forever. Artificial Analysis qualified its own Pareto-frontier claim on the near-99% cache-hit path, then publicly corrected a cache-hit calculation minutes after a screenshot of it circulated. That is a fair read on how few teams measure realized hit rate at all.

The floor under the invoice did not move

Here the sources genuinely disagree, and the disagreement is the intelligence. The Information reads falling API prices against inflating hardware as a reason to rent inference rather than self-host: Amazon lifted 2026 capex to $220B from $200B, which Andy Jassy attributed to memory chip costs, while Apple's CFO warned advanced chip constraints will increase significantly this quarter. a16z reads the supply side and finds the opposite for anyone modelling their own compute, with 12-month H100 contracts just under $2.50/GPU-hour, roughly 40% above November, Kalshi forwards near $2.78 and A100 spot merely stable rather than collapsing. a16z also dismantles the chart circulating as proof that AI demand is falling. Silicon Data's Token Cost Index measures token-spend intensity, so a mix shift toward cheaper tokens drags it down while B2B spend on Cursor, Anthropic and OpenAI rises in total and at the median across the four biggest-spending industries.

Read together the picture is coherent. The token price on the invoice is a competitive concession, granted three weeks after launch in response to customer bill shock, and it is reversible. The compute underneath is not getting cheaper on any product timeline.

A price cut you did not earn can be withdrawn. Cache-hit rate, turn count and spend ceilings are cost reductions you own.

So the repricing exercise has a second half most teams will skip. Re-score the shelved features at the new rate card, then re-run the survivors at flat and +25% compute. Two questions decide the sprint: does the feature still clear at +25%, and does its cost scale with turns or with tokens. Features that only clear at today's prices belong on a shelf list with a named trigger, not in next quarter's commitment.

Four independent results, one shape

An engineer kicked off a cloud agent, went to lunch, and came back to a branch that actually ran. Not because the model got smarter that morning. Cursor's headline number is what gets quoted everywhere; the mechanism is the part that transfers to another team. Its cloud agents did not get a better model. They got development environments an agent can discover state in, execute against, and verify deterministically. That is unglamorous, model-agnostic engineering. It compounds with every future price cut instead of being invalidated by one.

The same shape shows up three more times. AgentRadio lifted SWE-Atlas QnA from 32.3% to 62.1% using asynchronous messaging across four agents, and beat a stronger single-model baseline doing it. Google's Chrome security pipeline pairs automated triage with a fixing agent, a critic agent, and test-writing agents verifying across every supported platform. It surfaced a sandbox escape that had been reading local files undetected for 13+ years. And decomposing an agentic task into guided steps succeeded 100% of the time against 50% for a single one-shot prompt.

The cost side compounds with the quality side

OpenAI ran the same play internally, moving auto-review in ChatGPT and Codex CLI to the cheap tier for a 10x cost reduction. Worth separating the thing being pitched from the thing being done. The pitch is frontier capability. The work is routing and harness design. Across every one of these results, the gains are coming from everything except the model weights.

Where it stops being free

Two caveats belong in the planning doc intact. Microsoft's Echoverse work found that shallow evaluation environments actively hurt live-site accuracy while deeper ones improved it. So agent evals running in thin mocks may not merely be under-measuring quality. They may be degrading the thing being tuned against. An organization-owned eval suite with deeper task environments comes before a budget cycle spent on a more expensive model tier. The tradeoff is real and worth naming: that suite is months of work nobody demos.

The second caveat is strategic and comes from swyx: if models can be distilled, agent harnesses can be distilled. Orchestration cleverness is not a moat. Proprietary environments and eval data are. Cursor's advantage is replicable by any competent team, including whoever competes with that team.

There is also a downstream constraint most capacity models miss. The mid-2026 consensus on LLM coding productivity is 2x, not 10x, with the weakness localized precisely to reasoning about code structure and documentation. Meanwhile the delivery queue has moved from authoring to review. GitHub shipped stacked pull requests to public preview specifically because AI now generates more change than a human reviews in one sitting, and a single AI code-review vendor claims 2M reviews per week across 6M repositories. That gives the forcing function for this quarter. Generation throughput on one axis, review wait time as a discrete cycle-time stage on the other. Buying more of the first without instrumenting the second funds a longer queue.

The reliability your team has been waiting on a model release to deliver is already available through decomposition, a critic pass, and an environment an agent can verify itself in.

What the payload actually does

An analyst opens a finished report, checks the figures, and forwards it. The numbers are wrong and nothing on the page looks unusual. Håkon Måløy's technique hides JSON instructions in white text at small font size inside a Word document. Copilot ingests them whether a user uploads the file or Copilot finds it in OneDrive and pulls it in as context. The result is not exfiltration. It is rewritten figures inside a finished report, with the same hidden instructions copied into the generated output file, so the payload spreads through ordinary document sharing. Disclosed in March, patched roughly 144 days later. Researcher and vendor agree the class remains viable with adjusted prompts.

The product translation is narrow and cheap. Input filtering is the half every team builds. Almost nobody strips instruction-like content out of generated artifacts, and that omission is what converts one injection into worm-like spread. Output stripping belongs in the definition of done for any feature that reads a customer document and writes a new one.

The verification market moved before the roadmaps did

Pathlock's survey number is the commercial half of the story: 53% of organizations cannot fully verify what their AI agents do across finance, HR, procurement and supply chain, four of the most audit-sensitive process domains in the enterprise. Invert it. Roughly 47% say they can. The market has already split into haves and have-nots on agent auditability, and nobody has definitively solved it with runtime tooling.

Capital is moving on that read. Okta is paying just under $200M for Permiso to monitor employees, service accounts, applications and AI agents after they authenticate, extending visibility into Microsoft Entra ID and Active Directory. The detection evidence is unflattering: of the three organizations reached during frontier-lab evaluation runs, two never detected the activity themselves. Enterprise monitoring stacks are blind to agent-driven activity. That is a demand signal with a price attached. Per-action, per-identity, SIEM-exportable agent logs plus a hard agent-memory reset, packaged as an enterprise tier rather than shipped as telemetry.

Three spec assumptions that no longer hold

• Guardrails catch bad tool calls. Agents chain individually benign steps into a full exploit, so single-action filtering misses it. The requirement is sequence-level trajectory scoring. That is a quarter of architecture work, not a sprint.
• Our integration surface is fine. Researchers disclosed a critical unauthenticated flaw in an exposed MCP bridge chaining code execution, credential theft, AI memory poisoning and persistent compromise. One vulnerability, a complete kill chain. "Do you expose an MCP bridge?" becomes a standing procurement question inside a quarter.
• Revocation works. The OWAReaper implant establishes server-side mailbox permissions that survive credential rotation and full device rebuilds. The same test runs against any product: revoke a credential, then check whether delegated grants, OAuth tokens, service accounts, background agents and agent memory actually lose access. Two-day audit. "Fully, with a documented revocation SLA" is a differentiator no competitor improvises on a call.

There is a dated forcing function. Zenity Labs presents PleaseFix chained with Intent Collision, covering 0-click account takeover, data theft and remote code execution, with a claim that every agentic browser on the market was affected, at Black Hat on 8/6. Expect enterprise buyers to pause or gate agentic rollouts that week. A launch landing in that window needs its containment answer to precede the feature demo.

Prevention is off the menu. What you can still sell is a failure that is scoped, logged and reversible — and almost none of your competitors have that written down.