The Board Room

One manifest line was the entire attack

The largest Rust crate compromise by download count needed no exploit. One dependency line went into the Cargo manifests of arrayref (244M downloads) and append-only-vec (4M), pointing at proc-macro1, a typosquat that cloned the real crate's description, author, and docs. The payload sat in a build.rs script Cargo runs automatically. The genuine upstream library code was untouched. No import required, no binary shipped: compiling was the compromise. The Hacker News reports the initial vector was a compromised maintainer account, not a code review gap, in the ecosystem most often held up as the safe one.

Two consequences get missed at leadership level. Crate deletion is not remediation, because pinned lockfiles, build caches, and vendored copies still carry the malicious versions. Any credential that lived on an affected CI runner should be treated as exposed. This is an infostealer incident at developer privilege, not a dependency bump.

Agency, not severity, should rank the next two weeks

Scanners rank by CVSS and auditors ask by CVSS, which is a reasonable way to run a queue and a poor way to run a fortnight. The dimension that gets skipped is how much power the defender actually has to fix it.

On identity, the exposure is wider than one CVE. Google is tracking three Russian clusters, UNC6293 and UNC7005 as likely APT29 sub-clusters plus UNC5976, reaching mailboxes without stealing a password: app passwords, OAuth consent grants, device codes, WhatsApp device linking. MFA held every time and the mailbox was read anyway. Detection has to move from authentication to authorization, executives' personal accounts included, and those sit entirely outside company telemetry.

The bottleneck is throughput and org design

All four events were known within hours, so knowledge was never the constraint. Change-management latency and finite platform-engineering capacity are, and when four criticals contend for the same people, one quietly misses its window. GitLab was weaponized within days of disclosure. On NetScaler the sources diverge usefully: Rapid7 sees no exploitation of CVE-2026-19490, a pre-auth bypass on Gateway and AAA virtual servers, and still recommends emergency patching. A skeptic would read that as overcaution. ShadowServer counts 22,000+ ADC and 1,800+ Gateway instances internet-facing, and 22 Citrix bugs have been exploited in five years, six of them in ransomware. "Not observed exploited" is a clock, not a reprieve.

The harder problem is not security-owned, which is why it survives every tooling cycle. Build infrastructure is the highest-privilege, least-governed environment in most technology companies: owned by platform engineering, budgeted as developer productivity, monitored by nobody. A tool purchase does not close that gap. A named owner and a funded program does.

When a 10.0 in an identity provider arrives with "no customer action required," the fix that matters is not in the software. It is in the vendor terms.

One sourcing caveat: several round-ups carried truncated article bodies, so affected version ranges and prerequisites should come from primary vendor advisories before any change ticket is written.

Capability is being funded by output length

The two largest capability gains this cycle were bought with tokens, not efficiency. Qwen3.8-Max added eleven points on Artificial Analysis' intelligence index and moved from $0.54 to $1.13 per task, entirely because it generates more output. Grok 4.6 added five points and went from $0.36 to $0.84. List prices per token held roughly flat through both moves. A three-year business case resting on declining inference cost of goods is therefore empirically wrong for reasoning-heavy work, and the error compounds with agent adoption rather than decaying.

The market repriced this in ten weeks

Stripe confirmed its purchase of OpenRouter at a reported $7.5 billion. The same five-day window produced Ramp buying router.com to house its own Router product, and Merge shipping Merge for Workforce with a claim of 75x fewer tokens for better results. The buyers are the tell. Neither Stripe nor Ramp is an AI lab. Both already own spend rails, and both are now treating tokens as a governed spend category sitting next to payments and corporate expense. That is a bet that the durable asset is spend attribution and distribution, not model access.

The tradeoff most org charts never named is now visible. Engineering owns latency and quality. Finance owns the invoice. Nobody owns cost per successful outcome, which is the number that decides whether gross margin survives agent volume. Vendors will monetize that gap on the buyer's behalf if the buyer declines to. The CIO Dive read of a "cautious AI era" is the same condition seen from the buyer side: deployments narrowing to measurable use cases because token consumption makes open-ended adoption hard to justify. Anthropic now publishes an enterprise guide for controlling shared usage-based spend. Category leaders do not write spend-control documentation unless buyers are being surprised by invoices.

Where the evidence is thin

A reasonable skeptic would say the magnitudes here are vendor-supplied and should be discounted accordingly. The skeptic is correct. DeepSeek priced an experimental multimodal agent model at roughly $0.87 per million words against Anthropic's ~$50, a 57x spread, on self-published figures; the model wins only 3 of 11 benchmarks by narrow margins, trails on 8, and was never run against Opus 5. Merge's 75x claim discloses no baseline and no workload. The routing coverage carries a disclosed conflict, since two of the three companies in it are the author's own portfolio. The direction is corroborated across sources. The magnitudes are not. Verification belongs before the board deck, not after it.

The winning model in 2026 is not the one that scores highest. It is the one that finishes in the fewest turns, and almost nobody is measuring that.

Read the table as a routing map, not a ranking

The under-exploited line is the 27B Apache-2.0 tier, capable enough to run on a consumer machine. Counsel should clear the Max-tier license thresholds of $20M monthly revenue, 100M MAU, and $50M annual for model-as-a-service before anything ships on the licensed tiers, because that decision is cheap this quarter and expensive next. Andrew Ng's skills map, built from job postings and expert interviews, identifies disciplined evaluation and error analysis as the differentiating trait of strong AI builders. That is the same capability that makes every number above measurable in a buyer's own environment rather than in a vendor's.

The seam opposing counsel will find first

Insilico Medicine said a pulmonary fibrosis molecule was "discovered by" generative AI, then filed the patent naming five humans and no AI. Only humans can be inventors, whatever the model contributed, so the filing is correct. The cost is that both claims now sit side by side in the public record, which converts a legal necessity into a validity and credibility attack surface. Any firm that did both sits on that seam, and the count grows as generating a candidate design gets as cheap as generating text.

The remedy is weeks of unglamorous work: every AI-assisted filing from the last 24 months set beside what marketing said about the same work, and a contemporaneous human-conception log running from here forward.

Detection is arriving as an industry default, not a vendor quirk

Anthropic will embed SynthID-Text watermarks in every Claude model launched after August 2, 2026, worldwide rather than EU-only, to satisfy Article 50 of the AI Act; a detection API returning probability scores follows. Deterministic code carries fewer marks; non-deterministic code and code comments stay detectable. OpenAI, Google, Meta, and Microsoft have signed the EU Code of Practice, which makes provenance marking the default rather than one company's stance.

The board-deck version is a compliance item. The complete version is a 12-to-18-month horizon in which a customer, an auditor, or an acquirer can probabilistically estimate the AI-generated share of a codebase or a set of consulting deliverables. That reaches IP warranties, professional-services contract terms, and M&A diligence, where a probability score is enough to reprice a deal. Anthropic absorbed real backlash, including privacy objections and Steven Sinofsky invoking a "right to private thoughts free of a digital trail," which guarantees a competitor markets the no-watermark position. The answer needs to exist before a customer asks for it.

The asset side: the input nobody can synthesize

Simile AI, a roughly 60-person Stanford spinout, raised a $2B Series B from GreenOaks and Index, Fei-Fei Li and Andrej Karpathy on the cap table, for behavioral foundation models that predict what people do rather than what they say. Reported fidelity: 85% of the accuracy with which the same humans reproduce their own responses two weeks later, against 50-60% for frontier LLMs on general populations and 20-30% on niche ones. CVS runs tens of millions of simulations, Gallup is a strategic partner, Shopify built an internal equivalent called SimGym to find interventions that lift conversion.

The scarce input is not the model. It is first-party behavioral data: transaction logs, session telemetry, support transcripts. Most companies granted rights to exactly that data inside analytics and vendor contracts written before this category existed, which prices the one uncopyable input at zero.

Weak links, named: the 85% figure comes from the vendor's own research lineage, validated against a 1,000-person representative sample and not independently replicated at enterprise scale, and the post-training rests on a social-science literature with a documented replication crisis. That argues for cheap pilots with human ground truth in reserve, not a platform decision.

Provenance used to be a values debate. It is now something a buyer's counsel can measure on your codebase and your patent file.