The Board Room

The mechanic deserves a second read from procurement. The advisory tells labs to reduce reasoning depth, present correct information with different reasoning, introduce stylistic inconsistencies, and vary the degradation across requests "to complicate response quality evaluations". It also tells them not to inform the affected users. Safety researchers and third-party evaluators get an explicit carve-out and should be told.

The carve-out is the tell. Exempting evaluators concedes that degradation defeats measurement, which means a two-tier reliability regime now exists in a market where every SLA, eval score and cost-per-task model assumes a stable endpoint. Sophisticated buyers will negotiate into the top tier. Everyone else keeps paying specification prices for a discretionary output and never sees the difference, because the recommended pattern is built to survive a single-shot test.

The second front is provenance, and it arrives as a document request

The same advisory accuses Moonshot AI of distilling 17 American models, including Anthropic's Claude Fable 5, released only months earlier. Moonshot declined to comment. Its Kimi K3 is described as a genuine global hit, which is the reason the advisory exists at all. This is not litigation. It is a procurement artifact that any enterprise security reviewer, government buyer or acquirer can cite from next week, and exposure counts when it is indirect: through a multi-model router, a fine-tuned open-weight derivative, or a SaaS vendor's undisclosed inference stack.

Confidentiality moved in the same cycle. OpenAI, disputing an attribution claim, conceded it "cannot rule out that de-identified data derived from their usage of our products helped improve our models." Read that alongside model vendors pushing into finance workflows and payments, and one exposure has two faces. The supplier can vary what it delivers, and may learn from what it receives.

Where the reporting converges, and where it splits

Four independent accounts agree on the facts of the advisory and on the direction. Model supply chains are now a documented, disclosable part of enterprise risk. They split on the first move. One line of analysis says contract first: a non-degradation and disclosure clause. Another says documentation first: a model bill of materials naming every model, router and derivative in production within ten days. A third argues for a 30-day lineage sweep across production, fine-tuning and evaluation stacks, on the view that country-of-origin becomes a procurement gate before enforcement arrives.

They are sequencing the same three artifacts, and the order that holds is cheapest-first. The clause costs a letter. The bill of materials is what the first customer question demands, and producing it under deal pressure turns a memo into a discovery project. The measurement harness comes third and matters most, because longitudinal telemetry is the only evidence base that would ever support a contractual claim.

A vendor's refusal to put non-degradation in writing is itself the intelligence, and it belongs in the risk register rather than the follow-up folder.

A reasonable skeptic says no lab will ever sign this. Some won't. The negotiation is still cheapest now, before the practice normalizes and vendor legal positions harden. The predictable failure is filing all of it with the security team. This is supply-chain integrity with revenue, contract and disclosure consequences, and it needs an owner who sits at the executive table.

The transferable part is the architecture, not the theorem. Roughly 10,000 concurrent agents explored for about 88 hours against executable code and a cached copy of the internet, producing an analytical proof plus a Lean formalization, Lean being a checker that walks a proof line by line. A weaker model then spent 17 hours verifying it. The bill: 2.7 million messages and 130 billion output tokens on this problem, roughly 300 billion across everything attempted. Strong model explores, cheap model proves.

OpenAI then declined the $1M Millennium Prize and conceded competing priority: two mathematicians published overlapping blowup results roughly twelve hours earlier, one an Anthropic employee working independently, both using OpenAI's own coding tool. MIT Technology Review quotes NYU's Tristan Buckmaster calling it a "Deep Blue–Kasparov moment" and asking for "serious and unhurried discussion." He will not get it. The priority dispute is unresolved while the token cost of the attempt is already a line item in cloud spend.

The filter, not the milestone, changes the portfolio

The result was discussable because it was machine-checkable. A formal certificate is the one class of AI output nobody takes on faith, though a human still has to confirm the formal statement says what the field thinks it says. Innovation portfolios sort the same way. Problems with formal, simulation-based or test-based acceptance criteria are swarm-attackable at a price. Problems whose correctness is a matter of taste stay expensive, and senior human time belongs there.

Scarcity is drifting from generation to verification, and better models will not fix it. Both leading labs concede the limit: OpenAI's chief scientist Jakub Pachocki stated no lab knows how to safely reach full recursive self-improvement, and Anthropic published that autonomous successor development "has not been achieved and is not inevitable." When AI does the checking, the evaluator's weaknesses become the system's blind spots, invisible from inside the loop.

The financing side has not caught up

Cognition's most recent disclosed round cleared at roughly 53x run-rate revenue, the same multiple as its previous round after doubling both revenue and valuation, on approximately $900M ARR against up to $800M of cash burn, unaudited company figures. Nvidia, Citi, BNY and Mercedes on the roster settles the demand question and says nothing about inference margin. Capital is still paying for growth without asking, which is a reason to raise now and a warning about the repricing after.

The supply side sets the longer clock. Frontier compute carries roughly 15-month lead times and is migrating toward neoclouds: Figure's multi-billion-dollar agreement for up to 100,000 GPUs does not begin delivering until late 2027. Anything promised for 2028 rests on a commitment signed closer to now than feels comfortable, staged against demand milestones, with export-control and end-customer verification clauses so capital intensity does not outrun monetizable workload.

Compute buys discovery at a published price. Verified output is a separate purchase, and licensed data a harder one. The next dollar of differentiation goes to whichever of those a firm can actually secure.

The economics are the tell. OpenAI has pitched investors aggressive advertising growth as the route to monetizing an enormous non-paying user base, then voluntarily narrowed the pool of advertisers it will take money from, excluding exactly the category its own features now serve. Companies forgo revenue to protect what they consider core. The exclusion list reads as roadmap disclosure.

The timeline deserves equal weight. Search took roughly a decade to reach credible self-preferencing complaints. App stores took about five years. This arrived inside a first monetization cycle, before the ad business is even scaled, and the restriction never appeared in the published policy. The durable damage came from the undocumented change, not the change itself. Versioned eligibility rules and a partner change-notification SLA cost about a quarter of legal and comms time.

The price of agentic work has already been set

Meta's agent holds purchase authority, interacts with email, and arrives as a contact inside an installed base measured in billions with no download step. Its free tier and its $20 and $100 paid tiers now anchor consumer-adjacent agentic pricing; Meta internally considered $200 and backed off. Acquisition models that depend on an app-open now carry a worse CAC curve than anyone distributing in-thread, and that gap widens with every tier Meta does not have to charge for.

The exposure most companies will book as fraud

Agent-originated revenue will arrive as behavior existing systems classify as abuse. Bot detection, velocity rules and CAPTCHA layers were built to stop precisely this pattern, which leaves two outcomes: blocking paying customers, or waving through automation that cannot be authenticated. Meta concedes its agent "isn't immune to attack" from prompt injection, so some of that automation will act on an attacker's instructions rather than the customer's. Human-in-the-loop confirmation on the agent's side is not a control the merchant owns; the only confirmation worth trusting is enforced server-side on irreversible actions.

Coverage diverges usefully on urgency, and the disagreement is worth naming rather than averaging. A skeptic would read the ads exclusion as administrative lag at a single lab in a single category. That reading is plausible, and it does not disturb the lesson that access is contingent. A second reading argues for capping assistant-surface dependency below 15% of pipeline outright. A third notes the agent launched US-only and 18+, a company pre-pricing impersonation and minor-protection scrutiny; if international expansion stalls on regulatory friction, the distribution threat compresses into a US-adult channel and messaging-surface urgency drops a full quarter.

Distribution you do not own is a lease, and this landlord has shown it will change the terms without telling the tenant.

The counter-position is available immediately, which makes it a this-quarter decision rather than a this-decade one. A surface that can credibly say it does not compete with its advertisers has a live wedge into creative and vertical-AI budgets that are being reassessed right now. Neutrality differentiates only while that reassessment is live.