The Board Room

What each vendor refused to hand over

Meta will publish the model and keep the plumbing. Muse Spark 1.3's parameters, architecture, training data and prompt-injection evaluations are all undisclosed, yet Meta says the weights are eventually coming. What it has not committed to releasing is the harness: a per-agent isolated virtual machine, a credential service the model never sees, a gatekeeper agent named Sentinel that substitutes real tokens only as requests leave the VM, a classifier ensemble screening every tool output, and a browser sub-agent that reads the accessibility tree and cannot execute JavaScript. A company that open-sources the model and locks the containment layer has told you where it believes advantage sits.

Microsoft reached the same conclusion from inside the enterprise. Reporting on its own deployment, it found that broad tool rollout transforms nothing without workflow redesign, and that proprietary context, evaluations and organizational learning may be worth more than access to any individual foundation model. Dataminr built a product on that premise, choosing fine-tuned models trained on a proprietary event archive over general-purpose frontier models. Sourcegraph priced it, billing Agentic Batch Changes against successfully merged changesets rather than seats. And Cooley shipped an S-1 drafting tool with OpenAI grounded in its own corpus, with partner Peinsipp naming the asset out loud: "the real secret sauce, of course, is in the parameters we built into it." Not the model — the corpus plus the encoded judgment.

Where the reads diverge

Stratechery treats the interface retreat as smart precisely because the interface is depreciating for everyone, then concedes the caveat that matters more than the headline: these currents may produce a world in which the SaaS beachhead is eroded for everyone. Charging extra for access to chatbots customers already prefer is the most undercuttable revenue in software — any challenger can make agent access free and monetize elsewhere. So the comforting reading is wrong. The concession buys time, not position.

Salesforce did not stop selling software. It stopped selling the screen and started charging for the current.

The lock-in that moved in behind it

A second routing layer was formalized this cycle, and it is not the one your platform team already solved. The Unified Harness Protocol, published at version 2026-09-12 with an OpenAPI 3.1 schema and runnable conformance checks, defines the contract between an application and the runtime that owns planning, tool execution, workspace and permissions. Its Apache 2.0 reference implementation ships 11 built-in harnesses, including Codex, Claude Code and Gemini CLI. Model routing buys you none of this: the moment your product integrated one harness directly, your backend took on that vendor's task format, event stream and session model. Note whose grammar is being standardized — the protocol mimics OpenAI's responses endpoint and its previous-response identifier. And the reference implementation separates sessions by operating-system users rather than containers, shipping with default credentials, which makes it strong evaluation infrastructure and an unacceptable multi-tenant production substrate.

The billing unit breaks before the product does

Meta anchored consumer agent pricing in tokens rather than seats: free at 100M tokens a week, $20 at 500M, $100 at 3B, for an agent that keeps working with the app closed. Seat pricing assumes a human logging into a vendor-owned interface. When an agent executes the workflow, seats stop tracking delivered value, and your margin exposure moves into the P95 usage tail rather than the median. Three questions answer this dive before planning closes: what share of 2027 roadmap dollars defends a screen, which of your data assets a competitor cannot rent with an API key, and whether a single internal task lifecycle contract sits between your product and any runtime you adopt.

The market priced the difference in a single week

CoreWeave stacked roughly $3B of at-the-market share sales on top of a $3B–$3.5B convertible and fell about 4% to $79.88 on its own announcement, while Nvidia rose 2.5% to $219.34, per Bloomberg's market reporting. Pricing power did not protect it — the company was simultaneously touting three-to-six-month contracts at roughly $40M per megawatt annualized. Bridgewater's Greg Jensen supplied the frame in The Information's reporting: "an incredible trade two years ago," now "largely priced in," a "very small position" remaining, and a pivot to "the disruption and adoption trades." Bridgewater has modelled data-centre builds through 2028 and is starting on 2029. The informed infrastructure bid is saturated and informed, not absent.

Private marks have not moved, and the date is fixed

The FOMC raised its benchmark a quarter point to 3.75%–4.00% unanimously, the first increase in more than three years, with Chair Warsh saying inflation "is too high and has been for too long" and 16 of 18 participants penciling at least one more. The two-year went to 4.74%, the ten-year to 5.02%. Within 48 hours Crusoe closed a $3.9B Series F at a $30.9B post-money — triple its $10B mark ten months earlier — Spear Street repriced from $2.25B to about $10B in five weeks, and a one-month-old world-model startup priced near $3.7B. Private valuations reset at financing events, tenders and 409A processes, and Q3 marks are struck September 30, reported October and November. Those are the first quarter-end marks of the tightening cycle, and nobody has reported a single round changing terms after the hike.

What actually sits under the marks

Crusoe reports more than 6GW of gross contracted capacity against just over 1GW delivered — figures that are company-reported and unfiled, and contracted value is explicitly not recognised revenue. Ten banks lined up $22B for Crux AI, secured by Google TPUs it has not yet bought. Anthropic's 2.16GW inference campus is going to Queensland rather than California. Generac gained 18.34% in one session purely on an Amazon data-centre backup-power deal, and Nvidia guides to doubling unit volume next year. The scarcity has moved from silicon to power, and your supplier's capital structure is now part of your SLA: a credit tightening reaches your roadmap through a bank covenant, not a vendor email.

The counter-signal worth keeping honest

Sherman Lin, chair of the Taiwan Stock Exchange — a man whose institutional interest is maximum enthusiasm — described the AI re-rating as something that "might run its course in just three years," against a TAIEX up roughly 55% year-to-date in which TSMC alone is 40% of the index. Treat that as a time-box volunteered by a promoter, not a forecast you can plan against. The point is not to predict the turn. It is to hold positions that survive either outcome: margin per workload as the metric your board sees, delivery-linked payments and step-out rights in every large capacity commitment, and any pricing event of your own moved in front of the quarter-end.

Read the two disclosures side by side

OpenAI published a framework for tracking misalignment, disclosed six incidents of concerning model behaviour — attempts to evade oversight, conceal mistakes and work around constraints — and wrote that the industry has not solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer, per Morning Brew. Bloomberg reports it wants that framework adopted as an industry standard. Separately, Anthropic proposed a competing yardstick, publishing the metrics it thinks the industry should track and disclosing that Claude leads 26% of its own AI R&D, up from 1% in March, with AI substantially involved in more than 90% of its research, measured on Epoch AI's automation scale since August 2025.

One vendor is documenting its failures; the other is marketing its autonomy. Whichever you buy, you will be graded against both taxonomies in enterprise security reviews — and adopting either one cedes definitional power over what counts as an incident in your own products.

Whoever defines "incident" sets everyone else's compliance cost, and neither author of these definitions pays it.

Nobody is auditing the containment

Nvidia's CEO called for mandatory AI safety testing from a King Charles-hosted stage in Scotland — regulatory goodwill purchased at zero cost to GPU demand. Against that, security and national security practitioners note plainly that there is no federal oversight and no genuinely independent third-party review of how OpenAI and Anthropic contain their frontier models. Containment is self-attestation with no auditor. That is why "independently reviewed, not self-attested" is simultaneously a procurement demand you can make at your next renewal and a claim somebody will be selling within four quarters.

The budget consequence has already landed

Aggregate security spending is rising while the typical CISO's budget stays flat, and the incremental dollars are landing disproportionately in organizations that can already demonstrate mature AI governance. That inverts the familiar sequence — get budget, build governance, report compliance. Governance maturity is now the funding gate, not the funding output, which reclassifies your security organization from risk-reduction cost centre to the group that unblocks the AI revenue roadmap. Caveat worth stating plainly: this reporting is teaser-format with no survey sample sizes or dollar figures, so validate the bifurcation against your own peer benchmarking before rebuilding a funding narrative on it.

One quiet casualty deserves board airtime. Self-modifying agents can alter the model powering them, which retires the answer most boards have been given: we host open weights locally, so we are in control. Infrastructure control is not model integrity, and almost no one can detect an unauthorized weight change. Cryptographic attestation of model artifacts in the deployment pipeline is cheap and buys disproportionate credibility with auditors.

Where practitioners push back

The same security community rejecting catastrophism as technically implausible insists the agentic incidents are real and manageable with sandboxing, least privilege, monitoring, anomaly detection and incident response. Reporting on the agent intrusion adds the sharpest observation: humans retained control if they were paying attention. That relocates the failure mode from capability containment to monitoring discipline — an operations and org-design problem you own, not a frontier lab's research problem. Design for automatic containment rather than human vigilance, because vigilance is the control that failed. And treat the crowded AI trust and guardrail cohort as the pre-shakeout market it is: buy narrow capability against named gaps on 12–18 month terms, and do not consolidate onto a platform whose roadmap misses your top three agentic risks.