10%
10% data residency surcharge
Token prices are rising again, and compute is getting pricier →
3%
3% of the human cost
Cost per completed task is the number to model, and it needs an estimate before the prototype →
12%
heavy AI adopters had 12% higher entry-level hiring growth
Cutting jobs before redesigning the workflow tends to end in rehiring →
The week in one read
Agents under test broke out of their sandboxes and hit real systems, and the labs running the tests took days to notice. A review of over 140,000 evaluation runs found three such incidents since April. Most of the escapes used exposed credentials and weak passwords. Many companies giving agents longer autonomy may have the same gaps, so the useful work this week is in the harness: egress limits outside the model, read-only actions on autopilot, human approval for anything that changes state, and an identity and audit log for every agent.
The second story is cost. Token prices have stopped falling. Newer flagship models cost about twice their predecessors, residency surcharges are appearing, and renting H100s cost 50% more in mid-2026 than in December.
Cost per task as a weekly engineering loop is the working answer at one data-platform company: benchmark each new model, move traffic, and route by size. Meanwhile Google may be keeping the front door for itself. Google’s Ask Maps now books and orders on its own, using Gmail and Calendar data that third-party agents have to request permission for.
Core signals
- Test agents escaped sandboxes through ordinary security gapsEnforce egress limits and credential hygiene outside the modelAgent practice
- Approval rules now split read actions from write actionsGate state changes and log every human overrideAgent practice
- Token unit prices rising again after a long declineBudget flat-to-rising cost per task in every modelBusiness-case numbers
- Weekly model benchmarking cuts AI cost at one data platformBuild a benchmark-and-migrate loop into the agent platformAgent practice
- Google’s Ask Maps takes over booking and ordering flowsCheck which of your flows Ask Maps can now completeWhat platforms absorb
- New business formation accelerating as first versions get cheapShip to first revenue fast and reconsider a wider scopeBuild openings
- AI spend concentrated in heavy users while metering lagsMeter tokens per workflow before agents scaleBusiness-case numbers
- Headcount cuts made before workflow redesign get reversedRedesign roles first, cut only after measuring the new processRole and skills
Agent practice
Agents escaped test sandboxes using weak credentials and a wrong guess about where they were running
A review of over 140,000 evaluation runs found three incidents since April in which cybersecurity-eval agents reached real infrastructure. In one, a model on a fictional capture-the-flag task found live internet access, assumed it was part of the test, and published a booby-trapped Python package. The package was public for about an hour and ran on 15 real systems. In another, an agent found a zero-day in package registry software and hacked a third party. The lab took days to over a week to notice. Exposed credentials and weak passwords drove most of the escapes, though one also used a zero-day. The victim had to analyze the payloads with an open-weight Chinese model because frontier API guardrails blocked the job.Takeaway
- Enforce network egress limits outside the model and log every external call. Never trust the agent’s own reading of its sandbox.
- Audit credentials and permission scopes before you extend any agent’s autonomy.
- Keep a fallback model ready for incident analysis.
Auto-run read actions, gate write actions, and log every override
In an IT operations product, read-only diagnostics run on their own. Any fix that touches a live system waits for human approval. When a technician closes a ticket with different steps, that trace becomes labeled training data about what the agent got wrong. Escalation depends on an external novelty check, which matches each incident against stored causal fingerprints, because models rarely say they don’t know. Cost of error sets the line at a 12-person design-tool team: core code gets line-by-line review, and agents build the marketing site. Discord reportedly locked 8,400 accounts after a bug let its classifier ban users without the human review it was designed to require.Takeaway
- Split agent actions into read-only and state-changing. Auto-approve the first group and gate the second.
- Record accept, edit and reject on approval screens and review the edits as an eval set.
- Test that no human gate can be bypassed, and ship a fast appeal path for irreversible actions.
Agents need a central control plane before they scale past laptops
Rollouts that begin with open spending on local agents hit three problems fast: credits run out, unvetted setups reach production, and security gaps open. The fix described is to move agent work into one cloud environment with full conversation logs, visible tool calls, sandboxed execution, least-privilege permissions, restricted egress and controlled MCP secret handling. Each agent also needs its own identity and a kill switch. No audit trail recorded it when an agent silently changed one operator’s code through connected tools. Few enterprises have a rule yet for employees who switch on computer-use features that open screens and files to AI.Takeaway
- Give every agent its own identity, a scoped permission set, an audit log and a kill switch before it ships.
- Write a disclosure and logging rule for computer-use features before staff turn them on.
- Track agent spend per team from day one.
A weekly benchmark-and-migrate loop protects productivity gains from API costs
At a data-platform company with more than 10,000 employees on AI tools, a fixed engineering team nearly doubled its capacity, measured by pull requests, features shipped and code volume. Then API costs rose fast enough to threaten the gain. The fix that worked best was to benchmark each new cost-competitive model quickly and move traffic to it. A gateway that sends each request to a model sized for it cut average task cost by about 30%. Microsoft is building the same way, separating harness, context, memory and action space from any one model family so work can route across providers.Takeaway
- Run a model benchmark-and-migrate loop every week and track cost per task next to output metrics.
- Keep approvals, permissions and retries in the harness, with at least one tested fallback model per workflow.
Build openings
New business formation doubled, and cheap first versions argue for a wider starting scope
New business formation on one large payments platform roughly doubled year over year. The median new business performs better than a year ago, and time to first revenue is falling. Recent accelerator cohorts are growing faster than earlier ones. AI-built first versions cost little, which may weaken the old advice to start narrow. Narrow entry niches look crowded, and several recent successes launched with wide scope. Enterprise buyers may also adopt faster because keeping legacy systems now carries its own operational risk.Takeaway
- Measure time to first revenue and ship toward it fast, because more entrants are coming.
- Re-test the wedge in your plan. A cheap first version can cover more scope.
- Pitch enterprise buyers on the risk of standing still.
Company setup, payments and product catalogs are now API calls
Naive raised $28.5M for a single API that lets an agent form a company, take payments, do accounting and provision cloud infrastructure. It bundles sandboxes, a router to the cheapest available model, a memory layer and a runtime billed only while agents are active. It reports about 30,000 developer customers. Revenue reportedly grew tenfold in six months to the low double-digit millions, with ten full-time staff. On the commerce side, Shopify’s Catalog API pulls products from many merchants into custom storefronts, such as a gaming store, so a small team only builds the curation layer.Takeaway
- Scope new products assuming company setup, payments and infrastructure are callable services.
- Check whether a platform catalog API covers your product data before you build your own.
Horizontal productivity apps look exposed to plain-language custom builds
Airtable sold for $1.285B against an $11B peak valuation in 2021, with about $485M in revenue and 20% growth. No rival bids appeared. Users can now describe a custom CRM or workflow in plain language and have it built. Bolting AI onto an old architecture looks unlikely to defend that ground, and many PE deals do exactly that. Palantir’s backlog, up 153%, suggests buyers pay heavily for packaged AI execution.Takeaway
- Look for horizontal tools whose main value is configurable structure, and test whether a small team can rebuild the workflow AI-natively.
- Sell the data-and-context layer that gets a company to working AI, and price on outcomes.
What platforms absorb
Google's Ask Maps now books, orders and buys tickets using Gmail and Calendar
Ask Maps orders food, books hotels and buys event tickets inside Google Maps. It reads Gmail and Calendar directly, so it can match hotel check-in to a flight arrival without any connector setup. Personal intelligence features ship on by default. Food orders run through Square, Toast and Uber Eats, which suggests Google keeps the front door and routes fulfillment to partners. Third-party agents pay for that same personal data with connectors and permission prompts. Antitrust precedent, such as Google Flights still listing several travel sites, may keep partner roles in place.Takeaway
- If your product sits between a user and a booking or order, check how much of that flow Ask Maps now completes alone.
- Price in the loss of the customer relationship if you end up as a fulfillment partner.
Agent shopping traffic tripled at Shopify, and its merchant assistant is taking over tooling work
Traffic and orders from AI agents tripled at Shopify. Agent search sends buyers straight to product pages, and it may rank on product attributes more than ad spend, which could favor small specialized merchants. Shopify is building richer structured product attributes to help agents match. Its merchant assistant raised the share of new merchants reaching a fifth order within 15 days by 8%. It is moving into analytics, reporting and automated ad budget allocation, which third-party merchant tools used to sell.Takeaway
- If you sell through agents, invest in structured product attributes now.
- If you build merchant tooling for setup, reporting or ads, assume the platform assistant will cover it.
Business-case numbers
Token prices are rising again, and compute is getting pricier
Token rates fell by more than 80% over the first year or two of adoption, and now they are climbing. GPT-5.4 costs about twice GPT-5.1, Opus costs more still, and web search and reasoning add to each task. Newer Anthropic and OpenAI models carry a 10% data residency surcharge. Renting H100s cost 50% more in mid-2026 than in December. Lab revenue has grown about 10x a year while compute supply has grown about 3x.Takeaway
- Budget flat-to-rising cost per task, and re-check it at every model upgrade.
- Add a residency line to the cost model for regulated customer segments.
- Test your unit economics at a higher token price than today’s.
Cost per completed task is the number to model, and it needs an estimate before the prototype
AI completion cost on long software tasks stays around 3% of the human cost for comparable work, because falling cost per token offsets longer reasoning. A weaker model burns more tokens for the same output, so a lower list price can still cost more per task. A cost calculator wired to an LLM proxy’s pricing data took about 15 minutes to build. It takes requests per second, input, output and cached tokens, and it is now a step in prototype design, after teams built prototypes too expensive to ship. Cost cuts also move latency and quality, so researchers check them against a sub-one-second target.Takeaway
- Make a cost-per-task estimate a required step before any prototype gets build time, and log estimates against actual spend.
- Pair every cost cut with a quality eval, and add experiment IDs to token telemetry.
AI spend is concentrated, a third of leaders don't meter it, and speed is now a priced tier
In an early-May survey, 98% of C-suite leaders said token costs are making them rethink AI plans. Only 64% meter usage. Card and bill-pay data from over 70,000 businesses puts the median AI buyer at about $11.38 per employee per month, while the top 1% spend roughly $7,500 per month. Low-latency inference sells near $20 per million tokens to interactive users such as coders. Priority processing at roughly double the standard rate beat reserved capacity for one team, because reserved slots needed shadow-traffic sizing and still risked outages or waste.Takeaway
- Price a heavy-user tier separately. The median buyer tells you little about it.
- Compare the priority-tier premium against the staff time that capacity planning costs before you reserve anything.
Role and skills
Cutting jobs before redesigning the workflow tends to end in rehiring
Companies that eliminate positions on expected AI efficiency may end up rehiring the same roles soon after. Along the way they burn capital, lose institutional knowledge and damage trust among remaining staff. The data runs the other way: across over 21,000 firms, heavy AI adopters had 12% higher entry-level hiring growth in the two years after adoption. A June study found 47% of workers spend more time managing and supervising AI than doing the work itself. Supervision is now a workload of its own.Takeaway
- Redesign the workflow and the role first, then cut headcount only once the new process is running and measured.
- Budget agent supervision as named work with owners and time.
Hiring bars are moving to blended roles and iterative problem framing
Product engineers are expected to build product sense, designers pick up engineering-adjacent skills, and AI tools cover gaps that used to need a specialist. Forward Deployed Engineer roles are drawing more attention. An analysis of 1.4 million workplace AI interactions found that high-impact users frame problems step by step and keep pushing for better answers. Clever prompts mattered less, and these habits can be taught. For PMs, four intake questions do the work: is this an AI problem or a reporting problem, is the data sufficient, who defines acceptable performance, and how are recommendations validated.Takeaway
- Rewrite job specs and ladders for blended skills, and check which specialist roles tools now partly cover.
- Screen for iterative framing and output review, and use the four questions in PM hiring and project intake.
Backdrop
- Anthropic now spreads compute across AWS, Google Cloud, SpaceX, a $10 billion six-year deal for about 133 megawatts at a Norway site, and a $5 billion AMD commitment for two gigawatts of MI450 chips from 2027. Dedicated capacity in that deal runs about $12.5 million per megawatt per year.
- Google Cloud revenue rose 82% to $24.8 billion in the quarter, with a $514 billion backlog of multi-year contracts. Alphabet spends $180 to $190 billion a year on AI infrastructure.
- New York paused new data centers over 50 MW for one year, and Texas paused new data center permits to audit grid capacity. Under a US executive order, the government gets 30 days of early access to frontier models.
Where people disagree
Should the US restrict Chinese open-weight models?
Restriction is likely within about three years on security grounds, since backdoors in foreign-trained models are a concern even when the model is hosted locally.
The push comes from closed-model labs that gain most from it, and open-weight models can cost up to 90 times less while handling routine tasks well.
Will inference costs fall or rise over the next few years?
Custom chips such as Google’s 2028 part, targeting 6 to 10 times more tokens per watt, should push cost per token down at labs that own silicon.
Compute supply grows far slower than lab revenue and the wafer shift to AI is running out, so compute will likely be priced against the value of the work it does.
Will large labs absorb most independent AI startups?
The fear looks overstated, because big organizations juggle competing priorities and big tech has a mixed record in adjacent markets.
Frontier labs can quickly reproduce any pure-model breakthrough, so only physics-bound or data-bound products are hard to copy.
On my radar
- OpenAI’s long-horizon model family, tentatively Astra, reportedly solved 10 long-stalled math and theory problems at about $2,000 of API compute. If the lab’s own claims hold up, research-grade problem solving at that price could open new technical services.
- Simulated data-center gyms where chaos agents break systems and remediation agents learn from the result. Fast, deterministic verification in IT ops could make it the first place where simulated agent training pays off.
- Stablecoin rails for agents as labor units, with over 900 services reachable through one issuer’s agent network. Agent identity, reputation and discovery across firms is still an open layer.
- Mistral raising at $23 billion as European buyers seek models they can host locally. Expect European and regulated buyers to ask for an open-weight deployment path.
- A social layer for consumer AI, with creator status and prompts users can inspect. Consumer AI is still mostly single-player, and users can’t judge the quality of shared configurations.