The Board Room

Why recruiting stays unowned

No function owns this control because liability runs in both directions. Miss an operative and the exposure is sanctions and disclosure, since wages route to a weapons programme. Over-screen and the exposure is national-origin discrimination at scale. Endorsed's own CTO grew up in a Dallas suburb, went to UT Austin, spent his career at LinkedIn, and matches nearly every published fraud pattern. Over half of flagged applications carried a LinkedIn profile, and claimed employers (Amazon, Google, and Meta lead the list) are fabrications engineered to look statistically unremarkable. Screening on name, state, school, or employer becomes a trap the moment it is written into a process. Any control that works by reading a résumé is adversarially compromised.

The second door: the update channel

The routing incident matters for which controls were present. AS62390 announced a /24 inside Hetzner's space, more specific than Hetzner's /16, so ordinary route selection preferred it. The hijackers forged the AS path to retain Hetzner's AS24940 as apparent origin, and the route validated as RPKI-clean; network analyst Doug Madory confirmed it publicly. They obtained a legitimate TLS certificate in Softaculous's name, cloned the site, and served malicious Virtualizor updates to hosting providers for 33 hours. The vendor still cannot say how many customers were affected, because the hijacked traffic never touched its infrastructure. Two of the three controls engineering teams cite as proof an update is authentic were present and did nothing. The survivor is a detached artifact signature verified client-side against offline keys.

The third door: the integration list

McKesson involved no exploit. Social engineering plus cloud credential abuse reached third-party applications and exfiltrated customer data across three business units in four days. McKesson detected the activity and shut systems down on 25 August, after the data was gone; ShinyHunters set a 1 September deadline against a demand reportedly above $55 million. The same week ServiceNow patched three unauthenticated CVSS 10.0 flaws in its AI platform, and management platforms hold privileged integration credentials, so one unauthenticated endpoint is the blast radius. CISA built its FY2024–2025 review as a baseline before widespread AI-enabled vulnerability discovery, which is a regulator saying remediation throughput, not detection breadth, becomes the binding constraint.

Where sources agree, and the number to discount

The reporting converges on one board-level correction: coverage metrics out, mean-time-to-contain and enumeration in. It diverges on the headline. A skeptic would note the 47% figure is a Q3 2025 vendor-scored estimate from a pre-flagged sample, produced by a company selling the remedy. The skeptic is right. The 11% Q3 2024 baseline and the four-quarter trajectory between them are the sturdier facts, and they concentrate in the roles holding production credentials.

One dislocation is worth naming. PitchBook data shows cyber venture funding flat at $8.5B in H1 2026 while deal count fell 23.8%, with identity and access management collapsing from $0.8B in Q1 to $0.3B in Q2, a 62.5% contraction attributed to fear that frontier models commoditise AI-native security. The same reporting puts nonhuman identities ahead of humans 45 to 1 in typical enterprises. Structural demand is expanding while the clearing price is depressed. Terms for acquisition or preferential partnership in workforce and machine identity are better at this funding level than after the first large-cap disclosure event reprices the category.

Every ingress path in a company has a named owner and a budget line, except the three in these cases: the offer letter, the update server, and the OAuth grant.

Read the arithmetic before the headline

The comparison that produced the headline was not run on matched configurations. Glean ran Opus 4.8; Claude Cowork ran Sonnet 5 with high reasoning. Anthropic's own site states Sonnet 5 performs close to Opus 4.8 at lower cost, which means fewer tokens on a more expensive model does not mechanically produce an 81% cost reduction. Anthropic declined to comment, so the claim ran unrebutted for a full news cycle. The defensible read is directionally credible, magnitude unverified. The mechanism is the part that survives audit: a context layer mapping relationships across corporate data so agents stop burning tokens searching, plus complexity-based routing that sends easy work to cheap models. A Google Cloud-sponsored MIT Technology Review survey of 300 technology leaders reaches the same conclusion from the buyer's side, naming a trusted data foundation as what separates working agent deployments from stalled ones.

The scissors underneath the benchmark

Two facts moved in opposite directions the same week, and the pairing matters more than either alone. Anthropic signed a $35B compute lease with Lambda Labs days after $45B with Nscale, on top of $40B committed to SpaceX through 2029 — roughly $120B of fixed, long-dated obligations in about a year. In the same window Z.ai launched GLM-5.3 Flash at $0.15 per million input tokens, grew API revenue 28x, and said openly that the price war it leads will damage its own margins. Suppliers are locking cost at 2026 prices while the unit price of the thing they sell deflates toward utility levels.

That scissor is why the supplier-as-competitor detail is the strategically loaded part: Glean beat Anthropic's own application while paying Anthropic for the model underneath it. Model vendors now ship business-task applications directly, and the contested ground between them and the application layer is precisely the context layer a hyperscaler can bundle natively inside one product cycle.

What the sources disagree about

The tradeoff is narrower than the argument sounds. Both camps agree on the operating conclusion: rent the models, own the graph. The disagreement is only about how much of the intermediary layer is worth buying on the way there.

The number that does not exist yet

Cost per completed task currently sits between the CFO's cost centre and the platform team's dashboards, which is to say nowhere. Seats were a stable unit of account; tokens consumed per completed task are not, because they move with retrieval quality, reasoning depth, and how long an agent runs. As one vendor CEO put it, AI was not expensive last year because it was not doing complex things; now it runs for a long time and costs a lot. A renewal signed before a matched-configuration number exists is signed on somebody else's arithmetic, and that same measurement discipline is the hedge if a major lab's economics break under those fixed commitments.

The enterprise AI question stopped being which model is smartest and became who wastes the fewest tokens finding the right data.

The paper trail, and what it does not prove

The schedule is harder to dismiss than the performance claims because it sits in two years of public appearances. Architecture concept completed in October 2024, about a month after o1 shipped and reasoning workloads came into focus. By a March 2025 Synopsys keynote the team was six weeks into RTL. Silicon came back in May 2026 and was running OpenAI's own coding agents that same month, implying unusually clean first-silicon bring-up. The relative performance figures, beating Blackwell on throughput per watt and latency plus a 56% BF16 multiplier gain, come from OpenAI's slides with no third-party benchmark behind them.

The skeptic's case starts with the RTL freeze, and it belongs in the memo. Major changes landed up to the day of freeze, a flexibility traditional flows forbid because layout locks early, and on N3 that trade prices in respin and functional-escape risk. The open-source front end used, XLS, states on its own project page that it is not an officially supported Google product. Nine months may also reflect a rare concentration of Google-trained talent rather than a transferable method. All three objections hold, and none of them touches the calendar.

Why the number matters even if it is not repeatable

General-purpose GPUs dominate for a reason unrelated to efficiency: nobody wants to lock a three-year silicon bet around a workload that may change in six months. That risk premium is a meaningful share of what merchant silicon collects. Cut design time to nine months and the cost of being wrong falls sharply, which makes specialisation affordable even when a given bet misses. The recursive part compounds it, since coding agents helped design the chip and the chip now serves the coding agents, giving anyone who owns both workload and toolchain a compounding cost curve against a linear improvement gated by a supplier's margin for everyone renting.

Method also leaks faster than product. Google originated nearly this entire stack: the TPU programme, high-level synthesis, reinforcement-learning placement, learned coverage prediction, and XLS itself. It open-sourced the techniques and lost the people. Key contributors are now at OpenAI, the placement team left in 2025 to sell a commercial version, and MediaTek reimplemented the technique into its own advanced chips without licensing anything.

The three constraints that decide who can follow

• Implementation capacity. Design capability is diffusing while N3 physical implementation concentrates in Broadcom, which serves both Google's TPU programme and OpenAI. That dual position is a negotiating fact, and IP-isolation terms plus dual sourcing are what it costs to neutralise.
• Power. More chips are being bought than there is grid capacity to energise, and the substitution path is worse: roughly 50GW of combined annual turbine capacity across the three main suppliers, sold out to 2030. Vendors quote chip delivery dates rather than energisation dates, and the gap between the two is where capital dies.
• Memory and the second source. CXMT's first HBM3E parts begin unwinding memory pricing power, Nvidia is hedging its own stack with $3.5B of convertible capital into MediaTek, and The Information reports a sub-$1B non-Nvidia inference provider fielding multiple acquisition offers at a $200M-plus valuation. Non-Nvidia inference is now showing up on procurement shortlists.

The planning conclusion is unglamorous. At a roughly four-week frontier release cadence, nine-month silicon is still ten model generations behind, so commitments belong to durable workload classes such as reasoning, agentic serving and long-context inference rather than to any particular model. Direction can be committed now. Capital should wait for independent numbers.

A three-year silicon bet is now a nine-month experiment. The firms that own both the workload and the toolchain compound faster than anyone renting.