The Product Desk

The token gap grows on real workloads. AI Breakfast modeled 1M requests at 2,000 input and 500 output tokens each. That comes to about $45,000 on Astra versus $4,810 on Large 4, roughly 9.4x cheaper. Output-heavy features such as drafting and agent loops get closer to 12x. Your CFO will see this number first. It is also the weakest number in the decision, because it measures tokens rather than finished work. One widely shared claim put Large 4 at “a third” of Astra's price. The published rates show the gap is much wider than that.

Three numbers the price sheet leaves out

1. Success rate

Every Large 4 benchmark is self-reported. The only head-to-head result against Astra is visual grounding: 42% on Dense 200. The score closest to B2B agent work is AutomationBench, where Large 4 completed 59.9% of 657 workflows across Gmail, Sheets, Slack and Salesforce. Astra has no published score on that benchmark, so you can't tell whether that means parity or a gap. Large 4 scored 28.3% on Terminal-Bench 4, which says long-horizon work still needs a human checkpoint. If the cheaper model fails more often, retries and human fixes eat the discount. Cost per successful task is the only comparison that holds up.

2. Hosting weight

Large 4 is a mixture-of-experts model: 1 trillion total parameters, of which 49 billion are active for each token. Morning Brew points out that the nickname “Le Chonk” exists for a reason, because hosting it takes serious infrastructure. What you save with open weights depends on your volume and on whether you self-host or rent a third-party host. Morning Brew's sharper point is about predictability. Closed APIs are “hard to budget for,” and a usage-metered bill swings most when your feature succeeds.

3. Security operations

Self-hosting moves the attack surface onto servers you run. The next dive covers why that cost just went up.

The change is in the vendor list, not just the price

Until now, enterprise buyers had two realistic options: closed US frontier APIs, or Chinese open weights that security-conscious Western buyers avoid. Morning Brew describes Mistral (France) and Nvidia-backed Reflection AI (US) as a third option: Western open weights. You can tune these on your own data inside your own environment. Reflection's Beam technical details are due later this month. In public-sector and regulated deals, model origin and hosting location now become sales arguments.

The labs themselves are starting to treat models as interchangeable. Elon Musk said SpaceX's AI unit will run Grok partly on rival models, including Anthropic's Opus 5.5, as reported by The Information and AI Breakfast. The only source is a single overnight post. Still, if a lab with its own frontier models buys from competitors, staying with one vendor should be a deliberate choice, not a default.

The sources frame the opportunity differently. AI Breakfast leads with the size of the discount. Morning Brew argues that budget predictability matters more than price. Both point to the same move: measure before you migrate, and have the measurement done before the wider release removes your excuse for waiting.

A token that costs 12x less only makes a feature 12x cheaper if the cheaper model finishes the job just as often.

Anthropic's wording about GLM-5.3 sets the stakes: “a critical threshold in freely accessible capabilities has now been crossed,” per The Information. Closed-model safeguards only protect you while the strongest offensive capability stays behind them. Anyone can download open weights and strip the safeguards out. Mistral is adding to that pool: AI Breakfast reports it plans to openly release a model that solves 93% of Cybench challenges. Mistral's Pierre Stock told Axios, as Morning Brew relays, that wider availability improves defenses and lets researchers audit the technology. Both views can be true. Either way, attacking your product just got cheaper.

Anthropic's answer: gated defense, now open to more teams

The tiers differ by which safety filters are removed, not by how tightly they're tuned. On CyScenarioBench, AI Breakfast reports Defense Access is blocked on 46 of 50 tasks and Red Team Access on none. Program partners found 129,000 verified vulnerabilities from April to July 2026. For most product teams, Red Team Access is the realistic target. It lets you aim the same class of model attackers now run for free at your own auth flows and APIs.

Self-hosted AI is already being hit

CyberScoop reports that the PoeLLM botnet turns compromised open-source AI servers into proxies that scan for exploits, mine cryptocurrency and run remote code. It finds its command-and-control servers by running four words from a poem posted on GitHub through a dictionary built into the malware. Network monitoring can't see this, and the operators can switch servers without updating the malware. The practical early warning is behavior on the host itself, especially compute spikes nobody can explain. The reporting doesn't name which AI services were hit or how attackers got in.

Attacks are also getting faster. Former NSA chief Paul Nakasone says AI has cut adversary dwell time, the time an attacker sits inside a network before acting, to an average of about 29 minutes. He gives no methodology. CSO reports that AI is speeding up exploits against already-disclosed flaws, and that disclosures and exploits have reportedly doubled, though it gives no baseline. CSO also reports a root-level backdoor in a trusted low-code AI app builder, which it doesn't name. That is the kind of tool product teams use for prototypes.

What this means for your roadmap

First, any self-hosting scenario in your cost model needs a security operations line. Self-hosting still makes sense on privacy and cost, but only if someone is staffed to run it securely. Second, buyers will start asking. Bloomberg reports that JPMorgan CEO Jamie Dimon says Mythos has raised global cyber risk 10-fold. That is his opinion, not a measurement. But it comes from a major enterprise buyer, so expect financial-services security reviews to ask which model you run and how you contain agent actions. AI Breakfast expects regulated buyers to pay for governance they can verify.

When a frontier-grade attack model is a free download, your security backlog stops being tech debt and starts competing with features for roadmap capacity.

Cat Wu's admission carries weight because of where she works. The Information's author calls Anthropic “perhaps the most AI-pilled company in the world,” and its staff are now being pushed to ask, “Why am I still in that loop?” At the same Modal conference, ex-OpenAI researcher Diogo Almeida explained why automation stalls: “100% of LLMs today are optimized for assistance with RLHF.” Models trained to please a human reviewer are good at assisting and weak at running unattended. OpenCode's Dax Raad described the quality side: engineers aren't paying enough attention to code the AI writes.

Taken together, these say the human's 20% is both the ceiling on throughput and the weakest point for quality. A person who finishes every instance limits how far the feature can scale, and doing the same review over and over leads to rubber-stamping.

Vendors are building the handoff into products

• OpenAI's Decisions API (public beta, runs only on GPT-6 Luna) returns a probability that a statement is true, a choice with a confidence score, or a numeric rating, instead of prose. OpenAI claims it is about 10x faster than its Responses API, and it hasn't published pricing. Simplifying AI points out the catch: a router sold by OpenAI has no obvious reason to send your traffic to rival models.
• ElevenLabs' Architect searches thousands of call transcripts for failure patterns, builds fixes, tests them in simulation and saves each one as a versioned draft that someone must approve.
• Claude in Google Workspace (reported, in public beta) asks before each edit by default and offers an opt-in mode that runs until the task is done.

What these share is that the confidence threshold becomes a product setting. High-confidence cases go straight through, and only uncertain ones reach a person. That is how a product moves from a human reviewing every output to a human handling only the exceptions.

Pricing follows what you can verify

TLDR Hardware's report on GPT-Synopsys shows where this ends up commercially. OpenAI pays Synopsys a training subscription to learn its chip-design tools. The two then split revenue according to how much the agent improves designs, and they sell compute, model and licenses as one bundle. The arrangement works because chip designs have objective pass/fail checks. The Navy's $2.9B Arsenal 2 contract with Anduril also ties payments to production outcomes. Billing by usage, such as Runware's per-second compute, is becoming the minimum.

OpenAI's math release is the warning case. Out of about 4,000 attempts it produced 722 manuscripts, a 9.3% hit rate. Exponential View reports that many results were checked with Lean, a formal proof checker, but not all of them, and OpenAI gave no figure for how many. The viral claim that the release covered 81% of recent major discoveries came from AI models ranking AI output. The Algorithmic Bridge notes the results were released “in varying stages of the verification process.” When output grows faster than anyone can check it, volume stops telling you anything about value.

If you can't verify the outcome, you can't automate it and you can't charge for it.