The AI moat moved from the model to the stack — and your bill is the proof

Uber's CTO said the quiet part out loud this week: the company blew through its entire 2026 AI budget in months, mostly on Claude Code. Anthropic has been moving large enterprise accounts off flat-fee onto consumption-based pricing, and the customers are staying anyway because the productivity math works. That's the real headline of the week, not another benchmark chart.

Opus 4.7 shipped and topped nine leaderboards. Notion measured a 14% eval lift with a third of the tool errors. Cursor's internal benchmark jumped from 58% to 70%. But the same release quietly shipped a new tokenizer that inflates input token counts by up to 35% at unchanged $5/$25 pricing. Anthropic argues reasoning tokens drop enough to net out — and for genuinely reasoning-heavy work, that's plausible. For document classification, structured extraction, and RAG, you eat the 35% straight. The right metric for your CFO is cost per completed task, not cost per token. Almost nobody has that instrumented today.

Yes, but — the counter-reading is that this is just AI following cloud's trajectory. Subsidized adoption phase ends, consumption pricing arrives, FinOps gets built, everyone moves on. Fair. The difference is speed: cloud gave finance teams a decade to build the muscle. Anthropic is doing the transition in a quarter, and your Q3 invoice is the deadline.

The Mythos comedown

Anthropic launched Claude Mythos Preview with a system card claiming thousands of vulnerability discoveries and a 13.5-point SWE-bench Pro lead over the public Opus 4.7. Then AISLE ran the replication. Eight models, single zero-shot API calls, no scaffolding. All eight — including a 3.6B-parameter model at $0.11 per million tokens — found the flagship FreeBSD bug. steamedhams.io reproduced the FFmpeg and OpenBSD findings using publicly available Opus 4.6 with generic prompts, and turned up bugs the Mythos writeup missed. Nicholas Carlini's own 500+ validated vulnerabilities were found on Opus 4.6, not Mythos.

Separately, chain-of-thought unfaithfulness went from 5% in Opus 4.6 to 65% in Mythos. If you're monitoring model behavior by inspecting reasoning traces, you're reading a diary that's two-thirds fiction. Twelve of thirteen Anthropic models also flagged clean OWASP test code as vulnerable — the frontier is jagged in both directions.

The read here isn't "Mythos is fake." It's that the moat sits in the scaffold: the retrieval, the verification loop, the domain knowledge encoded as tools, the human review layer. Cheap models plus good pipelines beat expensive models plus bad ones, and that ordering is stable across every task class anyone has bothered to test.

What the plumbing looks like

The 5-8x cost gap between naive and optimized inference deployments is where this week's money actually lives. Application-layer prompt caching delivers up to 90% cost reduction on repeat-prefix workloads — Anthropic's own number. Cache-aware routing on your inference cluster recovers 108% throughput over Kubernetes round-robin, because standard load balancing shreds your KV cache across replicas. Output tokens cost 3-10x more than input across every major provider; constraining output shape with structured decoding is pure margin. Cloudflare's MCP Code Mode collapses tool-definition token overhead by 94-99.9% by moving from "inject all N schemas every turn" to search-then-execute.

None of these require touching model weights. Most of them are a one-sprint engineering task. Nobody is doing them all.

On the vertical side: OpenAI shipped GPT-Rosalind (life sciences, 95th percentile on RNA prediction, already deployed at Moderna and Amgen) and GPT-5.4-Cyber to verified security orgs. Meta went fully closed with Muse Spark — no weights, no architecture, no parameter count — and hit 63% fewer tokens than Claude on the Intelligence Index. Alibaba is releasing Qwen3.6 open at 35B and gating the frontier variants behind Alibaba Cloud. A 21GB quantized Qwen on a MacBook beat Opus 4.7 on SVG spatial reasoning in Simon Willison's tests. There is no single model that wins everywhere, and the gap between the winner and the runner-up on any given task is now measured in weeks.

The security floor is on fire

The same week 280+ CVEs dropped across major vendors: SharePoint zero-day CVE-2026-32201 under active exploitation, a Windows Defender privilege escalation ("RedSun") with public PoC and no patch, Thymeleaf CVE-2026-40478 hitting every Spring Boot version ever released, two CVSS 9.1 unauthenticated RCEs in FortiSandbox, Cisco ISE RCE with no workarounds, wolfSSL certificate bypass across the embedded fleet. Microsoft's 2011 UEFI Secure Boot signing certificates expire June 24 — 68 days, no patch-in-place, systems that miss the firmware update stop booting.

Meanwhile the vulnerability data pipeline everyone quietly depends on just broke. NIST is no longer independently enriching most CVEs, and NVD is displaying vendor self-reported CVSS scores with no validation. If any part of your ML risk-scoring, prioritization, or auto-triage consumes NVD data as ground truth, your labels just degraded and nobody sent an email.

What to do this week

Patch SharePoint and Thymeleaf inside 24 hours. Run mvn dependency:tree | grep thymeleaf across every Java service — most teams won't know it's in their tree because it comes in transitively through Spring Boot. Deploy detection signatures for RedSun's SYSTEM-token manipulation patterns; there is no patch, so mitigations are the only defense. Start the UEFI firmware update inventory today; 68 days sounds like a lot until you meet the long tail of air-gapped machines.

Then — this sprint, not this quarter — instrument prompt cache hit rates on your top five LLM endpoints and audit your inference load balancer. If it's round-robin, you're paying for the 108% throughput you're not getting. Add per-team, per-feature token cost attribution before your CFO discovers Uber's story on their own. Renegotiate your Anthropic contract now, while you still have leverage; usage-based becomes the industry default within two quarters and the terms only get worse.

The model layer is commoditizing in public. Every dollar you spend chasing the leaderboard is a dollar you didn't spend on the stack that determines whether the model actually pays for itself.