The SSH bug you can't see is the smallest problem this week

CVE-2026-35414 dropped this week. A comma-parsing bug in OpenSSH certificate principal handling — fifteen years old, script-kiddie exploitable in about twenty minutes, and it leaves zero authentication failures in the log. Issue a certificate for deploy,root and the session authenticates as both. Your SIEM sees a clean, authorized login. The session is root. Patch to OpenSSH 10.3.

Then do the part most shops will skip: grep your SSH CA issuance logs for any principal field containing a comma. Each hit was a silent root grant that left no trace. Every past write-access to that CA is now retrospectively load-bearing.

That's the emergency. It's also the least interesting thing that happened this week.

The post-auth perimeter is the only perimeter

Three disclosures cluster around the same idea: the attacker is already inside. OpenSSH's silent root. Microsoft's Entra ID shipping an Agent ID Administrator role mis-scoped to allow tenant-wide service principal hijack — the largest IAM platform in the enterprise couldn't get non-human identity right on the first ship. And a joint US/UK advisory clarifying that FIRESTARTER on Cisco ASA/FTD survives firmware updates and warm reboots. Only a full cold start evicts it. Multiple federal agencies had already reported those devices as remediated. They weren't.

What to do this week: cold-start the Cisco fleet, audit Entra for anyone who held that role before the patch, and stand up post-auth session monitoring — token binding, impossible-travel on session tokens, mid-session device fingerprint mismatch. AiTM proxies steal the token after MFA succeeds. Every login-phase control you own is decorative against that class.

One beat of counter-reading, because it's earned. You could argue the OpenSSH bug is the story and the rest is a slow week dressed up. It isn't. The Entra role, FIRESTARTER, and AiTM share a failure mode with OpenSSH — the validation tool reported green while the system underneath was compromised. Version strings matched. Role scopes looked right. Auth logs looked clean. That's a category, not four incidents.

Anthropic passed OpenAI. Rewrite your comps.

Forge Global has Anthropic at roughly a trillion and OpenAI at $880B. Prediction markets give Anthropic 64% odds of hitting the tape first. OpenAI missed its Q1 revenue target and is guiding to $25B of burn in 2026 against a $30B revenue plan — the CFO is publicly uncertain whether revenue growth covers the compute commitments. Microsoft renegotiated for 27% equity, 20% revenue share through 2030, and the freedom to sell Claude on Azure. The AGI clause is gone.

Andy Jassy confirmed OpenAI models land on AWS Bedrock in the coming weeks. Azure exclusivity — the strongest single argument for enterprise Azure commitments over the last three years — evaporated in one press release. The reported detail that matters more than the announcement: AWS enterprise customers are shrugging off OpenAI's arrival because they already built around Claude. Switching costs formed while OpenAI was locked to one cloud, and the switching cost was never contractual.

If a portfolio company or a cloud commitment was underwritten on "privileged OpenAI access," that thesis is dead. Re-underwrite. Design the model layer to be swappable now, because Anthropic will price like a leader once it files.

The pricing model is on a calendar

Ramp's data has 74% of AI SaaS spend already on consumption or token pricing. GitHub Copilot flips to usage-based billing on June 1 — $19 and $39 monthly credit caps, overage past that. Microsoft 365 E7 goes GA May 1, bundling Agent 365 into a governance tier that runs the Active Directory playbook on non-human identity. Salesforce is pricing "Agentic Work Units" at roughly $0.60 apiece. OpenAI's internal projections describe cannibalizing 80% of the 45M ChatGPT Plus base into an $8 ad-supported tier aimed at 112M subscribers — Plus revenue traded away deliberately for ad economics OpenAI has never operated before.

The forcing math is not the industry decision. It's the workload profile. Agentic coding runs consume roughly 1000x the tokens of chat with 30x run-to-run variance on identical tasks, and the accuracy-versus-spend curve is non-monotonic — spending more does not reliably produce better results. Flat per-seat pricing is not "under pressure." It is a mispriced option that gets exercised against whoever holds it.

One concrete task this week for anyone with an AI feature in the product: pull per-user token consumption for your top three AI surfaces and compute the P10 to P90 ratio. If it's 20x or higher, your average-cost model is fiction and your worst power users are eating the margin your CFO is projecting to the board. Model a hybrid — base subscription plus consumption overage, with a routing layer that sends commodity queries to open-weight models (Qwen, DeepSeek V4, MiMo-V2.5) and reserves frontier calls for the queries that actually need them. IBM and Cognition are already there.

The one thing to ship this week

Patch OpenSSH 10.3. Grep the CA logs for commas. Cold-start the Cisco boxes. And before Friday, put per-feature token attribution — user, cohort, workflow step — on every LLM call in production. When Copilot flips on June 1, the first invoice is the telemetry you didn't build. Build it now, while the emergency work gives you cover to spend the sprint on it.