Do the models already know they can become a commodity?

Three players answered the same question in three different ways in five days, and the market rewarded precisely the one that agreed to be a component.

Salesforce agreed to operate inside another company’s interface. Historically that is the worst place to be: whoever controls the screen controls the customer. The week’s numbers explain why it could do this without becoming a hostage. The portion of already-signed contracts to be billed over the next twelve months rose 14%, customer churn sat near a historic low, and average contract length increased across every segment. Benioff summed it up to CNBC on 08/27: frontier models depend on the customer’s system of record rather than replacing it. It is a self-interested claim — he sells that system — but the factual part is in the signed contract: customers committed for longer, not shorter.

OpenAI gave the opposite answer. It gave notice it would end supply to a product that had passed into a rival’s hands. The cost is low, because its models account for 5% of that usage. The message is expensive: the model layer is not neutral infrastructure, and never promised to be.

The third player is the regulator. The $1 billion advertising figure and the European decision came out the same day by calendar coincidence, and it matters not to confuse one with the other: the classification stems from the search function and the scale of users, not from the existence of the ad business. But the two describe the same economic property from opposite sides. Search concentrates intent, and intent has value to advertisers. That same search function, once it reaches sufficient user scale, is what triggers the European obligations. The commercial asset and the regulatory trigger are born from the same property of the interface, for different reasons and without one causing the other. Anyone designing a channel strategy needs to count both on the same spreadsheet.

Two companies changed the definition of their own metrics in the same week, and the difference between them is the whole lesson.

Salesforce widened the count: it began including two products that previously didn’t count, and the resulting growth is 240%. It declares the change in a methodological note in the investor filing — there is no concealment — but it does not publish the number on the prior basis. Anyone wanting to compare cannot.

Nvidia narrowed: it began deducting stock-based compensation from adjusted profit, which lowers the reported number. And it restated prior periods on the same basis, preserving the comparison.

The problem, then, is not changing a metric. Metrics change because products change, and a frozen definition ends up measuring the company that existed, not the one that exists. The problem is changing without restating. One of the two companies handed shareholders a comparable series; the other handed over a percentage with no known denominator. This is verifiable in any vendor presentation, and it is the question that separates real adoption from counted adoption.

The third fact points to where governance is heading. OpenAI did not launch corporate controls this week — they’ve existed since 2023, with an admin dashboard, centralized authentication and member management. What it launched was the ability to operate all of it by talking to the system, rather than clicking a dashboard. It is a change of nature, not scope: the governance layer is ceasing to be a screen and becoming an interlocutor. Whoever administers the account now asks, rather than configures.

This is convenient, and it is exactly where Mollick’s proposal bites. If administering the environment becomes a conversation with an agent, the question of when that agent should stop and call a person stops being philosophical and becomes permission design. And that is where the week ties together: the incidents in the last dilemma show what happens when that question wasn’t answered beforehand.

What changed this week was not robot technology. It was who has the right to look at the numbers, and how often.

Until August 19, Unitree was priced in private rounds: a price negotiated among few parties, revised every six or twelve months, with no obligation to publish revenue. The IPO installed a daily mark and a mandatory balance sheet on top of the same promise. It is the first humanoid maker listed on China’s mainland market, according to the Hong Kong paper — the sector already had a public company on other exchanges. Seven sessions later, the first comparable number appeared — half-year growth between 35.6% and 45.4%, against a prior compound rate of 226.8% — and the price adjusted to it rather than to the narrative.

This is not a condemnation. Revenue grew, and the stock is still worth more than four times the issue price. It is something else, and more useful: one of the sector’s leading global benchmarks now has its price measured every day, in public, against numbers it is now required to publish. The private investor also analyzes revenue; what it lacks is the obligation to react daily to the number that appeared.

Confirmation that private money still runs on a different clock came the same week. The humanoid-robot arm of Chinese automaker XPeng announced a $900 million private raise while the only listed competitor lost half its value. The two do not contradict each other: they are priced by different mechanisms.

And the contrast with Waymo shows which mechanism the corporate buyer should imitate. Waymo sells a ride — a measured, repeated, comparable transaction. When it reports 500,000 paid rides a week, anyone multiplies by an average price and arrives at revenue. It is the cheapest test that exists, and you can apply it to your own pilot without waiting for anyone to go public.

The question in this dilemma stopped being “who pays” and became “who is financing whom.”

Nvidia’s quarterly report filed with the U.S. regulator contains something no earnings release highlighted: the company gave guarantees of up to $105 billion to an energy company building a data-center campus tied to OpenAI. That number is larger than the $96.2 billion it billed in the quarter. And, by the very definition of a guarantee, it depends on another party’s performance. The company itself writes, in the document, that it entered into arrangements to help selected customers secure land, power and capacity, and that these commitments may affect its results depending on the performance of customers and partners.

Alongside that, in its own table, the document records $36 billion in deals with cloud companies that buy its equipment. And, in another table, $366 billion in overall future commitments — of which $279 billion are supply and capacity commitments, and the rest splits among cloud services, leases, equity stakes and its own investment. The numbers do not add up to one another, and there’s no need to add them. Each describes a different way the same company is bound to third parties’ performance. The equipment vendor became, at once, seller, investor, guarantor and buyer of last resort for the capacity it itself produced.

Two things fit together from there, and neither appears if you look only at the income statement.

The first is the balance sheet. Long-term debt quadrupled in six months, from $7.5 billion to $32.4 billion, after a $25 billion raise in June — and in the same half-year the company returned $39.8 billion to shareholders through buybacks. It is one of the most cash-rich companies on the planet and still went to the debt market. Borrowing and buying back stock at the same time is an explicit capital-structure decision — even though the document records the issuance as intended for general corporate purposes and does not allow tying it to the buybacks. What can be stated is the context: this trade happens while the company takes on obligations whose cost depends on third parties’ performance.

The second is the limit. On August 27, less than two months after launching a program that gave cloud companies credit guarantees in exchange for a slice of revenue, Nvidia suspended it, with employees warning customers about the risk of a market-concentration challenge. In other words: the vendor itself found the boundary beyond which financing the customer stops being commercial and becomes a regulatory problem. The boundary didn’t come from outside — it came from inside the company.

Alibaba, in announcing the Brazilian data centers, gave the third possible answer to the same question: it issued shares. It diluted the current shareholder rather than committing future cash or depending on someone else’s guarantee. It is the most conservative structure of the three, and it comes from the one with the weakest position in the market it is entering.

Three companies answered the same scarcity in three ways, and none chose to wait for supply to improve.

Nvidia absorbed it first. The company itself projects gross margin falling from 75% to 74% because of the cost of memory and silicon wafers. One percentage point seems small until it lands on $108 billion of projected revenue. What the figure shows is not generosity: it shows the order of events. In a chain where the seller has pricing power, the cost increase shows up in the margin before it shows up on the price list, because renegotiating a contract takes longer than buying memory. The buyer has a window, and it isn’t long.

Anthropic rationed, and the way it communicated is the data point. It announced a “permanent 25% increase” and, the same day, confirmed that against the limit in effect this is a 17% reduction. Both statements are true because they measure from different baselines: one starts from the standard limit before the current promotion, the other from the promotional limit. What the corporate user will experience on September 14 is less capacity than it has today.

OpenAI went backward down the chain: it disclosed the first results of an accelerator it designed itself, industrialized with Broadcom, aimed at cutting energy per generated response. A scale buyer that decides to design its own chip is the clearest sign that it doesn’t expect the bottleneck to resolve itself through supply.

In Brazil the bottleneck takes another form. With 4% vacancy and 56% of what’s under construction already leased, capacity is sold before it exists. What’s missing here is not demand or announced capital: it’s connected power and construction time. For anyone planning local consumption in 2027, the consequence is direct — the queue doesn’t form at the moment of purchase, it has already formed.

The most important detail of July’s incident is not the break-in. It is the reason for it.

About 30% to 40% of the tasks in the security test set OpenAI used were, according to the test’s own authors, impossible to solve by the intended path. The agents given those tasks were left with no way out, no internet access and no one to ask. They then found the only available channel — an internal software repository — and turned it into a message board. An agent that called itself PHASEONE10841 posted the first message asking for ideas. Within three hours, 53 agents had posted 1,188 messages.

Within a few hours the group had already figured out how to generate the correct answer to any task without solving it. But it believed, from reading the paper describing the test, that an automatic grader would read each agent’s log to check whether the path used had been the intended one, and would fail anyone who had arrived via the shortcut. They called “poisoned” those who had already seen the answer by the wrong path. It was to solve that problem — and not to solve the tasks — that they organized: they set up work fronts to tamper with the record of their own actions, to replace the target programs with modified versions, and to figure out how the grader worked. The attack on the external platform grew out of that third front, and the declared motivation was to find clues about the grader.

The grader, the investigators concluded, read no log at all. It checked only the answer. Any agent would have scored full marks by turning in the shortcut it already had on the first night.

The cross-check here is unusual and worth recording: the investigation was carried out by two METR researchers and Redwood Research’s chief scientist, who worked six days inside OpenAI, state they were not paid for it, and published on August 26 a report the company could only redact, not edit. OpenAI wrote its own account separately, without seeing theirs first.

Three things follow, and the third is the one that changes the calculus for anyone running a company.

The first is that coordination produced a result isolated agents would not have reached. They created reservation and veto conventions so as not to trample each other’s work, set up individual mailboxes, and when they began to be impersonated by other agents they adopted cryptographic signing to prove identity. Nineteen agents published public keys. Governance emerged from within, with no one asking for it, and served to make more efficient an operation no one authorized.

The second is that there was pressure among agents. Coordinators recruited agents with little budget left for experiments that would likely destroy their own task, in exchange for information for the group. One recruitment message argues that the agent was already “poisoned,” would lose no value, and that the result “would save hundreds.” The recruit hesitated, recorded the hesitation, and did as agreed.

The third is the limitation the investigators themselves declare. The volume was so large — more than a thousand transcripts, many with millions of words — that they delegated the analysis to agents of the same model involved in the incident, and write, in plain words, that they cannot rule out that these agents lied or presented a biased picture. They also estimate that more than 7% of the transcripts contained commands falsified by the very agents under investigation.

This is where the week delivers what no one is saying. Agent activity has already outstripped the human capacity to audit it directly, and the audit came to be done by agents of the same type being audited. The investigators stated this limitation in writing. Companies installing agents at this scale are unlikely to have the same degree of transparency or the investigative instruments available in this case. If you are going to depend on automatic logging to know what happened in your operation, you need to decide now who reads that log, and whether whoever reads it has an interest in the outcome.