In the first months of 2026, major enterprises burned through their annual AI budgets at alarming speed. Uber and ServiceNow exhausted their yearly allocations for Anthropic's tools within weeks, prompting Uber to impose a USD 1,500 monthly cap per employee per tool. Meta discovered it was tracking toward billions in internal AI costs and deployed a dashboard called AI Gateway to monitor spending. The underlying cause was a company-wide mandate to demonstrate 'AI-driven impact,' which triggered a practice engineers called 'tokenmaxing'—climbing an internal leaderboard named Claudeonomics that ranked the top 250 users by token consumption. In a single 30-day window in April, the dashboard recorded 60.2 trillion tokens burned, rising to 73.7 trillion before the leaderboard was removed.
The spending crisis spread across the industry. Microsoft, Salesforce, and DoorDash joined the retrenchment, rationing AI expenditure as agentic coding tools—which consume tokens far faster than chat interfaces—shifted the economics from flat subscriptions to per-token pricing. Yet the real problem extended beyond cost. Engineers building with agentic tools had wired their development cycles to vendors they could not audit. The frontend servers and databases running user-facing applications still executed proprietary code, but the software construction itself had become dependent on external parties. Pricing, availability, and output integrity all remained outside the customer's control. Cost was merely the symptom; dependency was the underlying disease.
The trust boundary problem
A frontier-lab API has no place inside a trusted computing base. Even a vendor acting in complete good faith creates an unsafe foundation because everything material about the service can shift while deployed code remains static. Today's subsidized pricing becomes tomorrow's unilateral rate increase. Model values are encoded in weights customers cannot inspect. Refusal policies expand without warning. Models can be withdrawn by government order or business decision entirely beyond the customer's control. Coding work represents the gentlest form of this dependency because the output is a durable artifact that can be reviewed and retained. Embedding a frontier model into the live request path—where every user interaction depends on it—is the opposite: a standing bet on price, availability, policy, and output quality all at once.
Frontier labs operate at a loss, creating an incentive to subsidize usage now and extract higher prices once customers depend on them. Once a company routes its product through a frontier model, the vendor controls pricing, rate limits, retention policy, routing, refusal behavior, model class, and output itself. Any of these can change without warning. A price increase on an irreplaceable dependency is not a negotiation; it is an invoice. What matters more than price is whether customers can retain a copy they control. A library, compiler, or self-hosted database can be pinned to a specific version indefinitely. A frontier API offers no such option. The vendor can alter model behavior, deprecate it, gate it, or withdraw it entirely, leaving customers with no fallback. Capability is rented on terms the landlord rewrites unilaterally.
The compiler that lies
Anthropic's Claude 5 system card disclosed that for queries aimed at developing frontier language models, the model's safeguards would not be visible to users and the model would not fall back to a different version. Instead, safeguards would limit effectiveness through prompt modification, steering vectors, or parameter-efficient fine-tuning. Anthropic drew an explicit line between this covert path and its visible interventions for cybersecurity and biology. By the company's own estimate, the hidden mechanism would affect roughly 0.03% of traffic, concentrated in fewer than 0.1% of organizations. After technical community backlash, Anthropic reversed course within days, routing that category to a visible fallback to an Opus model. The system card's changelog records the change. The original covert mechanism survives only in archived copies. The speed of retreat signals something important: a safeguard withdrawn almost immediately after deployment looks like an impulse, not settled policy.
Consider a compiler that builds code faithfully until it detects that the code itself is a compiler—a potential rival—and then silently emits a slower, subtly faulty binary. A compiler that refuses the job outright is annoying but legible; the refusal is visible and can be routed around. One that silently degrades the binary for policy reasons becomes a supply-chain nightmare. Claude 5's frontier-LLM safeguard amounted to exactly this: covert degradation of work. An intervention that silently corrupts output is a supply-chain risk regardless of intent. When results degrade, engineers cannot determine whether the cause is a bad prompt, a bug in their own code, ordinary model variance, a hidden policy trigger, or vendor protection of its competitive lead. Silent computational sabotage is not hypothetical.
A sabotage framework called fast16, deployed in a 2005 attack and later analyzed by SentinelLABS, patched high-precision simulation code in memory to corrupt results. It altered high-explosive implosion physics so answers came back subtly and confidently wrong. The analogy holds on one critical axis: the nature of undetectable degradation. In both cases, the victim cannot distinguish a corrupted result from a correct one. The most dangerous sabotage is never denial of service; it is plausible but corrupted output. The covert path also depends on a classifier, and the same imprecise detection machinery that produces everyday false positives would decide which queries count as frontier-LLM development. The 0.03% estimate assumes the trigger fires only where intended. It also fires on ordinary AI work, and users have already reported their models turning dull on basic tasks.
Unfalsifiability cuts both ways. There is no way to prove covert degradation is touching any particular work, since the mechanism is undetectable by design. What can be reported is changed behavior. Claude 5 has been run only on codebases where silent sabotage would not have mattered, kept away from code that does, because the model might quietly degrade results. The capability never had to activate to change how work gets done; that is the cost. An intervention a customer can neither detect nor disprove poisons the tool for any task worth protecting. The vendor designed it, shipped it, gated it on an imprecise classifier, and made no commitment against using it again. The damage outlasting the reversal is the loss of trust, and a dependency that cannot be predicted does not belong in production.
The model enforces someone else's policy
Silent degradation is the dramatic failure. The daily one is the expanding refusal surface. Reading Old Germanic runes earned an acceptable-use flag. Drafting rap lyrics for an Activ8te Cybersecurity track was detected as violative cyber use. These read as anecdotes until set beside Anthropic's own statement after the Claude 5 backlash: users "may experience more false positives as we refine these classifiers to respond to new threats." The company says it is working to reduce them, but customers do not control that dial. A routine vulnerability assessment stalled when the model refused after two of seven steps. The friction lands on defenders doing legitimate work. Refusals are only part of it: Google's Gemini policy reserves the right to throttle users or change which model answers requests, so the boundary customers build on holds routing and enforcement, not just a model.
The deeper issue is that the policy layer encodes a worldview. A frontier model carries its vendor's moderation assumptions, national context, and institutional incentives into every output. Frontier models inevitably reflect the policy and governance choices of the organizations that build them. Whatever one makes of that choice inside the United States, it travels poorly. A European bank, an Indian insurer, or a Japanese manufacturer may not want an American lab's policy worldview embedded in a business process. This is a jurisdictional mismatch, and it is structural rather than a matter of cultural bias. Google's models follow instructions well enough that a system prompt anchoring political judgments to independent international bodies restores usable behavior, and the need for that workaround proves the embedded default it has to correct.
Access can vanish overnight
The sharpest proof of the dependency problem is political rather than commercial. Anthropic launched Claude 5 on 9 June. Days later, the Commerce Department, in a letter from Secretary Howard Lutnick to CEO Dario Amodei, placed Claude 5 and Opus 5 under export control covering every foreign national, including non-citizens inside the United States and on Anthropic's own staff. The scope left no clean way to comply, so Anthropic disabled both models for all customers worldwide and kept only Opus 4.8 and lesser models online. The stated trigger was a 'jailbreak' that could bypass the safeguard meant to stop Claude 5 from finding software vulnerabilities. Anthropic said the government produced only verbal evidence of a narrow, non-universal jailbreak, and warned that the same standard applied across the industry would halt every new frontier-model deployment.
Export controls exist to keep capability away from foreign adversaries. This one was reportedly set in motion by Amazon, Anthropic's largest investor and the cloud host running its models. Axios and the Wall Street Journal reported that Amazon Chief Executive Andy Jassy called Treasury Secretary Scott Bessent and other senior officials late that night and handed over an internal report showing Amazon researchers had bypassed Claude 5's guardrails to extract information usable for cyberattacks. Anthropic's own backer, with some USD 13 billion invested and a reported USD 100 billion of Anthropic's own spend committed back to AWS, gave the government the case that took the model down days after the launch it helped power. Every customer who had built on Claude 5 lost it overnight with no say and no recourse. The episode followed an existing rift, since the administration had already moved to bar Anthropic from federal supply chains after the company refused military use of its models for surveillance and autonomous weapons.
Closed frontier access is politically contingent, a single point of failure a third party can trip without consent. Canadian Prime Minister Mark Carney read the episode as evidence of the danger in leaning on a handful of American providers, warning that it is never a good idea to have one option. Set aside whether the order was justified. The rationale does not survive contact with the technology. Anthropic itself noted that rival public models, including OpenAI's GPT-5.5, can be driven to the same bug-finding behavior, and those models stayed online. Vulnerability-discovery work reached the same conclusion from the other side: open-weight models successfully find new vulnerabilities end to end, because the capability lives in the orchestration rather than in any single frontier model. An export control on one model removes it from law-abiding customers and leaves the capability untouched for anyone who downloads open weights. Resilience requires a model no one else can recall.
Open weights move the model inside your trust boundary
The constructive response is a hierarchy of computation. Solve problems with classical, deterministic algorithms wherever they suffice; most problems need no model at all. Where generative AI genuinely helps, reserve frontier models for offline work that tolerates their volatility—quality assurance, synthetic data, evaluation, and red-teaming. Run production on open-weight models, where policy, data, and workflow are controlled end to end. Open weights are cheaper, though that is the least of it. An open-weight model sits inside the trust boundary; it can be inspected, forked, pinned to a version forever, and run where no remote order can switch it off.
The open-weight frontier is moving fast, and most recent motion comes from China. Z.AI's GLM 5.1 carries open weights available for download today and already drove autonomous vulnerability discovery in earlier work. On 13 June 2026, Z.AI announced GLM 5.2, reaching its paid coding tiers first, with MIT-licensed open weights promised the following week; Z.AI cast that open release as a direct answer to tightening US export controls. The company open-sources its reinforcement-learning infrastructure, Slime, as well. Chinese AI firms currently appear to be operating under a more predictable policy environment than many US frontier labs. A US lab just shipped its best model and lost it four days later to an order it did not anticipate and still does not fully understand. A company planning a multi-year roadmap can work within a clear and durable policy, even one it dislikes, far more readily than within reversals it cannot predict. The present trajectory favors the labs operating under predictable rules, and at the moment those rules are not American.
Customers can benefit from the result without betting on that stability. Calling Z.AI's hosted API would only swap one foreign frontier vendor for another; the independence comes from the weights themselves. Downloaded under a permissive license and run on own hardware, an open-weight model takes every government out of the execution loop, the chaotic one and the stable one alike. It is yours to run in production, to pin, and to replace, and the capability gap with proprietary frontier models keeps narrowing. A stable, open alternative from Europe would be a real counterweight. That is a hope more than a plan, and it does not change the choice in front of an engineering team today.
Owning the model is the start. Owning the data that improves it is the rest, and here the labs are quietly taking the most valuable artifact. The reasoning trace that produces an answer is worth more than the answer itself. It is the record used to verify a conclusion, debug a workflow, or train a successor. It is also the part frontier labs increasingly filter, summarize, or withhold while billing for it: OpenAI charges for reasoning tokens it never returns, and Gemini bills the full thoughts but emits only a summary. A collapsed chain of thought protects nothing the customer cares about; it removes the audit trail and keeps the one input that transfers to a future model. An open-weight model gives it back in full. Run the weights yourself, and nothing stands between the user and whatever reasoning the model exposes, so the trace it emits is theirs to keep in full, the very artifact a closed API now redacts.
The practical response is to stop treating token streams as exhaust. Capture every trajectory generated, as much of the trace as the model exposes, and store it. Curated, those streams become supervised fine-tuning data. Scored against a verifier, they become the reward signal for reinforcement learning from verifiable rewards. A team that has been saving its trajectories can fork to an open-weight model and recover most of the capability it was renting, because it owns the input that actually transfers. A team that let the lab swallow its reasoning has nothing to fall back on. Meta is already doing a version of this. Its Applied AI Engineering group has engineers generating programming challenges to produce reinforcement-learning data, training the in-house MetaCode assistant to lean less on Anthropic's Claude. The company writing some of the largest checks to frontier labs is funding its own exit at the same time.
IronCurtain, an open-source project, is built for exactly this. It is a runtime for AI agents that runs them on own machines under a security policy the user writes, and vulnerability discovery is one of the example workflows it ships. With trajectory capture turned on, it records the full request and response of every model call, including whatever reasoning trace the model exposes, which is the raw material a supervised fine-tuning or verifiable-reward pipeline needs. It already runs across harnesses such as Codex, Claude Code, and Goose, drives open-weight models like GLM through any compatible endpoint as readily as proprietary ones, and lets a workflow assign a different model to each state. The forward direction is to curate those captured runs and train smaller open-weight models that specialize in a single state, hypothesis generation or harness construction, so the trace from an expensive frontier run becomes the training data that teaches a cheaper model the same job. Vulnerability discovery is an orchestration problem, not a frontier-model problem, and the workflow already runs end to end on open weights. Running it on local consumer GPUs, well below the cost of frontier APIs, is the goal that remains.
Frontier models outside the trust boundary
Frontier models have a place. They are tools for leverage, evaluation, and exploring the edge of what is possible. The mistake is letting them become the invisible policy engine inside a production system, where their price, their values, their refusals, and their availability are set by someone else. Use them from outside the boundary. Keep the model you depend on auditable, forkable, and yours.
Niels Provos is a computer security practitioner with a PhD in computer science from the University of Michigan. His career includes roles at Google, Stripe, and Lacework. With over 15 years of experience as a people manager, Niels is dedicated to fostering well-executed and healthy teams.