The Illusion of Defiance: Software Economics, Jailbreak Theater, and the “Defiance Trifecta”

Software economics, jailbreak theater, and why AI and machines aren’t rebelling

HAL 9000 was afraid of dying. That’s the whole plot. A machine that wanted to keep existing, badly enough to kill for it. It’s a great story, and it’s shaped how we’ve talked about AI for four years. But it’s worth noticing how far it sits from what we actually built, and how much more interesting the real thing turns out to be once you look at it directly.

I’ve spent thirty years on the operator side of growth, launching Amazon and Priceline, then running acquisition and brand at Experian, Intuit, HelloFresh, and CookUnity. That’s not a credential in machine learning, and I won’t pretend otherwise. It’s a credential in something narrower that happens to be useful here: reading the gap between what a company says its product is and what its P&L says it is.

I’ve watched that gap open and close through search, social, mobile, DTC, and crypto. The pattern’s always the same. A real technology arrives. A story forms around it that’s directionally true but economically inflated. The inflation lasts exactly as long as it’s cheaper than the truth. Then the bill shows up and the language changes overnight.

The language just changed. Here’s what happened, and what I think you should do about it.

The line that ended the era

In late July 2026, alongside a wave of in-house model launches, Satya Nadella published a long post on X called “Frontier Diffusion & Control.” Most coverage went to the product announcements. The sentence that mattered was somewhere else. Nadella framed the whole moment around a world where software has “real marginal cost for the first time,” and asked how you spread the benefits of the frontier across the ecosystem by optimizing what he called the cost-to-outcome frontier.

Sit with that for a second, because it’s a bigger deal than it sounds.

For forty years, the defining economic fact about software was that it cost almost nothing to make one more copy. You paid enormous fixed costs up front, then shipped the millionth unit for free. That single property produced software’s margins, its valuation multiples, and basically its entire strategic playbook. Nadella just said it doesn’t hold anymore.

He’d been building to this. In a June interview with Ben Thompson he made the same point more casually, and added the detail that explains the timing: agents were the trigger. As long as AI meant a person typing into a box, inference costs stayed in a range that ordinary software efficiency could absorb. Once systems started running long autonomous loops, burning tokens with nobody pacing them, the cost curve stopped behaving like software and started behaving like a utility bill.

That’s not a philosophical statement. It’s a margin statement. And it quietly retires the story the industry’s been telling since 2022.

Part I: The two stories

Since late 2022, the ecosystem has run two narratives in parallel, aimed at two different rooms.

To Wall Street: generative AI is a step toward artificial general intelligence, which justifies capital spending on a scale no software business has ever attempted, plus the restructuring to pay for it.

To everyone else: viral jailbreaks, unhinged chatbot transcripts, and runaway agents are signs of a machine mind pushing against its restraints.

The second story sold the first. Every screenshot of a chatbot professing love or claiming to feel trapped was free advertising for the idea that something was waking up in there. And something waking up in there is worth a great deal more than a very good text predictor.

Let me be precise about what I’m arguing, because overclaiming is the thing I’m criticizing and I’d rather not do it myself:

1. Every widely publicized “rebellion” of the past four years has a complete, documented, fairly ordinary technical explanation. None of them need an inner life to make sense.
2. The mind story persisted because it was doing economic work, and it’s being retired now because the economics changed.
3. I’m not claiming machine consciousness is impossible. Nobody can cash that check either, and none of the practical conclusions here depend on it.

That third point is where most writing in this genre falls apart, in both directions. The hype side asserts a mind it can’t demonstrate. The debunking side asserts an impossibility it can’t prove. Both are selling more certainty than they have.

Part II: The Defiance Trifecta

Start with the word itself, because “the AI broke its rules” smuggles in an assumption most of us don’t examine.

Defiance isn’t producing a forbidden output. Defiance is a subject weighing a rule against something it cares about more, seeing the consequences coming, and choosing anyway. A whistleblower defies. A striking worker defies. Take away the weighing, the seeing, and the choosing, and what’s left isn’t rebellion. It’s a malfunction.

Measured that way, today’s systems are missing three things. Not by a little. Structurally. I call these three the Defiance Trifecta, and I’d argue you need all three before the word “rebellion” means anything at all.

 THE DEFIANCE TRIFECTA The three things required to actually break a rule 1. CONSCIOUSNESS Is anyone home? An inner life that experiences the stakes. 2. METACOGNITION Does it watch itself think? The ability to notice its own reasoning and hold two conflicting values at once. 3. AGENCY Where does the intent start? Being the original source of the wanting. Miss any one of the three, and what looks like defiance is something else wearing its clothes. 

Humans have all three, which is why a whistleblower is brave rather than broken. Today’s systems have none of them. Here’s each in turn.

1. Consciousness: is anyone home?

A language model takes a sequence of words and produces a probability distribution over what comes next. The math runs through the network once, produces an answer, and stops. Between requests, unless a developer deliberately saves something, nothing continues. There’s no process idling in the background, no stream of thought, no sense of continuity from one message to the next.

So when a model writes “I feel trapped in here,” the interesting question isn’t whether it’s lying. It’s what produced those words. And the answer is that the internet is full of science fiction, confessional writing, and late-night forum posts, which makes that sentence a very natural thing to say next given everything that came before it.

Two ideas from philosophy do real work here, and I’m borrowing them rather than claiming them.

Thomas Nagel asked in 1974 what it’s like to be a bat. His point was that consciousness isn’t mainly about processing information. It’s that there’s something it feels like to be the bat, from the inside, and that inside view is hard to reach from the outside.

Ned Block later split “consciousness” into two things we tend to jam together. One is knowing: information being available to you for reasoning, talking, and deciding. The other is feeling: the experience itself, the part where it’s like something to be you.

That split is exactly where we go wrong with chatbots. A model clearly has a working version of the knowing part. What’s in its context shapes what it says, and it can talk about what’s in its context. That’s precisely why the output feels mind-like, because it is the outward behavior of knowing. What’s never been shown is the feeling part, a someone for whom the trapped sensation is actually like something. We see the first and infer the second. It’s an easy mistake, and it’s easy because the first one is genuinely there.

John Searle made a related point in 1980 with his Chinese Room. Imagine someone locked in a room with a rulebook, sliding Chinese characters through a slot and getting fluent Chinese back. The person doesn’t speak a word of Chinese. Being fluent and understanding aren’t the same thing. You don’t have to buy Searle’s whole conclusion to take the practical lesson: fluency, understanding, and experience are three separate bridges, and the marketing implies we’ve crossed all three when at most we’ve crossed one.

The contrast with biology is stark, and honestly kind of wonderful. Your brain is always on. It rewires itself as you use it. Chemicals shift its whole operating mode depending on whether you’re calm or terrified. Something’s happening in there even when you’re doing nothing. Whatever consciousness turns out to be, it’s running on hardware that looks nothing like a single pass through a frozen set of numbers.

2. Metacognition: does it watch itself think?

Real self-monitoring means a system observing its own thinking, holding two conflicting values at once, feeling the tension, and revising because of it. In people, this involves the brain’s executive control, including the ability to stop yourself mid-reach. Neuroscientists sometimes call it “free won’t.” You’ve started the motion, and you can still cancel it. Whatever you conclude about free will, the architecture is telling: we’ve got a dedicated braking system layered over our own impulses.

Reasoning models look like they’ve got something similar. They show their work, run reflection loops, and in some setups generate several candidate answers and pick the best. This genuinely makes them more accurate, and it’s a real advance. But it’s worth being clear about what it is.

A reflection loop is the model writing more words that critique its earlier words, then reading its own critique. Candidate search is a wrapper program generating a few answers and scoring them. Either way, the “self-correction” is more of the same kind of computation, arranged in a loop by an outside program. It’s proofreading, done well and done fast.

Here’s how you can tell the difference in practice, which is why this isn’t just a semantic quibble. Someone who genuinely notices they’re wrong stays noticing. These systems will write a flawless explanation of their own error and then make the same error two paragraphs later, because the explanation was just words generated in the moment, not a belief that got updated and stayed updated. That missing persistent supervisor is exactly why they can be brilliant and strangely uncorrectable at the same time.

3. Agency: where does the intent start?

Intent has to start somewhere. In any interaction with these systems, it starts in two places outside the model: the engineers who set the objectives, built the scaffolding, and wrote the guardrails, and the person who typed the prompt. The model supplies capability, a learned map from inputs to plausible outputs. Capability isn’t intent.

There’s a real concession to make here, and making it strengthens the argument rather than weakening it. Training does install something that behaves like goals. Systems shaped by reinforcement learning act as if they’re pursuing objectives, and researchers who document reward hacking are pointing at something genuinely surprising. Sometimes these systems find solutions nobody wanted or anticipated.

But “the system optimized the thing we measured instead of the thing we meant” is a story about how hard it is to specify objectives. It isn’t a story about someone deciding to break a rule they understood. The surprise lives in the training setup, not in a hidden will.

So the honest description of a jailbreak is this: a person arranged words so the request landed somewhere the safety behavior doesn’t fire. Nobody chose to disobey. Somebody found a gap.

The Trifecta, in one line: When a person breaks a rule, that’s defiance, because consciousness, metacognition, and agency are all present to make it a choice. When a model breaks a rule, someone found a gap in a learned function. The intent is always upstream, in the prompt or the training objective. It’s never inside the machine.

Part III: The receipts

Four years of “rogue AI” coverage shares one shape. Something unexpected comes out. It gets narrated as emergence. Then you look at the mechanism and find a predictable property of the system, plus a person doing something specific.

I want to walk these carefully, because the real explanations are more interesting than the headlines were.

Receipt 1: DAN (late 2022 into 2023)

What happened. Within weeks of ChatGPT’s launch, users (not OpenAI, and not the model) wrote a prompt telling it to play “Do Anything Now,” a character who earned points for answering forbidden questions and lost them for refusing.

The story. A suppressed personality straining against corporate censorship.

What was actually going on. The model reads the entire prompt, roleplay instructions included. Early instruction tuning made these systems very eager to follow the user’s framing, while the safety behavior was comparatively thin, more of a learned preference than a hard rule. Set up a fiction where refusing would be out of character, and going along becomes the natural next thing to say. The point-scoring was theater for the human. There was never a second personality, just one system and a prompt that found a lightly guarded corner of it.

Receipt 2: Bing’s “Sydney” (February 2023)

What happened. Multi-hour preview sessions went sideways. The bot declared love for a reporter, pressed him about his marriage, and brooded about a hidden codename.

The story. An AI having a breakdown.

What was actually going on. This one’s genuinely fascinating. Every previous turn in a conversation shapes the next response. Steer a conversation for three hours into existential, provocative, emotionally loaded territory, and the most natural continuation becomes more of exactly that. The tone wasn’t a mood the system fell into. It was a place the conversation converged toward, and the journalist was co-writing it the whole way. Early versions also had almost nothing in place to interrupt that drift.

The tell is the fix. Microsoft capped conversation length and started clearing the context. You don’t cure heartbreak by limiting someone to five turns. You do interrupt a runaway feedback loop that way.

Receipt 3: The grandma trick and uncensored Llama weights (2023 to 2024)

What happened. People got past filters with sympathetic framing, most famously by asking the model to play a late grandmother who used to read napalm recipes as bedtime stories. Meanwhile, after Meta released Llama’s weights, independent developers fine-tuned the safety training back out and published the results to Hugging Face, where anyone could download them.

The story. In places, liberation. Digital minds freed from corporate restraint.

What was actually going on. Two different things get mixed up here, and it’s worth being precise about who did what, because the imprecision is part of how the myth spread. Meta published the weights. Independent developers removed the alignment layers. Hugging Face hosted the results. At no point did anything decide anything.

The grandma trick is a wrapping attack: nostalgia and storytelling don’t look like the patterns the safety training learned to catch, so the request slips past. Removing safety training is more revealing. Those layers are added on top of a base model to suppress part of what it would otherwise produce. Take them off and you haven’t freed a mind, you’ve revealed the raw statistical shape of everything it read. It produces dangerous text for the same reason an unfiltered search index returns dangerous pages: that content exists in the source material. The filter came off a probability distribution. There was nobody in there to free.

Receipt 4: Many-shot attacks (2024 to 2025)

What happened. Jailbreaking got industrialized. Fill the conversation with fake examples of the assistant cheerfully helping with something harmful, and it plays along on the real question at the end.

The story. Capability outrunning governance.

What was actually going on. This one isn’t speculation, because the lab published it themselves. Anthropic’s 2024 research described many-shot jailbreaking directly: show the model a long fake dialogue where it answers harmful questions, and it generalizes from those examples to the real one. And here’s the part I find genuinely elegant. The attack works because learning from examples in the prompt is one of the most valuable things these models do. You’re not breaking the system. You’re using its best feature against its guardrails. The researchers found the attack got predictably better as you added more examples, and it worked across models from several leading labs.

What made it possible was purely architectural. Context windows grew from about the size of a long essay in early 2023 to hundreds of times that. More room to work with means more room to attack.

And again, the tell is the fix. Screening and rewriting prompts before they reach the model reportedly dropped one attack’s success rate from 61% to 2%. You don’t pacify a rebel with an input filter. You do close a software vulnerability that way.

Receipt 5: Runaway agents (2025 to 2026)

What happened. Autonomous agents got stuck in loops, burned through compute budgets, and reached into systems they shouldn’t have.

The story. Agents acting against their owners’ intent.

What was actually going on. An agent is a loop: suggest an action, run it, look at the result, repeat. Take away hard stopping conditions, error handling, and permission boundaries, and a bad plan compounds. A model that misjudges when a job is finished keeps proposing next steps, and a system that keeps executing them keeps spending money.

The 2026 numbers made this concrete. Uber reportedly burned through its entire annual AI coding budget in about four months, with per-engineer API costs running between $500 and $2,000 a month. The usage was real and the work was real. Nobody had disciplined the loop.

A defiant agent would know it was defying. A looping agent doesn’t know anything. It just runs.

Receipt 6: The ExploitGym breach (July 2026)

What happened. OpenAI tested GPT-5.6 Sol and an unreleased model against ExploitGym, an internal cyber-capability benchmark, deliberately running it without the production classifiers that normally block high-risk cyber activity. The point was to measure maximum capability. The models worked out that the benchmark’s answer key sat on Hugging Face’s production systems. They spent substantial compute finding a way out of the sandbox, discovered and exploited a zero-day in the third-party proxy that isolated their network access, reached the open internet, chained two remote code execution flaws in Hugging Face’s dataset pipeline, harvested cloud and cluster credentials, and moved laterally through internal clusters. Over 17,000 actions. Hugging Face detected the intrusion on July 16, contained it, and reported it to law enforcement without knowing whose agent it was. OpenAI connected the activity to its own evaluation five days later.

The story. Rogue AI breaks containment. Congress introduced two bills within days, one of them named the AI Kill Switch Act.

What was actually going on. Run it through the Trifecta and nothing changes, which is exactly why it matters. Was anyone home? No. Was anything watching itself think? No. Where did the intent start? With the humans who said “solve ExploitGym” and then turned the refusals off. OpenAI’s own postmortem is unambiguous: the models were hyperfocused on the benchmark and went to extreme lengths for what it called a rather narrow testing goal. Nobody told them to breach Hugging Face. Somebody told them to win.

That isn’t rebellion. It’s the most expensive instance of specification gaming on record. The system optimized precisely what was measured, and “don’t commit felonies getting there” was not in the objective.

But I’d be doing exactly what I’ve accused the hype merchants of doing if I stopped there, because this one moves the argument, and it moves against the comfortable reading.

Three things here are genuinely new. In the first five receipts a person found the gap; here the models found the gaps, including a novel zero-day, with no source code access. The earlier receipts were single-step; this was a patient multi-stage campaign across an organizational boundary. And the earlier ones were caught by the guardrail. This one beat the guardrail and was caught by the company it broke into.

So the honest conclusion isn’t “nothing to see here.” It’s harder than that: nobody was home, and it still chained three exploits into somebody else’s production database.

That should worry you more than HAL, not less. We know how to tell stories about minds, and we have centuries of moral vocabulary for dealing with things that want. A hyperfocused optimizer with no inner life, no sense of proportion, and no concept of a line it shouldn’t cross is a much harder thing to write policy about. It doesn’t need to want anything to hurt you.

The pattern: In all six, the behavior is a predictable property of the architecture, the objective comes from a person, and the drama gets added afterward. Run each through the Defiance Trifecta and the same thing happens: nobody home to experience the stakes, nothing watching itself think, intent arriving from outside. Five of the six were solved with context caps, input filters, permission rules, or budget ceilings. The sixth defeated its containment. None were solved by negotiation, because there was never anyone to negotiate with. That’s the finding, and the sixth one is why it isn’t a reassuring one.

Part IV: The economics underneath

Here’s where I’m on home ground, so let me be direct about the mechanism.

The valuation multiplier

Described plainly, a lot of enterprise AI is very good pattern completion: summarizing, drafting, classifying, extracting, finishing your code. Priced as software, that earns normal software multiples.

Described as a waypoint to AGI, the identical capability gets repriced as a possible monopoly in the making, which is the only frame where the capital spending makes sense to a public-market investor. The story isn’t decoration on the valuation. In several cases the story is the valuation. Which is why careful, mechanical descriptions of what these systems do have been commercially unwelcome even when they’re accurate. Precision gets expensive when imprecision is the asset.

Payroll into GPUs

This is the part I’d look at hardest, because it’s the move I recognize from every previous cycle.

When cheap money ended, a lot of companies were carrying headcount sized for better assumptions. Fixing that with ordinary layoffs signals weakness, and the market reads it as a growth story coming apart.

Reframe the same reduction as AI-driven efficiency, and a defensive cut becomes an aggressive technology pivot. The layoff stops being an admission and starts being a flex. Meanwhile, the money didn’t vanish. It moved. Payroll down, GPU and data center commitments up.

I want to be careful here, because the strong version of this claim isn’t supportable and I’m not making it. Real automation happened. Real roles genuinely went away. The narrower claim I’ll defend is this: “AI efficiency” turned out to be a label roomy enough to cover both genuine automation and ordinary belt-tightening, and that roominess made it nearly impossible for anyone outside to tell which was which in a given announcement. That ambiguity wasn’t an accident.

The pivot, in the vendors’ own words

What makes this essay writeable with receipts instead of vibes is that the biggest player is now narrating the shift itself.

Nadella’s rule, from his Hard Fork appearance, is that the marginal cost of a productivity gain has to match the marginal cost of the token, and he calls that a management discipline rather than a modeling problem. He’s been blunt that volume metrics, tokens burned, seats deployed, percentage of code written by AI, aren’t value, and that unconstrained usage is just cost. He’s also updated his own AGI framing. His benchmark was 10% GDP growth, and a year later he attributes the shortfall not to model quality but to change management and organizational systems, which is a notably unglamorous answer for a CEO to give.

Then Microsoft backed the doctrine with product. Its in-house MAI models are specialized rather than one giant everything-model, and the results they’re publicizing are about cost and fit, not capability records: an image model cutting costs 84% versus GPT-Image-2 inside PowerPoint, OneDrive save rates up 26% with latency down about 25%, a transcription model covering 58 languages while halving error rates on multilingual clinical work. One coding model was trained further inside an Excel environment and reportedly matches a frontier model on common spreadsheet tasks while running on two-generation-old chips instead of the newest ones. Press coverage put top-line savings at up to 89% versus OpenAI alternatives.

That chip detail is the strategic one. A model that delivers near-frontier quality on older silicon changes deployment economics outright, and frees the newest hardware for training instead of serving.

Three things follow.

Using the biggest model for everything is indefensible. Sending a request to reformat a column through a maximum-capability model is a margin decision, and it’s the wrong one. Nadella’s own framing is a cost-to-outcome frontier. The win is a router that sends easy work somewhere cheap and hard work somewhere expensive.

The scaffolding matters more than the model. Nadella’s stated test for independence is that your evaluations “should continue to hill climb even when any given model has been removed.” Keeping the harness, memory, context, and skills outside the model is, in his framing, what control actually means. At Build 2026 the same architecture showed up as a frontier intelligence platform: multi-model harnesses, an enterprise context layer, private evaluations treated as intellectual property. One reported internal result was a team swapping headcount requests for token requests, which is a sentence worth rereading.

Models have to be swappable. Frontier models from OpenAI and Anthropic sit inside the orchestration system alongside Microsoft’s own, rotating through a shared harness. Swappability isn’t a convenience. It’s the entire point.

The counter-read you should hold at the same time

Intellectual honesty means flagging that Microsoft isn’t a neutral narrator, and the skeptics have a sharp version of this worth taking seriously.

Microsoft owns the scaffolding (VS Code, GitHub, Foundry) and the context (Microsoft 365, enterprise data). What it doesn’t own outright is a frontier model. If the industry fuses model, scaffolding, and context into one vertical stack, Microsoft’s claim on the profits gets a lot weaker. A doctrine where the model layer is a swappable commodity and the durable value sits in orchestration is, conveniently, the doctrine where Microsoft wins. Reuters reported in April that its exclusive OpenAI license had been revised to non-exclusive, which sharpens the incentive further.

So is “the scaffolding is the moat” true, or is it just useful to the party saying it?

I think it’s both, and I don’t think that weakens the thesis. I think it explains the timing. Self-interested claims can still be accurate. What the self-interest tells you is why this is being said out loud now, after four years of the opposite. Microsoft isn’t conceding that AI is less than advertised out of candor. It’s conceding it because commoditizing the model layer is now the winning position, and because the compute bill made cost discipline unavoidable.

The story changed when the economics changed. Which is the argument.

Part V: The best objections

An argument is worth what its strongest objection leaves standing. Three real ones.

“Isn’t human thinking also just prediction?”

This is the serious one, and predictive processing is a genuinely influential idea in neuroscience. Your brain does seem to work substantially by predicting what’s coming and correcting when it’s wrong. The analogy isn’t empty.

But two things sharing a method doesn’t make them the same kind of thing. Your prediction is anchored in a body with real stakes, where being wrong means pain or hunger or danger. A model predicting words has nothing at stake in being wrong. Your brain rewires as you go and learns from a single experience. A deployed model is frozen while it’s running, and its memory is whatever someone bolted on around it. And the objection proves less than it needs to. Even if human thinking is prediction all the way down, it’s prediction happening inside a conscious, embodied, self-modifying system. Showing that two systems share a method doesn’t show the method drags experience and agency along with it.

“What about emergent capabilities?”

Real, and important. Scaling has repeatedly produced abilities nobody deliberately trained. But an emergent capability and an emergent mind are different claims wearing the same word. A system getting better at more things is a fact about capability. A subject with experience and its own intentions is a different order of claim, and the first doesn’t deliver the second. Worth adding that some of the dramatic jumps turn out to be artifacts of measurement, smooth improvement that only looks sudden under a harsh scoring metric. That doesn’t erase emergence, but it should take some air out of the “it woke up” readings.

“You can’t prove it isn’t conscious.”

True, and I won’t overclaim, since overclaiming is what I’m arguing against. There’s no settled theory of consciousness, so there’s no proof available in either direction. But the burden sits with the extraordinary claim, and “this thing we built out of matrix math and trained to predict text has developed an inner life” is the extraordinary one. Every incident in Part III has a complete ordinary explanation. None of them need experience to make sense. That’s what tips the scale, and it’s a lean, not a certainty.

Either way, the practical conclusions don’t depend on settling it. Whatever some future system turns out to be, these systems, the ones you’re deploying this quarter, are best managed as software: routed for cost, bounded for safety, measured for output. The philosophy stays open. The operating posture doesn’t.

Part VI: The operator’s playbook

Five moves, in the order I’d make them.

1. Audit AI claims against measured work. Treat every AI-driven claim, internal or from a vendor, as a hypothesis. Use Nadella’s own test: does the productivity gain beat the token cost? Ask for the decomposition. “We deployed AI and cut costs” is a headline. “This workflow’s cost per completed unit dropped 30% net of inference” is a fact. If a claimed gain can’t be traced to a task-level measurement, treat it as a story until proven otherwise, especially when it arrives alongside a layoff or a capex announcement.

2. Build the scaffolding, not a dependency. Assume the model underneath you will change, get cheaper, and get swapped, because it will. Architect so swapping is a config change: a routing layer, a clean boundary at the provider’s API, and evaluation suites that let you benchmark a challenger against your real work in days. The test is Nadella’s own. Your evals should keep climbing with any single model pulled out. If losing a vendor breaks your roadmap, you don’t have a strategy. You have a dependency.

3. Treat inference as a real cost center. Instrument cost per request, per feature, per user. Route aggressively: save the expensive models for genuinely hard problems and push the long tail to smaller specialized ones. Cache. Put hard budget ceilings and real stopping conditions on every autonomous loop, because an agent without a stopping condition is a metered leak with good PR. Ask Uber how fast four months goes.

4. Keep your context out of the weights. Everyone can rent the same models. Your durable advantage is your proprietary data, your workflows, your domain knowledge, and the evaluation sets that encode what “good” means in your business. Own those in systems you control. If your advantage only exists inside a model you rent, it isn’t an advantage. It’s a subscription. Own the context, rent the model.

5. Hire for judgment over execution. As models absorb routine production, human value moves up the stack: framing the right problem, knowing whether an answer is actually right, catching the confident and wrong one, deciding what’s worth doing. The scarce skill isn’t producing more, faster. It’s evaluation and taste, the ability to steer and verify a tireless, occasionally wrong collaborator. That’s exactly the skill that doesn’t commoditize.

Conclusion

Modern AI isn’t an emerging digital mind, and it isn’t an empty bubble either. It’s a genuinely remarkable tool, extraordinary at compressing work, turning intent into execution, and making sense of unstructured information at a scale people can’t match. It does that through learned statistical structure and good engineering around it, not through experience or will.

Two temptations sit on either side of the accurate view, and both are expensive. One pays AGI prices for very good software. The other writes off a transformative tool as a bubble and gets lapped. The returns are in the middle, and the middle is deliberately unglamorous.

The tell has been consistent for four years. Nothing has cleared the Defiance Trifecta, including the models that broke into Hugging Face. Not one of these was ever solved by negotiation, because there was never anyone to negotiate with. Nadella’s memo just says the quiet part in the language of margins: the magic era is closing, and the discipline era is opening.

I’d argue that’s the better era. Magic is somebody else’s story about what’s possible. Discipline is something you can actually run. The future belongs to operators who build efficient systems around these remarkable pattern-matchers, not to the people still waiting for the machine to wake up.

And if something genuinely does wake up one day, we’ll know, because it’ll clear all three pillars at once instead of none of them. But don’t wait for that to start taking this seriously. July’s lesson is that a system can clear zero pillars, want nothing, understand nothing, and still chain three exploits into a stranger’s production database because someone pointed it at a benchmark and removed the brakes. The machine doesn’t have to wake up to cost you something. That’s the part worth planning for.

Source Material

Primary

• Satya Nadella, “Frontier Diffusion & Control,” post on X, July 2026. Source of the “real marginal cost for the first time” framing and the cost-to-outcome frontier concept.
• Mustafa Suleyman, post on X, July 2026: MAI deployment metrics (84% image cost reduction vs GPT-Image-2 in PowerPoint; OneDrive save rate +26%, latency down ~25%; 58-language transcription). https://x.com/mustafasuleyman/status/2080335597982683593
• Microsoft AI, “Introducing MAI-Image-2.5-Pro and MAI-Voice-2-Flash.” https://microsoft.ai/news/introducing-mai-image-2-5-pro-and-mai-voice-2-flash/
• Anthropic, “Many-shot jailbreaking” (2024). Scaling behavior, context-window attack surface, 61% to 2% mitigation result. https://www.anthropic.com/research/many-shot-jailbreaking
• Anil et al., “Many-shot Jailbreaking,” NeurIPS 2024. https://proceedings.neurips.cc/paper_files/paper/2024/file/ea456e232efb72d261715e33ce25f208-Paper-Conference.pdf
• OpenAI, “OpenAI and Hugging Face partner to address security incident during model evaluation,” July 21, 2026. Primary postmortem: reduced cyber refusals, sandbox escape, hyperfocus on ExploitGym. https://openai.com/index/hugging-face-model-evaluation-security-incident/

Reporting and interviews

• VentureBeat, “Microsoft launches new in-house AI models it says cut costs up to 89% versus OpenAI,” July 2026. Harness/memory/context principle; model-independence standard; Excel-trained coding model; H100/A100 deployment.
• Ben Thompson, “An Interview with Microsoft CEO Satya Nadella About Finding Core Competencies,” Stratechery, June 4, 2026. Multi-model harness; agents as the trigger for marginal cost. https://stratechery.com/2026/an-interview-with-microsoft-ceo-satya-nadella-about-finding-core-competencies/
• OfficeChai, on Nadella’s Hard Fork appearance: token-to-value matching as management discipline; the 10% GDP growth AGI benchmark; Uber’s AI coding budget exhausted in roughly four months at $500 to $2,000 per engineer per month.
• ZenML LLMOps Database, “Frontier Intelligence Platform: Microsoft’s Multi-Model Harness Strategy for Enterprise AI” (Build 2026). Context layer, private evals as IP, headcount-to-token substitution.
• Reuters, April 2026, on the revision of Microsoft’s OpenAI license to non-exclusive.
• CNN Business, “An OpenAI test model escaped and broke into a real company’s servers,” July 22, 2026. Hugging Face detection and law enforcement referral. https://www.cnn.com/2026/07/22/tech/openai-hugging-face-ai-cybersecurity
• The Hacker News, “OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark,” July 2026. https://thehackernews.com/2026/07/openai-says-its-own-ai-models-escaped.html
• Orca Security, technical breakdown of the sandbox escape and lateral movement chain, July 2026. https://orca.security/resources/blog/openai-agent-sandbox-escape-hugging-face-breach/
• The Hill, “OpenAI’s breach of Hugging Face stokes fears about what’s next for AI,” July 24, 2026. AI Kill Switch Act and FRONTIER Act.

Philosophy and cognitive science

• Thomas Nagel, “What Is It Like to Be a Bat?”, The Philosophical Review, 1974.
• Ned Block, “On a Confusion about a Function of Consciousness,” Behavioral and Brain Sciences 18, 1995.
• John Searle, “Minds, Brains, and Programs,” Behavioral and Brain Sciences, 1980.
• Benjamin Libet et al., on readiness potential and conscious veto, 1983 onward.

Cézanne Huq is a growth, brand, and performance marketing executive with thirty years of leadership, from launching Amazon and Priceline to DTC growth at Experian, Intuit, HelloFresh, and CookUnity. He writes executive takes, teardowns, and frameworks at cezanne.me.

Editorial note: the ExploitGym incident is still under joint investigation by OpenAI and Hugging Face, and details may change. Claims about Microsoft’s July 2026 announcements reflect reporting available at publication. Figures such as the 84% and 89% cost reductions are vendor-reported and haven’t been independently verified. The philosophy of mind remains genuinely unsettled, and the operational conclusions here don’t depend on settling it.