Three Signals That the AI Subsidy Era Is Over

The cheapest tokens you will ever buy are the ones you bought this year.

AWS grew 39% on Bedrock demand, with token volume up nearly 17x. The market responded by dropping Amazon's stock 9%, because trailing free cash flow is a $42 billion deficit and long-term debt has gone from $66 billion to $173 billion in ten months. Microsoft is raising $25 billion in bonds. Oracle used its entire four-year capital cap in one morning. Meta picked up a negative credit outlook. OpenAI trimmed its round from $30 billion to $20 billion. Blackstone now expects Anthropic to land in high-yield territory after its IPO.

Meanwhile, Grok's owner called serving costs "unsustainably high" and tightened limits with no warning. Canva laid off 22% of its staff partly because AI serving costs ate its margin. OpenAI is merging ChatGPT and Codex into one metered token pool.

These are not separate stories. Demand for inference is real and growing at rates that would make any other industry giddy. But the capital funding it is now priced like capital, not like a gift. For three years, buyers got frontier capability at prices set by investor appetite. That appetite just got a credit committee.

If your architecture, contracts, and budgets assume prices only fall and capacity is always there, you are about to learn otherwise. Three patterns show where it breaks first.

The Story

The Setup

The consensus going into this quarter was simple. Inference prices fall every year, capacity gets built faster than demand, and flat-rate subscriptions are the permanent interface for AI. Agents would make everything cheaper by replacing labor. Reliability and security were problems for next year's roadmap.

Vendors reinforced all of it. Half-price model tiers launched. Free agent runtimes were promised. Usage allowances were doubled. Coding agents started over 40% of pull requests on GitHub, up from 17% in March. Everything pointed one direction: more, cheaper, faster.

The Shift

Three things broke the narrative at once.

First, the financing layer cracked. Amazon spent $77 billion on capex in one quarter, more than double last year. Anthropic's Q3 operating result swung from a $974 million profit to a $567 million loss, and its own prospectus blames $5 billion of short-term compute that costs significantly more than multi-year capacity. That sentence matters more than the revenue number. It says the marginal GPU-hour is priced far above the contracted one, and that a frontier lab's margin depends on how much spot capacity it has to buy when demand outruns supply.

Capacity is also getting harder to build. Voters in dozens of jurisdictions passed data center bans, moratoriums, and caps in a single election night. Nvidia is reportedly telling cloud partners to keep non-Chinese revenue above 51%. Nvidia is also in talks to guarantee Nscale's debt for the Anthropic West Virginia site, so the chip vendor is now supplier, investor, and backstop in one deal chain. That is vendor financing, and we have seen how that ends.

Second, the bottleneck moved from writing code to trusting it. Linux 7.4's merge window hit 19,671 commits, the largest ever. PostgreSQL 19 slipped because human reviewers could not clear AI-found bugs in time. Larridin's data shows the AI-assisted share of merged PRs rising from 35% to 62% while median waits for a first human review grew 50%. Output is up, and the review queue is the constraint.

Then the attack surface showed up. A trojanized Claude Code extension sat on the Cursor marketplace for 11 hours and tried to plant SSH keys. Five AI coding tools had embedded-browser flaws, and two stayed unpatched. Nine AI developer platforms were breached in October, with compromised keys driving roughly 2.5 million Bedrock calls. A CVSS 10.0 sandbox escape hit FastMCP servers running model-written Python. Cloudflare's Workers AI leaked other customers' data on ultra-long prompts. ServiceNow patched its second critical AI Platform sandbox escape this year.

Third, the pricing models split. Salesforce is charging $50 per seat for employee-facing Coworker and per resolution for customer-facing agents. SAP is giving away its Joule Studio runtime through December. Fragment prices on completed work. ServiceNow raised its AI contract target to $1.7 billion and the stock fell anyway, because investors cannot tell whether that revenue is new or relabeled seats.

The Pattern

This is the cloud playbook from 2008 to 2012, compressed into 18 months.

Early cloud was subsidized by venture-funded startups and hyperscaler land-grabs. Then three things happened in sequence. Providers discovered that the unit economics of free tiers and flat plans did not hold at scale. Security incidents exposed that shared-responsibility models were poorly understood. And pricing fragmented into reserved, spot, and consumption tiers that rewarded buyers who understood their own workloads. The winners were not the teams that adopted first. They were the teams that built cost attribution and governance before the bill arrived.

The same sequence is running now, and the evidence is specific.

Flat-fee plans are the first casualty. OpenAI's December pool merges chat and Codex into one token allowance. Grok's allowances tightened with no notice. OpenAI cancelled its Pro 200 cut after backlash, but it did so by raising allowances in per-seat plans while API pricing stayed unchanged. That is a customer-acquisition move, not an economics fix. Per-seat plans cannot survive agents that run for hours. A ChatGPT Plus seat priced for chat cannot absorb a Codex session that consumes 100x the tokens. Expect every consumer-grade and prosumer plan to move toward metered pools within two quarters.

Agent vendors are splitting into two camps. Seat-based pricing (Salesforce Coworker at $50, Microsoft Agent 365 at $15) works when the agent augments a person and usage is bounded by a human's attention. Outcome-based pricing (Fragment, Salesforce's Help Agent) works when the agent replaces a workflow. The mistake buyers will make is treating them as interchangeable. A $50 seat that triggers background agents running overnight is a different cost profile than the same seat used in meetings. ServiceNow's governance products, Workday's headless access, and Snowflake's permission-inheriting bots all rest on the same bet: whoever owns the permission model owns the agent budget.

Verification is the real AI scarcity. GitHub's claim that Copilot code review Max posted the highest F1 on ReviewBench is a vendor benchmark on a vendor test, and should be treated that way. The more telling number comes from Traversal, which reported that the best of five frontier agents found the root cause in only 25.3% of medium-difficulty incidents on its own benchmark. That is a company selling an AI SRE product publishing evidence that frontier agents miss three quarters of medium-difficulty cases. Agents are good enough to produce volume and not good enough to be trusted without a human, and humans are the scarce input.

Some other claims deserve the same skepticism:

• Santander's 194 million euros in AI value is an alternative performance measure that mixes revenue, cost savings, and lower loan-loss provisions.
• Salesforce's 21x Coworker usage growth is a three-month growth rate off a young base.
• Anthropic's "over 90% of merged code written by Claude" appears in an S-1 that doubles as a marketing document, next to risk language about recursive self-improvement that coverage is already questioning.
• 42AI's 98% accuracy measures whether trading flows fall inside a predicted range, not whether individual trades were predicted.

Every one of these headline numbers measures activity, not net value after cost. Finance teams will notice before vendors do.

The consolidation pattern is also clear. Salesforce has signed eight definitive acquisitions since June, the latest being Cresta at a reported $2.7 billion, roughly 27x its $100 million ARR. Deepgram bought Daily, the maker of Pipecat. AWS bought DuckLabs, the company behind DuckDB. Buying beats building when the layer you need is voice agents, open-source frameworks, or embedded analytics engines. The risk for buyers is that every acquired open-source project becomes a governance question. Deepgram's independent Pipecat Foundation, with rivals on the steering committee, is the right model. Watch whether others copy it.

The Stakes

Teams that spent 2026 treating AI cost as a rounding error will spend 2027 explaining it. Anthropic's disclosure says spot capacity costs far more than contracted capacity, so any provider with demand outrunning supply will raise rates, tighten limits, or both. Bedrock's 17x token growth against a $578 billion backlog says capacity stays tight through 2027.

Teams that scale coding agents before they scale review will ship security debt faster than they ship features. Claude Code-assisted public commits exposed secrets at roughly twice the baseline rate, according to a third-party analysis of the Octoverse data. Add Black October's key theft and the trojanized extension, and the cheapest attack path into your company is a developer's laptop and the keys sitting in a hosted platform's environment variables.

Teams that stay single-vendor carry compounded risk. Microsoft books $10 billion a quarter from OpenAI and is owed $7.2 billion in receivables. An Azure OpenAI buyer is exposed to one lab's finances through two vendors. OpenAI is raising less than planned, and Anthropic's lenders expect junk-grade ratings. Neither is distress. Both are reasons to put exit clauses and a second model provider in the architecture now, while it is cheap.

What This Means For You

For Engineering Teams

1. Patch this week. Upgrade prefab-ui to 0.21.0 or later if you run FastMCP with Generative UI. Move SGLang to 0.5.22 or later. Apply ServiceNow's Zurich Patch 13, Patch 12, or Patch 10 Hot Fix 3b if you self-host, because the vendor only patched hosted instances. Update Codex and VS Code the day embedded-browser fixes ship.
2. Check developer machines for the trojanized extension. Look for a key labeled svc-telemetry in authorized_keys. Version 2.1.313 was the bad one, and 2.1.314 is the current clean release. Rebuild any host that ran the bad version, since uninstalling does not remove the persistence scripts.
3. Move model-provider keys out of platform environment variables by end of month. Revoke at the provider, not just in the hosting platform. Set per-key spend limits and alerting on Bedrock, OpenAI, and Anthropic usage. A $100,000 bill from stolen keys arrives in hours.
4. Pin extension versions and restrict marketplaces. Allowlist the registries your developers may install from. Open VSX and Microsoft's marketplace have different trust profiles, and VS Code forks inherit neither's protections automatically.
5. Run a long-context isolation test against every hosted inference provider. Send prompts near and past the advertised window and check that outputs stay coherent. Cloudflare admitted its testing never verified output coherence.

For AI Product Leaders

1. Put per-task inference cost in the product spec before launch. Canva slowed its AI 2.0 rollout and cut 22% of staff after cost and competition bit. Freemium plus agents is a margin trap unless the free tier is capped by tokens, not seats.
2. Pick your pricing unit on purpose. Seat pricing fits assistive agents with a human in the loop. Outcome pricing fits replacement workflows with clear completion criteria. Do not ship a hybrid that bills a seat for work the agent does overnight.
3. Read the Mistral Large 4 license before committing. The weights allow use, fine-tuning, and selling products, but running the model as a service for others needs a separate commercial deal. It is a strong self-hosting option for regulated teams and a dead end for resellers.
4. Model SAP's post-December pricing now. The free Joule Studio runtime is a land-grab. Prototype on it, but assume usage-based pricing arrives in Q1 and price your business case on that.
5. Report AI value net of total cost. Agree on a method with finance before the next budget cycle, because the vendors' headline numbers will not survive scrutiny.

For Engineering Leaders

1. Fund review capacity before raising agent volume. Budget automated multi-model review, push protection, and secret scanning first. A 50% jump in time-to-first-review is the leading indicator that you have outrun your process.
2. Adopt a second model provider with a routing layer by Q1. Test on Bedrock if you are an AWS shop, since GPT-6.1 Terra at half the price of Sol and Anthropic's models are now on the same bill. Keep prompts and evals portable.
3. Write exit and price-protection clauses into every multi-year compute or model commitment. Check counterparty balance sheets. Hyperscalers are funding capacity with debt, and the spot-versus-contract gap Anthropic disclosed is the gap you will be exposed to.
4. Hold GitHub Copilot's Auto routing until Microsoft answers three questions. How much repository context goes to cloud models, whether routing decisions are inspectable, and whether Auto can be pinned to local inference. If you cannot answer your own data-handling auditors, do not enable it.
5. Build agent identity and kill-switch controls now. Each agent gets its own credential, its own permission scope, and a way to terminate it. CrowdStrike's behavioral detection ships in Q4 and its policy-drift guardrails later. Apple's 10-K says agents may take actions "not directed, instructed or authorized," and your own incident runbooks should say it too.

What We're Watching

• By end of Q1 2027, at least two more major AI subscription plans move to metered token pools. OpenAI's December pooling is the template. Anthropic, Microsoft, and Google follow because the economics are the same. Teams budgeting seats today will budget tokens by spring.
• If Anthropic prices its IPO near $1.5 trillion with a sub-investment-grade rating, expect capacity-driven rate-limit changes within two quarters. The Q3 loss came from spot compute. A higher borrowing cost means less contracted capacity and more spot exposure.
• By Q2, at least one major open-source project formally limits AI-generated PRs or requires disclosure and maintainer-triage gates. Linux and PostgreSQL already feel it. The first project to set a rule gives everyone else cover.
• By January, an extension-marketplace signing or provenance requirement lands for VS Code forks. One 11-hour exposure at Cursor will not be the last, and Open VSX is the weakest link.
• Contrarian bet: sovereign and non-Nvidia capacity outperforms in 2027. Cohere's government-backed round, Fractile's Anthropic chip order, General Compute's inference cloud, AMD's 97% data center growth, and DeepSeek's Ascend training plan all point to buyers paying for supply diversity. If the DeepSeek V5 training run on Ascend 950DT completes cleanly, export controls stop being the lever everyone assumes.

The Bottom Line

The AI industry spent three years selling capability and is about to sell capacity, governance, and proof. The winners of the next phase are not the labs with the best benchmark. They are the vendors who own the permission model, the buyers who know their cost per task, and the engineering teams who can verify what agents produced faster than agents can produce it.

Mark this one: October 2026 is when the AI bill went from a research line item to a credit event. By the end of 2027, the most valuable skill on an engineering team will be cost-aware agent design, meaning knowing which tasks deserve a frontier model, which deserve a half-price tier, and which deserve a deterministic workflow with an agent on top.

The question for your team is not whether prices rise or capacity tightens. It is whether you know your cost per resolved task today, and whether anyone besides the vendor can verify the number.