Executive Summary
Today's sources agree on one thing: the assumptions enterprises use to plan AI (stable vendor margins, annual model refreshes, vendor-side security, human-paced attackers) are all wearing out at once. Margin position in the stack is moving faster than contracts, capability claims are moving faster than governance, and Calif's WeWorm demo shows exploit timelines shrinking to days. The durable posture is self-funded security and evaluation, plus contract terms that survive price and model volatility.
What Changed
Dylan Patel argues value capture has inverted at least twice in under two years. Model labs went from negative gross margins to substantial positive ones, and memory makers went from earning almost nothing in 2023 to out-earning foundry-tier economics. SemiAnalysis supplies the demand side: at roughly $100B/GW/year of inference revenue and 90%+ margins, a ~$5B islanded power plant pays back in about 20 days. Labs will therefore overpay for speed, and the scarce inputs (turbines sold out past 2030, a projected 288,000-worker labor gap) become the next margin pools.
On security, Calif reports going from bug to first RCE in about two days and to a zero-click worm in one more week. These are self-reported figures from a short excerpt, but the direction is consistent with the other security sources.
Cross-Expert Synthesis
The sharpest disagreement is Berman versus Lambert on recursive self-improvement. Berman relays claims of an internal OpenAI model solving a Millennium Prize problem in five days, and of a sitting Anthropic alignment lead putting extinction odds above 10%. Lambert rejects fast takeoff, calls extinction discourse poorly calibrated, and proposes "lossy self-improvement": jagged superhuman ability without compounding efficiency gains. Berman's headline claims are secondhand and unverified here. Lambert's rebuttal rests on absence of evidence, which is also not proof.
The enterprise decision does not depend on who is right. Both describe the same operational picture: labs detect misbehavior slowly (Lambert cites weeks for the OpenAI-HuggingFace incident, and Berman cites an evaluation-containment breach), and competitive pressure outruns safety spending. Calif adds the offensive side, since the same AI acceleration is available to attackers. Together these mean vendor assurances are not a security control.
Patel and SemiAnalysis also read differently. SemiAnalysis says value concentrates at the model layer, while Patel says it will not stay anywhere. They are compatible: margin sits wherever supply is scarcest, and that has been shifting down to memory, power, and equipment.
Jones adds a procurement lens. Iteration speed and role fit beat first-draft polish, so a single "best model" is the wrong unit of decision.
Enterprise Implications
- Pricing is a snapshot. Positive lab gross margins mean API prices are a choice. Multi-year commitments priced on today's rates carry repricing risk in both directions.
- Governance cadence is broken. If generations compress as Berman describes, semi-annual review cycles cannot keep up. Evaluations need to be automated and rerunnable against new models.
- Security must be self-funded. Monitoring, incident response, and mobile patch SLAs cannot depend on lab detection or user awareness, and zero-click attacks bypass the latter entirely.
- Open-weight policy is a tail risk. Lambert flags that one intentional-misuse incident could trigger heavy restrictions, which would hit on-prem and sovereign strategies with little warning.
- Capacity is a power problem. Time-to-power, not GPU price, differentiates neocloud and colocation options, and technology choice (reciprocating engines, turbines, fuel cells) matters.
What To Do About It
Sell model-agnostic architecture. Build an abstraction and evaluation harness so customers can swap models by role, following Jones's staffing framing: an expensive model for design and QA, a cheap one for execution. Add contract clauses for price protection and model deprecation notice.
Package an AI security offering: agent observability, action logging, least-privilege tool access, and shorter patch SLAs for managed and BYOD mobile fleets. Treat Lambert's "observability gap" framing as the pitch, not fear of loss of control.
For customers weighing data center or colocation capacity, add a due diligence checklist covering the six power gates: bankability, permits, gas, equipment, labor, and islanding. Ask any provider quoting delivery dates how they clear each one.
One sharp customer question: "If your model vendor's detection latency is measured in weeks, what is yours?"
Risks and Blind Spots
This brief leans on secondhand or self-reported claims: Berman's summaries of lab events, Calif's timelines, and SemiAnalysis's order data, which comes from its own model. None has independent verification in these sources. The sources are also thin on enterprise adoption evidence: nothing here shows what customers are actually paying, deploying, or losing. Patel's volatility argument can be over-applied, since switching costs (data, workflows, retraining) are real and can make lock-in unavoidable for some workloads. Finally, Jones's comparison is one task with one user, so treat the speed-over-polish finding as a hypothesis to test in your own workloads.