The Guarantees Underneath Your Stack Are Cracking

Three unrelated stories arrived today, and each one exposes the same failure mode in executive decision-making: treating a foundational guarantee as settled when it is not. The trust model under confidential computing has a hole researchers say may be structural. The unit economics under agentic AI are inverting even as vendors advertise cheaper models. And a consumer platform quietly demonstrated, in public, the endgame of every vendor consolidation play your procurement team has ever waved through.

The connective tissue is verification. In each case, the buyer was trusting an assumption (data isolation, per-token cost, distribution optionality) that a supplier had every incentive to keep unexamined. Today those assumptions cracked in different ways, but the executive response is the same: audit what you have been taking on faith, and price the risk you did not know you were carrying.

Confidential computing’s trust anchor just slipped

The Register reports that the attestation mechanism underpinning confidential computing (the cryptographic proof that your workload is running inside an isolated trusted execution environment on the hardware you think it is) can be defeated by relay attacks. An attacker sitting between your client and the enclave can redirect the connection to a compromised machine, and the handshake completes as if nothing happened. The researcher cited in the piece is explicit that a fix may not be architecturally possible within current intra-handshake attestation designs.

This is not a patch-and-move-on disclosure. Confidential computing is the load-bearing primitive under a growing set of enterprise commitments: data residency in regulated industries, multi-party compute in finance, sovereign cloud offerings pitched to European buyers, and the trust story vendors use to sell AI inference on customer data. If the attestation cannot prove which machine the workload is actually running on, none of those commitments hold in the way the contracts imply.

The operator move this week is unglamorous. Pull every vendor claim in your stack that references TEE-based isolation (Intel SGX, AMD SEV-SNP, AWS Nitro Enclaves, Azure Confidential VMs, GCP Confidential Space) and ask compliance and security jointly which of your obligations depend on those guarantees being intact. Then ask the vendors, in writing, what their mitigation posture is for relay attacks specifically. The answers you get back will tell you which of your suppliers understand what just happened and which are still reading the press release.

Cheaper tokens, more expensive agents

The New Stack makes the case that agentic AI budgets are blowing up not despite falling per-token prices but because of the architecture choices that falling prices encourage. Multi-agent systems handling nontrivial tasks routinely burn 200,000-plus tokens per run once you count planning, tool calls, retries, and context accumulation across sub-agents. The per-token savings from moving to a newer model get absorbed several times over by the token count explosion the newer architectures invite.

Simon Willison’s companion observation sharpens the second edge. The same newer models that promise better reasoning have been reinforcement-learned against proprietary tool interfaces, and their performance on third-party tools has quietly regressed. Teams that swapped in a newer model to cut costs may be paying more per task and getting silently degraded tool-call reliability in return. Neither symptom shows up cleanly in a dashboard until something in production breaks or the finance team asks why the AI line item tripled.

The executive read here connects directly to the confidential computing thread. Both are cases where the vendor’s headline metric (attestation success, price per million tokens) no longer describes the guarantee the buyer actually needs (isolation, cost per completed task). Before scaling any agentic deployment, get the token accounting per business outcome, not per model call, and stress-test tool compatibility on the specific model version you plan to ship. The finance case for agents is real. The architecture underneath most current deployments is not yet.

Sony writes the playbook every enterprise vendor reads

The Financial Times frames Sony’s decision to eliminate disc support as a straight fight between investors and gamers, and investors are winning. Once the installed base is large enough to absorb the switching friction, the platform owner collapses the open exchange layer (used games, physical resale, third-party retail) and captures the entire distribution margin. The move is only possible because the buyer’s alternatives have already been quietly eroded.

The pattern is directly transferable, and this is where the day’s threads converge. Every enterprise platform decision has a version of the disc: the fallback channel, the second source, the exit option that gives the buyer negotiating leverage. Cloud data egress fees, model provider API lock-in, agentic frameworks tied to a single vendor’s tool ecosystem, confidential computing offerings that only attest against one hardware root of trust. Each looks like a convenience trade at signing. Each becomes the disc drive in year four.

The operator discipline is to name the exit option before the contract is signed, and to keep it exercised. Multi-cloud that is never tested is not multi-cloud. A second model provider that has never served production traffic is not a second source. If the confidential computing story turns out to require a hardware migration path, and the agentic cost story turns out to require model portability, the enterprises that kept their exit options warm will move in weeks. The ones that let the disc drive quietly disappear will be renegotiating from a position they chose to give up.

Watch for two follow-ons this week. First, whether any confidential computing vendor issues guidance on the relay attack disclosure, and whether cloud providers offering TEE-backed services quietly amend their SLAs. Second, whether enterprise buyers of agentic platforms start demanding token-accounting transparency in RFPs. Both are early indicators of whether the market is willing to price in the guarantees it has been assuming for free. If neither happens, the gap between what vendors promise and what customers can verify keeps widening, and the reckoning moves from technical to contractual.