The Board Room

The arithmetic, and what it leaves out

AI Breakfast priced a mid-sized workload of 10 billion input and 3 billion output tokens a month at list rates. On GPT-6 Astra it costs about $250,000 a month. On Mistral Large 4 it costs roughly $26,000. That is a difference of about $2.7 million a year on a single workload, and it is the number your CFO will quote.

Most buyers won't capture all of it. A 1-trillion-parameter model is roughly 0.5–2 TB of weights, depending on precision. Self-hosting therefore swaps per-token fees for GPU capacity and an operations team. Morning Brew notes that most teams will use the model through a hosted provider, which narrows the gap. With the 10-year Treasury at 5.269%, capital spent on self-hosting isn't cheap either. Every benchmark is Mistral's own: 93% on Cybench, 61.7% on DeepSWE v1.1, 28.3% on Terminal-Bench 4. Mistral calls Large 4 the best model outside China, which concedes that Chinese open models still lead, per MIT Technology Review.

Why the leverage matters more than the migration

The useful question is not whether Large 4 beats Astra. It is how much of your traffic actually needs Astra. Other evidence points the same way. HuatuoGPT-3, a 27B open medical model, outscored Astra on HealthBench, per AI Breakfast. The Information reports that SpaceX's AI unit will power Grok Bot partly with competitors' models. When a frontier player stops relying only on its own models, the 'best model' position is commoditizing.

The timing adds to your leverage. OpenAI and Anthropic are preparing to go public. Morning Brew argues that closed labs needing predictable revenue, facing buyers who can credibly walk away, tend to offer multiyear commitments with steep discounts. Take the discount without the long term. Morning Brew's reading of Nvidia's backing for Reflection AI as a bet that cheaper models sell more GPUs is interpretation, not a reported motive.

Vendors will move margin to where you aren't looking

Closed vendors will answer with pricing that wins headline comparisons. Google's Nano Banana 2.1 shows how. Per-image API prices roughly halved, while input-token prices tripled to $1.50 per million. Simplifying AI estimates that requests above a certain input-token threshold per 1K image now cost more. That covers the reference-heavy, conversational workflows Google is promoting. Apps on the old version must migrate before Oct. 29. A forced migration that changes your cost structure is a repricing you didn't choose. Only teams with an evaluation harness and a routing layer, which sends each request to the cheapest model that can handle it, can respond in time.

Legal risk is a second reason to stay portable. The D.C. Circuit upheld the Department of War's exclusion of Claude on a standard that 'turns on what Anthropic does, not why.' The FTC has confirmed it is investigating Anthropic and OpenAI, per a16z's policy brief. Depending on one model vendor is now a regulatory exposure as well as a pricing one.

You don't need to switch models to get the discount; you need a tested, credible ability to switch.

The move

Treat late October as the moment to get the evidence for your negotiation. Run Large 4, and Beam once Reflection publishes its technical details, against your current model on your own workloads. Measure cost per successful task, not cost per token. Keep commitments short until the results are in. Own the routing layer yourself. OpenAI's Decisions API also wants that role, and a router supplied by one of the vendors it chooses between has a built-in conflict.

Price was never the constraint

One analyst estimate cited by a16z says AI inference could pay $5,600 per megawatt-hour, nearly 60 times the average industrial rate, and still earn a decent return. The reason is that idle GPUs cost far more than the electricity to run them. That changes how to judge every power decision. The expensive outcome is not a high tariff. It is a late energization date, the day your capacity actually switches on.

Texas is now charging for its queue, and the price is going up. From Oct. 8, a large-load study costs $100,000 plus a $50,000-per-MW deposit. A project that falls two years behind forfeits only 20% of that deposit, about $10 million on a 1 GW campus, which the author calls a thin filter. Only 28 of 377 companies answered the state's resource-use survey. Expect regulators to tighten the filter, which raises the cost of holding speculative queue positions.

The workarounds are closing too

SemiAnalysis tracks 75 GW of orders for on-site, off-grid power equipment. The Texas freeze now covers air permits, though, so on-site generation is stuck as well. Chevron, which holds a 20-year deal to power a Microsoft campus, says its investment decision could slip into 2027. If a supermajor with a hyperscaler as its customer is slipping, assume your provider's Texas dates are slipping too.

Regulators are also ending the habit of shifting grid costs onto other customers. FERC rejected Talen's bid to send Amazon's Susquehanna campus more power directly. Texas has proposed allocating transmission costs across all 12 monthly peaks, which ends the savings from ramping down on hot afternoons. In PJM, data centers account for 38% ($6.3B) of the capacity bill. The House-passed Ratepayers Protection Act would make large loads pay for the grid upgrades they require, per a16z's policy brief. Expect these costs to show up in your cloud and colocation pricing.

Europe is tightening on permits as well. TLDR Hardware reports that Finnish authorities are investigating whether Google's local operator cleared 300+ hectares of forest near Muhos before a required environmental assessment. Google says it complied with forestry rules. Treat any hyperscaler's regional expansion plan as a forecast, not a commitment.

Flexibility is what gets you connected

xAI won grid service at its second Memphis site by promising to run its entire load for four hours on its own power. ERCOT's Batch Zero study formalizes the same trade with two paths: bring your own power, or accept automatic cuts when lines are full. Eleven projects chose to bring their own power. Duke researchers estimate ERCOT could absorb about 10 GW of new load without new generation if that load gave up 0.5% of its yearly grid energy. a16z backs Heron Power and Base Power, so discount its enthusiasm accordingly. The xAI and Batch Zero evidence stands on its own.

Making compute curtail on command is a software capability most tech companies already own, and it is turning into a place in the power queue.

The hyperscalers have already treated power as strategy. Google secured Constellation power for 20 years, Morning Brew reports. Companies without a power strategy will rent capacity from those who have one, on their terms. Your lever is to split workloads into deferrable work (training and batch jobs) and latency-bound inference, and to price curtailment internally so it doesn't break service-level agreements. Then put that flexibility into your provider negotiations as something you can trade for earlier dates.

Anthropic gates, Mistral doesn't

Anthropic folded its Glasswing and Cyber Verification programs into three verified tiers: Defense, Red Team and Specialized, the last for safety-critical systems. On CyScenarioBench, Defense Access is blocked on 46 of 50 offensive tasks. Red Team Access is blocked on zero, per AI Breakfast. Partners found 129,000 verified vulnerabilities between April and July, more than 33,000 rated critical or high. Mistral is releasing a model it says scores 93% on Cybench, ungated. The Information reports Zhipu's GLM-5.3, another open model, matches Anthropic's original Mythos at autonomous attacks and can be stripped of its safeguards.

The skeptic's case is that gating is the responsible choice. Fair. For cleared users, though, Anthropic removes the safety classifiers outright, so identity verification becomes the only control. Audits tend to find the gap at the badge check. Once vendors use Red Team access on company systems, the audit question moves from whether the model is safe to who they verified, and how.

Jamie Dimon says Mythos has dramatically increased global cyber risk, Bloomberg reports. Bloomberg's headline attached a '10-fold' figure, which is framing, not a measured estimate. When the largest US bank calls a model a systemic risk, the question shows up in procurement questionnaires and insurance renewals well before the next audit committee meeting.

The attacker's clock and the attacker's inventory

Nakasone's 29-minute figure needs care. Dwell-time benchmarks usually run in days, so his number may track something narrower, such as time to lateral movement. The direction holds. A response that waits for an analyst to escalate to a manager, who then asks an engineer to act, is too slow. The bottleneck is decision rights: whether anyone has pre-authorized systems to isolate a host or revoke a credential before an executive is reached.

PoeLLM is the second problem. Attackers breached more than 3,400 open-source AI servers, then put them to work mining crypto and scanning third parties, on the owners' bill and from the owners' IP addresses. The botnet builds command addresses from words in a GitHub poem, so indicator blocklists never see its infrastructure. Any team self-hosting open weights this quarter is building exactly the server PoeLLM targets.

FortiBleed, subject of a joint FBI and Secret Service alert covering more than 400,000 Fortinet firewalls, is the old lesson again. The listed mitigations are configuration work: locking down management interfaces and enforcing MFA, plus an audit of admin accounts. The fix costs attention, and hardware money buys none of it.

When attackers move in minutes and borrow a company's own AI servers, someone senior has to pre-authorize containment and own the cost when it fires on a false positive.

The move

Security leaders want remediation throughput funded. The national-security camp wants systems given pre-approved authority to contain. Both are needed. Throughput is a budget line. Containment authority is a governance call, and leadership owns it, because only leadership can accept the cost of an automated shutdown triggered by a false positive.