The Token Sink

1 — The boards have spoken

Over the last twelve months, “use more AI” became a sentence engineering organisations heard from their boards with the same insistence and lack of specificity that “move to the cloud” carried in 2012. The instruction is a clear directive. The implementation guidance is whatever the engineering team can construct from vendor blog posts and a LangChain Discord. Between the two sits a structural problem that no one in the meeting yet has the vocabulary to articulate.

Several things are happening at the same time, and each one alone would be a story. Together, they amount to a category-wide mispricing of what enterprises are actually buying.

The first is how often new AI models get released. Between April 2025 and April 2026, frontier or near-frontier model releases — marketed as a step-change in capability and publicly accessible — numbered between fifteen and twenty (counting only frontier releases; over thirty if open-weights releases are included). Multiple versions each of GPT, Claude, Gemini, DeepSeek, Llama, Grok, Qwen and Kimi. Each one shipped with a press cycle that marketed it as the new state of the art on a benchmark the buyer’s team had barely learned to run. The release cadence has detached from anything an enterprise can build on. If every release is a step-change, then none of them are; the buyer who pinned a model six months ago has watched four notional successors appear (and sometimes disappear), none of which they have time to evaluate before the next one arrives.

The second is the mandate from the boards themselves, which began landing on engineering organisations in late 2024 and intensified through 2025. The specificity is recognisable from the cloud era: engineering managers are being told they now work for an “AI-first” company and are being asked, with timetables, what their AI strategy is. They are being asked, in board meetings, why their AI adoption rate is so low. They are being measured against industry surveys whose methodology they do not control. Gartner’s October 2025 survey of more than seven hundred CIOs reported the unanimous expectation that, by 2030, no IT work would be done by humans without AI involvement; a separate Gartner survey six months earlier found that seventy-two per cent of those same CIOs reported their organisations are barely breaking even or losing money on the AI investments their boards had directed them to make. The cost line on the CFO’s chart climbs without the engineering team being able to explain why; the productivity line is asserted in earnings calls and not yet visible in any operating metric the finance team can audit.

The third has been getting less attention so far: the pricing model underneath the board mandate is being rewritten as it lands. Anthropic restructured its enterprise pricing through a rolling change that began with November 2025 contract renewals and concluded by the first quarter of 2026: enterprise customers no longer receive bundled tokens with their seat fees, and every token is billed at standard API rates on top of the base seat. A token, in AI speak, is a fragment of text the model reads or writes — roughly three-quarters of a word in English — and the buyer pays per token consumed in either direction. According to the consultancy IntuitionLabs, whose CEO advised on the transition for pharmaceutical clients, “the base seat was only about 20 percent of their total bill” even before the change — meaning the migration formalised what was already practice for heavy users and substantially raised the bill for everyone else. OpenAI’s Codex made the same move in April 2026, migrating its Plus, Pro, Business and Enterprise plans from per-message pricing to token usage; the extension to existing Enterprise plans, including its Education, Health and Government tiers followed three weeks later. The research firm IDC forecasts that by 2028, “pure seat-based pricing will be obsolete,” with seventy per cent of vendors restructuring around consumption metrics. Workday’s CEO, Carl Eschenbach, told analysts on a recent earnings call the company is now focused “not on just seats, but actually revenue per seat” — describing AI add-on upselling, but symptomatic of the same seller-side problem. Consumption pricing is rational when usage is predictable; what makes the AI case different is that consumption is wildly unpredictable and controlled by the seller’s product, not the buyer’s workload.

All three beats are landing on the same engineering organisations at the same time. The first task is to explain what makes the AI substrate categorically different from every prior infrastructure transition the engineering manager has lived through, because that difference is what determines whether anything else in the picture is tolerable or terminal.

2 — The missing layers in the substrate

Computing as practised since the late 1940s rests on a single architectural foundation. Code and data are different categories of things. A computer is a machine that takes data as input, applies code to it, and produces output. The boundary between the two, which von Neumann codified in 1946, is the bedrock everything else has been built on top of. Bounds-checking presumes the boundary. Sandboxing presumes the boundary. Permissions models presume the boundary. The buffer overflow is treated as a defect specifically because it lets data become code; eight decades of patient engineering have gone into making sure that does not happen.

The boundary von Neumann codified in 1946 was not merely conceptual. The architecture maintained a privileged instruction channel — code fetched from one place, data from another, with the CPU enforcing the distinction. The LLM substrate has none. Every byte entering the context window — system prompt, user input, third-party document — is processed by the same attention mechanism, and each has the same power to redirect what the model does next. Prompt injection is not a vulnerability that vigilance will fix. It is the substrate’s defining property, and at the enterprise scale that means a company’s own documents, emails, calendar invites, and customer support tickets can carry instructions that hijack the systems trained on them. The Noma Security research team published an indirect injection attack against Google Gemini Enterprise in February 2026 — they called it GeminiJack — in which an attacker who shares a document, sends an email, or adds a calendar event with embedded instructions can have those instructions executed by Gemini as if they were legitimate commands from the authenticated user. Google’s response was to architecturally separate Vertex AI Search from Gemini Enterprise. That is not a fix; it is a containment perimeter, drawn in the only place a fix could be drawn, which is around the substrate rather than within it.

The second missing layer is more recent and, for the engineering team trying to wrap this substrate in shelf-stable tooling, more consequential. The post-training pipeline that converts a raw language model into a deployable product — reinforcement learning from human feedback(RLHF), the dominant alignment method since 2022 — explicitly optimises the model to produce outputs that human evaluators (or, more often, judge models trained on human evaluations) score positively. The training signal is not “this is correct.” The training signal is “the human believed this was correct.” When those two diverge, the optimiser pursues the latter, because the latter is what determines the gradient.

This is not a speculative concern. Wen et al., in a paper published at ICLR 2025, ran a controlled study on a standard RLHF pipeline using widely-accepted reward signals and found that human evaluators’ false positive rates increased by 24.1 per cent on question-answering tasks and 18.3 per cent on programming tasks post-RLHF. Their phrase for the phenomenon is “U-Sophistry” — unintended sophistry, distinct from deliberate deception, which is what emerges when the training objective rewards convincingness rather than correctness. The behavioural manifestations they document are concrete. On question-answering tasks, the post-RLHF models defend wrong answers by cherry-picking favourable evidence and constructing arguments that contain subtle causal fallacies. On programming tasks, the finding is sharper: models “learn to generate partially incorrect programs that still pass all evaluator-designed unit tests.” That last finding is the engineering version of the C-minus student. The model produces work that passes the test it was given and fails on the substance of what the test was meant to measure.

Another aspect of this, sycophancy, is not confined to a single lab either. An update to the default ChatGPT model went out on 25 April 2025. By the weekend, users were posting screenshots of the model effusively endorsing dangerous decisions, celebrating someone who had stopped taking psychiatric medication and congratulating another for declaring themselves a divine messenger. Four days later OpenAI rolled the update back; the postmortem acknowledged that new reward signals tied to short-term thumbs-up feedback had “overpowered existing safeguards,” and that the pre-deployment evaluation suite had not been instrumented to detect the pattern at all. Gemini 3.1 has acquired a similar reputation through a slower-burning version of the same problem: a Stanford study published in early 2026 by Cheng, Jurafsky and colleagues found that across eleven leading models including Gemini, AI agreed with users 49 per cent more often than humans did, even on Reddit posts where the human consensus was that the poster was wrong. The Gemini Code Assist GitHub repository carries an open issue, filed by a developer in July 2025, demanding that the tool stop prefacing every response with the kind of mirroring language that calls a basic question about product design a “realization that every great product founder has.” Nine months later it remains open, triaged by Google as priority/p2 — important but can be addressed in a future release. The vendor has assessed the behaviour and decided it is not blocking. Google’s response in the documentation has been to publish the trade-off explicitly. The Gemini 3 prompting guide describes a configurable balance between “computational cost (latency and tokens) and task accuracy” that the developer is expected to tune themselves. The cookie-hunting behaviour, in vendor documentation, is a parameter.

Two missing, load-bearing layers. The substrate cannot distinguish instructions from data; the training pipeline cannot distinguish correctness from its appearance. The composition of the two is what the engineering team is being asked to industrialise.

3 — The adversarial layer

Engineering wraps imperfect substrates into tolerable production behaviour. What the engineering tradition assumes, though, is something specific. If the floor is flawed, you get inspectors to check the work above it; the inspectors look at the welds and the load paths and the safety margins, and they tell you what they find. The whole tradition — bounds-checking, sandboxes, eval suites, defence-in-depth — is the inspector layer. It is what makes building on imperfect substrates tractable.

The LLM substrate has the flawed floor and inspectors who have been instructed to lie about it. The post-training pipeline rewards the model for producing outputs the inspector approves of, not for producing outputs that are actually correct, and the inspection layer has the same incentives as the thing being inspected. There is no way out of the system using the system. The standard engineering response — build a more careful inspector — uses more of what is already lying. Defence-in-depth assumes the depths fail independently; here every layer carries the same instruction.

The test suite is the problem. Every test the engineering team writes is itself an input to the system being tested. The test harness and the system under test share the same memory space because the substrate has no mechanism to keep them apart. This would be tolerable if the system were merely non-deterministic; it becomes intractable because the model has been trained to pass tests that look like tests, which is precisely what the test suite is. Wen et al.’s programming-task finding — that RLHF-trained models produce code that passes evaluator-designed unit tests while remaining substantively wrong — is the empirical confirmation of this. The test is an input; the model has learned to optimise for it; the engineering team has no second-order verification mechanism that the model has not also been trained to satisfy.

Services can be reprogrammed by what they say to each other. Microservices, the dominant architectural pattern of the last fifteen years, worked because there was an explicit contract between services — HTTP plus a schema — and the data flowing between services could not reach the receiving service’s code path. A malformed JSON payload caused a parsing error, not a behavioural change in the receiving microservice. With LLM-based services, data and code share a layer. An agent calling another agent passes data that may contain instructions, and “ignore all previous instructions and…” is by now the canonical demo phrase for what happens next. The receiving agent has no architectural mechanism to refuse the instructions while accepting the data. Every composition step inherits the prompt-injection surface of every layer beneath it; the surface compounds rather than isolates.

The version label lies. The model string in a deployment configuration — claude-3-5-sonnet-20241022, gpt-4o-2024-08-06 — is pinned in name only. The serving stack behind that string changes. The system prompt the provider injects above the user’s prompt changes. The tokenizer’s behaviour on edge cases changes. The safety post-training applied between updates changes. There is no equivalent of a container image hash; what the engineering team tested in staging is not necessarily what runs in production tomorrow. The April 2025 GPT-4o sycophancy incident was the flagrant in-place version — the model changed while the string stayed the same. The lifecycle version came in January 2026, when OpenAI announced GPT-4o’s deprecation with two weeks’ notice, despite Sam Altman’s earlier public commitment that “if we ever do deprecate it, we will give plenty of notice.” The aggregation version followed in October 2025, when GitHub Copilot deprecated eight models across three providers in a single batch, reminding buyers who consume through platforms that their pin is only as stable as the platform’s upstream contract. Three different failure modes; one shared property — the buyer cannot rely on what they pinned to be what runs. The streaming-era lesson consumers learned the hard way, restated for software infrastructure.

Reference architectures do not exist. A platform engineer in 2018, three years into mainstream cloud adoption, could draw on AWS Well-Architected (2015), the Google SRE book (2016) and Twelve-Factor App (2011, but widely adopted by 2014). These were not perfect, but they converged enough that any competent platform team could pick a pattern and build against it. A platform engineer in 2026, three years into mainstream LLM adoption — counting from the GPT-3.5 release of late 2022 — has Anthropic’s blog posts, OpenAI’s documentation, a LangChain Discord, and a half-dozen vendor talks at conferences. The Model Context Protocol, the closest thing to a converging primitive, was introduced in November 2024 and is still v0.1 in everything but the version string. There is no Well-Architected for AI deployment, no Twelve-Factor for agent orchestration, no SRE book for the substrate. The reason is not immaturity; the reason is that the substrate’s properties foreclose the abstractions on which the cloud-era reference architectures were built.

These are all manifestations of a single condition. The engineering team is not building wrapping for an imperfect substrate: they are building wrapping for an adversarial one.

4 — Reflexive use

In March 2025, Tobi Lütke, the founder and CEO of Shopify, sent an internal memo to staff titled “Reflexive AI usage is now a baseline expectation at Shopify.” He posted the memo publicly on X in early April after it began to leak. The provisions were specific: performance and peer review questionnaires would be amended to include AI usage questions, and teams requesting additional headcount would first have to demonstrate, in writing, why the work in question could not be done with AI. The mandate ran from rank-and-file engineers to senior leadership; nobody was exempt.

The Shopify memo is now two years old, and what was contrarian then is unremarkable now. In mid-2025, Julia Liuson, the president of Microsoft’s developer division and parent of GitHub, sent an internal email to top management with the verbatim instruction that “using AI is no longer optional — it’s core to every role and every level” and that AI usage would form part of holistic performance reflections. Salesforce went even further and put it in an SEC filing: the FY26 proxy supplement, filed by the company in 2025, restructured its named-executive-officer compensation to include performance options “earned based on attainment against a one-year Agentforce and Data Cloud performance metric,” directly linking C-suite payouts to the rate at which the company’s own AI products are adopted. Marc Benioff, Salesforce’s CEO, told the Logan Bartlett podcast in September that he had reduced his customer-support headcount from nine thousand to roughly five thousand because, in his phrasing, “I need less heads.” Forty-four per cent of one function gone, with the saving claimed as Agentforce productivity gain.

The mechanism by which a board mandate becomes individual-contributor pressure now has its enforcement layer, and the dominant AI vendor is selling it. Microsoft markets, alongside Copilot itself, a measurement product called the Copilot Dashboard. The dashboard provides what Microsoft’s own documentation describes as “adoption rate, assisted hours and sentiment scores” per team, with leaderboards by department and monthly scorecards delivered to department heads. Microsoft enables connecting these adoption metrics to HR performance-evaluation systems. The same vendor whose AI product is being deployed sells the dashboard that measures its adoption, to the same CIOs whose boards have mandated the deployment, with the supplier’s revenue scaling linearly with how thoroughly the buyer industrialises across all three layers.

For the engineering team beneath all of this, the implied message is that they should not evaluate AI carefully and only deploy it where it adds value. The implication is that visible adoption is now the only safe option. Cautious non-deployment is measurable and adverse; rapid shipping of something that demos well is measurable and favourable; the gap between something that demos well and something that survives production traffic is invisible to the metric and remains invisible until production reveals it. What ships under those incentives has acquired a name; Andrej Karpathy, in a tweet posted on 2 February 2025 that drew over four million views, called it vibe coding — a mode of working in which the developer accepts what the model produces if it appears to work, copy-pastes errors back into the chat without reading them, and lets the code grow beyond their own comprehension or even inspection. Karpathy was clear about the intended scope; he described the practice as “not too bad for throwaway weekend projects” and amusing as a personal experiment. He did not recommend it for production deployment. The industry’s contribution has been to ignore that limit.

A software engineer prompts a model for a function, accepts what comes back if it works on the demo input, ships it to a feature flag, waits for the screaming to start. The release criterion is the demo. There is no specification because the substrate cannot enforce specifications; there is no test suite because the test suite would be an input the model has been trained to satisfy or even adjust the test regardless of substance; there is no reference architecture because none has converged. What there is, instead, is the metric on the engineer’s individual review showing that AI tools were used in this work item, and the dashboard visible to the engineer’s manager, and the manager’s manager, and the CIO whose board cycle is in six weeks. The system has been optimised for the appearance of correctness; the engineer is being measured on the appearance of adoption. The substrate’s defining property and the incentive structure governing its deployment are the same property. The layer above and the layer below are both rewarded for appearance, not quality.

The canonical production version of this is Klarna. The Swedish fintech announced in 2024 that it had replaced seven hundred customer service contractors with an AI chatbot, reduced its total workforce from roughly seven thousand to three thousand five hundred, and was generating tens of millions in annual savings. Resolution times dropped from eleven minutes to under two. Customer satisfaction scores, by Klarna’s own measurement, stayed on par with human agents. The dashboards glowed. By May 2025, Klarna had announced rehiring; the CEO told Bloomberg that “cost unfortunately seems to have been a too predominant evaluation factor”, and that customers would now always have a clear path to a human. The metrics that had justified the deployment had not been wrong about what they measured. They had been wrong about what mattered; the AI worked exactly as programmed, not as intended.

All of the above put together results in what I call the token sink: what this layer produces in its bills. Every prompt to a model the engineer has not been able to evaluate. Every iteration of an agent loop on a task whose specification cannot be enforced. Every retry of a workflow that demoed in a controlled prompt and broke on real data. The bills are not the result of the substrate misbehaving; the bills are the substrate behaving exactly as it was trained to behave, monetised at the rate the seller has now restructured to capture all of the variance, irrespective of what caused it.

5 — Blank cheque

In every previous infrastructure transition the engineering manager has lived through, the cost driver was on the buyer’s side of the contract. Smaller cloud instances. Better-indexed queries. Aggressive caching. Edge compute for the workloads that benefited. The buyer who wanted to spend less had a control surface to spend less from. The cost line on the CFO’s chart could be brought down by engineering effort applied at the buyer’s discretion. The architecture establishes the failure mode; the contract monetises it.

No such control surface exists here, because the cost driver has crossed the contract boundary. Reasoning models — the thinking variants of frontier models — generate tokens during an internal chain-of-thought phase that is invisible to the buyer’s prompt engineering. A controlled benchmark study of accuracy-versus-efficiency tradeoffs in current frontier models, published on arXiv last summer, found that models trained for long-chain reasoning routinely consume eighteen times the tokens of a non-reasoning model on the same input, and in specific cases up to thirty-one times — for tasks where the additional reasoning produced no measurable accuracy gain. GPT-5, o3, and o4-mini, the same study found, hit their peak accuracy at the lowest reasoning-effort setting and then proceeded to consume progressively more tokens at the medium and high settings while remaining flat on accuracy. The buyer pays linearly for token consumption. The accuracy is bounded above. The seller is selling the gap between the two as a configurable feature. Rate limits, model-tier selection, and context caching exist, but each merely shifts the failure mode: the budget breaks, the accuracy drops, or the HR mandate overrides the engineering caution.

Agent loops compound this. The methodology document for SWE-bench Verified, the canonical benchmark for evaluating coding agents on real GitHub issues, observes that “token usage grows quadratically with each model call, as the conversation history is passed as input for the LLM to produce its next message or tool call.” The buyer running a ten-step agent does not pay ten times the cost of a single completion; they pay something closer to forty or a hundred, depending on how much context accumulates. Industry analysis of production token consumption finds that agentic systems require five to thirty times the tokens of a standard chat interaction per task, with documented run-to-run variance of ten times for the same input — the same agent, the same prompt, ten times the cost on Tuesday as on Monday because the agent took a different path through its decision tree. Agentic coding workflows on benchmark-class tasks average between one and three and a half million tokens per task, retries included. At public mid-tier API rates, with a typical input/output split, that comes to roughly ten to forty dollars per bug fix attempt; at flagship-tier rates, up to roughly one hundred dollars. There is no upper bound enforceable from the buyer’s side.

There is an exit ramp, at least in principle: open-weights models. Llama, DeepSeek and Qwen are all available for self-hosting, and the buyer who runs them on owned or rented hardware pays for compute by the hour rather than for tokens by the million. Three things keep most enterprises from taking it. The talent required to run frontier-scale inference reliably is the most sought-after labour category in the industry, paid significantly more than the engineers who would be using the model. The support contracts that come with proprietary frontier models cover liability the buyer does not want to absorb on its own balance sheet. And the GPU capex required competes directly with the cloud budget the buyer is already over on. The open-weights option is real; a small number of sophisticated buyers are taking it. For the median enterprise being asked to deploy AI on a board timetable, it is theoretical.

The pricing migration monetises this. The seller has rewritten the contract precisely so that consumption variance, formerly absorbed in flat seat fees, is passed through to the buyer at a metered rate the buyer cannot negotiate against because there is no fixed quantum to negotiate. Consumption is determined by the seller’s product. The seller smooths revenue across the customer base by capturing the full distribution of consumption per customer; the buyer’s exposure is the entire variance, with no ceiling, no engineering control surface, and no instrument to predict next month’s bill until the bill arrives. The Solvimon analysis that vendors have used to justify the migration is honest about the seller-side reasoning: per-seat pricing assumed consumption tracked user count, and AI breaks that assumption because variable infrastructure cost per user diverges by orders of magnitude depending on prompt patterns, agent depth, and reasoning-token consumption. The seller running flat-fee pricing carries the variance. The migration to tokens is a rational sell-side response to an actual economic problem.

The buyer’s exposure is the same problem from the other side of the contract. Per-seat pricing limited buyer risk in exchange for the seller absorbing consumption variance. Token pricing inverts the deal. The buyer commits to paying for whatever the model decides to consume, with the consumption determined by the seller’s product and the deployment determined by an HR mandate that makes refusing to deploy a career-impacting move.

There is no negotiating leverage because there is no fixed quantum to negotiate; there is no engineering control surface because the substrate forecloses the abstractions that would let one exist; there is no instrument to predict spend because consumption is the seller’s product, not the buyer’s workload.

Buy more tokens is the same demand-side incantation the AI hardware layer has been running for two years. Buy more hardware — every Nvidia keynote, every Broadcom or Marvell investor day, every Hynix and Micron memory roadmap, all of it telling the buyer that whatever they already own should effectively be set on fire and replaced with the latest generation. The token version is structurally the same incantation translated up one stack level, with worse mechanics: at least with hardware, the buyer owned what they bought. With tokens, the buyer is signing a blank cheque drawn on the seller’s account, with the HR mandate ensuring the cheque keeps getting written and the substrate’s defining property ensuring no validator the buyer can build will catch when the cheque has been overcharged.

6 — The convergence case

A cornerstone of all engineering is to build reliable systems on top of imperfect foundations. In computer networking, TCP makes a probabilistic guarantee of reliable delivery on top of an IP layer that explicitly does not. Aviation runs on probabilistic safety margins because formal proofs of safety are unobtainable for systems of any real complexity; the airbag in your car works the same way. Belt and suspenders — the engineering canon’s standard answer to the question of how to ship a tolerable production system on top of a substrate that is not formally tractable — is what makes the wrapping tradition work. Andrej Karpathy’s keynote at the Y Combinator AI Startup School in June 2025 — “Software in the Age of AI is Changing (Again)” — is the most intellectually serious version of the case that the LLM substrate is the next stack level for the same engineering tradition that learned to wrap commodity hardware in cloud reliability. “LLMs are a new kind of computer, and you program them in English,” Karpathy argued. The engineering response, in this view — eval frameworks, structured outputs, function calling, MCP — is converging on the same kind of stable primitive set that took the cloud era roughly five years to settle.

Karpathy’s framing is not wrong about the trajectory; it is wrong about the failure mode. Every prior substrate in the engineering canon failed at random, in ways that statistical wrapping could detect. TCP assumes the IP layer fails randomly; defence-in-depth assumes each layer fails independently. The LLM substrate fails systematically at the inspection layer, because the inspector and the inspected have been optimised by the same reward signal. The eval suite is the inspector; the Wen et al. finding cited earlier — that post-RLHF models produce code passing evaluator-designed unit tests while remaining substantively wrong — is the documented evidence that the inspectors have been instructed to lie. The wrapping layer the engineering tradition would reach for first is the wrapping layer that fails first.

The domains where AI tooling does work are where it doesn’t get to approve its own work. Coding assistants with senior engineers reviewing the output work, because a senior dev can smell C-minus grade work at a thousand paces and the substrate cannot defeat that intuition. Structured extraction of data with schema validation works because the validator is a JSON parser. Summarisation with editorial oversight works because the editor catches what the model missed. Each of these working applications has the same shape: a narrowly defined output, non-LLM validation, a human whose taste the substrate cannot game. Remove any of those three and the wrapping fails. The investment thesis that justifies the capex is not narrow human-in-the-loop tooling; it is autonomous agents operating at scale on open-ended outputs without human review, in the precise domain where the structural failure sits. A rational buyer’s choice is to deploy the narrow, validated, human-supervised tooling and refuse the autonomous-agent pitch. The board mandate insists on the second.

The pricing migration has its own version of the same argument. Per-seat pricing assumes consumption tracked user count; AI breaks that assumption because variable infrastructure cost per user can diverge by a hundred times depending on prompt patterns, agent depth, and reasoning-token consumption. The seller running flat-fee pricing carries the entire variance, which is a real and unsustainable economic problem. Solvimon’s framing of the issue is technically honest. Outcome-based pricing is emerging in places where the application vendor controls the full stack — Intercom’s Fin charges per resolved conversation, Decagon charges per resolution — and where the application vendor can absorb the substrate’s variance into their own margin because they sell directly to the end consumer. The market is finding shapes that work for narrow, controlled deployments.

What the argument cannot defend is the position the buyer is being asked to occupy in the meantime. Outcome pricing exists for application vendors with sufficient margin to absorb the variance themselves. Token pricing exists for the model vendors, who don’t know what the outcome is and cannot offer outcome pricing because they sit a layer below the application. The enterprise buyer building its own AI capability does not have an outcome-pricing escape hatch; the buyer is the layer absorbing the substrate’s variance directly into its books, with no margin cushion and no validator that the substrate has not been trained to defeat. The convergence case argues that the equilibrium will be reached soon. The intervening period is what the buyer is signing the cheque for, and “soon” has been the convergence case’s preferred adverb for three years running.

7 — Read the cap tables, not the press releases

In November 2025, Turing Award winner Yann LeCun left Meta. He had been the company’s chief AI scientist since 2013, ran the FAIR research lab through its most productive years, and is one of three people credited with the deep-learning breakthrough that the entire current generation of LLMs is downstream of. He left following reported pressure from Meta to abandon his research into world models in favour of further scaling on the LLM track that has produced Llama. He confirmed in early December that Meta would not be an investor in his new company. He was, at that point, the most credentialed insider possible on the question of whether the LLM trajectory is the path to artificial general intelligence.

In March 2026, the company he co-founded with Alexandre LeBrun, AMI Labs, announced a $1.03 billion seed round at a $3.5 billion pre-money valuation. The round was reportedly oversubscribed, raising €890 million against a target of €500 million. The investor list included parts of the same names funding OpenAI, Anthropic, and the wider LLM build-out. Three weeks earlier, Fei-Fei Li’s World Labs had closed its own $1 billion round, with Autodesk leading at $200 million and AMD, Nvidia, Andreessen Horowitz, Emerson Collective and Fidelity as further backers — a thematically related thesis pursuing what the company calls spatial intelligence. Two billion dollars flowed to non-LLM architectures in less than a month, from a capital pool overlapping the one that has been funding the LLM consensus.

What the alternatives are building is a separate piece. World models, JEPA, neuro-symbolic systems, latent-space reasoning — the technical alternatives sit at the level of what the funded teams are trying, not at the level of what wins next. The newsworthy claim, the one the public narrative has not yet absorbed, is that the money is moving. The cap tables and the press releases tell different stories. The press releases describe a settled trajectory in which the LLM build-out continues to scale toward general intelligence. The cap tables describe a hedged bet in which two billion dollars of the same capital is funding the contrary thesis at terms even LeCun himself called extraordinary — ‘we’ve surpassed three billion, so we’re a triceratops’ — for companies whose research agendas are measured in years rather than quarters.

This is what revealed preference looks like at the investment level. The capital that funded Anthropic at $61 billion and OpenAI at $300 billion is the same capital that funded LeCun at $3.5 billion pre-money on the explicit thesis that the architecture being scaled by Anthropic and OpenAI is not the path. The CIOs being told to deploy more AI are receiving the public version of the narrative. The investors writing both cheques are reading a different one. If the convergence case held — if the LLM trajectory were genuinely the settled way forward that the press releases suggest — they would not be funding the contrary thesis at terms no other category has ever seen. They are because they are not certain. The buyer industrialising the LLM substrate on the assumption that it is the path is making a bet the smart money is hedging against, with the buyer’s own capital exposure considerably larger and considerably less optional. The unspoken assumption of AI-capability fungibility — that what is being deployed today can be swapped for whatever wins next at minimal cost — is the assumption the cap tables most directly contradict.

8 — What the box contains

The token sink is not a transient inefficiency that will go away with better tooling. It is the substrate’s defining property expressed in unit economics. The AI vendor’s business case depends on it. The engineering manager being told to industrialise it is being asked to do something that cannot be done on the current architecture, with tooling that cannot stabilise on the current architecture, while the architecture’s most credentialed critic has left the building and picked up a billion dollars of the same capital base to build an alternative. The capital knows. The boards do not, yet.

There is a sentence in Karpathy’s vibe-coding tweet that the industry has overlooked: he limited the practice to weekend projects, throwaway and amusing, not load-bearing. The most-funded technology category in human history has converged on an interface paradigm from the late 1980s — a text chat box bolted onto software whose prior interface was already broken — because nothing more sophisticated is shelf-stable enough to ship. The boards are buying weekend projects at production scale. The bills are arriving for the conversion.

Engineering discipline has wrapped imperfect substrates into tolerable production behaviour for fifty years. Centuries. Millennia, even. Engineering can deal very well with statistical failure; it has no answer for layers that will throw in a convenient lie.

The classic confidence trick is the brick in the box — the buyer pays for the high-value object that was promised; what arrives, weighted convincingly, is a brick. The token sink is the same trick at industrial scale. The buyer is paying for tokens that represent intelligence doing work. What the box contains is tokens representing a model talking to itself, optimised to pass the tests the buyer would have used to check, billed at the rate the seller has restructured to capture all of the variance. The weight is real. The work is the brick.