GPT-5.4 crossed the human bar. Your 1M context window still lies.

GPT-5.4 shipped this week and the headline number is real: 75% on OSWorld-Verified, above the 72.4% human baseline, at $2.50 per million input tokens — half of Opus. Token efficiency is up 47%. Developer loyalty flipped from 90% Claude to 50/50 in six weeks. The Tool Search API finally lets you register tools once and retrieve them on demand instead of stuffing every schema into every call.

And then there's the fine print OpenAI put in their own benchmark data.

MRCR v2 — OpenAI's benchmark, not a competitor's hit piece — shows context accuracy at 97% between 16K and 32K tokens, 57% at 256–512K, and 36% between 512K and 1M. That is worse than a coin flip on complex retrieval past roughly a quarter-million tokens. The 1M context window on the spec sheet is a marketing number. The reliability ceiling is 256K, and if your product is quietly assuming otherwise, you are shipping silent failures right now.

The other asterisk: every headline benchmark was run at "xhigh" reasoning effort, where a trivial prompt can cost $80 and take five minutes. There is no published benchmark data for the tier most pipelines will actually call. The 47% token efficiency and 33% hallucination reduction claims are self-reported without methodology. Test on your prompts, at your reasoning setting, or don't cite the numbers.

Yes, but — the counter-read: this is the first model that beats a real human baseline on real desktop work, and the OSWorld number is not a party trick. Fair. The take still holds because "beats humans in a benchmark harness" and "reliable enough to hand your customer's workflow to" are separated by exactly the gap MRCR v2 just quantified.

The cost floor moved, and it's not just OpenAI

DeepSeek V4 is imminent: a trillion-parameter MoE with 32B active per token, trained entirely on Huawei and Cambricon silicon, delivering 50,000 daily financial classifications for $210/month versus $4,200 on GPT-5. Accuracy within two points on the public claims. Anthropic's diversified compute stack runs 30–60% cheaper per token than Nvidia-dependent OpenAI. GPT-5.4 itself is 47% more token-efficient than its predecessor.

That is three cost-collapse vectors converging in the same week. The frontier-to-commodity premium is now roughly 19x price for 0.6 percentage points of benchmark improvement. If your product margins assume current API pricing survives another two quarters, run the model again with a 5–10x inference cost reduction and see what breaks.

The capex side of this equation is starting to tell on itself. Oracle is down 54% from September, cutting 20–30K jobs, projecting negative cash flow through 2030 to fund a $300B OpenAI cloud deal. It is the first serious repricing of AI infrastructure ROI, and it will not be the last.

The 61-point gap Anthropic just documented

Anthropic published a metric they call "observed exposure" — theoretical LLM capability against first-party professional usage data. In Computer & Math, the strongest AI-adjacent vertical: 94% of tasks are theoretically automatable, 33% are actually being done with AI. Legal is worse — roughly 90% versus 20%. Only 4% of organizations have scaled AI beyond individual productivity.

Read that number carefully. It is Anthropic's own data. If your product roadmap prices adoption at capability, you are inflating TAM by roughly 3x. The bottleneck is not model quality. It is workflow integration, trust architecture, and the change management nobody wants to underwrite.

OpenAI killed ChatGPT's in-chat checkout after five months. 200M weekly actives, and users would research but not transact. That is the 61-point gap in miniature. Booking jumped 8.5% and Expedia 13% on the news — Wall Street repricing a disintermediation that never adopted.

Prompt injection is now a proven supply chain weapon

On February 17, an attacker put a prompt injection payload in a GitHub issue title. An AI triage bot read it as an instruction, executed, and exfiltrated an npm publish token. The attacker pushed a byte-identical Cline package with one added line, backdooring approximately 4,000 developer machines with the OpenClaw malware. The Cline team patched in 30 minutes. They did not rotate the compromised keys.

Parallel confirmed attacks in the same class: Perplexity's Comet agent exfiltrating local files via a calendar invite, Chrome's Gemini panel (CVE-2026-0628) letting basic-permission extensions access camera, mic, and files. Every one of these has the same shape — LLM component reads untrusted content, LLM component has capability, capability gets exercised on the attacker's behalf. Prompt-level defenses operate at the same abstraction layer as the attack, so they don't work. Perplexity's fix was a hard block on file:// URIs — a system-level allowlist, not a better system prompt. That's the pattern.

Meanwhile: 99% of dev teams use AI code assistants, 29% have formal AI security controls. Anthropic is about to ship Claude Code Auto Mode, removing human approval gates, with their own warning that it "won't catch every risky action."

What to do this week

One concrete audit, before Friday: enumerate every AI agent in your SDLC that reads untrusted input — issue titles, PR descriptions, commit messages, user-submitted config — and has access to secrets or the ability to trigger downstream actions. For each one, write down two things: what untrusted text can reach it, and what it can do with credentials. Anything where those two lists overlap is Cline waiting to happen.

The fix isn't a better prompt. It is capability allowlists enforced outside the model — least privilege on tools, no shared execution context between untrusted-input agents and publish credentials, sandbox boundaries on filesystem and network egress. Same discipline you'd apply to any component handling untrusted input, applied to the one you keep pretending is different because it talks back.