The verification gap is the story — everything else is downstream

Anthropic pointed Claude Opus 4.6 at Firefox's C++ codebase and got 22 confirmed vulnerabilities in fourteen days. Fourteen high-severity. First bug in twenty minutes. Total cost: roughly $4,000 in API credits, or about $400 per bug. That's a decades-old project with a dedicated security team, extensive fuzzing, and a bounty program. The finding-to-exploiting cost ratio is about 10:1 in favor of defenders — for now.

That's the number that matters this week. Not SoftBank's $40B bridge loan to OpenAI. Not the 25:1 subsidy on Claude Code. Not even the two fresh CVSS 10.0s (FreeScout's zero-click RCE via zero-width-space filename bypass, and pac4j-jwt's algorithm confusion — patch both today, and grep your codebase for any validation that runs before Unicode normalization). Those are the day's incidents. The verification gap is the shape of the next three years.

Here's the framework, courtesy of Christian Catalini's new paper and Eddy Lazzarin's read of it: automation costs are collapsing. Verification costs are not. Every model release widens the gap. Every sprint ships more machine-generated code into production than any human reviewed. The bug-finding capability that just embarrassed Mozilla is available to whoever has an API key, which means it's available to your adversaries at the same $400 price point you'd pay to defend yourself.

Yes, but — the counter-reading is that AI finds bugs faster than it exploits them, so defenders keep the edge indefinitely. I don't buy it. Anthropic's own researchers say the 10:1 ratio will shrink, and the exploit-chain synthesis work isn't standing still. The window where scanning-first beats being-scanned is real, but it's a window, not a moat.

What actually shifted this week

Three things converged, and they only look separate if you squint.

On the offensive side, Bing AI spent eight days recommending a poisoned GitHub repo as the top result for "OpenClaw Windows." Legitimate code, malware in the release binaries, clean on static scan. GTIG's 2025 numbers landed the same week: 90 zero-days exploited, 48% targeting enterprise infrastructure — a new record — with browsers finally under 10%. Cisco alone disclosed 50+ CVEs across SD-WAN Manager, ASA, FMC, and FTD, two under active exploitation. The perimeter you're paying to defend is now the thing being exploited, and the AI-recommended dependency chain is a live malware vector.

On the defensive side, OpenAI shipped Codex Security with a pipeline worth stealing regardless of whether you adopt the tool: clone into isolated container, auto-generate threat model, sandbox-verify each finding before reporting it. That sandbox-verify step is the whole point — it kills false-positive fatigue, which is why every SAST product your team has ignored got ignored. Free for open source, free trial month for Enterprise tiers. There's no reason not to run it against your public repos this week.

On the economic side, Anthropic is burning about $5,000 in compute per $200 Claude Code seat. Cursor flagged it, multiple sources corroborated the order of magnitude, and the playbook is 2013 AWS: subsidize until the switching costs are unbearable, then reprice. If your 2026 plan assumes today's Claude Code pricing holds, you're planning on quicksand. Model your AI tooling budget at 3–5x current levels for H2 and figure out which workflows still pencil.

Memory forked. Pick deliberately.

One piece worth internalizing even if it doesn't require action this week: the three major LLM providers have made incompatible memory bets. Gemini pushes 1M-token context with claimed 99.7% recall and zero cross-session state. ChatGPT auto-profiles users across sessions on an opt-out basis, which is a compliance problem waiting for its first GDPR complaint. Claude offers project-scoped opt-in memory at 200K–500K. None of them are wrong; none of them are interchangeable. If you're building on any of them without an abstraction layer, you've made a bet you probably don't remember making. The Custom GPTs memory-isolation bug — where main-session memory doesn't reliably inherit — is what a paradigm mismatch looks like in production.

What to do this week

One concrete action: instrument verification cost as a line item, this sprint. Not inference cost. Not latency. The hours your team spends reviewing, correcting, and re-testing AI-generated output — code, copy, retrieval citations, whatever your product ships. Most ML-ops dashboards track GPU utilization and token throughput and nothing else. If your automation costs drop 10x while your verification costs stay flat, your effective productivity gain is a fraction of what your CFO thinks you're getting. And when someone traces a production incident back to unverified AI output — Grammarly's attribution scandal is the preview — the first question in the postmortem will be whether anyone was measuring the gap.

Run Codex Security against a real repo. Patch FreeScout and audit for pac4j-jwt. But the durable move is the metric. The teams that can point to a verification-cost trendline in twelve months will be the ones still shipping. The teams that can't will be explaining what happened.