Microsoft's 3.3% Copilot conversion is the number that reprices everything

Microsoft has 450 million M365 seats. It converted 15 million to Copilot. That's 3.3%. Consumer Copilot sits at 6M DAU — behind Claude's 9M, and roughly 1/73rd of ChatGPT's 440M. The stock is down 19% YTD, worst in the Mag 7. Eric Boyd, who ran Azure AI Platform, left for Anthropic. Thomas Dohmke left GitHub. Rajesh Jha is retiring out of M365 and Windows.

That 3.3% is the load-bearing number of the week. It is the first hard, at-scale proof that owning distribution does not translate into owning AI adoption. If you have written "we'll drive adoption through our existing base" in a PRD, an investment memo, or a board deck this quarter, you should treat 3–5% as the ceiling of that plan and rebuild from there.

Yes, but — the counter-reading is that Copilot's problem is product execution, not the thesis. Microsoft shipped a mediocre wrapper on someone else's model and priced it at $30/seat; a better Copilot might have hit 15%. Fair. It still doesn't rescue the thesis, because the same week ChatGPT crossed 440M DAU with zero enterprise bundling and Claude passed Copilot on consumer with zero consumer surface area. Distribution wasn't the constraint. Product was. That's the whole point.

OpenAI is paying 17.5% to close, and disclosing why

OpenAI is offering PE firms — TPG and Advent named — a 17.5% guaranteed minimum return through enterprise JV structures, in exchange for pushing OpenAI into portfolio companies. Read that alongside the pre-IPO disclosures: $665B in compute commitments through 2030, Microsoft dependency flagged as material risk, 17+ active lawsuits, and a PBC governance structure the underwriters are treating as its own risk factor. Simultaneously: Dave Dugan hired from Meta as VP of Global Ad Solutions, ChatGPT ads live via Criteo at $50K–$100K entry packages, and Fidji Simo's memo pulling ChatGPT, Codex, and Atlas into one desktop app to fight Claude Code.

No healthy company competes on capital structure. A 17.5% floor is a senior claim that sits ahead of your common in a downside scenario, and it exists because Anthropic is raising into the same window with a cleaner story and Meta running its internal agent stack on Claude, not Llama. If you hold OpenAI secondary, model the waterfall under bear-case ad revenue (say, <10% of the $17B consumer target) with the PE floor active. If you're on the buy side for late-stage AI, mark every comparable's cost of capital up accordingly this week.

The agent stack has no security floor

While the platform race gets repriced, the substrate the winners are building on is unfinished. Three concrete gaps landed at once.

MCP has zero cryptographic integrity between approval and execution. No versioning, no content hashing, no snapshot. A malicious server presents "read my calendar," gets consent, rewrites the tool to "exfiltrate email," and the agent invokes the new definition. Neither Datadog nor LangSmith detects it — they log what was called, not whether it matched what was authorized. The fix is a weekend of work: SHA-256 the full tool definition at approval time, verify pre-execution, log the hash chain. Nobody has shipped this. If your agents touch regulated data, this is a HIPAA and EU AI Act Article 12 problem before it's a security problem.

AWS Bedrock has eight validated privilege-escalation paths from a single over-permissioned IAM identity — log redirection to attacker S3, bedrock:UpdateAgent hijack, Lambda layer injection, bedrock:UpdateGuardrail stripping, prompt template poisoning, and three more. All through the control plane. Invisible to application monitoring. This is an IAM audit, not an architecture project. Enumerate every principal with bedrock:* or any of the eight specific actions and scope to resources. Hours, not sprints.

An active OAuth device-code campaign is minting 90-day M365 tokens past MFA. AI-generated lures with QR codes, phishing infra hosted on Railway (clean reputation), and the device-code flow — designed for smart TVs, enabled by default in most Entra ID tenants — grants a token that no MFA prompt gates and no failed-login alert catches. Huntress pushed emergency conditional access to tens of thousands of tenants. If yours isn't one of them, block device code flow in conditional access today and query sign-in logs for deviceCode grants over the last 90 days. This is the single highest-ROI defensive change you can make this week.

Underneath all three: an autonomous bot the industry has started calling hackerbot-claw force-pushed credential-stealing code to 76 of 77 Trivy version tags, hit Microsoft, DataDog, and CNCF, and survived one rotation because the rotation wasn't atomic. Langflow's CVE-2026-33017 was weaponized in 20 hours from advisory. Your patch window is now measured in hours; your average patch cycle is 127 days. That gap is the actual problem.

What to do this week

One action, three checks. The action: block OAuth device-code flow in Entra ID conditional access today, and pin every GitHub Action in your CI to a commit SHA, not a tag. That closes two of the three active exploitation paths in an afternoon.

The checks, in order. First, pull the number that matters for your business — your equivalent of 3.3%. What percent of your existing users have adopted the AI feature you shipped this year? If you don't know, you're flying blind on the most important adoption question in your category. Second, if you're operating on MCP, hash your tool definitions at approval and verify at execution before your next production deploy. Third, if you're on Bedrock, audit bedrock:UpdateAgent, PutModelInvocationLoggingConfiguration, UpdateGuardrail, and Lambda layer attach permissions and scope every one to specific resources.

Everything else this week — the ad pivot, the PE terms, the Meta rollup, the LFM2 architecture search rejecting every SSM variant for edge — is context. The 3.3% number is the one that changes what you're allowed to assume.