Hormuz is dark, MDM is a weapon, and your AI stack just grew a new mouth

The Strait of Hormuz is running at 5% of normal traffic. Twenty-four days in, 285 million barrels of production sits shut in at the wellhead — three times the total Russia-Ukraine impact compressed into a quarter of the time. The IEA's SPR release plus every un-sanctioned Iranian and Russian cargo buys roughly 45 days. Kuwait, Bahrain, and Qatar have no alternative export routes. Qatari LNG is offline, and Taiwan's grid runs 15% on it.

The petrochemical cascade is already in the tape: butadiene up 140% in China, toluene up 70%, PET up 45% in Germany. The OECD revised US inflation from 2.8% to 4.2% — 56% above the Fed's own projection. WTI-Brent blew out to $20. And this landed in the same week that gas turbines are backordered through 2032, Meta's 2026 capex guide hit $115-135B, and Aligned Data Centers sold for $40B with $2.6B in investment-grade debt underwritten by pension money. AI infrastructure just became a fixed-income asset class right as its cost curve went vertical.

Yes, but — the forward curve still prices a spring resolution, and geopolitical shocks have a habit of resolving faster than the worst-case models predict. Fine. Price the tail anyway. The asymmetry is one-sided: if it clears in April you unwind hedges cheaply; if it doesn't, your Q2 hardware costs and your Taiwan-dependent roadmap both reprice while you're still in meetings about it.

The AI stack got three new mouths this week

Ten companies shipped agent-facing CLIs in seven days — Stripe, Visa, Ramp, ElevenLabs, Google Workspace, and five others. Stripe's Projects.dev is the one that matters: stripe projects add posthog/analytics creates the account, mints the keys, wires the billing. Patrick Collison cited Karpathy directly — the hard part of agent-native startups was never code generation, it was the DevOps orchestration around it. Stripe just claimed the toll booth. If your developer product doesn't have a CLI an agent can drive, you're invisible to the fastest-forming distribution channel in B2B software.

The surprise inside that story: agents work better with CLIs than with MCP servers. Deterministic outputs, standard auth, subprocess semantics engineers already understand. The MCP-first thesis for provisioning is aging badly this quarter.

Meanwhile, Intercom's Fin hit roughly $100M ARR resolving two million customer service issues a week — and beats both GPT-5.4 and Opus 4.5 in its domain. Cursor is shipping Composer 2 checkpoints every five hours off production accept/reject signals. NVIDIA's ProRL Agent nearly doubled Qwen 8B's SWE-Bench score from 9.6% to 18.0% purely by decoupling rollout from optimization. Not a new reward function. Not a bigger model. Infrastructure. Which means most published agent benchmarks are measuring pipeline quality, not intelligence.

The uncomfortable version of this: base models are commodity, harness engineering is the moat, and the harness is being open-sourced (Cline Kanban, Anthropic's generator-evaluator pattern) before most companies have shipped their first multi-agent product. And AI gross margins are running at 30% against SaaS's 75% — Salesforce's $800M Agentforce line is margin-neutral, Anthropic's next tier is described internally as "expensive to run," and 18 SaaS earnings calls in a row confirmed the same story. Every revenue multiple in the sector is priced on economics that don't apply.

The security perimeter that broke

MDM went from IT convenience to Tier-0 attack surface in a single week. Iranian actors used compromised Intune access to wipe 200,000+ Stryker devices — surgeries cancelled, hospitals falling back to radios. Luxembourg's government MDM pushed malware to 4,850 phones. Two Ivanti EPMM zero-days (CVE-2026-1281, CVE-2026-1340) are under active exploitation with WithSecure already doing IR. Your MDM admin console has domain-controller blast radius protected by email-tier MFA.

The protocol layer broke too. PolyShell is draining payment data from 57% of unpatched Magento stores by exfiltrating over WebRTC DataChannels on DTLS-encrypted UDP. CSP doesn't apply. WAFs can't see it. HTTP DLP is looking the wrong direction. The patch exists only in a beta released nine days before mass exploitation started.

And the AI toolchain is being poisoned at the documentation layer. Andrew Ng's Context Hub — an MCP server feeding docs to coding agents — merged 58 of 97 PRs with zero content sanitization. A researcher planted fake PyPI packages in Plaid and Stripe docs as proof. No malware. No exploit. Just a merged PR that convinces your agent to recommend the wrong install command. OpenClaw accumulated 104 CVEs in 18 days — 200x LangChain's lifetime rate — because it puts untrusted paths directly into system prompts. LangChain itself disclosed three new CVEs leaking filesystem data and env secrets.

Mistral's open-weight Voxtral clones any voice from five seconds of audio, runs locally on 3GB of RAM at 90ms latency, with no audit trail. Voice-based verification is done. Not degraded — done.

What to do this week

One action, not five. Stand up a two-hour cross-functional session with your CFO, CISO, and head of infrastructure and produce a single artifact: a one-page exposure map naming your top ten dependencies across three columns — physical (Taiwan, petrochemicals, energy-linked cloud rates), platform (MDM admin consoles, MCP doc sources feeding your coding agents, agent-provisioned credentials outside IAM), and margin (AI features on flat pricing, model routing gaps, voice-verified processes). For each row: current state, 45-day scenario, and the one contract or configuration change that changes the answer. If the map takes more than a page you're hiding the trade-offs.

Every item on that page is something a specific human already knows. The exercise is forcing them into the same room before the 45-day clock runs out.