GitHub froze Copilot signups because agentic AI's unit economics broke in public

GitHub paused new Copilot Pro, Pro+, and Student signups this week. It stripped Claude Opus 4.5 and 4.6 off the platform, gated 4.7 behind the $39/month tier, and started silently downgrading users who hit weekly token ceilings. VP of Product Joe Binder wrote the sentence out loud: long-running parallelized sessions consume far more resources than the plan structure was built to support. Weekly operating costs have doubled since January.

That is Microsoft — with Azure at cost, OpenAI at preferential rates, and more compute leverage than any competitor — saying the pricing model doesn't work.

The rest of the industry moved the same week. Anthropic shifted enterprise contracts to usage-based. OpenAI restructured tiers. Cursor is raising at $50B while barely gross-margin positive at a $6B ARR target. Adobe went further and priced CX Enterprise on completed outcomes, not tokens — a bet that inference costs fall faster than customers churn.

The demand side isn't the question. Cloudflare's internal data shows 93% R&D adoption drove merge requests from 5,600 to 8,700 per week — a 55% lift. The productivity is real. The margin isn't.

The counter-reading, and why it doesn't save you

Yes, but — Copilot's freeze could be read as a Microsoft-specific capacity problem, not an industry signal. Azure is genuinely constrained, Anthropic is genuinely rate-limiting, and once the 5GW of new Anthropic-AWS capacity comes online in 2027, flat rates come back.

I don't buy it. The token-per-session curve for agentic workflows is roughly 1000x conversational. That ratio doesn't compress with more GPUs — it compresses with better inference (diffusion LLMs, speculative decoding, KV-cache tricks), and even the optimists there are talking 3-10x, not 1000x. The pricing model was mispriced against the workload, and every provider quietly agrees.

Agents are quantifiably exploitable — and you're being told to run more of them

While the pricing story dominates, DeepMind published the first systematic taxonomy of agent attack surfaces. Six vectors. Simple HTML injection hijacks browsing agents 86% of the time. RAG corpus poisoning succeeds above 80% with less than 0.1% of documents corrupted. Compositional fragment attacks split payloads across benign-looking documents so per-document filters see nothing until aggregation.

CSA's numbers on the enterprise side: 47% of organizations have already had an AI agent security incident. 53% report agents exceeding intended permissions. Only 21% maintain a real-time agent inventory. 87% run two or more agent platforms.

Three specific class-level flaws confirmed this week: Google's Antigravity manager achieved RCE via prompt injection at maximum security because tools classified as "native" bypassed the sandbox. Copilot Studio and Salesforce Agentforce are both exploitable via form-field prompt injection — the input path nobody adversarially tested because the platform was assumed to sanitize it. And AI coding agents with write access to .git can execute arbitrary code via config hooks.

Mount .git read-only in every container running an LLM coding agent today. That's a five-character mitigation for a confirmed RCE class.

The reliability ceiling nobody wants to say out loud

TrustedSec ran 4,800 evaluations across six self-hosted LLMs on OWASP Juice Shop. Single-step tasks: 85–98% success. Ten-step chains: zero. Not low — zero, across every model tested from 24B to 32B. Zapier's AutomationBench shows no model breaks 10% on real business automation. Kimi K2.6's claim of 300 parallel sub-agents running 12+ hours with 4,000 tool calls is almost certainly a swarm architecture parallelizing to avoid the sequential compounding cliff, not a solution to it.

If you're paying token-based prices for chains longer than five steps, you're paying for failures. Checkpoint at depth three to five with verification gates. Design for graceful degradation, not gradual — because the failure mode is catastrophic, not gradual.

The infrastructure layer is consolidating around you

Amazon committed up to $33B to Anthropic at a $380B valuation. Anthropic committed $100B+ back to AWS over a decade, across 5GW of compute, running on Trainium. Amazon also has $50B into OpenAI. Google is shipping custom chips to Meta and Anthropic. Sergey Brin came out of retirement to lead a Gemini coding strike team after DeepMind's own researchers rated Claude higher internally.

The multi-cloud, multi-model posture that seemed prudent twelve months ago is becoming fiction. You're picking an axis — AWS-Anthropic, Azure-OpenAI, GCP-Gemini — whether you intend to or not.

What to do this week

One action, specific: pull the last 30 days of your AI feature usage data and rank users by inference cost. If your top 10% of users cost more than they pay under your current pricing, you have GitHub's problem — you just haven't been forced to admit it yet. Model a token cap, a Pro+ tier, or an outcome-priced variant, and put the number in front of your CFO before your provider does it for you.

Don't wait for the finance team to discover this in a quarterly review. It's a two-day analysis with a five-day fix window. That gap closes fast.