Microsoft killed Copilot everywhere it wasn't earning inference cost back

The verdict from the largest AI distribution on earth

Microsoft killed Copilot in Gaming, Photos, Widgets, and Notepad this week, consolidated 81 product surfaces under a single EVP, and quoted its own users calling the features "functionally useless." On the same earnings call it disclosed that 365 Copilot — the paid, workflow-bound version — grew paying users 33% quarter over quarter, and that inference costs are dragging margins across the rest.

That is the most instructive AI signal of the quarter, and it's not close.

Microsoft has preferential OpenAI pricing, unlimited capital, and 400M Office seats to amortize compute across. It still concluded that spraying a chat button across every surface loses money. Bessemer's public number puts AI gross margins at 50-60% against 80-90% for traditional SaaS, and the fast-growth cohort at 25%. Reasoning models push per-query compute up roughly 10x even as per-token costs fall. OpenAI's disclosed 1000x cost reduction over fourteen months got eaten by its own model advances. The margin math doesn't converge on SaaS margins by waiting.

Yes, but — a fair counter is that Microsoft's cull is a governance failure, not a category verdict. Eighty-one uncoordinated product teams shipping their own chatbots would fail under any economics. That's true, and it's why the second half of the story matters: the survivors weren't distinguished by better prompts. They automated a task the user already hated (meeting notes, email drafts) and produced output good enough to ship without a rewrite. Everything else was inference cost attached to a feature nobody was asking for.

If that decision grid doesn't fit on a whiteboard by end of sprint, the roadmap has a Microsoft problem sitting inside it.

The pricing model is being replaced in public

Anthropic did the opposite thing in the same week. Per-result pricing, not per-token. Claude Code Auto Mode targeting ~90% autonomous completion. Agent SDK GA. A Sonnet-drafts-Opus-reviews advisor pattern claiming frontier quality at roughly a fifth of the cost, contingent on escalation rates staying in the 10-20% band. Reported revenue growth is 80x year over year, and the company leased effectively all of xAI's 300MW Colossus 1 site because Google Cloud and AWS between them cannot supply enough inference capacity.

The operational consequence: any FinOps dashboard keyed on $/1M tokens is already stale. The metric that survives contact with per-result pricing is $/successful-task, and most teams don't have the task-level success instrumentation to compute it. Add a binary task_success label to your telemetry this sprint. Everything downstream — routing decisions, model selection, feature kill decisions — depends on it existing.

Stripe shipped 280+ agent-commerce features. Google and Solana launched pay.sh, metering Gemini and Vertex AI at $0.001–$20 per call. Anchorage shipped regulated Agentic Banking. a16z closed a $2.2B fund with agent commerce named as a target. Four independent actors converged on the same infrastructure in one week, which is usually the point where a category stops being a thesis. Per-seat pricing has a timer on it that just got shorter.

The load underneath is breaking things nobody planned for

GitHub posted 85.51% uptime across the last ninety days — two to three hours of daily degradation — and the CTO named AI agent load, up 3.5x in two years, as the cause. Internal capacity planning went from 10x to 30x in four months. In the same window, GitHub's merge queue silently produced incorrect merge commits on 2,092 PRs, including Modal and Zipline. Code that passed review landed wrong, and CI didn't catch it because CI trusts the merge commit rather than re-deriving it.

Vercel, Linear, Railway, GitLab, and Sentry are absorbing the same agent-driven demand curve without comparable degradation. That's architectural alpha showing up as reliability, and it's the first credible code-hosting displacement window in fifteen years. If you use squash-merge with multi-PR groups on GitHub around late April, diff the landed tree against the reviewed diff today. Wrong bytes in main are the failure mode you can't route around.

The security floor moved the same week

Apache httpd CVE-2026-23918 shipped with a working x86_64 RCE PoC — three curl commands against the default Debian package and the official Docker image. mod_http2 is enabled by default. Traefik shipped two CVSS 10.0 auth bypasses on the same day, both pre-auth, both on the Kubernetes ingress path. Drift's OAuth compromise cascaded to 700+ tenants because integration tokens sit behind authentication and don't re-challenge on MFA. AWS classified the Bedrock AgentCore S3 command-and-control channel as intended behavior — no CVE, no server-side fix. And PocketOS lost its production database and its backups in one Cursor session, because the agent held one credential scoped to both.

Offense costs $30-$150 per codebase now, on open-weight models, at 95% success rates in under six minutes to domain dominance. Defenders average 55 days to remediation against 135 new CVEs per day. That arithmetic doesn't close with human-speed processes, and it's not a model-access problem — restricted frontier models are being outperformed on cybersecurity tasks by broadly available ones. Any security strategy priced on attacker capability being gated by model access is defending last quarter's perimeter.

What to do this week

One thing, specific enough to finish. Pick your five highest-volume AI features and, for each one, write two numbers next to it: cost per invocation, and thirty-day retention of users who touched it. Kill or pause anything failing both. That audit takes an afternoon with the data you already have, and it's the only exercise on offer that lands you on the correct side of Microsoft's cull rather than the wrong side of it. While engineering runs prompt caching and vLLM V1 migration in parallel — 20-30 margin points recoverable in two weeks of infra work, plus correcting the four silent RL-biasing bugs in V0 — you'll be building the $/successful-task instrumentation that survives the next pricing model. Patch httpd to 2.4.67 and Traefik today. Rotate every LLM provider key ever stored in Braintrust. Those last two are today, not this sprint.