The wrapper tax just got a number, and it's brutal

A study of 515 high-growth startups landed this week with the cleanest empirical result on AI adoption I've seen in eighteen months. Firms that reorganized production around AI — not bolted it onto existing flows — found 44% more use cases, hit roughly 2x revenue at the top vigintile, and consumed about 40% less capital. The intervention was information about how peers redesigned. Not better models. Not more compute. Just discovery of what's possible when you stop wrapping.

The honest caveat: correlation isn't causation, and founders who redesign workflows also tend to make leaner calls elsewhere. Take a quarter of the reported gain on your numbers and it still pays off. Take half and it dominates every other lever on the roadmap.

Then the market rendered its own verdict. Accenture's free cash flow multiple collapsed from 30x to roughly 6x — about a third of its long-term average. One firm isn't a sector, but a five-fold compression is hard to explain with macro. The read is straightforward: buyers are pricing consulting-led "AI transformation" as commodity, and the reorganization work isn't something a SOW delivers.

Yes, but — Accenture has been written off before, and a single-name multiple isn't a category thesis. Fair. It's the direction that matters. Every dollar going into the $16B Q1 robotics print (4.5x the 2021–2025 run-rate) is a dollar not going to the advice layer.

The same pattern, one stack lower

While the study was circulating, Google shipped native computer-use in Gemini 3.5 Flash. Screenshot loops, coordinate parsers, action mappers, retry logic — roughly 500 lines of orchestration glue for a lot of teams — collapse into a model primitive. Microsoft shipped Copilot Skills, which turns Excel prompts into saved, named, org-shareable workflows. OpenAI put Codex on mobile with device pairing. Qualcomm paid $3.9B for Modular, buying an option on breaking CUDA lock-in at the compiler layer.

Four moves, one theme. Capabilities that were wrappers last quarter are primitives this quarter. Anything whose moat was the scaffolding just lost the moat.

For agent teams, this is a concrete decision, not a vibe. Port 20–50 tasks from your current harness onto native Gemini computer-use. Measure end-state task success, mean steps to completion, p95 latency, and cost per successful task — not tool-call accuracy, which stops being the right metric the moment the model drives the screen itself. If rankings reshuffle (and they will), the native number is the one that matches user experience.

For infra teams, freeze new commitments to Mojo/MAX. A chip vendor doesn't buy a compiler company to keep it neutral — that's the pattern from Intel/Habana, NVIDIA/OctoML, AMD/Nod.ai. Watch the next four quarterly releases for whether AMD and Intel backends keep getting optimization cycles. Meanwhile, run a bake-off between vLLM, TensorRT-LLM, and SGLang on your served traffic. The TCO delta will dominate any compiler-magic upside.

The extraction attack is now documented at industrial scale

Anthropic accused Alibaba of running 25,000 fake accounts to issue 28.8 million queries against Claude. The interesting number isn't 28.8M — it's ~1,150 queries per account, which sits comfortably under any naive rate-limit threshold. Per-key rate limits are useless against this shape. The academic literature puts 1–10M well-chosen queries in the range where a competitive student model is recoverable on narrow slices. This one is well past that.

If you serve a model via API, including internal ones consumed by partner teams, this is now a documented production TTP and not a paper threat. The defensive architecture is not more per-account limits. It's distribution-level: prompt-embedding entropy per account cohort, account-age-to-query-complexity ratio, cross-account clustering on capability space, account-creation temporal distributions. Then layer canary tokens or output watermarking on high-value generative endpoints so you can attribute leaked outputs downstream even when detection failed in real time.

The Anthropic disclosure is effectively a free red-team report. The open question is whether the defense gets instrumented before someone runs the same playbook on your endpoints.

What actually needs to happen this week

One planning move and one engineering move, both concrete.

Pull the prompt and interaction logs for every AI feature you ship. Find the top five most-repeated user queries. Every duplicate is a workflow you should have shipped as a saved, named artifact — the Copilot Skills pattern — instead of asking the user to be a prompt engineer week after week. The repeats are the roadmap. This is the cheapest version of the reorganization the 515-firm study measured, and it's a two-day exercise, not a strategy offsite.

On the security side: if you operate any LLM-serving API, spike a cross-account behavioral detector this sprint. Prompt embedding entropy, account-age-vs-complexity, temporal clustering. Add a synthetic red-team test to model-serving CI — 1,000 accounts × 100,000 queries with adversarial diversity — and require detection within a query-budget threshold. Make extraction resistance a first-class SLO alongside latency and accuracy.

And if the Cisco UCM patch for CVE-2026-20230 isn't verified across every instance in your fleet, stop reading and go do that. Root on UCM is a pivot to the identity plane, exploitation started weeks after the patch dropped, and no amount of AI-native repositioning fixes an unpatched appliance sitting on your voice VLAN.