The AI moat moved below the model this week — build accordingly

Meituan open-sourced LongCat-2.0 this week — a 1.6T-parameter MoE, 48B active per token, MIT-licensed, scoring 59.5 on SWE-bench Pro against GPT-5.5's 58.6. Z.ai shipped GLM-5.2 the same week: 744B, 40B active, 1M-token context, MIT weights, trained on Huawei silicon. Wafer benchmarked AMD MI355X serving GLM-5.2 at 2,626 tok/s/node, roughly 2x cheaper per token than Blackwell — via sglang, MXFP4 quantization, and FP8 KV cache. Configuration, not custom kernels.

The forcing function landed the same week. Alibaba banned Claude Code overnight and ordered all Anthropic models off employee machines. Anthropic's Fable 5 sat dark for 19 days behind an export-control firewall after Amazon researchers found a jailbreak that turned it into a vulnerability-discovery engine. Single-vendor cloud LLM is now a documented business-continuity risk with a specific outage number attached.

The SWE-bench delta is sub-one-point and vendor self-reported. Do not put "beats GPT-5.5" in a design doc without re-running on your own harness. What is not noise: an MIT-licensed model sits in the same performance band as a proprietary frontier model, on non-NVIDIA hardware, at half the serving cost. That combination didn't exist 90 days ago.

Yes, but — the strongest counter is that Blackwell scarcity plus enterprise switching costs will keep the current stack sticky for another 18 months, and "benchmark parity" has always been a leaderboard artifact that dissolves on real workloads. Fair. It still doesn't explain why Microsoft, AWS, OpenAI, and Anthropic committed $3.5B to forward-deployed engineering in eight weeks. Four balance sheets pricing the same bet — that the durable margin is in integration, not weights — is not a coincidence.

The stack is being squeezed from both ends

Stanford ran 1M+ queries across 20+ models and eight accelerators. A router that only needs 80% classification accuracy sends 71.3% of ChatGPT-class traffic to local models and cuts cost 59%, compute 62%, energy 64%. Local coverage was 23.2% in 2023. Intelligence-per-watt improved 5.3x in two years. Qwen 3.6 27B runs at 32 tok/s on an M5 MacBook — production-usable for the routine majority.

Read that as the cloud API business being compressed into roughly 11% of queries that genuinely need frontier reasoning. If your COGS scales linearly with LLM API spend, you are subsidizing your vendor's margin on work a mid-tier local model handles. The routing layer is the cheapest infrastructure you can build. It has to be right four times in five.

One caveat the Stanford paper is explicit about: coverage is strong on chat and knowledge tasks, weak on hard technical reasoning. A router keying on prompt length or keyword density will send the hard problems to the wrong tier and produce confidently wrong answers on the queries that matter. Classify on reasoning complexity, not surface features. That is the whole engineering problem.

The security bill for all this is already due

Epoch AI tracked ~1,500 high/critical CVEs published by 21 organizations in June 2026 — 3.5x the previous monthly record, coinciding with Claude Mythos Preview. Anthropic's Project Glasswing has surfaced 10,000+ vulnerabilities. Anthropic itself now says the bottleneck has shifted from discovery to verification and deployment. Meanwhile the Linux Foundation launched Akrites and stated that mean time to exploit is measured in negative days — public exploits precede public patches.

The dual-use problem is that the same agentic tooling flooding the disclosure pipeline is available to whoever is scanning your internet-facing assets. If your patch SLA was calibrated for 400 monthly high/critical CVEs, it is now calibrated for last quarter.

Add four concrete shadow-AI vectors that materialized this week: GLM-5.2's ZCode ships as self-hosted with no vendor telemetry. LongCat-2.0 ran undetected as "Owl Alpha" on OpenRouter for two months before anyone identified its origin — developers were already piping code through an unattributed Chinese model in production. Alibaba's PageAgent injects a full browser-controlling agent plus an MCP server into any page via one script tag. Jamie captures meeting audio with no visible participant. Every one of these produces zero telemetry to a SOC tuned for hosted API egress.

Anthropic, Amazon, Microsoft, and Google are drafting a CVSS-equivalent for jailbreaks. When it ships it becomes a compliance line item within 6-12 months. Programs that stand up the intake workflow now absorb it quietly. Programs that don't will scramble in public.

What to do this week

One action, three sub-tasks, all doable inside a sprint.

Instrument your LLM traffic by reasoning complexity — not by length, not by topic — and log it for two weeks. That gives you the actual percentage of queries a local tier would handle and the concrete dollar ceiling on hybrid-routing savings. While that log builds, publish an approved-model registry and route inference through a gateway that records model provenance, jurisdiction, and license per call. Then hunt endpoints for GLM-5.2, ZCode, LongCat-2.0, and Owl Alpha artifacts, and audit OAuth grants in Google Workspace and M365 for Jamie, PageAgent, and Wispr Flow.

By the end of the two weeks you have three numbers your CFO and your CISO both want: what fraction of your API spend is commodity work, what fraction of your codebase touched a model you cannot name, and how many meeting rooms have an invisible recorder. If any of those numbers surprise you, you already know which problem to fix first.