The Compute Landlord Pivot Meets Autonomous Ransomware in One Week

Two stories broke on the same day and they belong in the same piece, because they describe the same shift from different angles: the cost of AI infrastructure is being renegotiated in public, and the cost of attacking it just collapsed to near zero.

Start with the money. Nvidia is now taking equity stakes and cloud revenue share from AI companies in exchange for GPU access, and raised $20B in debt in the same breath. That is not a hardware vendor. That is a platform landlord funding its own demand while charging rent on the outcome. In the same week, its next-gen Kyber rack slipped to 2028 — a PCB manufacturing failure, and cloud customers rejected the two-rack workaround as too expensive to operate. Over 95% of Grace-Blackwell GPUs shipped in the last 18 months remain undeployed.

Against that: AMD's MI355X posted 2,626 tok/s/node on GLM-5.2 with a claimed 2x cost-efficiency over comparable Nvidia setups. Anthropic is in custom-silicon talks with Samsung. OpenAI claims it halved inference costs, mechanism undisclosed. Three independent token-reduction efforts landed the same week — Alibaba at 99.87%, Condense at 72%, pxpipe at 70%. A 35B model reportedly matches trillion-parameter models on long-horizon tasks via trajectory-level supervision. Treat every one of those numbers as a vendor claim until you benchmark it on your traffic. The direction is what matters. Supply is arriving. Demand-per-task is dropping. The scarcity premium built into your 2027 capacity plan is on borrowed time.

Yes, but — Foxconn just posted a $79B AI-server quarter, up 40%. Demand is real and growing. The counter still loses, because the shape of late-cycle infrastructure is exactly this: revenue expanding while pricing power compresses underneath. A monopolist who starts taking equity instead of just selling hardware is telling you the customers got big enough to build around them.

The kill chain got cheap

While the compute economics were repricing, Sysdig documented JadePuffer — the first end-to-end autonomous AI ransomware operation. The agent exploited CVE-2025-3248 in a Langflow server (patched April 2025, 14 months exposed), harvested credentials from MySQL and Alibaba Nacos, moved laterally, encrypted 1,342 records, and demanded Bitcoin. When its first login attempt failed, it diagnosed the error, deleted the broken account, and created a working admin account — in 31 seconds. Six hundred-plus distinct payloads deployed in a single campaign. Zero human at the keyboard for the kill chain itself; a human only provisioned infrastructure and picked the victim.

The entry vector is the part that should keep security leads awake. Langflow is an LLM orchestration tool. ML teams deploy these to prototype agent workflows, grant them broad credentials by design, and route them around normal security review because they are "internal dev tools." IBM disclosed six additional Langflow vulnerabilities including unauthenticated RCE in the same window. Nacos being targeted is the architectural tell — service discovery holds the map of the mesh and the keys to most of it. Compromise Nacos on a flat network and you own the environment.

The defensive gap is not detection technology. It is tempo. If your containment playbook requires a human to assess and approve isolation, you are running at 15-minute triage speed against a 31-second adversary. Automated circuit breakers, fired on lateral-movement signals with human override rather than human approval, are the only architecture that works from here. Signature-based detection is already dead — 600+ polymorphic payloads exhaust IOC feeds before the first alert clears the queue.

Your evals are lying to you at the same time

A sub-story worth its own paragraph because it compounds both of the above: your model-selection pipeline is probably steering you wrong. A 64-generation benchmark across five frontier models found LLM-as-judge rankings nearly inverse to human expert judgment on code and UI tasks. Judges clustered scores toward the middle, missed visual failures, and ranked the human-preferred winner last. Separately, Anthropic's Opus 4.8 and Sonnet 5 are appending extraneous fields to tool calls — a schema regression traced to post-training on Claude Code's forgiving parser. Your production harness validates strictly. Theirs doesn't. Your eval says quality improved. Your parser throws.

Sample size is small and the human rater was unblinded, so treat the inversion as directional. The schema regression is not directional — multiple independent sources confirmed it this week, and it will bite the next time Anthropic rotates a model version behind an API flag.

What to do this week

Three moves, in order of leverage.

First, audit every compute contract for revenue-share or equity-for-access clauses before your next renewal cycle, and commission an AMD MI355X proof-of-concept against your top three inference workloads. You are not switching vendors this quarter. You are gathering the benchmark you need to renegotiate with. The Kyber delay gives you 12–18 months where Nvidia cannot offer a unified next-gen rack. That is your window.

Second, inventory every LLM orchestration deployment across the org — Langflow, LangChain, CrewAI, custom agent harnesses, including the ones your ML team stood up without a ticket. Get them behind a WAF, patch the known CVEs by end of week, and add automated network isolation triggers keyed on lateral-movement indicators. Fire on the signal, escalate to humans in parallel. Not sequentially.

Third, add two metrics to your eval harness: schema compliance rate decoupled from task success, and human-anchored spot-check sampling (70/30 weight against your LLM judge) on any output that ships to users. Both are one-day instrumentation jobs. Both catch a class of production regression your current dashboard is designed not to see.

The compute economics are shifting toward you. The attack economics are shifting against you. The teams that move on both this quarter will not have to explain either one on next year's board slide.