OpenAI's 80% Luna Cut Is Built to Reprice in Two Quarters

Four independent results, one shape

An engineer kicked off a cloud agent, went to lunch, and came back to a branch that actually ran. Not because the model got smarter that morning. Cursor's headline number is what gets quoted everywhere; the mechanism is the part that transfers to another team. Its cloud agents did not get a better model. They got development environments an agent can discover state in, execute against, and verify deterministically. That is unglamorous, model-agnostic engineering. It compounds with every future price cut instead of being invalidated by one.

The same shape shows up three more times. AgentRadio lifted SWE-Atlas QnA from 32.3% to 62.1% using asynchronous messaging across four agents, and beat a stronger single-model baseline doing it. Google's Chrome security pipeline pairs automated triage with a fixing agent, a critic agent, and test-writing agents verifying across every supported platform. It surfaced a sandbox escape that had been reading local files undetected for 13+ years. And decomposing an agentic task into guided steps succeeded 100% of the time against 50% for a single one-shot prompt.

The cost side compounds with the quality side

OpenAI ran the same play internally, moving auto-review in ChatGPT and Codex CLI to the cheap tier for a 10x cost reduction. Worth separating the thing being pitched from the thing being done. The pitch is frontier capability. The work is routing and harness design. Across every one of these results, the gains are coming from everything except the model weights.

Where it stops being free

Two caveats belong in the planning doc intact. Microsoft's Echoverse work found that shallow evaluation environments actively hurt live-site accuracy while deeper ones improved it. So agent evals running in thin mocks may not merely be under-measuring quality. They may be degrading the thing being tuned against. An organization-owned eval suite with deeper task environments comes before a budget cycle spent on a more expensive model tier. The tradeoff is real and worth naming: that suite is months of work nobody demos.

The second caveat is strategic and comes from swyx: if models can be distilled, agent harnesses can be distilled. Orchestration cleverness is not a moat. Proprietary environments and eval data are. Cursor's advantage is replicable by any competent team, including whoever competes with that team.

There is also a downstream constraint most capacity models miss. The mid-2026 consensus on LLM coding productivity is 2x, not 10x, with the weakness localized precisely to reasoning about code structure and documentation. Meanwhile the delivery queue has moved from authoring to review. GitHub shipped stacked pull requests to public preview specifically because AI now generates more change than a human reviews in one sitting, and a single AI code-review vendor claims 2M reviews per week across 6M repositories. That gives the forcing function for this quarter. Generation throughput on one axis, review wait time as a discrete cycle-time stage on the other. Buying more of the first without instrumenting the second funds a longer queue.

The reliability your team has been waiting on a model release to deliver is already available through decomposition, a critic pass, and an environment an agent can verify itself in.

What the payload actually does

An analyst opens a finished report, checks the figures, and forwards it. The numbers are wrong and nothing on the page looks unusual. Håkon Måløy's technique hides JSON instructions in white text at small font size inside a Word document. Copilot ingests them whether a user uploads the file or Copilot finds it in OneDrive and pulls it in as context. The result is not exfiltration. It is rewritten figures inside a finished report, with the same hidden instructions copied into the generated output file, so the payload spreads through ordinary document sharing. Disclosed in March, patched roughly 144 days later. Researcher and vendor agree the class remains viable with adjusted prompts.

The product translation is narrow and cheap. Input filtering is the half every team builds. Almost nobody strips instruction-like content out of generated artifacts, and that omission is what converts one injection into worm-like spread. Output stripping belongs in the definition of done for any feature that reads a customer document and writes a new one.

The verification market moved before the roadmaps did

Pathlock's survey number is the commercial half of the story: 53% of organizations cannot fully verify what their AI agents do across finance, HR, procurement and supply chain, four of the most audit-sensitive process domains in the enterprise. Invert it. Roughly 47% say they can. The market has already split into haves and have-nots on agent auditability, and nobody has definitively solved it with runtime tooling.

Capital is moving on that read. Okta is paying just under $200M for Permiso to monitor employees, service accounts, applications and AI agents after they authenticate, extending visibility into Microsoft Entra ID and Active Directory. The detection evidence is unflattering: of the three organizations reached during frontier-lab evaluation runs, two never detected the activity themselves. Enterprise monitoring stacks are blind to agent-driven activity. That is a demand signal with a price attached. Per-action, per-identity, SIEM-exportable agent logs plus a hard agent-memory reset, packaged as an enterprise tier rather than shipped as telemetry.

Three spec assumptions that no longer hold

• Guardrails catch bad tool calls. Agents chain individually benign steps into a full exploit, so single-action filtering misses it. The requirement is sequence-level trajectory scoring. That is a quarter of architecture work, not a sprint.
• Our integration surface is fine. Researchers disclosed a critical unauthenticated flaw in an exposed MCP bridge chaining code execution, credential theft, AI memory poisoning and persistent compromise. One vulnerability, a complete kill chain. "Do you expose an MCP bridge?" becomes a standing procurement question inside a quarter.
• Revocation works. The OWAReaper implant establishes server-side mailbox permissions that survive credential rotation and full device rebuilds. The same test runs against any product: revoke a credential, then check whether delegated grants, OAuth tokens, service accounts, background agents and agent memory actually lose access. Two-day audit. "Fully, with a documented revocation SLA" is a differentiator no competitor improvises on a call.

There is a dated forcing function. Zenity Labs presents PleaseFix chained with Intent Collision, covering 0-click account takeover, data theft and remote code execution, with a claim that every agentic browser on the market was affected, at Black Hat on 8/6. Expect enterprise buyers to pause or gate agentic rollouts that week. A launch landing in that window needs its containment answer to precede the feature demo.

Prevention is off the menu. What you can still sell is a failure that is scoped, logged and reversible — and almost none of your competitors have that written down.