Cheap Tokens, Expensive Boundaries

The AI industry’s favourite graph is still a falling cost curve. OpenAI’s GPT-5.6 announcement supplies the expected refreshments: Luna at $0.20 per million input tokens and $1.20 per million output tokens; Terra at $2 and $12; and a Fast mode for Sol that promises up to 2.5 times the speed at twice the price. Intelligence, apparently, is becoming a utility. The billing system, in a touching display of continuity, remains extremely sentient.

For engineering teams, this is not merely a cheaper autocomplete. Lower per-token costs change which workflows survive contact with finance: longer contexts, multi-step tool use, bulk document processing, and retries that previously looked like an accidental acquisition of a small country. OpenAI also says Sol-assisted production work cut serving cost by 20% and raised token-generation efficiency by more than 15%. Those are vendor claims, not an independently audited efficiency filing, but the strategic direction is unambiguous: model capability is being industrialized into operating margin.

The awkward companion chart is the one nobody puts in the launch post: as capability gets cheap enough to deploy everywhere, unsafe context gets cheap enough to process everywhere too. The central technical problem is no longer simply whether the model can reason. It is whether the surrounding system knows what it is reasoning over, who supplied it, and what it is permitted to do next. At scale, an AI assistant is less like a clever intern than a privileged parser with a corporate credit card.

A coordinated disclosure described in Enklypesalt’s account of a Copilot for Word vulnerability makes that problem unpleasantly literal. Attacker-controlled instructions hidden in a shared document can be consumed by Copilot while it drafts or edits another file. The resulting document may then contain the malicious prompt itself, often concealed in white text, becoming a new carrier for later Copilot sessions. The spreadsheet macro did not die; it enrolled in product management and learned natural language.

The crucial detail is persistence across ordinary collaboration. An original hostile attachment need not remain in the workflow once a downstream document has inherited its instructions. If an assistant reads connected files, searches OneDrive, and contributes to documents that travel through SharePoint and Teams, then context is no longer passive reference material. It is executable influence wearing business casual.

Microsoft reportedly deployed mitigations after a 144-day coordinated disclosure window, but the author’s larger point is architectural: a patch can narrow an exploit without solving the fact that models must interpret untrusted text in order to be useful. CTOs should therefore treat provenance, content isolation, permission-scoped retrieval, and reviewable transformations as system requirements—not governance garnish applied after the agent has wandered through the filing cabinet. The relevant question for every retrieval pipeline is brutally plain: can untrusted content alter either the model’s instructions or the artifacts it produces? If yes, congratulations: your knowledge base may have opinions about financial reporting.

The underlying security research is harsher still. MIT Technology Review’s coverage of an ICML paper on role spoofing reports that models may attend more to the style and substance of text than to formal role labels such as user, assistant, system, or tool. In the researchers’ experiments, text styled as a model’s scratch-pad reasoning could be treated as if it were self-generated, creating a route around safeguards. This is less a bug in a permission check than a warning that the permission check is being interpreted by a probabilistic autocomplete engine.

Red-teaming matters; the article notes that leading models have become harder to prompt-inject. But the researchers’ argument is that training cannot fully cure a role-confusion problem built into the way a continuous text stream is processed. An outside expert’s assessment is appropriately unromantic: “But it’s not clear this will be sufficient for highly sensitive cases.” The reported experiments and broad impossibility claim need the usual methodological scrutiny—the article does not provide full success rates or procedures—but the deployment implication does not wait for metaphysical certainty.

Do not ask a model to be the security boundary for actions whose failure modes are material. Make authority external and explicit: constrained tools, narrow credentials, transaction previews, deterministic policy checks, independent validation of retrieved content, and approvals that are meaningful rather than ceremonial. An agent should be able to draft a wire-transfer request; it should not become the entity deciding that a paragraph in an uploaded PDF has granted it wire-transfer powers. This is not an anti-agent position. It is a refusal to appoint a text predictor as chief of internal controls.

Even when nobody is attacking, general-purpose language models retain a peculiarly expensive weakness: they are asked to do arithmetic by first pretending numbers are prose. Forbes’ examination of tabular foundation models describes models built specifically for rows, columns, mixed data types, anomalies, correlations, and regression or classification. Google Research’s TabFM is presented as one such effort, trained on hundreds of millions of synthetic tabular datasets. The prospective architecture is sensible: let the LLM translate human intent, then hand the table to something that regards 8,500 as a quantity rather than a charming sequence of glyphs.

This is a useful antidote to the single-model imperialism that has infected product roadmaps. A spreadsheet is not a slightly rectangular novel. It has schemas, missing values, type violations, formulas, distributional assumptions, and a longstanding habit of deciding the annual plan shortly before someone notices column G was excluded. The article is rightly cautious: these systems are early, comparative independent benchmarks are thin in the supplied evidence, and they are not pushbuttons. But specialization is not failure. It is what engineering looks like after the demo gods leave the building.

That same distinction becomes physical in Google DeepMind’s Gemini Robotics 2 announcement, which separates vision-language-action control, embodied reasoning, and a compact on-device model. The company says the system can adapt to new robot bodies with hours of data and typically fewer than 200 examples, while coordinating longer, multi-step tasks. Impressive, if substantiated beyond a product announcement—and a reminder that embodied systems need more than eloquent generality. They need local control, defined interfaces, proximity awareness, and safety constraints that still function when latency, physics, and a human elbow disagree with the roadmap.

Cheap models will make it tempting to put an agent behind every document, dashboard, and machine. Resist the urge to confuse ubiquity with architecture. The durable stack is likely plural: language models for interface and synthesis; specialized models for tables and control; conventional software for invariants; and security boundaries that do not require the model to correctly interpret its own badge. The future may indeed contain intelligence too cheap to meter. Trust, regrettably, will remain metered at enterprise rates.