The Context Window Is the Attack Surface

The industry’s preferred story is that intelligence is becoming abundant: faster inference, larger models, cheaper tokens, agents everywhere. The less cinematic story is that judgment—about data provenance, permissions, evaluation and consequences—remains painfully scarce. That is the actual constraint, and no amount of launch-thread confetti has yet compiled it away.

DeepSeek’s new V4.1-Flash is an unusually crisp illustration of the new economics. The company says its 552B-parameter MoE model activates 8B input parameters and 16B output parameters, requires a quarter of the prior generation’s HBM KV-cache capacity and an eighth of its SSD storage, and will pass efficiency gains through in API pricing. It has also retired prior Flash endpoints, temporarily routing their names to the new model. This is what progress looks like in production: architecture, memory pressure, migration behavior, and a bill that might finally stop resembling a small aerospace programme.

But cheaper cognition does not make an organization more coherent. It merely lets the organization make more decisions against its own undocumented, inconsistently permissioned substrate at a more competitive unit price. The real question for CTOs is no longer whether a model can reason over your business. It is whether your business has left enough legible evidence for it to reason over anything without improvising a corporate mythology.

Mistral’s €3 billion funding round—led by Samsung and valuing the French lab above €20 billion—puts a useful number on the cost of competing in the supposedly democratized model era. The capital is earmarked for training compute and international expansion. Open models may broaden access to capability; they do not repeal the material fact that capability is manufactured in data centres full of very expensive silicon.

Mistral is not selling one romantic notion of open source, either. It has managed cloud models, tools for synthetic-data generation and training workflows, an agent-development environment with repositories, system prompts, guardrails, retries, registries and version control, plus an on-premises code-and-office-work agent. It reports more than 125 enterprise clients. In other words, the enterprise offer is becoming less “here is a model, enjoy” and more “here is a model surrounded by the administrative state it requires.” Sensible, if less conducive to keynote transcendence.

That product sprawl connects directly to DeepSeek’s efficiency claims. Lower serving costs encourage more deployment; more deployment creates more integrations; more integrations make context, identity and governance the actual product. A cheap token is not a strategy. It is an invitation to discover whether your permissions model was designed by adults or accumulated like sediment in a shared drive.

The darker version of agentic efficiency arrived in Google Threat Intelligence Group’s reported account of a financially motivated actor that used an AI coding chatbot, a prompt and preconfigured instructions to run credential harvesting in under six hours. According to The Hacker News’ report, the campaign compromised thousands of third-party credentials while autonomously handling scanning, troubleshooting and IP-rotation logic. The victim and actor are unnamed, and the account rests on Google’s assessment, but the operational pattern is the important part.

Google described the instructions as operational playbooks: “Using preconfigured markdown instruction sets as operational playbooks, the threat actor conducted automated scanning and credential harvesting, compromising thousands of third-party credentials.” This is not the machine spontaneously discovering cybercrime in a cloud of existential fog. It is more prosaic and more useful to defenders: a workflow was decomposed, tool access was arranged, instructions were made durable, and execution became cheaper to supervise.

The report also describes attacks on proprietary AI models and theft of API credentials, source code, prompts and related AI research; it notes that open-weight models can be deployed locally without provider monitoring, whereas API-gated services permit providers to watch for misuse. That is not an argument that one deployment model is morally purified and the other is Mordor. It is a reminder that deployment choices redistribute observability. If agents get browser access, repository access and production credentials, your threat model must stop treating prompts as harmless prose. They are increasingly configuration files with literary aspirations.

The enterprise version of this problem is less dramatic than credential theft and often more common: an agent meets data whose ownership, meaning and freshness are unclear, then confidently does its best. Zac Choi of Big Context & Company makes that case in an Entrepreneur profile, arguing that language models are probabilistic while core data work is deterministic. The profile is promotional and supplies no independent customer outcomes, so treat the company’s remedy as a pitch. Treat the diagnosis as familiar production reality.

Choi’s concise formulation is still hard to improve: “garbage in, garbage out.” With retrieval, connectors and agents, however, the garbage can now query Salesforce, edit a spreadsheet and draft the explanation for why it did so. The failure mode is not merely a bad answer. It is a plausible operation conducted across a messy data estate, where every disconnected source system has become an uninvited co-author of the result.

That is why Marc Schmitt’s argument in Nature matters beyond universities. He contends that the danger is passive use—treating AI as a source of finished answers—rather than AI itself, and argues for using systems as intellectual sparring partners. His essay is opinion, not a demonstrated control framework, but the habit travels well. Engineers should ask models to expose assumptions, name missing evidence and challenge a proposed action; organizations should preserve the transcript and decide who owns the final call. The machine may redistribute intellectual firepower, as Schmitt writes. It does not redistribute accountability. The context window is getting cheaper. The responsibility window remains stubbornly human.