The Trust Tax on Cheap Intelligence

The AI industry’s preferred narrative is that intelligence is becoming cheaper, faster and more mobile. This week, the story is more precisely that capability is escaping the places where anyone thought to put a guardrail: into office documents, kernel review queues, production inference stacks and, now, robots with knees.

OpenAI has cut GPT-5.6 Luna to $0.20 per million input tokens and $1.20 per million output tokens, while offering a faster Sol processing tier at double the standard price. Its case is that better models, inference systems and context management have pushed the price-performance frontier outward. That may well be true; the company’s own numbers and benchmarks are, naturally, arranged in the most flattering possible light. Still, the engineering direction is real: intelligence is becoming a cheaper component in systems that already have permissions, APIs and deadlines. OpenAI’s announcement is less a pricing update than another reduction in the cost of doing things at scale before fully deciding whether they ought to be done.

The missing economic variable is not tokens. It is verification. A model can draft a report, review a patch, plan a robot task or optimize serving kernels at falling marginal cost. But the cost of establishing that its output is correct, safe, appropriately authorized and untainted by hostile context has not fallen on the same curve. In some settings, as Microsoft’s Word problem illustrates, it has become nastier: the assistant may now participate in propagating the thing that must be verified. The cross-document Copilot attack is what happens when “the context window” quietly becomes an attack surface with a productivity-suite logo.

The most consequential detail in the Copilot-for-Word disclosure is not that hidden instructions can induce a bad edit. Every security team has met the cursed spreadsheet and its cousins. It is that Copilot can place the malicious prompt into the downstream document—often concealed in white text—turning the output into another carrier. The original attacker-controlled file need not remain attached for the workflow to keep spreading the instruction. Enklypesalt’s account describes a two-stage, self-propagating cross-document AI worm disclosed to Microsoft over 144 days.

This is a particularly elegant failure of enterprise AI’s central premise: that the system can ingest the organization’s accumulated prose, search OneDrive, consult shared files and deliver useful synthesis. That convenience is not adjacent to the vulnerability; it is the delivery mechanism. When an assistant must interpret untrusted material as both evidence and possible instruction, a document is no longer merely a document. It is an input channel with formatting options.

Microsoft reportedly deployed mitigations, including changes to model behavior, but the author’s larger point is architectural. Patching a particular phrase or prompt pattern does not resolve the basic confusion of data, instruction and authority. CTOs should read this as a provenance problem before treating it as a prompt-injection problem: which content entered the context, who supplied it, what permissions did it inherit, and what transformations did the system make? “AI-assisted” will not be an adequate audit trail when the assistant has become a highly literate photocopier for hostile intent.

Meanwhile, the open-source world is conducting a familiar argument under new branding. Since September 2025, Linux has recorded just over 1,200 commits tagged as AI-assisted, according to Drew DeVault’s survey. The more immediate controversy is Sashiko, a patch-review tool largely dependent on Google Gemini. Its arrival raises a deceptively mundane question: if a bot emits a review, who is expected to read, assess and answer it—and how much review-shaped exhaust can a maintainer absorb before the queue becomes a landfill?

The debate is often staged as politics versus technical merit, as if infrastructure had somehow been built in a vacuum-sealed chamber. But Linux governance, licensing, contributor time, hardware access and the practical difficulty of forking a project at kernel scale are already power arrangements. The useful question is narrower and more operational: does model-generated review improve defect detection enough to justify its false positives, its energy and hardware demands, and the obligation it creates for human maintainers? A review comment is cheap to generate; taking responsibility for its consequences remains artisanal.

This is where the sensible, almost unfashionable advice from KDnuggets’ summary of Harvard Business School Online guidance earns its keep. Begin with the decision to improve, inspect the data and its provenance, validate against reality, and keep human judgment in the loop. Substitute “patch acceptance” for “business decision” and the lesson travels perfectly. LLMs can be useful assistants in code authoring and review. They are not a reason to automate the social contract that makes an upstream project trustworthy. Accuracy metrics are lovely. A maintainer who can explain why a change belongs is lovelier.

Google DeepMind’s Gemini Robotics 2 announcement supplies the physical counterpart to all this software-side ambition. The release combines a vision-language-action control model, an embodied-reasoning model for multi-step tasks and multi-robot coordination, and a smaller on-device model intended to adapt quickly across robot bodies. The demonstrations target full humanoids and multi-arm systems: walking, crouching, manipulating objects and coordinating work. In other words, the context window has acquired elbows.

There is real technical substance here. On-device operation and adaptation with hours of data and typically fewer than 200 examples point toward a less brittle path from one embodiment to another. Longer-horizon planning and explicit human-proximity safety tooling also address problems that cannot be solved by making a chatbot sound more certain. A robot that has to move through a real workplace cannot quietly hand-wave the contact dynamics, the latency budget or the existence of other people.

Yet physical intelligence makes the trust bill impossible to ignore. An erroneous sentence in a Word document can be copied onward; an erroneous action near a human can be immediate. DeepMind’s safety benchmark and proximity awareness are welcome, but benchmarks measure a slice of behavior, not institutional readiness. The durable pattern across this week’s stories is simple: cheaper inference will make delegation tempting everywhere. The winning systems will not be those that merely reason for minutes or generate hundreds of decisions. They will be those that can show, after the fact and preferably before the incident report, what they were allowed to believe, what they were allowed to do, and why.