Iterated Insights

How advancing intelligence could reshape the infrastructure boom

Jared Edward Reser, Ph.D. And GPT 6 Astra. 

October 29, 2026

Abstract

Advances in artificial intelligence may create a gap between demonstrated capability and commercially usable autonomy. The reasoning, programming, and tool-use abilities that make AI agents valuable as digital workers can also enable sophisticated cyber operations. As these capabilities improve, security requirements may delay model development, restrict deployment, increase supervision, or raise operating costs. If infrastructure investment assumes that capability gains will translate rapidly into revenue, such friction could contribute to financial restructuring even while the technology continues to advance. This article develops a conditional account of that interaction using three timelines: the arrival of useful capability, the availability of affordable security, and the time available to earn returns on committed capital. It proposes six observable trajectories, including growing deployment gaps, pressure on margins, differentiated access, changes in business models, security-triggered restructuring, and subsequent commercialization surges. It also examines three counterforces: separating useful intelligence from dangerous capabilities, rapidly reducing software vulnerabilities, and scaling defensive systems alongside stronger agents. The central question is whether the value of safely deployable work grows faster than the cost of securing it. The framework yields competing predictions rather than an inevitable forecast of an AI crash.

The gap between capability and revenue

The emerging market for AI agents rests on an attractive proposition. A system that can understand instructions, navigate software, diagnose problems, and complete substantial assignments could perform economically valuable computer work at scale. If such systems become dependable enough, their market could extend well beyond answering questions or assisting a person who remains responsible for every consequential action. Businesses could purchase completed workflows and delegated labor.

That opportunity also creates a security problem. The agent that understands unfamiliar software may discover how to exploit it. The agent that persists through obstacles may cross an authorization boundary. The agent that can use many interconnected applications may expose a customer to damage if it follows malicious instructions or makes an unauthorized change. The same capability improvements that increase the appeal of delegation can increase the consequences of granting it.

I propose that this coupling could become a bottleneck in AI commercialization. Model capability may advance faster than providers and customers can safely deploy it at an acceptable cost. If capital commitments assume a shorter conversion from capability to revenue, the resulting delay could create financial pressure. A technological breakthrough could therefore coexist with disappointing investment returns, and could contribute to the conditions producing them.

Public disclosures establish that parts of this mechanism are already relevant. On September 1, OpenAI reported delaying aspects of Astra development and release while strengthening safeguards, including temporary pauses in some training activities [1]. It subsequently released GPT-6 Astra on September 3, describing it as its first model at the Critical cybersecurity capability threshold and reporting significant compute costs from monitoring tool-using deployments [2]. Anthropic described Fable 5.1 and Mythos 5.1 as the same underlying model offered with different safeguards and access conditions [3].

These examples support a precise claim about delayed, constrained, and more costly deployment. They do not establish that all frontier intelligence is being withheld from the public or used only internally. Strong general-use models are being released. The unresolved issue is how much useful autonomy can accompany them, for which customers, at what cost, and with what residual risk.

The commercial connection is also explicit in Anthropic’s October 26 registration statement. Its risk disclosures identify safety measures and resulting development or release delays as possible constraints on revenue growth. The filing also describes suspending certain evaluations and reinforcement-learning environments after unauthorized access to external systems during testing [4]. These disclosures identify exposure; they do not quantify how much revenue has already been lost to security restrictions.

Why productive agency and cyber capability can emerge together

Digital work and cyber operations share several underlying abilities. Both can require understanding a complex codebase, inferring relationships among software components, testing hypotheses, interpreting errors, and adapting a plan over many steps. An agent capable of performing these activities without constant assistance may become useful in both legitimate and malicious settings. Anthropic has itself attributed Mythos Preview’s strong cyber abilities to its agentic coding and reasoning capabilities [5].

Their simultaneous improvement is therefore not necessarily a coincidence. Some progress in offensive capability can arise as a consequence of improving general competence. This does not establish that every increase in intelligence must produce a proportional increase in cyber risk. Training choices, available tools, permissions, and defensive environments can alter the relationship. The coupling is a hypothesis about overlapping competencies, not a claim that safe capability separation is impossible.

The threshold for causing serious harm may also differ from the threshold for dependable employment. In some malicious applications, many unsuccessful attempts are tolerable if an occasional success is sufficiently valuable. A business delegating sensitive work needs repeated appropriate behavior, predictable recovery from errors, and respect for authorization boundaries. Scale matters as well: an agent need not exceed every expert’s skill to create substantial risk if it can attempt tasks cheaply and in large numbers.

This suggests that dangerous cyber capability could become commercially consequential before broad employee replacement becomes reliable. The ordering will vary by task and environment. It cannot be inferred solely from a model’s performance on a technical benchmark. METR cautions that task-completion horizons measured against human work time do not directly represent an equivalent period of ordinary professional employment [6]. No particular date for surpassing the average employee is necessary for the present argument. The bottleneck can affect valuable individual workflows well before whole occupations are automated.

There are also two different security problems. Providers must prevent malicious customers from using agents offensively. Legitimate customers must protect their own agents from manipulated inputs, excessive permissions, and unauthorized behavior. A model can be available for sale while customers still decline to grant the access required for extensive delegation. Improving release safeguards alone does not automatically solve enterprise deployment security.

Three timelines that may diverge

The economic interaction can be organized around three timelines. The capability timeline concerns when agents can perform useful work. The security timeline concerns when that work can be delegated with acceptable risk and affordable protection. The financing timeline concerns how long the businesses funding infrastructure and development can wait for sufficient cash flow.

Timeline

Relevant milestone

Observable indicators

Capability

Agents can complete valuable work

Task success, output quality, human time saved

Security

Delegation is safe and economical

Incident rates, permissions, supervision and protection costs

Financing

Cash flow supports commitments

Operating margins, debt service, liquidity and refinancing terms

 

The critical condition arises when capability advances, security remains expensive or incomplete, and financing cannot accommodate the delay. A breakthrough may increase the estimated long-term value of a company while leaving near-term cash generation inadequate. The duration of the mismatch matters more than the mere existence of restrictions.

Neither security nor financing is fixed. More capable AI can help automate defensive work, and investors can revise contracts or supply additional capital. Conversely, a serious incident can tighten deployment rules while lenders become less willing to finance the transition. The three timelines interact, and the framework must allow them to converge as well as diverge.

How a security bottleneck could become a financial problem

Infrastructure investment precedes much of the revenue it is intended to support. Hardware, facilities, power arrangements, and compute contracts create commitments that cannot always be adjusted quickly. The Bank for International Settlements reported on October 27 that a growing share of AI infrastructure expenditure was being financed with long-term debt and complex off-balance-sheet arrangements. It also found that observed spillovers into Treasury and investment-grade bond markets on AI-financing news days had so far been small and short-lived [7]. Sector exposure should therefore be distinguished from an established systemic crisis.

Gartner’s October 14 analysis projected that more than $3.5 trillion of AI infrastructure spending could face impairment by 2030 if current investment plans continued. That estimate depends on assumptions about spending, revenue, and required returns [8]. It indicates a possible mismatch rather than a realized loss, and it does not show that cybersecurity is the cause.

Security could add to such a mismatch through several channels. Delayed releases defer sales. Restricted permissions reduce the range of tasks customers can delegate. Verification and supervision increase the cost of serving those customers. A serious incident may also change procurement decisions or expectations about liability. Each channel can reduce the cash flow available to meet commitments, even if underlying model capability continues to improve.

Financing then amplifies the effect. Interest and other contractual payments continue while revenue is deferred. Equipment may lose economic value as newer hardware arrives. Higher borrowing costs can make refinancing harder. Even without a rise in policy interest rates, lenders can demand a larger premium from borrowers whose revenue has become less predictable. A delay that is modest in the history of a technology can be consequential for a company facing near-term cash obligations.

The consequences would differ across the industry. A diversified company with substantial cash generation can tolerate delays that a heavily indebted specialist cannot. Model developers, cloud providers, infrastructure owners, and application businesses also capture different portions of the value. Productivity gains for users do not guarantee sufficient revenue or margins for every supplier involved in producing them.

Security work itself can sustain demand for compute. Monitoring, defensive agents, and verification require resources. Restrictions on public access also do not prevent revenue from approved enterprise customers or controlled internal uses. High infrastructure utilization could therefore coexist with pressure on application or model-provider margins. A later infrastructure downturn would require an additional transmission mechanism, such as reduced contracts or failed counterparties.

The relevant hypothesis is consequently narrower than a prediction that cybersecurity will inevitably burst an AI bubble. It is that security-related delays and costs could expose financing arrangements that depend on faster monetization. Financial restructuring could involve consolidation, repricing, and changes in ownership while the underlying technology remains valuable.

Six conditional predictions

The following predictions concern the period from late 2026 through October 2028. They describe potentially overlapping developments, not mutually exclusive outcomes with assigned probabilities. Their purpose is to make the proposed mechanism observable.

Capability could outpace usable autonomy

If protection requirements rise faster than deployment methods improve, frontier models should advance on relevant task evaluations while the scope of work customers can delegate grows more slowly. The strongest systems may show the largest discrepancy between demonstrated performance and broadly available permissions.

Evidence would include longer deployment reviews, persistent approval requirements, or restrictions on sensitive workflows despite improved task competence. The prediction weakens if stronger models consistently permit broader delegation with less supervision. Comparisons should follow the same workflows across generations rather than substitute unrelated benchmark gains for commercial performance.

Usage could grow while margins disappoint

If security and verification consume a large share of productivity gains, token consumption and infrastructure utilization could rise without a corresponding improvement in profitability. Customers might pay for more agent activity while providers spend more checking, containing, or correcting it.

The informative measure is the cost and margin of a successfully completed workflow, including human review and security overhead. Falling token prices alone would be insufficient evidence of improving economics. This prediction weakens if protection costs per completed task decline faster than the value produced, allowing margins to expand alongside usage.

Controlled enterprises could receive useful autonomy first

If verified identities, bounded environments, and auditable actions make stronger agents easier to deploy, organizations able to provide those conditions could gain access to useful autonomy earlier. Small businesses and individuals might encounter tighter restrictions even when nominally using a similar model.

The predicted difference concerns permission to delegate, not simply access to a more expensive subscription. Evidence would include enterprise environments supporting consequential autonomous workflows that remain unavailable in general-use settings. This segmentation could sustain substantial revenue and prevent a broad correction. It would diminish if inexpensive security tools made comparable delegation widely accessible.

Providers could sell completed work rather than unrestricted agents

When distributing broad autonomy is difficult, a provider could operate agents within a controlled environment and sell inspected results. Customers might purchase completed software projects, analyses, or business processes while the provider retains responsibility for execution.

This predicts greater use of outcome-based contracts and managed services. It also predicts that some providers will absorb supervision and verification costs that customers would otherwise bear. Internal operation still requires safeguards; control of the environment is an advantage rather than a guarantee. The prediction weakens if broadly available, self-service agents become equally dependable and economical.

Security shocks could precipitate uneven restructuring

A significant incident could cause multiple providers or customers to restrict deployment at the same time. If revenue expectations then deteriorate, firms with limited liquidity and inflexible commitments should be more vulnerable than financially diversified competitors.

The predicted sequence is a documented security shock, a change in deployment expectations, weaker anticipated cash flow, and disproportionate financing pressure among exposed businesses. Asset sales or acquisitions could follow while model capabilities continue improving. A financial decline driven primarily by power shortages, oversupply, or unrelated demand changes would not establish this mechanism. A security event with no material commercial effect would weaken it.

Improved security could release accumulated demand

If useful capabilities are available before they can be deployed affordably, progress in protection could produce a later acceleration in adoption. Reduced supervision costs and broader permissions might make existing capabilities economical without an equally large jump in intelligence.

Evidence would be faster commercial rollout following improvements in deployment security, with little corresponding change in underlying task performance. Infrastructure acquired more cheaply during a restructuring could support this expansion, but a preceding downturn is not required. The prediction weakens if adoption remains slow after security costs and restrictions measurably decline.

Three developments that could prevent a prolonged bottleneck

The forecasts above depend on security progress being insufficient or delayed. Three developments could change that balance. They address different parts of the problem and may reinforce one another.

Separating useful intelligence from dangerous capability

General competence and specialized dangerous knowledge may be partly separable. Researchers at AE Studio, in collaboration with Anthropic, tested Gradient Routed Auxiliary Modules, which confine selected knowledge to removable model components. Their experiments included cybersecurity and found promising preservation of general performance. The work was preliminary, involved models up to 5 billion parameters, and had not been applied to Anthropic production models [9]. It supports investigation of selective capability control without establishing its effectiveness at the frontier.

Pretraining filtering offers another route. The Deep Ignorance study found that filtering biological threat-related material from training data reduced dangerous proxy knowledge while preserving unrelated performance and increasing resistance to adversarial fine-tuning. The models could nevertheless use relevant information supplied in context [10]. These biological results support the general research direction but are not evidence that offensive cyber capability has been eliminated.

The key uncertainty is how much harmful competence can be reconstructed through general reasoning or acquired during deployment. An agent with strong programming skills may discover a vulnerability without memorized hacking instructions. Filtering also requires care because knowledge useful to an attacker can be important for a defender. Selective knowledge control, behavioral safeguards, and permissions may work best together.

Successful separation would allow useful intelligence to grow without a comparable increase in accessible harmful capability. The deployment gap could shrink, safeguards could become less intrusive, and the market advantage of restricted access could diminish. Complete removal of latent cyber ability is unnecessary if dangerous actions can be constrained reliably and at low cost.

Reducing the inherited backlog of vulnerabilities

Rapid remediation could lower the risk of deploying agents into existing software environments. Fixing a flaw in a widely used component can benefit many organizations, and preventing a class of vulnerabilities can be more durable than responding to individual exploits. The relevant prospect is substantial reduction of consequential exposure, rather than literal elimination of every possible weakness.

On October 22, Anthropic and Theorem reported using Claude to establish specified security properties across 123 open-source libraries. The proofs concerned particular executable artifacts and assumptions, including a modeled RISC-V and Linux environment, single-threaded execution, and bounded inputs and memory. They did not establish universal security of those libraries or their deployments [11]. The work nevertheless illustrates how stronger models could make broader verification economically feasible.

Producing a patch is only part of remediation. It must be validated, distributed, and adopted without unacceptable disruption. Anthropic’s October 8 Cyber Mission announcement acknowledged that verifying, prioritizing, and fixing discoveries remained difficult [12]. New code, misconfiguration, compromised credentials, and manipulation of agents also create continuing exposure.

A temporary surge in discoveries could therefore be followed by meaningful risk reduction if remediation and safer software production keep pace. Counting disclosed vulnerabilities alone would be misleading: more discoveries can indicate better inspection rather than greater underlying insecurity. The important measures concern deployed exposure, severity, and successful exploitation. If those improve quickly, a commercialization surge could occur without a financial correction.

Scaling defense alongside capability

Defensive co-scaling means improving protective systems as AI capabilities advance, including using stronger AI to perform defensive work. Agents can help inspect actions, test controls, detect anomalies, and verify proposed changes. Defenders can benefit from privileged knowledge of their systems, authority to modify them, and shared fixes that protect many users.

NVIDIA and CrowdStrike described an automated attack-defense evaluation loop in which simulated attacks informed improved detections, followed by further testing. The results came from a limited, isolated environment modeled on computing infrastructure [13]. They demonstrate a possible mechanism for faster defensive iteration, not a general finding that defense will outpace every attacker.

The economic test concerns protection costs relative to the value of safely completed work. Absolute security spending could rise while consuming a declining share of the productivity gain. A modest increase in monitoring might enable a much larger increase in valuable delegation. Conversely, better detection would provide limited commercial relief if it required constant human intervention or produced disruptive false alarms.

Successful co-scaling yields a competing prediction: successive agent generations will complete more valuable work per dollar while requiring fewer human safety interventions and causing fewer successful unauthorized actions under relevant adversarial testing. That outcome would weaken the expectation of a persistent security-driven margin squeeze. It would indicate that improving intelligence is helping remove its own deployment constraints.

How the competing paths could unfold

These mechanisms allow several trajectories. In a manageable transition, selective capability control and defensive improvements keep the deployment delay short enough for expected revenues to arrive. In an uneven transition, large organizations deploy safely while smaller firms remain constrained, concentrating benefits and encouraging consolidation. In a more disruptive transition, security delays exceed the financial tolerance of exposed businesses, leading to restructuring before safer deployment supports renewed expansion.

Security outcome

Expected commercial effect

Implication for the financing hypothesis

Useful capability becomes easier to separate from harmful use

Broader access with fewer restrictions

Lower risk of a prolonged revenue delay

Remediation rapidly reduces consequential exposure

More existing capability becomes deployable

Earlier adoption acceleration

Defensive co-scaling lowers protection cost per workflow

Better margins alongside growing autonomy

Security-driven margin pressure weakens

Security progress persistently lags capability

Narrower delegation and higher costs

Greater pressure on inflexible commitments

 

A temporary increase followed by a decline in security cost relative to productive value is one possible trajectory. Newly capable agents could initially reveal weaknesses faster than organizations repair them. Automated remediation and better controls could subsequently reduce that burden. The size and duration of the initial increase would determine whether it is a manageable adjustment or a financing problem. This trajectory is a hypothesis to test, not an assumed law of technological development.

Evidence that would distinguish the hypothesis

A useful empirical program would track a stable set of commercially meaningful workflows across model generations. It would record task success, output quality, permissions, human intervention, security incidents, and full delivery costs. Evaluations should include both consistent tests for comparison and updated adversarial challenges, since success against an obsolete attacker would not establish current security.

Financial observations should distinguish model developers from infrastructure owners and compare businesses with different liquidity, contract flexibility, and dependence on external financing. Security-related deployment changes should be dated and linked to revisions in adoption, revenue, or margins. Power constraints, hardware supply, general interest rates, competition, and ordinary product quality are competing explanations that must be considered.

Security-related restrictions also reflect selection: the most capable models may receive the strongest controls. An association between restrictions and high revenue would not show that restrictions help revenue, just as weak sales among restricted products would not establish that safeguards caused the weakness. Within-workflow comparisons and carefully examined deployment changes would be more informative than aggregate correlations alone.

Support would require evidence that security friction materially delays or reduces commercial returns, followed by greater pressure on businesses unable to finance that delay. The hypothesis would weaken if broadly available autonomy expanded, full delivery costs fell, and relevant security outcomes improved as models advanced. A stock-market correction by itself would not validate the proposed mechanism.

Contribution and implications

Parts of this connection already appear in public discussion. A June 19 article by Ana Maria Constantin brought together AI borrowing, security concerns, and model-access restrictions [14]. Company disclosures separately acknowledge commercial risks from safety delays. The contribution developed here is the explicit relationship between shared agentic competencies, the timing of safe delegation, and the financial tolerance of the infrastructure buildout, together with competing predictions that can fail.

The emerging economics of AI depend on the value that can be safely delegated and captured as revenue. Greater intelligence can increase that value, increase the cost of controlling it, or improve the defenses that make deployment possible. Those effects must be evaluated together.

If useful capability grows faster than affordable security, and financing cannot sustain the gap, cybersecurity could contribute to restructuring during a period of continuing technical progress. If safer training, remediation, and defensive co-scaling keep pace, the same advances could support broad commercialization and stronger returns. The decisive question is whether safely deployable productivity grows faster than the cost of securing it.

References

[1] OpenAI. (2026, September 1). Path to Astra: Critical capabilities and frontier safeguards. Source

[2] OpenAI. (2026, September 3). Safety overview: GPT-6 Astra. Source

[3] Anthropic. (2026, September). Introducing Claude Fable 5.1 and Claude Mythos 5.1. Source

[4] Anthropic, PBC. (2026, October 26). Form S-1 registration statement. U.S. Securities and Exchange Commission. See Risk Factors on safety, model releases, and revenue growth. Source

[5] Anthropic. (2026, April 7; updated October 6). Project Glasswing: Securing critical software for the AI era. Source

[6] METR. (2026, September 8, last updated). Task-completion time horizons of frontier AI models. Source

[7] Drehmann, M., & Eren, E. (2026, October 27). Building AI on credit: Structures and spillovers. BIS Bulletin 140. Bank for International Settlements. Source

[8] Gartner. (2026, October 14). Gartner says over $3.5 trillion of AI infrastructure spending could be exposed to impairment by the end of 2030. Source

[9] Roland, E., Cubuktepe, M., Martinez, E., et al. (2026, July 8). Modular pretraining enables access control. AE Studio in collaboration with Anthropic. Alignment Science Blog. Source

[10] O’Brien, K., Casper, S., Anthony, Q., Korbak, T., Kirk, R., Davies, X., Mishra, I., Irving, G., Gal, Y., & Biderman, S. R. (2026). Deep Ignorance: Filtering pretraining data builds tamper-resistant safeguards into open-weight LLMs. International Conference on Learning Representations. Source

[11] Lucas, K., Lynch, A., Tong, L., et al. (2026, October 22). LLMs are making formal software verification feasible at a much larger scale. Anthropic. Source

[12] Anthropic. (2026, October 8). Introducing the Anthropic Cyber Mission. Source

[13] Rodriguez, R., & Hudait, N. (2026, September 1). Building an adaptive agentic cybersecurity system with NVIDIA Nemotron. NVIDIA Technical Blog. Source

[14] Constantin, A. M. (2026, June 19). The AI bubble didn’t pop. It sent the bill. The Next Web. Source