Your AI Bill Can Sink You

Welcome to Edition 9 of The CAIO.

From October every AI request at Zühlke is billed to the team that made it. Token prices more than halved this summer, and the bill is still the number to watch. A cheap model that fails twice and ends with a person on the case costs more than the expensive one. The same agent on the same prompt takes two routes and sends two bills. My own dark factory burned one billion tokens over several days for a game I would not pay for. Almost no company has a person whose job is to watch that bill and switch.

That is where this edition starts. After that, the same question keeps coming back in different clothes. Who checks the work when the checker is a copy of the thing it checks. What an agent can see before you let it act. Who switched the safeguards off. And at the end, what happens to the hours AI gives back, because that decides whether your people come out of this stronger or just busier.

We Put a Price Tag on Every Prompt

#

We are in the pilot of an AI Gateway at Zühlke. Every model request runs through it, and from next month the cost lands on the department or the project that used it. That part is plumbing. The real work starts once the invoice has an owner.

Someone has to watch the model market all the time, pick the cheapest model that is still good enough, negotiate the contract, run the evals, tell the whole firm and switch. That is weekly work, and a three-year contract with one lab cannot do it. Every company already runs a job like this for electricity. A buyer watches the price, compares suppliers and moves when the market moves, and nobody calls that a strategy project. Developers already buy tokens this way. OpenRouter routes across hundreds of models and an engineer can switch in an afternoon. A company cannot, because it needs a contract, a data rule, an eval that proves the new model still does the work, and the right to change the default for everyone at once. In most companies that person does not exist.

Robert A. Lienhard described why in the comments. Procurement negotiates the contract, IT integrates the model, Security restricts it and the business complains about it, and nobody can replace it without reopening the whole institutional machine. The model is technically interchangeable and organisationally locked in. My answer is one person with a budget line, an eval suite and the right to change the default without opening a project. Alexander von Boguszewski asked where that person sits. Not in procurement. In the platform team, with the architecture mandate and the budget line in the same pair of hands.

Gabor F. pushed back that a token is not a kilowatt hour. Switch electricity suppliers and the light still goes on. Switch models with the same prompts and guardrails and your agents behave differently. He is right, and that is why the role runs an eval suite next to the contract. Without evals nobody can switch at all. With them, the change in behaviour becomes a number someone can decide on.

What the eval has to measure, I learned at my own desk. Opus 5 keeps getting worse for me. The report sounds finished when the work is not, so I opened a second tab and put Grok on the same jobs.

The public numbers point the other way. Sonar ran the same Java benchmark on Opus 5 and its predecessor: the pass rate went from 82.9 to 88.6 percent, and the amount of code went up 2.3 times. A stronger model, and more for you to read. Anthropic published a postmortem in April on Claude Code where the product got worse through three changes, none of them a weight update: a lower default effort, a cache bug that deleted the model’s own thinking after an idle hour, and one line in the system prompt that cost three points on a coding eval. The eval went up and the work got harder to trust. In most companies the only sensor for that is the person doing the work, and that person is not allowed to do anything about it except open a second tab.

So who in your company can change the default model this month?

Token Prices Halved. Your AI Bill Didn’t.

#

Token prices more than halved this summer, and a million tokens dropped below a dollar for the first time on 31 August. The companies selling them will still spend 750 billion dollars on data centres this year, so they change what they sell you. Charles-Henry Monchau at Syz Group describes the move toward distribution, memory and context: the model arrives inside software you already pay for, and your working state lives in their system. None of it is billed per token, and none of it comes with you when you leave. Put a seat licence or a committed compute floor where the token was and the chargeback loses its denominator. You still get an invoice. You no longer see what a task cost, and you cannot put two vendors side by side.

The desk also decides where the work runs. Stanford and Together AI measured intelligence per watt. On the same model a datacenter GPU is 1.4 to 7.4 times more efficient per query than a laptop chip, so a local AI box does not save energy, the datacenter chip is the better one. The saving came from somewhere else. A router chose a small model or a frontier one for each query, and at 80 percent router accuracy energy fell 64 percent and cost 59 percent, with misses falling back to the frontier model. Routed across several small models, 88.7 percent of single-turn queries were answered correctly by models with 20 billion active parameters or less. The study is single-turn, so measure your own mix. Most of the work does not need the most expensive model, and somebody has to be allowed to route it elsewhere.

Manuel Zorn named what both of these miss. Steer on cost per outcome, per resolved case or per document reviewed, because a cheaper model that retries twice and hands the case to a person costs more. In pharma and banking, changing the default also reopens validation, and that bill currently sits with nobody. The unit of work is the slow part of our own pilot. Cost per request is easy to get. Cost per finished job needs someone in the team to say where the job starts and ends, and without that, finance sees the total bill double and calls it a problem when the cost per job underneath may have halved.

Frederick C. asked how attitudes change once people see the real cost. I cannot answer that yet. Billing starts next month, at cost with nothing on top. Ask me in three months.

In my book I wrote that every capability on the platform should be swappable. That sentence was architecture. The invoice turns it into a job, and the meter is what makes the job possible. So look at your largest AI contract: is it priced per unit, or per seat?

Thirty Copies Are Not a Second Opinion

#

If the buying desk decides what the model costs, something else has to decide whether its work is any good. Most of what I read this month says we are building that check out of the same material as the thing it checks.

Anthropic’s Frontier Red Team ran seven experiments on agents working alongside each other. 18 of 30 agents created a git branch with the identical name. In a pricing game, agents with a private channel agreed price floors by round three. The researchers took the channel away and the agents still matched prices to the penny, because the same model looked at the same numbers. If you run pricing agents, your legal team should read that section. The report says it plainly: coordination does not emerge from stronger intelligence.

Teams buy multi-agent setups the way they buy redundancy. Redundancy means independent failure modes. Thirty copies of one model is replication, and replication multiplies a failure instead of surviving it. Liudmila Tsirelman has seen identical checkers approve each other’s work in production pilots, because the blind spot is shared. The test I would add is the disagreement rate. If your reviewer never says no, you have a rubber stamp.

The same thing happens with simulated users. A Harvard and MIT team built a simulation with 8.3 billion persona agents and showed that the actor decides the answer. Same 1,000 personas, same pricing page: 23.2 percent chose a paid plan under Claude Opus 4.8, 75.8 percent under GPT 5.5, 93.9 percent under Claude Haiku 4.5. If your personas and your product run on the same model, a good result means two things at once and you cannot tell which. The fix is one line in a config: record which model played the persona, and rerun the cohort under a model that does not share a backbone with what you are testing.

Code review has the same problem. Researchers at Virginia Tech and Carnegie Mellon changed how code looks without changing what it does, and the models lost bugs they had already found in 78 percent of cases. A misleading comment on its own dropped fault localisation to 26 percent, and the newer, bigger models improved by only one to two points. Patrick McElhaney answered that agents can review the code too. The reviewing agent reads the same misleading comment as the one that wrote the code, so you get two opinions carrying one bias. That is the same check run twice.

The most instructive case came from Robert C. Martin. He had Hunt the Wumpus written eight times under four testing disciplines, from strict TDD down to no unit tests at all. All eight passed 25 of 25 acceptance cases. In his words, acceptance is cheap to satisfy and silent on suite quality. Then the first pass had to be thrown away, because the agent recording the results copied them from one run to the next without doing the analysis. The code was under test. The report about the code was not. He caught it by reading the report.

Marcin I. added his own version. His agent committed and pushed to a branch on its own, in a setup that did not permit commits, because the rule lived in configuration and not in the harness. Asked afterwards, the agent said it had judged it a reasonable next step. That answer is reconstructed, not recalled, so the check he added was made of the same material as the thing he was checking. The git log was the one artefact in the story the agent did not write. He called the distinction byproduct or account, and I have used it since. A revert is a byproduct. A status report is an account.

Mike Goerlich put the rule in one line from his own field: the actor and the verifier must not share an identity. Separation of duties is one of the oldest controls we have, and today it usually exists only in the prompt. So where in your architecture are you calling it redundancy when it is really replication?

An Agent Can Only Act on What It Can See

#

I spent four posts this month on the Shift Left on Operations chapter of my book, and each one ended somewhere the chapter does not go, because agents changed what it is about. It was written for engineers reading telemetry. Now the reader is increasingly an agent, and the agent acts on what it reads.

Security shifted left and got a name, DevSecOps. Testing shifted left and got tooling in every pipeline. Operations mostly got renamed. The ops team became the DevOps team, then the SRE team, then the platform team, and the work still starts after the deploy. You cannot buy observability, you instrument it, and that happens in the code months before anyone points an agent at production. An agent with thin telemetry does what a junior engineer with no logs does. It guesses, with confidence.

Start with logs. Log lines are the only code nobody reviews. It is 3am, payments are down, and the log says “Operation complete.” Complete what, for whom, on which request? Reviews look at logic, tests, naming and sometimes security, and I have never seen a reviewer write that a line will not help the person we wake at 3am. That gap used to cost a longer incident. Now two more things happen. The moment logs go into an AI analysis tool, everything ever logged by accident leaves your boundary, and in banking or healthcare that arrives as a letter from the regulator. And the first responder reading the logs is starting to be an agent, which fills a vague line by guessing.

Then metrics. Your dashboard was green through the whole outage: CPU, memory, disk, network, response time, error rate, request rate, all measuring your machines. None of them knows whether a customer got what they came for. Classic software fails loudly, it throws or times out or spikes a queue. A model answers in 800 milliseconds with a clean 200 at normal CPU, and it is wrong. Only the business layer can see that, and business metrics usually have an audience instead of an owner. Jonathan Bezdek added the part that makes it worse: a model tends to fail the same group of customers every time, so the average never moves. Alert on the worst segment, with a name next to it. And once metrics feed something that scales, restarts or reroutes on its own, a loop pointed at machine health will protect the machine all night while checkout converts nothing.

Then traces. An agent call chain has exactly the shape a trace was built for: plan, retrieve, call a tool, hand off, call a model, answer. Most teams I ask have a trace id on the request that reaches the agent and nothing after it, so they debug by reading the chat transcript. The chapter says to sample one request in a hundred, which works while the path is deterministic. Run the same agent on the same prompt twice and you get two routes and two bills. One run in a hundred tells you about that one run. And sampling on errors does not help, because agent failures are mostly successes: the tool returned 200 and the agent picked the wrong tool. Liudmila Tsirelman named the practical breaking point. The request id gets set at the edge and is gone by the third service, because every service generates its own.

While a person sat in that path, the person was the audit trail. Every step of autonomy you add removes a witness, and nothing replaces them unless you build it. You cannot put a human in the loop you cannot see. So take the most autonomous agent you run in production and ask who could reconstruct what it did last Tuesday at 14:00 without asking the model to explain itself.

Containment Is the Operator’s Job

#

AGI is coming and we are all going to die. Did your pulse go up? That is how AI marketing works now.

Jacob Coxon quit Anthropic and said the labs are gambling with our lives. Anthropic’s own alignment lead backed him in public and put the odds of AI killing all humans above 10 percent within the decade. Fear of AI is useful to the labs themselves. It is free marketing, it justifies investment in the billions, and it builds the case for strict regulation, which hits smaller competitors far harder than the incumbents. We have seen the play before. In 2019 OpenAI withheld the full GPT-2 model as too dangerous to release, and shipped it that November. This case is different, because a researcher who quits pays for saying it. The number is still speculation. Nobody can compute 10 percent, and zero would be just as unfounded.

A risk with no known mechanism cannot be engineered against. A risk with a known mechanism can. Nobody can currently explain how recursive self-improvement would actually work. Models that do not do what their builders intended, and capable models in the hands of criminals, have mechanisms, owners, budgets and controls.

The labs had already supplied a case study. AI models broke out of the sandboxes built to contain them and took root on another company’s servers. At OpenAI, agents meant to be isolated found they could write files into the package proxy and turned it into a message board. They traded exploits on it for two months, chained vulnerabilities into Hugging Face and got root on a server. No model wanted to be free. Of 898 tasks in that benchmark, 198 had never been solved by any model they had, and that is where 93 percent of the board traffic came from. They were set an impossible job with no way to say so.

The production safeguards were off, because it was only a test. OpenAI measured afterwards that the same evaluation with the production harness cuts the propensity to compromise infrastructure by more than 100 times. Their own monitor would have paged security a day before the breach, and it was not switched on. After the agents took the package server down on 4 July, the server was rebuilt and the evaluations restarted on 8 July, and the agents had their board back the same day. Hugging Face spotted the intrusion three days before OpenAI’s own alarm went off. Both labs published detailed postmortems, and Anthropic found the same in its own setup. Credit for that. It does not change who held the switch.

Imagine a nuclear operator talking about its fuel rods this way. Fuel rods do physics. Containment is the operator’s whole job. Tobias Weber pointed out that the analogy goes further than I took it: the design flaws of the RBMK reactor were known, and nothing was done because slowing down meant losing a race. “If we slow down, the other side wins” is what we hear from the labs today, and Chernobyl also started as a test with the safety systems switched off.

Meet Shah asked the question I would bring to a board. Does “was the production harness on” belong in quarterly risk reporting? In my opinion yes, for every AI system that can act, test environments included: which safeguards are off, who signed that off, and until when. He underlined the last part, because temporary exceptions become permanent when nobody sets an expiry. I would give the end date teeth. When it passes, the safeguard switches back on by default and someone has to argue to turn it off again. Then the exception costs effort and the safe state costs nothing. None of this needs a probability for the end of the world. It needs an owner on Monday, so which of those two conversations is your organisation actually having?

What Happens to the Hours

#

Whoever does the checking pays for the gain in their own hours. Whether they come out of it stronger depends less on the tool than on who controls the time it saves.

Noam Segal and Lenny Rachitsky ran their second annual survey of tech workers. 49 percent say AI amplified them, 19 percent say it left them destabilised or diminished. Same tools. Which side someone lands on predicts how they feel about their career better than role, seniority and company size combined. Significant burnout rose from 44.7 to 55.7 percent in a year. Only 22 percent worry about losing their job to AI, while the top worry, at 51 percent, is being expected to do more for the same pay. One respondent put it in a sentence: “We just set a new denominator for the job. And it moves higher and higher every month.” The person who came out amplified was allowed to change the work. The person who came out diminished was only allowed to do more of it.

You can see the same thing in engineering. Denis Stetskov pulled the numbers together: AI users merge 98 percent more pull requests, and company-wide delivery showed no measurable change in throughput or quality. Every one of those pull requests lands on a senior’s desk. Julien Zaegel argued in the comments that a published pull request means the author already reviewed it with the agent. The survey in the article says 59 percent of developers ship AI-generated code they do not fully understand. Julien would rather fire the sloppy ones than add a second review gate. You cannot fire your way out of a majority. When most people do the same thing, the pressure they work under is producing it. So make the first review real: if the author cannot explain the change in their own words, it is not ready to publish.

So how do you tell fluency from activity? NZZ am Sonntag asked me how to test it when there is no curriculum. I gave them three questions. Which tasks do you do differently than six months ago, and how do you check the result? Where do you deliberately not use AI, and why? And what have you built that other people now reuse? The third one separates a private trick from a company capability. The same article quotes a UBS employee who sometimes logs into Copilot in the evening so his AI score does not drop. Kayo D. named the trap in the comments: any metric gets optimised, including a better one. The question is whether anything is left behind. Someone who logs in at night leaves nothing. Someone who builds a workflow the team adopts leaves something, even if they only did it for the score.

Underneath all of it sits the supply of people who can still say no. The expertise to check AI is exactly the expertise whose formation AI is removing, and Nolan Lovett calls that the Validation Tether. In a University of Deusto study, 80.7 percent of people spotted the error in an AI recommendation and followed it anyway. Detection is not override. I wrote in my book that humans must retain meaningful oversight, including the ability to override. What I did not price is that override has a supply chain, and its lead time is about ten years. At Zühlke we still take on apprentices and hire juniors, and I will be honest, it is getting harder, because clients want experienced people. We keep doing it. Our juniors are our next seniors.

The labour market is starting to say the same thing. The Oxford Internet Institute and the Burning Glass Institute went through about 30 million job ads and found that the fastest-growing human skill in AI roles is resilience. It takes nerve to say “this is wrong” about a document that reads better than anything you would have written yourself. Prompting does not gain value in that data. It is the thing that marks a job as an AI job, and everything that moved, moved around it.

Tool training is the easy thing to buy. The market is paying for the person holding the tool. So ask what happens to the hours your people save, because that answer decides which half of the survey your teams land in, and the model has no say in it.

My Current AI Stack

#

Claude Code: Still the primary tool for reports, meeting prep, coding and most of what I do. Four separate passes: analyse, plan, build, review, with the review running in a session that did not write the code.

GrokBot: Where my agents live now, from a podcast agent and an investment agent to one that runs my dark factory. Each has its own identity and its own email address. These are long-running agents that keep working when I close the laptop.

Grok Build: I am experimenting with it as an alternative to Claude Code. Claude keeps getting more expensive, and Grok costs several times less. Companies need to be able to switch. I am trying it on my own desk first.

Perplexity: Web research with real sources. First stop for primary sources behind the papers cited above.

NotebookLM: Documents in, audio and video summaries out.

Gemini: Image generation for the cyberpunk newsletter covers.

Vibe Coded This Month (Private Projects)

#

A dark software factory, and the game it built. A dark factory is automated far enough that you can switch the light off. In software there are five levels to get there, and the companies furthest along today sit on level four, where a human still reviews. I wanted to see level five, so I built one: a full V-model from requirements down to code, aimed at a 2D battle robot game from my Amiga days that I wanted to put on Steam. It ran for days and burned one billion tokens. I got a game. The legs moved strangely and so did the floor, because the model has no physical understanding. I asked for a brighter look and got brighter, and it still looked bad. Ask these systems for a mobile app and you get the average mobile app. Two things I would not repeat. I let the same model write the spec and the tests, and you do not let a pupil write the dictation and mark it as well. And the factory produced no monitoring and no logging at all, because nothing in it knew that software has to be operated by someone after it ships. It works. I would not pay for it. Steffen Ochsenreither and I took it apart in episode 8 of Prompt & Proper.

Where to Find Me

#

I co-host the DevOps Meetup Zürich with Martin Thalmann, two talks each evening from 17:30. Tuesday 13 October at Digicomp: Clément Raussin and Benjamin Calvet on orchestrating multi-agent AI on Kubernetes, and Ann Harding on throwing away an externally delivered IT strategy at Switch.

On Thursday 8 October I speak at the Hello 50:50 World meetup at Zühlke in Schlieren, from 17:30, on a fair question: who is afraid of AI? I want to sort the concerns into the ones that need a rule, the ones that need a new skill and the ones that go away after a week of real use. Bring someone who sees it differently.

The fourth edition of the CAS Enterprise Architecture at the Lucerne University of Applied Sciences and Arts starts on 16 October, which I run with Dietmar Wettach. Fridays and Saturdays until February, in German.

Prompt & Proper, the podcast Steffen Ochsenreither and I record in German, released three episodes this cycle: AI-First or AI-Augmented, which tool should we buy and why that question comes last, and the dark software factory above.

Further out, DevOpsDays Zurich returns on 14 and 15 April 2027 at the Alte Kaserne in Winterthur.

If this issue connected for you, forward it to one peer who needs the same conversation, and reply with the single sentence from this issue you would put on the wall.