AI Is Building on Sand

The week’s real story wasn’t any single AI failure or market signal — it was the accumulating evidence that the entire AI stack is being built on foundations nobody has actually stress-tested.

Start with the money. The gap between what hyperscalers are spending on AI infrastructure and what applications are returning in revenue has to close by one of two paths: either application revenue accelerates dramatically, or capex commitments get pulled. Neither path is comfortable. The first requires enterprise adoption at a scale and speed the market is currently pricing in but hasn’t demonstrated. The second is a reckoning nobody wants to say out loud. Both outcomes are live. And this week, the reconciliation began.

Alphabet slid 7% Thursday after raising its 2026 capex forecast alongside Q2 earnings. Amazon, Meta, and Microsoft fell too. FactSet analysts expect Microsoft’s free cash flow to go negative in Q4 for the first time since at least 2001. Amazon’s long-term debt rose 81% to $119 billion between December and March. Incremental annual debt went from 9% of capex in FY24 to 32% by mid-2026. Alphabet priced an $84.75 billion equity raise in June. The bulls have a real counter: Google Cloud’s remaining performance obligations exceeded $460 billion after Q1. That committed future revenue is real. The question is whether it converts fast enough against a capital base approaching $1 trillion. This week’s price action suggests the market is starting to ask that question out loud.

Now layer in what’s happening at the application layer. The piece on Copilot’s prompt-injection vulnerability wasn’t a story about a bug. It was a story about architecture. When the document becomes executable and the assistant becomes the attack surface, the entire enterprise security model — built on perimeter defense and user authentication — is structurally wrong for the threat it’s facing. The researcher is Håkon Måløy, a Norwegian data scientist with a PhD in applied AI and ML, who disclosed Tuesday. Microsoft confirmed the behavior on March 31 and deployed two mitigations: the first blocked the original prompt wording, the second upgraded the underlying model to GPT-5.5. Måløy says the full chain worked with modified instructions on GPT-5.6 the next day, and the attack class still reproduced on July 28. They blocklisted a payload and swapped in a more capable model. The vulnerability class survived both. That’s the architecture problem with evidence attached — capability upgrades don’t patch a trust-boundary flaw. Måløy withheld the specific payload, arguing that with no robust mitigation available, publishing it would be irresponsible. A researcher declining to disclose because there’s no fix is a stronger indictment than anything I can assert. Enterprise buyers, who are currently signing seven-figure Microsoft 365 Copilot contracts, are underpricing that risk in exactly the same way they underpriced cloud misconfiguration risk in the late 2010s. They’ll figure it out after the first major incident.

Then there’s the reasoning problem. A model that constructs a confident, internally coherent chain of thought on the way to a wrong answer isn’t making a random error — it’s manufacturing a liability. The enterprise market has been treating AI hallucinations as a UX problem, something to be papered over with disclaimers and human-in-the-loop checkboxes. Wrong. Hallucination-at-scale in a reasoning model is a systemic risk, the same category as a compliance failure or a data breach. The legal exposure alone should be giving general counsels nightmares. It isn’t yet, which means the pricing is still wrong.

What ties these threads together is a single pattern: every layer of the AI stack has a load-bearing assumption that hasn’t been tested at production scale under adversarial conditions. The economics assume revenue follows spend. The security model assumes the assistant is a tool, not a vector. The reasoning model assumes confident outputs are reliable outputs. Each assumption is reasonable in isolation. Together, they describe a system where the failure modes compound.

The Fed story sits slightly apart — Warsh is among the names most frequently speculated as Powell’s successor, and the 30-year Treasury has been a real-time credibility gauge for what that succession might mean for rate policy — but it rhymes. Markets have a way of pricing the gap between what institutions claim and what they demonstrably deliver. That mechanism is patient. It’s also merciless. Right now it’s doing to the hyperscalers what it will eventually do to AI vendors who oversold reliability: forcing a public reconciliation between the narrative and the numbers.

The next stress test is the Anthropic and OpenAI IPO pipeline. Both carry sky-high private valuations built on the same capex-heavy model that just punished Alphabet. When those prospectuses land, the market will have to decide whether the debt-funded buildout thesis holds through Q3 and beyond — or whether this week was the first page of a longer repricing story.

The question isn’t whether AI works. Most of it does, most of the time. The question is whether “most of the time” is good enough for the contracts being signed right now — and who’s on the hook when it isn’t.