Models are getting cheaper, but the security perimeter remains yours

In Stratechery, Ben Thompson examines Chinese models such as Kimi K3 and concludes that they do not pose an existential threat to American labs.

Intelligence is becoming a commodity, and providers compete on price. The real risk

Thompson sees it in cybersecurity, and U.S. sanctions restrictions reinforce that view.

This leads to a practical conclusion for company leaders:

The solution in an AI project lies in what surrounds the model, while choosing the model itself becomes secondary.

According to Thompson, model providers are moving toward competition based on token costs.

When several of them deliver comparable quality, the winner is the one with the lower price per unit of output.

R&D spending no longer protects the leader. That is good news for customers.

You can change the model, but dependence on a single vendor costs more than it seems.

At KT.Team, we build integrations across multiple providers: Anthropic Claude, OpenAI, Google Gemini, Alibaba Qwen, Meta Llama, and, for the CIS environment, Sber GigaChat and YandexGPT.

Replacing the model in such a project requires a configuration change and takes days, not a quarter of development.

Thompson points to the cyber risk. I will add the mechanics.

The cheaper and more diverse the models, the more areas of the business they are connected to, and each connection expands the attack surface.

An agent with access to CRM, 1C ERP, or a Pimcore product catalog gets the permissions previously held by an employee.

An error or substitution at the model level becomes an action in a production system. In a related note

Thompson describes his own case: his computer was hacked through a macOS vulnerability that the Dutch NCSC classified as highly serious and actively exploited.

Attacks were observed on systems where port 5900 was accessible from the internet.

Thompson writes plainly that he was to blame.

The service was enabled for convenience, became externally visible, and that was enough for an attacker. A person who writes professionally about technology was caught out by an open port. In a corporate IT environment with dozens of integrations, there are more open entry points.

A language model in an enterprise environment has three typical leakage channels. - Prompt.

An employee sends a contract, customer export, or source code to a chat, and the data goes to a third-party provider. - Context. RAG (searching an internal knowledge base before the model responds) may retrieve documents the user should not be allowed to see.

The model will summarize any document provided in its context. - Tools.

Through MCP (the protocol a model uses to call external systems), an agent gains access to actions such as creating an order, exporting a database, or sending an email.

Permissions for these actions are granted as strictly as they are to an employee.

A single control point for all three channels is called an LLM & Security Gateway.

Every request to every model passes through it.

The gateway masks personal data, verifies document permissions, logs tool calls, and tracks costs.

The provider behind the gateway can change while the security policy remains the same.

The release of Fable 5.1 provides a telling example.

Thompson writes that Fable temporarily removed its unpopular data retention policy altogether.

He also notes that increased caching benefits both sides: the provider saves computing resources, and the client pays less.

A vendor can change its data retention terms in a single release, in either direction.

If your protection rests on a clause in the provider's terms, it depends on someone else's decision.

A gateway on your side provides protection under your control.