The Token Amplification Trap: Auditing the Agent Runtime Economy

In 2017, I spent three months reverse-engineering the Solidity source of a liquidity protocol that the entire market had already decided was brilliant. My peers were watching token prices; I was watching integer overflow paths in pool logic. When I found seven of them, I learned something that has never left me: the most important signal is almost never in the marketing. It is in the arithmetic nobody bothered to run.

I thought about that habit again in late September 2026, when two of the largest AI laboratories published the same two numbers within forty-eight hours of each other. Two dollars per million input tokens. Ten dollars per million output tokens. Identical. Not similar — identical. In every market I have audited, from AMM fee curves to sequencer pricing on rollups, a coincidence this precise is not a coincidence. It is a signal. And the signal is not the one the press release wants you to read.

Tracing the code back to the silence of 2017, I have learned to treat synchronized pricing as a confession rather than a discount. When two competitors converge on the exact same price in the exact same window, the market is telling you that the underlying capability has stopped being a differentiator. The interesting question is never "how cheap is it." The interesting question is "what did they stop competing on, and what are they competing on instead." This article is an attempt to answer that question for the agent economy — not by repeating the product announcements, but by auditing the numbers underneath them.

The Three Runtimes Nobody Is Comparing

Before the economics, the architecture. The reporting on this cycle has been relentlessly product-focused, which is exactly the mistake I made as a twenty-one-year-old when I read whitepapers instead of bytecode. The announcements describe features. The runtime describes costs. And there are three genuinely different runtimes competing here, not five products.

The first is the cloud sandbox runtime, embodied by the per-agent cloud computer that one major lab shipped alongside its new model. The claim is that each agent runs on its own dedicated virtual machine, with orchestration across more than four thousand application integrations. Strip away the marketing and this is a computer-use architecture: a sandboxed virtual environment, a tool-calling protocol, and a state manager that keeps a long task chain coherent across many steps. The hard engineering is not in the model. It is in the parts nobody demos — state persistence across a task that runs for forty minutes, recovery when step nineteen fails, permission isolation so that the agent cannot touch what it was never granted, and the token amplification that every one of these mechanisms produces.

The second is the on-device plus private-cloud runtime, embodied by the hardware vendor that paired local inference with a verifiable private compute enclave. This is a privacy-engineering choice first and a capability choice second. By keeping the most sensitive inference on the device and routing only the residual to an enclave with attestation, it buys something the other runtimes cannot: a credible answer to the question "who can see my email." The cost is equally structural. On-device silicon has a ceiling, and that ceiling decides how complex an agent task can ever be. A local runtime can summarize, draft, and schedule. It cannot reliably execute a fifteen-step research-and-reconcile workflow that spans four external services, because the context and the tool surface exceed what the phone can hold.

The third is the light assistant runtime, embodied by the social platform's entry. It is thinner, cheaper, and honest about its scope. It is not trying to run a virtual machine per user. It is trying to put a competent assistant inside an app that already has a billion daily users, and let distribution do the work that architecture cannot.

Three runtimes, three cost curves. The cloud sandbox pays for compute, storage, and sandbox operations on every task, and the cost scales with task complexity. The on-device runtime pays once, at hardware purchase, and then nearly nothing per task — but it caps the task. The light assistant pays for whatever the social feed already costs and treats the assistant as a retention feature rather than a product. In the quiet, the protocol reveals its true intent: these are not three competitors in one race. They are three different businesses wearing the same word.

And then there is the fourth path, which is not really a consumer product at all. One lab has stepped out of the consumer race entirely and is selling deployment capability into the consulting and systems-integration layer, training engineers inside the large professional-services firms rather than acquiring users directly. That is not an assistant. That is enterprise services with a model attached. Treating it as a competitor to a phone assistant is a category error, and I will return to why the category error matters for valuation later.

The Arithmetic Nobody Ran

Here is where the agent economy stops being a product story and becomes an infrastructure story. And here is where the reporting has been most negligent.

The defining economic property of an agent is not that it uses a model. It is that it uses the model many times to accomplish one human task.

This is the token amplification effect, and it is the single most under-discussed variable in the entire cycle. A chat interaction is roughly one model call: you ask, it answers. An agent completing a "simple" task — triaging a morning inbox, reconciling a calendar against a set of invitations, drafting and filing three follow-ups — may trigger dozens to hundreds of model calls. It reads each message, decides an action, calls a tool, observes the result, re-plans, calls another tool, and loops until the task terminates. Every loop consumes tokens. Every tool observation is injected back into the context. Every re-plan is a fresh inference over a growing transcript.

The amplification factor is not two or three. In the workflows I have mapped while studying orchestration systems, a single delegated task routinely consumes between ten thousand and a million tokens depending on the task chain's depth. That is not a rounding error against a chat interaction. It is one to two orders of magnitude larger, and it is the reason the economics of an assistant and the economics of an agent cannot share a pricing model.

Now apply that to the free tier. One of the entrants is offering a weekly allowance of one hundred million tokens at no charge. Run the arithmetic the article that inspired this analysis pointed at but never completed. At the published two-dollar input and ten-dollar output rates, and using a generous blended figure of roughly four dollars per million tokens for a realistic input-to-output mix, a single user consuming the full weekly allowance represents an API-equivalent cost of approximately four hundred dollars. Over a month, that is on the order of seventeen hundred dollars. The premium tier for the same product is priced at twenty dollars a month.

Sit with that ratio. The subsidy is not a discount. It is a two-orders-of-magnitude gap between what the service costs to run at full utilization and what the user pays. The only way a free tier of this size survives is if actual utilization is a small fraction of the allowance — realistically below five to ten percent. A free tier priced at one percent of its worst-case cost is not a business model. It is a bet that almost nobody will use the thing they were given.

I have seen this pattern before. In 2020, I spent weeks isolated, mapping the incentive vectors of a lending protocol's governance design, and I found the same structural sleight of hand: a mechanism that looked generous at the headline and was quietly underwritten by the assumption that most participants would not exercise the rights they had been granted. The design was solvent only because the majority stayed passive. The moment participation approached the theoretical maximum, the math inverted. Free tiers in the agent economy carry the identical hidden assumption, and the identical fragility.

This is not an argument that the free tier is fraudulent. It is an argument that the free tier is a customer-acquisition instrument funded by something other than the AI business — advertising cash flow in one case, hardware margin in another, debt and strategic capital in a third. Which means the durability of the subsidy depends on the strength of the parent business, not on the merits of the assistant. The competition is not between assistants. It is between balance sheets, mediated by assistants.

What the Price Actually Anchors

The synchronized two-dollar, ten-dollar price is the second piece of arithmetic worth auditing, because it is doing two jobs at once and only one of them is honest.

The honest job is signaling. When two labs converge on the same number, they are telling the market that capability differences have narrowed enough that price is the only lever left. That is a real and important claim, and it is probably directionally true for the commodity tier of text work. If two models with genuinely different quality were competing, they would not price identically. They would price to their quality premium. Identical pricing is the market admitting that the premium has compressed.

The dishonest job — or at least the unspoken one — is anchoring. One lab's flagship subscription is priced at five hundred dollars a month, an order of magnitude above the standard tiers. The temptation is to read this as a premium product. I read it as a price anchor. A five-hundred-dollar tier makes a hundred-dollar tier feel like a bargain and a twenty-dollar tier feel like charity, and that psychological gradient is worth more than the revenue the top tier collects. Whether the five-hundred-dollar tier even covers its own cost is an open question, because a dedicated cloud computer per agent carries a marginal cost — dedicated compute, dedicated storage, dedicated sandbox operations — that no chat subscription ever carried.

There is a contradiction buried in the commodity framing that the reporting has not resolved. The same sources that call two-and-ten "the commodity price floor" also report that the two largest labs plan to roughly double their entry pricing. These two statements cannot both be true in the way they are presented. If a price is genuinely commoditized, it falls. It does not double. A price that doubles is a price under capacity constraint, or a price being tested for elasticity, or a price set by discipline rather than competition. The commodity narrative and the doubling plan are in direct tension, and only one of them is being told straight.

My read is that the doubling is price discipline dressed as commoditization. The labs want the market to believe the floor is permanent so that customers commit, while they quietly raise the entry price to protect margin. This is a familiar move to anyone who watched rollup fees: the advertised cost of a transaction and the realized cost of a transaction diverged the moment demand arrived, and the marketing never caught up to the fee curve.

And underneath all of it sits a signal that should interest anyone who follows market structure: two competitors setting identical prices within a day of each other is exactly the pattern that antitrust authorities scrutinize for tacit coordination. I am not alleging collusion. I am observing that the pattern is the kind of thing that draws attention under the competition frameworks that are already being applied to this sector, and that a synchronized price is a fragile thing to build a narrative on.

The Moat That Distribution Built

The competitive question this cycle has surfaced is the right one: does the advantage now live in the model or in distribution? The reporting leans toward distribution, and I think it is correct — but it overshoots by concluding that one player's distribution has effectively locked the market.

Start with where the moats actually are. The hardware vendor holds the strongest structural position, because system-level default plus personal data context plus on-device privacy creates a switching cost that no standalone app can match. When the assistant is the operating system's voice, the user does not choose it. It is simply there. The lab with the largest reported weekly user base holds the second-strongest position on breadth — more than four thousand integrations is a distribution moat measured in surface area, and surface area compounds.

The social platform holds scale but not trust. It can buy downloads — and it did, briefly topping the app store — but it carries a trust deficit that is structural rather than fixable by product quality. A recent multi-billion-dollar settlement over harms to minors, finalized days before the launch, is not a PR problem. It is a permanent feature of the trust equation for a company asking to read your messages.

The search-and-cloud giant is, remarkably, the least discussed player in the coverage and the most dangerous one to underestimate. It is the only entrant that simultaneously owns the model, the cloud, the silicon, the mobile operating system, the search box, and the browser. That is the most complete distribution stack in the field, and it appears in the reporting almost exclusively as a pricing party. The most strategically positioned competitor is the one the narrative has decided not to talk about. When a player that strong is systematically absent from the analysis, the absence itself is the finding.

Which brings me to the part the reporting got backwards. The coverage argues that the hardware vendor's lock-in makes it the likely winner, and then treats regulatory pressure as a mere geographic inconvenience. That framing is self-contradictory. The same regulatory regime that the reporting cites as a reason the vendor excludes certain regions is the regime that mandates opening default-app selection. The regulation is not a wall around the moat. It is a pickaxe aimed at the moat's foundation. If the user can choose the default assistant — and under the relevant regime, the user must be able to — then the system-level default stops being a lock and becomes a preference. Preferences are contestable. The moat is shallower than the narrative assumes.

The Multi-Homing Blind Spot

The deeper error is the assumption that users will pick one assistant and stay. This is the same error the Layer2 market made about itself. There are dozens of rollups now and roughly the same small population of active users, and the industry kept calling this scaling when it was actually slicing an already-scarce pool of liquidity into ever-thinner fragments. The agents are about to repeat it. There will be several capable assistants, and the realistic user behavior is not loyalty to one. It is multi-homing: using the system assistant for system tasks, the largest lab's assistant for complex research, and a specialist for whatever the specialist does best.

Multi-homing destroys lock-in. If a user can trivially keep three assistants and route each task to whichever is best, then no single assistant captures the user, and the switching cost that all the moat analysis depends on evaporates. The historical pattern supports this. Platform markets in operating systems, search, and commerce did not converge to a single winner. They converged to a small oligopoly in which several players coexist and divide the field by scenario. The base rate for assistant markets is fragmentation, not monopoly, and the coverage has inverted the base rate.

The scenario-division outcome is also the one that best matches the architecture. The on-device runtime wins the privacy-sensitive, latency-sensitive, low-complexity tasks because it is local. The cloud sandbox wins the high-complexity, long-horizon tasks because it has the compute. The light assistant wins whatever the social feed already wins. These are complementary positions, not mutually exclusive ones. A market that divides this way has room for three or four survivors, and the winner-take-all framing is a story told to justify valuations, not a description of the equilibrium.

There is one capability dimension where the reporting offers essentially nothing, and I want to be explicit about it rather than paper over it. The coverage provides no benchmarks, no context-length data, no multimodal comparisons, no reliability metrics. Every capability claim in this cycle is being made without a single independent measurement. I could construct a capability matrix, but it would be almost entirely inference, and a matrix built on inference is not evidence. I will say only this: identical pricing is indirect evidence that text capability has converged, and convergence on the commodity tier says nothing about reliability on the hard tier, which is where agents actually earn their keep.

The Omission That Should Worry You Most

We audit not to judge, but to understand — and understanding the agent economy requires looking at the thing the entire cycle has declined to discuss. The reporting is a masterclass in commercial analysis and a void on security. That void is not a gap. It is the most important finding in the material.

Consider what an agent is, mechanically. It reads external content — your email, the web pages it visits, the documents it opens — and it holds the authority to act: send, transfer, delete, book, pay. It is, by construction, a system that consumes untrusted input and executes trusted actions. In security terms, that is the definition of a dangerous machine. The attack that exploits it has a name. It is prompt injection, and it is the highest-severity issue in the entire architecture.

Here is the mechanism in plain terms. An attacker does not need to break into the model. The attacker only needs to place text where the agent will read it. A malicious instruction hidden in an email body, a calendar invitation, a web page, or a shared document becomes, to the agent, indistinguishable from a legitimate user instruction unless the runtime has been carefully engineered to maintain that distinction — and maintaining it is genuinely hard, because the model's whole strength is treating text as meaningful. A chat assistant that is fooled says something wrong. An agent that is fooled sends money, deletes files, or forwards your inbox to an adversary. Prompt injection turns a language-model failure into a financial and operational one, and the amplification factor that makes agents economically powerful makes this attack economically devastating.

I encountered a version of this risk class in 2021, when I worked with a small team to audit the order-matching logic behind a major marketplace's signature verification. The flaw was not in the cryptography. It was in the seam between two systems that each trusted the other slightly more than they should have. Agents are made entirely of such seams. The model trusts the tool output; the tool trusts the model's parameters; the orchestrator trusts both. Every seam is an injection surface, and there are dozens of them per task chain.

And yet the material treats the security question as absent. There is no mention of injection defenses, no red-team results, no mention of what happens when an agent with payment authority is hijacked. This is not a minor oversight. It is the difference between a product and a liability. A subscription that drafts emails is a convenience. A subscription that can move money and delete data is a security boundary, and a security boundary without a published threat model is not a product you can responsibly deploy.

The same material is candid, at least, about a second risk: the trust deficit of the institutions themselves. One lab is asking for access to the most intimate data a person has — inbox, calendar, payment — less than two weeks after a settlement over harm to minors measured in the billions. Another reports its user numbers itself, unaudited. The one player leaning hardest on privacy is doing so through a verifiable enclave, which is the correct technical answer, and it is also the only player whose privacy claim can be independently checked. Authenticity is not minted, it is verified, and in this market the verified privacy claim is the rarest asset on the board.

The reporting is right to flag the trust deficit. It is wrong to treat it as a soft reputational issue rather than a hard adoption constraint. Users will hand an agent their inbox only if they believe the operator will not misuse it, and belief is not produced by a privacy policy. It is produced by verifiable architecture and independent audit. The lab that publishes a third-party red-team report on its agent's injection resistance will move adoption more than the lab that cuts its price.

There is a third omission worth naming, because it is where the money will actually come from. When an agent completes tasks on a user's behalf — buying, booking, comparing, recommending — the agent controls the ranking. Ranking is monetization. The moment assistants start steering purchases, a new advertising and commission economy appears at the agent layer, and it arrives with all the dark-pattern risks of the old one, except now the intermediary is trusted as a neutral helper rather than recognized as a paid placement. The material does not mention this. It is, in my judgment, the largest unaddressed revenue pool in the entire sector, and the largest unaddressed ethical risk.

The Leverage Bet

Now the part of the material that is genuinely hard-core, and that I want to underline because it is the most important thing in the entire cycle: how this is being financed.

One lab has raised an eleven-billion-dollar high-yield bond — the largest in its corporate history, and high-yield means below investment grade, which is to say the market is pricing meaningful default risk into the financing of a frontier lab. Another is leaning on a three-hundred-billion-dollar commitment from a single strategic investor. And a third has committed to five hundred eighteen billion dollars of compute, of which roughly eighty percent — on the order of four hundred fourteen billion dollars — is reportedly non-cancelable, against a reported forty-billion-dollar loss.

Read that last number slowly. A non-cancelable compute commitment of that scale, set against losses of that scale, is a fixed-cost structure that dwarfs any plausible near-term revenue. If the lab's annual revenue is in the tens of billions, the non-cancelable commitment is a multiple of annual revenue, which is exactly the profile of a company that has bet everything on a distribution outcome that must arrive before the capital does. The existence of a registration filing confirms the direction: this entity is preparing to explain that bet to public markets.

This is the structural risk of the entire cycle, and the material names it correctly: the whole industry is burning capital on the assumption that one of the distribution bets pays off before the money runs out. That is a leverage bet, not a growth story. It is the same shape as the stablecoin designs I documented through the winter of 2022, when I retreated from the noise to trace exactly which cryptographic guarantees failed and which only appeared to hold. The failure mode there was not a bad model. It was a capital structure that required continuous confidence to remain solvent, and that collapsed the moment confidence paused. I am not predicting a collapse here. I am observing that the shape is familiar, and that shapes recur.

The mechanism that makes the leverage bet dangerous is the token amplification I described earlier. If agent usage scales, inference cost scales faster than chat ever did — one to two orders of magnitude faster per task. A leveraged operator whose costs amplify with usage is in a fundamentally different position from a leveraged operator whose costs are fixed. The free tier and the amplification effect interact: every incremental active user increases the subsidy, and the subsidy is funded by debt. An operator subsidizing amplified usage with borrowed money is short volatility on its own adoption. The more successful it is, the faster it burns, unless the pricing rises to match — and the pricing is, for now, being held down as a strategic signal.

What I Would Watch, and What I Would Not Trust

The temptation at the end of an analysis like this is to summarize. I will not, because a summary would flatten the one thing that matters, which is the direction of travel rather than the state of play.

What I would not trust is any number that a participant reports about itself. The user counts are self-reported. The download figures are self-reported. The capability claims are unbenchmarked. The pricing is synchronized in a way that invites scrutiny. In a market where every headline figure originates with a party that benefits from it, the correct posture is not skepticism for its own sake but verification as a discipline. Verify everything, not because the parties are lying, but because verification is the only input that does not depend on their honesty.

What I would watch, in order, is this. First, the injection resistance of the first agent granted real payment authority — because the first hijack will define the regulatory posture of the entire category, and it is a matter of when, not if. Second, the utilization data behind the free tier — because the subsidy's true size is the single number that determines whether the leverage bet is survivable, and it is the number least likely to be disclosed. Third, the entry-price trajectory — because if the commodity price floor doubles as reported, the commoditization narrative collapses and the market will have to reprice every assistant as a capacity-constrained product rather than a commodity. Fourth, the default-selection rules in the major jurisdictions — because those rules, not product quality, will determine whether the strongest moat survives.

And what I would hold onto, through all of it, is the lesson from 2017. The signal is in the arithmetic nobody ran, not in the announcement everybody read. The agent economy has been sold on capability and priced on hope. The capability is real. The hope is leveraged. Whether the leverage pays off is not a question about models. It is a question about whether the people funding the amplified burn can keep their conviction longer than the arithmetic can keep its patience. Authenticity is not minted, it is verified — and the verification is still, conspicuously, not on the record.

Every pixel carries a history we must respect. This cycle's pixels will one day be audited by someone with the benefit of hindsight, and the question they will ask is not whether the assistants were impressive. It is whether anyone, at the peak of the enthusiasm, bothered to run the numbers. Layer two was a promise, not just a layer, and promises are exactly the things that must eventually be settled in the ledger. The agent economy has made its promises. The ledger has not yet rendered its verdict.