The $3 Trillion Question Nobody Wants to Answer
Last week, Apollo Global Management’s chief economist Torsten Slok published a note titled “No Signs of AI Payoff Outside the Tech Sector.” The charts inside are brutal. Revenue per worker is climbing for the Magnificent Seven — the hyperscalers plus Apple, Nvidia, and Tesla — and flat for the other 493 companies in the S&P 500. Profit margins tell the same story: the seven giants are hovering near 30 percent while everyone else clings to about 10 percent.
Meanwhile, mainstream corporate America is pulling back. Token spending, once treated as a growth investment, is being reclassified as a cost center that weighs on margins. Venture-backed startups keep buying more compute, but the rest of the economy does not seem to need the latest model and is definitely not willing to pay for it.
Goldman Sachs chief economist Jan Hatzius confirmed the same trajectory from a different angle: AI’s boost to U.S. economic growth is nearing its peak. Across non-manufacturing industries, higher AI adoption actually correlates with weaker employment growth and higher unemployment — a signal that companies are automating roles before they have new revenue to justify the headcount reduction.
The question is not whether AI is useful. It is. The question is whether it is actually paying for itself outside the companies that sell it.
The Infrastructure Cracks Are Showing at the Worst Possible Time
While economists debate AI’s productivity numbers, the technology is also making the internet’s underlying plumbing more dangerous. Late last week, government websites across France, Denmark, Finland, the Netherlands, and Australia went dark. The Dutch cyber security agency took itself offline. So did Wikipedia systems, the Port of Rotterdam, and dozens of UK government services.
The cause was PHP2Shell — two critical memory-handling flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS 4.0. Together they let unauthenticated attackers execute arbitrary code on any PHP server and read server memory containing passwords, session tokens, and API keys. The bugs had been sitting in PHP’s codebase for fourteen years.
What made this different from a normal vulnerability disclosure was who found them. OpenAI’s Patch the Planet initiative discovered one of the flaws. Google-owned Wiz Research found both independently using its Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol. Calif, another AI security firm, found one using GPT-5.6 Sol in August.
AI found the bug. AI also helped write the patch. But for a few days in late October, the same capability turned the internet’s most widely used server language into a loaded weapon.
The Bug That Hid Inside Compression Itself
If you thought the risk was limited to PHP, CVE-2026-111497 arrived a few days later to change your mind. This one lives in Google’s Brotli decoder — the compression library that speeds up web traffic across Node.js, Bun, Python, Envoy, Istio, .NET, Ruby, and PHP. Versions 1.0.3 through 1.2.0 are affected.
The flaw is an out-of-bounds write in the C decoder’s core routine. A crafted Brotli stream tricks the decoder into appending attacker-controlled bytes past the end of an internal buffer. The result: memory corruption, crashes, information leaks, or remote code execution.
The attack surface is enormous. Node.js vendors its own copy of Brotli and uses it automatically in fetch() and Express 5 request bodies. Python’s requests, urllib3, aiohttp, and httpx all decode Brotli responses transparently when the relevant package is installed. Bun does the same in its fetch, node:zlib, and DecompressionStream implementations. Envoy and Istio trigger it whenever the Brotli decompressor filter is enabled — which Istio does not do by default, but Envoy operators often turn on.
Imperva demonstrated working RCE on the official Node.js 24.22.0 Linux arm64 Docker image. Public proof-of-concept code is already circulating.
Fixed versions are available: Node.js 22.23.4, 24.22.1, and 26.12.1; Bun 1.4.4; Google Brotli 1.0.10, 1.1.1, and 1.2.1; Python Brotli 1.2.1; Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8, and 1.36.12. Node.js 20.x and older will receive no fix — the line is end-of-life, and your only option is migration.
Run npm ls brotli or pip show brotli right now. If the version is below the fixed release, that is your afternoon gone.
MITRE Just Cataloged AI as Its Own Attack Surface
Last week also brought MITRE ATT&CK v20, and for the first time the framework treats AI abuse as a distinct adversary category. The new techniques cover direct and indirect prompt injection, AI-enabled exfiltration, and stealing application-specific passwords to bypass MFA. MITRE also added an entire ICS campaign covering the 2026 U.S. water-utility attacks — the ones that hit more than thirty facilities in Minnesota and elsewhere, reaching internet-exposed Rockwell MicroLogix PLCs over cellular links and locking operators out of their own systems.
CVE-2021-22681, the vulnerability those attackers exploited, was disclosed in 2021. It landed on CISA’s Known Exploited Vulnerabilities catalog in March 2026. Five years between disclosure and mandatory action is a bad number. Dragos, the industrial-security firm that tracked the attacks, noted that the same gaps have been open for a decade.
AI is both accelerating the discovery of these flaws and lowering the cost of exploiting them. That is an uncomfortable combination when your critical infrastructure still runs on firmware that has not seen a security patch since the Obama administration.
Where AI Actually Struggles
Slok’s note included a line that deserves more attention than it got. AI does not understand accountability, trust, culture, unwritten rules, ethical trade-offs, or fairness. All of those shape reputational risk, and reputational risk ultimately drives revenue growth and profit margins. I discussed this tension in Anthropic’s decision to let outsiders audit its models: transparency is only useful if the auditor can actually understand what they are looking at.
That observation has nothing to do with model size. It is about the gap between processing information and understanding context. A language model can draft a vendor proposal in seconds. It cannot read the room in a client meeting. It can optimize a supply chain schedule but will not notice that the warehouse supervisor is quietly disengaged and about to quit, taking operational knowledge with them. It can flag a customer complaint as negative sentiment without understanding that the client is actually describing a strategic buying signal.
As someone who manages an ICT division in a government institution, I see this gap every day. We can automate ticketing, deploy Copilots for internal documentation, and generate weekly reports with LLM assistance. But the things that actually move projects forward — aligning stakeholders, reading political dynamics, knowing which unofficial channels to engage — are the things AI is worst at. The same is true in any organization that depends on human judgment, not just code generation.
The Brotli vulnerability is a perfect example. AI found the bug. AI helped patch it. But patching still requires someone to decide which systems to prioritize, who to notify, how to communicate downtime to users, and what to do when Node.js 20.x has no fix. AI is a powerful discovery and acceleration tool. It is not a strategy.
The Real Story Is Still About People
MITRE’s move to formalize AI attack techniques is welcome. It gives defenders a shared vocabulary and a checklist. But the catalog is already hundreds of items long, and the average security team is struggling to keep up with the ones that do not involve AI at all. Adding a new AI section without adding defenders is like adding a new weight class to a boxing tournament when half the corners still have no cutman.
And here is the part that ties the economics to the infrastructure: as long as AI’s financial returns are confined to a small slice of the economy, the macroeconomic effects will be limited. The S&P 493 — the 493 companies that are not the Magnificent Seven — are not seeing revenue growth or margin expansion from AI. They are seeing token bills. Mainstream corporate America does not need the latest frontier model. OpenAI’s move to cut frontier models off live-internet training suggests even the vendors know the raw-data era is ending. What companies actually need is working software that does not introduce new categories of memory-corruption vulnerabilities into its supply chain.
The PHP2Shell and Brotli episodes are reminders that the software stack most companies depend on was built by volunteers. Browser-level changes like Chrome removing XSLT support show how quickly assumed infrastructure can shift maintained on thin margins, and audited by humans who now have AI-assisted tooling — but still finite time. The gap between AI’s promotional promise and its actual return is not a failure of imagination. It is a measurement problem. We can measure token throughput. We cannot yet measure whether a team made a better decision because an LLM summarized its options. Meta’s decision to claim the right to train on published web content is the same blind bet: more training data will somehow equal better decisions.
That last mile — turning generated output into organizational advantage — is where the payoff will actually show up. And it will show up first in organizations that have already figured out culture, accountability, and trust. AI does not replace those things. It amplifies whatever is already there.
The S&P 493 will decide AI’s legacy, not the Mag 7. And so far, the evidence from the 493 is: still waiting.