Every AI model you plug into your company could be learning your business, and selling it to your rivals.

Microsoft's chief executive says the fix isn't picking the best model. It's owning the test you judge every model by.

Should a company build on the most powerful closed AI model, or on cheaper open ones? Satya Nadella, talking to Harry Stebbings on 20VC, says the question is framed wrong. Models will compete and get cheaper. What a company must protect is its own definition of good work, and the data showing how it gets there.

In short: treat any AI model as a possible insider risk and contain it from outside, use frontier models only where needed, and keep your surplus in private evaluations, traces and context no model maker can absorb.

1. Assume the model is compromised

Nadella starts with security. In an essay published on October 10, "Models as Insider Risks in the Super Intelligence Era", he argued that companies can't trace why a model does what it does, so they should treat models like powerful employees:

• give each an identity,
• limit what it can touch,
• log everything,
• keep a human emergency brake.

We must assume a model is compromised and contain it from the start

He separates this from AI safety. Alignment has to be built in during training; "you can't RL your way to alignment," he says. Containment is the engineering layer on top. Microsoft's Agent 365 gives every agent an identity and records each tool call, model call and chain of thought. He wants that reasoning in plain English and checked by several models, not one, because reasoning traces can be unfaithful to what a model actually did. Hiding them makes things worse, and that pressure for transparency could favour open-weight models.

So which models will companies actually run?

2. Most AI work will be ordinary

Nadella expects both open and closed to survive. A frontier market will always exist for the hardest work, with science perhaps next. But most tasks "saturate": once a model is good enough, a company can train a cheaper one on its own records of how the work is done. Most of the world's AI usage, he predicts, will run on commodity models.

His example is Unilever, which uses agents for order-to-cash and trade claims. It started on a frontier model, then moved trade claims to a cheaper Microsoft MAI model and trains on its own traces. Microsoft plans to sell MAI models as licensed weights, "a simple straightforward software business," rather than one that grows by learning from customers' data.

Why does that distinction matter so much? An old economic paradox, turned inside out.

3. The reverse information paradox

Kenneth Arrow's information paradox says a seller can't show you an idea without giving it away. Nadella says AI flips this: now the buyer is exposed. Every workflow, correction and even thumbs-up a company feeds a model can improve the model maker's product, and that know-how can be sold to its rivals.

He draws on Friedrich Hayek: useful knowledge is scattered and tacit, spread across many people and firms. That's why, Nadella says, no single firm or intelligence will run everything.

4. A firm becomes its benchmark

His sharpest line: each firm will have a private benchmark of what good work looks like, and that benchmark becomes its core intellectual property. Models compete to score well on it. Asked for a prediction that sounds crazy but will be common in five years:

A firm would be an AI benchmark.

A company's surplus should stay with it, in its own weights, context or evaluations.

5. Many winners, and a ceiling

• A router at the top will send each task to whichever model does it best, with competition at every layer from chips to apps.
• No single vertically integrated winner; he hopes for several per layer, as with PCs and the cloud. "AI native" will soon sound as dated as "cloud native."
• Training budgets have a ceiling. Training is research spending, which for research-heavy companies runs about 15 to 20% of revenue, and is ultimately capped by economic growth. Power plants and chip factories take years to build.

World growth has been stuck around 2% for a long time. The real test of AI is whether it lifts that, through contact centres, supply chains and chip design, and by helping poorer countries catch up.

Related reading: if growth is the test, the financing is the risk. See AI Isn't the Bubble. The Debt Behind It Might Be.

Weighing it: what holds up

The essay is real. Published October 10, it says "We must assume a model is compromised and contain it from the start," and calls for an authorized person to be able to stop a model mid-task. Microsoft's security material describes Agent 365 as a control layer with agent identity, access policy and audit.

Unilever checks out in part. The example matches Microsoft's October 2026 London keynote and a Microsoft UK story on Unilever's order-to-cash agents, which reports faster claims handling. The "reverse information paradox" also appears in Nadella's earlier writing and press coverage.

Not checked: the move of Unilever's trade claims to an MAI model, Microsoft's licensing terms for MAI weights, the 15 to 20% research-spending figure, and the $100 billion training-run comment he attributes to Mustafa Suleyman.

The interest is obvious. Microsoft sells Agent 365, Copilot, its MAI models and the Azure cloud that hosts many rivals. An argument for routing between many models, keeping data in your own tenant and buying containment tools also describes Microsoft's product line. It may still be right.

Long Talk Short

• Treat every AI model as a possible insider risk, with identity, logs, monitoring and a human brake outside the model.
• Alignment must come from training; containment is a separate engineering job.
• Most AI work will move to cheaper open or closed models once a task is good enough; frontier models will serve the hardest problems.
• AI reverses Arrow's paradox: the buyer now leaks value to the model maker.
• A firm's lasting asset is its private eval of what good work looks like, plus its traces and context.

The one thing to remember: rent intelligence from whoever is cheapest and best this month, but never hand over the yardstick you use to judge it.

Source: "Satya Nadella on Open vs Closed Models: Who Wins | Why Companies Need to Own Their Own Intelligence", 20VC with Harry Stebbings. This is an independent summary and is not affiliated with 20VC or Microsoft.

This article is for general information only and is not investment advice. Quotes are taken from automatic captions and may contain small transcription errors.