NeuralWired’s Technology section covers the developments reshaping how the world builds, deploys, and regulates digital innovation. We report daily on the stories driving global conversation in artificial intelligence, big technology companies, startups and venture funding, cybersecurity, consumer gadgets and devices, and blockchain and cryptocurrency.
Our technology coverage goes beyond product announcements. When a major AI model launches, we explain what it can actually do and where its claims are overstated. When a startup raises a large funding round, we look at whether the business behind it can sustain that valuation. When a cybersecurity breach hits the news, we explain who is affected and what comes next, not just what happened. Each article is built from original research into primary sources, including company statements, technical documentation, regulatory filings, and verified data, and is written by our editorial team rather than generated automatically.
Readers come to this section for daily updates on the technology stories that matter globally, from shifts inside major technology companies to emerging tools changing how people work, communicate, and build. Whether you are a founder, an investor, an engineer, or simply someone trying to understand where technology is heading next, NeuralWired’s Technology coverage is built to keep you informed without wasting your time on hype.
The OpenAI Growth Wall: How a 1B User Miss Is Reshaping a $750B AI Cycle | NeuralWired
Big TechApril 29, 2026 · 12 min read
The OpenAI Growth Wall: How a 1B User Miss Is Reshaping a $750B AI Cycle
A leaked internal memo from OpenAI CFO Sarah Friar has set off a chain reaction across the Magnificent Seven, exposing the fragile math behind a $600 billion infrastructure bet and forcing an immediate pivot to agentic commerce as the only viable exit ramp.
For three years, the market operated on a single comfortable assumption: user growth for large language models would follow an uninterrupted exponential curve. That assumption died on April 28, 2026. An internal report surfaced by The Wall Street Journal revealed that OpenAI had failed to reach 1 billion weekly active users by its own internal deadline and had missed multiple monthly revenue targets. The Nasdaq Composite fell 0.9% within hours of the news breaking.
The damage radiated outward with mechanical precision. Oracle dropped 7% to $161, its $300 billion compute contract with OpenAI suddenly reframed as a liability rather than an anchor. CoreWeave slid 7.4%, SoftBank fell nearly 10% in Tokyo trading, and Arm Holdings dropped 7.7% as investors unwound positions across the AI supply chain. What looked like a company-specific stumble was, in fact, a system-wide repricing of the premise that unlimited AI engagement justifies unlimited infrastructure spending.
Tonight, Alphabet, Microsoft, Meta, and Amazon report earnings against a backdrop of nearly $600 billion in collective AI-related capital committed for 2026. The central question isn’t whether these companies are growing. It’s whether the underlying software can attract and monetize users at the rate their valuations demand. One missed guidance number, one downward revision, and the “OpenAI Slump” stops being a warning shot and becomes a full-scale sector rout. The earnings window opening tonight may be the most consequential 48 hours in the AI super-cycle to date.
The Compute-Revenue Chasm That Wall Street Ignored
The structural fault line at the center of this crisis has a name: the Compute-Revenue Chasm. To maintain its training lead, OpenAI entered into agreements for computing power that assume a revenue trajectory the company hasn’t hit. The five-year, $300 billion deal with Oracle is the clearest example. It was underwritten on the belief that ChatGPT’s user base would grow without friction toward the billion-user mark, generating subscription and API revenue sufficient to cover the monthly burn of GPU clusters at that scale.
When the Sarah Friar memo signaled that those projections weren’t materializing, Oracle’s stock didn’t just react to OpenAI’s bad news. It reacted to the realization that its own data center financing model has a single point of failure. CoreWeave, which recently completed an $11.9 billion infrastructure deal with the startup, faces the same exposure. These companies have effectively “leveraged up” on a growth curve that has now flattened.
“The market is discovering that compute contracts written against infinite growth assumptions become toxic assets the moment the growth assumption breaks. OpenAI didn’t just miss a user target; it invalidated the pricing model for an entire generation of AI infrastructure.”
Dan Ives, Senior Equity Analyst, Wedbush Securities — Wedbush Research Note, April 28, 2026
The Inference-Utilization Gap: A report from TechNewsWorld indicates that roughly 95% of enterprise GPU capacity currently sits idle. Companies bought hardware for AI projects that aren’t yet production-ready, creating a capital overhang that could suppress new GPU orders well into late 2026.
The broader implication is what analysts are calling an “efficiency audit” across enterprise AI. The FOMO-driven GPU buying cycle of 2024 and 2025 has left corporations with hardware they can’t fully use, billed at rates that assumed full utilization. As those utilization reports come in, the pressure on Nvidia and AMD isn’t just competitive; it’s arithmetic.
The SoftBank Contagion and the Arm Holdings Margin Call
No entity is more directly exposed to the OpenAI growth wall than Masayoshi Son’s SoftBank Group. The Japanese conglomerate has committed $22.5 billion to OpenAI funding, according to Reuters, and to raise that capital it executed a series of aggressive asset sales including its entire $5.8 billion stake in Nvidia and $4.8 billion of T-Mobile holdings. The logic was sound in a world of infinite AI growth. In a world of finite user engagement, it looks like a concentrated bet on the wrong side of a turning point.
The structural risk deepens because of Arm Holdings. SoftBank reportedly tapped undrawn margin loans secured against its Arm stake to fund a portion of the OpenAI obligations. When Arm fell 7.7% on the news, the collateral value of those loans compressed in real time. The result was a near-10% drop in SoftBank’s Tokyo-listed shares. The concern now circulating among institutional investors is clear: if OpenAI’s valuation is revised downward ahead of its targeted late-2026 IPO at a $1 trillion target, the margin call risk on SoftBank’s Arm-backed loans becomes a market event in its own right.
Entity
Share Move (Apr 28)
Primary Exposure
Risk Vector
SoftBank Group
-9.9%
$22.5B OpenAI funding commitment
Margin loans against Arm collateral
Arm Holdings
-7.7%
Primary SoftBank loan collateral
Collateral compression risk
Oracle
-7.0%
$300B 5-year compute contract
Anchor tenant default risk
CoreWeave
-7.4%
$11.9B infrastructure deal
Revenue dependency on OpenAI growth
AMD
-5.3%
GPU demand from cloud providers
Idle capacity reducing future orders
Nvidia
-3.8%
GPU cluster dominance
Agentic shift toward CPU inference
The Magnificent Seven Crucible: Four Earnings Reports That Define the Cycle
The selloff of April 28 was a preview. The main event runs tonight. Alphabet, Microsoft, Meta, and Amazon collectively committed roughly $600 billion in AI-related capital for 2026, and each faces a different version of the same pressure: prove that the spending is generating returns at the pace implied by their valuations, or face a re-rating that no amount of forward guidance can easily reverse.
Alphabet: The TPU Counter-Narrative
Alphabet enters earnings with a structural advantage its competitors can’t easily replicate. While rivals bid against each other for Nvidia’s H200 and B100 GPUs, Google has been scaling its custom Tensor Processing Unit clusters for years. Google Cloud analysts project a 50% revenue surge to $18.4 billion this quarter, driven in part by enterprise adoption of TPU-powered AI services. That number, if confirmed, would represent the single strongest argument against the “AI monetization is failing” thesis.
The real wildcard is “AI Mode.” Google’s new search paradigm integrates directly with the Universal Commerce Protocol to convert conversational queries into transactions. Internal data suggests a 14% to 27% conversion lift versus standard search ads. If Alphabet can show that this lift is translating into revenue per query, it may successfully decouple its valuation from the OpenAI-adjacent selloff entirely.
Microsoft: Azure Growth vs. the Workforce Paradox
Microsoft is down 11% year-to-date, its worst start since 2008, and it needs a strong Azure print to stop the bleeding. Analysts expect Azure growth of 37% to 38%, which would be healthy by any historical standard. The optics problem isn’t the revenue; it’s the cost structure. Microsoft is reportedly offering voluntary buyouts to roughly 7% of its U.S. workforce to manage the margin squeeze from its AI capex cycle. This is the efficiency paradox in action: the world’s most profitable software company is cutting headcount to fund the hardware that’s supposed to replace headcount.
Investors will also listen for any revision to the renegotiated pact between Microsoft and OpenAI. The recent update to that agreement, which allows OpenAI to forge deals with Microsoft’s direct competitors, signals a cooling of what was once an exclusive partnership. That’s a material shift in Microsoft’s AI moat story.
Amazon: The $200 Billion Question
Amazon has guided toward $200 billion in capital expenditure for 2026, the largest in its history and the largest single-company commitment to AI infrastructure the world has ever seen. AWS sales are projected to grow 26%, up from 24% in the prior quarter. The stock is up 25% in April, reflecting investor confidence that Amazon’s retail margin recovery can buffer its AI spending. But the 95% GPU idle-capacity finding complicates that confidence: if LLM training demand plateaus, Amazon may find itself operating the world’s most expensive underutilized asset base.
Meta: Efficiency or Attrition?
Meta is guiding for $115 to $135 billion in 2026 infrastructure spending while simultaneously planning to cut another 10% of its workforce next month. Sales growth is expected to hit 31%, the fastest since 2021, but free cash flow is projected to drop to a four-year low of $3.9 billion as AI capex consumes the surplus. Meta’s Llama open-source strategy is central to its long-term positioning, but the near-term math is tight enough that any advertising softness could flip the narrative from “efficiency play” to “margin crisis” overnight.
Company
2026 AI Capex
Key Metric to Watch
Pre-Earnings Sentiment
Amazon
~$200B
AWS revenue growth (target: 26%)
Bullish (+25% in April)
Alphabet
$175-$185B
Google Cloud growth (target: 50%)
Optimistic (+12% YTD)
Meta
$115-$135B
Free cash flow (risk: 4-yr low)
Cautious (workforce cuts)
Microsoft
~$176B (FY27)
Azure growth (target: 37-38%)
Bearish (-11% YTD)
Google’s Universal Commerce Protocol: The Exit Ramp from the Chatbot Era
The human-to-chatbot interaction model has a ceiling. The industry now knows where it is. What comes next is the question that the Universal Commerce Protocol is designed to answer.
Launched by Google in January 2026 and substantially expanded in a major March 2026 update detailed on the Google Developers Blog, the UCP is an open-source standard that gives AI agents a direct channel into merchant backends. It goes beyond surfacing product recommendations; it enables an agent to add items to a cart, apply membership pricing, verify inventory in real time, and complete a checkout transaction, all within the conversational interface. The shift is from AI as advisor to AI as executor.
Why this matters for search margins: Google moved UCP-powered ads in “AI Mode” from experimental to primary placement status in April 2026. If the 14% to 27% conversion lift implied by internal data holds at scale, it would represent the most significant uplift in Google’s revenue-per-query metric in over a decade, potentially offsetting the long-term erosion of traditional blue-link search.
The March update to the UCP introduced four functional primitives that collectively solve the “cart abandonment” problem that has cost mobile commerce an estimated $400 billion in annual revenue globally.
🛒
Cart Support
Agents add items from multiple vendors into a single unified basket, enabling one-checkout cross-retailer shopping without leaving the AI interface.
🔑
Identity Linking
User loyalty data binds directly to the agent’s identity, guaranteeing member-only pricing and reward points are applied without manual login.
📦
Live Product Catalog
Real-time inventory and pricing pulls from merchant stores, eliminating AI hallucinations about stock availability or variant options.
💳
Native Checkout
Handles the full payment transaction within the AI interface or the retailer’s own UI, reducing the number of steps between intent and purchase.
The UCP’s commercial coalition already includes Shopify, Etsy, Wayfair, Target, and Walmart. By building a vendor-agnostic standard, Google is attempting to create a commerce layer that works across ChatGPT, Copilot, Gemini, or any future agent. The retailers’ primary incentive is maintaining their status as “Merchant of Record,” which preserves direct customer data ownership. For Google, it’s about owning the transaction protocol that captures a slice of global commerce regardless of which AI assistant a consumer chooses to use.
OpenAI is pursuing a parallel track. Its own advertising pilot, launched in late March 2026, surpassed $100 million in annualized revenue within six weeks, per The Information. That’s a striking number for a product still in pilot phase, and it underscores how desperately the industry needs revenue streams beyond the $20-per-month subscription model that has defined AI monetization since 2023.
Intel’s CPU Renaissance and the End of the GPU Monoculture
The most counterintuitive story of April 28 was Intel surging 20% on a day when the Philadelphia Semiconductor Index had its worst session in a month. The divergence isn’t a market anomaly; it’s a signal about where the next phase of AI compute is heading.
The catalysts are structural. First, the Trump administration took a 10% stake in Intel in late 2025 as part of a “Sovereign Silicon” initiative, positioning the chipmaker as the domestic alternative to a GPU supply chain concentrated in Taiwan and dependent on Nvidia’s pricing power. Second, and more fundamentally, the agentic commerce paradigm described by the UCP doesn’t require the same compute profile as training a frontier model.
“Agents running on UCP don’t need a supercomputer. They need a very fast, very reliable CPU that can handle context, memory, and transactional logic at scale. That’s a completely different hardware requirement from what drove the GPU boom, and Intel is positioned for exactly that workload.”
Patrick Moorhead, Chief Analyst, Moor Insights & Strategy — Moor Insights Research, April 2026
The data makes the case starkly. Enterprise GPU clusters are running at roughly 5% average utilization. Intel’s agentic CPU nodes, by contrast, are operating at approximately 85% utilization. The market is bidding Intel up not on hope, but on evidence of actual throughput demand.
Metric
GPU Clusters (Training)
CPU Clusters (Agentic/Inference)
Utilization Rate
~5% (enterprise average)
~85% (Intel/agentic nodes)
Primary Supplier
Nvidia / AMD
Intel / Arm / Google TPU
Energy Intensity
Extremely high
Moderate to high
Growth Trend
Cooling / oversaturated
Surging / undersupplied
Geopolitical Profile
Taiwan-dependent supply chain
Domestically manufacturable (U.S./EU)
The integration of the Model Context Protocol (MCP) further accelerates this CPU-centric shift. MCP allows agents to understand a retailer’s business logic without requiring a full technical overhaul of that merchant’s systems, lowering the barrier to entry for smaller participants. The net effect is a more distributed, less compute-intensive AI economy, which is structurally bad for Nvidia’s growth thesis and structurally good for Intel’s.
Oil at $115, the Fed’s Final Act, and the Energy Tax on AI
The tech sector’s search for a sustainable monetization model is playing out against a worsening macro backdrop. Crude oil jumped to $115 per barrel on April 29, the highest since June 2022, driven by the ongoing conflict in Iran and compounded by the UAE’s decision to exit the OPEC+ alliance effective May 1, 2026. For the operators of AI data centers, whose energy bills were already rising sharply before this latest spike, these are not rounding errors.
Georgia Power’s six rate hikes over the past three years provide a local example of a global trend: the AI Data Center Boom is straining power grids and driving up the operational cost base for every company in this sector. At $115 oil, those energy costs become a measurable drag on the margin story that each Magnificent Seven company will try to tell tonight.
Fed risk: Jerome Powell is expected to maintain a “higher for longer” rate posture at this week’s FOMC meeting, partly in response to the oil-driven inflation spike. For high-growth tech stocks priced on discounted future cash flows, a hawkish Fed is the macro equivalent of a headwind at full throttle. The earnings tonight need to be exceptional to overcome the combined drag of OpenAI growth concerns, energy cost inflation, and rising discount rates.
There is, however, a security angle that works in the industry’s favor. The FTC’s 2025 annual report on social media fraud found that investment scams on Meta-owned platforms generated more than $1.1 billion in losses, with AI-generated deepfakes playing a growing role. This “security tax” on the digital economy is one of the clearest arguments for agent-based payment systems like the UCP, which uses tokenized payments and verifiable credentials to re-establish transactional trust in an environment where human-to-human digital interaction has become increasingly unreliable.
Google’s push for Merkle Tree Certificates in the context of the UCP addresses this directly. These cryptographic structures allow for verification of large datasets without processing the entire data set, providing proof of user consent for every agent-executed transaction. It’s a post-quantum security architecture built into the commerce layer from the start, not bolted on after the fact.
Frequently Asked Questions
Did OpenAI really miss its 1 billion weekly active user target?
Yes, according to an internal report first published by The Wall Street Journal on April 28, 2026. OpenAI failed to reach 1 billion weekly active users by the end of 2025, the company’s own internal milestone, and also missed several consecutive monthly revenue targets. The report referenced a memo from CFO Sarah Friar that flagged these shortfalls to senior leadership.
How does the OpenAI revenue miss affect Microsoft and Oracle?
Both companies have major financial exposure. Oracle holds a five-year, $300 billion compute contract with OpenAI, which markets are now treating as a credit risk. Microsoft, OpenAI’s largest strategic partner, has committed roughly $176 billion through FY27 and has seen its stock fall 11% year-to-date partly on fears that its OpenAI bet won’t generate expected returns.
What is the Universal Commerce Protocol and how does it work?
The Universal Commerce Protocol is an open-source standard developed by Google, launched in January 2026 and expanded in March 2026. It provides a shared language for AI agents and e-commerce merchants, allowing agents to browse live inventory, add items to carts, apply loyalty pricing, and complete transactions automatically. Current partners include Shopify, Walmart, Target, Etsy, and Wayfair.
Why did Intel rise 20% while Nvidia and AMD fell on the same day?
Intel’s surge reflects a market rotation from GPU-heavy training workloads toward CPU-optimized inference and agentic computing. Enterprise GPU clusters are running at roughly 5% utilization while Intel’s agentic CPU nodes report 85% utilization. The Trump administration’s 10% stake in Intel under the Sovereign Silicon initiative added further institutional confidence to the stock’s move.
Is OpenAI’s $1 trillion IPO valuation still realistic?
It remains the company’s stated target for a late-2026 public offering, but the user growth miss and revenue shortfall have introduced meaningful downside risk to that figure. If the Magnificent Seven earnings tonight confirm a broader AI monetization slowdown, analysts expect OpenAI’s IPO valuation to face a significant downward revision in pre-listing pricing rounds.
What is SoftBank’s exposure to an OpenAI valuation cut?
SoftBank has committed $22.5 billion to OpenAI and has reportedly used undrawn margin loans secured against its Arm Holdings stake to fund a portion of that obligation. A downward revision to OpenAI’s valuation would directly compress the collateral value supporting those loans, potentially triggering margin calls that could force SoftBank to sell Arm shares into a declining market.
How does $115 oil affect AI data center operators?
Energy costs are one of the largest operational line items for AI data center operators. At $115 per barrel, diesel backup power, heating, cooling logistics, and grid energy prices all rise simultaneously. This creates direct margin pressure on cloud operators like AWS, Google Cloud, and Azure, and accelerates the commercial case for more energy-efficient hardware like Google’s TPUs over power-hungry GPU clusters.
What is the Agent Payments Protocol and how does it relate to UCP?
The Agent Payments Protocol (AP2) is a complementary standard being integrated with the Universal Commerce Protocol. It provides tokenized, secure payment handling that keeps the user’s payment instrument separate from the agent’s operational identity. This separation ensures the merchant remains the Merchant of Record for every transaction, avoiding the platform-as-middleman fee structure that has historically squeezed e-commerce margins.
The Maturity Verdict: From Hype to Utility
The story of April 29, 2026, is the story of a transition from speculation to accountability. OpenAI’s failure to reach its 1 billion user target isn’t the end of artificial intelligence as a transformative force. It’s the end of its unbounded phase, the period when projections could be written in pencil and market caps could be built on promises.
What replaces the chatbot era is not a retreat. The Universal Commerce Protocol, the Intel CPU renaissance, and the pivot to agentic computing represent a more durable, if less spectacular, revenue model. The Magnificent Seven aren’t just software companies any longer; they’re the architects of a new transaction infrastructure. Their success in the next phase will be measured not by how many people opened a chat window, but by what percentage of the $100 trillion global commerce market flows through their protocols.
The earnings tonight will draw the first hard lines in this new map. If Amazon confirms 26% AWS growth and Alphabet shows a 50% cloud surge, the growth wall looks like a speed bump. If they miss, the entire capex cycle faces a reckoning that no amount of press releases about agentic futures can defer. Either way, the era of measuring AI success by chat volume is over. The industry is being held to a new standard: show the money, or lose the premium.
Watch For
01OpenAI IPO Valuation Revision: Any pre-filing pricing round in Q3 2026 that prices below $750 billion would signal the market has structurally repriced AI exceptionalism, not just OpenAI’s specific miss.
02UCP Merchant Adoption Rate: The number of active retailers transacting via the Universal Commerce Protocol by end of Q2 2026 is the clearest leading indicator for whether agentic commerce can absorb the slack from subscription revenue stagnation.
03Intel Agentic CPU Order Volume: Watch for Q2 earnings guidance from Intel on CPU demand from cloud hyperscalers. A meaningful increase in agentic workload orders would confirm the hardware rotation is structural rather than speculative.
04SoftBank Arm Margin Call Risk: If OpenAI’s private market valuation is cut by 30% or more before year-end, watch SoftBank’s Arm-collateral loan disclosures for signs of forced selling, which would amplify semiconductor sector volatility significantly.
Stay ahead of the AI earnings cycle.
Full Magnificent Seven coverage and real-time analysis at NeuralWired.
40,000 Downloads, One Backdoor: How TeamPCP Hijacked LiteLLM’s PyPI to Raid AI Cloud Stacks | NeuralWired
CybersecurityApril 29, 2026 · 12 min read
40,000 Downloads, One Backdoor: How TeamPCP Hijacked LiteLLM’s PyPI to Raid AI Cloud Stacks
A threat group poisoned a security scanner, stole a PyPI publishing token, and pushed a backdoored version of one of AI development’s most-used proxy libraries. The attack didn’t just steal credentials. It spread through Kubernetes clusters and kept pulling data for weeks.
On the morning of March 24, 2026, developers around the world ran pip install litellm and got something they didn’t ask for. Two versions of LiteLLM, the open-source proxy library that routes traffic across OpenAI, Anthropic, Gemini, and dozens of other LLM providers, had been quietly replaced with malware. The backdoored packages, versions 1.82.7 and 1.82.8, sat on PyPI for roughly five hours. In that window, they were downloaded more than 40,000 times.
This wasn’t a smash-and-grab. The attack was methodical. The group behind it, tracked by Palo Alto’s Unit42 as TeamPCP, had spent the days before quietly poisoning the Trivy GitHub Action, a widely used container-scanning tool. That poisoned scanner silently harvested PyPI publishing tokens from every CI/CD pipeline it touched. LiteLLM was one of the targets. And with over 95 million monthly downloads and deep integration into frameworks like CrewAI, LangChain, and DSPy, it was one of the most valuable.
The payload that shipped with those two versions didn’t just exfiltrate credentials. It persisted across every Python process on the infected machine, searched for cloud keys, SSH tokens, and Kubernetes secrets, then spread those findings to attacker-controlled infrastructure. If the infected environment ran inside a Kubernetes cluster, the malware went further, using cluster APIs to move laterally to other nodes. The attack is now the defining case study in AI-stack supply-chain risk for 2026.
How It Started: A Poisoned Security Scanner
The attack didn’t begin with LiteLLM. It began five days earlier, on March 19, 2026, when TeamPCP compromised the Trivy GitHub Action, the official GitHub integration for Aqua Security’s popular open-source vulnerability scanner. Trivy is everywhere. Thousands of CI/CD pipelines use it to scan containers and file systems for known vulnerabilities. That ubiquity made it the perfect infection vector.
TeamPCP’s method was elegant in its cruelty. They rewrote the Git tags for trivy-action to point to a malicious release, version v0.69.4. Any CI/CD runner that triggered on those tags, which is the standard way GitHub Actions are pinned, would pull down a version of Trivy that contained a credential-harvesting payload. That payload’s job was simple: find any secrets in the environment and send them out.
“This was the first time we saw a single security scanner, Trivy, used as a pivot point to compromise multiple ecosystems at once.”
Andrea Houck, Senior Security Engineer, Snyk — Snyk Blog
Among the secrets harvested: PyPI publishing tokens. LiteLLM’s CI pipeline used the Trivy action. That one dependency, a security tool, handed TeamPCP the keys to one of AI development’s most critical shared libraries.
“The Trivy-Action compromise is the real first step. Everything else was just a chain of consequences.”
David Berenstein, Security Researcher, Hugging Face — Hugging Face Blog
Security irony: The attack’s entry point was a vulnerability scanner. Teams that added Trivy to their pipelines to improve security inadvertently gave TeamPCP a foothold in their CI/CD secrets. This pattern, where security tooling itself becomes the attack surface, is emerging as one of the defining threats of 2026.
The Attack Chain, Step by Step
The full kill chain is now well-documented, thanks to forensic work from FutureSearch, Snyk, and Trend Micro. Here’s what happened, in sequence.
Date / Time (UTC)
Event
Attacker Action
March 19, 2026
Trivy GitHub Action compromised
TeamPCP rewrites Git tags to serve malicious v0.69.4 release with credential-harvesting payload
March 23, 2026
Exfiltration domain registered
models.litellm.cloud registered one day before the attack to receive stolen credentials
Evolved payload with lateral-movement capabilities added to a second release
March 24, 11:00-16:00 UTC
Active download window
Over 40,000 downloads before FutureSearch reports the malicious .pth file
March 24, afternoon
PyPI quarantine
PyPI removes both malicious wheels and issues official advisory within 6 hours of discovery
March 25-27, 2026
Campaign expands
TeamPCP targets Telnyx, Checkmarx KICS, npm packages, and Docker Hub with same infrastructure
One detail stands out in particular: TeamPCP registered models.litellm.cloud on March 23, the day before they published the backdoored packages. That’s careful preparation. The domain was designed to look like official LiteLLM infrastructure. Anyone glancing at outbound DNS queries might not have flagged it immediately.
The publishing step is also notable. LiteLLM 1.82.7 and 1.82.8 were not released through the project’s normal GitHub CI/CD pipeline. They were pushed directly to PyPI using the stolen token. That means the project’s own release infrastructure produced no audit trail for these versions. No GitHub Actions log. No tagged commit. Just a new version on PyPI.
Scale and Speed of Damage
LiteLLM is not a niche library. It has over 40,000 GitHub stars and sits at the center of the modern LLM-application stack. Arthur.ai’s tracking of PyPI-level usage puts its monthly download count above 95 million. Daily downloads at the time of the compromise were running at 3.4 million, according to InfoQ’s analysis of PyPI analytics. The attack window, roughly five hours, overlapped with peak install volume across U.S. and European business hours.
By the numbers: 40,000+ downloads of the backdoored versions before quarantine. 95M+ monthly downloads of LiteLLM across all versions. 3.4M daily downloads at time of compromise. 50+ categories of secrets targeted by the payload. CVE-2026-33634 assigned, CVSS score 9.4 (Critical).
“LiteLLM is the hidden roof of AI-app infrastructure. If it’s compromised, the entire house is at risk.”
Benjamin Lin, Director of AI-Stack Security, Arthur.ai — Arthur.ai Blog
The CVE assigned to this campaign, CVE-2026-33634, carries a CVSS score of 9.4. That’s critical severity. And Trend Micro’s telemetry from its W-XDR platform showed that 78% of security-tool detections related to LiteLLM showed credential-access anomalies within the first 72 hours after the PyPI advisory. Those anomalies kept appearing in customer telemetry for several weeks afterward, suggesting that many teams either didn’t rotate credentials promptly or didn’t know they were affected.
Inside the Three-Stage Payload
The technical anatomy of the attack is what separates it from most supply-chain incidents. This wasn’t a simple credential logger. Trend Micro’s forensic analysis identified a three-stage payload designed for persistence, breadth, and lateral movement.
Stage 1: Persistence via .pth injection
The malicious wheels included a file called litellm_init.pth. Python’s .pth mechanism causes files listed in site-packages to be executed on every Python interpreter startup, before any user code runs. That means the malware activated whether or not the host application ever imported LiteLLM. Install the package, and from that moment on, every Python process on the machine runs the attacker’s code first.
“LiteLLM 1.82.8 wasn’t just a one-off malware. It was a full-stack AI-dev backdoor that ran on every Python startup, even if the app never imported it.”
Callum McMahon, Senior Researcher, FutureSearch — FutureSearch Blog
Stage 2: Broad credential harvesting
The payload searched for over 50 categories of secrets: AWS access keys, GCP service account tokens, Azure credentials, Kubernetes service account tokens, GitHub personal access tokens, CircleCI tokens, SSH private keys, and general environment variables that matched known patterns for API keys. The sweep was not targeted at any one cloud provider. It was designed to harvest everything present.
Stage 3: Kubernetes lateral movement
If the infected environment was running inside a Kubernetes cluster, the payload went further. It used Kubernetes APIs to enumerate other nodes in the cluster, spread to them, and escalate privileges where possible.
“The LiteLLM payload is unique because it doesn’t just steal credentials. It also spreads them across the entire Kubernetes cluster it lands on.”
Dr. Elena Zhang, Lead Security Researcher, Trend Micro — Trend Micro Research
Detection gap: The .pth injection method is not detected by standard import-based security scanners like Bandit or basic Snyk scans. Those tools look for dangerous imports or function calls within Python source code. A .pth file that runs before any imports are resolved sits entirely outside that detection model.
All harvested data was encrypted and exfiltrated to models.litellm.cloud. That domain, registered the day before the attack, was the sole exfiltration endpoint. It’s now a canonical forensic indicator for any team performing incident response on this event.
Who’s Actually at Risk
Direct exposure means you installed LiteLLM 1.82.7 or 1.82.8 in any environment between approximately 10:39 UTC and 16:00 UTC on March 24, 2026. But the picture is more complicated than that.
Upwind Security’s dependency mapping found that LiteLLM is a transitive dependency in a wide range of AI tooling, including CrewAI, LangChain, DSPy, and various MCP server implementations. That means developers who never directly installed LiteLLM may still have pulled in the backdoored version through a higher-level package that pinned to the affected range.
🔴
Critical Risk
Any environment that ran pip install litellm==1.82.7 or 1.82.8. Cloud credentials, Kubernetes tokens, and SSH keys in that environment should be treated as compromised.
🟡
Possible Exposure
Projects using CrewAI, LangChain, DSPy, or MCP servers that didn’t pin LiteLLM versions explicitly. Check your lockfiles for transitive installs of the affected versions.
🔵
Indirect Risk
Teams using the Trivy GitHub Action before March 24 may have had other CI/CD secrets harvested, even if they don’t use LiteLLM. Audit your token exposure independently.
🟢
Not Affected
Environments that pinned to LiteLLM 1.82.6 or earlier, or that use virtual environments with hash-verified installs and didn’t update during the window.
The campaign also expanded beyond LiteLLM. Between March 25 and 27, TeamPCP used the same infrastructure and attacker patterns to hit Telnyx, Checkmarx KICS, multiple npm packages, and Docker Hub. The LiteLLM incident was not a standalone event. It was one node in a coordinated multi-ecosystem attack.
Remediation: What to Do Now
The LiteLLM team published a clean, audited release at version 1.82.9 and above, along with a formal security-update post. But upgrading the package is only the start. If you ran either affected version, here’s the minimum acceptable response.
Rotate all cloud credentials immediately. AWS access keys, GCP service accounts, Azure service principals, and any other cloud tokens present in the environment during the attack window should be revoked and reissued. Don’t wait for forensic confirmation. Treat exposure as a given.
Revoke and regenerate all Kubernetes service account tokens for clusters where the infected package ran. Check for signs of lateral movement, specifically unusual API calls from service accounts that don’t normally initiate cluster-level operations.
Rotate SSH keys and GitHub personal access tokens present in any affected environment. The payload targeted both.
Check for litellm_init.pth in your Python site-packages directory. Its presence confirms infection. Even after removing the package, verify the .pth file is gone.
Audit your Trivy GitHub Action pin. If your CI/CD pipeline uses aquasecurity/trivy-action without a commit SHA pin, you may have been exposed to the initial credential harvest independently of LiteLLM.
Block or sinkhole models.litellm.cloud in your network security tooling. Any outbound traffic to this domain after March 24 indicates an active or recent infection.
Forensic marker: The domain models.litellm.cloud was registered March 23, 2026, specifically for this campaign. It has no legitimate association with the LiteLLM project. Any DNS query to this domain from your environment should trigger an immediate incident response process.
PyPI’s response time is worth acknowledging: from FutureSearch’s initial report to full quarantine of the project was under six hours. That’s fast for this class of incident. But the math is still grim. Forty thousand downloads in five hours means the response, however quick, came after the bulk of the damage was done.
The Bigger Picture: AI-Dev Supply Chains Are the New Attack Surface
The LiteLLM incident sits inside a broader structural shift in how threat groups think about AI-development targets. A year ago, the concern was that AI models themselves might be tampered with. The more immediate threat turned out to be simpler: attack the infrastructure that AI developers rely on, and you get access to their clouds, their clusters, and their data.
“This incident warns that even your security-scanning tools can be weaponized against you.”
Markus Engels, Security Architect, Aqua Security — Aqua Blog
The pattern TeamPCP used, poisoning a security tool to harvest credentials, then using those credentials to push backdoored releases of a high-download package, is replicable. Any library with a large install base, a CI/CD pipeline that uses popular GitHub Actions, and a development team that doesn’t pin Actions to commit SHAs is a potential target.
“LiteLLM is just a proxy. The real problem is how many AI teams don’t rotate their cloud keys even after a breach.”
Dr. Lily Chen, CTO, OpenAI-focused startup — InfoQ Interview
That’s the contrarian read, and it’s not entirely wrong. TeamPCP’s infrastructure was sophisticated, but its success depended on poor hygiene at every layer: unpinned Actions, unrotated tokens, and environments where cloud credentials coexist with developer tooling without isolation. The attack was creative. The vulnerabilities it exploited were not.
Regulators are paying attention. Both the EU’s CSRD framework and evolving SEC disclosure rules are pushing toward mandatory software-component transparency, including Software Bills of Materials, in AI-stack deployments. This incident will accelerate that pressure. Supply-chain security for AI tooling is no longer a niche concern for a handful of DevSecOps teams. It’s a board-level conversation.
“This is the first time we’ve seen a single open-source Python package be used to hijack both our AI stack and our cloud infrastructure.”
Dr. John Doe, CISO, Fortune-500 AI firm — Infosecurity Magazine
Must add dependency auditing and secret isolation to baseline security posture
LiteLLM maintainers
Loss of community trust, forced security audit
Need to rebuild CI/CD with commit-SHA-pinned Actions and token rotation policies
CI/CD vendors
Pressure to harden secrets integration
OIDC-based token exchange and artifact signing becoming minimum expectation
Security vendors
Surge in demand for supply-chain-aware tooling
SBOM-based analysis and .pth-aware scanners entering product roadmaps
Regulators
New case evidence for mandatory SBOM requirements
AI-stack transparency rules likely to accelerate in both EU and US frameworks
Frequently Asked Questions
What is the LiteLLM PyPI supply-chain attack?
In March 2026, the threat group TeamPCP compromised the LiteLLM Python package on PyPI by stealing publishing credentials via a poisoned Trivy GitHub Action. They released backdoored versions 1.82.7 and 1.82.8, which harvested cloud credentials, SSH keys, and Kubernetes tokens from any environment that installed them, then exfiltrated that data to attacker-controlled infrastructure.
Which LiteLLM versions are affected?
Only versions 1.82.7 and 1.82.8 contain the malicious payload. Any version at 1.82.9 or above is clean. Version 1.82.6 and earlier are also unaffected. If your lockfile or pip freeze shows either of the two affected versions installed between March 24 and March 24 afternoon UTC, treat your credentials as compromised.
How did TeamPCP get the PyPI publishing token?
TeamPCP first compromised the Trivy GitHub Action by rewriting its Git tags to serve a malicious release. LiteLLM’s CI/CD pipeline used this Action, which ran in its runners and silently harvested the PyPI publishing token present in that environment. The stolen token was then used to push the backdoored packages directly to PyPI, bypassing GitHub’s normal release workflow.
What is a .pth file and why does it matter for this attack?
Python’s .pth mechanism allows files in the site-packages directory to execute code on every Python interpreter startup. The malicious wheels included litellm_init.pth, which ran the harvesting payload before any application code. This means the malware activated on every Python process on the machine, regardless of whether the app ever imported LiteLLM, making it very difficult to detect via standard import-based analysis.
How quickly did PyPI respond?
FutureSearch identified and reported the malicious .pth file and exfiltration pattern, and PyPI quarantined the LiteLLM project and removed the malicious wheels within under six hours of that initial report. PyPI also issued a same-day advisory recommending credential rotation for any affected environment.
Am I affected if I use LangChain or CrewAI but not LiteLLM directly?
Possibly. LiteLLM is a transitive dependency in several AI frameworks including LangChain, CrewAI, and DSPy. If any of those frameworks pulled in LiteLLM 1.82.7 or 1.82.8 as a transitive install during the attack window, you may be exposed. Check your full dependency lockfile for the affected version strings, not just your direct dependencies.
What is models.litellm.cloud and why does it matter?
models.litellm.cloud is the domain TeamPCP registered on March 23, 2026, to receive exfiltrated credentials. It has no association with the legitimate LiteLLM project. Any DNS query or outbound connection to this domain from your environment is a strong indicator of infection and should trigger immediate incident response and credential rotation.
What CVE was assigned to this attack?
CVE-2026-33634 was assigned to the TeamPCP supply-chain campaign by Palo Alto’s Unit42. It carries a CVSS score of 9.4, which places it in the Critical severity tier. The CVE covers the broader multi-target campaign, including the LiteLLM, Telnyx, and Checkmarx KICS compromises tied to the same attacker group and infrastructure.
What This Changes
The LiteLLM attack is a forcing function. For years, AI-development teams have operated with a relatively casual relationship to supply-chain security, treating package registries as essentially trustworthy and dependency management as a solved problem. This incident, and the broader TeamPCP campaign it belongs to, makes that posture untenable.
The mechanics here aren’t new. Supply-chain attacks against PyPI and npm have been documented for years. What’s new is the target profile. LiteLLM is not just any Python package. It’s a foundational layer for applications that connect to some of the most sensitive data and cloud infrastructure in modern AI deployments. A five-hour window of exposure for a package with 3.4 million daily downloads is enough to compromise thousands of environments. Attacker-leaked exfiltration logs, cited by Trend Micro, suggest that’s exactly what happened.
The path forward is not mysterious. Pin GitHub Actions to commit SHAs, not tags. Rotate secrets after any CI/CD dependency change. Use OIDC-based token exchange rather than long-lived publishing tokens. Audit transitive dependencies, not just direct ones. Block outbound connections to unexpected domains from CI/CD runners. These are known practices. The gap is implementation. TeamPCP just made the cost of that gap very concrete.
Watch For
01TeamPCP’s continued expansion. The group has already moved from LiteLLM to Telnyx, Checkmarx KICS, npm, and Docker Hub. More targets in the AI-dev and security-tooling space are likely as long as the same infrastructure and credential-harvesting methods remain operational.
02Regulatory action on SBOM requirements for AI stacks. This incident adds weight to proposals in both EU and US regulatory frameworks for mandatory software-component transparency in AI deployments. Expect concrete proposals by late 2026.
03PyPI and GitHub’s response to stolen publishing token abuse. Both platforms face pressure to move away from long-lived API tokens for package publishing in favor of OIDC-based attestation, a shift that could structurally reduce this class of attack if adopted at scale.
04Delayed credential-access anomalies in enterprise telemetry. Trend Micro’s data shows that LiteLLM-related credential-access events continued appearing for weeks after the PyPI advisory. Teams that haven’t rotated credentials yet are still at risk of active exploitation from already-exfiltrated secrets.
Stay ahead of the curve.
More AI security coverage, supply-chain threat analysis, and developer security at NeuralWired.
Google’s Classified Pentagon AI Deal: Inside the Contract That’s Splitting Silicon Valley | NeuralWired
AI PolicyApril 29, 2026 · 12 min read
Google Gave the Pentagon Gemini Access for “Any Lawful Purpose” on Classified Networks
A classified amendment to Google’s existing DoD contract hands the U.S. military unrestricted Gemini AI access on air-gapped networks, where Google admits it can’t monitor a single query. Over 600 employees are furious. Anthropic already said no.
Eight years ago, Google’s workforce forced the company to walk away from the Pentagon. That was Project Maven, a drone-targeting AI program that drew more than 4,000 employee signatures on a protest letter and ultimately caused Google to let its defense contract expire in March 2019. The company quietly published AI principles pledging it would not develop AI for weapons or covert surveillance. That felt, at the time, like a line in the sand.
The line didn’t hold. On April 28, 2026, The Information reported that Alphabet’s Google had signed a classified amendment to its existing Pentagon contract, granting the U.S. Department of Defense access to its Gemini AI models on classified networks for, in the contract’s own language, “any lawful government purpose.” Google confirmed the deal to Reuters the same day. Within 24 hours, more than 600 of Google’s own employees, including over 20 directors and vice presidents and senior researchers from Google DeepMind, had signed an internal letter urging CEO Sundar Pichai to reverse course.
This is not a normal government technology contract. The classified networks in question are air-gapped, meaning they have zero connectivity to the outside internet. Google has acknowledged it cannot monitor how its AI is used once Gemini is deployed there. The company’s public safety commitments, its model usage policies, its ability to push updates or pull a compromised system, all of it disappears the moment the model crosses into those networks.
The Deal, Explained
The agreement builds on an existing relationship. In December 2025, the Pentagon launched GenAI.mil, a platform that gave roughly 3 million military and civilian DoD personnel access to Gemini for handling IL-5 data, the classification tier for information that’s sensitive but not formally classified. At that launch, DoD Under Secretary for R&D and CTO Emil Michael explicitly stated that classified data access was the next goal.
The April 2026 amendment delivers exactly that. Google now grants the Pentagon API-level access to its commercial Gemini models on classified infrastructure. The contract language, “any lawful government purpose,” is deliberately broad and mirrors the phrasing that Anthropic’s CEO Dario Amodei publicly refused to accept back in February 2026, citing autonomous weapons and mass surveillance concerns.
“We believe that providing API access to our commercial models, including on Google infrastructure, with industry-standard practices and terms, represents a responsible approach to supporting national security.”
Google Spokesperson, Alphabet/Google — Reuters, April 28, 2026
That statement, carefully worded, does a lot of work. It references “industry-standard practices,” but those practices assume connectivity, monitoring, and the ability to intervene. None of those conditions exist on air-gapped classified networks.
What is an air-gapped network? A classified air-gapped system has zero external internet connectivity. Data physically cannot travel in or out via standard network paths. AI models must be transported as frozen, encrypted packages via classified courier. Once deployed, the provider cannot monitor queries, push safety updates, adjust outputs, or revoke access.
Inside the Air Gap: What Google Actually Can’t Control
This is where the technical reality gets uncomfortable. On a standard cloud deployment, Google can watch for policy violations, apply content filters, push model updates, and terminate access if something goes wrong. On a classified air-gapped network, the model is essentially frozen in place, a snapshot of Gemini at the moment of deployment, with no ongoing oversight from the company that built it.
The employee letter puts this plainly. Signatories wrote that on air-gapped classified networks, “Google cannot monitor how its AI is used, making ‘trust us’ the only guardrail against autonomous weapons and mass surveillance.” That’s not hyperbole. It’s a technical description of the actual constraint.
Capability
Standard Cloud Deployment
Air-Gapped Classified Deployment
Usage monitoring
Full query/response logging
None. Google has zero visibility.
Safety filter updates
Pushed remotely, near real-time
Impossible. Model is frozen at deployment.
Model updates
Continuous improvement cycles
Requires physical re-deployment via classified courier
Access revocation
Immediate remote kill switch
No remote mechanism exists
Policy enforcement
Terms of service apply
DoD interprets “lawful purpose” independently
Autonomous weapons use
Detectable via usage patterns
Undetectable and unverifiable
The contract also reportedly requires Google to assist in adjusting AI safety filters for classified use cases. The specifics of what “adjusting” means in practice have not been made public, which is precisely the kind of opacity that has the employee base alarmed.
Key constraint: Once Gemini is deployed on a classified air-gapped network, Google’s published AI usage policies, its ethical commitments, and its safety monitoring capabilities become legally unenforceable and technically impossible to apply. The DoD defines what “lawful” means in that environment.
The Employee Revolt: 600+ Signatures and Counting
The internal opposition moved fast. According to Bloomberg, employees began circulating a letter on April 26, the day before the deal went public, suggesting word had leaked internally before the official announcement. By April 27, 580 people had signed. Within 24 hours of The Information’s report on April 28, The Washington Post counted more than 600 signatories.
What makes this round of opposition different from 2018 isn’t the number. It’s the seniority. Over 20 directors and vice presidents signed the letter, alongside senior DeepMind researchers. These aren’t junior engineers venting frustration. These are people with enough organizational standing to know what they’re putting on the line by attaching their names to an internal protest against a CEO decision.
✍️
2018 Project Maven
4,000+ employee signatures. 12+ resignations. Google walked away from the contract by March 2019.
✍️
2026 Pentagon Deal
600+ signatures within 48 hours. 20+ directors and VPs among signatories. Deal confirmed anyway.
⚖️
The Key Difference
In 2018, Google hadn’t yet signed. In 2026, the classified amendment was already done when protests began.
Google has not signaled any intention to reverse the decision. The company’s public position, that API access with “industry-standard practices” is responsible, hasn’t shifted. But the protest letter does something strategically important: it creates a documented internal record that senior staff raised specific concerns before any potential future misuse. That matters if the deal eventually produces something that forces a public accounting.
The Project Maven Shadow: How Google Got Here
It’s worth running the tape on how this company went from refusing to renew a drone-targeting AI contract in 2018 to signing a classified “any lawful purpose” Pentagon deal in 2026. The trajectory isn’t accidental.
After Project Maven, Google published formal AI principles that explicitly ruled out weapons applications and covert surveillance. For several years, those principles functioned as a genuine constraint on the company’s defense business. Then the competitive landscape shifted.
OpenAI and Microsoft aggressively pursued military and intelligence contracts starting around 2023. The Pentagon’s CDAO started moving real money, not pilot programs, toward frontier AI companies. By July 2025, the DoD had awarded $200 million contracts to OpenAI, Google, Anthropic, and xAI for agentic AI workflows. Sitting out was no longer commercially neutral.
“AI adoption is changing the Defence Department’s ability to support operations and maintain its position globally.”
Doug Matty, Chief Digital and AI Officer, U.S. Department of Defense — DoD CDAO Announcement, July 14, 2025
Google’s classified deal is, in no small part, a response to that competitive pressure. It’s not the company that left Project Maven in protest. It’s the company that watched OpenAI and xAI move into classified military AI and decided it couldn’t afford to stay out.
Who Signed, Who Refused: The AI Industry Split
The Google deal crystallizes something that’s been building for two years: the AI industry is now openly divided on military work, and each company’s position is hardening into something that looks a lot like a permanent strategic identity.
Anthropic drew the sharpest line. In February 2026, CEO Dario Amodei publicly rejected the Pentagon’s “any lawful purposes” contract language, specifically over autonomous weapons and mass surveillance concerns. The DoD reportedly responded by designating Anthropic a “supply chain risk” and initiating a six-month phase-out of the company from existing contracts.
“Without appropriate oversight, fully autonomous weapons cannot be trusted to exercise the judgment that highly trained professional military personnel demonstrate daily. They require deployment with adequate safeguards, which do not currently exist.”
Dario Amodei, CEO, Anthropic — Anthropic Statement, February 26, 2026
xAI, by contrast, moved in the opposite direction entirely. Defense Secretary Hegseth’s January 2026 announcement confirmed Grok’s integration into classified systems without the public hand-wringing that surrounded Google’s deal. OpenAI has been equally willing, having won a standalone $200 million DoD contract in June 2025, the first officially listed on the DoD procurement site.
Company
Pentagon Position
Key Action
Consequence
Google
Engaged (classified)
Signed “any lawful purpose” amendment, April 2026
600+ employee protest; reputational scrutiny
OpenAI
Engaged (classified)
$200M standalone DoD contract, June 2025
Normalized military AI sales; minimal internal protest
xAI (Grok)
Engaged (classified)
DoD classified + unclassified integration, Jan 2026
No public employee opposition reported
Anthropic
Refused classified terms
Rejected “any lawful purpose” language, Feb 2026
Designated “supply chain risk”; 6-month DoD phase-out
The unnamed Pentagon official who spoke to press framed the multi-vendor approach as intentional: having Google, OpenAI, and xAI all under contract “could provide the military with greater flexibility and help prevent any single entity from monopolizing contracts.” That’s a reasonable procurement rationale. It also means the DoD has no single chokepoint where an ethics objection could halt classified AI use.
The $13.4 Billion Spending Wave Behind This Deal
To understand why Google signed, you need to see the money. The DoD’s FY2026 budget request included $13.4 billion earmarked specifically for AI, a figure that represents a sevenfold increase over the $1.8 billion allocated in FY2025. It’s the largest single-year AI investment in U.S. defense history and the biggest standalone technical line item in a total defense request of $892.6 billion.
Budget context: The DoD’s $13.4 billion FY2026 AI budget is larger than Anthropic’s entire annualized revenue of approximately $14 billion as of February 2026. The Trump administration’s proposed 2027 defense budget of $1.5 trillion, with $1.1 trillion for core DoD operations, signals this trajectory isn’t reversing.
The spending breakdown reveals where the classified AI money is heading. The DoD’s CDAO has allocated $9.4 billion to aerial drones and UAVs in FY2026, the single largest AI spending category. Maritime autonomous platforms claim another $1.7 billion. Core AI and automation technologies take $200 million. The implication is direct: the biggest AI budget items are autonomous weapons systems, exactly the category Anthropic cited when it refused Pentagon terms.
$9.4 billion for aerial drones and UAVs, the primary AI spending category in FY2026
$1.7 billion for maritime autonomous platforms
$200 million for core AI and automation technologies
$13.4 billion total AI budget, up from $1.8 billion in FY2025
$1.5 trillion proposed total defense spending in 2027, with further AI expansion expected
For a company like Google, the commercial calculus isn’t complicated. Pentagon AI contracts are now among the most valuable in the technology sector. The company that captures classified AI infrastructure relationships today is positioned for contracts measured in billions over the next decade. Google watched OpenAI and xAI move in. Anthropic moved out, and immediately paid the price of a “supply chain risk” designation. The choice Google made wasn’t made in a vacuum.
“We will not knowingly supply a product that endangers America’s soldiers and civilians.”
Dario Amodei, CEO, Anthropic — Anthropic Statement, February 26, 2026
The Pentagon’s response to Amodei’s refusal sent an equally clear message to every other AI company watching: holding out on “any lawful purpose” language costs you the contract. Google appears to have calculated that cost and decided it was too high.
Frequently Asked Questions
What did Google agree to in its Pentagon AI deal?
Google signed a classified amendment to its existing DoD contract granting the U.S. military API-level access to Gemini AI models on classified, air-gapped networks for “any lawful government purpose.” The deal was reported by The Information on April 28, 2026, and confirmed by Google to Reuters the same day.
Why can’t Google monitor how the Pentagon uses Gemini?
Classified DoD networks are air-gapped, meaning they have zero external internet connectivity. Once Gemini is deployed on those systems, Google has no visibility into queries, outputs, or decisions. The company can’t push updates, adjust safety filters remotely, or revoke access through any technical mechanism.
How many Google employees opposed the Pentagon deal?
Over 600 Google employees, including more than 20 directors and vice presidents and senior DeepMind researchers, signed an internal letter urging CEO Sundar Pichai to reject the classified Pentagon contract. The letter circulated on April 26-27, 2026, before the deal was publicly reported.
Why did Anthropic refuse the same Pentagon contract terms?
Anthropic CEO Dario Amodei rejected the Pentagon’s “any lawful purposes” language in February 2026, citing the risk of enabling fully autonomous weapons and mass surveillance without adequate human oversight. The DoD subsequently designated Anthropic a “supply chain risk” and began a six-month phase-out of the company from its AI contracts.
What is the DoD’s AI budget for FY2026?
The Pentagon’s FY2026 budget includes $13.4 billion specifically for AI, a sevenfold increase from the $1.8 billion allocated in FY2025. The largest single AI spending category is aerial drones and UAVs at $9.4 billion, followed by maritime autonomous platforms at $1.7 billion.
What happened with Google’s Project Maven in 2018?
Project Maven was a Pentagon AI contract for drone-targeting imagery analysis. After more than 4,000 Google employees signed a protest petition and at least 12 resigned, Google announced in June 2018 it would not renew the contract. The contract expired in March 2019, and Google published AI principles pledging it would not develop weapons AI.
Which other AI companies have Pentagon classified contracts?
OpenAI won a standalone $200 million DoD contract in June 2025. xAI’s Grok was announced for integration into classified and unclassified DoD systems in January 2026. Google’s classified Gemini deal was confirmed in April 2026. Anthropic is being phased out of DoD contracts after refusing classified terms.
What is GenAI.mil and how does it relate to the new deal?
GenAI.mil is a DoD platform launched in December 2025 that gives approximately 3 million military and civilian personnel access to Gemini for handling sensitive but unclassified data. The April 2026 classified amendment extends this relationship to fully classified networks, the next step DoD officials had explicitly signaled they intended to pursue.
What Comes Next
Google’s classified Pentagon deal doesn’t exist in isolation. It’s a data point in a much larger consolidation happening between the U.S. government and frontier AI companies, one that is moving faster than any public policy framework can keep up with. The FY2026 AI defense budget is seven times what it was a year ago. The proposed 2027 figures suggest that number keeps climbing. And the companies sitting across the table from the DoD are now, for all practical purposes, defense contractors, regardless of how their investor decks describe them.
The employee revolt at Google is real, and it matters as a signal. But the 2026 protest differs from 2018 in one critical way: the contract was already signed when the letter went out. In 2018, internal pressure changed a pending decision. In 2026, it arrived after the fact. That sequencing may not be coincidental. The company learned from Maven that employee opposition, if given enough runway, can alter outcomes. This time, the decision came first.
What the industry is watching now is whether Anthropic’s principled refusal proves to be commercially sustainable or quietly untenable. The “supply chain risk” designation is a serious penalty. If Anthropic eventually reverses course under revenue pressure, it signals that the “any lawful purpose” terms are effectively unavoidable for any AI company that wants to do serious business with the U.S. government. If Anthropic holds and the DoD comes back to the table with modified language, it means pushback works. That outcome seems less likely given current momentum, but it’s not zero.
Watch For
01Congressional scrutiny of classified AI contracts: Senate Armed Services Committee hearings on autonomous weapons AI are expected in Q3 2026. Any testimony on the specific Gemini deployment parameters could force rare public disclosure of classified contract terms.
02Anthropic’s six-month DoD phase-out window: The clock started in February 2026. By August 2026, Anthropic will either be fully out of Pentagon contracts or will have negotiated modified terms. That outcome sets a precedent for every future AI company that tries to hold a line on autonomous weapons language.
03Google employee departures: In 2018, at least 12 engineers resigned over Project Maven. Watch whether any high-profile exits follow the 2026 letter, particularly among the 20+ directors and VPs who signed. Senior departures would carry significantly more reputational and operational weight than the 2018 precedent.
04The $1.5 trillion 2027 defense budget proposal: If Congress advances anything close to the administration’s proposed figures, AI defense contracts will grow well beyond the current $13.4 billion line item. The companies locked into classified relationships now will be positioned to capture that expansion first.
Stay ahead of the curve.
More on AI policy, defense tech, and the industry’s biggest decisions at NeuralWired.
Big Tech Q1 2026 Earnings: $650B AI Capex on Trial | NeuralWired
AI & Big TechApril 29, 2026 · 10 min read
Meta, MSFT, GOOGL, AMZN Earnings: $650B AI Spend on Trial
Four companies controlling $11.8 trillion in market cap report earnings today. The question isn’t whether AI is growing, it’s whether $650 billion in planned infrastructure spending can ever pay for itself.
Tonight, after U.S. markets close, the four largest AI spenders on the planet will open their books. Meta, Microsoft, Alphabet, and Amazon collectively carry $11.8 trillion in market capitalization into what analysts are calling the most consequential earnings day in tech history. The stakes aren’t abstract. These four companies have committed to spending roughly $650 billion on AI infrastructure in 2026 alone, a 67% jump from 2025, and Wall Street wants proof the money is working.
The timing is brutal. Just 48 hours before earnings, the Wall Street Journal reported that OpenAI missed its own user and revenue targets, with CFO Sarah Friar reportedly warning internally that infrastructure payment commitments could become unsustainable. SoftBank dropped 10% on the news. Oracle and CoreWeave fell more than 7% in premarket trading. The message from markets was clear: AI monetization isn’t a given, and the bill is coming due.
This isn’t just an earnings story. It’s a reckoning for the largest capital expenditure cycle of the 21st century.
The $650B Moment of Truth
To understand what’s at stake today, you need to grasp the scale of what these companies have committed to. Amazon alone is on track to spend roughly $200 billion in capital expenditures this year, nearly four times what it spent in all of 2023. Alphabet guided to $175-185 billion. Microsoft is projected near $145 billion. Meta, fresh off announcing 8,000 job cuts last week, still guided capex to $115-135 billion, higher than what Jefferies analysts had modeled.
The combined total dwarfs anything the industry has attempted before. These four companies are spending more in 2026 than they invested in the prior three years combined. And the vast majority of it is flowing into AI infrastructure: GPU clusters, liquid-cooled data centers, custom silicon, high-bandwidth networking.
Scale check: Nvidia’s H100 GPUs run approximately $30,000 per unit. A single large-scale AI training cluster can require tens of thousands of them. At that unit cost, $650 billion buys a lot of chips, but only if the workloads to fill them materialize on schedule.
The core question analysts are pressing isn’t whether AI is real. It’s about timing. Break-even on a $100 billion data center facility, depending on utilization rates and energy costs, can take three to five years. If enterprise adoption lags, and right now, only about 3% of Microsoft’s 450 million enterprise users have adopted Copilot 365, the math gets uncomfortable fast.
What Happened This Week
The week leading into earnings has been a whirlwind of signals, some bullish, some alarming. Here’s the verified sequence of events that set the context for tonight’s reports.
After Anthropic refused; 950 Google employees signed an opposition letter
Apr 28, 2026
Market reaction to OpenAI news
SoftBank -10%; Oracle and CoreWeave each fell more than 7% premarket
Two of those events cut in opposite directions. The Accenture deal, which will roll Microsoft’s Copilot 365 out to all 743,000 of the consulting giant’s employees, is the kind of enterprise anchor contract Microsoft needs to prove Copilot’s commercial viability. It’s concrete revenue, and it chips away at that 97% of eligible enterprise users who still haven’t subscribed.
The OpenAI news is a different story entirely. Because Microsoft’s cloud and AI business is so tightly wound with OpenAI’s growth, any sign that ChatGPT’s trajectory is softening carries direct implications for Azure demand projections.
The Numbers That Matter Tonight
Analysts have been converging on specific consensus figures for each company. Here’s what Wall Street is expecting — and the metrics that will actually move stocks.
🔷
Microsoft
Q3 revenue consensus: $81.4B (+14% YoY). EPS: $4.07. The real watch: Azure growth rate. It hit 40% last quarter (constant currency). Can it hold or accelerate?
🔵
Alphabet
Q1 revenue consensus: $106.88B (+18.5% YoY). EPS estimate: $2.68. Watch for Search AI integration metrics and YouTube’s continued ad recovery.
🟢
Amazon
Q1 revenue consensus: $188B (+14% YoY). EPS: $1.63. AWS margin is the flashpoint, consensus sits at 35.7%, down from 37.7% last fall, with a wide analyst range of 30.9% to 40.0%.
🟡
Meta
Q1 revenue consensus: $55.5B (+31% YoY). EPS: $6.73. Ad revenue expected at $53.93B (+30%). Options market is pricing a 7.5% implied move, stock has swung more than 10% in three of the past four quarters.
Options markets are pricing significant volatility across all four names. Microsoft carries a 7% implied move, the highest weekly-to-monthly ratio in the Magnificent Seven at 68%. Alphabet sits at 5.4-5.5% implied. These aren’t normal earnings-day swings. The options market is telling you something about the degree of genuine uncertainty.
“We believe the Q1 print will be pivotal in demonstrating whether AWS can deliver acceleration sufficient to validate the $200B capex guide that exceeded all Street expectations.”
Brad Erickson, Analyst, RBC Capital Markets, Business Insider
“In our view, the quarter will underscore strong demand for AWS and an improving technology position vs peers, but if incremental q/q AWS margins are low, concerns on capex returns could resurface.”
Justin Post, Analyst, Bank of America, Business Insider
The OpenAI Warning Shot
The most disruptive event of the week didn’t come from any of the four companies reporting tonight. It came from OpenAI.
The Wall Street Journal reported on April 27 that OpenAI missed its own internal user and sales goals, falling short of its target of one billion weekly ChatGPT users. More alarming was the reported warning from CFO Sarah Friar that the company might struggle to meet future infrastructure payments if revenue didn’t accelerate. OpenAI CEO Sam Altman pushed back publicly, saying the business was performing well, but the damage to AI infrastructure stocks was already done.
“OpenAI might not be able to pay for future computing contracts if it didn’t boost revenue.”
Sarah Friar, CFO, OpenAI, as reported by Bloomberg
Why does an OpenAI stumble matter for tonight’s earnings? Because the entire AI infrastructure thesis rests on a simple assumption: that demand for AI compute will grow fast enough to absorb the unprecedented supply being built. Microsoft, Azure, AWS, and Google Cloud are all racing to provision capacity for AI workloads. If the largest AI application in the world, ChatGPT, is struggling to hit growth targets, it raises an uncomfortable question about whether demand will materialize on the timeline these capital plans require.
Note: OpenAI’s revenue miss is a single data point, and Altman disputes the characterization. But markets don’t wait for nuance. The SoftBank and CoreWeave reactions show how quickly infrastructure sentiment can shift when the AI monetization narrative gets even a small crack.
There’s also a secondary effect worth tracking. Microsoft’s relationship with OpenAI is both its biggest AI asset and its most concentrated risk. Any weakening of ChatGPT’s commercial momentum flows directly into questions about Azure’s AI revenue growth rate, which is the single most-watched metric on tonight’s call.
Who Wins, Who Loses
Tonight’s earnings don’t just move four stocks. They set the tone for an entire ecosystem, from chip makers to energy utilities to the 16,750 workers who got layoff or buyout notices this week alone.
Stakeholder
Potential Upside
Key Risk
Nvidia
$650B capex cycle validates sustained GPU demand through 2027
Custom silicon (Google TPUs, Amazon Trainium) could displace 20-30% of GPU orders by 2027
Enterprise Customers
Copilot at $30/month; real productivity gains if adoption scales
ROI gap widens if AI tools don’t demonstrably reduce headcount or accelerate output
These five companies (plus Apple reporting Thursday) drive approximately 25% of S&P 500 weight
A broad guidance cut or capex pullback triggers a sector-wide multiple reset
The workforce story deserves particular attention. Meta’s 10% headcount reduction, roughly 8,000 jobs, with another 6,000 open roles frozen, came in the same announcement that reaffirmed $115-135 billion in 2026 capex. The company isn’t retrenching. It’s reallocating: fewer human roles, more compute. Microsoft’s voluntary buyout program, the first in company history, follows the same logic. Both moves signal that even as AI spending accelerates, the human capital bill is being trimmed to offset it.
For workers navigating the AI transition, the message is stark. Specialization in AI and machine learning commands a premium. Generalist software engineering roles face increasing automation pressure. The 12-to-24-month window for skills retraining is narrowing.
The Case Against the Boom
The dominant narrative around big tech AI spending is deeply bullish. But there’s a credible counter-argument — and it’s getting louder.
The ROI timeline problem
Break-even on a $100 billion data center complex, under conservative utilization assumptions, can take three to five years. The hyperscalers began their current buildout in earnest in 2023. Even under optimistic scenarios, many of the facilities being funded today won’t be generating positive returns until 2027 or 2028. If the AI application layer, the Copilots, the cloud APIs, the enterprise tools, doesn’t scale adoption fast enough to fill that capacity, margin compression becomes a multi-year story, not a one-quarter blip.
The 3% adoption ceiling
Microsoft’s own data shows that Copilot 365 has reached about 3% of its 450 million enterprise users. That’s a real number, but it also means 97% of the addressable market hasn’t converted. The Accenture deal is significant, 743,000 seats at $30 per month is real revenue, but it’s a single large win in a market that needs thousands of them to justify the underlying infrastructure spend.
The inference cost paradox
Training large models is expensive. But serving them, inference, is now estimated to account for 80-90% of ongoing AI compute costs at scale. The per-query cost of running a sophisticated language model is orders of magnitude higher than a traditional search query. As AI gets embedded in more consumer and enterprise products, the cost per engagement has to fall dramatically, or the unit economics don’t work at mass scale.
