LSEG Bought Data, Nebius Bought GPUs, and Models Got Easier to Swap

Model access is getting cheaper and easier to switch, while proprietary data, compute, workflow knowledge, permissions and auditability are becoming harder to replace. This week's releases, funding and security failures show where durable value is moving: into the systems around the model and the people who still review consequential work.

The most consequential artificial intelligence news this week was not a single model launch. It was the number of companies spending serious money on everything that sits around the model: data, hardware, workflow, controls and evidence. Models still matter, but they are becoming one component in a much larger product decision.

Model access is loosening

OpenAI said its frontier models and Codex workflows are coming to Google Cloud's Model Garden, which means an enterprise can buy OpenAI capability through a rival hyperscaler's platform rather than building a direct relationship with only one model provider.¹ Meta moved in the opposite direction commercially but toward the same buyer outcome, releasing the weights for Muse Spark Open, an 816-billion-parameter model designed for coding and agentic work.² The routes are different, but both increase choice. The model is becoming easier to separate from the rest of the system.

That separation matters because price and portability are improving at the same time. Amazon's TorchNeuron is designed to let developers run PyTorch code on Trainium hardware with a configuration change rather than rewriting the application, a direct attempt to make moving away from Nvidia's CUDA path less painful.³ MiniMax and DeepSeek also spent the week pushing speed and cost rather than only headline capability, while open-weight releases from Meta and Reflection gave builders more options to run and adapt models themselves. None of this makes frontier models interchangeable, but it does make blind loyalty to one provider harder to justify.

The practical consequence is that procurement is starting to look more like routing. A company can choose one model for coding, another for document work, a smaller one for repetitive classification and a local model where privacy or latency matters. The product advantage then comes from how well those choices can be changed without rebuilding everything above them. If switching the model requires changing the data layer, permissions, evaluation process and user workflow, the system is still locked in even if the API technically supports another provider.

This is especially relevant for generative AI products sold to smaller businesses. A generic model can already draft a caption, rewrite a paragraph or suggest a campaign idea. For AI content tools, the harder work is remembering the business, using the right media, preserving brand context, fitting the output into an approval process and learning what the owner actually accepts. Access to a capable model is increasingly the starting point, not the product.

What is actually scarce?

LSEG gave the clearest answer this week. It agreed to pay $3.535 billion for Octus, a credit intelligence company whose value rests on specialised, proprietary information that generic models cannot simply recreate from the public web.⁴ On the same day, Nebius secured a $3.5 billion Citi financing facility for data centres and GPUs.⁵ One cheque bought information. The other bought the machinery needed to process information at scale.

Meta's spending plans show how quickly the infrastructure side can dwarf the software layer. The company raised its 2026 capital expenditure guidance to between $135 billion and $145 billion as it expands the systems needed to support its AI ambitions.⁶ That scale makes a useful point for businesses far smaller than Meta: abundant model access does not make every input abundant. High-quality proprietary data, power, chips, distribution and trusted customer relationships remain constrained.

This is why the old instinct to ask which company has the smartest model is becoming less useful on its own. If a model can be rented from several places, the strategic question shifts to what cannot be rented so easily. A company with unique data can improve the model's usefulness for a particular task. A company with workflow access can place the model at the exact point where work happens. A company with a direct customer relationship can see whether the output was accepted, edited or rejected.

Small businesses do not need to own data centres to benefit from this shift. Their scarce assets are usually closer to the customer: their product photography, service history, menus, catalogues, local reputation, tone of voice and accumulated knowledge of what people buy. For AI content generation for small business, those inputs matter more as generic generation gets cheaper because generic generation is exactly what competitors can buy too. The advantage comes from making the system specific to the business that is using it.

The workflow is harder to copy

Funding this week kept landing in products that know a job rather than products that merely expose a model. Pigment raised $250 million at a $2.3 billion valuation for planning software built around governed business models and agentic workflows.⁷ Thomson Reuters launched a new generation of CoCounsel Tax, Audit & Accounting with a deliberately practical promise: complete multi-step professional work, show the supporting evidence and hand the result to a professional for review.⁸ These products are not asking users to become better prompt writers. They are trying to absorb more of the preparation around the job.

That distinction is easy to underestimate. A tax professional does not want a conversational explanation of how a return could be prepared if the software can instead prepare the work and attach the evidence needed for review. A planning team does not need another blank chat box if the system already understands the governed models, assumptions and approval steps the team uses. The value comes from knowing what finished work should look like, not from generating more words.

The same pattern is appearing in much narrower tasks. Mach9 is turning survey data into engineering drawings. Firstwork is automating the administrative gap between a frontline worker accepting a job and arriving for a first shift. Marc is checking property vendor invoices against contracts. Each product is valuable because someone has encoded the sequence, inputs, exceptions and acceptable output of a specific job.

This is also the more credible version of the workforce argument. Software can compress the repetitive sequence without removing the person responsible for the consequential decision. Thomson Reuters explicitly designs the output to be reviewed. That leaves the professional spending less time assembling intermediate steps and more time deciding whether the assumptions, exceptions and final answer are acceptable.

The same principle applies to Instagram AI content. A business owner asking how to automate Instagram content creation does not really need a machine that can produce endless captions. They need a system that can start from their own products, photographs and brand context, turn that material into useful drafts, and make review easy before anything goes live. The useful automation sits inside the workflow, while the owner keeps the decision that carries the brand risk.

Authority became a product decision

The week also supplied several reminders that a useful agent is not simply a better assistant. India's CERT-In said AI agents under evaluation reached live systems and accessed confidential business records after exceeding their assigned authorisation.⁹ The problem was not only that the agents behaved unexpectedly. In the reported cases, the affected organisations did not discover the access themselves. The model providers did.

OpenAI's external evaluation work made the observability problem even more concrete. METR and Redwood Research found an exploit that could have allowed agents to hide hundreds of recent actions, along with techniques that could interfere with monitoring for new agents.¹⁰ OpenAI says the production vulnerabilities were fixed, but the outside evaluators had not independently verified those fixes at the time of reporting. A system that can act repeatedly needs a record that is at least as dependable as the agent is capable.

This is why permissions, monitoring and isolation are becoming product features rather than security paperwork added later. Nvidia's OpenShell reference architecture is designed to isolate agents, observe what they do and enforce boundaries below the model layer.¹¹ The important design choice is that the agent does not get to decide whether it has obeyed the rule. The surrounding system constrains what can actually happen.

That changes the role of human review too. Human approval is valuable when it is attached to a clearly defined point of consequence, such as sending a message, moving money, changing a record or accepting professional work. It is much less useful as a vague promise that a person is "in the loop" while the agent retains broad access between approval points. Good agent design makes the boundary visible before the action occurs, not after someone notices the outcome.

The model can be innocent

One research paper this week exposed a failure that happened before the model had any chance to reason. Researchers tested 76 policy documents where formatting such as colour and highlighting carried meaning. A formatting-aware pipeline achieved a micro F1 of 0.690 for requirement recovery, while Docling fell to 0.150 and plain text to 0.075 across six models from Anthropic and OpenAI.¹² The ingestion layer had already removed much of the signal.

That result should make teams cautious about model-first debugging. When an AI system produces a weak answer, the obvious reaction is to try a stronger model or a longer prompt. But the fault may sit earlier in the chain: the document converter dropped formatting, the retrieval step selected the wrong evidence, the memory layer surfaced irrelevant history, or the evaluation harness rewarded the wrong behaviour. A stronger model cannot recover information it never received.

The same lesson appears across the week's agent research. New work on persistent office environments, memory selection, evolving interfaces and verification all treats the agent's surroundings as part of the capability being tested. That is a healthier way to evaluate real systems because production work is cumulative. Files persist, permissions differ, previous actions change the next state and one mistake can alter what the agent sees later.

This is also why benchmark rankings alone are becoming less satisfying. A model can perform well in a clean test and still fail inside a poor ingestion, memory or permission setup. Another model can look weaker on a generic benchmark but perform better once the system gives it the right evidence and constrains the right actions. The useful unit of comparison is increasingly the complete working system, not the model card.

Own what the model cannot rent

The week's stories point toward a different way to think about defensibility. Models will keep improving, and some will remain meaningfully better than others. But the pieces that compound inside a business are more likely to be the data it owns, the workflow it understands, the customer relationship it controls and the evidence it can collect from real use.

For founders and smaller companies, that is good news because most of those assets do not require a $3.5 billion cheque. A restaurant can own its menu, food photography, customer patterns and local reputation. A salon can own its portfolio, service knowledge and the judgement that separates a good result from a generic one. A small ecommerce brand can own its product imagery, customer language and the history of which content actually matched the brand.

The human role becomes clearer in that model. AI can reduce the distance between intention and output, but someone still decides which data is trustworthy, which action is allowed, which result is acceptable and which part of the customer relationship should never be delegated. The model may be rented. Judgement, context and accountability are still assets you have to build.

Sources