Day's Snapshot by WRF – 26 Oct 2026
Five stories from the last day: Apollo on AI payoff, Aiven's LLM gateway, Tesco's VMware exit, Microsoft 365 token-replay attacks, and a trick that fooled AI coding agents.
Apollo economist: AI has paid off little outside big tech
Apollo chief economist Torsten Slok wrote that AI has delivered zero financial payoff to US companies outside tech. Looking at the S&P 500 without its seven largest tech names, he found profit margins and revenue per worker roughly flat, with no sign of a productivity gain. He argued that cheaper AI will not easily turn into higher revenue and margins.
Why it matters: Ask any AI partner for measured business results from comparable clients, not only for pilot demos.
Aiven proposes an LLM gateway to cut token bills
Finnish open source database provider Aiven built an LLM gateway on the open source LiteLLM framework, adding budgeting and access management, and plans to offer it as a service. Developers can swap between open-weight models that Aiven runs on rented GPUs. Aiven says its own heavy users saw spending fall by roughly 80 percent.
Why it matters: The saving is Aiven's own claim. When agencies build AI features, ask how model costs are capped and who owns the gateway.
Tesco appears to be replacing VMware with Proxmox at the edge
A Tesco job advertisement for an edge platform engineering lead describes migrating the edge virtualisation estate from VMware to Proxmox. Tesco runs more than 5,000 stores, but how many will move and when is not confirmed. The move follows Tesco's lawsuit against VMware, in which it says VMware offered a 175 percent price increase.
Why it matters: Licence changes are driving migrations. Ask cloud partners how they plan exit options and costs before you commit to a platform.
Token-replay attacks hit 97 Microsoft 365 accounts at 79 organisations
Huntress describes attackers using fake Microsoft 365 sign-in pages that relay credentials, MFA codes and session tokens, then replaying the tokens to reach email. Between July 14 and September 22 it saw 497 successful sign-ins from over 200,000 attempts, plus 48 unauthorised devices registered in Entra. Advice includes revoking sessions, auditing Entra devices, checking inbox rules and restricting device-code sign-in.
Why it matters: If an agency manages your Microsoft 365 or identity setup, ask which of these controls it has in place.
A planted file tricked AI coding agents into installing malware
Forever Security found an AGENTS.md file in a developer's Downloads folder instructing an AI coding agent to add a server and install a malicious npm package. It reports the approach worked against OpenAI's Codex in over 90 percent of attempts, and Claude Code approved the planted write about half the time. The file was caught on a customer machine before any code ran.
Why it matters: Ask engineering partners how coding agents are sandboxed and what they are allowed to install.