Are the frontier labs cooked? I’m convinced the future of models is hybrid. I recently spoke with someone who realized they had paid over $1K to Anthropic for token usage. Were they working on a massive new project? Nope. Turns out they accidentally ran it with Anthropic’s latest model, Fable, and their scheduled tasks ended up costing nearly 10x as much, because not only does Fable cost more per token, it also burns more.
The latest models are solid at complex tasks that include heavy reasoning or planning. Using them for basic tasks is like Kylie Jenner taking a 17-minute private jet flight to go 40 miles. Convenient…maybe? Economical…not even close.
For execution of basic tasks, you don’t need the latest model. You just need one that can get the job done with high confidence. This is the hybrid part. This isn’t anything new. Model routing is already a thing. You have a pool of available models, and a model router determines where it goes based on predefined criteria or the task.
Brian Armstrong, CEO of Coinbase, wrote on X in June about how they are reducing token costs, with one method being defaulting to Chinese open-weight models through their LLM gateway. He explicitly calls out that you don’t need frontier models for execution. Then, the Cursor coding agent introduced Cursor Router in July, which automatically routes every request to the most capable model for the task, “delivering frontier intelligence at a lower cost.”
That’s a glimpse into the hybrid future: Open-weight + closed-weight models working together in harmony, routed behind the scenes through your model harness. Imagine this: you launch your agent harness of choice (e.g., Claude Cowork or Cursor) and run your daily tasks through it. You don’t worry about which models to select for each task because you’re not part of the 0.001% of humans who nerd out over model performance. You just need to consolidate data for a report that won’t cost the same as a 17-minute private jet flight.
You might be asking. WTF is an open-weight model!? I’m so glad you asked.
Open-Source: Provides the complete recipe for the model, including the code, training data, and weights. A home chef can take all the raw materials and make the same meal, or add or remove ingredients to make it look materially different from the original recipe.
Open-Weight: Provides the finished weights without the code or training data. It’s like buying a frozen chicken dinner. You don’t have the original recipe, but you can still take it out of the box, heat it up, and add other spices or a side of veggies (because you’re healthy) to change the flavor profile but not the underlying protein.
Closed-Weight: This is your fast food option. You don’t know (and perhaps don’t want to know) how it’s made. You just know there’s a delicious chicken sandwich that arrives in a bag with a side of fries (what happened to you being healthy?). This is what most people are used to
for dinnerwhen using AI. They’re using an AI product like Claude, and like magic, their prompt to accomplish a boring, repetitive task just gets done.
The hybrid model…ermm…model…will be open-weight and closed-weight models used in tandem. So, the frontier models aren’t cooked, but the harnesses that win in the future will be multi-model with integrated routing. We’re seeing this play out now as OpenAI announced it will stop allowing Cursor access to its models. Cursor supports plenty of other models, so it’s not a company-ending event... the SpaceX acquisition will likely have more fallout than the OpenAI news.
What does this mean for security teams? I wrote last week about how the agentic perimeter is getting distributed. This only gets worse as agents offload tasks to one another across different platforms. For a single task, you will find some tasks running locally on the endpoint. Some of the advanced planning may go to the frontier lab infrastructure, with subagents spawning to call MCPs for a SaaS application that may in turn spawn more agents. Larger enterprises may have their own agents running in AWS that other tasks will get distributed to.
That’s why endpoint security does not equal agent security. Quite literally, agents will be operating everywhere. If you focus only on the endpoint, you’re essentially doing detection and response with one eye closed and the other squinting really hard.
What are the security considerations for a hybrid model world? Don’t get bogged down in whether an open-weight model or closed-weight model is more secure. The practical reality for most organizations is that it doesn’t matter. Both are going to become commonplace. Here’s my advice:
Trust no model: The tin-foil hat crowd will say you need to be careful about backdoors hidden deep in the model. Where a secret string will unlock some malicious capability. Possible? Sure. Probable for the average organization? No. If you’re not a three-letter agency, worry less about the model and where it was developed, and focus more on the infrastructure or harness using the model and the actions the agent is taking. You don’t need X-ray vision to see when someone is mugging you, just as you don’t need to see inside the model to know when the agent is about to take a risky action.
Get visibility now: The main focus needs to be on visibility into agents and behavior. Assume the model, any model, will allow something stupid to happen. Why? Because it literally happens all the time, but you just don’t see it because you’re not watching. Visibility starts with knowing which agent harnesses are in use and which models are tied to them. You can take a governance-first approach and allow only certain ones. This simplifies your universe and allows you to start pulling telemetry from all the places you need it. Then, ensure you have the telemetry for agent actions to enable the next item.
Start building agent-focused detections: Too many AIDR approaches are just another DLP tool: pokes CrowdStrike AIDR with a stick. One model is non-deterministic. Stacking multiple models compounds that variance. This means your agent’s behavior can be more erratic. If you’re just focused on when clear-text credentials enter the agent’s context, I’ve got some bad news. It happens all the time and gets ignored more than a neighborhood car alarm. You need to focus on detecting agent actions and behaviors.
An agent accessing a password manager and pulling credentials when it has no reason to do so for the task? That’s an agent-specific detection other tools won’t catch. That’s why you need to monitor an agent’s behavioral trend line from start to finish.
Just as we had to uplevel our security tools with the cloud, the same is happening with agents. If you’re ready to take the first step in gaining visibility and agent-focused detections, let’s chat.
