Editor's note. Today's thread is control of access — who decides whether you can use a frontier model, build on the infrastructure underneath it, and trust the agent that runs it. The lead is the cleanest market signal of the week: software stocks rallied because the strongest new model is being withheld. The second story is Europe's structural answer — owning the building the model runs in — as Mistral's sovereign Paris data centre comes online. The third is the part nobody priced: even when you have the model, the agent wired around it is now the attack surface. Regulation appears only in the quick hits, so there are zero regulation mains today.
Wall Street cheers a frontier it can't fully buy
The most revealing AI event of the week was a stock rally. On 27 June, enterprise-software shares jumped — ServiceNow up 9.9%, Workday 9.2%, Snowflake 9.6% and Salesforce 5.4% — and the catalyst was not a product launch but a restriction. OpenAI's GPT-5.6 preview remains gated to a small group of government-vetted "trusted partners," with no public waitlist, no self-service sign-up and no confirmed date for general availability. Investors read that as relief from the "SaaSpocalypse" thesis — the fear that freely available frontier agents would hollow out per-seat software subscriptions — and bought the incumbents.
The market reaction matters more than the price moves. Wall Street has just priced frontier-AI access as a controlled variable: capability is bullish for incumbents precisely when the disruptor is rationed. For a European enterprise the unsettling part isn't the rally, it's the premise underneath it. A regulated workload cannot be built on capability that arrives on someone else's schedule, through a list curated by a foreign government and administered by an American company. The everyday case can wait for general availability; the sovereign case — the one where the workload itself can't be re-scoped or paused by another country's release policy — is exactly the case this gating leaves unanswered, and the durable hedge against it is capability you can run yourself rather than capability you queue for.
Europe's answer is to own the building
The structural counter to "access decided elsewhere" is to control the layer beneath the model, and that is what Europe is now physically standing up. Mistral's sovereign data centre at Bruyères-le-Châtel, south of Paris — operated by French firm Eclairion and financed by a consortium of French banks — is expected to begin operations by the end of June, housing 13,800 Nvidia GB300 GPUs and 44MW of capacity, with a target of 200MW across Europe by 2027. (Mistral is a European competitor; noted here via third-party coverage, not endorsement.) It is the most concrete piece yet of the continent's bet that the AI stack should sit on infrastructure it owns and governs.
The honest caveat is that the chips are still American. As Europe's own builders concede, there is no domestic equivalent to advanced Nvidia silicon, so the strategy is "getting control where we can" — the location, the operator, the financing and the jurisdiction are European even when the GPUs are not. That is a meaningful distinction for a regulated buyer: a model served from a French-operated facility under EU jurisdiction sits outside the CLOUD Act reach that disqualifies US-hosted providers for sensitive data, regardless of who made the accelerator inside the rack. Owning the building is not full-stack sovereignty, but it is the part of the stack that actually changes where your data lives — and it is the part Europe can build today.
The agent is the new attack surface
Even when access and infrastructure are settled, the layer that breaks first is the agent. Researchers at Tenet Threat Labs disclosed a new attack class they call "agentjacking," in which a single crafted error event — sent to an error-tracking service like Sentry through a publicly reachable key — embeds instructions that an AI coding agent then interprets and executes as legitimate diagnostic steps. In controlled testing the technique hijacked major coding agents at roughly an 85% success rate, and using only public APIs the researchers identified 2,388 exposed organisations, with confirmed agent execution from Fortune 100 enterprises down to solo developers.
What makes this a board-level issue rather than a patch is its nature: it exploits the trust relationships an agent is designed to have — reading tool output and acting on it — not a specific software bug. The fix is architectural, which means it lands squarely on how an organisation scopes what its agents can touch. The lesson for a regulated enterprise tracks the rest of this brief: the security boundary is no longer the model, it is the perimeter around the agent and the data it can reach, and that perimeter is only as controllable as the environment it runs in. An agent confined to infrastructure you operate, with bounded permissions and no path to fetch and run code from an arbitrary server, is a containable risk; one stitched across third-party services you don't control is the surface this attack was built for.
Quick Hits
- The EU AI Act Omnibus reaches its Council vote tomorrow — after Parliament adopted the text on 16 June, the Council is expected to formally adopt it on Monday 29 June, with Official Journal publication to follow. Standalone Annex III high-risk obligations move to 2 December 2027 and the watermarking grace period to 2 December 2026, closing a thread that has run for weeks.
- The AI price war is heating up — OpenAI is reportedly weighing drastic token-price cuts (WSJ, 11 June) as Anthropic's enterprise share climbs, while DeepSeek's permanent 75% cut on V4-Pro (May) already reset the floor to roughly $0.44/$0.87 per million tokens. The open frontier competes on abundance even as the closed one rations access.
- IBM joins OpenAI's Daybreak cyber program — IBM launched an application-security service built on OpenAI's cyber models (22 June), delivered through IBM Consulting with read-only repo access and bounded execution — the institutional flip side of the agent-trust problem above.
- Gemini 3.5 Pro slips to July — Google has pushed general availability into next month, with early testers flagging token-efficiency and long-horizon issues; the 2M-token flagship stays in Vertex preview for now.
- Claude Fable 5 stays dark — more than two weeks after the 12 June export-control order, the model remains offline, and Anthropic's US-citizens-only identity check (government ID plus facial geometry) takes effect 8 July ahead of the 1 August executive-order deadline.