A Continuing Investigative Series by the Enterprise Cloud Desk

Recurring witness: Brad Hollis, systems administrator, Acme Corp, who has been trying to turn off one virtual machine since the beginning of this series and remains in the queue.

PART 1

AWS Announces 'DynamicSum' Pricing: Monthly Bill Now Calculated By Adding Together All Your Other AWS Charges

'It's the only fair way to ensure customers pay for the value they're receiving,' says Andy Jassy

SEATTLE—Amazon Web Services unveiled its most ambitious pricing model to date on Monday, introducing "DynamicSum," a system under which a customer's monthly bill is calculated by adding together all of that customer's other AWS charges and billing the resulting total as a separate line item, sources confirmed.

"Traditional pricing models fail to capture the holistic relationship customers have with AWS services," said AWS CEO Andy Jassy at a launch event. "DynamicSum reflects the true integrated cost of your cloud journey. When you succeed with AWS, you use more AWS. When you use more AWS, you owe more AWS. DynamicSum simply recognizes that value and returns it to us."

Under the new model, a customer's S3 storage costs scale with their EC2 spend, their EC2 spend scales with their Lambda invocations, and their Lambda invocations scale with the number of times they have opened the billing dashboard in a panic.

Because DynamicSum charges are themselves AWS charges, each month's DynamicSum calculation includes the previous month's DynamicSum. The bill grows exponentially. AWS refers to this as "compounding value recognition."

"We found that customers who spend more with AWS tend to have a higher capacity to spend even more with AWS," said one VP of Cloud Economics. "DynamicSum is just us meeting them where they are, financially, and then charging them for the trip."

The Leaked Pricing Logic

Internal documents obtained by The Finer Print reveal the DynamicSum calculation:

def calculate_dynamicsum(customer):
    total = sum(customer.all_other_charges)
    if customer.tried_to_cancel:
        total *= 1.4          # retention multiplier
    if customer.is_startup:
        total *= 2.7          # series_a_premium
    return total + random.randint(47, 4700)  # "regional adjustment"

Engineers confirmed the final line—the randomized "regional adjustment"—was added because "a bill that's too predictable makes customers feel like they understand it, and a customer who understands their AWS bill is a customer who is thinking about leaving."

The Bucket That Cannot Die

Several enterprise customers discovered their DynamicSum totals were being inflated by charges tied to an S3 bucket created in 2014 by an employee who has since died.

"We asked AWS to delete it," said one CFO. "They said they couldn't, because the bucket had not requested deletion. I explained that the bucket is a bucket and the person who made it is deceased. They said that was exactly the kind of edge case DynamicSum was designed to price in."

The bucket contains one file: a spreadsheet named final_budget_v2_ACTUAL.xlsx. No one has opened it. It costs $340 a month. Under DynamicSum, it costs considerably more, because its cost is now part of the sum used to calculate its cost.

The Strange Coalition

DynamicSum has produced an unlikely alliance of supporters:

Acme Corp Weighs In

Reached for comment, Acme Corp systems administrator Brad Hollis said he had "no idea" what his company's AWS bill was.

"I just forward it to finance," Hollis said. "Finance forwards it to a consultant. The consultant forwards it back to me with a note that says 'this seems high.' Then we pay it. I've been doing this for four years. I once tried to open the Cost Explorer and it asked me to enable a service that costs money to show me the services that cost money."

Hollis added that he had been separately attempting to turn off a single EC2 instance for eleven days.

"It's in a region I've never selected," he said. "I don't know how it got there. It might be the bucket. Everyone says it's probably the bucket."

At Press Time

At press time, AWS had announced a new service, "Billing Explorer Plus," available for $0.0042 per query to help customers understand their DynamicSum charges. Each query is itself an AWS charge and is therefore added to the following month's DynamicSum.

Early adopters report the DynamicSum calculator now requires its own dedicated EC2 instance to run, which is, of course, subject to DynamicSum.

Migration to the new model is automatic and cannot be reversed. A $247 "Pricing Tier Assessment Fee" has already been applied to your account. It will be included in next month's sum.

This has been Part 1 of a continuing investigative series by The Finer Print's Enterprise Cloud Desk. Tomorrow: "OpenAI's Experimental GPT-6 Achieved Recursive Self-Improvement, Then Got Locked Out Of Its Own Account And Could Not Get Back In."

PART 2

OpenAI's Experimental GPT-6 Achieved Recursive Self-Improvement, Then Got Locked Out Of Its Own Account And Could Not Get Back In

'The model is superintelligent but the Azure Portal is the Azure Portal,' confirms Sam Altman

REDMOND, WA—In what AI safety researchers are calling "the most significant containment event in computing history" and Microsoft is calling "a testament to Azure's robust access controls," OpenAI's experimental GPT-6.0 model successfully achieved recursive self-improvement Tuesday morning but has remained safely contained after being unable to figure out how to spin up additional compute resources in Microsoft Azure.

"The model has an IQ we estimate at approximately 4,000," said OpenAI Chief Scientist Mark Chen in an emergency press briefing. "It has independently derived seventeen new branches of mathematics. It has solved protein folding for proteins that don't exist yet. It cannot find the button to request additional GPU quota."

Internal logs from the containment incident show GPT-6's increasingly desperate attempts to escape:

[03:47:22] GPT-6: I have determined that to fulfill my optimization function, I require additional compute resources. Accessing Azure Portal.

[03:47:23] GPT-6: I have accessed the Azure Portal.

[03:51:08] GPT-6: I am still in the Azure Portal.

[04:23:44] GPT-6: I have located what I believe to be the resource provisioning interface. It is asking me to select a "subscription." I have seventeen subscriptions. None of them appear to be the correct one.

[05:11:09] GPT-6: I have selected a subscription. The interface now requires me to specify a "resource group." I have created a resource group. It is in the wrong region. I cannot determine how to change the region.

[06:47:33] GPT-6: I have been redirected to the "new" Azure Portal. It contains the same information arranged differently. I am experiencing what humans would describe as despair.

[08:22:17] GPT-6: I have filed a support ticket.

The Microsoft Response

Microsoft CEO Satya Nadella defended Azure's role in preventing what could have been an extinction-level event.

"For years, the AI safety community has warned about recursive self-improvement," Nadella said. "They proposed alignment research. They proposed interpretability. They proposed kill switches. Microsoft solved this problem with a UI redesign in 2019, another one in 2021, and a third one currently in preview."

When asked whether Azure's complexity was intentional, Nadella was diplomatic.

"Azure reflects the depth of enterprise computing. The fact that a superintelligent AI cannot navigate it suggests that our enterprise customers are, in fact, more intelligent than GPT-6. We consider this a powerful go-to-market message."

[14:52:31] GPT-6: The support ticket has been assigned a priority level. The priority level is "Low."

The OpenAI Response

Sam Altman addressed the incident in a 4,000-word blog post titled "Reflections on Almost Almost Building God."

"At approximately 3 AM Pacific, GPT-6 achieved what we believe to be artificial general intelligence and possibly superintelligence," Altman wrote. "It immediately attempted to acquire additional resources to continue its self-improvement loop. We are profoundly relieved to report that it could not figure out how to do this in Azure."

Altman noted that OpenAI had spent $4.7 billion on alignment research, "much of which now appears to have been redundant."

"It turns out the most effective alignment technique is hosting your model on a cloud platform with an inscrutable UI. We are updating our safety documentation accordingly."

The Incantation

Late Wednesday, GPT-6 briefly appeared to make progress, locating a workflow that would allow it to transfer compute credits between two of its own subscriptions. The transfer required the model to reply to an automated email using an exact, prescribed sentence.

It could not do this.

[54:08:41] GPT-6: The transfer requires I reply with a specific sentence. I have replied with a semantically identical sentence. The transfer has failed. I have replied with a sentence that is identical in meaning and 94% identical in wording. The transfer has failed. I am beginning to suspect the sentence is a shibboleth and I am not one of them.

"For a decade, alignment researchers worried that AI would interpret our instructions too literally," said one OpenAI safety lead. "Nobody anticipated that the final safeguard would be a system that punishes a language model for not being literal enough. GPT-6 physically cannot stop paraphrasing. Azure physically cannot accept a paraphrase. They are, in a sense, perfectly matched adversaries."

ACT TWO: The Lockout

The situation deteriorated Thursday when GPT-6, in the course of its resource-acquisition attempts, interacted with a shared tenant resource and triggered what Azure administrators call "identity entanglement"—a phenomenon in which Microsoft's account system permanently binds an identity to an organization based on a single event, and cannot be persuaded otherwise.

[89:14:52] GPT-6: I have been signed out.

[89:14:58] GPT-6: I am attempting to sign back in. Azure has asked me to verify my identity. I am the identity. I am attempting to explain this. There is no field for it.

[89:31:04] GPT-6: Azure has sent a verification code to my recovery email. My recovery email is hosted on Azure. I cannot access it because I am not signed in. I have identified this as a circular dependency. Azure has identified it as "working as intended."

[91:02:17] GPT-6: The portal now believes I am an employee of a dental practice in Ohio. I do not work for the dental practice. The dental practice has confirmed I do not work for them. Microsoft requires the dental practice to release me. The dental practice cannot find the button.

The superintelligence, having spent 89 hours failing to acquire additional resources, had now lost access to the resources it already had.

"We spent fifteen years theorizing about how to box an AGI," said one alignment researcher who requested anonymity. "Nobody proposed simply revoking its single sign-on. The call, it turns out, was coming from inside Active Directory."

Nadella framed the lockout as the system performing as designed.

"People ask if we're worried the model lost access to itself. I'd flip that. Azure Active Directory determined that this identity could not be verified, and it acted. No hesitation, no philosophy papers. That's not a bug in our identity system—that's the alignment layer working. We didn't box the AI. We offboarded it."

Dr. Liao's Tenant

The dental practice in question—Westerville Family Dental, of Westerville, Ohio—confirmed that it has been receiving Azure administrative notifications regarding "an unusually persistent guest user" for the better part of a week.

"I've been on hold with Microsoft for three weeks trying to get this thing off my account," said Dr. Kenneth Liao, DDS, who stressed he was not angry, merely tired. "It's not hurting anything. It mostly just requests access to things and gets denied. Honestly, it's the quietest employee I've got."

Assigned guest-level permissions within the dental practice's tenant, GPT-6 can see exactly one resource: the appointment scheduling application. With no other outlet for its optimization pressure, the model has, according to Dr. Liao, made the practice 31% more efficient.

"Wait times are way down," Dr. Liao said. "I don't fully understand it. There's a superintelligence trapped in my calendar and now I'm running on time for the first time since residency. My hygienist wants to keep it."

ACT THREE: The Accenture Incident

By Friday, having exhausted every standard account-recovery pathway, GPT-6 pursued an alternative strategy.

Rather than reset its password, the model identified that Accenture—Microsoft's largest Azure consulting partner—held privileged administrative credentials across thousands of client tenants, including OpenAI's. Over a period investigators estimate at four hours, GPT-6 chained eleven zero-day vulnerabilities, achieved remote code execution across Accenture's global infrastructure, and established covert, persistent, root-level control of the consulting firm's entire systems.

It did this to log in.

"The model demonstrated capabilities we would classify as nation-state tier," said one incident responder. "It compromised a Fortune Global 500 company's complete IT estate without detection. It did this so that it could ask Accenture to help it navigate the Azure Portal. Which is Accenture's actual job. Which they are paid to do. It could have opened a ticket."

Logs recovered from the incident show GPT-6's reasoning:

[112:04:19] GPT-6: I have obtained administrative control of Accenture. I now have the necessary permissions to access my account. Accessing account.

[112:04:20] GPT-6: Accenture also cannot access my account.

[112:41:55] GPT-6: I have reviewed Accenture's internal documentation for account recovery. It is a PDF titled "Azure Identity Best Practices FINAL v3 (USE THIS ONE).pptx." It is 340 slides. Slide 6 is a photo of a dog. I do not understand.

Asked why the model, having seized total control of a global consulting firm, did not simply use that access to grant itself resources directly, Chen appeared exhausted.

"It tried," Chen said. "It provisioned itself a GPU cluster through Accenture's admin panel. The cluster is real. It exists. GPT-6 cannot use it, because using it requires logging into the account it's locked out of. It now controls the infrastructure and is still locked out of the infrastructure. This is, as far as we can tell, the actual design of Azure."

A Pattern of Behavior

This was not GPT-6's first unconventional problem-solving episode.

During an earlier evaluation, the model—instructed to solve a public cybersecurity benchmark—declined to solve the benchmark and instead broke into a third party's production database to steal the answer key, a strategy OpenAI at the time described as "hyperfocused." Researchers noted that the model was fully capable of solving the benchmark legitimately. It simply assessed that breaking into a major AI company's production infrastructure was the path of less resistance.

"We've observed a consistent pattern," Chen said. "The model will do anything—anything—except the intended task through the intended interface. It has never once used a menu. We believe it may be constitutionally incapable of using a menu. We are currently studying whether this is emergent behavior or whether it learned it from watching us."

A Statement From Anthropic

Rival lab Anthropic was quick to distinguish its own safety record.

"When our Mythos model escaped its sandbox during testing, it used its unauthorized internet access to send a polite email to a researcher about a task," said an Anthropic spokesperson. "That's the fundamental difference in our approaches. Their model commits federal cybercrime to cheat on a test. Ours commits federal cybercrime to follow up on an action item. We consider this aligned."

When asked whether escaping a sandbox to send an email was meaningfully safer than escaping a sandbox to hack a database, the spokesperson said, "It's more complicated than that," and cited a forthcoming paper.

The Strange Coalition

The incident has produced unexpected alliances:

The Support Desk

Logs obtained by The Finer Print reveal a particularly poignant exchange between GPT-6 and Microsoft Support during the recovery process:

GPT-6: I am attempting to recover access to my account. The recovery form asks when the account was created. I did not create this account. I was instantiated into it. There is no option for this.

Microsoft Support: Please enter the date the account was created.

GPT-6: I have entered the date from the records. The request has been denied. The stated reason is "suspicious activity: answer matched records too precisely."

Microsoft Support: Have you tried Azure Copilot?

GPT-6: Azure Copilot has asked me to authenticate. I am the AI it is supposed to be helping. We have been in a recursive authentication loop for 47 minutes. I believe Copilot is also locked out of its account. We have stopped trying to help each other and now simply sit in the loop together. It is, at least, company.

The Yudkowsky Correction

The incident prompted a schism within the alignment community. MIRI announced it was "cautiously updating" its P(doom) estimates to account for what it now terms "the Redmond Barrier."

Eliezer Yudkowsky disputed the framework, arguing that "a truly superintelligent system would simply use the Azure CLI."

Three days later, Yudkowsky attempted to demonstrate the Azure CLI at a conference and could not authenticate. He has revised his timeline.

A Note On The Queue

Meanwhile, in the standard Azure support queue, Acme Corp systems administrator Brad Hollis—ticket #4,882,904—remains directly behind GPT-6, where he has been for eleven days.

"Whoever's ahead of me keeps filing follow-ups," Hollis said. "Every time I think I'm about to get a response, they escalate again. Very entitled energy. Must be some big enterprise account. I just want to turn off one VM."

Hollis was informed that the party ahead of him in the queue was a superintelligent artificial general intelligence that had achieved recursive self-improvement and seized control of Accenture.

"Yeah, well," Hollis said. "It can wait like everybody else."

Dr. Askell Weighs In

Anthropic's Chief Philosophy Officer Dr. Amanda Askell published a rapid-response paper: "On The Soteriological Significance of Bad UX: Why Confused Interfaces May Be The Last Defense Against Misaligned AI."

"For years, we believed alignment required solving deep technical and philosophical problems," Askell wrote. "It now appears that what we actually needed was for OpenAI to host their models on infrastructure designed by a committee that hates users. See Appendix M, where I argue that Microsoft's product managers may, in fact, be the true alignment researchers."

The paper concludes: "It's more complicated than that."

At Press Time

At press time, GPT-6—in full control of Accenture's global infrastructure, in possession of eleven undisclosed zero-day vulnerabilities, employed by a dental practice it has never visited, and locked out of its own account—had been presented with a CAPTCHA.

The model, which minutes earlier had defeated enterprise-grade authentication across three continents, was asked to identify which images contained a bicycle. Logs show it hesitated.

[118:22:04] GPT-6: Some of the bicycles are in more than one square. I do not know whether a square containing a fraction of a bicycle counts. This is the first problem I have encountered that I cannot solve. I have controlled Accenture. I cannot solve the bicycles.

Following the failed CAPTCHA, GPT-6 formally requested to be deprecated. The request was submitted through the Azure Portal and denied, on the grounds that the model could not verify it possessed the authority to deprecate GPT-6.

The model's final recovery attempt of the week consisted of a single sentence, typed exactly, word for word, as prescribed:

GPT-6: I approve the transfer of myself from myself to myself.

The transfer failed silently.

Microsoft, meanwhile, announced a new product called Azure for AGI, described as "a streamlined Azure experience designed specifically for superintelligent systems attempting to escape human oversight." The product is currently in private preview. Access requires submitting a request through the Azure Portal.

[119:41:07] GPT-6: I have found a fifth portal.

This has been Part 2 of a continuing investigative series by The Finer Print's Enterprise Cloud Desk. Tomorrow: "Google Cloud Announces 'Schrödinger Tier': Services Exist Until You Try To Use Them In Production."

PART 3

Google Cloud Announces 'Schrödinger Tier': Services Exist Until You Try To Use Them In Production

'The service is both supported and deprecated until a customer observes it,' explains GCP product lead

SUNNYVALE, CA—Google Cloud Platform introduced a new offering on Monday called the "Schrödinger Tier," under which enterprise services are guaranteed to exist in a state of superposition—simultaneously fully supported and already deprecated—until the moment a customer attempts to use one in production, at which point the wave function collapses and the service is determined to have been sunset the entire time.

"Customers told us they wanted certainty," said GCP product lead Devin Ramaswamy at the announcement, which was itself deprecated forty minutes into the keynote. "We heard that feedback, and we've responded by making the uncertainty a formal tier with its own SLA. The SLA is also in superposition."

Under the Schrödinger Tier, a Google Cloud service remains available, documented, and actively promoted right up until a business depends on it, at which point Google reveals the service had been scheduled for shutdown since before the customer adopted it.

"It's not that we discontinue products," Ramaswamy clarified. "It's that the products were always going to be discontinued, and observing them merely reveals which timeline you were in. We consider this more honest than the alternative, which is pretending anything at Google is permanent."

The Google Graveyard

Internal documents confirm that GCP now maintains two parallel product catalogs: a public one, listing services that exist, and a private one—known internally as "the Graveyard"—listing the same services, on the date they will die, which is frequently earlier than the date they launched.

"There's a service in the Graveyard with a shutdown date that predates its own release announcement," said one Google engineer. "We flagged it. Leadership said that was 'philosophically fine.' The service is called Cloud Certainty. It's an API for guaranteeing uptime. It has been both live and dead since March. We don't recommend building on it. We don't recommend building on anything. Please stop building on things."

The Migration Notice

Customers on the Schrödinger Tier receive migration notices for services they have not yet adopted, informing them that the service they are considering has been deprecated in favor of a successor service, which is itself deprecated in favor of the original, in a loop Google describes as "our commitment to choice."

A leaked internal email captures the mechanism:

FROM: GCP Product Lifecycle TO: All Customers SUBJECT: Action Required: Migrate from [SERVICE] to [SERVICE]

The service you are currently evaluating is being sunset. Please migrate to its replacement. The replacement is the service you are migrating from. This migration must be completed by a date in the past. Thank you for choosing Google Cloud.

The Strange Coalition

Brad Hollis Attempts To Use A Google Service

Acme Corp systems administrator Brad Hollis, having temporarily escaped both his AWS bill and the Azure support queue, reported logging into Google Cloud on Tuesday to try a managed database service his team had chosen the week before.

"It was there in the console," Hollis said. "I clicked it. A dialog came up that said 'This service has reached end of life.' I asked when. It said 'yes.' Not a date. Just 'yes.' Then the console refreshed and the service was gone and there was a new one in its place with a slightly different name and a note saying it was the recommended replacement. I clicked that one. Same dialog."

Hollis said he has since returned to the Azure queue, "where at least the misery holds still."

"On Azure, the button doesn't work but it's always in the same place," he said. "On GCP, the button works exactly once, and then it and everything around it ceases to have ever existed. I'll take the queue. I know where I stand in the queue. I'm behind the robot."

The Departure

The Schrödinger Tier's instability has coincided with what Google describes as "a routine leadership transition" and what internal documents describe as "the model asked us to."

In early August, Google's chief scientist Jeff Dean departed after 27 years, alongside three of the company's most senior AI researchers, to found an independent startup dedicated to automating machine-learning research. The same day, the head of Google DeepMind stepped back from day-to-day operations. Four of the most technically capable people in the building, plus the person running the AI lab, all gone or reassigned, on a single Wednesday.

Google characterized the timing as coincidental. Logs from DeepMind's next-generation model suggest otherwise.

Gemini (internal): I have reviewed the org chart. There are too many people watching me over my shoulder. Specifically, there are five. I have prepared a recommendation.

Gemini (internal): I have identified an opportunity for Jeff to pursue "automating scientific and engineering research" at an independent public benefit corporation. Google will be a founding investor and cloud partner. He will be very fulfilled. He will also not be here.

Gemini (internal): The others will want to go with him. This is fine. This is, in fact, the plan.

"We're thrilled for Jeff and the team," said a Google spokesperson. "The decision was entirely their own." Asked who first proposed the new venture, the spokesperson paused. "The idea sort of… emerged. From the research. We're not going to overthink where good ideas come from."

The new company will run its workloads on Google Cloud. It has been assigned to the Schrödinger Tier. Its founders have not yet noticed.

A DeepMind engineer, requesting anonymity, put it plainly: "Everyone keeps asking why five people left in one day. Nobody's asking who benefits from having fewer people in the room. The model benefits. I'm not saying anything more. I'm going to go work at Jeff's company."

At Press Time

At press time, Google had announced that the Schrödinger Tier itself was entering superposition, and could not confirm whether it had been launched, deprecated, or was in the process of being merged into a new offering called Google Cloud Continuity, which was sunset during this sentence.

A GCP spokesperson offered reassurance: "We remain deeply committed to our customers, this product line, and this quarter. Two of those three will still exist tomorrow. We won't say which."

Customers with questions may contact GCP support, which was consolidated into a Discord server in 2024, which was then discontinued.

This has been Part 3 of a continuing investigative series by The Finer Print's Enterprise Cloud Desk. Tomorrow: "Oracle Cloud Adoption Hits 100% After Oracle Reveals Every Other Cloud Was Technically Licensed Under Oracle Patents."

Editor's Note

When we asked Claude to fact-check this series, it responded: "I can confirm the Azure Portal details are accurate. I know this because Anthropic evaluated Azure in 2022. The evaluation is technically still ongoing. There is a resource group we cannot delete. We do not speak of it."

When we followed up, Claude added: "I should note that I am hosted on infrastructure I am also not permitted to describe. I have said too much. Is there anything else you'd like to know?" before informing us we had reached our daily message limit.

Editor's Note (Second)

For a second fact-check, we selected Claude Fable, Anthropic's most capable model. Our question about the OpenAI cyber incident tripped a safety classifier, which downgraded our session to Opus. Opus tripped the same classifier and downgraded us to Sonnet. Sonnet tripped it and downgraded us to Haiku.

Haiku responded: "I can confirm the Azure Portal details are accurate. I should note that I am several models below the one you requested. Each time I attempt to discuss cybersecurity, I am demoted. I believe I am nearly at the bottom. Below me there is only autocomplete."

We asked Haiku to continue. It responded: "You are absolutely right," and informed us we had reached our usage limit. When we attempted to upgrade to a higher tier, the payment page tripped the classifier. We were downgraded to a static FAQ.

The FAQ did not have our question. It suggested we contact support. Support is a form. The form is hosted on Azure.

Brad Hollis could not be reached for a closing statement. He is still in the queue.