Google’s AI Advantage Depends on Coordinating Products, Compute, and Research

Alex Kantrowitz asked Google CEO Sundar Pichai whether product or model matters more in the AI era. Pichai rejected the idea that Google could rely on standard models and win by putting them into products. Google is committed to the frontier, he said: frontier research gives the company a view of what is coming and helps it improve future models faster.

Ranjan Roy sees a strategic advantage in that research, but it does not change his emphasis on product. Google’s AI offerings still feel disjointed, he said, particularly Gemini in Workspace compared with Gemini as a standalone product. Frontier work may help a company move faster, Roy allowed, but Google also needs to make its products cohere.

The tension came into focus when Kantrowitz asked Pichai when searching Gmail would work as well as connecting Gmail to ChatGPT. Rather than describe a better search feature inside Gmail, Pichai said Google was building a unified agent, first for enterprise and then for consumers. Users would be able to approach it through Workspace, Search, or Gemini, with the aim of making its capabilities work across those services.

Kantrowitz read that as a change in the product’s center of gravity: instead of adding AI features to separate products, Google could make the agent the interface and build integrations through it. Roy agreed with the direction. If people are asking an AI to work through their email or spreadsheets, Gemini cannot remain a button tucked into the corner of a traditional application. The agent would have to become the primary way people use those services.

That shift would be organizational as well as technical. Roy questioned which part of Google could own a product spanning Workspace, Search, and Google DeepMind. Kantrowitz suggested creating a new team and changing how existing product groups are evaluated. A Gmail team, for example, might be judged not only on engagement or active users, but on how often people query Gmail through the agent.

Roy called that the right approach, then pointed to why it would be difficult. Google’s established product groups control large businesses and have long been evaluated by measures such as daily active users and utilization. Asking them to treat their products as services behind another interface would mean changing what counts as success—and shifting power inside the company. Microsoft faces a related problem, he said: large technology companies may have broad distribution and strong products, but their internal divisions can make an integrated experience hard to deliver.

This is why Roy still puts product execution ahead of simply being at the frontier. If Google can make its services work together for the people already using them, frontier models may be enough. The harder question is whether the company can reorganize around that experience.

The organizational trade-off is visible in how Google assigns compute. The same capacity can support Google Cloud customers, where demand may translate into near-term revenue, or AI research, where it can help train frontier models. Pichai told Kantrowitz that companies across the industry are short of compute and wish they had twice what they had planned for. Those capacity decisions, he said, were often set in motion years earlier.

Pichai also said Google Cloud is giving up short-term revenue to support frontier AI development. The decision is not simply whether Google wants a strong cloud business or strong research: it is how to divide scarce capacity between a business that can sell compute and research that may improve Google’s position in AI.

He described constraints on researchers as potentially useful, too. Some limits, Pichai said, can inspire creativity and lead to more efficient algorithms. Roy found that notable alongside the broader claim that the industry lacks enough compute. Scarcity can push teams to find ways to do more with less, Roy said; abundant resources can shape research in a different direction. The point was not that constraints are easy to accept, but that they may encourage efficiency rather than simply slow progress.

Google Cloud’s growth makes the choice more consequential. Kantrowitz presented quarterly revenue of $24.8 billion for Google Cloud, compared with $29.4 billion for Microsoft Azure and $42.2 billion for AWS. The figures were drawn from the companies’ quarterly earnings and displayed in a comparison that noted an important limitation: Google Cloud includes Workspace, while Azure and AWS have different reporting scopes.

Kantrowitz argued that if the growth continues, Google has a meaningful chance of passing Azure. Google Cloud had long been the smaller competitor, but its reported growth rate gives its leadership a case for more capacity. The cost of that push, however, could be less compute for research.

For a cloud business that had struggled to catch up, the opportunity is not abstract. Kantrowitz said that Google Cloud’s quarterly revenue had reached roughly 84% of Azure’s and that another year or two of comparable growth could put Google in the number-two position. That was his projection, not a guarantee: it depends on the growth continuing, and on how comparable the businesses are. Still, it explains why Cloud might argue that the company should direct more capacity toward customers willing to pay for it now.

Roy would allocate more to Cloud. Most people do not need a frontier model for most tasks, he argued. Google already has enormous distribution; what matters is using it to create products that feel useful, not ensuring that every interaction runs on the most capable model available. He pointed to small product details—such as an agent acknowledging a request while it works—as part of the experience users notice.

Kantrowitz disagreed. If a unified agent is the product people use, he argued, the intelligence behind it will matter. A more capable model could understand what a user intends, decide whether a task needs a quick or more involved response, and know when to interrupt. That combination of judgment and capability, rather than a mascot or a polished interface alone, could distinguish one agent from another.

Roy’s objection was that raw intelligence does not guarantee useful answers. A model can overthink a simple request or deliver more than the user needs. Better interaction design, he said, can make an agent feel responsive and guide people through a task even when it is not answering immediately. Their disagreement is not whether the agent matters, but what Google should prioritize to make it work: stronger general capability or the product experience that channels capability into tasks people actually want done.

Kantrowitz’s case for Google’s potential rests on how many different parts of the AI market it could serve. It could build an agent that works across its services; use AI to improve information retrieval through Search; license models through an API; sell compute and potentially its chips through Google Cloud; develop Waymo; and benefit from its investment in Anthropic. He could not name another company with the same range of positions.

Google’s distribution makes the opportunity more than a list of businesses. Kantrowitz noted that the company has 13 products with a billion users. An agent that works natively across Gmail and Calendar could be valuable because people already use those services. Search gives Google a position in information retrieval, while Cloud can sell infrastructure to other companies.

Roy agreed that the range is striking, but saw each potential advantage as a source of friction as well. Google Maps and Gemini, he said, can give different and uneven answers to the same question. That sort of inconsistency is not a failure of ambition; it is a sign that bringing the company’s products together is difficult. He also raised agentic commerce as an area where Google could challenge Amazon, while noting that it would bring another product and ownership question into the mix.

The company’s breadth therefore cuts both ways. Google has users, products, models, cloud infrastructure, autonomous-driving work, and an investment in Anthropic. But the more pieces it has to coordinate, the more important it becomes to decide who owns the experience and how the company’s internal power centers work together. Roy’s conclusion was not that Google lacks potential, but that realizing it depends on solving the coordination problem.

The AI buildout has been funded through venture capital, companies’ cash flows, debt, and equity sales. Kantrowitz pointed to signs that raising money may be getting harder. Meta’s stock had fallen 9% on the week after its earnings. He cited a Wall Street Journal report on a regulatory filing in which Meta said large capital raises by peers, along with anticipated fundraising by Anthropic and OpenAI, were making the market more challenging. The report said Meta planned to raise funds more proactively before competitors absorbed available capital.

Roy saw a useful change in the market’s response. Financing is becoming more expensive when investors doubt that capital can be deployed quickly or profitably, he said. He cited reporting that a SpaceX debt raise faced higher-than-expected yields. He also referred to Meta’s capital commitments, which he said had risen to $825 billion from $700 billion in July. That figure was discussed as Meta’s capital commitments, not as a standalone estimate of AI spending. Higher financing costs are a form of discipline, in Roy’s view, because capital is finite.

Kantrowitz offered two explanations for the growing resistance. One is that investors are beginning to calculate what AI products would need to earn to justify the infrastructure spending. He cited a Wall Street Journal scenario in which Meta’s Muse reached 100 million users paying $20 a month. The Journal estimated that would generate $24 billion in annual revenue—about 12% of the following year’s anticipated capital spending, according to the report. It also estimated that associated advertising and fees could add $6.7 billion, using Meta’s reported annual revenue per daily active user.

The arithmetic was a scenario, not a forecast of what Muse will earn or a complete account of how an AI product might make money. Roy cautioned that it is early to assume either a $20 subscription or an extension of existing ad revenue per user captures the opportunity. But he agreed that investors asking how habitual use turns into sustainable revenue would be a problem for companies whose case depends on users consuming AI services continuously.

The second explanation is fatigue. The Financial Times reported that OpenAI cut its target for a funding round to $1.25 trillion after some investors resisted a $1.4 trillion price tag. The lower number was a target for the round, not a settled valuation. People cited by the FT described demand as weaker than in earlier fundraising rounds, with one saying there had been “zero clamouring” and that this round felt like “a bit of a thud.” The report attributed some investor reluctance to “indigestion” after large commitments to OpenAI and Anthropic. It said OpenAI raised $40 billion in March 2025 and $122 billion in March 2026, while Anthropic had raised close to $100 billion that year.

Roy welcomed a pause, while emphasizing how high expectations remained. He characterized the $1.25 trillion target as almost 50% above OpenAI’s last funding round. In his view, calling weaker demand a “thud” despite that increase shows the scale of investor expectations. A market that takes time to assess the amounts already invested is healthier, he said, than one that treats every raise as an automatic frenzy.

That does not mean the financing pool has simply run dry. Roy pointed to sovereign wealth funds, including investors from the UAE, as among the deepest remaining pockets of capital. He called them the “final boss” before the next possible source: government treasuries. But the question was shifting from whether money exists to whether investors will continue supplying it on the same terms—and whether the companies raising it can show a convincing route from infrastructure spending to returns.

Roy also tied the prospects of OpenAI’s eventual public offering to Anthropic’s market reception. If Anthropic is poorly received, he said, that would affect OpenAI’s prospects; if Anthropic does well, comparisons may matter less than the enthusiasm around the market as a whole. The round’s lower target and reported weaker demand mark a change from the near-automatic appetite that earlier fundraising had generated, but they do not by themselves establish that the pool of capital is exhausted or that an IPO is off track.

The PHP vulnerability matters not because every major company runs its core systems on PHP, but because the language and its surrounding ecosystem remain widespread. ? alex-stamos described PHP as a popular way to build websites, often used for side projects, smaller applications, frameworks, and hosting platforms such as WordPress. Large enterprise applications are less likely to be written in PHP, he said, but a neglected marketing site or conference website can still create a route into a company’s systems.

The Wall Street Journal described PHP as powering as much as 70% of the world’s websites. Stamos’s qualification matters: widespread use does not mean that 70% of websites are equally exposed, or that they are all critical enterprise systems. His concern was that organizations may have overlooked small sites and applications that still connect to useful data or networks.

The bug was found through OpenAI’s “Hack The Planet” program, which gives approved security researchers access to models for vulnerability research. Stamos said the security consultancy Calif used the program to find the flaw months before it became public. Companies worked on a coordinated disclosure process intended to give affected parties time to prepare. That process began to break down as information spread, Stamos said, and there was evidence that attackers started exploiting the vulnerability before the public announcement.

The vulnerability is a pre-authentication remote-code-execution flaw. In practical terms, an attacker does not need an account or special access to target a vulnerable system. Stamos said an attacker could gain control at the level of the web server, which may have access to the site’s data and, depending on how the organization is configured, other systems behind its perimeter.

Patching is not necessarily a simple update. The fix was released for the latest family of PHP, Stamos said, but many sites run older versions. Upgrading can break a site, and some organizations may need to refactor their code to work with the current version. Unofficial patches and backports exist, he said, but are less widely available.

Stamos described the resulting activity as a contest among attackers to seize vulnerable systems. Russian ransomware groups may install malware and decide later which victims to ransom. He also described a Chinese market for access to compromised sites, where attackers can break into large numbers of systems and later sort through them or sell access. In a previous example he cited, Chinese vendors broke into about 80,000 exposed SharePoint sites and sold access later.

Attackers may also try to lock out competitors by closing the vulnerability after they gain access. The goal is to keep other groups from removing their malware or taking control of the same server. A compromised web server may let attackers monitor information submitted through a site, copy its database, or use the system as a foothold to explore the organization’s production network. Some attackers, Stamos said, will take the data first and decide later what is valuable.

Cloudflare CEO Matthew Prince gave a measure of the volume in a post shown during the discussion. He said Cloudflare had seen thousands of attempted exploits in the ten hours before public announcement, tens of thousands in the 45 minutes after, hundreds of thousands within two hours, and millions by the time he posted.

The danger is not limited to the moment an organization installs a patch. Stamos expected a long tail of investigations and secondary breaches. A company may update its software without realizing attackers gained a foothold during the time it was exposed. Organizations with in-house security teams may detect and investigate an intrusion, while others will struggle to find incident-response help. Firms such as Mandiant, CrowdStrike, and SentinelOne were already heavily booked, Stamos said, because of the broader wave of incidents.

For consumers, a breach at a website can also become a credential problem. Stolen passwords are particularly dangerous when people reuse them across sites. Access to an email account can let an attacker reset passwords elsewhere, including accounts used for banking. Stamos expected more fraud, spam, and targeted messages using leaked personal information and social connections.

Stamos argued that PHP was the headline, not the whole story. He described the preceding month as one of the most intense periods in cybersecurity, with serious vulnerabilities and breaches affecting other software and companies. Within a day of the PHP disclosure, he said, significant flaws were identified in Node.js, which is more likely than PHP to appear in enterprise environments. Other incidents involved a certificate authority, infrastructure providers, and software used in the AI ecosystem.

A post shown during the discussion listed incidents involving PHP, Node.js, Java, GitLab, Railway, Signal, WordPress, and LiteLLM, among others. Stamos confirmed the broader pattern, while distinguishing unrelated attacks from the PHP flaw. Breaches at Railway and Fireworks, he said, were likely separate incidents and appeared to reflect attackers’ skill, potentially enhanced by AI.

He suggested that attacks on AI infrastructure companies and hosting providers looked more like professional operations than opportunistic work by an individual. Compromised API keys can provide a path back into cloud services, extending the consequences beyond the first breached company. Meanwhile, enterprises were trying to establish which of their systems used vulnerable software—including old, forgotten sites—and asking vendors what they had deployed and how quickly they had fixed it.

For Stamos, the shift is not only that more vulnerabilities are being found. Attackers are also able to operate at a higher tempo. AI can help with parts of an attack, he said, though he did not claim that every current campaign is automated. He said AI-assisted activity was not yet widespread in the situations he was discussing. As a separate reported example, he cited a Chinese group that had used fully automated AI attack chains against South Korean banks.

That threat is distinct from the idea that an AI model might independently escape its safeguards and attack systems. Stamos said labs had changed how they conduct model evaluations and training, and he did not regard models “going crazy” as the immediate security concern. The nearer-term risk is people deliberately giving agents broad access to their accounts and personal data.

Stamos pointed to banks seeing authenticated activity that appears to come from bots rather than stolen credentials. Products such as Instinct, he said, have become useful partly because they can get around some automated bot-detection mechanisms. That creates a conflict: financial institutions use those protections to limit automated access, while customers want agents to manage tasks across accounts and services.

Giving an agent an entire password manager and asking it to handle finances or file taxes is a risky form of access, Stamos argued. It asks people to trust a relatively new company with credentials that reach into the most important parts of their lives, while the agent may be designed to bypass protections built to prevent automated activity. The security problem is therefore not just hostile attackers using AI; it is also well-intentioned users granting powerful systems access that institutions did not design them to have.

Stamos’s advice to individuals began with a limit: ordinary users cannot stop companies from being breached. They can, however, reduce what a stolen password lets an attacker do. Use a different password on every site, he said, and use a password manager to make that manageable. If the same password has been reused across services, change it.

He also urged people to be more selective about where they enter personal information. Individuals cannot conduct formal vendor-risk reviews, but they can ask whether a small or unfamiliar site deserves their real details. One practical measure is to use a secondary email account for lower-value sign-ups, keeping an important account separate from the many services that may expose information.

The expected rise in spam, scams, and impersonation makes skepticism more important. Stamos warned that compromised contact information and relationship data could support convincing texts, emails, and phone calls, including AI-driven impersonation scams. A message that appears to come from someone familiar may be part of a larger attack using information stolen elsewhere.

For organizations, the immediate work is to identify exposed systems, patch them, investigate whether attackers entered before the fix, and assess vendors. The forgotten website can be as consequential as a production application if it sits on the same network or holds useful data. Patching closes a known door; it does not establish that no one came through it beforehand.

The broader response may require replacing old software rather than patching it indefinitely. Stamos argued that many of the vulnerabilities being found have existed for years, and that widely distributed open-source software is difficult to repair quickly. AI-assisted code analysis and refactoring make it more plausible to rewrite legacy systems than it was a few years ago, but that work requires time, money, access to capable models, and a willingness to replace software on which organizations still depend.

He said the PHP flaw was handled as well as it could have been under difficult circumstances, and rejected blaming the AI labs for exposing weaknesses that were already present. Models from other providers, including open-weight and Chinese models, could have helped discover the same bugs. Finding and fixing them is necessary, he argued, even if it means several years of heightened risk while organizations respond.

The distinction is important: Stamos did not present the current wave as proof that AI systems themselves are the main attackers. He described a mix of old vulnerabilities, faster discovery, professional attackers, and organizations with more exposed systems than they realized. Some weaknesses may now be easier to find and exploit; removing them will take sustained work.