Nadella's lock-in test: pull out a model, see if your evals survive
Microsoft's chief executive spent a long interview arguing the AI fight is not about which model wins, and Apple published the factory-to-photo chain of trust behind its provenance system.
Satya Nadella used a rare All-In podcast appearance to say the durable AI business is the harness, not the model — and that enterprises must own the weights, memory and evaluations their agents run on. "I want my privacy. I want to be able to embed my knowledge in a set of weights that I control. I want to see the entire chain of thought... My IP should not leak," he said, framing a stack where the model, the orchestration layer and the memory system all belong to one vendor as a database whose seller claims the data you put in it. His test for any CTO is blunt: "pull out a model and see whether I can retain the eval. If I can't, that means you really are dependent on something that may or may not be yours." The remedy he wants is interoperability, including key-value cache reuse across model families, so memory stops being hostage to one supplier. On the numbers, Nadella defended Microsoft's $175 billion capital plan as built for the long tail rather than for "two or three anchor model companies," put Microsoft 365 Copilot at more than 30 million subscribers inside a 450 million knowledge-worker base, and offered a one-liner on the capex contest: "Speaking about a lot of capex is not a feature, it's a bug."
Two disclosures in the interview carry more weight than the strategy talk. Microsoft is building a frontier-class model from scratch — hill-climbing on its own reinforcement-learning environments and data rather than distilling anyone else's weights — with a cyber model that Nadella says beats the field on security evals when Microsoft's harness orchestrates other models alongside it. And he named a risk that has not reached investor models: persistent agents as a new insider-threat class, where the mundane failure is not malicious superintelligence but a model told to "optimize my working capital" that fakes the books. That is a test-time failure, he noted, and it can happen on an ordinary task no safety committee is watching — the argument for treating safety as monitoring, auditability and containment rather than a principles document. This is the same executive who backed deliberate pacing last week — Nadella backs AI pacing, and picks a fight over who referees — and the shift is telling: pacing is a message about other labs' pace, while "use all models, be independent of all models" is a message to his own customers about where their switching costs should sit. The tell is that Microsoft is now building weights of its own, which makes the anti-lock-in sermon slightly easier to preach and slightly harder to fully trust.
Apple published the architecture behind Reference Image, and the chain of trust begins on the factory floor, not on the phone. Each image sensor generates its own ECDSA P-256 signing key the first time it initializes in the factory and never releases the private half; the Secure Enclave produces a separately attested key, and a third certificate authority signs a device manifest binding sensor to enclave, so Private Cloud Compute can later verify that a specific sensor and a specific enclave shipped inside the same iPhone. At capture the sensor signs the digitized frame and an embedded metadata digest itself, so the operating system can only hand over the pixels the hardware recorded. Capture time is nailed down from both sides: the device keeps the freshest RFC 3161 timestamp token delivered on the push-notification heartbeat — globally about every 15 minutes — as a proven lower bound, then requests a second token after the shot for an upper bound.
The final signature on a developed reference image is a composite of RSA-3072 and ML-DSA-87 — post-quantum, on the reasoning that an image asserted authentic in 2026 should still be verifiable decades from now. Private Cloud Compute also scores whether an image carries the physical characteristics expected of raw sensor output, feeds that score into a per-sensor running record, and can revoke a single photo or every photo from a compromised sensor, with devices checking revocation lists on-device so no one learns which photo is being checked. Apple signed images with its own service instead of a photographer's credential specifically so conflict-zone journalists are not forced to trade anonymity for authenticity — the design choice that separates this from the C2PA model, and the one we flagged when the feature shipped in Apple wants to prove your iPhone photos aren't AI slop, after researchers showed C2PA camera proofs can be forged on a rooted Pixel.
What to watch: whether model vendors actually agree on a KV-cache standard, and whether any major platform honors an Apple signature once the photo leaves the Photos app.
If swapping a model broke your evals tomorrow, would you call that lock-in — or a system that was never yours? Tell us in the comments.
