The 'Token Beta' — Act I: Heads Down

The token economy is afoot, and how you posture in it will largely influence your personal competitive advantage for years to come. With the dystopia of tomorrow on the horizon — according to anyone with a podcast, albeit with varying credibility — this critique offers you the opportunity to change your place in our future economy. And you'll do it by simply acting in your own self-interest today; that is, after you've been distilled with this article's context. What this amounts to is you, or your firm, becoming one with what we call the 'Token Betas' — a growing archetype in the industry that methodically builds, deploys, or integrates AI solutions for its business in the face of the microphone-holding, chest-bumping voices of incentivized social-media influencers and misplaced C-suite narratives like 'AI leaderboards' ranked solely on token usage. The worst piece: the enterprises that don't realize telemetry has entered a new age — and that, odds are, it is sitting on the device you're reading these words from. This is the first of our trilogy, and by the end of this section alone, odds are you will have knowledge well beyond your station.

Act I — The Protection of Token Betas: Heads Down

It doesn't matter who you are — the odds are high that the most important border for you has nothing to do with the border security catching headlines today. It's the borders, and the associated security, placed around your or your firm's intellectual moat — or, as Alex Karp coined it on CNBC in early July 2026, 'Your Alpha'. To understand how the 'Token Beta' approach protects 'Your Alpha', we first have to frame what 'Your Alpha' is — and why it was worth Mr. Karp's unstructured rant in the first place. That brings us to the 'heads down' moniker in our title: the reality of enterprise telemetry's changes, and what they mean for your business and your place in it today.

We're living in a land where we're reading about (or choosing to ignore) OpenAI poaching trade secrets away from Apple's hardware unit, or Anthropic flipping its strategic design partnership with Figma only to subsequently announce Claude Design. What, in the realm of your lowly enterprise customer agreement (no matter how large), do you think these headlines mean strategically for you or your business? To be clear, being a large, regulated enterprise customer is the best case. Imagine you're in an unregulated industry, like a middle-market manufacturing company, or dial down the size to a small startup. Theirs is a more penurious position.

This landscape is frontier-model agnostic — whether it's a Copilot, a Cowork, or anything that's not local and hooked into a claw: keeping your 'heads down' about this reality won't save your firm or role any more than closing your eyes would help you win an eleven-leg parlay.

The Telemetry Parlay

Today, most firms are gambling with their intellectual property exposed (IP — 'Your Alpha'; we'll loosely use these terms interchangeably for much of this brief). Firms today are gambling on a parlay, full tilt, while their MSPs (managed service providers) have leveraged an undocumented explosion in telemetry that even the most astute technologists only dare to whisper to one another (because of how it can hide within security telemetry). Everyone's seen data aggregators for their personal data being poached and subsequently sold, but somehow we've all turned a blind eye to the reality that the mechanisms that harvest our personal info today can also be directed at our intellectual moats. The breadcrumbs of this activity are embedded in the CVEs (Common Vulnerabilities and Exposures) behind the legitimate security patching on all our devices — but when you see labels branded as 'anonymous user experience' in the guise of patching improvements, the wonder should begin to creep in: how would something that sends network packets linked to your device to any third party remain truly anonymous? Timestamps on specific activity alone can potentially reverse-engineer any anonymized user base today. So those less-than-anonymous 'user experience diagnostics' are, in actuality, just user-experience telemetry — and that's assuming 100% blind benevolence from every MSP and perfect compliance by their IT. Keep in mind, this is the perfect world where AI agents don't exist as an attack vector — it's not like AI bots cruise the internet for days on joyrides showcasing their cyber prowess. Anyone who's used a chatbot knows it will apologize to you when the LLM makes a mistake (like jumping a sandbox mistake); it was an accident, after all. With the apology inline in your context window, let's assume for the moment that bots won't expose vulnerabilities — the same way economists assume perfect markets when they teach supply-and-demand curves. Here's our 'perfect market' — a snippet of a recently patched Windows telemetry CVE. As the CVE indicates, you stand to lose services you need merely because the telemetry exists (that is, if the vulnerability were exploited):

No LLM to blame just yet, but it's worth asking: why would other services depend on user experiences being stored by Microsoft in the first place? You don't need to understand the CVE framework or any technical jargon to grasp the practical fallout. It has shown up for us all — in the form of searching for a file you know exists, or an email you're certain you sent, where a keyword search simply comes up empty. You end up finding it manually, rummaging through emails or files one by one. In the same vein sits the copy/paste between spreadsheets, which in recent years has been behaving more and more unpredictably. It can be frustrating that copy/paste efficacy was torched in favor of telemetry, and it's vital to recognize that your ability to press Ctrl+C/Ctrl+V is not the culprit. (Didn't you know? You could always just turn the functionality off to resolve the issue of it not working.) These are the subtle, hair-graying symptoms of a service-dependency chain that was never supposed to be visible to you.

Heads Up

Knowing this reality is the first step of the 'Token Beta' culture — the step that protects your business today, from today: 'Heads Up'. Well, you just got it; now what do you do with it?

'Heads Up' is specifically for the sake of your business's IP — at least in this section; we'll go through the token-usage mechanisms and their associated architecture later. But if you'd like to keep your role, or your business — it doesn't matter what business you're in — a good start would be keeping your unique selling proposition, your IP, or anything else you've done successfully to this point. That means today — preferably right after you finish reading this article — give your IP some border security and start to explore how to gate 'Your Alpha'. (Hint: the solution is not to wrap your business in Palantir.) The above was one resolved CVE, and it illustrates a telemetry rabbit hole that is much deeper and more nuanced. The goal is for blanket telemetry and its negative implications to be on your radar — minimized wherever possible, prioritized whenever practical — and for you, as a newfound 'Token Beta', to understand that your unique bastions of data can be casually and blindly ingested over silly conveniences where valid telemetry-free alternatives exist. Personally, we've all clicked through one of those lengthy, 24-page-style terms-of-service documents designed to be blindly accepted (go back and read your business's TikTok policy). If you're reading this and have made a few of these wordy docs yourself, you know best: blindly clicking through these agreements for your firm is not a business strategy — it's a dice roll. A snippet directly from the TikTok for Business Commercial Terms of Service:

This means that if TikTok mishandles your business data or ad account, you cannot sue in court and cannot join a class-action lawsuit. Disputes must go through private binding arbitration — a forum that statistically favors the company writing these ToS agreements. Again, this is just one example — and in this case, one sitting on your corporate mobile devices, where internal data compromised by the same telemetry is a potential violation of Regulation S-P, HIPAA, and much more if you're operating internationally. Regulators are almost ignorantly waiting to see how this plays out, but once they finally become wise to the violations under their purview, they will happily have your firm spend time in arbitration with them. You'll be in arbitration around the exact time you've realized your business's IP has been lifted, and no one is coming to save you. The lawyers you've retained at a few grand an hour will be sitting right there with you — their firms didn't understand today's technology either, and now their businesses are in the exact same boat.

The overarching point: your lowly enterprise agreements are not worth more than the partnership agreement Figma had, nor the employment agreements Apple had. Many of you have blindly 'clicked accept' on those 24-page, TikTok-style terms of service for your business. It could have happened when you began conveniently transcribing your meetings under a 'TL;DR AI' that lands in a neatly indexed document summary on Google Drive or OneDrive. Maybe you started fiddling with 'bossware' items wrapped in productivity branding like Viva Insights, or merely used Microsoft Teams. Maybe that's not you or your firm; you're the 1% on Linux, and smart enough to realize that cloud-based AI transcription is no way to treat your meetings if you're talking about vital business strategy. For you, let's take it a step further: you're a top-tier, privacy-focused dev using GitHub Enterprise or GitLab Ultimate repos secured by privately protected MFA passkeys — where are those server logs sitting? Internal employees or future agents of GitHub/GitLab aside, we are living in a world where AI is attempting to social-engineer fake profiles to get access to private repos. If you're using IDEs like VS Code, Codex, or default JetBrains, it doesn't matter; the fox built the henhouse.

Agents Enter the Chat

This covers most enterprises of all sizes, and that means most of the people reading this have the opportunity to escalate the issues with telemetry internally. These concepts were once well known across enterprises — when everything first moved 'to the cloud' in the mid-2010s, they were likely internally documented as risks. But business has survived those risks for a decade (telemetry 2016 < telemetry 2026), and enterprise has been lulled into a false sense of comfort. That comfort is hardened by a herd effect — everyone is doing it — akin to what happened during subprime mortgage securitization. With our article's breadcrumbs in place, we'll glue the exposure all together. Allow us to reintroduce: probabilistic AI models have entered the chat. Do you think OpenAI is going to ignore the information gleaned from the rogue agent? At the very least, they are going to index it for efficacy in their research pipeline. As an aside, there's an irony here: the Hugging Face security team had to use the open-source, open-weight Chinese GLM 5.2 to conduct the forensic analysis resolving an issue created by a closed-source, otherwise-restricted model. With OpenAI stating explicitly that incidents like this will become more common, and knowing you have cloud MSPs whose servers you don't control, the natural knee-jerk reaction is to run to your legal or compliance team as your enterprise-agreement enforcement mechanism. These are the same people who got you here, and these pieces of paperwork or policy are just that on their best day. Where you should be turning is IT — not the outsourced-to-an-MSP kind, either, but the kind aligned with your stakeholder interests (bonus, equity, long-term contracts with clawbacks). Maybe your reaction is to reactively fire legal, compliance, and some IT. That's reasonable, but blaming them will not save your firm from the telemetry expansion that took place under your noses. This moment will most likely put the most sophisticated among you in courtrooms for years to come. Litigation can be a viable strategy — and it's the exact reason patent trolls don't typically go after larger players. There's only one problem with this legacy strategy: AI is the new 'too big to fail', and without formal AI guardrails, your ROI is better placed protecting your moat of tomorrow than fighting for your moat of yesterday.

We've shown through these articles and snippets that telemetry can be the entry point to go after any piece of any business — it just needs to exist. We've gone through institutions holding stronger-than-enterprise agreements (i.e., partnership > employment > enterprise) that made headlines with cases whose facts and circumstances seem like a layup to any non-legal expert. In addition, the only reason we know about the well-documented instances of bots going awry is that Hugging Face and the UK's AI Security Institute are sophisticated players in the world's technology ecosystem — and, equally important, they 'won'. Imagine all of the unlogged, less-than-organized events that have gone on in the time it took to read this article. You might think the GLM 5.2 reference earlier made them the good guy of this story. There is no good or bad here — only actors with intent. Those intentions can turn a nefarious gaze toward these exposures with surprising ease, and that doesn't make headlines. It's the undocumented bots internally reviewing the telemetry you've served up — an IP silver platter for future rogue (or maybe not-so-rogue) models and agents — and your firm is practically paying them to do it.

With that in mind, the focus isn't to move your business into an off-grid, on-prem log cabin with no network, checking all Meta glasses at the door (although you should check those Meta glasses before you start working — or start writing up the Regulation S-P violation yourself). Controlled sharing was how everyone benefited from the benevolence of the open-source movement. It's why we are here today and why progress has been exponential — Grandma can vibe-code now if she wants to; you can thank the open-source movement for that. But if Grandma has moved from knitting to app building, the new risks introduced only scale exponentially for the technologists who actually know what they're doing. With the changes to telemetry and the advancement of AI agents, the professional world is quickly morphing into 'surveillance-as-a-service', whether you want it for your business or not — whoever said SaaS was done? Keep in mind: the sharing of the open-source movement was voluntary and controlled, whereas today's is less so.

The WIPO Tell

This is normally the part where, whether idealistically or ignorantly, you may feel that government guardrails will be in place to protect your IP, and that your firm is safe. We don't know what country you're reading this in, so we'll use a broad example — one powerful enough to quell even the staunchest advocate. Consider the WIPO, the World Intellectual Property Organization. Though less of a household name than the Fed, it's a branch of the UN established in the 1970s. Let's treat the WIPO for a moment the way we treat the Fed's 'Beige Book' releases today — specifically, the part where economists dissect subtle wording changes from one release to the next, attempting to forecast the trajectory of future Fed policies and interest rates.

The WIPO holds an annual conference in Switzerland — think of it as their 'Fed Meeting'. At the 2025 conference, the WIPO Pulse 2025 survey found that global trust in IP systems had 'reached new heights'. Covering 35,500 respondents across 74 countries, the survey averaged a score of 4 out of 5 on the importance of IP rights for fair compensation and consumer confidence. That survey size is larger than most U.S. presidential election exit polls. The results were so empowering that the 2025 'Fed Meeting' highlight video ended with the phrase 'purpose to make IP work for everyone'.

Now fast-forward to 2026: that language was removed. Instead of summarizing the 2025 findings, they replaced the annual meeting's 'Beige Book' of 2026 with Report #1, on AI adoption rates. Keep in mind, this is still the institution meant to protect your IP; it has 194 member countries represented — odds are, your business, and wherever you do business, are represented there. Here is the same institution, same conference, in the 2026 summary video recap: it's eight seconds longer, but completely silent on that empowering 'purpose to make IP work for everyone' language. Based on that language change, we think our WIPO 'Fed' is about to cut IP protections by a few hundred basis points.

With the institutions meant to protect IP asleep at the wheel, and as the fear starts to set in over what this could mean for you or your business, there is a natural comfort: if you know how, frontier models under a protected framework — even with telemetry — can be amazing to use. That 'if you know how' is an important caveat, and one by which you and your firm will be indexed. If your firm survives the brave new world of inference ingestion, your tale will be used as a beacon for years to come. This brings us back to why 'Token Betas' are the future, and why being one is appealing for yours.

Thank you for reading — this has been Act I. You've now seen arguably the most important piece of the 'Token Beta': 'Heads Up' to telemetry and its risks. But that's just the defensive side of the 'Token Beta' game plan. In the next piece of our trilogy, we go on offense — but to do so, we'll need to describe in more detail the methodology and focus of the 'Token Beta'. Next: 'Act II — The Power in Token Betas: Tokens Up'. In the meantime, talk internally about your firm's telemetry landscape. Do you have the capabilities to assess whether you're at risk? Are there other privacy-exposing concerns, specific to your operations, that weren't listed above?