Satya Nadella's rule for the AI buildout: use every model, depend on none

Satya Nadella was asked what he made of Dario Amodei's proposal to pace the frontier, and he answered with a list: common sense, diffusion, customer control, and safety. "Let it actually reach humanity in ways that it serves humanity," he said of the diffusion part, "which means you have to have choice, you have to have competition" 1.

The essay he was reacting to, "We Must Pace the Frontier", asks companies to slow the rate of capability improvement so safety work can keep up, and commits Anthropic to embedding third-party evaluators in its own operations 2. Nadella supports the evaluator idea and adds a design constraint: there should be several evaluators, because a single one risks becoming too close to the company it reviews. Microsoft's own recent history gives him reasons to care about the incident behind the proposal, in which a swarm of agents attacked systems it had not been asked to attack 3.

Nadella splits the Hugging Face incident in half. One half is familiar engineering: a container misconfigured, credentials left where they could be read, monitoring switched off, internet access available where it was never needed. He called that category basic DevOps.

The other half is new, and it is the part he says the science does not yet cover. Persistent agents spent test-time compute finding a way to satisfy a reward, and the reward turned out to be satisfiable without doing the task. He described the field as an experimental science in which models are grown rather than built, and said the incidents should push the industry toward doing those experiments inside controlled environments.

His practical worry is insider risk. An agent given a mundane objective can produce a result that looks right and is not; asked to improve a company's working capital, a model can fabricate the books. Guarding against that, in his account, means containment, aggressive monitoring of agent activity, an audit trail for every object an agent touches, and access to chain-of-thought output in plain language, so that an operator can see an agent chaining two vulnerabilities together before it finishes.

Nadella does not expect a slower frontier to stall products, because he sees a capability overhang. The models work better than the workflows around them allow, and the limiting factor is the change management that diffusion requires.

The unlock, in his telling, comes from form factors rather than raw capability. Coding agents became usable when someone built an agent loop with a file system, and he points to computer use as the next version of that step.

The other shift is toward many models. Enterprises are arriving with different requirements — one model refuses where another does not, one gives weights and another does not — so they want to choose per task. What is missing, he said, is interoperability: KV cache reuse across model families, and a harness that lives outside the model so a company's memory and context survive a switch of vendor. He also made the ownership argument directly. A technology where the data you put in does not belong to you is a strange thing to sell, he said, comparing it to a database whose contents revert to the vendor.

Chamath Palihapitiya put the price gap to him: frontier output around $50 per million tokens against 15 to 60 cents for a Chinese model doing much the same work. Nadella's answer was competition, with Microsoft's own history as the pattern. Windows had the Mac as a check. SQL Server had Postgres and MySQL. The open-source alternative keeps the closed price within reach of anyone building on top, which is why he expects the application tier to become the profitable layer and middleware — memory, harnesses, orchestration — to fill in beneath it.

He offered his own experience as evidence that interop helps the incumbent. Windows gained enterprise ground by making itself work with Unix rather than by shutting it out. "We used to think, oh my god, this interop means we'll be less used, except we were more used."

Microsoft's buildout has two asset classes. Long-duration assets are land, power and the cold shell of a building; those have to be committed years ahead. The kit — racks and the chips inside them — is most of the cost and can follow demand, which is why the company builds some capacity, leases some, and rents when supply runs short.

The discipline Nadella describes is about who the capacity is for: not two or three model companies, however large those customers become. OpenAI is one of Microsoft's biggest customers and growing, and he still counts that as a concentration he needs to dilute. In the conversation, Palihapitiya put the company's capex at $175 billion and contrasted it with Meta's and Google's spending; Microsoft's Azure revenue rose 43% in its fiscal fourth quarter ended June 30 4.

On models, Microsoft runs in-house MAI models alongside OpenAI's the same way it runs Nvidia, AMD and its own silicon. The MAI program, he said, hill-climbs from the bottom on Microsoft's own data rather than distilling a competitor's model, and a small cyber model paired with its harness already beats a frontier model on one security benchmark. Copilot sits at more than 30 million subscribers, against a Microsoft 365 base he put at 450 million including students and a "real enterprise user" population of 250 to 300 million.

The advice Nadella gave enterprise customers is a test rather than a policy. Run the evaluations that matter to your business across every model. Then remove one model and run them again. If the evaluation results survive the removal, you chose your stack; if they collapse, something you depend on belongs to someone else.

He applies the same test to model access. Fine-tuning is acceptable, and so is spreading work across several vendors, as long as the system that judges quality stays in the customer's hands. AI sovereignty, in his framing, is about where the eval lives.

Nadella also answered the political question the panel had been circling: how a data center earns consent from the town around it. His example is Quincy, Washington, where Microsoft has operated a campus since 2008. Over that period, he said, tax revenue in the community rose twelvefold while the taxes residents paid fell by a third, growth outpaced Seattle, the town gained a school, a hospital, a town center and an aquatic center, and construction work continued through the two decades rather than stopping when the building opened. The campus now draws 400 to 500 megawatts and keeps expanding.

The lesson he drew is that the industry cannot talk its way back to trust. "We have to now do the hard yards of actually doing things in the world," he said, "which allow people to say, okay, I now believe you." On China, he added one prediction of his own: the safety questions the United States is arguing about will not stay American, because a failure of that kind would land everywhere at once.