Microsoft, Uber rethink AI coding tools as costs spike

Today's episode focuses on the growing tension inside firms as AI coding tools scale faster than budgets can support. Microsoft and Uber are both pulling back after runaway usage pushed costs far beyond expectations. Their shift is an early signal for professional service firms evaluating how to control consumption before it becomes an uncontrolled expense. This matters because AI tools often feel inexpensive during pilot phases, but usage grows exponentially once teams adopt them. Without strong limits, firms risk turning automation into a major operational cost. Leaders also need to address shadow AI, identity‑driven threats, and vendor tools that do not match the real daily workflow. We also cover new moves from BT Business, Cato Networks, and the latest CI pipeline breach involving Megalodon. Learn more at https://crestvale.io

Transcript

SPEAKER_00 0:00

Microsoft and Uber are both running into the same wall. Their AI coding tools are blowing through budgets so fast that even they are pulling back. If the biggest players have to slow down, every smaller firm needs to pay attention. This is the Crestvale Newsroom Daily Podcast. The most important story this morning is the sharp turn happening inside Microsoft and Uber as they rethink how much AI coding tools should be allowed to run. Both companies pushed hard on agent-style coding assistance. Both saw usage spike far faster than expected, and both discovered that token pricing at scale is not a small expense. It is a budget event. At Microsoft, internal teams leaned heavily on clawed code. The company cut most of those licenses and pushed developers back to GitHub Copilot. That is not a preference shift. That is a cost emergency being handled quietly. Uber went even further. Leadership encouraged aggressive use of AI tools and even set up leaderboards to track who used them the most. By April, the company had burned through its entire 2026 budget. That is eight months of spending, gone in four months. The message is clear. Encouraging unlimited usage creates unlimited bills. Gartner is warning that this problem gets worse as agentic workloads gain traction. Even if token prices fall, the number of tokens consumed rises faster. It is the classic trap. Tools feel cheap during testing, then production use explodes. This is where it hits professional firms. The risk is not the list price. The risk is consumption. Once staff adopt these tools, usage ramps invisibly. And without controls, your technology budget becomes a variable cost with no ceiling. Blanket access feels generous, but it is not strategic. Leaders who roll out these tools without limits are not deploying automation. They are creating a new cost center. Now here is why this matters. If Microsoft cannot absorb this cost and Uber cannot contain it, a mid-sized firm will not stand a chance without controls. The smart move is to set usage limits now, define what work should go through these tools, and monitor consumption daily. Every firm that waits will face the same shock, and it will arrive fast. Now let's turn to the second major story. Shadow AI is not coming from junior staff. It is coming from your partners, directors, and executives. Trusted tech data shows that senior decision makers use unapproved AI tools at almost double the rate of other employees. And many of them know the risks. They still bypass policy because approved tools do not meet their needs. When leaders ignore governance, the rest of the firm sees that as permission. Attempts to ban tools do not work. A large share of employees say they will keep using AI even if it violates policy. That is not defiance. It is a gap between the tools offered and the work that must get done. Firms that do not address that gap will lose control of their data surface. Meanwhile, identity has replaced the network perimeter as the primary entry point for attackers. Most major incidents now start with compromised credentials, human or machine. Once an attacker takes over an identity with broad access rights, your internal network offers little resistance. The traffic looks normal. The activity looks like a user doing their job. Machine identities are the weakest point. Service accounts, application tokens, and automation credentials often never expire. They carry far more access than they need. And once they are stolen, attackers can move through internal systems without triggering alarms. This is the breach pattern now. Stolen identity, lateral movement, escalation, then ransomware or data theft. By the time anyone notices, the attacker has already done the real damage. Firms that still view identity as an IT chore are living in the past. There is another important shift happening in how AI tools fit into real work. Most vendors build tools around an idealized workflow. They assume clean linear paths. They assume the map is the territory. But real work is messy. A recent study found almost 200 separate micro tasks inside a single primary care visit. That same pattern shows up across legal, accounting, and consulting workflows. When vendors skip direct observation, they build guesses. Those guesses add friction, they increase rework, they slow teams down. If a vendor cannot show exactly which tasks their tool removes and which it adds, you should assume the tool will cost you time rather than save it. Here is what else is worth knowing today. BT Business is pushing CrowdStrike-powered security tools into small and mid-sized firm budgets. Enterprise grade detection is becoming the expectation, even for small shops. Cato Networks is wiring data security posture signals into its XDR platform. This tightens the connection between where sensitive data sits and how threats are flagged. Mid-market firms have been weakest in this area, and a threat group known as Megalodon compromised thousands of GitHub repositories by poisoning CI workflows. It is another sign that continuous integration systems are now one of the most valuable identity targets in the software supply chain. Before we close out, here is a quick look at where markets landed. The S P 500 closed higher in the previous session. The mood there was steady and confident. The NASDAQ also closed higher. Risk appetite held up across large technology names. The tenure treasury yield moved up by the close. Borrowing conditions tightened slightly. Bitcoin finished higher as well. Sentiment there leaned positive. Here is the takeaway treat AI consumption as a financial control problem, not a technology experiment. Tomorrow we are watching how firms are adjusting AI budgets ahead of mid year planning as internal usage continues to rise. If this was useful, follow the Crestvale Newsroom Daily Podcast so you don't miss it. Thanks for listening.