Alex Karp has spent the past few weeks saying aloud what a growing number of enterprise leaders have begun wondering privately. What exactly are the frontier AI companies doing with all the data, context, workflows and institutional knowledge their customers are feeding into their systems? Why are companies spending so much money on tokens when many still struggle to connect that consumption to measurable business value? And why are the companies that began by selling access to models now building agents, coding environments, enterprise applications and the other software that sits between those models and their customers?

Karp has not been subtle. The Palantir CEO says something has gone wrong in the relationship between the model companies and their enterprise customers. Companies are paying for intelligence while potentially surrendering some of the proprietary knowledge that made them valuable in the first place. As Tim Higgins recently described it in ⁠The Wall Street Journal, Karp is drawing attention to the power and insight AI labs can derive from their customers’ data and decision-making—the magic sauce behind what makes a company successful.

Satya Nadella has now given the problem a name: The ⁠Reverse Information Paradox.

Nadella begins with economist Kenneth Arrow’s traditional information paradox. A seller may have to reveal information before a buyer can understand its value, but once the information has been revealed, the buyer already possesses it. AI reverses the risk. The customer buys access to intelligence but must disclose more and more of its own proprietary knowledge to make that intelligence useful.

The enterprise effectively pays twice: first with money and then with the institutional knowledge it feeds into the system.

That second payment may ultimately be more valuable than the first.

The Enterprise is Teaching While it Uses

There is an important line to draw here. Karp’s accusations and Nadella’s argument do not establish that Anthropic, OpenAI or every other frontier lab is secretly training its models on enterprise data in violation of customer agreements. Enterprise contracts frequently contain stronger privacy and data-retention protections than consumer AI services, and zero-data-retention arrangements are available for sensitive workloads. The treatment of customer information depends upon the provider, product, contract and deployment architecture.

But the absence of a proven contractual violation does not make the underlying concern imaginary. An enterprise interaction with an AI system may include far more than a simple prompt. It can expose customer histories, internal processes, pricing logic, software code, operating exceptions, decision-making patterns and the accumulated judgment of employees who know how the business actually works.

Nadella expands the definition of what is at risk. It is not merely the source data placed into a model. It is what he calls the exhaust generated through the enterprise’s use of AI: prompts, agent activity, traces, evaluations, feedback and, perhaps most importantly, the corrections people make when the system gets something wrong.

Every correction can convert a piece of human judgment into machine-readable institutional knowledge. It teaches the system how this particular company defines a good answer, handles an exception or makes a decision. Individually, those interactions may appear inconsequential. Collectively, they can describe how the enterprise operates.

The company is not merely consuming intelligence. It is creating intelligence through the act of consumption. The strategic question is where that newly created intelligence accumulates and who has the right to use it.

If the learning flows primarily toward the provider, value will gradually migrate toward the company controlling the learning infrastructure. The enterprise may receive better answers, but the provider gains a continually improving understanding of how customers work, what they need and which products should be built next.

That is a much larger concern than data leakage. It is the potential transfer of the enterprise learning loop.

Sovereignty is Becoming an AI Requirement

Palantir formalized its position in a new white paper, ⁠Institutional Sovereignty in the Age of AI. The paper presents 15 steps governments and companies can take to protect their data, models, compute and control layers. Its recommendations include zero data retention, model choice, deliberate hardware decisions for sensitive workloads and enterprise control over permissions, auditability, cybersecurity and context.

Palantir’s risk model is intentionally severe. It argues that an enterprise using a third-party model without zero-data-retention protection should presume the system is extraction-prone. The paper depicts an external inference service retaining customer interactions and identifies several potential consequences. The information could contribute to future model improvements; capabilities might drift toward competitors, stored prompts could become discoverable in litigation, and metadata could expose sensitive patterns even when the underlying content remains protected.

Again, this is Palantir’s risk model, not proof that every provider engages in each of these practices. But the architectural point is sound. If an enterprise does not know what happens after information crosses its trust boundary, it does not have sovereignty over that information. A privacy policy and carefully negotiated contract can reduce the risk, but enterprise leaders should also ask whether the system minimizes the transfer in the first place.

Nadella reaches a similar conclusion. Enterprises need to own their evaluations, memories, feedback, traces, decisions and institutional context. They need protected environments in which models can learn against real workflows without exporting the company’s accumulated knowledge. They also need an orchestration layer that remains independent of any single model.

That last requirement is a useful test. If one model disappeared tomorrow, could the enterprise continue operating with another model while retaining everything its systems had learned? Would the company keep its accumulated capability, or would years of institutional learning leave with the provider?

If the learning cannot move, the enterprise does not truly own it.

Karp and Nadella Have Positions to Protect

I understand what Karp is saying, and Nadella has given the argument greater intellectual weight. Much of it deserves serious consideration by any company putting valuable data and workflows into AI.

But neither Karp nor Nadella is a neutral observer who discovered enterprise sovereignty solely out of concern for customers. They are also defending the parts of the AI economy their companies intend to own.

Palantir benefits from a world in which foundation models become increasingly interchangeable. If open and lower-cost models become capable enough for most enterprise workloads, customers have less reason to build their operations around a single frontier lab. The model becomes a replaceable component inside a larger system.

In that world, durable value moves toward the layer where Palantir has planted its flag: enterprise data, ontology, context, permissions, governance, orchestration and operational execution. Palantir does not need one model provider to dominate. It needs enterprises to believe that the model should remain subordinate to a customer-controlled operational layer—which Palantir is happy to provide.

Nadella is operating from an even more complicated position. Microsoft helped finance, commercialize and distribute frontier AI. It supplied infrastructure, capital, enterprise credibility and access to customers. Microsoft embedded AI throughout its productivity software, development platforms, cloud services and business applications.

The relationship was comfortable when the model makers appeared likely to remain suppliers operating inside Microsoft’s ecosystem. It looks different when those suppliers build competing coding environments, agents, productivity applications, enterprise memory and direct customer relationships.

Microsoft wants enterprises to retain their learning inside protected tenant boundaries. It also wants Azure and the wider Microsoft stack to provide those boundaries. Microsoft supports model choice, but it would prefer that customers exercise that choice through Microsoft’s cloud, orchestration and application layers.

Karp wants the control layer. Microsoft wants the cloud, productivity environment, orchestration layer and customer relationship surrounding it. Both are warning enterprises about a genuine transfer of power while competing to become the trusted alternative.

Commercial self-interest does not invalidate their warnings. It helps explain why those warnings have become so urgent.

Frankenstein’s Monster Has Escaped the Lab

David Sacks, the former Trump administration AI and crypto czar, described Anthropic and other model makers in the Journal as moving “up the stack” into applications. He is right about that too.

The frontier labs were far less threatening to the established technology order when they appeared likely to remain suppliers. Venture capitalists could finance them. Cloud providers could supply their compute. Enterprise software companies could embed their models. Consultants could build services around them. Existing platforms could add an AI button, call an API and retain control of the application, workflow and customer relationship.

That arrangement worked nicely for everyone above the model layer. The model companies provided the intelligence while the incumbents retained the parts of the stack where distribution, customer ownership and higher margins traditionally reside.

The frontier labs apparently have other plans.

Anthropic, OpenAI and their peers are expanding into coding environments, agents, research systems, enterprise workflows and other applications. Each new product places them closer to the work being performed and the customer paying for it. The model company is no longer merely supplying intelligence to someone else’s software. It is increasingly building the software, operating the agent and establishing the relationship through which the customer consumes intelligence.

The technology establishment helped unleash a force it believed it could finance, influence and contain. Now Frankenstein’s monster has escaped the lab.

The lab in this metaphor is not only the research environment in which the models were created. It is the commercial enclosure the established technology companies expected to maintain around them. The incumbents believed they could fund the models, host them, distribute them and capture the more valuable layers above them.

Now the model makers are climbing into those layers themselves. The companies that were supposed to supply intelligence to the software industry have accumulated enough capital, technical capability, brand recognition and distribution to remake parts of that industry around themselves. They have ambitions of their own, and those ambitions increasingly overlap with the businesses of the people and companies that helped create them.

Karp, Nadella, Sacks and the rest of the establishment may be identifying a legitimate danger to enterprise sovereignty. They may also be recognizing a danger to their own sovereignty. The frontier labs are no longer simply producing intelligence for the established technology industry. They are using that intelligence to enter some of its most valuable markets.

Frankenstein’s monster may not merely escape. It may eat their lunch.

Moving up the Stack is Rational

That does not make the model companies villains. It makes them companies.

Model performance continues to improve while capable open and lower-cost alternatives proliferate. Enterprises are learning to route workloads among models based on cost, speed, risk and required capability. Token prices face continuing downward pressure while training and operating frontier systems remain enormously expensive.

If models become more interchangeable and inference margins decline, frontier labs cannot support enormous ambitions and valuations by remaining wholesale suppliers of tokens. They need to capture value elsewhere. That means owning the agent, coding environment, workflow, memory, marketplace, interface and, ultimately, the customer relationship.

This is one of the central arguments of my forthcoming book, The Indispensability Trap: Why Becoming Essential Caps the Fortune, From the Railroads to AI. The greatest fortunes are rarely captured by companies providing the essential commodity at the bottom of a new economic system. They are captured higher in the stack, where someone controls orchestration, distribution and the customer relationship. The model companies understand that history. They have no intention of remaining mere suppliers of tokens.

Palantir and Microsoft understand it too. That is why this is not a simple confrontation between companies that respect enterprise sovereignty and companies that do not. It is a competition among model providers, cloud companies, application vendors and control-layer platforms to determine which will become hardest for the enterprise to replace.

Sovereignty Requires the Ability to Leave

Enterprise leaders should listen carefully to Karp and Nadella without adopting either company’s interests as their own. Choosing Palantir instead of a frontier lab does not automatically produce sovereignty. Neither does placing the learning loop inside Microsoft’s tenant boundary. Every vendor has an incentive to make its layer indispensable.

The leadership task is to preserve the enterprise’s freedom of action across the architecture. Sensitive interactions need enforceable data-retention protections. Workloads should be capable of moving among models without requiring applications to be rebuilt. Enterprise memory, evaluations, corrections, traces and context should remain owned by the enterprise and exportable in a complete, usable form. Identity, permissions, policy enforcement and audit records should not disappear because a vendor relationship ends.

Executives also need to recognize when an AI supplier is becoming a potential competitor. Information shared today to improve an agent or workflow may help a provider understand tomorrow’s application opportunity. That does not mean enterprises should stop using frontier models. It means they must stop treating model selection as an isolated procurement decision. The architecture, contract and operating model must account for where learning and value accumulate over time.

The model companies want the agent, application, memory, learning loop and customer relationship. Palantir wants the control layer governing them. Microsoft wants the infrastructure and enterprise environment surrounding it. Each will describe its preferred layer as the safest foundation for the customer’s future.

The people who helped bring frontier AI into the enterprise are discovering that they can no longer determine where it goes next. Their self-interest should be understood, but their warnings should not be dismissed. Enterprise sovereignty will not come from deciding which vendor’s warning to trust. It will come from ensuring that no vendor owns so much of the enterprise’s intelligence—and so much of its ability to learn—that the enterprise can no longer leave.