Investment Soars, Security Sinks — AI Industry's Dual Reality

Today's AI industry in one line: investment is skyrocketing while security hits rock bottom.

The $852B Valuation Illusion and Reality

OpenAI reached an enterprise value of $852 billion through $122 billion in funding. Simultaneously, with annual revenue surpassing $25 billion, they're preparing for an IPO by the end of 2026. By the numbers alone, the AI industry's winning streak seems undeniable.

But behind these dazzling figures lies a peculiar contrast. At the same time, Indian AI startup Sarvam AI raised $300-350 million at a $1.5 billion valuation. With Nvidia, Amazon, and Bessemer participating, this deal shows the global AI investment frenzy spreading beyond Silicon Valley to India.

The reason investors are pouring money this aggressively is clear. Just as Google launched Gemini 3.1 Flash-Lite with a shocking price of $0.25 per million tokens, AI model commercialization is happening faster than expected. But is this pace sustainable?

Source Code Leaks and Zero-Days — Security's Ugly Truth

In stark contrast to the investment frenzy, the AI industry's security situation is disastrous. Just yesterday, three serious security incidents erupted.

The most shocking was Anthropic accidentally releasing 1,900 files and 520,000 lines of Claude Code's internal source code. They explained it as a "release packaging error," but the fact that the industry's leading company with an $852B valuation makes such a mistake is itself the problem.

Chrome's WebGPU zero-day vulnerability CVE-2026-5281 was patched belatedly while attackers were already actively exploiting it. If web browsers and GPUs—core infrastructure of the AI era—are this vulnerable, how can we guarantee the safety of AI services built on top of them?

Even more concerning is the discovery of "tool addiction attack" vulnerabilities in the Model Context Protocol. The fact that malicious instructions can be embedded in MCP server documents means cracks have formed in the trustworthiness of the entire AI agent ecosystem.

Coding Agent Wars — Open Source vs Big Tech

Even amid this security chaos, AI coding agent competition is fierce. Cursor launched Cursor 3 to compete with Claude Code and Codex, while Claw Code, an open-source framework, reached 72,000 GitHub stars within days of launch.

Notably, OpenClaw surpassed 210,000 stars as GitHub's fastest-growing open-source project in history. This signals developers' backlash against Big Tech's monopolistic AI tools manifesting through open source.

What's interesting in this competitive landscape is that Pinterest deployed a production-scale MCP ecosystem, saving thousands of hours monthly. If AI agents are starting to be validated in real enterprise environments, the market dynamics could shift completely soon.

Signs of Maturation and Regulatory Shadows

Across the industry, a shift "from experimentation to practical deployment" is being detected. Both investors and companies now demand actual ROI beyond POCs. The EU will enforce transparency requirements for high-risk AI systems starting in August, which follows the same context.

But the real problem in this maturation process isn't technical completeness—it's governance. In a situation where an $852B company accidentally leaks source code and zero-days keep appearing in core infrastructure, does EU regulation even matter?

What to Watch Tomorrow

The critical question is how long this duality of investment bubble and security gaps can last. If OpenAI's IPO succeeds, the AI investment frenzy will accelerate further. Conversely, if security incidents continue, regulatory intervention will become inevitable.

The rapid growth of the open-source camp is also a variable to watch. Whether projects like OpenClaw and Claw Code can crack Big Tech's monopoly or eventually get acquired and disappear will be decided in the coming weeks.

One thing is certain: the AI industry has entered the real game "outside the laboratory." The number games are over; it's now a time when capability speaks.

---

🔗 Sources

Confidence Criteria:

• 🟢 Observed: Directly verifiable facts (official announcements, product pages, CVE)
• 🔵 Supported: Backed by reliable sources (media reports, research reports)
• 🟡 Speculative: Inference or prediction (analyst opinions, trend interpretation)

---

HypeProof Daily Research | 2026-04-03