For two years, the story of AI infrastructure has been about two things: power and GPUs. Hyperscalers buy data centres, sign nuclear contracts, and queue up for Nvidia chips. A third cost has now muscled into the conversation: memory. Every AI chip needs special, very fast memory chips bolted next to it — called HBM, or high-bandwidth memory — and the factories that make ordinary computer memory (DRAM and NAND, the kind in your laptop and phone) are being redirected to feed AI servers. The result: the price of memory has roughly tripled in a year. That is now showing up in Microsoft’s, Meta’s, and soon SAP’s and Deutsche Telekom’s bills. For any CIO who budgeted AI infrastructure in late 2025, the number penciled in for memory was almost certainly wrong.

On the Microsoft fiscal third-quarter call in late April, Amy Hood paused on a slide most analysts had not been waiting for. The CFO walked through the company’s revised $190 billion capex plan for fiscal 2026 — sixty-one percent above the prior year — and then, with the dry precision of someone who has learned to deliver bad news flatly, told investors that twenty-five billion dollars of that increase was not buying more servers, more land, or more transformers. It was simply covering higher prices for memory and other components. Microsoft is paying more, she said, for exactly the same hardware it had already planned to deploy. The call landed in a quarter that had already broken records elsewhere. SK Hynix, the South Korean memory maker that supplies the lion’s share of HBM stacks bolted onto Nvidia’s GPUs, reported a 72 percent operating margin in Q1 2026 — a number normally associated with software companies, not semiconductor fabs. Revenue rose 198 percent year-on-year. Operating profit jumped 405 percent. Management told analysts that cumulative HBM purchase commitments from hyperscalers and accelerator vendors now exceed three years of nameable forward supply. Samsung’s operating profit, reported the same week, rose 750 percent year-on-year to an all-time record. This is the moment a16z’s Charts of the Week captured under the heading “Memory to the moon” on May 15. The chart pack lined up four panels: DRAM contract prices up roughly 95 percent quarter-on-quarter in Q1; NAND flash up around 70 percent and accelerating; the three memory incumbents projected to roughly sextuple operating income in 2026 versus 2025; and a final panel showing memory ASPs on a curve that, plotted against the last five years, looked less like a cycle and more like a regime change. But the moment did not arrive out of nowhere. Three forces collided. HBM4, the next generation of high-bandwidth memory destined for Nvidia’s Rubin platform, requires up to 40 percent of the leading fabs’ DRAM wafer capacity according to SK Hynix’s own disclosures. Each Rubin GPU carries 288 GB of HBM4, against 80 GB of HBM3 on an H100 — meaning the same number of chips consumes roughly 3.6 times the memory. At the same time, the memory industry spent 2023 and most of 2024 in disciplined undersupply, cutting capex to repair balance sheets. Greenfield fab capacity announced today does not produce wafers before 2028. And every gigabyte of HBM diverted from regular DRAM lines tightens the supply for the laptops, phones, factory PLCs and enterprise servers that the rest of the world also keeps buying. The catch: nobody expected this third leg. Power was forecast. GPU scarcity was forecast. Memory was the part of the AI bill that everyone — CFOs, analysts, even hyperscaler procurement chiefs — had quietly assumed would behave like a commodity.

The headline figure is the easy one: DRAM contract prices rose 90 to 95 percent quarter-on-quarter in Q1 2026, according to TrendForce, with server-grade DRAM moving faster than commodity grades. Counterpoint Research expects another 50 to 60 percent layered on top in Q2. NAND, slower out of the gate, is now catching up: TrendForce sees Q2 2026 contract prices rising 70 to 75 percent quarter-on-quarter, outpacing DRAM for the first time in the cycle. Phison’s CEO confirmed in March that a 1 TB TLC NAND chip that cost $4.80 in July 2025 is now selling for $10.70 — a 123 percent move in eight months. The IDC point of comparison is sharper still: DRAM cost per gigabyte is forecast at $9.71 in 2026, against $3.76 in 2025. To put it in language a DAX40 CFO can use: memory pricing now consumes more dollars per server than the entire automotive semiconductor revenue line that Infineon, NXP and STMicroelectronics earned in a single quarter last year. The component that used to be a rounding error on the bill of materials is now, on Nvidia’s flagship B200, roughly 45 percent of cost of goods sold. HBM has eclipsed the logic die, the CoWoS interposer, and the packaging substrate combined. At the producer level, the math is staggering. SK Hynix posted KRW 37.61 trillion in Q1 operating profit, on a 72 percent margin. Samsung’s memory and foundry combined delivered the largest operating profit in company history. Micron’s fiscal Q2 2026 revenue of $23.86 billion beat its own guidance by 27 percent, with non-GAAP operating profit of $16.5 billion. Consensus 2026 operating income across the three is now projected at roughly six times the 2025 baseline — the “sextuple” headline a16z dropped into its chart pack. For enterprise buyers, the second-order numbers matter more. Microsoft’s $25 billion memory line item, baked into a $190 billion capex envelope, implies that roughly thirteen percent of the company’s entire 2026 infrastructure spend is now absorbing memory inflation. Alphabet and Meta have signalled similar exposures in their own April calls, with Big Four hyperscaler capex now forecast at $725 billion for 2026 — up 77 percent year-on-year. ASML disclosed that, for the first time on record, memory accounted for 51 percent of system sales in Q1 2026, narrowly eclipsing logic. The Veldhoven equipment maker raised its full-year guidance largely on this back. Memory customers, ASML’s CFO told analysts, are sold out for 2026 and constraints extend beyond. For European buyers, the most telegraphic number is the inventory line. As of January, Samsung had six weeks of DRAM inventory and SK Hynix two to three weeks — historically low by an order of magnitude. The market is not being rationed by price; it is being rationed by allocation. Hyperscalers signing letters of intent are jumping the queue. A DAX40 manufacturer ordering its 2026 private-cloud refresh in June is, in effect, buying at spot.

This is where the story stops being abstract for German enterprise buyers. Deutsche Telekom’s Industrial AI Cloud, the €1 billion sovereign AI factory in Munich built on roughly 10,000 Nvidia Blackwell GPUs, was costed in 2024 and 2025 — before the memory move. SAP, whose cloud revenue grew 27 percent at constant currencies in Q1, is now negotiating its own infrastructure build-out at exactly the moment memory contracts are repricing. CEO Christian Klein told analysts that cloud pricing will tilt toward consumption-based metrics — “memory used” was a phrase he used explicitly — as Business AI scales. Translation: SAP customers, including most of the DAX40, will increasingly pay variable rates against an input cost that has just tripled. Siemens, which operates its industrial AI stack jointly with Deutsche Telekom, faces a parallel problem in its factory edge: every smart sensor, every PLC, every machine vision controller carries DRAM that competes with the AI fabs for wafers. Procurement teams at automotive suppliers — Bosch, Continental, ZF — have already begun extending lead times on standard memory modules from twelve to twenty-six weeks. The Federation of German Industries reported anecdotally in early May that mid-cap Mittelstand IT refreshes are being deferred to 2027 or absorbed at sharply higher cost. The one DAX40 winner here is Infineon, but only obliquely. The Munich-based group makes power semiconductors and automotive MCUs, not memory; its exposure is to the same fabs only via shared lithography slots at ASML. Infineon and STMicroelectronics will see margin support from tight wafer supply, but neither captures the windfall directly. ASML, meanwhile, is now the cleanest European proxy for the memory cycle — its order book has effectively absorbed the demand shock that the memory makers themselves are unwilling to convert into capex. Analyst notes at Goldman and JP Morgan, surfaced via news coverage, suggest ASML’s 2026 EUV bookings from memory customers alone now exceed the value of the entire Dutch lithography sector’s output two years ago.

Anthropic, the maker of Claude, has rented the entire Colossus 1 supercomputer in Memphis from SpaceXAI — the merged Musk entity created in February when SpaceX absorbed xAI. The cluster holds more than 220,000 NVIDIA GPUs and pulls roughly 300 megawatts. Anthropic needs the machines because paying Claude users have spent months complaining about throttled rate limits and silently banned accounts, while CEO Dario Amodei admits demand grew 80 times faster than planned. The deal is strange because Musk has spent two years calling Anthropic evil. It matters to enterprise buyers because the world’s scarce frontier GPUs are being reshuffled between three labs — OpenAI, Anthropic, xAI — and Europe is not on the list. For DAX40 CIOs, that reshuffle decides who gets capacity, at what price, and under whose jurisdiction.

On a Wednesday morning in early May, Dario Amodei walked onto the stage of the Code with Claude developer conference in San Francisco and made the announcement his engineers had spent six weeks preparing for. Anthropic, he said, had signed a deal with SpaceXAI to take every available GPU at the Colossus 1 facility outside Memphis, Tennessee — more than 220,000 chips in total, a mixture of NVIDIA H100, H200 and the newer GB200 Blackwell accelerators, drawing close to 300 megawatts from the local grid. Effective immediately, Claude Code’s five-hour rate limits would double for Pro, Max, Team and seat-based Enterprise plans. Peak-hour throttling on Pro and Max would be removed. API rate limits for Opus would rise. The audience of developers, many of whom had been publicly hostile to Anthropic for months, applauded. The backstory explained the applause. Throughout the late winter and spring, The Pragmatic Engineer’s Gergely Orosz had documented what he called Anthropic’s hostile turn: Claude Code subscribers reporting that the agent had been silently nerfed, corporate accounts banned without warning, and a brief period in which Claude Code was quietly removed from $20 Pro plans after seven days. Amodei conceded the cause on stage. “We had originally planned for 10x growth, and we’ve seen something more like 80x growth in revenue and usage,” he told the room. The compute math, in other words, had stopped working. Anthropic could either ration its existing customers more aggressively or find an enormous slab of GPUs in a hurry. There are perhaps three places on Earth where 220,000 frontier GPUs sit under one roof, and exactly one of them belonged to a man who had spent the previous twenty-four months calling Anthropic “misanthropic” and accusing it of hating Western civilisation. The pivot happened in the early hours of the same week. Elon Musk, asked on his social network why he had agreed to power the company he most often denounces, posted a single sentence: “No one set off my evil detector.” Privately, according to people briefed on the negotiations, the SpaceXAI commercial team had spent months looking for an anchor tenant. The merger announced on 2 February — SpaceX absorbing xAI in a share exchange that valued the combined group at roughly $1.25 trillion ahead of a planned summer IPO — had left Colossus 1 with significant idle capacity once xAI shifted Grok training toward the larger, newer Colossus 2 site. Renting the cluster to a competitor was cleaner than mothballing it. Alberto Romero of The Algorithmic Bridge captured the strategic logic in three lines: “Musk realised he can’t beat Altman, so he’s arming Anthropic with 220,000 GPUs instead. Spite is a hell of a business strategy.” The deal includes an unusual side-letter committing both parties to explore multi-gigawatt orbital compute — solar-powered data centres flown on Starlink-class buses, an idea that until April was treated as Musk vapourware. It is, in scale, the GPU equivalent of handing a rival airline the keys to Frankfurt Airport for a year.

The Colossus 1 deal is the third act of a story that began in 2023, when Musk left OpenAI’s board and founded xAI explicitly to counter what he framed as Sam Altman’s monopoly on frontier intelligence. Colossus 1 in Memphis came online in late 2024 as the fastest large-cluster build in the industry’s short history — 100,000 H100s installed in 122 days, scaled to 200,000 by mid-2025. By autumn 2025 xAI was openly recruiting against Anthropic, and Musk was calling Dario Amodei’s company a threat to civilisation in nightly posts. Then, on 2 February 2026, SpaceX announced it had acquired xAI in a share-for-share transaction at roughly $1.25 trillion combined valuation, the largest corporate merger ever recorded. SpaceX confidentially filed for an IPO with the SEC at the end of March, advisors briefing a $1.75 trillion target raise of more than $75 billion. The merged entity needed two things at once: a story for IPO investors about non-Tesla revenue, and a tenant for Colossus 1. Anthropic, meanwhile, was choking. Internal projections shown to investors during the company’s $30 billion February raise had assumed roughly 10x year-on-year demand growth across 2026. By the end of Q1, actual usage was tracking 80x. Claude Code, the agentic coding product launched in 2025, had become a runaway hit among enterprise developers — a market Anthropic had not modelled. Ed Zitron at Where’s Your Ed At calculated that Claude Code subscribers were consuming between $8 and $13.50 of compute for every dollar they paid, meaning a $200-per-month Max user could burn through $2,700 in real GPU time. To control the bleed, Anthropic tightened rate limits, banned third-party harnesses and silently removed Claude Code from low-tier subscribers. The backlash was severe and public. Orosz’s mid-April Pulse newsletter, headlined “Did capacity shortages turn Anthropic hostile to devs?”, became a reference text inside enterprise procurement teams reconsidering Claude as a strategic supplier. The Memphis lease resolves the supply problem without solving the unit-economics problem. Pricing terms have not been disclosed, but analysts at The Information estimate the contract is worth between $4 billion and $6 billion annually, payable to a company whose CEO is simultaneously a major shareholder in Anthropic’s biggest competitor. The structural read is that frontier AI has become an oligopoly of three labs sharing four hyperscale GPU pools — Microsoft, Amazon, Google and now SpaceXAI — with everyone else queueing. For European challengers the queue is longer. Mistral signed a 13,000-GB300 deal with NVIDIA earlier in the year and is raising €830 million of debt to build a Paris data centre; Cohere completed its acquisition of Aleph Alpha in late April to consolidate what one Fortune piece called “AI’s middle powers”. None of them can credibly match a 220,000-GPU single-site contract. Gary Marcus, posting within hours of the Memphis announcement, offered the contrarian read: that Musk’s willingness to rent rather than train on the cluster is “a tacit concession that xAI is not all that close to AGI” and “more evidence that pure scaling doesn’t get you there”. If he is right, the deal marks the moment scaling stopped being a moat and became a commodity rental market.

For tech and AI leadership inside German and DACH-headquartered enterprises, the Colossus lease is a wake-up call dressed as a routine capacity announcement. Three implications stand out. First, supplier concentration: Claude’s enterprise reliability now depends on a Memphis facility operated by a Musk-controlled company that has its own ideological objections to Anthropic’s safety posture. CIOs who have written Claude into their procurement contracts as a primary supplier should re-read their force-majeure clauses and ask their vendor whether the Memphis terms include any priority guarantee for non-US, non-hyperscale tenants. The honest answer, in May 2026, is almost certainly no. Second, jurisdictional exposure: the GPUs powering Claude are now subject to U.S. Commerce Department export-control logic and to whatever conditions attach to SpaceX’s IPO disclosures. European data-residency promises from Anthropic become harder to honour when 300 megawatts of inference capacity sit in Tennessee. DAX40 buyers with DORA, NIS2, and BaIT exposure need to re-map their data-flow diagrams: any Claude request that touches a regulated workload should now be assumed to traverse Memphis unless the contract explicitly routes it through Amazon Bedrock’s Frankfurt region or the Anthropic Paris endpoint, both of which carry separate capacity ceilings. Third, the sovereign-AI debate moves from theoretical to operational. The European Commission has not yet commented publicly on the deal, but officials in DG CONNECT have privately briefed that the announcement strengthens the case for the EU AI Compute Reserve being negotiated under the AI Continent Action Plan. For DAX40 CIOs the practical question is whether to commit additional spend to Mistral, the Cohere-Aleph Alpha entity, or domestic GPU capacity through Schwarz Group’s Stackit and Deutsche Telekom’s sovereign-cloud build-out — or to accept that frontier-grade Claude access will, for the foreseeable future, route through a Memphis cluster owned by Elon Musk. There is no third option that does not involve writing a cheque.

Isomorphic Labs is the drug-discovery company Demis Hassabis spun out of Google DeepMind in 2021 to turn AlphaFold, the protein-structure model that won a Nobel Prize in 2024, into actual medicines. On May 12, 2026, it closed a $2.1 billion Series B led by Thrive Capital, with Alphabet, GV, CapitalG, MGX, Temasek and the UK’s Sovereign AI Fund alongside. It is the largest financing ever raised by an AI-first drug-discovery firm and the second-largest biotech round on record. The money buys time and scale: a bigger drug-design engine called IsoDDE, a global hiring run, and the push toward first human trials by late 2026. For European pharma that has been bolting AI onto legacy R&D one partnership at a time, a fully funded, vertically integrated competitor now sits in London.

Inside a converted King’s Cross building a few hundred metres from where AlphaFold 3 was trained, Demis Hassabis spent the first week of May rehearsing a pitch he had given before. Sir Demis, fresh off a Davos appearance in January where he had quietly slipped the company’s first-in-human trial target from end-2025 to end-2026, was talking to investors led by Joshua Kushner’s Thrive Capital about a number that would have sounded absurd in a normal biotech cycle: two billion dollars, no disclosed clinical asset, no published lead molecule. On May 12 it closed at $2.1 billion. “This investment will further turbocharge the development of our next-generation AI drug design engine,” Hassabis said in the announcement, “helping our team accelerate and increase the number of drug programmes we are working on, while continuing on our mission to one day solve all disease.” The valuation was undisclosed but, per Bloomberg and Sifted, well north of the $578 million round Isomorphic raised in April 2024 at a roughly $2.8 billion mark. Thrive led; Alphabet, GV, CapitalG, MGX (Abu Dhabi), Temasek and the UK government’s new Sovereign AI Fund filled out the syndicate. To put the cheque in scale: $2.1 billion is more than the entire annual external R&D budget of Bayer’s pharmaceutical division and roughly the combined 2025 AI-related capex disclosed by Sanofi, Boehringer Ingelheim and Merck KGaA. Then came the pivot in the room nobody outside the syndicate noticed. The Series B was not pitched as a clinical-stage biotech round at all. It was pitched as an AI infrastructure round that happens to output molecules. The deck centred on IsoDDE, the Isomorphic Drug Design Engine unveiled in March, which the company describes as a unified generative model covering target selection, binding-pose prediction, ADMET filtering and lead optimisation in one stack. AlphaFold 3, published in Nature in May 2024 and licensed exclusively to Isomorphic for commercial use, sits underneath it. Hassabis told investors the model has been used internally on every active programme; Max Jaderberg, the former DeepMind research lead now serving as Isomorphic’s president, walked them through preclinical candidates in oncology and immunology generated under the Eli Lilly and Novartis collaborations. Those two deals, signed in January 2024 and expanded by Novartis in February 2025, total close to $3 billion in upfront, milestone and royalty value. A third pharma partner, Johnson & Johnson, was added quietly last year. Critics noticed what was missing. MedCity News headlined its coverage “This TechBio Startup Just Raised $2B Without Disclosing a Single Detail About Its Drugs,” pointing out that even Altos Labs, the previous record-holder for opaque mega-rounds, at least cited scientific publications supporting its thesis. Isomorphic has not.

The arc from research artefact to industrial bet has taken five years. DeepMind released AlphaFold 2 in July 2021 and dropped the predicted structures of 200 million proteins into the public EMBL-EBI database a year later, a moment that, more than any single drug launch, reset what computational biology could plausibly claim. Isomorphic was incorporated in November 2021 as the commercial vehicle. The first big external validation came in January 2024, when Eli Lilly committed up to $1.7 billion and Novartis up to $1.2 billion in research-collaboration deals announced on the eve of the JPMorgan Healthcare Conference. A $578 million Series A followed in April 2024 led by Thrive Capital, with GV joining. AlphaFold 3, the protein-ligand version, was published a month later, and Demis Hassabis and John Jumper shared the 2024 Nobel Prize in Chemistry that October. February 2025 brought a Novartis expansion adding three programmes. Now $2.1 billion. The pivot in the story is that this round arrives at a moment when public AI-biotech is in a bear market, not a bull one. Recursion Pharmaceuticals (RXRX) trades in a $2.80-$7.18 band; Nvidia exited its full 7.71 million-share position earlier this year. AbCellera has guided down. Schrödinger has yet to deliver a wholly-owned clinical asset of consequence. The PitchBook house view, in a March 2026 note, was blunt: “AI drug discovery isn’t the layup VCs expected.” Derek Lowe, the chemist whose In The Pipeline column has been the field’s most cited sceptic for two decades, has been consistent that knowing a protein’s static structure is rarely the rate-limiting step in a discovery programme and that AlphaFold cannot yet predict how proteins flex around small-molecule ligands. His broader point, which the Isomorphic syndicate has implicitly accepted, is that the 85% Phase II/III failure rate is a problem of biology and target selection, not of chemistry or structure. Two things make Isomorphic’s pitch different from the Recursion-era cohort. The first is vertical integration with a frontier-AI lab. Isomorphic does not licence AlphaFold; it owns the only commercial pipeline from it, and shares engineering DNA, compute access and talent with Google DeepMind. The second is the IsoDDE framing. By selling itself as an engine that produces optimised drug candidates as outputs, rather than as a biotech with a pipeline, Isomorphic is positioning closer to ASML or TSMC in the semiconductor analogy than to a traditional pharma. That framing is what justifies a $2.1 billion cheque from infrastructure investors like MGX and a sovereign-AI fund. It also explains the silence on individual molecules: an engine company defends its moat with throughput, not with hero compounds. Whether that holds when the first IND filings land at the FDA in 2027, and the first Phase I readouts come in 2028, is the question the syndicate has bought a five-year option on.

For Bayer, Boehringer Ingelheim, Merck KGaA and the German operations of Sanofi and Roche, the Isomorphic round is not a curiosity. It is a forced re-evaluation of the build-versus-partner question that DAX40 pharma boards have been deferring since 2023. Bayer’s January 2026 three-year deal with Cradle for AI antibody engineering, and its AWS-hosted generative-AI work disclosed at re:Invent, have so far been positioned as augmentation of existing wet-lab pipelines. CEO Bill Anderson told Semafor in April that “every new medicine is now designed on computers.” Boehringer Ingelheim has run an internal AI4Discovery programme out of Biberach and Vienna and last year extended a collaboration with IBM on foundation models for chemistry. Merck KGaA Darmstadt operates the Syntropy oncology-data joint venture with Palantir and renewed its Recursion partnership in 2023 covering up to 40 targets in oncology and immunology. None of these is at the scale or vertical integration of Isomorphic. The harder question is platform dependency. If IsoDDE becomes the de facto generative chemistry stack the way CUDA became the AI compute stack, every European pharma will face the same architectural choice German automakers faced with battery cells in 2018: licence from a US/UK-hosted Alphabet subsidiary, or fund a credible European alternative. The candidates for the latter are visible but small: Owkin (French, focused on clinical trials), Cradle (Dutch), and the AlphaFold-derived open-weights ecosystem around EMBL-EBI and the Max Planck Institutes. The UK’s participation via the Sovereign AI Fund in this round was deliberate and is a model the EU AI Office and German BMWK have not yet matched. For an MD advising a DAX40 pharma client this quarter, three procurement questions follow: what does an enterprise IsoDDE licence look like, who owns the IP on AI-designed candidates under existing master collaboration agreements, and is there a European fallback worth co-funding before Isomorphic’s Series C closes the door.

Codex is OpenAI’s agentic coding tool: not a chat box that suggests lines, but a system that runs in the background on a laptop, a dev box, or a cloud sandbox, edits files, runs tests, and asks for human approval at key steps. Until this week, you supervised it from a desktop. On May 14, 2026, OpenAI made Codex available inside the ChatGPT mobile app on iOS and Android, free across every plan tier. From a phone, a developer can now see the live state of any Codex session, read diffs, approve commands, switch models, and start new tasks. Anthropic’s Claude Code remains terminal-first and, separately, just irritated its user base by metering Agent SDK usage. The shift matters because it changes who supervises coding agents, when, and on which screen.

On a Berlin S-Bahn around 8:30 in the morning, a backend engineer at one of the city’s larger insurers thumbs through a notification on her iPhone. Three Codex sessions she kicked off the night before have come back: one rewrote a flaky retry loop in a claims-ingestion service, one upgraded a Python dependency that had been pinned since 2023, and one paused with a question about whether to delete a deprecated database column. She scrolls the diff on the train, taps approve on the first two, leaves the third for a colleague, and starts a new task — “add structured logging to the payments webhook” — before the train reaches Friedrichstraße. By the time she sits down at her desk, two of the three pull requests are open in GitHub and a fourth has begun. That workflow is the explicit pitch OpenAI made on May 14, 2026, when it pushed Codex into the ChatGPT mobile app on iOS and Android. The rollout is in preview, available across every plan tier including Free and Go, and works by linking the phone to whichever environment a developer has Codex installed in — a laptop at home, a Mac mini under the desk, a remote dev box managed by the employer, or a cloud sandbox. A secure relay layer, in OpenAI’s description, “keeps trusted machines reachable across devices without exposing them directly to the public internet,” and syncs active session state across whichever devices a user is signed into ChatGPT on. The phone receives screenshots, terminal output, code diffs, test results, and approval prompts in real time. Codex Web (cloud) and Codex CLI (local) both feed into the same mobile inbox. Alexander Embiricos, the OpenAI product lead for Codex, has framed the trajectory for months: “I think we’re going to see the majority of work being written where the agent has its own computer, but it will still be really important for us to invest in accelerating developers who are doing work on their own computer, too.” OpenAI’s own marketing copy is blunter — start a task at home, approve the final output “over your matcha.” The company says more than a million developers now use Codex each week, with usage up roughly five-fold since January. The pivot, and it is a pivot, is that mobile is not a viewing surface; it is a control surface. BlackBerry email in 2002 made executive correspondence asynchronous and portable, and changed when and where decisions got made. Tuesday’s move does the same thing to code review and agent supervision. The dashboard moves out of the IDE. The competitive context tightens the screws. On May 13, Anthropic told Claude Code users that starting June 15, Agent SDK calls, claude-p, GitHub Actions, and third-party agents like OpenClaw would draw from a separate, non-rollover monthly credit pool — $20 for Pro, $100 for Max 5x, $200 for Max 20x — rather than the existing subscription limits. The developer reaction, as The New Stack and InfoWorld both reported, was hostile: heavy agentic sessions can burn 100,000 to 200,000 tokens, and a fixed monthly credit caps that kind of workflow hard. Anthropic’s framing was “simplification.” The community’s framing was “reduction in value.” Forty-eight hours later, OpenAI handed every ChatGPT user — including free ones — a mobile front-end to its coding agent. It is hard to read the timing as coincidence.

Underneath the marketing, three architectural choices in the Codex mobile release deserve attention from anyone running an engineering function. First, the relay model. The phone does not run Codex; it talks to a Codex instance running somewhere with state, files, network access, and credentials. OpenAI’s relay sits in the middle, terminating one TLS session from the phone and another from the developer’s machine, and brokering streamed updates and approval calls. That is similar in shape to how Tailscale, ngrok, or AWS Session Manager handle remote access, and it has the same security properties: the relay is now a sensitive trust boundary. For DAX40 CISOs, the obvious questions are jurisdictional (where does the relay terminate?), forensic (what telemetry crosses it, what is logged?), and contractual (does the existing ChatGPT Enterprise DPA cover an agent acting on managed dev hosts?). OpenAI has paired the launch with enterprise-leaning additions: programmatic access tokens for Business and Enterprise plans usable in CI pipelines, generally available Hooks, HIPAA-compliant Codex for eligible Enterprise workspaces in local environments, and SSH access to enterprise-managed development hosts so the agent runs inside existing dependency and policy guardrails. Second, the approval surface. Codex’s mobile UX collapses the SDLC review queue — diff, test output, command authorisation, model choice — into something that looks structurally like an email inbox. That has a productivity upside and a governance downside. The upside is that approvals stop being a context-switch cost and become a queue you process. The downside, as Gary Marcus and Nathan Hamiel argued in their widely circulated essay this year, is that agentic coding tools “don’t just autocomplete code” but “choose frameworks, install software packages, make bug fixes, and write whole programs,” and that prompt-injection attack success rates against state-of-the-art defences exceed 85 percent under adaptive strategies. A phone-based approve button, tapped on a tram, is a thinner review than a desktop diff with the test suite open. The risk model now includes the rushed approval. Third, the portfolio shape. Boston Consulting Group’s much-cited study earlier this month found that productivity per developer plateaued around three to four concurrent agents — the human ceiling on supervising parallel work. Gergely Orosz, in The Pragmatic Engineer, has been tracking the same trend under the label “programming by kicking off parallel AI agents.” Mobile supervision raises the ceiling slightly by making approvals available during dead time (commutes, between meetings, after dinner) but also reshapes the job: senior engineers begin to look less like authors and more like portfolio managers, allocating attention across a fleet of running tasks. SAP’s newly relaunched Joule Studio, which generates production-ready code and n8n agentic workflows and “enforces governance at runtime,” is built on the same assumption. Mercedes-Benz’s n8n deployment and Allianz’s internal foundry sit in the same architectural neighbourhood. The question is no longer whether enterprises will run async coding agents, but whether their review and audit pipelines can keep up with agents that file pull requests at 8:43 a.m. from a developer’s pocket.

For consulting firms advising DAX40 CIOs, three governance gaps open this week. Review integrity. Most DAX40 SDLC policies assume code is reviewed at a workstation that meets endpoint hardening standards: managed laptop, full-disk encryption, MDM, network controls. A mobile approve-the-diff workflow on a personal-profile iPhone sits outside most of those controls. Either the phone enters scope (Intune profile, supervised MDM, separate work account) or the approval right is restricted by plan tier and IP. SAP’s Joule Studio audit-trail-per-decision model is a useful template, but it needs to extend to the device that issued the approval, not just the agent that proposed the change. Allianz’s internal foundry, Mercedes-Benz’s n8n rollout, and Commerzbank’s €600M Momentum 2030 AI build-out all sit in the same architectural neighbourhood and will face the same audit questions before year-end. Segregation of duties. German banks, insurers, and automotive OEMs operate under BaIT, VAIT, and KRITIS audit regimes that treat code-change authorisation as a controlled act. If a developer kicks off a Codex session from their phone, watches it modify a production-adjacent service, and approves the merge — all from the same device, same identity, same session — auditors will want to know where the second pair of eyes lives. The honest answer right now, for most DAX40 shops, is “nowhere yet.” That is the work for Q3, and it ties directly into BaFin’s newly announced IT-spotlight inspection regime. Productivity measurement. If a senior engineer ships fourteen agent-driven PRs in a day, three of them approved on a train, what is the unit of productivity? Lines of code is meaningless; PRs are gameable; story points assume human authorship. The metric that survives is probably review-quality-weighted throughput — measured by post-merge defect rate, rollback frequency, and downstream incident attribution — and nobody has a clean definition of that yet. The DAX40 CIO who codifies one first sets the procurement template the rest will follow.