Mercor CEO on Why Application Layer Companies Have No Defensibility & Token Spend Exceeds Salaries

Why does it matter? Because tokens already cost more than people — and most software companies won't survive the inversion.

Mercor's CEO builds the training infrastructure that makes OpenAI and Anthropic work — and he already spends more on AI tokens than on employee salaries. Not as a projection. Now. This conversation is the bluntest map yet of which companies get obliterated by AI and which ones compound — and the answer hinges on one ruthless filter.

• Token spend on agents already exceeds total employee salary costs at Mercor — and the average enterprise will cross that line within 5 years • Application-layer software without network effects will be cloned out of existence within 12 months • Hackers now use AI agent swarms to scan entire codebases exhaustively — the threat model your security was built for no longer exists • The largest new job category in history: training agents to absorb repetitive tasks, once, so humans only do the hard parts

Mercor already spends more on AI tokens than on employee salaries — and every enterprise will look the same within 5 years

Mercor today. "Right now we're spending more on tokens for our internal agents than we are on employee headcount," Brandon Foody says. Harry Stebbings made him confirm it: "So your token spend on agents is more than salaries." Foody: "Exactly. It's pretty incredible."

This is Jevons paradox in corporate finance. As model performance improves and per-output cost falls, total consumption rises — the bill keeps climbing even as the unit price collapses. Foody manages it by running evals across every internal workflow — AI project manager, interview agents, fraud detection — benchmarking the price-performance winner for each use case. His prediction: "In 5 years the average enterprise spends more on compute than headcount." Every financial model still built around salary-heavy cost structures is already wrong.

Building defensibility in the application layer is 'incredibly difficult' — the model IS the product, and frontier labs are expanding into every vertical

Trillions of SaaS dollars sit on a foundation the underlying model providers can collapse at will. "Building defensibility in the software layer on top of the models is going to be incredibly difficult," Foody says. His two-part case: the model increasingly IS the product — drag-and-drop agent builders and API patchwork lost to end-to-end model training. And software gets rebuilt fast. "2026 is the year of how do you get the model to clone Slack end to end and those capabilities are going to exist in the models in the next 12 months." A customer spending $1M/year on SaaS who realizes Claude can replicate it will leave. Sales excellence doesn't survive that math.

Network effects are the single binary litmus test — this company either becomes worthless or gains dramatic value, nothing in between

Software companies without network effects are headed for worthlessness — that's the binary verdict, with no gradation. "The companies that don't have network effects are going to struggle very significantly because then there's not really a defensible moat in the pure software associated with the products that they build," Foody says. "That is the litmus test that determines whether this company is going to become worthless or whether this company is going to gain dramatic value."

Companies with networks — Salesforce's integration marketplace, Slack Connect, Cart's cross-company platform — can iterate 10 times faster using AI and compound that speed against network value, becoming dramatically more valuable while everyone else becomes replaceable. One diagnostic for every SaaS founder: does usage by one customer make the product more valuable to the next?

Hackers now deploy swarms of AI coding agents to scan entire codebases exhaustively — human-speed security is the wrong threat model

Mercor's breach didn't come from a human attacker grinding through code. "It was the attacker that used a swarm of coding agents to help get access to the system as is happening in a lot of these," Foody says.

The mechanic: a normal attacker is capped by team size and reading speed. Agent swarms aren't. "When they're using swarms of agents, they're able to be very exhaustive in reviewing the entire codebase" — every front end, every configuration, every dependency — in hours rather than weeks. Every security posture was designed for the previous threat model. Foody's response: add security as a seventh company value, engage Mandiant immediately, and build AI defensive capabilities that can match AI-speed offense. Anything short of that is already a gap waiting to be exploited.

'Agent trainer' will be the largest new job category in history — all knowledge work is converging on teaching machines to absorb your repetitive tasks

Mercor pays out over $3 million per day in the fastest-growing job category ever created — expected to triple within 12 months. The job: training agents.

"All knowledge work is converging on training agents because it is structurally more efficient to do something once." Instead of a customer support rep responding to hundreds of identical tickets, they train an agent to handle that class. Instead of a lawyer repeatedly red-lining commercial contracts, they train an agent to automate the pattern. The compounding value: codifying tacit knowledge — the unwritten rules and judgment calls that live only in people's heads — once, so agents can apply it indefinitely. Workers asking "which repetitive tasks can I train out of my job?" are building leverage. Everyone still asking "what will AI take?" is already behind.

OpenAI and Anthropic could hit $10 trillion — but most enterprise inference in 5 years runs on open-source models, not their APIs

OpenAI or Anthropic could be a $10 trillion company — and most of their customers will deploy open-source models by 2030. Foody holds both views without contradiction. He can "definitely see one of them being a 10 trillion company," possibly significantly higher — the frontier model advantage compounds through distillation and teacher-model dynamics. But: "majority of inference in 5 years is going to be using an open-source or custom fine-tuned or distilled model, not using a frontier model."

The West Coast pattern is already established: startups use frontier models to discover what's possible, then migrate to cheaper alternatives once the ceiling is mapped. Enormous future demand coexists with commoditizing APIs. The smart bet separates innovation (frontier labs) from deployment volume — which flows to evaluation tooling, distillation infrastructure, and the cost-performance optimization layer that handles actual scale.

In AI training data, the top 20% of tasks creates the majority of model improvement — quality has a power law, and volume-first vendors get commoditized

Out of 10,000 tasks in an AI training dataset, 2,000 create the majority of model improvement. "Quality is the X factor that becomes dramatically more valuable than any other dimension," Foody says. The highest-value data maps directly onto economic value — software engineering, finance, medicine, law, consulting — with the most important tasks being long-horizon ones: multi-week projects coordinating multiple experts and producing full deliverables, not one-shot prompts.

Mercor's vertical integration exists to capture this. Downstream quality signals inform upstream expert recruitment: which profiles consistently produce data in the top 2,000? A talent network of five million professionals can source the marginal oncologist faster than any niche vendor, and tooling built for lawyers ports directly to doctors. Volume-first data businesses get consolidated or displaced. Quality-first, vertically integrated ones sustain pricing power.

Mercor's AI project manager already ran a complete project end-to-end — the services automation thesis isn't coming, it arrived

150 people. That's the size of Mercor's delivery organization — the humans who coordinate expert networks, answer questions, and build bespoke tooling for deployed data projects. One AI project manager just replaced that function for a full engagement. "We have an AI project manager that just completed its first project managing that entire thing end to end where it's able to hire the experts. It's able to answer their questions." The experts who reported to it gave positive reviews.

"We're seeing in real time that services are getting automated." Foody's qualifier for 'AI-enabled services' companies: the actual test is whether you're automating your own delivery — not layering AI onto an unchanged model that AI will soon replace in its entirety. The income statement and headcount math at Mercor are already showing which answer survives.

Infrastructure eats software — the only question is which layer you're building in

All of these forces — tokens eclipsing salaries, agent swarms replacing both security perimeters and service delivery, open-source models commoditizing frontier APIs — point toward one structural shift: capital and leverage are migrating from headcount and software licenses to evaluation infrastructure, training pipelines, and genuine network effects. The companies that survive won't have the best product. They'll have the deepest irreplicable data moats and the capacity to automate their own delivery before a competitor does it for them. Infrastructure eats software. The only question is which infrastructure you're building.

---

Topics: AI infrastructure, SaaS defensibility, enterprise AI, model training data, AI agents, cybersecurity, future of work, token economics, network effects, open source AI, AI labor market, venture capital