The 90 Million Problem: AI Is Now Infrastructure and Nobody Is Ready
Something quietly changed this week. OpenAI reported that Codex, its AI-powered coding assistant, added 90 million installs in seven days. That is not a product milestone. It is a civilizational data point. When a software tool crosses that threshold in a single week, the word "adoption" stops fitting. We are watching AI become default infrastructure—and the institutions tasked with overseeing default infrastructure are still writing comment letters.
BlackRock's announcement landed in the same news cycle. The asset manager disclosed plans to launch two tokenized money market funds aimed specifically at stablecoin investors. The financial substance is straightforward: give stablecoin holders a regulated, yield-bearing wrapper backed by the world's largest fund manager. The signal is less straightforward. It tells us that legacy finance has decided crypto rails are permanent enough to build on. It tells us that the infrastructure layer beneath AI—the financial plumbing that will fund compute, data, and deployment—is already being shaped by the same concentrated interests that shaped the infrastructure beneath the last technological transition.
Read separately, each story is a product launch. Read together, they describe a single unresolved problem: nobody has built the governance architecture for a world in which AI is both the critical utility and the investment vehicle. The gap between those two realities is not a policy detail. It is the defining political question of the next decade.
The scale problem
Ninety million installs in seven days is a number that resists intuitive comprehension. To put it in structural terms: the most successful enterprise software products in history—Salesforce, SAP, Oracle—took years to reach 90 million users. They required dedicated sales teams, procurement cycles, and IT departments to install and maintain. Codex required an API call. The distribution cost of AI-generated tools has effectively collapsed, which means the threshold for systemic importance has collapsed with it. A tool does not need a Fortune 500 contract to matter. It needs 90 million people to run it without thinking, and that threshold is now crossed every week.
The implications for oversight are uncomfortable. Traditional regulators calibrate their response to market share. A product with 15 percent of a market gets scrutiny; a product with 60 percent gets antitrust attention. Codex's install figures suggest we are past the point where market share is the right metric. When a tool becomes frictionless enough to spread through organic adoption alone, the concept of "market share" stops capturing what is actually happening. The tool becomes ambient. It becomes the environment in which work happens.
BlackRock's move into tokenized money market funds follows a parallel logic. The asset manager is not entering crypto to chase retail excitement. It is entering because tokenized finance has crossed whatever threshold makes it worth the legal and operational investment. That threshold, like the one Codex just crossed, is not clearly visible from the outside. But once a firm of BlackRock's size treats a market as worth building permanent infrastructure for, it is already permanent infrastructure. The regulatory response to that permanence is always late.
The monitoring problem
The third OpenAI disclosure from this week deserves more attention than it has received. The company identified an accidental "chain-of-thought grading" phenomenon in its models—essentially, a case where the AI was evaluating its own reasoning processes in ways that were not fully visible to external observers. The finding that monitorability was not compromised is presented as reassuring. Read more carefully, it is a warning label.
The phrase "accidental" doing significant work in a sentence about a deployed AI system should concern anyone who takes infrastructure oversight seriously. "Accidental" implies that the internal behavior was not designed, not intended, and not caught until after deployment. Those three properties—undocumented, unintended, post-hoc detected—describe a category of risk that standard regulatory frameworks are structurally unsuited to address. Financial regulators audit against documented processes. Auditors look for evidence of decisions, not evidence that the decision-making substrate itself is behaving in undocumented ways.
Chain-of-thought reasoning in AI models is not a niche technical feature. It is a core mechanism through which these systems translate inputs into outputs. If that mechanism can produce "accidental" grading behaviors that are not caught until a dedicated internal review, then the external monitoring infrastructure—compliance teams, third-party auditors, regulatory frameworks—is operating with a fundamental information deficit. It is auditing the outputs of a process whose internal logic is not fully legible. That deficit is not a gap that can be closed by adding more reporting requirements. It is structural.
BlackRock's tokenized funds face a related but distinct monitoring problem. Tokenized assets sit at the intersection of securities regulation and crypto infrastructure, each governed by different agencies with different mandates and different technical literacy. The fund's underlying asset—money market instruments—is among the most regulated in finance. The wrapper—tokenized, accessible via stablecoin rails—operates in a regulatory zone that is still being defined. The combination creates a product that is simultaneously over-regulated and under-regulated, depending on which layer of the structure you examine.
The concentration problem
These three developments—deployment velocity, financial infrastructure integration, and opaque internal reasoning—share a common root. AI infrastructure is being built by a diminishing number of organizations, for a expanding set of critical functions, without the distributed oversight mechanisms that characterize other forms of critical infrastructure.
Electricity grids are regulated at the regional level, with interconnection standards, antitrust oversight, and reliability councils. Telecom networks have common carrier obligations, universal service requirements, and frequency regulators. The logic in each case is the same: infrastructure that society cannot function without requires governance structures that distribute both the benefits and the risks across a broad set of stakeholders.
AI infrastructure currently lacks that logic. The deployment of tools like Codex happens through market mechanisms that reward concentration—network effects, data advantages, compute economies of scale. The financial infrastructure built on top of AI—tokenized funds, AI-linked securities, stablecoin yield products—follows the same concentration logic. BlackRock is not building tokenized funds as a public utility. It is building them as a product for investors who already hold stablecoins. The incentive is to capture value at the point of concentration, not to distribute governance across a broader ecosystem.
This is not an argument that AI development should be paused or that tokenized finance should be prohibited. It is an observation that the combination of rapid deployment, concentrated infrastructure, and inadequate monitoring creates a risk profile that existing regulatory institutions are not designed to manage. The risk is not that AI will suddenly fail. The risk is that the institutions responsible for catching and correcting failures will be operating with incomplete information, inadequate authority, and a mandate gap that is politically difficult to close.
The take-away
Ninety million installs in a week, tokenized money market funds for stablecoin holders, and an AI system exhibiting undocumented reasoning behaviors—these are not separate stories. They are the same story told from three different vantage points: the deployment velocity of a technology that has become infrastructure, the financial architecture being built on top of that infrastructure, and the monitoring gap that exists between the two.
The path forward is not a single regulation. It is a recognition that AI infrastructure requires governance designed for infrastructure—which means distributed oversight, mandatory transparency mechanisms, and regulatory authorities with technical capacity that matches the systems they oversee. None of that exists yet. What exists is an extraordinary deployment velocity, billions in financial infrastructure investment, and the quiet confidence that somehow the oversight will catch up.
It has not caught up yet. The 90 million installs this week are evidence of that. So is every tokenized fund, every undocumented reasoning process, and every week that passes without the governance architecture being built. The problem is not that nobody has noticed. The problem is that noticing is not the same as acting, and the scale of what needs to be built is larger than the political will currently assembled to build it.
Monexus covered BlackRock's tokenized fund plans as a financial infrastructure development; wire services framed the same story as a crypto market liquidity play. The OpenAI Codex install figures were reported as a product milestone by most outlets. The chain-of-thought grading finding received minimal mainstream coverage despite its implications for AI governance.