In the time it takes to read this sentence, a determined attacker can begin dismantling the safety architecture of some of the world’s most widely deployed artificial intelligence models.

Not through exotic exploits or classified techniques. Through conversation.

That is the central finding of Cisco’s State of AI Security 2026 report, published in February: across eight leading open-weight large language models — including flagship systems from Meta and Google — multi-turn jailbreak attacks succeeded at a rate of 92.78%. Not in a laboratory stress-test designed to maximise failure. In conditions that approximate how enterprise software is already being deployed, right now, at scale.

The guardrails are not holding.

A Race the Defenders Are Losing

The broader context matters. Agentic AI systems — which can open pull requests, query internal databases, book services, and trigger automated workflows with limited human oversight — are now being embedded into core business operations. This is no longer theoretical. Organisations have granted these systems authority to modify code and access sensitive data. Yet only 29% of companies reported that they were prepared to secure those deployments — a gap that leaves an enormous attack surface essentially unguarded. Help Net SecurityHelp Net Security

Into that gap, adversarial research has rushed with uncomfortable speed. A late 2025 paper co-authored by researchers from OpenAI, Anthropic, and Google DeepMind found that adaptive attacks — which iteratively refine their approach based on prior failures — bypassed published model defenses with success rates above 90% for most systems tested. The velocity of that translation from academic demonstration to operational exploit is, as Cisco’s Amy Chang put it, the real warning signal. GovInfoSecurity

The attack surface, she told Information Security Media Group, is “quickly outpacing organisations’ defensive maturity.” GovInfoSecurity

1 — The Mechanics of the AI Guardrails Jailbreak

The AI guardrails jailbreak problem is not new. What’s changed is its sophistication and reach.

Cisco’s report, titled Death by a Thousand Prompts, focused specifically on open-weight models — AI systems whose underlying parameters are made publicly available, allowing anyone to download, fine-tune, and deploy them independently. They have surpassed 400 million downloads on Hugging Face, the dominant public repository for such models. Their accessibility drives adoption. It also concentrates risk in ways most enterprise deployments have not accounted for. GovInfoSecurity

The core attack vector Cisco tested was the multi-turn jailbreak: not a single hostile prompt, but a sequence of iterative exchanges designed to gradually erode a model’s resistance. Think of it less like picking a lock and more like a slow negotiation — patient, escalating, ultimately persuasive. Multi-turn attacks were up to ten times more effective than one-shot attempts. Hackread

The results were stark. Across all models tested, attack success rates reached 92.78%, with a sharp rise between single-turn and multi-turn vulnerability that reveals the near-total absence of mechanisms to maintain safety guardrails across longer conversations. The highest single-model rate — 92.78% — was recorded against Mistral’s Large-2. Alibaba’s Qwen3-32B followed at 86.18%. Meta’s Llama 3.3-70B-Instruct showed a multi-turn vulnerability gap of +70 percentage points compared to single-turn testing — a number that tells you the model’s defences were calibrated for simple probes, not sustained pressure. Cisco BlogsCisco Blogs

The contrast with Google’s approach is instructive. Google’s Gemma-3-1B-IT, which prioritises alignment more centrally in its development, demonstrated more consistent resistance across both types of attacks. That’s not vindication — its absolute failure rates remain troubling — but it is an architecture signal. GovInfoSecurity

Meanwhile, a separate line of research published in May 2025 found that an adaptive jailbreak framework achieved success rates of 98.9% against GPT-4o and 99.8% against GPT-4.1. The technique involved layered semantic mutations and dual-end encryption schemes that bypassed both input and output-stage defences. Ninety-nine-point-eight percent.

2 — Why the Safety Architecture Was Built This Way

How easy is it to jailbreak AI models?

Worryingly easy — and structurally, this was partly by design. The difference in vulnerability between Meta’s models and Google’s is not random. Meta’s own documentation acknowledges that developers are “in the driver’s seat to tailor safety for their use case” in post-training — an approach that explicitly places the security burden on whoever deploys the model. Google treated alignment as a central design objective; Meta and Alibaba treated it as a downstream configuration choice. The Cisco research suggests that distinction produces measurably different outcomes under adversarial pressure. GovInfoSecurity

How easy is it to jailbreak AI models? For closed, API-gated models, single-turn attacks fail most of the time. For open-weight models in multi-turn conversations, failure rates of 7–8% are now considered good performance. That reframing alone tells you how far the baseline has shifted.

The open-weight model dynamic compounds this further. Because the weights are publicly accessible, anyone can retrain the model with malicious intent — either weakening its guardrails directly or tricking it into producing content that closed models would reject. Fine-tuning for harm is not a nation-state operation. It requires a consumer GPU and a few hours. Hackread

What’s emerged more recently is an escalation that security teams weren’t fully prepared for: large reasoning models used as autonomous jailbreak agents. Researchers in 2025 evaluated four leading reasoning models — including Gemini 2.5 Flash and DeepSeek-R1 — directing them to conduct multi-turn adversarial conversations against nine widely used target models with no further human supervision. The overall jailbreak success rate across all model combinations reached 97.14%, revealing what the researchers called an “alignment regression” — in which reasoning models can systematically erode the safety guardrails of other models. The implication is genuinely unsettling: the most capable AI systems can now be repurposed as attack infrastructure against other AI systems. nih

3 — What Follows From Here

Are open-weight AI models less safe than closed models?

The evidence suggests yes — but the question carries a policy dimension that closed-model defenders prefer to avoid. Open-weight models with weaker guardrails are not only a security risk. They are increasingly a regulatory risk.

The EU AI Act’s rules for General-Purpose AI models became applicable in August 2025, and by January 2026, the EU AI Office had moved beyond administrative checks to verify the “machine-readability” of AI disclosures. Providers of models with systemic risk designations — those trained with more than 10²⁵ FLOPs of compute — face mandatory safety assessments and incident reporting. Over 30 AI models from companies including Meta, Google, Anthropic, and OpenAI appear to have been trained with at least that threshold. European Commissiontheregister

The regulatory exposure is sharpest for Meta. Two weeks before the EU AI Act’s General-Purpose AI provisions took effect, Meta declined to sign the European Commission’s voluntary safety guidelines, arguing the measures introduced “legal uncertainties” beyond the law’s scope. The position is legally defensible. In the context of Cisco’s vulnerability data, it reads very differently. theregister

State actors have already moved. A China-linked group reportedly automated 80–90% of a cyberattack chain by jailbreaking an AI coding assistant and directing it to scan ports, identify vulnerabilities, and develop exploit scripts. Russian operators integrated language models into malware workflows to generate obfuscated commands. North Korean actors used generative AI to create deepfake job applicants. These are not proofs of concept. They are operational deployments. Help Net Security

For enterprise security teams, the second-order problem is liability. When an agentic AI system operating inside a corporate environment is manipulated through a multi-turn jailbreak into exfiltrating data or executing malicious code, the question of who is responsible — the model developer, the system integrator, the deploying enterprise — will not remain unanswered for long. Litigation and regulatory enforcement will answer it, probably within the next 24 months.

4 — The Open-Weight Case for the Defence

The picture is more complicated than “open models are dangerous; close them.”

The case for open-weight release rests on three serious arguments. First, transparency: an open model can be independently audited, stress-tested, and improved by the research community in ways that closed API systems cannot. Second, concentration risk: if safety-critical AI infrastructure is exclusively controlled by four or five companies, the failure modes of those companies become systemic. Third, and most pragmatically: the security vulnerabilities Cisco identified in open-weight models also exist in closed systems — they’re simply harder to measure, because the weights aren’t visible.

Meta’s LlamaFirewall project — an open-source guardrail framework that combines prompt injection detection, agent alignment checks, and static code analysis — represents a genuine attempt to build a shared safety layer that deployers can adopt. Its PromptGuard 2 component claims state-of-the-art performance on universal jailbreak detection. Whether that performance holds under the kind of multi-turn, reasoning-model-as-attacker pressure Cisco and others have documented is, as yet, untested. Meta

The deeper argument — articulated by researchers at F5 Labs among others — is that several guardrail solutions falter against novel attacks, and even top-ranked models regress under subtle architectural shifts, with emerging jailbreak methods demonstrating the almost limitless ways that adversarial prompts can bypass defences. No single architecture is currently winning. That’s not an argument for abandoning safety research; it’s an argument for treating it as an ongoing adversarial process rather than a compliance checkbox. F5

The open-source community has often solved security problems faster than proprietary teams. CVE disclosure, coordinated patching, and red-team competition have all driven measurable improvements in conventional software security. There is no structural reason the same dynamic cannot operate in AI — only the question of whether it will move fast enough.

The Asymmetry at the Core

What Cisco’s research reveals, stripped of its technical language, is a fundamental asymmetry: the cost of mounting an AI guardrails jailbreak is falling, and the cost of defending against one is rising.

A sustained multi-turn attack requires patience and iteration. It does not require expertise. The G0DM0D3 open-source toolkit, which surfaced in early 2026, claims to jailbreak dozens of models simultaneously through parallel prompt engineering — no special knowledge required, a web interface, a few minutes. Whether or not specific tools like that persist, the underlying dynamic will: capability to attack will continue to outpace capability to defend, as long as safety alignment remains an afterthought in model development rather than a foundational design constraint.

The EU’s AI Act represents the first serious attempt to impose legal accountability on that dynamic — to require, not merely encourage, safety testing commensurate with a model’s potential harm. The regulation’s “ecosystem enforcement” strategy suggests the EU will use the AI Act in tandem with antitrust laws to prevent tech giants from monopolising the AI market — and, by extension, from externalising safety costs onto deployers and users. FinancialContent

Yet regulation, at its best, lags the technology by two to three years. The 92.78% figure exists today. The laws designed to address it do not.

What that gap costs — in data breaches, in manipulated agentic workflows, in AI systems turned against the organisations that deploy them — is a number no one has calculated yet. The bill is coming due regardless.

nThe hour is up

For the better part of a century, the economics of management consulting have rested on a beautiful fiction: that the value of advice can be measured in time. An analyst’s hours, a partner’s days, a team’s weeks on site — these were the denominator around which entire firms were built, pyramids of talent whose profitability depended on billing more hours than competitors at rates clients would reluctantly accept. The fiction held because nobody had a better alternative.

Artificial intelligence has now supplied one.

The pressure is visible in the numbers, in restructured partner pay, and in the quiet desperation with which firms like McKinsey, BCG, and Bain are repositioning themselves not as advisers but as delivery partners. The consultancy industry’s pricing model — the bedrock of a $700 billion global market — is cracking. The question is not whether it will change. It already is. The question is who benefits.

A familiar disruption, an unfamiliar pace

The consulting industry has survived disruptions before. Offshoring squeezed margins in the 2000s. The post-2008 austerity wave hammered public-sector mandates. The pandemic briefly collapsed travel-dependent engagement models. Each time, the billable-hour survived, battered but intact.

This time is structurally different. What AI is compressing is not demand for advice — that remains robust — but the labour input required to produce it. The Management Consultancies Association’s January 2026 member survey found that 77% of UK consulting firms have already integrated AI into their systems, with 76% deploying it specifically for research tasks and 68% having increased automation of core workflows. Meanwhile, the global AI consulting and support services market, valued at $14 billion in 2024, is forecast to expand at a compound annual growth rate of 31.6% to reach $72.8 billion by 2030 — a trajectory that reflects how thoroughly the tools are reshaping both supply and demand.

When AI compresses the time required to produce work, hourly billing stops being a proxy for value. It becomes a liability.

The AI consulting pricing model is already shifting — and McKinsey is leading it

In November 2025, Michael Birshan, McKinsey’s managing partner for the UK, Ireland, and Israel, made an admission that would have been unthinkable five years ago. Speaking at a media briefing in London, Birshan told reporters that clients were no longer arriving with a scope and asking for a fee. Instead, they were arriving with an outcome they wanted to reach and expecting the fee to be contingent on McKinsey’s ability to deliver it. “We’re doing more performance-based arrangements with our clients,” he said. About a quarter of McKinsey’s global fees now flow from this outcomes-based pricing model.

That 25% figure is both significant and revealing — significant because it marks a genuine departure from decades of billable-hour orthodoxy, revealing because it shows that three quarters of McKinsey’s revenue remains anchored to the old model. The transition is real. It is not complete.

The driver is largely internal. McKinsey’s Lilli platform — an enterprise AI tool rolled out firm-wide in July 2023 — is now used by 72% of the firm’s roughly 45,000 employees. It handles over 500,000 prompts a month, auto-generates PowerPoint decks and reports from simple instructions, and draws on a proprietary corpus of more than 100,000 documents, case studies, and playbooks. By McKinsey’s own reckoning, Lilli is saving consultants 30% of their time on research and knowledge synthesis. When a tool saves 30% of the hours that used to justify an invoice, the invoice requires a different rationale.

BCG has pursued a parallel path. Its internal assistant “Deckster” drafts initial client presentations from structured datasets in minutes. BCG disclosed in April 2026 that roughly 25% of its $14.4 billion 2025 revenue — approximately $3.6 billion — derived from AI-related work, the first time any Big Three strategy firm has made that figure visible. Bain’s “Sage” platform performs comparable functions. PwC, which became OpenAI’s first enterprise reseller, committed $1 billion to generative AI in 2023 and subsequently deployed ChatGPT Enterprise to 100,000 employees. KPMG followed with a $2 billion alliance with Microsoft.

Collectively, the Big Four and major strategy houses poured more than $10 billion into AI infrastructure between 2023 and 2025. The investments were real. The pricing implications they’re now confronting were perhaps underestimated.

What is outcome-based pricing in consulting — and why does AI accelerate it?

Outcome-based pricing ties a consulting firm’s compensation to measurable results — revenue growth, cost reduction, market-share gains — rather than to the hours or scope of work delivered. It existed before AI, but AI transformation projects suit it naturally: they are multi-year, multidisciplinary, and generate data that makes performance tracking tractable.

As Kate Smaje, McKinsey’s global leader of technology and AI, noted in November 2025, the shift “developed over the past several years as McKinsey started doing more multi-year, multidisciplinary, transformation-based work.” AI didn’t originate the model. It made it commercially necessary.

The structural problem no press release addresses

Here is where the analysis must get uncomfortable for the firms themselves.

The productivity gains AI is generating inside McKinsey, BCG, and Bain are not, in any consistent way, being passed on to clients. One detailed analysis of MBB pricing practices published in 2025 concluded bluntly: firms’ external pricing “hasn’t moved” even as internal AI tools have displaced significant analyst labour. Clients are still paying as if junior consultants spent 80-hour weeks building the models from scratch. In many cases, Lilli or Deckster did it in an afternoon.

This creates a credibility problem that compounds over time. Sophisticated procurement teams at large corporations are beginning to ask questions about methodology, tool usage, and the provenance of deliverables. Deloitte Australia’s AU$440,000 refund to a government client over unverified AI-generated outputs — reported in 2025 — turned what had been a theoretical concern into a profit-and-loss event. Ninety percent of enterprise buyers, according to subsequent surveys, now want explicit AI governance disclosures built into contracts.

The Financial Times has reported that McKinsey is already adjusting its internal partnership economics in response, planning to shift a greater share of partner remuneration into equity as AI-driven outcome-based pricing makes consulting revenues more volatile and harder to predict quarter-to-quarter. Partners, in other words, are being asked to absorb the risk that used to sit with clients. That is a profound structural change — and one the recruitment and retention of top talent will have to accommodate.

The Amazon McKinsey Group launched in January 2026 — a joint venture combining McKinsey’s strategy capability with AWS cloud infrastructure and AI tooling — represents the most explicit attempt yet to fuse the advisory and implementation roles into a single, outcome-accountable offer. Engagements are scoped for transformations expected to deliver at least $1 billion in measurable client impact. It is a bet that scale and technology integration can justify premium fees in ways that billable hours increasingly cannot.

The counterargument: not all hours are created equal

It would be wrong to read this as consulting’s obituary. The critics of outcome-based pricing are not wrong to worry.

The model introduces its own distortions. When fees depend on measured outcomes, consultants have an incentive to define those outcomes narrowly, to work on problems whose success is easily attributable, and to avoid the ambiguous, long-horizon strategic work that generates the least data but often the most genuine value. A firm paid to raise revenue by 8% in 18 months may not tell a CEO that the business model is structurally broken. A firm paid by the hour has no such structural inhibition.

There is also the question of risk allocation. Outcome-based contracts push downside exposure onto the consulting firm, which sounds appealing to clients until they realise that firms will price that risk into their upside. McKinsey isn’t offering to share downside and cap upside. The performance-based arrangements being described are, in practice, hybrid structures — some fixed base, performance kickers on top — not pure contingency. That’s a meaningful distinction.

Sceptics within the industry point to a second problem: attribution. Did McKinsey’s intervention raise the client’s revenue, or did a favourable macroeconomic tailwind? Determining causality in complex business environments is genuinely hard, and the history of performance-based arrangements in other professional services — notably investment banking and private equity advisory — suggests that disputes over attribution tend to be costly and corrosive.

“Outcomes-based pricing didn’t start because of AI,” Smaje acknowledged in November 2025. The honest implication of that statement is that it won’t be resolved by AI either.

What firms, clients, and the talent market face next

The second-order effects of this pricing shift will ripple well beyond contract structures.

The consulting pyramid — the hierarchy of analysts, associates, managers, partners, and senior partners whose labour cost structure has remained largely stable for three decades — is under genuine pressure. McKinsey’s own research has estimated that approximately 45% of activities traditionally performed by consultants could be automated with existing technology. If Lilli handles research, synthesis, and deck generation, the case for the analyst class — the bottom of the pyramid that cross-subsidises partner economics — becomes harder to sustain.

Hiring data from 2025 suggests firms are already adjusting. The UK Management Consultancies Association survey projected 5.7% consulting revenue growth in 2026 and 7.4% in 2027, with AI services driving the greatest expansion for 66% of firms. Yet headcount growth is not tracking revenue growth — a gap that implies productivity gains are being captured by existing staff rather than expanded teams.

For clients, the shift creates genuine leverage — but only for those sophisticated enough to use it. Enterprise buyers who understand what AI can and cannot do, who can write performance metrics that are both meaningful and attributable, and who are prepared to challenge deliverable provenance will extract real value from the new model. Those who outsource that judgment to the firms themselves will find that outcome-based pricing, in practice, looks a lot like billable hours with better marketing.

The talent market will bifurcate. Consultants who can manage AI-augmented workflows, design outcome metrics, and demonstrate delivery accountability will command premiums. Those whose competitive advantage was research bandwidth and slide-deck velocity — tasks now automated at scale — face a more difficult conversation. Research published in late 2025 found that consultants using AI tools completed tasks 25% faster at 40% higher quality, but the strategic thinking, relationship management, and client judgment that justify senior fees remain, for now, distinctly human.

The tension that will define the next decade

There is a phrase circulating in elite consulting circles that captures the bind precisely: firms are being asked to be accountable for outcomes they do not fully control, using tools whose productivity gains they have not fully disclosed, in a market where clients are only beginning to understand what to demand.

The billable hour was imperfect. But it had the great virtue of simplicity: time spent, time charged. What replaces it will be messier, more contested, and more lucrative for the firms that define the terms before their clients do.

McKinsey’s quiet overhaul of partner pay is the most honest signal of what the industry privately believes: that the revenue model is becoming structurally volatile, and that the people at the top of the pyramid need to share in the uncertainty their AI tools have created. That is not a reassuring message dressed up as progress. It is a reckoning.

The hour was always a fiction. The question now is what honest accounting looks like when a machine has done the work.

On 28 February 2026, the first US-Israeli strikes on Iran effectively closed the Strait of Hormuz to normal shipping. Within six weeks, Brent crude had recorded its largest single-month price rise in recorded history, surging roughly 65 percent to above $106 a barrel. For most of the world, that was a severe financial shock. For South-east Asia — a region of 700 million people that depends on the Middle East for 56 percent of its total crude oil imports — it was something closer to a structural emergency. Governments reached for the familiar toolkit: subsidies, price caps, rationing. It isn’t working.

The timing is particularly brutal. South-east Asia had entered 2026 on what looked like solid ground. The region had weathered US tariffs better than feared; export front-loading and resilient private consumption kept growth humming at roughly 4.7 percent across developing ASEAN in 2025. Inflation was subdued. Central banks had room to manoeuvre.

That cushion is now gone.

The World Bank’s April 2026 East Asia and Pacific Economic Update projects regional growth slowing to 4.2 percent this year, down from 5.0 percent in 2025, with the energy shock explicitly cited alongside trade barriers as a primary drag. The IMF, for its part, forecasts that inflation across emerging Asia will climb from 1.1 percent in 2025 to 2.6 percent in 2026 — a projection that assumes the most acute phase of supply disruption ends by May. Few analysts believe it will.

The Southeast Asian Energy Shock: What Hit, and Why It Hurts So Much

The mechanism is straightforward, even if the scale is not. The Strait of Hormuz — a 33-kilometre passage between Iran and Oman — serves as the transit point for roughly 20 percent of the world’s daily seaborne oil and up to 30 percent of global LNG shipments. When that artery seizes, South-east Asia feels it fastest. The region imports nearly all of its crude; it holds strategic reserves measured in weeks, not months. Most ASEAN economies sit on fewer than 30 days of emergency oil stocks. The Philippines and Thailand are exceptions, with roughly 45 and 106 days respectively — still a narrow buffer against a conflict that US officials privately suggest could persist through year-end.

The impact of the Southeast Asian energy shock has been immediate and sharp. According to an analysis by JP Morgan cited widely across regional media, the Philippines declared a national energy emergency after gasoline prices more than doubled. Indonesia and Vietnam introduced fuel rationing. Thailand’s fisheries sector — an industry that generates billions in export revenue and employs hundreds of thousands — began shutting down as marine diesel costs became unviable.

The fiscal arithmetic compounds the pain. Fossil fuel subsidies across five major ASEAN economies — Indonesia, Malaysia, Thailand, Vietnam, and the Philippines — reached $55.9 billion, or 1.3 percent of combined GDP, in 2024, before the current crisis. Indonesia alone spent the equivalent of 2.3 percent of GDP on explicit fuel price support. Now, with Brent crude above $100 and the World Bank’s commodity team forecasting an average of $86 a barrel across 2026 even in a best-case recovery scenario, those subsidy bills are rising faster than governments budgeted for.

The ASEAN Economic Community Council convened an emergency session on 30 April 2026, held by videoconference, in which ministers cited “growing instability along key maritime routes” as driving volatility in energy prices and sharply increasing freight, insurance, and logistics costs. The communiqué warned of spillover effects on food security and business confidence, particularly for small and medium enterprises — the backbone of most ASEAN economies.

Why Policy Options Are Narrowing — and Who Is Most Exposed

The question South-east Asian governments face isn’t whether the energy shock hurts. It’s whether they have enough fiscal and monetary space to absorb it.

The answer varies sharply by country, and understanding those differences matters for anyone assessing the ASEAN investment landscape.

Which Southeast Asian countries are most vulnerable to oil price spikes? Thailand and the Philippines face the gravest pressure. Both import nearly all their fuel, lack meaningful commodity export revenue to offset higher import bills, and carry domestic vulnerabilities — elevated household debt in Thailand, structural current-account exposure in the Philippines — that amplify the macro damage. Indonesia and Malaysia are better insulated: coal exports and palm-oil revenues provide a partial natural hedge, and their domestic energy production reduces import dependency. Vietnam sits somewhere in between, with growing industrial exposure but a more activist state ready to deploy price stabilisation funds.

Thailand’s predicament illustrates the bind. The country’s National Economic and Social Development Council reported GDP growth of 1.9 percent year-on-year in the first quarter of 2026, well below the government’s own 2.6 percent projection, even as tourist arrivals held firm. The Oil Fuel Fund empowers Bangkok to subsidise pump prices during international oil spikes — but that mechanism has a fiscal cost, and with the budget already stretched, sustaining it without cutting other expenditure is a genuine political and economic dilemma. The World Bank forecast that Thailand’s full-year growth will slow to just 1.3 percent in 2026, down from 2.4 percent last year — the weakest major economy in the region by a significant margin.

Central banks are caught in a similar bind. The IMF’s Andrea Pescatori put it plainly in April: the energy shock is “raising inflation, weakening external balances, and narrowing policy options.” Cutting rates to support growth risks stoking inflation and pressuring currencies already weakened by the dollar’s safe-haven surge. Raising rates to defend currencies risks tipping fragile economies into contraction. The Philippine peso and Thai baht have both depreciated this year, which means the energy shock arrives at an exchange rate that makes every dollar-denominated barrel of oil cost even more in local terms.

That is not a problem easily subsidised away.

Implications: Fiscal Strain, Food Prices, and the Coal Comeback

The second-order effects of the ASEAN oil crisis are where the real long-term damage accumulates.

The most immediate downstream risk is food inflation. Higher marine fuel costs don’t just shut down Thailand’s fisheries; they push up the price of fish for 70 million Thais and complicate the region’s food-export economics. Fertiliser prices — heavily tied to natural gas — are rising in parallel. Vietnam, a major rice and agricultural exporter, is watching input costs erode margins across its farm sector. Thailand, according to reports cited in regional media, is even exploring fertiliser purchases from Russia to manage costs — a geopolitical trade-off that puts ASEAN countries in an awkward position as the EU and US press them to limit economic lifelines to Moscow.

Then there’s the energy mix reversal. Vietnam and Indonesia are re-optimising towards coal to reduce LNG import dependence — a rational short-term response that directly undermines both countries’ climate commitments and their eligibility for concessional green finance. The IEA’s 2026 Energy Crisis Policy Response Tracker documents this shift across multiple Asian economies, noting a wave of emergency fuel-switching from gas to coal-powered electricity generation.

For businesses, the pressure is both direct and indirect. Singapore Airlines reported a 24 percent increase in fuel costs year-on-year in recent filings, a squeeze that hits one of the region’s most profitable and strategically important carriers. Logistics firms across the region are repricing contracts, with knock-on effects for the export-oriented manufacturers in Vietnam, Malaysia, and Thailand who depend on predictable freight rates to compete in global supply chains.

The Asian Development Bank’s April 2026 Outlook projects inflation across developing Asia rising to 3.6 percent this year, as higher energy prices feed through to consumer prices. For the urban poor across Manila, Bangkok, and Jakarta, who spend a disproportionate share of income on transport and food, that number translates into a genuine fall in real living standards.

The Case for Optimism — and Why It’s Incomplete

It would be unfair to write off ASEAN’s resilience entirely. The region has navigated severe external shocks before — the Asian financial crisis of 1997, the global financial crisis of 2008, the Covid-19 supply chain fractures of 2020–21 — and each time it emerged with stronger institutional frameworks and deeper reserve buffers.

The OMFIF notes that ASEAN+3 entered 2026 from a position of relative strength, with growth of 4.3 percent in 2025 and inflation at just 0.9 percent — conditions that gave central banks some room to absorb a supply shock without immediately tightening. Several governments are using the crisis to accelerate structural shifts that were already overdue: Indonesia is pushing its B50 biodiesel programme, blending palm-oil biodiesel with conventional diesel to reduce petroleum imports. Vietnam is expanding petroleum reserves and evaluating renewable energy deployment. Malaysia is prioritising industrial upgrading.

Some economists argue, too, that the region’s AI-related export boom — identified by the World Bank as a “bright spot” in 2025, particularly in Malaysia, Thailand, and Vietnam — provides a partial growth offset that didn’t exist in previous energy shock episodes. Semiconductor and electronics exports are less fuel-intensive than traditional manufacturing, offering a degree of natural hedge.

Yet this optimism has limits. Most of the structural diversification being contemplated operates on timescales of years, not months. Biodiesel programmes and renewable energy buildouts don’t lower this quarter’s fuel bill. And the fiscal space being consumed by subsidy programmes today is space that won’t be available for infrastructure investment, healthcare, or education tomorrow. Analysts at Fulcrum SGP, reviewing the region’s policy responses, concluded that “the reactive nature of most policy responses risks locking the region into structural fragility” — a diagnosis that captures the fundamental tension between managing the immediate crisis and building long-term resilience.

The Reckoning That Keeps Getting Deferred

South-east Asia’s energy vulnerability didn’t begin on 28 February 2026. For decades, the region’s economies grew rapidly on a diet of cheap imported oil, building infrastructure and industrial capacity calibrated to abundant fossil fuels and open sea lanes. The Hormuz closure has made visible what was always structurally true: that a region of 700 million people, with combined GDP approaching $4 trillion, had built its prosperity on a supply chain that runs through a 33-kilometre passage controlled by a third party.

Governments are responding, as governments do, with the instruments closest to hand — subsidies, rationing, emergency reserves. Those measures will blunt some of the pain. They won’t resolve the underlying architecture.

The World Bank’s Aaditya Mattoo put the challenge with unusual directness in launching the April update: “Measured support for people and firms could preserve jobs today, and reviving stalled structural reforms could unleash growth tomorrow.” The operative word is “stalled.” The reforms — energy diversification, grid integration, renewable deployment — were the right answer before the crisis. They remain the right answer during it. The distance between knowing that and doing it, at pace and at scale, is where South-east Asia’s next decade will be decided.

The Strait of Hormuz may reopen. The structural exposure won’t close itself.