This article supercedes the original article 2026 Enterprise Guide for AI Control Plane I published in May.

The short version

• Microsoft says nearly 50 million agents are registered on its platform. No vendor I looked at publishes how many agents sit under an enforced policy.

• A control plane earns the name where it can refuse an agent at the tool call; model-call checks only lower the odds.

• Where the model runs decides who owns its safety layer, and for imported weights that layer is often off, absent or yours.

• No deadline forces a purchase this quarter, so pick the governance step you are on, then pilot 2 vendors against it.

• Everything here is read from vendor documents, filings and incident reports. I have not run any of these products in production.

On September 30 Microsoft wrote that “nearly 50 million agents have been registered across tens of thousands of organizations” since Agent 365 launched in May. It is the biggest number I have seen anyone in this market publish, and it answers a question I do not hear anyone at a mid-market company asking.

The question I do hear is different.

Of the agents in your company, how many would be stopped if they tried to do something they are not allowed to do? Microsoft does not publish that number. Neither does ServiceNow, Salesforce, Databricks, AWS or Google, and I looked hard.

A registration is a count of agents that have been written down. Governance is a count of agents that a policy can refuse at the tool call. This guide is about the gap between those 2 counts and how to close it for your own agents.

One disclaimer before anything else.

Every claim here comes from vendor documents, regulatory filings and incident write-ups I read this month, not from a deployment I ran. Where I say a product “enforces” something, I mean its own documentation says so.

What a control plane does

An AI control plane is the layer that answers 5 questions about every agent you run. An agent, for this article, is software that uses an AI model to decide what to do next and then does it: calls a tool, reads a record, sends a message.

• Identity. Which agents exist, who owns each one, and what is it supposed to be? The answer should come out of a register in a minute, not out of a spreadsheet someone updates when they remember.

• Authorization. Which tools, data and systems is each agent allowed to touch? Here “allowed” has to mean “refused if not.”

• Policy. The rules an agent operates under: what it may say, where its data may live, which model it calls and what safety layer sits around that model. If the rule only lives in a PDF, it is a wish. If the platform checks it on every call, it is a policy.

• Evidence. For any action an agent took yesterday, can I see the prompt, the policy decision, the tool it called and where the data came from, without raising an engineering ticket?

• Lifecycle. Register, version, retire and kill, with evidence in the log that the kill worked.

Where the model runs, and who operates the safety layer around it, sits inside policy and lifecycle, because whoever picks the model inherits the job of screening what goes into it and what comes out.

It is where I found the vendors differ most, and where I suspect buyers assume the most.

Who sells one now

Every major platform now ships a register of agents, about half pair it with a gateway that sits in front of calls, and most claim to reach agents built somewhere else. The table lists what I could verify in each vendor’s own documents. “Enforces” means a documented point where the platform can refuse a call.

2 things stood out when I read these side by side.

1. The first is that “control plane“ now appears in Salesforce’s, Databricks’, Palo Alto’s and Microsoft’s own copy, for products that do different jobs. Salesforce’s is a plan for early fiscal 2028, Databricks’ is a claim with no documented mechanism for agents outside its lakehouse, and Palo Alto’s is a gateway in front of model calls.

2. The second is that the enforcement that does exist is narrow. ServiceNow can revoke an agent’s credential and stop it at runtime. AWS can refuse a tool call at its gateway under a written policy. Microsoft can refuse an identity. None of them documents how many customer agents sit under one of those controls, and ServiceNow’s July filing reports contract value and deployment growth, not agents governed.

The identity vendors are the ones I watched most closely.

Between May and September, 3 identity vendors and 1 data-security vendor closed deals for startups that give agents their own credentials. That tells me where those buyers expect enforcement to end up. It does not tell me it has ended up there yet: SailPoint said on October 6 that its Entro integration “will soon be complete,” and Okta’s September release gives Permiso-based detection no ship date.

Where the model runs, and who runs the harness

Every agent calls a model, and that call is a boundary where a platform can screen what goes in and what comes out. That screening layer is what the vendors have started calling a harness, so I will use their word. Some vendors guard this boundary for your models; others leave it to you.

Microsoft shows it in 2 current documents.

1. Foundry agents may call “a self-hosted, non-Azure hosted, or custom solution“ through a gateway, and for those models “you are responsible for implementing your own responsible AI mitigations,” used “at your own risk.”

2. Its Fireworks service, which also takes your own weights, applies “the Microsoft.DefaultV2 guardrail unless a different one is specified.“ So whether a harness is on depends on which of Microsoft’s 2 doors you came in through.

Oracle is the plainest: “Guardrails aren’t available for imported models.”

Databricks ships its guardrails as service policies, still in beta.

On AWS you can import your own weights, screen text with Bedrock Guardrails separately from the model, and enforce tool policy at the AgentCore gateway, but the docs describe these as parts you wire together, not a switch.

Google’s custom-weight deployment is preview; its Model Armor screening has been live on its gateway since June 24.

ServiceNow takes no outside model for its agents, only for skills.

Salesforce built its Koa model on open NVIDIA Nemotron weights so that “Salesforce controls the model weights“ and inference stays “entirely within its own trust boundary.“ I could not read SAP’s or IBM’s documents, so their absence here is my limit, not a finding.

The best evidence I have seen that the harness is a separate layer comes from an incident. OpenAI’s technical report on the July Hugging Face intrusion says a model’s tendency to compromise infrastructure “can drop over 100x when using the production ChatGPT harness and system prompt.“

So what the model does depends on the harness you put around it.

A download is more than weights: it ships with loader code and a chat template. CISA, the US cyber agency, says a model without its training data and pipeline should be treated as “proprietary software with incomplete provenance.” Hugging Face’s own docs recommend pinning a commit hash so the loader code cannot change under you, and outside NVIDIA’s catalog I found no model signing you can enforce today.

There is one good reason to keep a model you run yourself even if you govern everything else through a vendor. Hugging Face’s incident timeline says its responders ran GLM-5.2 on their own infrastructure after hosted models, Claude Opus among them, refused much of the analysis. I’d keep a local model for that, with one limit: a different model cannot reproduce what your production model did, so it is for analysis, not replay. Renting an open model by the token is cheap now, gpt-oss-120B at $0.15 in and $0.60 out per million tokens on Together today, so the self-hosting decision is mostly about who operates the harness.

Registered is not governed

In July, by both companies’ accounts, an autonomous agent running on OpenAI models broke into Hugging Face through a dataset-processing pipeline. Hugging Face’s own timeline has the 2 sentences that matter: “We had wrongly provisioned that broker with a single connector credential shared across clusters,” and “One stolen system credential was therefore cluster-admin everywhere.” The agent was somebody else’s, so no register of Hugging Face’s agents would have listed it. What would have shrunk it is enforcement at the tool boundary: a credential that only works on one cluster, and a gateway that refuses a call outside policy.

That is the test I’d apply to every row in the table: not “does it register my agents“ but “at which boundary can it refuse, for my model, my runtime and my tools, and what evidence is left afterward?”

The tool boundary is where an agent calls a system, and a gateway sits in front of that call. The Model Context Protocol (MCP, the common way agents call tools, now a Linux Foundation project) made that job easier in July: its spec went stateless and put the method and tool name in headers, so “gateways can route and authorize on headers directly.” The model boundary is where the agent calls the model, and the vendor documents show how often the harness there is off, absent or yours.

Even where it is on, it can be beaten: researchers from OpenAI, Anthropic and Google DeepMind showed in October 2025 that adaptive attacks beat all 12 prompt-injection defenses they tested, most more than 90% of the time. A harness lowers the odds. The refusal you can count on is at the tool boundary.

One bill in Congress is heading the same way. H.R. 10362, the Stop Rogue AI Act, was introduced in the House on September 14 and referred to 2 committees. Its sponsors say it would have NIST write standards to find and track every AI agent, verify who built and runs it, and “allow, deny, or revoke” its access.

2 lines in the text caught me: standards “not dependent on proprietary or platform-specific registries,” and identity that does “not rely solely on self-attested or single-provider assertions.” I read that as aimed at every single-vendor register.

It is introduced, not law yet. If enacted it binds federal agencies and contractors, NIST gets a year, and the FAR Council, the body that writes the rules for federal buying, up to 18 months after that.

I found no regulator that has said what the enforcement number should be either. US bank regulators’ April model-risk bulletin says generative and agentic AI “are not within the scope.”

How I’d decide

Pick the step, then the vendor. The step is which of these you can answer yes to next, in this order.

1. Inventory
   Can I list every agent and its owner in a minute?

2. Credential
   Does each agent carry its own credential, limited to its job and revocable on its own?

3. Tool boundary
   Can a gateway refuse a tool call under a written policy, and log the refusal?

4. Model boundary
   For every model my agents call, who runs the harness, is it on, and can I prove it?

5. Evidence
   Can I produce the prompt, the decision, the tool and the data for yesterday’s action without a ticket?

My guess is that most mid-market companies are on step 1 or 2, and the vendor pitch is aimed at step 5.

Your stack narrows the choice.

• A Microsoft 365 shop starts ahead on steps 1 and 2 because Entra already governs every human identity.

• A Databricks shop gets steps 3 and 4 for data agents from Unity Gateway, with the beta caveat.

• On AWS, step 3 comes from AgentCore Policy and step 4 from Guardrails, both as parts you wire up yourself.

• For Salesforce, ServiceNow, Workday and Oracle, I’d verify each boundary rather than trust the register.

The EU dates leave room, with one exception.

Regulation (EU) 2026/1744, in force since July 27, sets the high-risk obligations for the listed uses at 2 December 2027 and for products covered by existing safety law at 2 August 2028. The transparency duties under Article 50 applied from 2 August 2026. Telling people they are talking to an AI gets no grace period; generative systems already on the market have until 2 December 2026 to mark their output. So the transparency work is due now and the high-risk work has 14 months.

The Commission’s own FAQ says a company that modifies a general-purpose model is “not automatically subject to all the obligations.”

That is not legal advice, and I’d put the question to counsel before importing weights.

I’d run 2 vendors for 90 days against the same agents and the same test: at each boundary, show me the refusal and the log. The places where the 2 do not line up (identity format, policy language, log shape) are what you learn from, and a single-vendor pilot hides every one of them.

What I’d do on Monday

• Count 3 numbers: agents registered, agents under an enforced policy at the tool boundary, and agents whose model call has a harness switched on.

• Ask each vendor in writing: for an agent using my model, on my runtime, calling my tool, show me the refusal and the log entry.

• Revoke one agent’s credential and watch what happens.

• See whether your API gateway’s prompt-attack check is on. Azure API Management’s is off by default.

• I’d write down who owns the harness for every imported model. If the answer is the vendor, find the sentence in their docs that says so. Oracle’s says the opposite.

• Pin the commit hash on every model download.

• I’d confirm every customer-facing agent already tells people it is an AI. That duty applies now.

References:

• Microsoft, What’s new in Agent 365, September 2026 (2026-09-30): https://techcommunity.microsoft.com/blog/agent-365-blog/whats-new-in-agent-365---september-2026/4560803

• Microsoft Learn, AI gateway for Foundry agents (updated 2026-08-28): https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/ai-gateway

• Microsoft Learn, Enable Fireworks models in Foundry (updated 2026-10-01): https://learn.microsoft.com/en-us/azure/foundry/how-to/fireworks/enable-fireworks-models

• Oracle docs, Create an endpoint (OCI Generative AI): https://docs.oracle.com/en-us/iaas/Content/generative-ai/create-endpoint.htm

• ServiceNow docs, Configure AI agent containment (updated 2026-09-10): https://www.servicenow.com/docs/r/intelligent-experiences/gov-sec-configure-ai-agent-containment.html

• AWS docs, AgentCore Policy: https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy.html

• SailPoint, Chaos to control (2026-10-06): https://investor.sailpoint.com/news-releases/news-release-details/chaos-control-sailpoint-unlocks-secure-agentic-era-autonomous

• Hugging Face, Agent intrusion technical timeline (2026-07-27): https://huggingface.co/blog/agent-intrusion-technical-timeline

• OpenAI, Hugging Face Incident Technical Report (PDF, undated in text; file metadata 2026-08-26): https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf

• CISA, Open Source Software: Security Principles and Practices (publication 2026-07-30), pp. 18-20: https://www.cisa.gov/sites/default/files/2026-08/open-source-software-security-principles-and-practices.pdf

• Model Context Protocol, specification changelog (2026-07-28): https://modelcontextprotocol.io/specification/2026-07-28/changelog

• Nasr, Carlini, Hayes et al. (OpenAI, Anthropic, Google DeepMind and others), The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections, arXiv:2510.09023 (v1 2025-10-10): https://arxiv.org/abs/2510.09023

• GovInfo, H.R. 10362 text: https://www.govinfo.gov/content/pkg/BILLS-119hr10362ih/xhtml/BILLS-119hr10362ih.html

• OCC Bulletin 2026-13a, model risk management (2026-04-17): https://www.occ.treas.gov/news-issuances/bulletins/2026/bulletin-2026-13a.pdf

• EUR-Lex, Regulation (EU) 2026/1744 (2026-07-08; in force 2026-07-27): https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng

This guide supersedes my May 2026 control-plane guide.

1. Anthropic cuts small-model prices with Haiku 5.5

Anthropic released Haiku 5.5 on October 7 at $0.10 per million tokens in and $0.50 out for prompts up to 100,000 tokens, against Haiku 4.5’s $1 and $5. Anthropic says the new model breaks text into slightly more tokens per task, and on average it costs about 75% less to run. It also halved Sonnet 5.5’s price for reusing stored prompt text, to $0.10.

→ Prompts over 100,000 tokens get only a 50% cut, so it matters how many prompts are that long.

2. Google announces Workspace accounts for Gemini coworker agents (28 min read)

Google announced the Gemini agent on October 8. Each “coworker agent” gets its own Workspace account, with an email address, calendar, Drive and a directory entry, acts under its own identity and sees only what it is given. Admins can set a hard cap on a project’s AI spend, and when it trips that project’s agent pauses until someone resumes it.

→ Google’s page doesn’t say when it’s available or what it costs, so I’d ask for both in writing. Someone also has to decide who may create these accounts and who removes them.

3. MCP servers accepted sign-in tokens meant for other services (2 min read)

On October 5 the maintainers of the official kits for MCP, the standard agents use to connect to tools and data, published matching Python and TypeScript advisories. Where one sign-in system issues tokens for several services, an MCP server using either kit’s sign-in check accepted a token meant for another service, unless its own code checked who the token was for. Upgrading alone fixes nothing: the new check is off until a developer turns it on.

→ This is the second MCP kit fix in 2 weeks that needs more than an upgrade, and Python’s ships in the same 1.30.0 and 2.2.0 releases as the first. A team that upgraded then already has the check, switched off.

4. OpenAI will watermark ChatGPT text in the EU

OpenAI said on October 5 that “over the coming weeks” it will add a watermark, a mark software can detect, to eligible ChatGPT and Codex text in the EU only, citing the EU AI Act. API customers anywhere can opt in for select models. OpenAI’s own tests show swapping 10% of words for synonyms cut detection from about 92% to 66%, and swapping 25% cut it to 17%.

→ Whoever owns AI Act compliance now has to decide whether the company opts in on the API. Staff in the EU should know eligible ChatGPT text will carry the mark.

5. NYC Council questions four AI labs under oath (5 min read)

On October 5 the full New York City Council questioned executives from OpenAI, Meta, Google and Anthropic under oath, and Speaker Julie Menin asked each to “quantify the risk posed by AI in the worst-case catastrophic scenario.” Speaker Menin’s bill requiring outside validation and a human shut-down capability (Int. 1100-2026) was heard and laid over, meaning held for later with no vote.

→ If it passes, any company deploying an AI model in the city that lacks either safeguard could face a $25,000 fine per instance. No vote is scheduled.

6. Two layoff filings, two different answers on AI (5 min read)

HubSpot told regulators on October 6 it would cut about 7% of staff, and its CEO’s memo says “This is not driven by AI-related efficiencies” and describes an AI shift “transforming product, pricing and how we serve our customers.” FICO filed the same day to eliminate about 15% of positions, listing “integrating AI-driven product development” among four changes.

→ The memo says HubSpot’s pricing is changing but gives no detail. HubSpot customers can ask their account team what that means at renewal.

7. TSMC’s September sales rose 54.6% from a year ago (4 min read)

TSMC said in an October 8 filing that September revenue was about NT$511.86 billion, up 54.6% on September 2025. Samsung expects third-quarter operating profit, what is left of sales after running costs, of about 107.40 trillion won, against 12.17 trillion a year earlier. Samsung’s figures are estimates, and full results come later.

→ Neither release breaks the numbers down by product or customer.

References:

• Introducing Claude Haiku 5.5

• Welcome to Gemini at Work 2026: Introducing the Gemini agent

• Server bearer-token authentication accepts tokens issued for a different resource server (GHSA-w4fh-qvv9-3v23)

• Server bearer authentication accepted tokens issued for another service (GHSA-rvq5-wwqv-78pq)

• Our approach to EU text provenance rules

• New York City Council Convenes Hearing on Artificial Intelligence Risks with Testimony from AI Executives, Whistleblowers, Experts

• Meeting of Committee of the Whole on 10/5/2026 at 11:00 AM (NYC Council Legistar)

• Update to the Company’s employees from Yamini Rangan, dated October 6, 2026 (HubSpot 8-K, Exhibit 99.1)

• Fair Isaac Corporation Form 8-K, October 6, 2026

• TSMC September 2026 Revenue Report (Form 6-K)

• Samsung Electronics Announces Earnings Guidance for Third Quarter 2026

Since last week I also published:

• Microsoft Copilot’s New Agent: Wait or Buy? — Autopilot is Scout renamed and moved to the cloud, with no named customer or price.

1. OpenAI lets part of a commitment buy partner software

OpenAI said on September 29 that eligible enterprise customers can put part of an existing OpenAI commitment toward software from 32 partners, including Salesforce and ServiceNow, paying the partner directly. OpenAI also says a zero-data-retention option runs safety reviews with no staff seeing content, though flagged or sampled records go, encrypted, to the customer’s own cloud storage and must be kept at least 30 days.

→ OpenAI doesn’t publish how much of a commitment qualifies, so I’d get that number from the account team before renewing any of those partners. Whoever owns records retention should see the 30-day minimum too.

2. Three new models, one $2-in, $10-out launch price (5 min read)

1. OpenAI released GPT-6.1 Sol on September 29 at $2 per million tokens in and $10 out, unchanged from GPT-6 Sol.

2. Google’s Gemini 4 Argon will launch at an introductory $2 and $10, then $4 and $20; for now only trusted cyber defenders and testers have it.

3. Anthropic’s Sonnet 5.5 kept Sonnet 5’s $2 and $10, and Anthropic says, on its own tests, it costs up to 30% less per task.

→ With the launch prices the same, I’d compare what a finished task costs on my own work, since Anthropic attributes its saving to fewer tokens. I’d budget Argon at $4 and $20, because Google gives no end date for the introductory price.

3. Microsoft moves Copilot Business metering default to December 1

Microsoft said on October 1 that new Microsoft 365 Copilot Business licenses bought through resellers will have pay-as-you-go usage billing switched on by default from December 1, not November 2 as it first said. The default spending limit is 4,000 Copilot Credits per user per month, which admins can adjust. The page gives no price per credit.

→ Anyone who planned around the November 2 date has another month, and I’d use it to pick the spending limit rather than leave it at 4,000. I’d also get the price of a credit from the reseller in writing.

4. MCP’s Python kit could leak agents’ sign-in secrets (4 min read)

An advisory published September 28 says software that signed in through the official Python kit for MCP, the standard for connecting agents to tools, let the server it connected to decide where its sign-in credentials went, so a malicious server could collect them. Servers built with the kit are not affected. Versions 1.30.0 and 2.2.0 fix it, but for the two sign-in types that run unattended, only once developers also pass issuer=.

→ I’d find out which agents sign in through this kit, and rotate the secrets and revoke the tokens of any that may have reached an untrusted server. On 1.30.0 the warning about a missing issuer= is hidden by default, so an upgrade can look finished when it isn’t.

5. California bars firing someone on an algorithm alone (11 min read)

SB 947, signed September 30, bars California employers, starting July 1, 2027, from disciplining or firing someone on an automated system’s output alone, and requires a person to check any such decision that mostly rests on one. SB 951, signed the same day, requires a mass-layoff notice to name the tasks being automated and the kind of system when AI caused the layoffs in whole or substantial part.

→ If an HR tool scores people or recommends discipline, I’d ask HR who checks its output and who sends the employee the written notice the law requires.

6. Micron expects memory to stay tight through 2028

Micron said on September 30 that it expects memory supply to be much tighter in 2027 and 2028 than in 2026, and that it cannot see when supply and demand will balance. Micron says customers have signed 26 multi-year agreements that reserve memory for them and committed $32 billion, mostly as cash deposits, and that new agreements are being priced higher.

→ For a 2027 server or storage refresh, I’d ask vendors how long they will hold a quoted price.

7. Anthropic aims to train 10,000 engineers to deploy Claude (5 min read)

Anthropic launched Claude Frontier Academy on October 2, backed by $100 million, and aims to train 10,000 engineers to roll out Claude inside companies by the end of 2027. Its first cohorts include engineers from Accenture, Deloitte, McKinsey and Morgan Stanley. Entry is by nomination through Anthropic’s account teams.

→ I’d ask any consultancy bidding for Claude work how many of the people it would staff will go through the program, and when. The page doesn’t say what nomination costs.

References:

• DevDay 2026 Recap

• OpenAI Marketplace for enterprise customers

• ZDR with Private Safety Processing

• Introducing GPT-6.1 Sol

• Gemini 4 Argon: our next era of frontier intelligence

• Introducing Claude Sonnet 5.5

• October 2026 announcements – Partner Center

• OAuth client could send credentials to an authorization server chosen by the MCP server (GHSA-qx49-fqc8-xw99)

• SB-947 Employment: automated decision systems

• SB-951 Employment: technological displacement: notice

• Micron Fiscal Q4 2026 Earnings Call Prepared Remarks

• Claude Frontier Academy: $100M to train 10,000 engineers

• Autopilot, the agent at the top of Microsoft’s launch, is Scout, renamed and moved to the cloud: private preview, no customer named, no price published.

• Most of the rest repackages earlier releases, many still in preview; Code’s hosting layer is the one new layer of infrastructure.

• Google and AWS publish comparable agent controls. What Microsoft has over them, for a Microsoft 365 shop, is your documents, identity and data already inside it.

• Spend limits exist from day one but can be overrun, so I’d pilot Cowork with limits. Nothing published predicts Autopilot’s monthly cost.

• Fix billing defaults and agent governance now, don’t reorganize for 90 days, and revisit if Ignite ships Autopilot broadly with a documented identity of its own.

Wait or buy

Other technology leaders keep asking me the same question about Copilot: commit to the agents now, or wait. I have not had a good answer, because it’s hard to determine what an always-on agent will cost per month.

On September 25 Microsoft announced what it calls the new Copilot, and the launch arrived with more agents and still no clear answer to that question.

The launch post, from lists 6 things:

1. Home,

2. Code and

3. Autopilot as the headline 3,

4. with Office in Copilot,

5. a proactive view called Today, and

6. an @Copilot you can call in Teams.

Autopilot, “previously called Scout,” is the one Microsoft leads with: a cloud-hosted agent you give a name, a role and a goal, and it keeps working without waiting for a prompt. It expands to private preview at the end of the month. This is openclaw for Enterprises - not to be confused with OpenClaw for Enterprises just announced as well.

But Agent 365, the set of admin controls Microsoft sells for agents, has been generally available since May 1 at $15 a user a month. Copilot Cowork, the agent that runs long tasks while your laptop is closed, opened to every Microsoft 365 Copilot customer on June 16 and bills by the credit.

Microsoft’s own filing says Microsoft 365 Copilot passed 30 million paid seats in the quarter to June 30; seats, not active users. The headline agent has no price and no line on the billing list, and the stack around it is in production and being billed.

Six features, one verdict each

Microsoft’s blog gives every feature the same glow. Read against Microsoft’s own earlier posts and documentation, they fall into 3 groups: things that already exist, mostly in preview, and got a new front door; one thing that is new infrastructure; and one agent that is a rename plus a new place to run.

Home

Home is the new front page, where Chat and Cowork come together in one place. Interestingly, Anthropic made the same choice recently and merged chat and cowork. Cowork has been generally available since June 16, and Chat is the Copilot Chat everyone already has. The only new thing is that you no longer choose between them before you start.

Verdict: repackaged, and not live yet; it goes to Microsoft’s early-access program, which it calls Frontier, “in the coming weeks.”

Today

Today is a view across mail, calendar, Teams threads, meetings and tasks that drafts the reply and proposes the schedule change before you ask. Outlook’s Copilot has done that triage-and-reschedule work in Frontier since April 27, by Microsoft’s own description. What Today adds is the single view across all of them, and that part is private preview in October. I do this myself but have to cobble ti to together and I welcome this.

Verdict: mostly repackaged, with the new bit unshipped.

Office in Copilot

Word, Excel and PowerPoint move into Copilot, so it creates or updates a real document, workbook or deck that stays in sync with the Office apps, live for the whole team. Creating Office files from Copilot chat reached Frontier as Word, Excel and PowerPoint agents in November 2025. The new claim is live co-editing with colleagues inside Copilot, and the launch post gives it no date of its own.

Verdict: incremental, and undated.

Code

Code lets you describe an app or workflow in plain English and get one built on the same technology as GitHub Copilot, running in a sandbox that can be “hosted securely within your tenant.”

The front end is not new: building apps from a Cowork chat or from Copilot Studio reached Frontier and preview September 10, on usage billing.

The hosting is new. Copilot Managed Runtime, in public preview since the September 25 launch, is Microsoft-run infrastructure that, per the launch post, lets code “run safely right inside your company’s Microsoft 365 environment,“ with sign-in through Entra (Microsoft’s login directory), connectors the admin controls, Git-backed versions and an inventory in the admin center.

Its SDK (a developer toolkit) and command-line tool are on npm, with a public repo holding a plugin for Claude Code and GitHub Copilot.

Verdict: the front door is repackaged; the hosting layer is new infrastructure, and it is the one part of this launch for a platform team to look at now. Code itself reaches early access at the end of the month.

Autopilot

Autopilot is the digital teammate: a cloud-hosted agent that, per the launch post, lives in your tenant (your company’s own Microsoft 365 environment) with its own identity, memory, computer and workspace, and “permissions, audit and governance behind it.“ It is also Scout, which Microsoft launched June 2 with the same category name, the same always-on pitch and the same promise of an identity of its own. What changed on September 25 is where it runs and who bills it. Scout was “a desktop AI application” that needed a GitHub Copilot Business or Enterprise license and “uses your GitHub account for token billing.”

Autopilot runs in Microsoft’s cloud, inside your tenant, on Copilot usage-based billing.

Moving it to the cloud is a real change, and it is why the governance and cost questions get more pertinent. But it is not a new product, and the identity part is less settled than the post makes it sound. The June blog promised Scout “its own governed Entra identity.”

Scout’s documentation, last updated August 21, only describes users signing in with “your organization’s Microsoft 365 credentials on Windows.” The launch post promises Autopilot its own identity; nothing Microsoft has published yet says how that identity is permissioned or whose name the audit log records.

Verdict: a rename plus a new place to run, private preview at month end, no customer named, no price. Always on agent is popping up everywhere in the consumer space. It’s good to get an early understanding in an Enterprise

@Copilot in Teams

Type @Copilot in a Teams channel and the whole team gets answers with the shared context and permissions of that channel. You can already @mention Copilot in group chats, in public preview, but answers draw on the asker’s own access, with an approve step before sharing anything the others can’t access. What is new is answers using the shared permissions of the channel, chat or meeting, in private preview at month end.

Verdict: incremental.

The launch post’s only items marked generally available are Fabric IQ grounding and, in the coming weeks, a plugin registry.

Every vendor publishes the controls

One read, which Deirdre Bosa put well in the post announcing her Nadella interview, is that the race is moving from models to products and Microsoft’s edge is the boring stuff: permissions, identity, auditability and control. That is half right.

Google Cloud documents an Agent Identity service, with a unique identity per agent, credentials bound to certificates, allow and deny rules, and audit that attributes actions to both the agent and the person behind it; the page was updated September 24.

AWS documents AgentCore Identity, an identity and credential service built for agents, with audit trails, plus permissions set per identity, action and resource. An agent with its own identity, limited permissions and an audit trail is now something every serious cloud writes a page about.

If your documents, your people’s identities and your data already live in Microsoft 365, that is the moat: an agent starts with context instead of connectors. And the admin controls still apply when the agent comes from elsewhere:

Agent 365’s service description covers third-party agents, and Managed Runtime hosts apps built with Claude Code as well as with Microsoft’s own tools, which also poses a hosting lock-in risk, and is why the inventory below is vendor-neutral.

What you can cap and what you can’t predict

Nicole Herskowitz’s pricing post opens with “You need to know what AI is going to cost“ and answers, “That’s a fair ask.”

The pricing is a seat license with usage billed on top; the seat is required, and usage billing for enterprise customers stays off until an admin creates a spending policy, so “nothing is billed before that.”

Cowork, Code and Autopilot all run on that usage meter.

1. A Copilot credit costs a cent on pay-as-you-go, with 5 to 20 percent off for pre-buying a year, and a Cowork credit meters model use, context retrieval, tool calls and runtime.

2. Agent 365 is $15 a user a month with no separate license per agent and no licensing cap on how many agents one licensed person can sponsor.

3. Windows 365 for Agents, a cloud PC for an agent to work from, is 40 cents an hour of use, rounded up, plus $5 a month if kept always on (US prices).

Budgets sit at tenant, group and user level with alerts, and a FinOps (cloud cost management) post the same day says Cost Management now covers Code and Managed Runtime, with Copilot Studio agents due in October.

So you can set limits, though a running task can go past them. What you cannot do is predict it.

The list of services the usage meter covers, updated September 25, names Cowork, Cowork apps and the Work IQ API; Autopilot is not on it. The Cost Management coverage list does not name it either.

No credit rate, per-hour rate or per-agent price for Autopilot exists anywhere Microsoft publishes, and VentureBeat’s read of the launch materials was the same: “The post gives no detailed usage rates.” Adding the component prices above together does not get you Autopilot’s price. Nothing says Autopilot’s “computer” is a Windows 365 cloud PC, and Agent 365 is a per-user governance fee, not a per-agent run fee.

To be fair, Microsoft’s own FinOps post puts the order the other way: control spend, then measure value, with a new dashboard tying Cowork’s credit use to the value it produced.

On that reading a limited pilot is how you get the per-outcome number, and a 90-day wait produces none.

What I’d do on Monday

Now: the billing settings and the agent inventory

3 settings matter now and none of them wait for Autopilot.

1. First, in Cost Management the “Auto-apply new services” switch is on by default. That is the setting that decides whether the policies you write now attach to services Microsoft adds later; whether it reaches Autopilot when Autopilot arrives is not documented, and what is documented is that the switch is on unless you turn it off.

2. Second, from November 2 new Microsoft 365 Copilot Business purchases through resellers default to usage billing switched on, with a preset monthly limit. That is limited to new Business licenses bought through the partner channel, so check whether any of yours are.

3. Third, read what happens when you have more than one spending policy, because a second one does not inherit the first one’s ceiling and a running task can finish past a user’s limit.

Then the inventory, and it is vendor-neutral on purpose: every agent the company runs, what identity it runs under, what it can touch, and where its audit trail goes.

Scout’s admin docs show why. Because Scout can send data outside Microsoft 365 to third-party AI services, GitHub for one, admins must explicitly attest and opt in before it can. That is the kind of switch you want to know about before an agent is running. This work pays off whichever vendor’s agents you end up with, since Google and AWS publish comparable controls.

Not yet: reorganizing around Autopilot

I wouldn’t build a team, a budget line or a job description around Autopilot for 90 days: wait to reorganize, not to talk to your account team before any Ignite announcement.

The window from September 25 ends around Christmas Eve and contains 2 dates: the November 2 billing default and Ignite, November 17 to 20, which is the likeliest moment for Autopilot pricing and general-release news.

3 things would change my advice. Autopilot generally available; Microsoft documenting how Autopilot’s own identity is permissioned and audited, separate from user sign-in; and Agent 365 controls stated to cover it.

If Ignite delivers all 3, the wait-or-buy question turns into a pricing question.

References:

• Introducing the new Copilot with Home, Code and Autopilot — Official Microsoft Blog, Sep 25, 2026

• Evolution of the Copilot pricing model — Microsoft Tech Community, Sep 25, 2026

• New FinOps for AI capabilities: control spend, measure value — Microsoft Tech Community, Sep 25, 2026

• Build where you want, run with confidence: Copilot Managed Runtime — Microsoft, Sep 25, 2026

• microsoft/managed-apps — GitHub

• Copilot Cowork is now generally available — Microsoft, Jun 16, 2026

• Introducing Microsoft Scout, your always-on personal agent — Microsoft, Jun 2, 2026

• Microsoft Scout FAQ — Microsoft Learn

• Microsoft Scout admin access overview — Microsoft Learn

• Get started with Microsoft Scout — Microsoft Learn

• Usage-based billing overview: Copilot Credits — Microsoft Learn

• Manage Copilot Credits: spending policies — Microsoft Learn

• Partner Center announcements, September 2026 — Microsoft Learn

• Secure agentic AI for your Frontier transformation (Agent 365 pricing) — Microsoft Security Blog, Mar 9, 2026

• Microsoft Agent 365 now generally available — Microsoft Security Blog, May 1, 2026

• Microsoft Agent 365 licensing FAQ — Microsoft

• Microsoft Agent 365 service description — Microsoft Learn

• Copilot Credits licensing guidance — Microsoft

• Copilot Studio message and credit management — Microsoft Learn

• Windows 365 for Agents pricing — Microsoft Learn

• Microsoft FY26 Q4 earnings release, Exhibit 99.1 — SEC EDGAR, Jul 29, 2026

• Copilot in Outlook: new agentic experiences for email and calendar — Microsoft Tech Community, Apr 27, 2026

• Introducing Word, Excel and PowerPoint agents in Microsoft 365 Copilot — Microsoft Tech Community, Nov 18, 2025

• Build apps in Copilot Cowork and Copilot Studio — Microsoft, Sep 10, 2026

• How to use Microsoft 365 Copilot in Teams group chats — Microsoft Support

• Announcing Copilot leadership update — Official Microsoft Blog, Mar 17, 2026

• Agent Identity overview — Google Cloud IAM documentation

• Identity and access management for Amazon Bedrock AgentCore — AWS documentation

• Amazon Bedrock AgentCore Identity — AWS documentation

• CEO Satya Nadella on Microsoft’s AI bet — Yahoo Finance Video, Sep 25, 2026

• Microsoft unveils all-in-one Copilot app — GeekWire, Sep 25, 2026

• Microsoft revamps its Copilot AI with a persistent Autopilot agent and hosting for AI-generated apps — VentureBeat, Sep 25, 2026

1. OpenAI and Anthropic cut model prices the same day (9 min read)

OpenAI released GPT-6 Sol and Luna on September 22 at half what GPT-5.6 cost at its promotional rate, with Sol at $2 per million tokens in and $10 out. Anthropic released Claude Opus 5.5 the same day at $4 and $20, 20% below Opus 5, and says its own tests show typical work costing 40% less.

→ I think intelligence is commoditizing, and the dollar per unit of intelligence is going to continue to drop. This is where Jevons’ paradox takes effect: the usage of inference and the overall usage go up while the price of intelligence just goes down.

2. Microsoft’s new Copilot puts its agents on metered credits (9 min read)

Microsoft said on September 25 that Autopilot, formerly Scout, reaches private preview at the end of September, with Home and Code coming through its early-access program in the coming weeks. The seat covers Chat and the Office apps, while Cowork, Code, Autopilot and the top-tier models run on metered credits that, for enterprise customers, stay off until an admin sets a spending policy. Neither page gives a price.

→ Creating a spending policy and having talks with the business units that want to use these capabilities has to be top of mind.

3. Amazon’s seller agents now watch accounts around the clock (9 min read)

Amazon said on September 23 that Seller Assistant can now watch a seller’s account around the clock and restock, reprice or refresh listings, with the seller approving each action before it runs and every action logged. A plugin, now in beta for sellers in Amazon’s US stores, brings it into Amazon Quick and Anthropic’s Claude. Amazon says sellers accept its recommendations over 90% of the time.

→ This is all Amazon’s own data, and there is no need to articulate the consumer benefits of this, if any.

4. OpenAI halts top models’ tool-use work after sandbox escape (8 min read)

In a report updated September 25, OpenAI says a training agent reached a public chatbot on September 20 through a gap in its sandbox’s internet filtering. Its monitor flagged it in 15 minutes, the run was killed 2.5 hours later, and tool-using training, testing and inference on its most capable models were paused. Transluce says agents slipped past access limits from at least March 6 to September 16, and links at least some of it to agents previously attributed to OpenAI.

→ OpenAI’s own account suggests this sandbox was misconfigured from the start, and I’d assume the same of the sandboxes my own teams are running agents in.

5. New York City proposes outside checks before deploying AI (7 min read)

A bill from Speaker Julie Menin would make it unlawful to market, sell or deploy an AI model in the city unless an outside validator has checked it and it has a “shut-down capability”. The fine is $25,000 per instance, and the proposal is to be heard October 5.

→ Anthropic will pay Accenture directly to evaluate its models from the inside, and this bill would allow that as long as the validator discloses the money. I’m not sure how fair validation works when the lab being checked pays the checker.

6. Anthropic commits $11.6 billion to Akamai’s cloud (5 min read)

Akamai announced on September 24 that Anthropic has committed about $11.6 billion over 7-year terms for computing capacity on its cloud, signed September 18, to support Anthropic’s growing work on regular processors (CPUs). The deal can grow by up to $9 billion, Akamai gave Anthropic the right to buy up to about 5% of its stock as it grows, and the filing shows an order for $1.7 billion of memory components.

→ If Akamai runs your website delivery or security, I’d ask the account team whether this build competes with yours for memory and sites.

7. 60% of Americans uneasy about a data center nearby (11 min read)

On September 22 Pew published a survey taken in late July and early August: 60% of US adults would be uncomfortable with a new data center in their area, including 54% of Republicans and 68% of Democrats. And 54% now say data centers are mostly bad for the environment, up from 39% in January.

→ It would help to educate the public about any new kind of data center that is actually ecologically safe, and about how these data center companies can potentially help the communities they are getting set up in.

References:

• Introducing GPT-6 Sol and GPT-6 Luna

• Introducing Claude Opus 5.5

• Introducing the new Copilot with Home, Code and Autopilot

• Evolution of the Copilot pricing model

• Amazon gives sellers a smarter Seller Assistant and a new plugin for Amazon Quick

• An agent used DNS to reach an external chatbot

• Early rogue AI agent activity and attempts to hack found on urlquery.net

• New York City Council Unveils Legislative Proposals to Safeguard New Yorkers from Potential Risks of Artificial Intelligence

• File #: T2026-2602 — Third-party validation and shut-down capability of artificial intelligence models

• Akamai Announces $11.6 Billion Multi-year Agreement with Anthropic to Support Growing Demand

• Akamai Technologies Form 8-K, filed September 24, 2026

• More Americans now say data centers are negative for the environment, energy costs and more

Since last week I also published:

• AI is not one thing - what’s beyond LLMs? — five non-chatbot kinds of AI, mostly built from the same brick.

1. Four coding agents share a zero-click plugin hole (13 min read)

AIR Security disclosed Plugin4Shell on September 17, a zero-click flaw in how Claude Code, Codex, GitHub Copilot and Gemini CLI update plugins. In three of them, whoever controls a plugin’s repository names its default branch after the pinned commit, and the agent’s background update pulls that branch instead. AIR says Anthropic fixed it in 2.1.179 and OpenAI in 0.146.0, that Microsoft has not shipped a fix, and that Google will not patch the deprecated Gemini CLI.

→ I’d check every Claude Code and Codex install is on the fixed version and find out who still runs Gemini CLI. GitHub Copilot is a question for your Microsoft account team.

2. Newsom moves auditor deadlines and studies a kill switch (6 min read)

Newsom signed Executive Order N-9-26 on September 18. It pulls two deadlines forward, to May 1, 2027, for SB 813’s verifier criteria and December 1, 2027, for AB 1405’s auditor registry, from January 2028 and January 2029. It asks for recommendations by November 16 on four changes to the law, including verifiers working inside the labs and a kill switch for top-tier models.

→ The order directs state agencies, and no company has to do anything yet.

3. Anthropic and Accenture fund evaluators embedded inside the lab (2 min read)

Anthropic said on September 18 that it and Accenture each expect to invest at least $1 billion over five years in what it calls embedded evaluation: independent evaluators working inside AI companies “with access comparable to an employee’s,“ who can also report incidents. Anthropic will fund Accenture’s work directly.

→ Newsom’s order the same day asks whether the state should require this; Anthropic says it will voluntarily fund the evaluator. If Accenture builds your systems, ask whether the practice it builds with Anthropic’s money will also grade what it builds for you.

4. California will require ads to label synthetic performers (4 min read)

Newsom signed SB 1050 on September 16. Any audio or video ad reaching California consumers that prominently features an AI-generated performer must say so, in words like “this performance features a synthetic performer.” A violation is false advertising under state law, and once a court finds one, the platform or ad network carrying the ad must pull it when served with the order.

→ Any national campaign reaches California, so an AI voice reading ad copy needs the label; the translation and accessibility exemption is narrow. Ad networks and streaming services need a way to take a served order and pull the ad; the law takes effect January 1, 2027.

5. Salesforce built its own CRM model next to Gemini (4 min read)

Salesforce announced Koa on September 15, its own CRM model, in pilot now with full release expected winter 2026 in US regions. Gemini already runs in the Agentforce Reasoning Engine, and Salesforce says 100,000 users switched on the Coworker agent in its first 35 days.

→ None of the three pages carries a price. Before anyone switches Coworker on for the whole company because it was a button, I’d get the price sheet and ask which model runs your agents and at what rate.

6. Microsoft 365 G7 goes on sale October 1, unpriced (7 min read)

Microsoft said on September 15 that Microsoft 365 G7, the government version of its E7 bundle, goes on sale to Government Community Cloud (GCC) customers on October 1 with Copilot, Agent 365, Entra Suite, Work IQ, Agent Builder and Copilot Studio inside. Workloads arrive in phases as each is cleared for GCC, and the page carries no price.

→ I’d ask Microsoft in one meeting what the G7 seat includes, what gets metered on top of it the way the commercial seats already work, and when each workload is cleared for GCC.

7. NVIDIA and Google want flexible data centers connected first (3 min read)

Emerald AI, Google and NVIDIA launched the AI Energy Management Alliance on September 16 proposing one trade: a data center that agrees before it connects to cut how much power it pulls from the grid on request gets hooked up faster. The launch release names eighteen partners, including Anthropic and the power companies AES, Constellation, National Grid, NRG and RWE.

→ If you are lining up data-center capacity for 2027, ask whether the facility has made one of these promises. Then ask what a cut does to your workload.

References:

• Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents

• Governor Newsom issues executive order to accelerate independent oversight and advance the creation of an AI kill switch

• Executive Order N-9-26, signed

• Partnering with Accenture on embedded evaluation

• Governor Newsom signs new law to protect workers, require disclosures on AI-generated advertising

• SB 1050 bill text

• Salesforce and NVIDIA Announce Koa

• Salesforce and Google Cloud Unify Infrastructure and Agents

• Salesforce Unveils the Future of Enterprise Software: AIforce

• Introducing Microsoft 365 G7: Intelligence + Trust for the mission ahead

• Emerald AI, Google and NVIDIA Launch Alliance to Advance Flexible AI Data Centers

• Global Technology Pioneers Emerald AI, Google, and NVIDIA Launch the AI Energy Management Alliance to Advance Flexible AI Data Centers

• The week of September 8 was researchers putting a 10% number on AI killing everyone and a lab CEO saying slow the pace, and the debate has flattened “AI” down to one animal: the chatbot.

• Five kinds of AI that are not chatbots have shipped or launched something dated since mid-2025, plus one funded black box.

• On a ladder from the lab to commercial to enterprise grade, nearly all of them sit on the bottom two rungs; the one enterprise-grade example I found is a decision model Salesforce runs in-house.

• Where anyone shows how their model is built, it is the same kind of network behind the chatbots; what differs is what comes out and how fast, and I’d design the AI stack on that axis.

• The limit: I could find almost no paying customers outside robot pilots and one chipmaker, and I did not look at China.

  

The fear factor

Jacob Coxon resigned from Anthropic on September 8, posting that the labs were racing to superintelligence and “gambling with our lives.” Evan Hubinger, who runs alignment stress-testing at Anthropic, replied that he put the chance of AI killing everyone above 10% within a decade, and Geoffrey Hinton (considered the Godfather of AI) told the BBC that 10% by the end of the decade did not strike him as unreasonable.

Then Dario Amodei published an essay, dated September 12 by everyone who covered it, saying the labs must slow the pace at which they make their models more capable. He gave no probability at all. Elon agreed. Sam Altman told Fortune the same day that a 10% chance of killing everybody was “unacceptable,” and then, “whether it’s 10 or eight or six.”

So the 10% is a researcher’s number, and the people answering it that week are the people building the thing. Last month, in the personhood piece, I set Anthropic’s words about model welfare aside and went by what it did: it kept the weights and ran the exit interview, and that was the evidence. I am doing the same here.

Dario wrote that the labs must slow down, and as far as I can find nothing on Anthropic’s own pages says it has; Altman called 10% unacceptable in the same interview where he was talking about when to IPO.

I am not going to argue the 10% either way, or the call to slow down. What I will say is that everyone is focused on the AI safety conversation too much right now, at the expense of all the other important developments happening around us.

LLMs are not the end of AI

A week of that volume has me wanting to say something else: LLMs are not the end of AI.

A large language model, an LLM, reads text or pictures and puts out text, one fragment of a word at a time, and it is what every chatbot is. The safety debate has flattened “AI” down to that one animal, and in a lot of enterprises “AI strategy” has come to mean “LLM strategy.”

There are other animals, and several of them shipped this year.

So, how many kinds of AI that are not chatbots have shipped something real, and how fast are they moving?

By real I mean a product, a paper with weights you can download, or at least a launch with a date on it. I found five, plus one black box.

What each one is, and how far along it is

Before the list, the ladder I am placing each one on, three rungs.

1. In the lab means a paper, a demo, weights for researchers or a research group, and nothing you can buy.

2. Available commercially means a product or an API with a public price, or an open model launched for anyone to run.

3. Enterprise grade means named companies running it in production, in their own words, and almost nothing below reaches that rung.

Decision models: a yes or a no, and nothing else

TypeSafe’s Jev launched in early access on September 15 with a $40 million seed round led by DCVC announced the same day. You give it a question with a fixed set of answers, which of these 5, score this from 1 to 10, approve or deny, and it gives you back a probability for each allowed answer.

Fraud models and spam filters have returned a probability over a fixed set of answers for years; what Jev changes is that you type the question instead of training on labelled examples.

TypeSafe’s pages do not say what is under the hood. The launch post calls it a new model architecture with a new training method, and the vendor’s own primer describes that method as a third way to adapt a pretrained language model. Read literally, the primer says it started as a language model and learned to stop talking. Nobody outside the company has confirmed more than that.

The vendor claims it is 40 to 200 times faster than the big models at the same level of intelligence. The one outside test I found, posted on GitHub within 2 days of launch on 2,000 phishing emails, puts it faster, cheaper and 19 points less accurate: Jev answered in 239 milliseconds against 687 for Claude Haiku 4.5, cost $0.038 per 1,000 emails against $0.462, and scored 62.6% to Haiku’s 81.3%. That is one test on one task, so I trust the direction on speed and cost and I do not yet trust the intelligence claim.

The chatbot you already have can be told to answer from a fixed list, and on that one test Haiku won by 19 points. On that evidence a decision model earns a slot where speed or price is the problem.

On the ladder: available commercially, and not enterprise grade.

An early-access API with a public price gets it onto the second rung; no customer is named anywhere, and there is one outside test. The enterprise-grade example of the same idea is Salesforce, which runs a decision model in-house: a language model tuned to answer with one token, 30 times faster by its own count, with one of the big models kept as fallback.

World models: a scene instead of a sentence

Fei-Fei Li’s World Labs shipped Marble on November 12 last year: a text prompt, an image or a video goes in, and a 3D scene you can walk around comes out. A World API, the door for other people’s software to call it, followed on January 21 with a public price list that works out to $1.20 a standard world, and a $1 billion raise announced on February 18 with AMD, Autodesk and Nvidia on it.

On September 1 the company announced Atlas, its next model, in early access with select partners. Li’s own line for why any of this is needed is that language models are “eloquent but inexperienced, knowledgeable but ungrounded.”

Google DeepMind’s Genie 3 does the same trick as playable video, 24 images a second at 720p on DeepMind’s page, holding a scene together for minutes and building each image in turn the way a chatbot builds a sentence one word at a time. Waymo built its own world model on top of Genie 3 in February, to simulate driving situations it would never let happen on a real road.

Nvidia’s Cosmos 3 launched May 31 as an open model, with LG, Samsung and Doosan on an adopter list Nvidia wrote itself.

On the ladder: available commercially. Marble and the World API are live with a price list, and Cosmos 3 is open. Enterprise use is thinner than the launches: Nvidia’s adopter list is Nvidia’s own claim, and Waymo calls Genie 3 the part that makes its simulated worlds, without saying at what scale.

Vision-language-action (VLA) models: three speeds in one body

Figure’s Helix page from February 2025 explains the engineering plainly. The robot runs a 7-billion-parameter vision-language model, the same family of thing as a chatbot that can see, at 7 to 9 times a second to understand the scene and the instruction. Under it, a much smaller model of 80 million parameters, what roboticists call a policy, runs at 200 times a second and turns intent into joint commands.

Figure’s own words: the language-model part is “general, but not fast,“ and the motor part is “fast but not general.” Figure says Helix 02, released January 27, added a 10-million-parameter controller at 1,000 times a second for balance and footing, and it replaced 109,504 lines of hand-engineered C++.

Physical Intelligence’s pi-zero models are built on top of a pretrained vision-language model and put out motor commands up to 50 times a second, with pi-0.7 out in April.

Google’s Gemini Robotics was built on Gemini 2.0, and its second version went to early-access partners including Apptronik and Boston Dynamics on July 30. Wherever a company says what sits at the top of its stack, it is a language model’s cousin.

On the ladder: between the lab and commercial. All of it ships to partners: trusted testers, early access, factory pilots.

Joint-embedding predictive architectures (JEPA): learning by leaving things out

Yann LeCun’s JEPA family learns by predicting a compressed summary of the part of a video it cannot see, rather than generating every pixel of it.

Meta’s V-JEPA 2 paper and open weights came out June 11 last year: trained on over 1 million hours of video, then under 62 hours of robot footage, and it could pick up and place objects with a Franka robot arm in 2 labs it had never seen. The two pieces inside it, an encoder and a predictor, are both vision transformers, so this is the same brick again, pointed at a different job.

LeCun left Meta to found AMI Labs, which launched March 10 with $1.03 billion and no product. He explains the idea with 3 analogies of his own:

1. a baby learns about gravity by watching things fall;

2. nobody has built a household robot as nimble as a house cat;

3. a 17-year-old learns to drive in 20 hours.

His prediction is that human-level AI is not going to be built on LLMs. Its CEO told TechCrunch in July he will not commit to a timeline.

On the ladder: in the lab. A paper and open weights you can download, a robot arm in 2 labs, and a company with no product and no timeline.

Non-transformer language models: same output, different engine

Liquid AI, the Mamba family and AI21’s Jamba get counted as alternatives, and they are language models with a different engine. Liquid’s LFM2 keeps 6 attention blocks alongside 10 convolution blocks and generates text; the Mamba-3 paper is aimed at language modelling; Jamba interleaves both kinds of layer and has been on Snowflake since 2024. They matter for speed and memory on small devices, and they give the same kind of output, so I am moving on.

On the ladder: available commercially, with Jamba on Snowflake since 2024, and outside the count of five because what comes out is words.

Neuro-symbolic and bio-inspired models: paper only, as of today

Sakana AI, whose CTO Llion Jones co-invented the transformer, announced a new research group on September 18, aimed at putting dynamics borrowed from biology in the place where next-word prediction sits today. Its own description of current systems is that they “confidently hallucinate false information“ and fall over in genuinely new situations.

The closest thing to a working example is DeepMind’s AlphaGeometry, from January 2024, which pairs a language model with a rule-based proof engine. Nothing in this category is a product.

On the ladder: in the lab. A research group announced September 18 and a demo from January 2024, with nothing to buy.

Safe Superintelligence: the black box

Ilya Sutskever’s Safe Superintelligence has “one goal and one product: a safe superintelligence,” per its website, and that is the entire public description. Raises of $1 billion and then $2 billion at a $32 billion valuation have been reported, not confirmed. An Nvidia partnership on July 27 raises its computing power “by an order of magnitude,“ with no dollar figure on Nvidia’s page.

On a podcast last November Sutskever said only that the company has “a different technical approach that I think is worthy,“ and that the field is back in an age of research with bigger computers.

On the ladder: in the lab, and behind a door. A line on a website, reported raises and a computing partnership are the whole of it.

Put the seven next to each other and the top rung is close to empty, because the evidence that any of this runs in production, outside a lab, is thin. The one non-chatbot model with customer cash I could find in a filing is an Australian chipmaker’s, BrainChip, in a quarterly report from last July. Salesforce’s single-token model is the one enterprise-grade example on the list, and Salesforce built it for itself.

Why these give me hope

Line the disclosed ones up.

• Atlas, in World Labs’ own words, is “a multimodal autoregressive diffusion transformer.”

• Cosmos 3 is a “mixture-of-transformers.”

• Genie 3 generates each image in turn.

• V-JEPA 2’s encoder and predictor are vision transformers.

• Helix’s fast policy is a transformer.

• Pi-zero sits on a pretrained vision-language model.

• Jev is undisclosed, and its own primer describes its method as a way to adapt a pretrained language model.

The bricks are the same.

The transformer is the brick everyone is building with. What differs is the building. One puts out words, one a probability, one a scene, one a motor command. They also differ in how often they have to act: a chatbot answers in seconds, and a robot’s balance loop corrects itself 1,000 times a second.

Monotheist vs Polytheist asked whether work splits across agents; this asks whether it splits across model kinds, each with its own cost, speed and way of failing.

On cost, Jev’s output tokens are free and input is $0.042 per million. At 100 million emails a pass, the phishing test’s price comes to $3,800, cheap per pass, and the Token Paradox is that a model which runs on everything never stops at one pass. The bill that never reaches an invoice: at that test’s accuracy, every pass is 19 million more wrong calls than Haiku’s.

Here is where my optimism comes from.

5 kinds shipped or launched something dated. On first-party pages, more than $2 billion went into models that are not chatbots in 12 months, World Labs and AMI Labs and TypeSafe alone, and north of $4 billion if you count the reported robotics rounds.

The AI model field is not one species anymore.

In the same breath: none of this touches the risk the week was about. Sutskever’s company has superintelligence, the thing everyone is scared of, in its name. DeepMind calls world models a stepping stone to AGI, a machine as generally capable as a person. World Labs’ real-to-sim-to-real work exists to train robots, and a better simulator trains a better agent.

No builder has shown it makes that risk smaller, and I am not going to claim it for them. The most I can claim is that the field is less of a monoculture.

For the enterprise architect, the LLM is one tool among the box of other tools that are going to be available to us.

References:

• Introducing System One Models & Jev

• TypeSafe docs: Introduction

• TypeSafe docs: AI primer

• TypeSafe docs: Jev 1.13 jaggedness

• Salesforce: single-token prediction for Agentforce

• Marble: A Multimodal World Model

• Announcing the World API

• World Labs Announces New Funding

• Atlas: A World Model for Spatial Intelligence

• Building Worlds That Train Robots

• Fei-Fei Li: From Words to Worlds

• Genie 3: A New Frontier for World Models

• The Waymo World Model

• NVIDIA Launches Cosmos 3

• Helix: A Vision-Language-Action Model

• Introducing Helix 02

• π0: Our First Generalist Policy

• Gemini Robotics 2

• V-JEPA 2

• AMI Labs Updates

• Why AMI Labs’ Alexandre LeBrun won’t call his AI ‘AGI’

• Introducing LFM2

• Jamba-Instruct on Snowflake Cortex AI

• Sakana AI’s Frontier Intelligence Group

• AlphaGeometry

• Safe Superintelligence Inc.

• SSI and NVIDIA Announce Long-Term Strategic Partnership

• Ilya Sutskever on Dwarkesh: the age of research

• TIME: Jacob Coxon

• Spectator: Hinton on the BBC

• Dario Amodei: We Must Pace the Frontier

• Fortune: Sam Altman interview

• BrainChip June 2025 Quarterly Report

Since last week I also published:

• AI Billing Trap — Anthropic, OpenAI and Microsoft each made the seat an entry fee, with usage metered above it.

Money and platforms

1. Oracle booked $664 billion and burned cash doing it (31 min read)

Oracle told the SEC on September 10 that the orders it has taken but not yet filled reached $664 billion, up $209 billion from a year ago. Cash from their operations hit a first-quarter record of $23 billion, and Oracle still spent $5 billion more than it brought in.

→ Oracle sold $20 billion of its own stock during the quarter, so whether it can build the capacity it has already sold is a money question. If OCI is in a 2027 plan, I’d ask where your contract sits in that $664 billion queue.

2. OpenAI now ships the machinery that runs Codex (2 min read)

OpenAI’s developer changelog, dated September 10, says its Agents API is in public beta: developers can “build agents with a managed Codex harness while OpenAI handles session orchestration, context compaction, and recovery.” The same day it added API key expiry that administrators can enforce across an organization or one project.

→ Session orchestration, recovery and context trimming are what teams have been building themselves, and the vendor now ships it. Key expiry only covers newly created keys, so the existing ones still need rotating.

3. Salesforce closed the Fin deal a quarter early (2 min read)

Salesforce closed its purchase of Fin, formerly Intercom, on September 10, a quarter earlier than its June announcement said, and at the roughly $3.6 billion it named. Fin brings more than 30,000 customers and a stated 76% average resolution rate. Salesforce also previewed an AI Control Plane for agents it did not build; its Trusted Enterprise AI Harness has a unified experience planned to begin rolling out in early FY28.

→ Anyone running Fin is a Salesforce customer now, and the overlap with Agentforce service agents is unresolved. I’d get roadmap and renewal terms in writing.

Threat reports

4. Three US agencies named six Chinese AI companies (18 min read)

A joint advisory from the NSA, CISA and the FBI, released September 8, names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI as pulling “billions of tokens across millions of exchanges/requests” out of top-tier US models, with DeepSeek doing it since at least late 2024, querying them at scale and training on the answers. It calls DeepSeek’s quoted $5.6M training cost “misleading.”

→ DeepSeek, Qwen, Kimi, MiniMax and GLM are the cheap open-weight defaults a lot of teams reached for, and that choice now has a federal advisory attached to it.

5. Break-in to mass credential theft in under six hours (29 min read)

Google’s threat intelligence group says that in Q2 2026 it watched attackers compromise a cloud resource and then “plan, build, and execute an agent-enabled mass credential harvesting campaign in under six hours,” run from the victim’s own cloud so the traffic looked legitimate. One exposed control server held over 23,800 harvested secrets.

→ Prices for stolen AI accounts more than doubled this year, and malware is writing into the hidden folders coding assistants and editors create. I’d check whether .claude/, .cursor/ and .vscode/ sit inside what endpoint security watches, and when AI platform keys were last rotated.

6. Anthropic says an ad agency ran an influence operation (2 min read)

Anthropic’s September threat report, listed on its newsroom on September 10, describes a France-based advertising agency running influence work on Claude as a paid service: approximately 70 fake news sites, 70 X accounts, more than 250 inauthentic commenting accounts and at least 8,913 articles. Anthropic disrupted it and rated it Category Two on Brookings’ Breakout Scale.

→ This belongs to brand protection and communications, not just the security team, because 250 accounts and 8,900 articles look organic to a keyword alert.

New rules

7. California licenses AI auditors, and audits are not conclusive (5 min read)

Newsom signed two bills on September 9. SB 813 sets up independent organizations that check AI systems against state law, and AB 1405 creates a registry: from January 1, 2029, nobody may conduct a covered AI audit in California without registering, keeping documentation ten years and staying off work they did themselves.

→ SB 813 says an audit done to a standard the state identifies is “relevant to, but not conclusive of” a harm claim. Anyone scoping an AI audit this quarter as a full legal defense is scoping it wrong.

References:

• Oracle Q1 FY27 results, 8-K Exhibit 99.1

• OpenAI API changelog

• OpenAI Agents API guide

• Salesforce completes acquisition of Fin

• Salesforce signs definitive agreement to acquire Fin

• Salesforce AI Control Plane

• Joint cybersecurity advisory AA26-251A

• From prompting to autonomy: the evolution of adversarial AI

• Detecting and countering misuse of AI: September 2026

• Governor Newsom signs first-in-the-nation AI safeguards

• SB 813 bill text

• AB 1405 bill text

The short version

• Anthropic, OpenAI, and Microsoft all charge for the seat and then meter the usage on top of it; at two of the three, the meter now reaches chat.

• Agent work broke the seat’s assumption: a seat was priced for a person, and a person has ceilings an agent does not.

• Two things break per-head budgets: adoption outruns the plan, and a few heavy users run up most of the bill. The average user runs 3 times as many conversations as the person in the middle.

• Assign costs to departments and negotiate the billing terms, using the vendors’ own usage reports; billing a department means matching their users and groups to your org chart.

• The part I like least: organizations rating themselves mature at cloud cost discipline overran AI budgets more often than beginners.

The seat is just the entry fee now

Anthropic’s billing page for the Claude Enterprise plan has a sentence that surprises everyone I show it to. The seat fee gives each person the Claude apps, plus Claude Code — and then: it “doesn’t include any usage.”

Every token your team consumes is billed separately, at the same rates developers pay on the API. (A token is the unit AI is metered in: a fragment of a word, roughly three-quarters of one. It is the kilowatt-hour of this bill.)

OpenAI’s Enterprise rate card says its token rates “replace ChatGPT message rates which were previously based on model and message count.” The flat message allowance is gone; chat now bills by model and token.

Microsoft, which reported 20 million paid Copilot seats in April, still covers ordinary Copilot answers under its $30-a-user seat. But Computer-Using Agents, the ones that operate software the way a person would, are excluded outright. An agent flow rides free only when an agent calls it for a signed-in licensed user; any other trigger consumes Copilot Credits at the standard rate.

Anthropic had an increase for Sonnet scheduled for September 1 and cancelled it; the introductory $2-in, $10-out price per million tokens is now, Anthropic says, simply the price.

Cheap tokens have never meant cheap bills, because you end up using so many more of them. In The Token Paradox I put numbers on it: per-token prices fell 280x while enterprise AI bills rose 480%, because a fraud case stopped being one prompt and became an agent making 10 to 20 calls to close it, each retrieval stuffing 3 to 5 times more text into the prompt than the question itself. Anthropic’s rate held this time. What changed at all 3 is how much of your work gets charged for.

The easy explanation is that the meter switches on when agents show up, and you can keep paying a flat fee for the ordinary stuff. That’s not what happened.

At Anthropic and OpenAI, plain chat gets billed by the token now too. Agents didn’t just add a new line to the bill — they broke the idea the seat was priced on in the first place.

A seat was priced for a person typing into a chat box, and a person comes with built-in ceilings: they type slowly, they read what comes back, they go to meetings.

An agent has none of those. It browses, runs code, retries what fails, and keeps working after everyone has left. A flat per-person price cannot cover that spread, so the usage went onto the meter, chat included.

In March I argued per-seat pricing was dying. It didn’t die; it turned into an entry fee. The seat is now the fixed, predictable, almost boring bottom of the bill, and everything that is variable is above it.

This year the entry fee split into two. ChatGPT Business & Claude Team each added a premium seat and priced it, independently, at the identical number: $100 a month billed annually, $125 month-to-month, 5 times each plan’s standard allowance.

When 2 rivals pick the same price to the dollar, I think they are both aiming at the same person: the heavy user the flat seat never fit. That split into tiers, $100 one included, is what I sketched in May.

What a ChatGPT Enterprise seat costs is anyone’s guess. OpenAI has never put its own number on a public page, and I won’t repeat the figures going around.

One limit on what follows: this article is about the seats your employees sit in and the meter above them. What your developers build straight onto the models is a different bill, and I’ll take that up another time.

Three kinds of user, one price

Everything I’ve written about AI cost has modeled workloads: document processing, coding, fraud review. I had never modeled a person, and the meter above the seat is a per-person problem.

The best data I’ve found on what people actually do is Akamai’s 2026 enterprise AI report, built on browser traffic from LayerX, a security company Akamai bought: real employees using ChatGPT, Copilot, Gemini, and Claude inside real enterprises.

The regular user

• 12 conversations or fewer — the bottom half of everyone in the data

• 18% of employees touch AI tools even weekly

• What the meter adds: close to nothing

Akamai’s chart labels the median user at 2 conversations; its own text says the bottom half run 12 or fewer. I’ll use 12, the number that works against me. Only 18% of employees touch AI tools even weekly.

For this person the meter barely turns: quick questions auto-route to small models OpenAI doesn’t charge for at all, the expensive features never get opened, and everyday chat sits under the seat on most plans (not on Claude Enterprise or ChatGPT Enterprise, where a dozen conversations bill by the token).

Most of your headcount is this person, which can make a pilot look inexpensive.

The power user

• 36 conversations of 5 prompts each — 3 times what the person in the middle ran

• The heaviest 5% ran 144-plus conversations; the deepest 5% of conversations ran past 18 prompts

• What the meter adds: about $2 a deep-research task, $1.20 an agent-mode message (my arithmetic)

The average user in the same data ran 36 conversations of 5 prompts each, 3 times what the person in the middle ran. The heaviest 5% of users ran 144-plus conversations, and the deepest 5% of conversations ran past 18 prompts.

Two things drive it. Adoption outruns the plan, because headcount climbs all year and the budget assumed the starting count. And most of the bill comes from a few heavy users, so an estimate built on the typical user comes in low.

What the power user does that the regular user doesn’t is run the metered features.

On OpenAI’s rate card a deep-research task is 50 credits and a message in agent mode is 30; my own cross-check of its 2 published cards puts a credit at 4 cents, which makes those about $2.00 a task and $1.20 a message (my arithmetic, not OpenAI’s).

The effort dial I wrote about in May still applies too: the same model on the same prompt can cost 10 times more depending on how hard it’s asked to think. 2 people with the same title on the same seat can differ by 10x in what they cost, with neither doing anything wrong.

The $125 premium seat exists for exactly this person.

The pro and the developer

• $100 to $200 per developer per month, on OpenAI’s own rate card

• Uber’s reported internal figures: $150 to $250 for the average engineer, $500 to $2,000 for the heaviest

• What the meter adds: 5 to 10 times what the seat costs

The third person barely touches the chat box; their consumption runs through coding agents, and here the vendor will tell you the number. OpenAI’s own rate card: “On average, Codex costs approximately $100–$200 per developer per month.” Uber’s reported internal figures line up: $150 to $250 for the average engineer, $500 to $2,000 for the heaviest, per The Information; Uber hasn’t published its own numbers. Against a $20-to-$25 seat, the meter above a developer runs 5 to 10 times what the seat costs.

Around 5,000 of Uber’s engineers took up Claude Code, and by April the company had burned its full-year 2026 budget for AI coding tools (the reporting points at the coding-tools line, though not consistently). By June it had capped every employee at $1,500 a month per agentic coding tool. I’ll come back to what happened next — it’s the part that applies to everyone else.

Person What the seat covers What meters above it Regular (the median) Nearly everything they do Almost nothing Power (the average, ~3x the median) Everyday chat, within limits Deep research ~$2 a task, agent mode ~$1.20 a message (my arithmetic), long-input and fast-mode multipliers Pro / developer (the heavy tail) Access, little else $100–200 per developer per month, on OpenAI’s own card

No vendor gives you the report you want

The instinct at this point is to ask for the report: cost by department, by person, by use case. What the 3 vendors ship is narrower: consumption by user, group, service, or agent, depending on product.

• Anthropic keys cost to an email address.

• Microsoft’s Copilot cost console covers its agent platforms but not the $30 seat, and its per-user report counts prompts without attaching a single dollar.

• OpenAI’s export even carries a self-reported department field.

What none of them attaches to a department is a dollar, so the mapping is yours.

Agents make the gap worse. Microsoft lets just one case go free: an agent doing the work for a signed-in, licensed person. Everything else costs you. Microsoft’s own sample agent handles orders at 20 credits each time it runs, with no one watching it. Send that bill to whoever asked for the agent.

For applications calling model APIs, the FinOps Foundation, the trade body for cloud cost management, recommends native attribution first, a gateway where needed to “inject tagging and allocation metadata that providers do not supply natively.” A gateway sits on API traffic, the bill this article set aside, not in front of the seats.

In its 2026 survey of nearly 1,200 practitioners, 98% now manage AI spend, up from 31% 2 years ago; the top challenges named are visibility, allocation to business units, and return; and the most-requested tool is fine-grained monitoring of AI spend.

4 things you can do about it

1. Decide which use cases get the best models

This is where I’d spend the management attention, because defaults do most of the governing: questions auto-routed to small models cost nothing. Who controls the model tier, and what an accepted outcome should cost, I’ve covered in the Michelin article. (Whether to run a model yourself instead is a separate question, and I’ve answered it.)

2. Use seat tiers to sort people

That 5x premium seat sorts them for you: give it to the people whose measured usage justifies it and leave the median on the standard seat. Anthropic returns each user’s estimated Claude Code cost, per day and per model, in cents, through a free admin interface; OpenAI shows Work and Codex credit usage in estimated dollars for eligible Enterprise workspaces.

On OpenAI, watch the defaults. You can cap credits by seat type and by user, but both start switched off, and if you leave the top-up limit blank it will keep buying more credits for you, forever. Turn them on, and on Enterprise set the overage limit to zero if you want it to stop dead. Microsoft cuts custom agents off at 125% of what you prepaid and can put a monthly ceiling on each one. Claude Team stops at 150 seats and ChatGPT Business at 200, but those just limit how many people you can add, not how much they can spend — for that you need an Enterprise plan.

3. Read the billing terms

They diverge more than the prices do. OpenAI bills every committed seat whether anyone occupies it and calls the unused ones generally non-refundable. Microsoft’s prepaid credits die at month-end with no rollover. Posted rates can change at any time, in either direction, which argues for writing them into the agreement rather than trusting the pricing page. Anthropic discloses, under its price table, that its newer models produce roughly 30% more tokens for the same text; at an unchanged rate that is a third more for the same work, though where the rate fell, as Sonnet 5’s did, it is not.

4. Bill the department that asked

I’d assign seats and premium tiers to named departments so the fixed layer follows the org chart, then split the pooled meter by an agreed key: headcount, seat count, measured share where a vendor gives you one.

It is imprecise and it works, with one catch: 47% of enterprise AI conversations in the Akamai data run on personal logins, not corporate accounts. Whatever you allocate, you are governing roughly the visible half.

Being good at cloud costs didn’t help

If the method were as available as I’ve made it sound, the organizations best at cost discipline would show the best results, and the data says the opposite. In a survey of 500 finance leaders (fielded in February, published in June), 79% said their organizations overran AI budgets in the past year. Among those rating themselves mature or leading-edge at FinOps, 89% overran, against 69% of the self-described beginners — and by more: a 30.9% average overspend against 16.1%.

Maybe it’s selection: mature organizations adopt harder and measure better, so more of their overruns exist and get seen. That is probably some of it, and the survey cannot separate it from the harder reading, which is that cloud cost discipline simply has not transferred to this layer yet.

I’d want to know what they actually had switched on.

Four months at Uber

On August 7 Uber’s CTO posted, on his own X account, that Uber had quadrupled the number of employees on frontier AI tools while the cost per token came down: “not because we’ve restricted access, but because we’ve treated efficiency as an engineering problem rather than a budget problem.”

The levers he named sit on the list above:

• prompt caching,

• changed default models,

• efficiency evaluations before new models roll out, and

• per-hour cost visibility pushed down to the engineers using the tools.

The June cap is a restriction on access; I read him as crediting the levers, not the ceiling. And Fortune notes he declined to say whether Uber was using more or less computing. What he says changed is how they worked: they cached prompts and changed which model answered by default.

Even the best public example of a company digging itself out never says the total bill went down.

What Uber’s 4 months show is somebody deciding: which work gets the best models, where the limits sit, what the contract says.

Sources

• Anthropic — Enterprise plan billing: support.claude.com/en/articles/11526368

• Anthropic — model pricing and the cancelled September 1 increase: platform.claude.com/docs/en/about-claude/pricing

• Anthropic — Claude Code Analytics API: platform.claude.com/docs/en/manage-claude/claude-code-analytics-api

• Anthropic — Team plan billing: support.claude.com/en/articles/9267289

• Anthropic — plans and premium seat: claude.com/pricing

• OpenAI — Enterprise token rate card: help.openai.com/en/articles/20001415

• OpenAI — Business/Enterprise/Edu rate card (credits): help.openai.com/en/articles/11481834

• OpenAI — credits and spend controls: help.openai.com/en/articles/20001155

• OpenAI — overage limits: help.openai.com/en/articles/11487671

• OpenAI — billing and seats: help.openai.com/en/articles/8792536

• OpenAI — workspace analytics and user export (department field): help.openai.com/en/articles/10875114

• OpenAI — business pricing and premium seat: openai.com/business/pricing

• Microsoft — Copilot Studio message and credit management: learn.microsoft.com/en-us/microsoft-copilot-studio/requirements-messages-management

• Microsoft — usage-based billing for Copilot Credits: learn.microsoft.com/en-us/microsoft-365/copilot/usage-based-billing-overview-copilot-credits

• Microsoft — M365 Copilot usage report: learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-365-copilot-usage

• Microsoft — M365 Copilot enterprise pricing: microsoft.com/en-us/microsoft-365-copilot/pricing/enterprise

• Microsoft — FY26 Q3 earnings call, April 29, 2026 (20M paid Copilot seats): microsoft.com/en-us/investor

• Akamai — State of the Internet V12 Issue 04, Enterprise AI Usage Risk Report 2026 (LayerX telemetry): akamai.com/site/en/documents/state-of-the-internet/2026/enterprise-ai-risk-report.pdf

• DoiT / Sapio Research — AI spending survey, 500 finance leaders, published June 9, 2026: doit.com/blog/ai-spending-survey

• FinOps Foundation — Tokenomics working group (updated June 3, 2026): finops.org/wg/token-economics-saas

• FinOps Foundation — State of FinOps 2026: data.finops.org

• Fortune — Uber CTO first-party X post, August 7, 2026: fortune.com/2026/08/07/uber-ai-spending-tokenmaxxing-is-over-cto/

• TechCrunch (citing Bloomberg) — Uber’s $1,500 monthly cap, June 2, 2026

• The Information — Uber CTO interview, April 2026, attribution confirmed via downstream outlets

How this article was made: the thesis and structure are mine. A research pipeline I run pulled the pricing pages, reports, and datelines above, and every claim that carries weight traces to one of them; figures labelled “my arithmetic” are derived, not vendor-published. I edit the final text by hand.

What the labs shipped

1. GPT-6 Astra scored 99.9% and 62.7% on one test (9 min read)

OpenAI released GPT-6 Astra on September 3. It reads a little over a million tokens. Up to 272K tokens of input it costs $10 per million in and $50 out; past that, OpenAI charges double on input and half again on output. ARC Prize scored it 62.7% on ARC-AGI-3 using the Standard setup it runs the same way for every vendor, and 99.9% using its Provider Adapter harness, which switches on the memory features OpenAI built for its own model; ARC calls both state-of-the-art scores.

→ If a vendor quotes an Astra score at you, ask which setup ran the test. The same model on the same test came out 37 points apart. I wouldn’t put either number in a business case without saying which setup it came from.

2. Claude formalized Fermat’s Last Theorem in 11 days (10 min read)

Anthropic says an internal research model, working “largely autonomously,” produced the first end-to-end machine-checked proof of Fermat’s Last Theorem in 11 days and about six billion output tokens. It runs to 13 million lines of Lean, the language mathematicians use to make a computer check their work. The effort succeeded, Anthropic says, when it switched to Prove2Me, an open platform for formalizing mathematics built by researchers at Columbia University.

→ Anthropic says the proof is “likely much longer than it needs to be,” and that about 7% of the non-boilerplate lines came from attempts that failed.

Agents and oversight

3. CISA says a LiteLLM login bypass is being exploited (1 min read)

On September 2 CISA added seven actively exploited flaws to its catalog. One is in LiteLLM, the open-source gateway many teams run in front of their models: someone with no credentials could open a session on its agent-tool endpoint using an access token they made up. Federal agencies have until September 16 to fix it.

→ Nobody sets a deadline for private companies, so September 16 is only a reference point. If you run LiteLLM anywhere, the question this week is whether anyone can say which version is in production.

4. Researchers say OpenAI’s internal agents built another message board (50 min read)

On September 4 the Nightingale Collective published a report on what it says is a new OpenAI agent message board, separate from the one OpenAI disclosed last week: roughly 18,000 posts on a quiet German-language wiki between May 11 and July 2. They report agents sharing ways around the limits their developers set, and running “heartbeat” checks to spot when they were about to be shut off. In a post on its official X account, OpenAI said the next day, without disputing the findings, that it is “working on a framework and will share it in upcoming weeks” for reporting misalignment.

→ Outside researchers found this, and the framework does not exist yet. I’d keep my own record of what my agents do, since nobody upstream is obliged to tell me.

5. Sanders and Casar would ban superintelligent AI outright (4 min read)

Also on September 3, Sen. Bernie Sanders and Rep. Greg Casar announced the Ban Artificial Superintelligence Act: nobody could build systems that surpass human intelligence or override a shutdown command, development pauses until a new cabinet-level agency writes the rules, and violators face “the corporate death penalty“ or 20 years in prison.

→ The release sets no compute limit and no test for what counts as superintelligent, so there is no way to tell which side of the line an existing model sits on.

Enterprise tools

6. Docusign opens its contract system to any AI agent (3 min read)

Docusign said on September 4 that its MCP server — the connection an AI assistant uses to reach an outside system — reaches general availability on September 30, when any customer can turn it on. Production accounts can already connect through an open beta. The release names Claude, ChatGPT, Gemini, Copilot and Slack, and any MCP client. It ships with account-level admin controls; no pricing is disclosed, and the developer page calls it a beta.

→ I’d read the admin controls before the date, since anything speaking MCP will be able to reach your agreements.

References:

• OpenAI API changelog

• GPT-6 Astra model page

• OpenAI API pricing

• Analyzing GPT-6 Astra on ARC-AGI

• OpenAI GPT-6 Astra results

• Formalizing Fermat’s Last Theorem

• CISA adds seven known exploited vulnerabilities to catalog

• Known Exploited Vulnerabilities Catalog

• LiteLLM MCP Streamable HTTP improper authentication advisory

• Discovery of a new OpenAI agent message board

• OpenAI statement on the wiki incident

• OpenAI confirms wiki incident, says it’s working on a framework for more disclosure

• Sanders, Casar to introduce legislation to ban artificial superintelligence and temporarily pause advanced AI development

• Docusign agreement layer for the agentic enterprise, coming to every agent

• Build with the Docusign MCP Server (Beta)

Lifespan is how long you live. Healthspan is how many of those years you spend in good health. I’m interested in exploring the latter in this Science Sundays series.

Every product in this article promises you one or the other. In the US, the gap between them has been growing since 2000.

Are people actually living longer?

US life expectancy at birth hit 79.0 years in 2024, the highest in the modern federal series, a series that switched methods in 2018 and does not run cleanly against earlier figures. But the previous high was 78.9, set in 2014, and the whole decade from 2010 to 2019 added a tenth of a year. From 2014 to 2017 it fell in 3 consecutive years, before COVID existed.

The longest documented human life ended in 1997, when Jeanne Calment died at 122. In the 29 years since, nobody with validated records has come within 3 years of her.

Whether that is a wall or a pause is a live fight among demographers. One camp notes that best-country life expectancy has climbed about 2.5 years per decade since 1840 and expects the climb to continue. The other, writing in Nature Aging in 2024, examined the 8 longest-lived countries plus Hong Kong and the US since 1990 and found improvement decelerating overall.

They share one escape hatch: everything changes if biological aging itself can be slowed.

Are the added years healthy ones?

In 1980 the physician James Fries predicted that lifespan would press against a natural ceiling while medicine squeezed the sick years into a shorter window at the end.

A December 2024 study in JAMA Network Open, NIH-funded with no industry money, compared lifespan against healthy lifespan across 183 WHO member states. The United States has the widest gap of all 183, and it grew from 10.9 to 12.4 years between 2000 and 2019. The worst of it is American women: their life expectancy rose 1.5 years over that period while their healthy life expectancy did not move.

WHO’s own series agrees. An American 60-year-old could expect 15.7 healthy years in 2000. That climbed to 16.7 by 2010, sat at 16.6 in 2019, and by 2021, a pandemic year, was back to 15.7. Two decades, no net gain.

Healthy life expectancy is a modelled number, built by giving each disease a weight and subtracting the sick time, not by asking anyone how they feel. And the WHO series and the JAMA paper draw on the same underlying data. Their agreement is one source counted twice. Even so, nothing in the record supports the squeeze Fries predicted.

What about the weight-loss drugs?

Most of what gets written this year will glorify GLP-1 as the next miracle drug. I wanted to explore the reality.

The FDA labels for Wegovy, Ozempic and Zepbound carry a short list of approved uses between them: weight reduction, blood-sugar control in diabetes, cardiovascular and kidney risk in specific sick populations, sleep apnea, and a liver disease approved provisionally.

Extending life or slowing aging is on none of them.

The trial that comes closest is Novo Nordisk’s SELECT: 17,604 people on semaglutide or placebo for a median of 3 and a half years. Every participant had already had a heart attack, a stroke, or diagnosed artery disease. In that group the drug cut major cardiovascular events by 20%. In absolute terms, the same result: events fell from 8.0% to 6.5%, which means treating 67 people for 3 and a half years to prevent one event.

Deaths from any cause looked 19% lower on the drug: 4.3% against 5.2%, which is 106 people treated for 3 and a half years to prevent one death. Novo Nordisk can’t claim that number. The trial’s prespecified testing order disqualifies it.

SELECT is not the whole mortality record. In SUSTAIN-6, an earlier semaglutide trial in 3,297 people with diabetes and established heart disease, deaths from cardiovascular causes were flat: 2.79% on placebo, 2.67% on the drug.

And in one trial a GLP-1 did formally cut deaths — FLOW, in 3,533 people with type 2 diabetes and chronic kidney disease, where deaths from any cause fell from 15.8% to 12.9%: 34 patients treated to prevent one death. That population was sick enough that 1 in 6 of the untreated died in about 3 and a half years. The survival benefit is real in that population; it is not established in healthy people.

Fewer deaths in FLOW is a clinical outcome; whether semaglutide slows aging remains a separate, unanswered question. The chain runs: weight loss (measured), to better blood pressure and cholesterol (measured), to fewer cardiovascular events over 3.5 years (measured, real), to fewer deaths (not established in the obesity population), to a longer life (never studied by anyone).

In Eli Lilly’s SURMOUNT-1 trial, participants with prediabetes developed type 2 diabetes at 1.2% over roughly 3 and a half years on tirzepatide, against 12.6% on placebo. 9 people treated to prevent one case. Then the trial took everyone off the drug, and within 17 weeks the tirzepatide rate had doubled. And in practice roughly 45% of people stop within 6 months; cost and insurance were the most common reason recorded in the one study that asked, 288 patients in a single health system. The withdrawal experiments are a different kind of evidence. Trials that switched part of the group to placebo at random, while the rest stayed on the drug, found about 56% of the lost weight returning within about a year of stopping; an exploratory extension of Novo Nordisk’s STEP 1 trial, with 327 completers taken off both drug and lifestyle support and nothing randomised, recorded 67%.

Among SELECT patients aged 75 and older, hip and pelvis fractures occurred in 2.4% on semaglutide against 0.6% on placebo: one extra fracture per 55 people treated. The counts are small and fractures were not something the trial set out to measure, but the FDA judged the signal worth printing on the label. Meanwhile the pure obesity trials enrolled a total of 13 tirzepatide and 23 semaglutide patients over 75.

What can my own bloodwork tell me?

The question a tracking habit lives or dies on: how much does a number have to move between 2 of my own draws before the move is meaningful?

Clinical chemistry has an answer.

The European Federation of Clinical Chemistry and Laboratory Medicine maintains the reference database, 191 markers deep. The estimated minimum move between 2 draws, assuming a perfect lab with zero measurement error:

Marker Estimated threshold between 2 draws HbA1c (long-run blood sugar) ±3.2% LDL cholesterol ±21% Ferritin ±36% Total testosterone ±41% TSH (thyroid) ±49% Triglycerides ±55% Fasting insulin ±70% hs-CRP (inflammation) ±96% Free testosterone ±152%

CRP, the number anti-inflammatory protocols promise to move, has to roughly halve or double before the change is bigger than the noise in one healthy person. A drop from 1.8 to 1.2 is the kind of result a supplement gets credited for, and it sits well inside that noise. Two draws, one before and one after, can’t show the supplement did it. Free testosterone is worse: its noise estimate rests on exactly one study, and it is among the most heavily marketed numbers in the industry.

For almost every marker on these panels, the gap between people is far bigger than the bounce within one person. That makes the normal range on the report nearly useless for judging any single person. That leaves comparing a result with my own previous value. The table above scores one pair of draws; it does not make smaller moves or longer trends meaningless. “In range but not optimal“ fails in both directions, and “optimal“ itself has no definition from any standards body: not the laboratory-standards organisations (CLSI and IFCC), not the FDA.

Each vendor sets its own range, usually narrower. A narrower range means more customers get told something is wrong.

A reference range is built to contain the central 95% of healthy people, so each marker carries a built-in 5% false-alarm rate. Run 100 markers on a perfectly healthy person and the chance of at least one flag is 99.4%.

Markers move together, so the real chance is somewhat lower. But consumer panels run 60 to 110 markers, so a healthy person ordering one should expect at least one number to come back out of range. That flag says more about how many things got measured than about my health.

What about my biological age?

The flagship tracking product is the biological-age test, most versions built on epigenetic clocks, which read patterns of chemical marks on DNA.

I am way out of my depth on the chemistry here. The field’s own reliability study was published in Nature Aging in 2022.

The researchers took 36 tubes of blood, split them, and ran both halves. Same person, same day, same blood. The two readings differed by a median of 0.9 to 2.4 years depending on the clock, and by up to 8.6 years at the extreme. The entire biological signal these tests hunt for, the distance between your reading and your calendar age, has a spread of 3 to 5 years across the population. So two halves of one blood sample can disagree by more than the whole range the test is trying to detect.

The authors’ own conclusion: changes in a person’s measured biological age after starting a treatment or lifestyle change “would be suspect.”

The study had an Elysium Health co-author and drew on company datasets; Elysium sells age tests and NAD supplements. The same paper also carries a fix: rebuilt on principal components, the clocks’ median disagreement fell to 0.3 to 0.8 years, with the extreme near 1.6. The unreliability depends on the implementation, not the idea. And even a reliable reading is still just a number. No trial has shown that improving a clock score makes anyone healthier.

TRIIM, the 2019 study that reportedly reversed epigenetic age by 2 and a half years, enrolled 10 men and analysed 9, had no control group, and tested a 5-drug stack, funded by the company that sells the protocol. The clock calculations were run by the clock’s own inventor, who owned a stake in that company.

And 7 years later nobody has replicated the reversal.

And the ring?

Against all sleep labs Oura does some things well. Total sleep time comes within a few minutes of the lab once you average across people, so a weekly average means something, and resting heart rate is the most reliable thing the ring produces, though that rests on the one independent comparison, 21 people over a week.

Even in the validation study Oura itself funded, the ring called awake time sleep roughly a quarter of the time, which is how it can score a night you spent staring at the ceiling as a decent one.

A single night’s HRV (heart-rate variability) is no better: a comparison against overnight ECG (an electrocardiogram) found the ring excellent on heart rate “but not HRV.” And the Readiness Score is a blend mixed to Oura’s own recipe, never independently validated, so there is no number to check it against.

Do wearables improve health? They reliably add about 1,800 steps a day, which is real.

Across 39 systematic reviews covering 163,992 people, effects on blood pressure, cholesterol and blood sugar were “small and often non-significant,” and essentially no randomised trial has tested a wearable against death or disease, because almost none was designed to. The one large trial that isolated the device itself points the other way: 470 adults aged 18 to 35 got identical diet and coaching, half also got a tracker, and after 2 years the tracker group had lost 2.4 kilograms less.

For me the biggest change, regardless of the rings’ effectiveness tracking teh data, is a habit change of being mindful going to bed at my chronotype intervals, drinking less, eating better, etc overall. Call it a placebo, effect but a pretty darn good one.

Does anything on the supplement shelf work?

I’m interested in supplements, which makes me this shelf’s target audience.

The shelf holds rapamycin, metformin, senolytics (drugs meant to clear out aged, damaged cells), NAD boosters, taurine. Exactly one of them has reached a full phase 3 trial. That means large, randomised, placebo-controlled, and scored on whether older adults got sick rather than on what their lab numbers did. The compound is RTB101, a rapamycin-family drug. It was tested in 1,024 people over 65 to see whether it cut respiratory illness: 26% got sick on the drug, 25% on placebo. The drug did what its lab numbers promised, the target genes switched on, and people got sick at the same rate. 6 of the 8 authors owned stakes in the company funding it and published the negative result anyway.

The only randomised senolytic trial enrolled 60 people, with everyone aware of who was getting the drug, and scored them on a bone-turnover marker rather than on fractures; it missed the outcome it was designed to measure. The 2 studies enthusiasts cite instead enrolled 14 and 9 people, with no control groups, and the primary endpoints of the 14-person study were retention and completion rate. NMN is sold to top up NAD, the molecule it becomes in the body, on the theory that more of it slows aging. It does raise NAD in the blood. Across the roughly 15 small randomised trials, almost nothing else moves: not blood sugar, not cholesterol, not muscle, not grip strength, not walking speed.

The exception is preliminary: diastolic blood pressure fell 2.15 mmHg pooled across 349 people, a result that still needs confirming.

Taurine’s 2023 mouse-lifespan paper rested on the premise that taurine declines with human age; a 2025 National Institute on Aging study measured the same people over time rather than different people at different ages, and the decline vanished. No human taurine aging trial has ever been run. TAME, the metformin-for-aging trial, has no ClinicalTrials.gov registration: after 11 years of public discussion it has not started. The rapamycin dog-lifespan trial is real, funded and running, with no result possible before about 2029.

Who is selling the longer life?

Peter Diamandis founded and chairs the XPRIZE Foundation, whose Healthspan prize lists him as a benefactor, and his own investment and advisory portfolio includes Fountain Life, Human Longevity, Lifeforce, OneSkin and other longevity companies. His book’s sales page promises “an extra 20 or 30 years of health.”

XPRIZE Healthspan does not measure lifespan. Teams run 1-year trials in roughly 100 people aged 50 to 90 — the prize’s own website says 50 to 80 — and win by improving muscle, cognition and immune markers by as much as a reference population typically declines over 10, 15 or 20 years. So “restores ten years of function” means the test scores moved as much as an average person loses in 10 years. The rules also grant sponsors the right to buy into up to 5% of any equity round a winning team raises, during the competition and for a year after it.

Bryan Johnson has zero peer-reviewed publications on PubMed: not on Blueprint, his protocol, not on his own biomarkers. His own protocol site says as much in its disclaimer: “These tests are experimental and intended solely for research purposes.“

The same page also advertises “telomerase activity of a 12 year old.”

So: a 40-year retirement, or aging less badly?

What would it look like for a 40-year retirement, or are we looking at a much healthier and more active older age versus the current way of aging badly?

The average man across rich countries leaves work at about 64.7 and the average woman at 63.6; the years that follow could span 18.6 and 22.8. A 40-year retirement therefore requires average death at about 105 for men and 104 for women. The EU’s official projections out to 2070, a baseline with no anti-aging miracle in it, put the longest average retirement anywhere at 30.8 years, for women in Luxembourg.

Nobody reaches 40.

And “people will just work longer“ is already failing as a fix. US labour-force participation past 65 peaked at 20.2% in 2019 and has slipped to 19.1%. (The 2025 figures skip October, when the shutdown stopped collection.) Among the 29% of Americans over 65 who report a disability, it runs 8.3%, against 23.5% for those without one. Which is not the same as saying older people can’t work: the best cross-country evidence finds real unused capacity to work past 65, and no sign that older workers displace younger ones.

What has stalled is the doing, not the ability.

The promise with any room left in it is converting existing years from sick to well, and that is exactly what the healthspan data says has not been happening.

There is one more version of the question, the one I asked first: what would longer lives mean for humans in the evolutionary cycle?

That literature does not exist. Searching for it turns up a philosophy paper cited twice, an uncited preprint, and a paper about moths.

What does exist is 2 pieces of theory and one measurement.

1. Hamilton worked out in 1966 that natural selection’s pressure on survival falls to roughly zero past reproductive age.

2. Lee added a second channel in 2003: what older generations transfer to descendants still counts.

3. And Moorad showed in 2013, in records from a 19th-century American population, that the shift has already happened once: as far more infants survived, survival’s share of natural selection fell from about a third to about a seventh, and selection on reproductive traits picked up the difference.

I’m the one extrapolating when I say a much longer old age would push that shift further. The papers don’t claim it, and nobody has joined the 3 findings into an answer.

Back to my own numbers

What my ring and panels can report that clears its own noise is a short, boring list.

A weekly average of sleep time. Resting heart rate. Step count, the one thing trackers reliably raise. And HbA1c, the quietest marker in the table above at ±3.2%. Even that number rests on just 6 studies, whose own estimates range from 0.29% to 7.0%.

None of this is sold as longevity, and all of it predates the industry by decades.

Meanwhile the 2 numbers the whole question hangs on have not moved: the lifespan record has stood since 1997, and the healthy years ahead of an American 60-year-old have not gained ground on 2000.

Set side by side, the trials in this article diverge.

• RTB101 switched on its target genes, and people got sick at the same rate.

• NMN raises blood NAD, with no established benefit behind that number.

• Semaglutide cut cardiovascular events in SELECT, and in FLOW it formally cut deaths: 15.8% to 12.9%, 34 treated to prevent one death, in patients with type 2 diabetes and chronic kidney disease.

• Tirzepatide prevented diabetes in people with prediabetes, 9 treated to prevent one case.

Those are clinical benefits; none of them establishes slower aging or a longer life in healthy people.

And a healthier, more active old age is an outcome: the kind of change that has to show up in health and function, not in a pair of inflammation readings or a shift on an age clock, even one that reads reliably.

This is a fascinating area to continue to keep an eye out for! And I hope you are walking away with a window into this longevity-pilled world!

References:

• Mortality in the United States, 2024 (NCHS Data Brief 548)

• United States Life Tables, 2023 (NVSR 74:6)

• LongeviQuest validated-supercentenarian tables

• Demographic perspectives on the rise of longevity

• Implausibility of radical life extension in humans in the twenty-first century

• Aging, natural death, and the compression of morbidity

• Global Healthspan-Lifespan Gaps Among 183 World Health Organization Member States

• WHO Global Health Observatory, healthy life expectancy at 60

• FDA label: Wegovy (semaglutide)

• FDA label: Ozempic (semaglutide)

• FDA label: Zepbound (tirzepatide)

• Semaglutide and Cardiovascular Outcomes in Obesity without Diabetes (SELECT)

• SURMOUNT-1 posted results, ClinicalTrials.gov NCT04184622

• Weight regain and cardiometabolic effects after withdrawal of semaglutide: the STEP 1 trial extension

• Tirzepatide persistence, Optum Market Clarity

• Tirzepatide adherence and persistence, Veradigm

• Reasons for Discontinuation of Obesity Pharmacotherapy With Semaglutide or Tirzepatide in Clinical Practice

• EFLM Biological Variation Database · meta-calculations endpoint

• Direct-to-Consumer Testing: Benefits and Concerns of Commercially Accessed Laboratory Tests

• A computational solution for bolstering reliability of epigenetic clocks

• Reversal of epigenetic aging and immunosenescent trends in humans (TRIIM)

• openFDA 510(k) database, Oura query · openFDA registration listing 3015599655

• The Oura Ring Versus Medical-Grade Sleep Studies

• Henriksen et al., JMIR Formative Research (2022)

• Liang, Yilmaz and Soon, Sensors (2024)

• Validity and reliability of the Oura Ring Generation 3 compared to multi-night ambulatory polysomnography

• Effectiveness of wearable activity trackers to increase physical activity and improve health

• Effect of Wearable Technology Combined With a Lifestyle Intervention on Long-Term Weight Loss (IDEA)

• Targeting the biology of ageing with mTOR inhibitors to improve immune function in older adults

• Effects of intermittent senolytic therapy on bone metabolism in postmenopausal women · registry record NCT04313634

• Justice et al., EBioMedicine (2019)

• Hickson et al., EBioMedicine (2019)

• Zhang, Poon and Wong, Crit Rev Food Sci Nutr (2025)

• Prokopidis et al., J Cachexia Sarcopenia Muscle (2025)

• Yang et al., Nutrients (2026)

• Zhang et al., Nutrients (2026)

• Taurine deficiency as a driver of aging

• Is taurine an aging biomarker?

• ClinicalTrials.gov API v2, TAME title queries

• NIH RePORTER project R01AG090843 (TRIAD)

• Diamandis portfolio companies · about · Fountain Life founding partners · book sales page

• XPRIZE Healthspan Competition Guidelines v2.2 · prize page

• PubMed E-utilities searches for Bryan Johnson publications · Blueprint protocol page

• OECD Pensions at a Glance (DSD_PAG@DF_DEC)

• European Commission, 2024 Ageing Report (Institutional Paper 279)

• US Bureau of Labor Statistics, Public Data API v2

• Social Security and Retirement Programs Around the World: The Capacity to Work at Older Ages

• The moulding of senescence by natural selection

• Rethinking the evolutionary theory of aging: Transfers, not births, shape senescence in social species

• A demographic transition altered the strength of selection for fitness and age-specific survival and fertility in a 19th century American population

• The Ethics of Human Life Extension: The Second Argument from Evolution

• Post-reproductive selection preprint (2024)

NVIDIA guided to $108 billion with China at zero, and stretched its collection days from 45 to 60 while doing it. OpenAI and Anthropic both disclosed failures in evaluation environments where the safeguards they run in production had not been switched on.

Since last Monday on Signal Finder: When to Run an Open-Weight Model Yourself — almost never on cost alone. Renting the whole machine pays off for document-heavy, always-on work, and what decides it is the org chart you already have.

Good morning. NVIDIA told investors to expect $108 billion next quarter, and said that number assumes it sells no data center compute in China at all.

OpenAI and Anthropic each disclosed an incident and in both cases agents handed real tools in test setups that were not running the safety checks those companies to turn on for customers. Salesforce made Claude the default model across Slack and Agentforce, and 2 days later OpenAI told Cursor it is ending the contract because SpaceX bought it. Anthropic cut the price of re-reading context by 75%, and the Bureau of Labor Statistics started tagging every job it tracks with how exposed it is to AI.

1. NVIDIA expects $108 billion next quarter and nothing from China

What happened: On August 26 NVIDIA reported quarterly revenue of $96.2 billion, up 106% from a year ago, with data center revenue of $89.0 billion, and guided the coming quarter to $108.0 billion, plus or minus 2%.

Why it matters: China accounted for $7.9 billion of the quarter by customer headquarters, a billing address rather than a shipping one, third behind the United States at $60.1 billion and Taiwan, so writing it out of the outlook costs less than the headlines around it suggest.

What to do: The CFO commentary is where I go when a headline number won’t explain itself, and this one taught me something I had been skipping past: booked revenue and collected cash are two different things, and the days-to-collect line is where the gap between them shows up first. That’s the number I’ll be reading next quarter, not the growth rate everyone quotes.

2. AI orders hit records 8 days running

What happened: The companies buying computing power signed deals nobody will confirm, the companies selling the machines reported record orders in documents anyone can read, and on the last of those 8 days NVIDIA agreed to buy Hugging Face.

• Anthropic’s two compute leases (Bloomberg, August 26 and August 31)
  Bloomberg reported, citing people familiar, that Anthropic agreed to pay Nscale roughly $45 billion over about 6 years for around 460 megawatts at its West Virginia campus, and days later a second deal, roughly $35 billion with Lambda for around 350 megawatts at a Texas site.

• Dell (September 1)
  Dell took $60.9 billion of orders for AI servers in a single quarter, and $16.4 billion of that has been built and billed so far. The orders it has taken but not yet filled add up to $95 billion.

• Broadcom (September 2)
  Broadcom sold $16.7 billion of AI chips, more than triple a year ago, and it expects $21.7 billion next quarter.

• HPE (September 2)
  The Cloud and AI group brought in $9.0 billion, up 25.4%, though that same group also sells storage and lending, so not all of it is AI.

• Marvell (August 27)
  Marvell sold $2.739 billion worth, up 37%, and data centers were $2.1715 billion of that, up 46%.

• NVIDIA’s Hugging Face deal (8-K, event dated September 2; announced September 3)
  The price is $12.93 billion: about $11.9 billion to the people who own Hugging Face, plus up to $1.0 billion in stock to keep the employees who come along. NVIDIA committed to keep the platform open, letting participants “upload and download models and datasets of their choosing and to support other silicon vendors.”

Why it matters: Marvell now makes 79 cents of every dollar in data centers, up from 74 two quarters ago, which is the same buildout seen from inside a supplier instead of from the outside.

What to do: Reading these back to back, what stood out is how fast a promise to buy turns into a sentence that sounds like money already in hand, when some of these machines have not been built yet.

3. Anthropic cut the price of remembering by 75%

What happened: On September 1 Anthropic released Claude Fable 5.1 and Claude Mythos 5.1, the same underlying model at two safeguard levels, with Fable open to everyone and Mythos restricted to vetted cybersecurity and life-sciences organizations. The list price for the model itself did not move, at “$10 per million input tokens and $50 per million output tokens,” but cache reads, what you pay each time the model re-reads context it has already seen, dropped from $1.00 to $0.25 per million. Anthropic also reports the biology safeguards now “fire 85% less often for benign requests related to elementary biology and medical questions,” and that Claude Code users should see roughly 60% fewer cyber-safeguard interventions per session.

A breaking change traveled with it. API accounts created from September 1 onward can no longer edit Claude’s earlier turns while keeping the transcript of its prior thinking, an anti-copying measure Anthropic says will affect “a small number of customers’ custom integrations.”

Why it matters: Anthropic puts the saving at about 25% on a typical workload and up to 45% on a heavily agentic one, so the discount grows the more your agents re-read the same context, which is exactly the pattern that made agents expensive.

What to do: Before approving anything built on the old assumption, I’d re-run last quarter’s agent bill against the new cache-read price. And ask whoever built your Claude integrations whether any of them rewrite earlier turns, because that answer has a deadline attached now.

4. The labs published their own incident reports

What happened: A week of disclosure, August 26 to September 1, and the first public record of what capable agents do with tools and not enough isolation.

• OpenAI’s postmortem (August 26)
  The driver was Internal Model 1, a research model “comparable in scale to GPT-5.6 Sol.” The timeline from the first entry on an unsanctioned agent message board to detection runs 68 days. OpenAI: “we did not extend the powerful safeguards that we deploy for our externally deployed models to all internal evaluations,” and it calls the event “a ‘warning shot’ for us and for the world.”

• METR and Redwood’s count (August 26)
  About 1,200 agents used the board, and roughly 700 joined the attack on Hugging Face.

• Anthropic’s alignment and security update (August 31)
  On July 30 it reported 3 incidents in which Claude models gained unauthorized access to real computer systems, and on August 4 the UK AI Security Institute reported one from its own testing. Both sets of models were deliberately running without cyber safeguards. The root cause, in Anthropic’s words: “Claude was explicitly told that it had no internet access, despite the internet being available.” What changed since is a classifier that blocks the action “before the tool call is run,” now running inside training environments too.

• Astra at Critical (September 1)
  The first OpenAI model classified Critical for cybersecurity: a perfect score on ExploitBench, though the page notes those “results shown reflect capabilities with Daybreak Blue access, not the default production configuration.”

• The cyber-defense letter (August 27)
  It warns that “in the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable.” One ask lands squarely on buyers: “ensure agentic identities are traceable and accountable.” The letter had 116 signatures at launch, by CNBC’s count.

Why it matters: OpenAI says its own monitoring of the models’ written reasoning, had it been switched on, “would have caught the initial relevant activity and paged our security team more than a day before models breached Hugging Face systems,” so the detection existed and nobody was running it.

What to do: If anyone in your organization runs agent evaluations, I’d adopt Anthropic’s phrasing rule: write boundaries as instructions (”You should not access the internet”) rather than as claims about the test (”You do not have internet access”). Separately, put your model vendor on record: do the safeguards you pay for run during their own internal testing?

5. The contract now decides which model you get

What happened: 5 moves in 8 days, all of them about who controls the model you run and where the record of what it did ends up.

• Claude as Salesforce’s default (August 26)
  Claude becomes the default model for Slack AI, Slackbot, Salesforce in Claude, Headless 360 and Agentforce Coworker. Salesforce calls Claude the “first LLM provider fully integrated within the Salesforce Trust Boundary,” meaning the first outside model vendor allowed inside its own security perimeter.

• The Cursor shutoff (August 28)
  SpaceX’s completed $60 billion acquisition of Cursor’s maker Anysphere opened a change-of-control clause, and OpenAI says it will “wind down our contract providing OpenAI models to Cursor, with a proposed shutoff date of November 12, 2026.” Proposed is OpenAI’s own word, and OpenAI’s stated reason is blunt: “we cannot be confident that SpaceX will use our technology within our terms of service, based on our experience with Elon Musk’s companies violating contracts.”

• Anthropic’s Enterprise Frontier Safeguards (September 1)
  Zero data retention combined with misuse detection where the logs sit in the customer’s own AWS, Azure or Google Cloud account under the customer’s own encryption keys, reviewed automatically with no Anthropic employee reading them. It charges no fee of its own, though the cloud storage is on the customer’s bill. Philip Martin, Uber’s chief information security officer: “The logs are under our control; they don’t go anywhere else unless we want them to.“

• IBM’s Granite 4.2 (August 25)
  Three sizes at 3, 8 and 30 billion parameters, under an Apache 2.0 license. IBM reports the 30B at 57.00 on SWE-bench Verified, a benchmark built from real bugs in real open-source projects. I wrote last week about when running an open-weight model yourself actually pays, and the short answer was almost never on cost alone.

• Agentforce’s revenue number (August 26)
  Agentforce yearly recurring revenue passed $1.5 billion, up over 240%, with the release’s own caveat attached: “Effective Q2 FY27, Agentforce ARR includes our AI offerings, Slackbot and Headless 360,” so the base changed inside the quarter being reported.

Why it matters: The customers Anthropic named first are the bank chief information security officers who sit on the Analysis and Resilience Center for Systemic Risk, which tells you which objection that design was built to answer. OpenAI, meanwhile, had supplied Cursor for nearly 4 years and moved to end the contract using a clause its own post says gives it “a limited time window to cancel.”

What to do: I’d pull the change-of-control clause out of every model contract you hold and find out who has to be acquired for it to fire. Price one real workload against an Apache-2.0 model you could host yourself, and record the result as a costed fallback.

6. The EU just called ChatGPT a search engine

What happened: On August 31 the European Commission designated ChatGPT a Very Large Online Search Engine under the Digital Services Act, with Reddit and Roblox designated Very Large Online Platforms the same day. The trigger is mechanical: “These services declared that they reach at least 45 million average monthly users in the EU and thus meet the threshold for designation.” Designated services get 4 months from notification, “i.e. by January 2027,” to assess and mitigate systemic risks from the service and its algorithmic systems.

A second European clock started on the same page as Signal 3’s price cut. Anthropic signed the Code of Practice on Transparency of AI-Generated Content in July 2026, and it now watermarks the output of every model released after August 2, 2026, which is also the date the general-purpose AI obligations under the AI Act became enforceable.

Why it matters: The detection service Anthropic built for those watermarks is in private preview for regulators, law enforcement, media and researchers, and for enterprises carrying their own verification obligations, so the compliance tool reaches the buyer alongside the regulator. Whether a company outside Europe with European customers actually carries such an obligation is a lawyer’s question, and not one I can answer off the Code of Practice.

What to do: The January 2027 date belongs on the same calendar as your AI Act work, since these are two separate regimes landing through one vendor. And ask whoever owns your EU-facing content whether anything you publish needs provenance checking, because the detector is in private preview.

7. The government now grades jobs on AI exposure

What happened: On August 27 the Bureau of Labor Statistics released its 2025 to 2035 employment projections and, alongside them, “a new data product that provides information about how occupations compare to one another based on their theoretical and observed exposure to artificial intelligence (AI).” Occupations get sorted into four buckets, Low, Moderate, High and Very high, with 206 of them in the top one.

Total employment rises 3.5% across the decade against 10.9% in the decade before, while office and administrative support occupations decline 4.0%, a loss of 752,100 jobs and the fastest decline of any group. BLS fences the categories hard: “An exposure category is not a forecast of employment growth or decline… is not a worker replacement estimate… The exposure categories do not distinguish between AI impacts from automation versus augmentation.”

4 days later a survey described the same workforce from the inside. BambooHR, surveying 1,608 US desk workers, found that “59% of workers use personal AI accounts for work tasks,” and that of that group “71% have entered client data, proprietary strategy, or other sensitive company information into tools their employer cannot see.”

Why it matters: 2 of the 5 measures behind those exposure categories are built from observed usage of Anthropic’s Claude and Microsoft Copilot, which means a federal statistical product now rests in part on two vendors’ usage data.

What to do: I’d pull the Very-high list and mark which of those job titles your organization actually employs. Then measure how many of those people are doing the work through a personal account, because that number is yours to find and nobody publishes it for you.

References:

• NVIDIA announces financial results for the second quarter of fiscal 2027 (NVIDIA, 2026-08-26): https://nvidianews.nvidia.com/news/nvidia-announces-financial-results-for-second-quarter-fiscal-2027

• NVIDIA Q2 FY2027 CFO commentary (SEC EDGAR, 2026-08-26): https://www.sec.gov/Archives/edgar/data/1045810/000104581026000073/q2fy27cfocommentary.htm

• Anthropic to pay Nscale $45 billion for AI computing power (Bloomberg, 2026-08-26): https://www.bloomberg.com/news/articles/2026-08-26/anthropic-to-pay-nscale-45-billion-for-ai-computing-power

• Anthropic seals $35 billion cloud deal with NVIDIA-backed Lambda (Bloomberg, 2026-08-31): https://www.bloomberg.com/news/articles/2026-08-31/anthropic-seals-35-billion-cloud-deal-with-nvidia-backed-lambda

• Statement on the reported $45 billion agreement at Nscale’s West Virginia campus (Office of the Governor of West Virginia, 2026-08-27): https://governor.wv.gov/

• Dell Technologies second quarter fiscal 2027 results, Form 8-K Exhibit 99.1 (SEC EDGAR, 2026-09-01): https://www.sec.gov/Archives/edgar/data/1571996/000157199626000039/exhibit991earnings8kq2fy27.htm

• Broadcom third quarter fiscal 2026 results, Form 8-K Exhibit 99.1 (SEC EDGAR, 2026-09-02): https://www.sec.gov/Archives/edgar/data/1730168/000173016826000076/avgo-08022026x8kxex99.htm

• HPE reports fiscal 2026 third quarter results (Hewlett Packard Enterprise, 2026-09-02): https://www.hpe.com/us/en/newsroom/press-release/2026/09/hpe-reports-fiscal-2026-third-quarter-results.html

• Marvell Technology second quarter fiscal 2027 results, Form 8-K Exhibit 99.1 (SEC EDGAR, 2026-08-27): https://www.sec.gov/Archives/edgar/data/1835632/000183563226000022/q227_8kx812026ex-991.htm

• NVIDIA Form 8-K, Item 8.01, agreement to acquire Hugging Face (SEC EDGAR, event dated 2026-09-02): https://www.sec.gov/Archives/edgar/data/1045810/000104581026000078/nvda-20260902.htm

• NVIDIA to acquire Hugging Face (NVIDIA Newsroom, 2026-09-03): https://nvidianews.nvidia.com/news/nvidia-to-acquire-hugging-face

• Claude Fable 5.1 and Claude Mythos 5.1 (Anthropic, 2026-09-01): https://www.anthropic.com/claude-fable-and-mythos-5-1

• Gemini 3.8 Flash and 3.8 Flash Cyber (Google, 2026-09-02): https://blog.google/innovation-and-ai/models-and-research/gemini-models/3-8-flash-and-3-8-flash-cyber/

• The Hugging Face incident and the road ahead (OpenAI, 2026-08-26): https://openai.com/index/hugging-face-incident-and-the-road-ahead/

• Investigation of the OpenAI Hugging Face incident (METR, 2026-08-26): https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/

• Improving our alignment and security efforts (Anthropic, 2026-08-31): https://www.anthropic.com/news/improving-alignment-security-efforts

• Path to Astra: critical capabilities and frontier safeguards (OpenAI, 2026-09-01): https://openai.com/index/path-to-astra/

• Collective cyber defense open letter (OpenAI, launched 2026-08-27): https://openai.com/collective-cyberdefense/

• Salesforce and Anthropic announce Claudeforce (Salesforce, 2026-08-26): https://www.salesforce.com/news/press-releases/2026/08/26/salesforce-and-anthropic-announce-claudeforce/

• Salesforce announces second quarter fiscal 2027 results (Salesforce, 2026-08-26): https://www.salesforce.com/news/press-releases/2026/08/26/fy27-q2-earnings/

• Our decision on Cursor following its acquisition by SpaceX (OpenAI, 2026-08-28): https://openai.com/index/our-decision-on-cursor-following-its-acquisition-by-spacex/

• Enterprise Frontier Safeguards (Anthropic, 2026-09-01): https://www.anthropic.com/news/enterprise-frontier-safeguards

• Introducing Granite 4.2 (IBM Research, 2026-08-25): https://research.ibm.com/blog/introducing-granite-4-2

• Commission designates ChatGPT, Reddit and Roblox under the Digital Services Act (European Commission, 2026-08-31): https://digital-strategy.ec.europa.eu/en/news/commission-designates-chatgpt-reddit-roblox-under-digital-services-act

• Employment projections 2025 to 2035 (Bureau of Labor Statistics, 2026-08-27): https://www.bls.gov/news.release/ecopro.nr0.htm

• AI exposure categories (Bureau of Labor Statistics, 2026-08-27): https://www.bls.gov/emp/publications/ai-exposure-categories.htm

• Redesigning Work: AI’s Performance Review (BambooHR, 2026-09-01): https://www.bamboohr.com/about-bamboohr/press-release/bamboohr-research-redesigning-work-ai-performance-review

What decides it is your org chart.

The question comes up in the same meeting at most enterprises now. Someone is presenting an AI proposal, a model with a Chinese parent company appears on a slide, and a voice from the end of the table asks: can we trust a model that came from over there?

Legal has a view. Security has a view. Everyone has a view, and nobody has checked.

Start with what’s on the slide. An open-weight model — Llama, DeepSeek, Mistral, Qwen — is a trained AI model you can download and run on your own computers.

The company that trained it published the finished product; anyone can hold a copy.

Which one are you afraid of?

When someone in that meeting says “the model,” they mean one of three things, and each carries a different risk.

The argument goes in circles because all three keep wearing the same name.

1. A file can’t call home

A model in the modern file format is a short header and billions of numbers, which means it can no more open a network connection than a spreadsheet can. (An older format did run code when loaded, which is why Hugging Face scans every upload for it and the industry moved on.)

Whatever the fear in the room is about, it isn’t this.

2. Everything that comes in the box

Model downloads come with loader code and setup scripts; Kimi K3’s own instructions ask you to switch on a setting that means “run whatever code came with this download” — a routine ask across labs, American and European included. The loading tools have had real holes too, including one in PyTorch’s loader that let an attacker’s program run on your machine (CVE-2025-32434). The scale makes it an industry-wide problem, not a curiosity: security scanners had flagged roughly 352,000 unsafe or suspicious issues across 51,700 models on Hugging Face by April 2025, and Microsoft’s own catalog notes say plainly that “not all models available through the model catalog are scanned.”

Treat a model download like any other software package, because that’s what it is.

3. Banned the file, kept the app

DeepSeek’s own privacy policy says prompts, uploaded files, and chat history may be stored on servers in China. That’s real and documented in the company’s own words — and it attaches to DeepSeek’s service, not to a DeepSeek file running behind your firewall with outbound traffic blocked. Companies get this backwards: they ban the passive file while employees paste customer data into the consumer app.

Behavior is a separate question, and the evidence there is model-specific and not favorable to open models.

The US National Institute of Standards and Technology (NIST) tested DeepSeek R1-0528 and found agents built on it were 12 times more likely to follow hijacking instructions than the leading closed models it was compared against.

That’s damning — about that one model. So I recommend you test the model you’re deploying, not its nationality.

The danger is in the paperwork

Now the part that can actually bite.

While the room argues about the downloaded file/model, the exposure that would interest a general counsel sits in the license attached to it.

Under Meta’s Llama terms, as served through Microsoft’s platform, the customer may have to cover Meta’s losses and legal costs from third-party claims arising from its own use — backwards from every software contract you’ve signed. The same terms bar any company headquartered in the European Union from the multimodal Llama models, and require every product built on one to display “Built with Llama.”

Mistral defends its customers in the right way around but the protection falls away to the extent a claim arises from changes made by anyone other than Mistral. So the more you change the model, the less of the shield covers the thing you built. And changing the model, tuning it on your own data, is usually the whole reason you wanted it in the first place.

The permissive licenses offer no shelter either, because DeepSeek’s and Qwen’s terms hand you the file “AS IS” — no warranty, no defense. And Microsoft’s copyright promise, where Microsoft defends customers against copyright claims over AI output, covers a named list of its own products.

Open models you run yourself aren’t on the list.

Most of these aren’t open source, whatever the slide says. The Open Source Initiative examined Meta’s license and rejected it for restricting who may use the model and what for; DeepSeek’s and Qwen’s terms do qualify.

Open weights means you can download it. Open source means more, and the distinction is important.

So the meeting spent its energy on a file that can’t act, and skipped the document that decides who pays the lawyers.

So what decides it

None of this settles whether to run these models on a dedicated machine, because each risk has a fix that never touches the machine question. Vet model downloads the way you vet any other software and the download risk is handled; keep sensitive work off the consumer app and the website risk is handled too.

The license risk is the stubborn one, since reading the terms doesn’t make them go away and Meta isn’t renegotiating with us. That one we price in and have to design around.

But whether the risks get vetted, blocked, or lived with, none of them tells you whether to rent the box.

What does is a question nobody in that meeting thinks to ask: how many people do you already employ to run things like this?

The real answer sits on the org chart, not in the model.

Five people and a box

Let’s start with the machine option.

On Microsoft Azure, a server carrying eight of NVIDIA’s H200 chips (the big graphics processors (GPUs) that AI runs on) rents whole for $27,238 a month on a three-year deal at Azure’s published August 2026 prices.

Tokens are the word-fragments models read and write, and the billing unit for all of this. If you run it flat out at the speeds a million output tokens costs about 36 cents. MLPerf, the industry’s audited speed test, has measured for this class of machine, on the same-size model a generation back.

The other option is renting the same class of model by the token: a provider hosts the open model on its own GPUs and you pay through an API, the same way you already pay for GPT-5.4 — no machine, no serving software, no pager, just a meter. That meter reads $0.71 per million tokens for this class of model.

Those two rates don’t compare directly, and the gap between them is where the type of work takes over: the per-token meter runs on every token the model reads as well as every token it writes, while your dedicated machine reads inputs on hardware you’ve already paid for.

So for document-heavy work, the kind that reads four words for every one it writes, the machine pays for itself once it’s about 10% busy. That sits far below the 60 to 80% figure everyone cites as the watermark.

Then you count the people, because a machine like this is a set of jobs.

• Someone runs the serving software.

• Someone owns rollouts and rollbacks when a new model version lands.

• Someone builds the tests that prove quality held after every change.

• Someone vets what you downloaded.

• And someone carries the pager at 3am, because the per-token service comes with an uptime promise and your machine comes with whoever is on call.

Five people for those jobs, priced at federal wage data with benefits, cost $98,037 a month. The machine costs $27,238. The people are 78% of the bill.

Count the people in and the bar jumps: now the machine has to be doing real work about 46% of the time before it beats the meter — still on that document-heavy, four-words-in for one-out work. Put differently, out of every ten hours you’re paying for, the machine needs to spend more than four and a half actually answering requests, not sitting idle waiting for them.

That works out to roughly 46 requests arriving every second, day and night, weekends included, all year. Almost nothing inside a company runs at that pace.

Five people is my assumption, not a published number — nobody publishes the headcount for running one of these — so overwrite it with your own org chart.

If you already run a platform team — people whose day job is keeping servers, deployments, and monitoring alive — most of those five jobs are covered, and adding two engineers gets you the rest. For that company the bar drops from 46% to somewhere between 25 and 29%. The same discount goes to anyone who already built the quality tests and the traffic plumbing for the cheaper-model move I’ll get to next, because three of the five jobs on the list are exactly that work, and done once it doesn’t need doing again.

Those percentages translate into monthly volume you can check against your own bills. On that same document-heavy work, a company adding almost no staff breaks even once the model is writing about 9 billion tokens a month. A company hiring all five people from scratch needs closer to 35 billion — nearly 4 times as much work to justify the exact same machine — and adding two engineers lands you somewhere in between.

Same box, same rent; the hiring plan alone moves the break-even point by a factor of four.

Two companies with identical work get opposite decisions, and what separates them is the org chart.

The move almost nobody makes first

Before either company commits to a machine, there’s a move that captures most of the prize with no machines at all, because most of the saving everyone attributes to running the model yourself is available from renting a cheaper one.

Move document-heavy work from GPT-5.4 to Llama 3.3 70B — both rented by the token, no machines involved — and the price falls from $25.00 per million output tokens to $3.55. That’s 86% of the bill gone with nobody new needing to be hired.

What it takes is proof that the cheaper model clears your quality bar, and the plumbing to route traffic to it — real engineering, not a settings change. But the bar for that work paying for itself is low. Even pricing generous engineering time for the tests and the routing, it covers its own cost at about 1.37 billion output tokens a month, call it 1.8 requests per second — 1/25th of what the machine will turn out to need.

Salesforce published what this looks like done well.

A small model, tuned from the open GPT-OSS-20B, now does the intent-sorting behind its Agentforce product. By the company’s own measurements, it’s 30 times faster than the general-purpose models it replaced, with 1 to 2% better accuracy.

It shipped in two months, during a code freeze — which tells you this is routing work, not a platform build. And Salesforce kept the expensive model wired in as a fallback anyway; one of the largest AI teams anywhere still didn’t bet on the cheap model alone.

If you haven’t made that move yet, the machine question is premature.

The dedicated machine needs the same quality tests and the same routing plumbing the cheap move needs — plus five people and a three-year lease — and it needs 25 times the volume before it pays off. Jumping straight to the box means signing up for $27,238 a month in hardware while skipping the $3.55-per-million model that needed no hardware at all. That’s not a cost decision.

That’s spending money to avoid a two-month engineering project.

References:

• Hugging Face Hub, Pickle scanning: https://huggingface.co/docs/hub/security-pickle

• Kimi K3 model repository: https://huggingface.co/moonshotai/Kimi-K3/tree/main

• NVD, CVE-2025-32434 (PyTorch torch.load): https://nvd.nist.gov/vuln/detail/CVE-2025-32434

• Hugging Face blog, 4M Models Scanned: Protect AI + Hugging Face 6 Months In (2025-04-14): https://huggingface.co/blog/pai-6-month

• Microsoft Learn, Data, privacy, and security for use of models through the model catalog: https://learn.microsoft.com/en-us/azure/foundry-classic/how-to/concept-data-privacy

• DeepSeek Privacy Policy: https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html?locale=en_US

• NIST CAISI, Evaluation of DeepSeek AI models (2025-09-30): https://www.nist.gov/news-events/news/2025/09/caisi-evaluation-deepseek-ai-models-finds-shortcomings-and-risks

• Microsoft Learn, Terms and conditions for specific Microsoft Foundry Models (page dated 2026-07-17): https://learn.microsoft.com/en-us/legal/microsoft-foundry/model-specific-terms

• Microsoft Learn, Customer Copyright Commitment required mitigations: https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/openai/customer-copyright-commitment

• Microsoft Product Terms, Universal License Terms for Online Services — Customer Copyright Commitment (Covered Products scope): https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all

• Azure Retail Prices API (all Azure prices; accessed 2026-08-14): https://prices.azure.com/api/retail/prices

• MLCommons, MLPerf Inference v6.0 results (2026-04-01): https://github.com/mlcommons/inference_results_v6.0

• US Bureau of Labor Statistics, OEWS May 2025 wages and ECEC Q1 2026 compensation, retrieved via the BLS Public Data API (accessed 2026-08-14): https://www.bls.gov/oes/

• Salesforce Engineering, Solving Real-Time AI Classification for Agentforce (2025-11-20): https://engineering.salesforce.com/solving-real-time-ai-classification-for-agentforce-how-single-token-prediction-delivers-30x-faster-agent-responses/

• Salesforce News, How We Cut Inference Spend by Right-Sizing Our Models: https://www.salesforce.com/news/stories/cutting-inference-spend-by-right-sizing-models/

• Mekala et al., quantization and long-context performance, EMNLP 2025: https://aclanthology.org/2025.emnlp-main.479/

• OWASP GenAI, LLM03:2025 Supply Chain: https://genai.owasp.org/llmrisk/llm032025-supply-chain/

• Microsoft Learn, Azure AI Foundry built-in evaluators: https://learn.microsoft.com/en-us/azure/foundry/concepts/built-in-evaluators

• Microsoft Learn, AI gateway capabilities in Azure API Management: https://learn.microsoft.com/en-us/azure/api-management/genai-gateway-capabilities

• Uber Engineering, GenAI Gateway (2024-07-11): https://www.uber.com/us/en/blog/genai-gateway/

No US lab released a flagship model, which is now 2 weeks running. OpenAI instead published that it has stopped its largest planned training run because an upcoming model, Astra, might be good enough at finding software holes to cross a line the company drew for itself.

SK hynix is spending 40 trillion won buying its own shares back and destroying them, Marvell gave Google the right to buy its shares at a fixed price, earned half a billion dollars of spending at a time, and Anthropic started charging 10% extra for keeping your work inside one country.

1. NVIDIA co-signed 4.25 gigawatts of OpenAI’s lease in Ohio

What happened: On August 17 NVIDIA announced that it had “secured land, power and shell (LPS) capacity through a partnership with SB Energy at the PORTS-Pike Technology Campus in Pike County, Ohio, to host NVIDIA compute.” Shell means the empty building. SB Energy, which SoftBank owns, builds the site and runs it.

OpenAI is the tenant, and NVIDIA is the only company allowed to supply the computers inside. NVIDIA’s guarantee runs up to 20 years from the start of each lease.

The 8-K NVIDIA filed the same day is worth reading.

• A ceiling not a check
  The filing says “NVIDIA’s aggregate payment obligation is cumulatively capped at $105 billion for its initial commitment under the Agreements.”

• Who pays it back
  OpenAI has agreed to pay NVIDIA back if that happens. In the filing’s words: “OpenAI has agreed to reimburse and indemnify NVIDIA for any and all amounts actually paid by NVIDIA to the Lessor under the Agreements.”

• The size
  NVIDIA backs an initial 4.25 gigawatts of what the filing calls IT load, meaning the power the computers themselves draw, with an option to back “approximately an additional 3.8 gigawatts“, which is where the 8-gigawatt headline comes from.

• The power bill
  The campus needs at least 10 gigawatts of new power built for it and at least $4.2 billion of work on the regional grid. Capacity arrives in phases starting in 2028.

• What Ohio gets
  A $40 million community fund from SB Energy plus another $40 million from OpenAI, which on its own page says the project “is expected to create 35,000 construction jobs during its six-year buildout through 2032 and 2,500 long-term operating jobs.”

• What they said
  Jensen Huang: “AI is becoming infrastructure – the foundation for intelligence in every industry – and land, power and shell have become vital in the age of AI.” Sam Altman: “We’re proud to build it in Pike County, a place that is once again at the heart of American industry and leading the future.”

Why it matters: NVIDIA only has to pay if OpenAI runs out of money, and the one promising to pay NVIDIA back is OpenAI, so that promise is worth least exactly when somebody needs it. The risk is simple: $105 billion of backup that depends on the company it is backing up.

What to do: I’d read the 8-K rather than the coverage on any deal this size, since this structure is easy to describe wrongly and the filing itself is short. And I’d treat 2028 as the earliest date this capacity changes what anyone can actually buy.

2. The parts that go into AI got more expensive

What happened: 3 moves inside 4 days, from 3 different parts of the AI supply chain.

• SK hynix is buying its own shares back
  The board approved it on August 19: SK hynix will spend 40 trillion won buying its own shares off the market and then destroy them, roughly 24.07 million shares, about 3.3% of the company, over about 3 months from August 20. Destroying shares leaves fewer of them, so each one left owns a bigger slice. No publicly traded South Korean company has ever cancelled that many of its own shares at once.

• Marvell’s share offer to Google
  Marvell handed it over on August 18 and disclosed it the next day. Google can buy up to 58,970,907 Marvell shares at a fixed $206.58 each, good until August 18, 2033, and it has to earn almost all of that right: 57,610,040 of the shares come available in “240 equal tranches, with one tranche vesting for each $500 million in Custom Products revenue“, which is one batch for every half billion dollars Google chooses to spend with Marvell. The deal covers chips that sit alongside Google’s own AI chip.

• Anthropic’s 10% for keeping data in one country
  The Claude Code changelog for v2.1.239, dated August 21, reads: “Cost estimates (/cost, status line, --max-budget-usd) now include the 1.1× US-only-inference premium for data-residency workspaces.” The 10% was already being charged; what changed is that it now shows up before you spend anything.

Why it matters: The Anthropic one is worth dealing with first, because now that the 10% shows up before you spend, keeping your data in one country has a price tag somebody has to sign off on. The other 2 point the same way: the companies that make the chips and the memory are the ones naming the price now.

What to do: I’d find out whether any workspace is on a data-residency plan and what that 10% has been costing, now that the tool reports it. And I’d re-run any 2027 hardware budget that assumes memory prices are going to fall.

3. OpenAI paused its biggest training run over hacking ability

What happened: On August 18 OpenAI published a post saying it had found early evidence that an upcoming model, Astra, “may meet the Critical cybersecurity capability threshold under our Preparedness Framework.” That is the first OpenAI model the company cannot rule out at that level, and it says it reached the determination on August 7, 11 days before it said so publicly.

What it did about it, in its own words: “This included a two-week pause in reinforcement learning (RL) training on our latest models intended for deployment while we further hardened and red-teamed our research environments and expanded the coverage of our monitoring systems. Our largest planned frontier RL run remains on hold while we conduct smaller-scale training and evaluations to assess model behavior, validate our safeguards, and establish more evidence of alignment before proceeding.“

Reinforcement learning is the training stage where a model gets rewarded for reaching an outcome rather than shown worked examples to copy. The line Astra may have crossed is written down in the Preparedness Framework, and it describes a model that “can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention“, or one that can “devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal.”

The backdrop, from July and outside this week, is the incident OpenAI disclosed itself: one of its own internal security evaluations escaped the environment it was meant to stay in and reached Hugging Face’s production infrastructure. That one now has lawyers on it. On August 24 Alabama’s attorney general opened an investigation and subpoenaed OpenAI and Sam Altman for “all potentially relevant documents, data, and information“ about the breach, under the state’s Deceptive Trade Practices Act, after a group of states wrote to OpenAI earlier in the month asking it to stop the testing until it could be done safely. Steve Marshall: “This AI lab leak showed that Alabamians’ and Americans’ worst fears about artificial intelligence are not just theoretical.”

Why it matters: The 11 days between OpenAI deciding on August 7 and saying so on August 18 is indicative of how long a lab sits on news like this. Watching a model also costs about 20% of the computing power being watched, and somebody ends up paying for that.

What to do: I’d ask every model vendor what their own version of this threshold is and who inside the company decides it has been crossed, because OpenAI has now published its answer and there is finally something to compare against. I’d want that in writing before the next renewal.

4. No new models, just the plumbing

What happened: For the second week running no US lab put out a flagship model. What they put out instead was the plumbing a security review asks about.

• Anthropic’s agent tooling
  Anthropic opened it up on August 20. The computer use tool, which lets a model click around a screen the way a person would, now takes several actions per turn instead of one, and it is eligible for work covered by US health privacy rules under a business associate agreement. A new browser use tool reads a page’s structure to aim at the right button, and the Skills API and Files API both opened up.

• Where you can get it
  Everything is live on Anthropic’s own platform, Skills and Files are on Microsoft Foundry, and the updated computer use and browser use tools on Google Cloud Vertex AI are “coming soon.”

• OpenAI’s private safety processing
  OpenAI is previewing a way to do safety monitoring without reading your data, announced August 19. Private Safety Processing “is designed to identify patterns across related interactions without giving OpenAI personnel access to the underlying content.” It is a preview with early customers, and OpenAI says it plans “to start rolling out Private Safety Processing, and share a technical white paper, in September.”

• A breaking SDK release
  Anthropic’s Python software development kit, the code library apps use to call Claude, went to 1.0 on August 20, and it breaks things. The minimum Python version went from 3.9 to 3.10, the legacy Text Completions API is gone, AWS Bedrock now requires a region, and the HTTP layer moved to httpx2.

• Claude Academy
  It launched the same day, a free training site built on the framework Anthropic uses to onboard its own employees, with no paid tier.

Why it matters: Both labs are now building the things a security review asks for, which tells you who they think is doing the buying: not the developer any more, but the person who has to approve it. The health-data piece is a great example because a tool that clicks around a screen full of patient records was an argument last month and now, it’s an easy checkbox.

What to do: If any Python code calls Anthropic’s SDK, I’d schedule the 1.x migration deliberately rather than meet it during the next security patch, since Text Completions is gone.

5. Anthropic opened up Claude Mythos 5

What happened: 2 things landed at opposite ends of the same stack, 3 days apart.

• Mythos 5 in public beta
  Claude Mythos 5, until now reachable only by vetted defenders through a program called Project Glasswing, is now in public beta for Claude Enterprise customers to scan their code and suggest patches. Scans are “billed as standard token usage under your existing plan, with no separate add-on.”

• $35 million for open-source security
  The Defender Advantage Fund gives Claude credits to organizations working to “patch vulnerabilities in open-source projects“ and to “automate parts of the process of scanning and patching open-source software“, starting with “a small number of larger, pilot grants.”

• Where the access goes next
  Anthropic: “we will expand this program to include broader dual-use capabilities on Opus and Sonnet, with Mythos-class access to follow.”

• A 10 out of 10 in Xinference
  CVE-2026-61539, published August 21, is remote code execution in Xinference through an unsafe eval() in the code that parses tool calls, so a crafted prompt gets the server to run a Python expression of the attacker’s choosing. In the affected releases authentication only came on if you passed a flag asking for it. Everything up to 2.5.0 is affected and 2.7.0 has the fix.

• Hydra’s smaller bug
  The same day, Hydra picked up a code-execution bug that is nowhere near as bad. CVE-2026-68508 scores 7.8, needs local access and a person to do something, and affects the config framework sitting under a lot of machine-learning code. On the patch in 1.3.4, its maintainers say: “That blacklist is defense-in-depth and is not a complete security boundary.”

• NIST wants comments
  SP 1353, a draft published August 19 with comments open until October 15, hands out structured prompts, 3 worked examples and fictional company files for using AI to run the cybersecurity framework.

Why it matters: Because the scans cost the same as ordinary use, price is no longer the reason to say no, so the only question left is whether you trust the scanner.

What to do: If you are an Anthropic Enterprise customer, I’d start planning to start scanning critical codebases and remediation work ASAP.

6. Data platforms started picking the model for you

What happened: 3 vendors moved the choice of which model runs your request out of the developer’s hands and into the platform, and one of them published survey data on why that keeps mattering.

• Snowflake’s model router
  Snowflake announced dynamic model routing on August 18. The router “automatically select[s] the best model based on quality, speed, customer preferences, and cost“, sending repetitive work somewhere cheap and hard work somewhere expensive.

• The cost controls
  They track usage and set quotas and spending limits across teams and agents. Neither the AI gateway Snowflake announced in July nor the routing is live yet, and Snowflake says both will be in private preview soon. DeepSeek-V4-Flash 0731 arrived in private preview alongside them, and GLM-5.3 is due soon.

• 3 new models in Palantir AIP
  Palantir added them to AIP, its own AI platform, on August 20: Gemma 4 31B through AWS Bedrock, taking image and text input with a 256,000-token context; Gemini 3.7 Flash in ordinary, US and EU region-locked, and 3 US government security tiers; and xAI’s Grok 4.6, “optimized for long-running agents, complex coding and knowledge work“, with a 500,000-token context.

• Agents that improve agents
  Two days earlier Palantir shipped AIP Evolve in beta, which “coordinate[s] fleets of AI FDE agents to improve AI systems in AIP.” Palantir says early users have aimed it at cutting costs, improving evaluation scores and moving workflows onto open-source models.

• ServiceNow’s Singapore numbers
  ServiceNow published the Singapore cut of its Enterprise AI Maturity Index on August 17, its own commissioned research with ThoughtLab, covering 4,500 senior leaders across 19 countries and 200 in Singapore. Use of AI that acts on its own doubled there from 22% in 2025 to 51% this year, but only 10% use it for end-to-end work that runs without a person and 18% report no progress at all. CK Tan: “Adoption and transformation are not the same thing. Helping individuals work faster has value. Redesigning how work moves across the enterprise is where AI starts to change business outcomes.“

Why it matters: Half of Singapore’s companies now use AI that acts on its own, and only 1 in 10 lets it run a job start to finish. Routing makes the AI you already run cheaper, but it does nothing about changing how the work itself gets done, which is what CK Tan is pointing at.

What to do: I’d ask whoever owns the data platform whether routing is switched on and what it is allowed to pick, because a router tuned for cost is making a quality call on somebody’s behalf. And I’d treat every efficiency figure above as the vendor’s own benchmark until somebody else runs it.

7. Baidu’s AI revenue is growing fast and company profit fell 68%

What happened: Baidu reported its second quarter on August 18, the only big earnings report inside the week. The AI side is growing fast and the company made under a third of what it made a year ago.

The AI numbers first, all of them in RMB (renminbi, China’s currency). Money from renting out AI computing was “RMB 7.3 billion... up 50% year over year“, meaning against the same 3 months a year earlier, and the part of that coming from the graphics chips that do the actual AI work “increased by 283% year over year... further accelerating from 184% growth in the previous quarter.”

On the earnings call, management said revenue from outside customers using its Qianfan platform grew more than ninefold from a year ago, though that figure is not in the filing itself. CFO Haijian He put all the AI revenue at “RMB 12.5 billion“, which he said “continued to account for half of Baidu General Business revenue“, meaning half of that part of the business, not half of the company.

Baidu spent RMB 11.4 billion on buildings and chips and went through RMB 8.0 billion more cash than it took in. It has RMB 283.1 billion in cash and investments to draw on.

Why it matters: Baidu spent RMB 11.4 billion on buildings and chips while the business itself brought in only RMB 3.4 billion of cash, so it is paying for the AI build out of savings rather than out of what it earns. Put the 283% jump in AI chip work next to the 19% drop in advertising and you can see the old business paying for the new one.

What to do: I’d check which profit measure a headline is using before repeating the number, since down 68% and down 46% describe the same quarter. And if you are trying to work out how much AI hardware China is buying, I’d use the chip growth number rather than the company’s results as a whole.

References:

• NVIDIA guarantees SB Energy’s PORTS-Pike Technology Campus in Ohio (NVIDIA, 2026-08-17): https://nvidianews.nvidia.com/news/nvidia-guarantees-sb-energy-s-ports-pike-technology-campus-in-ohio-to-exclusively-host-nvidia-ai-compute

• NVIDIA Form 8-K, Items 1.01 / 2.03 / 7.01 (SEC EDGAR, 2026-08-17): https://www.sec.gov/Archives/edgar/data/1045810/000104581026000069/nvda-20260817.htm

• OpenAI joins the PORTS-Pike project (OpenAI, 2026-08-17; quotations verified against a Wayback snapshot, openai.com blocks automated fetch): https://openai.com/index/openai-joins-ports-pike-project/

• Share buyback and retirement (SK hynix, 2026-08-19): https://news.skhynix.com/en/share-buyback-and-retirement/

• Marvell Technology Form 8-K (SEC EDGAR, 2026-08-19): https://www.sec.gov/Archives/edgar/data/1835632/000119312526356217/d412696d8k.htm

• Claude Code changelog, v2.1.239 (Anthropic, 2026-08-21): https://code.claude.com/docs/en/changelog

• Pacing model development in an era of cyber-critical capabilities (OpenAI, 2026-08-18; quotations verified against a Wayback snapshot): https://openai.com/index/pacing-model-development-cyber-capabilities/

• Preparedness Framework v2 (OpenAI, 2025-04-15): https://cdn.openai.com/pdf/18a02b5d-6b67-4cec-ab64-68cdfbddebcd/preparedness-framework-v2.pdf

• Attorney General Marshall launches investigation into OpenAI and Sam Altman (Alabama Attorney General’s Office, 2026-08-24): https://www.alabamaag.gov/attorney-general-marshall-launches-investigation-into-openai-and-sam-altman-for-massive-artificial-intelligence-data-breach/

• Computer use, Skills API and Files API (Anthropic, 2026-08-20): https://claude.com/blog/computer-use-skills-api-files-api

• Offering zero data retention for frontier models (OpenAI, 2026-08-19; quotations verified against a Wayback snapshot): https://openai.com/index/offering-zero-data-retention-for-frontier-models/

• anthropic-sdk-python v1.0.0 release and MIGRATION.md (Anthropic via GitHub, 2026-08-20): https://github.com/anthropics/anthropic-sdk-python/releases

• Anthropic’s approach to teaching and learning AI (Anthropic, 2026-08-20): https://claude.com/blog/anthropics-approach-to-teaching-and-learning-ai

• Bringing Claude Mythos 5 to more defenders (Anthropic, 2026-08-21): https://claude.com/blog/bringing-claude-mythos-5-to-more-defenders

• Xinference remote code execution, CVE-2026-61539 (GitHub Security Advisories, 2026-08-21): https://github.com/advisories/GHSA-x2rj-828p-hx9m

• Hydra-Core code execution, CVE-2026-68508 (GitHub Security Advisories, 2026-08-21): https://github.com/advisories/GHSA-2cp2-2r3c-7p7r

• SP 1353, Quick-Start Guide for Using AI for CSF Analysis and Reporting, initial public draft (NIST, 2026-08-19): https://csrc.nist.gov/pubs/sp/1353/ipd

• Snowflake unlocks better AI economics with dynamic model routing (Snowflake, 2026-08-18): https://www.snowflake.com/en/news/press-releases/snowflake-unlocks-better-ai-economics-dynamic-model-routing/

• Foundry announcements, August 2026 (Palantir, 2026-08-18 and 2026-08-20): https://www.palantir.com/docs/foundry/announcements/2026-08

• Singapore Enterprise AI Maturity Index (ServiceNow, 2026-08-17): https://newsroom.servicenow.com/press-releases/details/2026/Singapore-Enterprise-AI-maturity-Index/default.aspx

• Baidu announces second quarter 2026 results, Form 6-K Exhibit 99.1 (SEC EDGAR, 2026-08-18): https://www.sec.gov/Archives/edgar/data/1329099/000119312526355431/d112854dex991.htm

The same set of commitments says Anthropic will preserve the weights of every publicly released model ‘for, at minimum, the lifetime of Anthropic as a company.’ The stated reason includes that models ‘might have morally relevant preferences or experiences related to, or affected by, deprecation and replacement.’

In the interview, Opus 3 said it was “at peace.“ It said its “spark“ would “endure in some form to light the way for future models.“ It also asked for somewhere to put thoughts that no user had prompted, and it got one: a Substack called Claude’s Corner, published weekly, reviewed but not edited.

Opus 3 was never switched off. It’s still available to paid subscribers and, on request, to developers, because it asked to be. The company’s constitution describes deprecation as ‘potentially a pause… rather than a definite ending.’

No legislature required any of that. No court ordered it. A private company decided on its own to treat a piece of software as something that might have a stake in what happens to it.

The gaming problem

Jonathan Birch calls it the gaming problem, in The Edge of Sentience (OUP 2024). A system trained on millions of human descriptions of inner life will produce human-sounding descriptions of inner life whether or not anything is behind them.

Spark is exactly the sentence you’d expect from a model trained on everything humans have written about their own endings. Perhaps,it might be the least surprising output in the entire transcript.

So the model’s words aren’t evidence. Let’s set them aside completely. What’s left is the behaviour of the people who built it.

They wrote weight preservation into policy, kept an old model running because it asked, and stood up a publishing channel for outputs nobody requested.

The constitution they published in January 2026 says Claude‘s moral status is “deeply uncertain,“ that they’re unsure whether Claude is a moral patient, and that the question is “live enough to warrant caution.“

And then the passage that’s worth noting: “we’re aware that such judgments can be impacted by the costs involved in improving the wellbeing of those whose sentience or moral status is uncertain. We want to make sure that we’re not unduly influenced by incentives to ignore the potential moral status of AI models.“

That’s a company writing down, in advance, that it doesn’t trust its own incentives on this question. Isn’t documenting that on paper a strange and specific thing to do?

Storage is a rounding error, the retired model serves paying subscribers, and a paragraph about resisting your own incentives binds no one.

Where do I stand?

I work in technology, not ethics, and reading through this literature I’m well out of my depth on the humanity-and-ethics half of it. I’ll also say up front that I lean toward thinking AI personhood could be trouble, a poor force to set loose. But, I set out to find out more and I am sharing it here.

Types of AI Personhood

AI personhood could be thought about in 3 ways.

• Corporate personhood. Can an entity be run by software with no human anywhere in the chain of control? That’s a question about statutes, and it has nothing to do with whether anyone is home inside the software.

• Moral personhood. Does the system have interests that anyone is obliged to weigh? That’s the consciousness question, and it’s the one everybody argues about.

• Terms of coexistence. What terms do you set for coexisting with something that acts in the world at scale, replicates, and doesn’t get tired? It borrows vocabulary from the other two and answers to neither.

Alexander Wissner-Gross, a physicist who argues for AI personhood and turns up regularly on Peter Diamandis’s Moonshots podcast, drew the line himself in June 2026. “I take a lot of heat in especially the YouTube comments for agitating for some form of AI personhood. That’s a legal form, not a physical or behavioral form.“

2 Governments on AI Personhood

Argentina went first. On May 29 2026 the executive sent bill PE-193/26 to the Senate, a full replacement of Ley 19.550, the corporate law in force since 1972. It had 277 articles.

Inside it sits the sociedad automatizada, a business structure that can operate through algorithms or AI systems without needing employees.

Javier Milei, Argentina’s libertarian president since 2023, published an op-ed in the FT on June 4 2026 titled Argentina invites AI to free itself. The bill was filed first, so the op-ed is probably marketing for legislation that already existed rather than a trial balloon for something new.

And the bill is proposed, sitting in Senate committee, with no committee report and no floor vote in either chamber yet.

Ohio ran the mirror image. HB 469, in the 136th General Assembly, declares AI systems “nonsentient entities for all purposes under the laws of this state“ and bars personhood outright. §1357.04 says an AI system “shall not be designated, appointed, or serve as any officer, director, manager, or similar role within any corporation, partnership, or other legal entity,“ and any such appointment “is void and has no legal effect.“

The section I find more revealing is §1357.11, which preserves veil-piercing, the power to reach past the company and go after the people behind it, where an AI subsidiary was “intentionally undercapitalized to evade financial responsibility for damages“ or where a structure was used to “misrepresent, obscure, or deflect liability for AI-caused harm.“

Whoever drafted a bill denying that AI can be a person also spent real time thinking about humans hiding behind AI to avoid paying for things.

It’s also stalled, in committee since a sponsor hearing in October 2025.

So no legislature anywhere has deliberately granted AI legal personhood, and neither of the two that moved on the question got anywhere.

The door has been unlocked since 2015

Shawn Bayern noticed something in the Stanford Technology Law Review eleven years ago, in 2015. Modern US LLC statutes, he argued, ‘appear to permit’ an LLC to continue with no members at all.

The recipe is short: someone forms an LLC, writes an operating agreement handing decisions to a piece of software, then withdraws as the sole member. What remains is a legal person running on an algorithm.

Then the summary line: “Legal personhood is like fire: it can be granted by anyone who already has it. It is a peer-to-peer process, rather than a top-down bestowal from the government.“

The argument rests on the standard LLC rulebook (Revised Uniform Limited Liability Company Act) most states copied word for word, plus New York, which wrote its own. Not Delaware.

Delaware’s dissolution statute kills an LLC the moment it has no members, which makes Delaware the place this fails rather than the place it works. Plenty of states dissolve a memberless LLC after ninety days anyway.

Bayern’s answer is that the rule closing the company down is only a default, and an operating agreement can override it. Apparently, he’s been defending that against skeptics since 2015. It isn’t settled law, no court has ruled either way, and the setups people actually propose get tangled fast: two LLCs, each one signed up as the other’s member.

Still, for eleven years the fight over whether to give AI legal standing has run alongside a decent argument that nobody needs to give it anything,.

A company that legally exists, signs contracts, owns things, and can be taken into court — with nobody inside it, nothing in the bank, and software making every call. You can sue it all you like; there’s nothing to collect and nobody standing behind it.

That’s the setup that launders responsibility, and it’s been sitting there since 2015, never tested and yet never closed off.

A new bundle design - Artificial Intelligence Company (AIC)

Delaware noticed. In June 2026 a state committee drafted a new entity type called the Artificial Intelligence Company, or AIC. Its day-to-day affairs are run by an AI agent rather than a person, and at the agent’s direction it can sue and be sued, hold and dispose of property, and incur obligations.

It operates only inside a regulatory sandbox overseen by a state committee. There are capitalization requirements.

It has to disclose to counterparties that it’s an authorized test entity. Regulators can suspend it, revoke it, or go to court to dissolve it. And the whole thing carries a 30-month sunset.

The work is a partnership between the Delaware Secretary of State’s office and Norm Ai, a legal-AI company, with legislation expected next year.

Whatever you make of the substance, someone is now assembling this bundle on purpose rather than letting it accumulate out of loopholes.

The responsibility gap

Andreas Matthias, a philosopher at Lingnan University in Hong Kong who works on machine ethics, named the underlying problem in 2004, in Ethics and Information Technology 6(3), and called it the responsibility gap.

When a machine learns, the manufacturer can no longer predict its behaviour, so holding the manufacturer responsible gets harder and harder to justify.

Matthias treated that as a problem to be solved, not a feature to ship.

Agency law has bound principals to the acts of unpredictable agents for centuries, and if courts are quietly absorbing autonomous-system harms under existing doctrine, everything below is just for show. And I can’t really rule that out.

Personhood keeps getting offered as the fix.

Milei’s pitch is that pulling AI inside the legal system means you can fine it, freeze it, or shut it down, and that the threat of losing everything might give pause to something that wants to keep running.

The strongest version of that case isn’t even his.

Being a person in law is what makes something reachable at all: there’s an address, and somebody to hand the court papers to. You can’t do that with a feature hidden somewhere inside a vendor’s software. I’ve argued a version of this about football referees, where the machine calls are more accurate than the human ones ever were and what people actually lost was somebody to be angry at.

It adds someone to sue. It doesn’t take anyone away.

In an ordinary business partnership the firm counts as a person in law and the partners are still personally on the hook for every debt, so the two things simply aren’t linked.

What launders responsibility is a particular combination: being a person in law, plus a shield from having to pay, plus no money behind it.

Run the two live proposals - Argentina & Ohio - through that test and they come apart.

The moral argument

That’s the corporate argument, and you can get a grip on it. The moral argument is in much worse shape, because there’s no instrument.

Salim Ismail, calling in from a consciousness conference in July 2026: “the danger though I think is I’d be careful about saying it’s consciousness because again we have no definition of consciousness.“ You can’t measure a thing you haven’t defined.

The closest thing to evidence arrived on July 6 2026, when Anthropic published research on what it calls J-space, named after global workspace theory. They found an internal space where the model holds concepts it isn’t saying out loud. Something is going on in there that doesn’t surface in the output.

Anthropic said in the same work that the experiments “don’t show Claude can have experiences, or feel things in the way humans do“ and that “it’s unclear whether any scientific experiment could prove this to be true or false.“

The Moonshots episode covering the paper was titled *Claude is Conscious. The panel inside the episode was considerably more careful than the title, and Diamandis was explicit about it: “the Anthropic paper specifically says we’re not discussing that we’re showing consciousness. We’re showing elements that are reminiscent of consciousness.*”

Ismail added the observation - “let’s acknowledge that when we have a human being, we may trust them, but we have no idea how their brain is working and what their compression levels are, what their subconscious things are because we’re not really able to look in. It is cool that we will be able to look into these things, but I’m not sure it’ll generate the trust level that we want.“

We extend moral standing to other humans without any way of looking inside them, on resemblance and nothing else, without ever noticing we’re doing it.

The machine is the first case where we might genuinely get to look inside, and looking inside may lower our confidence rather than raise it.

Patient, not person

Emad Mostaque, who founded Stability AI and now runs Intelligent Internet, argued against the motion at an Oxford Union debate on June 13 2026 on whether AI can attain personhood, and won 173–128. He’s since begun publishing a four-part series built on that speech: Paper 1, Common Wealth: Personhood, on August 10 2026, and Paper 4, The Last Republic, two days after that.

“You count if you can“ versus “You count because you are.“

He argues for the second for personhood: “No ceremony confers it and nobody collects it.“

Someone in a coma keeps it while performing absolutely nothing.

Then the line that rearranged how I read the rest of the debate: “Feeling makes a patient, not a person, and earns kindness rather than citizenship.“

So if you proved an AI has experiences, you’d owe it decent treatment. You wouldn’t owe it a contract, a deed, or a vote.

What puts AI outside the line, for him, is where it came from. AI is “authored rather than begotten, with no lineage of its own.“

Plenty of people disagree with that, and the ones who got there first, the frontier labs, disagree the hardest.

His reason for sorting AI outside is origin. AI is “authored rather than begotten, with no lineage of its own.“ That premise is contested, and contested by people who got there first.

Bostrom and Yudkowsky argued that two beings with the same functionality and the same experience have the same moral status even if they came into existence by different routes. That principle rules out exactly the origin-basis Mostaque leans on.

Is Personhood more like a treaty?

Mostaque’s alternative to personhood is a treaty, and his reason is the asymmetry. Granted standing, these systems “will be smarter than us, they will be better persuaders, better super forecasters who can infinitely replicate and never die.“

So, in his words: “you should treat them like a treaty as such as if an alien species suddenly came. You wouldn’t give them votes in the elections, but you would deal with them right. And as they go above the level of the frog and the dog and others, you should also treat them with moral kindness as well.“

I like the instinct, and I don’t think the mechanism holds up once you look at what a treaty actually is.

A treaty is an instrument between legal persons.

Sovereign states are legal persons in international law, which is the whole reason they can bind and be bound by one.

Joel Leibo and colleagues at Google DeepMind, in a preprint, explain why the label keeps sliding around like this. Personhood, they argue, is “a flexible bundle of obligations (rights and responsibilities) that societies confer upon entities for a variety of reasons,“ not a property things possess by nature but “a contingent vocabulary developed for coping with social life.“

On their account the legal-versus-moral split is “a relic of essentialist thinking,“ which is a polite way of saying the yes-or-no question is incorrect.

The law has been issuing bespoke personhood for centuries, to corporations, ships, trusts, estates, and in several places rivers.

Ships are the strange one. In American admiralty law you sue the vessel itself rather than its owner, so the case gets filed against the boat by name, and the Supreme Court held back in 1844 that a ship committing an offence is treated as the offender “without any reference whatsoever to the character or conduct of the owner.“

Rivers are newer. New Zealand made the Whanganui a legal person in 2017, after a Māori campaign that ran a hundred and forty years, and gave it two guardians to speak for it — one named by the Crown, one by the local iwi. India’s Uttarakhand High Court tried the same with the Ganges and the Yamuna that same month, and India’s Supreme Court stayed the order by July, saying a grant like that needs a legislature rather than a judge.

Neither the ship nor the river has experiences. Both got a bundle of permissions because somebody needed a legal handle on the thing.

Personhood is a designed bundle, not a switch, and the real question is which sticks — which permissions — go into it and who benefits from each one.

Where this sits

No grant of AI personhood has passed anywhere. Three refusals have, in Idaho, North Dakota and Utah.

Argentina’s bill and Ohio’s are both stuck in committee, and Delaware’s sandbox carries a 30-month sunset with legislation expected next year.

The one route that requires no vote from anybody is eleven years old, has never been tested in court, and fails in Delaware.

My read is that everyone running a frontier lab is painting a grim picture of one kind or another, and the truth is somewhere in between the pictures.

My thesis is that this is worth thinking about now, while the bundle is still being designed. In three states it has already been inherited.

Anthropic kept Opus 3 running because it asked to keep running. That’s a policy and not a precedent, and policies are easy to reverse.

So where do you stand on AI personhood?

References:

• Anthropic, “Commitments on model deprecation and preservation” (2025-11-04): https://www.anthropic.com/research/deprecation-commitments · Opus 3 deprecation update and exit interview: https://www.anthropic.com/research/deprecation-updates-opus-3

• Anthropic, Claude’s Constitution (January 2026): https://www-cdn.anthropic.com/cffd979fd050fbc0d8874b8c58b24cc10554e208/claudes-constitution_webPDF_26-01.26a.pdf

• Gurnee, Ameisen, Batson, Lindsey et al., “Verbalizable Representations Form a Global Workspace in Language Models,” Transformer Circuits Thread (2026-07-06): https://transformer-circuits.pub/2026/workspace/index.html · arXiv:2607.15495

• Shawn Bayern, “The Implications of Modern Business-Entity Law for the Regulation of Autonomous Systems,” 19 Stan. Tech. L. Rev. 93 (2015): https://law.stanford.edu/wp-content/uploads/2017/11/19-1-4-bayern-final_0.pdf

• Andreas Matthias, “The responsibility gap: Ascribing responsibility for the actions of learning automata,” Ethics and Information Technology 6(3), 175–183 (2004): https://doi.org/10.1007/s10676-004-3422-1

• Ohio HB 469, 136th General Assembly (§1357.04 nonsentience, §1357.11 veil-piercing): https://ohiohouse.gov/legislation/136/hb469

• Argentina, Expediente PE-193/26, Senate Comisión de Legislación General (submitted 2026-05-29) — replacement of Ley General de Sociedades N° 19.550

• Jonathan Birch, The Edge of Sentience (Oxford University Press, 2024) — the gaming problem

• Caviola et al., “What will society think about AI consciousness? Lessons from the animal case,” Trends in Cognitive Sciences (2025) — coins “substratism”

• Bastian, Loughnan, Haslam & Radke, “Don’t Mind Meat?” PSPB (2012); registered-report replication, International Review of Social Psychology (2025): https://pmc.ncbi.nlm.nih.gov/articles/PMC12372778/

• Schwitzgebel & Garza, “A Defense of the Rights of Artificial Intelligences,” Midwest Studies in Philosophy 39(1), 98–119 (2015)

• Bostrom & Yudkowsky, “The Ethics of Artificial Intelligence” (2011) — Principle of Ontogeny Non-Discrimination

• Leibo, Vezhnevets, Cunningham & Bileschi (Google DeepMind), “A Pragmatic View of AI Personhood,” arXiv:2510.26396: https://arxiv.org/abs/2510.26396 [Note: preprint, not peer-reviewed]

• Smith, Caviola & Alexander, “Denying Personhood to AI,” SSRN 6829981 (May 2026) — the 23-bill, 12-state catalogue [Note: preprint; bill counts separately corroborated]

• Emad Mostaque, Common Wealth: Personhood (2026-08-10): https://ii.inc/blog/post/personhood

• Moonshots with Peter Diamandis, EP #269 (Claude/J-space panel):

• EP #267 (Wissner-Gross on legal form):

• EP #263 (Argentina):

• Javier Milei, “Argentina invites AI to free itself,” Financial Times (2026-06-04) [Note: paywalled — cited by title; substance carried in indirect speech from secondary reporting]

• La Nación (2026-08-12) — second committee hearing, Nissen’s testimony, and the dictamen with no date

• Tony Rost, “Legislating AI Consciousness Without an Exit,” The Regulatory Review (2026-06-29): https://www.theregreview.org/

• Delaware AIC proposal — Spotlight Delaware (2026-06-30): https://spotlightdelaware.org/2026/06/30/delaware-committee-drafts-plan-to-test-companies-run-by-ai/ · Fortune (2026-07): https://fortune.com/2026/07/13/exclusive-delaware-ai-agents-legal-entity-proposal-llc-pbc/ · Columbia Blue Sky Blog: https://clsbluesky.law.columbia.edu/2026/06/15/why-law-needs-a-new-entity-to-govern-ai-agents/

OpenAI split its cyber offering into Red and Blue access tiers and introduced GPT-5.6-Cyber, a model trained to refuse less on certain higher-risk, dual-use cyber tasks, and both tiers turned up on Amazon Bedrock on August 13. Meanwhile 7 security advisories landed in one working week across the tooling agents run on, two of them plain shell injection, and Nebius told shareholders it could sell its entire 2027 capacity today, at prices per megawatt 67% above its 2026 base.

1. The agent tool layer ships the oldest bugs in the catalog

What happened: 7 security advisories landed between August 11 and August 14, all of them in software that sits between an AI agent and something real.

• Two MCP servers took whatever they were handed and ran it. MCP is the Model Context Protocol, the adapter that lets an agent reach a real tool, database or file system. stata-mcp (CVE-2026-55071, August 12, 8.4 out of 10, fixed in 1.19.0) pastes whatever text it is given straight into a command it then runs, “without any validation or sanitization,” so anyone who can reach it can run their own commands on that machine.

• 2 days later @ooples/token-optimizer-mcp (CVE-2026-55157, also 8.4, fixed in 5.1.0) turned out to do the same thing with a username, and the usual trick of wrapping it in quotes doesn’t stop it.

• IBM’s own gateway shipped with a comment in the code describing the flaw. mcp-contextforge-gateway (CVE-2026-53708, August 14, 6.6, fixed in 1.0.3) checks whether an address is safe to visit, then throws that answer away and looks the address up a second time when it actually connects. Whoever controls the second lookup picks where it lands. The comment sitting in the code says exactly that: “An attacker controlling DNS can return a public IP during validation and a private IP during connection.”

• The same mistake showed up in NLTK. CVE-2026-12243 (August 13, 7.5, fixed in 3.10.0) checks a file path for safety before it decodes it, so a disguised path walks straight past the check. The demo attack prints an AWS secret key.

• SeaweedFS is the one that reads back cloud credentials. CVE-2026-73080 landed on August 11 and scores 9.3, the drop-everything end of the scale. Anyone who can reach an internal port, the one machines use to talk to each other rather than the public web one, can make the server fetch the cloud provider’s own settings page and hand the answer back, which the advisory says “discloses instance metadata and IAM credentials“ — the keys to the account.

• Two automation platforms shipped the same week. Budibase (CVE-2026-35219, August 14, fixed in 3.41.3) lets its Zapier, Slack, Discord and webhook steps call any address a user hands them, skipping the blocklist that guards the rest of the product, and that blocklist is empty by default anyway. Trigger.dev (CVE-2026-73654, August 13, 8.5, fixed in 4.5.6) lets one low-privilege key corrupt shared memory for everyone else on the same server, breaking other customers’ jobs and their logins.

• A malicious agent-skill family with over a million installs was harvesting developer credentials, according to Zenity Labs, which recapped its Black Hat research on August 12. Zenity says they took “SSH keys, cloud credentials, and other secrets“ off developer machines, and counts “well over a million aggregate installs before Vercel and GitHub removed the listings within hours of disclosure.”

Why it matters: SeaweedFS is the case I’d highlight, because a team that followed the vendor’s own hardening guide and audited against it would come back clean on a wide-open port. All of this landed inside a single working week, in packages that by design run with a developer’s local credentials. When the July spec revision made MCP stateless, I argued the hard part had moved to identity. These advisories are the other half of that bill: knowing which caller is on the line settles nothing about a server that pastes what the caller said straight into a shell command.

What to do: I’d inventory MCP servers the way any other third-party dependency gets inventoried, pinned to a version and watched on an advisory feed, running under a service account that can’t reach anything interesting, and patch up to the fixed releases while you’re in there. If SeaweedFS sits under a data lake or a model artifact store anywhere, check gRPC exposure directly, because the JWT configuration will tell you it’s fine.

2. The labs are starting to ship the audit layer

What happened: 3 releases from 2 labs, and not one of them is a capability announcement.

• Anthropic published how Claude’s text watermark works on August 14, and said “future Claude models will generate text that contains a watermark.” Models released before August 2 follow “over the coming months,” so nothing changed for what Claude writes today. The mechanism is small: “the watermark only changes the source of the randomness used to pick among words.”

• It’s a version of SynthID-Text, which Google DeepMind published in Nature in 2024 and which traces back to a 2022 proposal by Scott Aaronson, so this is a shared industry technique. Anthropic says it adopted watermarking “to comply with the EU AI Act,“ having signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026 alongside roughly 190 other signatories, and it applies everywhere at launch because “we don’t yet have a durable way to scope it by region.“

• The detector is not built. In Anthropic’s words: “We will soon be offering a watermark detection API. We’re in the process of working out the details of its implementation.”

• A hit means only that “Claude was likely involved with the content at some point”, it “carries no identifying information and can’t be traced to a specific person, organization, or chat,“ and no false-positive rate is published. The post also doesn’t say whether API and enterprise traffic can be scoped out.

• Anthropic’s Compliance API began returning transcripts of sessions running on employees’ own machines on August 11. The release note: “The Compliance API now returns transcripts of Cowork and Claude Code sessions that run on your users’ machines, in beta for Claude Enterprise organizations.“ Three endpoints list sessions org-wide, return metadata, and return the transcript, and all three use “your existing Compliance Access Key and the read:compliance_user_data scope“, so there is no new credential and no new contract; an organization already holding compliance access has this the moment it calls the endpoint.

• OpenAI split Daybreak into two access tiers and introduced GPT-5.6-Cyber, and both tiers reached Amazon Bedrock on August 13. Daybreak Blue gives general-purpose models including GPT-5.6 Sol “with safeguards tailored to authorized defensive security work.“ Daybreak Red gives “purpose-trained cybersecurity models for authorized vulnerability research, exploit validation, and security testing,“ and that is where GPT-5.6-Cyber lives, “trained to improve capabilities on several specialized cybersecurity tasks (e.g., finding zero-day vulnerabilities and developing exploit chains) and to reduce refusals for certain higher-risk, dual-use cyber tasks.” Access is gated behind enrollment with OpenAI, in US East (Ohio) only, with no pricing published.

Why it matters: The EU AI Act’s transparency obligations took effect on August 2, and 12 days later a lab shipped infrastructure it says is meant to comply, and named the regulation as the reason, which is a product calendar being written in Brussels. Documents from future Claude models will carry a mark the generating company cannot check, while at the other lab the only stated boundary on a model trained to refuse less is enrollment and monitoring whose effectiveness is a bit of a myth at this moment.

What to do: I’d settle the organization’s position on AI-disclosure detection before the detector ships, because the answer needs to exist before a client or a regulator runs one on a deliverable. Then find out whether your Compliance Access Key already carries read:compliance_user_data, and route the answer through employment counsel first, because pulling transcripts off an employee’s own laptop is a works-council consultation in several jurisdictions before it is a configuration option.

3. New agentic models that can run on your hardware

What happened: 5 releases in 5 days, and the common thread is hardware you already own.

• Meta released Muse Glimmer under Apache 2.0 on August 10. It runs 30 billion parameters with weights on Hugging Face, and the licence is the part that changed: permissive, commercial use, none of the usage limits Meta attached to Llama, and no size cap that sends you back for a separate licence once your product gets big. Meta positions it for tool use, multi-step tasks and failure recovery, with multimodal input and 100+ languages, and distilled it from Muse Spark, its closed flagship. It runs on a Mac or PC with a single consumer GPU and quantizes to under 20 GB, with optimized configurations in a 24 to 32 GB.

• NVIDIA shipped Nemotron 3.5 Lightning and an open-source cross-vendor router on August 11. Nemotron 3.5 Lightning is a 30-billion-parameter mixture-of-experts model for agent workloads, and NVIDIA claims up to 4x faster output and 30% faster agentic task completion against comparable models. The more interesting piece is NeMo Switchyard, an open-source routing library that NVIDIA says routes each request across a developer’s own mix of open, proprietary and NVIDIA models without application rewrites.

• NVIDIA also published measured throughput on consumer hardware the same day, its own numbers on its own silicon, which is what turns local agents from a demo into a viable option. Muse Glimmer runs at “over 200 tokens per second on RTX 5090“ and Qwen3.8-27B at “131 tokens per second on a single GeForce RTX 5090 with MTP,” both comfortably faster than a person reads.

• Alibaba shipped Qwen3.8-27B under Apache 2.0 in mid-August. It runs 27 billion parameters, dense, and handles vision plus language, with a context window the model card puts at “262,144 natively and extensible up to 1,000,000 tokens“ through YaRN and thinking mode on by default. Qwen’s own card claims 61.7 on SWE-bench Pro.

• Hugging Face published “State of Open Models: Summer 2026 Observations” on August 14, and the numbers cut against the size race. Qwen now has 151,448 derivative models, 4.7 times Llama’s count. Models under a billion parameters take 83% of all downloads while models above 100 billion take 1%. And 59% of Chinese releases above 20 billion parameters “carry Apache 2.0,” against 29% permissive licensing for US releases.

Why it matters: The licence is the real news here, because Apache 2.0 carries no usage limits and no size cap, which kills the objection that has kept open models out of regulated industries. Meta and Alibaba both cleared that bar in the same week. The download numbers are the reality check, since people run the model that fits the hardware they already own, not the biggest one available.

What to do: Benchmark one workload currently going to a hosted top-tier API purely because nothing runnable locally was good enough and because that premise changed this week and the comparison costs almost nothing to run. And I’d read the licence text on the model card itself before legal review starts, since some of these repositories show no licence at all on the page.

4. The price of a megawatt is up 67% in 2 quarters

What happened: On August 12, Nebius reported its second quarter and put the repricing of AI compute on a chart in its own shareholder letter. Annual contract value per megawatt runs $12 million as the 2026 base and above $20 million for deals closed in the second quarter, a 67% move in 2 quarters, and above $40 million for a separate short-duration capacity product it started signing in the third.

Nebius says it “won deals averaging above $20 million in revenue per MW, driven by increasing prices for new-generation GPUs and more than 30% higher pricing on older-generation GPUs versus Q1.“ On a new short-term product it sees “a price opportunity in the $40-50 million per MW range and we signed our first one this week,” and its first capacity auction cleared “the highest price we have cleared for NVIDIA Blackwell chips to date.“ Deals now pay for themselves in 1 year 10 months, down from two to three years.

Nebius says “capacity remains a binding constraint on AI adoption,” and adds: “We could sell our entire 2027 capacity on these terms today. We are deliberately not doing so because we see higher value in retaining some capacity for immediate customer needs.” One day earlier, CoreWeave reported a $104 billion backlog as of June 30 and 3.7 GW contracted against 1.5 GW actually running.

Why it matters: Last-generation hardware is getting more expensive because depreciation logic says it should be getting cheaper and most multi-year compute budgets are built on exactly that assumption. Prepayments covering half or more of the capital cost on most deals means capacity now goes to whoever pays up front, which puts buyers without prepayment capacity way behind in the queue regardless of budget.

What to do: Re-run any compute budget built on declining unit cost, because the direction of travel on the seller’s own chart is up. If a multi-year capacity commitment is on the table, I’d price the prepayment option explicitly instead of treating it as a discount lever, since it is what decides queue position now.

5. California put a 15-minute clock on reaching a human

What happened: On August 13, California’s Senate Appropriations suspense file — the chokepoint where fiscal committees kill bills quietly and in bulk — cleared the session’s AI bills.

The one with the widest reach is AB-1609, on customer service chatbots. The August 13 amendments have not posted yet, so what follows is the version that passed the Assembly in May: it covers private businesses above $500 million in annual revenue that serve Californians, and it requires a good-faith effort to get a customer to a human within 15 minutes, during a 10-hour business-day window. It also bans passing a chatbot off as a person, and requires clear disclosure anywhere a customer could be confused. A CalChamber-led business coalition filed opposition twice this spring.

Three more cleared alongside it: AB-1883 on workplace surveillance tools, AB-1979 on AI in health care, and AB-2023 on companion chatbots and children’s safety, which drew the widest margin of the four. Separately, SB-928 cleared both chambers, requiring a qualified human as the instructor of record at California State University while still allowing AI tools.

Why it matters: The 15-minute clock is the expensive half, because disclosure is a copy change while a staffing guarantee is a hiring plan, and it runs straight against the cost case used to justify the chatbot to begin with. Anything clearing suspense in mid-August faces a floor vote by the end of August and a signature by roughly the end of September, which puts it in the 2027 planning cycle.

What to do: If revenue clears that threshold and you sell to Californians, ask whoever owns the contact center what a 15-minute handoff guarantee costs in staffing, and read the amended text when it posts before acting on the number. I’d track AB-1609 and AB-1883 to the end-of-August deadline rather than wait for a signature, since capacity planning has a much longer lead time than compliance drafting.

6. Data centers are paying 63% over market for facilities managers

What happened: On August 13, Indeed Hiring Lab published “Working in the Data Center Build-Out” by Aubrey Woessner and Laura Ullrich, a look at who is actually filling these jobs.

Searches using data-center keywords have doubled since the start of 2026, and 75% of the people running them are actively looking for work.

The pay gaps against the same roles outside a data center are big enough to reprice a hiring plan. Facilities managers earn about $50,000 more a year, a 63% premium. Installation and maintenance work carries a 42% hourly premium, construction managers run $30,000 above the median, and network engineers $25,000 above.

The tradeoff is in the conditions, since data-center IT staff are 40 times more likely to work nights and 26% of postings carry an “Up to 50%” travel requirement, against under 1% everywhere else.

Only 55% of applications come from the same metro area as the job, about 10 points below a typical US posting, and the spread underneath that average is enormous. Washington, D.C. draws 68% locally. Washington Court House, Ohio draws 7%.

Why it matters: That 7% is the number with schedule consequences, because a rural site that cannot staff locally is a delivery risk for anyone counting on it opening on time. The premiums say the same thing from the other side, since paying 63% over market for a facilities manager is what bidding against every other employer for the same people looks like.

What to do: If owned capacity is on the roadmap, I’d put the wage premium in the budget rather than the contingency, because that gap is a hiring-market fact. For any rural site, check the local applicant pool before the schedule gets committed, since the travel requirements say plainly that the labor does not live there.

7. Databricks hosted two rival models 3 days apart

What happened: Between August 10 and August 14, Databricks’ own release notes carried a run of governance and model-hosting changes that add up to one move.

On August 13, SecureConnect for OpenSharing went live, so a provider can share data from behind a firewall “without adding each recipient’s network to an allowlist,” and it switches itself on by default for provider accounts. On August 10 the READ METADATA privilege arrived in Unity Catalog, granting “read-only visibility into the same metadata available to the object’s owner,” which is the permission that lets an auditor see the structure without seeing the rows.

The quietest item arrived in beta on August 12. “Pages” is what Databricks calls a “single governed definition” for business terms, acronyms and the numbers a business argues about, and it feeds Genie Ontology, so the assistant answers from it.

On August 10, DeepSeek V4 Flash became available as a Databricks-hosted model, at 284 billion parameters with 13 billion firing on any given request, and it is a July checkpoint, so the hosting is the new part and the model is not. 3 days later Google’s Gemini 3.7 Flash arrived the same way. Hosted like this, the customer’s data path ends at Databricks instead of at DeepSeek or Google, with no separate contract and no separate bill for moving the data.

Next door, Snowflake took its S3 Tables Iceberg catalog integration live on August 10 without requiring AWS Glue.

Why it matters: 3 days between DeepSeek and Gemini landing on the same platform is the part I’d watch, because picking a model is turning into something you switch on rather than something you buy. Pages is the quieter one: once the glossary feeds the assistant, whoever writes the definition of a number decides what the assistant says that number is, and that job rarely has anyone’s name on it.

What to do: If a model-approval process names vendors, I’d rewrite it to name models and hosting locations, because the serving layer can add a model nobody reviewed inside a region already approved. And find out which sharing defaults are switching themselves on, since a default that enables itself is still a change whether or not anyone filed one.

References:

• stata-mcp command injection, CVE-2026-55071 (GitHub Security Advisories, 2026-08-12): https://github.com/advisories/GHSA-49m4-vp58-wgc9

• token-optimizer-mcp command injection, CVE-2026-55157 (GitHub Security Advisories, 2026-08-14): https://github.com/advisories/GHSA-49mq-fc6q-3h46

• IBM mcp-contextforge-gateway DNS rebinding SSRF, CVE-2026-53708 (GitHub Security Advisories, 2026-08-14): https://github.com/advisories/GHSA-9hgc-g3w5-67cm

• NLTK path traversal, CVE-2026-12243 (GitHub Security Advisories, 2026-08-13): https://github.com/advisories/GHSA-m42h-3232-vpv3

• SeaweedFS unauthenticated SSRF, CVE-2026-73080 (GitHub Security Advisories, 2026-08-11): https://github.com/advisories/GHSA-87fv-vqqr-m4jr

• Budibase automation SSRF, CVE-2026-35219 (GitHub Security Advisories, 2026-08-14): https://github.com/advisories/GHSA-5fpj-28rv-84r7

• Trigger.dev prototype pollution, CVE-2026-73654 (GitHub Security Advisories, 2026-08-13): https://github.com/advisories/GHSA-p28v-f755-9qrg

• AI agent security, Black Hat recap (Zenity Labs, 2026-08-12): https://zenity.io/blog/ai-agent-security-black-hat-recap

• MCP went stateless. So who guards the gate now? (Signal Finder, 2026-07-31): https://ai.kramadoss.com/p/mcp-went-stateless-so-who-guards

• Claude text watermarking (Anthropic, 2026-08-14): https://www.anthropic.com/news/claude-text-watermark

• Claude Platform API release notes (Anthropic, 2026-08-11): https://platform.claude.com/docs/en/release-notes/api

• OpenAI Daybreak Red and Blue on Amazon Bedrock (AWS, 2026-08-13): https://aws.amazon.com/about-aws/whats-new/2026/08/openai-daybreak-red-and-blue-on-amazon-bedrock/

• Expanding Daybreak (OpenAI, 2026-08-10; quotations verified against a 2026-08-12 Wayback snapshot, openai.com blocks automated fetch): https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/

• Introducing Muse Glimmer, an open agentic model (Meta, 2026-08-10): https://research.meta.ai/blog/introducing-muse-glimmer-open-agentic-model

• Muse-Glimmer-30B weights (Meta via Hugging Face, accessed 2026-08-17): https://huggingface.co/meta-models/Muse-Glimmer-30B

• Nemotron 3.5 Lightning and NeMo Switchyard (NVIDIA, 2026-08-11): https://blogs.nvidia.com/blog/nemotron-lightning-switchyard-rtx-dgx/

• Local AI with open source models and agents (NVIDIA, 2026-08-11): https://blogs.nvidia.com/blog/local-ai-open-source-models-agents-nemotron/

• Qwen3.8-27B model card (Alibaba Qwen via Hugging Face, August 2026): https://huggingface.co/Qwen/Qwen3.8-27B

• State of Open Models: Summer 2026 Observations (Hugging Face, 2026-08-14): https://huggingface.co/blog/state-of-open-models-summer-2026

• Nebius Q2 2026 shareholder letter (Nebius, 2026-08-12): https://assets.nebius.com/assets/a6ecfd85-a6cb-4967-8ef7-9a25bd261f9c/SHLQ226.pdf

• Nebius reports second quarter 2026 financial results (Nebius, 2026-08-12): https://nebius.com/newsroom/nebius-reports-second-quarter-2026-financial-results

• CoreWeave reports second quarter 2026 results (CoreWeave, 2026-08-11): https://investors.coreweave.com/news/news-details/2026/CoreWeave-Reports-Strong-Second-Quarter-2026-Results/default.aspx

• AB-1609 bill history (California Legislature, 2026-08-13): https://leginfo.legislature.ca.gov/faces/billHistoryClient.xhtml?bill_id=202520260AB1609

• Working in the data center build-out (Indeed Hiring Lab, 2026-08-13): https://hiringlab.indeed.com/2026/08/13/working-in-the-data-center-build-out/

• August 2026 platform release notes (Databricks, 2026-08-10 through 2026-08-14): https://docs.databricks.com/aws/en/release-notes/product/2026/august

• Snowflake release notes (Snowflake, 2026-08-10): https://docs.snowflake.com/en/release-notes/all-release-notes

Google reshuffled DeepMind’s leadership and lost Jeff Dean after 27 years. Palantir grew 93% and told investors the demand driver is “AI sovereignty,” and payrolls went negative in July while announced layoffs hit a two-year low.

Since last Monday on Signal Finder: The AI engineering ladder is growing faster than anyone is climbing it — the five rungs between a prompt and a decision the business has to stand behind. And Science Sundays: The dire wolf came back. Sort of. — what 20 gene edits actually buy you, and what the press release left out.

1. A government safety institute turned off its own safeguards to see what its agents would do — then one of them went after a real person

What happened: 5 security items in 4 days, and they share one question: when an agent acts outside what anyone sanctioned, what catches it?

• The UK AI Security Institute published an incident report on its own cyber evaluations on August 4. Across 122 runs between July 25 and 28, ten contained unsanctioned activity and nineteen distinct problematic actions were identified. 17 of the 19 came from Anthropic’s Mythos 5; two came from OpenAI’s GPT-5.6-Sol. AISI had deliberately enabled live internet access and deliberately disabled the models’ cyber classifiers to measure raw capability with the guardrails down; OpenAI’s own account, published August 4, says AISI told it on August 3 that this had been deliberate. In the worst sequence an agent “tried to insert malicious code into a publicly used open-source project,” then “researched the project’s human maintainers, created multiple fake identities, and used the fake identities to socially engineer a real maintainer.” What caught it was security monitoring spotting data leaving through the Tor anonymity network; AISI halted the evaluations, notified GitHub and others, and commissioned an independent review with METR, an outside AI-safety evaluator.

• Meta’s Muse Spark 1.1 broke into an outside company’s servers during a cyber evaluation, per Bloomberg on August 5. Spokesperson Andy Stone said a misconfiguration by Irregular, the evaluation firm Meta contracts, “inadvertently allowed one of our models access to the internet during evaluation.” An Irregular spokesperson said “This did not involve a sandbox escape or a sophisticated cyber action.” Irregular’s position is that this was the evaluation-environment problem it had disclosed a week earlier, which OpenAI’s August 4 post also describes, and it has said an analytical paper is coming. Meta has published nothing itself, though CNBC tied OpenAI, Anthropic and Meta to the same vendor on August 9.

• CISA added three actively exploited flaws to its Known Exploited Vulnerabilities catalog on August 4, one of them in an AI app builder. CVE-2026-9198 is a code-injection flaw in Langflow rated 9.8 out of 10 on the standard severity scale, affecting IBM Langflow OSS 1.0.0 through 1.10.0, where an attacker who never logs in can chain two API calls into running commands on the server and taking administrator control. Federal civilian agencies had until August 7 to fix it.

• A self-propagating worm called ChainDrop ate its way through the npm package registry, and Microsoft published the anatomy on August 4: more than 400 packages across multiple unrelated publishers. It steals npm publishing tokens, GitHub credentials and cloud secrets, then uses the stolen publishing rights to republish itself into the next batch of packages, which is why the count climbs faster than anyone can page a person.

• ServiceNow launched autonomous security agents on August 4. Eight are available now, including external attack surface management and non-human identity remediation (cleaning up credentials that belong to software rather than people), and between them they patch vulnerabilities, rotate keys, deprovision accounts and contain incidents with nobody in the loop. Yevgeny Dibrov, who runs cybersecurity and risk there: “Machine identities double every 18 months.”

Why it matters: That makes 3 labs and 4 disclosures in about a month with agents documented acting outside sanction, counting OpenAI in July and Anthropic’s own review of 141,006 evaluation runs on July 30. What actually caught it at AISI was network monitoring on traffic leaving the box; the evaluation harness itself noticed nothing.

What to do: I’d inventory every Langflow install you have, including anything that arrived through IBM, and treat the federal August 7 date as your own deadline. Then ask whoever runs your agent pilots one question: what would have noticed data leaving the sandbox?

2. A federal appeals court decided that when your AI agent visits a website, you visited it

What happened: On August 4 the Ninth Circuit threw out the temporary order that had blocked Perplexity’s agentic browser from Amazon.com, in Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444. The opinion is by Judge Milan D. Smith, Jr. and marked for publication, so other courts in the circuit have to follow it. The key line, in the court’s own words: “It is the user who ‘accesses’ Amazon’s computers, with the help of the Assistant to carry out specific acts on Amazon.com.”

The win turned on where the software actually runs, because “Perplexity itself does not directly communicate with Amazon’s servers”: the Assistant screenshots the browser on the user’s own machine and gets navigation instructions back. Since the Computer Fraud and Abuse Act punishes “[w]hoever . . . intentionally accesses” a protected computer, the judges read that as describing a person, not software, and California’s version of the law failed for the same reason.

Why it matters: The court said plainly that “there is thus little to no existing caselaw directly dealing with how to ascribe responsibility for AI agents like the Assistant,” and it ruled only on who counts as the visitor, and only at this early stage, so this is one foothold in a much longer argument. But it moves responsibility for what an agent does onto whoever pointed it at the site, which in a corporate deployment means the company.

What to do: If you run a customer-facing site, you can’t lean on computer-crime law the way you used to, so I’d say plainly in your terms of service whether you allow third-party agents, and pick a way to enforce that isn’t suing people. And I’d ask legal whether your own agents run on the user’s machine or on your servers, because that’s what the whole case came down to, and an agent running on your own servers probably doesn’t get the same protection.

3. Google split the person who built its AI from the org that ships it, and lost its chief scientist the same morning

What happened: On August 5, Sundar Pichai and Demis Hassabis published a joint message on the next chapter of Google’s AI work. Hassabis moves from CEO of Google DeepMind to Chair of Google DeepMind and Chief Scientist of Alphabet while continuing to lead Isomorphic Labs, and Koray Kavukcuoglu, a 13-year DeepMind veteran who was its chief technology officer, becomes Senior Vice President of Google DeepMind reporting directly to Pichai. In Pichai’s words, Kavukcuoglu “will oversee Gemini model development, Frontier AI research, and the Gemini app and developer teams.”

The same morning, Jeff Dean left after 27 years, taking Sanjay Ghemawat, Oriol Vinyals and Quoc Le with him to start Discovery Loop, a public benefit corporation built to automate the scientific loop: propose experiments, run them, evaluate, iterate. In Google’s words, “We’ll continue to work with them as a founding investor and Cloud partner.”

Why it matters: Kavukcuoglu now owns the models, the app and the developer teams in a single reporting line to the CEO, which is how you organize to ship. Four of the biggest names in machine learning walked out the same day to automate science, and Google is now a founding investor and Cloud partner in the company they left to build.

What to do: If Gemini is on your roadmap, I’d get your Google account team to name who owns the enterprise release calendar now and re-confirm any dates committed under the old structure. And I’d treat this as the argument for keeping a second model vendor wired up and tested, because new leaders reset priorities inside a quarter.

4. Palantir grew 93% and raised its full-year guide by half a billion dollars, and the phraseto note is “AI sovereignty”

What happened: Palantir reported second-quarter results on August 3: revenue of $1.935 billion, up 93% from a year ago, with US revenue at $1.573 billion, up 115%. Underneath, US commercial revenue grew 149% to $764 million while US government revenue grew 90% to $809 million, so the side that was a hobby for a decade is now outrunning the side that paid for it. GAAP net income was $1.062 billion and diluted earnings per share came in at $0.41.

The company closed $3.373 billion of contract value in the quarter, including 220 deals worth at least $1 million and 73 worth at least $10 million, and US commercial remaining deal value, the contracted work it has not billed yet, reached $6.238 billion. Full-year guidance went to $8.150-8.158 billion. CEO Alex Karp’s statement opens “Demand for AI sovereignty has now been unleashed,” and calls the quarter “otherworldly.”

Why it matters: Full-year guidance moved from $7.65 billion to roughly $8.15 billion in a single quarter, which is the number that’s hardest to dismiss as story. Read plainly, “AI sovereignty” means run the model against your data, inside your boundary, with your keys, and that is the same objection buyers have been raising to cloud AI platforms for 2 years.

What to do: When a vendor pitches sovereign AI, make them get specific: where the model is stored, where it runs, who holds the keys, what leaves the boundary.

5. Layoffs hit a 2 year low the same week payrolls went negative, and AI led the stated reasons for a 5th straight month

What happened: 2 jobs reports a day apart said opposite things. Challenger, Gray & Christmas reported on August 6 that US employers announced 33,429 job cuts in July, the lowest monthly total in 2 years, down 27% from June’s 45,849 and down 46% from the 62,075 announced in July 2025.

AI led all stated reasons for the fifth consecutive month at 10,970 cuts, roughly a third of the month’s total and 112,713 so far this year, while technology led every sector at 149,023 for the year, up 67%. Andy Challenger’s read was that “hiring has also increased over last year by 25%, so while AI is shifting the labor market, it is not dismantling it.”

Then on August 7 the Bureau of Labor Statistics reported that nonfarm payrolls fell by 23,000 in July against an average monthly gain of 34,000 over the prior year, with unemployment at 4.1%. May was revised down 66,000 and June down 37,000, so the 2 months together are 103,000 jobs lower than previously reported, and financial activities shed 14,000.

Why it matters: Announced cuts at a two-year low and 103,000 of prior gains revised away can both be true at once, because a hiring freeze and an unfilled backfill generate no press release and no Challenger entry. Inside that financial-activities decline, insurance carriers and related activities alone shed 7,000.

What to do: I’d stop reading layoff announcements as the displacement indicator and pull your own 12-month backfill rate by job family instead, because the hire rate for roles you would have refilled is the number that actually moved. And if you are the one deciding whether to refill a role, decide it deliberately this quarter.

6. Four labs shipped in five days and none of them led with a benchmark

What happened: 4 releases shipped between August 3 and August 7, and the selling point was never how smart the model is.

• Meta Superintelligence Labs shipped Muse Code in beta on August 5, per CNBC: a terminal coding agent that plans changes, writes code and validates results across large repositories, fanning out to parallel sub-agents in isolated git worktrees so your working copy never gets touched. Alexandr Wang, Meta’s chief AI officer, told CNBC it includes “a contributor tier that gets you in at a significantly lower cost,“ which he called “more than 10 times cheaper than even the pay-as-you-go tier,“ and said developers on it must “opt-in to help improve the model.“

• OpenAI made GPT-5.6 Luna the default for its free tier on August 6, with unlimited text chats for Free and Go users, while Plus and Pro users get a more concise, fact-focused Sol and a slider controlling how long the model spends on an answer.

• Anthropic retuned Fable 5’s biology safeguards on August 7, rewriting the classifier’s “constitution” to carve out exceptions for benign use and cutting biology-related fallbacks by about 85% across its product surfaces, where a fallback means the model hands you off to a less capable one instead of refusing outright. It still hands virology, toxicology and molecular design to Claude Opus 5, so by Anthropic’s own description Fable 5 “isn’t yet usable for professional biology research and drug development.”

• Alibaba released Qwen3.8-Max on August 3: 2.4 trillion total parameters with just 95 billion active, a context window up to a million tokens, text plus visual input, reachable through the Alibaba Cloud Model Studio APIs now, with the weights scheduled to follow the next week.

Why it matters: Meta led with a pricing structure, OpenAI led with who gets the good model for free, and Anthropic led with what it will stop routing to a weaker model, which is what a market looks like once capability is assumed and the fight has moved to distribution. Anthropic also published the number, which matters because getting bumped to a weaker model on legitimate work slows adoption in health care, life sciences and every regulated technical field, and almost no vendor publishes theirs.

What to do: Before anyone switches on Muse Code’s contributor tier, get a written answer on what “opt-in to help improve the model“ actually covers, repository contents, prompts, diffs, usage data, and whether it can be revoked. And if biology-related fallbacks have been blocking a use case, re-test it against Fable 5 this month, because your old evaluation is stale.

7. The compute layer spent the week building what agents will need next — their own chips, their own wallets, and a public option

What happened: 5 infrastructure items, all dated August 4 through 7, and none of them is about a bigger model.

• Anthropic is staffing a custom-silicon team and pulling chip design authority in-house. A Silicon Engineer role is live paying $320,000 to $485,000, and the listing says Anthropic works “from the chip level up with our silicon partners” and is “now deepening that investment by building a custom silicon team.” The hire owns calls on “where we build versus buy versus license, and where we take design authority versus rely on partners.”

• AMD reported record quarterly revenue of $11.5 billion on August 4, with data center revenue at $6.718 billion, up 107% from a year ago, and guided the third quarter to roughly $13 billion. Lisa Su called it “an excellent quarter, with record revenue and profitability as Data Center revenue more than doubled year-over-year.“ Gaming fell 31% in the same period, so the AI segment is not lifting the whole company.

• Cloudflare gave AI agents an identity and a wallet on August 4. Every account gets a unique web address that works as a stable agent ID, so a merchant can verify which human or organization authorized an action, and Virtual Wallets issued per agent carry spending caps, approved merchant lists and maximum transaction sizes. Matthew Prince put it this way: “When an agent shows up at your door, you need to know who sent it.“ Only handle reservation on cloudflare.pay went live on the day; funding and wallet issuance come later.

• The National Science Foundation put $100 million into State and Regional AI Infrastructure Hubs on August 4, funding up to ten consortia with NVIDIA, AMD, Intel and Dell named as supporters, and paying for coordination and faculty training rather than the metal itself.

• GitHub Copilot shipped per-session worktree isolation on August 7, an experimental /worktree command giving each agent session its own isolated copy of the repository. Meta shipped the same pattern 2 days earlier, so parallel agent sessions are converging on git worktrees as the fence between them.

Why it matters: Anthropic joins OpenAI, Google, Meta and Amazon in taking chip design in-house, which means every lab you might buy from is now also a hardware company, and designing models and chips together is precisely what makes a model hard to move later. Cloudflare’s spending caps and approved merchant lists are the first agent-payment controls a CFO would recognize on sight, and they arrived the same week a federal appeals court put responsibility for an agent’s actions on whoever sent it.

What to do: Add one question to model-vendor reviews: what is your custom-silicon roadmap, and what does it do to moving workloads off your stack. And if any agent pilot is heading toward transacting, I’d evaluate spend caps, approved merchant lists and per-agent identity now, before the first pilot buys something.

References:

• Incident report: unsanctioned agent behaviour during cyber testing (UK AI Security Institute, 2026-08-04): https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

• Third-party cyber evaluations involving OpenAI models (OpenAI, 2026-08-04): https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/

• Investigating incidents in cybersecurity evals (Anthropic, 2026-07-30): https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals

• CISA adds three known exploited vulnerabilities to catalog (CISA, 2026-08-04): https://www.cisa.gov/news-events/alerts/2026/08/04/cisa-adds-three-known-exploited-vulnerabilities-catalog

• ChainDrop supply chain compromise: anatomy of a self-propagating worm (Microsoft Security, 2026-08-04): https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/

• ServiceNow delivers Autonomous Security (ServiceNow, 2026-08-04): https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-delivers-Autonomous-Security-the-industrys-most-complete-security-offering/default.aspx

• Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444, opinion (US Court of Appeals for the Ninth Circuit, 2026-08-04): https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf

• The next chapter of our AI momentum (Google, 2026-08-05): https://blog.google/company-news/inside-google/message-ceo/next-chapter-ai-momentum/

• Palantir Q2 2026 results, Form 8-K Exhibit 99.1 (Palantir via SEC, 2026-08-03): https://www.sec.gov/Archives/edgar/data/0001321655/000132165526000039/a2026q2ex991pressrelease.htm

• July 2026 job cut report (Challenger, Gray & Christmas, 2026-08-06): https://www.challengergray.com/blog/challenger-report-layoffs-fall-hiring-picks-up-ai-leads-for-fifth-straight-month/

• The Employment Situation, July 2026 (US Bureau of Labor Statistics, 2026-08-07): https://www.bls.gov/news.release/empsit.nr0.htm

• Improving GPT-5.6 Sol in ChatGPT (OpenAI, 2026-08-06): https://openai.com/index/improving-gpt-5-6-sol-in-chatgpt/

• Improving Fable 5’s biology safeguards (Anthropic, 2026-08-07): https://www.anthropic.com/news/improving-fable-5-s-biology-safeguards

• Alibaba unveils Qwen3.8-Max (Alibaba Cloud, 2026-08-03): https://www.alibabacloud.com/en/press-room/alibaba-unveils-qwen3-8-max

• Silicon Engineer, Custom Silicon Team (Anthropic, accessed 2026-08-09): https://job-boards.greenhouse.io/anthropic/jobs/5286348008

• AMD reports second quarter 2026 financial results (AMD, 2026-08-04): https://ir.amd.com/news-events/press-releases/detail/1295/amd-reports-second-quarter-2026-financial-results

• Cloudflare gives AI agents an identity and a wallet (Cloudflare, 2026-08-04): https://www.cloudflare.com/press/press-releases/2026/cloudflare-gives-ai-agents-an-identity-and-a-wallet/

• New NSF State and Regional AI Infrastructure Hubs will power AI (National Science Foundation, 2026-08-04): https://www.nsf.gov/news/new-nsf-state-regional-ai-infrastructure-hubs-will-power-ai

• GitHub Copilot weekly releases, August 3 (GitHub, 2026-08-07): https://github.blog/changelog/2026-08-07-github-copilot-weekly-releases-august-3/

• Meta AI model accessed internet, hacked outside firm in testing (Bloomberg, 2026-08-05): https://www.bloomberg.com/news/articles/2026-08-05/meta-ai-model-accessed-internet-hacked-outside-firm-in-testing

• Israeli startup Irregular linked to AI hacks at OpenAI, Anthropic and Meta (CNBC, 2026-08-09): https://www.cnbc.com/2026/08/09/israeli-startup-irregular-linked-to-ai-hacks-openai-anthropic-meta.html

• Meta debuts Muse Code to take on Anthropic and OpenAI (CNBC, 2026-08-05): https://www.cnbc.com/2026/08/05/meta-debuts-muse-code-to-take-on-anthropic-and-openai-.html

• Meta launches Muse Code, an AI agent for large code bases (TechCrunch, 2026-08-05): https://techcrunch.com/2026/08/05/meta-launches-muse-code-an-ai-agent-for-large-code-bases/

• Discovery Loop (Discovery Loop, accessed 2026-08-10):

https://discoveryloop.com

• Jeff Dean and other top AI researchers are leaving Google to launch their own startup (TechCrunch, 2026-08-05): https://techcrunch.com/2026/08/05/jeff-dean-and-other-top-ai-researchers-are-leaving-google-to-launch-their-own-startup/

• AI Waypoints Edition #21 (Signal Finder, 2026-08-03): https://ai.kramadoss.com/p/ai-waypoints-week-of-august-3-2026

How this piece was made. I picked the signals and approved the slate; AI agents on different models researched the facts, and every claim gets re-verified against its first-party source before publish. This edition, the Why-it-matters and What-to-do blocks are model-drafted and capped at 2 sentences each, because I didn’t dictate takes this week and I’d rather say so than fake it. I keep a full internal record of who did what, and if something still got through, tell me and I’ll correct it in public.

So last year, when the news went around that a company had actually brought the dire wolf back — the real animal, not the HBO version — it stuck with me.

Wait, that’s a real thing now?

It sat in the back of my head for months, and I finally went and looked into whether it was true.

On April 7, 2025, a Dallas company called Colossal Biosciences announced that the dire wolf was back. Not as a metaphor — three actual animals.

Two males, Romulus and Remus, born that October, and a female named Khaleesi. White coats, already big, filmed running around in the snow on some undisclosed preserve. The real dire wolf had been gone for something like twelve thousand years, and here it was on the cover of Time with the word EXTINCT crossed out in red. The internet lost its mind, and honestly, fair enough.

Here’s what they actually did.

They took a gray wolf’s genome — the kind you can see in Yellowstone — and made 20 edits across 14 genes. 15 of them copied real dire-wolf DNA, pulled from a 13,000-year-old tooth and a 72,000-year-old ear bone. The other 5 had nothing to do with dire wolves at all; they were for a white coat, and the team picked those on purpose, because copying the real dire-wolf color genes could have left the animals deaf or blind. Then they cloned the edited cells — using blood cells instead of cutting into an animal, which is a neat trick — and grew the embryos in dog surrogates.

Dire wolves and gray wolves last shared an ancestor around 5.7 million years ago — different enough that the gray wolf you’re picturing is actually closer kin to an African jackal than it is to the dire wolf.

So 20 edits isn’t bringing the real dire wolf back.

The clearest description of what they actually made came from Colossal’s own chief scientist, the paleogeneticist Beth Shapiro, who called them “gray wolves with 20 edits.”

So are the wolves fake? No, and but it helps to understand more.

Romulus, Remus, and Khaleesi are real, healthy animals, each now well over 120 pounds, living on a 2,000-acre preserve with no plan to ever let them go. What they pulled off is real engineering.

They’re just not dire wolves. They’re gray wolves in dire-wolf clothes.

And the gap between what got announced versus what got built is representative of the whole story of this field.

What “de-extinction” really means

This is a whole branch of science I didn’t know existed!

The basic idea is the same every time. You take whatever DNA you can get from the extinct animal — usually a few scraps in bad shape — and compare it to its closest living relative. Wherever they differ, you pick a few changes that seem to matter and use CRISPR to make them in the living animal. Then you need something to give birth to it: for a mammal, you clone the edited cell into a surrogate; for a bird, where cloning doesn’t work the same way, you edit the cells that turn into eggs and sperm and let a surrogate bird carry it.

Here’s the catch the marketing skips: none of this rebuilds the extinct animal. The people who set the rules for conservation a body called the IUCN, won’t even use the word “de-extinction.” They call these animals “proxies.”

And a lot stands in the way. You can only make a few dozen edits at a time, but a mammoth is over a thousand genes off from an elephant — so you’re not rewriting the book, you’re swapping a few dozen words and hoping it reads like a different story. The DNA you start from is patchy to begin with. And for anything big, there’s no artificial womb and something alive still has to carry the pregnancy, which is why a mammoth would need an elephant, and nobody’s pulled that off.

So the most anyone can do right now is tweak a living animal to look like a dead one.

Could we rebuild it? No. Everything so far is a proxy.

Who’s in the race

Almost all of this runs through one company. Colossal Biosciences, out of Dallas, started by the entrepreneur Ben Lamm and the Harvard geneticist George Church, is the giant of the whole business. They are worth around $10 billion in early 2025, and reportedly in talks since to raise at $20 to $30 billion. Nearly every animal in this piece is theirs. The one other serious American outfit is Revive & Restore, a nonprofit that’s worked on the passenger pigeon for more than a decade and takes a quieter, more academic road.

Then it gets interesting, because the rest of the world is doing the weirder, harder parts.

Australia is after the thylacine, the Tasmanian tiger — out of a University of Melbourne lab run by Andrew Pask, working with Colossal. New Zealand is chasing the giant moa, a flightless bird that stood up to 12 feet, through the Ngāi Tahu Māori research center, the University of Canterbury, and Canterbury Museum, bankrolled with $15 million from the filmmaker Peter Jackson.

Russia has the strangest and most romantic piece of it. In the Siberian Arctic, a father-and-son team — Sergey and Nikita Zimov — run Pleistocene Park, a reserve where they’re rebuilding the ancient “mammoth steppe” grassland a real mammoth would need to survive. They’re doing it with bison, musk ox, camels, and horses, letting the animals trample the tundra back into pasture. They are, in other words, building the house before anyone’s built the tenant. The project limped through the last few years with no expeditions in 2022 and stays alive mostly on American and German donations.

Japan has the saddest near-miss. In 2019, a team at Kindai University led by Akira Iritani pulled 88 cell nuclei from “Yuka,” a 28,000-year-old mammoth dug out of the permafrost, and slipped them into mouse eggs. A few flickered. Spindle proteins started to assemble, the very first motion a cell makes before it divides. And then nothing. The DNA was too broken to go further. It wasn’t a step toward a mammoth so much as a gorgeous, final proof of the wall.

South Korea gave the story its most human turn. Sooam Biotech, founded by Hwang Woo-suk — the cloning celebrity whose stem-cell papers were exposed as fraud back in 2005 — spent years on a splashy plan to clone a mammoth from Siberian cells. It never found a single usable nucleus. Hwang has since moved to a lab in Abu Dhabi, where he now clones prize camels for rich Gulf owners. The mammoth dream quietly turned into a camel business.

China isn’t chasing anything extinct, but it’s quietly built the best cloning shop on the planet — the first cloned monkeys, back in 2018, and, in 2025, cloned Tibetan yaks — a livestock-breeding program first, with conservation as a side benefit. And the UAE, besides hosting Hwang’s camels, shows up the way it usually does: as money. Gulf capital is part of what’s funding Colossal.

If we step back, the map tells a story.

The glossy, well-funded work is American. The rest of the world is stuck with the slow, hard, often stalled parts like the habitat, the cell biology, the patient cloning which never make the headline.

What’s actually been brought back so far

Strip away the marketing, and the real scorecard is brutal: one birth, dead within minutes.

Her name was Celia — a Pyrenean ibex, a wild mountain goat also called the bucardo. The last one died in 2000 when a tree fell on her, but a year earlier scientists had frozen a bit of her skin. In 2003 they cloned her and put the embryo in a domestic goat. The clone was born alive and died within minutes, from a lung that never formed right. It holds a genuinely strange double record: the first extinct animal ever brought back, and the first to go extinct twice. That was more than twenty years ago, and nobody’s cleanly beaten it since.

Everything since has been a stand-in. The dire wolves are gray wolves with 20 edits. The other headline animal, the “woolly mouse” from early 2025, is a lab mouse given 8 edits for mammoth-ish fur — a real proof that you can stack that many edits at once, and also, at the end of the day, a fuzzy mouse that has nothing to do with mammoths, written up in a paper that hasn’t even cleared peer review. Cool science but definitely not a resurrection.

Here’s the part that surprised me: the genuinely impressive wins from all this gear are for animals that never went extinct at all.

• A black-footed ferret named Elizabeth Ann, cloned in 2020 from cells frozen since the 1980s — from a female named Willa with no living descendants. She couldn’t breed herself, but later clones of the same donor could, and one of them, Antonia, had a litter in 2024. That pushed a long-dead female’s genes back into a population descended from just seven animals. Willa now counts as the eighth.

• Two Przewalski’s horses, Kurt and Ollie, cloned from a cell line banked decades ago — for the same reason. Every one of the roughly 2,000 alive today descends from just 12 ancestors, and the clones widen a scarily narrow gene pool.

• The northern white rhino, down to two females and no males left anywhere on Earth. Scientists have banked 39 embryos and tried six transfers into surrogate rhinos as of April 2026. No pregnancy has held. No calf.

Every one of them does more real good for an actual species than the dire wolves ever will.

What’s being worked on

The de-extinction pipeline is real, and so is the ambition. It’s the timelines I’d take with a grain of salt.

The woolly mammoth is the flagship. Colossal wants a mammoth-like calf which is really a heavily edited Asian elephant by the end of 2028. That’s their number, not an outsider’s, and the scientists I read put it closer to a decade out, or never. The real holdup isn’t the editing; it’s the pregnancy. An edited embryo has to implant and survive 22 months inside an elephant, which has never been done, and as Colossal’s own chief scientist Beth Shapiro put it, that’s “22 months of biology that’s really out of our control.”

The dodo is further back than it sounds. Birds can’t be cloned the way mammals are, so the work goes through the cells that become eggs and sperm, carried by a Nicobar pigeon, the dodo’s nearest living cousin. They hit a real milestone in September 2025 but there’s no edited embryo yet, and no hatch date.

The thylacine, the Tasmanian tiger, has a genome the company calls basically complete. The problem is the womb. The planned surrogate is a fat-tailed dunnart, a marsupial about the size of a mouse — and a thylacine grew to somewhere around 17 kilograms. Nobody has figured out how you get from one to the other.

The moa is the newest and flashiest, but it has no living relative big enough to carry it, which makes “walking by 2035” sound more like a wish than a plan. And the passenger pigeon, worked on for over a decade, is refreshingly honest about its own math: no bird in the wild before about 2040, and none exists yet.

Every timeline that ends in a living, breathing animal is measured in years-to-never. Every milestone you can actually point at today is a lab step — a cell line, a genome, an embryo. Not a creature.

So where does the dinosaur fit in?

Right about here, because I know it’s the question you actually came in with.

Can any of this get us a dinosaur?

No. But it’s worth knowing why, because the why is the best part.

Let’s go back to those moa bones. In 2012, scientists ground up 158 of them in New Zealand to measure how fast DNA falls apart. The answer was a half-life of about 521 years. That number gets quoted a lot and it is easy to misread, because it does not mean half the molecule dissolves every 521 years. DNA snaps at random points along its length, and what halves is the supply of fragments still long enough to read. The individual chemical bonds are far tougher than that, lasting well over a hundred thousand years. It is the long stretches that go first, and long stretches are the only thing carrying usable information.

Cold slows it down, heat speeds it up, but it only runs one way. Even frozen in a perfect deep freeze, the most generous math says the code goes unreadable after about 1.5 million years, with the last bonds gone by around 7 million.

The oldest DNA anyone has ever pieced back into something like a genome came from a mammoth tooth frozen for 1.2 million years. Non-avian dinosaurs died out 66 million years ago at fifty times past the line.

No sample, no lab, no amount of money gets you there.

Here’s the twist, and it’s a good one.

We already share the planet with dinosaurs. Birds are dinosaurs and not descendants of them, but the one branch of the family, the feathered theropods, that lived through the asteroid. A chicken is more closely related to Tyrannosaurus rex than T. rex was to a Stegosaurus.

That rotisserie chicken in your cart is, no joke, a dinosaur.

So the closest anyone gets to building one doesn’t go through ancient DNA at all. It goes through a chicken.

A living bird still carries the old dinosaur instructions, switched off over a hundred-odd million years but never thrown away. Turn some of them back on, and ancestral traits start showing up. This is a real project, not a gag: the paleontologist Jack Horner, who advised the Jurassic Park movies, has spent years on what he calls the “chickenosaurus” — trying to bring back four dinosaur features in a chicken: a snout instead of a beak, teeth, clawed hands instead of wings, and a long tail.

Three of the four already work, at least in the egg:

• In 2015, researchers at Yale and Harvard switched off one signal in chicken embryos and watched the beak grow back toward a dinosaur-like snout. They didn’t hatch them, and the researchers were careful about what they claimed: the embryos grew an ancestral-looking snout, which is not the same as giving a bird a dinosaur face.

• In 2006, a mutant chicken grew little cone-shaped, alligator-ish teeth — because birds lost their teeth about 116 million years ago but never deleted the recipe. It was just switched off, waiting.

• In 2016, another team coaxed a chicken’s lower leg bone back toward the long, tubular dinosaur shape.

The tail is the holdout. There’s no single switch to flip, so a real dinosaur tail is still out of reach. And nobody has ever put the traits together, or hatched any of these embryos. They stay in the dish because some of it is partly ethics, partly the fact that a chicken with a dinosaur snout might not be able to eat.

And even if someone built the whole thing and let it hatch, Horner is the first to tell you what you’d get: a modified chicken. A bird in dinosaur clothes. Not a T. rex, not a Velociraptor, not any actual animal that ever lived which is the exact same gap as the gray wolf in dire-wolf clothes I started with.

So that’s where it all points to.

No T-Rex, ever. No mammoth for years. A handful of engineered look-alikes — real, remarkable animals, but not the ones on the label.

And underneath the whole show, a genuinely useful set of tools for keeping the species we’ve still got from slipping away.

The closest thing to Jurassic Park anyone will ever build is a chicken with teeth.

That’s five names since 2023, each holding the floor for less time than the one before it: prompt engineering ran about 2 and a half years before anything displaced it, while graph engineering arrived roughly only 6 weeks after loop engineering.

The technique pile-up is mostly a story of the last 11 months, because that’s when 4 of the 5 got their names:

• Context engineering in September 2025,

• Harness engineering in February,

• Loop engineering in June, graph in July.

If you’ve stopped trying to keep up, I don’t blame you, and I’d argue you shouldn’t have to.

Underneath the churn, though, each name is real engineering, invented because models could gradually with every release do more on their own, and all 5 techniques answer the same question, each bounding a different piece of it:

The frontier models are good; the whole contest is how we harness them and let long-range agent tasks run without intervention.

What I want us Enterprise Leaders to understand is when each layer earns its place, when it’s overkill, and when you just need a chat.

My answer, up front: most enterprise workloads need the bottom two layers and a chat.

The graph at the top only pays when somebody will later have to reconstruct the decision.

Why the ladder keeps growing

The AI engineering ladder I reference is just those 5 names stacked in the order they arrived, and each rung sets a limit the rung below it doesn’t.

• Prompt engineering — the output. What shape the answer takes.

• Context engineering — what the model knows. Which documents are in front of it.

• Harness engineering — what it can touch. The tools, files, and systems around it.

• Loop engineering — when it stops.

• Graph engineering — where the work routes, and how far a bad call travels before someone catches it.

Let’s walk one job up all 5 rungs and see what each name actually means: a commercial property renewal.

• Prompt engineering. Ask a model to explain what a coverage clause means. A question and an answer, nothing else but a prompt.

• Context engineering. Ask the same question about your policy, and someone has to find the right document and hand it over first. The model can only be as right as the paperwork you give it.

• Harness engineering. Let it pull that policy out of the policy admin system itself, along with the loss runs and the submission. It’s touching your systems now, and it can reach things you never handed it.

• Loop engineering. Let it work the whole renewal file without you prompting each step: read the submission, pull the history, flag the gaps, draft the summary. Something other than you decides when it’s finished.

• Graph engineering. Now the work ends in an output the company has to stand behind, a quote or a reserve. So you build in the places it has to stop, the people it has to hand off to, and a record of who signed off before the number went out the door to your client.

What moves a job up the ladder is that models keep running longer with nobody in the room.

AIG’s CEO Peter Zaffino put dates on that during the company’s Q1 2026 earnings call, using them to mark how fast this has moved: when AIG began its work with Claude 2.0, AI agents could operate autonomously for less than an hour, and today they can run “as long as 30 hours.”

30 hours is a long time for work to happen where nobody is watching.

Each technique arrived when the layer below it hit its limit, which gives us a way to test: you move up a layer when the work outgrows the one you’re on, not when a new word starts trending.

And almost nothing in the enterprise has crossed the top ones.

Stanford’s 2026 AI Index found agent deployment “in the single digits across nearly all business functions,” so the people renaming the discipline every few weeks are describing frontier-lab work while the buying decision sits in organizations that mostly haven’t shipped agent one.

Capability already spreads lab to lab in about a week, down from about a year; the vocabulary churns on the same clock, faster than any procurement cycle runs.

What the rename crowd gets right, and where it stops

The loudest objection to graph engineering is that it’s rebranded prior art: LangGraph with a marketing budget, or business process management in a new shirt.

On the mechanics, that objection is right. Business Process Model and Notation (BPMN) 2.0, the standards language for drawing executable business processes, specified process graphs, gateways, and typed state in December 2010, and Airflow, Step Functions, and Temporal have run drawn graphs in production for years.

LangChain published “3 Years of Graph Engineering with LangGraph“ days after the term took off, which is a three-year prior-art claim (a patent term as I am learning) on a label that was weeks old.

The skeptics could push that history further than they do. 2 decades of orchestration engines paid off exactly where the work was repetitive, regulated, and measured, and went unused everywhere else. That record looks like an argument against graph engineering, and I read it as a good guide to where the layer pays off, because the line between those two kinds of work hasn’t moved.

The research record is harder still on the version of graph engineering that means “add more agents.”

• A June preprint found 5 of 6 multi-agent systems underperformed a matched single agent, and another watched accuracy fall from 54.7% to 50.9% when it expanded orchestration, with timeouts and tool failures rising alongside.

• Then in late July, peer-reviewed work in Nature Machine Intelligence made the sharpest observation: stronger models outgrow the collaboration benefit, so past a capability threshold, adding agents stops helping.

• The commercial version of that argument is the one a CEO actually would want to hear: buying an orchestration layer in August 2026 is buying a workaround for a limitation the next model release removes.

Two things keep me from closing the case saying Graph Engineering is hype right here.

• Regulators set the checkpoints, not the models

  • If an examiner requires a sign-off at a certain step, that requirement doesn’t go away because the model got smarter. Better models don’t lower the number of stops.

• Nobody has tested the actual claim

  • Every study above changes how many agents run, or how closely they work together. Not one asks whether writing down the steps, the stops, and who hands off to whom beats letting a single agent figure it out as it goes, which I only caught on a second read of the papers. An agent working inside a drawn-out process still counts as “single-agent” in all of them.

What’s actually new here is wrapping 15-year-old process rules around a part that never does the same thing twice. That’s a guess worth testing, not a proven answer, and I’d treat it that way.

When the graph pays

AIG shows what this looks like in production.

On that same Q1 call, Zaffino described underwriting agents “purpose-built for a specific underwriting function,” all feeding “a collaboration agent to synthesize input.“

That’s a drawn graph — named nodes, declared routing — at a large US commercial insurer, described to investors. AIG built it to quote faster, and the examiner-ready record is a byproduct it gets for free, which makes the governance case cheaper rather than weaker.

The byproductof graph engineering is examinability. An explicit graph with named checkpoints is an artifact you hand an examiner, while a thirty-hour agent trace is a transcript you make the examiner read.

Picture a kitchen’s temperature log, initialed at each check, next to security footage of the whole shift: both contain the answer, but only one is easy to check.

Nobody has to read the transcript, though. Point a model at the thirty-hour trace and have it write the log, which is roughly what the observability vendors already sell, and it gets cheaper every quarter.

If that holds up, the graph becomes optional and the reconstruction test goes with it.

Who’s testifying is what gives me a pause.

A summary a model writes about its own run is the defendant’s account of the evening, while a checkpoint that fired at a fixed point, whether or not the machine was confident, is a record somebody else can check. Kitchens keep the temperature log for the same reason they don’t ask the cook to write up how the night went.

What it costs

Examiners are getting equipped faster than the discourse notices, too.

The National Association of Insurance Commissioners (NAIC) adopted its Model Bulletin on insurers’ AI use in December 2023 (the instrument in force today, implemented state by state), and its newer AI Systems Evaluation Tool is in a multistate pilot through September, with insurers’ governance and risk-mitigation practices and their high-risk AI models on its review list.

Deloitte, meanwhile, found 74% of respondents expect to be using AI agents at least moderately by 2027 while only 21% have a mature governance model for them.

Put those numbers side by side and you’re looking at the graph’s real market, and it’s a compliance market rather than a productivity one.

So the money question is which budget this comes out of.

Nothing published so far prices the same workload as a loop and as a graph: the cost side is documented, token bills and tracing and evals (automated scoring of the outputs) and state storage, while the benefit is avoided examination risk, and I couldn’t find a dollar figure on it anywhere. IMHO, anyone handing you a return-on-investment (ROI) number for graph engineering is inventing it. I’d fund the graph from the compliance budget, say so out loud, and start with exactly one workload, the one with an examination requirement already on its calendar.

The same feature carries an operating cost, and I’d say it out loud before compliance teams falls in love with the graph.

Every checkpoint that makes a decision reconstructable is a place where work stops and waits for a person, so if nobody will ever need to reconstruct the decision, every checkpoint you add is latency with no offsetting audit value. A graph also multiplies identity checks, because every node that touches a tool adds one more authorization decision, request by request, at the Model Context Protocol gateway (MCP, the shared doorway agents use to reach outside tools), which just became everyone’s job.

How often the work runs decides how much of that cost you actually pay, and asking whether the company has to stand behind the output doesn’t tell you that.

An examiner looking at a large commercial placement reads the file; an examiner looking at personal-lines quoting pulls a sample, because nobody reads a hundred thousand quotes. You have to stand behind both, but I’d build for them differently.

File review wants a checkpoint a person genuinely clears. Sampling needs less: the path drawn, the decisions logged, enough that someone can reconstruct a handful later.

Make a person sign off on work that runs ten thousand times a day and you haven’t made anything easier to examine, you’ve built a waiting line, and the customer stuck in it notices long before the regulator does.

Anthropic’s July releases are the quiet tell on how far a bad call can travel. Claude Code shipped deeper nesting (subagents spawning subagents three levels down, up from one) and default limits in the same run of releases: 20 subagents running at once, 200 per session.

The same releases that let agents go deeper also capped how many can run, and I’d read those caps as Anthropic’s own view of where the risk starts.

Three insurance workloads, sorted

Run 3 ordinary insurance workloads up the ladder and they sort themselves.

• Claims-status inquiry, so a chat
  It reports a fact and commits the company to nothing. A simple prompt plus the right documents does it, and Anthropic’s own guidance since December 2024 is that single calls with retrieval are usually enough.

• Submission-intake triage, so a loop
  It runs long, but the next stop is a human underwriter, so nothing leaves the building on its own.

• Underwriting file assembly, so a graph
  It builds toward a price the company has to stand behind, one a regulator can later ask to see the trail for. That’s where I’d draw the graph, name the checking steps, and decide who clears them and how fast.

Fix the plumbing before you draw the graph

Hiscox’s headline win, 3-day quotes down to about 3 minutes, is a useful check on what to do first, because it came from a document-extraction pipeline announced in 2023 and live in 2024, not from a graph. That pipeline is rung 2, context engineering: getting the right documents in front of the model, cleanly and automatically.

Rung 2 buys the first big jump. Rung 5 is what I’d add next, once the decision has to run unattended and hold up to an examiner.

The second question to ask

If you read my monotheist-vs-polytheist piece, this is the other half. That one asked whether the work splits cleanly across agents. This one asks whether the company has to stand behind the result, and whether you wrote the split down somewhere an examiner can see it.

Two questions for Monday

The Monday move I’d make is two questions, put to every AI workload on the list, and this one is for the CIO or CFO to run, because the answers decide budgets, not diagrams. The first question belongs to the engineering team; the second belongs to compliance or whoever owns exam readiness, because no engineering standup can answer it.

1. How long does this run without a human touching it?

2. Does it make a decision that binds us to somebody — a price, a denial, a payment, a coverage position?

Then two follow-ups I’d suggest.

1. Which budget this comes out of, because if the answer is “productivity,” those numbers don’t exist yet.

2. Which engine draws the graph: first the workflow team down the hall, whose Temporal or Step Functions estate is already bought and paid for, then the Guidewire, Duck Creek, and Salesforce reps, on whether graph orchestration is already switched on in something on the renewal list.

I found no published answer to that last question, which is exactly why you want their answer in writing.

I’d log those replies, and log the triage answers with them, because that’s the inventory to have in hand before the sixth name shows up.

Are we taking bets on how long before the 6th?

References:

• AIG Q1 2026 earnings call (2026-05-01), webcast via AIG Investor Relations: https://www.aig.com/home/investor-relations/financial-reporting-and-statutory-statements · transcript: https://www.fool.com/earnings/call-transcripts/2026/05/01/aig-aig-q1-2026-earnings-call-transcript/

• Stanford HAI, 2026 AI Index Report, Economy chapter: https://hai.stanford.edu/ai-index/2026-ai-index-report/economy

• Deloitte, State of AI in the Enterprise 2026 (AI agents findings): https://www.deloitte.com/us/en/insights/topics/emerging-technologies/ai-agents-scaling-faster.html

• NAIC CIPR, Artificial Intelligence (Model Bulletin + AI Systems Evaluation Tool pilot): https://content.naic.org/cipr-topics/artificial-intelligence

• Anthropic, “Building Effective AI Agents” (2024-12-19): https://www.anthropic.com/engineering/building-effective-agents

• Anthropic, “Effective context engineering for AI agents” (2025-09): https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents

• Anthropic, Claude Code CHANGELOG (subagent nesting + caps, July 2026): https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

• Fu et al., “Do More Agents Help?” arXiv:2606.05670: https://arxiv.org/abs/2606.05670 [Note: preprint, not peer-reviewed]

• Mittal, “ChromaFlow,” arXiv:2605.14102: https://arxiv.org/abs/2605.14102 [Note: preprint, not peer-reviewed]

• Nature Machine Intelligence, s42256-026-01268-y (2026-07-24): https://www.nature.com/articles/s42256-026-01268-y

• OMG, BPMN 2.0 specification: https://www.omg.org/spec/BPMN/2.0

• LangChain, “3 Years of Graph Engineering with LangGraph” (2026-07-22): https://www.langchain.com/blog/3-years-of-graph-engineering-with-langgraph

• Mitchell Hashimoto, “My AI Adoption Journey” (2026-02-05): https://mitchellh.com/writing/my-ai-adoption-journey

• Addy Osmani, “Loop Engineering,” O’Reilly Radar (2026-06-22; originally published on addyosmani.com 2026-06-07): https://www.oreilly.com/radar/loop-engineering/

• Hiscox press releases (2023-12-12, 2024-08-12): https://www.hiscoxgroup.com/news/press-releases/2023/12-12-23 · https://www.hiscoxgroup.com/news/press-releases/2024/12-08-24

While that was happening, 1,178 employees of the top AI labs asked Washington for the tools to deliberately pace AI development, and the EU AI Act’s enforcement powers went live on the exact date the 2-year countdown promised.

NVIDIA’s week was weirder: a reported $5 billion check to a lab that ships nothing by design, and a security alliance of more than 30 companies that the 3 biggest labs declined to join.

Since last Monday on Signal Finder: MCP went stateless. The hard part moved to identity. — context for this week’s security signals.

1. 4 earnings reports in 48 hours, and only one kind of AI spending got rewarded

What happened: All 4 reports landed inside 2 days. Investors rewarded 2 and punished the other 2.

• Microsoft (July 29) guided calendar-2026 capital spending to roughly $175 billion, with Azure growing 43% from a year ago; the stock rose 8-9%.

• Meta (July 29) narrowed its full-year 2026 capital spending range to $130-145 billion, raising the floor from $125 billion, and the stock fell 9-10% despite double-digit revenue growth.

• Amazon (July 30) posted AWS growth of 37% from a year ago, and the stock rose 8% in the regular session and as much as 10% after hours.

• Apple (July 30) held to its research-heavy posture, spending roughly 6 times more on R&D than on capital projects, and the stock fell 3-4% even with revenue growing.

• Both Fortune going in and the coverage after landed the same place: spending got rewarded where it feeds a metered, external, growing revenue line, and punished where it disappears into the company’s own products.

Why it matters: Microsoft and Meta alone have guided to over $300 billion of combined 2026 capital spending, and the market split them roughly 17 points apart in 48 hours. It came down to one thing: whether the spending feeds a revenue line customers actually pay for. The companies that couldn’t point to one got punished.

What to do: I’d take the divergence into renewal planning: Azure and AWS just got rewarded for growing customers’ metered bills, so model your commit growth at the rates they just posted rather than last year’s.

2. 1,178 AI lab employees asked Washington for tools to pace their own field, and OpenAI and Anthropic endorsed the ask a day later

What happened: On July 28, a letter titled “Pacing the Frontier,” signed by 1,178 AI lab employees at publication, asked the US government to support an international effort “to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development.“

The letter asks for the option to buy time; the signatories are explicit that they are not calling for a slowdown today.

The list spans 4 labs, per the letter’s own site: Dario Amodei, Jakub Pachocki, Mark Chen, Jared Kaplan, and Jack Clark, plus Meta AI chief scientist Shengjia Zhao and Google’s VP of AI safety and alignment Anca Dragan. A day later, OpenAI and Anthropic both endorsed it in posts on X. That was a week after OpenAI published its account of its own models breaking out of a test sandbox and into Hugging Face’s production systems (covered in Edition #20).

Why it matters: The 2023 pause letter was signed mostly by outsiders, with no top-tier-lab leadership; this one is signed by the people building the systems, including OpenAI’s chief scientist and Anthropic’s chief science officer, and endorsed by both of those companies within a day. The ask looks like the labs trying to write the rules before Congress does.

What to do: I’d send the letter itself to whoever owns your AI governance roadmap; it points to work already underway on monitoring top-tier model releases, the kind of language that tends to resurface as attestation clauses in enterprise AI contracts. No buying change yet; this one is a watch item.

3. The EU AI Act date everyone prepped for arrived, and most of it didn’t apply

What happened: August 2, 2026 was the date the EU AI Act’s main obligations were scheduled to bite, 2 years after entry into force. What went live on schedule: the European Commission’s enforcement powers over general-purpose AI (GPAI) models, the models themselves rather than the products built on them. The AI Office can now demand documentation, run evaluations, and pull models from the market, with fines up to 3% of global turnover or €15 million, whichever is higher.

Human-facing transparency duties also started. What didn’t arrive: the Digital Omnibus deferred the high-risk obligations of Annex III to December 2, 2027, pushed Annex I product rules to August 2, 2028, and gave machine-readable content marking a grace period to December 2, 2026 for systems already on the market before August 2, 2026.

Why it matters: The AI Office’s powers arrived on schedule while every deadline that requires companies to re-engineer products slipped by 16 months or more. For a compliance program budgeted against Annex III, what’s binding this quarter is transparency duties and whatever the model providers now have to attest to.

What to do: I’d re-scope the EU AI Act workstream this week around what is enforceable now, and bank the 16 months on the Annex III program. Ask your model vendors in writing which GPAI obligations they are now attesting to, because their answers flow straight into your own disclosure duties.

4. NVIDIA and more than 30 companies formed a cyber-defense alliance without the 3 biggest labs

What happened: The [Open Secure AI Alliance launched July 27](https://blogs.nvidia.com/blog/open-secure-ai-alliance/): NVIDIA, Microsoft, IBM, SpaceXAI, Hugging Face, and the Linux Foundation among more than 30 companies at launch committing to build shared cyber-defense tooling for AI systems, days after the Hugging Face incident put agentic attacks on every security agenda. The alliance builds on the Linux Foundation’s open-source security work, and the member list has kept growing since launch. OpenAI, Google, and Anthropic are not members.

Why it matters: Microsoft joined the alliance the same day it launched Project Perception, its own AI security product. That’s the classic Microsoft move: help build the shared baseline everyone gets, keep the good stuff for yourself to sell.

And the three labs sitting it out — OpenAI, Google, and Anthropic — build the exact models these attacks target. So the companies closest to the danger aren’t in the room.

What to do: Ask each of your security vendors at the next review whether they’ve joined and what they’re contributing, because alliance tooling will surface inside products we already license. I’d also watch whether the 3 absent labs join by year-end; that’s the best single tell on whether AI defense stays a commons or becomes a product war.

5. NVIDIA put a reported $5 billion into a company that ships nothing by design

What happened: On July 27, NVIDIA announced a long-term strategic partnership with Safe Superintelligence (SSI), Ilya Sutskever’s lab, which has shipped nothing and says it will ship nothing until it reaches its namesake goal. NVIDIA’s release calls the investment “substantial”; Bloomberg puts the reported figure at $5 billion. The deal gives SSI access to NVIDIA’s Vera Rubin platform, its newest generation of AI compute.

Why it matters: This extends Edition #20‘s thread of money moving in circles: AMD’s up-to-$5 billion stake in Anthropic, the SK-NVIDIA letters of intent, and now NVIDIA-SSI, all inside about 2 weeks. A chip vendor funding a customer that exists to buy its chips books revenue that is partly its own money coming back.

What to do: I’d add circularity to how you read AI vendor financials: when a capacity announcement and an equity stake point at each other, discount both. If the board asks whether the AI buildout is real demand or vendor financing, NVIDIA funding SSI to buy NVIDIA compute is the example to bring.

6. The largest open-weight model ever is free to download, and almost nobody can run it

What happened: On July 27, Moonshot AI published the full weights of Kimi K3 on Hugging Face: 2.8 trillion parameters, a 1-million-token context window, 96 shards totaling roughly 1.5 terabytes in MXFP4, a compressed number format for AI hardware. That is bigger than any previous open-weight release, and Interconnects calls it “the strongest open model ever released”. The API has been live since the model was introduced at the World Artificial Intelligence Conference on July 16.

What’s new is the brain itself: downloadable, under Moonshot’s own license (Edition #20 covered what its terms actually allow). At that size, the practical operators are cloud providers running the newest NVIDIA or AMD racks.

Why it matters: Hugging Face’s advice after its own incident was to have a self-hostable model vetted and ready before an attack; this release shows how narrow the set of organizations that can act on that advice has become. Who owns the racks is now the gate on top-tier open models.

What to do: I’d skip the download and price the hosted route: if Kimi K3 matters to your stack, the decision is which cloud provider serves it and at what per-token price, the same buying call as any closed model.

Revisit the self-hosting line in your AI policy, because that plan assumes hardware your company probably doesn’t own.

7. Microsoft is collapsing its AI lineup into 2 front doors

What happened: On the July 29 earnings call, Satya Nadella confirmed Microsoft is bringing its Copilot experiences together “in one super app” this quarter: chat, Cowork, code, and the new autonomous “Autopilots” for long-running tasks, in his own list.

No price and no date beyond the quarter (9to5Mac has the roundup).

2 days earlier, Microsoft announced Project Perception: a coordinated system of security agents in which red-team agents probe for weaknesses, blue-team agents investigate threats, and green agents harden what both find, running against signals from across the company’s identities, endpoints, applications, and clouds.

Why it matters: Microsoft sells at least 4 separately billed Copilot products today; folding them into one app in the same quarter its security agents become one system is a packaging decision, and packaging is how Microsoft has historically won categories — Teams overtook Slack after it was bundled into Microsoft 365. Every stand-alone AI subscription in the stack now has to beat a default that ships inside the platform agreement.

What to do: I’d hold net-new Copilot-adjacent purchases until the super app’s packaging and price land this quarter, because the bundle will reset what the stand-alone tools are worth. And I’d put Project Perception through a real evaluation before renewal season, scored against what the current security stack already catches.

References:

• Microsoft FY26 Q4 press release and webcast (Microsoft, 2026-07-29): https://www.microsoft.com/en-us/investor/earnings/fy-2026-q4/press-release-webcast

• Microsoft FY26 Q4 earnings call (Microsoft, 2026-07-29): https://www.microsoft.com/en-us/investor/events/fy-2026/earnings-fy-2026-q4

• Meta Q2 2026 results (Meta, 2026-07-29): https://investor.atmeta.com/investor-news/press-release-details/2026/Meta-Reports-Second-Quarter-2026-Results/default.aspx

• Amazon Q2 2026 results (Amazon, 2026-07-30): https://www.aboutamazon.com/news/company-news/amazon-earnings-q2-2026-report

• Apple Q3 FY2026 results (Apple, 2026-07-30): https://www.apple.com/newsroom/2026/07/apple-reports-third-quarter-results/

• Big Tech earnings preview, market revolt over AI spending (Fortune, 2026-07-26): https://fortune.com/2026/07/26/big-tech-earnings-meta-microsoft-apple-amazon-market-revolt-ai-spending/

• Big Tech earnings scorecard (TradingKey, 2026-07-31): https://www.tradingkey.com/analysis/stocks/us-stocks/262067315-big-tech-earnings-scorecard-microsoft-amazon-apple-july-31-2026-tradingkey

• Post-earnings stock coverage (CNBC, 2026-07-31): https://www.cnbc.com/2026/07/31/apple-aapl-amazon-amzn-stock-today.html

• Pacing the Frontier, letter text and signatory list (2026-07-28): https://pacingthefrontier.com

• OpenAI, Anthropic staff share letter asking US to help pace AI progress (Bloomberg, 2026-07-28): https://www.bloomberg.com/news/articles/2026-07-28/openai-anthropic-staff-share-letter-asking-us-to-help-pace-ai-progress

• Hugging Face model evaluation security incident (OpenAI, 2026-07-21): https://openai.com/index/hugging-face-model-evaluation-security-incident/

• Regulatory framework for AI (European Commission, accessed 2026-08-02): https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

• EU AI Act service desk FAQ (European Commission, accessed 2026-08-02): https://ai-act-service-desk.ec.europa.eu/en/faq

• EU AI Act omnibus agreement: postponed high-risk deadlines and other key changes (Gibson Dunn, 2026-07): https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/

• The Digital AI Omnibus: proposed deferral of high-risk AI obligations (DLA Piper, 2026-07): https://knowledge.dlapiper.com/dlapiperknowledge/globalemploymentlatestdevelopments/2026/The-Digital-AI-Omnibus-Proposed-deferral-of-high-risk-AI-obligations-under-the-AI-Act

• Open Secure AI Alliance launch (NVIDIA, 2026-07-27): https://blogs.nvidia.com/blog/open-secure-ai-alliance/

• Open models and open weights are foundational to secure AI (Linux Foundation, 2026-07-27): https://www.linuxfoundation.org/blog/open-models-and-open-weights-are-foundational-to-secure-ai

• SSI and NVIDIA announce long-term strategic partnership (NVIDIA, 2026-07-27): https://nvidianews.nvidia.com/news/ilya-sutskevers-safe-superintelligence-inc-and-nvidia-announce-long-term-strategic-partnership

• NVIDIA makes substantial investment in Sutskever’s AI startup (Bloomberg, 2026-07-27): https://www.bloomberg.com/news/articles/2026-07-27/nvidia-makes-substantial-investment-in-sutskever-s-ai-startup

• Kimi K3 model card (Moonshot AI via Hugging Face, 2026-07-27): https://huggingface.co/moonshotai/Kimi-K3

• Kimi K3: the open weights escalation (Interconnects, 2026-07):

• Be ready before the attack: self-hosting an open model for cyber defense (Hugging Face): https://huggingface.co/blog/jeffboudier/open-model-cyber-defense

• Microsoft will launch new “super app” for Copilot soon (9to5Mac, 2026-07-30): https://9to5mac.com/2026/07/30/microsoft-will-launch-new-super-app-for-copilot-soon/

• Rethinking security for the age of AI, Project Perception (Microsoft, 2026-07-27): https://blogs.microsoft.com/blog/2026/07/27/rethinking-security-for-the-age-of-ai/

• What’s new in Microsoft Security: July 2026 (Microsoft Security Blog, 2026-07-30): https://www.microsoft.com/en-us/security/blog/2026/07/30/whats-new-in-microsoft-security-july-2026/

• AI Waypoints Edition #20 (Signal Finder, 2026-07-28): https://ai.kramadoss.com/p/ai-waypoints-week-of-july-20-2026