AI Waypoints: Week of May 26, 2026 — Edition #11
The week enterprise AI moved from abstract to itemized.
Good day. This was the week enterprise AI’s bills became real line items. The security operations queue, the hyperscaler invoice, the consulting invoice, and the severance schedule landed on the same page. Three of the seven signals below touch Anthropic. (no surprise - they have been busy!)
1. Anthropic’s Project Glasswing found 10,000 critical vulnerabilities in 30 days
What happened: Anthropic published on May 22 the first progress report on Project Glasswing, the controlled-deployment program for Claude Mythos Preview’s cyber capabilities. About 50 trusted partners collectively identified more than 10,000 high- or critical-severity vulnerabilities across systemically important codebases in one month. Most partners reported hundreds of issues in their own software; several reported bug-detection rates rose more than 10x. Median patch time for a Mythos-discovered high or critical: about two weeks. Some open-source maintainers asked Anthropic to slow the disclosure pace so they could keep up. Public model access remains closed.
Why it matters: This is the first published data on what an unrestricted frontier cyber model does to enterprise vulnerability backlogs — it buries you. Every organization running a security operations (SecOps) pipeline sized for 500 high or critical findings a year should expect 5,000 if equivalent tooling becomes available. Patch velocity becomes the bottleneck on security posture for 2026-2027. The defensive scan-and-patch framing also resets the “Mythos as autonomous offensive weapon” narrative from the Anthropic-Pentagon dispute.
What to do: Before any Glasswing-class capability reaches general availability, I’d want two things in hand: your current vulnerability-to-patch service level agreement (SLA) tested against a 10x detection-rate scenario, and patch velocity on the CISO scorecard if it isn’t there already. Scan rate alone won’t tell you whether you’re keeping up.
2. NVIDIA’s networking line is the part the analysts under-priced
What happened: NVIDIA reported Q1 FY27 on May 20: total revenue $81.6B (+85% year-over-year), data center $75.2B (+92%), and networking $14.8B (+199% year-over-year, +35% quarter-over-quarter). Q2 guide is $91B ±2%. The guide assumes zero China data-center compute revenue. Jensen Huang called the AI-factory buildout “the largest infrastructure expansion in human history.“ A new $80B buyback was authorized and the dividend went from $0.01 to $0.25.
Why it matters: The compute number is the headline; the networking number is the news. Spectrum-X and InfiniBand at +199% year-over-year (and +35% quarter-over-quarter) changes the cost basis of every multi-GPU cluster being procured into 2027. The constraint is shifting from cards to fabric. The zero-China assumption means any China re-opening is upside, which tightens GPU allocations for everyone else if it lands.
What to do: If you’re sizing 2027 inference capacity, I’d line up your hyperscaler’s GB300 and Vera Rubin allocation timeline against your contracted token volume before the next quarterly business review (QBR), and press them on networking SKUs by name, not just GPU count.
3. Google priced Gemini 3.5 Flash as a budget weapon
What happened: At Google I/O 2026 on May 20-21, Gemini 3.5 Flash went generally available with Google claiming less than half the cost of comparable frontier models and 4x faster output tokens. Google asserted a customer running a trillion tokens a day could save more than $1B a year by shifting 80% of workload to 3.5 Flash. Gemini Spark (a personal agent running on its own dedicated VM per user, Model Context Protocol-connected) is rolling out to Google AI Ultra and Workspace customers. Antigravity 2.0 desktop app is GA, and the Managed Agents API on Agent Platform spins up custom agents in Google-hosted environments with VPC-SC and Agent Identity controls. Google disclosed 375+ Cloud customers each processing over a trillion tokens in the prior twelve months.
Why it matters: The pricing claim is a real cost cut against Anthropic and OpenAI on commodity workloads, and it directly weaponizes token math. The Spark architecture (one isolated VM per user) is also the first hyperscaler bet that personal agents need tenant-level isolation alongside identity controls.
What to do: If your 2026 budget assumed Anthropic or OpenAI as inference primary, it’ll be an interesting exercise for procurement to model an 80/20 split with Gemini 3.5 Flash on high-volume, low-judgment workloads. Even a 30% migration tests the savings claim with your own data.
4. KPMG locks in Anthropic across 276,000 people, making it three of four Big Four
What happened: Anthropic announced on May 19 a global strategic alliance with KPMG: all 276,000+ employees across 138 countries get Claude access, and Claude, Claude Cowork, Managed Agents, and Claude Code embed inside Digital Gateway, KPMG’s main Azure-hosted client-work platform. Initial focus is tax and legal services, cybersecurity vulnerability work, and private equity portfolio support. With PwC’s 30,000-consultant expansion on May 14 and the earlier Deloitte deal, EY is the only Big Four firm without a publicly disclosed Anthropic-anchored core platform.
Why it matters: Big Four dependency on Anthropic is now structurally locked across three of four firms. If you contract any of them for a complex transformation, you are de facto contracting Claude as the inference layer. I read this as a vendor-concentration question that hits audit committees within a quarter. Two threads come up first: data residency (Digital Gateway is Azure-resident; tokens flow to Anthropic) and evidentiary chains in tax audits using Claude reasoning.
What to do: If KPMG, PwC, or Deloitte is on your panel, best to inquire which engagements run on Claude, what data leaves your tenant, what their fallback model is, and whether they can demonstrate the engagement under a non-Anthropic model. If they can’t, your Chief Information Security Officer (CISO) and audit committee should weigh in on that.
5. Anthropic meters Claude agents — June 15 cutover, no team pool
What happened: Anthropic is separating programmatic Claude usage from chat-subscription limits on June 15, 2026. Agent SDK, claude -p non-interactive, Claude Code GitHub Actions, OpenClaw, and any third-party app authenticating via the Agent SDK move to a separate monthly credit pool billed API-style: Pro $20, Max 5x $100, Max 20x $200. Credits are per-user and non-poolable across teams.
Why it matters: This is the formal end of all-you-can-eat subscription economics for agent and coding workloads. Non-poolable credits break the team-shared automation pattern. A single Max 20x seat covering a CI/CD pipeline goes away. Read this alongside Signal #3: Google is making inference cheaper for commodity workloads while Anthropic is itemizing it for programmatic workloads. Token spend is starting to behave like AWS spend, with named budget owners and per-user accounting. That’s the trajectory I traced in The Token Paradox last month: per-token price was never the cost story. Procurement channel and accounting structure were.
ELI5: What changed with Claude billing on June 15?
Old subscription: like a company Netflix account — one seat, the whole team binge-watches. After June 15, every Claude agent task has to be billed to a named person, and credits don’t pool across teammates. That’s how AWS billing already works: every line item ties back to a cost-center owner. Token spend is on the same trajectory.
What to do: Before June 15, I’d walk every CI/CD (continuous integration / continuous deployment) pipeline, internal tool, and shared automation calling Claude through the Agent SDK, and compare per-user versus team-shared burn at current rates. A Max seat covering team-shared automation today is better off on a direct API contract after June 15.
6. OpenAI ships Codex on-prem through Dell — the first regulated-industry path
What happened: At Dell Technologies World on May 18, OpenAI and Dell announced that Codex (used weekly by 4M+ developers) will distribute through the Dell AI Data Platform and Dell AI Factory as a hybrid and on-premises offering. This is OpenAI’s first explicit hybrid/on-prem distribution path, targeting financial services, healthcare, and government buyers that cannot send code or data to public cloud.
Why it matters: Read this with Signal #5 as a pair: OpenAI is widening its reach into regulated industries while Anthropic is tightening commercial controls on existing customers. The on-prem Codex path also directly competes with Anthropic’s Pentagon and Mythos-defensive air-gapped narrative, and it puts frontier coding agents into the regulated-industry contracts that Microsoft Azure Government and AWS GovCloud have owned. The way I read this: the assumption that frontier coding stays in public cloud just broke for any procurement officer who had treated it as fixed.
What to do: If you’re in financial services, healthcare, or public sector and you’ve been waiting on an air-gapped frontier coding option, I’d pull a Dell AI Factory quote in parallel with whatever you’re running today. Locking a public-cloud-only coding contract in for 36 months is a bigger commit than it was two weeks ago. The on-prem option just changed your negotiating position.
7. Standard Chartered names 7,800 jobs and a 20% income-per-employee target
What happened: At Standard Chartered’s May 19-21 Investor Event in Hong Kong, CEO Bill Winters disclosed plans to cut more than 15% of corporate-functions headcount by 2030, about 7,800 roles out of roughly 52,000 in support services. Winters framed it directly: “It’s not cost cutting; it’s replacing in some cases lower-value human capital with the financial capital and the investment capital we’re putting in.” The 2030 targets: income per employee up about 20% by 2028, cost-to-income ratio down to 57% by 2028, return on tangible equity above 15% in 2028 and roughly 18% by 2030. AI replacing back-office processing is the named mechanism.
Why it matters: This is the first major global bank to attach a named AI-attributable headcount number to a multi-year cost-cut schedule with a forward income-per-employee key performance indicator (KPI). It turns the category-level data (BLS’s -0.2% for AI-exposed cohorts in Edition #10) into a named-firm commitment that HSBC, Citi, JPMorgan, and Barclays boards will press on. Winters walked the “lower-value human capital” line back the next day after backlash. The 7,800 number and the 2030 income-per-employee target stayed on the slide.
What to do: If you’re an enterprise architect at a global bank, I’d expect a comparable internal target ask within 60-90 days. I’d want a defensible per-process automation savings model in hand first (which back-office processes, which agent platform, what’s the displacement-versus-retraining split). Otherwise the board does that math without you.
What am I missing that’s on your radar?
References:
Project Glasswing initial update (Anthropic Research, 2026-05-22): https://www.anthropic.com/research/glasswing-initial-update
NVIDIA Q1 FY27 results (NVIDIA Newsroom, 2026-05-20): https://nvidianews.nvidia.com/news/nvidia-announces-financial-results-for-first-quarter-fiscal-2027
Google I/O 2026 Cloud announcements (Google Cloud Blog, 2026-05-20): https://cloud.google.com/blog/products/ai-machine-learning/innovations-from-google-io-26-on-google-cloud
KPMG + Anthropic strategic alliance (Anthropic, 2026-05-19): https://www.anthropic.com/news/anthropic-kpmg
Claude Agent SDK metering (Anthropic Support, June 15 cutover): https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan
OpenAI + Dell Codex enterprise partnership (OpenAI, 2026-05-18): https://openai.com/index/dell-codex-enterprise-partnership/
Standard Chartered Day 1 Investor Event Presentation (sc.com, 2026-05-19): https://www.sc.com/en/uploads/sites/66/content/docs/standard-chartered-may-2026-day-1-investor-event-presentation.pdf