Good morning. Oracle booked another $30 billion of AI cloud contracts last quarter and still burned cash. The NSA, CISA and the FBI named six Chinese AI companies as pulling billions of tokens out of American models. And Google says attackers have stopped typing prompts and started running agents.
Since last week I also published:
AI Billing Trap — Anthropic, OpenAI and Microsoft each made the seat an entry fee, with usage metered above it.
Money and platforms
1. Oracle booked $664 billion and burned cash doing it (31 min read)
Oracle told the SEC on September 10 that the orders it has taken but not yet filled reached $664 billion, up $209 billion from a year ago. Cash from their operations hit a first-quarter record of $23 billion, and Oracle still spent $5 billion more than it brought in.
→ Oracle sold $20 billion of its own stock during the quarter, so whether it can build the capacity it has already sold is a money question. If OCI is in a 2027 plan, I’d ask where your contract sits in that $664 billion queue.
2. OpenAI now ships the machinery that runs Codex (2 min read)
OpenAI’s developer changelog, dated September 10, says its Agents API is in public beta: developers can “build agents with a managed Codex harness while OpenAI handles session orchestration, context compaction, and recovery.” The same day it added API key expiry that administrators can enforce across an organization or one project.
→ Session orchestration, recovery and context trimming are what teams have been building themselves, and the vendor now ships it. Key expiry only covers newly created keys, so the existing ones still need rotating.
3. Salesforce closed the Fin deal a quarter early (2 min read)
Salesforce closed its purchase of Fin, formerly Intercom, on September 10, a quarter earlier than its June announcement said, and at the roughly $3.6 billion it named. Fin brings more than 30,000 customers and a stated 76% average resolution rate. Salesforce also previewed an AI Control Plane for agents it did not build; its Trusted Enterprise AI Harness has a unified experience planned to begin rolling out in early FY28.
→ Anyone running Fin is a Salesforce customer now, and the overlap with Agentforce service agents is unresolved. I’d get roadmap and renewal terms in writing.
Threat reports
4. Three US agencies named six Chinese AI companies (18 min read)
A joint advisory from the NSA, CISA and the FBI, released September 8, names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI as pulling “billions of tokens across millions of exchanges/requests” out of top-tier US models, with DeepSeek doing it since at least late 2024, querying them at scale and training on the answers. It calls DeepSeek’s quoted $5.6M training cost “misleading.”
→ DeepSeek, Qwen, Kimi, MiniMax and GLM are the cheap open-weight defaults a lot of teams reached for, and that choice now has a federal advisory attached to it.
5. Break-in to mass credential theft in under six hours (29 min read)
Google’s threat intelligence group says that in Q2 2026 it watched attackers compromise a cloud resource and then “plan, build, and execute an agent-enabled mass credential harvesting campaign in under six hours,” run from the victim’s own cloud so the traffic looked legitimate. One exposed control server held over 23,800 harvested secrets.
→ Prices for stolen AI accounts more than doubled this year, and malware is writing into the hidden folders coding assistants and editors create. I’d check whether .claude/, .cursor/ and .vscode/ sit inside what endpoint security watches, and when AI platform keys were last rotated.
6. Anthropic says an ad agency ran an influence operation (2 min read)
Anthropic’s September threat report, listed on its newsroom on September 10, describes a France-based advertising agency running influence work on Claude as a paid service: approximately 70 fake news sites, 70 X accounts, more than 250 inauthentic commenting accounts and at least 8,913 articles. Anthropic disrupted it and rated it Category Two on Brookings’ Breakout Scale.
→ This belongs to brand protection and communications, not just the security team, because 250 accounts and 8,900 articles look organic to a keyword alert.
New rules
7. California licenses AI auditors, and audits are not conclusive (5 min read)
Newsom signed two bills on September 9. SB 813 sets up independent organizations that check AI systems against state law, and AB 1405 creates a registry: from January 1, 2029, nobody may conduct a covered AI audit in California without registering, keeping documentation ten years and staying off work they did themselves.
→ SB 813 says an audit done to a standard the state identifies is “relevant to, but not conclusive of” a harm claim. Anyone scoping an AI audit this quarter as a full legal defense is scoping it wrong.
References: