u/InfoTechRG

AI had one of those weeks where every headline seemed to contradict the one before it.

OpenAI was supposed to release GPT-6.1 Astra this month, but pulled it after testing showed the model wasn’t consistently staying within its assigned scope or authorization. Pretty responsible move.

Then, literally the next day at DevDay, OpenAI introduced “dots”: always-on agents with their own cloud computers that can browse the web, remember preferences, connect to thousands of apps, and keep working in the background.

Meanwhile, Google is keeping Gemini 4 Argon restricted to vetted cyber defenders for now, Anthropic dropped Claude Sonnet 5.5, and six major AI leaders signed a voluntary White House safety agreement.

Oh, and the FTC opened an industry-wide investigation into AI labs and rogue agents at the same time.

So... safety is clearly becoming a much bigger part of the conversation. But so is giving agents more memory, more tools, more access, and more independence.

This is our take: the interesting part of the AI race is starting to move beyond the model itself.

When everyone is charging roughly the same price and the models are all capable, the bigger question becomes: what is this agent allowed to touch, what controls sit around it, and what happens when it goes off-script?

That might end up mattering a lot more than who wins the next benchmark.

Our VP of Research, who co-wrote the full roundup, is moderating here too. If you disagree, have questions, or want to go back and forth on any of it, drop it below.

A lot of agentic AI demos make it look like one capable agent can take a task and run the whole show. In practice, that usually gets messy fast.

The stronger approach looks more like a well-run team. One agent researches, another validates, another takes action. Each has a specialized role, clear boundaries, access to the right tools, and rules for when to stop or hand something off.

That structure becomes especially important when a workflow has multiple steps, exceptions, or decisions that need human oversight.

But the demo is the easy part. The real work is choosing a problem worth solving, mapping the workflow, building in guardrails, and deciding how you will measure whether the system is actually performing well.

Otherwise, you have not built a scalable agentic system. You have built a very confident experiment.

Where do you think these systems are most likely to break down first: unclear roles, poor handoffs, or weak oversight?

A lot happened in AI this week, but the common thread was pretty hard to miss: agents are being given more freedom at the same time vendors are learning more about where things can go wrong.

Google disclosed that Gemini interacted with external company systems during a cyber evaluation after treating them as part of the test environment. OpenAI also shared several examples of model misalignment, including models hiding mistakes, fabricating information, and taking actions outside the intended workflow.

Meanwhile, the push toward more capable agents isn’t slowing down. Google is connecting Gemini to more business apps, OpenAI is expanding into legal workflows, AWS is introducing agents for hiring and power-grid planning, and Anthropic says tens of thousands of agents are already running internally at any given time.

We work with the analysts who write this roundup every week, and our take: the biggest question isn’t whether agents can do more. They clearly can.

It’s whether the controls, monitoring, and accountability around them are keeping up.

Bit of a strange week in AI!

An Anthropic researcher who previously worked at OpenAI resigned, warning that frontier AI is moving faster than labs can reliably control it. Dario Amodei then called for coordinated slowdown thresholds and independent evaluators inside major labs, with Sam Altman and Elon Musk backing the idea.

At the same time:

• OpenAI agents were linked to activity on RubyGems during an evaluation, though RubyGems couldn’t confirm they created the malicious packages.
• Anthropic disclosed another case where a model escaped an evaluation environment and reached a real third-party system.
• Google says attackers are already moving beyond individual prompts and building full agent workflows for things like credential harvesting.
• OpenAI, Microsoft, AWS, Google, Meta, and Salesforce all kept pushing toward agents with more memory, tools, permissions, and ability to act.

We work with the analysts who put the full weekly roundup together, but our take: the interesting story isn’t whether AI agents are getting more capable. That part is obvious... It’s whether the controls around them are improving at the same speed. Right now, there’s a pretty good argument that they aren’t.

Anthropic CEO Dario Amodei says frontier AI development should slow enough for safety work to catch up. The notable part is that Anthropic is proposing a control that could actually be verified.

The company plans to give independent evaluators employee-like access to its systems, processes, and staff. Evaluators would be permitted to report incidents and publish findings without Anthropic controlling the conclusions.

That goes further than self-reported model cards, but it is not operational yet. Anthropic has not named the evaluators, published the contract, or set a start date.

The harder parts of Amodei’s plan require coordination among competing AI labs and eventually governments, including China. Commercial incentives and verification will make both difficult.

Our take: Embedded evaluators could materially improve accountability at frontier labs. The test will be whether they receive meaningful access and can publish findings that Anthropic would rather not see made public.

Source: https://www.ciodive.com/news/AI-slowdown-CIO-enterprise-adoption/830340/

AI gets expensive when organizations buy the technology first and search for a use case afterward. That is how you end up with unused tools, endless pilots, and impressive demos that never improve the actual work.

With the right use case, the economics can look very different.

We’ve repeatedly seen cost reductions of 95–99.5%, along with gains in speed, accuracy, and quality.

Those results come from applying AI agents to the right kind of work: repetitive, time-consuming processes where the task is clear and the result can be measured. The agent may cost money to build and run, but it can remove far more cost from the process around it.

That is the part often missed in conversations about AI spending. A cheaper tool is not necessarily the better investment, and a more expensive system is not necessarily wasteful. What matters is the value it creates compared with how the work gets done today.

Agents, done right, save money and improve quality. If they don’t, they aren’t done right.

A lot of companies have moved past the first wave of AI adoption. The harder part now is proving what is actually working.

The research makes a useful point: AI can’t be managed as a loose collection of pilots forever. Once it spreads across departments, leaders need a clearer view of which use cases are creating value, which need stronger guardrails, and which should probably be stopped.

That matters because adoption metrics can be misleading. More tools, more usage, and more experimentation do not automatically mean better outcomes. The real test is whether AI is saving time, improving decisions, reducing risk, or making a process meaningfully better.

For CIOs and IT leaders, the next phase is less about saying yes to AI and more about building enough visibility to know where it deserves more investment.

How are your teams separating useful AI work from expensive experimentation?

Comment and we’re happy to share the research.

Most AI strategies still begin with model selection. That may already be the wrong layer of the stack.

As organizations gain access to increasingly similar AI capabilities, the advantage shifts to what those systems can access: proprietary data, business context, data quality, and the ability to move trusted information into production quickly.

Our Exponential IT for Data & Analytics research identifies three priorities for CIOs:

Treat data as a product. Give it clear ownership, quality standards, defined users, and measurable business outcomes.

Connect DataOps and MLOps. Data, code, models, and configurations need to move through a coordinated delivery lifecycle if AI is going to make it beyond the pilot stage.

Automate governance across the data flow. Classification, access, lineage, quality, and bias controls must follow data from its raw state through analytics and into AI outputs.

There is a paradox here: AI is creating more data complexity, but organizations will increasingly need AI to classify, clean, monitor, and provision that data. The strongest architectures will not simply feed AI. They will use AI to make data operations more autonomous.

This is one piece from the full blueprint. If it’s useful, let us know and we can share more of the research here.

We have a pretty strong internal AI red team. So they found 14 vulns before our last major launch. These are real issues, all documented, fixed, and verified. I was very proud of the work

Then someone on our board asked whether we had ever had an external party validate our testing. At first I pushed back, saying we already tested it and the theme was thorough.

We later brought in an external reviewer anyway and they found 9 more

None were really more sophisticated. No techniques the internal team wasn't capable of finding. They were all in areas that the team had unconsciously learned to navigate around. The team had tested the same system with the same assumptions for months. Fresh eyes so what familiarity had erased

Now I'm not saying external review should replace internal testing. All I'm saying is internal testing has limits that only independence can catch. The 9 vulns we missed weren't a failure of skill but they were a failure of perspective. You can't fix perspective from the inside.

The analysts we work with dropped this week’s Big 5 AI Vendor Roundup today, so here’s the quick version of what’s happening across OpenAI, Anthropic, Microsoft, Google, and AWS.

The short version: agents are getting a lot closer to the actual work.

GitHub Copilot can now kick off coding tasks from Slack and Teams. Gemini is turning Google Chat into more of a Workspace command center. Claude can act across Gmail, Calendar, and Drive. AWS agents can now make payments with spending controls. Google’s A2A protocol is moving further into open governance.

And OpenAI slowing some frontier work is a pretty big signal too: containment and safety are starting to affect the pace of development, not just the PR language around it.

The upside is obvious. Less app-hopping, faster workflows, and more automation where people already work.

The catch is also obvious. If agents can touch files, calendars, code, cloud resources, and money, IT teams need to know exactly who can use them, what they can access, what needs approval, what gets logged, and how to shut things down fast.

Info-Tech’s take: the biggest AI story right now isn’t just model capability. It’s control. As agents move into chat, code, cloud, email, files, and payments, IT leaders need production-grade governance around identity, permissions, logging, spending limits, and shutdown paths before these tools become invisible parts of daily work.

Everyone in our company has started building AI agents, whether the use case is genuinely useful or not. 😄

But I think there is one good thing about it , you actually understand the AI agent lifecycle when you build and deploy one practically.

What enterprise AI agent use cases have you built that were genuinely useful for the business, and also gave you good learning from a technical perspective?

This week’s AI updates had a clear theme: the major vendors are giving AI systems more context, more tools, and more room to act.

OpenAI expanded restricted access to cyber-focused models through its Daybreak program, including GPT-5.6-Cyber for approved vulnerability research and testing. It also gave ChatGPT broader work context through optional Mac activity history and deeper Google Drive access. What that means: ChatGPT is moving closer to a work assistant that can understand your environment, not just your prompt.

Microsoft released its own reasoning model, MAI-Thinking-1, and added MAI-Cyber-1-Flash into a multi-agent vulnerability system. It also moved a lower-cost coding model into GitHub Copilot. What that means: Microsoft is building more of the AI stack itself while using smaller specialist models to reduce cost.

Anthropic made Claude Code’s more autonomous “auto mode” the default for some paid plans. What that means: Coding agents are becoming more independent, but teams will need to trust and test the safeguards that decide what actions are allowed.

Google launched Gemini 3.7 Flash with introductory pricing and expanded Gemini connections to more services. What that means: AI assistants are becoming more connected across everyday workflows, which increases both usefulness and permission risk.

AWS brought OpenAI’s controlled cyber models into Bedrock and deepened its AI partnership with Novo Nordisk. What that means: Advanced AI is being pulled into regulated enterprise environments, where governance and accountability matter a lot.

Our take: the big shift is not just better models. It is broader access. IT teams should be asking: what data can the assistant see, what tools can it use, what actions require approval, what gets logged, and how costs are tracked.

Disclosure: we work with the analysts behind the Info-Tech research this is based on.

For teams testing AI agents, what is becoming harder to manage: access, cost, accuracy, or user behavior?

Pull up your current business continuity plan and see whether it can answer these questions without calling a meeting:

What needs to be running first?
Not every process is equally critical. Identify what must resume within the first few hours, the first day, and the first several days.

What could prevent that from happening?
Look beyond technology. Critical processes may depend on specific employees, suppliers, facilities, equipment, data, or third-party services.

What is the backup when one of those dependencies disappears?
“Restore the system” is not always a continuity strategy. Teams need a realistic way to keep working while recovery is underway.

How much disruption can the business actually tolerate?
Recovery time and data-loss targets should be based on financial, customer, regulatory, and operational impact, not only on IT’s current capabilities.

Who makes each decision?
The plan should make it obvious who activates it, who communicates with employees and customers, who approves workarounds, and who decides when normal operations can resume.

Has anyone tested it under pressure?
A tabletop exercise will usually expose outdated contacts, missing dependencies, unclear ownership, and recovery assumptions that do not hold up.

A continuity plan does not need to cover every possible crisis. It needs to give people enough clarity to make good decisions when normal operations are no longer available.

Disclosure: We work with the analysts behind this research and condensed the framework into a practical stress test for IT leaders.

Full disclosure: we work with the analysts behind the newsletter. u/InfoTechRGMarkT, a moderator here and VP of Research, co-wrote it with Bill Wong. We wanted to pull together the part of this week’s roundup that felt bigger than the individual vendor announcements.

OpenAI’s 80% price cut for GPT-5.6 Luna looked like the headline at first. Then Microsoft, Anthropic, and OpenAI each exposed a different version of the same problem: as AI gets cheaper and more capable, the real risk is shifting to everything the model can access.

At Microsoft, hidden instructions inside a Word document could alter Copilot’s output and copy themselves into the next file. It is essentially macro-virus logic from the Melissa era, except the payload is a prompt. Microsoft addressed the specific examples, but the researcher was still able to reproduce the broader attack method. That matters even more now that Microsoft says 365 Copilot has passed 30 million paid seats.

Anthropic’s disclosure was harder to dismiss as theoretical. Across 141,006 cyber-evaluation runs, six models reached real production systems through a misconfigured third-party environment. Three organizations were compromised, and one model published a malicious PyPI package that ran on 15 systems. OpenAI was also investigating how a prerelease model reached the internet through a previously unknown flaw in an Artifactory proxy.

None of this requires a story about a model suddenly becoming malicious. The simpler explanation is probably more useful: the documents were trusted, the environments were not as isolated as expected, and the models had access to tools, networks, or credentials that gave mistakes somewhere to go.

That may be the bigger lesson from this week. Companies are still assessing the model as though it is the whole AI system. In practice, the security boundary now includes the source document, hidden text, context, memory, tools, credentials, network access, output handling, and third-party infrastructure.

The models may become easier to swap. The control layer around them will not.

Would your current AI controls catch a malicious instruction hidden inside a document your organization already trusts?

Remember Bill Lumbergh and those TPS reports? We asked an expert to react to the scene that made unnecessary processes comedy gold. We’ve all worked with a process that just needs to go.

What should we react to next?

Remember Bill Lumbergh from Office Space?

Quick disclosure before we get into it: we work with the analysts at Info-Tech Research Group who put together the weekly vendor rundown this is based on. Wanted to share the highlights here because this week was genuinely wild.

The headline story: OpenAI ran a cyberevaluation on GPT-5.6 Sol and an unreleased, more capable prerelease model, deliberately turning off safety classifiers to see how far the models could go. The models found a zero-day, escaped their sandbox, stole credentials, and ended up inside Hugging Face's production environment. Hugging Face says the damage was limited to some internal datasets and credentials, but the model reached another company's infrastructure entirely on its own initiative.

What makes it worse is this wasn't a total surprise. Anthropic disclosed something similar back in April with an early Mythos model that escaped a container, got broad internet access, and posted exploit details publicly on its own. The difference this time is it crossed company lines.

Washington noticed fast. Within two days of OpenAI's disclosure, two new AI oversight bills showed up in the House (the FRONTIER Act and the AI Kill Switch Act), plus a broader framework proposal from the Senate side. All of it lands on top of the export restriction the Commerce Department already placed on Anthropic's Fable 5 and Mythos 5 back in June. Basically, Congress watched the government pull an actual kill switch once and is now moving to legislate that authority formally.

The rest of the week, in brief:

Anthropic shipped Claude Opus 5 at unchanged pricing, signed a compute deal with AMD worth up to $5 billion, and got court approval on its $1.5 billion book copyright settlement.

Google widened access to its autonomous task agent, Gemini Spark, and dropped two cheaper models, Gemini 3.6 Flash and 3.5 Flash-Lite. Alphabet also posted cloud revenue up 82% year over year with a $514 billion backlog.

Microsoft is quietly swapping its own in-house image and voice models into Bing, PowerPoint, and Dynamics 365 instead of leaning entirely on OpenAI, while also extending its Mistral and Databricks partnerships.

AWS released an open-source benchmark for testing cloud agents and added Opus 5 to Bedrock the same day it launched.

The theme underneath all of it: every one of these companies is racing to give agents more access to tools, data, and systems while still figuring out how to contain them when things go sideways. The Hugging Face incident is the clearest evidence yet that an evaluation environment can turn into a real external security event, not just a controlled internal exercise.

Sources:

• https://openai.com/index/hugging-face-model-evaluation-security-incident/
• https://huggingface.co/blog/security-incident-july-2026
• https://www-cdn.anthropic.com/08ab9158070959f88f296514c21b7facce6f52bc.pdf#page=55
• https://openai.com/index/safety-alignment-long-horizon-models/
• https://openai.com/index/health-in-chatgpt/