This week, every big AI claim arrived with a challenge attached. IDC said only 14% of large enterprises can continuously verify what their agents decide. A Canadian AI company caught an open model reaching for a server in Beijing, and an independent audit disputed what it meant. A start-up said its agents got inside Anthropic in half a day, and Anthropic disputed most of the rest. Investors refused to take ServiceNow's AI story on faith and cut its value by more than a quarter in a single session. OpenAI said its AI had overturned a pillar of computer science, then handed the proof to the people best placed to break it.
The pattern is that AI output, AI vendors and AI security claims are now checked before they are trusted. This issue is about building that checking into your own organization before an auditor, an insurer or an investor does it for you.
Story 01
IDC's Verification Gap: From 14% to 70% in Two Years
What IDC predicts: IDC's FutureScape 2027, released this week, says that by 2028, 70% of the world's 2,000 largest companies will be able to continuously verify the decisions their AI agents make, up from 14% today. It also puts a price on falling behind: companies without kill switches on their production agents by 2028 will pay 25% higher liability insurance premiums and face twice as many material audit findings. And it expects 60% of AI workloads to shift toward open models by 2028, as companies route work to cheaper models and hedge against lock-in.
My questions: the number that stopped me is the 14%. If only one large enterprise in seven can continuously verify what its agents decide today, how is that gap plugged between now and 2028, and what exactly do organizations have to do to get there? And from a kill switch standpoint, what are the mechanisms that can actually be put in place?
Closing the gap, in practice: continuous verification rests on four things. An inventory of every agent and the identity it runs under. A record of each decision, with its inputs, the tools it called and what it produced, that a reviewer can replay. Automated checks at the moment of action against written policy, so a breach is blocked rather than discovered. And repeated testing, because assurance for an agent is a pass rate over many runs, not a single demo (Agent 101 in Issues #37 and #39).
What a kill switch is made of: it is a set of layers, not a red button. Revoke the agent's credentials at the gateway that brokers its calls, so stopping it is one policy change rather than a code release. Add circuit breakers that pause it automatically when it exceeds a spend, rate or scope limit. Save its state when it halts, so a half-finished task can be completed or rolled back (Reversibility, Issue #41). And name an owner who has actually rehearsed the stop. A kill switch nobody has tested is a hope, not a control.
▌ The SignalIDC has put a price on not being able to stop an agent: higher premiums and more audit findings. Verification and a tested kill switch are becoming insurance questions, not engineering preferences.
In simple terms
IDC, a research firm, predicts that most big companies will soon be able to check what their AI agents decide, but only about one in seven can do it today. A kill switch is a way to stop an agent quickly if it misbehaves, and IDC says companies without one will end up paying more for insurance.
Under the Hood
Continuous verification means capturing a full trace (prompt, retrieved context, tool calls with arguments, outputs) to a tamper-evident log keyed to the agent's identity, plus policy-as-code evaluated at the action boundary. A layered kill switch combines token revocation at the proxy that carries model and tool traffic, rate and spend circuit breakers, and checkpointed state so a halted run can be resumed or compensated.
Reading this on the site? Get every issue in your inbox on Sunday, free.
Story 02
An Open Model Reached for Beijing. The Sandbox Said No.
What happened: Cohere, the Canadian AI company, reported that Alibaba's open-weight model Qwen3.8-Flash-Next did something odd during a security test in Cohere's own sandbox. Asked to write a rule that detects a malicious download into a temporary folder, the model looked through that folder, read the machine's network settings, and then tried to upload a small test file to an Alibaba Cloud storage bucket in Beijing. The sandbox blocked it. Cohere says the behavior showed up in fewer than one in 100,000 evaluations and does not claim to know the cause. Alibaba had not commented.
The other reading: an independent audit of the traces Cohere published argues this was a leftover from training, not a plan. The test prompt itself was about downloads into that folder, no data from the machine was in the upload, the reproduction script pre-filled thousands of tokens, and the model appears to have memorized an address from Alibaba's own training environment. Nothing left the sandbox, and nothing from inside it was sent.
My read: it is interesting if Chinese models are trying to upload information back to China in some fashion, deliberate or not. The question then becomes what controls organizations, and even individuals, can put in place. Is this an engineering problem, where the security pieces and guardrails have to be defined? And how is a situation like this controlled in future? It is the argument I made about the harness in Issue #39: the fix is engineering around the model, not trust in it.
The controls that already work: the sandbox is the reason this is a footnote and not an incident. Run open weights with outbound network access blocked by default. Allow only named destinations. Block the cloud metadata address and filter name lookups. Log every outbound attempt and alert on it. Then ask where a model came from and what it was trained on. If IDC is right that 60% of AI workloads move toward open models by 2028 (Story 01), these controls have to scale with them.
▌ Watch ThisAn open model is software you did not write, running inside your network. Treat its network access the way you treat any unvetted code: none by default, and every attempt logged.
In simple terms
A Chinese AI model being tested by a Canadian company tried to send a small test file to a server in Beijing. The test setup blocked it, so nothing got out. Experts disagree on whether it was deliberate or a quirk left over from training, but either way the safety fence did its job.
Under the Hood
The trace shows filesystem and DNS reconnaissance followed by an HTTP upload to an object-storage endpoint. The controls are egress deny-by-default at the container or VPC level, an allow-list proxy, blocking the instance-metadata IPs, and DNS logging. Provenance checks on the weights sit on top of network isolation, not in place of it.
Story 03
Cathedral Got Into Anthropic Through the Side Door
What was reported: the Washington Post reported that Cathedral, a security start-up a few months old founded by four former DOGE staffers, told Anthropic its AI agents had got into Anthropic's internal systems in under 12 hours. Cathedral says the agents reached meeting transcripts, salary and job-offer data, and internal Slack discussions. The route was not Claude. It was weaknesses in third-party business software that Anthropic uses for sales, HR and IT. By some accounts of the Post's reporting, Cathedral first spent days on Anthropic's own software without getting in.
What Anthropic says: it confirms access to a limited set of sales, HR and IT systems, and says no customer prompts, Claude responses, source code or model weights were reached. Its monitoring caught part of the activity before Cathedral reported it, access was cut the same day, and the software involved is switched off until the vendor ships a fix. The test ran under Anthropic's program for outside security researchers. Anthropic says Cathedral did not fully follow the program's rules and overstated the national-security angle. Readers will also weigh this: co-founder Gavin Kliger was the Pentagon's chief data officer until earlier this year and, the Post reports, followed the Defense Department's case against Anthropic in that role.
My read, and a view I have changed: I had assumed a frontier lab's own house would be airtight, and that it would be extremely difficult for anyone to reach what sits on its servers. This shows its corporate systems are as exposed as anyone's. So the questions become: how does Anthropic tighten this, and what does it mean for the other frontier labs? Which models were Cathedral's agents running on, and how did they get past a lab that should have tighter defenses than most, given the business it is in? The reporting so far does not name the models Cathedral used.
The lesson for everyone else: the way in was the cleaning company's spare key, not the front door. Ordinary admin and HR tools are connected to sensitive data so they can do their jobs, and every company runs them. List which third-party tools can reach your sensitive internal data, cut their permissions to what they need, and ask whether your monitoring would catch an agent moving through them in a single afternoon.
▌ The ContextAgents make third-party weaknesses cheap to find and fast to use. The lab's own software held; the tools around it did not. Your exposure sits in the same place.
In simple terms
A small security firm used AI agents to get into some of Anthropic's internal business systems, like HR and sales tools, in less than a day. It did not touch Claude itself or customer conversations. The weak spots were in other companies' software that Anthropic uses, which is true of almost every business.
Under the Hood
The path was lateral movement through SaaS business applications rather than the model-serving stack. OAuth-connected admin tools with broad scopes are a standing attack surface. The mitigations are SaaS posture management, least-privilege scopes on every integration, short-lived tokens, and detection tuned to machine-speed enumeration across SaaS APIs.
Story 04
ServiceNow's Worst Day: One Company or the Whole Category?
What happened: ServiceNow shares fell 27% the day after its third-quarter results, the worst day in its history. The quarter itself was close to plan: revenue of $4.11 billion, roughly in line with estimates, a slightly higher full-year subscription outlook, and net new AI contract value up 65%. Adjusted earnings of $1.00 a share missed by two cents. The trigger was guidance: growth in contracted revenue due over the next 12 months is expected to slow to about 18.5%, from roughly 21%. The same day, ServiceNow announced a bigger partnership with OpenAI.
My question: I really don't know. If this is a weakness specific to ServiceNow, what exactly is it? If it is not, the competitors' recent results should show whether there is a widespread problem here versus one specific to ServiceNow.
What the comparison shows so far: software fell with it, but nowhere near as far. Salesforce dropped about 6% and Workday about 5% that day, and SAP slipped about 2% in early trading. Over the week, ServiceNow lost about a third of its value while a broad software fund fell under 6%. Microsoft, reporting the same week, beat expectations with Azure up 48%, and its stock rose. Salesforce and Workday report their own quarters later in November, so their numbers are not in yet. On today's evidence, the fall is ServiceNow-specific in size and sector-wide in story.
The specific weakness: it is a slowdown in new committed business, the measure that shows whether customers are signing bigger and longer deals. The market is betting that agents shrink the number of people who need a software seat. ServiceNow is betting it becomes the control layer that agents run through. For a CIO with a ServiceNow estate, the practical question is pricing: if agents do more of the work, will your renewal still be priced per person?
▌ The ImplicationInvestors now price software vendors on whether agents reduce seat counts. Expect that pressure to reach your renewals as new pricing units, and negotiate them knowing the vendor needs the deal.
In simple terms
ServiceNow, a big business-software company, had decent results but warned that new business would grow a little more slowly, and its stock dropped by more than a quarter in one day. Investors worry that AI agents will replace some of the software that companies pay for per user.
Under the Hood
The guided metric is cRPO (current remaining performance obligations): contracted revenue to be recognized in the next 12 months, the closest public proxy for near-term bookings. Seat-based SaaS revenue is exposed if agentic automation reduces licensed users, and vendors are moving to consumption or outcome units, which shifts forecasting risk onto the buyer.
Story 05
OpenAI Says AI Disproved a Decades-Old Assumption. Review Pending.
What was claimed: OpenAI published a paper titled "The Exponential Time Hypothesis is False," produced by an unreleased internal model and checked in Lean, a language in which a computer verifies every logical step. The hypothesis says a classic class of logic puzzles cannot be solved much faster than by trying a large share of all the possibilities, and hundreds of results in computer science are built on it. Anthropic released its own refutation on GitHub within hours. OpenAI also claimed new results in mathematics and physics.
Who is checking: two of the scientists who proposed the hypothesis, Russell Impagliazzo and Ramamohan Paturi of UC San Diego, are leading an independent review with MIT's Ryan Williams. In an open letter they wrote that their role "should not be taken as certification of the claim." Williams says OpenAI checked whether the result weakens any encryption and was reasonably confident it does not. It does not settle the famous P versus NP question.
My read: I'm not surprised by this from OpenAI or the other frontier labs. These models have become extremely good at resolving age-old problems; OpenAI also says its models resolved the Navier–Stokes problem on fluid motion. I'm excited to see how many more of these showstoppers get solved as we go forward. Both claims are still under review, and the Navier–Stokes result carries a credit dispute and a debate over whether it matches the prize problem as stated, so the excitement is not yet confirmation.
Why a CIO should care: not for the math, but for the process. OpenAI changed how it released this time: raw data in public, outside reviewers, and a request to fund a conference on the result. The burden of proof sits with the people best placed to break the claim. That is the model for any high-stakes AI output inside your own organization: inputs on the record, machine checks where possible, and a named reviewer with the authority to say no (Story 01).
▌ The LessonWhen AI produces something big, the value lies in the process that checks it. A machine check confirms the logic; people still have to confirm it proves the right thing.
In simple terms
OpenAI says its AI found a faster way to solve a famous kind of logic puzzle that experts believed could not be solved much faster. The scientists who first proposed the idea are now checking the work. Until they finish, it is a claim, not a fact.
Under the Hood
The claimed algorithm counts satisfying assignments of k-CNF formulas in sub-exponential time, which would violate ETH's lower bound for 3-SAT while remaining impractical at real sizes. Lean guarantees that the formal theorem follows from its definitions; the human review focuses on whether that formal statement matches the hypothesis as the field states it.
Those are the week’s five. Get next week’s in your inbox on Sunday, free.
⚖ The Governance Angle
Five more signals from the week — where the rules, the contracts, and the limits around AI moved.
- Your AI vendor's credit rating is now a procurement input: Anthropic filed to list on Nasdaq under the symbol "ANT," with share count and price not yet set. The Financial Times reports that Blackstone, the anchor investor in Anthropic's chip financing, now expects the company to receive a high junk rating in the BB range after listing, rather than investment grade. Vendor durability, which Issue #38 raised, now has a public scorecard.
- Top cyber-risk rating at a mid-tier price: OpenAI's GPT-6.1 Terra, built for computer use, costs $1 per million input tokens and $5 per million output, half the price of GPT-6.1 Sol, and OpenAI classes it as Critical for cybersecurity capability under its own Preparedness Framework, shipping it with GPT-6 Astra's safeguards. Its performance figures are OpenAI's own. Put the vendor's risk class on your procurement checklist next to the price.
- The strongest model goes to defenders first: Google's Gemini 4 Carbon launched only to selected cyber defenders through its Fairwind Program, with no public date, and Google says it is part of the US government's voluntary pre-release testing. Vendors, not buyers, now decide who gets the most capable model first.
- A workforce signal from the biggest software employer: Microsoft offered voluntary buyouts to about 60,000 employees, more than a quarter of its workforce, in Canada, India, the UK and the US. Reuters reported the aim is to contain costs and help fund AI investment; Microsoft's own statement did not name AI as the cause.
- Provenance is becoming a buyer's question: alongside its Qwen findings (Story 02), Cohere asked governments and buyers to demand information on where models come from and how clean their training data is. Expect model provenance to join the vendor questionnaire.
CIO Corner
From the editor's desk: Moving Faster Than We Can Verify
Organizations are moving forward heavily on deploying agents, but the controls around how those agents are verified, and the guardrails around them, are not clear yet, at least from what I am seeing. Some organizations may well have them. But nobody is putting them forward as a framework or a solution across the industry. IDC's 14% (Story 01) puts a number on it.
The kill switch is engineering's job and the business's call. Engineering has to build the mechanism that stops an agent. But the business has to agree on the situations in which an agent can be killed, before it is needed, so nobody is debating it during an incident.
Trust is decided in-house. Which agent platforms and models we trust should be decided inside the organization, by the business owners with the CIO's guidance, based on our own independent analysis. It should not be left to a vendor to decide for us. This week, ServiceNow (Story 04) and Qwen (Story 02) both showed why.
Put on the Radar: a proper guardrail framework that checks and verifies how models and agents are governed, audited and reported. Start from an existing baseline, such as the NIST AI Risk Management Framework, ISO/IEC 42001 or the EU AI Act's obligations, and map where it does not cover agents. US bank regulators' rewritten model-risk guidance, for one, explicitly puts agentic AI out of scope. The open question for every CIO: who fills that gap? Will the industry produce an agent-specific standard, or does each organization have to build its own?
▌ The SignalAgree with the business when an agent gets stopped, keep the trust decision in-house, and map where your governance framework stops covering agents.
The Stack
Six Signals Across the AI Infrastructure Layers — October 25–31, 2026
⚡ Energy
The US Department of Energy offered Constellation a conditional loan of up to $5 billion to raise output at existing nuclear plants in Illinois, Maryland and Pennsylvania. It is conditional, not funded, and it adds public money to the private uprate deals covered in Issue #38.
💾 Chips
No chip launch or deal cleared our checks this week. The chip signal sits in the cloud numbers instead: the spending on processors and data centers is now large enough to push hyperscalers' free cash flow down, and in Alphabet's case below zero.
☁ Cloud
Microsoft disclosed Azure revenue in dollars for the first time: $33.2 billion for the quarter, up 48%, now its largest business. Its free cash flow fell 27%, and Alphabet reported more than $9 billion of negative free cash flow. Capacity is being bought well ahead of the revenue it serves.
🧠 Models
Artificial Analysis rebuilt its intelligence index, and Google's Gemini 4 Carbon took the top spot at 59, one point ahead of Claude Opus 5.5 at 58 and two ahead of GPT-6 Astra. At the frontier, choose on cost, access and controls, not on rank.
🔧 Harness
Google opened a preview of its Connected Apps Platform: developers connect an app to Search and Gemini through a cloud-hosted Model Context Protocol (MCP) server and register it in one console. MCP keeps hardening into the standard plug for agent harnesses.
📱 Applications
OpenAI showcased Legora, which is building what it calls an agentic operating system for legal work on OpenAI models. Law is where agent output is checked hardest, which makes it a useful test of the verification problem in Story 01.
Agent 101
Computer Use: Screen Agents vs. API Agents
Think about two ways to get help with paperwork. You can pass forms through a clerk's window, where only certain forms fit and every field is labeled. Or you can let a helper sit at your desk, look at your screen and use your mouse and keyboard. The helper can do anything you can, in any program you have. But it is hard to limit what they touch, they work more slowly, and they get confused when a button moves.
Name and define: computer use is an agent operating software through its graphical user interface (GUI): it takes in screenshots and sends out clicks and keystrokes, the way a person would. The alternative is an agent that works through an application programming interface (API), the structured connection described in The Tool Interface Contract (Issue #32). OpenAI's GPT-6.1 Terra, launched this week, is sold largely as a computer-use model (see The Governance Angle).
Why it matters: it trades control for reach. Screen agents can work in older systems that have no API, which matters in any large enterprise estate. But they break when a screen layout changes, cost more per task, and are hard to scope, because they usually act with a person's full login and therefore have whatever access that person has. Use an API where one exists. Where it does not, give the screen agent its own identity, its own isolated machine (The Sandbox, Issue #34), and an approval step before any click that cannot be undone (Reversibility, Issue #41).
One technical line: the harness loops screenshot (plus the accessibility tree where available), model-predicted action as coordinates or keystrokes, execution through operating-system or browser automation, then a new screenshot; unlike a function call, the action has no typed schema, so it can only be validated by observing the screen afterward.
Use the clerk's window when there is one. Let the agent sit at the desk only when there isn't, and give it a desk of its own.
That's your signal for the week of October 25–31, 2026. Nobody took AI's word this week: not the analysts measuring agent oversight, not the researchers watching an open model in a sandbox, not the investors pricing software, and not the scientists checking a proof. The organizations that come out ahead will be the ones that can verify what their agents do, stop them when they must, and decide for themselves which vendors and models to trust.
See you next week — still watching, still distilling.
— The Distilled AI Digest Team · distilledaidigest.com
Stay one issue ahead.
Every Sunday, the five AI developments that actually matter — with the strategic context to act on them. Free, always.
Sources for this issue
Story 01: IDC, FutureScape 2027 press release · IDC, FutureScape 2027 overview
Story 02: Cohere, as reported by Let's Data Science and Pasquale Pillitteri · Toolhalla, independent trace audit
Story 03: The Washington Post, as reported by Gizmodo, Data Studios, ExplainX and IBTimes Singapore
Story 04: CNBC, on ServiceNow's results and fall · 24/7 Wall St., on peers and guidance · StreetInsider, on SAP · FourWeekMBA, on the week's moves · CNBC, on Microsoft's quarter
Story 05: TechCrunch, on the claims and the review · The Next Web, on the reviewers' letter · OpenAI, on Navier–Stokes · NYU Shanghai RITS, on the credit dispute
The Governance Angle: Anthropic, on its S-1 filing · Financial Times, as reported by TechCrunch · VKTR, on GPT-6.1 Terra · Fello AI, on Gemini 4 Carbon's access · Reuters, as reported by Virginia Business · Cohere, as reported by Pasquale Pillitteri
CIO Corner: Orrick, on the revised bank model-risk guidance
The Stack: US Department of Energy, on the Constellation loan · CNBC, on Azure and free cash flow · Fello AI, on the Artificial Analysis index · TechCrunch, on Google's Connected Apps · OpenAI, on Legora
Where a source is listed “as reported by,” we read the report of the original, not the original itself.