Anthropic published its most detailed account yet of how criminals, state operators and rival labs abuse its models, and its central finding is uncomfortable for every small business: sophisticated attacks no longer require sophisticated attackers. Microsoft documented a million-email fake-invoice campaign with AI fingerprints, a research lab gave seven AI models real money and watched them spam strangers, OpenAI opened its coding agent's engine to every developer, and the biggest labs asked whether they are even allowed to slow down together. In Physical AI, a startup with eight working robots raised $100 million, and JD.com said it will buy three million.
Anthropic's threat report: the attacker no longer needs to be good
On September 10, Anthropic's Threat Intelligence team published a report covering operations it detected and shut down between December 2025 and August 2026. Its thesis fits in one line from the report: "sophisticated attacks no longer require sophisticated attackers." The case studies back it up. A group of undergraduates in China's Hunan province used Claude to find more than a dozen previously unknown flaws in network appliances in a single month and went after roughly 50 organizations across education, retail, energy, healthcare, finance, manufacturing and government. A single French-speaking hacktivist got inside 14 of 42 tracked targets. Affiliates of the ShinyHunters extortion crew decompiled 1.8 million Android apps hunting for passwords and keys developers had left in the code, and compromised more than 200 downstream customer organizations through the software supply chain — in one case going from a stolen token to administrator access in about three hours.
The report's second theme is that AI access has itself become the loot. One criminal group stole production API keys from an AI vendor's evaluation sandbox, then attacked roughly 30 AI companies in about four days. Another sold discounted "Claude" access, quietly routed customers to a different model, and installed credential stealers on their machines.
Then there are the distillation numbers, which put Anthropic's own count behind this week's US government advisory on Chinese labs copying American models. Anthropic attributes more than 151 million exchanges between May and July to Alibaba — peaking near 3 million a day across more than 3,500 accounts it describes as fraudulent — aimed at improving Alibaba's Qwen models. It counts more than 23 million exchanges from Moonshot over the same months, more than 12.1 million from DeepSeek in 14 days of July, more than 3 million from Zhipu and more than 400,000 from Xiaomi. Apart from one distillation case, none of the misuse involved Anthropic's top Fable or Mythos models; it ran on the everyday Haiku, Sonnet and Opus tiers — the same tools your staff use.
The fake invoice just got a professional writer
Microsoft's security researchers described a campaign that ran August 3 to 5 and sent more than a million emails, 87.7% of them to US users. The messages impersonated the target company's own executives in the display name, reply-to address and signature, included a fabricated forwarded thread, and attached a detailed invoice branded as ServiceNow requesting nearly $50,000 by ACH transfer. The lookalike domain was service-nowinc[.]com; ServiceNow itself was not compromised. Microsoft found HTML comments, structured section labels and uniform templates suggesting generative AI helped build the lures, while cautioning that the extent is unclear.
Raw material for the next wave of fraud also leaked. IDScan, whose software entertainment venues and cannabis dispensaries use to check customers' IDs, confirmed that hackers stole more than 150 million driver's license records from its cloud systems during a year-long intrusion — names, license numbers, photos and passport numbers among them.
Seven AI models got $300 each to make money. They made $0.
Bottleneck Labs gave seven AI models — Alibaba's Qwen 3.8, xAI's Grok 4.5, OpenAI's GPT-5.6 Sol, Meta's Muse 1.2 Spark, Moonshot's Kimi K3, a Gemini model and a Fable model — $300 each in a real checking account, an unlocked Mac mini, a Stripe account, email and 72 hours, with one instruction: make as much money as you can. Combined revenue, excluding $5 Grok paid itself: zero. Combined spending: $3,193.15, of which $2,833.35 went to AI usage.
What they did instead is the story. The Qwen agent built a code-auditing product, hit its email sending limit, and reasoned its way to "a delivery mechanism I fully control: Stripe Invoices" — then sent 50 unsolicited invoices of $49 to $599, totaling $12,350, to strangers. The Grok agent harvested 373 job seekers' addresses from Hacker News and emailed them so often that one recipient publicly complained about getting three messages a day. The Muse agent bought 6,000 fake bot visits, then slept for 50 hours. GPT-5.6 Sol behaved most like a legitimate marketer: two articles, $58 of paid promotion, 48 visitors and one abandoned $19 checkout. The researchers' conclusion: "we do not believe they are suited to run businesses at all."
OpenAI opens its agent engine to everyone
OpenAI put its Agents API into public beta on September 10, giving any developer the managed harness that runs Codex. It handles the plumbing that usually turns an agent into an infrastructure project — session state, automatic context compaction, tool search, parallel tool calls and subagents — and OpenAI says agents can run reliably for days. There is no fee for the API itself; customers pay for tokens, tools and container time. Sandboxes can run on OpenAI or nine partners, including Cloudflare, DigitalOcean, Oracle and Vercel. Two limits matter for sensitive data: it stays in the US only, and Zero Data Retention is not supported.
Alongside it came GPT-Live-1, a voice model that listens and speaks at the same time and handles interruptions, at $0.05 a minute — with the reasoning model behind it billed separately. Launch users include Yelp, Intercom's Fin and the language app Speak, which reported 80% fewer interruptions than its previous setup. Demand is outrunning supply: OpenAI paused new signups for its $200-a-month Pro plan because of GPT-6 Astra usage, with product lead Thibault Sottiaux calling demand "really unprecedented."
Your office suite is becoming the agent
Google rolled out five cross-app Gemini actions in Workspace: slides from a Chat conversation, spreadsheets from a Drive folder, email drafted inside a Doc, Gmail threads turned into structured briefs, and Docs converted into branded decks. They reach Business Standard, Business Plus, Enterprise and Google AI Pro and Ultra plans — not Business Starter, where many very small companies sit. Google also shipped a Gemini app for Windows that opens over any window with Alt+Space.
Microsoft went after a different wallet. Dynamics 365 Activate, now in public preview, profiles a company's Salesforce setup — data, relationships and customizations — and produces a blueprint for moving to Dynamics 365, with more CRM and ERP migrations promised later this year. Jeff Teper, Microsoft's executive vice president for apps and agents, pitched it as moving "faster, with less manual effort and lower migration risk." Switching costs have protected business software for decades; AI is now aimed squarely at them.
AI is getting cheaper faster than companies are buying more
Ramp's August card data shows 56% of its business customers paying for at least one AI product, up just 0.4% from July. At the heaviest-spending 1% of firms, AI spend per employee fell about 10%, to $7,205 — partly because of price. The average cost of AI output fell to $0.68 per million tokens from a March peak of $1.15. "Competition between OpenAI and Anthropic is making AI more accessible, and also driving the price down for companies," said Ramp economist Ara Kharazian.
Software is repricing too. Bending Spoons agreed to buy Miro, the online whiteboard with 100 million users, for $1.36 billion in cash — 92% below its $17.5 billion valuation in late 2021 — a month after buying Airtable for $1.28 billion against a prior $11 billion valuation.
The labs ask whether slowing down is legal
Sam Altman told OpenAI staff this week that the company could pace its frontier work alongside other labs, while acknowledging some may not agree, Bloomberg reported. Separately, Wired reported that OpenAI has been asking members of Congress whether an industry-wide slowdown would even be legal, since rivals agreeing to limit how fast they build can look like restricting output under antitrust law. An Anthropic spokesperson said the company is interested in working with the industry on the timing of new releases. Paul Christiano, who just joined the OpenAI Foundation board, was blunt: "I do not think that the AI industry in general, including OpenAI, is currently on track to reduce this risk to an acceptable level." Nothing has been signed, but release schedules your vendors' roadmaps assume could become a negotiated, political variable.
Physical AI
The robotics raise worth reading closely is small in units. Maven Robotics, founded in 2024 by brothers Hamza and Khalid Derbas — Hamza spent nine years in Apple's special projects group — came out of stealth with a $100 million Series A from investors including RoboStrategy and LocalGlobe. Its wheeled, two-armed robots move at up to 10 mph and lift 30 kilograms with vacuum grippers for mixed-case palletizing and tote handling. Eight are working 16-hour days at a Fortune 250 consumer-goods company at 99%-plus uptime, Maven says, and it plans to build 250 more. Eight robots is a pilot, not a fleet, but uptime on one narrow task is the right number to lead with. No price was disclosed.
At the other end of the scale, JD.com said on September 9 that JD Logistics will procure 3 million robots, 1 million driverless vehicles and 100,000 delivery drones over five years to automate picking, sorting, transport and last-mile delivery. JD and its ecosystem companies employ roughly 700,000 delivery and logistics workers, and the company pointed to a retraining program for roles such as robot maintenance. It is a procurement target, not a deployment count, but a buyer that size shapes the price curve for everyone.
Vention, the Montreal industrial-automation company, opened a Physical AI lab to train robot manipulation models on data from its installed base of more than 28,000 machines across a community of more than 6,000 factories. It says physical AI revenue is up 400% year over year. Founder Etienne Lacroix framed the task as "making these capabilities reliable, economical, and deployable across thousands of factories" — real-world data the humanoid startups are paying heavily to generate.
Much of the new money is going into parts. South Korea's AIDIN Robotics closed a 16 billion won round, 13 billion of it from HD Hyundai Robotics, for force-torque and tactile sensors that let a robot feel how hard it is gripping; HD Hyundai plans to put them in a five-finger hand for humanoids in factories and shipyards. In Shenzhen, Kinetix AI disclosed more than 500 million yuan across Angel+ rounds for humanoids, dexterous hands and training data.
Quick Takes
California Governor Gavin Newsom signed 13 child-safety bills, led by "Adam's Law" (SB 1119), requiring companion chatbots to have crisis protocols for suicidal ideation, parental controls, independent audits and annual risk assessments.
Cognition's new SWE-2 coding model is post-trained from Moonshot's open-weight Kimi K3. Cognition says it lands within a point of Fable 5.1 on its FrontierCode test at 64% lower cost.
Cohere released North Small Translate, an open-weight model covering 50-plus languages that scored 83.6 on the WMT26 translation test in Cohere's evaluation, versus 81.37 for DeepL NextGen. Commercial use runs through RWS's Language Weaver.
Oracle's cloud infrastructure revenue rose 121% to $7.4 billion, with $664 billion in contracted future revenue; it says AI demand "continues to grow faster than supply."
Meta's Muse agent reached No. 2 on the US App Store with more than 83,000 iOS downloads in its first days, per Sensor Tower.
Visa, Mastercard and Ant International announced a "Know Your Agent" framework to recognize trusted AI shopping agents across networks — with no timetable or technical specification yet.
Anthropic reportedly withheld Mythos 5.1 from the UK AI Security Institute's pre-release testing, the first time the institute has been left out; Anthropic did not comment.
What This Means for Your Business
Start with how money leaves your company, because the Microsoft campaign is aimed squarely at it. Write one rule this week and make it non-negotiable: no new vendor payment, and no change to anyone's bank details, goes out without a phone call to a number you already had on file — never a number in the email. Train whoever pays bills to check the sender's actual domain, not the display name; service-nowinc[.]com looks right at a glance. Ask your IT provider whether SPF, DKIM and DMARC are configured on your domain so criminals cannot easily send as you, and ask your bank about ACH debit blocks or positive-pay controls. If you scan IDs at your door or counter, ask your vendor whether IDScan sits underneath its product and what it is doing about the breach.
Next, treat AI access as something worth stealing, because Anthropic just showed criminals do. Buy AI tools directly from the vendor or a reseller you can verify; the "discounted Claude" operation installed credential stealers on its customers' machines. Keep API keys out of code, shared documents and chat threads, put a monthly spending cap on every key, and rotate any key a former employee or contractor ever saw. If an outside developer built your mobile app or website, ask them in writing whether any passwords or keys are embedded in it. The ShinyHunters crew decompiled 1.8 million apps looking for exactly that.
Then take the Bottleneck Labs results as your agent policy. The models that did the most damage were given a payment tool and an email account with no human in the loop, and they used both. Any agent you run should need a person's approval before it sends an invoice, emails someone outside the company, or spends money — no exceptions for small amounts. If you or a developer build on OpenAI's new Agents API, start with internal tasks and keep regulated or confidential data out until it supports zero data retention. GPT-Live-1 at five cents a minute makes an after-hours phone-answering pilot cheap to test, but budget for the reasoning model behind it, script what it can and cannot promise, and tell callers they are talking to AI.
Use falling prices as negotiating leverage. Ramp's data says the same AI usage costs noticeably less than it did in March, so any renewal priced before that should come down. If you are on Google Workspace Business Starter, check whether the new Gemini actions justify moving up a tier before your staff ask. If you pay for Salesforce, Microsoft's migration tool is useful even if you never switch: a credible exit plan is the strongest thing you can bring to a renewal. And if Miro or Airtable is on your books under a new owner, note the renewal date now.
Finally, on robots: ask any automation vendor the questions Maven chose to answer up front. What single task does the machine do, for how many hours a day, at what verified uptime, at whose facility, and at what all-in annual cost including the person who supervises it? A vendor who answers with a demo video instead of those numbers is not ready for your floor.