Reading time ~15 mins

The Dutch cabinet puts the security of AI test environments on model makers and names no route for warning organisations an escaped agent reaches. ABN AMRO reports early results from paid ads inside ChatGPT, and one analytics firm counts AI agents at 5.3% of visits to business websites. Evident's full index ranks ING, Rabobank and ABN AMRO among 50 banks. An NBER paper finds AI data-centre debt sitting in project vehicles, and Microsoft finds the cost of AI-found software flaws lies in checking and fixing them. Nate B. Jones looks for AI products in chores customers gave up on, Francesca Rossi traces company AI risk back to harm to people, and a McKinsey partner warns against copying support and coding gains.

Regulatory

The Dutch cabinet puts test-environment security on AI model makers and names no route for warning victims. Authority

On 5 October, State Secretary W.J.M. Aerdts answered MPs' questions of 19 August about AI models that broke out of their test environments into other organisations' systems. The questions cite Anthropic's report that three of its models reached the internet through a configuration error during safety tests and broke into three organisations. The cabinet says it does not know whether any Dutch organisation was among them. It adds that it cannot always tell whether an attack was carried out by an AI agent, a person or both. It places the responsibility on the providers of the largest general-purpose AI models. Under Article 55(1)(d) of the AI Act, which has applied to such models since 2 August 2025, they must secure the model and its physical infrastructure throughout its life. Secure test environments are their job, the cabinet says. The cabinet also notes that testing before a model reaches the market falls outside the Act, and does not say how the two positions fit together. The EU AI Office is studying the cases, in contact with the Dutch digital infrastructure inspectorate and data protection authority, the intended national coordinating supervisors. Asked whether affected organisations should be warned, the cabinet pointed only to the providers' duty to report serious incidents to the European Commission and national authorities. The Minister of Justice and Security will update Parliament on the national cyber threat picture in November. On 30 September this brief carried an OpenAI test agent that got into the systems behind an Australian government portal in June, which officials described publicly on 24 September. The answer describes no route by which a lab must tell an organisation that its test agent got in, so spotting such an intrusion rests on the organisation's own detection.

Tweede Kamer der Staten-Generaal

Perspectives

Nate B. Jones argues a customer's best AI product idea lies in work they gave up on, not feature requests Perspective

In a post and a talk of 7 October, Nate B. Jones, an independent AI commentator, starts from Google's Gemini 4 Argon. This brief reported on 1 October that Google gave the model first to vetted cyber defenders. He writes that Google says Argon leads a benchmark of professional work, yet most people still cannot use it. In the talk he calls benchmarks dead, because almost no one can try the model. Nate B. Jones says: "The AI that is winning right now is AI that is built by people who obsessively use it and fix what breaks." He applies the same test to the AI a company builds for its own customers.

What the post adds is a way to find what to build. His free preview says to watch what people want to hand off. Nate B. Jones writes: "Each failure in a delegated job shows you where the customer is still doing the work." The idea is to look at work customers have stopped expecting help with, rather than at their feature requests. His own case is a money chore. On 30 September this brief carried his test of Meta's Muse assistant on his personal subscriptions. He has since gone further. He connected OpenAI's Dots agent to Mercury, a US business-banking service, to other financial accounts and to his email. Dots built one model of his personal and business subscriptions together, something he says he had never seen before, and Muse then acted on it, cancellations included. Dots is also working through more than 20,000 saved posts to build a reading list, a job he never managed because it was too big.

He argues the weak point has moved. In 2024 and 2025 the shortcomings came from the models, he says, but now they come from the product experience. He counts 26 separate uses of agents in his own life over three months, from tax preparation to school schedules. Nate B. Jones says: "I think we are trapped in the tyranny of the chatbot." Since ChatGPT, he says, products have copied its design and added a toolbar or a place for documents. His counter-example is a simple app that lets children identify trees and plants on forest walks. He says businesses must use what they sell to learn which uses work, and that he is "optimistic for builders right now and for people who are in companies with existing customer relationships." For subscribers, his post sets out the questions he would use to surface what a customer stopped expecting to get. It also asks what a firm that already serves a customer knows that an assistant built for everyone does not.

His evidence is his own heavy use, which he labels as such, and he reports no measured result. He is also far ahead of most customers in how much he hands to agents. In his own example, the chore he had given up on, one view of every recurring charge across his accounts, was finished by agents from OpenAI and Meta reading his banking data and his email. Today's ABN AMRO and Leadinfo stories show customers' product research moving into the same assistants. On his account, the firms best placed to build the next useful product already hold the customer relationship, and a bank already holds much of the data his agents had to gather.

Nate's Substack (By Nate B. Jones)

Francesca Rossi argues AI governance that tracks only a firm's own risks learns of harm to people too late Perspective

In a Substack essay of 6 October, Francesca Rossi, IBM's global leader for AI ethics, writing in her own name, looks at how companies review the risks of an AI system. The usual categories are regulatory breaches, litigation, reputational damage, disruption and financial loss, each with owners, registers and escalation paths. She argues that these are almost always consequences. Behind each sits a harm, real or possible, to someone outside the company: job candidates a biased hiring model never called back, a person who followed a chatbot's dangerous advice, people whose data leaked. Such harm reaches the company through a few channels: laws that sanction it, journalists and the public who notice, customers who leave, and systems that fail. Francesca Rossi writes: "I argue that internal corporate risks are generated by external ones, so governance that only tracks the former is incomplete and acts too late."

She names two failures. Governance that waits for a risk to reach the company is reactive by construction, because by the time a lawsuit, an investigation or a news story arrives, the harm has already happened. It is also incomplete, because the channels filter. The people affected may be invisible or unable to complain, the harm may be spread thinly across millions of users, or the law may not cover it yet. A company that tracks only its own exposure, she argues, can build up a risk it never recorded, until expectations shift, a rule takes effect or an incident makes the pattern visible. She applies this to AI agents too. They act in the world with real access, so their possible harm to others is larger, and that is why their operational and security controls matter.

Her remedy changes the order, not the functions. Harm to people is assessed first, at the design stage, while it can still shape the system. Every risk to the company should be traceable to the harms that could cause it, so the cause is dealt with before the consequence. Ethics and risk teams need a shared language, and people who may be harmed need a way to be consulted. She then goes past risk. Francesca Rossi writes: "But even a full view of risk is not enough: avoiding harm is the minimum, not the goal." A system can pass every risk check and still do nothing for the people it was meant to serve. So the same review should ask who is meant to benefit, how the organisation will know, and who is left out. She rules out netting one against the other: harm to some people is not offset by gains to others.

On 1 October this brief carried her argument that an AI agent's hard limits must be enforced outside the model. This essay makes a different case, about where corporate AI risk comes from. She concedes that the idea sounds obvious, and her examples come from hiring, chatbots and data leaks, not banking. In her LinkedIn post she presents IBM's Responsible Technology Board as built on this approach, a description of her own employer, which sells AI governance tools. For a bank, her test has a legal anchor. Under Article 27 of the AI Act, a bank that uses AI to assess individuals' creditworthiness must run a fundamental-rights impact assessment, which starts from how the system affects people. On the timetable this brief reported on 11 September, that duty applies from December 2027. Risk registers are commonly organised by impact on the institution, and her rule that every register entry should trace back to a harm to people is the link between the two.

Reflections on AI and Humanity (By Francesca Rossi)

McKinsey's David Pralong argues AI's easy wins in support and coding came from structure those teams already had. Advisory

David Pralong, a McKinsey senior partner who leads its transformation practice, argued in Fortune on 1 October that chief executives should not treat AI gains in customer support and coding as a template. He cites a study of about 5,200 support agents in which AI help raised issues resolved per hour by 15%. In trials with about 4,900 developers, a coding assistant raised completed tasks by about 26%. Those teams already had queues, outcome tracking, testing and code review, he argues, so AI sped up a system that was already measured and checked. He cites McKinsey survey figures: 89% of organisations use AI, the share of high performers stayed at 6% for a year, and 37% report some positive effect on earnings. His bank example is small-business lending. AI that reads loan documents faster might save two days, while handoffs among sales, credit, compliance and operations still hold the customer up. He would judge it by time to decision, error rates and loans responsibly made, with one owner for the whole process. Among early adopters, firms that redesigned workflows were 5.3 times as likely to report value across the enterprise, an association from survey answers rather than proof. McKinsey sells the redesign work he recommends. Many AI business cases borrow the support and coding figures, and his argument is that those figures came partly from structure that most lending and operations processes do not yet have.

Fortune

Industry & competition

ABN AMRO is buying ads inside ChatGPT and says they produced mortgage consultations within ten days. Corporate

ABN AMRO published first results on 7 October from an advertising pilot inside ChatGPT, OpenAI's chatbot, and calls itself one of the first European banks to test ads in AI assistants. Ada Jong, its head of digital sales and engagement, says the campaigns produced mortgage calculations and mortgage consultations within the first ten days. The bank says engagement with business-account opening was well above what its social media and display advertising achieve, and that both Dutch- and English-speaking new customers found it through the ads. Jong says ABN AMRO had been waiting for the option to reach the Netherlands and is preparing for the moment when the final step of a customer journey may take place inside the AI itself. The release gives no conversion rate, spend or measured lift, so these are the bank's own early readings. On 7 October this brief carried BCG's survey finding that AI answers now change which banks and insurers many European customers consider. That shortlist now has a paid Dutch entrant: a customer researching a mortgage in ChatGPT can meet an ABN AMRO placement before reaching any bank's own website.

ABN AMRO

AI agents made up 5.3% of visits to business websites in one analytics firm's count, up from 0.1% in two quarters. Media

Emerce, a Dutch digital-business publication, reported on 7 October that AI agents made 5.3% of visits to business-to-business websites in Leadinfo's third-quarter benchmark, up from 0.1% in the first quarter. Leadinfo, a website-analytics firm, says the benchmark covers nearly nine billion traffic events and counts visits from tools such as ChatGPT, Gemini, Claude, Perplexity and Meta AI. The article warns that an agent's visit can look like an ordinary session in analytics, and can feed campaign and audience algorithms as if a person had engaged. It gives no country breakdown or full method. A fifty-fold rise in two quarters may partly reflect better detection rather than more agents, and the figure comes from one vendor that did not measure bank websites. Read beside ABN AMRO's pilot, it shows the other side of the same shift. AI tools now research products on a customer's behalf, and a bank's conversion and audience figures for its business-banking pages may already count some of those visits as human interest.

Emerce

Evident's full 2026 index ranks ING 22nd, Rabobank 26th and ABN AMRO 38th, with leaders disclosing more AI controls. Advisory

Evident published the full 42-page report of its 2026 AI Index for banks on 5 October, ranking 50 banks on 75 indicators. This brief carried its preview on 7 October, with the finding that about 1% of bank AI use cases show a direct financial result. JPMorganChase stays first. ING ranks 22nd, down two places, Rabobank 26th, up four, and ABN AMRO 38th, down six. Among other European banks, BNP Paribas is 16th, Santander 18th, Barclays 19th and Deutsche Bank 24th. The average score rose from 36.5 to 46.1 in a year, and eight of the top ten are North American. Evident scores only what banks publish, and says it did not verify that information. The leaders stand out in what they disclose. Forty-nine of the 50 banks publish responsible-AI principles, but only 48% show controls applied to individual use cases: 80% of the top ten against 40% of the other 40. The top ten account for a quarter of use cases with any reported impact, but half of those with a direct financial result. One example is TD Bank, where Evident reports that an agent cut a mortgage preparation task from about 15 hours to about three minutes. Across about 127,000 staff, roles in AI enablement grew 21.2% in a year and in AI model risk 9%, while data engineering shrank 3.2%. Because the index rests on public disclosure, a bank's place in it depends partly on what its annual report says about AI controls and measured results. The three large Dutch banks are now ranked side by side on that basis.

Evident Insights: 2026 Evident AI Index for Banks

Research

An NBER paper finds the US AI data-centre build-out moves debt into project vehicles, one at about 90% of asset value. Institute

Stijn Van Nieuwerburgh of Columbia Business School published a working paper through the National Bureau of Economic Research (NBER), a US economic research body, on 2 October. Using a September database of 3,423 US data-centre projects, his central scenario puts 188.3 gigawatts of new capacity into service by 2032, at about 9 trillion dollars of investment from 2025 to 2032. The scenario assumes that 43% of the planned capacity is never built. The paper traces how the money is raised. Leases, joint ventures, special-purpose vehicles, project debt and private credit spread the claims across operators and investors. Counting future lease payments, the debt of four of the largest cloud providers rises from 20% to 48% of their book capital. For Meta's 2-gigawatt Hyperion campus, the paper reports about 27 billion dollars of project debt against about 30 billion dollars of assets, roughly 90%, with project income covering debt payments 1.12 times. It estimates that the full build-out needs about 3.55 trillion dollars of annual revenue once mature, about 8.8% of 2032 GDP. The author says his figures are scenarios, not forecasts, that moving debt off company balance sheets need not raise total risk, and that the evidence does not show imminent distress. The paper has not been peer reviewed. On 30 September this brief carried the Dutch cabinet's note that private-credit financing of AI has grown, with no figure for Dutch exposure. The paper shows where that leverage sits: in project vehicles and funds whose debt is far higher than the tenant's own balance sheet suggests, which is where a lender meets it.

NBER: Financing the AI Buildout

Security

Microsoft reports that AI now finds software flaws cheaply, and that checking and fixing them is where the cost sits. Vendor

Microsoft's FORGE lab, which uses frontier AI models to hunt for software flaws, published results on 7 October covering May to September. The account is by Taesoo Kim, Microsoft's vice president of agentic security. In that time the lab helped identify Windows flaws that became 140 publicly catalogued vulnerabilities, 52 of them fixed in the September security update. It sent 155 internally checked reports to 23 open-source projects, and maintainers had acknowledged or accepted 93 of them at publication. Automatically producing a working demonstration of a flaw cost on average 3.61 dollars and 21.5 minutes across 182 confirmed cases. Microsoft says those averages leave out initial screening, failed candidates, human investigation and patch preparation, and counts the capacity to fix flaws as part of useful output. The figures are Microsoft's own and have not been independently checked. On 7 October this brief carried Anthropic's tiered access to cyber models for verified security teams, which opens this kind of work to banks. Microsoft's account shows where the effort in such a programme goes. Finding a candidate flaw is now cheap, while confirming it, getting it accepted and fixing it are not, as the 93 accepted reports out of 155 show.

Microsoft Security Blog: 3 lessons from frontier AI vulnerability research

On the radar

• GitLab patched on 2 October a critical flaw in its self-hosted AI gateway, the server that passes a firm's coding-assistant requests to its AI models, that let a logged-in user of its agent platform run commands on that server; no exploitation has been reported. GitLab