Reading time ~14 mins

Anthropic says its models found 29,000 possible open-source flaws in six months, while its staff could check about 6,000. Google has paused an open-source bug bounty over invalid automated reports. Capgemini and an audited deployment agree that the cost of each completed result, not token price, decides whether AI pays. An MLCommons group proposes a testable profile for each deployed agent. Google names Commerzbank results for a new long-running agent, Mastercard adds an agent-legitimacy score for card issuers, and bunq's assistant figures count support automation. EuroStack puts most of the cost of leaving a cloud provider in its software, and Nate B. Jones asks what an agent can learn from an airline's old email.

Perspectives

Nate B. Jones argues that an agent trained on office email and chat learns to perform a job rather than do it Perspective

In a talk and a Substack post of 8 October, Nate B. Jones, an independent AI commentator, starts from a sale this brief has not covered. He says Google made the winning 10 million dollar bid in an August bankruptcy auction for Spirit Airlines' work records. The runner-up, at 7.5 million dollars, was Mercor, a company that supplies expert work for AI training. The archive he describes holds 100 million emails and half a billion Microsoft Teams records, with code and business documents. The sale has not gone through, and he says a court hearing on it is set for 14 October. Labs pay, he says, because of a leading theory that records of work can teach AI to do knowledge work. This year's progress came in work a machine can check, such as code that runs or fails. The harder frontier is a document whose quality no single changed sentence proves. Nate B. Jones says: "And so what we're really talking about here is the difference between work and the performance of work."

His case is an invoice that does not match its purchase order before the month closes. The two documents sit in separate systems, and a supplier has emailed a credit to someone who was not copied. Suppose, he says, the fix took 30 messages and three meetings, and the one step that mattered was a person noticing the credit had not been applied. Nate B. Jones says: "A message that prevents a costly mistake and a message that says you're following up will sit right next to each other and the agent is going to read both." The success label can mislead as well. A thread may end with the invoice approved and the ticket closed, which looks like success to an agent, while a duplicate payment surfaces six weeks later. He calls his examples lightly anonymised cases he lived through.

What he adds is a view of who sets the standard. Mercor announced plans in July to buy DeepTune, which builds training environments: the software an agent operates, an assignment and checks on whether it succeeded. Mercor has advertised paid roles for experts who help set those checks, so one expert's reading of a job becomes the target an agent trains to hit. Nate B. Jones says: "When a vendor says an agent can handle your role, somebody somewhere in that supply chain has decided what had to be true before a task that you do counts as done." He also sees a skew in the supply. The firms with the strongest reason to sell are those that can find no other use for their records. Nate B. Jones says: "This is the data of last resort." A new broker offers to package small-business data for between 20,000 dollars and 5 million dollars for resale to labs, he says. Spirit's flight attendants' union has raised concerns about confidential employee information and what the linked records reveal.

He says he believes in agents, and his alternative is plain. Find repetitive, high-drudgery work and rebuild it so an agent reads, processes and outputs the data with no chat in between. Structure a team's knowledge in files agents can read, and build evaluations on top. His evidence is his own experience and the auction record, not a measured comparison. His estimate that up to a third of some teams quietly resist AI tools is what leaders told him in private. For subscribers, his post also explores where staff unease about machine-made output comes from, and which set-aside projects might now be worth starting.

For a bank, his argument meets two decisions. A plan to ground an agent on the bank's own email and Teams archives inherits the gap between activity and outcome that he describes. A vendor's claim that its agent can take over a role rests on success checks that someone outside the bank wrote. Today's MLCommons proposal asks for evidence of what one deployed agent may do, and his argument is that the training record behind such an agent may never have shown what success looked like.

Nate's Substack (By Nate B. Jones)

Netherlands & Sovereignty

A EuroStack brief puts most of the cost of leaving a cloud provider in its software, not data location. Institute

EuroStack, an initiative that campaigns for European digital supply, published a 39-page brief on 9 September by authors from Abilian Econ Lab, including Stefane Fermigier. It argues that moving a workload into an EU data centre does little to reduce dependence. A foreign provider's own software can still run the operating system, the control layer that manages the estate and the application interfaces. A calibration it cites across 35 Amazon Web Services products puts about 70% of the cost of switching in that software lock-in and about 30% in moving the data. The brief therefore tells buyers to start with identity, encryption keys, monitoring and deployment tooling. These control the estate but are fairly easy to separate from business logic. It also tells them to put a price on the exit at each renewal. It applies the same test to AI. Retrieval indexes, the searchable stores an AI assistant draws its answers from, are named with evaluation sets, conversational memory and tool and permission settings as assets that tie a firm to one supplier. It recommends portable formats and tested export terms at the first AI purchase, while switching is still cheap. The authors say their working papers are not peer reviewed, and EuroStack argues for buying European. On 13 July this brief carried Arvind Narayanan and Akash Kapur's argument that memory, retrieval indexes and evaluations build lock-in around one AI provider, and EuroStack turns that point into contract terms. The EU's Digital Operational Resilience Act (DORA) already requires banks to keep exit strategies for technology services that support critical functions. On the brief's calibration, an exit plan built around where data sits addresses less than a third of the cost of leaving. On its reading, the next lock-in forms in the indexes and evaluations of a bank's first production agents.

EuroStack: Shifting to sovereign digital supply

Industry & competition

A comparison of bunq, Starling and Revolut assistants finds only bunq publishes figures, and they count support automation. Corporate

Martin Korbelar compared three AI assistants at digital banks in a Finextra blog post on 6 October: Finn at bunq, the Dutch digital bank, Starling Assistant and Revolut AIR. He judges each by the actions it may take, the data it can reach and how the bank brought it into production. He describes Finn mainly as a layer that answers questions and routes support requests. It also prepares payment details from an uploaded receipt or invoice, and hands unresolved cases to a human specialist. Citing an Amazon Web Services write-up, he relays bunq's figures: about 97% of support activity handled, 82% fully automated, requests resolved in about 47 seconds and 90% user satisfaction. Starling and Revolut have published no comparable adoption figures, he writes. His argument is that an automation rate counts support requests closed, not customers who choose to use the assistant, and that weak transaction categories and recurring-payment data limit what any assistant can tell a customer. The figures are bunq's own and were not independently checked, and the author's affiliation is not stated. bunq's 82% is the only published figure among the three, which makes it the obvious reference point when a Dutch bank reports on its own assistant. It measures support work absorbed, not customers who rely on the assistant.

Finextra

Innovation

Google launched a work agent that can run for days and pass tasks to Anthropic's models. Vendor

Google Cloud introduced Gemini agent on 8 October. It plans and carries out goals, keeps tasks running for hours or days, works to a schedule and can create helper agents with identities of their own. Google says it can route each task between its own Gemini models and Anthropic's Claude models, choosing by cost and performance. For control, Google describes a verified identity and narrow permissions for every agent, audit logs and a sandbox with a network boundary. A gateway applies policy to agent traffic as it happens, and spending caps per project pause an agent's work. Gemini for Financial Services, the banking package this brief first covered on 26 August, remains in preview. The new part is named European bank results. Google says Commerzbank cut a manual document review from 20 hours to one. It also says BNP Paribas is putting Gemini Enterprise into its assistant for more than 65,000 staff, the plan this brief carried on 25 September. Google also says Starling's scam warnings quadrupled the rate at which customers cancel payments that may be fraudulent. All of these results are Google's own and come without a stated method. An agent that runs for days and switches between two vendors' models makes the model behind a piece of work a choice made while it runs rather than in the contract. Google's answer for a bank's audit trail is an identity, a log and a spending cap for every agent.

Google Cloud: Welcome to Gemini at Work 2026

Mastercard is adding a score telling card issuers how likely shopping traffic comes from a legitimate AI agent. Vendor

Mastercard said on 8 October that it is adding identity, fraud and behaviour data to Agent Pay, its service for purchases an AI agent makes on a customer's behalf. One addition is a probability score for issuers, the banks that put cards in customers' hands, estimating whether shopping traffic comes from a legitimate AI agent. Skyfire, a firm that verifies AI agents, is bringing its Know Your Agent token into Agent Pay. The token confirms the agent and the person it acts for, and travels with card details replaced by a token limited to the amount the customer approved. Mastercard groups these under an Agent Pay Trust Framework covering identity, proof of intent, limits on authority, secure execution and intelligence. It gives no date for general availability. On 15 September this brief reported that Mastercard, Visa and Ant International had begun work on a shared way to identify agents across payment networks. On 25 September it carried a purchase an agent made with a Danske Bank Mastercard. The new score is built for the issuer, the bank that approves or declines each payment. That places the judgement on whether an agent is legitimate with the card-issuing bank, which gains a third kind of shopper to tell apart from people and bots, on a timetable Mastercard has not given.

Mastercard

Research

Two independent sources find that the cost of each completed result, not the token price, decides whether AI pays. Advisory

Capgemini Invent, the consulting arm of Capgemini, published the first issue of its AI Compass series on 1 October, a 60-page report on what it calls AI Yield. It defines AI value as the verified business result minus the full cost of delivering it safely, human oversight included. In its own model, how well the AI performs explains about 54% of the difference in value between uses and the intensity of human oversight about 19%, while token price explains almost none. For one high-stakes workflow it puts the break-even accuracy near 89%, and warns that a workflow can be profitable on average while the worst 5% of tasks carry large losses. Separately, Richard Ewing described in CIO on 7 October his audit of an award-winning document workflow at an unnamed mid-sized firm. Turnaround fell by 90%, but each file cost 12 to 14 dollars to process against about 80 cents for the manual review. About 40% of files fell below the confidence threshold and went to a person, taking about ten minutes each. During the three-month pilot, the computing and model charges sat in a central innovation fund, and the economics turned negative within sixty days of the costs being charged to the business line.

One is a consultancy's model and the other a single anonymised case from an author who sells advice on AI economics, so neither proves how large the effect is. They reach the same mechanism from opposite ends. The bill is set by how often the AI gets the work right and by the human handling of the rest, and a token price list shows neither. A business case built on pilot speed and token prices leaves out exactly those two costs, and in Ewing's case the pilot's own accounting is what kept them out of view.

Capgemini: The era of AI Yield | CIO

An MLCommons working group proposes a testable profile for every AI agent a financial firm puts into use. Institute

A working group of MLCommons, an industry consortium best known for AI benchmarks, posted a 36-page working draft on arXiv, an open research archive, on 2 October. Its authors include Kevin Werbach of Wharton and Lukasz Szpruch of the University of Edinburgh and the Alan Turing Institute. They argue that financial firms have no shared, testable way to state what one deployed agent may do. Model tests, company governance, agent identity and runtime controls each cover something else. Their answer is an Agent Reliability Profile for each deployment. It records the agent's level of autonomy, the business setting it may act in, the actions it may and may not take, and its controls. Each claim carries its evidence, a validity period and a list of changes that void it, such as a new model, tool or credential. Assurance comes in three levels, from the firm's own statement to testing by an independent assessor. The paper also argues that a configured approval step does not prove human control. It proposes checking how often reviewers edit or reject an agent's proposals, and whether they catch deliberately planted errors. On 1 October this brief carried Singapore's agent framework, which asks firms to test whether human approval is real or rubber-stamping. The paper is a design proposal with no pilot results, as its authors say, and it leaves out fairness, explainability and cybersecurity. Model cards and vendor benchmarks describe a model, while a bank's model-risk review answers for one agent in one process. The profile gives that review a fixed shape, and its list of voiding changes turns each model or tool update into a reason to test again.

arXiv: MLCommons Financial Services Working Group, Agent Reliability Profile

Security

Anthropic now sends unreviewed AI-found flaw reports to open-source projects that ask, as checking falls behind finding. Vendor

Anthropic launched a free, opt-in service on 8 October that scans enrolled open-source projects for security flaws with its strongest models. These include Mythos, its most capable model, with a documented ability to find and exploit software flaws. Anthropic says its models found more than 29,000 candidate flaws over six months, while its staff could review about 6,000. At maintainers' request it has already sent nearly 5,000 unchecked reports with proposed fixes. Reports from the new service are written entirely by the model and sent without human review. Anthropic says some will be wrong and expects more than 90% to be valid. In its test of an early version, outside security testers judged 85 of 97 serious findings across 48 projects fit for formal disclosure, 11 genuine but duplicates and one false. Maintainers of PostgreSQL, a widely used database, and of OpenSSL and wolfSSL, encryption software built into many systems, are quoted, and wolfSSL says 72 of 74 reports were valid. The figures are Anthropic's own. Projects that cannot sort reports at volume keep receiving human-checked disclosures. On 8 October this brief carried Microsoft's account that finding flaws with AI is now cheap while checking and fixing them is not. Anthropic's figures make the same point from a second lab. Its new service moves the checking to the maintainers who receive the reports, the side where Google has just paused an open-source bug bounty. Much of a bank's software rests on components like these databases and encryption libraries. How fast their maintainers can sort and fix a rising volume of reports now helps set the pace of the security updates the bank receives.

Anthropic

On the radar

• Google paused its open-source bug bounty, which pays outsiders who report software flaws, from 1 October until an update in early 2027, saying most of a surge in automated submissions were not valid. TechCrunch

• OWASP's GenAI Security Project, part of a nonprofit that publishes software-security standards, released an unofficial roundup of the third quarter's AI agent attacks mapped to its 2026 risk lists, concluding that instructions in a prompt do not keep an agent within its task and recommending enforced limits, separate credentials and monitoring of what agents actually do. OWASP GenAI Security Project