Reading time ~15 mins

Wiz reads October's AI platform incidents as one hunt for stored keys, tested within 30 minutes and resold. Harvard and McKinsey find human checking, not AI output, limits the gain. Anthropic's amended filing puts computing at 58% of revenue. McKinsey maps where agents could act alone on customers in arrears. The EU's AI-marking code gets a February 2027 test date, the Dutch privacy regulator publishes how it enforces, and Fifth Third answers Meta's Muse inside its own app.

Regulatory

The EU's code for marking AI content now has a February 2027 test date, and the working group meant to reach it failed to form. Authority

The EU's code for marking AI-generated content, which this brief followed on 14 October, has moved on. Minutes dated 26 October record the 1 October meeting of the code's first task force, chaired by the AI Office, the Commission body that oversees the AI Act. Members have committed to show a minimum level of interoperability across marking and detection tools by 2 February 2027, under Measure 3.3 of the code. A mark made with one provider's tool should then be detectable by another's. The proposal for a working group on this failed to reach consensus, and the Chair will return to members by email. A common detection API, a shared way for software to check for marks, is the named first milestone. The code is voluntary and has 95 signatories, 47 of them in this task force. The minutes also name 2 December 2026, the date readers had on 28 July, as the end of the grace period for systems on the market before 2 August 2026. That date covers one duty, the provider's marking of synthetic output under Article 50(2) of the AI Act. It reaches a bank only where the bank provides a generative system rather than just uses one. Such a bank is four weeks from that date, and the shared detection route has no working group behind it.

European Commission

The Dutch privacy regulator published how it picks and escalates enforcement, and says AI Act legislation will join its list. Authority

The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, published its enforcement policy on 30 October. The policy is general and creates no AI duty. Its only mention of AI is a note to Annex I, which lists the laws the AP enforces today, from the GDPR to the Dutch Financial Supervision Act. The note says the list will be extended, for example for legislation implementing the AI Act. A formal procedure takes nine to eighteen months on average once the AP intends to use a formal instrument, which can run from a reprimand to a processing ban or a fine. Under a recognition and acceptance route the AP can cut a fine by at most 35%, where the case suits it. In choosing a measure it weighs factors including steps taken to limit harm, the safeguards in place and cooperation with the AP. On 12 October this brief reported the AP's new AI directorate, whose role under the AI Act was still under discussion. A bank's AI reaches the AP today through data protection law, in customer scoring for example. The policy sets out how long that exposure would run, what admitting a breach is worth and which evidence shapes the outcome.

Autoriteit Persoonsgegevens: Handhavingsbeleid AP gepubliceerd

Perspectives

Anthropic's amended filing puts computing at 58% of revenue, and Ed Zitron argues the chain behind it is fragile. Skeptic

Anthropic, the maker of the Claude AI models, filed an amended S-1 on 2 November, and the commitment totals left blank in the draft this brief reported on 27 October are now filled in. Third-quarter revenue was $16.96 billion, against $11.56 billion in the second quarter. Computing and infrastructure expense rose faster, from $5.56 billion to $9.86 billion, or from 48% to 58% of revenue. That included $5.0 billion of short-term computing, which cost significantly more than multi-year capacity. Price cuts and contractual discounts took about $600 million off the gain from higher usage. Computing commitments total about $895.4 billion, a figure that needs its qualifiers. About $213.8 billion can still be ended or depends on conditions, leases not yet begun account for about $451.2 billion, and $69.8 billion falls due in the 12 months after 30 September. Against that, the filing shows $146.6 billion of liquidity before the offering. Ed Zitron, a persistent critic of AI economics, argues in a 3 November essay that this rests on a fragile chain of model usage, cloud partners, venture-backed customers and debt-financed computing. A financing squeeze is his scenario, and the filing does not show one. For a bank buying from this supplier, the amendment now shows what falls due within a year and what price cuts cost. With computing's rising share of revenue, those filed numbers are a guide to how much room a main model supplier has on price.

Where's Your Ed At: Running Dry | US SEC: Anthropic Form S-1/A

McKinsey's map for AI agents in bank arrears handling goes as far as fully autonomous settlement offers, and reports no measured AI result. Advisory

McKinsey's Risk Practice published Banking on AI: How a new operating model can transform distressed credit management, dated 29 October, by Bruno Batista, Thomas Kelepouris and colleagues. Tony Moroney, who writes on digital change in financial services, shared it on LinkedIn on 2 November without a view of his own. It argues that banks should stop adding AI use cases in arrears handling and redesign the function around agents that hand work to each other. One agent would scan the performing book for early distress, before a payment is missed. A copilot would listen to collection calls and read the customer's tone of voice. The most usable part is a map of 14 activities, from human-led to fully autonomous. At its higher setting, the specifics of restructuring and settlement offers run fully autonomously. The report gives no figure for what AI has done to cure rates, recovery costs or complaints. Its one performance number, borrowers 20 to 30 percent more likely to pay, compares a digital route with outbound calling, has no sample and does not measure AI. Its only example of spotting vulnerability needs the customer to reply. McKinsey sells this work, and the report names no EU or Dutch rule. On 30 October this brief carried the Dutch privacy regulator saying consequential decisions in debt collection should not be fully automated, and its roundtable on the subject is on 2 December. Article 35 of the EU's revised consumer credit directive, whose measures apply from 20 November, requires reasonable forbearance where appropriate, weighing the consumer's circumstances, before enforcement. How these rules apply to a bank's own settlement offers is untested. Settlement terms are the step where McKinsey's higher setting meets both rules.

McKinsey: Banking on AI: How a new operating model can transform distressed credit management (shared by Tony Moroney)

Tony Moroney argues that small changes to how work moves between AI models add up to decisions that may never reach the board. Advisory

Tony Moroney, who writes on digital change in financial services, argued on LinkedIn on 3 November that routing work across several AI models creates a new kind of strategic decision. Models evolve, engineers adjust thresholds and a fallback model becomes the preferred route. Each step may be reasonable, he says, yet together they can shift quality, risk and authority. He proposes change control for routing rules, with named owners, evidence for material changes and the power to withdraw delegated authority, and rejects a committee approving every model call. Tony Moroney writes that boards "do need assurance that changes affecting risk appetite, customer commitments or decision authority cannot occur without appropriate governance." His essay three days earlier adds the cost side, where the unit to watch is an accepted outcome, counting retries, checks and human review, rather than a token. It is one adviser's argument, with no data behind it. A bank approves an agent on stated conditions, and engineering can change those conditions afterwards without any single change reaching a review.

Tony Moroney via LinkedIn | Tony Moroney: The Allocation Layer (LinkedIn; original source not verified)

Jakub Szarmach points to a lawyers' guide that treats AI supplier contracts as a different kind of contract. Corporate

Jakub Szarmach, who runs a library of AI governance resources, wrote on LinkedIn on 2 November about Colin S. Levy's guide to contracting with AI vendors. Jakub Szarmach writes that it "treats AI risk as something that should change contractual architecture, not just trigger another security questionnaire." His questions include whether embeddings, the numeric copies of a firm's documents that AI systems store, are deleted at exit, whether subprocessors can train on customer data and whether model changes require notice. The document he shared is a February edition, which Levy replaced on 9 September with a rewrite called Negotiating AI Terms, and the link below goes to that. Both are written for US lawyers and neither mentions DORA, the EU's digital resilience law. Article 30 of DORA requires service levels, subcontracting conditions and return of data, and its text says nothing on training rights, embeddings or model changes. A contract can meet the DORA list and still leave those risks with the bank.

Colin S. Levy: Contracting with AI vendors (shared by Jakub Szarmach)

Industry & competition

Fifth Third answers Meta's Muse by building the same services into its own app, and KPMG's banking head backs the race. Advisory

Michael Abbott, KPMG's global head of banking, wrote on LinkedIn on 3 November that Fifth Third has picked the right race. On the US bank's earnings call on 19 October, chief executive Tim Spence said it will build every valuable service offered on Muse, Meta's AI assistant, into its own apps. He named subscription savings and budgeting. He said the banks most at risk of AI moving cash to better rates are online-only lenders defined only by pricing, Banking Dive reported. Finance chief Bryan Preston called those concerns likely overblown, citing a median household checking balance of $3,000, and said Fifth Third does not currently let agents start transactions in customer accounts. Michael Abbott writes: "Incumbents have the leverage. Speed decides whether they use it, because first movers usually take the majority share." He says 71% of consumers in KPMG's research would welcome an AI assistant in their primary bank's app, without naming the study. Readers have had banks blocking outside agents and, yesterday, Wells Fargo admitting them. This is a third position, keeping the agent out for now and making the bank's app do its job. It rests on customers staying for service, so a retail bank's exposure turns on how much of its deposit base stays for the app rather than the rate.

Banking Dive: Fifth Third CEO downplays risk from AI agent Muse (shared by Michael Abbott)

Huntington offers AI agents to every small-business owner, customers or not, as a way to win them. Media

Huntington, a US regional bank, announced The 1866 Studio on 19 October, built on Google's Gemini. Banking Dive reports it launched with eight AI agents for tasks such as business registration, marketing and preparing for finance. The base level is open to all small-business owners, whatever their relationship with the bank. President Brant Standridge told Banking Dive he sees it as a customer acquisition tool, and said the bank has about 500,000 small-business customers. American Banker's public preview, dated 3 November, gives a target of more than 60 agents within a year. Uptake and results are not known. On 22 October this brief carried Stripe and Anthropic putting payment tools into an assistant for small-business owners. Huntington is working the same ground from the bank's side. The owner meets the bank's AI before opening an account, so the assistant becomes the way into the relationship.

Banking Dive: Huntington launches small-biz operating platform | American Banker: Banks moving to provide AI toolkits to small-business clients

Research

Two independent data sets find that human checking, not AI output, limits the gain: Harvard on 655 firms and McKinsey on bank agents. Independent

Fiona Chen and James Stratton of Harvard updated their working paper, Artificial Intelligence in the Firm: Bottlenecks in Software Production, on 1 November. Gemma Whitehouse, an interim technology chief, pointed to it in her November digest, which quotes an earlier version. The paper tracks 720,542 software workers at 655 firms from January 2021 to August 2026. AI agents raised lines of code by 44.0% and code submissions by 35.7%, while finished work items rose 13.7%, a borderline significant result. The time from submitting code to its approval rose 56.1%. McKinsey reaches the same point from bank deployments in Agentic AI in financial-crime prevention: Lessons from winners, the companion to the paper readers had on 30 October. In August 2025 the firm floated a 20-fold productivity potential. SecureWorld reports it now sees about twice baseline at equal or better quality, and says the fully supervised digital factory of agents remains untested. In one banking customer-service task, tokens, the metered unit of AI use, were 20-25% of variable running cost and human oversight 70-75%. At one large European bank a transaction-monitoring case cost about 2.50 euros before optimisation, roughly half of it automated quality checks. One bank signs off agents at a minimum of 80% accuracy and 70% consistency between repeat runs. First approvals through risk governance took six to eight months.

The two sources use different data in different trades and describe one mechanism. When producing work gets cheap, the cost moves to proving it right. The Oliver Wyman Forum made the same point on 21 October. Both new sources have limits. The Harvard paper is unreviewed and rests on one vendor's client data, and McKinsey's figures come from its own selected engagements. Even so, a bank's agent case built on tokens and output leaves out the largest variable cost, and the 2x figure now comes from the adviser that floated 20x.

Harvard: Chen and Stratton, Artificial Intelligence in the Firm | Ingeniva Consulting: Ten Per Cent, Not Ten Times | SecureWorld: Agentic AI's Financial Crime Reality Check | McKinsey: Agentic AI in financial-crime prevention: Lessons from winners

A Stanford team retested 50 published findings about AI models and classed 44% as expired. Institute

The Zou Group at Stanford University published The shelf life of LLM findings, by Owen Queen and James Zou. They re-ran 50 published findings about language models on 20 models from eight developers, released between July 2024 and September 2026. A finding counts as expired when a fifth or less of the original effect remains. By 30 September, 44% had expired, 34% had weakened, 16% still held and 6% had grown stronger. The team estimates that 16% had expired one year after publication and 39% after two. All nine reasoning failures tested had expired or weakened, while AI judges favouring their own output grew stronger. The panel is small, each claim was tested in one design and the work is not peer reviewed. A bank's model validation file can hold findings of this kind, about how a model behaved at a given version and date. In this panel about one such finding in six had expired within a year, so a control resting on an older result may not describe the model now in use.

Zou Group at Stanford University: The shelf life of LLM findings

Accenture's first CIO survey finds 53% confident in their suppliers' cyber resilience and 17% with real-time sight of it. Advisory

Accenture's CIO Pulse, dated 3 November, surveyed 300 senior technology leaders in 19 industries at organisations with over $1 billion in revenue, in August and September. While 61% expect a significant or fundamental redesign of enterprise architecture within three years, 27% have the agent layer in scope, the lowest of eight domains. AI usage, measured in tokens, rose at 97% of organisations in the last 12 months, by a mean of 47%. The answers are self-reported, and the page ends by selling Accenture's services. The sharpest result is the supplier gap. Some 53% are confident in the cyber resilience of their partner ecosystem, while 17% have real-time visibility and automated resilience across it. Under DORA, the EU's digital resilience law, a bank has to monitor its critical ICT suppliers, and this survey measures how far confidence runs ahead of visibility at large firms.

Accenture: CIO Pulse Survey

Security

Wiz reads October's run of AI platform incidents as one pattern: a hunt for stored keys to AI services, sold on through resale sites. Vendor

Wiz Research, part of the cloud-security firm Wiz, published an analysis on 30 October of at least nine AI developer platforms, services where companies build and run AI applications, that disclosed incidents in the month. Updates add three more, among them one run by NVIDIA, with no technical detail yet. Reported causes differ, and Wiz says no single flaw or supplier links the cases. What recurs is the target, stored settings holding the secret keys a company uses to reach its AI services. In two enterprise cases Wiz traced, the keys were first tried within 30 minutes of the reported access at the vendor. Bulk use began four days later on one key, with about 800,000 calls over 30 hours. On the other, limited to US routes, it began about a week later, with about 1.7 million calls in 13 hours. Wiz estimates the two cases ran up over $100,000 at list price. It links the keys to two openly advertised resale sites, and says it cannot establish that those operators carried out the original thefts. Most victim reports are preliminary, and Wiz sells cloud security. The finding applies to any firm whose AI keys sit at a development platform, directly or through a supplier. Those keys now have a resale market, so a key held at a vendor carries third-party exposure of its own. In these cases, a vendor's notice that took days could arrive after the first test and before the bulk use.

Wiz Research: "Black October" for AI Developer Platforms

On the radar

• Binance said in its first incident report, relayed by The Block on 3 November, that attackers took more than $6.3 billion in digital assets after a fake recruitment process, using an employee's computer and an internal AI tool to take over two engineers' devices; it says it has frozen or intercepted about $2.85 billion. The Block

• WIRED reported on 29 October, citing unnamed sources, that an Accenture contractor connected a personal Claude Code agent to a US defence network for two months and that it appears to have sent login details to an outside website; Accenture says an independent investigation found the allegations without merit. WIRED

• Ars Technica reported on 30 October that a backdoored update to Anthropic's official Claude extension sat in the marketplace of Cursor, an AI coding tool, for nearly 12 hours and could have reached up to 5,000 developers; Cursor says errors in the malicious code made it fail outside unusual circumstances. Ars Technica

• Cobus Greyling, an AI practitioner, questioned the Qwen upload attempt this brief carried on 27 October, noting Cohere's own figure of fewer than 1 in 100,000 evaluation calls and a test that gave the model a live command line; he argues it shows no planted backdoor, though Cohere says it also occurred, rarely, without prefilled prompts. Cobus Greyling on Substack

• The Dutch digital infrastructure inspectorate (RDI) published its Trendradar 2026-2035 on 3 November, rating agentic AI and AI-driven cyber attack and defence as high impact within three years, with no new duty attached. Rijksinspectie Digitale Infrastructuur