Reading time ~12 mins

The ECB has started judging the frontier-AI cyber plans banks sent in October, and the Dutch national cyber assessment puts the time from a software flaw's discovery to its abuse at hours. Anthropic ties zero data retention for its newest models to a new safeguards programme. Deutsche Bank and Ant Digital Technologies set out controls for AI agents that make wholesale payments, and Nubank tests its service agents on simulated customers. NIST drafts a shared vocabulary for threats to AI agents, and Nate B. Jones hears from OpenAI that coding agents overloaded the systems behind its code.

Regulatory

The ECB says it is now assessing the frontier-AI cyber plans banks sent in October, and will share good practice across the industry. Authority

The ECB is now assessing the action plans that every bank it supervises had to submit by the end of October. Claudia Buch, Chair of its Supervisory Board, said so in a written overview for the Eurogroup dated 9 November. The request came in the ECB's letter of 7 July on AI-enabled cyber threats, and the deadline has run in this brief since 8 July. On 2 November this brief carried Pedro Machado, a member of the Supervisory Board, saying a fuller assessment could only follow once the plans were in. That assessment has now started. The ECB says it will "identify areas for improvement and share feedback on good practices with the industry". It gives no date for that feedback and sets no new duty. Its reason is that frontier AI models make it quicker and cheaper to find and exploit flaws in IT systems, so banks must invest in cyber defences and operational resilience. A footnote also puts euro area banks' AI-related lending at about €62 billion in the second quarter of 2026, or 1.2% of committed corporate exposures. That count covers data centres, chipmakers and software developers. It leaves out data centres classed as real estate and lending through special purpose vehicles. It is therefore narrower than the just under €200 billion of loans to AI companies in the keynote by Philip Lane, an ECB Executive Board member, that this brief carried on 6 November. The two figures count different things and do not contradict each other. With the plans in, each bank's plan is now read beside its peers', and the good practice the ECB shares is likely to become the reference for what supervisors ask next.

European Central Bank: Written overview for the exchange of views with the Eurogroup

Perspectives

Nate B. Jones hears from OpenAI that coding agents overloaded the systems behind its code, not only its reviewers Perspective

Nate B. Jones, an independent AI commentator, published a post on his paid Substack on 6 November built on an interview with Vijaye Raji, OpenAI's chief technology officer for applications. Raji joined OpenAI when it bought Statsig, the company he founded. The free preview says engineers at OpenAI could pursue more changes at once with coding agents, while the agents kept pulling code, running tests and submitting their work. Nate B. Jones writes: "The infrastructure that supported those activities struggled to keep up."

In the public part of the interview, Raji dates the change to February 2026, when agents running in parallel took hold. As engineers put out far more code, he says, review, testing and the systems that build and release software all became bottlenecks. OpenAI added automated review and had to rethink its build-and-test system. The traffic in and out of OpenAI's single shared code repository went, in his words, over an order of magnitude beyond what the system was designed to support. OpenAI set up a team to rebuild the system behind the repository, now called Pando, on different assumptions. Nate B. Jones puts the reason simply in his talk. Git, the standard tool for tracking changes to code, "was designed for people who worked offline", and agents are online all the time. Asked whether agents' changes would collide, Raji said the bigger problem was how fast agents could fetch code at all. OpenAI reports a nearly 80% drop in median push latency, the wait to submit a change, after the rebuild.

The free preview adds a second company. At FurtherAI, a fivefold jump in merged changes per engineer moved the wait into testing, review and deciding what to build. FurtherAI turned review comments that kept recurring into 21 automated checks, and agents fix what those checks catch before a person looks. The post's title carries the arithmetic. When agents make coding 3.5 times faster, a 10-day feature still takes about 5.7 days, and planning and review take 70% of it. Raji adds that more code is now thrown away than before, because prototypes cost so little to make. Nate B. Jones writes: "When one part of the work accelerates, it changes what the rest of the organization must handle." His remedy is to find the delays and their causes. In his words: "You need to identify the resulting delays, understand their causes, and change the systems or decisions responsible for them."

Readers have met the review bottleneck twice. On 29 September this brief carried his own argument that one fast person's output waits on everyone else's review. On 4 November a Harvard working paper found code submissions up 35.7% while the time to approval rose 56.1%. What is new here is a frontier lab's own account that the strain reaches the machines as well as the reviewers. FurtherAI adds one way to take recurring corrections out of the review queue. Raji's figures are OpenAI's own. He says AI use, measured in tokens, grew 17-fold in a year at frontier labs against about twofold at ordinary software firms, without giving a source. A typical firm runs far less agent work than OpenAI, so the rebuild shows a direction rather than next year's load. For subscribers, the post adds how the two design changes behind Pando work, and a seven-question constraint review, a table for tracing where one recent piece of work waited.

In a bank, code review often doubles as a control. Change-management procedures usually require someone other than the author to approve a change before it reaches production. A review queue that grows with agent output therefore strains a control as well as a delivery date. An automated check that takes over part of that review becomes something auditors test in its own right.

Nate's Substack (By Nate B. Jones)

Industry & competition

Deutsche Bank and Ant Digital Technologies set out how AI agents could make wholesale payments under a revocable mandate. Corporate

Deutsche Bank and Ant Digital Technologies, the technology business of China's Ant Group, published a joint white paper on agentic payments in wholesale finance, dated October 2026. It defines an agentic payment as one that a software agent selects or initiates under an explicit, bounded and revocable mandate from a legally accountable institution. It looks at three uses, managing treasury liquidity, routing cross-border payments and trade finance, and calls their benefits "value hypotheses to be assessed, not established outcomes". Its central rule is that the agent may supply judgement while the institution's own independent controls give permission. The paper says existing rules on AI, payments, financial crime, data protection, outsourcing and operational resilience already govern such payments. It says institutions must still settle when an agent's instruction is legally attributable to the institution behind it. They must also settle how responsibility is shared between that institution, the human owner, the agent's operator, the executing bank and the settlement system. It proposes four stages, from assisting staff to executing within a mandate, with wider use only once evidence supports it. Ant Digital Technologies sells this kind of infrastructure, and the paper includes a case study of its own product. This brief carried Deutsche Bank's short article on new payment rails and agentic payments on 30 October. The paper puts the check on an agent's mandate with the bank that executes the payment, which is where a corporate client's agent would first meet a bank's controls.

Deutsche Bank: Agentic payments in wholesale finance (publication date unverified)

Nubank says testing new versions of its service agents on simulated customers cut each evaluation from 21 days to under five. Corporate

Nubank, the Brazilian digital bank, described on 5 November how its AI research team now tests customer-service agents before release. Each new agent version first runs against synthetic customers, software that plays the part of real ones, with hypotheses and success criteria fixed in advance. Nubank says this cut the average evaluation of an agent version from 21.2 days to 4.4. Offline testing also cut unnecessary handoffs to human staff from 22.4% to 16.0%. A card-management agent built this way is live for customers in Brazil. In a live comparison with Nubank's card-delivery agent, its self-service rate was 4.9 percentage points higher, and its transactional Net Promoter Score, a measure of satisfaction after an interaction, was 36.7 points higher. Nubank notes that the two agents handled different tasks, so those gains cannot be credited to the simulator alone. The cut in evaluation time does not rest on that comparison. Readers had simulated bank customers only as research benchmarks, such as the Sierra test of a fictional bank on 23 October. A pass mark set before release turns each agent update into a dated test record, the kind of evidence a model-risk reviewer can check rather than reconstruct.

Nubank: Nubank cuts AI agent update cycles from three weeks to under five days

Innovation

Anthropic ties zero data retention for its newest models to a new safeguards programme, and keeps 30 days for other customers. Vendor

Anthropic released Claude Fable 5.2 on 9 November on all major cloud platforms, including Amazon Web Services, Google Cloud and Microsoft Azure. Claude Mythos 5.2 is the same underlying model without Fable's extra cyber and biology safeguards, and stays limited to organisations in Anthropic's cyber and life-sciences verification programmes. The terms that reach a bank's data protection team come further down the announcement. Anthropic says some misuse shows only in patterns across many requests, so these models rely on safety monitoring over a window of usage data. Its new Enterprise Frontier Safeguards are in private beta with customers including Bridgewater, Salesforce and Stripe. They run that monitoring on prompts and responses stored in the customer's own systems, which Anthropic says makes them compatible with zero data retention. Eligible customers can keep using the 5.2 models with zero retention while they set it up. For other customers, Anthropic keeps conversations for 30 days for safety monitoring. Price and speed are Anthropic's own claims, at $8 per million input tokens and $40 per million output tokens, with output up to 30% faster than version 5.1. The terms close a thread readers have followed. On 4 September Amazon offered zero retention for Anthropic's newest model on its Bedrock service only through 31 December 2026. On 7 October Anthropic promised a zero-retention version with safeguards for this autumn, and on 6 November OpenAI said zero-retention customers of its cyber model still get automated review. Whether a frontier model may keep a bank's prompts for 30 days now turns on the bank qualifying for this monitoring and running it in its own systems.

Anthropic: Introducing Claude Fable 5.2 and Claude Mythos 5.2

Security

The Dutch national cyber assessment says the time from a software flaw's discovery to its abuse fell from months in 2024 to hours in 2026. Authority

The National Coordinator for Counterterrorism and Security (NCTV) sent its annual Cybersecuritybeeld Nederland 2026, the Dutch government's threat assessment, to parliament on 6 November with the cyber action programme. This brief mentioned the assessment in one sentence that day, without its figures. NCTV says the average time between the discovery of a vulnerability and its exploitation was several months in 2024, several weeks in 2025 and only several hours in 2026. If the trend continues, it says, the time available to patch could shrink to minutes. Criminals and state actors now use AI beyond picking targets and writing phishing emails, NCTV says, in carrying out attacks, developing malicious software and adapting commands in real time. It cites a reported campaign of November 2025 in which attackers found and used flaws in up to four hours with Claude Code. It also cites Mozilla's count of 271 Firefox vulnerabilities found with Anthropic's Mythos Preview, against 22 with an earlier model. A KPN survey it cites shows a gap between confidence and practice. Of the organisations asked, 67% felt prepared for an attack, 28% exercised regularly, a third had no or only basic detection and 38% called their security budget insufficient. NCTV says late patching, weak logging and monitoring and a lack of ownership by management persist, and that a weak supplier can expose every organisation that relies on it. It asks boards to invest urgently in basic controls and patching, and says national resilience cannot yet be measured reliably. Set against that estimate, a patch cycle counted in days, at a bank or at a critical supplier, is slower than the abuse the government now describes.

NCTV: Cybersecuritybeeld Nederland 2026

NIST opens comments until 18 December on a draft vocabulary for threats to AI agents' tools, memory and links to other agents. Authority

The US National Institute of Standards and Technology (NIST) released a public draft on 9 November of the 2026 edition of Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. The document is a shared vocabulary for attacks on AI systems and the defences against them. NIST describes the draft as focused on attacks on what it calls "agentic superintelligence" systems, though most of its agent material applies to agents in use today. It treats an agent's tools, memory and skills, and the other agents it deals with, as resources an attacker can target. It sorts attacks by type of system, stage of the system's life and the attacker's goals, capabilities and knowledge. The defences it discusses include monitoring each action an agent takes, giving an agent only the access it needs, identity and authorisation for agents, isolating their communications and controlling how information flows through the system. Its authors come from NIST, Northeastern University, ElevenLabs and the UK AI Security Institute. The draft is voluntary, and comments close on 18 December 2026. On 20 October this brief carried MITRE's addition of AI techniques to ATT&CK, the catalogue of attacker behaviour security teams map their defences to. Security vendors and auditors commonly use NIST's terms in their test reports, so once final this vocabulary is likely to shape the agent-security assurances a bank receives from its suppliers.

NIST: Adversarial Machine Learning, A Taxonomy and Terminology of Attacks and Mitigations (initial public draft)