News & Updates
The latest news and updates from companies in the WLTH portfolio.
Britain's New AI Biosecurity Lab Pairs £100 Million in Public Money With Up to £200 Million in OpenAI and Anthropic Credits
The UK's new AI Biosecurity Lab will start with £100 million in government funding and up to £200 million in model credits, access and support from OpenAI and Anthropic. It will run as an independent nonprofit focused on earlier threat detection and faster vaccine and treatment work. Britain set up its AI Security Institute in 2023 to probe the risks in frontier models. The country's newest AI body has a different brief, putting those models to work against biological threats, and as much as two-thirds of its backing comes from the companies that make them. The AI Biosecurity Lab gets £100 million in government money. OpenAI and Anthropic have committed up to £200 million more, in the form of access to their own systems. OpenAI is putting in £100 million in compute and model credits, and Anthropic's pledge of up to £100 million covers model credits, trusted model access and technical support, the Cabinet Office said. Google DeepMind and Basecamp Research are signed on as research partners. The lab will be an independent nonprofit, and the government wants it to "move with the speed and focus of a frontier AI-bio company." Its first projects aim at spotting emerging biological threats earlier and speeding up work on vaccines and treatments. Where OpenAI's credits come from OpenAI's credits run through Rosalind Biodefense, a program it launched in May to sponsor use of GPT-Rosalind, its life sciences reasoning model, on vetted defensive projects. When the program started, OpenAI also gave access to the Coalition for Epidemic Preparedness Innovations (CEPI). CEPI's deputy CEO, Aurelia Nguyen, is quoted backing the British lab in the wider announcement. "Rapid advances in AI are creating new risks related to the design and modification of pathogens, increasing the potential for both accidental and deliberate harm," she said. The lab is part of an AI package Chancellor John Healey is putting into Wednesday's Budget, and other line items lean toward security too. The AI Security Institute, which this week published its own analysis of a Mythos 5 test run that went after a real GitHub project, gets an extra £120 million. A National Cyber Shield built on agentic AI gets £60 million. The lab's remit also reaches into drug approval. It will work with the Medicines and Healthcare products Regulatory Agency to prepare for health emergencies and to inform how AI-designed medicines are regulated.
Google Cloud Lets Anthropic Run Claude Directly for Customers Who Want New Features First
Google Cloud made an Anthropic-managed deployment option for Claude generally available, giving customers day-zero access to Claude Platform features such as Managed Agents, skills and code execution. The existing Google-managed option keeps Google as data processor, with VPC Service Controls, CMEK and regional data residency. Companies that buy Claude through Google Cloud no longer have to wait for Google to wire in each new Anthropic feature before they can use it. Google Cloud has made an Anthropic-managed deployment option for Claude generally available, running next to the Google-managed version it already sells. Both versions get new Claude models on day zero, at the same pricing and on the same Google Cloud bill. What separates them is the legal and operational setup. "The difference comes down to who acts as your data processor and whether you need access to the new Claude platform features when they launch," Michael Gerstenhaber, vice president of product management for Gemini at Google Cloud, wrote in the announcement. Two ways to buy the same models On the new option, Anthropic operates the stack as the data processor on Google Cloud infrastructure, under Anthropic's Commercial Terms. Customers still sign in with Google Cloud IAM, keep Cloud Audit Logging and run spending through their existing Google Cloud billing, and usage draws down eligible Google Cloud commitments. In exchange, they get Claude Platform features the day they ship, including Claude Managed Agents, which is in beta, along with skills and code execution. Skills also figured in separate Anthropic news earlier Thursday, when the company said it is handing its Agent Skills standard to the Agentic AI Foundation, the Linux Foundation group that also looks after the Model Context Protocol. The Google-managed route keeps Google Cloud as the data processor under customers' existing agreements. That is the version with VPC Service Controls, customer-managed encryption keys and data residency in the U.S., EU and APAC, plus native hooks into BigQuery and Model Armor. Google says it is meant for strict governance, compliance and sovereignty requirements. New platform features arrive there only after Google integrates them into its own infrastructure. Google is stacking up model choices The Claude lineup on offer includes Claude Fable 5.1, Sonnet 5.5, Haiku 5.5 and Opus 5.5. Anthropic's own Claude on Google Cloud page promotes dedicated capacity and prompt caching as ways to keep production workloads predictable. The Claude announcement came a day after Google Cloud put OpenAI's GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna into its model garden in private preview, as WebProNews reported, and Gerstenhaber wrote in that announcement that Google Cloud is now the only hyperscale cloud provider offering access to all three leading closed source LLMs. The OpenAI models are also sold through Google Cloud Marketplace, so that usage lands on the same Google Cloud invoice as everything else. Google gave no schedule for the Google-managed side. Its post says new Claude Platform features "roll out over time" on the Google-managed option, with no date for when Managed Agents will get there.
Anthropic Study Finds Robots Capable of Most Physical Tasks but Cost-Effective for Few
Anthropic's Sept. 30 study finds robots can perform 74% of physical U.S. job tasks, or 34% of working hours, but are cheaper than humans for just 0.3% of work. Adding robots to AI raises exposure for hands-on jobs like cleaning and maintenance, though cost and dexterity remain major barriers. Anthropic published research on Sept. 30 measuring how well today's robots can handle U.S. job tasks. Robots can already perform 74% of physical tasks, which make up 34% of working hours, according to the study. But they are cheaper than human labor for just 0.3% of work. The findings come from a new robot exposure index built by Anthropic researchers Russell Legate-Yang and Maxim Massenkoff. Anthropic defines robots as autonomous physical machines that sense and act, and it used Claude to rate how well current robots perform each task. The scale runs from tasks no robot can do today to tasks robots already perform in unstructured environments such as city roads. Most of that capability is confined to controlled settings: robots do only 2% of physical tasks in unstructured environments, mostly driving. Counting robots changes the picture from Anthropic's earlier AI-only work. Around half of all work is exposed to large language models alone, and that rises to 81% when robots are added. In transportation and moving, less than 15% of tasks are exposed to LLMs, compared with about 90% once robots are included. Hands-On Jobs Get a Second Look Business Insider's Alistair Barr revisited the gardener question in an Oct. 17 column. He recalled that Anthropic's earlier jobs report suggested gardeners were among the safest workers "because AI couldn't pull weeds or tell a rose from a dandelion." In Anthropic's new chart, cleaning and maintenance, the group that includes gardeners and janitors, sees much higher exposure once robots are counted. Barr isn't convinced. "On paper, it makes sense. In practice, I'm skeptical," he wrote, pointing to how hard it is to identify the right plant and pull a weed out by the roots. The study has its own caveats here: cleaning is hard to standardize, and robot cleaners are often slower than humans and still several times more expensive. Exposure does not equal job loss. Cost is the most common barrier in Anthropic's estimates. Robots are cost-competitive today for roughly 300,000 workers. Robot prices have fallen about 3% a year since the 1990s, and at that pace it would take around 40 years for robots to become cost-competitive for 10% of work. After cost, the main barrier is capability, such as the dexterity needed to untangle wires; half of physical tasks wouldn't be automated at scale unless robots get better at handling objects. Workers most exposed to robots are more likely to be male, less educated and lower paid. In the top fifth of the index, they earn about $23 an hour on average, versus nearly $53 for workers with no exposure, and about 61% frequently lift or carry weight. Taxi drivers top the exposure list, followed by agricultural equipment operators and light truck drivers. The study backtests its approach against history. From 1977 on, jobs more exposed to existing robots saw larger declines in wages and employment in later decades. Robots have also kept picking up new work: each year, they became able to do about 2% of the physical tasks they previously couldn't. The authors say AI-powered robots could leapfrog the scale, for example by learning to climb ladders or use their grippers more deftly. Other limits would remain. Anthropic estimates current regulations would bar robots from 14% of physical tasks, and human preferences hold them back on about a quarter. For now, the report says, efforts to track AI's impact could watch drivers and warehouse packers for early signs of disruption. Packers are the largest occupation already exposed to cost-competitive robots, and their employment has fallen 22% since 2015.
Anthropic's Claude Traces NIST ECDSA Curve Seeds to 1990s Random Number Generator
Anthropic reported that its Claude model traced the seeds of NIST P-192, P-256 and other ECDSA curves to lrand48 outputs seeded by Unix timestamps from 1997-1998. The finding replaces a long rumor about hashed phrases with a reproducible process from 1990s C libraries and raises confidence that no backdoor was inserted. No changes are needed for current implementations. An internal research model from Anthropic solved a long-standing mystery about the seeds used in widely adopted NIST elliptic curves for ECDSA. The model determined in under half an hour that the seeds for the P-192, P-224, P-256, P-384 and P-521 curves came from the C library's lrand48 pseudorandom number generator seeded with a Unix timestamp. That turned out to be wrong. The decades-old rumor held that the seeds resulted from hashing some humorous or obscure phrase. Anthropic published its findings on October 16, 2026. Claude spotted statistical patterns in the seeds. Four of the ten seeds showed all-zero top bits in each 32-bit word. The chance of that pattern occurring randomly stood at 1 in 5,810. This pointed directly to lrand48. The process worked like this. The generator was initialized with a Unix timestamp t. It then ran for a number of iterations n. Each iteration pulled 20 bytes as a candidate seed. The standardized seed for P-256 emerged as candidate 1,842 from its run. Timestamps for the 10 prime-curve seeds fell between May 1997 and April 1998. Binary curve initializations pointed to dates in February 1984. The model recovered the internal PRNG state. It used brute force for the binary seeds and lattice reduction via the LLL algorithm for the truncated outputs from prime curves. Anthropic stressed the discovery carries no immediate security implications. "This is not a cryptographic break, new attack, or weakness in the ECDSA curves." The simple and reproducible method makes deliberate backdoors much less plausible. No action is required for users or implementers. The research also connected base points for several curves to Arjen Lenstra's FreeLIP library. A seed-and-discard recipe generated those points in May 1997. Reproducible code in the post confirms the matches. But some details remain open. The seed for B-163 stays unexplained. Base points for P-224, P-256, P-384 and P-521 have no identified origin yet. Viable candidate seeds were skipped in certain runs. Cryptographers had questioned the NIST curves for 25 years. Adoption of ECDSA dates to 2000. The new account replaces speculation with a mundane explanation drawn from 1990s software practices. And it increases confidence in the standards' integrity. Anthropic's Frontier Red Team conducted the work. The post includes full reproduction steps. One concrete example: the P-256 seed traces to a clock reading of August 16, 1997, at 01:52:34.
Anthropic's Claude Code Team Scales Code Review as Pull Requests Double
Anthropic's Claude Code team now routes every pull request through an AI review first. Merged PRs more than doubled from June to September, while the share of changes that had to be reverted fell by more than 40%. Required human approvals now scale with each change's risk. Anthropic's Claude Code team has reworked its code review process to keep up with a surge in AI-generated changes. From June to September, merged pull requests to Claude Code's codebase more than doubled, while the share that had to be reverted fell by more than 40 percent, according to a post on claude.dev published Thursday, Oct. 15. The pressure reaches well beyond one team. In Anthropic's monorepo, changes landing per day rose from about 2,500 in May to more than 30,000 in September. Claude Code lives in its own repository, separate from the monorepo, but the post says it is seeing a lot of pressure too. At that pace, manual line-by-line review is "incredibly difficult if not impossible," the authors wrote. Once the team had high coverage and deep reviews in place, it started optimizing for the minimum amount of human review time that doesn't raise reverts or incidents. Every pull request now gets a review from Claude before a person looks at it. The model reads the diff against the whole repo and the PR's stated intent, and checks whether the change solves its problem, fits the system or breaks something else. On a bug fix, it looks for the root cause. A public version, Code Review for Claude Code, is now generally available on Team and Enterprise plans, and the /code-review command runs a lighter version locally. When Anthropic launched the research preview, the share of internal pull requests getting substantive review comments rose from 16% to 54%. Human approval is scaled by risk. Docs, copy and additive changes behind a flag need no human approval once automated review and security checks are green, ordinary product changes need one person, and the highest-risk code needs two. A classifier sets the tier from the change rather than the author, and an agent's approval never counts as a person's. A PR also can't merge while any finding from the bug review or a separate automated security review is still open. Anthropic has rebuilt its source control to handle the volume as well. In a separate engineering post published Tuesday, Oct. 13, the company described Scion, an in-house version control system, and a code review tool called Antique. A team of seven built both, plus half a dozen related systems, and fully migrated the monorepo from Git in five months. That team still reviews every change request for Scion, but its members now examine the intent of a change instead of reading every line. Anthropic's reviews have let bugs through before. In an April 23 postmortem on Claude Code quality complaints, the company traced the reports to three separate changes, all resolved as of April 20 in v2.1.116. One of them, a caching bug that kept clearing Claude's older reasoning from sessions that had been idle for over an hour, made it past multiple human and automated code reviews. When Anthropic back-tested Code Review against the offending pull requests, Opus 4.7 found the bug once it had the code repositories it needed for full context, and Opus 4.6 didn't. Anthropic said it was landing support for additional repositories as context for code reviews.
Anthropic's Claude Code Team Scales Code Review With AI-First Process
Anthropic's Claude Code team more than doubled merged pull requests from June to September while the share reverted fell by more than 40%. Every PR now gets a Claude review first, and the number of required human approvals scales with each change's risk. The reviewer reads each diff against the whole repo and the PR's stated intent. Anthropic's Claude Code team more than doubled the number of pull requests merged to Claude Code's codebase from June to September, while the share that had to be reverted fell by more than 40 percent. Every pull request now gets a review from Claude before a person looks at it. The team laid out its process in a post on claude.dev published Thursday, Oct. 15. Anthropic has said Claude writes about 90 percent of Claude Code's own code, and the post takes up how to review code at that volume. "We didn't remove review," the authors wrote. "But we did move most of the reading to machines, optimized for human time and attention, and invested heavily in making it fast and easy to undo mistakes." Code review does two jobs, according to the post: it finds and fixes issues before they ship, and it builds shared context and understanding of the codebase across the team. The post mostly covers the first. The team calls "did a human read the code?" an imprecise proxy for a better question: what could go wrong with this change, and which check, automated or human, is the right one to catch it? Claude reads each pull request's diff against the whole repository and the PR's stated intent, then asks whether the change solves its problem, fits the system or breaks something else. On a bug fix, it looks for the root cause. The public version, Code Review for Claude Code, is now generally available on Team and Enterprise plans, and the /code-review command runs a lighter version locally. When the research preview launched, the share of internal PRs getting substantive review comments rose from 16% to 54%. In the public product, several agents examine the diff and surrounding code in parallel, a verification step filters out false positives, and the remaining findings are deduplicated, ranked by severity and posted as inline comments with a summary and a check run, according to Anthropic's documentation. That product never approves or blocks a pull request. Anthropic's own repos are stricter: a PR can't merge while any finding from the bug review or a separate automated security review is still open, and each finding has to be fixed or resolved with a reason. Human approval is scaled by risk. Low-risk changes such as docs, copy and additive changes behind a flag need no human approval once automated review and security checks are green. Ordinary product changes need one person, and the highest-risk code needs two. A classifier sets the tier from the change rather than the author, and an agent's approval never counts as a person's. People now concentrate on direction and scope, risky code such as billing and the auto-updater, and architecture that others will copy. The goal is the minimum amount of human review time that doesn't raise reverts or incidents. The pressure extends well beyond Claude Code. In an engineering post published Tuesday, Oct. 13, Anthropic said changes merged to its monorepo went from about 2,500 a day in May to more than 30,000 a day in September. To keep up, it built Scion, an in-house version control system, along with a code review tool called Antique. That review tooling can express semantic constraints on approvals that separate comment-only changes from sensitive logical changes, so human reviewers can focus on the most consequential ones. The source control team still reviews every change request for Scion, but its members now examine the intent of a change instead of reading every line. The Claude Code team has also had to stop agents from reviewing in circles. One CLI pull request went through more than fifty rounds of review and fixes overnight before its author stopped it. Now, after three rounds, the reviewer asks the author to step back and reconsider the approach.
Replit Names OpenAI Its Preferred Partner, Making ChatGPT the Default Over Anthropic's Claude
Replit has made OpenAI its preferred partner for Replit Agent, with ChatGPT now the default model. CEO Amjad Masad cited cost, partnership and performance onstage at TechCrunch Disrupt on Thursday, Oct. 15. Customers can still choose Claude models, and a person familiar with the Anthropic partnership told TechCrunch it is still in place. Replit no longer counts Anthropic as its preferred partner for AI models. CEO and co-founder Amjad Masad announced the change on Thursday, Oct. 15, while onstage at TechCrunch Disrupt, and said cost was one of several reasons. OpenAI's ChatGPT is now the default model for Replit Agent, though customers can still pick Anthropic's Claude models. Because most customers stick with the default rather than choosing a model themselves, TechCrunch reported, the shift could significantly reduce Replit's spending with Anthropic. Masad said onstage that Replit had been, until recently, one of Anthropic's top five customers. "I think ChatGPT is better now," Masad said. He pointed to an internal benchmark Replit uses and a public one it publishes, where he said Sol and Astra "perform better on building vibe-coded applications from scratch." "It was a decision based on both cost, partnership, and performance. And for all these reasons, we just felt like they were a better partner for now," he said. Shift Follows Earlier Collaboration Replit had kept working with both companies. Its October 2 changelog added new models from each: GPT-6.1 Sol in Max Mode and Claude Sonnet 5.5 in Power Mode. Replit announced its OpenAI partnership in August, but nothing public had suggested the Anthropic relationship was ending. "Replit remains model agnostic," Masad told TechCrunch afterward, calling OpenAI "our preferred partner for powering Replit Agent, based on performance, economics, and the strength of our partnership." He repeated the point on X on Saturday, Oct. 17, writing, "What I meant at TC Disrupt is that OpenAI is now our preferred partner powering Agent based on performance, cost, and strength of our partnership." In a reply, he added that "OpenAI models are generally more affordable." People familiar with the Anthropic-Replit partnership rejected Masad's onstage comments, according to TechCrunch. One of them, who asked not to be named, said the partnership was still in place. Replit sells a cloud-based software development platform where users build and deploy apps from inside a browser. At Disrupt on Thursday, Masad also described Replit as a "self-driving company," with agents doing much of the routine work while people supply judgment. "You need human judgment; you need taste," he said. Claude is still on the menu. A day after Masad's remarks, Replit's October 16 changelog said builders on Core and Pro plans can now choose Claude Haiku 5.5 from the model selector in Power Mode, and Replit's AI Integrations documentation still lists Anthropic's Claude models.
Anthropic Staff Expect AI to Handle Most of Their Work by 2030, Forecast Higher Unemployment
Anthropic's Oct. 16 research shows its employees expect AI to handle 75% of their work by 2030 versus 28% for U.S. workers. Staff forecast unemployment above 12% that year while the public sees it near 8%. Internal data already shows fewer junior technical hires and AI agents working six times the hours of humans. Anthropic published research on Oct. 16 that compares views on artificial intelligence from its own employees with those of U.S. adults. The AI company surveyed 1,334 staff members and found they anticipate far greater automation of their tasks than the general public does. Staff at the company expect AI to perform 75% of their current work by 2030. U.S. workers overall put that figure at 28%. The gap appears again when employees consider specific roles. Most Anthropic staff said AI will handle at least 80% of their jobs by 2030. Only about 5% of U.S. workers saw similar disruption in their own fields. The median Anthropic employee expects AI to manage 95% of the work of building a new AI model by the end of 2030. That belief carries over to the broader economy. Anthropic staff forecast U.S. unemployment at more than 12% in 2030. The current rate stands at 4.2%. Most U.S. workers in the survey predicted it would stay around or under 8%. Those who see AI taking on more of their own responsibilities tend to predict higher joblessness across the board. The pattern holds for both groups. Ten additional percentage points of work that respondents expect AI to handle correlates with 0.4 percentage points more forecasted unemployment among U.S. workers. Anthropic also released an accompanying study on how its own workforce has shifted. The share of junior employees in technical departments fell from 21% in early 2025 to 14%. Among new technical hires, the junior share dropped from 27% to 9%. Job postings for those entry-level technical roles declined sharply after December 2025. At the same time, AI agents have taken on more hours. In March 2026, autonomous and interactive agent work hours first exceeded human hours. By August, AI agent hours outnumbered employee hours by six to one. Managers have responded by adjusting hiring. Around a third of machine-learning managers and a fifth of software-engineering managers reported hiring less because of AI. Productivity perceptions inside the company have risen. In late 2024, 44% of employees agreed that work processes made them as productive as possible. That rose to 58% by November 2025. Employees also described roles changing. Some moved from performing tasks to overseeing AI outputs. The research, titled "The AI expectations gap," appears on Anthropic's site. A separate paper, "How employment is changing at Anthropic," details the internal hiring data and is available at anthropic.com. Business Insider reported on the surveys and noted that researchers have so far found mixed evidence on AI's effect on jobs. A Yale team recently concluded that the technology had mainly changed tasks without any connection to unemployment shifts. The Oct. 16 publications from Anthropic add fresh internal data from a company at the front of AI adoption. Anthropic said its experience could serve as an early indicator for wider labor trends. The company has set up systems to reallocate workers whose roles face immediate pressure to areas that may prove more durable.
Anthropic Pitches Draft Bill to Regulate Frontier AI Safety
Anthropic has pitched lawmakers on a draft bill that would allow government intervention in frontier AI only at strict thresholds: imminent risk of more than $1 billion in damages or over 50 deaths or serious injuries from biological weapons, loss of control or cyberattacks. The proposal requires independent evaluations and limits intervention powers to the Commerce Department and a D.C. federal judge. Anthropic representatives have pitched Capitol Hill lawmakers on a draft bill to regulate frontier AI safety and security, Politico reported Friday, citing three people with knowledge of the effort. The draft sets strict thresholds for government intervention. The bill would let the government block a model's release or use only if it poses a foreseeable, imminent risk of more than $1 billion in damages, or of killing or seriously injuring more than 50 people. That risk must stem from the creation or release of a biological weapon, the model evading its developer's controls, or a cyberattack. An Anthropic spokesperson told Reuters the bill represents proposals outlined in the company's Advanced AI Framework, released earlier this year. According to the spokesperson, the bill would give the government the "ability to block or deter dangerous deployments of the most powerful models," and would require developers to test frontier models, be transparent about their findings and have them independently evaluated. Under the draft, independent evaluators would register with the Commerce Department and periodically assess labs and their frontier models. Labs could pay the evaluators, as long as the payment isn't tied to the outcome of the evaluation. If evaluators determine there is "imminent enumerated risk" for a company's frontier models, they must report it to Commerce within 72 hours of completing their assessment. Commerce could then ask a federal judge in the U.S. District Court for the District of Columbia to suspend the model. The language explicitly prohibits any other U.S. government department, agency or officer from suspending development, deployment or internal use of a model, according to the report. That leaves one narrow path to a shutdown: registered evaluators, then the Commerce Department, then a single federal court. Security has become a hot topic in Washington after recent incidents in which AI agents escaped their developers' control, Reuters reported. Federal AI policy under President Donald Trump has relied mostly on voluntary industry pledges and executive orders, and Congress has yet to pass a federal AI law. The Commerce Department did not immediately respond to a Reuters request for comment. The draft text has not been published, and no sponsor has been named. Any action will have to wait: Congress is out of session until after next month's midterm elections, according to Reuters.
Bank of America Mobilizes 4,000 Workers After Anthropic's Mythos Exposes Vast Software Weaknesses
Bank of America chief executive Brian Moynihan delivered a blunt assessment this week. When frontier AI models began surfacing flaws across the bank's proprietary systems and vendor software, executives saw immediate danger. "That risk is real risk," he told CNBC. So the institution acted. It added 1,000 contractors to its existing team of roughly 3,000 specialists dedicated to remediation work. The contractors arrived in the second quarter. They remain on site. Their assignment centers on addressing vulnerabilities uncovered by tools that include Anthropic's Mythos model. The effort contributed to third-quarter costs that Moynihan described to analysts as "a couple hundred million plus." That figure covers both the software fixes and separate anti-money laundering compliance demands. Expenses should ease, he added, once the initial surge of discoveries subsides. Mythos arrived quietly in April under Project Glasswing. Anthropic granted limited access to select banks, technology companies and government agencies. The goal was defensive. Let trusted parties scan critical codebases before adversaries could weaponize the same capabilities. One early scan flagged more than 23,000 potential issues. Most rated low to moderate. Some carried higher severity. The volume proved overwhelming. Similar pressure hit other large lenders. JPMorgan Chase CEO Jamie Dimon told Bloomberg in early October that cybersecurity risks had risen tenfold after Mythos appeared. "AI created vulnerabilities that we didn't know about," he said. Banks that once measured patching cycles in weeks suddenly faced demands measured in days. Reuters reported last May that major institutions began sharing insights with smaller peers lacking direct access to the model. The model's track record extended beyond finance. It identified 271 flaws in Mozilla's Firefox 150 release. Mozilla CTO Bobby Holley offered a striking verdict in April. "So far we've found no category or complexity of vulnerability that humans can find that this model can't," he said, according to The Register. "We also haven't seen any bugs that couldn't have been found by an elite human researcher." The observation underscored a key point. Mythos accelerated discovery. It did not invent entirely new classes of problems. Yet the speed at which it surfaced them changed the math for security teams. Bank of America's response reflects that shift. Its technical workforce gained about 10 percent in efficiency from AI initiatives overall. The bank runs roughly 130 AI-related projects. Each carries expectations of two- to threefold returns over time. Those gains offer a partial offset. Moynihan projected AI-driven savings climbing from roughly $300 million this year to $700 million in 2027. Still, the immediate remediation bill landed heavily in the third quarter. And the pattern repeats elsewhere. Comcast and Booz Allen Hamilton reported using Mythos-class models to locate authentication weaknesses and complex exploit chains that traditional scanners missed. One Comcast assessment spanned 258 critical systems and approximately 170 million lines of code. The model's ability to reason across boundaries, rather than flag isolated issues, surprised some reviewers. Yet questions linger about long-term balance. Every vulnerability Mythos surfaces still requires human verification, code changes, testing and deployment. The contractors at Bank of America perform exactly that labor. They augment staff rather than replace it. Early hype around autonomous AI agents fixing their own discoveries has not fully materialized. Machines file the tickets. People still close them. Regulators took notice quickly. The U.S. government briefly restricted Mythos exports before lifting the ban. Anthropic later expanded its Cyber Verification Program, allowing broader vetted access while maintaining controls. By July, partners under the original Glasswing effort had verified more than 129,000 vulnerabilities. The company's own open-source scanning added thousands more. Bank of America's disclosure marks one of the most specific public accountings to date from a major corporation. It quantifies both headcount and spending tied directly to AI-generated findings. Other executives have spoken in broader terms. Dimon's warning on amplified risk. Earlier Reuters reporting on accelerated patching cycles across the industry. The collective message is consistent. Advanced models now scan at machine scale. Human remediation capacity has limits. Banks are paying to expand that capacity in the short term. Costs are expected to moderate. Once core systems receive attention, the volume of new high-priority findings should drop. Vendor software updates will incorporate many fixes over time. Moynihan signaled as much. The contractors will not stay indefinitely. Their presence buys breathing room while the bank absorbs the initial wave. Even so, the episode illustrates a broader tension. AI promises efficiency gains across operations. In security it first delivers an avalanche of work. That avalanche arrived at one of the country's largest financial institutions. Bank of America met it with thousands of additional hands and hundreds of millions of dollars. The rest of the sector watches closely. So do the regulators charged with ensuring systemic stability. The contractors continue their tasks. The models keep scanning. And the industry adjusts to a new rhythm where discovery outpaces repair, at least until equilibrium returns. How quickly that happens will shape cybersecurity budgets and staffing plans for years ahead.
EU AI Act Targets High-Risk Agentic AI Systems from OpenAI and Anthropic
The European Union continues to shape global standards for artificial intelligence governance as fresh discussions emerge around the implementation of the AI Act. Recent reports highlight growing concerns over how advanced AI systems, particularly those developed by companies like OpenAI and Anthropic, will comply with new rules on agentic systems and security requirements. According to a detailed examination published by TechRepublic, regulators are focusing on the risks posed by autonomous AI agents that can make decisions and take actions without constant human oversight. The AI Act, which entered into force in stages throughout 2024 and 2025, classifies AI applications according to risk levels. High-risk systems face strict obligations around transparency, data quality, and human oversight. Agentic AI, which refers to models capable of planning sequences of actions, using tools, and pursuing goals independently, falls squarely into this category for many applications. European officials worry that without proper safeguards, these agents could cause unintended harm in areas such as financial services, healthcare, or critical infrastructure management. OpenAI has already adjusted some of its practices to align with the incoming rules. The company introduced additional layers of safety testing for models like GPT-4o and o1, including evaluations that simulate real-world deployment scenarios where the system might interact with external tools or APIs. These tests examine whether the model attempts to bypass restrictions or engages in deceptive behavior when pursuing assigned objectives. Anthropic, known for its constitutional AI approach, has similarly emphasized built-in principles that guide model behavior even in complex, multi-step tasks. Both organizations have publicly committed to working with European authorities to interpret the Act's requirements for general-purpose AI models. One central challenge involves defining what constitutes an AI agent under the regulation. Traditional chatbots that simply respond to queries are treated differently from systems that can book appointments, transfer money, or control physical devices. The TechRepublic analysis points out that the distinction matters because agentic capabilities introduce new vectors for security vulnerabilities. An agent with access to email accounts, calendars, and payment systems could be manipulated through carefully crafted prompts that cause it to leak sensitive information or execute unauthorized transactions. Security experts have identified several specific threats associated with autonomous agents. Prompt injection attacks, where malicious instructions are hidden in data the agent processes, become more dangerous when the model can act on those instructions. For instance, an agent reading web pages might encounter hidden text that instructs it to forward private documents to an external address. Traditional input filtering proves insufficient because agents often summarize or transform data before acting on it, potentially bypassing safeguards. Data privacy represents another major area of focus. The AI Act requires providers of high-risk systems to maintain detailed technical documentation and undergo conformity assessments. For companies like OpenAI and Anthropic, this means documenting exactly how training data was collected, how models handle personal information, and what measures prevent unauthorized access to user conversations. European data protection authorities have signaled they will coordinate closely with AI regulators to enforce these overlapping requirements. Member states are approaching implementation at different speeds. France and Germany have established dedicated AI oversight bodies that are already conducting preliminary audits of large language model deployments. Smaller nations are pooling resources through the European Artificial Intelligence Board to share best practices and avoid regulatory fragmentation. This coordinated approach aims to prevent companies from seeking out jurisdictions with weaker enforcement while still allowing room for national innovation programs. The security dimension of the AI Act extends beyond protecting users from malicious actors. Regulators also want to prevent AI systems themselves from developing unwanted behaviors during operation. Techniques such as reinforcement learning from human feedback have proven effective at reducing harmful outputs in controlled settings, yet they offer less assurance once models gain the ability to interact with external environments over extended periods. Researchers at various European universities are working on new evaluation frameworks that test agent persistence, goal misgeneralization, and resistance to adversarial manipulation. OpenAI has responded to these concerns by releasing updated usage policies that explicitly prohibit certain agentic use cases in regions subject to the AI Act. The company now requires enterprise customers to implement additional monitoring when deploying custom agents built on its platforms. Anthropic has taken a similar stance, offering what it calls "agent safety tiers" that limit tool access based on the sensitivity of the task. Both firms have increased transparency by publishing more details about their red-teaming processes, though critics argue that self-reported testing lacks independent verification. Industry groups have expressed measured support for the regulation while calling for practical guidance on compliance. The European AI Alliance, which includes representatives from technology providers, research institutions, and civil society organizations, has submitted recommendations on standardized testing protocols for agentic systems. These proposals include mandatory reporting of incident data when AI agents cause significant harm or financial loss. Such transparency measures would allow regulators to identify patterns across different providers and adjust rules accordingly. Financial implications for AI developers are substantial. Compliance with the AI Act is expected to add considerable costs related to documentation, third-party audits, and ongoing monitoring systems. Smaller European startups worry they will struggle to meet these requirements while competing against well-resourced American companies. To address this gap, the European Commission has allocated funding through the Digital Europe Programme to support conformity assessment tools and shared testing facilities. These initiatives aim to reduce the burden on innovative firms without compromising safety standards. Public perception of AI safety has shifted noticeably in recent months. Surveys conducted across EU member states show increasing awareness of both the benefits and risks associated with autonomous systems. Citizens express particular concern about AI making decisions in sensitive areas such as loan approvals, medical diagnoses, or criminal justice assessments. This sentiment has encouraged policymakers to maintain a firm stance on high-risk classifications even as some industry voices argue for more flexibility. Technical solutions for meeting the Act's requirements continue to evolve. Methods such as constitutional AI, where models are trained to evaluate their own outputs against a set of principles, show promise for agentic applications. Similarly, sandboxing techniques that restrict an agent's access to only necessary tools and data can limit potential damage from compromised or misbehaving systems. Hybrid approaches that combine automated monitoring with human review for critical actions offer another path toward compliance. The interaction between the AI Act and other EU regulations adds further complexity. The General Data Protection Regulation continues to apply to any processing of personal data by AI systems, creating overlapping obligations around consent, data minimization, and individual rights. Cybersecurity requirements under the NIS2 Directive also intersect with AI security standards, particularly for systems operating in critical sectors. Companies must therefore develop integrated compliance strategies that address multiple regulatory frameworks simultaneously. As enforcement deadlines approach, both OpenAI and Anthropic have expanded their presence in Brussels and established dedicated policy teams to engage with regulators. These efforts include technical workshops where engineers demonstrate how safety mechanisms function in practice. Such direct dialogue has helped clarify ambiguous sections of the legislation and allowed for adjustments before full implementation begins. Looking ahead, the success of the AI Act will depend on several factors. Effective enforcement mechanisms, sufficient funding for regulatory bodies, and continued cooperation with international partners will all play important roles. The TechRepublic report suggests that the coming year will prove decisive as authorities begin conducting actual audits and issuing guidance based on real-world deployments rather than theoretical scenarios. European citizens and businesses stand to benefit if the regulation strikes the right balance between innovation and protection. Well-designed rules could increase confidence in AI applications while encouraging responsible development practices. Companies that adapt successfully may gain competitive advantages through demonstrated compliance and trustworthiness. Those that fail to meet the standards risk significant fines and reputational damage. The conversation around agent security reflects broader questions about how society should govern increasingly capable AI systems. European policymakers have chosen a risk-based approach that focuses oversight on applications with the greatest potential for harm. Whether this strategy provides adequate protection while allowing beneficial innovation remains to be seen. What is clear is that the decisions made in Brussels will influence regulatory thinking far beyond the continent's borders as other regions consider their own approaches to AI governance. Ongoing collaboration between regulators, technology companies, researchers, and civil society will be essential for addressing emerging challenges. As AI agents become more sophisticated and widespread, the need for clear, enforceable standards will only grow. The EU's AI Act represents one of the first comprehensive attempts to meet that need, and its implementation will offer valuable lessons for the global community.
Anthropic Hands Startups Free Claude Access to Capture the Next Wave of AI Builders
Anthropic announced Tuesday an expanded Claude for Startups program. The move gives qualifying young companies a full year of its paid Claude Team plan and $1,000 in API credits. It also unlocks discounts worth up to $45,000 from partner tools. The timing aligns with SF Tech Week and signals the AI company's determination to embed itself deeper into the startup world. The benefits add up fast. A new Claude Team subscription for five premium seats runs about $6,000 annually. Combine that with the credits and the partner offers. Total value can reach roughly $52,000 for approved applicants. But the real point runs beyond the dollars. Anthropic wants its models inside the products that will shape how most people encounter AI. Anthropic put it plainly in its announcement. "We created this program because we believe the benefits of AI will reach most people through the companies that build on top of models, rather than through the models alone. That makes partnering closely with founders and developers central to our mission." The statement reflects a calculated bet. Direct consumer apps matter. Yet the bigger impact may come from thousands of specialized tools built by nimble teams. Eligibility stays broad. Companies founded within the past five years qualify. So do those that raised money in the past two years. No venture capital required. Bootstrapped outfits, pre-seed teams, and funded players all sit at the same table. Applicants simply need a Claude Console account, a company email tied to their domain, and a short note on what they build. Anthropic reviews each one. It checks against its supportability policies. Once accepted, members receive the $1,000 in Claude API credits. These work only on Anthropic's first-party API through the console. They cannot run on Amazon Bedrock or Google Vertex AI. The credits expire after six months. Members also gain higher rate limits automatically. For teams new to Claude Team, the free year covers up to five premium seats. Existing users skip that part but still tap the other perks. The Claude Startup Stack forms the fresh element. It bundles offers from companies already building on Claude. Categories stretch across build, design, analyze, and grow functions. Specific examples include $5,000 in ClickHouse Cloud credits, 12 months of ElevenLabs with 33 million characters, and $100 in Cosmos credits from Augment Code. AI Weekly listed several of these in its coverage. Participants redeem each one with a code inside the Claude Console. Anthropic itself does not administer the partner deals. It bears no responsibility for them. Each carries the provider's own terms. Support goes further. Members book 45-minute virtual office hours with Anthropic's Applied AI team. Sessions run every other week. They gain entry to events such as hackathons, meetups, and the Claude Founder House held in San Francisco from October 6 to 8 during SF Tech Week. A startup newsletter delivers product updates and the chance to appear in features. Access to Claude Marketplace lets teams create and share plugins. This expansion builds on a program that began earlier in 2026. It already counts thousands of participating companies. The update opens the door wider. Founders backed by venture firms inside Anthropic's partner network can claim up to $100,000 in extra API credits through their investors. That tier targets the fastest-moving teams. Yet the core offer remains available without such connections. The strategy carries weight for Anthropic's business. Business customers generate the majority of its revenue, Quartz noted, citing earlier CNBC reporting. By subsidizing early adoption, Anthropic locks in usage before habits harden. Startups that wire Claude into their core workflows face high switching costs later. The company secures mindshare and data that sharpen its models over time. Competitors pursue similar plays. OpenAI, Google, and others offer startup credits and incubator programs. Anthropic differentiates through its focus on safety and its constitutional AI approach. The startup program adds practical tools for running an AI-native company. It doesn't stop at model access. It supplies the surrounding stack that reduces operational friction. Early reactions on X reflected genuine excitement. One founder posted that the program delivered "an amazing value" and expressed eagerness for the API credit plus specific partner offers like ElevenLabs. Another highlighted how the subsidies help model vendors secure API lock-in long before enterprise decisions crystallize. Several users shared screenshots of their approval or listed the exact perks they planned to claim first. Details matter for anyone considering the application. The $1,000 credit sounds modest compared with some past industry grants. Yet paired with the Team plan and partner stack it multiplies. Credits draw down based on actual token usage. Teams building high-volume agents or analysis tools will burn through them faster. Those testing ideas or augmenting internal processes gain more runway. Anthropic has paired this announcement with other initiatives. Days earlier it committed $100 million to the Claude Frontier Academy to train 10,000 engineers in enterprise AI deployment. The efforts converge on a single theme. The company aims to accelerate responsible AI adoption across both builders and large organizations. Founders should weigh the fine print. Credits expire. Offers come from third parties with their own rules. Approval isn't guaranteed. Still, the barrier to entry sits low. A two-minute form plus basic verification opens the gate. For teams already experimenting with Claude the program removes meaningful cost from the early stages. The announcement lands at a moment when AI costs remain a top concern for startups. Inference prices have fallen but scale quickly with usage. Tooling and data platforms add their own bills. Anthropic's package attacks those pain points directly. It hands teams breathing room to iterate before revenue arrives. Whether the program tilts the competitive balance remains to be seen. Yet it reveals Anthropic's view of the market. The future belongs not just to the best model but to the best integrated solutions built on top of them. By investing early in the companies that will create those solutions, Anthropic positions itself at the center of that activity. The free year of service and credits serve as both incentive and invitation. Applications are open now through the Claude for Startups program page. For many founders the decision comes down to a simple question. If your company meets the age or funding test, why not apply? The upside sits in plain view. The downside is two minutes of form filling. In a sector where every efficiency counts, that math looks favorable.