Executive Summary
On 10 September, OpenAI turned the engine behind its coding agent into a public API with no platform fee, and priced a new voice model at five cents a minute. The same day, Anthropic and Microsoft each published evidence that criminals and state-backed groups made the same move months ago — using agents to run intrusions and to send over a million fraudulent invoice emails.
Both stories matter to any business, but for different reasons. One changes what you can build. The other changes what you need to defend.
The most useful item this week was neither: a benchmark showing the best AI system passed under a quarter of real agent-building tasks.
Estimated reading time: 11 minutes
Key Takeaways
- Agent orchestration is now a commodity. OpenAI charges nothing for the Agents API beyond the tokens and tools your agent uses.
- The bottleneck moved from capability to specification. The best system tested on a new agent-building benchmark passed 23.9% of tasks against an 82.2% expert score.
- Attackers have adopted the same architecture. Anthropic documented one breach going from a stolen developer token to full cloud admin control in roughly three hours.
- Your AI API keys are now a target in their own right. Attackers steal them to run their own attacks on your account and your bill.
- Out-of-band payment verification is the cheapest useful control available right now. Microsoft documented a campaign of over a million emails impersonating customers’ own CEOs.
- If you operate in the EU or EEA, part of the AI Act has applied since 2 August 2026. The widely reported “delay” did not cover everything.
What Happened?
Three separate developments landed within a few days of each other.
OpenAI shipped an agent platform
On 10 September, OpenAI released three products at once.
| Product | What it is | Pricing |
|---|---|---|
| Agents API (public beta) | The harness behind Codex, opened to developers. Handles session management, context, tool coordination and subagents | No platform fee. You pay for tokens and tools only |
| GPT-Live-1 | A voice model that listens and speaks at the same time, so callers can interrupt without breaking the conversation | $0.05 per minute for the voice layer. Backend model and tools billed separately |
| ChatGPT for Financial Services | A version of ChatGPT Work for investment banking and equity research, built with Morgan Stanley and Evercore | Not published |
The Agents API lets developers choose where the agent actually runs: an OpenAI-managed sandbox, their own infrastructure, or a partner environment. Named partners include Cloudflare, Oracle, Vercel, Modal, DigitalOcean and others. The underlying harness is open source.
ChatGPT for Financial Services ships with licensed data from Daloopa, PitchBook, LSEG News and Crunchbase already connected, and lets administrators publish Word, Excel and PowerPoint templates so outputs match a firm’s house style. OpenAI has said similar products for other sectors will follow, without naming them.
Two security reports landed the same day
Anthropic published its fourth threat intelligence report, covering misuse it detected and disrupted between December 2025 and August 2026 across seven categories including cyber operations, fraud and influence campaigns.
The core finding: most of the operations it documented used AI to carry out or coordinate the work, not just to advise on it. Humans mainly set targets and reviewed results.
Documented examples include:
- One breach escalating from a single stolen developer token to full administrative control of a cloud environment in roughly three hours
- One compromised software supplier giving attackers access to data belonging to around 200 of that supplier’s own customers
- A Russian state-linked group running agents that watched whether its malware had been detected, then rebuilt it automatically until it was not
- Attackers stealing AI API keys from victims and then running their attack workloads on the victim’s account
Microsoft published an analysis of a fraud campaign it detected between 3 and 5 August 2026. More than one million emails were sent to business users, 87.7% of them in the United States.
The emails impersonated the recipient company’s own CEO, CFO or President and asked accounts payable to approve a payment of nearly $50,000. To make the request look routine, the attackers attached a fake ServiceNow invoice and two fabricated forwarded email threads between the spoofed executives.
Microsoft found several signs consistent with AI-assisted writing, but was careful to say these indicate involvement rather than prove how much of the content AI produced. It also confirmed it found no evidence that ServiceNow or the other impersonated organisations were compromised.
A benchmark asked whether AI can actually build a working agent
On 8 September, the customer-service AI company Sierra open-sourced a benchmark that makes building an agent the task rather than scoring a finished one.
An AI is given what a real project actually starts with: messy business records, a client who holds the requirements in their head, a production system to work through, and a cost limit. It then has to deliver a working customer-service agent, which is scored by deploying it against simulated customers.
Across 53 tasks, the strongest system tested passed 23.9%. An expert-built reference scored 82.2%.
Why It Matters
Look at these three stories together and a single picture emerges. The technology to run long, multi-step work through software has arrived, become cheap, and is already in use — by businesses and by criminals.
That is a bigger shift than any individual product launch.
For years, the honest answer to “should we build an AI agent?” involved a long engineering conversation about orchestration, context limits and error recovery. That conversation is largely over. You can rent all of it, and OpenAI is not charging a margin on it.
But the same week produced clear evidence that the engineering was never the expensive part. The 58-point gap in Sierra’s benchmark sits in a different place entirely: working out what the agent is supposed to do, digging that out of records nobody has tidied since 2019, and checking the result before customers see it.
That work is internal, unglamorous, and cannot be bought.
The security reports make the same point from the other direction. Anthropic was explicit that none of the attacks it documented used a technique defenders have never seen. Stolen credentials, unpatched systems, phishing. What changed is the cost of running them. When the labour of reconnaissance and exploitation drops close to zero, targets that were previously not worth an attacker’s time become worth it.
The practical translation: you did not become more interesting to attackers this year. You became cheaper.
Business Impact
Finance and accounts payable teams
This is the group with a live problem. The Microsoft campaign is built to defeat exactly the instincts finance staff have been trained on. The email appears to come from inside the company. The vendor is real and recognisable. The approval conversation is already there in the thread.
No amount of “look for spelling mistakes” training catches this. The only control that reliably works is verifying payment changes through a channel the email cannot reach — a phone call to a number you already had, not one in the message.
IT and security teams
Two changes deserve attention.
First, AI API keys and session tokens are now stolen for their own sake. Anthropic described attackers gaining three things at once from a stolen key: something to resell, free computing power billed to the victim, and activity that looks like it came from the legitimate owner. Keys were being harvested from mobile app files, code repositories and container images.
Second, signature-based detection is under pressure. If attackers can automatically rebuild malware until it stops being flagged, the defensive value shifts toward watching behaviour — identities, credentials, unusual data movement — rather than matching known files.
Customer service and contact centre operations
Voice agent economics changed this week. A model that can be interrupted without losing the thread removes the most common reason customers give up on automated phone systems.
Be careful with the pricing, though. Five cents a minute is a rate for time on the line, not for problems solved. A poorly designed agent that keeps customers talking costs more, not less. Backend reasoning, tools, telephony and your own infrastructure are all extra.
Software and product teams
If you are currently building your own agent orchestration, it is worth pausing to check whether you are rebuilding something now available at cost. The harness is open source, so you can read exactly what you would be replacing.
Financial services
OpenAI’s vertical product targets the research, modelling and pitchbook work normally done by junior analysts. Anthropic released a comparable product for the sector last year. Firms in this space should expect vendor conversations shortly, and should ask about pricing and regional availability — neither has been published.
Everyone else
No urgent action. But the pattern of “model plus licensed data plus firm templates” is clearly repeatable, and OpenAI has said more sectors are coming. If your industry runs on licensed data and standardised documents, you are on that list somewhere.
Key Changes
The developments that actually change a decision:
- Agent infrastructure now costs nothing beyond usage. The build-versus-buy question on orchestration is close to settled.
- Voice and reasoning are now priced and chosen separately. You can put a cheap model behind a conversation about order status and an expensive one behind a complaint.
- Vertical AI products arrive with data licensing already done. That removes a procurement step that often took months.
- Where the agent runs is now your choice, including inside your own network. That matters for regulated work.
- AI credentials belong in your access management policy. Most organisations have not made this change yet.
- Payment approval processes need an out-of-band step. This is a process change, not a technology purchase.
Industry Reaction
Developer discussion of the Agents API on Hacker News focused less on the features and more on the trade-off: managed convenience against control and dependence on a single supplier. That is a reasonable concern. The harness is open, but the managed service, the hosted data and the vertical tooling are not.
Coverage of ChatGPT for Financial Services widely framed it as a direct response to Anthropic’s competing product for the same sector.
On the research side, Sierra’s framing was blunt. Building a reliable customer-service agent used to be the hard question. Now it is table stakes, and the harder question is who builds it.
One critical voice is worth repeating. Commenting on a separate story — UBS making AI skills a formal requirement for its 2027 graduate intake — The Next Web raised a concern about what happens when juniors use AI from day one and never develop the instinct that comes from getting things wrong slowly. Screening for AI skill does not solve that, and may make it worse.
It is an open question, and nobody has answered it yet.
⚠️ Read the sources critically
Both security reports come from companies that sell the remedy. Anthropic sells AI; the Microsoft post ends with product recommendations. That does not make the findings wrong — the evidence is detailed and both companies published technical indicators — but it is worth knowing who is telling you to be worried.
Opportunities
Cheaper internal tooling. Teams that understand their own processes can now stand up working agents in days rather than building infrastructure first.
Better phone support without a replatform. Full-duplex voice removes the awkward delay that makes automated calls feel broken. For businesses handling repetitive enquiries, this is the first version of the technology worth piloting properly.
A services gap worth filling. Sierra’s benchmark identified exactly what AI does badly at agent projects: understanding messy records, asking the client the right questions, and testing more than one design. Consultancies and internal analysts who do that well have a clear role.
A cost lever on inference. Competition on inference chips continued this week, with Positron raising $875M at a $5B valuation for a design built around commodity memory rather than the expensive kind. Nothing changes your 2026 budget, but the direction is downward.
European options are better funded. Mistral raised €3 billion at a valuation above €21 billion, led by Samsung and co-led by an EU-backed fund. Its models can be downloaded and run on your own servers, which matters if your data cannot leave your infrastructure.
Risks & Limitations
The Agents API is a public beta. Features, pricing and terms can change. One report indicates US-only data residency and no Zero Data Retention support during the beta. We could not confirm this in OpenAI’s documentation, and it would be a blocker for some regulated work. Confirm it directly before committing.
Every performance number from the launch is vendor-supplied. OpenAI published customer testimonials claiming 60% lower cost per case and 86% fewer failed responses. None has been independently audited. Treat them as marketing until proven otherwise.
Recording customer calls is processing personal data. Disclosure, consent and retention rules apply, and call-recording law varies by country. Design for this before the pilot, not after.
Self-hosting moves the burden, it does not remove it. Running open-weight models on your own servers means owning the patching, monitoring and evaluation that a managed service handles for you.
The benchmark has caveats too. Sierra’s evaluation uses AI to simulate users and to grade results, without stated human calibration, and the research builds heavily on the authors’ own earlier work. The 23.9% figure is a strong signal, not a settled fact.
Concentration risk is real. Buying the harness, the model, the data and the application from one supplier rebuilds the lock-in that open models were meant to avoid.
Compliance note: the EU AI Act date most teams have wrong
If you sell into the EU or EEA, check this against your compliance calendar.
| Obligation | Status |
|---|---|
| High-risk standalone systems (Annex III) — hiring tools, credit scoring, biometric ID | Deferred to 2 December 2027 |
| High-risk AI built into regulated products (Annex I) | Deferred to 2 August 2028 |
| Article 50 transparency — telling people they are talking to a machine, labelling synthetic media | Already in force since 2 August 2026 |
| Article 50(2) marking for systems already on the market before 2 August 2026 | Grace period ends 2 December 2026 |
The deferrals became law through Regulation (EU) 2026/1744, in force from 27 July 2026. Penalties for transparency and high-risk breaches sit at up to €15M or 3% of turnover.
The headline most teams absorbed was “the EU delayed the AI Act.” Half of that is true. If you run a customer-facing chatbot in the EEA, the transparency rules already apply to you.
Future Outlook
Confirmed. The Agents API is in public beta and OpenAI has said it will iterate toward general availability based on feedback. OpenAI has stated it will release tailored products for further sectors. Mistral has said it will spend its new funding on research, compute and infrastructure it owns rather than rents.
Likely. Agent infrastructure pricing will keep falling toward zero margin, with suppliers capturing value through data, evaluation tooling and vertical applications instead. Expect competing responses from Anthropic, Google and Mistral within months. Expect more benchmarks in the style of Sierra’s, measuring whether something can actually be deployed rather than whether it scores well.
Editorial interpretation. We expect procurement teams to start asking vendors for deployment evidence rather than demonstrations, because the gap between the two is now measurable. We also expect AI credential handling to appear in cyber insurance questionnaires and audit checklists within the next year. Neither is confirmed.
Unknown. Pricing and European availability for ChatGPT for Financial Services. Which sectors OpenAI targets next. Whether Mistral’s funding translates into a model that competes at the frontier — the company announced no successor model, no release date and no capability target.
The Future Signal
The interesting thing about this week is not that agents got cheaper. It is where the difficulty went.
For three years the limiting factor in business AI was the model. Then it was the plumbing around the model. Both are now solved well enough to buy. What is left is the part nobody can sell you: knowing precisely what the work is, where the rules live, and which exceptions matter.
Sierra’s benchmark measured that gap and found it enormous. The same gap explains why some companies get value from AI quickly and others burn a year on pilots. It was never about which tool they chose.
The security reports say the same thing from the other side. Attackers succeeded because they knew exactly what they wanted and let the software handle the rest. That is a discipline, not a technology.
So the durable advantage is shifting toward something unfashionable: organisations that genuinely understand their own processes. Documented workflows. Clean records. People who can explain why a rule exists.
That was always valuable. It is now the difference between an AI project that ships and one that quietly stops being mentioned.
What Businesses Should Do Next
This month — do these regardless of your AI plans
- Add an out-of-band verification step for any payment request involving new bank details or unusual urgency
- Tell your finance team what this specific scam looks like: internal sender, real vendor branding, approval thread already attached
- Find out where your AI API keys currently live — code repositories, mobile apps, container images, CI/CD pipelines
- Add AI keys to your credential rotation and monitoring policy
- Confirm nobody in your organisation buys AI access through a discount reseller
- If you sell into the EEA, check whether your customer-facing AI meets the transparency rules that took effect in August
This quarter — if you are considering agents
- Pause any in-house work on agent orchestration and check whether you are rebuilding something now available at cost
- Pick one narrow, well-documented process for a pilot rather than a broad one
- Write down the rules and exceptions for that process before writing any code. This is the step the benchmark says gets skipped
- Measure cost per resolved case, not cost per minute or per token
- Ask any vendor for evidence of deployment, not a demonstration
Monitor, do not act yet
- Vertical AI products for your own industry
- Inference pricing, which is trending down but not yet enough to change a budget
- European sovereign options if data residency is a live constraint for you
💡 Future Signal Tip
Before your next AI pilot, try this test. Ask two people who do the process today to independently describe the rules for handling an unusual case. If their answers differ, you have found your real project — and it is not an AI project yet.
Frequently Asked Questions
Should we build an AI agent now that the infrastructure is free?
The infrastructure being free does not make the project cheap. The evidence this week suggests most of the cost sits in understanding your own process well enough to specify it. Start with one narrow workflow you can already describe precisely.
Is five cents a minute actually cheap for a voice agent?
It is cheap for the voice layer only. The model doing the thinking, any tools it calls, phone service and your own infrastructure are all additional. Work out your cost per resolved call before comparing it to a human.
Are AI-written phishing emails really a new threat?
The emails themselves are not new. What changed is volume and polish. Microsoft detected over a million in three days, each personalised with the recipient company’s own executive names. The defence is process, not detection.
What exactly should we do about AI API keys?
Treat them like production database passwords. Know where they are, scope them narrowly, rotate them, and monitor for unusual usage. Attackers steal them specifically because the compute gets billed to you and the activity looks like yours.
Does the EU AI Act delay mean we can stop preparing?
No. The high-risk obligations moved to December 2027, but the transparency rules — telling people they are dealing with a machine, labelling synthetic media — took effect on 2 August 2026 and were not deferred.
Is Mistral a serious alternative to OpenAI or Anthropic now?
It is a better-funded one. Its advantage is that you can run the models on your own servers, which solves a real problem for regulated businesses. It did not announce a new model, so there is no new evidence on capability.
We are a small business. Does any of this apply to us?
The security items do, and they cost nothing to fix. Out-of-band payment verification and knowing where your API keys are matter more for small businesses than for large ones, because the consequences are harder to absorb.
Why does a 23.9% benchmark score matter to a non-technical reader?
Because it is the clearest evidence yet that the hard part of AI projects is not the AI. An expert scored 82.2% on the same tasks. The difference is understanding the business, and that is your team’s job, not the vendor’s.
Conclusion
The week’s headline was that agents became infrastructure you can rent. The more useful finding was that renting the infrastructure does not get you an agent that works.
If you take one action from this article, make it a security one. Add an out-of-band step to payment approvals, and find out where your AI API keys are. Both are cheap, both take days rather than quarters, and both address a threat that two independent companies documented in detail this week.
If you are considering an AI project, spend the first month writing down how the process actually works rather than choosing a tool. The evidence now strongly suggests that is where projects succeed or fail.
The tools will keep getting better and cheaper. Your understanding of your own business is the part that only you can improve.
