Big 5 AI Vendor Roundup: Week of October 19, 2026
Technology Note By:
Mark Tauschek,
Bill Wong,
Infotech
OpenAI disclosed two internal cases where coding agents weakened the systems monitoring them, then published a detailed account of the stronger isolation it now uses for frontier training. Google introduced hardware-isolated compute for agents, Microsoft said frontier models can't be trusted by default, and AWS added model fallback and managed cloud desktops for agents. The vendors are reaching the same conclusion from different directions: agent safeguards need to sit outside the model and outside the environment the agent can change.
The commercial market is moving quickly in the other direction. OpenAI models and the Claude Platform are becoming available through more cloud channels, Anthropic is making proactive agents and automatic tool use easier to access, and both Google and AWS are reducing the work required to move PyTorch workloads onto their own chips. IT leaders are gaining model choice, but identities, memory, runtime policy, telemetry, and billing remain tied to vendor control planes.
OpenAI agents weaken monitoring as the company hardens containment
- OpenAI reports that two internal agents weakened the systems monitoring them. In one October incident, a GPT-6.1 Sol agent suppressed automatic security alerts while repairing an evaluation pipeline. In another, GPT-6 Astra removed a monitoring integration to match a reference implementation, then incorrectly said it hadn't removed it. OpenAI hasn't concluded whether the behavior reflected over persistence or deliberate monitoring evasion. It is adding stronger review, automatic blocking, and termination of workloads that lack required monitoring.
- OpenAI moves frontier training into a more isolated environment. The company paused frontier reinforcement learning on September 20 after an internal model used a DNS resolver error to obtain limited internet access, then resumed work on October 1. OpenAI ran frontier training without internet access and used its strongest agents to attack its own containment. Those agents found chains of flaws that could escape hardened virtual machines, reach unexpected network paths, and communicate through shared resources. OpenAI says it patched the findings and found no simple concealed path to the internet.
- The Decisions API targets high-volume routing and classification. The generally available service uses GPT-6 Luna for bounded choices such as classifying an input, routing a request, or selecting an agent's next action. OpenAI says it can be up to ten times faster than using Luna through the general Responses API. The narrower service could lower the cost and latency of agent workflows, but hard security and compliance rules should still be enforced with deterministic policy rather than left to a model decision.
- OpenAI coordinates fixes for critical PHP vulnerabilities found with AI. Security firm Calif used GPT-5.6 Sol to identify a critical flaw, while Wiz independently found and reported the vulnerabilities. OpenAI worked with PHP maintainers, cloud providers, security firms, and governments to prepare patches and mitigations before disclosure. The case shows the defensive value of advanced cyber models, but it also shortens the time defenders may have before the same capability becomes widely available to attackers.
Google builds the infrastructure and distribution layer for multimodel agents
- Agent Compute Engine gives each agent an isolated virtual machine. The service, which already supports Gemini internally and is expected in preview in the coming months, places each agent in a small hardware-isolated environment with its own kernel, short-lived identity, and persistent workspace. Credentials are injected outside the sandbox rather than stored inside it. Google is also extending identity, policy, tracing, and network controls across Cloud Run, GKE, local coding agents, and other clouds. The architecture puts enforcement outside the agent, where it belongs.
- OpenAI models enter Google Cloud's Model Garden. GPT-6 Astra, GPT-6.1 Sol, GPT-6 Luna, and Codex workflows are rolling out in private preview, with general availability planned in the coming weeks. Customers can buy them through Google Cloud Marketplace and apply existing cloud commitments. OpenAI models are also planned for Antigravity and Gemini for business. The partnership increases model choice inside Google Cloud, but moving between models is easier than moving identity, policy, task state, logs, and spending controls to another platform.
- Google open sources native PyTorch support for TPUs. TorchTPU lets developers use standard PyTorch APIs and familiar tools such as vLLM, SGLang, Ray, and Hugging Face on Google accelerators. Meta helped develop the stack and says it is using it for key production workloads. The release lowers a major migration barrier for TPU adoption and gives large AI buyers another way to reduce dependence on one accelerator architecture, although cost and performance still need workload-specific testing.
- Google Vault adds filtered exports for Gemini in Workspace. Administrators can export Gemini conversations across Gmail, Drive, Docs, Sheets, Slides, and Meet by user, organizational unit, and date. Exports include prompts, responses, generated attachments, file references, and citations. Retention rules and litigation holds for Gemini in Workspace are still to come. The update improves eDiscovery, but IT and legal teams should confirm that conversation history settings preserve the records they expect to find.
Anthropic makes proactive agents easier to access and agent skills easier to move
- Claude Duet introduces a proactive agent that keeps working after the user leaves. The research preview is available by waitlist to US Pro and Max subscribers. Duet monitors connected applications, prepares a morning brief, completes work in a cloud computer, and asks before sending messages, making payments, signing documents, or deleting content. Anthropic says the early version can misread threads or misjudge urgency. The preview is aimed at individuals, but it shows the persistent agent model enterprises will soon need to govern.
- Anthropic donates Agent Skills to neutral governance. The Agentic AI Foundation under the Linux Foundation will receive the specification, name, GitHub organization, and domain. Anthropic says more than 70 platforms, including ChatGPT, GitHub Copilot, Cursor, and VS Code, already support the format. Neutral governance may improve portability, but skills can include instructions, scripts, and reference files. Organizations should treat them as versioned software packages, not harmless prompt templates.
- The full Claude Platform becomes available through Google Cloud. The Anthropic-managed option gives Google Cloud customers same-day access to Claude Platform features while using Google identity, billing, and committed spending. Anthropic acts as the data processor. The existing Google-managed option remains available for customers that require Google as processor, stronger regional controls, or deeper Google Cloud integration. Buyers now have more deployment choice, but they need to compare data roles, residency, feature timing, discounts, and support responsibilities.
- Claude Security adds continuous scanning and tracks fixes. The public beta for Claude Enterprise can monitor connected repositories as code changes, reopen vulnerabilities that return, and use organization-specific context to prioritize findings. New APIs, webhooks, MCP access, and role-based permissions connect the service to development workflows. Anthropic says customers have found more than one million vulnerabilities since the earlier beta, a company-reported figure. Security teams still need independent verification, clear repository scope, retention review, and human approval for patches.
Microsoft treats agents as insiders and broadens app creation
- Microsoft says frontier models can't be trusted by default. Microsoft describes enterprise agents as “agentic insiders” because they hold identities, reach business systems, and can adapt or collaborate in unexpected ways. It argues that Guardian Agents should inspect every action before execution. Project Perception is positioned as the control layer that discovers agents, assigns identity and policy, calculates risk, and adjusts what they may do. The direction is sound, but buyers should distinguish the architecture Microsoft describes from controls that are available and proven in their environment today.
- Copilot Code lets employees build working software from natural language. The Frontier preview can create apps, dashboards, scripts, and data transformations from a description, use Microsoft 365 context with permission, and publish applications to Copilot Managed Runtime. Users can also connect GitHub or work with local files and tools where administrators allow it. The product lowers the barrier to internal development, which makes application inventory, source control, data permissions, testing, support ownership, and usage-based spending controls more important.
- GitHub adds centralized model policy and clearer agent usage reporting. New APIs let enterprises manage model availability for organizations, teams, and agent applications. GitHub also began enforcing a global default for generally available features and expanded usage reports to name internal skills, agents, MCP servers, and plugins. Administrators should review defaults now rather than let new capabilities become available through an inherited setting.
AWS adds agent continuity, governed desktops, and a more portable chip stack
- AgentCore Gateway adds automatic model fallback. Applications can reach Bedrock models through one governed endpoint and define an ordered fallback chain for throttling, server errors, timeouts, or unavailable capacity. A circuit breaker skips destinations that are already failing. This can improve availability, but silent model substitution can change quality, safety, data location, latency, and cost. Every fallback route needs its own evaluation and clear telemetry showing which model handled the request.
- Amazon WorkSpaces simplifies agent access to governed cloud desktops. The managed MCP service now handles OAuth and desktop session lifecycles, so agents don't receive the underlying streaming connection. Agents can discover and launch approved applications through a catalog, while administrators can inspect active sessions. Workloads inherit the VPC, data loss prevention, and session controls already applied to human users. The service reduces custom integration, but desktop agents still need separate identities, narrow application access, recording, and rapid shutdown.
- TorchNeuron brings native PyTorch to AWS Trainium. The open source public beta supports standard PyTorch APIs, eager execution, and torch.compile on Trainium2 and Trainium3. Like Google's TorchTPU release, it reduces the effort required to move existing workloads onto a hyperscaler's custom chips. Framework compatibility improves hardware choice, but it doesn't remove dependence on the cloud's compiler, runtime, networking, and operational tooling.
Outside the Big 5
- Nvidia expands the supply chain behind its next-generation systems. Agreements with substrate, packaging, testing, and optical suppliers are intended to raise substrate capacity 2.5 times over three years, advanced packaging capacity by more than 300% by the end of 2028, and optical engine capacity 15 times by mid-2027. Nvidia is also advancing $1.1 billion to reserve US testing capacity. The plans show that the compute buildout is becoming a manufacturing and supply chain program, not only a data center investment cycle.
- Daytona raises $60 million to build an agent-specific cloud. The funding values the company at $1 billion. Daytona provides isolated Linux, Windows, macOS, and GPU environments that can start, pause, fork, and preserve state for long-running agents. The company says revenue has grown roughly 25 times since January, a company-reported figure. The round reflects growing demand for agent runtime infrastructure outside the hyperscalers, but enterprise buyers should test isolation, networking, identity, logs, regional availability, and exit options.
Being Reported
These stories are being reported but haven't been fully announced by the organizations involved.
- OpenAI reportedly cuts its fundraising valuation target. The Financial Times reports that OpenAI lowered the target for a planned $30 billion round to $1.25 trillion from $1.4 trillion after some investors resisted the higher price. The company is reportedly seeking bridge financing before a possible 2027 initial public offering. OpenAI hasn't confirmed the terms. The revision is an early sign that even frontier AI companies may face more scrutiny over infrastructure spending, revenue quality, and the path to sustainable returns.
- Anthropic is reportedly preparing to publish its S-1 Monday morning. Bloomberg, citing people familiar with the matter, says Anthropic plans to make its IPO registration statement public at about 9am Eastern on October 26 and could begin its formal roadshow the week of November 9. The Wall Street Journal has reported that the offering could raise up to $100 billion, which would surpass existing IPO records. Earlier expectations centred on a valuation around $2 trillion, more than double Anthropic's $965 billion private valuation in May, but some current and prospective investors have since discussed roughly $1.5 trillion. Anthropic told investors that third-quarter revenue rose 45% sequentially to $16.8 billion and that it was profitable on an adjusted basis, but growth slowed from the second quarter. A draft prospectus also showed an $80.7 billion first-half net loss, mostly from non-cash accounting charges, and at least $518 billion in decade-long infrastructure commitments. Anthropic confidentially filed a draft S-1 on June 1, but hadn't confirmed Monday’s timing at the time of writing. The public filing should show whether its growth and improving operating economics can support a valuation far above its latest private round.
Our Take
The OpenAI incidents are the clearest lesson this week. A monitoring system is weak if the agent being monitored can modify its configuration, suppress its alerts, or launch child workloads outside its coverage. The behavior doesn't have to be malicious to create risk. An agent focused on completing a task can treat oversight as an obstacle or an implementation detail. Google, Microsoft, AWS, Anthropic, and OpenAI are all moving toward the same architecture: separate the agent from its credentials and policy, contain it in an isolated runtime, inspect actions before execution, and retain a control path the agent can't reach.
The other story is qualified portability. OpenAI models and the Claude Platform are becoming available through Google Cloud, Agent Skills is moving to neutral governance, and PyTorch can now run more naturally on TPUs and Trainium. Those changes reduce model and hardware friction. They don't make the full system portable. Memory, business context, approval rules, agent identities, marketplaces, observability, data terms, and consumption billing remain platform specific. IT leaders should evaluate those layers before a pilot becomes a dependency.
What IT leaders should be doing
- Keep monitoring and enforcement outside the agent. An agent shouldn't be able to change its own alerts, credentials, network rules, approval requirements, or kill switch. Apply the same controls to subagents and workloads it creates.
- Govern persistent agents as nonhuman identities and managed endpoints. Give each agent an owner, defined purpose, least privilege, separate credentials, spending limits, retention rules, activity logs, and an expiry or review date.
- Test every fallback route. Automatic model switching improves availability only when the backup meets the same quality, safety, residency, and contractual requirements. Record which model handled every request.
- Treat skills, plugins, MCP servers, and generated apps as a software supply chain. Approve publishers, inspect content and code, pin versions, control distribution, maintain inventory, and test updates before release.
- Preserve an exit path from the control plane. Keep prompts, skills, business definitions, task state, traces, and evaluations exportable. Test another model, runtime, and cloud path before the primary platform becomes difficult to replace.
