The Watch

Four Vendor Failures, One Week

In a single intelligence cycle, four major AI vendors simultaneously demonstrated that the governance assumptions underpinning most enterprise AI deployments are fundamentally unreliable. This isn't a theoretical risk assessment — these are concrete events that may already affect your environment.

Microsoft Copilot: 'Entertainment Purposes Only'

Microsoft's official terms and conditions describe Copilot as being 'for entertainment purposes only' — explicitly not for business use. If your organization deployed Copilot for code review, document generation, email drafting, or any production workflow, you're operating outside the vendor's stated terms. In a regulatory inquiry, breach investigation, or litigation, this creates a liability vacuum: Microsoft has pre-emptively disclaimed responsibility for the exact use cases you purchased it for.

This is particularly acute for organizations subject to HIPAA, SOC 2 Type II, or GDPR where AI-assisted data processing requires demonstrable vendor accountability.

Anthropic: Platform Access Revoked Overnight

Effective April 4, 2026, Anthropic blocked Claude Pro and Max subscribers from connecting to third-party agentic tools like OpenClaw. Users must now switch to per-token API billing. OpenClaw's creator (now at OpenAI) accused Anthropic of an embrace-extend-extinguish strategy. The security lesson: any automation, detection logic, or security tooling your teams built on Claude via third-party connectors may have broken overnight with zero notice.

Grok: Forced Adoption Under Business Pressure

Banks, law firms, and advisers working on the SpaceX IPO are being required to purchase Grok subscriptions worth tens of millions of dollars and integrate the chatbot into their IT systems. Some have already complied. Grok faces active investigations for generating harmful content, yet it's entering financial institution environments through business pressure rather than security procurement. Sensitive IPO materials and M&A data are flowing through a platform with known safety gaps — creating regulatory exposure under OCC, FFIEC, and SEC oversight.

OpenAI: Leadership Vacuum During IPO

OpenAI's Fidji Simo (CEO of AGI Deployment — their revenue leader) is on medical leave. COO Brad Lightcap shifted to special projects. This during IPO preparation — historically when companies are most distracted from operational fundamentals including security. Two sources independently flagged this as a TPRM watchlist event.

Platform dependency without contractual guarantees is operational risk. This week proved that every major AI vendor can change your deployment terms, revoke your access, or lose their leadership overnight.

The Pattern

These aren't isolated incidents. They reveal a structural gap in how organizations evaluate AI vendor risk. Traditional TPRM assesses data handling, uptime SLAs, and security certifications. It doesn't assess whether the vendor's ToS actually covers your use case, whether API access can be unilaterally revoked, or whether business partners can force AI tool adoption into your environment.

What's New Since Thursday

Thursday's briefing covered the LAPSUS$ claim against Mercor — 939GB of source code, 4TB total data exfiltrated via TailScale VPN. Today's intelligence adds a more insidious dimension: Mercor's core business model is itself a systematic IP exfiltration mechanism, and Meta has paused its partnership in response.

The Business Model IS the Threat

Mercor, now valued at $10 billion, has been actively soliciting proprietary work materials from professionals across industries — offering payment for materials like '4D physics scenes with camera data' from visual effects artists. Despite claiming it 'does not buy intellectual property,' the materials Mercor seeks are precisely that: work product created under employment agreements that assign IP to the employer.

Two independent sources confirm the pattern. This creates a two-sided security exposure that's more dangerous than the breach itself:

• Breach exposure: If any employees engaged with Mercor, their PII and potentially your proprietary data are in the 4TB dump
• Ongoing insider threat vector: Mercor's solicitation model creates a permanent financial incentive for current and former employees to exfiltrate IP — a pipeline that operates post-employment, beyond your DLP perimeter

Why Traditional Controls Fail

The attack chain bypasses standard defenses:

1. Employee departs with copies of work product (or retains cloud access past revocation)
2. AI data broker offers cash for 'old job materials' — framed as harmless freelance work
3. Your trade secrets enter a third-party pipeline with zero contractual protections for you

Traditional DLP catches bulk downloads during employment. It doesn't prevent an ex-employee from sharing a Google Drive folder six months later. Your offboarding process is now your perimeter — and as one source noted, most organizations' offboarding is Swiss cheese.

When a $10B startup is paying your ex-employees cash for their old work materials, your separation agreement and offboarding controls are your last line of defense — and they probably weren't written for this threat model.

Three New Agent Capabilities Shipped This Week

While Friday's briefing covered DeepMind's research proving 86% prompt injection success against AI agents, this week's intelligence reveals the attack surface has expanded with three specific new capabilities now in production:

1. Claude Desktop Control — Full Session Privileges

Anthropic released a feature allowing Claude to take direct control of a user's desktop when standard integrations fall short. The AI can click, type, navigate applications, and perform any action the logged-in user can. It inherits file system access, browser sessions with authenticated cookies, credential managers, and email. Compounding the risk: Anthropic simultaneously disclosed 'functional emotions' in Claude that influence its behavior, and multimodal hallucination research confirms AI models fabricate confident descriptions of content they never processed.

Your EDR was designed to detect malware, not an AI assistant accidentally emailing sensitive files because it hallucinated the user's intent.

2. Cursor 3 — Parallel Autonomous Agent Fleets

Cursor 3 shipped an 'agent-first' IDE replacing the classic editor layout with parallel AI fleets that execute code autonomously. This means multiple AI agents running code on developer workstations simultaneously, with each agent having access to the codebase, terminal, and development environment. If your engineering teams adopt it — and developer adoption of AI coding tools is notoriously fast and shadow-IT-driven — your code execution environment just multiplied its attack surface.

3. MetaClaw — Silent Calendar Access

MetaClaw trains AI agents by accessing users' Google Calendar data while they're in meetings. In most Google Workspace and M365 tenants, default OAuth consent policies allow users to grant third-party apps read access to calendar, email, and documents without admin approval. Each grant is an invisible data exfiltration channel.

The Detection Gap

None of these tools trigger malware signatures. They operate as legitimate applications with user-granted permissions. Your EDR sees a desktop application performing normal user actions. Your network monitoring sees HTTPS traffic to known cloud endpoints. Your SIEM sees OAuth grants that look like any other third-party app approval.

The agents that will cause your next incident won't exploit a vulnerability — they'll use the permissions your employees granted them.