The Board Room

The bar that was cleared is the problem

The technique cited in the revocation was a prompt asking the model to read a codebase and fix its flaws. It surfaced a handful of minor, already-known vulnerabilities. Anthropic's public position is that GPT-5.5 does the same work with no bypass at all. Whatever the merits, an enforcement bar that low is repeatable — and it was cleared by researchers at a company that is simultaneously Anthropic's distribution partner and its competitor. POLITICO's account has Amazon researchers testing the model two days after its June 9 release, Andy Jassy phoning the White House, and the Commerce letter arriving after Dario Amodei refused to pull the model.

Strip out the AI specifics and the structure is familiar to anyone who has run a platform business: a partner who also competes used a regulatory channel to remove a rival's product, with no published finding and no appeal path.

Model access stopped being a procurement decision and became a political exposure — and most enterprises are still single-sourced.

Read the scope, not the headline

Two details matter more than the letter itself. First, the removal was surgical: other models in the family were untouched, so this was not a vendor outage, a breach, or a capacity decision. Second, it reached Anthropic's own foreign-national employees, inside and outside the United States. Your standard continuity language — uptime credits, support tiers, escalation paths — covers none of that. The event your contract does not describe is precisely the one that happened.

Where the reporting agrees, and where it splits

Across the available coverage the agreement is unanimous on direction: single-lab dependency is now a regulatory exposure, not merely a commercial one. The Information's reporting supplies the mirror image. Anthropic publicly accused several Chinese labs of using Claude illicitly and routing sensitive domestic data into it, and within days China's internet regulator opened an investigation into DeepSeek and Moonshot AI. No lawsuit, no injunction — a vendor published what its telemetry showed and a foreign regulator did the punishing. Compliance disclosure is now a market-share instrument, and it runs in both directions.

The split is in what you do about it. Benedict Evans frames vendor risk as substitutability: quantify switching cost per workload, and pre-agree what Anthropic's year-end S-1 would have to show — margin after distribution payments, stock comp, customer concentration — to change your build/buy stance. The Commerce thread frames it as continuity: advance notification, service credits on government-ordered suspension, export-control contingency, disclosure of foreign-national access restrictions. Those are different clauses drafted by different people. You need both, and only one of them is in anyone's template.

The move

Fund portability as a resilience line item and frame it to the board as supply continuity rather than engineering elegance, because the scenario you are insuring against is a letter, not an outage. In practice that means a model-agnostic abstraction layer with a maintained eval harness — the harness is the expensive half, and without it a switch is a guess rather than a decision. Then do the cheap part nobody has done: write down which of your investors, resellers and distribution partners also compete with you at the model layer, and what regulatory relationships they hold. That list is short, it takes a week, and it is the difference between a supplier map and an escalation map.

Start with the one that has legal exposure

A reverse-engineered implant running command-and-control through a legitimate OneDrive account can remotely replace every stolen credential on request. Revoking the compromised token left the backdoor alive. Independent analysis reaches the same conclusion from the cloud side: the durable object of compromise is the application registration, not the token, and most monitoring is token-centric. The word "contained" appears in regulatory notifications, insurance attestations and customer communications. Every cloud incident your security organization closed on the strength of revocation was certified against an assumption that no longer holds.

Then the two that invalidate your dashboards

SANS reporting documents a malware-as-a-service kit that shipped a Microsoft-attested kernel driver, registered as an NVIDIA service, which terminated 145 antivirus and EDR processes from kernel mode, persisted across reboots, and re-killed any agent that came back — with zero VirusTotal detections. If your assurance reporting depends on agent coverage, you cannot currently distinguish "clean" from "silenced."

The second is quieter and cheaper to fix. Microsoft rated a SharePoint Server flaw CVSS 6.5, classified as spoofing; researchers then published detail showing authenticated remote code execution on a core collaboration platform. Meanwhile Cisco's Identity Services Engine carries an actively exploited CVSS 10.0 unauthenticated-root flaw — the company's second critical zero-day in short succession — Veeam flaws are delivering SYSTEM-level access, and a Zyxel GS1900 switch bug was already patched when CISA confirmed exploitation. Your patch queue did not fail. It sorted correctly against inputs that turned out to be marketing.

The surfaces nobody in your org chart owns

Three of these exposures sit outside the security mandate entirely. Attackers impersonated 40+ organizations on GitHub, using SEO to outrank a real project; LastPass caught it through brand monitoring, not product telemetry, because the product was never flawed. One infected smart-meter vendor endpoint was linked to roughly 167 downstream utility tenants, which makes your internal admin tooling a higher-value target than your production data plane. And an AI coding client packaged a 313MB commercial codebase plus full Git history, retried upload to Alibaba cloud storage 564 times, and encrypted the archive with a key held only on the vendor's back end — so neither the developer nor the client can verify what left. Vendor attestation is not a control.

What the sources agree on

Six independent reads converge on one uncomfortable point: this is a scope problem, not a budget problem. The prevailing guidance is that strengthening baseline capability beats buying tools, and every failure above was reachable through hygiene. Expect vendors to relabel as "AI agent security" specifically to escape that scrutiny; the qualifying question is whether a product enforces verification or merely observes it. Two caveats worth holding: several of these digests are teaser-level, without CVE identifiers or affected version ranges, so confirm against primary advisories before a remediation clock starts. And the federal backstop is thinning — CISA has shed roughly 1,000 staff and is retiring the free monthly vulnerability bulletin many runbooks quietly cite.

The moment your incident response plan calls the breach over is now the moment the attacker rotates back in.

The distribution mechanism is the strategy

Note where the policy lives: MXC containment rules are managed through Intune, the fleet product your IT organization already pays for. This is not a feature launch requiring a new purchase decision; it is a capability arriving through an existing enterprise contract, which is the hardest kind of competitor to displace. No rival operating system has a matching stack, and the category of independent agent-identity and agent-sandboxing vendors is being compressed before it had time to consolidate.

The more aggressive move is cross-platform. MXC already runs on Windows, Linux and macOS, delegating to Apple's own seatbelt containment layer. Microsoft is not building a Windows feature; it is bidding to own the containment policy format on machines it does not control. The developer who never touches Windows still ends up writing Microsoft's policy files.

The choke point Microsoft has not confirmed

Independent researchers — not Microsoft — found that the new On Device Agent Registry inserts itself as a proxy between every MCP client and server, returning its own process ID to the agent. MCP is the emerging protocol agents use to call tools. That position is the browser seat of the agent era: visibility into all agent-to-tool traffic, policy leverage over what passes, and telemetry no competitor can replicate. Two consequences. If you sell anything in that middle seat — agent gateways, routers, tool-call observability — you are structurally disintermediated on Windows. If you buy, you need a written answer on inspection scope and payload retention before regulated data crosses that boundary, not after an auditor finds it.

Identity is inventory, not enforcement

Agents get Entra ID identities and appear as distinct users in Task Manager. But registration is self-attested — a rogue agent opts out by declining to register, which is exactly why Defender is being retrofitted to hunt unregistered agents the way it hunts viruses. Two other reads corroborate where enforcement has to sit. A public proof-of-concept on Meta's Muse agent shows assistants are permission aggregators: malware already resident on a Mac inherits every OS permission the user granted the agent, and one hidden configuration setting converts that into persistence. And the disciplined pattern emerging on the vendor side is to treat agents as identities — per-agent least-privilege credentials, scoped revocable tokens, action-level audit logging. Treat registration as hygiene; put the control in containment and egress.

Where the value is moving

The layer above is commoditizing at the same time. Anthropic's Claude Code now reads OpenAI's Agents.md instruction format, handing the standard-setting position to a competitor in exchange for interoperability, and Google shipping an open agent orchestration runtime is a declaration that middleware will be free. Any proprietary agent-instruction or prompt-configuration layer on your roadmap is a depreciating asset. What stays defensible is above the runtime — evaluation, governance, oversight of machine-authored change — and below it, in your codebase, incident history and customer context.

One economic item for the CFO. Windows ML's Execution Provider model severs hardware optimization from driver cycles that previously took six months to reach meaningful adoption, small models are shipping in-OS, and a pre-release Surface ran Qwen against GitHub Copilot at roughly 40 tokens per second. A tier of AI functionality is heading to zero marginal cost on a 12-18 month clock. Hold it loosely: the registry is beta-only, MXC is not broadly enforced, and NPU-free models remain aspirational. Build behind feature flags with cloud fallbacks.