The Board Room

The Pragmatic Engineer reports that agent-written pull requests on GitHub outnumbered human ones in August 2026, after a ninefold rise in eight months. Your review process and output metrics were built for human volume. Both now overstate how much of that code anyone has actually checked. AINews and ByteByteGo add that automated graders and approval scores have errors of their own, so the checking itself needs auditing.

SANS NewsBites reports that attackers are exploiting FortiMail flaw CVE-2026-104286 and that no patched release existed as of October 6. Citrix NetScaler logged its third actively exploited flaw in eight days. If you run either product, your CISO needs to answer for it this week. At the same time, Google stopped taking open-source bug reports after a flood of invalid AI-generated submissions. CyberScoop rates the newest NetScaler bug the mildest of the three.

Applied AI reports that Microsoft cut its internal Claude bill by more than a third. The bill had peaked above $1 billion annualized. Microsoft got there by routing work to OpenAI models it reportedly uses without paying, and to its own MAI models. It now says it wants Copilot customers to make the same swap. Whoever controls routing keeps the savings, so you need to own that layer. Underneath it, AINews reports decision models priced at $0.02 to $0.10 per million input tokens.

The Pragmatic Engineer reports that spot CPU capacity is nearly impossible to get without long provider relationships. Some customers are already prepaying for capacity that comes online from December. Moving agents to the cloud will raise your CPU demand while supply is rationed. TLDR IT reports that Amazon is exploring a roughly $8 billion sale-leaseback of Nvidia chips, which would move depreciation risk to investors. Expect pressure to sign longer commitments.

Morning Brew reports that Sam Altman told Politico the world should 'accept some bad things happening' from AI. Meanwhile, the Supreme Court is weighing a tobacco-style consumer-protection suit against Exxon. Simplifying AI reports that OpenAI watermarks ChatGPT text in the EU but leaves watermarking off by default in its API. Both developments push the cost of AI harm toward the company shipping the product. A ruling in the Boulder case is likely in June 2027.