Leadership & Executive
The Board Room
Workday will start charging for outside AI agents in February 2027.
The bill for an agent now comes from the system the agent works inside, and Bhusri still says he would prefer you run the vendor's own Sana. JPMorgan refused outside agents entirely, so the choice is a priced door or a closed one. The new line item lands in a budget cycle where only 10% of managers expect AI spend to rise substantially.
In Play
Systems of Record Start Pricing Agent Access
Workday opened its platform to agents from Anthropic, Microsoft and OpenAI, and The Information reports it will charge by agent usage from February 2027. JPMorgan is blocking outside agents from client accounts instead. Agent access to your core business systems is becoming a privilege that is either priced or refused. A Wharton/GBK survey finds only 10% of managers expect AI spending to rise substantially, down from 19% last year.
Ask ClarityAgent Frameworks Fail at the Tool-Call Boundary
CSO reports that researchers bypassed six AI agent frameworks with a single 'Repeat-After-Me' prompt. A separate study found 253 verified bugs across 118 open-source MCP servers, the connectors agents use to call tools. The weakness sits in the layer that lets agents take actions, not in the model itself. Every agent with write access in your business carries that weakness until something outside the model checks each action before it runs.
Ask ClarityVendor Control Planes Cause Physical Loss
Attackers remotely hijacked Danfoss freezer controls over October 10-11, and SANS NewsBites reports an estimated 250-350 French supermarkets were hit. Sources disagree on how much damage the attack did. GitLab patched a CVSS 10.0 flaw in self-managed servers, and a Palo Alto GlobalProtect flaw is under active exploitation. Your largest exposure now sits in systems that vendors manage and your IT team may not own.
Ask ClarityFrontier Model Prices Are Promotions
Google made Gemini 4 Argon generally available on October 14. AINews reports Artificial Analysis rates it level with GPT-6 Astra at about 60% of the cost per task. Argon's introductory API price of $2/$10 per million tokens reportedly doubles to $4/$20 after November 30, so an AI budget built on today's rates rests on a promotion. Meta's Muse Wonder launched at the same $4/$20, against $10/$50 for Fable and Astra, per ben's bites.
Ask ClarityAI Deal Prices Split on Operating Proof
The Information reports that Applied Intuition, which makes software to develop and validate driver-assistance systems, is fielding offers at $30B or more. That is roughly double its June mark. Its only disclosed revenue figure is $400M ARR at end-2024. Character.AI filed for bankruptcy two years after Google paid $2.7B to license its models, and Disney has bid $20M for its IP. The comparables for your own financing and M&A are splitting on operating proof.
Ask Clarity
Deep Dives
- ●
The System of Record Now Sets Your Agent's Terms
Platforms are choosing to meter outside agents, refuse them, or be audited by them, and each choice lands on an AI budget case that is still graded on hours saved.
How platforms are treating outside agents Workday chose to admit and meter . CEO Aneel Bhusri calls the opening "giving customers choice" that "will be equally good for Workday," though he says he would still prefer customers use Workday's own…
3 action items
- ●
Six Frameworks, One Prompt: Agent Safety Has to Live Outside the Model
When an agent treats whatever its model writes as a command, every safeguard inside the model becomes optional, and most agent business cases have not priced the fix.
A shared assumption, not six separate bugs The echo technique works by getting an agent to repeat attacker-supplied tool calls and then run them. When unrelated frameworks fail to the same trick, the likely cause is a shared design assumption…
3 action items
- ●
The Freezer Hijack Shows Your Vendors' Remote Access Is Your Perimeter
Retailers that share no network may have shared a refrigeration vendor, so vendor concentration, not firewall strength, likely decided who lost stock.
How it worked, as far as is known The attackers did not need malware on store IT. SANS editor Sachs notes they used a legitimate defrost function . Fellow editor Ullrich says the controllers appear to have been reachable from…
3 action items
The edition continues
Take the signal into the room.
Sign up or log in to read all 3 deep dives in full, plus the final take.
Read the full editionContinue with LinkedIn