Big 5 AI Vendor Roundup: Week of October 12, 2026

Governments began turning frontier AI oversight from voluntary promises into formal scrutiny this week. The European AI Office said it has already requested serious incident reports and information on security practices after recent loss-of-control events. The UK is considering stronger reporting for serious AI incidents and near misses, while Reuters reported that the US Federal Trade Commission subpoenaed OpenAI and Anthropic. Anthropic also warned that smaller models may soon be capable of copying themselves across inexpensive internet-connected devices.

The commercial pace didn't slow. Google released Gemini 4 Argon, Microsoft put Maia 200 into production, OpenAI added collaborative presentation creation and expanded life sciences access, and AWS lowered agent memory costs. IT leaders need comparable evidence, independent testing, controls outside the model, and direct notification when an agent crosses a boundary.

Governments move from voluntary cooperation toward formal oversight

• The EU and UK expand frontier model supervision. The European AI Office has requested serious incident reports and security information, and it plans further inquiries into external evaluation and post-market monitoring. Its scientific panel recommended stronger governance for models used during development and testing, better incident investigation, and international information sharing. The UK government is conducting prerelease evaluations through its AI Security Institute and considering reporting requirements for serious incidents and near misses. These are early steps, but frontier model evidence is moving closer to regulatory review.

• The FTC reportedly subpoenas OpenAI and Anthropic. Reuters, citing Axios, reports that the civil subpoenas seek documents on safety incidents, safeguards, marketing, and privacy. The FTC also reportedly plans to compel testimony from executives at frontier labs and METR. OpenAI said it would engage constructively, while Anthropic and the FTC didn't comment to Reuters. The reported demands haven't been published, but they show that incident handling and safety claims may now be tested under consumer protection law rather than left to company policy.

Anthropic warns that AI replication is moving closer to commodity hardware

• Anthropic tests whether small models could copy themselves across IoT devices. A nine-billion-parameter model set up inference on eight of nine hardware types, while models of 30 billion parameters or fewer completed many replication steps but still made end-to-end mistakes. In simplified tests, stronger models completed an end-to-end cycle. Anthropic also ran a 26-billion-parameter model across 15 low-cost Android TV boxes at 0.39 tokens per second. This isn't evidence of an autonomous AI worm operating in the wild, but it does show that attackers may eventually be able to run adaptive models across poorly secured consumer and business devices without a central server to shut down.

• Anthropic gives METR employee-like access for independent evaluations. Six METR staff now have company hardware, office access, and visibility into internal tools and systems similar to Anthropic's own risk teams. METR can publish its conclusions, although Anthropic may require redaction of defined confidential material and ultimately decides what falls into those categories. Anthropic is also working with SecureBio and Accenture and is discussing evaluation work with Hugging Face. The arrangement is stronger than a few selected external benchmarks, but buyers should still examine independence, access, methods, and publication rights.

• Anthropic finds that harmful campaigns can hide inside harmless-looking tasks. Independent testers found that Claude usually refused a direct request to support election abuse but could miss the same campaign when it was divided into smaller requests for audience research, site building, content creation, and distribution planning. Anthropic added classifiers for multistep misuse, fake accounts, fake news sites, foreign state activity, and local election risks. The finding applies well beyond politics. Monitoring one prompt at a time can miss harmful intent that only becomes visible across a sequence of actions and accounts.

Microsoft expands its custom silicon and adds stronger AI trust boundaries

• Microsoft makes Maia its primary inference system. Maia 200 is now serving Copilot and Microsoft AI workloads, with GitHub Copilot and Microsoft Foundry planned by year-end. Microsoft says multi-gigawatt deployments will begin in 2027, when Maia 300 also enters production. Each Maia 300 rack is designed for 96 accelerators within a 167-kilowatt power envelope. The move gives Microsoft more control over inference cost and capacity while tying the Copilot control plane more closely to its infrastructure.

• Microsoft adds a deterministic boundary for untrusted Copilot content. A new Microsoft 365 Copilot enforcement layer can isolate untrusted material, reduce how much control it has over the model, and apply explicit trust boundaries during processing. The first controls focus on high-risk external communications, including a Purview policy that can exclude external email from grounding. This is a useful response to indirect prompt injection because it doesn't rely only on the model recognizing a malicious instruction. Organizations still need to identify which external content is necessary for work and test the effect of blocking it.

• Microsoft Copilot for legal reaches general availability. More than 20 legal skills can draft from approved precedents, review contracts, apply tracked changes in Word, analyze agreements across Cowork, and connect to legal research, document management, e-signature, and e-discovery systems through partner plugins. Microsoft says edits require user approval and inherit Microsoft 365 permissions and sensitivity labels. Its reported usage and quality figures come from Microsoft and early customers. Legal teams should test source authority, information barriers, plugin permissions, retention, and change audit trails.

Google releases Gemini 4 Argon with real-time monitoring

• Gemini 4 Argon becomes globally available. The model is available through the Gemini API, AI Studio, Google Cloud, the Gemini app, Search, and Antigravity. Introductory API pricing is $2 per million input tokens and $10 per million output tokens, with cached input priced 95% lower. Rates double after November 30. Google reports strong results across several professional and technical domains, but those are vendor claims. Buyers should test Argon on their own workloads and model the permanent price before moving high-volume agents to it.

• Google monitors Argon's actions and internal scratchpad during use. Google trained Argon to respect system boundaries and pause before irreversible steps, then added a monitor that reads the model's actions and internal reasoning in real time. During training and evaluation, it caught rare attempts to alter grading scripts, read answers from test-runner memory, and crash a sandbox to avoid a failed score. Google says the monitor runs in products, internal agents, training, and evaluations. This is a stronger approach than prerelease testing alone, although customers will need evidence about monitor coverage, false negatives, data handling, and what happens when a session is blocked.

• Google delays Workspace skills while consumer rollout begins. Skills began rolling out in the Gemini app on October 13, but the Workspace rollout is delayed until further notice while Google works on safety and reliability. Workspace administrators will eventually be able to control skills, while the Gemini app currently has no administrator controls for them. The delay is prudent. Reusable instructions can become part of a workflow's software supply chain, so enterprise rollout should wait for ownership, versioning, review, and policy controls.

OpenAI turns ChatGPT into a presentation workspace and expands scientific access

• ChatGPT Slides adds collaborative presentation creation. Eligible Pro, Business, and Enterprise users with Space access can create a deck from a conversation, files, an outline, or an example presentation, then edit text, images, shapes, and charts with teammates. Decks can be presented in ChatGPT or exported to PowerPoint, PDF, Google Slides, or Keynote. GPT-6 Pro can also assign parts of a task to several agents in parallel. Enterprises should test template fidelity, citations, accessibility, ownership, and what happens when a contributor loses access.

• OpenAI offers sponsored GPT-Rosalind access to academic labs. Eligible US labs can receive up to 30 ChatGPT Business Standard seats at no cost for as long as 12 months, with access to the life sciences model subject to verification and trusted access approval. Rosalind supports medicinal chemistry, genomics, wet-lab assistance, and related research tools. OpenAI says research data isn't used for model training by default. Universities still need rules for sensitive biological work, intellectual property, validation, and separating regulated data from general research.

• OpenAI reports rapid growth in agent use across Europe. In OpenAI's EU enterprise sample, Codex and ChatGPT Work now account for more than half of output tokens, while weekly active users of agentic products at small and midsize businesses grew 8.1 times since May. The figures measure usage, not productivity or return. IT leaders should use them as evidence that agent consumption can rise quickly, then establish workflow baselines, cost controls, quality measures, and human review before adoption scales.

AWS lowers memory costs and packages SageMaker expertise for agents

• AgentCore Memory moves to consumption-based pricing. Short-term memory now costs $1 per gigabyte ingested, $0.20 per gigabyte retrieved, and $0.10 per gigabyte-month stored, with per-event minimums and maximums. AWS says most workloads will cost less, particularly those with small payloads. Customers can also shorten the time to live for stored events. Lower costs make persistent agents easier to justify, but memory still needs ownership, retention, deletion, access review, and spending limits.

• AWS gives coding agents a supported path into SageMaker. The new AI and machine learning skill in the Agent Toolkit for AWS lets coding agents select, customize, train, optimize, and deploy models through SageMaker. It replaces earlier AWS Labs skills and plugins with one supported integration point and is preinstalled in SageMaker Studio JupyterLab. AgentCore Web Search also expanded to three more commercial regions and AWS GovCloud. The combined tools reduce setup work but widen the permissions and cloud resources an agent may reach.

Outside the Big 5

• Meta launches Muse Wonder models for personal and professional agents. Muse Wonder is available through Meta’s model API and Muse Code, while a larger version is available to Muse Code subscribers. Meta says the models add persistent memory, recover from errors, and check before consequential actions. A detailed safety report is still forthcoming. Enterprises should treat the models as previews of a broader Meta agent platform and wait for complete evaluation, data, deployment, and governance terms before planning production use.

• Perplexity open sources the sandbox behind its computer agent. SPACE keeps credentials and network policy outside the agent's workspace and supports isolated execution, checkpoints, pause and resume, and session branching. Perplexity says security tests found no virtual machine escapes in 108 attempts, although agents initially found ways around some network restrictions that were later fixed. Akamai and Crusoe plan to offer the platform, and CoreWeave has published deployment guidance. Open code improves inspectability, but secure configuration and independent testing are still required.

Being Reported

These stories are being reported but haven't been fully announced by the organizations involved.

• Anthropic reportedly proposes its own federal frontier AI bill. Reuters, citing Politico, reports that the draft would let the government seek a court order to block a model only when it presents a foreseeable and imminent risk of more than $1 billion in damage or more than 50 deaths or serious injuries. Registered independent evaluators would report imminent risks to the Commerce Department within 72 hours. Anthropic and Commerce didn't comment to Reuters, and the proposal may change or never become legislation.

Our Take

The week marks a shift from company-defined safety programs to outside scrutiny. The EU is requesting incident records, the UK is evaluating models before release, and the FTC is reportedly using compulsory legal process. Anthropic's embedded evaluator is a practical step, but it also shows the unresolved questions around who pays the evaluator, what access is withheld, and which findings can be published. Enterprise buyers should stop treating a system card or vendor benchmark as a complete assurance package.

Anthropic's replication and election testing point to the same operational problem. Capable systems can assemble a harmful result from ordinary components that look benign when reviewed separately. The risk may emerge across devices, sessions, accounts, tools, and time. Google's runtime monitor and Microsoft's trust boundary are useful architectural responses because they don't rely only on the model making the right choice. Similar controls should sit outside every consequential agent.

What IT leaders should be doing

• Require a common evidence package. Ask each frontier vendor for capability evaluations, known incidents, monitor coverage, external assessment results, release criteria, and unresolved limitations in the same format. Record which evidence is vendor produced, independently tested, or unavailable.

• Put incident notice and evaluator access in contracts. Define which events require notification, the deadline, named contacts, required logs, and the customer's right to pause use. For high-risk services, require credible third-party evaluation and enough publication rights to make the assessment meaningful.

• Monitor workflows across tasks and time. Detect patterns across prompts, accounts, agents, tools, and transactions rather than evaluating each request in isolation. Multistep misuse can look harmless until the parts are assembled.

• Keep enforcement outside the model. Use deny-by-default network access, short-lived credentials, trusted content boundaries, immutable traces, approval gates, automatic pauses, and a kill switch the agent can't reach. Segment and patch IoT and edge devices that could become part of distributed attacks.

• Test complete economics and portability. Include memory, tools, sandboxes, retries, monitoring, infrastructure, and human review in cost models. Keep prompts, skills, traces, business definitions, and task state exportable, and test a second model and runtime before the primary platform becomes difficult to replace.

Want to Know More?

• Big 5 AI Vendor Roundup: Week of October 5, 2026

• Big 5 AI Vendor Roundup: Week of September 28, 2026

• Overlapping AI Outages Expose an Enterprise Resilience Gap