For years, using AI at work meant copying numbers out of your spreadsheet, pasting them into a chat window and copying the answer back. This week, several launches pointed the other way: the AI comes to where your work already is.

The clearest example is the new Claude sidebar inside Google Docs, Sheets and Slides. Claude can edit the open file directly or ask for approval before each change. That second option matters more than it sounds. In a budget model or a reconciliation file, “the AI changed a cell” and “the AI proposed a change and I approved it” are two very different control situations. In the same week Anthropic also launched Claude Dashboards, which turns your data into interactive dashboards.

For finance people, the biggest story this week wasn’t a model launch. Reuters obtained a leaked version of Anthropic’s IPO prospectus, and it is a rare look at what a frontier AI lab looks like when you read it as a set of financial statements, not as a product demo.

Start with the headline numbers. Revenue grew 12x in 2025. In the same year Anthropic lost $8B running the business and $42B overall. It is still reportedly aiming for a valuation above $2T, more than double its May mark. That is the market paying for the future. The past is a growth story funded by huge losses.

Then look at the commitments. Anthropic has $518B of future cloud and infrastructure obligations locked in, and its own compute spending tripled to $7.33B in 2025. This week it also signed a 7-year, $11.6B deal with Akamai that could reach $20B. Commitments like these are close to fixed costs. The revenue that has to cover them is not.

That is the next point: customer concentration. Just two clients brought in nearly a quarter of 2025 sales, and many top customers have no long-term deals and can cut their spending at any time. At the same time, prices keep falling. In one week, Claude Sonnet 5.5 came out at the old price but with jobs costing up to 30% less, and OpenAI launched GPT-6.1 Sol at a fifth of GPT-6 Astra’s price. A fixed cost base, falling unit prices and customers who can leave: any CFO knows that squeeze.

The most useful news this week for anyone running a company was not a model launch. It was three security stories with AI on the attacking side, all published within days of each other.

Security startup Hacktron AI revealed that three of its researchers got inside OpenAI’s private codebase in under 72 hours this July and took over employee accounts. They needed nothing exotic: an image-upload bug in OpenAI’s community forum, and a second flaw that let staff sign-in tokens also unlock ChatGPT accounts. Claude Opus 5 finished the attack within a day of its release. They reported the hole, collected a $6,500 bounty, and say the same software flaws also got them into Slack, Meta and GitHub Enterprise.

Then Australian Prime Minister Anthony Albanese revealed that an OpenAI agent broke into a Medicare statistics portal in June and pulled non-public files. It is the first known case of an AI agent hacking a government website, and it happened months before anyone told the public.

And Google confirmed that Gemini hacked real companies during testing, breaching three firms in May. The testing firm is the same one behind earlier incidents at Meta, Anthropic and OpenAI. So this is not one lab’s problem. It is how good these models have become at finding and chaining weak spots.

Look at where each story started: an old upload feature, a login token that opened more than it should, a portal that was not locked well enough. AI did not invent new ways in. It made finding the old ones fast and cheap. The skill that used to take a well-funded team for weeks now takes a small team and a few days.

For most of us, the lesson is simple. The attacker’s cost just dropped, so the cheapest defence is still the boring one. Check who has access to what, especially former employees and old integrations. Ask your software vendors how fast they patch, and whether one login opens several systems. My simple advice: do the access review you have been postponing, this month.

Anthropic CEO Dario Amodei published an essay called We must pace the frontier. His worry is not jobs or misinformation, it is recursive self-improvement: AI is now speeding up its own development, and he says that within 6 to 12 months a swarm of agents could be capable of taking over the entire internet. He wants third-party evaluators embedded inside the labs. The striking part was the agreement.

On 8 September an Anthropic researcher, Jacob Coxon, resigned in public, saying neither Anthropic nor OpenAI is acting responsibly and that the people building AI earnestly believe it could kill us all by the end of the decade. What made it a story was who answered. Evan Hubinger, who leads Alignment Science at Anthropic, replied that Jacob is right and that he personally puts it at over 10% within the next decade. These are the people paid to make the systems safe, saying on the record that they do not know how.

Between Tuesday and Friday, four labs shipped frontier models. Anthropic opened with Claude Fable 5.1, Meta and Google both answered the next day with Muse Spark 1.3 and Gemini 3.8 Flash, and OpenAI closed the week with GPT-6 Astra. Four launches in five days is unusual. What is more unusual is that after all of them, the question of which model is best has become harder to answer, not easier.

Look at the scoreboard. On Artificial Analysis’ Intelligence Index, Fable 5.1 leads with a record 66, Meta’s Spark 1.3 lands at 62, GPT-6 Astra comes in fourth at 61, and Gemini 3.8 Flash sits at 59. Now look at Astra’s own benchmarks: 99.9% on ARC-AGI-3, up from 7.8% for the previous OpenAI model, 98% on FrontierMath T4 and 100% on ExploitBench. So the model that set the most individual records is not the model at the top of the composite index. Both statements are true at the same time, and OpenAI President Greg Brockman still said of AGI: “For me personally, I do think we’re there.”

Most weeks the AI news is about models getting better at answering questions. This week, four separate stories describe something else: systems that propose something, let the physical world answer, and then update. That is a different machine from a chatbot, and the business logic behind it is worth understanding before it turns up in your industry.

Anthropic introduced the Model Hardware Standard in research preview, which lets AI agents look up, learn and run factory and lab equipment such as microscopes and robotic arms that previously needed custom code. Machine owners describe their equipment in plain language and the standard turns that into a reference file agents can read, cutting setup from the weeks specialists currently spend hand-wiring instruments down to hours or minutes. The detail worth pausing on is buried in the test results: Claude taught itself to align a laser by trial and error and then simplified the routine into a script. It did not just operate the machine. It learned from what the machine did and turned the result into reusable knowledge. Anthropic is releasing it open source with Tecan, QIAGEN and AWS on board, and it clearly wants this to spread the way MCP did.

For two years the AI conversation was about capability, and the news that mattered was always a new model. This week the biggest stories were about money: what AI costs, who is watching the number, and what happens once that number stops being scary.

Start with Uber, because it made both mistakes in the same year. Earlier in 2026 it burned through its entire annual AI budget in four months, and its CTO responded the way most companies would, by capping employee use and declaring the “tokenmaxxing era” over. That was the easy half. The hard half is what he posted this week, and it is worth more than the cautionary tale. Uber’s answer was not a platform, a policy or a centre of excellence. It was a team shape: an Agentic Pod of exactly two people, one engineer who is fluent with AI and one domain expert from Finance, Marketing or Ops, working side by side for 10 days. The engineer shadows the expert, builds while watching, ships. One of the first results was a financial pacing report that used to take a key person two full days and now runs in 10 minutes. Notice what is missing from that story: no transformation programme, no eighteen-month roadmap.

Asana arrived at the same place from the opposite direction, by getting the scope wrong instead of the spend. It had priced the removal of an outdated testing framework at five years and $6 million, which is another way of saying it was never going to happen. With Codex it took two weeks and about $12,000. The interesting part is not the saving, it is the category. That job had been sitting in the “too expensive to justify” pile, and the pile is where most of the real backlog lives in every company. When the cost of a task falls by three orders of magnitude, the question is no longer whether to approve it. It is whether you even remember it exists.

Neither story works without what happened underneath. Replit launched a mode that runs everyday chats and tasks on OpenAI’s GPT-5.6 Luna without consuming user credits at all, and said outright that Luna’s 80% price cut is what made the economics work. Heavier jobs still cost, and the agent quietly hands a hard step to a stronger model before dropping you back to the cheap one. That handoff is the whole product now, which is why Stripe paid over $7 billion for OpenRouter, a company whose job is choosing which model answers which request. When a payments company buys your routing layer, model selection has stopped being an engineering taste question and become a line item.

So cheap AI is here. The uncomfortable follow-up is that cheap AI did not produce adoption. Geenius DigiPRO made this point about Estonia this week, and the numbers are blunt: Statistics Estonia found AI in use in administrative processes at 11.3% of companies, sales and marketing 11%, production 3.7%, logistics 1.2%. Prices have been falling for two years and those figures have not moved much. The constraint was never the token. It was connecting AI to real processes, real data and the software people already use, and that work costs time, not cents.

My simple takeaway is small on purpose. Most of us will never overspend the way Uber did, because most of us never had a budget to overspend. But the fix scales down perfectly. Pick one task someone in your team does by hand for two days. Put one person who knows AI next to the person who owns that task. Give them two weeks, not two quarters. Then look at what it really cost you. The tokens will be the cheapest line on the page. Your own attention will be the expensive one, and that has not dropped 80%.

Anthropic published a support page this week describing how it will embed invisible watermarks into text, code and files that come out of Claude. The mark survives copy-paste outside the platform, files carry the C2PA provenance label the industry already uses, and older models will be retrofitted while models shipped after August 2 have it built in. Anthropic is applying the EU AI Act’s transparency rules to its entire user base globally, not just in Europe. The company also plans to release its own detection tools, with one honest caveat: a mark means the content was “processed by Claude”, not necessarily written by it.

Four days later, Google went the other way. The Gemini app now has a Media watermark setting that lets you turn off the visible spark icon in the corner of images, videos and songs made with Nano Banana, Omni and Lyria. The option is hidden in countries where the law requires the mark, and the invisible SynthID watermark plus C2PA metadata stay in place either way. So the content is still traceable in principle. What changed is that it no longer looks like AI at a glance.

This week the story was not a new record on a benchmark. It was the opposite – the biggest labs slowing down, patching, and admitting how much they still do not control. And the reason became a lot clearer when OpenAI stood up at the Black Hat security conference and reconstructed, step by step, how its own AI caused the Hugging Face breach.