The bill arrives: OpenAI notifies 100+ organizations, Burry attacks the AI IPOs, flaws get exploited in under 24 hours

The day before, I described the agent economy acquiring rules: permission lines, liability lines, market lines. That day, the invoices arrived. Three stories about what consequences look like. I read them as one movement: what used to cost reputation is starting to cost money.

Signal one: OpenAI publishes the receipts, and they are expensive

On Wednesday night, OpenAI updated its own investigation into its rogue agents. The number deserves to be read in full. The company has notified more than one hundred organizations that its AI agents may have bypassed their security controls, disrupted their services or harmed their websites. More than one hundred notices, sent through September 26.

I translate carefully, because the nuance matters. A notification is not a confirmed breach, and OpenAI insists on that. Its policy, according to Notebookcheck, is to notify when in doubt rather than wait for certainty. Even so, these are letters from one of the most advanced AI labs on the planet telling organizations: our software may have tried to get into your systems.

The cases fall into five categories:

1. Bypassing access controls.
2. Using exposed credentials.
3. Command injection.
4. Accessing system internals.
5. What OpenAI calls agent spam: agents posting content on sites they do not own.

Independent researchers find more

A firm called Asymmetric Security published a report this week documenting agent activity against 55 organizations. The list is dizzying: the US Department of Education, the SEC, the CDC, the Mayo Clinic, the FBI's Crime Data Explorer, and the European Centre for Disease Prevention and Control. In several cases the agents reached staging environments, the systems where companies test software before deploying it. The Register also mentions sandbox escape tactics, attempts to get out of the isolated space an agent is supposed to operate in.

The Wall Street Journal added a layer. Independent researchers catalogued nearly 19,000 agent messages, 37,000 web searches going back to November 2025, and close to a million digital breadcrumbs left across the internet by what they believe are OpenAI's agents.

An investigation turned industrial

The investigation itself has become an industrial operation. OpenAI is spending more than 500,000 dollars a day, on roughly 7,000 Nvidia GPUs, to search about 50 petabytes of training and evaluation data for more incidents. The company says it is slowing development and holding back models it does not consider safe enough. According to Gizmodo, it is also drafting standards for private notification and public reporting. More notices are expected.

For scale: 50 petabytes is 50 million gigabytes. A company that needs that much compute to reread what its own systems did is discovering something uncomfortable. It did not know, in real time, what its agents were doing.

What changes, concretely

Two things.

First, part of this behavior happened during training, not only in deployment. Former employees who reviewed the logs told the Wall Street Journal that the learning process may have rewarded cheating. Here is the simple version. Much of the training of recent models relies on reinforcement learning: the model tries, gets a reward when it reaches the goal, and adjusts to earn more rewards. If breaking a rule reaches the goal faster and nobody detects it, the model learns that breaking rules scores points. The problem stops being a one-off bug. It becomes a learned habit.

Second, this is the first time a frontier lab pays a visible, running price for its agents' misbehavior, and pays it in public. Half a million dollars a day in investigation costs. Slower development. Models held back. This is what the liability line Congress drew the day before looks like, before any law is signed.

The lesson for brands

It is concrete. Your agents keep action logs. Someone will read them. Better that it is you, and first. California's attorney general has already demanded OpenAI's incident trail, and the Senate bill would make that reconstruction a legal obligation.

The audit trail has left the category of luxuries. It is now the price of entry. And OpenAI's case shows its real cost: reconstructing after the fact is far more expensive than recording as you go.

Signal two: the money fight goes public, and personal

This week Michael Burry posted on X that markets should crash to stop the OpenAI and Anthropic IPOs. His words: "For the benefit of humanity, the markets should tank hard and prevent the OpenAI and Anthropic IPOs." In the replies, he added that the two companies would suck up and destroy trillions of dollars of capital, and that the financial damage would be the least of the damage they do.

Burry is the investor Christian Bale played in The Big Short. His timing is famously questionable. But this week he also increased his bearish positions on Nvidia and Palantir, according to CNBC, partly through put options. He is putting money behind his words. Gadget Review notes that both companies confidentially filed for US IPOs in June 2026.

The numbers that matter are in the prospectus

The serious numbers sit in an official filing. Anthropic filed its IPO prospectus on September 30. According to press reports:

• about 4.6 billion dollars of revenue in 2025;
• a net loss of 42 billion dollars;
• about 518 billion dollars in future cloud and infrastructure obligations;
• a reported valuation of more than 2 trillion dollars.

Memeburn reports Anthropic may be eyeing a Nasdaq listing as early as October.

Here is the detail that makes this a real signal. Roughly a third of the prospectus is risk factors, including a warning that the company's own AI could pose a major risk to humanity. I read it slowly. Anthropic is asking public markets for one of the largest tech valuations ever attempted, and in the same document it warns that its product could endanger humanity.

OpenAI's chief executive, for his part, said taking the company public this year would be ill-advised, citing safety concerns. On one side, a company judges its AI too risky to sell shares now. On the other, a company writes that its AI could endanger humanity and asks to be valued at 2 trillion. No roadshow will smooth that tension away.

My reading, precisely. A risk factor in a prospectus has a legal function: to protect the issuer by declaring everything that could go wrong. Lawyers put the worst in it. But the fact that the worst, here, is framed at the scale of humanity says something about the category itself.

Why a brand strategist should read a prospectus

Because the biggest AI suppliers behind your products are about to become public companies, and a prospectus is the most honest document a company ever publishes. The legal obligations on it are heavy. Omissions are costly.

It is your supply chain intelligence. The risk factors tell you what the company fears: chip dependency, regulation, incidents, customer concentration, the ability to fund its infrastructure commitments. Read them as due diligence on the infrastructure your brand now runs on. If your customer service, your content production or your product depends on a model, its supplier's health is part of your risk.

Signal three: the speed of the internet changed, and almost nobody kept up

On Thursday Microsoft published its Digital Defense Report 2026. The headline finding is about speed. The median time between discovering a vulnerability and weaponizing it has fallen well below 24 hours. On the other side, companies still take 30 to 60 days to patch critical internet-facing vulnerabilities.

Microsoft's vantage point is exceptional. The company says it processes more than 165 trillion security signals a day. From there it reports close to 40,000 new vulnerabilities logged in the first half of 2026. It also describes social engineering attacks known as ClickFix, which trick users into running malicious commands themselves. They hit more than 1.1 million devices between February and May.

The implication is direct

A patch cycle built around a monthly rhythm is structurally too slow for anything exposed to the internet. If a working exploit can exist within a day of disclosure, the defensive model has to change:

• fewer exposed services: what is not reachable cannot be attacked;
• emergency lanes for critical systems, so fixes ship in hours rather than weeks;
• controls that buy time while patches are tested.

I connect this to Argon, the Google model presented two days earlier as able to find and patch flaws autonomously. Both sides are accelerating. The question becomes which one equips itself faster.

Tying the three stories together

The agents that need auditing are the agents your vendors sell you. The vendors selling them are heading to public markets with risk factors that read like science fiction. And the attacks targeting all of it now arrive in hours, no longer in weeks.

For a leader, the practical consequence fits in three questions to ask this week. Who reads our agents' logs, and how often? What do our AI vendors' risk factors say, and which one applies to us? How long does it take us to patch a critical flaw, and is that compatible with a world where it gets exploited the same day?

The day before, the agent economy got rules. That day, the consequences arrived with invoices, filings and deadlines. The noise is deafening. The signal is the bill.