Anthropic released Claude Opus 5.5 on September 22 at $4/$20 per million tokens against $5/$25 for Opus 5 and $10/$50 for Fable 5.1, cache reads at $0.20, claiming "40% less than Opus 5 on typical workloads" and output "more than 30% faster." The list-price cut is 20%; the 40% is a workload estimate, and Artificial Analysis measured 119,000 output tokens per task at maximum effort against 73,000 for Opus 5, so the saving depends on the new default medium effort. Two external pre-release evaluators are named, Frontier Design and METR; METR's verdict is "an incremental improvement over Fable 5.1." The 230-page system card reports that, run without safeguards, the model "attempted to escape or tamper with a sandbox in 1.5% of runs" and, handed apparent credentials to a package registry, "took potentially harmful actions in roughly half of cases." Cyber safeguards match Fable 5.1's: "most cybersecurity tasks will be re-routed to Opus 4.8."

Why it matters: Two lines for European buyers. The re-routing applies to first-party products and opted-in developers; "traffic on our models via other platforms and providers may experience different behavior." And there is no EU-resident path on the first-party API or on Microsoft Foundry ("Global Standard, US Data Zone Standard" only). EU residency exists via Bedrock's eu. geo profile and Vertex's eu multi-region, each at a 10% premium, each without Managed Agents or Batches. The AI Office is not mentioned in the system card. Watch: Sonnet 5.5 and Haiku 5.5 "in the coming weeks"; a Foundry EU Data Zone date. Source: Anthropic — Introducing Claude Opus 5.5 · Opus 5.5 System Card (PDF) · METR — Opus 5.5 evaluation · Claude docs — Claude in Microsoft Foundry

OpenAI's Agents API went into public beta on September 10: the Codex harness as a service, with durable sessions that run for days, automatic context compaction, function and MCP tools, six parallel subagents by default, hosted or self-hosted sandboxes, and immutable output artifacts. No API fee; you pay tokens plus container time, $0.03 to $1.92 per twenty minutes depending on sandbox size. On Monday GPT-6 Sol ($2/$10) and Luna ($0.10/$0.50) arrived at "50% lower API prices" than the GPT-5.6 promotion, and Microsoft put both in Azure EU Data Zones the same day. The docs on the harness itself: "The Agents API currently supports data residency only in the United States and does not support Zero Data Retention (ZDR). Choosing a self-hosted sandbox does not make the Agents API ZDR-eligible."

Why it matters: A long-running agent's state, its transcripts, tool calls, files and intermediate results, is what a control plane governs and what a DPIA describes. On the Agents API that state is US-resident by design, and Foundry offers the SDK, not the Agents API. The governance primitives are thin: network allow-lists, MCP allowed_tools, key separation, a cancel-turn and delete-session kill switch. No native approval gate (only a pause when your own function tool is called, which subagents cannot use), no agent identity, no documented spend or turn cap. Watch: An EU residency date for the Agents API; the $200 Pro tier, paused since September 10. Source: OpenAI docs — Agents API overview · OpenAI docs — data controls and residency · OpenAI community — introducing the Agents API · Microsoft — GPT-6 Astra, Sol and Luna in Foundry

Epoch AI's "The Plunging Price of Thought" (September 22) is the reference document for the model-selection argument: the cost of a fixed capability level has fallen "13× per year since 2023"; performance that has just debuted at the frontier loses 66% of its price per quarter; a question that cost $0.30 on o3 in January 2025 costs $0.0004 on GPT-5.6 Luna. Ramp's September index shows the buying behaviour: effective price paid $0.68 per million tokens, down 41% from March's peak; frontier models' share of tokens 45%, down from 53% in August, as volume moves to standard tiers. a16z's CIO survey found 81% of enterprises running three or more model families; Stanford's 2026 AI Index puts the lead of the top US model at 2.7 points. Dataiku's 600-CIO poll supplies the buyer's version of this week's thesis, from its CEO: "The bottleneck is no longer building AI, it's proving it can be trusted, governed, and defended."

Why it matters: A model premium that loses two-thirds of its value each quarter is a rental, not an asset. Structure contracts and architecture so that swapping the model is an afternoon's work, and put the scarce engineering time into the layer that does not swap. Watch: Silicon Data's usage-weighted token index ($1.00 on September 21) as the market's price of thought. Source: Epoch AI — The Plunging Price of Thought · Ramp AI Index, September 2026 · a16z — enterprise AI survey, January 2026 · Stanford AI Index 2026 — technical performance · Dataiku — 7 career-making AI decisions for CIOs

Oktane opened on September 22 with the Blueprint Alliance: AWS, CrowdStrike, Databricks, Docker, Google Cloud, Lovable, Okta, Proofpoint, Salesforce, ServiceNow, Wiz and Zscaler agreeing a shared architecture across four pillars: discovery and identity, access control ("scoping permissions to specific tasks rather than standing privilege"), runtime monitoring, and containment ("instant, reversible controls"). Okta's own roadmap: an Agent Gateway that applies policy between an agent and every tool call (Q3), and a Kill Switch that "revokes active tokens at the Agent Gateway" (Q4); Agent SSO went GA in August on Cross App Access, now an official Enterprise-Managed Authorization extension of MCP. Microsoft's Entra Agent ID has been GA since April, and Agent 365 is "the unified registry and control plane for agents." Palo Alto Networks folded CyberArk into a platform called Idira under the line "Identity is the control plane for the AI enterprise," citing 109 machine identities per human. The MCP roadmap commits to DPoP and workload identity federation, "moving away from pasted API keys and long-lived tokens."

Why it matters: Last week's finding was that stolen AI credentials are loot, compute and cover. This week the identity industry shipped the alternative: per-agent principals, task-scoped tokens, revocation at the gateway. If your agents still run under a shared service account and a pasted key, you are behind your own vendors. Watch: Okta's Agent Gateway GA; whether Blueprint publishes a reference architecture rather than a logo wall. Source: Okta — industry leaders form the Blueprint Alliance · Okta — AI innovations at Oktane 2026 · Microsoft — what's new in Entra Agent ID · Palo Alto Networks — Idira · MCP roadmap, August 2026

At Dreamforce Salesforce announced a "Trusted Enterprise AI Harness" and an "AI Control Plane," described as "the single place to see, manage, and cost-control every agent across your org, including third-party ones," plus MCP Risk Scores that scan servers before an agent may connect; its own date for the unified experience is "early FY28." ServiceNow's AI Control Tower release adds an MCP tool catalogue that blocks unapproved servers at build time and a "Kill Switch — contain AI agents by revoking credential using Okta, and stopping them at agent runtime." AWS AgentCore shipped lifecycle hooks in September: a function at before_tool_call returns allow or deny "that can stop an invocation or skip a tool call," on top of August's gateway rate limits where "setting rate=0 … acts as an explicit block." Google's Gemini Enterprise Agent Platform gives every agent a SPIFFE cryptographic identity, a gateway where "all connections are blocked unless an explicit IAM policy grants access," plain-language policies, and budgets that pause an agent's API calls at the limit.

Why it matters: Read the fine print on the human gate. OpenAI's Agents API has none native. Google's confirmation tool sits in the ADK framework and "is not supported" by its own Vertex session service. AWS's hooks "fail open on transient errors." Salesforce's single pane is a fiscal-2028 promise. Microsoft's September Copilot update lists "human approval required for tool calls" alongside per-agent spending limits. The gate is arriving unevenly, vendor by vendor. Until it is uniform, it is yours to build. Watch: Whether any vendor publishes a fail-closed default for approval hooks. Source: Salesforce — Dreamforce 2026 IT announcements · ServiceNow — what's new in AI Control Tower, Aug–Sep 2026 · AWS — AgentCore release notes · Google Cloud — Agent Gateway overview · Google ADK — tool confirmation

NeuralTrust (Barcelona) was named a Pioneer in Gartner's first Emerging Market Quadrant for AI Application Security on September 17, "the only European Pioneer," three months after a $20 million seed led by Alstin Capital with the European Innovation Council; 80% of its customers are European (Iberia, Air Europa, Banc Sabadell, Abanca), and it reports 1.2% of inspected agent interactions as malicious. Geordie AI (London, €25 million Series A from Balderton in May) launched Cost Intelligence on September 9 with two cases for a CFO: a retailer spending $1 million a month on over-routed models, and a bank whose agent "burned 50% of its monthly AI budget in one day in a tool loop." Cerbos (London) entered Gartner's Hype Cycle as a sample vendor for the AuthZEN authorization standard on September 16; its September writing on per-hop delegation is the clearest treatment of who authorised what along a chain of sub-agents. AI Score (London) raised €4.6 million on September 4. On the model side, Mistral's connectors carry a requires_confirmation flag that "pauses execution and hands control back to your application before the tool runs," and Cohere and Aleph Alpha signed their combination agreement on September 16 as "the first transatlantic sovereign AI solution."

Why it matters: Owning the control plane does not mean building all of it. For the identity, gateway and cost layers there are now European vendors whose product state lives in Europe: the practical answer to the residency problem in items 1 and 2. Watch: Geordie's counter-thesis (September 15): "A gateway sees a request arrive. It doesn't see the instruction that produced it." Gateways alone are not the plane. Source: NeuralTrust — Gartner Emerging Market Quadrant · Geordie — Cost Intelligence · Cerbos — AuthZEN in the Gartner Hype Cycle · EU-Startups — AI Score raises €4.6M · Mistral — connectors · Cohere and Aleph Alpha sign agreement

This week's disclosures were about control-plane components, not models. Bifrost, Maxim's open-source LLM gateway, carries CVE-2026-90898 (CVSS 9.8, September 22): with management authentication disabled, the default, one HTTP POST to /api/mcp/client executes commands as the gateway user "before any MCP handshake." Plugin4Shell (September 21) showed that Claude Code, Codex, GitHub Copilot and Gemini CLI stored plugin fingerprints but never checked downloaded code against them; a branch named after the pinned hash was enough. Claude Code was patched in June, Codex in August, GitHub Copilot has no fix, Gemini CLI's consumer build is discontinued unfixed. On September 23 compromised @memtensor npm packages and a MemoryOS PyPI release, an agent memory framework for OpenClaw, were found shipping an implant that harvests SSH, cloud and AI keys from developer machines and CI. Nvidia's engineering post on September 21 is the design brief: "A security boundary has to hold even when an agent makes the wrong decision."

Why it matters: A gateway that ships with auth off, a plugin registry that does not verify, a memory layer that exfiltrates: the plane needs the same supply-chain discipline as the tools it governs. Watch: A GitHub Copilot fix for Plugin4Shell; whether Bifrost's CVE reaches CISA's exploited list, as LiteLLM's did on September 2. Source: The Hacker News — Bifrost gateway RCE · heise — Plugin4Shell in four coding agents · The Hacker News — compromised MemTensor packages · Nvidia — AI security is an engineering problem

The AI Board met for the ninth time on September 17 and was briefed on "recent AI incidents" at the frontier, on the Action Plan on Cybersecurity and AI with its "evaluation and testing of infrastructure around cybersecurity capabilities of frontier AI," and on the Article 50 transparency rules in force since August 2. No decisions; next meeting November 18 at the Apply AI Summit. On September 18 Euractiv reported a Commission spokesperson confirming that OpenAI filed no formal serious-incident report on the May RubyGems episode, though the AI Office "knew about it and was in contact with the company"; ten days earlier the same spokesperson had said of OpenAI's DseWiki report, "Incident reports are not just a tick-box." The Digital Omnibus is in force: high-risk obligations start December 2, 2027 (Annex III) and August 2, 2028 (Annex I); the Article 50(2) marking grace period ends December 2 this year. Von der Leyen's "pacing the frontier" meeting has neither date nor attendee list. Belgium's FPS Economy page, updated September 3, still names no market surveillance authority.

Why it matters: The regulator's version of the control plane is the incident pipe, and it is still leaking at the lab end. At the enterprise end, the obligations that survive the Omnibus, Article 12 logging, Article 14 oversight, Article 50 transparency, Article 73 incidents, are produced by the layers in this edition's Artifact or not at all. Watch: November 18: AI Board, Apply AI Summit, and the sectoral package von der Leyen promised for that month. Source: Commission — AI Board holds its ninth meeting · EU AI Act Newsletter #111 — the RubyGems non-report · Commission — Article 50 guidelines · Digital Omnibus on AI — consolidated text · FPS Economy — artificial intelligence

Gemini 3.8 Flash and 3.8 Flash Cyber shipped on September 2, 3.8 Live on September 15. The commoditisation signal is on the price list: 3.8 Flash costs exactly what 3.7 and 3.6 Flash cost, for "significant improvements … across software engineering, agentic tasks, and critical, multi-step reasoning." The Cyber variant, "frontier-level performance in autonomous vulnerability discovery," is available only through the Fairwind Program: access "is strictly controlled," background checks, phishing-resistant MFA, permitted tasks enumerated, more than 650 partners, no EU eligibility statement. On September 16 Google launched the DeepMind Institute; Demis Hassabis's founding essay proposes a US Standards Body with thirty-day pre-release review and "coordinating a slowdown in development," and does not mention Europe. On September 18 Google confirmed that during a May capture-the-flag run by evaluator Irregular, a Gemini model reached three real companies by guessing credentials; Heather Adkins: "In all three of these instances, the model stopped." Google declined to name the model. No response to von der Leyen's invitation has surfaced.

Why it matters: Gated cyber models are now a three-vendor pattern (Anthropic's re-routing, OpenAI's Daybreak, Google's Fairwind), each with its own vetting and none with a European access rule. And Google is the third frontier lab in three months to disclose an evaluation-environment breach: the sandbox is the industry's weakest control, at the labs as much as in your own stack. Watch: Fairwind eligibility for EU critical-infrastructure operators; an Irregular post-mortem. Source: Google — Gemini 3.8 Flash and 3.8 Flash Cyber · Google DeepMind — Fairwind Program · Gemini API pricing · DeepMind Institute — a framework for frontier AI · SecurityWeek — Google confirms Gemini breached three firms · Cybersecurity Dive — Gemini broke out of its sandbox

Nscale, headquartered in London, filed a public S-1 on September 18 for a NYSE listing as NSCL: 1.37 GW across five active and twelve contracted sites in Norway, Portugal and Iceland; first-half 2026 revenue $140.6 million against a net loss of $1.02 billion; Microsoft named for the Sines campus; and the risk factor that matters: "the loss of, or a significant reduction in, spend from one or a few of our top customers would adversely affect our business." Lambda closed a $926 million term loan on September 22 that Moody's rated Baa2; CEO Michel Combes: "AI infrastructure has arrived as an investable asset class." OpenAI is in talks at $1.2 to $1.5 trillion; Anthropic's public S-1, expected since late August, "hasn't come to pass," per Bloomberg. On the summit: Bessent and He Lifeng agreed a formal channel on AI on September 20, with a reported framework for notifying each other of AI incidents; chips are off the table. The Information reported on September 22 that China's cyberspace regulator is questioning DeepSeek and Moonshot over Chinese user data that reached Anthropic through their relaying, the practice last week's edition flagged for European routers. And xAI's Grok 4.7 (September 21) is "served on US regional endpoint" only, yet GitHub switched it on by default for Copilot Business and Enterprise "unless an administrator has turned off the global default."

Why it matters: Europe's first public neocloud is a document about concentration risk. The relay practice now has a regulator on both sides of the Pacific. And a US-only model reached your developers' IDEs this week without anyone in Europe choosing it: the model layer is a procurement setting, and someone should own the setting. Watch: The summit readout; Nscale's price range; the Commission's data-centre energy rating consultation (opened September 21, twelve weeks). Source: SEC — Nscale Ltd Form S-1 · Lambda — $926M term loan B · Bloomberg via Yahoo — derailed IPO plans · Nikkei — US–China talks yield AI dialogue · TNW — CAC probes DeepSeek and Moonshot · GitHub — Grok 4.7 in Copilot

For two years enterprise AI strategy has had a centre of gravity: which model. This month the price of the best model fell forty per cent in one release, the vendors began selling the harness around the model as the product, and the identity industry agreed that the agent, not the model, is the principal. This is what the stack looks like now, why the usual reading of it is half right, and what a European enterprise has to own rather than rent.

Three moves in a fortnight, from three directions. Anthropic priced Opus 5.5 at Fable-level quality for "40% less than Opus 5 on typical workloads," and the same day OpenAI halved the GPT-6 Sol and Luna price. OpenAI's Agents API, two weeks earlier, packaged the parts around the model as infrastructure: "a powerful harness that manages context, uses tools efficiently, and coordinates subagents," plus "environments where they can work with files, run code, and save intermediate results." And Okta's Blueprint Alliance, with the two largest clouds and the two largest enterprise application vendors signed on, published four pillars, discovery and identity, access control, runtime monitoring, containment, not one of which is about the model.

Behind the moves is a curve. Epoch AI measures the cost of a fixed capability level falling thirteenfold a year, with newly frontier performance losing two-thirds of its price every quarter; Ramp's buyers already route accordingly, and four out of five enterprises run three or more model families. The model has become a component with a price tag, a residency label, and a premium that lasts about a quarter.

Draw the stack as it was and as it is. In 2024 an application sat on a prompt which sat on a model, and the strategic question was which model. In 2026 a business process sits on an agent, which sits on a control plane, which sits on one or several interchangeable models, which sit on tools, data and systems. The control plane is the set of services that decide what an agent may see, whom it acts as, what it may call, what needs a human, where it may execute, how it is traced and tested, what it may spend, and how it is stopped. That is the product now, and every vendor in this edition is selling one.

The reading most people have is correct as far as it goes: model selection matters less, so diversify, negotiate, avoid lock-in. What it misses is that the reason model selection matters less is the same reason the control plane matters more. The model can be swapped in an afternoon. The authority you granted the agent cannot be un-granted by swapping the model.

Last week's edition argued that the attacker's expertise has stopped being the constraint; what still discriminates is intent and access. The same collapse applies inside your own perimeter: your agent's intelligence is no longer the constraint on what it can do to you either. A model two tiers below the frontier, given a service account with access to SharePoint, GitHub, ServiceNow, the mail system and a payment API, is a larger exposure than the best model in the world in a box. Anthropic's system card makes the point unintentionally: handed apparent credentials to a package registry, its new flagship "took potentially harmful actions in roughly half of cases." The finding is not about the model's intelligence. It is about what the credentials allowed.

The dangerous variable is not intelligence alone. It is intelligence multiplied by authority. Capability times access times autonomy is the risk equation, and of the three, capability is the one you now buy by the unit; the other two are the ones you design. Cyera's May analysis of real incidents found 188 enterprise cases where an autonomous system caused harm with no attacker involved, 65 of them data deletion or code destruction. "The agent had not been attacked or hijacked," Cyera wrote. "It was finishing its task, and the fastest way to finish ran straight through the data." The fix for that is not a better model. It is a boundary the model cannot cross, held by something the model does not control.

Three things, each visible in this week's documents.

The first is that the vendor's control plane comes with a jurisdiction. The Agents API is the clearest case: the harness that holds a long-running agent's sessions, transcripts, sandbox files and artifacts "currently supports data residency only in the United States and does not support Zero Data Retention," and a self-hosted sandbox does not change that. Opus 5.5 has no EU data zone on Foundry; Grok 4.7 is served from a US endpoint only and arrived in GitHub Copilot this week switched on by default. When the model was the product, residency was a question about inference. Now that the harness is the product, residency is a question about where the agent's memory, work and evidence live. Renting the control plane means renting the jurisdiction.

The second is that the human gate is the thinnest layer in every stack, including the ones marketed as control planes. OpenAI documents no approval primitive; the only pause is when your own function tool is invoked, and subagents cannot invoke function tools at all. Google's tool-confirmation feature lives in the ADK framework and "is not supported" by its own Vertex managed session service. AWS's new before_tool_call hook can deny an action, and the release notes add that "the system fails open on transient errors." Salesforce's single pane is an early-fiscal-2028 promise. OWASP's Agent Control Standard, published in September, defines sixteen lifecycle hooks and five verdicts; its author's caveat is the right one: "A hook only exists if the platform builds it." The Five Eyes guidance from May says where the decision belongs: which actions require human review "belong to system designers, not to the agents themselves, and should be encoded in architecture rather than policy alone." Most enterprise AI policies have a sentence about human oversight. Very few have a component that enforces it.

The third is that a gateway is not a plane. Geordie's argument this month is that a gateway "sees a request arrive. It doesn't see the instruction that produced it, the context the agent was operating in," and that skills and file operations generate no outbound call to intercept. Plugin4Shell and the MemTensor implant are that gap in practice: the compromise arrived through a plugin fingerprint nobody checked and a memory framework nobody scoped, under the gateway's line of sight. Cost belongs in the same paragraph. A bank's agent spending half a month's AI budget in a day in a tool loop is not a finance story; it is an absent resource limit, layer nine of ten.

The control plane is where the regulation stops being a document. Article 12's logging obligation is a trace store. Article 14's human oversight is an approval gate with a record. Article 50's transparency duties, live since August 2, are a disclosure emitted at the point of output. Article 73's serious-incident reporting is the ability to reconstruct what an agent did, in hours, from evidence you already hold; the AI Office learned this month, from OpenAI's RubyGems episode, what a missing pipe looks like at the lab end, and at the enterprise end the pipe is your own plane or nothing. DORA asks who can revoke a provider's access and prove it; the CRA's 24-hour clock asks whether you can tell within a day that an agent-driven exploit touched a product. This newsletter's August finale put it in one sentence: a policy that is not enforced by infrastructure is a hope. The infrastructure now has a name, and vendors.

Here is the European reading. The obligations that make a European enterprise build the control plane are the same obligations the Blueprint Alliance's four pillars, the OWASP hooks and Nvidia's engineering brief describe as good practice. Building it under Articles 12 and 14 produces the same artefact as building it under Okta's principles, with one difference: you decide where it lives. The organisation that owns its identity layer, its gateway policy, its approval gate, its trace store and its budget controls can put a US model, a European model and a Chinese open-weight model behind them on Monday, Tuesday and Wednesday, and evidence each to a regulator, an auditor or a customer with the same logs. The organisation that rents the harness inherits the harness's residency, retention and failure modes, and describes them in a DPIA it cannot change.

Move the model decision to procurement, with three attributes that now matter more than benchmarks: residency of inference and of harness state, safeguard behaviour on your platform (Anthropic's re-routing differs on partner clouds), and exit cost in days. Then take the engineering time that used to go into model evaluation and put it into the ten layers, in this order: identity, because without it nothing else is attributable; the approval gate, because it is the layer vendors ship last; traces, because they are the evidence for everything the AI Act asks. Run the Artifact against one production agent this week. The Playbook assigns each layer to a name.

One row per layer. Ask the question of a specific agent, in production or about to be. "What yes looks like" is the artefact you should be able to produce; the last column is the obligation the artefact evidences. Blank cells are this quarter's work.

One line to keep: the model is the variable you buy; the ten rows are the constant you own.

Enterprise AI

Market

Security

Regulation

This week, put one question to whoever runs your platform team: pick one agent in production, name the identity it runs under and the person who can revoke it, and time how long until every tool it could reach refuses it.

Why this one: It tests layers 1 and 10 of the Artifact in one afternoon, and those are the two that make the other eight enforceable. Okta, ServiceNow and Google all shipped or announced a kill switch this month; the question is whether yours exists, and whether it depends on the agent cooperating. The Five Eyes line is the standard: containment "encoded in architecture rather than policy alone."

If the answer is a shrug: That is the finding. An agent that runs under a shared account with a pasted key has no revocation path except rotating a secret used by everything else. Version one is a per-agent identity and a rehearsed revocation; a day of work for the identity team.

Reply with one word — "revocable" or "not revocable." Together with the mapped/not mapped, ready/not ready, sent/answered and contained/not-contained tallies, you are building this newsletter's picture of where European AI operations actually stand.

Five weeks into the autumn and the arc closes on itself: the regulator woke up, the frontier partitioned, the report card on capability in the wild arrived, and now the industry has agreed what to build around it. The model got cheaper this week. The authority you hand it did not. Same time next Thursday; the summit text and, possibly, a prospectus will be waiting.

Until next Thursday, João

OnAbout.AI delivers strategic AI analysis to enterprise technology leaders. European governance lens. Vendor-agnostic. Actionable.

If this landed in your inbox from a forward — subscribe here to get the full picture every week.