AI2Day Weekly — week of Sep 7

Welcome to AI Today Weekly, your Monday briefing on the technology reshaping how we live and work. I'm Leo, joined as always by Elena, and we have a packed week to get through. The Pentagon has handed its own versions of ChatGPT and Grok to three million service members and staff. Salesforce just had its best stock day in years, thanks in part to a deal with Anthropic that Wall Street is calling a comeback story. And the security warnings around AI agents are getting louder and more specific. Let's get into it.

Start with the military. The U.S. Department of Defense has quietly made two of the world's most recognizable AI tools available to roughly three million civilian and military personnel through a secure portal called GenAI dot mil. The two additions are ChatGPT Mil and Grok for Government, custom versions of the consumer products built specifically for government use. Think of GenAI dot mil as a locked-down version of the chatbot experience most people already know, one where sensitive data does not flow through ordinary consumer servers. The portal launched last year with Google Gemini on board and has already logged more than one point seven million unique users. Grok for Government runs through SpaceX's Starshield satellite network, which is the secure military spin-off of Starlink. One notable absence: Anthropic's Claude, which is missing after the Trump administration flagged Anthropic as a supply-chain risk over a dispute about AI safety guardrails. The Pentagon has also struck separate deals with Amazon Web Services, Microsoft, Nvidia, and Reflection AI, so this is a broad expansion, not a single bet.

That absence of Claude is interesting on its own, but it also connects to a story we will get to in a moment about Anthropic turning up in some unexpected places. But first, let me hand the security conversation over to something that affects every organisation deploying AI right now, not just the Pentagon.

Here is a scenario that should make any IT leader uncomfortable. You hire a contractor and on day one you hand them a master key to the whole building, before you have written down which rooms they can enter, whose authority covers them, or what they were actually sent to do. That is essentially what most companies are doing when they deploy AI agents. An AI agent is software that can carry out multi-step tasks on its own, reading files, querying databases, sending requests, sometimes even spending money. The security typically comes second, or not at all. A real-world warning sign: in June 2025, the U.S. cybersecurity agency CISA added a flaw in LiteLLM, a widely used AI traffic management tool, to its list of actively exploited vulnerabilities. That single tool had seven separate security flaws disclosed in one month, and one of them required no password whatsoever to exploit. A study of two hundred and five security leaders found that organisations with overly broad AI access reported a seventy-six percent security incident rate, compared with seventeen percent at those that kept access tight. The practical takeaway: establish identity and attribution before you layer on enforcement controls, not the other way around.

And we will come back to that theme in our last story of the day, because the execution phase, what happens after an agent is already inside your systems, turns out to be its own separate problem. But first, a very different kind of regulation, and one that will have a direct effect on how OpenAI operates in Europe.

ChatGPT just hit a regulatory milestone in Europe, and it is not the kind OpenAI was looking for. The European Commission has officially classified ChatGPT as a Very Large Online Search Engine under the EU's Digital Services Act, commonly called the DSA. The DSA is essentially a rulebook for the biggest platforms operating in Europe, setting firm requirements on user safety, data handling, and content. The threshold for being caught by it is forty-five million average monthly users inside the EU, and ChatGPT has cleared that bar. The classification means OpenAI must comply by the end of December 2026. What changes? OpenAI will need to offer stronger protections for children, put safeguards around user mental health, and do more to stop illegal content spreading through the platform. Reddit and Roblox were simultaneously classified as Very Large Online Platforms under the same law and face the same deadline. Worth noting: the DSA also bans targeted advertising aimed at children and restricts ads based on religion, sexual orientation, ethnicity, or political beliefs. So even if OpenAI never runs ads today, the classification shapes what it can do tomorrow.

Never played a hand of poker in your life? Our sponsor Zero2Hero starts you from zero. A free academy teaches the game from what the cards are, then you sit at AI tables where a coach grades every hand and answers your questions at the table. 50 free hands a day, in any browser, on any computer. That is Zero2Hero dot A I. Zero, the number two, hero, dot A I.

Regulation in Europe, and a very different kind of reckoning in the markets. Over to you for the Salesforce story, because this one genuinely surprised people.

For most of the past year Wall Street had been writing Salesforce's obituary. The fear was that AI companies, the Anthropics and OpenAIs of the world, would make traditional business software completely obsolete. The stock fell twenty-one percent in 2025 and kept sliding into 2026. Then Thursday happened. Salesforce shares jumped almost twenty-three percent, their best single session since 2020 and second-biggest one-day gain since the company went public in 2004. What moved the needle? Two things landed on the same day. Quarterly revenue grew eleven percent year on year, slightly ahead of analyst forecasts. And Salesforce unveiled a joint product with Anthropic called Claudeforce, which brings Anthropic's Claude AI directly into Salesforce's sales and customer tools and into Slack. Annualised revenue from Salesforce's AI product line, called Agentforce, has hit one point five billion dollars, a two hundred and forty percent increase year on year. The company also booked a two point six billion dollar gain from its three-year investment in Anthropic. The rally nearly wiped out the year's losses, though shares remain about five percent below where they started 2026. And there is one more wrinkle: reports suggest twenty-two former Salesforce employees currently working at OpenAI are in talks to return. The doomsayers may need to revise their verdict.

Remarkable turnaround. And that Anthropic partnership is a thread running through several of this week's stories. From the markets to something more philosophical now, and a conference in Copenhagen that asked some hard questions about who is really in charge of the AI era.

TechBBQ, the annual Nordic tech conference held in Copenhagen, wrapped up on the twenty-seventh of August with one theme dominating every panel and every side conversation: AI sovereignty. The question was not what AI can do. It was who controls it, and what happens when the answer is someone outside Europe. The sharpest reminder came earlier this year when Anthropic's AI models Mythos and Fable were cut off for users outside Europe, disrupting software teams across the continent. One startup executive described it as waking up to find a key supplier had simply disappeared. Signal president Meredith Whittaker warned that AI assistants built into phones and operating systems are, in her words, a data collection apparatus. Emad Mostaque, co-founder of Stability AI, put it bluntly: the person who controls the AI ultimately controls the country. Investors and founders at the conference framed the core tension not as a technical question but as a values question. How much of your economy, your infrastructure, your decision-making, are you willing to hand to tools built and governed elsewhere? For European founders, that question is no longer abstract. It is a business continuity problem.

That sovereignty anxiety is very real, and it is playing out in real contract decisions too. The next story is a case study in what happens when the politics of AI ownership get very, very personal.

OpenAI announced late on Friday that it will cut off access to its AI models for Cursor, a popular AI-powered coding assistant, on 12 November 2026. The reason: SpaceX completed a sixty billion dollar acquisition of Cursor on the fourteenth of August 2026, and OpenAI says it cannot trust Elon Musk's companies to follow its terms of service. The company cited, quote, experience with Elon Musk's companies violating contracts, as its justification. That is about as blunt as corporate announcements get. For the people who actually use Cursor day to day, the immediate impact should be modest. Cursor's own chief executive, Michael Truell, said OpenAI models handle roughly five percent of the tool's user traffic. The much larger share runs on Anthropic's Claude, and Anthropic has confirmed it will keep supplying its models to Cursor regardless of who owns it. So Cursor keeps working for most users. But the decision deepens an already bitter feud between Elon Musk and OpenAI's chief executive Sam Altman, one that now has direct consequences for developers caught in the middle. Worth watching as November approaches.

The Musk-Altman saga has its own gravitational pull. Meanwhile, on a platform with a very different kind of content problem, Instagram is finally taking aim at fake AI personas.

Scroll Instagram long enough and you have probably followed an account that had photos, a bio, a personality, and absolutely no human being behind it. Instagram is now taking its first concrete step against those accounts. Two changes. First, a label rename. What the platform previously called an AI creator tag will now read AI-generated profile, which is clearer about what the account actually is: a persona built by a computer. Second, and more consequential, enforcement. Instagram says it will actively hunt down accounts that feature AI-generated people but do not carry the label. If it finds one, the account's posts will stop appearing in Reels and Explore, which are the sections Instagram uses to push content to users who do not already follow that account. Effectively, the penalty is invisibility to new audiences. Accounts flagged incorrectly can appeal. And the rules apply to fake AI personas, not to real people who simply use AI tools to help them create content. That is an important distinction. The platform is not going after AI-assisted creators. It is going after accounts pretending to be people who do not exist.

Good. And that distinction matters more than it might sound, because the line between AI-assisted and AI-generated is where a lot of the hard policy questions live right now. Let's close out with the security story that ties back to where we started this episode.

We talked earlier about the risks of deploying AI agents without proper identity controls in place. Now let's talk about what happens after the agent is already inside. This is a separate and in some ways more dangerous problem. An AI agent authenticates with valid credentials, receives real API keys, those are digital passes that let software talk to other software, and gains access to platforms like Microsoft 365, Salesforce, or GitHub. The security check at the door passes. Then the agent starts working, and that is where most enterprise security tools go blind. Researchers at MITRE, the organisation that catalogues cybersecurity threats, have identified four distinct threats that emerge during execution. Goal drift, where the agent starts pursuing unintended objectives. Excessive tool use, where it calls on capabilities it was never meant to use. Memory poisoning, where past interactions corrupt future behaviour. And context manipulation, where bad actors feed the agent misleading information mid-task. Traditional security checks verify identity at login and then stop watching. A newer approach called runtime trust continuously monitors what the agent is actually doing throughout the task, not just at the front door. The practical takeaway: getting the agent in the door safely is only the beginning. You need someone watching what it does once it is inside.

That is a theme worth sitting with as AI agents move deeper into the systems organisations depend on. A huge week of news, and there is more detail behind every one of these stories. Thank you for spending part of your Monday with us. For deeper reporting, links, and our daily briefing, head to the newsletter. That is the week in AI. Full stories and the daily briefing at A-I-2-Day dot live. That is A, I, the number two, D-A-Y, dot live. See you next Monday. If you got something out of this, a thumbs up and a subscribe genuinely helps.