AI agents (programs that can carry out multi-step tasks on their own) are building their own supply chain, and each link raises the question of who holds the authority. Anthropic is spending $100 million to certify the engineers who will set up its Claude AI inside the largest companies. Apple is rewriting the rules for how software can reach the files on a Mac because AI agents raise the stakes of one setting. Supabase raised $150 million on the idea that AI agents now create databases by the million. And fraudsters used a cloned voice and a fake executive message to move €95 million out of an Italian bank. Whoever controls the credential, the permission, the storage, or the approval carries the risk and earns the margin.
Anthropic launched Claude Frontier Academy on October 2, backed by a $100 million commitment, with a goal of training 10,000 Frontier Deployed Engineers by the end of 2027.
The first groups include engineers from Accenture, Bain, Capgemini, Commonwealth Bank of Australia, Deloitte, McKinsey, Morgan Stanley, Novo Nordisk, and other organizations. Anthropic says the people who can put AI to work inside real businesses have become the hardest talent to find. Anthropic The program is modeled on medical training. Companies nominate their strongest engineers, and each arrives with a named Claude project to lead. A multi-day in-person session walks through a practice deployment, from choosing the use case through the security review to the final handover, and ends with a graded exercise that earns a Claude Resident Engineer badge. Badge holders then spend 12 weeks leading a real project at their own employer, and those who pass a second assessment earn the Frontier Deployed Engineer badge, with the first recipients expected in early 2027. Groups are running in San Francisco, New York, and London. Steve Corfield, Anthropic's global head of business development and partnerships, said "a small team of high-agency people with the right skills, access to Claude, and a deep understanding of how their business runs can transform an entire company." Anthropic
The biggest limit on the value companies get from AI has moved from how smart the models are to who can connect a model to a real business process and defend it through a security review. By certifying those people, Anthropic gets its way of working into the biggest consulting firms and a stream of customers who think in its tools. The upside for you is real: a 12-week project tied to a named goal is a practical way to build skills. The cost is that your best engineers come back fluent in one vendor's methods, which makes switching later more expensive. When you nominate someone, require that the plans, tests, and designs they produce are written so they can also run on a second AI model.
Anthropic is moving closer to the customer by training the staff of the consulting firms that used to stay neutral between AI vendors. The responsibility that must stay with the customer is the security review and handover step, and if those rules end up buried in instructions written by vendor-trained engineers, the customer takes on hidden rule debt that is hard to audit. The defense is to keep your governance record in your own tracked systems and to avoid depending on a single AI vendor for any critical workflow.
Apple announced new controls around a macOS setting called Full Disk Access, which lets an app reach files, mail, messages, and browsing history.
Apple said the setting was designed so backups could work properly, but that AI agents have increased "the risks associated with this level of access." It said some developers are using it "in ways that could put users at risk, exposing everything on their systems…without users' full knowledge and understanding," and that people who "genuinely wish to grant an app this extraordinary level of access" will be able to do so only through "very explicit user action." TechCrunch The announcement followed a claim by Inc. columnist Jason Aten that Meta's Muse app on Mac knew the contents of his private messages without his permission, which Meta disputed. In Muse, users can choose to turn on Full Disk Access. Apple wrote, "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially." Apple did not respond to TechCrunch's request for comment on the change. TechCrunch
The company that makes the operating system is acting as the enforcer for AI agent behavior, and it is doing so before any government requires it. Every AI assistant on an employee's Mac may have been given blanket access to files through a single switch, and the companies writing those assistants have strong reasons to ask for the maximum. Treat each approved Full Disk Access grant as a decision to expose company data, and expect Apple's change to break some AI products that relied on easy access. Use the time to list which AI tools on company Macs hold this permission and what business data is within their reach.
Supabase, which sells a commercial version of the free PostgreSQL database, raised $150 million in a round led by Singapore's GIC, with Alphabet's CapitalG, IronArc, and SquarePeg also taking part, and agreed to buy Turso, a database built for AI agents.
The price was not disclosed and the report does not say the deal has closed. Supabase said it will use the money to give employees a chance to sell shares and to build features for AI agents, and it introduced Supabase Compute, a hosted workspace where long-running AI agents can operate in isolation. SiliconANGLE Turso is built on SQLite, a database small enough that an agent can start one almost instantly to store what it collects or creates. Supabase co-founder and CEO Paul Copplestone wrote that "agents are spinning up millions of databases to power the prototypes, explorations, dashboards, and apps they're building," and that "this new pattern, at this massive scale, requires an evolution in database infrastructure." SiliconANGLE
AI agents create places to store data faster than any approval process can keep track of them. If an agent can start a database for a task, then customer data, interim results, and passwords can end up in places your records have never listed. The technology vendors are building for that scale, and this funding shows investors expect it to be normal. Ask your technology team how many data stores were created by automated tools in the last 90 days compared with how many appear in your official inventory. The gap is your unmanaged data, and it will grow as hosted agent workspaces become a standard product.
Fraudsters using AI to impersonate senior executives stole €95 million ($108 million) from Fideuram, the private banking arm of Intesa Sanpaolo, according to two sources cited by Reuters.
The scheme began in February when Fideuram's then-chairman received what looked like a WhatsApp message from Intesa CEO Carlo Messina asking for urgent help with an overseas transaction. A follow-up call seemed to come from a senior partner at a prominent law firm, and the sources said the callers used AI to copy the lawyer's voice. The chairman then told the finance department to arrange a series of transfers, mainly to accounts in China and Hong Kong. Reuters Fideuram spotted the irregularities quickly and alerted banks and authorities in several countries. The sources said more than half the money was recovered, about €53 million through cooperation among authorities in China, Portugal, and Italy, while about €36 million remained missing after being converted into cryptocurrencies. They said neither the former chairman nor any other Fideuram executive is under investigation, and Milan prosecutors have placed a foreign national living outside Europe under investigation on suspicion of computer fraud. Intesa and Fideuram declined to comment, and Reuters attributed its account to the sources. Reuters
The attackers used two channels that vouched for each other. A message from the chief executive and a call from a trusted outside lawyer each made the other seem real, and one senior approver could then start a series of international payments. A voice or a video can no longer prove who is asking for a payment. Require a call back to a pre-registered number for any request that arrives through a messaging app, a second approver above a set amount regardless of the requester's rank, and a standing rule that urgent overseas transfers requested outside normal systems are paused until verified.
Palmer's "Reddit Tightens Access to its Data" (October 1) covers Reddit's decision to shut off its RSS feeds (a way of following a site's updates) on November 13 and to close remaining older public data access in March 2027, with more than 14,000 apps and bots registered for the transition as of September 30 and a $1 million program offering $1,000 payments to eligible apps that move.
Shelly Palmer Reddit says RSS feeds have become a common route for large-scale automated abuse, while approved uses, including its agreements with Google and OpenAI, continue. Palmer compares the move with MTV, which began with free videos from record labels and by 1984 was paying them cash and advertising time for exclusive rights. The lesson for business leaders is that data owners are turning open access into paid access, and anyone who built a process on a free feed should plan for a price.
Today's four stories share one question: who holds the authority when software acts on its own.
Decide which authorities you will never hand to a single vendor, a single permission, or a single approver, and write them down. Anthropic's academy shows the race is moving to people and method, so build your own internal team for deploying AI and keep it able to work with any vendor. Your three-year plan should treat AI agent passwords, data stores, and payment approvals as managed assets with named owners.
Value is moving to the chokepoints.
AI model companies are taking the certification layer, operating system makers are taking the permission layer, database vendors are taking the storage layer for AI agents, and data owners such as Reddit are taking the access layer. Each owner will put a price on its position, and companies that depend on free or effortless access at any of them will see costs and limits rise. Expect consulting firms to split into those tied to one AI vendor and those that work with any.
If your marketing tools rely on public feeds, automated data pulls, or free connections to other services, check them against the Reddit timeline and assume more data owners will follow.
Trust is also a selling point. Customers who read about the Fideuram fraud will ask how you verify requests made in your name, so publish a clear statement of how your company will and will not contact them about moving money.
Set up a registry that lists every AI agent, the permissions it holds, and every data store it creates, and reconcile it monthly.
Pair it with a payment-verification procedure that assumes voice and message impersonation. These are everyday operating controls, and adding them before an incident costs far less than adding them after one.
The Fideuram case, with about €36 million still missing, shows why recovery is only partial even when detection is fast.
Put second-approver and call-back controls ahead of any new spending on fraud-detection tools. Budget for price increases as data owners and platform vendors end free access, and treat Anthropic-style training programs as skill investments that need a clause keeping the skills usable with other vendors.
List the Full Disk Access grants on company-managed Macs and revoke any that a business purpose does not justify.
Add databases and workspaces created by AI agents to your system discovery. Require that AI agent plans and tests run on at least two models, so no single vendor's training program defines your architecture.
Ask management for three lists: AI agents with broad access to files or systems, data stores created by automated tools, and payments approved on the strength of a call or message alone.
A board that can see those lists can govern AI risk. One that cannot is relying on assumptions.
The pattern across these four stories is that authority is being split apart and sold in pieces: certification by the AI vendor, permissions by the operating system maker, storage by the database platform, access by the data owner, and, illegitimately, executive identity by the fraudster. The assumption this breaks is that a company controls its own risk because it controls its own network. The choice this forces is which of those authorities you will hold yourself and which you will rent, and whether you will know the difference before the bill or the incident arrives.
If every authority your AI agents use were repriced or revoked next quarter, which processes would stop, and who would be the first to find out?
**Build the harness. Price the outcomes. Redesign the org.**