The scarce resource in business AI is now the ability to check what AI produces. Google froze its open-source bug bounty (a program that pays outsiders to report security flaws) after AI-generated reports swamped the people who review them, while an Anthropic AI model found a flaw that attackers were exploiting within a day. Washington formed a 120-day task force as its Treasury secretary told the AI labs to own their risks. Google is testing a Gemini mode that acts without asking permission, as Apple moves to restrict exactly that, and Airbnb is preparing for a world where other companies' AI agents come to it. Each of these moves depends on who can confirm what an AI claims, does, or asks for, and how fast.
Google paused product security reports to its open-source bug bounty program, effective October 1, saying it had received a flood of invalid, AI-generated reports.
Reports made before October 1 and reports about supply chain issues are unaffected, Google said it may still accept some through its cloud program, and it committed to an update by the first quarter of 2027 without promising that reports will resume. Tom's Hardware reports that thousands of poorly written reports claimed bugs that were invalid or impossible to exploit, and that Linux maintainers said they were "completely overwhelmed" by security findings as AI-powered bug hunters pushed the Linux kernel to a record 2,000 vulnerabilities per release. Intel also suspended a bounty that paid up to $100,000 per flaw, though Intel has not confirmed AI-generated reports as the reason. Tom's Hardware The same week showed the other side. Horizon3 researcher Zach Hanley used Anthropic's restricted Mythos AI model to find a critical flaw, tracked as CVE-2026-61500, in a free, open-source file server called Rejetto HTTP File Server. The flaw lets an attacker log in as an administrator and run commands remotely. VulnCheck researcher Patrick Garrity said "our canaries detected an actor in China targeting real vulnerable hosts in the US," starting the night after disclosure, followed the next day by four hits from two U.S. internet addresses that appeared to be relays hiding the real source. It is the second Anthropic-linked flaw known to be exploited in the wild, among 286 flaws that Garrity's tracker attributes to Mythos and Anthropic's Project Glasswing. Users should update to version 3.2.1 or later. The Register
Producing a believable security report now costs almost nothing, while checking one takes the same skilled hours as before. That imbalance is breaking volunteer and bounty programs, and it will reach any channel where your company accepts outside submissions, from security tips to customer complaints to supplier claims. At the same time, real flaws found with AI are being used by attackers within hours, which shrinks the time you have to fix exposed software. Require a working demonstration for any outside report, staff the review function as a funded team, and set an internal goal of one business day to fix or isolate internet-facing open-source software that carries a critical warning.
Reuters, citing The Wall Street Journal, reported that the White House has created a task force to examine AI's risks and opportunities and recommend what role the federal government should play in overseeing the technology, with a report due within 120 days.
Jay Clayton, who heads the Office of the Director of National Intelligence, said he would lead it. The group is known as the "Super Intelligence Force," and a senior White House official described Clayton as effectively President Trump's AI czar. U.S. News Clayton told the Journal the task force will aim to prevent overregulation that stifles innovation. The Standard Treasury Secretary Scott Bessent said in an Axios interview that "this alarmism without solutions by some of the AI community, that's not leadership" and that "it is the people at the labs who have to accept responsibility." Asked about executives who are calling for regulation, he said, "Well, then they should slow down." He added that Chinese AI models can be "80%, 90% as powerful" as U.S. models without safety guardrails, and Axios reported the U.S. plans to propose a system to warn China about serious AI incidents, which had not been proposed, agreed to, or put in place as of the report. Mr. Trump said last week that he does not want an AI safety deal with China. The Next Web
The federal approach is to study first and put responsibility on the AI labs, which means the practical rules for the next several months will come from states, courts, contracts, and your own controls. If the 120-day clock started this weekend, the report lands around the end of January. Until then, the question a customer, auditor, or state attorney general will ask is what you did, not what Washington required. Write down your own AI risk standard now, tied to a named executive, so you can show it came before any federal rule and adjust it when the report arrives.
The new development is on the other side of the line Apple drew on Friday.
TestingCatalog, an AI news account, spotted a hidden setting called "Additional sandbox options" in the Gemini Desktop app that would let Gemini read, create, change, or delete files anywhere on a user's computer, including folders it was not connected to, and act through apps such as Mail, Safari, and Messages. A message in the interface reads, "Depending on which settings you enable, Gemini may be permitted to take actions without asking for your permission first." The feature is not live, Google has not confirmed it, and when it might launch is unknown. BleepingComputer The report says Gemini would still ask for confirmation before buying products or transferring money, creating an online account, accepting legal terms for the user, or changing sensitive personal information. BleepingComputer notes that Apple is considering making it harder for AI agents to reach personal files on Mac. BleepingComputer
This is a reported test, so treat it as a sign of direction and not a product. The direction is clear: the biggest AI vendors are competing on how much an AI may do on its own, while the maker of the operating system competes on how hard that is to grant. Your employees will sit in between. Define two or three permission levels for desktop AI tools now, such as read-only access in named folders, limited write access for a specific task, and full access reserved for approved roles, and enforce them through your device-management system before a vendor's default sets the policy for you.
Airbnb CEO Brian Chesky told TechCrunch that the company wants to become friendlier to AI agents, that agents could be good at generating leads, and that it is planning for agent-to-agent interactions both inside its platform and with agents from other apps.
Chesky said apps have rarely worked together without a business deal, while agents, which he called "apps with faces," could make them work together by talking to one another. He said Airbnb may eventually run agents in areas such as its Explore tab and customer service, followed by a "macro Airbnb agent" that would probably connect to others through MCP, a standard that lets AI agents link to other software. TechCrunch Chesky said an agent would need to hand off to the Airbnb app, or the agent's own application would need a more robust developer toolkit, for steps such as messaging a host, comparing listings, verifying identity, and staying inside the platform. He described the industry race as one to become the "quarterback," the main AI agent people go through for everything, and said there is no true operating system for AI yet because today's products are apps built on iOS, macOS, and Windows. Over the next three to six months, Airbnb is also exploring "multiplayer" AI that groups planning a trip together can share. TechCrunch
Chesky is describing a deliberate split: let outside agents bring in customers and keep identity checks, messaging, and the booking itself inside the platform that carries the liability. That is the right instinct for any business with regulated or trust-dependent steps. Map your own customer journey into steps an outside agent may perform, steps it may only start, and steps that must finish in your environment. Then publish agent-ready connections for the first group and a handoff for the third before a competitor defines the terms.
The point of contact with the customer is moving to whichever AI agent the customer talks to, which is the risk of being squeezed out that Chesky names when he describes the race to be the quarterback. The part that carries responsibility sits at identity checks, host messaging, and the transaction, and Airbnb is positioning itself to defend that part while giving up the front door. That is a two-track position, and it lasts only if Airbnb avoids relying on any single outside agent for its customers.
Palmer's "Kargo Announces Karlo Ad Buying Platform" (October 2) covers the general availability of Karlo, a self-serve, AI-driven ad-buying platform from Kargo aimed at smaller advertising teams.
At launch it supports video ads on connected TV and the open web, with social planned for later in 2026 and display and other formats in future releases. Advertisers can start from existing briefing documents or plain-language prompts, Karlo handles setup, spending pace, and optimization, and advertisers keep final control. Shelly Palmer Palmer writes that "these goal-seeking agentic tools are likely to evolve quickly" and that smaller agencies "just got a new tool to test." Keeping the advertiser's final say inside an automated system is the same pattern showing up in Gemini's confirmation prompts and Airbnb's handoffs: give AI limited authority and keep a person at the last step.
The limit on your AI program is how quickly you can verify what AI agents and AI-generated inputs tell you.
Direct each business unit to name the three places where AI output enters a decision unchecked, and fund the checking capacity before funding more AI output. Washington is not going to set your standard this quarter, so set it yourself and attach an executive's name to it.
Trust is becoming the scarce asset.
Bounty programs, open-source maintainers, and review desks are being overwhelmed by cheap generated volume, and attackers are moving from disclosure to attack in hours. Expect new kinds of businesses built around validated reports, proof that a flaw is real, and tools that control which AI agent can do what, and expect the vendors who can certify a claim to earn more than those who can only produce one.
AI-driven discovery and buying are arriving on both the consumer and advertiser side, as Airbnb's plans and Kargo's Karlo show.
Decide which customer steps you want outside AI agents to complete for you and which must happen in your own channel, where you keep the relationship and the data. Test one AI buying or discovery tool on a limited budget with a final-approval step, and write down what it learns that your team did not know.
Treat the intake of outside submissions as a staffed process with a service level, covering security reports, vendor claims, and customer disputes that AI can now generate in bulk.
Pair it with a patch runbook that targets one business day for critical warnings on exposed software. Name an owner for desktop AI permissions and review the policy monthly as vendors change their defaults.
Update Rejetto HFS to version 3.2.1 or later anywhere it runs, and scan for it, since attackers are already using the flaw.
Use your device-management system to set permission levels for desktop AI tools before Gemini or similar products turn on broader access by default. Publish a machine-readable connection for the customer steps you are willing to expose to outside AI agents, and keep identity checks and transactions inside your own environment.
Ask management to report how quickly critical flaws in exposed software get fixed, which permission levels desktop AI tools have been granted, and who owns the company's written AI risk standard.
With federal direction months away, the board's evidence of care will be the controls the company chose and documented on its own initiative.
The pattern is that producing AI output is now cheap and checking it is not. Bounty desks, open-source maintainers, security teams, and review boards are all finding that the volume of believable AI output can exceed their capacity to confirm it, while attackers move faster on the real findings. The assumption this breaks is that more AI output means more progress, because unchecked output shifts the cost to whoever has to verify it. The choice this forces is where you will invest in checking capacity and permission control before the next round of AI releases arrives.
If your company's AI tools produced 1,000 believable claims tomorrow, who would check them, and how long would it take?
**Build the harness. Price the outcomes. Redesign the org.**