Your AI supplier's security gaps, unfinished work and power deals are now your business risks, and this week showed each one.
The AI Transformation Brief
Buying AI now means inheriting your supplier's risks. Anthropic told business customers an outside firm reached their contact, plan and spending details without permission. CellCog A new test built from real requests found the best AI coding tool fully finished only 26.4% of tasks. The Decoder Anthropic also agreed to pay $3.4 billion for gas generators to secure its own power. TNW Security, quality and power now land on the buyer's desk.
On November 7, Anthropic began emailing organizations that use Claude to say an outside cybersecurity research company had reached limited customer information without permission. For everyone notified, that meant names and email addresses. For enterprise accounts, it also covered account numbers, plan level, and usage and spending figures. Conversations, passwords and payment details were not included. Anthropic says it cannot confirm whose information was viewed, and the firm certified in writing that it deleted the data. CellCog
The weak point was ordinary business software around the AI. In October, researchers reached Anthropic's sales, human resources and IT systems through outside programs in under 12 hours. The Decoder Your spending figures and staff contacts now sit with every AI supplier you use. Add AI suppliers to your vendor security reviews, require breach notices that name the systems involved, and warn staff to expect fake emails that mention your AI plan or bill. CellCog
Anthropic answers for securing its own business systems. Your company decides whether to warn its staff, and it carries the risk of fake billing emails that use the exposed details.
Researchers from Alibaba and several Asian universities built Co-Design Bench from real change requests that users had to rephrase or roll back. The best of 10 AI systems met about 70% of each task's requirements on average and fully finished only 26.4% of tasks. On older tests, the same systems score above 99%. Results fell further when a task mixed layout, design, interaction and content changes, which is normal in real projects. The Decoder
The gap between 70% done and finished is where your people spend their time. One AI system scored 75% or 56% on larger jobs depending on the software it ran inside, so test the AI and its setup together. The Decoder Count the hours your staff spend finishing AI work, and budget for review as a permanent cost. A strong score on a vendor's chart says little about your own backlog.
Anthropic agreed to pay $3.4 billion for 1.7 gigawatts of gas-fired generators, the Financial Times reported on November 8. The deal, signed in late September, took over orders that San Antonio supplier OnePWR had placed with Caterpillar about two years ago, plus the work to install them. It is the largest known purchase of power equipment by an AI company. Where the generators will run is unknown, and both companies declined to comment. TNW
AI suppliers are buying their way to the front of the line for electricity. Anthropic's updated filing for its stock market listing showed $895 billion in commitments, almost all for computing and data centers. TNW Those costs will show up in prices and contract terms. Ask each AI supplier how much of its power it controls directly and what service you can expect during a shortage.
Palmer tells business leaders and board members to start using a personal AI assistant themselves, because their customers already are. Assistants now compare products, skip parts of the planned customer journey and leave gaps in marketing measurement. Shelly Palmer His point applies inside the company too: leaders who use these tools daily will spot the unfinished work and data risks this edition describes.
Every AI supplier now carries part of your security, quality and service risk.
This quarter, name one executive who owns AI supplier risk end to end, from contract terms to breach response.
AI suppliers are buying their own power and holding more customer data.
Buyers face fewer alternatives and more exposure, so contract terms on security, notice and service levels now decide value.
Most AI coding output still needs a person to finish it.
Measure finishing time per task, keep senior reviewers on every release, and test each tool inside your own setup before teams start using it.
Ask management which AI suppliers hold staff contacts and spending data, how fast each must report a breach, and who decides when employees are warned.
The shift this edition is that buying AI now means inheriting the supplier's security gaps, unfinished work and power limits. The assumption it breaks is that a subscription moves those risks to the vendor. The decision it forces is to write breach notice, quality checks and service commitments into every AI contract, and to staff the review work these tools still need.
If your main AI supplier had a breach tomorrow, would your contract tell you what it took?
Make AI accountable. Measure the results. Redesign the business.