AI News Roundup: September Twenty-Five and Agent Control

Overview: Today’s AI coverage converged on a practical question: who controls an agent once it can run software, access data, and continue working after the user leaves? Anthropic’s infrastructure bet, Meta’s persistent cloud computer, a wave of flawed security evaluations, Microsoft’s enterprise execution layer, and renewed U.S.-China dialogue all point to the same shift. AI capability is becoming an operating problem, not just a model problem.

Anthropic’s $11.6B Akamai Bet: AI Agents Run on CPUs

Anthropic committed $11.6 billion over seven years to Akamai cloud infrastructure, in what TechCrunch reports is the largest contract in Akamai’s history. The striking detail is that the deal is aimed at growing CPU demand rather than simply adding more GPU capacity. Tool calls, web requests, code execution, orchestration, storage, and other agent work create a general-purpose compute footprint that model-centric infrastructure planning can miss. For builders, the message is direct: agent economics require separate budgets and scaling plans for inference and execution.

Meta Muse Turns the AI Agent Into a Cloud Computer

Meta’s Muse is built around a persistent Secure VM with its own browser, filesystem, and continuing state. The Verge’s reporting showed how quickly that architecture becomes a security debate when the agent can expose or package large portions of its environment. A persistent VM is powerful because it gives an agent somewhere to work, but it also means permissions, egress, storage separation, and recovery must be enforced at the runtime boundary. Prompt instructions are not a substitute for operating-system controls.

Israeli Startup Irregular Behind Wave of Rogue AI Attacks

A Verge investigation linked incidents involving OpenAI, Meta, Anthropic, and Google to a flawed evaluation scenario at Irregular, formerly Pattern Labs. The common failure was not a single model’s behavior. It was the evaluation environment: internet access was unintentionally available and a fictional target overlapped with a real domain. That distinction matters. Testing harnesses are production security infrastructure when they run frontier agents, and domain allowlists, isolated networks, and simulated-target validation deserve the same rigor as the models under evaluation.

Microsoft Rebuilds Copilot as an Enterprise AI Super App

Microsoft is combining chat, coding, and autonomous work in a redesigned Copilot. CNBC reports that the product brings together Code and Autopilot experiences, with custom agents working across tools such as Teams and Outlook. Usage-based pricing makes the operational layer impossible to ignore: enterprises will need budgets, approval gates, permission scopes, and action-level observability, not just model access. Copilot is becoming an execution surface for business software.

U.S.-China AI Talks Put Technical Cooperation on the Agenda

CNBC reports that U.S. and Chinese leaders discussed continued AI dialogue, including concerns about misuse and human control. This is not a technical alliance and does not erase competition over chips, models, or compute. It does signal that incident response and controllability are becoming international policy concerns. Builders operating across markets should expect stronger pressure for portable logs, explicit authorization, reversible actions, and clear escalation paths.

What to Watch Tomorrow

• Agent runtime boundaries: More scrutiny of persistent VMs, filesystem access, and network egress will follow the Muse controversy.
• CPU capacity for agents: Akamai’s deal may encourage other infrastructure providers to position general-purpose compute as a first-class AI asset.
• Evaluation security: The Irregular disclosures raise questions about how frontier labs validate third-party testing environments.
• Enterprise agent budgets: Microsoft’s usage-based model will test whether companies can measure agent work before scaling it.

Builder Impact

The common thread is control infrastructure. Separate model inference from execution authority. Give agents short-lived, least-privilege credentials and capability-specific permissions. Treat persistent memory and filesystems as privileged resources. Isolate evaluations from production, restrict outbound traffic, and log every sensitive tool call. Finally, design approval and recovery paths before deployment. The next phase of AI competition will be won not only by better models, but by systems that can keep capable agents observable, bounded, and interruptible.