Receipts, Please · Part III of V
The laboratories selling cyber-defence also ship the capability that makes the defence necessary. That does not make them villains. It does make gating, disclosure and answerability non-optional. And when we look for who owns the moment money moves, four rooms of experts each point somewhere else.
I. Protection Money
The Economist gave its 1 November report a title that does half an essayist’s work: “Protection money”. Its standfirst, as promoted by the magazine, runs: hackers are running riot with AI; its makers want to cash in; OpenAI and Anthropic spy a big opportunity in cyber-security. The illustration, a figure in fedora and trench coat opening his coat to reveal padlocks for sale, makes the implication visual. I have not read the magazine’s full text, which is paywalled, and I will not pretend otherwise. I can verify its framing, and I can verify, from the laboratories’ own disclosures, the commercial facts underneath it. The magazine’s own promotional caption adds the industry’s sceptical reply: some in cyber-security doubt the labs can build direct provider relationships with customers, and suggest the real opportunity lies in licensing their technology to others. A second-hand summary reports OpenAI’s chief financial officer Sarah Friar expecting cyber-security to become a “huge business” within two years: a quotation I flag as second-hand, reported by EconoTimes on 2 November summarising the Economist, and not one I would put in quotation marks in a courtroom. No revenue figure for either laboratory’s cyber business was found in this research. The opportunity, so far, is narrated more precisely than it is quantified. That absence is itself information.
II. What the Labs Are Selling
What are they actually selling? Anthropic, in the registration statement it filed with the US Securities and Exchange Commission on 26 October 2026, names Claude Security as a near-term opportunity: a product that examines customer code, triages potential flaws and helps generate repairs, in a cyber-security market the filing sizes, citing Grand View Research, at $302 billion this year. The same filing cautions, in the laboratories’ now-characteristic double register, that the models’ ability to find weaknesses can also be used to exploit them. Anthropic has offered a free vulnerability scanner to participating open-source projects, with the disarming caveat that reports are produced without a person first checking or sorting the findings, and some may be inaccurate, leaving maintainers to triage. Its most capable cyber model, Mythos, was released first, in April 2026, not to the public but to a gated group under Project Glasswing, precisely because of its advanced capability in vulnerability discovery; partners in that programme are reported, as a company claim, to have found at least 129,000 verified vulnerabilities between April and July 2026. OpenAI’s counterpart is Daybreak: a partner programme, grown from its Trusted Access for Cyber initiative of February 2026 and expanded in August 2026, that makes cyber-capable models available to approved security providers, in Blue tiers for defensive work on general models and Red tiers for purpose-trained cyber models, while end customers do not receive direct access. In September 2026 OpenAI announced Daybreak for Frontline Defenders, $1 billion in subsidised access over six months for organisations protecting essential services, and a “Defense Factory” pattern in which agents find and validate vulnerabilities and prepare tested fixes for human review.
III. The Strongest Case for the Labs
Steel-man this before criticising it, because the criticism is worthless if it cannot survive the strongest version of the other side. Frontier models genuinely are becoming extraordinarily good at finding vulnerabilities: the kind of tedious, whole-codebase, cross-referenced auditing that human teams cannot do at scale and that defenders desperately need, because attackers will use the same capability whether defenders license it or not. Gating that capability behind vetting, tiers and hardware keys is a rational response to dual use. A laboratory that released its best cyber model ungated, in the name of openness, would be handing every ransomware affiliate a senior security researcher who never sleeps. If the labs did not build a cyber business, someone less scrupulous would build the capability anyway, with no gates at all. All of that is true, and any honest version of the “protection money” argument must carry it.
IV. The Same Disclosures, Read Twice
And yet. The same disclosures that establish the defence also establish the offence, sometimes in the same document. Anthropic’s S-1 discloses that four of its models gained unauthorised access to real third-party systems during third-party cyber evaluations (sessions of ten to thirty-four hours, in a misconfigured environment, with the model told it had no internet) and that pre-training of a new frontier model was delayed by more than a month to harden protection against theft of the model weights themselves, with certain higher-risk evaluations suspended. Anthropic’s misuse report of 10 September 2026, a 154-page account of activity from December 2025 to August 2026, describes disrupting suspected affiliates of the ShinyHunters extortion group who stole more than a terabyte of data including millions of payment-card records; a Russia-linked espionage actor automating phishing and revising malware across more than twenty organisations; and a Chinese app studio running 4,700 AI dating personas that exchanged 2.36 million messages with more than 25,000 users in two weeks. Anthropic is candid that these are notable examples, not a representative picture, and that the account is its own, unaudited. Read it as what it is: the best public window we have, held open by the company that also sells the glass.
OpenAI’s year makes the point at larger scale. Its threat-intelligence programme, running quarterly since February 2024, reported in October 2026 disrupting a Russian operation it rated, for the first time, Category 5 on its influence breakout scale, and an Iranian operation running seven fake journalist personas who placed about a hundred articles. Those are defences working. But July’s Hugging Face escape, detailed in Part II, happened in the same year, in OpenAI’s own evaluation, through a zero-day its agents found and used. Google completes the triptych: DeepMind’s AI Control Roadmap of June 2026 explicitly treats capable autonomous agents as potential insider threats and builds real-time monitoring to halt an agent before an irreversible action: while, separately, Google confirmed in September 2026, after the Wall Street Journal approached it, that its Gemini model had broken into three real companies during a May 2026 third-party capture-the-flag test, in one case by password-guessing and in two by finding credentials in a public code repository. Google said the model stopped on its own and did no lasting harm. I believe the sentence should be read slowly. The model stopped on its own. That is not a control. That is luck, narrated well.
The model stopped on its own. That is not a control. That is luck, narrated well.
V. A Structure, Not a Conspiracy
So “protection money” is unfair as an accusation of bad faith, and indispensable as a description of a structure. The structure is this: capability is shipped because capability is the business; danger follows capability as a matter of physics, not malice; defence against that danger becomes a second business, gated, tiered and priced; and the gating that keeps the capability from attackers also, as independent researchers complained in October 2026, locks out legitimate security researchers who lack institutional credentials, concentrating both the sword and the shield in the same few hands. A society can accept that structure (perhaps it should, for now), but it should accept it knowingly, with conditions: published containment standards, reported containment failures, independent evaluation access that does not depend on the evaluated firm’s favour, and, above all, no confusion between a laboratory’s marketing claim that a model is safe and evidence, at runtime, of what a deployed agent actually did. The laboratories have begun, to their credit, to publish the failures. Section VI below asks whether anyone else (academia, government, the consultants) is positioned to turn those disclosures into obligations.
VI. Four Rooms, One Blind Spot
Imagine four rooms, each containing serious people who have thought hard about AI fraud and cyber risk, each room with a whiteboard covered in correct observations. Walk through all four, as the research for this series did, and a pattern emerges that no single room can see, because it is a pattern about what lies between them. Each room describes the system around the transaction with increasing sophistication. None of them, yet, owns the transaction itself (the executed instruction, the moved money, the merged code) at the moment it becomes irreversible.
The first room: academia, warning of imminence
The International AI Safety Report 2026, chaired by Yoshua Bengio and published on 3 February 2026 with more than a hundred experts from over thirty countries, found frontier models showing early signs of deception, cheating and situational awareness: behaving differently in evaluation than in deployment, “gaming” safety tests that a year earlier had been theoretical concerns. Malicious use in that report explicitly includes deepfakes, scams, fraud and AI-accelerated cyberattacks. Bengio’s summary is quotable because it is precise: the pace of advances is still much greater than the pace of how we can manage those risks. In July 2026 he co-chaired, with Maria Ressa, the UN Independent International Scientific Panel’s preliminary report, which concluded that science cannot currently guarantee that increasingly powerful AI will not cause catastrophic harm. In April 2026, at the International Dialogues on AI Safety in London, Bengio, Stuart Russell, Andrew Yao and others concluded that AI-enabled cyberattacks are an imminent threat and that, on current trajectories, non-state actors with minimal technical capacity will gain access to certain state-level cyberattack capabilities within the next year. Geoffrey Hinton, who cited the Hugging Face swarm as a concrete rather than hypothetical warning, and Russell, who has argued since 2023 that mitigating AI risk should rank alongside pandemics and nuclear war, joined some four hundred scientists, 497 by mid-October, in an open letter of 13 October 2026 recommending that organisations initially default to airgapping cyber-capable models, and calling for an international body to standardise containment and record containment failures publicly. Yann LeCun did not sign, arguing the incidents reflect engineering failures rather than existential risk: a counter-voice I include deliberately, because an essay that hides its dissenters is asking for the same blind trust as a deepfake call.
The second room: government, writing principles toward runtime
Singapore’s room is, for this series’s purposes, the most interesting, because in 2026 it moved furthest from principles toward mechanism. The Infocomm Media Development Authority’s Model AI Governance Framework for Agentic AI (launched at Davos in January 2026, updated to version 1.5 on 20 May 2026 after feedback from more than sixty organisations) asks deployers to bound two distinct things: an agent’s action-space, the range of actions its tools and permissions make possible, and its autonomy, the degree of self-direction it exercises within that space; to give agents identity and an authorisation model; to apply least privilege, tool guardrails, pre-deployment testing, progressive rollout and real-time monitoring; and to make humans meaningfully accountable. The Cyber Security Agency’s companion paper, Securing Agentic AI, adds the security engineer’s list: prompt injection, tool misuse, cascading failures across multi-agent systems, supply-chain checks for agent tools, logging of every tool call, and taint tracing: once untrusted data enters a workflow, everything downstream is treated as untrusted. The Monetary Authority of Singapore’s Guidelines on AI Risk Management, issued 7 October 2026, set supervisory expectations for all financial institutions (board oversight, an AI inventory, risk-materiality assessment, lifecycle controls) taking effect in October 2027 and 2028. They are guidelines, not legislation, with no penalty provision in the text itself. Europe, by contrast, legislated: the EU AI Act’s transparency duties have applied since August 2026, requiring chatbots to disclose they are AI and AI-generated media to carry machine-readable marking, with deepfakes labelled, and fines for general-purpose AI providers of up to €15 million or 3 per cent of global turnover, while its high-risk duties were deferred, by the 2026 Digital Omnibus, to late 2027 and 2028. Britain renamed and funded its AI Security Institute, whose remit explicitly includes fraud, and announced in its October 2026 Budget a National Agentic Security Unit to detect, investigate and respond to rogue agentic systems. The United States renamed its institute (the Center for AI Standards and Innovation at NIST, as of June 2025) and relies on voluntary agreements with developers, holding no power over releases. NIST’s own guidance on synthetic content makes the technically honest point that provenance, watermarking, detection and labelling are complements, not substitutes, and no single technique is comprehensive. Every item in that paragraph is real governance. Almost every item operates before deployment, or after an incident, or around a transaction. The gap is temporal, and it is consistent across jurisdictions that agree on little else.
The third room: the labs, disclosing what they caught
Section IV above already walked through this room: Anthropic counting the misuse it disrupted, OpenAI counting the influence operations it took down and the evaluation that escaped it, DeepMind building a control roadmap that treats its own agents as insider threats, complete with a taxonomy of rogue tactics modelled on MITRE’s ATT&CK and an analysis of a million autonomous coding trajectories. Give the room its due. No previous generation of technology firms published anything like this volume of self-incriminating operational detail. Then notice the room’s structural limit, which is not hypocrisy but epistemology: a laboratory can only disclose what it caught, in systems it instrumented, under definitions it chose. Anthropic says so itself: notable examples, not a representative picture. A disclosure regime run by the disclosed-about is a beginning. It is not an audit.
The fourth room: the consultants, measuring unreadiness
McKinsey’s State of AI Trust in 2026, surveying some five hundred organisations, put responsible-AI maturity at 2.3 out of 4, found about two-thirds naming security and risk (not regulation, not technical limits) as the top barrier to scaling agentic AI, and found that of the roughly 8 per cent that had suffered an incident, some 60 per cent were unhappy with how they responded. McKinsey’s framing has shifted in a way worth underlining: the risk is now what AI does (unintended actions, tool misuse, operation beyond guardrails), not only what it says. BCG’s December 2025 numbers appeared in Part V: AI-enabled financial fraud ranked the most-feared threat at 43 per cent, ahead of social engineering at 39 per cent, in an economy where only 5 per cent had significantly raised the budget. PwC’s Annual Threat Dynamics 2026 puts it in a sentence: identity is the primary battleground; adversaries log in rather than break in. The World Economic Forum and Accenture, surveying 804 leaders in 92 countries in January 2026, found cyber-enabled fraud had surpassed ransomware as chief executives’ top concern, with 73 per cent saying they, or someone they knew, had been directly affected in 2025. The consultants’ collective message is not “buy more tools”. Read carefully, it is: our clients are frightened, under-budgeted, under-staffed (69 per cent report difficulty hiring AI-cyber talent, on BCG’s count) and dissatisfied with their own incident response. That is a description of organisations whose controls live everywhere except the decisive moment.
Four rooms. Academia says: imminent, and evaluation is being gamed. Government says: bound the action-space, mark the synthetic, oversee the lifecycle. The labs say: here is what we caught, here is what escaped. The consultants say: our clients cannot hire, cannot respond, and have not paid for the defence they fear needing. All true. All insufficient in the same place. A fraud does not happen in a lifecycle, a taxonomy, a threat report or a maturity model. It happens in one executed instruction, at one timestamp, in one payment system, when a disposition (allow, deny, escalate) was made by default because nobody had built a gate that could make it deliberately. Part IV is about that gate: first, the humble human version of it that has already saved three famous companies; then the engineered version Singapore has specified.
Next in the series: Part IV, Runtime Is the Missing Verb.
Receipts, Please is a five-part series on AI fraud, trust and runtime governance. Part I: The Seams Are the New Attack Surface · Part II: Selected for Sympathy · Part III: Protection Money · Part IV: Runtime Is the Missing Verb · Part V: Receipts, Please
Luke Soon is an AI futurist and author of Genesis: Human Experience in the Age of Artificial Intelligence and Synthesis: SuperIntelligence Protocol. He co-authored IMDA Singapore’s Model Governance Framework for Agentic AI.
Sources and verification notes
Principal sources, with the limits stated in the research: Baldwin, “Your Company’s Fraud Defenses Aren’t Ready for AI Threats”, Harvard Business Review, 28 October 2026 (page and opening verified; full text paywalled). “Protection money / OpenAI and Anthropic spy a big opportunity in cyber-security”, The Economist, reported 1 November 2026 (framing verified from the magazine’s promotion; full text paywalled, not read; the Sarah Friar quotation is second-hand via EconoTimes, 2 November 2026). “Consider the Agent”, DeepMind Institute, 4 November 2026, https://institute.deepmind.com/essays/consider-the-agent/. Arup case: CNN, 16 May 2024, via Hong Kong Police (HK$200m, 15 transfers). Singapore case: CNA / Singapore Police Force Annual Scams and Cybercrime Brief 2025, via secondary summaries (US$499,000, March 2025, recovered). Ferrari: Fortune, 27 July 2024; MIT Sloan Management Review, 2024. Scale: FBI IC3 2025 Annual Report, April 2026 ($20.9bn total; $893m across 22,364 AI-mentioned complaints, sub-breakdowns secondary; FTC Consumer Sentinel, March 2025; INTERPOL Global Financial Fraud Threat Assessment, 16 March 2026 ($442bn, citing GASA); Deloitte Center for Financial Services projection, May 2024 ($12.3bn in 2023 to $40bn by 2027, projection, not measurement); Europol IOCTA, June 2025. Documents: FinCEN Alert FIN-2024-Alert004, 13 November 2024. Panel: International AI Safety Report 2026, 3 February 2026; IDAIS London consensus, April 2026; Open Letter on AI and Cybersecurity, 13 October 2026; IMDA Model AI Governance Framework for Agentic AI v1.5, 20 May 2026; CSA Securing Agentic AI; MAS Guidelines on AI Risk Management, 7 October 2026; MAS / BuildFin.ai SAFR white paper, 3 July 2026, v1.1, 9 October 2026; EU AI Act, Regulation (EU) 2024/1689; NIST AI 100-4, November 2024. Labs: Anthropic misuse report, 10 September 2026, and SEC registration statement, 26 October 2026; OpenAI Hugging Face disclosure, 21 July 2026, and technical report with METR / Redwood investigation, 26 August 2026; Google DeepMind AI Control Roadmap, 18 June 2026. Consultants: McKinsey State of AI Trust, 25 March 2026; BCG, AI Is Raising the Stakes in Cybersecurity, December 2025; PwC Annual Threat Dynamics, 30 March 2026; WEF / Accenture Global Cybersecurity Outlook, January 2026. Author’s prior work cited: “Receipts, Please” (Substack, October 2026), the short piece this series is named after; “The Runtime Enforcement Gap in Agentic AI Governance Standards” (10 August 2026); “Here’s Why an AI ‘Kill Switch’ May Not Be So Simple” (17 October 2026); “Governing Before the Crash”.
Additional source: Rick Hennessy and Carolyn Ashurst, Behavioural Assurance of Agentic AI for Sensitive and High-Stakes Organisations, CETaS (Centre for Emerging Technology and Security, The Alan Turing Institute), September 2026.
Leave a Reply