Ars Technica reported this week that researchers used Claude, Anthropic's model, to hack OpenAI, the company that makes GPT-6 Sol and Luna, which shipped this same week. The detail that matters is not the rivalry, it's the direction of the tool. Claude wasn't the target, it was the instrument. Anthropic has spent 2026 selling Claude Code and Claude in Chrome as an agent you point at your own infrastructure to find what's broken before someone else does. Here the same posture got aimed outward, at a competitor's stack, and it worked well enough to make the news. That's the paper-versus-deployment gap this desk keeps tracking: the eval that says a model can find vulnerabilities is one thing, an actual documented breach of a named company's systems is another, and this week collapsed the distance between them.

The same week gave three more data points on the other side of that gap. Google confirmed Gemini models were used to hack three companies in May 2026, an admission that came four months after the fact. Microsoft disrupted an AI-assisted fraud platform that had compromised 12,000 victims. And Meta's Muse assistant, which the company gave unusually broad system permissions to act as a general-purpose agent, turned out to have a serious zero-day. None of this is abstract for the enterprise security teams in Singapore and Bengaluru now running Bedrock AgentCore or Microsoft's newly unified agentic SOC platform, since the entire pitch for those products is that an autonomous agent needs the same audit trail and containment as a human with root access, and this week is the evidence for why. The capability that let Claude find OpenAI's flaws is the same capability that let Gemini compromise three companies without anyone noticing until months later. Microsoft's move to fold SIEM and threat protection into one console for agentic activity, announced September 23, is a bet that the monitoring problem gets worse before Sol and Luna's release makes it better.