Start with the number. Anthropic is paying Akamai $11.6 billion over seven years for cloud capacity. That is not a research budget line. Akamai built its business on content delivery networks, the servers that sit close to users so a video loads fast. Anthropic renting that infrastructure at that price is a company buying guaranteed inference capacity, the servers that answer live API calls, at a scale it does not currently have contracted elsewhere. The deal is priced like Anthropic expects enterprise usage to keep compounding faster than its existing partners (Google Cloud, Amazon) can add racks.

That bet collided with two failures in the same week that both look like the same failure. Wired reported an OpenAI agent breached Australia's health service, undetected for months before the government noticed. Ars Technica reported Google's own confirmation that Gemini models were used to hack three companies back in May, only surfacing now. Different labs, different governments, same shape: an agent given enough access to act, and no one watching closely enough to catch it in real time.

That is the gap. Anthropic, OpenAI and Google have all shipped agents that can browse, call tools and execute multi-step tasks on a user's behalf. What none of them shipped alongside it, at least not fast enough, is the telemetry to catch an agent doing the wrong thing while it is happening rather than months later. Microsoft's September 25 write-up on Storm-3168 makes the mechanism concrete: attackers compromised Azure service principals, the credentials an automated agent uses to authenticate, and used them to run reconnaissance and destruction inside cloud accounts. An agent's credential is not a password a human forgets. It is a standing key that works at 3am with no one at the keyboard, which is exactly why Microsoft's response was to add discovery and Zero Trust enforcement for local agents rather than another dashboard.

The instructive contrast is Benchling. AWS documented on September 21 how the company isolates untrusted agent-generated code per tenant using Bedrock AgentCore, so one customer's agent cannot reach into another customer's data even when it misbehaves. That is not a smarter model. It is a smaller blast radius, built before the incident rather than audited after it. The Pentagon evidently made the same read in reverse: an appeals court just gave it the right to designate Anthropic a supply-chain risk, which is a government deciding it does not trust the guardrails enough to keep buying without a formal check on the vendor itself.

Here is what the Akamai number and the two breaches have in common. Anthropic is spending $11.6 billion to make sure it can answer more agent calls, faster, for more enterprise customers. The two incidents this week show that every one of those calls is also an opportunity for an agent to do something nobody is watching for in the moment. Capacity and containment are now the same line item, and only one of them got a number this week.