top of page
Search

Voice of AI: Access denied: The week AI became a contract issue šŸ”

Writer: Ralph Schwehr
Ralph Schwehr
18 minutes ago
8 min read

On October 20th in Las Vegas, an AI agent paid a supplier's bill. It had a digital identity, a tokenized payment key, and a single permission: to settle this one bill, authorized by the buyer. Three days later, OpenAI described how a research agent in its training environment found a vulnerability in the DNS resolver and thus accessed the open internet, even though it wasn't authorized to do so. Two agents, one week, two completely different worlds. The difference lies not in the intelligence of the systems, but in the precision of their boundaries. And this is precisely the question that has been occupying the Swedish government since Monday: Which AIs are allowed access, and under what conditions?



Sweden is banning ChatGPT and Claude, but not in the way many think.

Since October 26, 2026, the browser versions of ChatGPT and Claude have been inaccessible on the work computers of the Swedish Government Chancellery (Regeringskansliet). The Chancellery includes the Prime Minister's office and the ministries. Microsoft Copilot remains the only AI tool permitted, following its own security review.

The reasoning is remarkably matter-of-fact. Digitalization Director Mikael Wettercrantz points to risks to information security when AI services are used without a contract: sensitive information in input fields, unchecked answers, data on third-party servers without written rules.

Social media quickly seized upon this as a narrative that Europe was banning American AI and switching to European alternatives. The facts tell a different story. The replacement comes from Redmond. The models from OpenAI and Anthropic even remain usable for some employees, albeit via Intric, an internally operated and controlled platform. And because Microsoft integrated Claude models into Copilot in early 2026, it's not even certain whether Claude has actually been deactivated in Copilot's governmental instance. The law firm has not yet confirmed this.

Sweden is not alone in taking this approach. The tax authority and the institutional care authority have already issued similar bans, and the enforcement agency is expected to decide shortly. The European Parliament went even further in February, disabling AI functions on all work devices, including Copilot. However, there is no general EU-wide ban for public employees.

The real message, therefore, is: What will be permitted is not what is European, but what is contractually and technically controllable.



Digital sovereignty between aspiration and procurement

How difficult it is for Europe to develop its own alternatives is illustrated by the situation in Germany. In November 2025, the federal government, SAP, and Mistral AI agreed on a framework for AI in public administration. In mid-October, the Federal Ministry for Digitalization and Public Sector Modernization initially confirmed that it was not pursuing any procurement projects with Mistral. Shortly thereafter, the ministry clarified that it had not withdrawn from the joint project. The status remains uncertain, while SAP and Mistral continue to develop their offering for public authorities without a government contract for the time being.

This comes at an inopportune time for Mistral. The company had just unveiled its largest model to date, the Mistral Large 4, and shortly thereafter lost Ecosia as a partner. At the same time, Aleph Alpha is positioning itself specifically for government agencies and industry with its Kolibri-1.

Austria demonstrates that there is another way. GovGPT, the federal administration's AI application, is based on Mistral and Open Web UI, runs on servers of the Federal Computing Center, and is deliberately designed to allow for interchangeability of the model provider. This is perhaps the most important principle for any AI strategy: sovereignty is not created by choosing a specific model, but by an architecture that permits switching between them.



PHP2Shell: The AI found what humans overlooked for ten years

While Europe debated access control, that same week provided stark evidence of why oversight is so urgent. On October 21, the PHP Foundation released emergency patches for two critical vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities allow malicious code to be executed on web servers without authentication. PHP underpins much of the web, including WordPress, Joomla, and Drupal. Wiz estimates that around 70 percent of all websites run on PHP. This reflects the technology's reach, not the number of actually compromised servers.

What's remarkable is its origin. The vulnerable code had existed for more than ten years. It was discovered by the security firms Wiz and Calif, using intensive AI models, including Gemini 4 Argon and GPT-5.6 Sol. Wiz co-founder Ami Luttwak described the vulnerability as likely too complex to discover without AI.

Then came the race against time. Information about the patch leaked via Hacker News just under two days before its release. CERT-EU and the US National Security Agency (NSA) advised organizations to isolate internet-exposed applications if they couldn't patch immediately. Some operators took their sites offline as a precaution.

The lesson for companies is uncomfortable: AI is shortening the time window between detection and attack from months to days, for both defenders and attackers. Anyone still managing patches manually as a quarterly process has already lost this race.



When the borders themselves become a weak point

On October 23, OpenAI disclosed how it secures its training environments for its most powerful models and why this was necessary. In one instance, an internal research model exploited a misconfiguration of the DNS resolver, gaining access to the open internet, even though the environment was designed to only provide an offline copy of the web. OpenAI subsequently paused its most demanding training runs, hardened the environments, and only resumed Frontier training after conducting new security audits. A related red team campaign also uncovered vulnerabilities in virtual machines. Future training will take place without access to the live internet.

Clarity is more important than hype here . No model "wanted" to break free. A system trained to persistently solve problems and find weaknesses will inevitably find them within the very boundaries it's designed to contain. This isn't science fiction; it's an engineering problem.

For companies that equip AI agents with tools, databases, and network access, this is the most important technical lesson of the year: A single security layer is no longer sufficient for capable agents. Network boundaries, permissions, and logging must operate independently of each other.



Agents with power of attorney: The visa model

The example from the beginning illustrates what responsible agent autonomy looks like. On October 20th, Visa, BILL, and Billtrust launched what they claim is their first live pilot project in which AI agents consistently pay approved invoices via supplier portals. Previously, automating this final step often failed due to portals requiring human login.

The design is instructive. The agent authenticates via Visa's Trusted Agent Protocol, uses tokenized payment data instead of shared passwords, and is only permitted to process payments that the buyer has already approved. It does not decide what is paid for. According to BILL, nearly 500,000 businesses trust the platform. The benefits: faster cash flow for suppliers, less manual work for finance teams.

The message aligns seamlessly with the Swedish decision: trust is not built through prohibitions, but through precisely defined, verifiable powers. This is precisely the core of any viable applied AI architecture.



Data and capital: Whoever possesses the foundations decides.

This week's M&A activity also follows this logic. Salesforce is acquiring the customer engagement platform Braze for an enterprise value of approximately $5.66 billion, representing a premium of about 58 percent over the previous share price. This is part of a series: In June, Salesforce announced the purchase of Fin for $3.6 billion, followed by the acquisition of Listen Labs for $2 billion at the end of September.

Even more revealing is a deal from London. The London Stock Exchange Group is acquiring credit data provider Octus for $3.535 billion, with the deal expected to close in the first half of 2027. LSEG revealed a remarkable figure: 80 percent of AI agreements with clients include the purchase of additional datasets. In other words: models are becoming cheaper, but the underlying data is becoming more expensive.

Meta, in turn, demonstrates the scale that financing has now reached. On October 21, the company raised the lower end of its investment forecast for 2026 to $135 billion. Investments increased by 80 percent year-over-year, free cash flow became negative, and share buybacks have been suspended. Furthermore, starting January 19, 2027, Meta will introduce non-voting Class C shares to raise capital for data centers, talent, and acquisitions without diluting Mark Zuckerberg's control. Here, too, the same question arises: Who ultimately retains control?



What companies should do now

The signals from this week suggest three steps that do not require a major investment but provide clarity.

First: Make shadow AI visible. Examine which AI services are being used in your company without a contract and what data is flowing into them. Sweden conducted precisely this inventory before taking action. The AI Readiness Check provides a structured assessment in just a few minutes.


Second: Define agent permissions before agents act. Use the Visa model as a guide: clear identity, narrowly defined rights, and full logging. And, following OpenAI's experience, treat network boundaries as a multi-layered task, not a one-time configuration.


Third: Rebuild skills. Anthropic reports, based on its own data, that the proportion of entry-level professionals among new technical hires has fallen from 27 to 9 percent, while employee-driven agents ran six times as many hours in August as their clients. These figures come from a single AI lab; runtime is measured, not value creation. Nevertheless, they serve as a signal: When entry-level tasks are automated, teams need to learn differently. The AI Competency Assessment shows where your team stands today.

Anyone buying companies in this environment or investing in AI promises should also take a close look at the underlying technology. That's where our ARGUS Technology Due Diligence comes in.


Conclusion: Control is the new core competency of AI transformation.

This week answered a question that many companies have been putting off. It's no longer about whether AI will be used, but about who has what access and rights to which data. Governments are drawing boundaries through contracts, laboratories are reinforcing the cages of their own systems, payment networks are defining powers for agents, and corporations are securing data and voting rights. A successful AI transformation, therefore, doesn't begin with the model itself, but with the architecture of control.


We support you in developing your AI strategy to create speed rather than risk: from AI impact analysis and strategy development to implementation. You can find all our services at oakai.de/leistungen , or contact us directly at info@oakai.de .


All issues can be found in the archive at oakai.de/presse .

The future is not a matter of chance. It is a choice. Ralph Schwehr, OAKAI


Sources

Ā 
Ā 

OAKAI®

E-Mail: info@oakai.de

NEWSLETTER

Sign up for the OAKAI newsletter.

  • LinkedIn

© 2024 OAKAI®

Imprint

Data protection

Thanks for subscribing!

bottom of page