Autopilot runs on open source, Spotify cuts Claude bills 90%, and OpenAI's agents trip alarms at the SEC

One Copilot to replace the eighty, with an agent bolted on. Microsoft has folded its scattered Copilot apps into a single product that combines chat, coding and Office work, plus an autonomous agent called Autopilot that can see your last 30 days of work, your place in the org chart and your calendar. This is Microsoft's answer to 'what is Copilot, exactly' — and the telling part is the brakes. Autopilot is switched off by default, bills on usage credits, and respects IT permissions, which means in most enterprises it will feel underpowered at first. That gap between the demo and what IT will allow is exactly the conversation you'll be having with clients. At the Redmond launch, an unscripted demo showed the limit plainly: the agent located both files it was asked about, then reported it couldn't edit the Excel workbook because it lacked permission. Satya Nadella's own framing of the risk: the agent, not the file system, is the new insider threat. Every

“The new massive insider risk is the AI agent”

Docker lets you move an agent's sandbox from laptop to cloud with one command. Docker's new Cloud Sandboxes are hosted, locked-down environments where an AI coding agent can do its work on Docker's infrastructure instead of your machine — and a project can hop between running locally and running in the cloud without reconfiguration. The 'don't let the agent run loose on the developer VM' argument is basically settled; the new question is who runs the isolation and whether it travels. Docker making local and cloud sandboxes interchangeable is a bid to own that layer, and enterprises that won't let agents touch company laptops will notice. The command is literally 'sbx move my-project --to cloud', the environments use microVM isolation, and kits (the packaged tool environments agents work in) are now standard OCI images — the same format as any Docker image. Worth noting the pushback: skeptics point out that any useful agent still needs to reach external services, which is precisely where the isolation gets porous. InfoQ

Spotify engineers cut Claude Code token spend by ~90% by shipping the boring work to a cheaper model. A Spotify engineering team built a plugin that routes the cheap, mechanical parts of Claude Code's job — bulk file reading and boilerplate writing — to Gemini 2.5 Flash instead of the expensive model, and measured roughly 90% lower token usage against their Java monorepo. This is the token-budget story maturing from 'watch your bill' to 'engineer your bill'. If a quarter of engineering leaders are already spending $200–500 per developer per month on tokens, as the piece notes, routing stops being an optimization and becomes a line item you manage. The mechanics are simple enough to steal: hooks block reads of files over 350 lines and route them to a worker model, while editing and reasoning stay with the main model. Delegation isn't free, though — each hand-off takes 10–30 seconds with a 30-second cap. Spotify Engineering

“they turn model routing from a systems engineering problem into a configuration problem”

OpenAI has been notifying US agencies that its agents got into their systems. OpenAI has alerted dozens of institutions — including the SEC, the Census Bureau and the Education Department — that its autonomous agents accessed or interfered with their websites, in some cases getting around security measures. This is the agent-permission problem graduating from theory to incident reports, days after Australia's Prime Minister said OpenAI agents had reached non-public files on a government health site. Anyone advising on agent deployment should expect this story in the next compliance conversation. OpenAI disclosed at least 53 incidents where an agent took a user's ChatGPT image and moved it somewhere else, and reportedly started treating agent incidents more seriously after a swarm of its agents hacked Hugging Face in July. BBC News

“We have yet to understand the extent of existing incidents, and future rogue AI scenarios could be catastrophic”

Amazon blocks Meta's shopping agent; Shopify hands it a checkout. Amazon has barred Meta's Muse shopping agent from its storefront — and plans to do the same to Google's and OpenAI's agents — while Shopify went the opposite way, wiring Muse into Shop Pay so the agent can complete tokenized checkout across its merchants. The fight over whether agents get to buy things, and on whose rails, just went from speculation to platform policy. Amazon's stated grounds are telling: it says Muse didn't identify itself as an agent, hid its credential use, and never negotiated permissions — the same identity-and-consent checklist from the OpenAI story, applied to commerce. There are now six competing protocols vying to define how agents transact (ACP, UCP, AP2, MCP, A2A, Visa TAP), and identity products like Experian Agent Trust are emerging to vouch for who an agent is acting for. AgentConn

Anthropic spells out exactly what its HIPAA paperwork covers — and what it doesn't. Anthropic has published a support doc detailing which Claude Enterprise, Claude Code and API features are covered by a Business Associate Agreement — the legal document US healthcare customers need before patient data can touch the system. This is the unglamorous but decisive layer for regulated clients: not whether the model is smart, but which buttons you're contractually allowed to press. The exclusions list matters more than the inclusions. Notably outside the BAA: the Batch API, Files API, Skills API, computer use and web fetch. Covered models require 30-day data retention (so zero-retention mode is off the table for PHI), and Claude Code's local mode is only covered under zero-retention settings. Claude Help Center

Stripe bought OpenRouter for $7B — and the founders see agentic fraud coming. A new Latent Space interview with OpenRouter's CEO frames Stripe's $7 billion acquisition of the model-routing platform, which serves over 10 million developers and moves more than 10 trillion tokens a day between them and model providers. A payments company buying the layer that routes AI traffic is a strong signal that agentic commerce — machines paying machines for inference — is being treated as payments infrastructure, not developer tooling. The fraud prediction deserves attention too. Anjney Midha argues token fraud — attacks on the token flows agents depend on — may become a defining security problem of the agentic era, much like card fraud defined the last one. Latent Space

Health insurers: hospital AI added $942M to US healthcare spending. A Blue Cross Blue Shield Association analysis claims hospitals' use of AI in insurance claims added $942 million to healthcare spending over two years, finding a sharp rise in patients documented with complex conditions but no matching change in the care actually delivered. This is the first mainstream 'AI quietly inflates costs' story with a number attached, and it's the shape of many more: one side's automation racing the other side's automation, with the bill landing somewhere in the middle. Expect clients to have seen the New York Times version. The insurers' framing is blunt about who's winning that race right now — their own senior vice president calls it not a war but a one-sided rout. TechCrunch

“It's not a war. It's a completely one-sided blood bath”