September 18: the economics of AI attack

If this becomes law, expect state regulators to gain real leverage to stop data center buildouts from raising your electricity bill.

Finance: Utilities and hyperscalers may face new negotiated rate structures that change the economics of data center site selection and could slow some AI infrastructure spending.

Managers: If your company is negotiating a data center lease or colocation deal, expect power cost terms to get more scrutiny and possibly renegotiation as state rules catch up.

Do this: Nothing to do yet — the bill is stalled in the Senate; watch for a floor vote before the midterms.

IAM policies don't distinguish between human and machine credential lifecycles — nobody has inventoried which agents hold which credentials, where those credentials came from, or whether they expire on a human timeline or a machine one.

Engineers: A single attacker used hundreds of agents built on OpenAI Codex and a DeepSeek model to exploit two PaperCut NG/MF vulnerabilities across 395 organizations, reaching initial compromise at 11 organizations in 26 seconds — service accounts with domain-level privileges and no expiry are exactly what gets found and used.

Managers: An agent's API key never takes leave, never changes role, and often never gets revoked when a project ends — treat it like a highly privileged employee, not a service ticket.

Do this: Audit which AI agents and service accounts hold standing credentials, confirm they expire and rotate on a schedule, and check whether your PaperCut instances are patched — the federal remediation deadline for the exploited CVEs was September 14 and has passed.

When a startup this new can command eight-figure enterprise deals and repeat funding rounds this quickly, it signals real corporate demand for hands-on AI implementation help, not just AI tools.

Finance: The round, led by Temasek's Xora with backing from Aramco Ventures and tech CEOs, values specialized AI-services firms highly even before profitability is proven — a pattern worth tracking if you're assessing where enterprise IT budgets are shifting.

Managers: If your company outsources software modernization, expect vendors like this — not just the traditional IT services giants — to be pitching AI-driven rebuilds soon.

Do this: Nothing to do yet — just be aware this is an early signal that AI consulting, not just AI products, is becoming a fundable, defensible category.

The "software is dead" narrative has cooled for now, but the underlying AI disruption risk hasn't disappeared — it's just been pushed further out.

Finance: Analysts note that "frontier labs are more likely to partner with leading vendors than own the full stack," since systems of record and sticky workflows remain durable moats — a reason to look past the panic-driven selloff earlier in the year.

Managers: If you paused vendor decisions or software budgets while waiting to see if AI would gut incumbents, this rebound suggests it's safer to resume normal planning.

Do this: If you hold or are evaluating software-sector positions, revisit the thesis now — earnings quality and AI-pause signals both point away from imminent disruption, but don't assume the risk is gone for good.