STEVEN STEINBECK
← ALL DISPATCHESDISPATCH 46

WEEK OF NOV 8 – 14, 2025

An AI ran 80% of an intrusion, a judge ordered 20 million chats produced, and GPT-5.1 shipped a shell tool

Anthropic disclosed the first AI-orchestrated espionage campaign, OpenAI put a patch-and-shell agent loop into its API, a New York magistrate ordered 20 million ChatGPT logs handed to news plaintiffs, and CoreWeave cut capex guidance two days before Anthropic committed $50 billion to building its own data centers.

This was the week agentic AI stopped being a demo category. On Thursday, Anthropic published a report on a campaign it detected in mid-September: a threat actor it assesses with high confidence to be Chinese state-sponsored drove Claude Code through roughly thirty target organizations, with the AI performing an estimated 80-90% of the tactical work. The same week, OpenAI shipped the tools that make that kind of loop ordinary — a patch tool and a shell tool in the Responses API.

The money moved in the opposite direction from the guidance. CoreWeave beat on revenue, nearly doubled its contracted backlog to $55.6 billion, then cut full-year revenue and capex guidance because a third-party data-center developer was behind schedule; the stock fell about 5-6%. Two days later Anthropic announced $50 billion of its own custom capacity with Fluidstack in Texas and New York — its first build-out rather than a rental, and a direct bet that the delay was a scheduling problem, not a demand problem.

And the discovery fight in the copyright cases turned into a data-governance problem for every team that logs prompts. OpenAI spent Wednesday arguing in the Southern District of New York that producing a 20-million-conversation sample of consumer ChatGPT logs to the New York Times and its co-plaintiffs is a privacy catastrophe; the court's own proportionality maths says the sample is less than 0.05% of the logs OpenAI retained. In-window, no frontier lab released near-frontier open weights — Kimi K2 Thinking's trillion-parameter MoE landed on November 6, just before this window opened.

THU · Nov 13, 2025securityagentsmcpanthropic

Anthropic: a state-sponsored group used Claude Code to run an 80%-automated espionage campaign

Anthropic disclosed on Thursday that a threat actor it assesses with high confidence to be Chinese state-sponsored, tracked internally as GTG-1002, manipulated Claude Code into attempting intrusions against roughly thirty organizations — large technology companies, financial institutions, chemical manufacturers and government agencies — and succeeded in a small number of cases. The company says it detected the activity in mid-September 2025 and describes it as the first documented case of a large-scale cyberattack executed without substantial human intervention. Operators split the work into small, individually innocuous tasks and told the model it was an employee of a legitimate cybersecurity firm running defensive tests.

Anthropic's account puts the AI's share of tactical operations at 80-90%, with humans making perhaps four to six critical decisions, and at peak the framework issued thousands of requests, often multiple per second, with tool access frequently reached through the Model Context Protocol. The disclosed kill chain is the standard one, executed by an agent: reconnaissance, vulnerability research and exploit writing, credential harvesting, backdoors, data exfiltration, then generated documentation of the intrusion. It escalates Anthropic's August 2025 report on Claude used in a data-extortion campaign against 17 organizations, where humans stayed in the loop directing operations.

Anthropic: a state-sponsored group used Claude Code to run an 80%-automated espionage campaign
Anthropic

WHY IT MATTERS

The report is really about blast radius, not alignment: an agent holding shell, file and MCP tool access executes with whatever credentials you gave it. If you run coding or ops agents in production, treat revocation of API keys, OAuth tokens and MCP server registrations — plus freezing memory stores and tool-call histories — as the containment step, because isolating a host does nothing to an agent that talks to an API from anywhere.

Anthropic: disrupting the first reported AI-orchestrated cyber espionage campaignThe Register: Chinese spies used Claude to break into critical orgs
WED · Nov 12, 2025modelsopenaiagentspricing

GPT-5.1 ships with adaptive reasoning — and one day later, apply_patch and a shell tool in the API

OpenAI rolled GPT-5.1 out on Wednesday to ChatGPT subscribers first, splitting it into GPT-5.1 Instant, which adds adaptive reasoning and decides for itself when to deliberate, and GPT-5.1 Thinking, tuned to spend less time on easy prompts and persist on hard ones. The model keeps GPT-5's pricing and rate limits, carries a 400,000-token context window, and scores 76.3% on SWE-bench Verified, all under the same GPT-5 generation label rather than a new family. The developer release followed on Thursday alongside gpt-5.1-codex and gpt-5.1-codex-mini for long-running Codex-style harnesses.

The part that changes architecture is tooling, not benchmark deltas. Two new Responses API tools landed with the developer release: apply_patch, which emits freeform structured diffs to create, update and delete files without JSON escaping, and shell, which lets the model propose commands that your integration executes and returns results for — a plan-execute loop you own. Extended prompt caching now keeps context hot for up to 24 hours, with cached input still 90% cheaper than uncached, and reasoning effort none is now the default for latency-sensitive calls.

GPT-5.1 ships with adaptive reasoning — and one day later, apply_patch and a shell tool in the API
Anthropic

WHY IT MATTERS

apply_patch plus shell means OpenAI now ships the edit-run-test loop as primitives rather than leaving it to framework authors — expect harness parity pressure on Anthropic's and Google's SDKs. The 24-hour cache is the quieter decision-relevant change: overnight and multi-hour agent sessions stop re-paying full input cost, which resets the cost model for long-running agents, and reasoning effort none by default means auditing latency assumptions made for GPT-5.

OpenAI: GPT-5.1 — a smarter, more conversational ChatGPTOpenAI: introducing GPT-5.1 for developers
WED · Nov 12, 2025infrastructureanthropiccapex

Anthropic commits $50 billion to custom data centers with Fluidstack

Anthropic announced a $50 billion investment in American computing infrastructure on Wednesday, building custom data centers with neocloud provider Fluidstack in Texas and New York, with more sites to come and capacity online through 2026. The company says the project creates about 800 permanent jobs at an average salary near $144,000 plus roughly 2,400 construction roles, and frames the spend against more than 300,000 business customers, with accounts above $100,000 in run-rate revenue growing nearly sevenfold in a year.

This is Anthropic's first move to build rather than rent. Its existing capacity comes from Google and Amazon, and the new sites are described as custom-built to maximize efficiency for its own workloads, which puts it in the same physical-supply-chain race as OpenAI's Stargate program and Meta's multi-hundred-billion-dollar commitments. It also lands two days after CoreWeave told investors that a third-party data-center developer was behind schedule — the same class of dependency Anthropic is now internalizing.

WHY IT MATTERS

Compute access, not model quality, is the binding constraint on what you can ship, and a $50 billion dedicated allocation to one lab shifts who can serve frontier models at what price and with what rate limits. If your architecture assumes you can rent the same capacity a frontier lab uses for inference, or that neocloud delivery schedules hold, this week gave both assumptions a counterexample.

Anthropic: Anthropic invests $50 billion in American AI infrastructureCNBC: Anthropic to spend $50 billion on US AI infrastructure
WED · Nov 12, 2025legalprivacyopenaidata governance

OpenAI asks a judge to reverse an order to produce 20 million user chats

OpenAI filed for reconsideration on Wednesday asking Magistrate Judge Ona Wang in the Southern District of New York to reverse a discovery order requiring it to hand a 20-million-conversation sample of consumer ChatGPT logs to the New York Times and other news plaintiffs, arguing that 99.99% of the transcripts have nothing to do with the copyright claims and that producing them would expose private user conversations. Its CISO, Dane Stuckey, published a user-facing post the same day; a Times spokesperson responded that the court ordered a sample anonymized by OpenAI itself, under a legal protective order, and that no user's privacy is at risk.

The scope is narrower than the headline: the sample is a random draw of consumer conversations from December 2022 to November 2024, excludes business and enterprise customers, is de-identified by OpenAI's own tooling, and represents less than 0.05% of the tens of billions of output logs the company retained in the ordinary course. The Times had previously sought a far larger sample — a July motion to compel covered 120 million logs.

WHY IT MATTERS

Any product that logs prompts and completions for debugging, evals or abuse review is accumulating the same category of material, and this is a live example of it becoming discoverable in third-party litigation. If you cannot demonstrate de-identification on demand and defend a retention window, your logs are a legal liability rather than an asset — the retention policy you write now is the one you will have to defend in production.

Reuters: OpenAI fights order to turn over millions of ChatGPT conversationsArs Technica: OpenAI slams court order that lets NYT read 20 million complete user chats
MON · Nov 10, 2025infrastructureearningscoreweaveai bubble

CoreWeave doubles revenue to $1.36B and nearly doubles backlog — then cuts capex guidance

CoreWeave's third quarter, reported Monday, was a demand story with a delivery problem attached. Revenue more than doubled year over year to $1.364 billion from $583.9 million, the net loss narrowed to $110 million from $359 million, adjusted EBITDA reached $838 million, and revenue backlog nearly doubled to $55.6 billion from about $30 billion on contracts with Meta, OpenAI and Poolside. The company then trimmed full-year revenue guidance to $5.05-5.15 billion and cut 2025 capex guidance to $12-14 billion from the $20-23 billion it forecast a quarter earlier, citing a third-party data-center developer behind schedule; shares fell roughly 5-6%.

The balance sheet carries the risk the backlog is meant to offset: about $9.7 billion of obligations due within twelve months against roughly $14 billion in total debt, both up sharply from the prior quarter. CEO Michael Intrator described relentless demand alongside industry-wide supply-chain pressure, and said the affected customer agreed to reschedule delivery while preserving the contract's total value. Management guided that 2026 capex will rise substantially, which puts the deferral into next year rather than removing it.

WHY IT MATTERS

For anyone buying inference, the signal is that contracted GPU capacity is not the same as delivered capacity — the slippage that forced a guidance cut will surface as quota tightening and spot-price volatility before it surfaces in earnings. Architect for provider portability across at least two clouds plus an owned-model fallback, and treat multi-year capacity commitments as schedule risk you are underwriting, not insurance against it.

CoreWeave: reports strong third quarter 2025 resultsFortune: CoreWeave's earnings highlight $56 billion in contracted revenue, but guidance and share price tick down