GPT-6 Can Build Software Over Your Enterprise Data | Thursday, October 8, 2026

The Big Story

Researchers at Pwn2Own Ireland 2026, running October 6 to 9 in Cork, booked $388,500 on the first day across 32 unique zero-days, and the notable part is what sat on the target list. One team took over OpenAI's Codex cloud coding agent with a single argument-injection bug for $40,000. Another chained five zero-days against Oracle's Autonomous AI Database. A year ago the marquee targets were phones and routers. Now a coding agent and an AI database share the board with the Galaxy S26. The Zero Day Initiative gives vendors 90 days before public disclosure, so the clock on those fixes is already running. If your SDLC or your data platform now includes an AI agent, it has joined the list of things people get paid to break.

Governor Newsom signed SB 947, the No Robo Bosses Act, on September 30, and it takes effect July 1, 2027. The law bars employers from using an automated system as the sole basis for disciplining or firing a worker, requires a human to weigh the system's output against other evidence, and gives affected employees the right to know the tool was used and what data it relied on. It was one of 13 AI bills Newsom signed that day; a companion, AB 1883, bars workplace tools that read a worker's emotional state or collect neural data. For any company operating in California, the HR-analytics and workforce-monitoring stack now carries a compliance deadline, and "the model flagged them" stops being a defensible basis for an adverse action on its own.

Anthropic launched Claude Frontier Academy with a commitment to train 10,000 enterprise deployment engineers by the end of 2027, structured like a medical residency: in-person training, simulated deployments, then a twelve-week stint leading real projects inside the engineer's own employer. The first cohorts come from Accenture, Bain, Capgemini, Deloitte, McKinsey, Morgan Stanley, Novo Nordisk, and Commonwealth Bank of Australia, and Accenture says it intends to put roughly 30,000 of its own people through Claude training. Read past the goodwill and the message is an admission. The bottleneck in enterprise AI is no longer the model; it is the scarcity of people who can make one work inside a real company. A frontier lab spending nine figures to train its customers' integrators is telling you where the value and the shortage actually sit.

At Dreamforce this week Salesforce introduced AIforce, an architecture meant to carry governed Salesforce data, workflows, and permissions into whatever AI tool a company already uses, with ClaudeForce and Slackforce bringing that context into Claude and Slack directly. Alongside it came Koa, a CRM reasoning model, and an Enterprise AI Harness for securing and monitoring agents, with the Agentforce Winter '27 release set for general availability on October 12. The strategic move is quiet but real. Salesforce is conceding that the interface may belong to someone else, Claude or Slack or Gemini, and positioning its data and governance layer to sit underneath all of them. For buyers, it is a reminder that the contest is shifting from whose chatbot wins to whose data and controls ride inside the winner.

Microsoft told partners that usage-based billing will be the default for new Microsoft 365 Copilot Business licenses sold through its CSP channel, starting December 1 after a move from an earlier November 2 date. Pay-as-you-go becomes the standard configuration, metering newer experiences such as Copilot Cowork, the Work IQ APIs, and GitHub Copilot Harness. The per-seat era of Copilot is quietly giving way to consumption pricing, and the switch arrives on by default, which means a procurement team that does nothing has still chosen the metered plan. For finance, it turns a fixed line item into a variable one tied to how heavily employees lean on agents, and that is a number you now have to forecast rather than assume. Check the default before the renewal, not after the invoice.