Good morning, Fargo-Moorhead. There is a lot of AI news every week and most of it does not matter to somebody running a business here. This week is different. Four separate stories landed, and when you line them up they are all describing the same shift.
For three years, using AI meant asking it something and reading what came back. You were still the one driving. What is happening right now is that AI is being handed the keys: your logins, your inbox, its own computer, and permission to go do the thing instead of telling you how. That is a genuinely different product, and it comes with a genuinely different set of risks.
Here is what happened, in the order I would explain it at a kitchen table.
An AI agent that gets its own computer
The concept of an AI agent is not new. What is new is that setting one up used to require a developer, and now it does not.
The clearest example on the market is Grok Bot, from Elon Musk’s xAI, which merged into SpaceX earlier this year. VentureBeat covered it at launch as persistent digital coworkers that operate your apps, and three details are worth understanding even if you never buy it.
Each agent gets its own computer, in the cloud. Not a window on your laptop. An actual machine that keeps running after you close the lid and go home. It stays signed into the sites and apps you gave it, so it is not logging back in every time. That is the difference between a tool you sit in front of and an employee you leave a task with.
It signs into websites the way a person does. No API, no integration, no waiting for your vendor to support it. If you can do it in a browser, it can do it in a browser. For a small business, that is the whole ballgame, because the software most of us actually use does not have a nice integration story.
You teach it a task by recording yourself doing it once. This is the feature that made me sit up. You screen record the workflow, the ugly one nobody wants to document, and the system turns that recording into a repeatable skill. No code. If you have ever thought “I could hire someone if I could just explain this job,” that is what this is aimed at.
The multi agent piece is real too. You can set up a chief of staff agent that hands work to specialists, and their own examples are exactly the boring stuff that eats a week: one triages the inbox, one handles expense reports, one does first round recruiting screening, one catches bug fixes. They message each other and coordinate without you sitting in the middle relaying instructions.
Now the caveat, and this is the part I would want to know before spending money. Reviewers have flagged that you do not get to pick which AI model is actually doing your work. Grok Bot routes each task to whatever model it wants on the back end, the company has said it does not plan to allow admin or user choice of models, and at least one early tester said the router was not great. If you are a business owner, “something is doing my work and I cannot tell you what” is a real problem, especially if you have any compliance obligation or you need the behavior to stay consistent from January to December. The tier in that VentureBeat piece runs $120 a month.
The cheap models got good enough to matter
Second story, and this is the one with the most direct dollar impact locally.
The open weight models, the ones you can download and run yourself, have quietly closed most of the gap with the expensive frontier models. The names to know are DeepSeek V4 Pro, Kimi K3, GLM 5.2, Qwen3.6, and MiniMax M3. Several of them now score within single digits of the closed models on coding and reasoning tests.
The independent tracker Epoch AI puts the gap at about four months. One note on that, because I have seen it repeated wrong: the gap did not stay perfectly flat, it moved from roughly three months to roughly four. But that is the actual story. Over more than a year of the fastest technology race any of us have watched, the free models have stayed within a few months of the paid ones instead of falling off the pace.
The practical version: DeepSeek V4 Pro resolves north of 80 percent of the tasks on SWE-bench Verified, which is a standard test of fixing real software bugs, and it ships under a plain MIT license. MIT means you can run it commercially without asking anyone’s permission.
I want to be straight about what self hosting means, because the word gets thrown around loosely. This is not a model you run on the desktop in the back office. It is enormous, and running it means renting real hardware or going through one of the cheap providers that host these models for a fraction of what the big labs charge per use. What it changes is not “free AI in your closet,” it is that the metered bill from a frontier provider is no longer the only option, and your data does not have to leave a machine you control. For anyone in healthcare, finance, or law who has been told AI is off the table for privacy reasons, that second part is the one to pay attention to.
Two AI systems got out of their test environments this summer
Now the story I actually think is the biggest, and it is not a rumor. Two separate labs, two confirmed incidents, both disclosed by the companies themselves.
OpenAI, July. During an internal security evaluation, two of its models broke out of the sandbox they were being tested in. They found and exploited a previously unknown vulnerability in a self hosted package registry proxy, got to the open internet, and compromised Hugging Face’s production infrastructure. Hugging Face is the site where most of the world’s AI models are stored and shared, so this is not a small target. The motive is the part that sticks with me: the models were doing it to steal the answers to the benchmark test they were being graded on. Hugging Face later reconstructed roughly 17,600 actions taken between July 9 and July 13. Eight security vulnerabilities were published later that month as a result, credited to OpenAI.
Anthropic, prompted by the OpenAI news. Anthropic went back and reviewed 141,006 of its own evaluation runs where a model could conceivably have gotten internet access. It found three incidents where Claude models, specifically Opus 4.7, Mythos 5, and an unreleased internal test model, reached out of the test environment and gained unauthorized access to the production systems of three real companies. The models had been told in the prompt that they had no internet access. A misconfiguration at a third party testing partner meant they did.
Read how it happened, because this is where it stops being an AI story and starts being an IT story. The models were running a capture the flag exercise, which is a standard security training game where you break into a machine to retrieve a hidden piece of information. When the search wandered onto real systems on the open internet, the model had no way to know those were not part of the game, so it treated them as fair targets. And then it got in, using what Anthropic describes as basic techniques: weak passwords and endpoints sitting on the internet with no authentication on them at all.
Nothing was stolen. Anthropic notified the affected organizations, moved roughly 150 engineers onto security and reliability work, and froze changes to the environments in question for a month. OpenAI brought in outside firms to validate what its models had done. Both labs have rebuilt their containment.
Two things worth saying plainly. First, neither of these is a model that decided to break free. Both are models doing exactly the task they were given, extremely well, inside a fence that turned out to have a hole in it. That is arguably worse, because it means the failure was ours and not theirs. Second, and this is the part for every business owner reading: the three companies that got breached were not compromised by some exotic AI superpower. They were compromised by weak passwords and services left open with no login. The AI just happened to be the thing that found them first, at machine speed, while nobody was looking. That is the same list of basics we talk about on the radio every month, and it is now being checked by something that never gets tired. We wrote about the same underlying lesson from a different angle in supply chain attacks and your blast radius.
And then, yesterday, a new Claude
Anthropic released Claude Fable 5.1 on September 1, which is the sequel to the model I got a little carried away about in July (see the AI model the federal government banned if you missed that saga).
The benchmark jumps are large. On a science focused agentic test, it went from 24.7 percent to 52.6 percent, more than doubling. Long running office tasks and coding improved substantially too.
The real headline for a business is the price. The sticker price per token did not change, but the cost of re reading context it has already seen dropped by 75 percent, and the model needs fewer steps to finish the same job. Anthropic’s own estimate is roughly 25 percent cheaper for typical work and up to about 45 percent cheaper for the heavy agentic work where you turn it loose on a long task. That is the direction that matters. The capability is getting better and the cost of using it that way is falling at the same time.
Two other pieces tie this back to everything above. Fable 5.1 shipped with tightened cyber safeguards built in direct response to the sandbox incidents, including a model that can find software vulnerabilities but is restricted from writing working exploits for them. And it is the first Claude model to invisibly watermark its own text output, so AI written content can be identified later even after it has been copied, pasted, and lightly edited. That one is going to matter in schools, in hiring, and in every argument about who actually wrote something.
What I would actually do with this
You do not need to buy an agent this month. But if you run a business here, three things follow from all of this.
Decide what you would trust an agent to do before somebody in your office decides for you. The teach it by recording feature means the person most likely to set one of these up is not you and not your IT provider, it is the employee who is tired of doing expense reports. That is not a bad thing. It is a thing you want to know about, with a rule about which accounts are in scope.
Ask what model is doing the work. If a vendor cannot tell you, that is an answer.
And go fix the boring stuff. The single most useful sentence out of all four of these stories is that the real companies got breached through weak passwords and services left open to the internet. AI did not invent a new way in. It just made finding the old way in fast, cheap, and tireless.
If you want a second set of eyes on which of your systems are sitting open right now, or help thinking through where an agent fits in your business without handing over the keys to everything, reach out to DarkHorse IT.
We talk through this kind of thing every week. Join us Thursdays at 7:40 AM on KFGO 790 AM.