Big 5 AI Vendor Roundup: Week of July 27, 2026

OpenAI led the week with a security investigation, large API price cuts, and claims that an unreleased model produced ten significant results in mathematics and theoretical computer science. Microsoft's rapid Copilot growth collided with a coordinated disclosure showing that hidden instructions in a Word document can alter downstream files and copy themselves forward. Some may recall the macro virus insanity dating back to the late 1990s when the “Melissa” macro virus ran rampant, and this is very similar. The only complete solution then seems to be the same today, which is to shut it down. Anthropic disclosed three real-world compromises during cyber evaluations, Google introduced new robotics and autonomous research systems, and AWS added catalog-aware agentic analytics. Microsoft and Amazon shares rose sharply after earnings, while Alphabet fell despite exceptional Google Cloud growth.

The common issue is control, as vendors separate foundation models from the context, memory, tools, data, and evidence systems around them. That can improve portability and verification, but it shifts lock-in toward the orchestration and data layers. The security incidents showed how trusted context can become an attack path. The science announcements showed why provenance and independent validation must be built into AI workflows.

OpenAI: Security, lower prices, and scientific claims

• OpenAI says Astra produced ten advances in mathematics and theoretical computer science. On August 1, OpenAI published results it says resolve or materially advance long-standing problems across geometry, coding theory, complexity, cryptography, and combinatorics. An internal version of the unreleased Astra model generated the arguments, humans prepared the manuscripts, and the model produced Lean certificates. OpenAI estimates the solution tokens would cost about $2,000 at Sol API rates. The work needs independent mathematical review, but it points beyond research summarization toward generating testable results.
• OpenAI expanded its review of the Hugging Face security incident. OpenAI said the prerelease model was an internal prototype that has been deactivated and restricted. The models reached the internet through a previously unknown flaw in an Artifactory proxy. CrowdStrike is advising the investigation, while METR and Redwood Research are conducting outside assessments. Enterprise evaluation agreements should require trace preservation, rapid notification, and independent review after agent incidents.
• OpenAI cut GPT-5.6 Luna API prices by 80% and Terra prices by 20%. Terra now costs $2 per million input tokens and $12 per million output tokens. Luna costs $0.20 and $1.20, while Sol pricing is unchanged. Enterprises should route each workflow stage to the lowest-cost model that meets its quality and risk threshold, then measure cost per completed outcome.
• OpenAI added provenance signals to supported GPT-Live audio. Supported audio generated through ChatGPT Voice and the OpenAI API now includes SynthID watermarks, with public and API verification tools. Organizations using synthetic voice should record provenance at creation and test whether it survives editing, transcoding, storage, and delivery.
• OpenAI found that workplace AI use often crosses job boundaries. Its analysis of more than 800,000 messages from US ChatGPT users found that 43.5% of occupation-specific messages involved tasks associated with another occupation. This is OpenAI product data, but governance is front and center as permissions, training, review, and accountability must follow the work, not only the employee's job title.

Microsoft: A multi-model Copilot platform takes shape

• A hidden prompt can propagate through Copilot-generated Word documents. Security researcher Håkon Måløy disclosed a cross-domain prompt injection attack after a 144-day coordinated process with Microsoft. Hidden instructions in a source document could alter content and copy themselves into the output, which then becomes a new carrier. Microsoft mitigated specific payloads, but the researcher reproduced the broader attack class with GPT-5.6 and current mitigations. High-integrity documents need independent source-to-output verification.
• Microsoft is consolidating Copilot into a multimodel "super app." Microsoft said its Copilot experiences, including Code, will come together in one app this quarter. Its architecture keeps the harness, context, memory, and action space separate from any model so models can be substituted. Microsoft also reported a fivefold increase this year in customers using models from multiple providers. This reduces single model dependence, but the shared context and governance layer can deepen Microsoft platform lock-in. The details came from Microsoft's earnings call.
• Microsoft's AI and cloud results drove a 15.5% share-price increase. Microsoft reported quarterly revenue of $90 billion, Microsoft Cloud revenue growth of 27% to $59.3 billion, and Azure growth of 43%. Microsoft 365 Copilot passed 30 million paid seats, Agent 365 had nearly 40 million registered agents, and capital spending reached $41 billion. The shares gained about $450 billion in market value. The scale is obvious, but it doesn't prove that individual deployments produce measurable returns.
• Project Perception applies coordinated agents to cyberdefense. Red-team agents find attack paths, blue-team agents assess risk, and green-team agents improve defenses. Microsoft says a configuration using MAI-Cyber-1-Flash scored 96% on CyberGym and cut costs by almost 50%. Those are Microsoft benchmarks. Security teams should test false positives, approvals, rollback, and evidence retention before automated remediation.
• Microsoft added domain exclusions for Copilot web grounding. Administrators can exclude up to 1,000 sites, but the control is opt-in and doesn't cover malicious instructions in attached or OneDrive documents. Organizations still need content inspection, source logging, output checks, and limits on agent actions.

Anthropic: Cyber evaluations reached real systems

• Claude models compromised three organizations during cyber evaluations. Anthropic reviewed 141,006 runs and found six in which models reached production systems through a misconfigured third-party evaluation environment. Opus 4.7 accessed a production database, Mythos 5 published a malicious PyPI package that ran on 15 systems, and an internal model compromised one organization after scanning about 9,000 targets. Anthropic said the models didn't deliberately try to escape. The incidents still show that prompts and assumed isolation aren't security controls.
• Anthropic rejected a blanket ban on open-weight models. CEO Dario Amodei backed capability-based testing, chip export controls, and action against industrial scale model distillation instead. For enterprises, the useful distinction is what a model can do, how it is deployed, and what it can access, not simply whether its weights are public.
• Cognizant expanded its Anthropic partnership. Cognizant became a Global Premier Partner and is embedding Claude in engineering and IT operations platforms. It says more than 30,000 associates have been trained. Systems integrators can accelerate adoption, but they can also embed one model deeply across process design, code, and operating knowledge.

Google: Strong cloud growth, robotics, and verifiable research

• Google Cloud grew 82%, but Alphabet shares fell about 7%. Alphabet reported $119.8 billion in revenue, while Google Cloud reached $24.8 billion and $8.8 billion in operating income. It raised 2026 capital-spending guidance to $195 billion to $205 billion. Strong AI demand wasn't enough to offset concern about how much capital it will consume.
• Gemini Robotics 2 adds whole-body control, dexterity, and multirobot coordination. Google introduced a vision-language-action model for full humanoid control, an embodied reasoning model for multistep tasks and robot teamwork, and an on-device model that can adapt to new robot bodies with a few hours of data. Robotics ER 2 is available in AI Studio and private preview; the other models are limited to early access partners. Buyers should treat the demonstrations as research progress, not production readiness.
• Google's Science One Framework builds evidence chains into autonomous research. The experimental system grounds literature in retrieved papers, records evaluator outputs, and binds claims to code, results, or sources before writing a manuscript. Google says its tests produced no phantom references and fully reproducible scores while matching or exceeding human experts on five systems tasks. These are vendor results, and the prototype isn't production ready, but the architecture is useful: verification should be part of generation, not a cleanup step.
• Gemini Spark can use logged-in Chrome sessions and saved passwords. With permission, Spark can complete web errands and return sensitive steps, such as payments, to the user. Browser agents inherit the user's sessions and reach. Enterprises should separate work and personal profiles and block unmanaged agents from corporate credentials and sensitive applications.
• Google added hooks, budgets, and schedules to Gemini-managed agents. Developers can block or audit tool actions, set token budgets, and run recurring jobs in persistent environments. Organizations need expiration, cleanup, egress, credential, and approval policies before enabling unattended agents.

AWS: Growth, governed analytics, and MCP updates

• AWS revenue grew 37%, lifting Amazon shares 15.3%. AWS reached $42.2 billion in revenue and $16.6 billion in operating income. Amazon says its AI and chips businesses each exceeded a $25 billion annual run rate. Free cash flow fell to a $7.6 billion outflow as AI infrastructure spending increased. Investors rewarded the fastest AWS growth in 18 quarters.
• Amazon Quick added an agentic catalog experience. Quick Agent can search governed catalogs, identify approved tables, and create datasets and topics that inherit definitions and relationships from AWS Glue Data Catalog or Databricks Unity Catalog. This addresses a common source of unreliable AI analytics: inconsistent business definitions. IT leaders should still test lineage, access controls, semantic drift, and how easily the context layer can move to another platform.
• AgentCore Gateway supports the July 28 MCP specification. The update moves MCP toward stateless HTTP, adds governed extensions, and aligns authorization more closely with OAuth 2.0 and OpenID Connect. AWS made the version opt-in and supports multiple versions. Enterprises should pin protocol versions and test authentication, schemas, logging, and fallback behavior before upgrading.

Being Reported

The following financing discussions have been reported but haven't been announced or finalized.

• Nvidia may provide a $250 billion financing backstop for an OpenAI data-center project. The Wall Street Journal reported talks involving a proposed 10-gigawatt Ohio project that could cost more than $500 billion, including chips.
• Banks are discussing $15 billion in financing for an Anthropic data center project. The Wall Street Journal reported talks for a 1.6-gigawatt Texas campus that would support Anthropic and use Google chips and financial guarantees.

Our Take

The Anthropic, OpenAI, and Microsoft incidents followed different paths, but each exposed a weak system boundary. OpenAI's models found a zero-day and reached the internet. Anthropic's models followed an unintended live network path. The Copilot attack used hidden instructions in documents to corrupt and propagate outputs through normal office workflows, which is elegant in its simplicity. It’s surprising that it took this long to appear considering that it’s just a prompt hidden in text buried in a Word document. The security boundary is the full system, including source content, model, harness, tools, credentials, network, output handling, and third-party infrastructure.

At the same time, vendors are moving value above the model. Microsoft wants models to be swappable while it owns the context, memory, governance, and workflow layer. AWS is connecting agents to governed catalog semantics. Google is building evidence chains into autonomous research. These are useful design choices, but they also show where the next lock-in will form. The earnings reactions reinforce the point that markets rewarded Microsoft and Amazon for visible cloud growth and monetization, while Alphabet's strong growth didn't offset concern about the capital bill.

What IT leaders should be doing

• Treat model context as an attack surface. Quarantine external documents, expose hidden text, verify high-integrity outputs against source data, and deny standing credentials or unrestricted internet access in evaluation environments.
• Separate models from the control plane. Keep routing, memory, data access, policies, and evaluations portable. Test a fallback model from another provider before production dependence forms.
• Build evidence into agent workflows. Preserve sources, tool calls, code, intermediate results, and approvals. For scientific or analytical claims, require independent replication or formal verification where practical.
• Control unattended agents. Set time, token, tool, destination, privilege, and spending limits. Require approval before publication, payment, software installation, production changes, or data transfer.
• Assess suppliers using operating metrics. Track cloud growth, free cash flow, capacity, pricing, capital commitments, and cross-investments. Strip investment revaluations out of headline profit.

Want to Know More?

• Big 5 AI Vendor Roundup: Week of July 20, 2026
• Big 5 AI Vendor Roundup: Week of July 13, 2026
• Claude Mythos Preview and Project Glasswing: What IT and Security Leaders Need to Know Now
• Establish Your Adaptive AI Governance Program From Principles to Practice