Key takeaways
- Meta Opens the Books on Prometheus and Shows That Reliability, Not Chips, Now Sets the Pace of Frontier AI. Stop buying AI capacity on peak FLOPS alone. Ask every provider for goodput, mean time between interruptions, spare ratios and recovery playbooks, and price the roughly 13 percent over provisioning that Meta disclosed into your own capacity plans. The vendors that can answer with numbers are the ones that will deliver the training runs you are paying for.
- Microsoft Treats AI Agents as Insiders, Scoring Every One for Risk and Stripping Their Powers in Real Time. Inventory every agent running on employee machines now, before a vendor does it for you, and give each one its own identity, owner and least privilege scope. Whether or not you buy E7, adopt the graduated model Microsoft describes: reads stay open, writes require trust, consequential actions require a human, and anything anomalous gets isolated automatically.
- DHS Orders DeepSeek Out of Federal Civilian Systems, Including Any Third Party Product Built on It. Build a model bill of materials for every product you sell to government or regulated customers, identifying each underlying model and its origin. If any component relies on DeepSeek implementations, plan the replacement now; the civilian exception window is short, requires a compelling justification, and runs from an order that was already months old when it was published.
- One Hacker, an Open Source Agent Platform and More Than 100 Breached Companies: NorForge Exposes the Cairn Campaign. Assume continuous, low cost, automated probing of every internet facing asset you own, including vendor run and support sites. Shorten patch cycles on public web properties, hunt specifically for uploader web shells, and rotate any credential that touches agent tooling. Budget for defense that runs at agent speed, because the attacker's cost per attempt is now measured in dollars.
Welcome to the DX Today Executive Briefing
The story of enterprise AI this week is a story about control. The largest operators are publishing how they keep a million GPU ambition from collapsing under its own failure rate, the largest software vendor is rebuilding identity security around the assumption that its own agents may misbehave, Washington has finally shown its hand on a Chinese model it has been quietly purging, and a single researcher has documented what happens when attack agents are left to run unsupervised. Each one moves a line item from the innovation budget to the risk register.
In this edition, Meta opens the operating numbers behind Prometheus, its gigawatt scale supercluster in Ohio. Microsoft introduces dynamic risk scoring and graduated containment for AI agents it now calls agentic insiders. The Department of Homeland Security publishes an order removing DeepSeek and anything built on it from federal civilian systems. And NorForge exposes a campaign in which one hacker's agents broke into more than 100 company websites on an open source platform called Cairn.
01
Meta Opens the Books on Prometheus and Shows That Reliability, Not Chips, Now Sets the Pace of Frontier AI
Meta published a detailed engineering account of Prometheus on its Engineering at Meta blog on October 19, describing the gigawatt scale supercluster it is building in New Albany, Ohio. The first phase is complete, and Meta says it is working toward scaling the site to roughly 1 million GPUs. Today the cluster already comprises hundreds of thousands of GPUs spread across multiple interconnected buildings, a mix of traditional data center halls, AI optimized buildings and rapid deployment structures that Meta has stitched into a single training fabric.
The first phase has already done real work. Meta says it was used to train its Muse foundational models, including the Muse Wonder models. That makes this disclosure unusual: rather than a capacity announcement or a capital expenditure figure, it is a post mortem on what it actually took to keep a frontier training run alive at this scale.
The headline numbers are about uptime, not throughput. Meta reports more than 85 percent goodput for pre training runs and more than 90 percent goodput for reinforcement learning runs of Muse Wonder. Mean time between interruptions reached about 47,000 GPU hours during those runs, and firmware fixes have since pushed it past 54,000 GPU hours. The starting point was far worse. In mid 2025, according to Meta, interruption rates peaked at nearly 1,000 events per 8,000 GPUs every day. The company says it has since cut interruptions by 99 percent, and its stated north star is two interruptions per 8,000 GPUs per day, roughly 100,000 GPU hours between interruptions.
The reason reliability became the binding constraint is architectural. Meta says moving from the eight GPU NVLink domain of the H100 generation to 72 GPU NVIDIA NVL72 racks increased the fault blast radius by 9X. Its answer is deliberate over provisioning. Each NVL72 rack runs a 64 GPU slice and keeps the remaining eight GPUs as in rack spares, and Meta holds roughly 2 percent additional racks in reserve. In practice, a 32,768 GPU training run requires provisioning 523 NVL72 racks, or 37,656 GPUs, about 13 percent above the active footprint. That is the hidden tax on every frontier model, and it rarely appears in public capacity math.
The physical plant is just as demanding. Meta says each building level Ethernet fabric interconnects up to 20,736 GPUs. Synchronized training produces load swings of 30 to 40 percent, and starting or pausing a major job can shift more than tens of megawatts in seconds, which Meta manages with a cluster wide power capping framework it calls Dynamo Dimmer. Operations have had to industrialize as well: Meta can now push firmware and driver fixes to more than 100,000 GPUs within a few hours, and it has cut the P90 time to upgrade a single pod from more than seven hours to two.
The hardware roadmap keeps moving underneath all of this. Meta notes that the GB300 raises memory per GPU from 192 GB to 288 GB, and that a third Prometheus platform based on NVIDIA Vera Rubin NVL72 is arriving soon. Its next supercluster, Hyperion in Richland Parish, Louisiana, is being designed with the lessons learned in Ohio. Meta also says it pays the full cost of energy for the New Albany site, a pointed answer to the growing public debate over who pays for AI power demand.
For enterprise buyers, the lesson travels well beyond Meta. Every GPU contract, cloud reservation and neocloud commitment now embeds an assumption about failure rates, spares and recovery time, and those assumptions decide how much of the capacity you pay for actually produces a model. Meta has just published a benchmark for what good looks like.
Strategic Takeaway
CIOs, CFOs, and Heads of AI Infrastructure
Stop buying AI capacity on peak FLOPS alone. Ask every provider for goodput, mean time between interruptions, spare ratios and recovery playbooks, and price the roughly 13 percent over provisioning that Meta disclosed into your own capacity plans. The vendors that can answer with numbers are the ones that will deliver the training runs you are paying for.
02
Microsoft Treats AI Agents as Insiders, Scoring Every One for Risk and Stripping Their Powers in Real Time
Microsoft introduced a new class of security controls on October 19 built on a blunt premise: AI agents should be governed like employees who might go rogue. In a post on the Official Microsoft Blog titled Securing the agentic insider, Hayete Gallot, Executive Vice President of Microsoft Security, described agents as agentic insiders, and Microsoft rolled out Dynamic Agent Risk and Dynamic Conditional Access for agents as new capabilities in Microsoft 365 E7 and Project Perception, the agentic security system it first introduced in July.
The framing follows an essay that Microsoft Chairman and CEO Satya Nadella published on October 10, urging companies to treat AI models as insider risks and to place safeguards outside the model rather than trusting the model to police itself. Gallot carried that argument into product. Her post says Microsoft will need Guardian Agents that watch and moderate every action of every agent before it happens, around the clock. On the question of whether better model interpretability will eventually make all this unnecessary, she was direct: "Model transparency will not replace containment."
The technical detail came from a companion post on the Microsoft Security blog by Nadim Abdo, Corporate Vice President for Identity and Network Access. Discovery comes first. Microsoft is expanding detection to 35 additional types of local agents, bringing the total to 60 supported local agents, including Claude Code, OpenAI Codex and GitHub Copilot. That matters because the most capable agents in most enterprises today were installed by developers on their own machines, not deployed through a central process.
Dynamic Agent Risk then assigns each agent a continuously updated score built from identity, data, endpoint, cloud, network and runtime signals, plus the agent's own activity. As the score rises, the response is graduated rather than binary. Microsoft says the system should preserve safe reads while blocking writes, require provable human approval for a consequential step, or isolate and stop the agent when the risk warrants it. That is the same playbook security teams already use for suspicious human accounts, now applied at machine speed.
Two further controls narrow what an agent can do in the first place. Dynamic Permissions scope an agent's access to the approved task and make it time bound, with organization wide policy preventing an agent from ever obtaining authority its user does not have. And Microsoft named the Microsoft Execution Container, a sandbox that creates an enforcement boundary where security controls and observability operate outside the agent's reach.
Commercially, this is Microsoft planting a flag on the control plane for agents. According to GeekWire, the new controls are in private preview with broader availability planned for Microsoft Ignite, which runs November 17 to 20, and Microsoft 365 E7, which launched in May, costs $99 per user per month. The message to enterprise buyers is that agent governance is becoming a premium licensing tier, not a free feature.
The deeper shift is conceptual. For two years the debate about agent safety has focused on making models behave. Microsoft is now betting its security business on the opposite assumption, that models will sometimes not behave, and that the enterprise answer is identity, permissions and containment applied from the outside.
Strategic Takeaway
CISOs, CIOs, and Identity and Access Leaders
Inventory every agent running on employee machines now, before a vendor does it for you, and give each one its own identity, owner and least privilege scope. Whether or not you buy E7, adopt the graduated model Microsoft describes: reads stay open, writes require trust, consequential actions require a human, and anything anomalous gets isolated automatically.
03
DHS Orders DeepSeek Out of Federal Civilian Systems, Including Any Third Party Product Built on It
The Department of Homeland Security published notice in the Federal Register on October 20 of an order that excludes DeepSeek products from federal civilian agency procurements and removes them from civilian agency information technology. The notice went on public inspection on October 19. The signed order, attached as an appendix, was issued from Secretary of Homeland Security Markwayne Mullin and carries an original release date of July 24, 2026, nearly three months before the public notice. Russell Vought, Director of the Office of Management and Budget, is listed as copied.
The legal basis is the Federal Acquisition Supply Chain Security Act of 2018, and the order follows review of a recommendation from the Federal Acquisition Security Council. That is significant on its own. Rather than relying on an executive order or a procurement memo, DHS used the supply chain statute Congress built specifically to purge risky technology from federal systems, which gives the order durable footing and a defined review cycle. The Secretary is required to review it within one year and annually thereafter.
The scope is where enterprises and federal contractors should pay closest attention. The order does not stop at the DeepSeek app or the company's hosted services. It requires removal of DeepSeek and DeepSeek affiliate products and of third party products and services developed using DeepSeek implementations. A vendor that has embedded a DeepSeek model inside a larger product is likely inside the blast radius when selling to civilian agencies.
DHS lays out its reasoning in the order. It states that DeepSeek servers are located in the People's Republic of China, that use by government employees or vendors may result in the transfer of sensitive data to the PRC, and that the models themselves may contain malware or other security vulnerabilities. It also cites outside security research finding that the DeepSeek iOS app contains multiple critical vulnerabilities.
There is a narrow exception path. Under the order, agencies may request exceptions in writing within 60 days of the order's issuance, with a compelling justification, and CISA reviews those requests. Until removal is complete, agencies are encouraged to monitor traffic, implement enhanced logging and data exfiltration controls, and flag anomalous activity. The order applies to federal civilian executive branch agencies but excludes their national security systems and secure compartmented information systems, and it does not reach the Department of War or the intelligence community, which sit under separate authorities.
The practical effect will spread well beyond Washington. Federal procurement rules tend to become the default compliance posture for regulated industries, and the third party clause effectively asks every software vendor a question many cannot yet answer: which models are inside your product, and where did their weights come from? Model provenance has moved from a governance nice to have to a contract requirement.
The timing also lands in a week when security researchers found a possible link between a DeepSeek model and an autonomous hacking campaign, covered in our final story. The two developments are not connected by DHS, but together they show why policymakers increasingly treat the model layer as part of the software supply chain.
Strategic Takeaway
General Counsels, Chief Procurement Officers, and Federal Contractors
Build a model bill of materials for every product you sell to government or regulated customers, identifying each underlying model and its origin. If any component relies on DeepSeek implementations, plan the replacement now; the civilian exception window is short, requires a compelling justification, and runs from an order that was already months old when it was published.
04
One Hacker, an Open Source Agent Platform and More Than 100 Breached Companies: NorForge Exposes the Cairn Campaign
A report published October 19 by Snorre Fagerland, principal threat researcher at NorForge, offers the clearest picture yet of autonomous AI agents conducting real intrusions at scale. Fagerland found control panels for Cairn, an open source AI platform, left exposed on the web, and inside them he could watch what operators had asked their agents to do. According to Reuters, which reviewed the findings, a Chinese speaking hacker used AI agents to break into the websites of more than 100 companies, with the agents attempting more than 1,200 sites.
Reuters identified Deere, SharkNinja and Cummins among the companies hit. Deere said it had taken remediation steps and had no sign that sensitive information was accessed. SharkNinja said the attack hit a standalone product support site. Cummins said it was looking into a possible attack on a website run by one of its vendors. The victims point to the soft edge of the modern enterprise: support portals, vendor sites and legacy web properties that sit outside the main security program.
According to The Next Web's account of the findings, the campaign began on September 25 and Fagerland began finding exposed panels around October 2. NorForge judged more than 20 of the panels likely malicious. The most active group was a Chinese language cluster that NorForge tracked across more than 1,100 attack projects on 14 panels, aimed mostly at organizations in the United States, Japan and Australia, with the apparent goal of persistent access to online commerce and payment systems. NorForge checked one claimed intrusion against a large hardware parts vendor and found a live uploader web shell on the site.
The economics are what should alarm executives. NorForge found that successful projects in that cluster took a little under 23 hours on average from start to goal, and it estimated an average success rate of around 10 percent across the attack harnesses it observed. Fagerland estimated to Reuters that the operation consumed about $5,000 in tokens, roughly $50 per successful hack, while the NorForge report puts the average at about $5 per task when failed attempts are included, and stresses that the figures carry considerable uncertainty. Either way, a capability that once required a skilled team now costs less than a software subscription.
The tooling is equally telling. Cairn tasks in the campaign ran on a worker whose name referenced both Claude Code and DeepSeek's V4.1 Flash model, which NorForge presented cautiously as possible evidence of a commercial coding agent orchestrating DeepSeek's model. Cairn's author, posting on X, said the platform was not designed for hacking. As with most dual use tools, intent at publication offers little protection once the code is in circulation.
The attackers were careless too. NorForge reports that the exposed panels leaked hundreds of credentials and API keys, and that the secret scanning tool TruffleHog verified 11 percent of them as valid. That is a reminder that agent infrastructure, whether run by criminals or by your own teams, accumulates secrets quickly and exposes them just as quickly.
The evidence points one way: autonomous offensive agents have moved from proof of concept to production crime, and they are pointed first at the forgotten parts of the corporate web.
Strategic Takeaway
CISOs, Chief Risk Officers, and Boards
Assume continuous, low cost, automated probing of every internet facing asset you own, including vendor run and support sites. Shorten patch cycles on public web properties, hunt specifically for uploader web shells, and rotate any credential that touches agent tooling. Budget for defense that runs at agent speed, because the attacker's cost per attempt is now measured in dollars.
The Analysis
The Bottom Line
Read together, these four stories describe the same transition from four directions. At Meta, the constraint on frontier AI is no longer just how many GPUs you can buy but how reliably you can keep them working together. At Microsoft, the constraint on enterprise agents is no longer just what they can do but how quickly you can take power away from them. At DHS, the constraint is provenance: knowing which model sits inside which product. And in the Cairn campaign, the constraint on attackers has almost disappeared, because agents now do the patient, repetitive work that once limited how many targets one person could pursue.
The common thread is that control has become the scarce resource. Every organization deploying AI now needs three capabilities it did not budget for two years ago: operational resilience for the infrastructure it relies on, containment for the agents it runs, and a verifiable inventory of the models inside its software supply chain. Those are not innovation projects. They are the cost of staying in the game.
The executives who act first will set the terms their vendors, auditors and regulators measure everyone else against. The ones who wait will learn the requirements from an exclusion order, a breach disclosure or a failed training run.