The Executive Briefing — Friday, October 23, 2026

Meta Discloses $454.52 Billion in Commitments and $355.73 Billion in Leases Yet to Begin as Quarterly Capital Spending Hits $34.91 Billion

Meta has long told investors that the AI build out is a long game. On Thursday its paperwork showed how long. Bloomberg reported that Meta has agreed to spend about $825 billion in the future on various leases and contracts, a figure drawn from the company's quarterly filing. That is not a capital budget. It is a stack of signed obligations that will shape Meta's cost structure into the next decade regardless of what happens to AI sentiment in any single quarter.

The components are spelled out in Meta's Form 10-Q for the quarter ended September 30. Approximately $355.73 billion of operating and finance leases had not yet commenced at quarter end. Those leases cover data centers, energy related infrastructure, colocations and network infrastructure, they begin through 2036, and they carry terms of up to 30 years. Separately, Meta reported $454.52 billion of non cancelable contractual commitments, mostly tied to third party cloud capacity, servers and network infrastructure, energy agreements for data centers, and Reality Labs hardware. Approximately $45.85 billion of that is due in 2026 and $121.41 billion in 2027. On top of both, Meta disclosed contingent obligations to buy up to $14.72 billion of cloud capacity over five years, an amount that can shrink if the provider resells the capacity to other customers.

The operating results released on Wednesday explain why management is comfortable with that exposure, and also why the market is watching it closely. Third quarter revenue was $64.60 billion, up 26% year over year. Capital expenditures, including principal payments on finance leases, were $34.91 billion in the quarter alone. Meta narrowed its 2026 capital expenditure outlook to a range of $135 billion to $145 billion, up from a prior range of $130 billion to $145 billion, by lifting the bottom of the range. Fourth quarter revenue guidance sits at $73 billion to $76 billion.

The cash flow line is where the commitment curve becomes visible. Operating cash flow was $32.79 billion, and free cash flow was negative $2.12 billion. The quarter also absorbed a $9.89 billion charge tied to Meta's agreement with state attorneys general, which pushed diluted earnings per share to $3.83, and full year 2026 total expense guidance now runs from $175 billion to $179 billion. Meta still held $82.45 billion in cash, cash equivalents and marketable securities at quarter end, while headcount fell 15% year over year to 66,775. The company is spending more on machines and less on people, in plain sight.

Meta also announced a new class of nonvoting Class C common stock alongside the results. Whatever its other purposes, a new listed share class gives the company another instrument to fund a program of this scale. Mark Zuckerberg, Meta's founder and chief executive, framed the quarter without hedging: "Our investments are paying off, the core business is strong, and we're seeing velocity across the board."

For enterprise buyers, the lesson is less about Meta than about the market Meta is helping to set. When one company commits hundreds of billions of dollars to data center leases, cloud capacity and energy contracts running out to 2036, it absorbs supply that every other buyer of compute, power and colocation is competing for. Long dated commitments of this kind tend to keep the markets for those inputs tight even when sentiment about AI investment wavers. They also mean the hyperscalers and the largest model builders are now, functionally, utility customers with fixed obligations rather than discretionary spenders who can pause at will.

The Agentic AI Foundation Takes In Agent Skills, Open Responses, OpenEnv and OpenSandbox and Says It Now Hosts 10 Projects

The plumbing of agentic AI took another step toward neutral ownership on Thursday. Speaking from San Jose during AGNTCon + MCPCon North America, the Linux Foundation announced that the Agentic AI Foundation (AAIF) had accepted four new hosted projects: Agent Skills, contributed by Anthropic; Open Responses, contributed by OpenAI; OpenEnv, contributed by Hugging Face; and OpenSandbox, contributed by Alibaba. According to the Linux Foundation, the additions take the foundation to 10 projects, up from the three it launched with.

Those three founding projects, the Model Context Protocol, goose and AGENTS.md, arrived when AAIF launched in December 2025. The four newcomers join them alongside Agent2Agent (A2A), Agent Router and agentgateway, all under the foundation's vendor neutral governance. Manik Surtani, CTO and cofounder of the Agentic AI Foundation, summed up the year: "A year ago, AAIF launched with three projects and a bet that agentic AI needed a neutral home to thrive."

Each new project fills a distinct layer. Agent Skills is an open format for giving agents new capabilities and domain expertise, packaging instructions, scripts and resources that agents load on demand. Open Responses is an open specification for building multi provider, interoperable LLM interfaces, based on the OpenAI Responses API. OpenEnv is an open framework and community hub for creating reinforcement learning environments, exposed as a containerized service using MCP and Gym interfaces. OpenSandbox is a general purpose sandbox platform for AI applications, with multi language SDKs and Docker and Kubernetes runtimes. Read together, they cover how an agent learns a task, how it talks to models from different vendors, how it is trained and evaluated, and where it runs safely.

The contributor list matters as much as the code. Anthropic is now handing another building block of its agent tooling to a neutral home. OpenAI placing an interface specification derived from its own Responses API under shared governance is a notable concession for a company whose API shape has long served as a de facto standard. Alibaba contributing the sandbox layer means the execution environment, the part security teams worry about most, now has a vendor neutral reference that spans Western and Chinese developers.

Commerce shows why this layer is suddenly urgent. A day earlier, TechCrunch reported that Walmart launched Agent Gateway, an MCP server that lets approved AI agents search its online inventory and make purchases on behalf of customers. Walmart's Agent Profiles, rolling out in November, keep each agent's purchases separate and let customers require approval for every transaction or pre authorize spending within a limit. TechCrunch also reported that Amazon has begun blocking AI agents from making purchases for shoppers. Walmart and Amazon have taken opposite positions on agent access, and the protocols deciding how that access works are exactly the ones moving under AAIF governance.

The practical effect is that the interfaces enterprises build against are hardening into shared specifications rather than vendor features. That lowers lock in risk for teams that standardize on them, and it raises the cost of building bespoke agent plumbing that will need to be rewritten when the standards settle.

Treasury Proposes COINS Act Rules That Would Bar U.S. Investment in Foreign Super Intelligence Developers in Countries of Concern

The rules governing where American money may follow AI abroad moved from statute to draft regulation on Thursday. The U.S. Department of the Treasury issued a notice of proposed rulemaking to implement the Comprehensive Outbound Investment National Security Act, known as the COINS Act, which was enacted on December 18, 2025 as part of the Fiscal Year 2026 National Defense Authorization Act. The outbound investment program it expands began in 2023 under an executive order from President Joe Biden, the Associated Press reported. The COINS Act turns that program into law and widens it.

The proposal covers six technology sectors: semiconductors and microelectronics, super intelligence systems, quantum information technologies, high performance computing and supercomputing, hypersonic systems, and biotechnology. Biotechnology was added by Treasury Secretary Scott Bessent under authority the Act grants. The countries of concern named in Treasury's fact sheet include China, including Hong Kong and Macau, as well as Russia, North Korea, Iran and Cuba. The rule would apply to U.S. persons, including their controlled foreign entities.

The most consequential change for the AI industry is a matter of tiers. According to Treasury's fact sheet, the draft would prohibit covered transactions by U.S. persons involving entities in countries of concern that develop any super intelligence system, eliminating the existing notification requirement for those transactions. The terminology itself is new: the fact sheet says the draft uses "super intelligence systems" in place of "AI systems," following Executive Order 14434 of September 29, 2026. For investors, the shift from notify to prohibit removes the gray zone that let some funds take positions in foreign AI developers while simply reporting them.

The mechanics are detailed. Notifiable transactions would have to be reported within 30 days after completion. According to Treasury's fact sheet, a $50,000 aggregate de minimis exception applies to the notification requirement, and a limited partner exception covers committed capital of $2 million or less. The Associated Press reported that the proposal would exclude many financial investments, including stock purchases. Violations would carry civil penalties up to the maximum allowed under IEEPA, and Treasury could compel divestment of prohibited transactions.

Secretary Bessent framed the proposal in national security terms: "Under President Trump's leadership, we are committed to putting America's national security first." Christopher Pilkerton, Assistant Secretary of the Treasury for Investment Security, was also quoted in the announcement. Public comments are due December 7, 2026 through regulations.gov, and the COINS Act directs Treasury to issue implementing regulations within 450 days of enactment.

For enterprises, the immediate exposure is narrower than the headline suggests but broader than most compliance teams assume. Corporate venture arms, strategic partnerships that include equity, joint ventures, and fund commitments by controlled foreign subsidiaries can all fall inside the definitions. The comment window is the moment to raise ambiguities about what counts as developing a super intelligence system, because that definition will determine whether a minority stake in an applied AI company abroad is reportable, prohibited, or out of scope.

There is also a timing problem worth naming. Deals that close during the comment period and before the final rule are not in a safe harbor simply because the rule is unfinished, since Treasury's fact sheet says the existing Part 850 regulations continue to apply to covered activity until the final rule takes effect. Boards that treat the proposal as a distant event risk discovering, after the fact, that a transaction they approved this winter sits on the wrong side of a line Treasury has already drawn in public. The prudent posture is to read the draft as the likely destination and to structure new commitments accordingly.

Microsoft Ties the ConnectWise Breach to Storm-0940 and an Agentic Hacking Framework It Says Reached Privileged Access in Under Three Hours

Security leaders have long warned that attackers would eventually hand the keyboard to AI agents. On Wednesday Microsoft published a case file showing it has happened at scale. Microsoft Threat Intelligence assessed that Storm-0940, a China state aligned actor active since 2021 that targets organizations across industries for data theft, was responsible for the recent supply chain compromise of ConnectWise's multi tenant cloud backup application. The tool doing much of the work was ARTEX, an open source, multi agent LLM penetration testing framework written in Go that can use any AI model to run an intrusion from reconnaissance through data exfiltration.

The speed is the headline. Microsoft says that as early as September 2026, Storm-0940 used ARTEX to automate attacks against hundreds of organizations worldwide, in sectors including aerospace and defense, energy, financial services, government, legal, semiconductors and think tanks. Microsoft observed multiple instances in which the time from initial targeting to privileged cloud access was less than 3 hours. After the unauthorized ConnectWise access, the actor used ARTEX to attempt sign ins to more than 2,250 tenants.

The run up was noisy. Between October 10 and 14, Storm-0940 infrastructure ran an automated password spray against 327 accounts across eight organizations. Microsoft telemetry captured more than 151,000 failed logon events, peaking on October 11 at 2,900 failures per minute, with more than 111,000 failures in a single day. Forty eight accounts received more than 1,000 failures each, lockout responses made up nearly 98% of the activity, and Microsoft observed no successful authentication from that spray. Public reports of the ConnectWise compromise surfaced on October 15, and ConnectWise published its initial advisory on October 16.

The successful path did not need passwords at all. According to Microsoft, AI agents operating for Storm-0940 used compromised ConnectWise application identities to authenticate into customer tenants through apps that had already been granted access. In some environments they went on to Microsoft Graph reconnaissance, application credential changes and privileged role changes, the kind of persistence that can survive after the original application is cleaned up.

Microsoft was careful on two points. The activity did not result from a compromise of or vulnerability in Microsoft systems, and a successful authentication does not necessarily mean customer data was accessed. Its guidance is specific: preserve evidence before deleting enterprise applications, review activity from at least October 15 and service principal sign ins back to October 1 where records exist, and only then remove unauthorized credentials and rotate secrets.

The broader lesson is about trust that was granted once and never revisited. Third party applications with tenant wide permissions are standing doors, and an agentic attacker can test every one of them at machine speed, around the clock. Defenses built on the assumption that a human operator needs days to move from foothold to privilege no longer hold when the gap is measured in hours.

What makes this case different from earlier AI assisted intrusions is the division of labor. The human operator chose targets and supplied stolen application identities; the agents did the repetitive, parallel work that used to consume an operator's week. That model scales with compute rather than headcount, which means the volume of attempts against any single enterprise is likely to rise even if the number of skilled adversaries does not. Detection that depends on spotting a human pattern of behavior will struggle against agents that never sleep and never repeat themselves exactly.