Legal & RegulatoryDeveloping
May 1: Pentagon signs classified-network AI deals with eight vendors, formally excludes Anthropic
Building on the White House–Anthropic standoff covered in Friday's What to Watch, the DoD on May 1 announced agreements with SpaceX, OpenAI, Google, Microsoft, AWS, Nvidia, Oracle, and Reflection AI to deploy their models inside IL6 and IL7 networks (secret and top-secret). Anthropic is not on the list. The Pentagon's stated rationale is to avoid "vendor lock," widely read as a reference to Claude's prior dominance via Palantir's Maven platform. Onboarding time for new vendors is reportedly down from 18 months to under three.
So what
For portfolio companies serving federal customers, the procurement reset is real and now operational, not theoretical. The strategic message for any growth company building on Anthropic infrastructure: federal classified work is closed for now, but the injunction remains active and Trump's "shaping up" remark suggests the door is not bolted. Update federal-account roadmaps to reflect a multi-vendor stack as the realistic baseline; treat single-vendor strategies for any classified-adjacent buyer as a procurement risk worth flagging in board materials.
Confidence: Established fact — announcement is on the record; vendor list and exclusion confirmed by Reuters, CNN, WSJ, and the DoD release.
Go deeper CNN: Pentagon strikes deals with 8 Big Tech companies after shunning Anthropic · The Rundown AI
TechnologyDeveloping
May 1: OpenAI completes Codex repositioning — from coding tool to general-purpose work agent
Building on the Codex platform expansion held from Friday's edition, OpenAI on May 1 made the repositioning explicit through coordinated messaging from Altman, Brockman, and the Codex engineering lead: the product now connects to Slack, Google Drive, Gmail, and calendar, runs on Mac with native UI affordances, and is being marketed to non-coders. The Deep View characterizes this as the staged rollout of OpenAI's superapp strategy — Codex, ChatGPT, and Atlas browser converging into one surface. The catch-up move is also obvious: Anthropic shipped Claude Cowork in January with a similar feature set.
So what
The agent-surface war is now clearly a two-horse race for knowledge-work distribution: Cowork on the Anthropic side, Codex on the OpenAI side, both trying to own the "daily AI assistant" layer between user and apps. For SaaS leadership teams, the question is not which model to standardize on but how the product surfaces in both. Get specific about what your product looks like as a tool inside a Codex or Cowork workflow — not as a destination app the user remembers to open. The connectors and MCP servers you ship in the next two quarters are the equivalent of mobile-app submissions in 2009.
Hype check
OpenAI's framing of this as a strategic pivot obscures that the substantive feature set is a deliberate copy of Claude Cowork shipped four months earlier; the news is OpenAI's marketing posture, not a product-capability leap.
Confidence: Established fact — corroborated across three independent sources and OpenAI's own posts.
Go deeper The Deep View: OpenAI turns Codex into a daily work agent · Superhuman AI
Technology
May 4: UK's NCSC issues unusual "patch wave" warning as AI-discovered Linux flaw goes public
The UK's National Cyber Security Centre published guidance on May 4 warning that AI-driven vulnerability discovery is now operating at a scale and speed the industry's patching infrastructure was not designed for; the agency advises organizations to assume incoming updates will be critical severity and prioritize internet-facing systems first. Context: Anthropic's Mythos found 271 Firefox zero-days and over 2,000 unknown flaws in seven weeks of testing; over 99% remain unpatched. Last week, Theori's AI scan of Linux's cryptographic code surfaced "Copy Fail," a one-hour-to-find flaw granting root access on every major Linux distribution shipped since 2017.
So what
The window between "flaw discovered" and "flaw exploited" is collapsing from weeks to hours, and most growth companies' patch cadence assumes the older timeline. Ask your CISO three questions this week: how many of our internet-facing systems can be patched within 24 hours of a critical CVE, what legacy systems can no longer be patched at all (and what is the migration plan), and how would we know within hours rather than days if one of our vendors had been breached. This is also a customer-conversation issue: enterprise buyers will start asking suppliers for evidence of accelerated patch SLAs.
Confidence: Established fact for the NCSC guidance and the Copy Fail vulnerability; informed perspective on the broader timing implication.
Go deeper NCSC: Prepare for a vulnerability patch wave · The Neuron