North Korea-linked adversary poisoned 131 AI packages on Microsoft's npm

Oppenheimer initiated coverage of cybersecurity firm SailPoint with an Outperform rating and a $30 price target, sending shares up 1.3% in premarket trading on Wednesday. Analyst Ittai Kidron wrote that SailPoint offers differentiated technology well-positioned for a critical role in AI agent identity security, and that AI security adoption offers meaningful upside versus management's FY29 ARR target that is mismodeled by consensus. Kidron noted that strong management execution could drive share appreciation despite the roughly 85% ownership overhang from private equity firm Thoma Bravo, and said a strategic buyer may emerge if the valuation discount versus peers persists. He added that SailPoint's shift to software-as-a-service from on-premises represents roughly $1B in incremental annual recurring revenue, which could pressure near-term reported revenue and free cash flow but strengthens recurring revenue growth and long-term margins. Over a 12-18-month horizon, Kidron said he anticipates AI security proof points to emerge along with positive revenue and ARR revisions and multiple expansion toward the 11x multiple embedded in his price target.

Mysten Labs, the developer of Sui, announced on October 6 a joint development plan with Google Cloud. The two will build Verifiable Agent Arbiter, or VAA, a platform that uses blockchain to prove that AI agents acted within the scope of the authority granted to them. VAA links the operations an agent is permitted to perform, its actual actions, and their outcomes into a record, so that counterparties and auditors can verify the record independently of the system that ran the agent. Instructions given to the AI, its outputs, its use of external tools, and decisions based on internal rules are stored privately in customer-managed Google Cloud storage, while cryptographic proofs corresponding to the records are stored on Walrus, a data storage platform, with Sui handling the management and linkage of those proofs. In addition to handling disputes in business-to-business transactions and investigating the causes of suspicious operations, the plan also includes integration with Sui's mechanism for AI agents to pay usage fees for external services under the x402 payment standard.

Paramount Skydance announced on Tuesday, October 6, that it had completed its acquisition of Warner Bros. Discovery, creating a giant company under the name Skydance that brings together two century-old Hollywood studios, two global streaming services, and two major American news organizations under one roof. Meanwhile, Anthropic announced it is expanding a special program that allows vetted cybersecurity experts to access and test the company's most powerful artificial intelligence models under relaxed safeguards on the models themselves, after its Project Glasswing collaboration helped detect more than 100,000 software vulnerabilities worldwide this year. Separately, Nippon Group Holdings, a major Japanese books and publishing group, acknowledged that one of its affiliates sold a large number of books to Anthropic, the American artificial intelligence developer, amid concerns in Japan's publishing industry that the books may have had their spines cut off so they could be scanned into digital data for training AI models and may be destroyed afterward. In Japan as well, the Japan Fair Trade Commission raided four major beer makers that together hold more than 90% of the market today, October 7, on suspicion of colluding to set wholesale beer prices, which would violate antitrust law.

U.S. artificial intelligence company Anthropic announced on the 6th that it will restructure its certification program for using its AI models in cybersecurity-related work. As a result, individuals engaged in security-related research will also be able to register, allowing more organizations and others to use its most advanced model, Claude Mythos 5.1, which has a strong ability to discover software vulnerabilities. The company will integrate its existing certification program with Project Glasswing, a framework announced in April for accrediting organizations that can use Mythos. Users will be divided into three tiers according to how they use the model. The lowest tier can include small security firms, universities, and individuals, who can use models such as Mythos for defensive work such as vulnerability analysis. The highest tier is intended for organizations responsible for critical infrastructure such as transportation and finance, and they can conduct high-risk security testing and similar work.

CrowdStrike expanded its Google Cloud relationship on September 1, announcing Falcon capabilities designed to protect enterprise AI applications against prompt injection, sensitive-data leakage, and malicious AI activity through Google's Agent Gateway, alongside broader connections between Falcon and Gemini Enterprise. The move follows a fiscal second quarter in which revenue rose 26% year-over-year to approximately $1.47 billion, annual recurring revenue reached approximately $5.84 billion, up 25%, and net new ARR added during the quarter totaled $332.8 million. ARR from customers using Falcon Flex exceeded $2.29 billion, up 101% from a year earlier, while operating cash flow increased to $530.3 million from $332.8 million and free cash flow rose to $377.4 million from $283.6 million. Management raised its full-year fiscal 2027 net new ARR growth outlook to 34% at the midpoint. Jim Cramer highlighted CrowdStrike on Mad Money on October 1, noting the stock rallied 39% and that the Charitable Trust owns it, though the company still trades at roughly 210x forward earnings versus 96x for Palo Alto Networks and reported a $33.2 million GAAP operating loss against $371.6 million in non-GAAP operating income. Legal exposure from the July 2024 outage remains unresolved, with discovery ongoing in Delta's lawsuit and the company disclosing requests for information from the Justice Department and SEC concerning revenue recognition, ARR reporting for certain customers, and the outage.