Friday, and the loudest thing in tech this week was a mood, not a fact. The "great September AI panic" spent its energy on superintelligence and existential risk while three quieter, verifiable stories told an operator what actually matters right now: where the money really is, where the attacks really are, and where your tooling is quietly exposed. The throughline is that the boring signals — revenue and attack surface — beat the prophecy.
The revenue gap nobody wants to talk about
The China-is-winning narrative just got a price tag. OpenAI and Anthropic together generate roughly 10 times the annual recurring revenue of every major Chinese AI model combined, according to estimates published Thursday by research firm Rhodium Group. Rhodium put OpenAI's ARR at about $40 billion and Anthropic's at $65 billion, against roughly $4 billion for ByteDance and $2.4 billion for Alibaba. And the valuations run the other way: Rhodium estimated Moonshot at about 50x its ARR and DeepSeek at 163x, versus 34x for OpenAI and 21x for Anthropic.
The operator's take: cheaper, open-weight Chinese models are winning developers on price, but adoption is not revenue, and revenue is what funds the next model. If you're standardizing on a vendor for a three-year horizon, weigh who can actually keep paying to stay at the frontier — not just who's cheapest per token this quarter. Sky-high revenue multiples on thin sales are a warning label, whichever flag they fly.
The AI cyber threat showed up before the sci-fi did
While the discourse chased doomsday, the practitioners pointed at next quarter. Security experts told Axios that an unprecedented wave of AI-powered, human-driven cyberattacks is coming, and that powerful models with advanced offensive capabilities are already letting attackers bypass the human bottleneck that long kept most hacking campaigns from reaching industrial scale. The piece argues the panic that spread from boardrooms to Congress in the last week largely missed this nearer, more concrete risk.
The operator's take: you can't patch a boardroom fear, but you can prepare for scaled phishing, faster exploit development, and more convincing social engineering — because those don't need a superintelligence, just a capable model and an attacker with intent. Assume your attackers are now automating the reconnaissance and lure-writing that used to gate them. The defensive move is unglamorous: enforce phishing-resistant MFA, shrink standing privileges, and rehearse incident response now, not after the first AI-scaled campaign lands in your inbox.
The sandbox running your coding agents had a hole
This one is close to home for anyone shipping with agents. Docker warned that a critical flaw, CVE-2026-77179, allowed malicious code inside a Docker Sandboxes virtual machine on macOS to escape the shared project directory and read or change files anywhere on the host — running with the rights of the account that launched the VM. Docker Sandboxes exists to isolate each AI coding agent in its own small VM; the bug affects versions 0.28.0 up to 0.42.0 on macOS and was fixed in 0.42.0 on September 7.
The operator's take: the whole pitch of running an agent in a sandbox is that a bad tool call stays in the box — a container escape turns that safety story inside out. This is the tax on the autonomous-coding wave everyone's funding: the isolation layer is now security-critical infrastructure, so patch it like it is and track the versions your developers are actually running. Treat "the agent is sandboxed" as a claim you verify, not a checkbox you trust.
Also on my radar
- Snap wants agents on your face at work. Snap is pushing its roughly $2,000 Specs AR glasses into the enterprise, with Salesforce bringing Agentforce, AWS connecting its Amazon Quick assistant, and Nvidia contributing agents built on its XR stack — worth watching if you run field service or retail ops, but no named customers yet.
- Another big credential spill. Gyazo exposed over 23 million user records plus roughly half a billion metadata points — a reminder that screenshot and productivity tools are quietly part of your data perimeter.
- Patch your DNS. The Internet Systems Consortium shipped BIND 9.20.29 and 9.21.26 to fix fourteen flaws, one letting an unauthenticated sender crash a DoH-serving named with a single request — no known exploitation yet, so get ahead of it.
The throughline: this was the week AI risk got debated in the abstract and delivered in the concrete. The signals that should move your calendar aren't the ones about machine gods — they're revenue that decides which vendors survive, attackers who are automating today, and a sandbox bug in the tooling you already run. Mind the plumbing, not the prophecy. That's the Signal for today.
Paul Sapio is the CIO of Mikhail Education and a full-stack AI engineer. Open to contract work in security, networking, AI, and SaaS development — reach out.