This week exposed four kinds of dependency that model benchmarks omit. Anthropic sought capital for compute while OpenAI disputed the terms of Apple distribution. Cyber gates controlled who could use advanced models, not what those models could do. Package, sandbox, and browser controls failed or held at different layers, while healthcare harms reached both courts and procurement audits.
1. Capital lock-in and platform lock-in constrain model companies differently
The Financial Times reported agreed terms for a $30 billion Anthropic round at a $900 billion valuation, while OpenAI reportedly considered a breach notice after Apple's ChatGPT integration delivered weak placement and subscription conversion. Neither event was publicly closed or adjudicated.
Anthropic's constraint is upstream: multi-year compute demand requires extraordinary capital. OpenAI's is downstream: an operating-system owner controls discovery, interface, telemetry, and conversion. A model lab can finance capacity yet still lack customers, or reach customers yet lack control over the route; both dependencies belong in supplier economics.
Sources: Financial Times on Anthropic's reported terms · TechCrunch on the reported Apple dispute · Ars Technica on the integration
2. Cyber access gates actors while benchmarks estimate actions
OpenAI granted selected European companies and institutions GPT-5.5-Cyber access through identity and scope checks. Separately, the UK AI Security Institute reported longer autonomous attack chains from Mythos and GPT-5.5, while Microsoft said MDASH found 16 Windows vulnerabilities and scored 88.45% on CyberGym.
The mechanisms answer different questions. Trusted access controls who enters and leaves an auditable program; capability benchmarks estimate what a configured model and harness can complete. Neither substitutes for the other, and cross-provider scores remain incomparable until task access, time budgets, nudges, verification, and success criteria are aligned.
Sources: Reuters on European trusted access · CyberScoop on AISI's benchmarks · Microsoft's MDASH report
3. Agent containment spans packages, identities, and browser policy
Malicious TanStack packages compromised two OpenAI employee devices before any model boundary mattered. OpenAI's Windows Codex sandbox instead separates online and offline local identities, while AWS AgentCore Browser exposes more than 450 Chrome policies beneath an agent's prompt and application logic.
These controls occupy consecutive layers: dependency provenance protects the host, operating-system identity limits code, and browser policy limits navigation. A failure at one layer can bypass strengths elsewhere. Certificate rotation, restricted credentials, filesystem ACLs, egress rules, domain allowlists, and session evidence therefore form one containment chain rather than interchangeable safeguards.
Sources: OpenAI's TanStack response · OpenAI's Windows sandbox design · AWS on AgentCore Browser policies
4. Healthcare accountability reaches both conversation history and procurement math
A California complaint alleged that ChatGPT advised a 19-year-old about a fatal drug combination. Ontario's auditor general separately found defects in all 20 approved AI medical scribes tested on two simulated conversations, while note accuracy counted for about 4% of the procurement score.
The lawsuit asks whether repeated consumer interactions, warnings, and personalization create provider responsibility. The audit asks why public procurement admitted weak clinical notes in the first place. Courts evaluate causation after alleged harm; hard accuracy gates, review evidence, and audit samples can act before deployment. Both depend on preserving the underlying interaction record.
Sources: Reuters on the overdose complaint · Ars Technica on Ontario's audit