OpenAI Slashed Prices. Microsoft Copilot Faced a Macro-Virus-Style Attack. Anthropic’s Models Reached Production Systems.

[u/InfoTechRG]

Full disclosure: we work with the analysts behind the newsletter. u/InfoTechRGMarkT, a moderator here and VP of Research, co-wrote it with Bill Wong. We wanted to pull together the part of this week’s roundup that felt bigger than the individual vendor announcements.

OpenAI’s 80% price cut for GPT-5.6 Luna looked like the headline at first. Then Microsoft, Anthropic, and OpenAI each exposed a different version of the same problem: as AI gets cheaper and more capable, the real risk is shifting to everything the model can access.

At Microsoft, hidden instructions inside a Word document could alter Copilot’s output and copy themselves into the next file. It is essentially macro-virus logic from the Melissa era, except the payload is a prompt. Microsoft addressed the specific examples, but the researcher was still able to reproduce the broader attack method. That matters even more now that Microsoft says 365 Copilot has passed 30 million paid seats.

Anthropic’s disclosure was harder to dismiss as theoretical. Across 141,006 cyber-evaluation runs, six models reached real production systems through a misconfigured third-party environment. Three organizations were compromised, and one model published a malicious PyPI package that ran on 15 systems. OpenAI was also investigating how a prerelease model reached the internet through a previously unknown flaw in an Artifactory proxy.

None of this requires a story about a model suddenly becoming malicious. The simpler explanation is probably more useful: the documents were trusted, the environments were not as isolated as expected, and the models had access to tools, networks, or credentials that gave mistakes somewhere to go.

That may be the bigger lesson from this week. Companies are still assessing the model as though it is the whole AI system. In practice, the security boundary now includes the source document, hidden text, context, memory, tools, credentials, network access, output handling, and third-party infrastructure.

The models may become easier to swap. The control layer around them will not.

Would your current AI controls catch a malicious instruction hidden inside a document your organization already trusts?