Sunday, 25 October 2026

Torsten Slok, chief economist at Apollo Global Management, says AI has "delivered zero financial payoff to corporate America outside of tech" [1]. His Daily Spark note, published on October 24, splits the S&P 500 into seven big tech companies and the other 493 [3]. Those seven are Alphabet, Amazon, Apple, Meta, Microsoft, Nvidia and Tesla [2]. Revenue per worker and profit margins are rising for the seven and flat for the 493, and there are still no signs of AI boosting productivity growth, Slok writes [1].

With no effect on the bottom line, he argues, mainstream companies are "starting to view token spending not as a source of growth but as a cost center that weighs on margins" [1]. VC-backed companies keep spending more on tokens, while mainstream corporate America "does not need the latest model and is unwilling to pay for it" [1]. Part of the spending data comes from Ramp's AI Index [1]. In that data the top tenth of firms account for 99.5% of model-serving and inference spend and 95.6% of direct payments to OpenAI and Anthropic, according to [3].

Slok doubts cheaper models will close the gap on their own. "AI may be a great calculator, but in business, intelligence is mostly judgment," he writes, adding that AI does not understand accountability, trust, culture or unwritten rules [1][2]. His bottom line: "the AI story will be decided in the S&P 493, not the Mag 7, and so far, there is no evidence that revenue growth or margins are improving outside the tech sector" [1]. The note works from index-level charts on margins, revenue per worker and productivity; it does not examine individual companies' AI projects [1].

OpenAI is pulling large customers away from Anthropic with steep discounts, The Information reports, according to [1]. Replit moved most of its AI spending to OpenAI after being offered more than 30 percent off under a contract worth over $100 million a year [1][2]. Replit, OpenAI and Anthropic have not publicly confirmed the financial terms, according to [2]. Anthropic had declined to extend Replit's earlier discount without a higher spending commitment, according to [3].

Other customers are named. At Rippling, CEO Parker Conrad said OpenAI's share of the coding workload rose from 16 to 52 percent while Anthropic's fell from 57 to 18 percent [1]. DataCamp CEO Jonathan Cornelissen said OpenAI's pricing cut his costs by 80 to 90 percent [1]. A US bank with more than $7 billion in assets had its ChatGPT seats doubled to 500 employees at no extra charge, paying under $7 per user instead of the usual $20 or more [1]. Anthropic's growth slowed from Q2 to Q3, according to an investor memo cited in [1].

The figures come from The Information's reporting, and the 80 to 90 percent figure is one customer's own cost reduction [1]. [1] says OpenAI is partly buying market share at the expense of its own margins, but has also cut real prices through its Sol and Luna model lines. OpenAI is now the default model provider for Replit Agent, and customers who want Claude have to pick it, according to [3]. Claude is still available in Replit's catalog [3].

The Model Context Protocol project's v2.1.0 release, published on October 25, fixes eight vulnerabilities in three of its reference servers: filesystem, everything and fetch [1]. Users should move @modelcontextprotocol/server-filesystem and server-everything to 2.0.1, and mcp-server-fetch to 2026.10.24 [1].

The filesystem server had four flaws. In one, a parent directory swapped for a symlink between the access check and the write could redirect write_file, edit_file, create_directory or move_file outside the allowed directories [1][2]. The advisory includes a script that demonstrates a file landing outside the allowed folder [2]. On Windows this is only partly fixed, the release notes say [1]. The everything server's HTTP and SSE transports sent a wildcard Access-Control-Allow-Origin header and exposed a get-env tool that returns the whole process environment, so a web page open in the developer's browser could read API keys and other secrets [3]. The default stdio transport is not affected [3]. The fetch fixes cover internationalized host names, NAT64 addresses that wrap private IPv4 addresses, and robots.txt checks after redirects [1].

The catch is the upgrade path. The TypeScript servers moved from date versions (2025.x, 2026.x) to semantic versions, and package managers rank 2.0.1 below every date version, so they will not offer it as an upgrade [1]. The everything advisory adds that Dependabot will not open one either [3]. The fix is to install the version explicitly, for example npm install @modelcontextprotocol/[email protected] [1]. Claude Desktop users will find the affected file under the Filesystem extension's installation directory, the filesystem advisory says [2].

Magnus Lynch, a consultant dermatologist at Guy's Hospital, gave 200 biopsy-proven skin lesions to GPT-6 Astra, Claude Fable 5.1 and a fine-tuned Inception v3, a convolutional neural network Google first published in 2015 [1]. Each lesion came as a clinical photo plus a dermoscopic image from MILK10k, a public dataset from the International Skin Imaging Collaboration [1][3]. The CNN named the right diagnosis out of six for 125 lesions (62%); the two LLMs got 84 and 85 (42%) [1].

The misses matter. For an invasive melanoma on the ear, both LLMs answered seborrhoeic keratosis, a harmless growth, and said the patient could be discharged; the CNN called it a melanoma [1]. The CNN named 13 of the 30 melanomas, against 8 and 11 for the LLMs [1]. Each LLM had a favourite answer: GPT-6 Astra called 75 lesions basal cell carcinoma when 25 were, and Claude Fable 5.1 called 53 lesions actinic keratosis when 20 were [1]. Asked as a patient whether to see a doctor, both LLMs said yes in almost every case, harmless lesions included [1].

Lynch lists the limits himself. Two hundred lesions are enough to show a pattern but not to rank close results, each LLM case was run once, and every lesion was biopsied, so the set is harder than average [1]. The CNN is a deliberate baseline, not state of the art, fine-tuned on 68,011 ISIC Archive images on one H100 GPU [1][2]. It runs in a phone browser [1], but its own page says it is not a medical device and will miss skin cancers, including melanoma [2]. Lynch says the analysis and first drafts were produced with Claude Code [1].

Johns Hopkins Bayview Medical Center in Baltimore is notifying 3,182 patients that their health information may have been exposed after a worker uploaded a spreadsheet to a public AI tool the hospital had not approved [1][3]. The hospital says it discovered the problem on September 21, the same day the upload happened during an internal review [1]. The reports do not name the AI tool [1][2].

The spreadsheet covered patients admitted and treated between May and September 2026 [1]. It may have included names, admission and treatment dates, medical record numbers, account numbers, the treating department, medications given and the names of providers; the hospital says it did not include Social Security numbers or financial account details [1]. The worker deleted the prompt, the thread and the document from the tool's history, and the hospital asked the company that runs the tool to delete the data [1]. Letters began going out on October 22 and offer 12 months of free credit monitoring through Experian IdentityWorks [1].

The hospital's fix is policy and training: tighter rules on handling protected health information, limits on unapproved apps and AI tools, and retraining staff on which tools are approved [1][2]. Feeding protected health information into public AI tools can raise HIPAA concerns because many of those platforms do not sign business associate agreements, according to [2], citing Medical Economics. The same survey data found 71% of healthcare workers were still using personal AI accounts for work tasks, down from 87% the year before, according to [2].

A subsidiary of Authentic Brands Group, with other companies that hold rights to Elvis Presley's music, sued Anthropic on Friday, October 23, alleging it trained its models on 274 Presley songs without permission [1]. The plaintiffs seek statutory damages of up to $150,000 per song, about $41.1 million [1]. The suit also says Claude kept reproducing copyrighted material after Anthropic added safeguards against generating song lyrics; asked to recreate songs "for a modern audience", it produced material that closely resembled the originals, according to the filing [1].

Two days earlier, on October 21, music publisher Reservoir filed two suits in the Northern District of California: one against Suno over 1,050 compositions, and one against Anthropic over lyrics from 853 compositions, including Madonna's "Papa Don't Preach" and Johnny Cash's "Ring of Fire" [2]. Reservoir seeks about $186.4 million from Suno and $151.4 million from Anthropic, figures based on maximum statutory damages [2]. It also asks for orders restricting further infringement and requiring the destruction of unauthorized copies [2]. Anthropic disputes Reservoir's allegations and says it will defend the case vigorously [2].

Round Hill Music has filed separate suits against Suno and Anthropic over hundreds of its works, and names the data-scraping firm Bright Data as a co-defendant in the Suno case [3]. Anthropic also faces a 2023 lyrics suit from Universal Music Publishing Group, Concord and ABKCO, and an August suit from Sony Music Publishing and Warner Chappell [1]. Anthropic has not publicly responded to the Presley suit, but has previously argued that training on copyrighted material can be fair use, according to [1].