Today
Saturday, 14 November 2026
The morning's sourced briefing on AI, technology and enterprise risk: the developments that matter most, what each one means, and which forecasts it moves.
Listen
Today's briefing, read aloud from start to finish.
Why it matters
The big picture
Authority is being handed to automated systems faster than the controls around them mature, so resilience and accountability now matter more than raw capability.
Read the reasoning
A change inside Microsoft's own network, not an attacker, interrupted mail and collaboration worldwide, and the Government of Bermuda was among those warning users. The same day, CISA put a root-level flaw in a widely deployed firewall operating system on its exploited list and demanded forensic triage, not just patching. Both stories show that dependence on a few suppliers and on trusted perimeter systems is where operational risk concentrates.
The control question is also moving to agents. OpenAI is giving agents the ability to spend money through the card networks, and the AI Futures Project has shortened its timeline for AI that can do AI research. Liability, authorisation and oversight arrangements for autonomous action are not yet settled, while the forecasting community is moving toward earlier capability arrival.
Bermuda's re/insurers are already naming this as a portfolio-level issue: shared reliance on AI suppliers and data-centre infrastructure creates correlated exposure. The practical response for any senior team is the same: map supplier concentration, define where humans must sign off, and rehearse operating without a key platform.
- Provider-side outages as a standing risk
A hyperscaler's internal change disrupted organisations worldwide. Continuity plans should assume core productivity platforms can fail with no attacker involved.
- Agent payments and liability
Card networks are backing agent purchasing at scale. Expect pressure on dispute rules, fraud controls and authorisation standards.
- Systemic AI risk in insurance
Re/insurance leaders are discussing AI and data-centre concentration as a risk to whole portfolios. Watch for it to enter underwriting and capital frameworks.
Developments
What moved
- 01Cloud ResilienceMicrosoft · Global
Bermuda Government warned of email disruption as Microsoft traces global 365 outage to fault from earlier network capacity upgrade
Why it matters. Bermuda's Government and its regulated firms now have a live example of a single supplier's internal change halting mail, collaboration and security tooling at once, which makes a continuity plan that does not assume Microsoft 365 availability a board-level requirement. Any organisation that treats Exchange Online as the only channel for incident communication, regulatory notification or client contact is exposed, because a provider-side fault gives no warning and no workaround. Watch for Microsoft's promised post-incident report, and use it to test out-of-band communication channels and mail-timeout settings.
“A fault in one company's network change can stop email for people on the other side of the world. We rarely think about how much of our daily contact rests on a single supplier.”
Jorai Laurenceo
Founder & Executive Director, LaurenceoWhat happened, Bermuda lens and sources
What happened Sourced reporting
Microsoft said the 12 November Microsoft 365 outage was introduced by an issue during an earlier network capacity upgrade that surfaced after a recent network change. Engineers froze all deployments, spread connection traffic across its worldwide infrastructure, steered traffic away from struggling systems and rebooted affected servers; Microsoft also apologised and extended email timeouts to 48 hours. The Government of Bermuda warned that the Exchange Online issue could disrupt Government email services, and Bernews described it as a worldwide outage rather than a Bermuda-specific one.
Bermuda lens
The Government of Bermuda flagged possible disruption to Outlook access, email communications and response times. Bermuda insurers, banks and service firms that depend on Microsoft 365 should confirm they have an alternative channel for regulatory and client communication during a provider outage.
- BetaNewsMicrosoft says network upgrade caused Microsoft 365 outage
- SecurityWeekMicrosoft 365 Outage Disrupts Outlook, Exchange Online and Teams
- BernewsGovernment Warns Of Possible Email Disruptions
- 02CybersecurityCISA / Check Point · Global
CISA adds exploited Check Point Gaia root flaw to KEV with a 16 November federal deadline
Why it matters. Owners of Gaia-based gateways must treat this as a possible compromise, not a routine patch, because the KEV entry requires forensic triage and a three-day federal deadline. Perimeter firewalls and management servers are the most trusted systems in a network, so root access on them undermines everything behind them. Security teams outside the US federal sphere should adopt the same triage standard, starting with accounts that can reach the local socket.
What happened and sources
What happened Sourced reporting
On 13 November CISA added two flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-123039 in Check Point Gaia OS and CVE-2026-114713 in UnrealIRCd. The Check Point flaw arises because the Gaia DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating callers, so an authenticated local user can run commands as root. The KEV entry sets a due date of 2026-11-16 and requires forensic triage under BOD 26-04; the Canadian Centre for Cyber Security notes Check Point says the flaw is exploited in the wild.
- CISACISA Adds Two Known Exploited Vulnerabilities to Catalog
- CISAKnown Exploited Vulnerabilities Catalog
- Canadian Centre for Cyber SecurityCheck Point security advisory (AV26-1154)
- 03AGI ForecastsAI Futures Project · Global
AI Futures Project pulls Superhuman AI Researcher forecast into May to November 2027
Why it matters. Boards and strategy teams should treat this as a stress-test input rather than a forecast to plan around: one widely followed group has shortened its timeline on the strength of a single evaluation of AI-assisted R&D. The exposure falls on firms with large clerical and back-office workforces, and on regulators and insurers pricing workforce and capability risk. Watch whether METR or other evaluators corroborate the acceleration estimate, since that evidence matters more than the forecast itself.
What happened and sources
What happened Sourced reporting
The AI Futures Project published a timelines update saying there is now a meaningful probability that a Superhuman AI Researcher emerges between May and November 2027. Forbes reports the revision followed a November METR report concluding Anthropic was improving its models at roughly twice its previous rate. The group also raised its estimate of AI automating most office work to a 35% to 65% chance before 2028.
- AI Futures ProjectQ3.5 Timelines Update: Looks Like the Intelligence Explosion Will Happen in 2027 After All
- ForbesAI Futures Project Pulls Its 'Intelligence Explosion' Forecast Into 2027
- 04Insurance RiskPwC Bermuda · Bermuda
PwC Bermuda summit in Hamilton: re/insurance CEOs weigh AI and data-centre systemic risk
Why it matters. Bermuda's re/insurers are framing AI concentration and data-centre exposure as a portfolio-level risk, which will feed into underwriting appetite, accumulation modelling and capital discussions. Carriers with heavy exposure to the same AI suppliers and infrastructure on both sides of the balance sheet are most exposed to correlated losses. Watch for this language to appear in risk appetite statements and in dialogue with the Bermuda Monetary Authority.
What happened, Bermuda lens and sources
What happened Sourced reporting
PwC Bermuda's 19th annual re/insurance summit drew more than 400 attendees to the Hamilton Princess on 10 November 2026. CEOs discussed the scale of AI and data-centre risk, citing a PwC report projecting US$31.6 trillion of capital expenditure through 2050 on AI compute. They also discussed how widespread AI use creates systemic risk that could affect a re/insurer's entire portfolio.
Bermuda lens
Held at the Hamilton Princess with Bermuda re/insurance leaders, the discussion addresses AI risk for the Bermuda market. Bermuda carriers should test whether their accumulation and aggregation models capture shared dependence on AI suppliers and data-centre infrastructure.
- BernewsPwC Bermuda's 19th Annual Insurance Summit
- 05Agentic CommerceOpenAI · United States
OpenAI launches ChatGPT Wallet so its agents can buy for users, built with Visa, Mastercard, Amex
Why it matters. Agent-initiated payments move from pilot to mainstream infrastructure, so banks, card issuers, insurers and merchants must settle questions of authorisation, liability and fraud controls before volumes arrive. Issuers should decide how to distinguish agent-initiated from user-initiated transactions in disputes, and merchants should review their checkout and chargeback terms. The initial restriction to US Pro subscribers gives a short window to prepare before wider rollout.
What happened and sources
What happened Sourced reporting
OpenAI announced ChatGPT Wallet, a payment feature that lets its 'dots' AI agents make purchases on behalf of users. It was built with American Express, Mastercard and Visa, lets customers keep existing card rewards and protections, and OpenAI says the agents never access card details. It is initially available to US Pro subscribers over 18; CNBC cites more than 1.2 billion weekly ChatGPT users and nearly 100 million paying users at the end of Q3.
- CNBCOpenAI launches ChatGPT Wallet, allowing its 'dots' AI agents to make purchases for users
- The InformationOpenAI Launches ChatGPT Wallet
Analysis
Laurenceo's take
The daily View on the lead story, the latest forecast move and the newest long reads. All analysis
More stories
Earlier briefings
Keep scrolling and each earlier briefing loads in turn, preserved as published. Corrections are marked on the edition and listed in the corrections log.