Microsoft made the software that runs its own AI agents available to developers on 28 October, with billing from 1 December, and GitHub made its model-routing tool generally available the same day. Two days later, Wiz Research listed nine AI developer platforms that had disclosed security incidents in October.
The nine disclosures ran from 6 to 30 October, 24 days from the first listed date to the last, by our arithmetic. In one of two cases Wiz traced, a single stolen key made about 1.7 million Bedrock calls over thirteen hours, or about 36 calls a second.
Short explainer · Microsoft Sells Its AI Harness as 9 AI Platforms Disclose Incidents
A vertical news Short summarising this story. Figures come from Microsoft, GitHub, Wiz Research and Cursor; our arithmetic is labelled.
Business Pill · The Model and the Harness
An evergreen Business Engineer explainer on how an AI model and the harness around it split the work. It teaches the general idea only and does not discuss these launches or incidents.
The key insight:Microsoft made its harness a priced product on 28 October, and in the same month Wiz listed nine AI developer platforms that disclosed incidents, over 24 days by our arithmetic.
Microsoft’s official blog describes the harness as “everything around the model”. It calls it “the orchestration layer that gives an agent the right instructions, context, execution environment, and controls to accomplish meaningful work”.
The post says the Microsoft Copilot harness powers Copilot Code, Copilot Studio, the GitHub Copilot app, the CLI and VS Code, and that Microsoft is now making it available through Microsoft Foundry.
The Foundry blog says billing for the harness begins on 1 December 2026, with consumption-based pricing, and that harness runtime usage is free before then. That leaves 34 days of free runtime from the announcement, by our arithmetic.
AI developer platforms listed by Wiz Research with incidents disclosed in October 2026, and the 28 October launches of the Microsoft Copilot harness in Foundry and GitHub Copilot Fusion. Day count and calls per second are FourWeekMBA arithmetic.
GitHub Routes Between Models
GitHub’s changelog says “GitHub Copilot Fusion is generally available”. Instead of picking a model for each task, developers can let Copilot route and orchestrate the models it uses.
In the Artificial Analysis Coding Agent Index, the changelog says, Copilot Fusion Max scored 60, within two points of Claude Code with Opus 5.5 Max. GitHub says it did so at about half the average API cost per task, with about half as many tokens and about 40% less time per task.
The Same Layer Gets Hit
The Wiz Research post says “At least nine AI Developer Platforms have disclosed incidents over the course of the month”. Its list starts with Fireworks AI on 6 October and ends with Northflank on 30 October. It also names Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp and CommandCode.
Wiz says several of the platforms reported indications of an “agent swarm” attack, and that most of the incidents are still being analysed. In one of two cases it traced, the actor made approximately 1.7 million Bedrock calls over thirteen hours, with over a million successful, spread across a dozen Claude models.
On 29 October, Cursor published a security notice that a malicious version of the Claude Code extension, versions 2.1.312 and 2.1.313, had been identified in its VS Code Extension Marketplace.
The Business Lever: Who Carries the Risk
Microsoft is turning the orchestration layer into a product, billed by consumption from 1 December. GitHub offers a router that, in the one benchmark it cites, cost about half as much per task as Claude Code with Opus 5.5 Max. The incidents Wiz compiled were disclosed by AI developer platforms, and the two cases it traced involved stolen cloud keys used to call models. Cursor’s notice adds a tampered extension.
For a buyer, the harness now has two prices: the bill for running it and the cost of securing the keys and extensions around it. The sources read do not put a figure on the second.
The Structural Read
As we read the two launches, the layer around the model is now something a company can buy from Microsoft or route through GitHub rather than build itself.
As we read the Wiz post, the incidents sit in the same layer: the developer platforms and cloud keys that agents use to reach models.
As we read the pricing note, Microsoft charges for the harness by consumption from 1 December, and the sources read put no price on securing it.
Microsoft, Introducing the Microsoft Copilot harness
“If the model supplies the intelligence, the harness is everything around the model.”
Three Implications
FOR DEVELOPERSMicrosoft says harness runtime is free before 1 December, with consumption-based billing after that, according to its Foundry blog.
FOR SECURITY TEAMS Wiz says one stolen key made about 1.7 million Bedrock calls over thirteen hours in one of the cases it traced.
FOR MODEL MAKERS GitHub says Copilot Fusion routes each task across models, so the router, not the developer, picks the model.
The framework says “The surface, not the model, governs autonomy.”
As we read it, this week the surface became something you buy, from Microsoft or through GitHub’s router, in a month when the AI developer platforms that agents run on disclosed a string of incidents. The framework is the owner’s argument and does not discuss these launches or incidents.
Wiz does not link every listed incident to one campaign, and it says detailed technical information is not available for most of them. The pages read give no customer counts for the Copilot harness, no Foundry price per run, and no evidence that any listed incident involved Microsoft or GitHub products.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
Microsoft made its AI harness available on 28 October, the day GitHub made its model router generally available, with billing from 1 December. Wiz listed nine AI developer platforms with October incidents two days later, including one stolen key that ran about 36 Bedrock calls a second for thirteen hours, by our arithmetic.
A note on sourcing. All facts and figures come from Microsoft’s and GitHub’s 28 October posts, Wiz Research’s 30 October post and Cursor’s 29 October notice, read on 31 October 2026. Day counts and the calls-per-second figure are our arithmetic. We did not contact the companies.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
