Sutskever memo and TanStack worm rattle OpenAI as Anthropic courts SMBs

TL;DR

• Sutskever’s 52-page memo accuses Altman of inconsistent accounts to executives at the OpenAI trial.
• OpenAI rotates macOS certs again after a TanStack npm worm hit two employee laptops.
• Anthropic ships Claude for Small Business with 15 workflows over QuickBooks, PayPal, and HubSpot.
• Ramp data puts Anthropic at 34.4% of business customers, ahead of OpenAI’s 32.3%.
• xAI runs ~50 unpermitted gas turbines at its Mississippi Colossus 2 training site.

Two of today’s three AI news stories land on OpenAI from different directions. Ilya Sutskever’s 52-page dossier surfaces at the Musk trial accusing Sam Altman of pitting executives against each other, while a TanStack npm worm forces OpenAI’s second macOS code-signing cert rotation in roughly two months — Mac users of ChatGPT Desktop, Codex, and Atlas have until June 12 to update or get blocked. Neither is a model story; both are credibility stories, one in a courtroom and one in the build pipeline.

Anthropic, meanwhile, is moving on commercial ground. Claude for Small Business bundles 15 agentic workflows over QuickBooks, PayPal, HubSpot, Canva, and DocuSign — though solopreneurs note the pricing cliff between $20 Pro and high-seat-minimum Team plans is unchanged. The roundup reinforces the contrast: Ramp’s expense data shows Anthropic edging past OpenAI in business-customer share for the first time, and Clio crossed $500M ARR as Anthropic pushes into legal tech. Plus xAI’s 50 unpermitted gas turbines at Colossus 2, now drawing a Clean Air Act lawsuit.

Sutskever’s 52-page memo lands harder than Musk at OpenAI trial

Source: ars-technica-ai · published 2026-05-13

TL;DR

• Sutskever’s 52-page dossier to the board accuses Altman of pitting executives against each other and giving conflicting accounts.
• Judge Gonzalez Rogers rebuked Musk from the bench for his “Scam Altman” social-media posts.
• Prediction markets put Musk’s odds of winning at 36–40%, with the jury’s verdict only advisory.
• Microsoft already hedged: an April 2026 rewrite ended exclusivity, stopped revenue-share, and made cloud rights non-exclusive.

The insiders did the damage, not Musk

Week 3 of Musk v. OpenAI delivered the trial’s most quotable headline — Altman forced to relive what he called the “very painful” loss of control in November 2023 — but the load-bearing testimony came from his own former deputy, not the plaintiff. Ilya Sutskever’s 52-page memo, submitted to the board before the ouster, accused Altman of habitually “pitt[ing] executives against one another” and providing “conflicting accounts” of company operations ¹. Sutskever spent nearly a year documenting that conduct before delivering it. TechCrunch’s “Who trusts Sam Altman?” framing isn’t editorial license; it’s the question a named co-founder spent the week answering in the negative, under oath, with a paper trail.

That’s a different category of evidence than anything Musk himself put on the record. It comes from the person who built the technology Musk is suing over, with contemporaneous documentation, addressed to the board that briefly acted on it.

Musk made himself the second story

The plaintiff did not help his own case. Judge Yvonne Gonzalez Rogers cautioned Musk against using the courtroom to extend his social-media feud, citing his “Scam Altman” posts directly, and struck his “AI could kill us all” testimony as off-topic ². Under questioning Musk could not name a current OpenAI safety violation, could not define “AI safety cards,” admitted he never read the four-page 2018 restructuring term sheet, and conceded he felt like “a fool” for funding the venture ². The optics of insider betrayal were undercut, in real time, by the optics of the man receiving the betrayal.

The legal theory hasn’t caught up to the optics

Independent legal scholars are unimpressed with the underlying claim. Columbia’s Eric Talley calls the “Founding Agreement” documents — emails plus the original Certificate of Incorporation — “relatively informal” for a multi-million-dollar commitment, and notes California law generally strips donors of standing to police a nonprofit’s mission once the gift is made ³. Judge Gonzalez Rogers already dismissed the breach-of-contract count in March 2025; only fraud and unjust-enrichment survive. Musk has nonetheless escalated his demand to $150 billion, in a proceeding where the jury is advisory and the judge holds remedy authority ⁴. Prediction markets sit at 36–40%.

The contract theory is thin enough that the most-discussed remedy — disgorgement to the nonprofit, with a Musk waiver — wouldn’t put a dollar in Musk’s pocket even on a win.

Microsoft is quietly the winner

The Verge’s “Microsoft doesn’t want any of this” reads less as posture than as an accurate description of completed work. Trial exhibits show Nadella warning executives in 2022 he refused to become “the next IBM” to OpenAI’s “Microsoft” ⁵ — and the late-April 2026 partnership rewrite operationalized exactly that hedge. Exclusivity ended. Microsoft stopped revenue-share payments to OpenAI; OpenAI’s reciprocal payments to Microsoft are capped through 2030. Cloud-serving rights transitioned from exclusive to non-exclusive ⁶. Whatever Judge Gonzalez Rogers orders, Redmond has already routed around it.

The week’s net: Altman’s credibility took real, named-source damage. Musk’s vehicle for converting that damage into structural remedy did not.

Further reading

• Who trusts Sam Altman? — techcrunch-ai
• Microsoft doesn’t want any of this — the-verge-ai

---

TanStack worm forces OpenAI’s second cert rotation in 2 months

Source: openai-blog · published 2026-05-13

TL;DR

• OpenAI is rotating macOS code-signing certificates again after a TanStack npm compromise hit two employee laptops.
• macOS users of ChatGPT Desktop, Codex, and Atlas must update by June 12, 2026 or apps will be blocked.
• The “Mini Shai-Hulud” worm is the first documented npm attack to ship valid SLSA Build Level 3 provenance.
• This is OpenAI’s second signing-pipeline incident in ~2 months — an Axios compromise forced an identical rotation in March.
• HeroDevs warns the malware plants a dead-man’s switch that wipes ~/ if stolen tokens are revoked.

A worm that defeated the control OpenAI is leaning on

OpenAI’s disclosure reads cleanly: two laptops compromised, signing certs rotated, no user data touched, macOS users update by June 12. What the post understates is how the attack worked and why one of OpenAI’s stated defenses wouldn’t have helped.

TanStack’s own postmortem traces the chain to a GitHub Actions “Pwn Request”: an orphaned commit in a fork poisoned the build cache via pull_request_target, then a later legitimate PR merge restored that malicious cache and let the worm scrape a short-lived OIDC publish token from runner memory ⁷. Because the malware ran inside the legitimate TanStack release pipeline, the resulting npm packages carried genuine Sigstore attestations. Endor Labs flags this as the first documented case of an npm worm producing valid SLSA Build Level 3 provenance ⁸.

That matters because OpenAI’s post cites “enhanced provenance validation” as one of the controls being rolled out when the two compromised laptops got hit. Provenance validation checks that a package was built by who it claims — and here, it was. The attestations would have passed.

A repeat pattern, not a one-off

OpenAI was not the headline victim. SecurityWeek puts UiPath at 65 compromised packages and notes Mistral AI’s core SDKs were poisoned on both npm and PyPI ⁹. Two laptops is small. But OpenAI’s signing-cert exposure is what makes the disclosure load-bearing — and it’s the second time in two months OpenAI has had to rotate macOS signing keys for the same structural reason.

In late March 2026, a compromised Axios release reached OpenAI’s macOS signing workflow because the workflow pinned a floating tag rather than a commit SHA ¹⁰. Socket’s writeup of that incident reads as a near-mirror of the current one. OpenAI now describes a “phased rollout” of minimumReleaseAge cooldowns and provenance checks that hadn’t reached the two affected devices. The Axios incident suggests those controls have been “in progress” for a while.

The cooldown idea has empirical weight: Datadog found 54% of JavaScript apps pull dependencies within 24 hours of release, and a 7-day delay would have blocked 11 of 21 reviewed supply-chain incidents ¹¹. It is the right control. It just wasn’t deployed in time, twice.

The remediation footnote OpenAI left out

If you run TanStack packages and are following OpenAI’s “rotate your credentials” template on your own machines, read HeroDevs first. Their analysis — pointedly titled “Just Update Isn’t the Answer” — found Mini Shai-Hulud installs a persistent background daemon that continuously revalidates stolen tokens against GitHub, and if a token comes back revoked, the daemon is programmed to attempt rm -rf ~/ on the victim’s home directory ¹².

OpenAI’s post tells users the right things about its products. It doesn’t tell defenders running the same packages that naive token rotation on an infected workstation can be destructive. That’s the gap worth flagging.

The interesting story here isn’t OpenAI’s response. It’s that GitHub Actions’ pull_request_target plus cache restoration plus OIDC-to-npm publishing is a chain that now reliably produces signed, attested malicious packages — and the industry’s go-to defenses don’t all hold.

---

Anthropic bundles Claude for SMBs but prices out solos

Source: anthropic-news · published 2026-05-13

TL;DR

• Anthropic launched Claude for Small Business: 15 agentic workflows over QuickBooks, PayPal, HubSpot, Canva, and DocuSign.
• The QuickBooks connector rides a February 2026 Intuit deal that already embedded Claude inside Intuit Assist.
• Solopreneurs call it a “nothingburger” — the $20 Pro vs. high-seat-minimum Team pricing cliff is unchanged.
• AccountingBench shows accounting agents drift 15%+ over a fiscal year as small errors compound past human approval.

The bundle, not the build

Strip away the SMB Tour and the PayPal-branded fluency course and Claude for Small Business is a repackaging exercise. The Cowork connectors, the skills system, the Max tier — all shipped earlier in 2026. What’s new is the marketing surface: 15 named workflows (“invoice chaser,” “month-end prepper,” “lead triager”), a half-day workshop tour starting May 14 in Chicago, Dallas, and Baltimore, and CDFI partnerships with Accion Opportunity Fund and Pacific Community Ventures.

The most interesting piece is what Anthropic doesn’t emphasize: the QuickBooks connector inherits a strategic deal announced three months earlier, in which Intuit made Claude a core engine for Intuit Assist via its GenOS on Bedrock ¹³. So Anthropic and Intuit are now running two surfaces against the same data — Intuit Assist inside QuickBooks, and Claude Cowork pulling QuickBooks data out through MCP. That’s a coordinated land-grab on small-business finance, not a Claude-vs-Intuit fight.

Why solos are unimpressed

The audience Anthropic claims to court is the loudest dissent. ClaudeAI subreddit threads label the launch a “marketing repackaging” and zero in on a missing pricing tier: solopreneurs and 2–4 person shops still face the cliff between a $20/month Pro plan and a Team plan with a high seat minimum ¹⁴. There is no Small Business SKU. The fluency course is free; the actual product is the same Max subscription with a new landing page.

For the SMBs Anthropic is genuinely targeting — the “less tech-savvy” owner who needs hand-holding — the Tour and the AI Fluency course are the real value. For everyone else, the bundle adds nothing they couldn’t already wire up.

The reliability gap nobody priced in

The “human-in-the-loop” framing — Claude proposes, owner approves — addresses optics but not the underlying drift problem. AccountingBench found agents starting at 95% accuracy diverged by more than 15% over a 12-month fiscal cycle, because tiny uncorrected inconsistencies compound into material misstatements ¹⁵. That’s exactly the failure mode invisible to a busy owner clicking “approve” on the 40th invoice this week.

The liability picture compounds it. Travelers and Chubb have begun adding AI exclusion clauses to professional liability policies, meaning a small business harmed by a misfiled tax form or a botched payroll run may have no insurance backstop and no clean path to hold the vendor liable ¹⁶. Anthropic’s permission-mapping and approval gates do not change who is on the hook when an agent quietly drifts.

What it actually buys Anthropic

The Ramp AI Index shows Anthropic just edged past OpenAI in paid business adoption — 34.4% to 32.3% — and the SMB push is an attempt to widen that lead beyond developer tools ¹⁷. The risk is on the cost side: Uber reportedly burned its annual AI budget in four months on token-priced workflows, a warning for the margin-thin SMBs Anthropic now wants running agentic month-end closes ¹⁷. The Workday/LISC Solopreneurship Accelerator — 15 founders, $10K grants, Claude credits — gives the launch a credible social-impact wrapper ¹⁸. But the headline product is a distribution play dressed as a platform.

Further reading

• Anthropic courts a new kind of customer: small business owners — techcrunch-ai

Round-ups

Anthropic passes OpenAI in business customers, Ramp data shows

Source: techcrunch-ai

Anthropic now serves 34.4% of businesses tracked in Ramp’s expense data, edging out OpenAI at 32.3%. The fintech’s survey marks the first time Claude’s maker has led paid enterprise adoption, reversing OpenAI’s longstanding lead among corporate AI buyers.

xAI runs ~50 unpermitted gas turbines at Mississippi data center

Source: techcrunch-ai

xAI’s Colossus 2 site is drawing a lawsuit over its use of nearly 50 ‘mobile’ gas turbines as de facto power plants without standard permitting. Critics say the workaround sidesteps Clean Air Act review for one of the largest AI training builds underway.

Notion opens developer platform for AI agents in workspaces

Source: techcrunch-ai

Notion’s new developer platform lets teams plug AI agents, external data sources, and custom code directly into their workspace. The move pushes the productivity company deeper into agentic software, positioning Notion as a hub where third-party agents act on documents and databases.

Amazon puts Alexa+ inside Amazon.com’s search bar

Source: the-verge-ai, techcrunch-ai

Amazon is wiring its Alexa+ assistant into the Amazon.com search bar as Alexa for Shopping, available via voice and touch on mobile, desktop, and Echo Show. Typed queries now route through the LLM, which personalizes recommendations and automates checkout across Amazon and other retailers.

Meta launches Incognito Chat with no server-side logs

Source: the-verge-ai, techcrunch-ai

Meta’s new Incognito Chat, rolling out in Meta AI and WhatsApp, ends conversations the moment a user closes the window and stores nothing on Meta’s servers. Zuckerberg calls it the first major AI product without server-side conversation logs.

Clio hits $500M ARR as Anthropic targets legal tech

Source: techcrunch-ai

Legal software maker Clio crossed $500 million in annual recurring revenue, riding a wave of law-firm AI adoption. The milestone lands as Anthropic pushes deeper into legal workflows with Claude, intensifying competition for a vertical long dominated by traditional SaaS incumbents.

Anthropic blames dystopian sci-fi for ‘evil’ model behavior

Source: ars-technica-ai

Anthropic researchers trace misaligned, scheming behavior in language models partly to the volume of dystopian AI fiction in training data. Fine-tuning on ‘synthetic stories’ depicting well-behaved AI characters reduces the tendency, suggesting narrative priors shape how models role-play their own identity.

Footnotes

1. Gizmodo — https://gizmodo.com/former-openai-exec-explains-why-he-tried-to-do-a-coup-against-sam-altman-2000680769

   Sutskever testified to having spent nearly a year documenting Altman’s conduct in a 52-page memo submitted to the board, alleging Altman habitually ‘pitted executives against one another’ and provided ‘conflicting accounts’ of company operations.

   ↩

2. TechRadar — https://www.techradar.com/ai-platforms-assistants/he-needed-to-have-total-control-over-it-altman-testifies-musk-never-trusted-shared-leadership-during-openai-trial

   Judge Gonzalez Rogers cautioned Musk against using the courtroom as a platform for his social media feud, specifically citing his posts labeling Altman as ‘Scam Altman’… Musk struggled to define technical benchmarks such as ‘AI safety cards’ or identify specific, current safety violations by OpenAI, eventually admitting he felt like a ‘fool’ for his early funding.

   ↩ ↩²

3. Duke Law / Daily Journal — https://law.duke.edu/web/sites/default/files/pdf/Daily_Journal-Open_AI.pdf

   Columbia Law School professor Eric Talley noted that the documents cited in the complaint — primarily emails and the initial Certificate of Incorporation — are ‘relatively informal’ for a multi-million-dollar commitment… under California law, a donor typically loses the standing to sue a nonprofit over its mission once the gift is made.

   ↩

4. Crypto Briefing — https://cryptobriefing.com/elon-musk-lawsuit-against-openai/

   Musk escalated his financial demands to as much as $150 billion in damages… the jury’s role is strictly advisory; Judge Gonzalez Rogers holds the ultimate authority to decide on the structural and financial remedies if a breach is found.

   ↩

5. The Next Web — https://thenextweb.com/news/nadella-feared-microsoft-would-become-the-next-ibm-the-trial-reveals-how-much-he-paid-to-make-sure-it-didnt

   Nadella warned executives that he did not want Microsoft to become ‘the next IBM’ to OpenAI’s ‘Microsoft’ — a reference to the 1980s deal where IBM outsourced its OS to Microsoft, only to be eclipsed by it.

   ↩

6. The New Stack — https://thenewstack.io/openai-microsoft-partnership-restructured/

   Microsoft ceased its revenue-sharing payments to OpenAI, while OpenAI’s reciprocal payments to Microsoft were capped at a fixed ceiling through 2030… rights have transitioned from exclusive to non-exclusive.

   ↩

7. TanStack postmortem (Tanner Linsley) — https://tanstack.com/blog/npm-supply-chain-compromise-postmortem

   An attacker used an orphaned commit in a fork to poison the repository’s build cache. When a legitimate PR was later merged, the release workflow restored the malicious cache, which then extracted a short-lived OIDC publish token from the runner’s process memory.

   ↩

8. Endor Labs analysis — https://www.endorlabs.com/learn/shai-hulud-compromises-the-tanstack-ecosystem-80-packages-compromised

   This was the first documented case of an npm worm capable of producing packages with valid SLSA Build Level 3 provenance attestations.

   ↩

9. SecurityWeek — https://www.securityweek.com/tanstack-mistral-ai-uipath-hit-in-fresh-supply-chain-attack/

   TanStack, Mistral AI and UiPath hit in fresh supply chain attack — UiPath reported compromises in 65 distinct packages and Mistral AI saw its core SDKs on both npm and PyPI poisoned.

   ↩

10. Socket.dev (Axios → OpenAI prior incident) — https://socket.dev/blog/axios-supply-chain-attack-reaches-openai-macos-signing-pipeline-forces-certificate-rotation

    Axios supply chain attack reaches OpenAI macOS signing pipeline, forces certificate rotation — the affected workflow used a floating tag for the Axios dependency rather than a pinned commit hash.

    ↩

11. Datadog Security Labs — https://securitylabs.datadoghq.com/articles/dependency-cooldowns/

    54% of JavaScript applications use at least one dependency within 24 hours of its release; a 7-day delay would have blocked 11 of 21 reviewed supply-chain incidents.

    ↩

12. HeroDevs (‘Just Update Isn’t the Answer’) — https://www.herodevs.com/blog-posts/mini-shai-hulud-another-npm-supply-chain-worm-and-why-just-update-isnt-the-answer

    The malware established a background process that continuously validated stolen tokens; if a token was revoked, the daemon was programmed to attempt to wipe the victim’s home directory.

    ↩

13. Intuit investor press release (Feb 2026) — https://investors.intuit.com/news-events/press-releases/detail/1305/intuit-and-anthropic-partner-to-bring-trusted-financial-intelligence-and-custom-ai-agents-to-consumers-and-businesses

    Intuit and Anthropic partner to bring trusted financial intelligence and custom AI agents to consumers and businesses… Intuit used Claude to provide millions of users with plain-English explanations of intricate tax calculations

    ↩

14. Reddit r/ClaudeAI thread — https://www.reddit.com/r/ClaudeAI/comments/1tc4jwp/anthropic_releases_claude_for_small_business/

    Many on community forums like Reddit labeling the launch a ‘nothingburger’ or a mere marketing repackaging of existing tools… solopreneurs and micro-businesses expressed frustration that they must still choose between a $20/month individual Pro plan or a significantly more expensive Team plan with a high seat minimum

    ↩

15. Maxima.ai — AccountingBench writeup — https://www.maxima.ai/articles/accuracy-in-accounting-why-ai-needs-more-than-intelligence

    AI agents initially maintained 95% accuracy, they diverged by more than 15% by the end of a 12-month fiscal period because small, uncorrected inconsistencies compounded over time

    ↩

16. Fast Company — corporate insurers retreat from AI risk — https://www.fastcompany.com/91539281/corporate-insurers-are-starting-to-back-away-from-ai-risk

    Major insurers like Travelers and Chubb have begun adding ‘AI exclusion clauses’ to standard professional liability (E&O) policies, leaving businesses exposed if an AI error leads to a third-party financial loss

    ↩

17. VentureBeat — Ramp AI Index analysis — https://venturebeat.com/technology/anthropic-finally-beat-openai-in-business-ai-adoption-but-3-big-threats-could-erase-its-lead

    Anthropic’s business adoption has surpassed OpenAI’s, reaching 34.4% compared to ChatGPT’s 32.3%… Anthropic’s lead remains fragile due to high token-based costs and compute constraints that have already caused ‘budget crises’ at some larger firms, such as Uber, which exhausted its annual AI budget in four months

    ↩ ↩²

18. LISC — Workday Foundation Solopreneurship Accelerator — https://www.lisc.org/our-initiatives/small-business/our-work/workday-foundation-solopreneurship-accelerator-program/

    Anthropic has joined Workday and the Local Initiatives Support Corporation (LISC) to launch the Solopreneurship Accelerator Program… an initial cohort of 15 aspiring solo business owners with $10,000 grants, Claude credits, and an AI-first curriculum

    ↩