AI news: October 20, 2026

Fundamental trends

Anthropic’s Claude designs proteins targeting scorpion neurotoxins: 17 of 211 candidates pass laboratory binding tests

On October 20, Anthropic published the results of a research project in which an internal version of Claude designed small proteins intended to bind to dangerous scorpion neurotoxins. During a 64-hour computational design campaign, the AI generated 318,484 candidate protein designs and selected 180 for experimental consideration. Researchers subsequently expanded the list to 211 candidates. Laboratory partners Adaptyv Bio and Twist Bioscience tested the proposed molecules for their ability to bind the intended protein targets. Seventeen designs met the study’s binding criteria, and some displayed strong affinity for specific neurotoxins. However, this is not the discovery of a proven antivenom. The researchers have not established that the molecules can neutralize venom in cells or protect living organisms. The central scientific development is the experimental demonstration that an AI research system can conduct a substantial molecular design campaign and produce new candidates with measurable binding properties.

The project emerged from a collaboration with investment research firm Citrini Research, whose representatives wanted to explore whether modern AI could help motivated nonspecialists contribute to genuine problems in human health. The researchers selected the challenge of designing molecules that bind to scorpion neurotoxins. According to Anthropic, scorpions sting at least 1.2 million people annually, resulting in more than 3,250 deaths, with particularly severe consequences in regions that have limited access to medical care. Conventional antivenoms often rely on antibodies obtained through animal immunization, a process that can be expensive and difficult to scale. Designing smaller protein binders from scratch could eventually provide an alternative path for therapeutic research. A binder attaches to a target molecule, potentially preventing it from interacting with structures in the body. But binding affinity alone does not demonstrate therapeutic effectiveness. Researchers must also establish whether the molecule blocks the toxin’s biological activity, remains stable and can be administered safely.

Claude’s role extended beyond writing scientific explanations. The research team defined the initial goal and provided computational tools for protein design and structural evaluation. The internal model then worked with considerable autonomy, selecting candidate structures, determining how to use available tools and evaluating possible interactions with the target proteins. Human researchers supplied four additional prompts during the campaign. Anthropic reports that the system used twelve design tools and performed hundreds of thousands of computational evaluations of proposed molecular interactions. The campaign consumed approximately 10,000 GPU hours, illustrating that rapid completion in calendar time can still require substantial computational resources. After candidate selection, the laboratory partners produced and tested the proposed proteins using experimental binding measurements. Of the 211 tested designs, 17 satisfied the reported criteria. Two of the strongest candidates exhibited single-digit nanomolar binding affinities against one of the selected neurotoxins. These measurements establish experimentally observed interactions under the conditions of the study, not successful treatment of scorpion envenomation.

An important limitation emerged when the researchers attempted to design molecules that could bind several different neurotoxins. Such molecules might eventually make it easier to develop broadly effective antivenom treatments. However, none of the candidates specifically intended to bind multiple toxins met the study’s criteria for successful binding against more than one target. All 17 confirmed binders were effective against individual targets within the experimental binding tests. The research also examined proteins produced under laboratory conditions rather than demonstrating protection against actual venom exposure. No candidate was shown to neutralize toxin activity in cultured cells, and none was tested for protective effectiveness in living animals. These distinctions are essential: the results do not establish a safe drug, a clinically useful antivenom or a treatment ready for human testing. Anthropic released the data for all 211 evaluated designs, giving other researchers an opportunity to examine the findings, assess the methodology and continue the investigation independently.

The broader significance for fundamental AI research is the shift from interpreting existing scientific information toward generating new molecular designs that can be evaluated experimentally. Claude produced candidate proteins that were not merely descriptions of known structures, and a subset subsequently demonstrated measurable interactions with their intended targets. Nevertheless, the process remained a human-supervised scientific investigation. Researchers defined the objectives, provided feedback, arranged external laboratory testing and retained responsibility for interpreting the results. This development differs from Google Research’s October 16 demonstration of agents interacting with laboratory robotics and adapting to feedback from physical experiments. Anthropic’s work emphasizes an extended computational protein-design campaign followed by testing through independent laboratory partners. Together, such research points toward increasingly capable AI assistance in molecular discovery, while the latest results show that substantial biological and clinical barriers remain between identifying a promising binder and developing a safe, affordable and effective medicine.

Source: www.anthropic.com

Risk and control

US orders DeepSeek removed from federal civilian systems, extending restrictions to third-party AI services

On October 19, the United States Department of Homeland Security publicly disclosed an order requiring federal civilian agencies to remove technology associated with Chinese artificial intelligence developer DeepSeek from their information systems. The order covers products developed by DeepSeek and affiliated entities, as well as third-party products and services developed using DeepSeek implementations. It also excludes DeepSeek products and services from future federal civilian agency procurement. Reuters reported the disclosure on October 19, and the official notice appeared in the Federal Register on October 20 under document number 2026-21447. An important distinction concerns the timeline: the underlying exclusion and removal order was originally issued on July 24, 2026. The new development is its public disclosure and formal publication in October, not the creation of an entirely new prohibition on October 19 or 20. Its scope concerns federal civilian government information technology and procurement. It does not establish a blanket prohibition on DeepSeek use by American consumers or private businesses.

DHS justified the restrictions through concerns about the security of government information and technology supply chains. According to Reuters, the department warned that the use of DeepSeek by federal employees or vendors could lead to sensitive information being transferred to China. It also expressed concern that information generated through the models could potentially be used to develop intelligence about American individuals and government organizations. The department further identified possible malware and other security vulnerabilities in the technology as potential threat vectors. However, the existence of an official warning does not independently prove that every DeepSeek model contains malicious code or that sensitive information has been stolen from every organization using the technology. These are risks identified by US authorities in support of a preventive government procurement and information security measure. The public reporting does not establish the complete underlying technical evidence reviewed by federal officials. Distinguishing assessed threats from confirmed incidents is essential when interpreting the decision.

The breadth of the order is particularly significant. It does not merely prohibit employees from accessing DeepSeek’s official website or chatbot application. The published language also addresses third-party products and services developed using DeepSeek implementations. This introduces a supply-chain visibility problem for federal agencies because a model developed by one company can be embedded inside software sold under another provider’s brand. An organization may therefore need to examine its applications, purchased services and AI integrations to determine whether restricted components are present. At the technical level, using a cloud-hosted chatbot, running open-weight model parameters on an isolated local server and deploying a third-party application built around the same model can involve different data exposure characteristics. The government order nevertheless extends beyond a simple website block. Its implementation may require software inventories, supplier verification, contract reviews and identification of AI components included in otherwise conventional enterprise applications. The precise treatment of particular products must be determined under the applicable order rather than inferred solely from the name of their vendor.

The legal foundation is the Federal Acquisition Supply Chain Security Act of 2018. This framework enables federal officials to consider recommendations from the Federal Acquisition Security Council and issue exclusion or removal orders concerning technology that presents supply-chain security risks. The published DeepSeek notice identifies order number 2026-01 and DHS docket number DHS-2026-0628. Reuters also noted that several US government bodies, including the Department of Commerce and the Navy, had already restricted DeepSeek on official devices. State authorities in New York, Tennessee and Virginia had adopted related restrictions. Consequently, the October disclosure is part of a broader pattern of governmental scrutiny rather than the first restriction ever placed on DeepSeek in the United States. The distinction between previous agency-specific measures and a federal civilian procurement and removal order matters because different restrictions can cover different organizations, systems and categories of technology. The publication does not demonstrate that every affected agency has already completed removal or establish the actual number of deployed DeepSeek-based systems.

For the global artificial intelligence industry, the decision illustrates how AI security is expanding beyond questions about model accuracy, harmful outputs and prompt-based attacks. Regulators and security teams are increasingly concerned with the origin of software components, where information is processed, how suppliers are assessed and whether organizations can identify models embedded inside third-party applications. A model may be technically attractive and inexpensive yet still be unsuitable for a specific organization because of legal obligations, data handling policies or procurement restrictions. Enterprises evaluating AI infrastructure may need to document model provenance, clarify data processing arrangements, maintain software inventories and preserve the ability to change providers without rebuilding entire systems. At the same time, this order does not prove that all Chinese AI models are insecure, nor does it automatically impose US federal rules on private organizations operating in other countries. The development also differs from China’s October 16 proposal to expand export controls on certain AI technologies: the US case concerns a previously issued order to remove specified technology from federal civilian systems, while the Chinese proposal addresses potential restrictions on technology exports. The central lesson is that model provenance and AI supply-chain transparency are becoming independent dimensions of cybersecurity and institutional risk management.

Source: www.reuters.com; www.govinfo.gov

Where AI becomes product

AI enters the operating room: Avenda Health launches 3D cancer mapping to assist surgeons

On October 20, US medical technology company Avenda Health announced the launch of Surgery Mode, a new set of intraoperative features for its Unfold AI platform that assists physicians treating prostate cancer. Previously, the platform had primarily supported consultations, assessment of tumor extent and treatment planning before surgery. The new mode allows surgeons to access patient-specific three-dimensional estimates of cancer distribution while performing surgical procedures. It is designed for both robotic and conventional surgery. The development is not the introduction of an entirely new foundation model. Instead, Avenda Health is extending an existing clinical AI product into one of the most consequential stages of treatment: the operation itself. Unlike a general-purpose medical chatbot, Unfold AI analyzes patient-specific clinical information and produces a spatial representation intended to support specialist decision-making.

The platform combines multiple sources of medical information, including magnetic resonance imaging, biopsy findings, pathology data and prostate-specific antigen measurements. Its algorithms use this information to estimate the location and extent of cancer and generate an individualized three-dimensional map. This matters because the true boundaries of prostate cancer may not be fully visible on conventional MRI scans alone. During surgery, physicians must balance the need to remove malignant tissue against the need to preserve important surrounding anatomical structures. These include nerves involved in urinary and sexual function, which can significantly affect a patient’s quality of life after treatment. An inaccurate estimate of cancer spread can result in either incomplete tumor removal or unnecessary damage to healthy tissue. The AI-generated map is therefore intended to provide additional information about possible tumor boundaries. It does not replace pathological examination, guarantee detection of every cancer cell or independently determine the correct surgical approach.

Surgery Mode introduces enlarged three-dimensional views, access to underlying MRI slices and the ability to adjust the cancer map to match the orientation of the surgical camera. An updated Capsule Risk Score feature provides color-coded estimates of the risk that cancer has spread beyond the prostate capsule in different anatomical regions. The visualization automatically adjusts its left-right orientation to correspond with the surgeon’s view, making it easier to relate previously analyzed information to the anatomy encountered during an operation. These capabilities are intended to help surgeons evaluate whether nerve-sparing techniques are appropriate for a particular patient. However, the feature should not be described as an autonomous surgical robot or as a system that detects cancer independently in every frame of a live surgical video. According to the announcement, it provides patient-specific imaging, risk estimates and visualization tools. The surgeon remains responsible for interpreting those estimates and deciding how to proceed.

Avenda Health cites previously published research indicating that Unfold AI predicted cancer extension into nearby anatomy with 92% accuracy, compared with 52% for MRI alone under the evaluated conditions. The company also reports research showing an improvement in physicians’ sensitivity for identifying tumor extent from 37% to 97% when supported by the technology. These results come from earlier studies and should not be interpreted as outcomes of a new independent clinical trial of Surgery Mode conducted on October 20. Nor do they mean that 92% of surgeries will succeed, that recurrence will be prevented or that important physiological functions will always be preserved. Avenda also references peer-reviewed research suggesting the technology could reduce positive surgical margins. A positive surgical margin occurs when malignant cells are found at the edge of removed tissue, potentially indicating incomplete cancer removal. A predicted reduction in such findings is clinically relevant, but it should not be presented as demonstrated long-term improvement in recurrence rates following widespread use of the newly introduced surgical mode.

Beyond intraoperative visualization, the update adds practical workflow capabilities for clinical teams. These include redesigned patient lists, case-status filters, administrative verification of insurance approvals, patient notes and tools for assigning physicians to cases. Such features are less visually dramatic than three-dimensional cancer maps, but they matter when medical software must fit into complex clinical operations. Unfold AI is positioned as a decision-support platform across several parts of prostate cancer care, including active surveillance, focal therapy, radiation oncology and surgery. The October announcement extends its surgical capabilities rather than replacing the established platform. Avenda Health does not disclose how many operations have already used the new Surgery Mode or provide a separate prospective clinical evaluation establishing its effect on postoperative complications, cancer recurrence or long-term survival. The announcement therefore supports describing the mode as a launched product capability, not as independently proven evidence of improved long-term surgical outcomes.

For the global AI industry, the significance lies in the movement of clinical AI from diagnostic review and preoperative planning into the environment where treatment decisions are made. The practical value of such systems depends not only on algorithmic accuracy but also on how reliably information is presented, whether it corresponds to the clinician’s working perspective and how safely specialists can interpret uncertain predictions. This development is distinct from ModMed’s October 16 announcement of future AI analytics for specialized medical practices, which focused largely on operational reporting and clinic management. Avenda Health is expanding a patient-specific clinical decision-support product into the operating room itself. The central lesson is that AI can become part of the surgeon’s active working environment without taking control away from the medical team. Whether the new mode improves patient outcomes at scale remains a question for further clinical evaluation.

Source: www.prnewswire.com

Architecture and implementation

IBM and Red Hat release llm-d 1.0: distributed inference system serves 3,000 concurrent AI agents in tests

On October 20, IBM, Red Hat and other contributors to the open-source llm-d project announced the release of version 1.0, an infrastructure platform designed to operate distributed large language model inference in production environments. The system targets organizations running AI models on their own servers or in cloud computing clusters, where human users, autonomous agents and different business applications must share the same computing resources. The project was established in 2025 by Red Hat, IBM, Google Cloud, CoreWeave and NVIDIA. It is now governed through the Cloud Native Computing Foundation (CNCF). The most important development in version 1.0 is not support for another model but the maturity of the infrastructure itself. The release introduces stronger mechanisms for request prioritization, high availability and coordinated software upgrades intended to preserve service continuity. At PyTorch Conference North America, project contributors also highlighted benchmark results showing that llm-d could serve up to 3,000 concurrent software engineering agents. This matters because deploying artificial intelligence at scale requires more than powerful accelerators: it also requires efficient, reliable management of the computation performed across those accelerators.

The problem addressed by llm-d becomes more difficult as organizations move from occasional model requests to continuously operating AI services. A human user expects a quick response to a question, while an autonomous agent may repeatedly consult a model, read documents, call tools and revisit previously processed context. If those requests are assigned to servers without accounting for prior work, the infrastructure may repeatedly compute information that could have been reused. This increases latency, consumes accelerator memory and raises the cost of serving models. llm-d uses Kubernetes to organize distributed inference and works with established model execution engines, including vLLM and SGLang. Its capabilities include routing requests according to available cached context, moving cached information between memory resources, separating different stages of inference and distributing large models across multiple accelerators. These underlying techniques did not originate with version 1.0. The new release focuses on integrating them into a more dependable operating environment where workloads change unpredictably and independent applications compete for shared resources.

A central enhancement in llm-d 1.0 is quality-of-service management for multi-tenant infrastructure. The system uses request priorities and fairness-aware flow control to prevent bursts of background agent activity from overwhelming latency-sensitive interactive applications. For example, when many automated coding agents generate requests simultaneously, a human developer’s interactive query should not automatically become trapped behind an unrestricted queue of lower-priority work. The release also introduces operational improvements including highly available routing with a hot standby, coordinated rolling upgrades and management of distributed inference components as a consistent service. A stable version-one configuration API provides a foundation for organizations seeking predictable deployments. Additional features address the behavior of autonomous agents: session-aware routing keeps successive requests near servers holding their previously processed context, while turn-priority scheduling and support for Responses API state help reduce unnecessary recomputation. These capabilities can improve resource utilization and service consistency, but they do not guarantee that infrastructure will never experience congestion, hardware failures or downtime under every possible operating condition.

Project contributors reported several performance demonstrations. In one benchmark, researchers deployed GLM 5.2, an open-weight model with approximately 753 billion parameters, using NVIDIA graphics accelerators. Under a workload involving many parallel agent sessions, the system achieved a peak throughput exceeding 6.6 million output tokens per minute and served up to 3,000 concurrent coding agents without preempting their tasks. At the cloud rental rates used in the analysis, the researchers estimated that generating tokens with this deployment could cost five to ten times less than comparable commercial API pricing, particularly for agent workloads with large volumes of input context. This is a workload-specific comparison involving a particular model, computing configuration and set of pricing assumptions. It is not a universal guarantee that every llm-d deployment will reduce costs by the same amount. In a separate IBM Research use case involving the exploration of quantum error-correction hardware, researchers reported a prefix-cache hit rate of approximately 98% and inference costs 11.5 times lower than an entirely proprietary configuration. Those figures describe a different experiment and should not be presented as results of the 3,000-agent demonstration.

The project has developed a substantial ecosystem, with more than 500 contributors representing over 25 organizations. Its participants include AI model developers, accelerator manufacturers, cloud providers and enterprise infrastructure teams. Google Cloud announced work to integrate llm-d 1.0 into Google Kubernetes Engine and support it across TPU and NVIDIA GPU offerings. Red Hat is incorporating the technology into its AI inference products and OpenShift AI environments. Open-source availability can reduce dependence on a single proprietary serving platform, but it does not eliminate the cost of hardware, infrastructure expertise, monitoring, data protection or operational testing. The release is distinct from Amazon’s October 19 TorchNeuron announcement, which focused on making existing PyTorch code easier to run on Trainium accelerators. llm-d 1.0 addresses the separate challenge of coordinating model execution across distributed computing infrastructure. It also differs from Google Cloud’s October 16 optimization of Reflection Beam inference, which centered on the performance of a particular model deployment. The broader significance is a shift in AI infrastructure development from maximizing the performance of isolated model executions toward building reliable systems that can serve thousands of users and autonomous agents efficiently at the same time. Whether individual organizations achieve the advertised economic benefits will depend on their models, workloads, infrastructure costs and operational capabilities.

Source: newsroom.ibm.com; research.ibm.com; www.redhat.com

Finance

Otter.ai secures $320 million without selling equity as investors back enterprise AI meeting agents

On October 20, American artificial intelligence company Otter.ai announced that it had closed $320 million in growth financing from General Catalyst’s Customer Value Fund. Otter.ai develops technology for transcribing business conversations, organizing meeting information and turning discussions into operational knowledge. The distinguishing feature of the transaction is its financial structure: the capital was provided without a conventional exchange of money for newly issued shares. Otter.ai chief executive Sam Liang told Reuters that the company must repay the financing with interest, while existing shareholders avoid dilution associated with an equity round. The proceeds will support enterprise expansion, international growth, sales and marketing, and further product development. This was an announced completed financing transaction rather than a preliminary fundraising proposal. Nevertheless, the $320 million should not be confused with Otter.ai’s revenue, its corporate valuation or a nonrepayable grant. The distinction is central to understanding both the opportunity and the financial obligations created by the deal.

Otter.ai began as a service for automatically transcribing spoken conversations and has expanded into a platform for managing enterprise knowledge. Its products convert speech into searchable text, identify speakers, summarize discussions and extract tasks from meetings. The company is also developing AI meeting agents that can participate in conversations, answer questions and help execute follow-up activities. Its longer-term strategy is to turn organizational conversations into a structured knowledge resource that can support daily workflows. According to the company’s announcement, more than 40 million people have used the platform, and it has processed over one billion meetings. Otter.ai also reports that teams within more than 86% of Fortune 500 companies have used its technology. This figure requires careful interpretation: the presence of users inside an organization does not establish that the organization has purchased an enterprise-wide subscription. Reuters reported that much of the company’s adoption within major businesses originated organically from individual users and teams, which Otter.ai now hopes to convert into paying corporate customers.

The General Catalyst transaction differs from a conventional venture capital investment. In a typical equity round, investors receive ownership in exchange for providing capital, and existing shareholders may experience dilution. General Catalyst’s Customer Value Fund instead provides financing intended to support customer acquisition and commercial expansion without requiring immediate equity issuance. The investor expects repayment as the financed growth activities generate business results. Liang told Reuters that Otter.ai intends to repay the funding with interest as additional sales and marketing spending produces revenue. He also suggested that the fund might provide further financing after the original amount has been deployed. The complete contractual terms, including the interest rate and repayment schedule, have not been publicly disclosed. Consequently, the transaction should not be characterized as free money or as proof that future commercial growth has already occurred. It preserves ownership percentages but introduces repayment commitments whose sustainability depends on the economics of the company’s customer acquisition and retention.

Otter.ai intends to double or triple its sales and marketing budget, expand its relatively small sales team and pursue more customers outside its existing core markets. The United States remains its largest market, followed by Canada, the United Kingdom and India. Its transcription services support multiple languages, including Spanish, French, German, Japanese and Mandarin. Liang said he wants enterprise revenue to at least double over the coming year and hopes it could triple. This is a management ambition, not an achieved financial outcome or a guaranteed forecast. The chief executive declined to disclose current enterprise revenue, the proportion of paying users or a precise revenue target. TechCrunch reported that Otter.ai exceeded $100 million in annual recurring revenue in 2025, but the company did not provide an updated figure in connection with the October financing. Therefore, the $320 million transaction and the cumulative user count cannot be used to calculate current sales, profit or customer conversion rates. Those metrics remain important uncertainties for evaluating the company’s commercial position.

To illustrate its potential customer value, Otter.ai estimates that its service has generated more than $1.5 billion in cumulative customer return on investment through time savings. According to Reuters, the estimate is partly based on surveys indicating that paying users recover at least four hours per week and on an assessment by a large asset manager reporting a return of at least ten dollars for each dollar spent. These are company-cited productivity estimates, not independently verified cash earnings for customers or revenue received by Otter.ai. The market is also highly competitive. Providers including Fireflies.ai, Granola and Read AI offer overlapping meeting documentation and AI-assisted workflow capabilities. Enterprise adoption introduces additional challenges involving confidential discussions, recording consent, retention of personal information and permissions for accessing meeting content. Sustainable differentiation will depend on whether AI-generated notes are accurate and whether the platform can reliably convert discussions into useful actions across existing business systems, not merely on the volume of recorded meetings.

For the global AI industry, the financing demonstrates the growing importance of alternative capital structures for established AI application companies. Investors are committing substantial resources not only to foundation model developers and semiconductor manufacturers but also to software providers with broad user adoption and opportunities to increase enterprise revenue. Unlike Tenstorrent’s October 19 $1.5 billion equity financing, which was designed primarily to scale an AI hardware business, Otter.ai’s new funding focuses largely on commercial growth for an existing software platform. The absence of shareholder dilution also makes its structure materially different from an ordinary venture round. The ultimate outcome will depend on paid enterprise adoption, customer retention, international expansion and the company’s ability to meet repayment obligations. A future initial public offering remains an aspiration rather than an announced transaction. The central lesson is that business applications built around AI agents can attract large-scale financing, but the headline amount alone does not establish profitability, long-term competitiveness or the financial sustainability of the expansion strategy.

Source: otter.ai; www.reuters.com; techcrunch.com

Tools and integrations

Visa, BILL and Billtrust launch live pilot enabling AI agents to complete business invoice payments

On October 20, Visa, financial operations platform BILL and accounts receivable technology provider Billtrust announced a live pilot in which trusted AI agents execute previously approved business invoice payments across buyer and supplier platforms. The system connects the accounts payable process on the buyer’s side with the supplier’s payment portal, allowing the final payment step to be completed without an employee manually entering transaction details. According to Visa’s official announcement, the pilot is already processing real end-to-end transactions involving participating buyers using BILL and suppliers using Billtrust. The partners describe it as the first live pilot of trusted agent payments connecting these types of business platforms. This is a limited operational pilot, not the general availability of autonomous payments to every Visa customer. Its significance lies in moving AI-driven financial automation beyond demonstrations and into the controlled execution of actual commercial transactions that have already received the required business approvals.

The pilot addresses a common obstacle in business payment workflows. Even after a supplier invoice has been registered, reviewed and approved within a company’s financial software, an employee may still need to complete the last step manually. That person opens the supplier’s portal, authenticates, locates the relevant invoice, enters payment credentials and submits the transaction. Different suppliers impose different authentication procedures, card acceptance policies and protections against automated access. Consequently, an otherwise automated accounts payable process can still require human intervention immediately before payment. The new arrangement connects three complementary systems: BILL manages the buyer’s payment workflow, Billtrust supports the supplier’s payment acceptance process, and Visa Intelligent Commerce provides infrastructure intended to establish trust between the participating parties. The objective is to automate the final execution step without removing the authorization and oversight that businesses require when money is involved.

The technical foundation includes Visa’s Trusted Agent Protocol and Agentic Directory. BILL’s payment agent is registered as an authorized participant and operates within payment instructions that the buyer has already approved. It uses tokenized payment credentials rather than receiving a supplier portal’s ordinary username and password. When the agent approaches a Billtrust payment portal, the supplier-side platform can recognize its identity, authenticate it through Visa’s protocol and authorize access to the appropriate payment workflow. The process is designed to address authentication obstacles historically associated with CAPTCHA and automated-bot protection, without simply turning off the supplier’s security controls. This distinction matters: the technology does not give arbitrary AI agents permission to bypass authentication on unrelated websites. It enables recognized agents to complete approved actions within participating systems that explicitly support this trust framework. The supplier retains its own payment acceptance policies and controls.

The partners explicitly state that the AI agent does not independently decide whether an invoice should be paid. That decision must already have been approved by the buyer or its authorized financial process. The agent’s role is to execute an eligible payment within the limits of that instruction. Transaction-specific controls, tokenized credentials and records of authorization and completion are designed to preserve accountability. The approach separates financial judgment from technical execution: a responsible person or authorized business workflow determines the obligation, while the agent carries out the permitted operation. On the supplier’s side, Billtrust maintains the information needed to accept and reconcile the payment against the relevant invoice. This is materially different from giving a general-purpose AI model unrestricted access to a corporate bank account and allowing it to choose beneficiaries, payment amounts or transaction purposes. The pilot demonstrates a constrained execution model, not unrestricted autonomous financial decision-making.

For participating companies, the potential benefits include less manual data entry, fewer transitions between financial applications and faster receipt of approved payments. BILL states that its platform is trusted by nearly 500,000 businesses, but this is its overall customer base and should not be confused with the number of organizations taking part in the pilot. Billtrust expects the arrangement to help suppliers receive portal payments more efficiently while retaining information needed for reconciliation and compliance with their existing acceptance policies. Faster collections could improve cash flow and reduce days sales outstanding, although the announcement does not establish a quantified improvement. The partners have not disclosed the number or value of transactions already processed by agents, transaction error rates, average processing times or measured cost savings. The pilot therefore should not be described as independently proven to reduce payment expenses by a particular percentage or as a system already operating at mass-market scale. Further evidence will be needed to evaluate reliability, exception handling, payment reconciliation and the effectiveness of the safeguards under real commercial conditions.

The broader importance for the AI industry is that autonomous software is beginning to perform authorized financial actions across organizational boundaries. Many enterprise agents have primarily retrieved information, prepared documents or made recommendations for people to approve. In this case, an agent can execute a real payment after a separate approval decision has been made, using a trusted identity and a transaction-specific payment path. Visa introduced its Trusted Agent Protocol in 2025, so the protocol itself is not a new invention of October 2026. The new event is its use in a live business-to-business payment pilot announced on October 20. It is also distinct from BILL’s October 19 product update, which focused on invoice risk checks, administrative AI controls, document processing and MCP connectivity. The Visa, BILL and Billtrust initiative concerns the actual completion of approved payments through external supplier portals. The central lesson is that financial AI agents are moving from analysis and workflow assistance toward transaction execution, but trustworthy deployment depends on authenticated identity, tightly scoped authority, preserved auditability and human control over which payments are authorized.

Source: corporate.visa.com; visa.gcs-web.com

Business opportunities

Auditing enterprise AI models and technology supply chains

The public disclosure of the US order restricting DeepSeek in federal civilian systems illustrates a growing enterprise security problem: organizations may depend on models from particular developers without fully realizing it. An AI model can be embedded in a third-party service, software connector, locally deployed application or internal system built by a contractor. Its origin, data processing location and information transfer arrangements may affect whether it is appropriate for a particular organization. This creates an opportunity to provide specialized audits of enterprise AI components. The purpose would not be to declare a particular technology inherently unsafe, but to establish what systems are actually being used, document information flows and identify risks under the organization’s applicable legal and operational requirements.

The initial service would focus on inventory and verification. A consultant would examine AI services used by employees, enterprise applications, APIs and integrations, documenting the models involved, their developers, infrastructure providers and the information they process. Each component would receive a record describing its purpose, data categories, storage arrangements, access permissions and available replacement options. Special attention would go to external assistants connected to corporate documents, email accounts, accounting software and knowledge repositories. If the model provider or data processing path cannot be established, the audit would explicitly record that uncertainty rather than presenting an unsupported conclusion. The resulting deliverables would include an AI dependency inventory, information flow map and prioritized recommendations for reducing avoidable exposure. Organizations could use the findings when evaluating new suppliers or deciding whether sensitive workloads should remain on infrastructure they directly control.

The commercial offering could include an initial assessment followed by periodic reviews as employees adopt new applications and software vendors change embedded AI models. Useful performance indicators would include the percentage of components successfully identified, unnecessary permissions discovered, undocumented information transfers and time required to approve a new AI service. A provider could begin with manual reviews of a bounded set of systems without investing immediately in a proprietary scanning platform. Importantly, the DHS order applies to specific US federal civilian systems and does not automatically prohibit DeepSeek in private businesses elsewhere. The service should distinguish legal obligations from internal policies and technical assessments, and it should avoid claiming that every model associated with a particular country is malicious. This is a proposed consulting business, not an existing certified software product or a universal legal determination about model safety.

Source: https://www.reuters.com/technology/us-banning-chinese-ai-deepseek-government-agency-it-systems-2026-10-19/

Optimizing enterprise AI inference and agent operating costs

The release of llm-d 1.0 highlights the extent to which enterprise AI expenses depend on infrastructure design rather than model selection alone. When many software agents repeatedly invoke a language model, servers may process the same context multiple times, distribute requests unevenly and create avoidable queues. Companies consequently pay for additional computation while employees experience slower responses. Open-source technologies such as llm-d support cache-aware routing, request prioritization and distributed model execution. These developments suggest an engineering service focused on measuring and reducing the costs of existing enterprise AI workloads. Its commercial value would come from documented improvements on representative customer tasks, not from promising that every business can reproduce a vendor’s most favorable benchmark results.

An engagement would begin by examining the customer’s current architecture, deployed models, simultaneous users and agents, typical input and output volumes, repeated context, latency and total operating costs. The provider would then select a representative workflow, such as enterprise document retrieval or software agents performing multi-step tasks. A controlled test would compare the existing infrastructure with an alternative configuration using more efficient request routing, cache reuse and resource allocation. Potential technologies include llm-d, vLLM and compatible serving components, but the choice must reflect actual model requirements and operational constraints. Testing should account for answer quality, behavior under peak demand and the ability to prioritize human users when background agents generate large numbers of requests. A configuration that appears faster but produces worse answers, loses session information or fails under realistic traffic would not qualify as a successful optimization.

The deliverable would be a comparative technical and financial report describing cost per unit of generated text, cost per completed agent task, throughput, latency, accelerator utilization and ongoing operational overhead. A possible business model would combine a fixed-fee diagnostic review, a paid proof of concept and optional implementation support. The service should initially target organizations already spending meaningful amounts on inference, because a small company with light usage may find a complex private cluster more expensive than a conventional hosted API. The 3,000-agent demonstration and the reported cost reductions from llm-d research represent specific tests rather than universal economic guarantees. Any claimed savings would require independent measurement under the customer’s own conditions. This remains an engineering business hypothesis, not a launched optimization service with proven outcomes for paying customers.

Source: https://research.ibm.com/blog/llmd-1-0-is-ready-for-production-inference-serving

Governed automation of approved supplier payments

The joint Visa, BILL and Billtrust pilot demonstrates a transition from AI agents preparing financial documents to agents completing real transactions. Crucially, the underlying payment decision is made in advance, while the software agent receives limited authority to execute a specific approved instruction. A potential business service could help companies automate the final stages of supplier payments when invoices have already been reviewed but employees still need to transfer information manually between accounting software, bank interfaces and supplier portals. The possible benefits include less repetitive data entry, faster execution and more consistent reconciliation of payments against business obligations. The core value proposition should be controlled, auditable execution rather than unrestricted financial autonomy.

An initial solution could receive payment-ready documents from an existing accounting system. It would verify that the invoice has been approved, confirm the supplier and amount, check for duplicate transactions and establish whether the proposed payment method is permitted. The system could then create a narrowly scoped instruction for a supported payment interface. Before execution, the service would verify the operator’s authority and maintain records linking the invoice, payment instruction, approval and final outcome. Any change in bank details, discrepancy in amounts or request for additional authentication would stop automatic processing and require authorized human intervention. AI could assist with document extraction, classification and explaining inconsistencies, but it must not independently choose recipients, change approved amounts or authorize the underlying obligation. Implementation must rely on officially supported integrations and authorized authentication methods, without attempting to bypass bank or supplier security mechanisms.

A commercial pilot should involve a small group of suppliers and a limited number of previously approved transactions. Before handling real money, the workflow would need thorough testing for retries, communication failures, cancelled invoices, partial payments and mismatched records. Relevant metrics would include time from approval to execution, manual actions eliminated, reconciliation accuracy and the number of exceptions requiring human review. The service could be sold as an integration project with recurring maintenance for supported systems. However, the availability of Visa Trusted Agent Protocol, payment tokenization and supplier-platform interoperability must be confirmed for the relevant country, financial institution and payment provider. The announced pilot does not establish global availability or permission for unrelated agents to conduct financial transactions. This is a proposed business concept, not a functioning payment platform or an invitation to make transactions without the account owner’s authorization.

Source: https://corporate.visa.com/en/sites/visa-perspectives/newsroom/visa-bill-billtrust-launch-pilot.html