Tech news, 3 November 2026: Anthropic's compute commitments, ADNOC's AI agents, and exploited Ivanti and Drupal Commerce flaws

1. Anthropic's amended S-1 shows the scale of AI compute commitments

Anthropic filed an amended IPO registration on 2 November adding third-quarter results, with revenue of about $17 billion for the quarter, and disclosed about $895.4 billion of purchase commitments and lease agreements¹. Coverage reports nine-month revenue of $33.2 billion and says substantially all of the commitments relate to compute and infrastructure².

CTO take: the model providers you build on are making very long, very large bets on compute. That is good for capacity, but it also means pricing, contracts and capacity allocation will be shaped by their need to fill those commitments. Keep your stack portable across providers and know your cost per task; see planning around the AI capacity crunch and model routing.

2. ADNOC signs up to run AI agents with OpenAI and G42

ADNOC announced a multi-year agreement with OpenAI and G42 on 2 November to build and run AI agents on OpenAI's Frontier platform across its operations, including forecasting crude supply, demand, prices and margins³. The systems will run on G42's UAE-based infrastructure, with human experts keeping oversight of consequential decisions; financial terms were not disclosed⁴.

CTO take: agent platforms are moving from pilots into core operations at large industrial firms, with in-country hosting and human sign-off built into the deal. If you sell into Gulf enterprises, expect buyers to ask for exactly that combination. See when agents become the user and the UAE page.

3. CISA adds two more Ivanti Connect Secure flaws to its exploited list

CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalogue on 30 October, with federal patch deadlines in early and mid-November⁵. The Hacker News reports attackers chaining Connect Secure flaws to gain unauthenticated root access⁶.

CTO take: VPN gateways remain the front door attackers try first. Patch now, check for signs of compromise rather than assuming the patch is enough, and keep the management interface off the internet. The pattern is covered in hardening a utility's management plane.

4. A highly critical Drupal Commerce flaw is being exploited

Drupal says an access bypass in the Commerce Core module, CVE-2026-118539, is being actively exploited, and asks store owners to update and audit their orders for inconsistencies⁷⁸. Commerce Core is a contributed module, not Drupal core itself.

CTO take: if you run Drupal Commerce, update to the fixed release named in Drupal's advisory today and review recent orders and payments. For older stores, this is a good moment to inventory which contributed modules handle money and who maintains them.

What I'd do this week

• Patch Ivanti Connect Secure and Drupal Commerce if you run them, then check for compromise.
• Review your AI provider contracts for pricing and capacity terms that could change.
• If you sell into Gulf enterprises, prepare an answer on in-country hosting and human oversight for agents.

See where I work, or analyse your challenge and bring the result to a call.