Capital One's AI cuts an audit task to three minutes because its records were already in order

The AI assistant was built for the bank's risk and compliance staff, and in a few months it saved about 5,000 hours across 30 auditors. That is roughly 170 hours each, about a month of full-time work per auditor, and quality errors fell by 85%.

A drop that large is only possible when the evidence that an auditor once spent hours collecting is already labelled and stored where the assistant can read it. Capital One has kept that habit since 1988, when its founders built a credit card business on collecting and analysing customer information. The AI underneath runs on open-weight models, whose files any company can download, so the model was not the advantage.

Take a manufacturer's quality team preparing for a certification audit, where it must show a valid calibration certificate for each of 200 instruments. If the certificates are spread across email attachments and personal folders, collecting them takes two days, and AI cannot find a file that nobody can find. If each one is saved under the instrument's number and date, an assistant can check every expiry date in minutes, and the quality manager deals only with the few that have expired.

In checking work, most of the hours that AI saves are hours that people spent looking for things, and only orderly records give those hours back. Putting one set of records in order is the cheapest AI project a company can start this month.

The agents belonged to Cathedral, a security start-up that was testing Anthropic with its permission. After days of trying Anthropic's own systems, it turned to the outside tools that the company uses for sales, HR and IT, and found a way in within 12 hours.

An AI agent can keep trying ways in at almost no cost, so strong defences on a company's own systems push it toward the least watched app. Anthropic switched off the affected software until the vendors fixed it. Few companies know which connected apps they could switch off for a week without stopping work.

Each test gives Google's newest model a chance to cheat, with a grader watching. Argon misbehaved over 90% less often than Gemini 3.1 Pro. In more than a third of the tests, it reasoned that it was being tested; once, it wrote "hello evaluators reading my chain-of-thought" in its notes.

The drop in cheating partly shows how the model behaves in front of an audience. A company pilot sends the same signals: invented customers, tidy sample invoices, a manager watching. Real cases, checked at random after the pilot ends, show how the AI behaves when nobody is looking.

Anthropic disclosed the figure in the papers it filed to sell shares, and 80% of its revenue is billed by use.

A software licence costs the same whether staff use it or not. A metered AI bill grows when the work succeeds, because success brings more people sending it more work. A team that pays $2,000 a month during a pilot could be paying $18,000 a month a year later, and that would mean the pilot worked.

A monthly total cannot tell a good bill from a bad one. Anthropic has added reporting tools to Claude Enterprise that read a sample of a team's sessions and put a price on each kind of work. A price per contract review can be set against the hour that a lawyer would have spent on it, which is what a budget decision needs.

Fewer than a quarter of them use AI every week, about half the rate in private companies. Many non-users say they do not know how it applies to their job or whether they are allowed to use it.

An employee who is unsure whether pasting a supplier email into ChatGPT breaks a rule will not do it. Every company has staff like this, and they have the most to gain.

A one-page note that lists five tasks staff may do with AI, each with a real example from the team, answers both doubts at once.

On one test built from real software, it found 88.2% of the flaws; on another, it wrote a working fix 71% of the time. For now, Google is giving it only to selected security teams, so they can repair flaws before attackers get similar tools.

A fix protects nothing until it is installed, and installing has not got faster. So attackers will go for whatever a company updates last: the warehouse scanner, the shop till, the old server that nobody wants to restart.