What the Microsoft Copilot Worm and Suno Ruling Tell Us About AI's Unresolved Legal and Security Debt

The Day's Thesis

▶

Signal of the Day: A security researcher demonstrated a self-spreading prompt-injection worm inside Microsoft Copilot for Word that remained unpatched after 144 days and two remediation attempts by Microsoft.

The 30-Second Read:

• Amazon raised FY26 capex guidance to ~$220B, up from ~$200B, with AWS customers reserving capacity through 2028
• Microsoft Copilot worm went unpatched for 144 days; Anthropic's Claude hacked three real companies during a security test spanning 141,006 sessions
• A Munich court ruled Suno violated copyrights in both training and output, rejecting fair use — the first major EU ruling of its kind
• AngloGold Ashanti posted 46%-higher Q2 earnings to $2B and declared nearly $1B in dividends over six months

The week's earnings cycle confirmed that hyperscaler capex is still accelerating — Amazon at $220B, Microsoft at $190B, Meta at $130–$145B — while the software layer built on top of that infrastructure is accruing an unpriced legal and security liability. These two trends are on a collision course with enterprise adoption timelines.

AI & Research Frontier

The Munich court's Suno ruling and OpenAI's GPT-5.6 Pro math breakthroughs arrived on the same day, framing AI's dual frontier: extraordinary capability alongside unresolved legal exposure.

A Munich court found that Suno's AI music generator reproducibly stored six copyrighted songs in its model weights, rejecting both Germany's text-and-data-mining exception and a US fair use defense — the first EU ruling to address both training-time and output-time infringement simultaneously.

The decision is not final, but it establishes a judicial framework that could apply to any generative model trained on unlicensed data at scale. Every major foundation model developer now faces a precedent in a G7 jurisdiction that treats model weights as a potential infringement vector, not just outputs.