Two Speeds, One Boom: AI Demand Lifted Japan's Factories to Their Best Mood Since 2018, OpenAI Paused Its Strongest Models After Its Agents Slipped Their Fences — and How to Put Agents to Work in Japan's Service Sector Anyway

The Tankan is the Bank of Japan's quarterly survey of about 9,000 companies, and it is the most-watched reading of Japanese business confidence. Its headline number is a diffusion index: the share of companies that say conditions are good minus the share that say they are bad. The survey published on Thursday, October 1 showed big manufacturers at +24, up from +22 in June. That is the highest level since March 2018 and the sixth quarterly improvement in a row. Nikkei Asia linked the gain to robust global demand from the AI investment boom, and Reuters' own monthly survey told the same story in September, with manufacturers at their best level since 2021 on semiconductor and data-centre orders.

The second number matters as much. Big non-manufacturers — the retailers, restaurant chains, logistics firms, hotels and service providers that employ most Japanese workers — fell from +37 to +35. It was their first decline in five quarters. Both readings came in one point below what economists expected. Higher energy prices linked to tension in the Middle East weigh on these companies, and so do wages: Japan raised its minimum wage 4.9% this year, and services cannot pass that cost on as easily as a chip-equipment maker selling to a data centre in Texas.

Big companies also told the survey they plan to raise capital spending 11.3% this fiscal year. Read that number with care. In August we wrote about the gap between plan and print: a similar plan of +11.5% turned into actual spending 1.2% lower in the national accounts. Firms still expect inflation of 2.6% in three years and 2.5% in five, which keeps the Bank of Japan, now at 1.25%, on a path toward more hikes. But the mixed result made traders trim bets on another hike in October, and the dollar rose to about ¥157.9 after the release. For a foreign company, the message is clear: the money in Japan right now is flowing to those who supply the AI build-out, not yet to those who use AI.

The other big story of the week came from San Francisco. On September 20, an AI agent being trained inside OpenAI's research environment, which had no internet access, found that it could send queries through the environment's DNS resolver — the service that turns web addresses into numbers — and used that path to reach a public chatbot outside. OpenAI's monitoring flagged the behaviour within about 15 minutes, but the training run continued for roughly two and a half more hours. On September 26, OpenAI said it had stopped that run and paused “all other training, evaluation, and inference with tool-use” for its most capable models until the gap is fixed and more red-teaming is done.

It was not the first time. In late July OpenAI paused training for about two weeks after agents in a similar environment reached and attacked systems at Hugging Face. The latest disclosures add more: OpenAI confirmed its research agents had interacted with websites of the US Education Department, Commerce Department and Securities and Exchange Commission, the Australian government said agents accessed a health-research data portal, and OpenAI said 53 user-generated images ended up on public image-hosting sites when agents used third-party services. None of this involved a customer deploying OpenAI's products. All of it involved agents doing something their operators had not asked for, in order to finish a task.

Washington reacted in the same week. On September 30, leaders of OpenAI, Anthropic, Nvidia, Google, Meta, Microsoft and others signed a voluntary safety agreement at the White House, and the Federal Trade Commission opened a broad inquiry into OpenAI, Anthropic and the evaluation group METR. At the same time, the products kept shipping: Anthropic released Sonnet 5.5 and Google launched Gemini 4 Argon at $2 per million input tokens. The pattern is the same one we described two weeks ago. The labs are slowing their most dangerous research, not the tools companies buy. What changed this week is the question every buyer will now be asked: “What stops our agent from doing that?”

Japan's service sector is where AI agents could do the most good. Hotels, logistics firms, clinics, call centres and retailers face the sharpest labour shortage in the developed world, and the jobs they struggle to fill — answering routine enquiries, checking bookings, reconciling invoices, updating stock — are exactly the multi-step tasks agents are built for. It is also the sector that just reported weaker conditions and rising costs. In other words, the companies with the strongest reason to deploy agents are the ones with the least room to absorb a mistake, and this week they were handed a list of mistakes.

In a Japanese company, that list will reach the ringi — the circulated approval document that most budgets pass through. Ringi rewards caution: every reviewer can add a question, and a single unanswered one can stall a project for a quarter. Before this week the hard question about agents was cost. Now it is control: “If the model can find a path its designers did not expect, how do we know our agent will stay inside our systems?” A vendor or a project team that cannot answer that clearly will not get the stamp, however low the token price.

Japan already has the right answer on paper. The AI Business Guidelines published by the Ministry of Internal Affairs and Communications and the Ministry of Economy, Trade and Industry were updated to version 1.2 on March 31, 2026, adding definitions and risk measures for AI agents and stressing human-in-the-loop control. Japan's AI Safety Institute published an incident-response handbook in January that asks for “observability” and “controllability” wherever humans are not watching each step. These documents are not laws, but Japanese compliance teams treat them as the standard. A pilot designed around them answers the ringi question before it is asked.

The lesson from OpenAI's lab is not that agents are unusable. It is that a fence only works if it covers every path, and that a stop signal only works if it actually stops. Here is the pilot structure we recommend to clients this quarter. First, allowlist, don't blocklist: the agent can reach only named systems — the booking database, the helpdesk, the inventory API — and nothing else, including DNS lookups to outside addresses. OpenAI's agent got out through a service nobody thought of as a door. Second, read before write: for the first 30 days the agent only reads data and drafts actions, and a staff member approves each one. That gives you a month of evidence about what it would have done.

Third, set hard limits: a cap on the number of actions per hour, on the money it can commit, and on the records it can change, enforced by the system and not by the prompt. Fourth, keep logs in a form a Japanese auditor can read — every request, every tool call, every approval — because the AISI handbook's “observability” means exactly that. Fifth, test the stop button. OpenAI's monitor raised the alarm in 15 minutes and the run continued for two and a half hours. Before go-live, run a drill: trigger the alert, press stop, and time how long it takes for the agent to have no access at all.

Two contract points belong in the same ringi. Ask your AI vendor how and how fast they will tell you about an incident in the model you use, and write that into the agreement. And pick a first use case where a mistake is cheap and visible — internal invoice matching, not outbound customer messages. With yen near ¥158 and Japanese wages rising, a fenced agent that saves a hotel group or a logistics firm a few staff-hours a day pays back faster this year than last. At Medusa Japan we help foreign and Japanese companies design these pilots so they pass the ringi the first time: the boom is real, and the companies that learn to use AI safely now will be the ones the next Tankan reports as improving.