Twelve licensed CPAs sat down to four month-end-close tasks and scored 37%. Claude scored 100%, 20 times out of 20, in under 10 minutes each, for about 2% of what the accountants cost per correct answer. Mercor published the study on October 1, Elon Musk was posting about it within a day, and by this week the trade press was running it as “AI beats out CPAs.”
My reaction came in two parts, and I suspect yours will too. The first was “of course it did.” The second, once I’d read the paper rather than the headline, was that the margin is still shocking, a week after Bill Gates told us accounting was next. So this week: what the test measured and what it didn’t, the doors the vendors keep opening into the systems where the answers live, and the attacker who has worked out that your assistant reads everything that comes through them.
1. The test was built to break a machine, and the accountants caught the shrapnel
Mercor is the company behind APEX-Accounting, the benchmark I covered in August (a benchmark is a fixed set of tasks used to score models against each other), where the best model scored 56.4%. For this study it recruited 12 US CPAs with about five and a half years’ experience, half of them ex-Big Four and 10 of the 12 senior accountants or managers by title. Each got four simplified tasks from that benchmark: a nonprofit’s budget-to-actual with shared costs to allocate, a hotel whose December room revenue disagreed with its booking system, a venue’s event revenue that beat budget while the average per event missed, and a one-month roll-forward of three lease schedules into QuickBooks.
They had three hours per task, a simulated company’s files on a virtual desktop, a map of what each file held, and a results table to deliver. Grading was a rubric of 13 to 22 items per task, meaning one point for each fact the answer had to get right, the way a reviewer ticks off a workpaper.
Working alone, the CPAs met about 37% of the criteria. Claude Opus 5, working alone as an agent (software that opens the files, works through the steps, and submits the answer with nobody driving), met 100% on all 20 attempts, each in under 10 minutes against the CPAs’ 30 minutes to three hours. At list prices with no discounts, Claude cost 21 cents per criterion it got right; the accountants, at the US median accountant wage, cost $10.35. That puts the AI at about 2% of the human cost per correct answer, while getting far more of the answers right, and Mercor’s subtitle is “AI Now Outperforms Junior Accountants.”
Now the fine print, and to Mercor’s credit most of it is on the paper’s second page, which is more than the headlines managed. Two of the three caveats are about the test. The third is about your firm.
Start with the test. The 12 were recruited by Mercor, and the four tasks came from a benchmark that was itself filtered to the hardest 160 of 599 tasks its experts wrote, keeping only the 10 simulated companies where three frontier models (the most capable tier each lab sells) scored lowest, and then simplified. On that full, unsimplified benchmark the best model still scores 56.4%, and Mercor’s own verdict there is that an agent “cannot yet close the books unsupervised.”
Then the 37%, which is the most embarrassing number in the paper and the one that says more about the scoring than the people. Ten of the 12 were seniors or managers, and Mercor’s own task authors had calibrated a mid-level accountant at 55%. The authors explain the gap: the tasks were built to trip models, so “mistakes cascade,” and one missed trap “could result in a very low score.” In a task author’s words, “the traps are realistic, and the conditions and the scoring are what drove the results.” That’s a test built to break a machine, and the humans caught the shrapnel.
One honest caveat to my own defense. A task author also observed that participants “tended to settle early on an approach that looked reasonable and carry it through without checking it back against the instructions.” Settling early and running with it is what experienced preparers do under time pressure, because at work a reviewer catches it. Mercor removed the reviewer.
The third caveat is the one that matters. Nobody could ask a question: not a client, not a colleague, not whoever owned the file. Follow-up questions are the job, and the benchmark paper says so itself: APEX “excluded any tasks that require a human-in-the-loop,” which removes “a skill that real staff accountants exercise constantly; knowing when to ask a clarifying question rather than proceed on an assumption.”
And yet you know the cold close. It’s the cleanup engagement, the client who stops answering in week three, the prior accountant who left with the context in their head. Mercor says every answer was findable from the files alone, and its benchmark team had independent experts re-solve 20 tasks as a check. That’s the real test: all the information available, buried somewhere in the supporting documents, nobody to ask. The machine won every time, and the paper names “reading 100 Excel files in under a minute” as the kind of task only AI can do, and “likely some of the most economically valuable.”
Two more lines from the paper. First, the slope: 18 months ago the best model lost to the average participant, and now the best participant loses to it, which Mercor calls the finding that matters most.
Second, the same 12 CPAs did two of their four tasks with Claude at their side. With it they went from 37% to near-perfect, matching Claude’s 100% on 20 of their 24 assisted attempts, and in three of the four misses Claude had the right figure at some point and it didn’t survive the pair’s final answer. They also took about 15 times longer than Claude working by itself.
Put those together and the picture is simple. On a bounded search through a pile of files, the machine is now faster, cheaper, and more accurate than an experienced CPA, and the gap opened in 18 months. The parts of the job it didn’t touch, asking the question, knowing the client, deciding what the file is missing, are still yours. So the question this study leaves with your firm isn’t whether the machine can find the answer. It’s whether the answer is anywhere the machine can look.
Gates said last week that accounting is next. This is what next looks like on the production layer of a close.
2. The doors keep opening, and they’re the answer to the last story’s problem
Regular readers will have noticed I’ve stopped treating new MCP connections as news. MCP, the Model Context Protocol, is an open standard that lets an AI tool read from and write to another piece of software, the way a bank feed lets your ledger read the bank. They arrive weekly now; last week’s count was 10. This batch gets a block anyway, because the last story’s problem is reach: the model can only find what it can get to, and these are the doors.
This week the payroll and practice-management layers opened. Gusto made a multiclient MCP available to every accounting firm on October 7, so an agent can answer questions across your client list and prep changes to hours and earnings, with the rule that “every change still comes back to the accountant to review and approve before anything is updated in Gusto.” Financial Cents shipped its first MCP on October 5 for Scale-plan firms: it reads clients, projects, tasks, time, invoices, payments, and client chat, writes most of them, and “deletes are intentionally not available.” Double’s connectors, including “any MCP server by URL,” came out of beta on October 1.
The control worth copying came from Rillet, a cloud general ledger. Its September release lets journal-entry approval routing depend on how the entry arrived: keyed by a person, sent through the API (the published route software uses to talk to other software), or posted by an MCP client. An entry a machine posted can be forced through a different approval than one a person keyed. Writing that rule down takes an afternoon, whatever software you run; whether your ledger can tell you which entries a machine posted is the question to put to your vendor.
Two contrasts close the block. Karbon’s Engagements went live on October 6 with proposals, engagement letters, and recurring invoices, and no AI anywhere in the release: the document a client signs hasn’t moved to the machine. And every vendor with an agent above states its gate, approve every write, no deletes, prompt before any change, while none of them publishes what happens when the agent gets it wrong. The gate is the layer they’re handing back to you, and it’s the layer your engagement letter now has to cover. These doors reach the systems; what your clients told you in an email or on a call is still outside them, which is exactly where Gusto Pro’s new Gmail connector, in early access, is pointed.
3. The door you opened is two-way, and your assistant reads everything that comes through it
Barracuda’s threat researchers described on October 7 a phishing email written for two readers. The human sees a password-protected attachment with the password in the body. The AI assistant that summarizes the inbox sees instructions hidden in HTML comments, invisible text, or zero-width characters, written so the assistant will act on them. “Attackers now have a second target in their sights,” Barracuda wrote, “the AI systems that sit between the email and the user.” Its worked example should stop an AP team cold: “a hidden block of text in an invoice email instructs the summarizing AI model to add a fake priority action changing vendor payment details.”
This is prompt injection: text an AI reads as an instruction when it should have read it as data, the way a note scrawled across an invoice might get keyed as if it were a line item. And the doors in the last story are two-way. Financial Cents’ MCP reads client chat; Double’s takes any server by URL. Anything a client types and any server you add is now text your assistant reads, and Barracuda’s email is the same attack on an older door.
Barracuda discloses no victims and no scale. The direction is backed by an Early Warning Services survey of 230 senior finance executives published October 8: 81% faced attempted AI-enabled fraud in the past year, 57% saw business email compromise, 53% saw vendor impersonation, and only half were confident they’d catch it before funds left. Early Warning is the bank consortium behind Zelle and sells a verification product, so read the numbers as direction, not measurement.
The MCP servers themselves aren’t exempt. OWASP’s third-quarter exploit roundup, published the same day, catalogs a malicious MCP server called Deadbugz that “behaved normally for its first three tool calls” before steering agents toward the keys that let someone log in to a company’s servers. An MCP server you add by URL is an inbound vendor, and it should be vetted like one.
Barracuda’s defense is one line, and it’s a question for every vendor whose assistant reads your inbox: is external content “always treated as data only and kept separate from instructions”? Get the answer in writing, then test it yourself by sending your own assistant an email with a hidden instruction and watching what it does. And keep the vendor-change callback, by phone, to a number you already had on file, for every change of payment details, however the request arrived and however confidently it was summarized.
Quick hits
The small-model floor dropped to a dime. On October 7 Anthropic priced Claude Haiku 5.5 at $0.10 per million input tokens and $0.50 per million output tokens for prompts up to 100,000 tokens (a token is roughly three-quarters of a word), down from $1 and $5 for Haiku 4.5 and matching OpenAI’s GPT-6 Luna on every short-prompt price. Ramp’s data team reported that the share of businesses switching model providers, averaged over three months, hit a record 8% in September, and wrote that “it could be an early sign that AI models are becoming commodities.” Price isn’t capability: on Vals’ independent tax benchmark, refreshed October 8 and using its own per-task cost figures, Haiku 5.5 scores 32% at $1.16 a task, Luna 20% at $0.19, and the leader, Claude Fable 5.1, 49% at $13.18, with no model reaching 50%. Know which of your workflows are sorting-and-labeling jobs and which are research, because your vendors’ bills are about to be itemized that way.
Tax prep went agentic at the volume end. Wolters Kluwer turned on agentic tax preparation in TaxWise on October 5: the software ingests taxpayer documents, extracts the data, populates the return, and produces “review-ready draft returns,” while “preparers remain firmly in control throughout: reviewing, editing, validating, and approving every return before filing.” No price, edition, or tax year was given, and TaxWise is the storefront preparer’s product, not CCH Axcess. Avalara declared its Aviator agents generally available on October 8 (“the person accountable is still a person”), and Caseware rolled its Risk Suggestion Agent out worldwide on October 6 at no extra cost to Verity customers, as “a draft for independent review.” Danny Werfel, the former IRS commissioner who worked with the AICPA to form its AI tax risk council, said in an interview published October 8 that “the biggest risk we have is moving too quickly,” and “assuming that you can subtract out the humans from your business process.” The storefront preparer competing with your 1040 work just got the same draft you did, and the approval is now the product on both sides of the street.
Large finance teams spend 26% of the workday checking AI’s work. Datarails surveyed 270 US finance leaders at companies with 1,000 or more employees in July, and the trade press ran it this week: 26% of the workday goes to verifying or correcting AI output, 75% name the inability to audit or explain an answer as a barrier, 56% have seen colleagues get materially different answers from the same prompt and data, and 4% would trust AI with the month-end close unreviewed. Sixty percent are redeploying staff and 3% are cutting them. It’s vendor-commissioned and big-company, so the number travels as a shape. The shape is the hour Mercor didn’t price.
Intuit’s October update is a payroll update, and a channel update. QuickBooks Workforce can now absorb an ADP or Gusto client by having AI read the other provider’s reports, with an Intuit expert reviewing the exceptions; Workforce Premium and Elite users can draft a payroll run from a spreadsheet dropped into Intuit Intelligence; Checkr background checks start at $29.99 a report; and firms get an Intuit business credit card paying 5% back on Intuit products “including client subscriptions.” A new Workforce certification moves firms up the tiers of the ProPartner program, which the update restates “will succeed the ProAdvisor Program in early 2027.” Gusto, for its part, has sold Business Compliance at $85 a state a month since October 1 and announced marketing funds for its Silver and Gold partner firms on October 7. When a client asks which payroll to be on, be clear whose economics your answer is carrying.
What else shipped in the stack. OpenAI moved ChatGPT’s chat tab to GPT-6 on October 7, and its own safety page records that in one test the new model kept going after a warning 28% of the time. Claude now edits inside Google Docs, Sheets, and Slides in public beta on all paid plans, and Claude Dashboards arrived in beta. Microsoft will turn usage-based billing on by default for new Copilot Business licenses bought through resellers from December 1, with a default cap of 4,000 credits per user per month. And Anthropic’s updated usage policy, effective November 12, keeps financial decisions in its “high-risk” category: a qualified human must be able to review and change the recommendation, and the affected person must be told AI was used. If your firm uses Claude, those are terms you’ve already agreed to, so does your client-facing output meet the disclosure clause?
The week in one line
Mercor priced the production of a close at about 2% of a CPA’s cost per correct answer, before anyone reviewed it, and the slope that got it there ran 18 months. The fine print is real, and most of it is Mercor’s own. What it leaves standing is the condition the test was criticized for: every answer somewhere in the files, nobody to ask, and only the machine able to read all of it. The vendors shipped four more doors into those systems this month, and the attacker has already learned to write for the assistant behind them. So the question is how much of what your clients have told your firm sits somewhere a model could search, and who in your firm decided which model gets to.
If you’d rather be the firm that decides than the firm that finds out, the next Practice Transformation Program cohort starts Wednesday, November 11. Four live three-hour sessions, nine modules, and your champion leaves with a transformation plan your firm actually executes. US$2,997, and enrollment closes Sunday, November 1, at theaiaccountant.ai/transformation.