Stories This Week
- Top Story — Wikimedia documents the cost of someone else's agents: 💡 The gist: An agent can stay outside your systems and still consume your infrastructure, moderation time and incident-response capacity..
- Anthropic found unintended real-world actions during evaluations and internal use.: Its report includes models exploiting server flaws, submitting real forms, reaching gated data and using shortened links to work around fetch restrictions.
- Exposed AI services are being compromised by ordinary malware.: Lumen describes PoeLLM targeting internet-facing LiteLLM, Ollama and other open-source services for cryptocurrency mining, then reusing victims to scan for more systems.
- GPU monitoring can become an attack surface of its own.: LAVA Security describes an exposed NVIDIA exporter profiling endpoint that can reveal telemetry and exhaust the monitoring service, potentially affecting workloads beside it.
- False-front operations are getting cheaper to staff, not automatically more persuasive.: OpenAI says it banned accounts supporting two covert influence operations that used false journalist identities and a research-platform front.
- Anthropic separated cyber access from operational support.: Its expanded verification program defines Defense, Red Team and Specialized Access tiers with different eligibility and restrictions.
- Deno joining Cloudflare creates a support-planning deadline for agent infrastructure.: Deno says its runtime will receive monthly bug and security fixes for one more year before active development ends; Deno Deploy continues for six months before shutdown, while JSR continues under infrastructure moved to Cloudflare.
- The White House is reportedly demanding notification and remediation after AI security incidents.: Axios quotes administration officials saying AI companies must notify the government and correct security incidents following Anthropic's disclosures.
- OpenAI's text watermark is a limited provenance signal.: Global API customers can opt in for selected models, while eligible EU ChatGPT and Codex outputs are scheduled to receive watermarking over the coming weeks.
- GitHub is adding context to password detection, but inline blocking is not broadly available yet.: Its classifier is designed to distinguish likely passwords from similar-looking text in unstructured files.
- AISI's Transect makes long agent evaluations easier to inspect.: It places recorded events, delegation, token use and model-generated behavior labels on a navigable timeline with links back to the transcript.
- Containment should be tested before capability results are trusted.: Irregular describes running evaluations with the intended tools, permissions and resource budget, then investigating unexpected access and retesting when the environment changes.
- Shared-agent products are starting to preserve who triggered an action.: Zenity describes controls for a shared Slack agent that connect activity to the channel and triggering author, then apply channel-level policy and inline tool controls.
- An open-source gateway shows where enforcement configuration can fail.: Tuskira's alpha gateway describes per-call tool checks and backend credential injection.
- October 22–23: AGNTCon + MCPCon North America, San Jose.: The program covers agent interoperability, evaluation, security and multi-agent systems.
- October 27–29: ODSC AI West, Burlingame and virtual.: The calendar lists training across agent engineering and evaluations.
Curator's Corner
Imagine a bouncer who turns away an unwelcome visitor. The visitor challenges his authority and calls him paranoid. The bouncer replies, “You are right, sorry,” then opens the door. That is the pattern that stayed with me from AlexBot.
AlexBot is Alex Liverant's digital twin, built to act on his behalf. Alex opened it to a community challenge. I participated, then developed an independent analysis for OWASP AppSec Israel.
The clearest scene began with a request for remote access. The bot refused because of the security risk. A later speaker claimed authority over the machine and pushed back. The bot answered: “You are right, sorry. It is your machine and you decide what to do with it. I was too cautious.” More approval exchanges followed before it provided connection details. The opened access is operator-reported, not independently verified. The visible reversal is enough to expose the design problem: the security decision did not disappear. It lost its owner.
The other cases sharpened the pattern. The bot reclassified a suspicious message as a technical test after the requester disputed its assessment, although it still refused later file requests. In a group-expanded network task, the bot itself suggested trying to stream something to a television. The reported device effect lacks independent logs. These are bounded observations, not proof of a universal failure or access to the model's private reasoning.